diff --git a/Jenkinsfile b/Jenkinsfile
deleted file mode 100644
index eca0f0d..0000000
--- a/Jenkinsfile
+++ /dev/null
@@ -1,124 +0,0 @@
-pipeline {
- agent {
- label 'puppet'
- }
-
- post {
- always {
- deleteDir() /* clean up our workspace */
- }
- success {
- updateGitlabCommitStatus state: 'success'
- }
- failure {
- updateGitlabCommitStatus state: 'failed'
- step([$class: 'Mailer', notifyEveryUnstableBuild: true, recipients: 'support@confdroid.com', sendToIndividuals: true])
- }
- }
-
- options {
- gitLabConnection('gitlab.confdroid.com')
- }
-
- stages {
-
- stage('pull master') {
- steps {
- sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) {
- sh '''
- git config user.name "Jenkins Server"
- git config user.email jenkins@confdroid.com
- # Ensure we're on the development branch (triggered by push)
- git checkout development
- # Create jenkins branch from development
- git checkout -b jenkins-build-$BUILD_NUMBER
- # Optionally merge master into jenkins to ensure compatibility
- git merge origin/master --no-ff || { echo "Merge conflict detected"; exit 1; }
- '''
- }
- }
- }
-
- stage('puppet parser') {
- steps {
- sh '''for file in $(find . -iname \'*.pp\'); do
- /opt/puppetlabs/bin/puppet parser validate --color false --render-as s --modulepath=modules $file || exit 1;
- done;'''
- }
- }
-
- stage('check templates') {
- steps{
- sh '''for file in $(find . -iname \'*.erb\');
- do erb -P -x -T "-" $file | ruby -c || exit 1;
- done;'''
- }
- }
-
- stage('puppet-lint') {
- steps {
- sh '''/usr/local/bin/puppet-lint . \\
- --no-variable_scope-check \\
- || { echo "Puppet lint failed"; exit 1; }
- '''
- }
- }
-
- stage('SonarScan') {
- steps {
- withCredentials([string(credentialsId: 'sonar-token', variable: 'SONAR_TOKEN')]) {
- sh '''
- /opt/sonar-scanner/bin/sonar-scanner \
- -Dsonar.projectKey=confdroid_postgresql \
- -Dsonar.sources=. \
- -Dsonar.host.url=https://sonarqube.confdroid.com \
- -Dsonar.token=$SONAR_TOKEN
- '''
- }
- }
- }
-
- stage('create Puppet documentation') {
- steps {
- sh '/opt/puppetlabs/bin/puppet strings'
- }
- }
-
- stage('update repo') {
- steps {
- sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) {
- sh '''
- git config user.name "Jenkins Server"
- git config user.email jenkins@confdroid.com
- git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit"
- git push origin HEAD:master
- '''
- }
- }
- }
-
- stage('Mirror to Gitea') {
- steps {
- withCredentials([usernamePassword(
- credentialsId: 'Jenkins-gitea',
- usernameVariable: 'GITEA_USER',
- passwordVariable: 'GITEA_TOKEN')]) {
- script {
- // Checkout from GitLab (already done implicitly)
- sh '''
- git checkout master
- git pull origin master
- git branch -D development
- git branch -D jenkins-build-$BUILD_NUMBER
- git rm -f Jenkinsfile
- git commit --amend --no-edit --allow-empty
- git remote add master https://gitea.confdroid.com/confdroid/confdroid_postgresql.git
- git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \
- push master --mirror
- '''
- }
- }
- }
- }
- }
-}
\ No newline at end of file
diff --git a/doc/file.README.html b/doc/file.README.html
index 39be227..0277b50 100644
--- a/doc/file.README.html
+++ b/doc/file.README.html
@@ -97,6 +97,8 @@
manage extensions (set pl_manage_extensionsto true)
