adding variables and place holders for certs

README.md

@@ -28,7 +28,7 @@ NRPE allows monitoring tools like NAGIOS or ICINGA to connect to clients for mon
 
 ## WARNING
 
-***Attention: Never use this puppet module on systems which have been previously configured manually. It is impossible to predict how and what would have been configured, hence previous configurations outside the scope of this module may be overwritten! Automated configurations require a test environment to verify that the module suits the purpose intended by the user, as well as tune the parameters, before deploying into live production***
+> **Attention: Never use this puppet module on systems which have been previously configured manually. It is impossible to predict how and what would have been configured, hence previous configurations outside the scope of this module may be overwritten! Automated configurations require a test environment to verify that the module suits the purpose intended by the user, as well as tune the parameters, before deploying into live production**
 
 ## Features
 

manifests/main/files.pp

@@ -69,5 +69,33 @@ class confdroid_nrpe::main::files (
       content  => template($ne_nrpe_te_erb),
       notify   => Exec['create_nrpe_pp'],
     }
+
+    # file for ssl certificate
+    if $ne_enable_ssl == true {
+      file { $ne_ssl_cert_file:
+        ensure   => file,
+        path     => $ne_ssl_cert_file,
+        owner    => 'root',
+        group    => 'root',
+        mode     => '0644',
+        selrange => s0,
+        selrole  => object_r,
+        seltype  => cert_t,
+        seluser  => system_u,
+        content  => template($ne_ssl_cert_erb),
+      }
+      file { $ne_ssl_privatekey_file:
+        ensure   => file,
+        path     => $ne_ssl_privatekey_file,
+        owner    => 'root',
+        group    => 'root',
+        mode     => '0600',
+        selrange => s0,
+        selrole  => object_r,
+        seltype  => cert_t,
+        seluser  => system_u,
+        content  => template($ne_ssl_privatekey_erb),
+      }
+    }
   }
 }

manifests/params.pp

@@ -74,6 +74,14 @@
 # @param [Array] reqpackages which packages to install
 # @param [Boolean] ne_manage_cmds Whether to manage command rules for NRPE
 #   checks, to allow dynamic check & command rules.
+# @param [String] ne_ssl_cert_pem Optional parameter to specify the content of 
+#   the nagios server ssl certificate. This is used for the nagios server 
+#   certificate and has to be provided via Hiera or ENC. Must be specified if 
+#   SSL is enabled.
+# @param [String] ne_ssl_privatekey_pem Optional parameter to specify the content of 
+#   the nagios server ssl private key. This is used for the nagios server 
+#   private key and has to be provided via Hiera or ENC. Must be specified if 
+#   SSL is enabled.
 ###############################################################################
 class confdroid_nrpe::params (
 
@@ -113,6 +121,8 @@ class confdroid_nrpe::params (
   String $ne_ssl_logging                  = '0x00',
   Array $ne_nasty_metachars               = ["|`&><'\\[]{};\r\n"],
   String $ne_include_file                 = '',
+  Optional[String] $ne_ssl_cert_pem       = undef,
+  Optional[String] $ne_ssl_privatekey_pem = undef,
 
 # nrpe.conf
   String $ne_ssl_opts                     = '',
@@ -158,7 +168,9 @@ class confdroid_nrpe::params (
   $ne_nrpe_pp_file            = "${ne_main_conf_d_dir}/nrpe.pp"
   $ne_semodule_erb            =  'confdroid_nrpe/semodule_nrpe.erb'
   $ne_ssl_cert_file           = "/etc/pki/tls/certs/${fqdn}.crt.pem"
+  $ne_ssl_cert_erb            = 'confdroid_nrpe/ssl_cert.erb'
   $ne_ssl_privatekey_file     = "/etc/pki/tls/private/${fqdn}.key.pem"
+  $ne_ssl_privatekey_erb      = 'confdroid_nrpe/ssl_privatekey.erb'
 
 # includes must be last
   include confdroid_nrpe::main::config

templates/ssl_cert.erb

@@ -0,0 +1,3 @@
+<% unless $ne_ssl_cert_pem == undef -%>
+<%= $ne_ssl_cert_pem %>
+<% end -%>

templates/ssl_privatekey.erb

@@ -0,0 +1,3 @@
+<% unless $ne_ssl_privatekey_pem == undef -%>
+<%= $ne_ssl_privatekey_pem %>
+<% end -%>