Skip to content

Commit 3c73fc0

Browse files
smortexsmortex
committed
Add missing parameters to mod_md
A bunch of new parameters have been intruduced in mod_md. Sync the module with the latest documentation from Apache to allow to configure them.
1 parent cdb899c commit 3c73fc0

3 files changed

Lines changed: 126 additions & 0 deletions

File tree

‎manifests/mod/md.pp‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,12 @@
2020
# @param md_certificate_check
2121
# -
2222
#
23+
# @param md_certificate_file
24+
# Specify a static certificate file for the MD.
25+
#
26+
# @param md_certificate_key_file
27+
# Specify a static private key for for the static cerrtificate.
28+
#
2329
# @param md_certificate_monitor
2430
# The URL of a certificate log monitor.
2531
#
@@ -33,12 +39,27 @@
3339
# Define a program to be called when the `dns-01` challenge needs to be
3440
# setup/torn down.
3541
#
42+
# @param md_challenge_dns01_version
43+
# Set the type of arguments to call MDChallengeDns01 with
44+
#
45+
# @param md_check_interval
46+
# Determines how often certificates are checked
47+
#
3648
# @param md_contact_email
3749
# The ACME protocol requires you to give a contact url when you sign up.
3850
#
51+
# @param md_external_account_binding
52+
# Set the external account binding keyid and hmac values to use at CA
53+
#
3954
# @param md_http_proxy
4055
# Define a proxy for outgoing connections.
4156
#
57+
# @param md_initial_delay
58+
# How long to delay the first certificate check.
59+
#
60+
# @param md_match_names
61+
# Determines how DNS names are matched to vhosts
62+
#
4263
# @param md_members
4364
# Control if the alias domain names are automatically added.
4465
#
@@ -57,16 +78,31 @@
5778
# @param md_private_keys
5879
# Set type and size of the private keys generated.
5980
#
81+
# @param md_profile
82+
# Use a specific ACME profile from the CA
83+
#
84+
# @param md_profile_mandatory
85+
# Control if an MDProfile is mandatory.
86+
#
6087
# @param md_renew_mode
6188
# Controls if certificates shall be renewed.
6289
#
90+
# @param md_renew_via_ari
91+
# usage of the ACME ARI extension (rfc9773).
92+
#
6393
# @param md_renew_window
6494
# Control when a certificate will be renewed.
6595
#
6696
# @param md_require_https
6797
# Redirects http: traffic to https: for Managed Domains.
6898
# An http: Virtual Host must nevertheless be setup for that domain.
6999
#
100+
# @param md_retry_delay
101+
# Time length for first retry, doubled on every consecutive error.
102+
#
103+
# @param md_retry_failover
104+
# The number of errors before a failover to another CA is triggered
105+
#
70106
# @param md_server_status
71107
# Control if Managed Domain information is added to server-status.
72108
#
@@ -85,6 +121,9 @@
85121
# @param md_store_dir
86122
# Path on the local file system to store the Managed Domains data.
87123
#
124+
# @param md_store_locks
125+
# Configure locking of store for updates
126+
#
88127
# @param md_warn_window
89128
# Define the time window when you want to be warned about an expiring
90129
# certificate.
@@ -99,27 +138,40 @@
99138
Optional[Enum['accepted']] $md_certificate_agreement = undef,
100139
Optional[Stdlib::HTTPUrl] $md_certificate_authority = undef,
101140
Optional[String] $md_certificate_check = undef, # undocumented
141+
Optional[Stdlib::Absolutepath] $md_certificate_file = undef,
142+
Optional[Stdlib::Absolutepath] $md_certificate_key_file = undef,
102143
Optional[String] $md_certificate_monitor = undef,
103144
Optional[Enum['ACME']] $md_certificate_protocol = undef,
104145
Optional[Apache::OnOff] $md_certificate_status = undef,
105146
Optional[Stdlib::Absolutepath] $md_challenge_dns01 = undef,
147+
Optional[Integer[1,2]] $md_challenge_dns01_version = undef,
148+
Optional[String] $md_check_interval = undef,
106149
Optional[String] $md_contact_email = undef,
150+
Optional[String] $md_external_account_binding = undef,
107151
Optional[Stdlib::HTTPUrl] $md_http_proxy = undef,
152+
Optional[String] $md_initial_delay = undef,
153+
Optional[String] $md_match_names = undef,
108154
Optional[Enum['auto', 'manual']] $md_members = undef,
109155
Optional[Stdlib::Absolutepath] $md_message_cmd = undef,
110156
Optional[Apache::OnOff] $md_must_staple = undef,
111157
Optional[Stdlib::Absolutepath] $md_notify_cmd = undef,
112158
Optional[String] $md_port_map = undef,
113159
Optional[String] $md_private_keys = undef,
160+
Optional[String] $md_profile = undef,
161+
Optional[Apache::OnOff] $md_profile_mandatory = undef,
114162
Optional[Enum['always', 'auto', 'manual']] $md_renew_mode = undef,
163+
Optional[Apache::OnOff] $md_renew_via_ari = undef,
115164
Optional[String] $md_renew_window = undef,
116165
Optional[Enum['off', 'permanent', 'temporary']] $md_require_https = undef,
166+
Optional[String] $md_retry_delay = undef,
167+
Optional[Integer[0]] $md_retry_failover = undef,
117168
Optional[Apache::OnOff] $md_server_status = undef,
118169
Optional[Apache::OnOff] $md_staple_others = undef,
119170
Optional[Apache::OnOff] $md_stapling = undef,
120171
Optional[String] $md_stapling_keep_response = undef,
121172
Optional[String] $md_stapling_renew_window = undef,
122173
Optional[Stdlib::Absolutepath] $md_store_dir = undef,
174+
Optional[String] $md_store_locks = undef,
123175
Optional[String] $md_warn_window = undef,
124176
) {
125177
include apache

