protect the password

Signed-off-by: Stephen Gran <steve@lobefin.net>

diff --git a/modules/roles/manifests/pubsub/client.pp b/modules/roles/manifests/pubsub/client.pp
index 3335ffe..7fe1a88 100644 (file)
--- a/modules/roles/manifests/pubsub/client.pp
+++ b/modules/roles/manifests/pubsub/client.pp
@@ -11,6 +11,7 @@ class roles::pubsub::client {
        $rabbit_password = hkdf('/etc/puppet/secret', "mq-client-${name}")
 
        file { '/etc/dsa/pubsub.conf':
-               content => template('roles/pubsub/pubsub.conf.erb')
+               content => template('roles/pubsub/pubsub.conf.erb'),
+               mode    => '0440'
        }
 }