swedenconnect/eid-ops
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tls for lighttpd

Browse source
This commit is contained in:
Leif Johansson 2018-02-12 00:39:51 +01:00
parent 5bc14462d7
commit c2d34da3f2
2 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
global/overlay/etc/puppet/cosmos-rules.yaml
View file

@ -23,6 +23,7 @@ p1.komreg.net:
sunet_iaas_cloud: sunet_iaas_cloud:
autoupdate: autoupdate:
md_publisher: md_publisher:
keyname: p1.komreg.net_infra
sunet::frontend::register_sites: sunet::frontend::register_sites:
sites: sites:
'qa.komreg.se': 'qa.komreg.se':

14
global/overlay/etc/puppet/manifests/cosmos-site.pp
View file

@ -146,7 +146,11 @@ class md_signer($dest_host="localhost",$dest_dir="") {
} }
} }
class md_publisher(Array $allow_clients = ['any'], String $dir = "/var/www/html") { class md_publisher(Array $allow_clients = ['any'], String $keyname = undef, String $dir = "/var/www/html") {
$_keyname = $keyname ? {
undef => $::fqdn,
default => $keyname
}
sunet::rrsync {$dir: sunet::rrsync {$dir:
ro => false, ro => false,
ssh_key => safe_hiera('publisher_ssh_key',"NOT SET IN HIERA"), ssh_key => safe_hiera('publisher_ssh_key',"NOT SET IN HIERA"),
@ -154,6 +158,14 @@ class md_publisher(Array $allow_clients = ['any'], String $dir = "/var/www/html"
} -> } ->
package {'lighttpd': ensure => latest } -> package {'lighttpd': ensure => latest } ->
service {'lighttpd': ensure => running } -> service {'lighttpd': ensure => running } ->
exec {'enable-ssl':
cmd => "/usr/sbin/lighttpd-enable-mod ssl",
onlyif => "test ! -h /etc/lighttpd/conf-enabled/*ssl*"
} ->
exec {'server.pem':
cmd => "cat /etc/ssl/private/${_keyname}.key /etc/ssl/certs/${_keyname}.crt > /etc/lighttpd/server.pem",
onlyif => "test ! -f /etc/lighttpd/server.pem"
} ->
apparmor::profile { 'usr.sbin.lighttpd': source => '/etc/apparmor-cosmos/usr.sbin.lighttpd' } -> apparmor::profile { 'usr.sbin.lighttpd': source => '/etc/apparmor-cosmos/usr.sbin.lighttpd' } ->
sunet::misc::ufw_allow {'allow-lighttpd': sunet::misc::ufw_allow {'allow-lighttpd':
from => $allow_clients, from => $allow_clients,