It is very recommendable to define such commands directly within Puppet modules or profiles, so any node running the particular service controlled by the module will automatically get the required check commands defined as well, while nodes not running the service also do not contain the command check. The same then is true for Nagios checks, so you would have both the NRPE command definition and the Nagios check contained in Puppet modules or profiles to have it in one location.
-It is very recommendable to define such commands directly within Puppet modules or profiles, so any node running the particular service controlled by the module will automatically get the required check commands defined as well, while nodes not running the service also do not contain the command check. The same then is true for Nagios checks, so you would have both the NRPE command definition and the Nagios check contained in Puppet modules or profiles to have it in one location.
-# File 'manifests/main/files.pp', line 6
@@ -294,6 +306,18 @@ class confdroid_nrpe::main::files (
seluser => system_u,
content => template($ne_ssl_privatekey_erb),
}
+ file { $ne_ssl_ca_cert_file:
+ ensure => file,
+ path => $ne_ssl_ca_cert_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0644',
+ selrange => s0,
+ selrole => object_r,
+ seltype => cert_t,
+ seluser => system_u,
+ content => template($ne_ssl_ca_cert_erb),
+ }
}
}
}
diff --git a/doc/puppet_classes/confdroid_nrpe_3A_3Aparams.html b/doc/puppet_classes/confdroid_nrpe_3A_3Aparams.html
index 632eb73..5d42b30 100644
--- a/doc/puppet_classes/confdroid_nrpe_3A_3Aparams.html
+++ b/doc/puppet_classes/confdroid_nrpe_3A_3Aparams.html
@@ -777,6 +777,24 @@ inherited by all classes except defines.
—
Optional parameter to specify the content of the nagios server ssl private key. This is used for the nagios server private key and has to be provided via Hiera or ENC. Must be specified if SSL is enabled.
+Optional parameter to specify the content of the CA certificate. This is used for the CA certificate and has to be provided via Hiera or ENC. Must be specified if SSL is enabled.
-86 -87 -88 89 90 91 @@ -890,10 +905,16 @@ inherited by all classes except defines. 174 175 176 -177+177 +178 +179 +180 +181 +182 +183
# File 'manifests/params.pp', line 86
+ # File 'manifests/params.pp', line 89
class confdroid_nrpe::params (
@@ -935,6 +956,7 @@ class confdroid_nrpe::params (
String $ne_include_file = '',
Optional[String] $ne_ssl_cert_pem = undef,
Optional[String] $ne_ssl_privatekey_pem = undef,
+ Optional[String] $ne_ssl_ca_cert_pem = undef,
# nrpe.conf
String $ne_ssl_opts = '',
@@ -983,6 +1005,8 @@ class confdroid_nrpe::params (
$ne_ssl_cert_erb = 'confdroid_nrpe/ssl_cert.erb'
$ne_ssl_privatekey_file = "/etc/pki/tls/private/${fqdn}.key.pem"
$ne_ssl_privatekey_erb = 'confdroid_nrpe/ssl_privatekey.erb'
+ $ne_ssl_ca_cert_file = "/etc/pki/tls/certs/${fqdn}-ca-chain.crt.pem"
+ $ne_ssl_ca_cert_erb = 'confdroid_nrpe/ssl_ca_cert.erb'
# includes must be last
include confdroid_nrpe::main::config