move passwords to a different file and enable apache certs

Signed-off-by: Martin Zobel-Helas <zobel@debian.org>

diff --git a/.gitignore b/.gitignore
index c29343dffb9e72ad6830c95012dd4f621651c3e7..22c685f5924429b38054991adc0c9d1cda7987ec 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@ modules/hiera-puppet
 modules/puppetmaster/manifests/db.pp
 modules/exim/files/email-virtualdomains/
 modules/roles/manifests/pubsub/params.pp
 modules/puppetmaster/manifests/db.pp
 modules/exim/files/email-virtualdomains/
 modules/roles/manifests/pubsub/params.pp

+modules/roles/manifests/openstack/params.pp

 *.swp
 *~
 /secret
 *.swp
 *~
 /secret

diff --git a/modules/roles/manifests/keystone.pp b/modules/roles/manifests/keystone.pp
index 92642b3491f1394f5cb3352d0bc63cc809875e36..befe945f04f005c410342d344afa479bb8b0ef81 100644 (file)
--- a/modules/roles/manifests/keystone.pp
+++ b/modules/roles/manifests/keystone.pp
@@ -1,32 +1,33 @@
 class roles::keystone {
 
 class roles::keystone {
 

-       $keystone_postgres_password = hkdf('/etc/puppet/secret', "openstack-keystone")
+       include roles::openstack::params

 
 

-       class { 'keystone':
+       $keystone_dbpass = $roles::openstack::params::keystone_dbpass
+       $admin_token     = roles::openstack::params::admin_token
+       $admin_pass      = roles::openstack::params::admin_pass
+
+       class { '::keystone':

                verbose        => true,
                debug          => true,
                sql_connection => 'postgresql://keystone:$keystone_postgres_password@bmdb1.debian.org/keystone',
                catalog_type   => 'sql',
                verbose        => true,
                debug          => true,
                sql_connection => 'postgresql://keystone:$keystone_postgres_password@bmdb1.debian.org/keystone',
                catalog_type   => 'sql',

-               admin_token    => 'admin_token',
+               admin_token    => $admin_token,

                enabled        => false,
        }
        class { 'keystone::roles::admin':
                email    => 'test@puppetlabs.com',
                enabled        => false,
        }
        class { 'keystone::roles::admin':
                email    => 'test@puppetlabs.com',

-               password => 'ChangeMe',
+               password => $admin_pass,

        }
        class { 'keystone::endpoint':
                public_url => "https://${::fqdn}:5000/",
                admin_url  => "https://${::fqdn}:35357/",
        }
 
        }
        class { 'keystone::endpoint':
                public_url => "https://${::fqdn}:5000/",
                admin_url  => "https://${::fqdn}:35357/",
        }
 

-       keystone_config { 'ssl/enable': value => true }
-

        include apache
        class { 'keystone::wsgi::apache':
        include apache
        class { 'keystone::wsgi::apache':

-               ssl => true
-       }
+               ssl      => true,
+               ssl_cert => '/etc/ssl/debian/certs/openstack.bm.debian.org.crt-chained',
+               ssl_key  => '/etc/ssl/private/openstack.bm.debian.org.key',

 
 

-       ssl::service { 'openstack.bm.debian.org':
-               notify => Service['apache2'],

        }
 }
        }
 }