-# [*protocol*] - Mail protocol to use: (imap|pop3|smtp)
-# [*auth_http*] - With this directive you can set the URL to the external HTTP-like server for authorization.
-# [*xclient*] - Whether to use xclient for smtp (on|off)
-# [*imap_auth*] - Sets permitted methods of authentication for IMAP clients.
-# [*imap_capabilities*] - Sets the IMAP protocol extensions list that is passed to the client in response to the CAPABILITY command.
-# [*imap_client_buffer*] - Sets the IMAP commands read buffer size.
-# [*pop3_auth*] - Sets permitted methods of authentication for POP3 clients.
-# [*pop3_capabilities*] - Sets the POP3 protocol extensions list that is passed to the client in response to the CAPA command.
-# [*smtp_auth*] - Sets permitted methods of SASL authentication for SMTP clients.
-# [*smtp_capabilities*] - Sets the SMTP protocol extensions list that is passed to the client in response to the EHLO command.
-# [*proxy_pass_error_message*] - Indicates whether to pass the error message obtained during the authentication on the backend to the client.
-# [*server_name*] - List of mailhostnames for which this mailhost will respond. Default [$name].
-# [*raw_prepend*] - A single string, or an array of strings to prepend to the server directive (after mailhost_cfg_prepend directive). NOTE: YOU are responsible for a semicolon on each line that requires one.
-# [*raw_append*] - A single string, or an array of strings to append to the server directive (after mailhost_cfg_append directive). NOTE: YOU are responsible for a semicolon on each line that requires one.
-# [*mailhost_cfg_append*] - It expects a hash with custom directives to put after everything else inside server
-# [*mailhost_cfg_prepend*] - It expects a hash with custom directives to put before everything else inside server
+# [*ensure*] - Enables or disables the specified mailhost (present|absent)
+# [*listen_ip*] - Default IP Address for NGINX to listen with this server on. Defaults to all interfaces (*)
+# [*listen_port*] - Default IP Port for NGINX to listen with this server on. Defaults to TCP 80
+# [*listen_options*] - Extra options for listen directive like 'default' to catchall. Undef by default.
+# [*ipv6_enable*] - BOOL value to enable/disable IPv6 support (false|true). Module will check to see if IPv6
+# support exists on your system before enabling.
+# [*ipv6_listen_ip*] - Default IPv6 Address for NGINX to listen with this server on. Defaults to all interfaces (::)
+# [*ipv6_listen_port*] - Default IPv6 Port for NGINX to listen with this server on. Defaults to TCP 80
+# [*ipv6_listen_options*] - Extra options for listen directive like 'default' to catchall. Template will allways add ipv6only=on.
+# While issue jfryman/puppet-nginx#30 is discussed, default value is 'default'.
+# [*index_files*] - Default index files for NGINX to read when traversing a directory
+# [*ssl*] - Indicates whether to setup SSL bindings for this mailhost.
+# [*ssl_cert*] - Pre-generated SSL Certificate file to reference for SSL Support. This is not generated by this module.
+# [*ssl_ciphers*] - Override default SSL ciphers. Defaults to nginx::ssl_ciphers
+# [*ssl_client_cert*] - Pre-generated SSL Certificate file to reference for client verify SSL Support. This is not generated by this module.
+# [*ssl_crl*] - String: Specifies CRL path in file system
+# [*ssl_dhparam*] - This directive specifies a file containing Diffie-Hellman key agreement protocol cryptographic parameters, in PEM
+# format, utilized for exchanging session keys between server and client.
+# [*ssl_ecdh_curve*] - This directive specifies a curve for ECDHE ciphers.
+# [*ssl_key*] - Pre-generated SSL Key file to reference for SSL Support. This is not generated by this module.
+# [*ssl_password_file*] - This directive specifies a file containing passphrases for secret keys.
+# [*ssl_port*] - Default IP Port for NGINX to listen with this SSL server on. Defaults to TCP 443
+# [*ssl_prefer_server_ciphers*] - Specifies that server ciphers should be preferred over client ciphers when using the SSLv3 and TLS protocols. Defaults
+# to $nginx::ssl_prefer_server_ciphers.
