From 00a84464eae31150714f667df67774ebe34b8514 Mon Sep 17 00:00:00 2001
From: Fraser Tweedale <ftweedal@redhat.com>
Date: Thu, 28 May 2020 14:45:44 +1000
Subject: [PATCH] acme: configure engine.conf and disable by default

When deploying ACME set up configsources.conf to retrieve engine
configuration from engine.conf.  In the initial configuration, the
ACME service is disabled (i.e. it will refuse to service requests).

A subsequent commit will add command(s) for flipping the ACME
service on or off (on a per-server basis).  Later we will move to
LDAP configuration so that management of the ACME service is
deployment-wide.

The default configuration also disables issuance of wildcard
certificates.

Part of: https://pagure.io/freeipa/issue/4751

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
---
 install/share/Makefile.am                          | 2 ++
 install/share/pki-acme-configsources.conf.template | 2 ++
 install/share/pki-acme-engine.conf.template        | 2 ++
 ipaplatform/base/paths.py                          | 2 ++
 ipaserver/install/cainstance.py                    | 3 +++
 5 files changed, 11 insertions(+)
 create mode 100644 install/share/pki-acme-configsources.conf.template
 create mode 100644 install/share/pki-acme-engine.conf.template

diff --git a/install/share/Makefile.am b/install/share/Makefile.am
index 5753de9f7..96ad94abd 100644
--- a/install/share/Makefile.am
+++ b/install/share/Makefile.am
@@ -101,7 +101,9 @@ dist_app_DATA =				\
 	ipaca_default.ini		\
 	ipaca_customize.ini		\
 	ipaca_softhsm2.ini		\
+	pki-acme-configsources.conf.template	\
 	pki-acme-database.conf.template	\
+	pki-acme-engine.conf.template	\
 	pki-acme-issuer.conf.template	\
 	$(NULL)
 
diff --git a/install/share/pki-acme-configsources.conf.template b/install/share/pki-acme-configsources.conf.template
new file mode 100644
index 000000000..f82ac2157
--- /dev/null
+++ b/install/share/pki-acme-configsources.conf.template
@@ -0,0 +1,2 @@
+engine.class=org.dogtagpki.acme.server.ACMEEngineConfigFileSource
+engine.filename=/etc/pki/pki-tomcat/acme/engine.conf
diff --git a/install/share/pki-acme-engine.conf.template b/install/share/pki-acme-engine.conf.template
new file mode 100644
index 000000000..cb9898c5f
--- /dev/null
+++ b/install/share/pki-acme-engine.conf.template
@@ -0,0 +1,2 @@
+enabled=false
+wildcard=false
diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py
index fd13bc951..ce841c23d 100644
--- a/ipaplatform/base/paths.py
+++ b/ipaplatform/base/paths.py
@@ -118,7 +118,9 @@ class BasePathNamespace:
     PKI_TOMCAT_ALIAS_PWDFILE_TXT = "/etc/pki/pki-tomcat/alias/pwdfile.txt"
     PKI_TOMCAT_PASSWORD_CONF = "/etc/pki/pki-tomcat/password.conf"
     PKI_TOMCAT_SERVER_XML = "/etc/pki/pki-tomcat/server.xml"
+    PKI_ACME_CONFIGSOURCES_CONF = "/etc/pki/pki-tomcat/acme/configsources.conf"
     PKI_ACME_DATABASE_CONF = "/etc/pki/pki-tomcat/acme/database.conf"
+    PKI_ACME_ENGINE_CONF = "/etc/pki/pki-tomcat/acme/engine.conf"
     PKI_ACME_ISSUER_CONF = "/etc/pki/pki-tomcat/acme/issuer.conf"
     ETC_REDHAT_RELEASE = "/etc/redhat-release"
     RESOLV_CONF = "/etc/resolv.conf"
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index 18f4163f8..ce20bb37c 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -1559,7 +1559,10 @@ class CAInstance(DogtagInstance):
 
         # write configuration files
         files = [
+            ('pki-acme-configsources.conf.template',
+                paths.PKI_ACME_CONFIGSOURCES_CONF),
             ('pki-acme-database.conf.template', paths.PKI_ACME_DATABASE_CONF),
+            ('pki-acme-engine.conf.template', paths.PKI_ACME_ENGINE_CONF),
             ('pki-acme-issuer.conf.template', paths.PKI_ACME_ISSUER_CONF),
         ]
         sub_dict = dict(