caucase.jinja2.library 4.19 KB
Newer Older
1 2 3 4 5 6 7 8 9 10
{% macro caucased(
  prefix,
  buildout_bin_directory,
  caucased_path,
  data_dir,
  netloc,
  service_auto_approve_count=0,
  user_auto_approve_count=1,
  key_len=None,
  backup_dir=None,
11
  promise=True
12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
) -%}
[{{ prefix }}-directory]
recipe = slapos.cookbook:mkdirectory
data-dir = {{ data_dir }}
mode = 0750

[{{ prefix }}]
recipe = slapos.cookbook:wrapper
wrapper-path = {{ caucased_path }}
command-line = '{{ buildout_bin_directory }}/caucased'
  --db          '${ {{- prefix }}-directory:data-dir}/caucase.sqlite'
  --server-key  '${ {{- prefix }}-directory:data-dir}/server.key.pem'
  --netloc      '{{ netloc }}'
  {% if key_len %}--key-len '{{ key_len }}' {%- endif %}
  {% if backup_dir %}--backup-directory {{ backup_dir }} {%- endif %}
  --service-auto-approve-count '{{ service_auto_approve_count }}'
  --user-auto-approve-count    '{{ user_auto_approve_count }}'
  --lock-auto-approve-count

{% if promise -%}
[{{ prefix }}-promise]
33 34 35 36
<= monitor-promise-base
module = check_command_execute
name = {{ prefix }}.py
config-command = '{{ buildout_bin_directory }}/caucase-probe' 'http://{{ netloc }}'
37 38 39 40 41 42 43 44 45 46 47
{%- endif %}
{%- endmacro %}

{% macro updater(
  prefix,
  buildout_bin_directory,
  updater_path,
  url,
  data_dir,
  ca_path,
  crl_path,
48
  crt_path=None,
49 50 51 52
  key_path=None,
  on_renew=None,
  max_sleep=None,
  mode='service',
53
  template_csr=None,
54
  template_csr_pem=None,
55 56
  openssl=None,
  promise=True
57 58 59 60 61
) -%}
[{{ prefix }}-directory]
recipe = slapos.cookbook:mkdirectory
data-dir = {{ data_dir }}

62 63
{% if crt_path %}
{%   if template_csr_pem or template_csr -%}
64
[{{ prefix }}-provided-csr-content]
65
{%     if template_csr_pem %}
66
content = {{ dumps(template_csr_pem) }}
67
{%     elif template_csr %}
68
content = {{ template_csr }}
69
{%     endif %}
70 71 72
[{{ prefix }}-provided-csr]
recipe = slapos.recipe.template:jinja2
mode = 644
73
{%     if template_csr_pem %}
74 75 76
template = inline:{{ '{{ content }}' }}
rendered = ${ {{- prefix }}-directory:data-dir}/provided.csr.pem
context = key content {{ prefix }}-provided-csr-content:content
77
{%     elif template_csr %}
78 79
template = {{ '${' + prefix }}-provided-csr-content:content}
rendered = ${ {{- prefix }}-directory:data-dir}/provided.csr.pem
80
{%     endif %}
81 82
{{   rerequest(
       prefix=prefix ~ '-csr',
83 84
       buildout_bin_directory=buildout_bin_directory,
       template='${' ~ prefix ~  '-provided-csr:rendered}',
85 86 87
       csr='${:csr}',
       key=key_path,
)}}
88
{%-   else -%}
89 90
[{{ prefix }}-csr]
recipe = plone.recipe.command
91 92 93 94
command =
  if [ ! -f '{{ key_path or crt_path }}' ] && [ ! -f '${:csr}' ] ; then
    '{{ openssl }}' req -newkey rsa:2048 -batch -new -nodes -subj /CN=example.com -keyout '{{ key_path or crt_path }}' -out '${:csr}'
  fi
95
{%-   endif %}
96
csr = ${ {{- prefix }}-directory:data-dir}/good.csr.pem
97
{%- endif %}
98 99 100 101 102 103 104 105

[{{ prefix }}]
recipe = slapos.cookbook:wrapper
wrapper-path = {{ updater_path }}
command-line = '{{ buildout_bin_directory }}/caucase-updater'
  --ca-url '{{ url }}'
  --cas-ca '${ {{- prefix }}-directory:data-dir}/cas.crt.pem'
  --mode '{{ mode }}'
106 107
  {% if crt_path %}--csr '${ {{- prefix }}-csr:csr}'
  --crt '{{ crt_path }}' {%- endif %}
108 109 110
  --ca '{{ ca_path }}'
  --crl '{{ crl_path }}'
  {% if key_path %}--key '{{ key_path }}' {%- endif %}
111
  {% if on_renew %}--on-renew '{{ on_renew }}' {%- endif %}
112
  {% if max_sleep %}--max-sleep '{{ max_sleep }}' {%- endif %}
113 114 115 116 117 118 119 120 121
{% if promise -%}
[{{ prefix }}-promise]
<= monitor-promise-base
module = check_certificate
name = {{ prefix }}.py
config-certificate = {{ crt_path }}
config-key = {{ key_path }}
config-certificate-expiration-days = 15
{%- endif %}
122 123 124 125 126
{%- endmacro %}

{% macro rerequest(prefix, buildout_bin_directory, template, csr, key) -%}
[{{ prefix }}]
recipe = plone.recipe.command
127 128 129
checksum-file = '{{ template }}.md5'
command =
  set -e
130
  md5_current=$(${buildout:executable} -c "import hashlib ; hashlib.md5(open('{{ template }}', 'rb').read()).hexdigest()")
131 132 133 134 135 136 137
  md5_old=$([ -f ${:checksum-file} ] && cat ${:checksum-file} || echo none)
  if [ "$md5_current" != "$md5_old" ] || [ ! -f '{{ csr }}' ] || [ ! -f '{{ key }}' ] ; then
    '{{ buildout_bin_directory }}/caucase-rerequest' --template '{{ template }}' --csr '{{ csr }}' --key '{{ key }}'
    echo $md5_current > ${:checksum-file}
  fi
update-command = ${:command}
stop-on-error = True
138
{%- endmacro %}