Commit 54283870 authored by Vincent Pelletier's avatar Vincent Pelletier

erp5.mariadb: Provide a way to enable SSL support.

parent 8cffc02a
......@@ -90,6 +90,25 @@
"description": "When enabled, sets innodb_flush_log_at_trx_commit = 0, innodb_flush_method = nosync, innodb_doublewrite = 0 and sync_frm = 0 - RTFM, those options are dangerous",
"default": false,
"type": "boolean"
},
"ssl": {
"description": "Enable and define SSL support for network connections",
"default": {},
"properties": {
"ca-crt": {
"description": "Certificate Authority's certificate, in PEM format",
"type": "string",
},
"crt": {
"description": "Server's certificate, in PEM format (mandatory to enable SSL support)",
"type": "string"
},
"key": {
"description": "Server's key, in PEM format (mandatory to enable SSL support)",
"type": "string"
}
},
"type": "object"
}
}
}
......@@ -174,7 +174,7 @@ context =
[template-mariadb]
< = download-base
filename = instance-mariadb.cfg.in
md5sum = d51a5ad6cfa76b7bc20519694e88df80
md5sum = 31e49ad3abb6926f21f29c53cda49ebb
link-binary =
${coreutils:location}/bin/basename
${coreutils:location}/bin/cat
......@@ -205,7 +205,7 @@ md5sum = b54344ee94519f7e95e270664ba3dc99
[template-my-cnf]
< = download-base
filename = my.cnf.in
md5sum = 774b0e5d167b75a0ad8ead45fa2eadf6
md5sum = 21d1e74c964a4882f33c360e9c8a3d44
[template-mariadb-initial-setup]
< = download-base
......
......@@ -29,6 +29,40 @@ recipe = slapos.cookbook:publish.serialised
database-list = {{ render_database_list(database_list) }}
test-database-list = {{ render_database_list(test_database_list) }}
[simplefile]
recipe = slapos.recipe.template:jinja2
template = inline:{{ '{{ content }}' }}
{% macro simplefile(section_name, file_path, content, mode='') -%}
{% set content_section_name = section_name ~ '-content' -%}
[{{ content_section_name }}]
content = {{ dumps(content) }}
[{{ section(section_name) }}]
< = simplefile
rendered = {{ file_path }}
context = key content {{content_section_name}}:content
mode = {{ mode }}
{%- endmacro %}
{% set ssl_dict = {} -%}
{% macro sslfile(key, content, mode='644') -%}
{% set path = '${directory:mariadb-ssl}/' ~ key ~ '.pem' -%}
{% do ssl_dict.__setitem__(key, path) -%}
{{ simplefile('ssl-file-' ~ key, path, content, mode) }}
{%- endmacro %}
{% set ssl_parameter_dict = slapparameter_dict.get('ssl') -%}
{% if ssl_parameter_dict -%}
{% set base_directory = '${directory:mariadb-ssl}/' -%}
{# Note: The key content will be stored in .installed.cfg, and this template's
rendering, so the only point of mode is to avoid risking mariadb complaining
about laxist file mode. -#}
{{ sslfile('key', ssl_parameter_dict['key'], mode='600') }}
{{ sslfile('crt', ssl_parameter_dict['crt']) }}
{% if 'ca-crt' in ssl_parameter_dict -%}
{{ sslfile('ca-crt', ssl_parameter_dict['ca-crt']) }}
{% endif -%}
{%- endif %}
{% if full_backup_retention_days > -1 -%}
[{{ section('cron-entry-mariadb-backup') }}]
<= cron
......@@ -75,7 +109,10 @@ binlog-path = ${directory:mariadb-backup-incremental}/binlog
binlog-expire-days = {{ incremental_backup_retention_days }}
{% else %}
binlog-path =
{% endif -%}
{%- endif %}
{%- for key, value in ssl_dict.items() -%}
ssl-{{ key }} = {{ value }}
{% endfor %}
[my-cnf]
recipe = slapos.recipe.template:jinja2
......@@ -206,6 +243,7 @@ mariadb-backup-full = ${:backup}/mariadb-full
mariadb-backup-incremental = ${:backup}/mariadb-incremental
logrotate-backup = ${:backup}/logrotate
mariadb-data = ${:srv}/mariadb
mariadb-ssl = ${:etc}/mariadb-ssl
var = ${buildout:directory}/var
log = ${:var}/log
run = ${:var}/run
......
......@@ -70,6 +70,14 @@ collation_server = utf8_unicode_ci
character_set_server = utf8
skip_character_set_client_handshake
{% if 'ssl-key' in parameter_dict -%}
ssl_cert = {{ parameter_dict['ssl-crt'] }}
ssl_key = {{ parameter_dict['ssl-key'] }}
{% if 'ssl-ca-crt' in parameter_dict -%}
ssl_ca = {{ parameter_dict['ssl-ca-crt'] }}
{%- endif %}
{%- endif %}
[client]
socket = {{ socket }}
user = root
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment