Recommit for updates in build 43

Jenkinsfile

@@ -1,124 +0,0 @@
-pipeline {
-    agent any
-
-    post {
-        always {
-            deleteDir() /* clean up our workspace */
-        }
-        success {
-            updateGitlabCommitStatus state: 'success'
-        }
-        failure {
-            updateGitlabCommitStatus state: 'failed'
-            step([$class: 'Mailer', notifyEveryUnstableBuild: true, recipients: 'support@confdroid.com', sendToIndividuals: true])
-        }
-    }
-
-    options {
-          gitLabConnection('gitlab.confdroid.com')
-    }
-
-    stages {
-
-      stage('pull master') {
-        steps {
-          sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) {
-            sh '''
-                git config user.name "Jenkins Server"
-                git config user.email jenkins@confdroid.com
-                # Ensure we're on the development branch (triggered by push)
-                git checkout development
-                # Create jenkins branch from development
-                git checkout -b jenkins-build-$BUILD_NUMBER
-                # Optionally merge master into jenkins to ensure compatibility
-                git merge origin/master --no-ff || { echo "Merge conflict detected"; exit 1; }
-            '''
-        }
-      }
-    }
-
-      stage('puppet parser') {
-        steps {
-          sh '''for file in $(find . -iname \'*.pp\'); do
-            /opt/puppetlabs/bin/puppet parser validate --color false --render-as s --modulepath=modules $file || exit 1;
-            done;'''
-          }
-        }
-
-      stage('check templates') {
-        steps{
-          sh '''for file in $(find . -iname \'*.erb\');
-            do erb -P -x -T "-" $file | ruby -c || exit 1;
-            done;'''
-        }
-      }
-
-      stage('puppet-lint') {
-        steps {
-          sh '''/usr/local/bin/puppet-lint . \\
-                --no-variable_scope-check \\
-                || { echo "Puppet lint failed"; exit 1; }
-            '''
-          }
-        }
-
-      stage('SonarScan') {
-         steps {
-            withCredentials([string(credentialsId: 'sonar-token', variable: 'SONAR_TOKEN')]) {
-              sh '''
-              /opt/sonar-scanner/bin/sonar-scanner \
-                -Dsonar.projectKey=confdroid_nrpe \
-                -Dsonar.sources=. \
-                -Dsonar.host.url=https://sonarqube.confdroid.com \
-                -Dsonar.token=$SONAR_TOKEN
-                '''
-              }
-            }
-          }
-
-      stage('create Puppet documentation') {
-        steps {
-          sh '/opt/puppetlabs/bin/puppet strings'
-        }
-      }
-
-      stage('update repo') {
-        steps {
-          sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) {
-            sh '''
-                git config user.name "Jenkins Server"
-                git config user.email jenkins@confdroid.com
-                git rm -r --cached .vscode || echo "No .vscode to remove from git"
-                git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit"
-                git push origin HEAD:master
-            '''
-        }
-      }
-    }
-
-      stage('Mirror to Gitea') {
-        steps {
-          withCredentials([usernamePassword(
-            credentialsId: 'Jenkins-gitea',
-            usernameVariable: 'GITEA_USER',
-            passwordVariable: 'GITEA_TOKEN')]) {
-            script {
-              // Checkout from GitLab (already done implicitly)
-                sh '''
-                  git checkout master
-                  git pull origin master
-                  git branch -D development
-                  git branch -D jenkins-build-$BUILD_NUMBER
-                  git rm -f Jenkinsfile
-                  git rm -r --cached .vscode || echo "No .vscode to remove from git"
-                  git commit --amend --no-edit --allow-empty
-                  git remote add master https://sourcecode.confdroid.com/confdroid/confdroid_nrpe.git
-                  git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \
-                  push master --mirror
-                  '''
-          }
-        }
-      }
-    }
-  }
-}

README.md

@@ -102,14 +102,20 @@ It is very recommendable to define such commands directly within Puppet modules
 
 ## managing TLS certificates
 
+When `ne_enable_ssl` is enabled (default), the certificates for the ca (root if standalone or intermediate), the nagios server and the key for the nagios server have to be provided through the following values:
+
+- `ne_ssl_ca_cert_pem`
+- `ne_ssl_cert_pem`
+- `ne_ssl_privatekey_pem`
+
+via Hiera (if you use it) or ENC.
+
 ## SELINUX
 
 All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.
 