‎spec/classes/mod/md_spec.rb‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,27 +18,40 @@
1818
'md_certificate_agreement' => { type: 'MDCertificateAgreement', pass_opt: 'MDCertificateAgreement' },
1919
'md_certificate_authority' => { type: 'URL', pass_opt: 'MDCertificateAuthority' },
2020
'md_certificate_check' => { type: 'String', pass_opt: 'MDCertificateCheck' },
21+
'md_certificate_file' => { type: 'Path', pass_opt: 'MDCertificateFile' },
22+
'md_certificate_key_file' => { type: 'Path', pass_opt: 'MDCertificateKeyFile' },
2123
'md_certificate_monitor' => { type: 'URL', pass_opt: 'MDCertificateMonitor' },
2224
'md_certificate_protocol' => { type: 'MDCertificateProtocol', pass_opt: 'MDCertificateProtocol' },
2325
'md_certificate_status' => { type: 'OnOff', pass_opt: 'MDCertificateStatus' },
2426
'md_challenge_dns01' => { type: 'Path', pass_opt: 'MDChallengeDns01' },
27+
'md_challenge_dns01_version' => { type: 'Dns01Version', pass_opt: 'MDChallengeDns01Version' },
28+
'md_check_interval' => { type: 'Duration', pass_opt: 'MDCheckInterval' },
2529
'md_contact_email' => { type: 'EMail', pass_opt: 'MDContactEmail' },
30+
'md_external_account_binding' => { type: 'Path', pass_opt: 'MDExternalAccountBinding' },
2631
'md_http_proxy' => { type: 'URL', pass_opt: 'MDHttpProxy' },
32+
'md_initial_delay' => { type: 'Duration', pass_opt: 'MDInitialDelay' },
33+
'md_match_names' => { type: 'String', pass_opt: 'MDMatchNames' },
2734
'md_members' => { type: 'MDMembers', pass_opt: 'MDMembers' },
2835
'md_message_cmd' => { type: 'Path', pass_opt: 'MDMessageCmd' },
2936
'md_must_staple' => { type: 'OnOff', pass_opt: 'MDMustStaple' },
3037
'md_notify_cmd' => { type: 'Path', pass_opt: 'MDNotifyCmd' },
3138
'md_port_map' => { type: 'String', pass_opt: 'MDPortMap' },
3239
'md_private_keys' => { type: 'String', pass_opt: 'MDPrivateKeys' },
40+
'md_profile' => { type: 'String', pass_opt: 'MDProfile' },
41+
'md_profile_mandatory' => { type: 'OnOff', pass_opt: 'MDProfileMandatory' },
3342
'md_renew_mode' => { type: 'MDRenewMode', pass_opt: 'MDRenewMode' },
43+
'md_renew_via_ari' => { type: 'OnOff', pass_opt: 'MDRenewViaARI' },
3444
'md_renew_window' => { type: 'Duration', pass_opt: 'MDRenewWindow' },
3545
'md_require_https' => { type: 'MDRequireHttps', pass_opt: 'MDRequireHttps' },
46+
'md_retry_delay' => { type: 'Duration', pass_opt: 'MDRetryDelay' },
47+
'md_retry_failover' => { type: 'Integer', pass_opt: 'MDRetryFailover' },
3648
'md_server_status' => { type: 'OnOff', pass_opt: 'MDServerStatus' },
3749
'md_staple_others' => { type: 'OnOff', pass_opt: 'MDStapleOthers' },
3850
'md_stapling' => { type: 'OnOff', pass_opt: 'MDStapling' },
3951
'md_stapling_keep_response' => { type: 'Duration', pass_opt: 'MDStaplingKeepResponse' },
4052
'md_stapling_renew_window' => { type: 'Duration', pass_opt: 'MDStaplingRenewWindow' },
4153
'md_store_dir' => { type: 'Path', pass_opt: 'MDStoreDir' },
54+
'md_store_locks' => { type: 'Path', pass_opt: 'MDStoreLocks' },
4255
'md_warn_window' => { type: 'Duration', pass_opt: 'MDWarnWindow' }
4356
}
4457

