init.sls 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116
  1. #
  2. # SSL Certificates
  3. #
  4. openssl:
  5. pkg.installed:
  6. - name: openssl
  7. ssl-cert:
  8. pkg.installed:
  9. - name: ssl-cert
  10. update_ca_certificates:
  11. cmd.wait:
  12. - name: /usr/sbin/update-ca-certificates
  13. - watch: []
  14. generate-dhparam:
  15. cmd.run:
  16. - name: openssl dhparam -out /etc/ssl/dhparam.pem 2048
  17. - creates: /etc/ssl/dhparam.pem
  18. # Install FFHO internal CA into Debian CA certificate mangling mechanism so
  19. # libraries (read: openssl) can use the CA cert when validating internal
  20. # service certificates. By installing the cert into the local ca-certificates
  21. # directory and calling update-ca-certificates two symlinks will be installed
  22. # into /etc/ssl/certs which will both point to the crt file:
  23. # * ffho-cacert.pem
  24. # * <cn-hash>.pem
  25. # The latter is use by openssl for validation.
  26. /usr/local/share/ca-certificates/ffho-cacert.crt:
  27. file.managed:
  28. - source: salt://certs/ffho-cacert.pem
  29. - user: root
  30. - group: root
  31. - mode: 644
  32. - watch_in:
  33. - cmd: update_ca_certificates
  34. {% set certs = {} %}
  35. # Are there any certificates defined or referenced in the node pillar?
  36. {% set node_config = salt['pillar.get']('node') %}
  37. {% for cn, cert_config in node_config.get ('certs', {}).items () %}
  38. {% set pillar_name = None %}
  39. {# "cert" and "privkey" provided in node config? #}
  40. {% if 'cert' in cert_config and 'privkey' in cert_config %}
  41. {% set pillar_name = 'node:certs:' ~ cn %}
  42. {# <cn> only referenced in node config and cert/privkey stored in "cert" pillar? #}
  43. {% elif cert_config.get ('install', False) == True %}
  44. {% set pillar_name = 'cert:' ~ cn %}
  45. {% endif %}
  46. {% if pillar_name != None %}
  47. {% do cert_config.update ({ "pillar_name" : pillar_name }) %}
  48. {% do certs.update ({ cn : cert_config }) %}
  49. {% endif %}
  50. {% endfor %}
  51. # Are there any cert defined or referenced for this node or roles of this node?
  52. {% set node_roles = node_config.get ('roles', []) %}
  53. {% for cn, cert_config in salt['pillar.get']('cert', {}).items () %}
  54. {% if grains['id'] in cert_config.get ('apply', {}).get ('node', []) %}
  55. {% do certs.update ({ cn : { 'pillar_name' : 'cert:' ~ cn }}) %}
  56. {% endif %}
  57. {% for role in cert_config.get ('apply', {}).get ('roles', []) %}
  58. {% if role in node_roles %}
  59. {% do certs.update ({ cn : { 'pillar_name' : 'cert:' ~ cn }}) %}
  60. {% endif %}
  61. {% endfor %}
  62. {% endfor %}
  63. # Install found certificates
  64. {% for cn, cert_config in certs.items () %}
  65. {% set pillar_name = cert_config['pillar_name'] %}
  66. {% set user = cert_config.get ('user', 'root') %}
  67. {% set install_dir = cert_config.get ('install_dir') %}
  68. /etc/ssl/certs/{{ cn }}.cert.pem:
  69. file.managed:
  70. {% if salt['pillar.get'](pillar_name ~ ':cert') == "file" %}
  71. - source: salt://certs/certs/{{ cn }}.cert.pem
  72. {% else %}
  73. - contents_pillar: {{ pillar_name }}:cert
  74. {% endif %}
  75. {% if install_dir %}
  76. - name: {{ install_dir }}/{{ cn }}.cert.pem
  77. {% endif %}
  78. - user: {{ user }}
  79. - group: {{ cert_config.get ('group', 'root') }}
  80. - mode: 644
  81. /etc/ssl/private/{{ cn }}.key.pem:
  82. file.managed:
  83. - contents_pillar: {{ pillar_name }}:privkey
  84. {% if install_dir %}
  85. - name: {{ install_dir }}/{{ cn }}.key.pem
  86. {% endif %}
  87. - user: {{ user }}
  88. - group: {{ cert_config.get ('group', 'ssl-cert') }}
  89. - mode: 440
  90. - require:
  91. - pkg: ssl-cert
  92. {% endfor %}
  93. {% if 'frontend' in node_config.roles or 'nginx' in node_config %}
  94. certs-nginx-reload:
  95. cmd.wait:
  96. - name: service nginx reload
  97. - watch:
  98. - file: /etc/ssl/certs/*
  99. {% endif %}