cdn-ops/global/overlay/etc/puppet/modules/cdn/manifests/mqtt.pp

# Configure a SUNET CDN mqtt server
class cdn::mqtt(
  String $dc = '',
  Array[String] $mqtt_client_ips = [],
  Hash[String, Hash] $bridges = {},
  Hash[String, String] $acme_url = {
    test => 'https://internal-sto3-test-ca-1.cdn.sunet.se:9000/acme/acme/directory'
  }
)
{
  include sunet::packages::certbot
  include cdn::ca_trust

  package {'mosquitto': ensure => installed }

  file { '/etc/mosquitto/aclfile':
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0644',
    content => template('cdn/mqtt/aclfile.erb'),
  }

  file { '/etc/mosquitto/conf.d/cdn.conf':
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0644',
    content => template('cdn/mqtt/cdn.conf.erb'),
  }

  sunet::nftables::allow { 'allow-step-ca-acme':
    from  => 'any',
    port  => 80,
    proto => 'tcp',
  }

  $mqtt_client_ips.each | String $mqtt_client_ip | {
    sunet::nftables::allow { "allow-acme-client-${mqtt_client_ip}":
      from  => $mqtt_client_ip,
      port  => 8883,
      proto => 'tcp',
    }
  }

  # From https://wiki.sunet.se/display/sunetops/Platform+naming+standards
  $my_fqdn = $facts['networking']['fqdn']
  $dot_split = split($my_fqdn, '[.]')
  $my_hostname = $dot_split[0]
  $dash_split = split($my_hostname,'[-]')
  $environment = $dash_split[2]

  file { '/etc/letsencrypt/renewal-hooks/deploy/sunet-cdn-mqtt':
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0755',
    content => file('cdn/mqtt/sunet-cdn-mqtt'),
  }

  exec { "certbot certonly -n --email patlu@sunet.se --no-eff-email --agree-tos --standalone -d ${my_fqdn} --server ${acme_url[$environment]}":
    creates => "/etc/letsencrypt/live/${my_fqdn}/fullchain.pem"
  }
}