@@ -64,6 +77,17 @@
6477
{ puppetized_config_option.to_sym => valid_value }
6578
end
6679

80+
it { is_expected.to contain_file('md.conf').with_content(%r{^#{config_hash[:pass_opt]} #{valid_value}$}) }
81+
end
82+
end
83+
when 'Dns01Version'
84+
valid_config_values = [1, 2]
85+
valid_config_values.each do |valid_value|
86+
describe "with #{puppetized_config_option} => #{valid_value}" do
87+
let :params do
88+
{ puppetized_config_option.to_sym => valid_value }
89+
end
90+
6791
it { is_expected.to contain_file('md.conf').with_content(%r{^#{config_hash[:pass_opt]} #{valid_value}$}) }
6892
end
6993
end
@@ -130,6 +154,17 @@
130154
{ puppetized_config_option.to_sym => valid_value }
131155
end
132156

157+
it { is_expected.to contain_file('md.conf').with_content(%r{^#{config_hash[:pass_opt]} #{valid_value}$}) }
158+
end
159+
end
160+
when 'Integer'
161+
valid_config_values = [42]
162+
valid_config_values.each do |valid_value|
163+
describe "with #{puppetized_config_option} => #{valid_value}" do
164+
let :params do
165+
{ puppetized_config_option.to_sym => valid_value }
166+
end
167+
133168
it { is_expected.to contain_file('md.conf').with_content(%r{^#{config_hash[:pass_opt]} #{valid_value}$}) }
134169
end
135170
end

