from-scratch 0.1.1 → 0.2.0

data/cookbooks/openssl/libraries/secure_password.rb

@@ -18,13 +18,14 @@
 # limitations under the License.
 #
 
-require 'openssl'
+include OpenSSLCookbook::Helpers
 
 module Opscode
   module OpenSSL
+    # Generate secure passwords with OpenSSL
     module Password
       def secure_password(length = 20)
-        pw = String.new
+        pw = ''
 
         while pw.length < length
           pw << ::OpenSSL::Random.random_bytes(1).gsub(/\W/, '')

data/cookbooks/openssl/metadata.json

@@ -1,31 +1 @@
-{
-  "name": "openssl",
-  "version": "4.0.0",
-  "description": "Provides a library with a method for generating secure random passwords.",
-  "long_description": "openssl Cookbook\n================\n\nThis cookbook provides a library method to generate secure random passwords in recipes using the Ruby OpenSSL library.\n\nIt also provides an attribute-driven recipe for upgrading OpenSSL packages.\n\nRequirements\n------------\n\nThe `secure_password` works on any platform with OpenSSL Ruby bindings installed, which are a requirement for Chef anyway.\n\nThe upgrade recipe works on the following tested platforms:\n\n* Ubuntu 12.04, 14.04\n* Debian 7.4\n* CentOS 6.5\n\nIt may work on other platforms or versions of the above platforms with or without modification.\n\n[Chef Sugar](https://github.com/sethvargo/chef-sugar) was introduced as a dependency to provide helpers that make the default attribute settings (see Attributes) easier to reason about.\n\nAttributes\n----------\n\n* `node['openssl']['packages']` - An array of packages of openssl. The default attributes attempt to be smart about which packages are the default, but this may need to be changed by users of the `openssl::upgrade` recipe.\n* `node['openssl']['restart_services']` - An array of service resources that use the `node['openssl']['packages']`. This is empty by default as Chef has no reliably reasonable way to detect which applications or services are compiled against these packages. *Note* These each need to be \"`service`\" resources specified somewhere in the recipes in the node's run list.\n\nRecipes\n-------\n\n### upgrade\n\nThe upgrade recipe iterates over the list of packages in the `node['openssl']['packages']` attribute and manages them with the `:upgrade` action. Each package will send `:restart` notification to service resources named by the `node['openssl']['restart_services']` attribute.\n\nUsage\n-----\n\nMost often this will be used to generate a secure password for an attribute. In a recipe:\n\n```ruby\n::Chef::Recipe.send(:include, Chef::OpenSSL::Password)\nnode.set_unless[:my_password] = secure_password\n```\n\nTo use the `openssl::upgrade` recipe, set the attributes as mentioned above. For example, we have a \"stats_collector\" service that uses openssl. It has a recipe that looks like this:\n\nLWRP\n==== \n\nThis cookbook includes an LWRP for generating Self Signed Certificates\n\n## openssl_x509\ngenerate a pem formatted x509 cert + key  \n\n### Attributes\n`common_name` A String representing the `CN` ssl field\n`org` A String representing the `O` ssl field\n`org_unit` A String representing the `OU` ssl field\n`country` A String representing the `C` ssl field\n`expire` A Fixnum reprenting the number of days from _now_ to expire the cert\n`key_file` Optional A string to the key file to use. If no key is present it will generate and store one. \n`key_pass` A String that is the key's passphrase\n`key_length` A Fixnum reprenting your desired Bit Length _Default: 2048_\n`owner` The owner of the files _Default: \"root\"_\n`group` The group of the files _Default: \"root\"_\n`mode`  The mode to store the files in _Default: \"0400\"_\n\n### Example usage\n\n    openssl_x509 \"/tmp/mycert.pem\" do\n      common_name \"www.f00bar.com\"\n      org \"Foo Bar\"\n      org_unit \"Lab\"\n      country \"US\"\n    end\n\n    \nLicense and Author\n==================\n\nAuthor:: Jesse Nelson (<spheromak@gmail.com>)\nAuthor:: Joshua Timberman (<joshua@chef.io>)\n=======\n\n\n```ruby\nnode.default['openssl']['restart_services'] = ['stats_collector']\n\n# other recipe code here...