# This module is distributed under the GNU Affero General Public License:
# 
# Monkeysphere module for puppet
# Copyright (C) 2009-2010 Sarava Group
# 
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or any later version.
# 
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
# 
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

#
# Class for monkeysphere management
#

class monkeysphere {
  # The needed packages
  package { monkeysphere: ensure => installed, }

  include monkeysphere::defaults
  file {
    "/etc/monkeysphere/monkeysphere.conf":
    mode => 644,
    ensure => present,
    content => template("monkeysphere/monkeysphere.conf.erb"),
  }
  file {
    "/etc/monkeysphere/monkeysphere-host.conf":
    mode => 644,
    ensure => present,
    content => template("monkeysphere/monkeysphere-host.conf.erb"),
  }
  file {
    "/etc/monkeysphere/monkeysphere-authentication.conf":
    mode => 644,
    ensure => present,
    content => template("monkeysphere/monkeysphere-authentication.conf.erb"),
  }
}

class monkeysphere::defaults {
  $keyserver = $monkeysphere_keyserver ? {
    '' => 'pool.sks-keyservers.net',
    default => $monkeysphere_keyserver
  }
}

define monkeysphere::import_key ( $scheme = 'ssh://', $port = '', $path = '/etc/ssh/ssh_host_rsa_key', $hostname = $fqdn ) {

  # if we're getting a port number, prefix with a colon so it's valid
  $port = $port ? {
    '' => '',
    default => ":$port"
  }

  $key = "${schema}://${fqdn}${port}"

  exec { "monkeysphere-host import-key $path $key":
    alias => "monkeysphere-import-key",
	  require => [ Package["monkeysphere"] ],
	  unless => "/usr/sbin/monkeysphere-host s | grep $key > /dev/null"
  }
}

# Server host key publication
define monkeysphere::publish_keys ( $keyid = '--all' ) { 
  exec { "monkeysphere-host publish-keys $keyid":
    environment => "MONKEYSPHERE_PROMPT=false",
	  require => [ Package["monkeysphere"], Exec["monkeysphere-import-key"] ],
  }
}

# optionally, mail key somehwere 
define monkeysphere::email_keys ( $email = 'root'  ) { 
  exec { "mail -s 'monkeysphere host pgp keys for $fqdn' $email < /var/lib/monkeysphere/host_keys.pub.pgp":
	  require => [ Package["monkeysphere"], Exec["monkeysphere-import-key"] ],
  }
}

# add certifiers
define monkeysphere::add_id_certifier( $keyid ) {
  exec { "monkeysphere-authentication add-id-certifier $keyid":
	  environment => "MONKEYSPHERE_PROMPT=false",
	  require => [ Package["monkeysphere"] ],
	  unless => "/usr/sbin/monkeysphere-authentication list-id-certifiers | grep $keyid > /dev/null"
  }
}

define monkeysphere::authorized_user_ids( $source, $user = 'root', $group = $user, $dest_dir = '/root/.monkeysphere', $dest_file = '.authorized_user_ids') {
  file {
    $dest_dir:
      owner => $user,
      group => $group,
      mode => 755,
      ensure => directory,
  }
  file {
    "${dest_dir}/${dest_file}":
      owner => $user,
      group => $group,
      mode => 644,
      source => $source,
      ensure => present,
      recurse => true,
  }

  exec { "monkeysphere-authentication update-users $user":
	  require => [ Package["monkeysphere"] ],
    refreshonly => true,
    subscribe => File["${dest_dir}/${dest_file}"] 
  }
}