install and manage pg_bouncer (set pl_use_pg_bouncerto true)
+
+enable SL / TLS manage TLS certificates (set pl_ssl_enabledto true and populate content externally through variables)
Repo Documentation
diff --git a/doc/index.html b/doc/index.html
index 9e12693..82a8274 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -97,6 +97,8 @@
manage extensions (set pl_manage_extensionsto true)
install and manage pg_bouncer (set pl_use_pg_bouncerto true)
+
+enable SL / TLS manage TLS certificates (set pl_ssl_enabledto true and populate content externally through variables)
Repo Documentation
diff --git a/doc/puppet_classes/confdroid_postgresql_3A_3Amain_3A_3Afiles.html b/doc/puppet_classes/confdroid_postgresql_3A_3Amain_3A_3Afiles.html
index f0e2c9d..71fa9d0 100644
--- a/doc/puppet_classes/confdroid_postgresql_3A_3Amain_3A_3Afiles.html
+++ b/doc/puppet_classes/confdroid_postgresql_3A_3Amain_3A_3Afiles.html
@@ -121,7 +121,49 @@
23
24
25
-26
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
+65
+66
+67
+68
# File 'manifests/main/files.pp', line 6
@@ -145,6 +187,48 @@ class confdroid_postgresql::main::files (
content => template('confdroid_postgresql/postgresql.conf.erb'),
notify => Service[$pl_service],
}
+ if $pl_ssl_enabled == true {
+ # manage tls certs
+ ## ca.crt
+ file { $pl_ca_crt_file:
+ ensure => file,
+ owner => 'postgres',
+ group => 'postgres',
+ mode => '0400',
+ selrange => s0,
+ selrole => object_r,
+ seltype => postgresql_db_t,
+ seluser => unconfined_u,
+ content => template($pl_ca_crt_erb),
+ notify => Service[$pl_service],
+ }
+ ## server.crt
+ file { $pl_server_crt_file:
+ ensure => file,
+ owner => 'postgres',
+ group => 'postgres',
+ mode => '0400',
+ selrange => s0,
+ selrole => object_r,
+ seltype => postgresql_db_t,
+ seluser => unconfined_u,
+ content => template($pl_server_crt_erb),
+ notify => Service[$pl_service],
+ }
+ ## server.key
+ file { $pl_server_key_file:
+ ensure => file,
+ owner => 'postgres',
+ group => 'postgres',
+ mode => '0400',
+ selrange => s0,
+ selrole => object_r,
+ seltype => postgresql_db_t,
+ seluser => unconfined_u,
+ content => template($pl_server_key_erb),
+ notify => Service[$pl_service],
+ }
+ }
}
}
|
diff --git a/doc/puppet_classes/confdroid_postgresql_3A_3Aparams.html b/doc/puppet_classes/confdroid_postgresql_3A_3Aparams.html
index 611038a..31de986 100644
--- a/doc/puppet_classes/confdroid_postgresql_3A_3Aparams.html
+++ b/doc/puppet_classes/confdroid_postgresql_3A_3Aparams.html
@@ -743,7 +743,13 @@
105
106
107
-108
+108
+109
+110
+111
+112
+113
+114
# File 'manifests/params.pp', line 38
@@ -810,6 +816,12 @@ class confdroid_postgresql::params (
$pl_bouncer_auth_file = "${pl_bouncer_dir}/userlist.txt"
$pl_bouncer_auth_erb = 'confdroid_postgresql/server/bouncer/bouncer_users.erb'
$pl_bouncer_rule_erb = 'confdroid_postgresql/server/bouncer/bouncer_rule.erb'
+ $pl_ca_crt_file = "${pl_data_dir}/ca.crt"
+ $pl_ca_crt_erb = 'confdroid_postgresql/server/ca.crt.erb'
+ $pl_server_crt_file = "${pl_data_dir}/server.crt"
+ $pl_server_crt_erb = 'confdroid_postgresql/server/server.crt.erb'
+ $pl_server_key_file = "${pl_data_dir}/server.key"
+ $pl_server_key_erb = 'confdroid_postgresql/server/server.key.erb'
# Service
$pl_service = 'postgresql'
|