Replace apache::cert::other with a simple wrapper around ::comodo

    reloading Apache, in preparation for support for non-sysvinit init

    systems.  (rra)

    Since apache::cert::comodo no longer does anything Comodo-specific,

    replace apache::cert::other with a simple wrapper around ::comodo.

    Eventually, both classes should be renamed.  (rra)

    Fix formatting, valid parameter checks, variable references, and file

    layout to match current Puppet coding standards.  (rra)

# This used to be a separate class for certificates that are not self-signed

# but were not from Comodo.  However, apache::cert::comodo no longer does

# anything Comodo-specific, so this can be a simple wrapper.

#

# Install some other certificate which is neither from Comodo nor self-signed.

# This installs only the certificate, not a root certificate, but pulls the

# key from Puppet.  The certificate will be symlinked to

# /etc/ssl/certs/server.pem and the key to /etc/ssl/private/server.key.

#

# Syntax:

#

#     apache::cert::other { '<hostname>':

#         ensure      => present,

#         keyname     => 'unix-<hostname>-ssl-key',

#         owner       => 'root',

#         group       => $operatingsystem ? {

#                            'debian' => 'ssl-cert',

#                            'ubuntu' => 'ssl-cert',

#                            'redhat' => 'root',

#                        },

#         identity    => '<hostname>.stanford.edu',

#         symlink     => true,

#     }

#

# Only ensure need be specified; the other listed parameters are the defaults.

# <hostname> should be the unqualified hostname.  The public certificate

# should be stored in modules/apache/files/certs/<identity> (defaulting to

# <hostname>.stanford.edu).

# Eventually, both classes should be merged and renamed.

define apache::cert::other(

  $ensure,

    $keyname     = 'NONE',

  $keyname     = undef,

  $owner       = 'root',

    $group       = 'NONE',

    $identity    = 'NONE',

  $group       = undef,

  $identity    = undef,

  $symlink     = true

) {

    case $ensure {

        'present', 'absent': { }

        default: { crit "Invalid ensure value: $ensure" }

    }

    # We can't use $name when setting a default value inside the parameter

    # list, so we have to do this lame nonsense.  We also can't reset the

    # variable, so we have to use a different variable.

    case $keyname {

        'NONE':  { $key = "unix-${name}-ssl-key" }

        default: { $key = $keyname }

    }

    case $identity {

        'NONE':  { $id = "${name}.stanford.edu" }

        default: { $id = $identity }

    }

    case $group {

        'NONE':  { $grp = $operatingsystem ? {

                'debian' => 'ssl-cert',

                'ubuntu' => 'ssl-cert',

                'redhat' => 'root',

            }

        }

        default: { $grp = $group }

    }

    # Include required packages.

    case $ensure {

        'present': { include apache::cert::packages }

        default:   { }

    }

    # Install the private key.

    base::wallet { $key:

        ensure  => $ensure,

        type    => "file",

        path    => "/etc/ssl/private/${name}.key",

  apache::cert::comodo { $name:

    keyname  => $keyname,

    owner    => $owner,

        group   => $grp,

        mode    => 0640,

        require => $operatingsystem ? {

            'debian' => Package['ca-certificates'],

            'ubuntu' => Package['ca-certificates'],

            'redhat' => [

                         Package['openssl'],

                         File['/etc/ssl/private']

                        ],

        },

    }

    # Install the public certificate.

    file { "/etc/ssl/certs/${name}.pem":

        ensure  => $ensure,

        source  => "puppet:///modules/cert-files/${id}",

        require => $operatingsystem ? {

            'debian' => Package['ca-certificates'],

            'ubuntu' => Package['ca-certificates'],

            'redhat' => [

                         Package['openssl'],

                         File['/etc/ssl/certs']

                        ],

        },

    }

    # Create the OpenSSL hash links.

    apache::cert::hash { "${name}.pem": ensure => $ensure }

    # Install the server symlinks unless symlink is set to false.

    case $symlink {

        true: {

            file {

                '/etc/ssl/certs/server.pem':

                    ensure  => $ensure ? {

                        present => link,

                        absent  => absent,

                        default => $ensure,

                    },

                    target  => "${name}.pem",

                    require => File["/etc/ssl/certs/${name}.pem"];

                "/etc/ssl/private/server.key":

                    ensure  => $ensure ? {

                        present => link,

                        absent  => absent,

                        default => $ensure,

                    },

                    target  => "${name}.key",

                    require => File["/etc/ssl/private/${name}.key"];

            }

        }

        default: { }

    group    => $group,

    identity => $identity,

    symlink  => $symlink,

  }

}