+# [*ssl_protocols*] - SSL protocols enabled. Defaults to nginx::ssl_protocols
+# [*ssl_session_cache*] - Sets the type and size of the session cache.
+# [*ssl_session_ticket_key*] - This directive specifies a file containing secret key used to encrypt and decrypt TLS session tickets.
+# [*ssl_session_tickets*] - Whether to enable or disable session resumption through TLS session tickets.
+# [*ssl_session_timeout*] - String: Specifies a time during which a client may reuse the session parameters stored in a cache.
+# Defaults to 5m.
+# [*ssl_trusted_cert*] - String: Specifies a file with trusted CA certificates in the PEM format used to verify client
+# certificates and OCSP responses if ssl_stapling is enabled.
+# [*ssl_verify_depth*] - Sets the verification depth in the client certificates chain.
+# [*protocol*] - Mail protocol to use: (imap|pop3|smtp)
+# [*auth_http*] - With this directive you can set the URL to the external HTTP-like server for authorization.
+# [*xclient*] - Whether to use xclient for smtp (on|off)
+# [*imap_auth*] - Sets permitted methods of authentication for IMAP clients.
+# [*imap_capabilities*] - Sets the IMAP protocol extensions list that is passed to the client in response to the CAPABILITY command.
+# [*imap_client_buffer*] - Sets the IMAP commands read buffer size.
+# [*pop3_auth*] - Sets permitted methods of authentication for POP3 clients.
+# [*pop3_capabilities*] - Sets the POP3 protocol extensions list that is passed to the client in response to the CAPA command.
+# [*smtp_auth*] - Sets permitted methods of SASL authentication for SMTP clients.
+# [*smtp_capabilities*] - Sets the SMTP protocol extensions list that is passed to the client in response to the EHLO command.
+# [*proxy_pass_error_message*] - Indicates whether to pass the error message obtained during the authentication on the backend to the client.
+# [*server_name*] - List of mailhostnames for which this mailhost will respond. Default [$name].
+# [*raw_prepend*] - A single string, or an array of strings to prepend to the server directive (after mailhost_cfg_prepend directive). NOTE: YOU are responsible for a semicolon on each line that requires one.
+# [*raw_append*] - A single string, or an array of strings to append to the server directive (after mailhost_cfg_append directive). NOTE: YOU are responsible for a semicolon on each line that requires one.
+# [*mailhost_cfg_append*] - It expects a hash with custom directives to put after everything else inside server
+# [*mailhost_cfg_prepend*] - It expects a hash with custom directives to put before everything else inside server
it { expect { is_expected.to contain_class('nginx::resource::server') }.to raise_error(Puppet::Error, %r{nginx: SSL certificate/key \(ssl_cert/ssl_cert\) and/or SSL Private must be defined and exist on the target system\(s\)}) }
end
context 'SSL key missing and ssl => true' do
let :params do
default_params.merge(ssl: true,
ssl_cert: 'cert')
end
it { expect { is_expected.to contain_class('nginx::resource::server') }.to raise_error(Puppet::Error, %r{nginx: SSL certificate/key \(ssl_cert/ssl_cert\) and/or SSL Private must be defined and exist on the target system\(s\)}) }
end
context "SSL cert missing and starttls => 'on'" do
let :params do
default_params.merge(starttls: 'on',
ssl_key: 'key')
end
it { expect { is_expected.to contain_class('nginx::resource::server') }.to raise_error(Puppet::Error, %r{nginx: SSL certificate/key \(ssl_cert/ssl_cert\) and/or SSL Private must be defined and exist on the target system\(s\)}) }
end
context "SSL key missing and starttls => 'on'" do
let :params do
default_params.merge(starttls: 'on',
ssl_cert: 'cert')
end
it { expect { is_expected.to contain_class('nginx::resource::server') }.to raise_error(Puppet::Error, %r{nginx: SSL certificate/key \(ssl_cert/ssl_cert\) and/or SSL Private must be defined and exist on the target system\(s\)}) }
end
context "SSL cert missing and starttls => 'only'" do
let :params do
default_params.merge(starttls: 'only',
ssl_key: 'key')
end
it { expect { is_expected.to contain_class('nginx::resource::server') }.to raise_error(Puppet::Error, %r{nginx: SSL certificate/key \(ssl_cert/ssl_cert\) and/or SSL Private must be defined and exist on the target system\(s\)}) }
end
context "SSL key missing and starttls => 'only'" do