‎templates/mod/md.conf.epp‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ MDCertificateAuthority <%= $apache::mod::md::md_certificate_authority %>
1616
<% if $apache::mod::md::md_certificate_check { -%>
1717
MDCertificateCheck <%= $apache::mod::md::md_certificate_check %>
1818
<% } -%>
19+
<% if $apache::mod::md::md_certificate_file { -%>
20+
MDCertificateFile "<%= $apache::mod::md::md_certificate_file %>"
21+
<% } -%>
22+
<% if $apache::mod::md::md_certificate_key_file { -%>
23+
MDCertificateKeyFile "<%= $apache::mod::md::md_certificate_key_file %>"
24+
<% } -%>
1925
<% if $apache::mod::md::md_certificate_monitor { -%>
2026
MDCertificateMonitor <%= $apache::mod::md::md_certificate_monitor %>
2127
<% } -%>
@@ -28,12 +34,27 @@ MDCertificateStatus <%= $apache::mod::md::md_certificate_status %>
2834
<% if $apache::mod::md::md_challenge_dns01 { -%>
2935
MDChallengeDns01 "<%= $apache::mod::md::md_challenge_dns01 %>"
3036
<% } -%>
37+
<% if $apache::mod::md::md_challenge_dns01_version { -%>
38+
MDChallengeDns01Version <%= $apache::mod::md::md_challenge_dns01_version %>
39+
<% } -%>
40+
<% if $apache::mod::md::md_check_interval { -%>
41+
MDCheckInterval <%= $apache::mod::md::md_check_interval %>
42+
<% } -%>
3143
<% if $apache::mod::md::md_contact_email { -%>
3244
MDContactEmail <%= $apache::mod::md::md_contact_email %>
3345
<% } -%>
46+
<% if $apache::mod::md::md_external_account_binding { -%>
47+
MDExternalAccountBinding "<%= $apache::mod::md::md_external_account_binding %>"
48+
<% } -%>
3449
<% if $apache::mod::md::md_http_proxy { -%>
3550
MDHttpProxy <%= $apache::mod::md::md_http_proxy %>
3651
<% } -%>
52+
<% if $apache::mod::md::md_initial_delay { -%>
53+
MDInitialDelay <%= $apache::mod::md::md_initial_delay %>
54+
<% } -%>
55+
<% if $apache::mod::md::md_match_names { -%>
56+
MDMatchNames <%= $apache::mod::md::md_match_names %>
57+
<% } -%>
3758
<% if $apache::mod::md::md_members { -%>
3859
MDMembers <%= $apache::mod::md::md_members %>
3960
<% } -%>
@@ -52,15 +73,30 @@ MDPortMap <%= $apache::mod::md::md_port_map %>
5273
<% if $apache::mod::md::md_private_keys { -%>
5374
MDPrivateKeys <%= $apache::mod::md::md_private_keys %>
5475
<% } -%>
76+
<% if $apache::mod::md::md_profile { -%>
77+
MDProfile <%= $apache::mod::md::md_profile %>
78+
<% } -%>
79+
<% if $apache::mod::md::md_profile_mandatory { -%>
80+
MDProfileMandatory <%= $apache::mod::md::md_profile_mandatory %>
81+
<% } -%>
5582
<% if $apache::mod::md::md_renew_mode { -%>
5683
MDRenewMode <%= $apache::mod::md::md_renew_mode %>
5784
<% } -%>
85+
<% if $apache::mod::md::md_renew_via_ari { -%>
86+
MDRenewViaARI <%= $apache::mod::md::md_renew_via_ari %>
87+
<% } -%>
5888
<% if $apache::mod::md::md_renew_window { -%>
5989
MDRenewWindow <%= $apache::mod::md::md_renew_window %>
6090
<% } -%>
6191
<% if $apache::mod::md::md_require_https { -%>
6292
MDRequireHttps <%= $apache::mod::md::md_require_https %>
6393
<% } -%>
94+
<% if $apache::mod::md::md_retry_delay { -%>
95+
MDRetryDelay <%= $apache::mod::md::md_retry_delay %>
96+
<% } -%>
97+
<% if $apache::mod::md::md_retry_failover { -%>
98+
MDRetryFailover <%= $apache::mod::md::md_retry_failover %>
99+
<% } -%>
64100
<% if $apache::mod::md::md_server_status { -%>
65101
MDServerStatus <%= $apache::mod::md::md_server_status %>
66102
<% } -%>
@@ -79,6 +115,9 @@ MDStaplingRenewWindow <%= $apache::mod::md::md_stapling_renew_window %>
79115
<% if $apache::mod::md::md_store_dir { -%>
80116
MDStoreDir "<%= $apache::mod::md::md_store_dir %>"
81117
<% } -%>
118+
<% if $apache::mod::md::md_store_locks { -%>
119+
MDStoreLocks "<%= $apache::mod::md::md_store_locks %>"
120+
<% } -%>
82121
<% if $apache::mod::md::md_warn_window { -%>
83122
MDWarnWindow <%= $apache::mod::md::md_warn_window %>
84123
<% } -%>

0 commit comments

Comments
 (0)
⚡