Puppet Class: dehydrated

Inherits:
dehydrated::params
Defined in:
manifests/init.pp

Summary

Base class to define necessary variables and include setup classes.

Overview

Base class to setup the letsencrypt certificate handling with dehydrated.

Examples:

# should be sufficient in most cases.
include dehydrated

# if you are "upgrading" from bzed-letsencrypt,
# you might want to use these options to stay
# compatible with the old group/directory:
class { 'dehydrated' :
  group    => 'letsencrypt',
  base_dir => '/etc/letsencrypt',
}

Parameters:

  • base_dir (Stdlib::Absolutepath) (defaults to: $dehydrated::params::base_dir) —

    The base directory where keys/csr/certs are stored. Defaults to:

    • on $::os['family']=='Debian': /etc/dehydrated
    • on other Linux/Unix systems: /etc/pki/dehydrated
    • on windows: C:\LE_certs.
  • crt_dir (Stdlib::Absolutepath) (defaults to: join([$base_dir, 'certs'], $dehydrated::params::path_seperator)) —

    The directory where certificates are stored. Defaults to $base_dir/certs

  • csr_dir (Stdlib::Absolutepath) (defaults to: join([$base_dir, 'csr'], $dehydrated::params::path_seperator)) —

    The directory where CSRs are stored. Defaults to $base_dir/csr

  • key_dir (Stdlib::Absolutepath) (defaults to: join([$base_dir, 'private'], $dehydrated::params::path_seperator)) —

    The directory where pricate keys are stored. Defaults to $base_dir/private

  • user (String) (defaults to: $dehydrated::params::user) —

    Linux: The user who owns the files in /etc/dehydrated. Windows: The user who owns the files in C:\LE_Certs. Needs to be specified!

  • group (String) (defaults to: $dehydrated::params::group) —

    Linux: The group which owns the files in /etc/dehydrated. If you have a non-root process which needs to access private keys, add its user to this group. Windows: The group which owns the files in C:\LE_Certs. Needs to be specified!

  • dehydrated_user (Optional[String]) (defaults to: $dehydrated::params::dehydrated_user) —

    User to run the dehydrated script as. Only used on the host that actually requests certificates.

  • dehydrated_group (Optional[String]) (defaults to: $dehydrated::params::dehydrated_group) —

    Group to run the dehydrated script as. Only used on the host that actually requests certificates.

  • letsencrypt_ca (String) (defaults to: $dehydrated::params::letsencrypt_ca) —

    Let’s Encrypt CA to use. Defaults to v2-production. See the letsencrypt_cas parameter for a way to specify your own Let’s Encrypt / ACME compatible CA. This configures the default CA to use, but You can actually define different CAs for each certificate, see the dehydrated::certificate define for details.

  • letsencrypt_cas (Hash) (defaults to: $dehydrated::params::letsencrypt_cas) —

    Hash with the definitions of the official testing and production Let’s Encrypt CAs this puppet module was tested against.

  • dh_param_size (Integer[768]) (defaults to: $dehydrated::params::dh_param_size) —

    Default size of the DH params we should generate. Defaults to 2048.

  • challengetype (Dehydrated::Challengetype) (defaults to: $dehydrated::params::challengetype) —

    Default challengetype to use. Defaults to 'dns-01'. You can specify a different challengetype for each certificate, see dehydrated::certificate.

  • algorithm (Dehydrated::Algorithm) (defaults to: $dehydrated::params::algorithm) —

    Default algorithm / elliptic-curve you want to use. Supported: rsa, secp384r1, prime256v1. Defaults to rsa. You can specify a different algorithm for each certificate, see dehydrated::certificate.

  • key_size (Integer[768]) (defaults to: $dehydrated::params::key_size) —

    Size of the key if we create a new one. Only used if algorithm is 'rsa'. You can specify a different size for each certificate; see dehydrated::certificate.

  • dehydrated_base_dir (Stdlib::Absolutepath) (defaults to: $dehydrated::params::dehydrated_base_dir) —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host. Path where the dehydrated script and configurations/csrs are being stored. Defaults to '/opt/dehydrated'.

