|
# Manage a Candlepin server
|
|
#
|
|
# @param oauth_key
|
|
# The OAuth key for talking to the candlepin API
|
|
#
|
|
# @param oauth_secret
|
|
# The OAuth secret for talking to the candlepin API
|
|
#
|
|
# @param manage_db
|
|
# Whether a database should be installed, this includes db creation and user
|
|
#
|
|
# @param init_db
|
|
# Whether a database should be initialised.
|
|
#
|
|
# @param db_type
|
|
# The type of database Candlepin will be connecting too.
|
|
#
|
|
# @param db_host
|
|
# Hostname of database server.
|
|
#
|
|
# @param db_port
|
|
# Port the database listens on. Only needs to be provided if different from
|
|
# standard port of the :db_type.
|
|
#
|
|
# @param db_ssl
|
|
# Boolean indicating if the connection to the database should be over an SSL
|
|
# connection.
|
|
#
|
|
# @param db_ssl_verify
|
|
# Boolean indicating if the SSL connection to the database should be verified
|
|
#
|
|
# @param db_ssl_ca
|
|
# The CA certificate to verify the SSL connection to the database with
|
|
#
|
|
# @param db_name
|
|
# The name of the Candlepin database
|
|
#
|
|
# @param db_user
|
|
# The Candlepin database username
|
|
#
|
|
# @param db_password
|
|
# The Candlepin database password
|
|
#
|
|
# @param user_groups
|
|
# The user groups for the Candlepin tomcat user
|
|
#
|
|
# @param log_dir
|
|
# Directory for Candlepin logs
|
|
#
|
|
# @param loggers
|
|
# Set the log levels for loggers
|
|
#
|
|
# @param env_filtering_enabled
|
|
# If subscription filtering is done on a per environment basis
|
|
#
|
|
# @param keystore_file
|
|
# Tomcat keystore file to use
|
|
#
|
|
# @param keystore_password
|
|
# Password for keystore being used with Tomcat
|
|
#
|
|
# @param keystore_type
|
|
# Keystore type
|
|
#
|
|
# @param truststore_file
|
|
# Truststore file to use for Tomcat and Artemis
|
|
#
|
|
# @param truststore_password
|
|
# Password for truststore being used with Tomcat and Artemis
|
|
#
|
|
# @param ca_key
|
|
# CA key file to use
|
|
#
|
|
# @param ca_cert
|
|
# CA certificate file to use
|
|
#
|
|
# @param ca_key_password
|
|
# CA key password
|
|
#
|
|
# @param ciphers
|
|
# Allowed ciphers for ssl connection
|
|
#
|
|
# @param tls_versions
|
|
# Allowed versions of TLS, for example 1.1, 1.2, etc
|
|
#
|
|
# @param version
|
|
# Version of Candlepin to install
|
|
#
|
|
# @param java_package
|
|
# Use in conjunction with java_home to specify the JVM used by Tomcat
|
|
#
|
|
# @param adapter_module
|
|
# Candlepin adapter implementations to inject into the java runtime
|
|
#
|
|
# @param enable_basic_auth
|
|
# Whether to enable HTTP basic auth
|
|
#
|
|
# @param enable_trusted_auth
|
|
# Whether to enable trusted auth
|
|
#
|
|
# @param consumer_system_name_pattern
|
|
# Regex that consistutes a valid consumer name
|
|
#
|
|
# @param enable_hbm2ddl_validate
|
|
# If true will perform a schema check to ensure compliance with the models.
|
|
# Disabling this feature may be required if modifications are required to schema
|
|
#
|
|
# @param ssl_port
|
|
# Port to deploy SSL enabled Tomcat server on
|
|
#
|
|
# @param host
|
|
# Host to deploy Tomcat server on; defaults to localhost
|
|
#
|
|
# @param candlepin_conf_file
|
|
# Configuration file location for candlepin
|
|
#
|
|
# @param tomcat_base
|
|
# In new-style instances, if CATALINA_BASE isn't specified, it will be
|
|
# constructed by joining TOMCATS_BASE and NAME.
|
|
#
|
|
# @param tomcat_conf
|
|
# Where your the tomcat configuration lives
|
|
#
|
|
# @param java_home
|
|
# Where your java installation lives
|
|
#
|
|
# @param catalina_home
|
|
# Where your tomcat installation lives
|
|
#
|
|
# @param catalina_tmpdir
|
|
# System-wide tmp
|
|
#
|
|
# @param java_opts
|
|
# Java Parameters
|
|
#
|
|
# @param lang
|
|
# Tomcat locale setting
|
|
#
|
|
# @param security_manager
|
|
# Run tomcat under the Java Security Manager
|
|
#
|
|
# @param shutdown_wait
|
|
# Time to wait in seconds, before killing process
|
|
#
|
|
# @param expired_pools_schedule
|
|
# Quartz schedule notation for how often to run the ExpiredPoolsJob
|
|
#
|
|
# @param artemis_port
|
|
# Port to expose Artemis on
|
|
#
|
|
# @param artemis_host
|
|
# Host address to have Artemis listen on; defaults to localhost
|
|
#
|
|
# @param artemis_client_dn
|
|
# Full DN for the client certificate used to talk to Artemis
|
|
#
|
|
# @param broker_config_file
|
|
# Config file for Artemis
|
|
#
|
|
# @param user
|
|
# User under which Candlepin will run
|
|
