Add hiera-gpg for storing secrets used in templates.

3 files changed, 71 insertions, 0 deletions

diff --git a/global/overlay/etc/puppet/cosmos-modules.conf b/global/overlay/etc/puppet/cosmos-modules.conf
index ea69171..af786c4 100644
--- a/global/overlay/etc/puppet/cosmos-modules.conf
+++ b/global/overlay/etc/puppet/cosmos-modules.conf
@@ -10,3 +10,4 @@ vcsrepo puppetlabs/vcsrepo no
 xinetd puppetlabs/xinetd no
 #golang elithrar/golang yes
 #python git://github.com/stankevich/puppet-python.git yes
+hiera-gpg git://github.com/SUNET/hiera-gpg.git no
diff --git a/global/overlay/etc/puppet/hiera.yaml b/global/overlay/etc/puppet/hiera.yaml
index e69de29..cd619bb 100644
--- a/global/overlay/etc/puppet/hiera.yaml
+++ b/global/overlay/etc/puppet/hiera.yaml
@@ -0,0 +1,18 @@
+---
+:backends: - yaml
+           - gpg
+
+:logger: console
+
+:hierarchy: - %{env}/%{location}/%{calling_module}
+            - %{env}/%{calling_module}
+            - secrets.yaml
+            - common
+
+
+:yaml:
+   :datadir: /etc/hiera/data
+
+:gpg:
+   :datadir: /etc/hiera/data
+   :key_dir: /etc/hiera/gpg
diff --git a/global/pre-tasks.d/040hiera-gpg b/global/pre-tasks.d/040hiera-gpg
new file mode 100755
index 0000000..e5de6da
--- /dev/null
+++ b/global/pre-tasks.d/040hiera-gpg
@@ -0,0 +1,52 @@
+#!/bin/sh
+#
+# Set up a keyring for Hiera GPG
+#   https://github.com/crayfishx/hiera-gpg
+#
+
+set -e
+
+GNUPGHOME=/etc/hiera/gpg
+export GNUPGHOME
+
+if [ ! -f /usr/lib/ruby/vendor_ruby/gpgme.rb ]; then
+    apt-get update
+    apt-get -y install ruby-gpgme
+fi
+
+
+if [ ! -s $GNUPGHOME/secring.gpg ]; then
+
+    if [ "x$1" != "x--force" ]; then
+	echo ""
+	echo "Automatic Hiera-GPG key generation DISABLED (to not block on missing entropy)"
+	echo ""
+	echo "  Run \`$0 --force' manually"
+	echo ""
+	exit 0
+    fi
+
+    if [ ! -f /usr/bin/gpg2 ]; then
+	apt-get update
+	apt-get -y install gnupg2
+    fi
+
+    mkdir -p $GNUPGHOME
+    chmod 700 $GNUPGHOME
+
+    TMPFILE=$(mktemp /tmp/hiera-gpg.XXXXXX)
+    cat > $TMPFILE <<EOF
+%echo Generating a default key
+Key-Type: default
+Subkey-Type: default
+Name-Real: Cosmos Puppet
+Name-Comment: Hiera GPG key
+Name-Email: root@`hostname --fqdn`
+Expire-Date: 0
+# Do a commit here, so that we can later print "done" :-)
+%commit
+%echo done
+EOF
+    gpg2 --batch --gen-key $TMPFILE
+    rm -f $TMPFILE
+fi