refs #8175 - certificates for dispatch router

manifests/capsule.pp

@@ -26,6 +26,7 @@
   class { 'certs::apache':        hostname => $capsule_fqdn }
   class { 'certs::qpid':          hostname => $capsule_fqdn }
   class { 'certs::pulp_child':    hostname => $capsule_fqdn }
+  class { 'certs::qpid_router':   hostname => $capsule_fqdn }
 
   if $certs_tar {
     certs::tar_create { $certs_tar:

manifests/params.pp

@@ -93,6 +93,13 @@
 
   $messaging_client_cert = "${pki_dir}/qpid_client_striped.crt"
 
+  $qpid_dispatch_server_cert = "/etc/qpid-dispatch/server.crt"
+  $qpid_dispatch_client_cert = "/etc/qpid-dispatch/client.crt"
+  $qpid_dispatch_server_key  = "/etc/qpid-dispatch/server.key"
+  $qpid_dispatch_client_key  = "/etc/qpid-dispatch/client.key"
+  $qpid_dispatch_owner       = "qpidd"
+  $qpid_dispatch_group       = "root"
+
   $pulp_server_ca_cert   = '/etc/pki/pulp/server_ca.crt'
   # Pulp expects the node certificate to be located on this very location
   $nodes_cert_dir        = '/etc/pki/pulp/nodes'

manifests/qpid_router.pp

@@ -0,0 +1,89 @@
+# Constains certs specific configurations for qpid_dispatch
+class certs::qpid_router(
+  $hostname               = $::certs::node_fqdn,
+  $generate               = $::certs::generate,
+  $regenerate             = $::certs::regenerate,
+  $deploy                 = $::certs::deploy,
+  $server_cert            = $::certs::qpid_dispatch_server_cert,
+  $client_cert            = $::certs::qpid_dispatch_client_cert,
+  $server_key             = $::certs::qpid_dispatch_server_key,
+  $client_key             = $::certs::qpid_dispatch_client_key,
+  $owner                  = $::certs::qpid_dispatch_owner,
+  $group                  = $::certs::qpid_dispatch_group,
+) inherits certs::params {
+
+  $server_keypair = "${hostname}-qdrouterd-server"
+  $client_keypair = "${hostname}-qdrouterd-client"
+
+  cert { $server_keypair:
+    ensure        => present,
+    hostname      => $hostname,
+    country       => $::certs::country,
+    state         => $::certs::state,
+    city          => $::certs::sity,
+    org           => 'dispatch server',
+    org_unit      => $::certs::org_unit,
+    expiration    => $::certs::expiration,
+    ca            => $::certs::default_ca,
+    generate      => $generate,
+    regenerate    => $regenerate,
+    deploy        => $deploy,
+    purpose       => server,
+    password_file => $certs::ca_key_password_file,
+  }
+
+  cert { $client_keypair:
+    ensure        => present,
+    hostname      => $hostname,
+    country       => $::certs::country,
+    state         => $::certs::state,
+    city          => $::certs::sity,
+    org           => 'dispatch client',
+    org_unit      => $::certs::org_unit,
+    expiration    => $::certs::expiration,
+    ca            => $::certs::default_ca,
+    generate      => $generate,
+    regenerate    => $regenerate,
+    deploy        => $deploy,
+    purpose       => client,
+    password_file => $certs::ca_key_password_file,
+  }
+
+  if $deploy {
+    Cert[$server_keypair] ~>
+    privkey { $server_key:
+      key_pair => Cert[$server_keypair]
+    } ~>
+    file { $server_key:
+      owner => $owner,
+      group => $group,
+      mode  => '0640',
+    } ~>
+    pubkey { $server_cert:
+      key_pair => Cert[$server_keypair]
+    } ~>
+    file { $server_cert:
+      owner => $owner,
+      group => $group,
+      mode  => '0640',
+    }
+
+    Cert[$client_keypair] ~>
+    privkey { $client_key:
+      key_pair => Cert[$client_keypair]
+    } ~>
+    file { $client_key:
+      owner => $owner,
+      group => $group,
+      mode  => '0640',
+    } ~>
+    pubkey { $client_cert:
+      key_pair => Cert[$client_keypair]
+    } ~>
+    file { $client_cert:
+      owner => $owner,
+      group => $group,
+      mode  => '0640',
+    }
+  }
+}