let :params do
default_params.merge(starttls: 'only',
ssl_cert: 'cert')
end
it { expect { is_expected.to contain_class('nginx::resource::server') }.to raise_error(Puppet::Error, %r{nginx: SSL certificate/key \(ssl_cert/ssl_cert\) and/or SSL Private must be defined and exist on the target system\(s\)}) }
end
context 'when listen_port != ssl_port' do
let :params do
default_params.merge(listen_port: 80,
ssl_port: 443)
end
it { is_expected.to contain_concat__fragment("#{title}-header") }
end
context 'when listen_port != "ssl_port"' do
let :params do
default_params.merge(listen_port: 80,
ssl_port: 443)
end
it { is_expected.to contain_concat__fragment("#{title}-header") }
end
context 'when listen_port == ssl_port' do
let :params do
default_params.merge(listen_port: 80,
ssl_port: 80)
end
it { is_expected.not_to contain_concat__fragment("#{title}-header") }
end
context 'when listen_port == "ssl_port"' do
let :params do
default_params.merge(listen_port: 80,
ssl_port: 80)
end
it { is_expected.not_to contain_concat__fragment("#{title}-header") }
end
context 'when ssl => true' do
let :params do
default_params.merge(ensure: 'absent',
ssl: true,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert')
end
it { is_expected.to contain_concat__fragment("#{title}-header") }
it { is_expected.to contain_concat__fragment("#{title}-ssl") }
end
context 'when ssl => false' do
let :params do
default_params.merge(ensure: 'absent',
ssl: false)
end
it { is_expected.to contain_concat__fragment("#{title}-header") }
it { is_expected.not_to contain_concat__fragment("#{title}-ssl") }
it { is_expected.to contain_nginx__resource__location("#{title}-default").with_fastcgi_param('key' => 'value') }
end
context 'when uwsgi => "uwsgi_upstream"' do
let :params do
default_params.merge(uwsgi: 'uwsgi_upstream')
end
it { is_expected.to contain_file('/etc/nginx/uwsgi_params').with_mode('0644') }
end
context 'when listen_port == ssl_port' do
let :params do
default_params.merge(listen_port: 80,
ssl_port: 80)
end
it { is_expected.not_to contain_concat__fragment("#{title}-header") }
it { is_expected.not_to contain_concat__fragment("#{title}-footer") }
end
context 'when listen_port != ssl_port' do
let :params do
default_params.merge(listen_port: 80,
ssl_port: 443)
end
it { is_expected.to contain_concat__fragment("#{title}-header") }
it { is_expected.to contain_concat__fragment("#{title}-footer") }
end
context 'when ensure => absent' do
let :params do
default_params.merge(ensure: 'absent',
ssl: true,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert')
end
it { is_expected.to contain_nginx__resource__location("#{title}-default").with_ensure('absent') }
it { is_expected.to contain_file("#{title}.conf symlink").with_ensure('absent') }
end
context 'when ssl => true and ssl_port == listen_port' do
let :params do
default_params.merge(ssl: true,
listen_port: 80,
ssl_port: 80,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert')
end
it { is_expected.to contain_nginx__resource__location("#{title}-default").with_ssl_only(true) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{access_log\s+/var/log/nginx/ssl-www\.rspec\.example\.com\.access\.log combined;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{error_log\s+/var/log/nginx/ssl-www\.rspec\.example\.com\.error\.log}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{ssl_certificate\s+dummy.cert;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{ssl_certificate_key\s+dummy.key;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-footer") }
end
context 'when ssl_client_cert is set' do
let :params do
default_params.merge(ssl: true,
listen_port: 80,
ssl_port: 80,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert',
ssl_client_cert: 'client.cert',
ssl_verify_client: 'optional')
end
it { is_expected.to contain_nginx__resource__location("#{title}-default").with_ssl_only(true) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{access_log\s+/var/log/nginx/ssl-www\.rspec\.example\.com\.access\.log combined;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{error_log\s+/var/log/nginx/ssl-www\.rspec\.example\.com\.error\.log}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{ssl_verify_client\s+optional;}) }
end
context 'when passenger_cgi_param is set' do
let :params do
