caucase.jinja2.library 3.31 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
{% macro caucased(
  prefix,
  buildout_bin_directory,
  caucased_path,
  data_dir,
  netloc,
  service_auto_approve_count=0,
  user_auto_approve_count=1,
  key_len=None,
  backup_dir=None,
  promise=None
) -%}
[{{ prefix }}-directory]
recipe = slapos.cookbook:mkdirectory
data-dir = {{ data_dir }}
mode = 0750

[{{ prefix }}]
recipe = slapos.cookbook:wrapper
wrapper-path = {{ caucased_path }}
command-line = '{{ buildout_bin_directory }}/caucased'
  --db          '${ {{- prefix }}-directory:data-dir}/caucase.sqlite'
  --server-key  '${ {{- prefix }}-directory:data-dir}/server.key.pem'
  --netloc      '{{ netloc }}'
  {% if key_len %}--key-len '{{ key_len }}' {%- endif %}
  {% if backup_dir %}--backup-directory {{ backup_dir }} {%- endif %}
  --service-auto-approve-count '{{ service_auto_approve_count }}'
  --user-auto-approve-count    '{{ user_auto_approve_count }}'
  --lock-auto-approve-count

{% if promise -%}
[{{ prefix }}-promise]
recipe = slapos.cookbook:wrapper
wrapper-path = {{ promise }}
command-line = '{{ buildout_bin_directory }}/caucase-probe' 'http://{{ netloc }}'
{%- endif %}
{%- endmacro %}

{% macro updater(
  prefix,
  buildout_bin_directory,
  updater_path,
  url,
  data_dir,
  crt_path,
  ca_path,
  crl_path,
  key_path=None,
  on_renew=None,
  max_sleep=None,
  mode='service',
52
  template_csr=None,
53 54 55 56 57 58 59
  template_csr_pem=None,
  openssl=None
) -%}
[{{ prefix }}-directory]
recipe = slapos.cookbook:mkdirectory
data-dir = {{ data_dir }}

60
{% if template_csr_pem or template_csr -%}
61
[{{ prefix }}-provided-csr-content]
62
{%   if template_csr_pem %}
63
content = {{ dumps(template_csr_pem) }}
64 65 66
{%   elif template_csr %}
content = {{ template_csr }}
{%   endif %}
67 68 69
[{{ prefix }}-provided-csr]
recipe = slapos.recipe.template:jinja2
mode = 644
70
{%   if template_csr_pem %}
71 72 73
template = inline:{{ '{{ content }}' }}
rendered = ${ {{- prefix }}-directory:data-dir}/provided.csr.pem
context = key content {{ prefix }}-provided-csr-content:content
74 75 76 77
{%   elif template_csr %}
template = {{ '${' + prefix }}-provided-csr-content:content}
rendered = ${ {{- prefix }}-directory:data-dir}/provided.csr.pem
{%   endif %}
78 79
{{   rerequest(
       prefix=prefix ~ '-csr',
80 81
       buildout_bin_directory=buildout_bin_directory,
       template='${' ~ prefix ~  '-provided-csr:rendered}',
82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112
       csr='${:csr}',
       key=key_path,
)}}
{%- else -%}
[{{ prefix }}-csr]
recipe = plone.recipe.command
command = '{{ openssl }}' req -newkey rsa:2048 -batch -new -nodes -subj /CN=example.com -keyout '{{ key_path or crt_path }}' -out '${:csr}'
{%- endif %}
csr = ${ {{- prefix }}-directory:data-dir}/good.csr.pem

[{{ prefix }}]
recipe = slapos.cookbook:wrapper
wrapper-path = {{ updater_path }}
command-line = '{{ buildout_bin_directory }}/caucase-updater'
  --ca-url '{{ url }}'
  --cas-ca '${ {{- prefix }}-directory:data-dir}/cas.crt.pem'
  --mode '{{ mode }}'
  --csr '${ {{- prefix }}-csr:csr}'
  --crt '{{ crt_path }}'
  --ca '{{ ca_path }}'
  --crl '{{ crl_path }}'
  {% if key_path %}--key '{{ key_path }}' {%- endif %}
  --on-renew '{{ on_renew }}'
  {% if max_sleep %}--max-sleep '{{ max_sleep }}' {%- endif %}
{%- endmacro %}

{% macro rerequest(prefix, buildout_bin_directory, template, csr, key) -%}
[{{ prefix }}]
recipe = plone.recipe.command
command = '{{ buildout_bin_directory }}/caucase-rerequest' --template '{{ template }}' --csr '{{ csr }}' --key '{{ key }}'
{%- endmacro %}