Skip to content

Commit f6fa483

Browse files
david22swandavid22swan
authored
Merge pull request puppetlabs#2157 from dodevops/te_ssl_reload
Add feature to reload apache service when content of ssl files has changed
2 parents de1edc6 + 562a12f commit f6fa483

File tree

10 files changed

+159
-2
lines changed

10 files changed

+159
-2
lines changed

‎REFERENCE.md

+28
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,7 @@
109109
* `apache::confd::no_accf`: Manages the `no-accf.conf` file.
110110
* `apache::default_confd_files`: Helper for setting up default conf.d files.
111111
* `apache::default_mods`: Installs and congfigures default mods for Apache
112+
* `apache::mod::ssl::reload`: Manages the puppet_ssl folder for ssl file copies, which is needed to track changes for reloading service on changes
112113
* `apache::package`: Installs an Apache MPM.
113114
* `apache::params`: This class manages Apache parameters
114115
* `apache::php`: This class installs PHP for Apache.
@@ -207,6 +208,7 @@ The following parameters are available in the `apache` class:
207208
* [`default_ssl_crl_path`](#default_ssl_crl_path)
208209
* [`default_ssl_crl_check`](#default_ssl_crl_check)
209210
* [`default_ssl_key`](#default_ssl_key)
211+
* [`default_ssl_reload_on_change`](#default_ssl_reload_on_change)
210212
* [`default_ssl_vhost`](#default_ssl_vhost)
211213
* [`default_type`](#default_type)
212214
* [`default_vhost`](#default_vhost)
@@ -434,6 +436,14 @@ environment.
434436

435437
Default value: `$apache::params::default_ssl_key`
436438

439+
##### <a name="default_ssl_reload_on_change"></a>`default_ssl_reload_on_change`
440+
441+
Data type: `Boolean`
442+
443+
Enable reloading of apache if the content of ssl files have changed.
444+
445+
Default value: ``false``
446+
437447
##### <a name="default_ssl_vhost"></a>`default_ssl_vhost`
438448

439449
Data type: `Boolean`
@@ -6369,6 +6379,7 @@ The following parameters are available in the `apache::mod::ssl` class:
63696379
* [`ssl_stapling`](#ssl_stapling)
63706380
* [`ssl_stapling_return_errors`](#ssl_stapling_return_errors)
63716381
* [`ssl_mutex`](#ssl_mutex)
6382+
* [`ssl_reload_on_change`](#ssl_reload_on_change)
63726383
* [`apache_version`](#apache_version)
63736384
* [`package_name`](#package_name)
63746385
* [`ssl_sessiontickets`](#ssl_sessiontickets)
@@ -6525,6 +6536,14 @@ Default based on the OS and/or Apache version:
65256536

65266537
Default value: ``undef``
65276538

6539+
##### <a name="ssl_reload_on_change"></a>`ssl_reload_on_change`
6540+
6541+
Data type: `Boolean`
6542+
6543+
Enable reloading of apache if the content of ssl files have changed. It only affects ssl files configured here and not vhost ones.
6544+
6545+
Default value: ``false``
6546+
65286547
##### <a name="apache_version"></a>`apache_version`
65296548

65306549
Data type: `Any`
@@ -7789,6 +7808,7 @@ The following parameters are available in the `apache::vhost` defined type:
77897808
* [`ssl_stapling_timeout`](#ssl_stapling_timeout)
77907809
* [`ssl_stapling_return_errors`](#ssl_stapling_return_errors)
77917810
* [`ssl_user_name`](#ssl_user_name)
7811+
* [`ssl_reload_on_change`](#ssl_reload_on_change)
77927812
* [`use_canonical_name`](#use_canonical_name)
77937813
* [`define`](#define)
77947814
* [`auth_oidc`](#auth_oidc)
@@ -10638,6 +10658,14 @@ Sets the [SSLUserName](https://httpd.apache.org/docs/current/mod/mod_ssl.html#ss
1063810658

1063910659
Default value: ``undef``
1064010660

10661+
##### <a name="ssl_reload_on_change"></a>`ssl_reload_on_change`
10662+
10663+
Data type: `Boolean`
10664+
10665+
Enable reloading of apache if the content of ssl files have changed.
10666+
10667+
Default value: `$apache::default_ssl_reload_on_change`
10668+
1064110669
##### <a name="use_canonical_name"></a>`use_canonical_name`
1064210670

1064310671
Data type: `Optional[Enum['On', 'on', 'Off', 'off', 'DNS', 'dns']]`

‎manifests/init.pp

+4
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,9 @@
9191
# this parameter with your SSL key's location before deploying this server in a production
9292
# environment.
9393
#
94+
# @param default_ssl_reload_on_change
95+
# Enable reloading of apache if the content of ssl files have changed.
96+
#
9497
# @param default_ssl_vhost
9598
# Configures a default SSL virtual host.
9699
# If `true`, Puppet automatically configures the following virtual host using the
@@ -472,6 +475,7 @@
472475
$default_ssl_crl_path = undef,
473476
$default_ssl_crl = undef,
474477
$default_ssl_crl_check = undef,
478+
Boolean $default_ssl_reload_on_change = false,
475479
$default_type = 'none',
476480
$dev_packages = $apache::params::dev_packages,
477481
$ip = undef,

‎manifests/mod/ssl.pp

+22
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@
6262
# - Debian/Ubuntu + Apache >= 2.4: 'default'.
6363
# - Debian/Ubuntu + Apache < 2.4: 'file:${APACHE_RUN_DIR}/ssl_mutex'.
6464
#
65+
# @param ssl_reload_on_change
66+
# Enable reloading of apache if the content of ssl files have changed. It only affects ssl files configured here and not vhost ones.
67+
#
6568
# @param apache_version
6669
# Used to verify that the Apache version you have requested is compatible with the module.
6770
#
@@ -97,6 +100,7 @@
97100
Optional[String] $stapling_cache = undef,
98101
Optional[Boolean] $ssl_stapling_return_errors = undef,
99102
$ssl_mutex = undef,
103+
Boolean $ssl_reload_on_change = false,
100104
$apache_version = undef,
101105
$package_name = undef,
102106
) inherits ::apache::params {
@@ -174,6 +178,24 @@
174178
include apache::mod::socache_shmcb
175179
}
176180

181+
if $ssl_reload_on_change {
182+
[$ssl_cert, $ssl_key, $ssl_ca].each |$ssl_file| {
183+
if $ssl_file {
184+
include apache::mod::ssl::reload
185+
$_ssl_file_copy = regsubst($ssl_file, '/', '_', 'G')
186+
file { $_ssl_file_copy:
187+
path => "${apache::params::puppet_ssl_dir}/${_ssl_file_copy}",
188+
source => "file://${ssl_file}",
189+
owner => 'root',
190+
group => $apache::params::root_group,
191+
mode => '0640',
192+
seltype => 'cert_t',
193+
notify => Class['apache::service'],
194+
}
195+
}
196+
}
197+
}
198+
177199
# Template uses
178200
#
179201
# $ssl_compression

‎manifests/mod/ssl/reload.pp

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# @summary
2+
# Manages the puppet_ssl folder for ssl file copies, which is needed to track changes for reloading service on changes
3+
#
4+
# @api private
5+
class apache::mod::ssl::reload () inherits ::apache::params {
6+
file { $apache::params::puppet_ssl_dir:
7+
ensure => directory,
8+
purge => true,
9+
recurse => true,
10+
require => Package['httpd'],
11+
}
12+
file { 'README.txt':
13+
path => "${apache::params::puppet_ssl_dir}/README.txt",
14+
content => 'This directory contains puppet managed copies of ssl files, so it can track changes and reload apache on changes.',
15+
seltype => 'etc_t',
16+
}
17+
}

‎manifests/params.pp

+6
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@
6363
$server_root = "${httpd_root}/etc/httpd"
6464
$conf_dir = "${httpd_dir}/conf"
6565
$confd_dir = "${httpd_dir}/conf.d"
66+
$puppet_ssl_dir = "${httpd_dir}/puppet_ssl"
6667
$mod_dir = $facts['operatingsystemmajrelease'] ? {
6768
'7' => "${httpd_dir}/conf.modules.d",
6869
default => "${httpd_dir}/conf.d",
@@ -169,6 +170,7 @@
169170
$server_root = '/etc/httpd'
170171
$conf_dir = "${httpd_dir}/conf"
171172
$confd_dir = "${httpd_dir}/conf.d"
173+
$puppet_ssl_dir = "${httpd_dir}/puppet_ssl"
172174
$conf_enabled = undef
173175
if $::operatingsystem =~ /^[Aa]mazon$/ and $::operatingsystemmajrelease == '2' {
174176
# Amazon Linux 2 uses the /conf.modules.d/ dir
@@ -341,6 +343,7 @@
341343
$confd_dir = "${httpd_dir}/conf.d"
342344
# Overwrite conf_enabled causes errors with Shibboleth when enabled on Ubuntu 18.04
343345
$conf_enabled = undef #"${httpd_dir}/conf-enabled.d"
346+
$puppet_ssl_dir = "${httpd_dir}/puppet_ssl"
344347
$mod_dir = "${httpd_dir}/mods-available"
345348
$mod_enable_dir = "${httpd_dir}/mods-enabled"
346349
$vhost_dir = "${httpd_dir}/sites-available"
@@ -544,6 +547,7 @@
544547
$conf_dir = $httpd_dir
545548
$confd_dir = "${httpd_dir}/Includes"
546549
$conf_enabled = undef
550+
$puppet_ssl_dir = "${httpd_dir}/puppet_ssl"
547551
$mod_dir = "${httpd_dir}/Modules"
548552
$mod_enable_dir = undef
549553
$vhost_dir = "${httpd_dir}/Vhosts"
@@ -617,6 +621,7 @@
617621
$conf_dir = $httpd_dir
618622
$confd_dir = "${httpd_dir}/conf.d"
619623
$conf_enabled = undef
624+
$puppet_ssl_dir = "${httpd_dir}/puppet_ssl"
620625
$mod_dir = "${httpd_dir}/modules.d"
621626
$mod_enable_dir = undef
622627
$vhost_dir = "${httpd_dir}/vhosts.d"
@@ -687,6 +692,7 @@
687692
$conf_dir = $httpd_dir
688693
$confd_dir = "${httpd_dir}/conf.d"
689694
$conf_enabled = undef
695+
$puppet_ssl_dir = "${httpd_dir}/puppet_ssl"
690696
$mod_dir = "${httpd_dir}/mods-available"
691697
$mod_enable_dir = "${httpd_dir}/mods-enabled"
692698
$vhost_dir = "${httpd_dir}/sites-available"