 ## Known Problems
 
-- SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the `ssl_cert_file` line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the `$ne_enable_ssl` boolean parameter, which is set to `false` by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found.  Setting this option  to `true` will include all SSL / TLS settings.
-
 ## Troubleshooting
 
 - `CHECK_NRPE: Unable to read output`: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through `$ne_allow_sudo` and `$ne_include_selinux`.

doc/file.README.html

@@ -78,7 +78,7 @@
 </li><li>
 <p><a href="#managing-check-commands">Managing Check Commands</a></p>
 </li><li>
-<p><a href="#managing-tls-serts">managing TLS serts</a></p>
+<p><a href="#managing-tls-certificates">managing TLS certificates</a></p>
 </li><li>
 <p><a href="#selinux">SELINUX</a></p>
 </li><li>
@@ -191,16 +191,24 @@
 
 <p>It is very recommendable to define such commands directly within Puppet modules or profiles, so any node running the particular service controlled by the module will automatically get the required check commands defined as well, while nodes not running the service also do not contain the command check. The same then is true for Nagios checks, so you would have both the NRPE command definition and the Nagios check contained in Puppet modules or profiles to have it in one location.</p>
 
-<h2 id="label-managing+TLS+serts">managing TLS serts</h2>
+<h2 id="label-managing+TLS+certificates">managing TLS certificates</h2>
+
+<p>When <code>ne_enable_ssl</code> is enabled (default), the certificates for the ca (root if standalone or intermediate), the nagios server and the key for the nagios server have to be provided through the following values:</p>
+<ul><li>
+<p><code>ne_ssl_ca_cert_pem</code></p>
+</li><li>
+<p><code>ne_ssl_cert_pem</code></p>
+</li><li>
+<p><code>ne_ssl_privatekey_pem</code></p>
+</li></ul>
+
+<p>via Hiera (if you use it) or ENC.</p>
 
 <h2 id="label-SELINUX">SELINUX</h2>
 
 <p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.</p>
 
 <h2 id="label-Known+Problems">Known Problems</h2>
-<ul><li>
-<p>SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the <code>ssl_cert_file</code> line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the <code>$ne_enable_ssl</code> boolean parameter, which is set to <code>false</code> by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found. Setting this option to <code>true</code> will include all SSL / TLS settings.</p>
-</li></ul>
 
 <h2 id="label-Troubleshooting">Troubleshooting</h2>
 <ul><li>

doc/index.html

@@ -78,7 +78,7 @@
 </li><li>
 <p><a href="#managing-check-commands">Managing Check Commands</a></p>
 </li><li>
-<p><a href="#managing-tls-serts">managing TLS serts</a></p>
+<p><a href="#managing-tls-certificates">managing TLS certificates</a></p>
 </li><li>
 <p><a href="#selinux">SELINUX</a></p>
 </li><li>
@@ -191,16 +191,24 @@
 
 <p>It is very recommendable to define such commands directly within Puppet modules or profiles, so any node running the particular service controlled by the module will automatically get the required check commands defined as well, while nodes not running the service also do not contain the command check. The same then is true for Nagios checks, so you would have both the NRPE command definition and the Nagios check contained in Puppet modules or profiles to have it in one location.</p>
 
-<h2 id="label-managing+TLS+serts">managing TLS serts</h2>
+<h2 id="label-managing+TLS+certificates">managing TLS certificates</h2>
+
+<p>When <code>ne_enable_ssl</code> is enabled (default), the certificates for the ca (root if standalone or intermediate), the nagios server and the key for the nagios server have to be provided through the following values:</p>
+<ul><li>
+<p><code>ne_ssl_ca_cert_pem</code></p>
+</li><li>
+<p><code>ne_ssl_cert_pem</code></p>
+</li><li>
+<p><code>ne_ssl_privatekey_pem</code></p>
+</li></ul>
+
+<p>via Hiera (if you use it) or ENC.</p>
 
 <h2 id="label-SELINUX">SELINUX</h2>
 
 <p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.</p>
 
 <h2 id="label-Known+Problems">Known Problems</h2>
-<ul><li>
-<p>SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the <code>ssl_cert_file</code> line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the <code>$ne_enable_ssl</code> boolean parameter, which is set to <code>false</code> by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found. Setting this option to <code>true</code> will include all SSL / TLS settings.</p>
-</li></ul>
 
 <h2 id="label-Troubleshooting">Troubleshooting</h2>
 <ul><li>

doc/puppet_classes/confdroid_nrpe_3A_3Amain_3A_3Afiles.html

@@ -196,7 +196,18 @@
 98
 99
 100
-101</pre>
+101
+102
+103
+104
+105
+106
+107
+108
+109
+110
+111
+112</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/main/files.pp', line 6</span>
@@ -239,7 +250,6 @@ class confdroid_nrpe::main::files (
   }
 
   if $ne_allow_sudo == true {
-
     file { $ne_sudo_file:
       ensure   =&gt; file,
       path     =&gt; $ne_sudo_file,
@@ -267,33 +277,45 @@ class confdroid_nrpe::main::files (
       content  =&gt; template($ne_nrpe_te_erb),
       notify   =&gt; Exec[&#39;create_nrpe_pp&#39;],
     }
+  }
 
