config.pp

# Configure the foreman proxy
class foreman_proxy::config {

  # Ensure SSL certs from the puppetmaster are available
  # Relationship is duplicated there as defined() is parse-order dependent
  if $foreman_proxy::ssl and defined(Class['puppet::server::config']) {
    Class['puppet::server::config'] ~> Class['foreman_proxy::config']
    Class['puppet::server::config'] ~> Class['foreman_proxy::service']
  }

  # Ensure 'puppet' user group is present before managing proxy user
  # Relationship is duplicated there as defined() is parse-order dependent
  if defined(Class['puppet::server::install']) {
    Class['puppet::server::install'] -> Class['foreman_proxy::config']
  }

  if $foreman_proxy::tftp and $foreman_proxy::tftp_managed { include ::foreman_proxy::tftp }

  # Somehow, calling these DHCP and DNS seems to conflict. So, they get a prefix...
  if $foreman_proxy::dhcp and $foreman_proxy::dhcp_managed { include ::foreman_proxy::proxydhcp }

  if $foreman_proxy::dns and $foreman_proxy::dns_managed {
    include ::foreman_proxy::proxydns
    include ::dns::params
    $groups = [$dns::params::group, $foreman_proxy::puppet_group]
  } else {
    $groups = concat($foreman_proxy::groups, $foreman_proxy::puppet_group)
  }

  user { $foreman_proxy::user:
    ensure  => 'present',
    shell   => $::foreman_proxy::shell,
    comment => 'Foreman Proxy daemon user',
    groups  => $groups,
    home    => $foreman_proxy::dir,
    require => Class['foreman_proxy::install'],
    notify  => Class['foreman_proxy::service'],
  }

  foreman_proxy::settings_file { 'settings':
    path   => "${::foreman_proxy::etc}/foreman-proxy/settings.yml",
    module => false,
  }

  foreman_proxy::settings_file { 'bmc':
    enabled   => $::foreman_proxy::bmc,
    feature   => 'BMC',
    listen_on => $::foreman_proxy::bmc_listen_on,
  }
  foreman_proxy::settings_file { 'dhcp':
    enabled   => $::foreman_proxy::dhcp,
    feature   => 'DHCP',
    listen_on => $::foreman_proxy::dhcp_listen_on,
  }
  foreman_proxy::settings_file { 'dhcp_isc':
    module => false,
  }
  foreman_proxy::settings_file { 'dns':
    enabled   => $::foreman_proxy::dns,
    feature   => 'DNS',
    listen_on => $::foreman_proxy::dns_listen_on,
  }
  foreman_proxy::settings_file { ['dns_nsupdate', 'dns_nsupdate_gss']:
    module => false,
  }
  foreman_proxy::settings_file { ['dns_libvirt', 'dhcp_libvirt']:
    module => false,
  }
  foreman_proxy::settings_file { 'httpboot':
    enabled   => pick($::foreman_proxy::httpboot, $::foreman_proxy::tftp),
    feature   => 'HTTPBoot',
    listen_on => $::foreman_proxy::httpboot_listen_on,
  }
  foreman_proxy::settings_file { 'puppet':
    enabled   => $::foreman_proxy::puppet,
    feature   => 'Puppet',
    listen_on => $::foreman_proxy::puppet_listen_on,
  }
  foreman_proxy::settings_file { [
      'puppet_proxy_customrun',
      'puppet_proxy_legacy',
      'puppet_proxy_mcollective',
      'puppet_proxy_puppet_api',
      'puppet_proxy_puppetrun',
      'puppet_proxy_salt',
      'puppet_proxy_ssh',
      'puppetca_hostname_whitelisting',
      'puppetca_token_whitelisting',
    ]:
      module => false,
  }
  foreman_proxy::settings_file { 'puppetca':
    enabled   => $::foreman_proxy::puppetca,
    feature   => 'Puppet CA',
    listen_on => $::foreman_proxy::puppetca_listen_on,
  }
  foreman_proxy::settings_file { 'realm':
    enabled   => $::foreman_proxy::realm,
    feature   => 'Realm',
    listen_on => $::foreman_proxy::realm_listen_on,
  }
  foreman_proxy::settings_file { 'realm_freeipa':
    module => false,
  }
  foreman_proxy::settings_file { 'tftp':
    enabled   => $::foreman_proxy::tftp,
    feature   => 'TFTP',
    listen_on => $::foreman_proxy::tftp_listen_on,
  }
  foreman_proxy::settings_file { 'templates':
    enabled   => $::foreman_proxy::templates,
    feature   => 'Templates',
    listen_on => $::foreman_proxy::templates_listen_on,
  }
  foreman_proxy::settings_file { 'logs':
    enabled   => $::foreman_proxy::logs,
    feature   => 'Logs',
    listen_on => $::foreman_proxy::logs_listen_on,
  }

  if $foreman_proxy::puppetca_split_configs {
    foreman_proxy::settings_file { [
        'puppetca_http_api',
        'puppetca_puppet_cert',
      ]:
        module => false,
    }
  }

  if $foreman_proxy::puppetca or $foreman_proxy::puppet {
    $puppetca_sudo = $foreman_proxy::puppetca and versioncmp($facts['puppetversion'], '6.0') < 0
    $puppetrun_sudo = $foreman_proxy::puppet and $foreman_proxy::puppetrun_provider == 'puppetrun'
    $uses_sudo = $puppetrun_sudo or $puppetca_sudo

    if $foreman_proxy::use_sudoersd {
      if $uses_sudo and $foreman_proxy::manage_sudoersd {
        ensure_resource('file', "${::foreman_proxy::sudoers}.d", {'ensure' => 'directory'})
      }

      file { "${::foreman_proxy::sudoers}.d/foreman-proxy":
        ensure  => bool2str($uses_sudo, 'file', 'absent'),
        owner   => 'root',
        group   => 0,
        mode    => '0440',
        content => template('foreman_proxy/sudo.erb'),
      }
    } elsif $foreman_proxy::use_sudoers {
      augeas { 'sudo-foreman-proxy':
        context => "/files${::foreman_proxy::sudoers}",
        changes => template('foreman_proxy/sudo_augeas.erb'),
      }
    }
  } else {
    # The puppet-agent (puppet 4 AIO package) doesn't create a puppet user and group
    # but the foreman proxy still needs to be able to read the agent's private key
    if $foreman_proxy::manage_puppet_group and $foreman_proxy::ssl {
      if !defined(Group[$foreman_proxy::puppet_group]) {
        group { $foreman_proxy::puppet_group:
          ensure => 'present',
          before => User[$foreman_proxy::user],
        }
      }
      $ssl_dirs_and_files = [
        $foreman_proxy::ssldir,
        "${foreman_proxy::ssldir}/private_keys",
        $foreman_proxy::ssl_ca,
        $foreman_proxy::ssl_key,
        $foreman_proxy::ssl_cert,
      ]
      file { $ssl_dirs_and_files:
        group => $foreman_proxy::puppet_group,
      }
    }
  }
}