puppetlabs-puppetdb
puppetlabs-puppetdb copied to clipboard
Should support specifying the paths to the SSL cert, key & CA
There doesn't seem to be a way to specify the path to the SSL certificate, key or CA. In the mean time, I've made this :tada: (many thanks to @insertjokehere for basicca)
$puppetdb_keydir = '/etc/puppetdb/ssl'
file { $puppetdb_keydir:
ensure => directory,
require => Package[$puppetdb::params::puppetdb_package]
}
basicca::selfsignedcert { "puppetdbcert":
keypath => "${puppetdb_keydir}/private.key",
csrpath => "${puppetdb_keydir}/request.csr",
certpath => "${puppetdb_keydir}/public.crt",
keysize => 2048,
issuelength => 365,
subject => "/commonName=${fqdn}/",
require => File[$puppetdb_keydir]
}
class { 'puppetdb': }
ini_setting { 'puppetdb_ssl_key':
path => "${puppetdb::params::confdir}/jetty.ini",
ensure => present,
section => 'jetty',
setting => 'ssl-key',
value => "${puppetdb_keydir}/private.key",
require => Basicca::Selfsignedcert['puppetdbcert'],
}
ini_setting { 'puppetdb_ssl_cert':
path => "${puppetdb::params::confdir}/jetty.ini",
ensure => present,
section => 'jetty',
setting => 'ssl-cert',
value => "${puppetdb_keydir}/public.crt",
require => Basicca::Selfsignedcert['puppetdbcert'],
}
# Make sure the certs are generated before starting PuppetDB
Basicca::Selfsignedcert['puppetdbcert'] ->
Class['puppetdb::server::jetty_ini'] ->
Ini_Setting['puppetdb_ssl_key'] ->
Ini_Setting['puppetdb_ssl_cert'] ->
Service[$puppetdb::params::puppetdb_service]