From 0e375233af569acc80ddd55b3e0b4d522eabb04c Mon Sep 17 00:00:00 2001 From: Paul Wise Date: Sun, 3 Sep 2017 20:30:46 +0800 Subject: [PATCH] Disable the usual SSL setup for godard --- modules/ssl/manifests/init.pp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/ssl/manifests/init.pp b/modules/ssl/manifests/init.pp index 636d2b567..756661e06 100644 --- a/modules/ssl/manifests/init.pp +++ b/modules/ssl/manifests/init.pp @@ -156,13 +156,19 @@ class ssl { refreshonly => true, require => Package['openssl'], } + if $::hostname == 'godard' { + $extra_ssl_certs_flags = ' --default' + } else { + $extra_ssl_certs_flags = '' + } + exec { 'refresh_normal_hashes': # NOTE 1: always use update-ca-certificates to manage hashes in # /etc/ssl/certs otherwise /etc/ssl/ca-certificates.crt will # get a hash overriding the hash that would have been generated # for another certificate ... which is problem, comrade # NOTE 2: always ask update-ca-certificates to freshen (-f) the links - command => '/usr/sbin/update-ca-certificates -f', + command => "/usr/sbin/update-ca-certificates --fresh${extra_ssl_certs_flags}", refreshonly => true, require => Package['ca-certificates'], } -- 2.20.1