-    # file for ssl certificate
-    if $ne_enable_ssl == true {
-      file { $ne_ssl_cert_file:
-        ensure   =&gt; file,
-        path     =&gt; $ne_ssl_cert_file,
-        owner    =&gt; &#39;root&#39;,
-        group    =&gt; &#39;root&#39;,
-        mode     =&gt; &#39;0644&#39;,
-        selrange =&gt; s0,
-        selrole  =&gt; object_r,
-        seltype  =&gt; cert_t,
-        seluser  =&gt; system_u,
-        content  =&gt; template($ne_ssl_cert_erb),
-      }
-      file { $ne_ssl_privatekey_file:
-        ensure   =&gt; file,
-        path     =&gt; $ne_ssl_privatekey_file,
-        owner    =&gt; &#39;root&#39;,
-        group    =&gt; &#39;root&#39;,
-        mode     =&gt; &#39;0600&#39;,
-        selrange =&gt; s0,
-        selrole  =&gt; object_r,
-        seltype  =&gt; cert_t,
-        seluser  =&gt; system_u,
-        content  =&gt; template($ne_ssl_privatekey_erb),
-      }
+  # file for ssl certificate
+  if $ne_enable_ssl == true {
+    file { $ne_ssl_cert_file:
+      ensure   =&gt; file,
+      path     =&gt; $ne_ssl_cert_file,
+      owner    =&gt; &#39;root&#39;,
+      group    =&gt; &#39;root&#39;,
+      mode     =&gt; &#39;0644&#39;,
+      selrange =&gt; s0,
+      selrole  =&gt; object_r,
+      seltype  =&gt; cert_t,
+      seluser  =&gt; system_u,
+      content  =&gt; template($ne_ssl_cert_erb),
+    }
+    file { $ne_ssl_privatekey_file:
+      ensure   =&gt; file,
+      path     =&gt; $ne_ssl_privatekey_file,
+      owner    =&gt; &#39;root&#39;,
+      group    =&gt; &#39;root&#39;,
+      mode     =&gt; &#39;0600&#39;,
+      selrange =&gt; s0,
+      selrole  =&gt; object_r,
+      seltype  =&gt; cert_t,
+      seluser  =&gt; system_u,
+      content  =&gt; template($ne_ssl_privatekey_erb),
+    }
+    file { $ne_ssl_ca_cert_file:
+      ensure   =&gt; file,
+      path     =&gt; $ne_ssl_ca_cert_file,
+      owner    =&gt; &#39;root&#39;,
+      group    =&gt; &#39;root&#39;,
+      mode     =&gt; &#39;0644&#39;,
+      selrange =&gt; s0,
+      selrole  =&gt; object_r,
+      seltype  =&gt; cert_t,
+      seluser  =&gt; system_u,
+      content  =&gt; template($ne_ssl_ca_cert_erb),
     }
   }
 }</pre>

doc/puppet_classes/confdroid_nrpe_3A_3Aparams.html

@@ -699,7 +699,7 @@ inherited by all classes except defines.
         <span class='type'>(<tt>Boolean</tt>)</span>
       
       
-        <em class="default">(defaults to: <tt>false</tt>)</em>
+        <em class="default">(defaults to: <tt>true</tt>)</em>
       
       
         &mdash;
@@ -777,6 +777,24 @@ inherited by all classes except defines.
         &mdash;
         <div class='inline'>
 <p>Optional parameter to specify the content of the nagios server ssl private key. This is used for the nagios server private key and has to be provided via Hiera or ENC. Must be specified if SSL is enabled.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>ne_ssl_ca_cert_pem</span>
+      
+      
+        <span class='type'>(<tt>Optional[String]</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>undef</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Optional parameter to specify the content of the CA certificate. This is used for the CA certificate and has to be provided via Hiera or ENC. Must be specified if SSL is enabled.</p>
 </div>
       
     </li>
@@ -799,9 +817,6 @@ inherited by all classes except defines.
         <pre class="lines">
 
 
-86
-87
-88
 89
 90
 91
@@ -890,10 +905,16 @@ inherited by all classes except defines.
 174
 175
 176
-177</pre>
+177
+178
+179
+180
+181
+182
+183</pre>
       </td>
       <td>
-        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 86</span>
+        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 89</span>
 
 class confdroid_nrpe::params (
 
@@ -924,7 +945,7 @@ class confdroid_nrpe::params (
   String $ne_command_timeout              = &#39;60&#39;,
   String $ne_connection_timeout           = &#39;300&#39;,
   String $ne_allow_weak_rnd_seed          = &#39;1&#39;,
-  Boolean $ne_enable_ssl                  = false,
+  Boolean $ne_enable_ssl                  = true,
   String $ne_ssl_version                  = &#39;TLSv2+&#39;,
   String $ne_ssl_use_adh                  = &#39;1&#39;,
   String $ne_ssl_cipher_list              = &#39;ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH&#39;,
@@ -935,6 +956,7 @@ class confdroid_nrpe::params (
   String $ne_include_file                 = &#39;&#39;,
   Optional[String] $ne_ssl_cert_pem       = undef,
   Optional[String] $ne_ssl_privatekey_pem = undef,
+  Optional[String] $ne_ssl_ca_cert_pem    = undef,
 
