first draft of lets_encrypt defined resource

# Link to an EXISTING Let's Encrypt certificate (if the certificate

# exists). Otherwise, link to a "snake-oil" certificate so that Apache

# works.

#

# 1. If the Let's Encrypt certificate does NOT exist, then be sure

#    the snake-oil certificate exists and link to it.

#

# 2. If the Let's Encrypt certificate DOES exist, then link to it.

#

# $name: the fully-qualified domain name of the Subject.

# Example: debian-repo-dev.stanford.edu. This MUST match the

# cert-name of the Let's Encrypt certificate, i.e., must match

# the directory /etc/letsencrypt/live/<FQDN>.

define su_apache::cert::lets_encrypt (

  String $lets_encrypt_basedir = '/etc/letsencrypt',

) {

  # $main_key/$main_cert will be linked to either the snake-oil key-pair

  # or the Let's Encrypt key-pair.

  $main_key  = "/etc/ssl/private/${name}.key"

  $main_cert = "/etc/ssl/certs/${name}.pem"

  $le_key  = "${lets_encrypt_basedir}/live/${name}/privkey.pem"

  $le_cert = "${lets_encrypt_basedir}/live/${name}/fullchain.pem"

  $so_key  = '/etc/ssl/private/ssl-cert-snakeoil.key'

  $so_cert = '/etc/ssl/certs/ssl-cert-snakeoil.pem'

  ## STAGE 1.

  # Make sure the snake-oil key-pair always exists. This is useful

  # in case the Let's Encrypt certificate does not (yet) exists.

  # Only run if it does not already exists.

  $subject = "/C=US/ST=California/L=Stanford/O=Stanford University/OU=IEDO/CN=${name}"

  exec { 'create-snake-oil':

    path    => '/usr/bin:/usr/sbin',

    command => [

            'openssl',

            'req',

            '-x509',

            '-nodes',

            '-newkey', 'rsa:2048',

            '-keyout', $so_key,

            '-out',    $so_cert,

            '-days',   '3650',

            '-subj',   $subject,

    ],

    creates => $so_key,

  }

  # In the following, because of the onlyif's exactly one of 2A and 2B

  # will execute.

  ## STAGE 2A.

  # Link the main key-pair to the snake-old key-pair, but only if the

  # Let's Encrypt key-pair does NOT exist.

  # This command returns 0 if either Let's Encrypt file does NOT exist.

  $onlyif_cmd_so = "sh -c \"test ! -f ${le_cert} || test ! -f ${le_key}\""

  # This is the command that does the linking.

  $cmd1        = "ln -s ${so_key} ${main_key}"

  $cmd2        = "ln -s ${so_cert} ${main_cert}"

  $link_cmd_so = "${cmd1} && ${cmd2}"

  exec { "link-${name}-to-so":

    path    => '/usr/bin:/usr/sbin',

    command => $link_cmd_so,

    onlyif  => $onlyif_cmd_so,

  }

  ## STAGE 2B.

  # Link the main key-pair to the Let's Encrypt key-pair, but only if

  # the Let's Encrypt key-pair exists.

  # This is the command that returns 0 if both Let's Encrypt files

  # exist. We only link to them if they are in place.

  $onlyif_cmd_le = "sh -c \"test -f ${le_cert} && test -f ${le_key}\""

  # This is the command that does the linking.

  $cmd1        = "ln -s ${le_key} ${main_key}"

  $cmd2        = "ln -s ${le_cert} ${main_cert}"

  $link_cmd_le = "${cmd1} && ${cmd2}"

  exec { "link-${name}-to-le":

    path    => '/usr/bin:/usr/sbin',

    command => $link_cmd_le,

    onlyif  => $onlyif_cmd_le,

  }

}