  • dehydrated_git_dir (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/dehydrated") —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host. Path where the dehydrated script is being checkout out into using git. Defaults to $dehydrated_base_dir/dehydrated.

  • dehydrated_git_tag (String) (defaults to: $dehydrated::params::dehydrated_git_tag) —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host. Version of the dehydrated script we want to use. Change it on your own risk.

  • dehydrated_git_url (Dehydrated::GitUrl) (defaults to: $dehydrated::params::dehydrated_git_url) —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host. Git url to clone dehydrated from. If you have an internal mirror/version, you can override the default github url here.

  • dehydrated_host (Stdlib::Fqdn) (defaults to: $dehydrated::params::dehydrated_host) —

    Default setting for the host you want to request the certificates on. Required on that host, on all others it is used as default for certificates requested via dehydrated::certificate. You can specify a different dehydrated_host on each certificate if you want to. If $trusted['certname'] == $dehydrated::dehydrated_host, dehydrated will be installed and the certificate request cronjob will be setup.

  • dehydrated_requests_dir (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/requests") —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host. Path where requests that need to be handled are being stored.

  • dehydrated_hooks_dir (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/hooks") —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host.

  • dehydrated_requests_config (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/requests.json") —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host.

  • dehydrated_wellknown_dir (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/acme-challenges") —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host.

  • dehydrated_alpncert_dir (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/alpn-certs") —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host.

  • dehydrated_host_packages (Array) (defaults to: $dehydrated::params::dehydrated_host_packages) —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host.

  • dehydrated_environment (Hash) (defaults to: $dehydrated::params::dehydrated_environment) —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host.

  • dehydrated_domain_validation_hook (Optional[Dehydrated::Hook]) (defaults to: $dehydrated::params::dehydrated_domain_validation_hook) —

    Only used if $trusted['certname'] == $dehydrated::dehydrated_host.

  • dehydrated_hook (Dehydrated::Hook) (defaults to: "${challengetype}.sh") —

    Name of the hook script dehydrated will use to validate the authorization request. The hook script must live in the $dehydrated_hooks_dir on $dehydrated::dehydrated_host.

  • dehydrated_contact_email (Optional[Dehydrated::Email]) (defaults to: $dehydrated::params::dehydrated_contact_email) —

    Contact email address for created accounts. We'll create one account for each puppet host.

  • accounts_per_agent (Boolean) (defaults to: true) —

    Create one ACME account per puppet client (true; the default), or one account globally.

  • dehydrated_status_file (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/status.json") —

    File the dehydrated job runner will dump its status into. Pretty printed JSON.

  • dehydrated_monitoring_status_file (Stdlib::Absolutepath) (defaults to: "${dehydrated_base_dir}/monitoring.status") —

    Status file for monitoring with check_statusfile, see README.md for details.

  • manage_user (Boolean) (defaults to: $dehydrated::params::manage_user) —

    Create $dehydrated_user/$dehydrated_group and $user/$group if necessary.

  • manage_packages (Boolean) (defaults to: $dehydrated::params::manage_packages) —

    Install required packages using ensure_packages? Should be safe to leave enabled in most cases.

  • pki_packages (Array) (defaults to: $dehydrated::params::pki_packages) —

    Required packages to create /etc/pki. Not really used yet.

  • packages (Array) (defaults to: $dehydrated::params::packages) —

    The list of packages we actually need to install to make this module work properly. You are free to modify this list if you need to.

  • certificates (Array[Variant[Dehydrated::DN, Tuple[Dehydrated::DN, Array[Dehydrated::DN]]]]) (defaults to: []) —

    Allows to request certificates instead of using dehydrated::certificate. The puppet definition of this rather complex parameter is Array[Variant[Dehydrated::DN, Tuple[Dehydrated::DN, Array[Dehydrated::DN]]]] So basically, you need to specify an Array. Contents are either a

    • distinguished name
    • tuple with [distinguished name, array of distinguished names] The first case requests a default certificate. The tuple version will request a SAN certificate.
  • build_pfx_files (Boolean) (defaults to: $dehydrated::params::build_pfx_files) —

    Create PKCS12 container with key, certificate and ca certificates. Defaults to true on windows, to false on all other OS.

