Skip to content

Commit 0ae14f8

Browse files
smortexsmortex
committed
Mandate the use of Sensitive to pass passwords
This allows us to get rid of the `show_diff` trickery as an epp template that render a Sensitive value return a Sensitive. While here, fix some data-type mismatches.
1 parent 875256f commit 0ae14f8

12 files changed

Lines changed: 58 additions & 70 deletions

File tree

‎REFERENCE.md‎

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@
3838
* [`Bacula::Command`](#Bacula--Command): A Bacula console command
3939
* [`Bacula::JobType`](#Bacula--JobType): The type of job
4040
* [`Bacula::Message`](#Bacula--Message): A Bacula message specification
41-
* [`Bacula::Password`](#Bacula--Password): Temporary workarond to accept Sensitive and non-Sensitive passwords
4241
* [`Bacula::Runscript`](#Bacula--Runscript): A Bacula Runscript specification
4342
* [`Bacula::Size`](#Bacula--Size): A size indication
4443
* [`Bacula::Time`](#Bacula--Time): A time indication
@@ -380,7 +379,7 @@ Default value: `[]`
380379

381380
##### <a name="-bacula--client--password"></a>`password`
382381

383-
Data type: `Bacula::Password`
382+
Data type: `Sensitive[String[1]]`
384383

385384
A password to use for communication with this File Daemon
386385

@@ -585,7 +584,7 @@ Default value: `'bacula'`
585584

586585
##### <a name="-bacula--director--db_pw"></a>`db_pw`
587586

588-
Data type: `Bacula::Password`
587+
Data type: `Sensitive[String[1]]`
589588

590589
The database user's password
591590

@@ -682,7 +681,7 @@ Default value: `true`
682681

683682
##### <a name="-bacula--director--password"></a>`password`
684683

685-
Data type: `Bacula::Password`
684+
Data type: `Sensitive[String[1]]`
686685

687686
password to connect to the director
688687

@@ -756,7 +755,7 @@ Default value: `$bacula::director::db_name`
756755

757756
##### <a name="-bacula--director--postgresql--db_pw"></a>`db_pw`
758757

759-
Data type: `Bacula::Password`
758+
Data type: `Sensitive[String[1]]`
760759

761760
The database user's password
762761

@@ -937,7 +936,7 @@ Default value: `'File'`
937936

938937
##### <a name="-bacula--storage--password"></a>`password`
939938

940-
Data type: `Bacula::Password`
939+
Data type: `Sensitive[String[1]]`
941940

942941
Specifies the password that must be supplied by the named Director
943942

@@ -1032,7 +1031,7 @@ The port of the Bacula File server daemon
10321031

10331032
##### <a name="-bacula--director--client--password"></a>`password`
10341033

1035-
Data type: `Bacula::Password`
1034+
Data type: `Sensitive[String[1]]`
10361035

10371036
The password to be used when establishing a connection with the File services
10381037

@@ -1107,7 +1106,7 @@ Default value: `$bacula::conf_dir`
11071106

11081107
##### <a name="-bacula--director--console--password"></a>`password`
11091108

1110-
Data type: `Bacula::Password`
1109+
Data type: `Sensitive[String[1]]`
11111110

11121111
The password that must be supplied for a named Bacula Console to be authorized
11131112

@@ -1478,7 +1477,7 @@ Default value: `9103`
14781477

14791478
##### <a name="-bacula--director--storage--password"></a>`password`
14801479

1481-
Data type: `Bacula::Password`
1480+
Data type: `Sensitive[String[1]]`
14821481

14831482
Bacula director configuration for Storage option 'Password'
14841483

@@ -2399,12 +2398,6 @@ Struct[{
23992398
}]
24002399
```
24012400

2402-
### <a name="Bacula--Password"></a>`Bacula::Password`
2403-
2404-
Temporary workarond to accept Sensitive and non-Sensitive passwords
2405-
2406-
Alias of `Variant[String[1], Sensitive[String[1]]]`
2407-
24082401
### <a name="Bacula--Runscript"></a>`Bacula::Runscript`
24092402

24102403
A Bacula Runscript specification

‎data/common.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,15 @@
11
---
2+
lookup_options:
3+
"bacula::client::password":
4+
convert_to: "Sensitive"
5+
"bacula::director::db_pw":
6+
convert_to: "Sensitive"
7+
"bacula::director::password":
8+
convert_to: "Sensitive"
9+
"bacula::storage::password":
10+
convert_to: "Sensitive"
11+
"bacula::storage::password":
12+
convert_to: "Sensitive"
213
bacula::director::messages:
314
Daemon:
415
mname: 'Daemon'

‎manifests/client.pp‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@
6363
String[1] $ensure = 'present',
6464
Stdlib::Port $port = 9102,
6565
Array[String[1]] $listen_address = [],
66-
Bacula::Password $password = Sensitive('secret'),
66+
Sensitive[String[1]] $password = Sensitive('secret'),
6767
Integer[1] $max_concurrent_jobs = 2,
6868
String[1] $director_name = $bacula::director_name,
6969
Bacula::Yesno $autoprune = true,
@@ -94,12 +94,11 @@
9494
$use_pki = ($pki_signatures or $pki_encryption) and $pki_keypair
9595

9696
concat { $config_file:
97-
owner => 'root',
98-
group => $group,
99-
mode => '0640',
100-
show_diff => false,
101-
require => Package[$packages],
102-
notify => Service[$services],
97+
owner => 'root',
98+
group => $group,
99+
mode => '0640',
100+
require => Package[$packages],
101+
notify => Service[$services],
103102
}
104103

105104
concat::fragment { 'bacula-client-header':

‎manifests/director.pp‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
Bacula::Yesno $manage_db = true,
4545
Stdlib::Absolutepath $conf_dir = $bacula::conf_dir,
4646
String[1] $db_name = 'bacula',
47-
Bacula::Password $db_pw = Sensitive('notverysecret'),
47+
Sensitive[String[1]] $db_pw = Sensitive('notverysecret'),
4848
String[1] $db_user = 'bacula',
4949
Optional[String[1]] $db_address = undef,
5050
Optional[Stdlib::Port] $db_port = undef,
@@ -56,7 +56,7 @@
5656
Array[String[1]] $listen_address = [],
5757
Integer[1] $max_concurrent_jobs = 20,
5858
Boolean $manage_defaults = true,
59-
Bacula::Password $password = Sensitive('secret'),
59+
Sensitive[String[1]] $password = Sensitive('secret'),
6060
Stdlib::Port $port = 9101,
6161
Stdlib::Absolutepath $rundir = $bacula::rundir,
6262
String[1] $storage_name = $bacula::storage_name,
@@ -100,11 +100,10 @@
100100
}
101101

102102
file { "${conf_dir}/bconsole.conf":
103-
owner => 'root',
104-
group => $group,
105-
mode => '0640',
106-
show_diff => false,
107-
content => epp('bacula/bconsole.conf.epp');
103+
owner => 'root',
104+
group => $group,
105+
mode => '0640',
106+
content => epp('bacula/bconsole.conf.epp');
108107
}
109108

110109
Concat {
@@ -145,7 +144,6 @@
145144
Concat::Fragment <<| tag == "bacula-${director}" |>>
146145

147146
concat { "${conf_dir}/bacula-dir.conf":
148-
show_diff => false,
149147
}
150148

151149
$sub_confs = [
@@ -154,20 +152,13 @@
154152
"${conf_dir}/conf.d/job.conf",
155153
"${conf_dir}/conf.d/jobdefs.conf",
156154
"${conf_dir}/conf.d/fileset.conf",
157-
]
158-
159-
$sub_confs_with_secrets = [
160155
"${conf_dir}/conf.d/console.conf",
161156
"${conf_dir}/conf.d/client.conf",
162157
"${conf_dir}/conf.d/storage.conf",
163158
]
164159

165160
concat { $sub_confs: }
166161

167-
concat { $sub_confs_with_secrets:
168-
show_diff => false,
169-
}
170-
171162
bacula::director::fileset { 'Common':
172163
files => ['/etc'],
173164
}

‎manifests/director/client.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
define bacula::director::client (