‎manifests/vhost.pp

+23-1
Original file line numberDiff line numberDiff line change
@@ -1679,6 +1679,9 @@
16791679
# @param ssl_user_name
16801680
# Sets the [SSLUserName](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslusername) directive.
16811681
#
1682+
# @param ssl_reload_on_change
1683+
# Enable reloading of apache if the content of ssl files have changed.
1684+
#
16821685
# @param use_canonical_name
16831686
# Specifies whether to use the [`UseCanonicalName directive`](https://httpd.apache.org/docs/2.4/mod/core.html#usecanonicalname),
16841687
# which allows you to configure how the server determines it's own name and port.
@@ -1762,6 +1765,7 @@
17621765
$ssl_crl = $apache::default_ssl_crl,
17631766
$ssl_crl_check = $apache::default_ssl_crl_check,
17641767
$ssl_certs_dir = $apache::params::ssl_certs_dir,
1768+
Boolean $ssl_reload_on_change = $apache::default_ssl_reload_on_change,
17651769
$ssl_protocol = undef,
17661770
$ssl_cipher = undef,
17671771
Variant[Boolean, Enum['on', 'On', 'off', 'Off'], Undef] $ssl_honorcipherorder = undef,
@@ -2706,12 +2710,30 @@
27062710
# - $ssl_openssl_conf_cmd
27072711
# - $ssl_stapling
27082712
# - $apache_version
2709-
if $ssl {
2713+
if $ssl and $ensure == 'present' {
27102714
concat::fragment { "${name}-ssl":
27112715
target => "${priority_real}${filename}.conf",
27122716
order => 230,
27132717
content => template('apache/vhost/_ssl.erb'),
27142718
}
2719+
2720+
if $ssl_reload_on_change {
2721+
[$ssl_cert, $ssl_key, $ssl_ca, $ssl_chain, $ssl_crl].each |$ssl_file| {
2722+
if $ssl_file {
2723+
include apache::mod::ssl::reload
2724+
$_ssl_file_copy = regsubst($ssl_file, '/', '_', 'G')
2725+
file { "${filename}${_ssl_file_copy}":
2726+
path => "${apache::params::puppet_ssl_dir}/${filename}${_ssl_file_copy}",
2727+
source => "file://${ssl_file}",
2728+
owner => 'root',
2729+
group => $apache::params::root_group,
2730+
mode => '0640',
2731+
seltype => 'cert_t',
2732+
notify => Class['apache::service'],
2733+
}
2734+
}
2735+
}
2736+
}
27152737
}
27162738

27172739
# Template uses:

‎spec/acceptance/apache_ssl_spec.rb

+32
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,17 @@ class { 'apache':
4848

