From 9c891f058bfa36e47a89578e4271888744a7e2d3 Mon Sep 17 00:00:00 2001
From: 12ww1160 <12ww1160@confdroid.com>
Date: Sun, 15 Mar 2026 16:29:32 +0100
Subject: [PATCH] OP#501 update template

---
 manifests/main/dirs.pp | 14 ++++++++++++++
 manifests/params.pp    | 13 +++++--------
 templates/nrpe_cfg.erb |  1 -
 3 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/manifests/main/dirs.pp b/manifests/main/dirs.pp
index 7008d4a..06b5512 100644
--- a/manifests/main/dirs.pp
+++ b/manifests/main/dirs.pp
@@ -33,4 +33,18 @@ class confdroid_nrpe::main::dirs (
     seltype  => var_run_t,
     seluser  => system_u,
   }
+
+  if $ne_enable_ssl {
+    file { $ne_servercert_dir:
+      ensure   => directory,
+      path     => $ne_servercert_dir,
+      owner    => 'root',
+      group    => 'root',
+      mode     => '0755',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => cert_t,
+      seluser  => system_u,
+    }
+  }
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index 309d5b2..7ff49c8 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -32,9 +32,6 @@
 #   NRPE daemon will wait for a connection to be established before exiting.
 # @param [String] ne_ssl_version These directives allow you to specify how to
 #   use SSL/TLS.
-# @param [String] ne_ssl_use_adh This is for backward compatibility and is
-#   DEPRECATED. Set to 1 to enable ADH or 2 to require ADH. 1 is currently the
-#   default but will be changed in a later version.
 # @param [String] ne_ssl_cipher_list ciphers can be used. For backward
 #   compatibility, this defaults to 'ssl_cipher_list=ALL:!MD5:@STRENGTH' in
 #   this version but will be changed in a later version of NRPE.
@@ -115,9 +112,8 @@ class confdroid_nrpe::params (
   String $ne_allow_weak_rnd_seed          = '1',
   Boolean $ne_enable_ssl                  = false,
   String $ne_ssl_version                  = 'TLSv2+',
-  String $ne_ssl_use_adh                  = '1',
   String $ne_ssl_cipher_list              = 'ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH',
-  String $ne_ssl_client_certs             = '2',
+  String $ne_ssl_client_certs             = '0',
   String $ne_ssl_logging                  = '0x00',
   Array $ne_nasty_metachars               = ["|`&><'\\[]{};\r\n"],
   String $ne_include_file                 = '',
@@ -150,6 +146,7 @@ class confdroid_nrpe::params (
 # directories
   $ne_main_conf_d_dir         = '/etc/nrpe.d'
   $ne_run_dir                 = '/var/run/nrpe'
+  $ne_servercert_dir           = '/etc/pki/tls/servercerts'
 
 # files
   $ne_main_conf_file          = '/etc/nagios/nrpe.cfg'
@@ -168,11 +165,11 @@ class confdroid_nrpe::params (
   $ne_checkmodule_nrpe_erb    = 'confdroid_nrpe/checkmodule_nrpe.erb'
   $ne_nrpe_pp_file            = "${ne_main_conf_d_dir}/nrpe.pp"
   $ne_semodule_erb            =  'confdroid_nrpe/semodule_nrpe.erb'
-  $ne_ssl_cert_file           = '/etc/pki/tls/certs/nagios.crt.pem'
+  $ne_ssl_cert_file           = "${ne_servercert_dir}/nagios-crt.pem"
   $ne_ssl_cert_erb            = 'confdroid_nrpe/ssl_cert.erb'
-  $ne_ssl_privatekey_file     = '/etc/pki/tls/private/nagios.key.pem'
+  $ne_ssl_privatekey_file     = "${ne_servercert_dir}/nagios-key.pem"
   $ne_ssl_privatekey_erb      = 'confdroid_nrpe/ssl_privatekey.erb'
-  $ne_ssl_ca_cert_file        = '/etc/pki/tls/certs/ca-chain.crt.pem'
+  $ne_ssl_ca_cert_file        = "${ne_servercert_dir}/ca-cert.pem"
   $ne_ssl_ca_cert_erb         = 'confdroid_nrpe/ssl_ca_cert.erb'
 
 # includes must be last
diff --git a/templates/nrpe_cfg.erb b/templates/nrpe_cfg.erb
index 8031930..e3984e2 100644
--- a/templates/nrpe_cfg.erb
+++ b/templates/nrpe_cfg.erb
@@ -35,7 +35,6 @@ allow_weak_random_seed=<%= @ne_allow_weak_rnd_seed %>
 
 <% if @ne_enable_ssl == true -%>
 ssl_version=<%= @ne_ssl_version %>
-ssl_use_adh=<%= @ne_ssl_use_adh %>
 ssl_cipher_list=<%= @ne_ssl_cipher_list %>
 ssl_cacert_file=<%= @ne_ssl_ca_cert_file %>
 ssl_cert_file=<%= @ne_ssl_cert_file %>