  • preferred_chain (Optional[String]) (defaults to: $dehydrated::params::preferred_chain) —

    Preferred dehydrated CA chain to use



139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
 
# File 'manifests/init.pp', line 139

class dehydrated (
  Stdlib::Absolutepath $base_dir = $dehydrated::params::base_dir,
  Stdlib::Absolutepath $crt_dir = join([$base_dir, 'certs'], $dehydrated::params::path_seperator),
  Stdlib::Absolutepath $csr_dir = join([$base_dir, 'csr'], $dehydrated::params::path_seperator),
  Stdlib::Absolutepath $key_dir = join([$base_dir, 'private'], $dehydrated::params::path_seperator),
  String $user = $dehydrated::params::user,
  String $group = $dehydrated::params::group,
  Optional[String] $dehydrated_user = $dehydrated::params::dehydrated_user,
  Optional[String] $dehydrated_group = $dehydrated::params::dehydrated_group,

  String $letsencrypt_ca = $dehydrated::params::letsencrypt_ca,
  Hash $letsencrypt_cas = $dehydrated::params::letsencrypt_cas,
  Integer[768] $dh_param_size = $dehydrated::params::dh_param_size,
  Dehydrated::Challengetype $challengetype = $dehydrated::params::challengetype,
  Dehydrated::Algorithm $algorithm = $dehydrated::params::algorithm,
  Integer[768] $key_size = $dehydrated::params::key_size,

  Stdlib::Absolutepath $dehydrated_base_dir = $dehydrated::params::dehydrated_base_dir,
  Stdlib::Absolutepath $dehydrated_git_dir = "${dehydrated_base_dir}/dehydrated",
  String $dehydrated_git_tag = $dehydrated::params::dehydrated_git_tag,
  Dehydrated::GitUrl $dehydrated_git_url = $dehydrated::params::dehydrated_git_url,
  Stdlib::Fqdn $dehydrated_host = $dehydrated::params::dehydrated_host,
  Stdlib::Absolutepath $dehydrated_requests_dir = "${dehydrated_base_dir}/requests",
  Stdlib::Absolutepath $dehydrated_hooks_dir = "${dehydrated_base_dir}/hooks",
  Stdlib::Absolutepath $dehydrated_requests_config = "${dehydrated_base_dir}/requests.json",
  Stdlib::Absolutepath $dehydrated_wellknown_dir = "${dehydrated_base_dir}/acme-challenges",
  Stdlib::Absolutepath $dehydrated_alpncert_dir = "${dehydrated_base_dir}/alpn-certs",
  Stdlib::Absolutepath $dehydrated_status_file = "${dehydrated_base_dir}/status.json",
  Stdlib::Absolutepath $dehydrated_monitoring_status_file = "${dehydrated_base_dir}/monitoring.status",
  Array $dehydrated_host_packages = $dehydrated::params::dehydrated_host_packages,
  Hash $dehydrated_environment = $dehydrated::params::dehydrated_environment,
  Optional[Dehydrated::Hook] $dehydrated_domain_validation_hook = $dehydrated::params::dehydrated_domain_validation_hook,
  Dehydrated::Hook $dehydrated_hook = "${challengetype}.sh",
  Optional[Dehydrated::Email] $dehydrated_contact_email = $dehydrated::params::dehydrated_contact_email,
  Boolean $accounts_per_agent = true,

  Boolean $manage_user = $dehydrated::params::manage_user,
  Boolean $manage_packages = $dehydrated::params::manage_packages,

  Array $pki_packages = $dehydrated::params::pki_packages,
  Array $packages = $dehydrated::params::packages,
  Array[Variant[Dehydrated::DN, Tuple[Dehydrated::DN, Array[Dehydrated::DN]]]] $certificates = [],

  Boolean $build_pfx_files = $dehydrated::params::build_pfx_files,
  Optional[String] $preferred_chain = $dehydrated::params::preferred_chain,
) inherits dehydrated::params {
  require dehydrated::setup