4949
describe 'vhost ssl parameters' do
5050
pp = <<-MANIFEST
51+
file { [
52+
'/tmp/ssl_cert',
53+
'/tmp/ssl_key',
54+
'/tmp/ssl_chain',
55+
'/tmp/ssl_ca',
56+
'/tmp/ssl_crl',
57+
]:
58+
ensure => file,
59+
before => Class['apache']
60+
}
61+
5162
class { 'apache':
5263
service_ensure => stopped,
5364
}
@@ -63,6 +74,7 @@ class { 'apache':
6374
ssl_crl => '/tmp/ssl_crl',
6475
ssl_crl_check => 'chain flag',
6576
ssl_certs_dir => '/tmp',
77+
ssl_reload_on_change => true,
6678
ssl_protocol => 'test',
6779
ssl_cipher => 'test',
6880
ssl_honorcipherorder => true,
@@ -99,6 +111,26 @@ class { 'apache':
99111
it { is_expected.not_to contain 'SSLCARevocationCheck' }
100112
end
101113
end
114+
115+
describe file("#{apache_hash['httpd_dir']}/puppet_ssl/test_ssl_tmp_ssl_cert") do
116+
it { is_expected.to be_file }
117+
end
118+
119+
describe file("#{apache_hash['httpd_dir']}/puppet_ssl/test_ssl_tmp_ssl_key") do
120+
it { is_expected.to be_file }
121+
end
122+
123+
describe file("#{apache_hash['httpd_dir']}/puppet_ssl/test_ssl_tmp_ssl_chain") do
124+
it { is_expected.to be_file }
125+
end
126+
127+
describe file("#{apache_hash['httpd_dir']}/puppet_ssl/test_ssl_tmp_ssl_ca") do
128+
it { is_expected.to be_file }
129+
end
130+
131+
describe file("#{apache_hash['httpd_dir']}/puppet_ssl/test_ssl_tmp_ssl_crl") do
132+
it { is_expected.to be_file }
133+
end
102134
end
103135

104136
describe 'vhost ssl ssl_ca only' do

‎spec/classes/mod/ssl_spec.rb

+12
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,18 @@
127127
it { is_expected.to contain_file('ssl.conf').with_content(%r{^ SSLCACertificateFile}) }
128128
end
129129

130+
context 'setting ssl_cert with reload' do
131+
let :params do
132+
{
133+
ssl_cert: '/etc/pki/some/path/localhost.crt',
134+
ssl_reload_on_change: true,
135+
}
136+
end
137+
138+
it { is_expected.to contain_file('ssl.conf').with_content(%r{^ SSLCertificateFile}) }
139+
it { is_expected.to contain_file('_etc_pki_some_path_localhost.crt') }
140+
end
141+
130142
context 'with Apache version < 2.4 - ssl_compression with default value' do
131143
let :params do
132144
{

‎spec/defines/vhost_spec.rb

+10-1
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@
7171
'ssl_key' => '/ssl/key',
7272
'ssl_chain' => '/ssl/chain',
7373
'ssl_crl_path' => '/ssl/crl',
74-
'ssl_crl' => 'foo.crl',
74+
'ssl_crl' => '/ssl/foo.crl',
7575
'ssl_certs_dir' => '/ssl/certs',
7676
'ssl_protocol' => 'SSLv2',
7777
'ssl_cipher' => 'HIGH',
@@ -88,6 +88,7 @@
8888
'ssl_proxy_cipher_suite' => 'HIGH',
8989
'ssl_proxy_protocol' => 'TLSv1.2',
9090
'ssl_user_name' => 'SSL_CLIENT_S_DN_CN',
91+
'ssl_reload_on_change' => true,
9192
'priority' => '30',
9293
'default_vhost' => true,
9394
'servername' => 'example.com',
@@ -516,6 +517,10 @@
516517
content: %r{^\s+SSLSessionCacheTimeout 300$},
517518
)
518519
}
520+
it { is_expected.to contain_file('rspec.example.com_ssl_cert') }
521+
it { is_expected.to contain_file('rspec.example.com_ssl_key') }
522+
it { is_expected.to contain_file('rspec.example.com_ssl_chain') }
523+
it { is_expected.to contain_file('rspec.example.com_ssl_foo.crl') }
519524
it { is_expected.to contain_class('apache::mod::mime') }
520525
it { is_expected.to contain_class('apache::mod::vhost_alias') }
521526
it { is_expected.to contain_class('apache::mod::wsgi') }
@@ -1859,6 +1864,10 @@
18591864
it { is_expected.not_to contain_class('apache::mod::proxy') }
18601865
it { is_expected.not_to contain_class('apache::mod::proxy_http') }
18611866
it { is_expected.not_to contain_class('apache::mod::headers') }
1867+
it { is_expected.not_to contain_file('rspec.example.com_ssl_cert') }
1868+
it { is_expected.not_to contain_file('rspec.example.com_ssl_key') }
1869+
it { is_expected.not_to contain_file('rspec.example.com_ssl_chain') }
1870+
it { is_expected.not_to contain_file('rspec.example.com_ssl_foo.crl') }
18621871
it { is_expected.to contain_file('/var/www/foo') }
18631872
it {
18641873
is_expected.to contain_file('/tmp/logroot').with('ensure' => 'absent')

0 commit comments

Comments
 (0)