\nservice 'stats_collector' do\n  action [:enable, :start]\nend\n\ninclude_recipe 'openssl::upgrade'\n```\n\nThis will ensure that openssl is upgraded to the latest version so the `stats_collector` service won't be exploited (hopefully!).\n\n```text\nCopyright:: 2009-2011, Chef Software, Inc\nCopyright:: 2014, Chef Software, Inc <legal@chef.io>\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n",
-  "maintainer": "Chef Software, Inc.",
-  "maintainer_email": "cookbooks@chef.io",
-  "license": "Apache 2.0",
-  "platforms": {
-  },
-  "dependencies": {
-    "chef-sugar": ">= 0.0.0"
-  },
-  "recommendations": {
-  },
-  "suggestions": {
-  },
-  "conflicting": {
-  },
-  "providing": {
-  },
-  "replacing": {
-  },
-  "attributes": {
-  },
-  "groupings": {
-  },
-  "recipes": {
-    "openssl": "Empty, this cookbook provides a library, see README.md"
-  }
-}
+{"name":"openssl","version":"4.4.0","description":"Provides a library with a method for generating secure random passwords.","long_description":"OpenSSL Cookbook\n================\n[![Build Status](https://travis-ci.org/opscode-cookbooks/openssl.svg?branch=master)](https://travis-ci.org/opscode-cookbooks/openssl)\n\nThis cookbook provides tools for working with the Ruby OpenSSL library. It includes:\n- A library method to generate secure random passwords in recipes, using the Ruby SecureRandom library.\n- An LWRP for generating RSA private keys.\n- An LWRP for generating x509 certificates.\n- An LWRP for generating dhparam.pem files.\n- An attribute-driven recipe for upgrading OpenSSL packages.\n\nRequirements\n------------\n\nThe `random_password` mixin works on any platform with the Ruby SecureRandom module. This module is already included with Chef.\n\nThe `openssl_x509`, `openssl_rsa_key` and `openssl_dhparam` LWRPs work on any platform with the OpenSSL Ruby bindings installed. These bindings are already included with Chef.\n\nThe `upgrade` recipe has been tested on the following platforms:\n\n* Ubuntu 12.04, 14.04\n* Debian 7.4\n* CentOS 6.5\n\nThe recipe may work on other platforms or different versions of the above platforms, but this has not been tested.\n\nDependencies\n------------\n\nThis cookbook depends on the [Chef Sugar](http://supermarket.chef.io/cookbooks/chef-sugar/) cookbook. [Chef Sugar](http://supermarket.chef.io/cookbooks/chef-sugar/) is used to make the default attribute settings easier to reason about. (See [Attributes](#attributes))\n\nAttributes\n----------\n\n* `node['openssl']['packages']` - An array of packages required to use openssl. The default attributes attempt to be smart about which packages are the default, but this may need to be changed by users of the `openssl::upgrade` recipe.\n* `node['openssl']['restart_services']` - An array of service resources that depend on the packages listed in the `node['openssl']['packages']` attribute. This array is empty by default, as Chef has no reasonable way to detect which applications or services are compiled against these packages. *Note* Each service listed in this array should represent a \"`service`\" resource specified in the recipes of the node's run list.\n\nRecipes\n-------\n\n### default\n\nAn empty placeholder recipe. Takes no action.\n\n### upgrade\n\nThe upgrade recipe iterates over the list of packages in the `node['openssl']['packages']` attribute, and manages them with the `:upgrade` action. Each package will send a `:restart` notification to service resources named in the `node['openssl']['restart_services']` attribute.\n\n#### Example Usage\n\nIn this example, assume the node is running the `stats_collector` daemon, which depends on the openssl library. Imagine that a new openssl vulnerability has been disclosed, and the operating system vendor has released an update to openssl to address this vulnerability. In order to protect the node, an administrator crafts this recipe:\n\n```ruby\nnode.default['openssl']['restart_services'] = ['stats_collector']\n\n# other recipe code here...\nservice 'stats_collector' do\n  action [:enable, :start]\nend\n\ninclude_recipe 'openssl::upgrade'\n```\n\nWhen executed, this recipe will ensure that openssl is upgraded to the latest version, and that the `stats_collector` service is restarted to pick up the latest security fixes released in the openssl package.\n\nLibraries & LWRPs\n-----------------\n\nThere are two mixins packaged with this cookbook.\n\n### random_password (`OpenSSLCookbook::RandomPassword`)\n\nThe `RandomPassword` mixin can be used to generate secure random passwords in Chef cookbooks, usually for assignment to a variable or an attribute. `random_password` uses Ruby's SecureRandom library and is customizable.\n\n#### Example Usage\n```ruby\nChef::Recipe.send(:include, OpenSSLCookbook::RandomPassword)\nnode.set['my_secure_attribute'] = random_password\nnode.set_unless['my_secure_attribute'] = random_password\nnode.set['my_secure_attribute'] = random_password(length: 50)\nnode.set['my_secure_attribute'] = random_password(length: 50, mode: :base64)\nnode.set['my_secure_attribute'] = random_password(length: 50, mode: :base64, encoding: 'ASCII')\n```\n\nNote that node attributes are widely accessible. Storing unencrypted passwords in node attributes, as in this example, carries risk.\n\n### ~~secure_password (`Opscode::OpenSSL::Password`)~~\n\nThis library should be considered deprecated and will be removed in a future version. Please use `OpenSSLCookbook::RandomPassword` instead. The documentation is kept here for historical reasons.\n\n#### ~~Example Usage~~\n```ruby\n::Chef::Recipe.send(:include, Opscode::OpenSSL::Password)\nnode.set_unless['my_password'] = secure_password\n```\n\n~~Note that node attributes are widely accessible. Storing unencrypted passwords in node attributes, as in this example, carries risk.~~\n\n### openssl_x509\n\nThis LWRP generates self-signed, PEM-formatted x509 certificates. If no existing key is specified, the LWRP will automatically generate a passwordless key with the certificate.\n\n#### Attributes\n| Name  | Type | Description |\n| ----- | ---- | ------------ |\n| `common_name`  | String (Required)  | Value for the `CN` certificate field. |\n| `org` | String (Required) | Value for the `O` certificate field. |\n| `org_unit` | String (Required) | Value for the `OU` certificate field. |\n| `country` | String (Required) | Value for the `C` ssl field. |\n| `expire` | Fixnum (Optional) | Value representing the number of days from _now_ through which the issued certificate cert will remain valid. The certificate will expire after this period. |\n| `key_file` | String (Optional) | The path to a certificate key file on the filesystem. If the `key_file` attribute is specified, the LWRP will attempt to source a key from this location. If no key file is found, the LWRP will generate a new key file at this location. If the `key_file` attribute is not specified, the LWRP will generate a key file in the same directory as the generated certificate, with the same name as the generated certificate.\n| `key_pass` | String (Optional) | The passphrase for an existing key's passphrase  \n| `key_length` | Fixnum (Optional) | The desired Bit Length of the generated key. _Default: 2048_ |\n| `owner` | String (optional) | The owner of all files created by the LWRP. _Default: \"root\"_ |\n| `group` | String (optional) | The group of all files created by the LWRP. _Default: \"root\"_ |\n| `mode` | String or Fixnum (Optional) | The permission mode of all files created by the LWRP.  _Default: \"0400\"_ |\n\n#### Example Usage\n\nIn this example, an administrator wishes to create a self-signed x509 certificate for use with a web server. In order to create the certificate, the administrator crafts this recipe:\n\n```ruby\nopenssl_x509 '/etc/httpd/ssl/mycert.pem' do\n  common_name 'www.f00bar.com'\n  org 'Foo Bar'\n  org_unit 'Lab'\n  country 'US'\nend\n```\n\nWhen executed, this recipe will generate a key certificate at `/etc/httpd/ssl/mycert.key`. It will then use that key to generate a new certificate file at `/etc/httpd/ssl/mycert.pem`.\n\n### openssl_dhparam\n\nThis LWRP generates dhparam.pem files. If a valid dhparam.pem file is found at the specified location, no new file will be created. If a file is found at the specified location but it is not a valid dhparam file, it will be overwritten.\n\n#### Attributes\n| Name  | Type | Description |\n| ----- | ---- | ------------ |\n| `key_length` | Fixnum (Optional) | The desired Bit Length of the generated key. _Default: 2048_ |\n| `generator` | Fixnum (Optional) | The desired Diffie-Hellmann generator. Can be _2_ or _5_. |\n| `owner` | String (optional) | The owner of all files created by the LWRP. _Default: \"root\"_ |\n| `group` | String (optional) | The group of all files created by the LWRP. _Default: \"root\"_ |\n| `mode` | String or Fixnum (Optional) | The permission mode of all files created by the LWRP.  _Default: \"0644\"_ |\n\n#### Example Usage\n\nIn this example, an administrator wishes to create a dhparam.pem file for use with a web server. In order to create the .pem file, the administrator crafts this recipe:\n\n```ruby\nopenssl_dhparam '/etc/httpd/ssl/dhparam.pem' do\n  key_length 2048 \n  generator 2\nend\n```\n\nWhen executed, this recipe will generate a dhparam file at `/etc/httpd/ssl/dhparam.pem`.\n\n### openssl_rsa_key\n\nThis LWRP generates rsa key files. If a valid rsa key file can be opened at the specified location, no new file will be created. If the RSA key file cannot be opened, either because it does not exist or because the password to the RSA key file does not match the password in the recipe, it will be overwritten.\n\n#### Attributes\n| Name  | Type | Description |\n| ----- | ---- | ------------ |\n| `key_length` | Fixnum (Optional) | The desired Bit Length of the generated key. _Default: 2048_ |\n| `key_pass` | String (Optional) | The desired passphrase for the key. |\n| `owner` | String (optional) | The owner of all files created by the LWRP. _Default: \"root\"_ |\n| `group` | String (optional) | The group of all files created by the LWRP. _Default: \"root\"_ |\n| `mode` | String or Fixnum (Optional) | The permission mode of all files created by the LWRP.  _Default: \"0644\"_ |\n\n#### Example Usage\n\nIn this example, an administrator wishes to create a new RSA private key file in order to generate other certificates and public keys. In order to create the key file, the administrator crafts this recipe:\n\n```ruby\nopenssl_rsa_key '/etc/httpd/ssl/server.key' do\n  key_length 2048 \nend\n```\n\nWhen executed, this recipe will generate a passwordless RSA key file at `/etc/httpd/ssl/server.key`.\n\n\nLicense and Author\n------------------\n\nAuthor:: Jesse Nelson (<spheromak@gmail.com>)  \nAuthor:: Seth Vargo (<sethvargo@gmail.com>)  \nAuthor:: Charles Johnson (<charles@chef.io>)  \nAuthor:: Joshua Timberman (<joshua@chef.io>)\n\n=======\n\n```text\nCopyright:: 2009-2015, Chef Software, Inc <lega@chef.io>\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n","maintainer":"Chef Software, Inc.","maintainer_email":"cookbooks@chef.io","license":"Apache 2.0","platforms":{},"dependencies":{"chef-sugar":">= 3.1.1"},"recommendations":{},"suggestions":{},"conflicting":{},"providing":{},"replacing":{},"attributes":{},"groupings":{},"recipes":{"openssl":"Empty, this cookbook provides a library, see README.md","upgrade":"Upgrade OpenSSL library and restart dependent services"}}

data/cookbooks/openssl/providers/dhparam.rb

@@ -0,0 +1,33 @@
+#
+# dhparam.pem provider
+#
+# Author:: Charles Johnson <charles@chef.io>
+#
+
+include OpenSSLCookbook::Helpers
+
+use_inline_resources
+
+def whyrun_supported?
+  true
+end
+
+action :create do
+  converge_by("Create a dhparam file #{@new_resource}") do
+    unless dhparam_pem_valid?(new_resource.name)
+      dhparam_content = gen_dhparam(new_resource.key_length, new_resource.generator).to_pem
+
+      log "Generating #{new_resource.key_length} bit "\
+          "dhparam file at #{new_resource.name}, this may take some time"
+
+      file new_resource.name do
+        action :create
+        owner new_resource.owner
+        group new_resource.group
+        mode new_resource.mode
+        sensitive true
+        content dhparam_content
+      end
+    end
+  end
+end

data/cookbooks/openssl/providers/rsa_key.rb

@@ -0,0 +1,39 @@
+#
+# dhparam.pem provider
+#
+# Author:: Charles Johnson <charles@chef.io>
+#
+
+include OpenSSLCookbook::Helpers
+
+use_inline_resources
+
+def whyrun_supported?
+  true
+end
+
+action :create do
+  converge_by("Create an RSA key #{@new_resource}") do
+    unless key_file_valid?(new_resource.name, new_resource.key_pass)
+
+      log "Generating #{new_resource.key_length} bit "\
+          "RSA key file at #{new_resource.name}, this may take some time"
+
+      if new_resource.key_pass
+        unencrypted_rsa_key = gen_rsa_key(new_resource.key_length)
+        rsa_key_content = encrypt_rsa_key(unencrypted_rsa_key, new_resource.key_pass)
+      else
+        rsa_key_content = gen_rsa_key(new_resource.key_length).to_pem
+      end
+
+      file new_resource.name do
+        action :create
+        owner new_resource.owner
+        group new_resource.group
+        mode new_resource.mode
+        sensitive true
+        content rsa_key_content
+      end
+    end
+  end
+end

data/cookbooks/openssl/providers/x509.rb

@@ -3,51 +3,61 @@
 #
 # Author:: Jesse Nelson <spheromak@gmail.com>
 #
-require 'openssl'
+
+include OpenSSLCookbook::Helpers
 
 use_inline_resources
 
+def whyrun_supported?
+  true
+end
+
 attr_reader :key_file, :key, :cert, :ef
 
-action :create  do
-  unless ::File.exists? new_resource.name
-    create_keys
-    cert_content = cert.to_pem
-    key_content = key.to_pem
+action :create do
+  converge_by("Create #{@new_resource}") do
+    unless ::File.exist? new_resource.name
+      create_keys
+      cert_content = cert.to_pem
+      key_content = key.to_pem
 
-    file new_resource.name do
-      action :create_if_missing
-      mode  new_resource.mode
-      owner new_resource.owner
-      group new_resource.group
-      content cert_content
-    end
+      file new_resource.name do
+        action :create_if_missing
+        mode new_resource.mode
+        owner new_resource.owner
+        group new_resource.group
+        sensitive true
+        content cert_content
+      end
 
-    file new_resource.key_file do
-      action :create_if_missing
-      mode  new_resource.mode
-      owner new_resource.owner
-      group new_resource.group
-      content key_content
+      file new_resource.key_file do
+        action :create_if_missing
+        mode new_resource.mode
+        owner new_resource.owner
+        group new_resource.group
+        sensitive true
+        content key_content
+      end
+      new_resource.updated_by_last_action(true)
     end
-
   end
 end
 
 protected
 
+  # rubocop:disable Metrics/AbcSize, Style/IndentationConsistency
   def key_file
     unless new_resource.key_file
-      path, file= ::File.split(new_resource.name)
-      filename  = ::File.basename(file, ::File.extname(file) )
-      new_resource.key_file  path + "/" + filename + ".key"
+      path, file = ::File.split(new_resource.name)
+      filename = ::File.basename(file, ::File.extname(file))
+      new_resource.key_file path + '/' + filename + '.key'
     end
     new_resource.key_file
   end
 
   def key
-    @key ||= if ::File.exists? key_file
-               OpenSSL::PKey::RSA.new File.read(key_file), new_resource.key_pass
+    @key ||= if key_file_valid?(key_file, new_resource.key_pass)
+               OpenSSL::PKey::RSA.new ::File.read(key_file), new_resource.key_pass
              else
                OpenSSL::PKey::RSA.new(new_resource.key_length)
              end
@@ -69,16 +79,16 @@ protected
   end
 
   def subject
-    @subject ||= "/C="  + new_resource.country +
-                 "/O="  + new_resource.org +
-                 "/OU=" + new_resource.org_unit +
-                 "/CN=" + new_resource.common_name
+    @subject ||= '/C=' + new_resource.country +
+                 '/O=' + new_resource.org +
+                 '/OU=' + new_resource.org_unit +
+                 '/CN=' + new_resource.common_name
   end
 
   def extensions
     [
-      ef.create_extension("basicConstraints","CA:TRUE", true),
-      ef.create_extension("subjectKeyIdentifier", "hash"),
+      ef.create_extension('basicConstraints', 'CA:TRUE', true),
+      ef.create_extension('subjectKeyIdentifier', 'hash')
     ]
   end
 
@@ -88,7 +98,7 @@ protected
     ef.subject_certificate = cert
     ef.issuer_certificate = cert
     cert.extensions = extensions
-    cert.add_extension ef.create_extension("authorityKeyIdentifier",
-                                       "keyid:always,issuer:always")
-    cert.sign key, OpenSSL::Digest::SHA1.new
+    cert.add_extension ef.create_extension('authorityKeyIdentifier',
+                                           'keyid:always,issuer:always')
+    cert.sign key, OpenSSL::Digest::SHA256.new
   end

data/cookbooks/openssl/recipes/upgrade.rb

@@ -2,7 +2,7 @@
 # Cookbook Name:: openssl
 # Recipe:: upgrade
 #
-# Copyright 2014, Chef Software, Inc. <legal@chef.io>
+# Copyright 2015, Chef Software, Inc. <legal@chef.io>
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,16 +18,18 @@
 #
 include_recipe 'chef-sugar'
 
-node.default['openssl']['packages'] = case
-                                      when debian_before_or_at_squeeze?, ubuntu_before_or_at_lucid?
-                                        %w{libssl0.9.8 openssl}
-                                      when debian_after_or_at_wheezy?, ubuntu_after_or_at_precise?
-                                        %w{libssl1.0.0 openssl}
-                                      when rhel?
-                                        %w{openssl}
-                                      else
-                                        []
-                                      end
+# Attributes are set here and not in attributes/default.rb because of the
+# chef-sugar dependency for the methods evaluated in the case statement.
+case
+when debian_before_or_at_squeeze?, ubuntu_before_or_at_lucid?
+  node.default['openssl']['packages'] = %w(libssl0.9.8 openssl)
+when debian_after_or_at_wheezy?, ubuntu_after_or_at_precise?
+  node.default['openssl']['packages'] = %w(libssl1.0.0 openssl)
+when rhel?
+  node.default['openssl']['packages'] = %w(openssl)
+else
+  node.default['openssl']['packages'] = []
+end
 