  $certificates.each | $certificate | {
    if ($certificate =~ Tuple[Dehydrated::DN, Array[Dehydrated::DN]]) {
      dehydrated::certificate { $certificate[0] :
        subject_alternative_names => $certificate[1],
      }
    } else {
      dehydrated::certificate { $certificate : }
    }
  }

  $_fqdn_based_config = {
    'dehydrated_contact_email' => $dehydrated_contact_email,
  }

  $dehydrated_domains = $facts['dehydrated_domains']
  $ready_for_merge = $dehydrated_domains.map |Dehydrated::DN $_dn, Hash $_config| {
    $_base_filename = $_config['base_filename']
    $_dh_param_size = $_config['dh_param_size']
    $_csr = $_config['csr']
    $_crt_serial = $_config['crt_serial']
    $_subject_alternative_names = $_config['subject_alternative_names']
    $_dehydrated_host = $_config['dehydrated_host']

    dehydrated::certificate::dh { $_base_filename :
      dn            => $_dn,
      dh_param_size => $_dh_param_size,
    }

    $request_name = join(
      concat([$trusted['certname'], $_dn],
        $_subject_alternative_names
      ),
    '-')

    $_request_config = merge($_fqdn_based_config, $_config)
    if $_csr =~ Dehydrated::CSR {
      @@dehydrated::certificate::request { $request_name :
        request_fqdn    => $trusted['certname'],
        config          => $_request_config,
        dn              => $_dn,
        dehydrated_host => $_dehydrated_host,
      }
    }

    $transfer_query = @("EOF":json)
      ["from", "resources",
        [ "extract",
          [
            "title",
            "certname",
            "parameters.file_type",
            "parameters.request_dn",
            "parameters.file_content"
          ],
          [
            "and",
            [ "=", "certname", "${_dehydrated_host}"],
            [ "=", "type", "Dehydrated::Certificate::Transfer" ],
            [ "=", "parameters.request_fqdn", "${trusted['certname']}" ],
            [ "=", "parameters.request_base_filename", "${_base_filename}" ],
            [ "=", "exported", true ]
          ]
        ]
      ]
      | EOF

    $transfer_data = puppetdb_query($transfer_query)
    $transfer_data.each |$transfer| {
      if ($transfer['parameters.file_type'] == 'ocsp') {
        $content = base64('decode', $transfer['parameters.file_content'])
      } else {
        $content = $transfer['parameters.file_content']
      }

      $filenames = {
        'ca'   => "${crt_dir}/${_base_filename}_ca.pem",
        'crt'  => "${crt_dir}/${_base_filename}.crt",
        'ocsp' => "${crt_dir}/${_base_filename}.crt.ocsp",
      }

      $filename = $filenames[$transfer['parameters.file_type']]
      file { $filename:
        ensure  => file,
        owner   => $user,
        group   => $group,
        mode    => '0644',
        content => $content,
      }
    }

    # mark as ready for merge in case we have 3 files to transfer.
    if length($transfer_data) == 3 {
      $_dn
    } else {
      undef
    }
  }.delete_undef_values()

  if ($dehydrated_host == $trusted['certname']) {
    require dehydrated::setup::dehydrated_host
    include dehydrated::setup::requests
    Class['dehydrated::setup::dehydrated_host'] -> Class['dehydrated::setup::requests']

    if 'dehydrated_certificates' in $facts {
      $dehydrated_certificates = $facts['dehydrated_certificates']
      $dehydrated_certificates.each |Stdlib::Fqdn $_request_fqdn, Hash $_certificate_configs| {
        $_certificate_configs.each |Dehydrated::DN $_request_dn, $_request_config| {
          $_request_base_dir = $_request_config['request_base_dir']
          $_request_base_filename = $_request_config['base_filename']
          dehydrated::certificate::collect { "${_request_fqdn}-${_request_dn}" :
            request_dn            => $_request_dn,
            request_fqdn          => $_request_fqdn,
            request_base_dir      => $_request_base_dir,
            request_base_filename => $_request_base_filename,
          }
        }
      }
    }
  }
}