feat: certbot reorg

- moved certbot into its own module
- added fact to list available certificates
- created systemd timer to rsync data to $data_dir/pub
- ensure the $data_dir/pub exists
- manage selinux for nginx

modules/certbot/manifests/nginx.pp

@@ -0,0 +1,91 @@
+# certbot::nginx
+class certbot::nginx (
+  Stdlib::Absolutepath  $data_root = $certbot::data_root,
+  Stdlib::Fqdn          $nginx_vhost = $certbot::nginx_vhost,
+  Array[Stdlib::Host]   $nginx_aliases = $certbot::nginx_aliases,
+  Stdlib::Port          $nginx_port = $certbot::nginx_port,
+  Stdlib::Port          $nginx_ssl_port = $certbot::nginx_ssl_port,
+  Enum['http','https','both'] $nginx_listen_mode = $certbot::nginx_listen_mode,
+  Enum['puppet', 'vault']     $nginx_cert_type = $certbot::nginx_cert_type,
+) {
+
+  # select the certificates to use based on cert type
+  case $nginx_cert_type {
+    'puppet': {
+      $selected_ssl_cert = "/etc/pki/tls/puppet/${facts['networking']['fqdn']}.crt"
+      $selected_ssl_key  = "/etc/pki/tls/puppet/${facts['networking']['fqdn']}.key"
+    }
+    'vault': {
+      $selected_ssl_cert = '/etc/pki/tls/vault/certificate.crt'
+      $selected_ssl_key  = '/etc/pki/tls/vault/private.key'
+    }
+    default: {
+      # enum param prevents this ever being reached
+    }
+  }
+
+  # set variables based on the listen_mode
+  case $nginx_listen_mode {
+    'http': {
+      $enable_ssl = false
+      $ssl_cert = undef
+      $ssl_key = undef
+      $listen_port = $nginx_port
+      $listen_ssl_port = undef
+      $extras_hash = {}
+    }
+    'https': {
+      $enable_ssl = true
+      $ssl_cert = $selected_ssl_cert
+      $ssl_key = $selected_ssl_key
+      $listen_port = $nginx_ssl_port
+      $listen_ssl_port = $nginx_ssl_port
+      $extras_hash = {
+        'subscribe' => [File[$ssl_cert], File[$ssl_key]],
+      }
+    }
+    'both': {
+      $enable_ssl = true
+      $ssl_cert = $selected_ssl_cert
+      $ssl_key = $selected_ssl_key
+      $listen_port = $nginx_port
+      $listen_ssl_port = $nginx_ssl_port
+      $extras_hash = {
+        'subscribe' => [File[$ssl_cert], File[$ssl_key]],
+      }
+    }
+    default: {
+      # enum param prevents this ever being reached
+    }
+  }
+
+  mkdir::p {"${data_root}/pub":}
+
+  # set the server_names
+  $server_names = unique([$facts['networking']['fqdn'], $nginx_vhost] + $nginx_aliases)
+
+  # define the default parameters for the nginx server
+  $defaults = {
+    'listen_port'          => $listen_port,
+    'server_name'          => $server_names,
+    'use_default_location' => true,
+    'access_log'           => "/var/log/nginx/${nginx_vhost}_access.log",
+    'error_log'            => "/var/log/nginx/${nginx_vhost}_error.log",
+    'www_root'             => "${data_root}/pub",
+    'autoindex'            => 'on',
+    'ssl'                  => $enable_ssl,
+    'ssl_cert'             => $ssl_cert,
+    'ssl_key'              => $ssl_key,
+    'ssl_port'             => $listen_ssl_port,
+  }
+
+  # merge the hashes conditionally
+  $nginx_parameters = merge($defaults, $extras_hash)
+
+  # manage the nginx class
+  include nginx
+
+  # create the nginx vhost with the merged parameters
+  create_resources('nginx::resource::server', { $nginx_vhost => $nginx_parameters })
+
+}