Skip to content

Commit ffac0c6

Browse files
david22swandavid22swan
authored
Merge pull request #2090 from smortex/mod_md
Add support for mod_md
2 parents 6243304 + a97f9b5 commit ffac0c6

File tree

11 files changed

+545
-0
lines changed

11 files changed

+545
-0
lines changed

‎manifests/mod/md.pp‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# @summary
2+
# Installs and configures `mod_md`.
3+
#
4+
# @param md_activation_delay
5+
# -
6+
#
7+
# @param md_base_server
8+
# Control if base server may be managed or only virtual hosts.
9+
#
10+
# @param md_ca_challenges
11+
# Type of ACME challenge used to prove domain ownership.
12+
#
13+
# @param md_certificate_agreement
14+
# You confirm that you accepted the Terms of Service of the Certificate
15+
# Authority.
16+
#
17+
# @param md_certificate_authority
18+
# The URL of the ACME Certificate Authority service.
19+
#
20+
# @param md_certificate_check
21+
# -
22+
#
23+
# @param md_certificate_monitor
24+
# The URL of a certificate log monitor.
25+
#
26+
# @param md_certificate_protocol
27+
# The protocol to use with the Certificate Authority.
28+
#
29+
# @param md_certificate_status
30+
# Exposes public certificate information in JSON.
31+
#
32+
# @param md_challenge_dns01
33+
# Define a program to be called when the `dns-01` challenge needs to be
34+
# setup/torn down.
35+
#
36+
# @param md_contact_email
37+
# The ACME protocol requires you to give a contact url when you sign up.
38+
#
39+
# @param md_http_proxy
40+
# Define a proxy for outgoing connections.
41+
#
42+
# @param md_members
43+
# Control if the alias domain names are automatically added.
44+
#
45+
# @param md_message_cmd
46+
# Handle events for Manage Domains.
47+
#
48+
# @param md_must_staple
49+
# Control if new certificates carry the OCSP Must Staple flag.
50+
#
51+
# @param md_notify_cmd
52+
# Run a program when a Managed Domain is ready.
53+
#
54+
# @param md_port_map
55+
# Map external to internal ports for domain ownership verification.
56+
#
57+
# @param md_private_keys
58+
# Set type and size of the private keys generated.
59+
#
60+
# @param md_renew_mode
61+
# Controls if certificates shall be renewed.
62+
#
63+
# @param md_renew_window
64+
# Control when a certificate will be renewed.
65+
#
66+
# @param md_require_https
67+
# Redirects http: traffic to https: for Managed Domains.
68+
# An http: Virtual Host must nevertheless be setup for that domain.
69+
#
70+
# @param md_server_status
71+
# Control if Managed Domain information is added to server-status.
72+
#
73+
# @param md_staple_others
74+
# Enable stapling for certificates not managed by mod_md.
75+
#
76+
# @param md_stapling
77+
# Enable stapling for all or a particular MDomain.
78+
#
79+
# @param md_stapling_keep_response
80+
# Controls when old responses should be removed.
81+
#
82+
# @param md_stapling_renew_window
83+
# Control when the stapling responses will be renewed.
84+
#
85+
# @param md_store_dir
86+
# Path on the local file system to store the Managed Domains data.
87+
#
88+
# @param md_warn_window
89+
# Define the time window when you want to be warned about an expiring
90+
# certificate.
91+
#
92+
# @see https://httpd.apache.org/docs/current/mod/mod_md.html for additional documentation.
93+
#
94+
# @note Unsupported platforms: CentOS: 6, 7; Debian: 8, 9; OracleLinux: all; RedHat: 6, 7; Scientific: all; SLES: all; Ubuntu: 14, 16, 18
95+
class apache::mod::md (
96+
Optional[String] $md_activation_delay = undef,
97+
Optional[Enum['on', 'off']] $md_base_server = undef,
98+
Optional[Array[Enum['dns-01', 'http-01', 'tls-alpn-01']]] $md_ca_challenges = undef,
99+
Optional[Enum['accepted']] $md_certificate_agreement = undef,
100+
Optional[Stdlib::HTTPUrl] $md_certificate_authority = undef,
101+
Optional[String] $md_certificate_check = undef, # undocumented
102+
Optional[String] $md_certificate_monitor = undef,
103+
Optional[Enum['ACME']] $md_certificate_protocol = undef,
104+
Optional[Enum['on', 'off']] $md_certificate_status = undef,
105+
Optional[Stdlib::Absolutepath] $md_challenge_dns01 = undef,
106+
Optional[String] $md_contact_email = undef,
107+
Optional[Stdlib::HTTPUrl] $md_http_proxy = undef,
108+
Optional[Enum['auto', 'manual']] $md_members = undef,
109+
Optional[Stdlib::Absolutepath] $md_message_cmd = undef,
110+
Optional[Enum['on', 'off']] $md_must_staple = undef,
111+
Optional[Stdlib::Absolutepath] $md_notify_cmd = undef,
112+
Optional[String] $md_port_map = undef,
113+
Optional[String] $md_private_keys = undef,
114+
Optional[Enum['always', 'auto', 'manual']] $md_renew_mode = undef,
115+
Optional[String] $md_renew_window = undef,
116+
Optional[Enum['off', 'permanent', 'temporary']] $md_require_https = undef,
117+
Optional[Enum['on', 'off']] $md_server_status = undef,
118+
Optional[Enum['on', 'off']] $md_staple_others = undef,
119+
Optional[Enum['on', 'off']] $md_stapling = undef,
120+
Optional[String] $md_stapling_keep_response = undef,
121+
Optional[String] $md_stapling_renew_window = undef,
122+
Optional[Stdlib::Absolutepath] $md_store_dir = undef,
123+
Optional[String] $md_warn_window = undef,
124+
) {
125+
include apache
126+
include apache::mod::watchdog
127+
128+
apache::mod { 'md':
129+
}
130+
131+
file { 'md.conf':
132+
ensure => file,
133+
path => "${apache::mod_dir}/md.conf",
134+
mode => $apache::file_mode,
135+
content => epp('apache/mod/md.conf.epp'),
136+
require => Exec["mkdir ${apache::mod_dir}"],
137+
before => File[$apache::mod_dir],
138+
notify => Class['apache::service'],
139+
}
140+
}

