From 7eb774354a82ba4b9cd123f432830682d0ebdb6c Mon Sep 17 00:00:00 2001
From: Vincent Le Gallic <legallic@crans.org>
Date: Mon, 4 Mar 2013 20:09:46 +0100
Subject: [PATCH] =?UTF-8?q?[secrets]=20On=20cr=C3=A9e=20un=20Bundle=20et?=
 =?UTF-8?q?=20un=20Groupe=20=C3=A0=20part=20pour=20la=20gestion=20des=20se?=
 =?UTF-8?q?crets.=20On=20pense=20aussi=20=C3=A0=20ajouter=20une=20action?=
 =?UTF-8?q?=20pour=20que=20les=20secrets=20soit=20lisibles=20par=20www-dat?=
 =?UTF-8?q?a=20sur=20le=20serveur=20de=20l'intranet2.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Bundler/secrets.xml | 20 ++++++++++++++++++++
 Metadata/groups.xml | 13 +++++++++----
 Rules/secrets.xml   |  8 ++++++++
 3 files changed, 37 insertions(+), 4 deletions(-)
 create mode 100644 Bundler/secrets.xml
 create mode 100644 Rules/secrets.xml

diff --git a/Bundler/secrets.xml b/Bundler/secrets.xml
new file mode 100644
index 0000000..84d1071
--- /dev/null
+++ b/Bundler/secrets.xml
@@ -0,0 +1,20 @@
+<Bundle name="secrets">
+ <Group name="secrets">
+   <Group name="bcfg2-server" negate="true">
+     <!-- Sur le serveur les fichiers suivant sont utilises comme
+          sources pour les clients -->
+     <Path name="/etc/crans/secrets" type="directory"/>
+     <Python name="/etc/crans/secrets/secrets.py"/>
+     <Group name="rsync">
+       <Python name="/etc/crans/secrets/rsyncd.secrets"/>
+     </Group>
+     <Python name="/etc/crans/secrets/slon.py"/>
+     <Python name="/etc/crans/secrets/nols.py"/>
+     <Python name="/etc/crans/secrets/README"/>
+     <!-- Il faut penser au setfacl sur le serveur de l'intranet2 (o2) -->
+     <Group name="intranet2-server">
+       <Action name="setfacl-secrets"/>
+     </Group>
+   </Group>
+ </Group>
+</Bundle>
diff --git a/Metadata/groups.xml b/Metadata/groups.xml
index 21ee299..d9583d1 100644
--- a/Metadata/groups.xml
+++ b/Metadata/groups.xml
@@ -299,7 +299,7 @@
   <Group name="o2"
          profile="true">
     <Group name="crans-domu-squeeze"/>
-    <Group name="nginx" comment="Pour l'intranet"/>
+    <Group name="intranet2-server"/>
     <Bundle name="check_cert" />
     <Group name="https_cert" />
   </Group>
@@ -425,7 +425,10 @@
        a un serveur du Cr@ns. -->
 
   <Group name="crans" comment="groupe encore plus minimal pour un serveur du Crans">
+    <Group name="secrets"/>
+
     <Bundle name="knownhosts"/>
+    <Bundle name="secrets"/>
   </Group>
 
   <Group name="crans-common"
@@ -441,7 +444,6 @@
     <Group name="mail"/>
     <Group name="apt"/>
     <Group name="cron"/>
-    <Group name="secrets"/>
     <Group name="bcfg2-client"/>
     <Group name="backup-client"/>
     <Group name="munin-node"/>
@@ -510,7 +512,6 @@
 
     <Group name="mail"/>
     <Group name="apt"/>
-    <Group name="secrets"/>
     <Group name="bcfg2-client"/>
     <Group name="backup-client"/>
     <Group name="xen"/>
@@ -529,7 +530,6 @@
     <Group name="squeeze"/>
     <Group name="mail"/>
     <Group name="apt"/>
-    <Group name="secrets"/>
     <Group name="bcfg2-client"/>
     <Group name="backup-client"/>
     <Group name="rsyslog-client"/>
@@ -724,6 +724,11 @@
     <Group name="intranet-server-backend"/>
   </Group>
 
+  <Group name="intranet2-server"
+     comment="le serveur HTTPS (port 443) gérant intranet2.crans.org">
+    <Group name="nginx" comment="Pour l'intranet"/>
+  </Group>
+
   <Group name="wiki">
     <Bundle name="moinmoin" />
   </Group>
diff --git a/Rules/secrets.xml b/Rules/secrets.xml
new file mode 100644
index 0000000..f32dd4c
--- /dev/null
+++ b/Rules/secrets.xml
@@ -0,0 +1,8 @@
+<!-- Règles pour secrets //-->
+<Rules priority="1">
+  <Group name="intranet2-server">
+   <Action name="setfacl-secrets" timing="post"
+     when="modified" status="check"
+     command="setfacl -m u:www-data:rx /etc/crans/secrets; setfacl -m u:www-data:r /etc/crans/secrets/secrets.py"/>
+  </Group>
+</Rules>