 # nrpe.conf
   String $ne_ssl_opts                     = &#39;&#39;,
@@ -983,6 +1005,8 @@ class confdroid_nrpe::params (
   $ne_ssl_cert_erb            = &#39;confdroid_nrpe/ssl_cert.erb&#39;
   $ne_ssl_privatekey_file     = &quot;/etc/pki/tls/private/${fqdn}.key.pem&quot;
   $ne_ssl_privatekey_erb      = &#39;confdroid_nrpe/ssl_privatekey.erb&#39;
+  $ne_ssl_ca_cert_file        = &quot;/etc/pki/tls/certs/${fqdn}-ca-chain.crt.pem&quot;
+  $ne_ssl_ca_cert_erb         = &#39;confdroid_nrpe/ssl_ca_cert.erb&#39;
 
 # includes must be last
   include confdroid_nrpe::main::config

manifests/main/files.pp

@@ -41,7 +41,6 @@ class confdroid_nrpe::main::files (
   }
 
   if $ne_allow_sudo == true {
-
     file { $ne_sudo_file:
       ensure   => file,
       path     => $ne_sudo_file,
@@ -69,45 +68,45 @@ class confdroid_nrpe::main::files (
       content  => template($ne_nrpe_te_erb),
       notify   => Exec['create_nrpe_pp'],
     }
+  }
 
-    # file for ssl certificate
-    if $ne_enable_ssl == true {
-      file { $ne_ssl_cert_file:
-        ensure   => file,
-        path     => $ne_ssl_cert_file,
-        owner    => 'root',
-        group    => 'root',
-        mode     => '0644',
-        selrange => s0,
-        selrole  => object_r,
-        seltype  => cert_t,
-        seluser  => system_u,
-        content  => template($ne_ssl_cert_erb),
-      }
-      file { $ne_ssl_privatekey_file:
-        ensure   => file,
-        path     => $ne_ssl_privatekey_file,
-        owner    => 'root',
-        group    => 'root',
-        mode     => '0600',
-        selrange => s0,
-        selrole  => object_r,
-        seltype  => cert_t,
-        seluser  => system_u,
-        content  => template($ne_ssl_privatekey_erb),
-      }
-      file { $ne_ssl_ca_cert_file:
-        ensure   => file,
-        path     => $ne_ssl_ca_cert_file,
-        owner    => 'root',
-        group    => 'root',
-        mode     => '0644',
-        selrange => s0,
-        selrole  => object_r,
-        seltype  => cert_t,
-        seluser  => system_u,
-        content  => template($ne_ssl_ca_cert_erb),
-      }
+  # file for ssl certificate
+  if $ne_enable_ssl == true {
+    file { $ne_ssl_cert_file:
+      ensure   => file,
+      path     => $ne_ssl_cert_file,
+      owner    => 'root',
+      group    => 'root',
+      mode     => '0644',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => cert_t,
+      seluser  => system_u,
+      content  => template($ne_ssl_cert_erb),
+    }
+    file { $ne_ssl_privatekey_file:
+      ensure   => file,
+      path     => $ne_ssl_privatekey_file,
+      owner    => 'root',
+      group    => 'root',
+      mode     => '0600',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => cert_t,
+      seluser  => system_u,
+      content  => template($ne_ssl_privatekey_erb),
+    }
+    file { $ne_ssl_ca_cert_file:
+      ensure   => file,
+      path     => $ne_ssl_ca_cert_file,
+      owner    => 'root',
+      group    => 'root',
+      mode     => '0644',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => cert_t,
+      seluser  => system_u,
+      content  => template($ne_ssl_ca_cert_erb),
     }
   }
 }

manifests/params.pp

@@ -115,7 +115,7 @@ class confdroid_nrpe::params (
   String $ne_command_timeout              = '60',
   String $ne_connection_timeout           = '300',
   String $ne_allow_weak_rnd_seed          = '1',
-  Boolean $ne_enable_ssl                  = false,
+  Boolean $ne_enable_ssl                  = true,
   String $ne_ssl_version                  = 'TLSv2+',
   String $ne_ssl_use_adh                  = '1',
   String $ne_ssl_cipher_list              = 'ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH',