Working product.

10 files changed, 173 insertions, 145 deletions

diff --git a/manifests/authenticator/nginx.pp b/manifests/authenticator/nginx.pp
new file mode 100644
index 0000000..971c4ed
--- /dev/null
+++ b/manifests/authenticator/nginx.pp
@@ -0,0 +1,22 @@
+# Sets up nginx specific configuration, and provides access to
+# variables for enterpolating into nginx configurations
+#
+# These use the default cert name
+# @example
+# nginx::resource::server { 'servername':
+#   * => $letsescrypt::nginx::server_ssl
+# }
+# $letsencrypt::nginx::location_ssl
+# @param certbot_plugin_package
+#   Name of the system package providing this plugin.
+#   Populated through hiera.
+# @param manage_package
+#   If this class should manage the package.
+class letsencrypt::authenticator::nginx (
+  String $certbot_plugin_package,
+  Boolean $manage_package = true,
+) {
+  if $manage_package {
+    ensure_packages([$certbot_plugin_package])
+  }
+}
diff --git a/manifests/cert.pp b/manifests/cert.pp
index 061ace1..13e1c82 100644
--- a/manifests/cert.pp
+++ b/manifests/cert.pp
@@ -1,44 +1,78 @@
 # @summary A single certificate
-# TODO possibly default cert_name to $::fqdn instead
-# @param cert_name Name of the certificate
+# @param cert_name
+#   Name of the certificate, can be anything, but $::fqdn is recommended
 # @param ensure    Present or absent (currently does nothing)
-# @param include_self Should the certificates name be one of its domains?
+# @param include_self
+#   Should the certificates name be one of its domains?
+# @param authenticator
+#   How should the challenge be handled.
+# @param domains
+#   List of domains to add to certificate
+# @param config
+#   Additional config for this entry
 define letsencrypt::cert (
+  Letsencrypt::Authenticator $authenticator,
   String $cert_name                 = $name,
   Enum['present', 'absent'] $ensure = 'present',
   Boolean $include_self             = true,
+  Array[String] $domains            = [],
+  Hash[String, Any] $config         = {},
 ) {
-  # TODO these env files are systemd specific
-  # TODO concat::fragment is clumsy, look at re-implementing the
-  # functionallity internally
+  $conf_file   = "${letsencrypt::config_dir}/${cert_name}.ini"
+  $domain_file = "${letsencrypt::config_dir}/${cert_name}.domains"
 
-  concat { "${letsencrypt::config_dir}/env/${cert_name}":
-    ensure => present,
-    warn   => true,
+  include "::letsencrypt::authenticator::${authenticator}"
+
+  $local_conf = {
+    'cert-name'           => $cert_name,
+    'rsa-key-size'        => 4096,
+    'authenticator'       => $authenticator,
+    'agree-tos'           => true,
+    'quiet'               => true,
+    'keep-until-expiring' => true,
+    'non-interactive'     => true,
   }
 
-  $cert_preamble = @(EOF)
-    AUTHENTICATOR = ''
-    POST_HOOK = ''
-    DOMAINS =
-    |- EOF
+  $conf = $letsencrypt::config_ + $local_conf + $config
 
-  concat::fragment { "letsencrypt ${cert_name} preamble":
-    target  => "${letsencrypt::config_dir}/env/${cert_name}",
-    order   => '0',
-    content => $cert_preamble,
+  file { $conf_file:
+    ensure  => file,
+    content => epp("${module_name}/ini.epp", { 'values' => $conf }),
   }
 
-  concat::fragment { "letsencrypt ${cert_name} postamble":
-    target  => "${letsencrypt::config_dir}/env/${cert_name}",
-    order   => '99',
-    content => "\n\n",
+  concat { $domain_file:
+    ensure_newline => true,
+    warn           => true,
   }
 