 node['openssl']['packages'].each do |ssl_pkg|
   package ssl_pkg do

data/cookbooks/openssl/resources/dhparam.rb

@@ -0,0 +1,10 @@
+
+actions [:create]
+default_action :create
+
+attribute :name,        :kind_of => String, :name_attribute => true
+attribute :key_length,  :equal_to => [1024, 2048, 4096, 8192], :default => 2048
+attribute :generator,   :equal_to => [2, 5], :default => 2
+attribute :owner,       :kind_of => String
+attribute :group,       :kind_of => String
+attribute :mode,        :kind_of => [Integer, String]

data/cookbooks/openssl/resources/rsa_key.rb

@@ -0,0 +1,10 @@
+
+actions [:create]
+default_action :create
+
+attribute :name,        :kind_of => String, :name_attribute => true
+attribute :key_length,  :equal_to => [1024, 2048, 4096, 8192], :default => 2048
+attribute :key_pass,    :kind_of => String, :default => nil
+attribute :owner,       :kind_of => String
+attribute :group,       :kind_of => String
+attribute :mode,        :kind_of => [Integer, String]

data/cookbooks/openssl/resources/x509.rb

@@ -1,16 +1,16 @@
 
-actions [ :create ]
+actions [:create]
 default_action :create
 
-attribute :name,       :kind_of => String,  :name_attribute => true
+attribute :name,        :kind_of => String, :name_attribute => true
 attribute :owner,       :kind_of => String
-attribute :group,      :kind_of => String
-attribute :expire,     :kind_of => Fixnum
-attribute :mode
-attribute :org,        :kind_of => String, :required => true
-attribute :org_unit,   :kind_of => String, :required => true
-attribute :country,    :kind_of => String, :required => true
+attribute :group,       :kind_of => String
+attribute :expire,      :kind_of => Integer
+attribute :mode,        :kind_of => [Integer, String]
+attribute :org,         :kind_of => String, :required => true
+attribute :org_unit,    :kind_of => String, :required => true
+attribute :country,     :kind_of => String, :required => true
 attribute :common_name, :kind_of => String, :required => true
-attribute :key_file,   :kind_of => String, :default => nil
-attribute :key_pass,   :kind_of => String, :default => nil
-attribute :key_length, :kind_of => Fixnum, :default => 2048
+attribute :key_file,    :kind_of => String, :default => nil
+attribute :key_pass,    :kind_of => String, :default => nil
+attribute :key_length,  :equal_to => [1024, 2048, 4096, 8192], :default => 2048

data/cookbooks/postgresql/.gitignore

@@ -0,0 +1,18 @@
+.vagrant
+Berksfile.lock
+Cheffile.lock
+Gemfile.lock
+*~
+*#
+.#*
+\#*#
+.*.sw[a-z]
+*.un~
+.bundle
+.cache
+.kitchen
+bin
+.kitchen.local.yml
+.kitchen/
+.librarian/
+tmp/