2626
String[1] $address,
2727
Variant[String[1],Stdlib::Port] $port, # FIXME: Remove String
28-
Bacula::Password $password,
28+
Sensitive[String[1]] $password,
2929
Bacula::Time $file_retention,
3030
Bacula::Time $job_retention,
3131
Bacula::Yesno $autoprune,

‎manifests/director/console.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
# }
2626
#
2727
define bacula::director::console (
28-
Bacula::Password $password,
28+
Sensitive[String[1]] $password,
2929
String $conf_dir = $bacula::conf_dir,
3030
String[1] $catalogacl = '*all*',
3131
Array[Bacula::Command] $commandacl = ['list'],

‎manifests/director/postgresql.pp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@
88
# @param db_user The database user
99
#
1010
class bacula::director::postgresql (
11-
String[1] $make_bacula_tables = $bacula::director::make_bacula_tables,
12-
String[1] $db_name = $bacula::director::db_name,
13-
Bacula::Password $db_pw = $bacula::director::db_pw,
14-
String[1] $db_user = $bacula::director::db_user,
11+
String[1] $make_bacula_tables = $bacula::director::make_bacula_tables,
12+
String[1] $db_name = $bacula::director::db_name,
13+
Sensitive[String[1]] $db_pw = $bacula::director::db_pw,
14+
String[1] $db_user = $bacula::director::db_user,
1515
) {
1616
include bacula
1717

‎manifests/director/storage.pp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
define bacula::director::storage (
2020
String[1] $address = $name,
2121
Stdlib::Port $port = 9103,
22-
Bacula::Password $password = Sensitive('secret'),
22+
Sensitive[String[1]] $password = Sensitive('secret'),
2323
String[1] $device_name = "${facts['networking']['fqdn']}-device",
2424
String[1] $media_type = 'File',
2525
Optional[Integer[1]] $maxconcurjobs = undef,

‎manifests/storage.pp‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
Optional[Integer[1]] $maxconcurjobs = undef,
4646
Integer[1] $max_concurrent_jobs = 20,
4747
String[1] $media_type = 'File',
48-
Bacula::Password $password = Sensitive('secret'),
48+
Sensitive[String[1]] $password = Sensitive('secret'),
4949
Stdlib::Port $port = 9103,
5050
Stdlib::Absolutepath $rundir = $bacula::rundir,
5151
String[1] $storage = $trusted['certname'], # storage here is not storage_name
@@ -99,11 +99,10 @@
9999
Concat::Fragment <<| tag == "bacula-storage-dir-${director_name}" |>>
100100

101101
concat { "${conf_dir}/bacula-sd.conf":
102-
owner => 'root',
103-
group => $group,
104-
mode => '0640',
105-
show_diff => false,
106-
notify => Service[$services],
102+
owner => 'root',
103+
group => $group,
104+
mode => '0640',
105+
notify => Service[$services],
107106
}
108107

109108
@@bacula::director::storage { $storage:

‎spec/defines/director_console_spec.rb‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@
1414

1515
let(:params) do
1616
{
17-
password: 'monitoring_password',
17+
password: sensitive('monitoring_password'),
1818
}
1919
end
2020

21-
it { is_expected.to contain_concat__fragment('bacula-director-console-Monitoring').with(content: <<~FRAGMENT) }
21+
it { is_expected.to contain_concat__fragment('bacula-director-console-Monitoring').with(content: sensitive(<<~FRAGMENT)) }
2222
Console {
2323
Name = Monitoring
2424
Password = "monitoring_password"
@@ -33,7 +33,7 @@
3333

3434
let(:params) do
3535
{
36-
password: 'A different UntrustedUser',
36+
password: sensitive('A different UntrustedUser'),
3737
jobacl: 'Restricted Client Save',
3838
clientacl: 'restricted-client',
3939
storageacl: 'second-storage',
@@ -46,7 +46,7 @@
4646
}
4747
end
4848

49-
it { is_expected.to contain_concat__fragment('bacula-director-console-restricted-user').with(content: <<~FRAGMENT) }
49+
it { is_expected.to contain_concat__fragment('bacula-director-console-restricted-user').with(content: sensitive(<<~FRAGMENT)) }
5050
Console {
5151
Name = restricted-user
5252
Password = "A different UntrustedUser"

0 commit comments

Comments
 (0)