init.sls 1.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778
  1. #
  2. # SSL Certificates
  3. #
  4. openssl:
  5. pkg.installed:
  6. - name: openssl
  7. c_rehash:
  8. cmd.wait:
  9. - name: /usr/bin/c_rehash >/dev/null 2>/dev/null
  10. - watch: []
  11. # FFHO internal CA
  12. /etc/ssl/certs/ffho-cacert.pem:
  13. file.managed:
  14. - source: salt://cert/ffho-cacert.pem
  15. - user: root
  16. - group: root
  17. - mode: 644
  18. - watch_in:
  19. - cmd: c_rehash
  20. # StartSSL Class1intermediate CA certificate
  21. /etc/ssl/certs/StartSSL_Class1_CA.pem:
  22. file.managed:
  23. - source: salt://cert/StartSSL_Class1_CA.pem
  24. - user: root
  25. - group: root
  26. - mode: 644
  27. - watch_in:
  28. - cmd: c_rehash
  29. # StartSSL Class2 intermediate CA certificate
  30. /etc/ssl/certs/StartSSL_Class2_CA.pem:
  31. file.managed:
  32. - source: salt://cert/StartSSL_Class2_CA.pem
  33. - user: root
  34. - group: root
  35. - mode: 644
  36. - watch_in:
  37. - cmd: c_rehash
  38. # Are there any certificates defined or referenced in the node pillar?
  39. {% for cn in salt['pillar.get']('nodes:' ~ grains['id'] ~ ':certs', {})|sort %}
  40. {% set pillar_name = None %}
  41. {% set cert_config = salt['pillar.get']('nodes:' ~ grains['id'] ~ ':certs:' ~ cn) %}
  42. {# "cert" and "privkey" provided in node config? #}
  43. {% if 'cert' in cert_config and 'privkey' in cert_config %}
  44. {% set pillar_name = 'nodes:' ~ grains['id'] ~ ':certs:' ~ cn %}
  45. {# <cn> only referenced in node config and cert/privkey stored in "cert" pillar? #}
  46. {% elif cert_config.get ('install', False) == True %}
  47. {% set pillar_name = 'cert:' ~ cn %}
  48. {% endif %}
  49. {% if pillar_name != None %}
  50. /etc/ssl/certs/{{ cn }}.cert.pem:
  51. file.managed:
  52. - contents_pillar: {{ pillar_name }}:cert
  53. - user: root
  54. - group: root
  55. - mode: 644
  56. /etc/ssl/private/{{ cn }}.key.pem:
  57. file.managed:
  58. - contents_pillar: {{ pillar_name }}:privkey
  59. - user: root
  60. - group: root
  61. - mode: 400
  62. {% endif %}
  63. {% endfor %}