config wireguard group

REFERENCE.md

@@ -33,6 +33,7 @@ manages the wireguard package
 
 The following parameters are available in the `wireguard` class:
 
+* [`config_directory_group`](#-wireguard--config_directory_group)
 * [`manage_package`](#-wireguard--manage_package)
 * [`package_name`](#-wireguard--package_name)
 * [`package_ensure`](#-wireguard--package_ensure)
@@ -41,6 +42,12 @@ The following parameters are available in the `wireguard` class:
 * [`interfaces`](#-wireguard--interfaces)
 * [`default_allowlist`](#-wireguard--default_allowlist)
 
+##### <a name="-wireguard--config_directory_group"></a>`config_directory_group`
+
+Data type: `String`
+
+specify the group on `$config_directory`
+
 ##### <a name="-wireguard--manage_package"></a>`manage_package`
 
 Data type: `Boolean`

data/common.yaml

@@ -0,0 +1,3 @@
+---
+
+wireguard::config_directory_group: 'systemd-network'

data/os/RedHat.yaml

@@ -0,0 +1,3 @@
+---
+
+wireguard::config_directory_group: 'root'

hiera.yaml

@@ -0,0 +1,13 @@
+---
+version: 5
+
+defaults:  # Used for any hierarchy level that omits these keys.
+  datadir: data         # This path is relative to hiera.yaml's directory.
+  data_hash: yaml_data  # Use the built-in YAML backend.
+
+hierarchy:
+  - name: "osfamily"
+    paths:
+      - "os/%{facts.os.family}.yaml"
+  - name: 'common'
+    path: 'common.yaml'

manifests/init.pp

@@ -1,6 +1,7 @@
 #
 # @summary manages the wireguard package
 #
+# @param config_directory_group specify the group on `$config_directory`
 # @param manage_package if the package should be managed or not
 # @param package_name the name of the package
 # @param package_ensure the ensure state of the package
@@ -12,6 +13,7 @@
 # @author Tim Meusel <[email protected]>
 #
 class wireguard (
+  String $config_directory_group,
   Boolean $manage_package = true,
   String[1] $package_name = 'wireguard-tools',
   Enum['installed', 'latest', 'absent'] $package_ensure = 'installed',
@@ -40,7 +42,7 @@
     ensure => $_file_ensure,
     owner  => 'root',
     mode   => '0750',
-    group  => 'systemd-network',
+    group  => $config_directory_group,
     *      => $options,
   }
 

manifests/interface.pp

@@ -270,7 +270,7 @@
       ensure  => 'file',
       content => $private_key,
       owner   => 'root',
-      group   => 'systemd-network',
+      group   => $wireguard::config_directory_group,
       mode    => '0640',
       notify  => Exec["generate public key ${interface}"],
     }
@@ -287,7 +287,7 @@
     file { $private_key_path:
       ensure => 'file',
       owner  => 'root',
-      group  => 'systemd-network',
+      group  => $wireguard::config_directory_group,
       mode   => '0640',
     }
   }
@@ -303,7 +303,7 @@
     ensure  => 'file',
     owner   => 'root',
     group   => 'root',
-    mode    => '0600',
+    mode    => '0644',
     require => Exec["generate public key ${interface}"],
   }
 

manifests/provider/systemd.pp

@@ -38,7 +38,7 @@
     owner           => 'root',
     group           => 'systemd-network',
     mode            => '0440',
-    require         => File["/etc/wireguard/${interface}"],
+    require         => File["${wireguard::config_directory}/${interface}"],
   }
 
   $network_epp_params = {

manifests/provider/wgquick.pp

@@ -32,10 +32,11 @@
     'default_allowlist' => $default_allowlist,
   }
 
-  file { "/etc/wireguard/${interface}.conf":
+  file { "${wireguard::config_directory}/${interface}.conf":
     ensure  => $ensure,
     content => epp("${module_name}/wireguard_conf.epp", $params),
     owner   => 'root',
-    mode    => '0600',
+    group   => $wireguard::config_directory_group,
+    mode    => '0640',
   }
 }

metadata.json

@@ -1,4 +1,4 @@
 {
   "name": "puppet-wireguard",
   "version": "4.1.1-rc0",
   "author": "Vox Pupuli",
@@ -44,6 +44,12 @@
         "11",
         "12"
       ]
+    },
+    {
+      "operatingsystem": "RedHat",
+      "operatingsystemrelease": [
+        "9"
+      ]
     }
   ],
   "requirements": [