Make some required params optional

manifests/init.pp

@@ -33,9 +33,10 @@
 # Copyright 2012 Puppet Labs, LLC
 #
 class stunnel(
-  $package  = $stunnel::params::package,
-  $service  = $stunnel::params::service,
-  $conf_dir = $stunnel::params::conf_dir
+  $package        = $stunnel::params::package,
+  $service        = $stunnel::params::service,
+  $conf_dir       = $stunnel::params::conf_dir,
+  $service_ensure = $stunnel::params::service_ensure,
 ) inherits stunnel::params {
 
   package { $package:
@@ -49,7 +50,7 @@
     recurse => true,
   }
 
-  if $::osfamily == 'Debian' {
+  if $::osfamily == 'Debian' and $service_ensure {
     exec { 'enable stunnel':
       command => 'sed -i "s/ENABLED=0/ENABLED=1/" /etc/default/stunnel4',
       path    => [ '/bin', '/usr/bin' ],
@@ -61,7 +62,7 @@
     # There isn't a sysvinit script installed by the "stunnel" package on
     # Red Hat systems.
     service { $service:
-      ensure     => running,
+      ensure     => $service_ensure,
       enable     => true,
       hasrestart => true,
       hasstatus  => false,

manifests/params.pp

@@ -28,14 +28,16 @@
 class stunnel::params {
   case $::osfamily {
     'Debian': {
-      $conf_dir = '/etc/stunnel'
-      $package  = 'stunnel4'
-      $service  = 'stunnel4'
+      $conf_dir       = '/etc/stunnel'
+      $package        = 'stunnel4'
+      $service        = 'stunnel4'
+      $service_ensure = 'running'
     }
     'RedHat': {
-      $conf_dir = '/etc/stunnel'
-      $package = 'stunnel'
-      $service = 'stunnel'
+      $conf_dir       = '/etc/stunnel'
+      $package        = 'stunnel'
+      $service        = 'stunnel'
+      $service_ensure = 'running'
     }
     default: {
       fail("Your OS family ${::osfamily} is not supported")

manifests/tun.pp

@@ -125,9 +125,9 @@
     $private_key = undef,
     $ca_file     = undef,
     $crl_file    = undef,
-    $ssl_version = 'TLSv1',
-    $verify      = '2',
-    $chroot,
+    $ssl_version = undef,
+    $verify      = undef,
+    $chroot      = undef,
     $user,
     $group,
     $client      = false,
@@ -139,7 +139,7 @@
     $conf_dir    = $stunnel::params::conf_dir
 ) {
 
-  unless $verify == 'default' {
+  unless $verify == 'default' or empty($verify) {
     $ssl_version_real = $ssl_version ? {
       'tlsv1' => 'TLSv1',
       'sslv2' => 'SSLv2',
@@ -164,10 +164,12 @@
     require => File[$conf_dir],
   }
 
-  file { $chroot:
-    ensure => directory,
-    owner  => $user,
-    group  => $group,
-    mode   => '0600',
+  unless empty($chroot) {
+    file { $chroot:
+      ensure => directory,
+      owner  => $user,
+      group  => $group,
+      mode   => '0600',
+    }
   }
 }

templates/stunnel.conf.erb

@@ -3,28 +3,25 @@
 <% if @verify == 'default' -%>
 verify = default
 <% else -%>
-cert = <%= @certificate %>
-key = <%= @private_key %>
-CAfile = <%= @ca_file %>
-CRLfile = <%= @crl_file %>
-sslVersion = <%= @ssl_version_real %>
+<%= "cert = #{@certificate}" if defined?(@cert) %>
+<%= "key = #{@private_key}" if defined?(@private_key) %>
+<%= "CAfile = #{@ca_file}" if defined?(@ca_file) %>
+<%= "CRLfile = #{@crl_file}" if defined?(@crl_file) %>
+<%= "sslVersion = #{@ssl_version_real}" if defined?(@ssl_version_real) %>
 
-verify = <%= @verify %>
+<%= "verify = #{@verify}" if defined?(@verify) %>
 <% end -%>
 
-chroot = <%= @chroot %>
-setuid = <%= @user %>
-setgid = <%= @group %>
-pid = <%= @pid_file %>
+<%= "chroot = #{@chroot}" if defined?(@chroot) %>
+<%= "setuid = #{@user}" if defined?(@user) %>
+<%= "setgid = #{@group}" if defined?(@group) %>
+<%= "pid = #{@pid_file}" if defined?(@pid_file) %>
 
-socket = l:TCP_NODELAY=1
-socket = r:TCP_NODELAY=1
+<%= "debug = #{@debug_level}" if defined?(@debug_level) %>
+<%= "output = #{@log_dest}" if defined?(@log_dest) %>
 
-debug = <%= @debug_level %>
-output = <%= @log_dest %>
-
-client = <%= @client_on %>
 
 [<%= @name -%>]
-accept = <%= @accept %>
-connect = <%= @connect %>
+<%= "client = #{@client_on}" if defined?(@client_on) %>
+<%= "accept = #{@accept}" if defined?(@accept) %>
+<%= "connect = #{@connect}" if defined?(@connect) %>