From 67d85ee33a3a747f237100f9338f8159b35dba38 Mon Sep 17 00:00:00 2001
From: Fabien COMBERNOUS <fabien.combernous@adullact.org>
Date: Wed, 30 Nov 2022 21:42:41 +0100
Subject: [PATCH] add parameter crldir_manage
---
REFERENCE.md | 9 +++++++++
manifests/init.pp | 14 +++++++++++++-
2 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/REFERENCE.md b/REFERENCE.md
index 4a5314f..671e004 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -96,6 +96,7 @@ The following parameters are available in the `cfssl` class:
* [`serve_config`](#serve_config)
* [`crl_manage`](#crl_manage)
* [`crldir`](#crldir)
+* [`crldir_manage`](#crldir_manage)
* [`crl_expiry`](#crl_expiry)
* [`crl_gentimer`](#crl_gentimer)
* [`crl_extension`](#crl_extension)
@@ -261,6 +262,14 @@ A directory where the CRL file is written.
Default value: `'/var/cfssl'`
+##### <a name="crldir_manage"></a>`crldir_manage`
+
+Data type: `Boolean`
+
+Determines whether Puppet manages the `crldir` directory.
+
+Default value: ``true``
+
##### <a name="crl_expiry"></a>`crl_expiry`
Data type: `Integer`
diff --git a/manifests/init.pp b/manifests/init.pp
index 8dbfd49..1e0f537 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -45,6 +45,7 @@
# @param serve_config The configuration of CFSSL serve process.
# @param crl_manage If true a CRL file is generated from the served autority.
# @param crldir A directory where the CRL file is written.
+# @param crldir_manage Determines whether Puppet manages the `crldir` directory.
# @param crl_expiry A value, in seconds, after which the CRL should expire from the moment of the request
# @param crl_gentimer Systemd timer https://www.freedesktop.org/software/systemd/man/systemd.time.html
# @param crl_extension The filename extension suffix used form generated CRL.
@@ -71,6 +72,7 @@ class cfssl (
Cfssl::Serveconfig $serve_config = { signing => { 'default' => { expiry => '1h', usages => ['client auth'] } } },
Boolean $crl_manage = false,
Stdlib::Absolutepath $crldir = '/var/cfssl',
+ Boolean $crldir_manage = true,
Integer $crl_expiry = 604800,
String[1] $crl_gentimer = '*:00:00',
String[1] $crl_extension = 'pem',
@@ -129,7 +131,7 @@ class cfssl (
}
}
- file { [$confdir, "${confdir}/ca", $logdir, $crldir]:
+ file { [$confdir, "${confdir}/ca", $logdir]:
ensure => directory,
mode => '0700',
owner => $sysuser,
@@ -137,6 +139,16 @@ class cfssl (
require => User[$sysuser],
}
+ if $crldir_manage {
+ file { $crldir:
+ ensure => directory,
+ mode => '0700',
+ owner => $sysuser,
+ group => $sysgroup,
+ require => User[$sysuser],
+ }
+ }
+
postgresql::server::db { $dbname:
user => $dbuser,
password => postgresql::postgresql_password($dbuser, $dbpassword),
--
GitLab