strongswan-formula

A SaltStack formula to install, configure and manage Strongswan.

Table of Contents

• General notes
• Contributing to this repo
• Available states
  • strongswan
  • strongswan.install
  • strongswan.config
  • strongswan.service
  • strongswan.apparmor
• Testing
  • Requirements
  • bin/kitchen converge
  • bin/kitchen verify
  • bin/kitchen destroy
  • bin/kitchen test
  • bin/kitchen login

General notes

See the full SaltStack Formulas installation and usage instructions.

If you are interested in writing or contributing to formulas, please pay attention to the Writing Formula Section.

If you want to use this formula, please pay attention to the FORMULA file and/or git tag, which contains the currently released version. This formula is versioned according to Semantic Versioning.

See Formula Versioning Section for more details.

Contributing to this repo

Commit message formatting is significant!!

Please see How to contribute for more details.

Available states

• strongswan
• strongswan.install
• strongswan.config
• strongswan.service
• strongswan.apparmor

strongswan

Meta-state (This is a state that includes other states)

This installs the strongswan package, configures and starts the associated strongswan service.

strongswan.install

This state will install the strongswan package only.

strongswan.config

This state will configure the strongswan service and has a dependency on strongswan.install via include list.

Configuration is splitted:

• for connections:
  • in a main file for default options and %default connection. This file include files from dropin directory
  • in a dropin directory where each connection has its own config file
• for secrets:
  • in a main file which include files from dropin directory
  • in a dropin directory where each connection has its own secret file

warning: if you use AppArmor, you will need to add specific rules for read access to the secrets dropin directory. You can manage them on your own, or use the apparmor state, see below.

strongswan.service

This state manage the strongswan service.

strongswan.apparmor

This state is not run by default with the meta-state It has only been tested on recent versions of Debian, feel free to propose a PR to add support for other distributions.

It configures AppArmor rules to allow read access to the secrets dropin directory. It must be run explicitely or use this pillar to activate it:

strongswan:
  lookup:
    apparmor:
      add_rules: true

Testing

Linux testing is done with kitchen-salt.

Requirements

• Ruby
• Docker

$ gem install bundler
$ bundle install
$ bin/kitchen test [platform]

Where [platform] is the platform name defined in kitchen.yml, e.g. debian-9-2019-2-py3.

bin/kitchen converge

Creates the docker instance and runs the template main state, ready for testing.

bin/kitchen verify

Runs the inspec tests on the actual instance.

bin/kitchen destroy

Removes the docker instance.

bin/kitchen test

Runs all of the stages above in one go: i.e. destroy + converge + verify + destroy.

bin/kitchen login

Gives you SSH access to the instance for manual testing.