data/cookbooks/postgresql/.kitchen.yml

@@ -0,0 +1,175 @@
+---
+driver_plugin: vagrant
+
+platforms:
+- name: ubuntu-14.04
+  run_list:
+  - recipe[apt]
+
+- name: ubuntu-12.04
+  run_list:
+  - recipe[apt]
+
+- name: ubuntu-10.04
+  run_list:
+  - recipe[apt]
+
+- name: debian-7.4
+  run_list:
+  - recipe[apt]
+
+- name: centos-7.0
+
+- name: centos-6.4
+
+- name: centos-5.10
+
+suites:
+- name: default
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql]
+  attributes: {}
+
+- name: contrib
+  run_list:
+  - recipe[postgresql::contrib]
+  attributes:
+    postgresql:
+      password:
+        postgres: "iloverandompasswordsbutthiswilldo"
+
+- name: apt-pgdg-client
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql]
+  excludes: ["centos-5.10", "centos-6.4", "centos-7.0"]
+  attributes:
+    postgresql:
+      enable_pgdg_apt: true
+      version: "9.3"
+
+- name: yum-pgdg-client
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql]
+  excludes: ["ubuntu-10.04", "ubuntu-12.04", "ubuntu-14.04", "debian-7.4"]
+  attributes:
+    postgresql:
+      enable_pgdg_yum: true
+      version: "9.3"
+      client:
+        packages: ["postgresql93"]
+
+- name: ruby
+  run_list:
+  - recipe[postgresql::ruby]
+  - recipe[minitest-handler]
+  attributes: {}
+
+- name: server
+  run_list:
+  - recipe[postgresql::ruby]
+  - recipe[minitest-handler]
+  - recipe[postgresql::server]
+  attributes:
+    postgresql:
+      password:
+        postgres: "iloverandompasswordsbutthiswilldo"
+
+- name: apt-pgdg-server
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql::ruby]
+  - recipe[postgresql::server]
+  excludes: ["centos-5.10", "centos-6.4", "centos-7.0"]
+  attributes:
+    postgresql:
+      enable_pgdg_apt: true
+      version: "9.3"
+      password:
+        postgres: "iloverandompasswordsbutthiswilldo"
+      config:
+        ssl_cert_file: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
+        ssl_key_file: "/etc/ssl/private/ssl-cert-snakeoil.key"
+
+- name: yum-pgdg-server
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql::ruby]
+  - recipe[postgresql::server]
+  excludes: ["ubuntu-10.04", "ubuntu-12.04", "ubuntu-14.04", "debian-7.4"]
+  attributes:
+    postgresql:
+      enable_pgdg_yum: true
+      version: "9.3"
+      server:
+        packages: ["postgresql93-server"]
+        service_name: "postgresql-9.3"
+      password:
+        postgres: "iloverandompasswordsbutthiswilldo"
+
+- name: apt-pgdg-client-ruby
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql]
+  - recipe[postgresql::ruby]
+  excludes: ["centos-5.10", "centos-6.4", "centos-7.0"]
+  attributes:
+    postgresql:
+      enable_pgdg_apt: true
+      version: "9.3"
+
+- name: yum-pgdg-client-ruby
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql]
+  - recipe[postgresql::ruby]
+  excludes: ["ubuntu-10.04", "ubuntu-12.04", "ubuntu-14.04", "debian-7.4"]
+  attributes:
+    postgresql:
+      enable_pgdg_yum: true
+      version: "9.3"
+      client:
+        packages: ["postgresql93", "postgresql93-devel"]
+
+- name: apt-pgdg-server-pg_stat_statements
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql::ruby]
+  - recipe[postgresql::contrib]
+  excludes: ["centos-5.9", "centos-6.4"]
+  attributes:
+    postgresql:
+      enable_pgdg_apt: true
+      version: "9.3"
+      password:
+        postgres: "iloverandompasswordsbutthiswilldo"
+      config:
+        shared_preload_libraries: "pg_stat_statements"
+        ssl_cert_file: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
+        ssl_key_file: "/etc/ssl/private/ssl-cert-snakeoil.key"
+      contrib:
+        extensions:
+          - pg_stat_statements
+
+- name: yum-pgdg-server-pg_stat_statements
+  run_list:
+  - recipe[minitest-handler]
+  - recipe[postgresql::ruby]
+  - recipe[postgresql::contrib]
+  excludes: ["ubuntu-10.04", "ubuntu-12.04", "debian-7.1.0"]
+  attributes:
+    postgresql:
+      enable_pgdg_yum: true
+      version: "9.3"
+      server:
+        packages: ["postgresql93-server"]
+        service_name: "postgresql-9.3"
+      password:
+        postgres: "iloverandompasswordsbutthiswilldo"
+      config:
+        shared_preload_libraries: "pg_stat_statements"
+      contrib:
+        extensions:
+          - pg_stat_statements