default_params.merge(passenger_cgi_param: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'test3' => 'test value 3' })
end
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_set_cgi_param test1 test value 1;}) }
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_set_cgi_param test2 test value 2;}) }
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_set_cgi_param test3 test value 3;}) }
end
context 'when passenger_cgi_param is set and ssl => true' do
let :params do
default_params.merge(passenger_cgi_param: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'test3' => 'test value 3' },
ssl: true,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert')
end
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_set_cgi_param test1 test value 1;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_set_cgi_param test2 test value 2;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_set_cgi_param test3 test value 3;}) }
end
context 'when passenger_set_header is set' do
let :params do
default_params.merge(passenger_set_header: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'test3' => 'test value 3' })
end
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_set_header test1 test value 1;}) }
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_set_header test2 test value 2;}) }
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_set_header test3 test value 3;}) }
end
context 'when passenger_set_header is set and ssl => true' do
let :params do
default_params.merge(passenger_set_header: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'test3' => 'test value 3' },
ssl: true,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert')
end
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_set_header test1 test value 1;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_set_header test2 test value 2;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_set_header test3 test value 3;}) }
end
context 'when passenger_env_var is set' do
let :params do
default_params.merge(passenger_env_var: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'test3' => 'test value 3' })
end
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_env_var test1 test value 1;}) }
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_env_var test2 test value 2;}) }
it { is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{passenger_env_var test3 test value 3;}) }
end
context 'when passenger_env_var is set and ssl => true' do
let :params do
default_params.merge(passenger_env_var: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'test3' => 'test value 3' },
ssl: true,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert')
end
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_env_var test1 test value 1;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_env_var test2 test value 2;}) }
it { is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{passenger_env_var test3 test value 3;}) }
it { is_expected.to contain_concat__fragment("#{title}-footer").with_content(%r{passenger_pre_start http://example.com:80/test/me;}) }
it { is_expected.to contain_concat__fragment("#{title}-footer").with_content(%r{passenger_pre_start http://example.com:3009/foo/bar;}) }
end
context 'when server name is sanitized' do
let(:title) { 'www rspec-server com' }
let(:params) { default_params }
it { is_expected.to contain_concat('/etc/nginx/sites-available/www_rspec-server_com.conf') }
end
context 'when add_header is set' do
let :params do
default_params.merge(add_header: { 'header3' => 'test value 3', 'header2' => 'test value 2', 'header1' => 'test value 1' })
end
it 'has correctly ordered entries in the config' do
is_expected.to contain_concat__fragment("#{title}-header").with_content(%r{\s+add_header\s+"header1" "test value 1";\n\s+add_header\s+"header2" "test value 2";\n\s+add_header\s+"header3" "test value 3";\n})
end
end
context 'when add_header is set and ssl => true' do
let :params do
default_params.merge(add_header: { 'header3' => 'test value 3', 'header2' => 'test value 2', 'header1' => 'test value 1' },
ssl: true,
ssl_key: 'dummy.key',
ssl_cert: 'dummy.cert')
end
it 'has correctly ordered entries in the config' do
is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(%r{\s+add_header\s+"header1" "test value 1";\n\s+add_header\s+"header2" "test value 2";\n\s+add_header\s+"header3" "test value 3";\n})