#
|
|
# @param group
|
|
# Primary group for the Candlepin user
|
|
#
|
|
# @param disable_fips
|
|
# Disable FIPS within the Java environment for Tomcat explicitly.
|
|
# When set to false, no flag is added. Then on FIPS enabled systems, a Candlepin build that supports FIPS is required.
|
|
#
|
|
# @param db_manage_on_startup
|
|
# How to manage database migrations on startup.
|
|
#
|
|
# @example Set debug logging
|
|
# class { 'candlepin':
|
|
# loggers => {
|
|
# 'org.candlepin' => 'DEBUG',
|
|
# },
|
|
# }
|
|
#
|
|
class candlepin (
|
|
Boolean $manage_db = true,
|
|
Boolean $init_db = true,
|
|
Enum['postgresql','mysql'] $db_type = 'postgresql',
|
|
Stdlib::Host $db_host = 'localhost',
|
|
Optional[Stdlib::Port] $db_port = undef,
|
|
Boolean $db_ssl = false,
|
|
Boolean $db_ssl_verify = true,
|
|
Optional[Stdlib::Absolutepath] $db_ssl_ca = undef,
|
|
String $db_name = 'candlepin',
|
|
String $db_user = 'candlepin',
|
|
Variant[Sensitive[String], String] $db_password = $candlepin::params::db_password,
|
|
Variant[Array[String], String] $user_groups = [],
|
|
Stdlib::Absolutepath $log_dir = '/var/log/candlepin',
|
|
Hash[String[1], Candlepin::LogLevel] $loggers = {},
|
|
Variant[Sensitive[String], String] $oauth_key = 'candlepin',
|
|
Variant[Sensitive[String], String] $oauth_secret = 'candlepin',
|
|
Boolean $env_filtering_enabled = true,
|
|
Stdlib::Absolutepath $keystore_file = '/etc/candlepin/certs/keystore',
|
|
Optional[Variant[Sensitive[String], String]] $keystore_password = undef,
|
|
String $keystore_type = 'PKCS12',
|
|
Stdlib::Absolutepath $truststore_file = '/etc/candlepin/certs/truststore',
|
|
Optional[Variant[Sensitive[String], String]] $truststore_password = undef,
|
|
Stdlib::Absolutepath $ca_key = '/etc/candlepin/certs/candlepin-ca.key',
|
|
Stdlib::Absolutepath $ca_cert = '/etc/candlepin/certs/candlepin-ca.crt',
|
|
Optional[Variant[Sensitive[String], String]] $ca_key_password = undef,
|
|
Array[String] $ciphers = $candlepin::params::ciphers,
|
|
Array[String] $tls_versions = ['1.2'],
|
|
Optional[String[1]] $java_package = undef,
|
|
String $version = 'present',
|
|
Optional[String] $adapter_module = undef,
|
|
Boolean $enable_hbm2ddl_validate = true,
|
|
Boolean $enable_basic_auth = true,
|
|
Boolean $enable_trusted_auth = false,
|
|
Optional[String] $consumer_system_name_pattern = undef,
|
|
Stdlib::Port $ssl_port = 8443,
|
|
Stdlib::Host $host = 'localhost',
|
|
Stdlib::Absolutepath $candlepin_conf_file = '/etc/candlepin/candlepin.conf',
|
|
Stdlib::Absolutepath $tomcat_base = '/var/lib/tomcats/',
|
|
Stdlib::Absolutepath $tomcat_conf = '/etc/tomcat',
|
|
Stdlib::Absolutepath $java_home = '/usr/lib/jvm/jre',
|
|
Stdlib::Absolutepath $catalina_home = '/usr/share/tomcat',
|
|
Stdlib::Absolutepath $catalina_tmpdir = '/var/cache/tomcat/temp',
|
|
String $java_opts = '-Xms1024m -Xmx4096m',
|
|
Optional[String] $lang = undef,
|
|
Boolean $security_manager = false,
|
|
Optional[Integer[0]] $shutdown_wait = undef,
|
|
String $expired_pools_schedule = '0 0 0 * * ?',
|
|
Stdlib::Host $artemis_host = 'localhost',
|
|
Stdlib::Port $artemis_port = 61613,
|
|
Variant[Deferred, String] $artemis_client_dn = 'CN=ActiveMQ Artemis Client, OU=Artemis, O=ActiveMQ, L=AMQ, ST=AMQ, C=AMQ',
|
|
Stdlib::Absolutepath $broker_config_file = '/etc/candlepin/broker.xml',
|
|
String $user = 'tomcat',
|
|
String $group = 'tomcat',
|
|
Boolean $disable_fips = true,
|
|
Enum['None', 'Report', 'Halt', 'Manage'] $db_manage_on_startup = 'Manage',
|
|
) inherits candlepin::params {
|
|
contain candlepin::service
|
|
|
|
$_ca_key_password = if $ca_key_password =~ String { Sensitive($ca_key_password) } else { $ca_key_password }
|
|
$_oauth_key = if $oauth_key =~ String { Sensitive($oauth_key) } else { $oauth_key }
|
|
$_oauth_secret = if $oauth_secret =~ String { Sensitive($oauth_secret) } else { $oauth_secret }
|
|
$_db_password = if $db_password =~ String { Sensitive($db_password) } else { $db_password }
|
|
$_keystore_password = if $keystore_password =~ String { Sensitive($keystore_password) } else { $keystore_password }
|
|
$_truststore_password = if $truststore_password =~ String { Sensitive($truststore_password) } else { $truststore_password }
|
|
|
|
Anchor <| title == 'candlepin::repo' |> ->
|
|
class { 'candlepin::install': } ~>
|
|
class { 'candlepin::config': } ~>
|
|
class { 'candlepin::artemis': } ~>
|
|
class { "candlepin::database::${candlepin::db_type}": } ~>
|
|
Class['candlepin::service']
|
|
}
|