‎manifests/mod/watchdog.pp‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# @summary
2+
# Installs and configures `mod_watchdog`.
3+
#
4+
# @param watchdog_interval
5+
# Sets the interval at which the watchdog_step hook runs.
6+
#
7+
# @see https://httpd.apache.org/docs/current/mod/mod_watchdog.html for additional documentation.
8+
class apache::mod::watchdog (
9+
Optional[Integer] $watchdog_interval = undef,
10+
) {
11+
include apache
12+
13+
$module_builtin = $facts['os']['family'] in ['Debian']
14+
15+
unless $module_builtin {
16+
apache::mod { 'watchdog':
17+
}
18+
}
19+
20+
if $watchdog_interval {
21+
file { 'watchdog.conf':
22+
ensure => file,
23+
path => "${apache::mod_dir}/watchdog.conf",
24+
mode => $apache::file_mode,
25+
content => "WatchdogInterval ${watchdog_interval}\n",
26+
require => Exec["mkdir ${apache::mod_dir}"],
27+
before => File[$apache::mod_dir],
28+
notify => Class['apache::service'],
29+
}
30+
}
31+
}

‎manifests/params.pp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,7 @@
231231
default => 'mod_ldap',
232232
},
233233
'lookup_identity' => 'mod_lookup_identity',
234+
'md' => 'mod_md',
234235
'pagespeed' => 'mod-pagespeed-stable',
235236
# NOTE: The passenger module isn't available on RH/CentOS without
236237
# providing dependency packages provided by EPEL and passenger

‎manifests/vhost.pp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1725,6 +1725,10 @@
17251725
# value of the $servername parameter.
17261726
# When set to false (default), the existing behaviour of using the $name parameter
17271727
# will remain.
1728+
#
1729+
# @param $mdomain
1730+
# All the names in the list are managed as one Managed Domain (MD). mod_md will request
1731+
# one single certificate that is valid for all these names.
17281732

17291733
define apache::vhost (
17301734
Variant[Boolean,String] $docroot,
@@ -1975,6 +1979,7 @@
19751979
Hash $define = {},
19761980
Boolean $auth_oidc = false,
19771981
Optional[Apache::OIDCSettings] $oidc_settings = undef,
1982+
Optional[Variant[Boolean,String]] $mdomain = undef,
19781983
) {
19791984
# The base class must be included first because it is used by parameter defaults
19801985
if ! defined(Class['apache']) {
@@ -2775,6 +2780,10 @@
27752780
}
27762781
}
27772782

2783+
if $mdomain {
2784+
include apache::mod::md
2785+
}
2786+
27782787
# Template uses:
27792788
# - $passenger_enabled
27802789
# - $passenger_start_timeout

‎spec/acceptance/mod_md_spec.rb‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
require 'spec_helper_acceptance'
2+
3+
describe 'apache::mod::md', if: mod_supported_on_platform?('apache::mod::md') do
4+
pp = <<-MANIFEST
5+
class { 'apache':
6+
}
7+
apache::vhost { 'example.com':
8+
docroot => '/var/www/example.com',
9+
port => 443,
10+
ssl => true,
11+
mdomain => true,
12+
}
13+
MANIFEST
14+
15+
it 'succeeds in configuring a virtual host using mod_md' do
16+
apply_manifest(pp, catch_failures: true)
17+
end
18+
end

0 commit comments

Comments
 (0)