modules/ssl/manifests/init.pp

   1 class ssl {
   2
   3         package {
   4                 'openssl':
   5                         ensure => installed,
   6                         ;
   7                 'ssl-cert':
   8                         ensure => installed,
   9                         ;
  10         }
  11
  12         file { '/etc/ssl/debian':
  13                 ensure  => directory,
  14                 mode    => '0755',
  15                 purge   => true,
  16                 recurse => true,
  17                 force   => true,
  18                 source  => 'puppet:///files/empty/'
  19         }
  20         file { '/etc/ssl/debian/certs':
  21                 ensure => directory,
  22                 mode   => '0755',
  23         }
  24         file { '/etc/ssl/debian/crls':
  25                 ensure => directory,
  26                 mode   => '0755',
  27         }
  28         file { '/etc/ssl/debian/keys':
  29                 ensure => directory,
  30                 group  => ssl-cert,
  31                 mode   => '0750',
  32                 require => Package['ssl-cert'],
  33         }
  34         file { '/etc/ssl/debian/certs/thishost.crt':
  35                 source => "puppet:///modules/ssl/clientcerts/${::fqdn}.client.crt",
  36                 notify => Exec['c_rehash /etc/ssl/debian/certs'],
  37         }
  38         file { '/etc/ssl/debian/keys/thishost.key':
  39                 source => "puppet:///modules/ssl/clientcerts/${::fqdn}.key",
  40                 mode   => '0440',
  41                 group   => ssl-cert,
  42                 require => Package['ssl-cert'],
  43         }
  44         file { '/etc/ssl/debian/certs/ca.crt':
  45                 source => 'puppet:///modules/ssl/clientcerts/ca.crt',
  46                 notify => Exec['c_rehash /etc/ssl/debian/certs'],
  47         }
  48         file { '/etc/ssl/debian/crls/ca.crl':
  49                 source  => 'puppet:///modules/ssl/clientcerts/ca.crl',
  50         }
  51
  52         file { '/etc/ssl/debian/certs/thishost-server.crt':
  53                 source  => "puppet:///modules/exim/certs/${::fqdn}.crt",
  54                 notify => Exec['c_rehash /etc/ssl/debian/certs'],
  55         }
  56         file { '/etc/ssl/debian/keys/thishost-server.key':
  57                 source  => "puppet:///modules/exim/certs/${::fqdn}.key",
  58                 mode    => '0440',
  59                 group   => ssl-cert,
  60                 require => Package['ssl-cert'],
  61         }
  62
  63         exec { 'c_rehash /etc/ssl/debian/certs':
  64                 refreshonly => true,
  65         }
  66 }