-  if $include_self {
-    letsencrypt::domain { $cert_name: }
+  $domains.each |$domain| {
+    letsencrypt::domain { $domain:
+      cert_name => $cert_name,
+    }
+  }
+  if $include_self and ! $cert_name in $domains {
+    letsencrypt::domain { $cert_name:
+      cert_name => $cert_name,
+    }
   }
 
   letsencrypt::renew { $cert_name:
   }
+
+  # This might be incorrect. If a certificate of that name already
+  # exists then the new certificate will instead be called
+  # ${cert-name}-0001. See
+  # https://eff-certbot.readthedocs.io/en/stable/using.html#where-are-my-certificates
+  exec { "letsencrypt - get initial ${cert_name}":
+    creates => "${letsencrypt::cert_dir}/${cert_name}",
+    command => [$letsencrypt::renew::setup::renew_script, $cert_name],
+    require => File[$letsencrypt::renew::setup::renew_script],
+  }
+
+  exec { "letsencrypt - refresh ${cert_name}":
+    command     => [$letsencrypt::renew::setup::renew_script, $cert_name],
+    subscribe   => [File[$conf_file], Concat[$domain_file]],
+    refreshonly => true,
+    require     => File[$letsencrypt::renew::setup::renew_script],
+  }
 }
diff --git a/manifests/domain.pp b/manifests/domain.pp
index 9e6b377..1f9fa40 100644
--- a/manifests/domain.pp
+++ b/manifests/domain.pp
@@ -1,20 +1,15 @@
-# A single domain belonging to a certificate
-# @example
-# letsencrypt::domain { 'www.example.com':
-#   cert_name => 'example.com',
-# }
-# @param domain_name Hostname which should be included in the target certificate
-# @param cert_name Certificate to add the hostname to
+# @summary
+#   A single domain name which should be part of a certificate
+# @param cert_name
+#   Which certificate this domain name belongs to
+# @param domain_name
+#   The domain name to be added
 define letsencrypt::domain (
+  String $cert_name,
   String $domain_name = $name,
-  String $cert_name   = $::facts['fqdn'],
 ) {
-  ensure_resource('letsencrypt::cert', $cert_name, {
-      ensure => present,
-  })
-
-  concat::fragment { "letsencrypt ${cert_name} - ${domain_name}":
-    target  => "${letsencrypt::config_dir}/env/${cert_name}",
-    content => " -d ${domain_name}",
+  concat::fragment { "Letsencrypt::Domain - ${cert_name} - ${domain_name}":
+    target  => "${letsencrypt::config_dir}/${cert_name}.domains",
+    content => $domain_name,
   }
 }
diff --git a/manifests/init.pp b/manifests/init.pp
index cc72b32..d6fb5f6 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,38 +1,53 @@
 # @summary Sets up letsencrypt for other classes
 # @param email Contact email sent to letsencrypt
-# @param config_dir Location of configuration files
-# @param default_cert Should a certificate be automatically configured
-# @param default_cert_name
-#   The name (and domain) of the automatically configured centificate.
+# @param manage_package
+#   Should the certbot package resource be managed by this class
+# @param certbot_package
+#   Name of the certbot package. Should be automatically set through hiera.
+# @param server
+#   Server providing ACME challenge
+# @param renewal_provider
+#   Service responsible for periodically renewing the certificate
+# @param config
+#   Default configuration values to pass to certbot. $server and
+#   $email is added here if not explicitly set. It's later merged with
+#   a specific instance for each certificate.
 class letsencrypt (
   String $email,
-  Stdlib::Unixpath $config_dir = '/etc/letsencrypt',
-  String $default_cert_name = $::facts['fqdn'],
-  Boolean $default_cert = true,
-  # TODO renewal provider here?
+  Letsencrypt::Renewal_provider $renewal_provider, # hiera
+  String $certbot_package = 'certbot',
+  Boolean $manage_package = true,
+  String $server = 'https://acme-v02.api.letsencrypt.org/directory',
+  Hash[String, Any] $config = {},
 ) {
-  if $default_cert {
-    letsencrypt::cert { $default_cert_name:
-      ensure => present,
-    }
-  }
+  # if $default_cert {
+  #   letsencrypt::cert { $default_cert_name:
+  #     ensure => present,
+  #   }
+  # }
 
-  file { $config_dir:
-    ensure => directory,
-  }
+  # These are internal instead of parameters, since certbot appears to
+  # not accept them in other places. This might prove wrong (BSD?), in
+  # that case: make them parameters again, and resolve the few remaining
+  # instances where they are hard coded.
+  $config_dir = '/etc/letsencrypt'
+  $cert_dir = "${config_dir}/live"
 
-  $cli_conf = @("EOF")
-    email = ${email}
-    | EOF
+  # Used by letsencrypt::cert
+  $config_ = {
+    'server' => $server,
+    'email'  => $email,
+  } + $config
 
-  file { "${config_dir}/cli.ini":
-    content => $cli_conf,
+  file { $config_dir:
+    ensure => directory,
   }
 
   include letsencrypt::renew::setup
 
-  # Boolean indicating if ssl is configured. Mainly used by
-  # letsencrypt::nginx and similar classes to determine their export
-  # of their variable $ssl.
-  $ssl_configured = 'letsencrypt_director$' in keys($facts)
+  if $manage_package {
+    package { $certbot_package:
+      ensure => installed,
+    }
+  }
 }
diff --git a/manifests/nginx.pp b/manifests/nginx.pp
deleted file mode 100644
index 75b5b48..0000000
--- a/manifests/nginx.pp
+++ /dev/null
@@ -1,52 +0,0 @@
-# Sets up nginx specific configuration, and provides access to
-# variables for enterpolating into nginx configurations
-#
-# These use the default cert name
-# @example
-# nginx::resource::server { 'servername':
-#   * => $letsescrypt::nginx::server_ssl
-# }
-# $letsencrypt::nginx::location_ssl
-#
-# @param certbot_plugin_package
-#   Name of the system package providing this plugin.
-#   Populated through hiera.
-# @param manage_package
-#   If this class should manage the package.
-class letsencrypt::nginx (
-  String $certbot_plugin_package,
-  Boolean $manage_package = true,
-) {
-  # TODO $cert_path should use the default certificate name.
-  # There should however also be a hash of all configured
-  # certificates.
-  $cert_path = "${letsencrypt::config_dir}/live/${letsencrypt::config_dir::default_cert_name}"
-
-  $server_ssl = if $letsencrypt::ssl_configured {
-    {
-      ssl          => true,
-      ssl_redirect => true,
-      ssl_cert     => "${cert_path}/fullchain.pem",
-      ssl_key      => "${cert_path}/privkey.pem",
-    }
-  } else {
-    {
-      ssl => false,
-    }
-  }
-
-  $location_ssl = if $letsencrypt::ssl_configured {
-    {
-      ssl      => true,
-      ssl_only => true,
-    }
-  } else {
-    {
-      ssl => false,
-    }
-  }
-
-  if $manage_package {
-    ensure_packages([$certbot_plugin_package])
-  }
-}
diff --git a/manifests/renew.pp b/manifests/renew.pp
index 97cf5e9..ce6fbee 100644
--- a/manifests/renew.pp
+++ b/manifests/renew.pp
@@ -6,10 +6,7 @@
 define letsencrypt::renew (
   String $cert_name = $name,
 ) {
-  # TODO this is systemd specific
-  # TODO ensure letsencrypt::renew::setup is included beforehand
-  service { "${letsencrypt::renew::systemd::service_name}@${cert_name}.timer":
-    ensure => 'running',
-    enable => true,
+  Resource["letsencrypt::renew::${letsencrypt::renew::setup::provider}"] { $cert_name:
+    cert_name => $cert_name,
   }
 }
diff --git a/manifests/renew/cron.pp b/manifests/renew/cron/setup.pp
index 37aa3fb..d6cb51b 100644
--- a/manifests/renew/cron.pp
+++ b/manifests/renew/cron/setup.pp
@@ -1,6 +1,6 @@
 # Handles renewal certificates through CRON
-# private
-class letsencrypt::renew::cron (
+# @api private
+class letsencrypt::renew::cron::setup (
 ) {
   fail('Not yet implemented')
 }
diff --git a/manifests/renew/setup.pp b/manifests/renew/setup.pp
index 8b4708b..7ba6a1b 100644
--- a/manifests/renew/setup.pp
+++ b/manifests/renew/setup.pp
@@ -1,18 +1,17 @@
 # Sets up timers for automatically renewing certificates
-# TODO
-# - make provider OS dependant
-# - is provider the correct name?
 # @param provider
 #   How the renewal should be managed.
 # @api private
 class letsencrypt::renew::setup (
-  Enum['systemd', 'cron'] $provider = 'systemd',
+  Letsencrypt::Renewal_provider $provider = $letsencrypt::renewal_provider,
 ) {
-  file { [
-      '/etc/letsencrypt/env',
-    ]:
-      ensure => directory,
-  }
+  include "::letsencrypt::renew::${provider}::setup"
+
+  # also used by letsencrypt::cert
+  $renew_script = "${letsencrypt::config_dir}/renew_cert"
 
-  include "::letsencrypt::renew::${provider}"
+  file { $renew_script:
+    source => "puppet:///modules/${module_name}/run_certbot.py",
+    mode   => '0555',
+  }
 }
diff --git a/manifests/renew/systemd.pp b/manifests/renew/systemd.pp
index 8c63f23..f64e7e5 100644
--- a/manifests/renew/systemd.pp
+++ b/manifests/renew/systemd.pp
@@ -1,16 +1,11 @@
-# Handles renewal certificates through systemd timers
-# @param service_name Target name of the service file
-# @param service_path Where the service file should be installed
 # @api private
-class letsencrypt::renew::systemd (
-  String $service_name = 'letsencrypt-renew',
-  String $service_path = '/etc/systemd/system',
+define letsencrypt::renew::systemd (
+  String $cert_name = $name
 ) {
-  file { "${service_path}/${service_name}@.service":
-    source => "puppet:///modules/${module_name}/letsencrypt-renew.service",
-  }
-
-  file { "${service_path}/${service_name}@.timer":
-    source => "puppet:///modules/${module_name}/letsencrypt-renew.timer",
+  require letsencrypt::renew::systemd::setup
+  $service = $letsencrypt::renew::systemd::setup::service_name
+  service { "${service}@${cert_name}.timer":
+    ensure => 'running',
+    enable => true,
   }
 }
diff --git a/manifests/renew/systemd/setup.pp b/manifests/renew/systemd/setup.pp
new file mode 100644
index 0000000..5839efc
--- /dev/null
+++ b/manifests/renew/systemd/setup.pp
@@ -0,0 +1,23 @@
+# Handles renewal certificates through systemd timers
+# @param service_name Target name of the service file
+# @param service_path Where the service file should be installed
+# @api private
+class letsencrypt::renew::systemd::setup (
+  String $service_name = 'letsencrypt-renew',
+  String $service_path = '/etc/systemd/system',
+) {
+  file { "${service_path}/${service_name}@.service":
+    source => "puppet:///modules/${module_name}/letsencrypt-renew.service",
+    notify => Exec['systemctl daemon-reload'],
+  }
+
+  file { "${service_path}/${service_name}@.timer":
+    source => "puppet:///modules/${module_name}/letsencrypt-renew.timer",
+    notify => Exec['systemctl daemon-reload'],
+  }
+
+  exec { 'systemctl daemon-reload':
+    refreshonly => true,
+    provider    => shell,
+  }
+}