3bfcc19a3e
The `params` vs. `bind` class distinction has been blurry for a long time. I'm formalizing it. `params` is now `defaults` and its purpose is to gather platform-specific variation into a single scope. These variables are related to situating a BIND server on a particular platform and it should not ever be necessary or perhaps even possible to change them as a matter of preference. Rather, correct values are function of e.g. `$osfamily` or `$operatingsystem`. The parameters of the `bind` class are limited to those that control the server's feature set. These parameters *are* matters of preference and/or purpose, rather than platform. Also, I have taken some care to develop a convention for direct references to qualified parameters where they are re-scoped into the local scope centrally at the top first, and subsequent references are to the local value. This should minimize future code churn and also aid readability.
53 lines
1.4 KiB
Puppet
53 lines
1.4 KiB
Puppet
# ex: syntax=puppet si ts=4 sw=4 et
|
|
|
|
define bind::key (
|
|
$secret = undef,
|
|
$secret_bits = 256,
|
|
$algorithm = 'hmac-sha256',
|
|
$owner = 'root',
|
|
$group = $::bind::defaults::bind_group,
|
|
$keydir = $::bind::keydir::keydir,
|
|
$keyfile = undef,
|
|
$include = true,
|
|
) {
|
|
# Pull some platform defaults into the local scope
|
|
$confdir = $::bind::defaults::confdir
|
|
|
|
# Generate a key of size $secret_bits if no $secret
|
|
$secret_actual = $secret ? {
|
|
undef => hmac_secret($secret_bits),
|
|
default => $secret,
|
|
}
|
|
|
|
# Keep existing key if the module is generating a key
|
|
$replace = $secret ? {
|
|
undef => false,
|
|
default => true,
|
|
}
|
|
|
|
# Use key name as key file name if none is supplied
|
|
$key_file_name = $keyfile ? {
|
|
undef => $name,
|
|
default => $keyfile,
|
|
}
|
|
|
|
file { "${keydir}/${key_file_name}":
|
|
ensure => present,
|
|
owner => $owner,
|
|
group => $group,
|
|
mode => '0640',
|
|
replace => $replace,
|
|
content => template('bind/key.conf.erb'),
|
|
}
|
|
|
|
if $include and defined(Class['bind']) {
|
|
Package['bind'] -> File["${keydir}/${key_file_name}"] ~> Service['bind']
|
|
|
|
concat::fragment { "bind-key-${name}":
|
|
order => '10',
|
|
target => "${confdir}/keys.conf",
|
|
content => "include \"${keydir}/${key_file_name}\";\n",
|
|
}
|
|
}
|
|
}
|