ssl_cert => 'puppet:///modules/sslkey/wildcard_mydomain.crt' doesn't work after upgrade

[yarikdot]

We did upgrade to the latest version of your great plugin and unfortunately this construction stopped working:

nginx::resource::vhost { "${name}.${::domain} ${name}":
    ensure                => present,
    listen_port           => 443,
    www_root              => $tmp_www_root,
    proxy                 => $proxy,
    location_cfg_append   => $location_cfg_append,
    index_files           => [ 'index.php' ],
    ssl                   => true,
    ssl_cert              => 'puppet:///modules/sslkey/wildcard_mydomain.crt',
    ssl_key               => 'puppet:///modules/sslkey/wildcard_mydomain.key',
}

When applied the changes after module upgrade we see and of course nginx crashed:

-  ssl_certificate           /etc/nginx/myproject.crt;
-  ssl_certificate_key       /etc/nginx/myproject.key;
+  ssl_certificate           puppet:///modules/project_ssl/mydomain.tld/mydomain.tld.crt;
+  ssl_certificate_key       puppet:///modules/project_ssl/mydomain.tld/mydomain.tld.key;

[yarikdot]

It seems like that it was introduced in commit be4decd.

[3flex]

@yarikdot I'm sorry about that. This is one of the reasons we have removed any kind of SSL cert/key management from the module (because we don't know how everyone's doing it to start with). The module now requires any certificates, keys, and other SSL files to be copied in whatever manner the admin sees fit, and you then must specify the path to that file in the module.

In your case you will need a bit of boilerplate code that sits outside the module to copy the file from the server to the client.

There's a bit more about my rationale here: #599

[yarikdot]

Nothing to be sorry about. Evolution sometimes brings some victims. Would you mind updating the README file, section "Example puppet class calling nginx::vhost with HTTPS FastCGI and redirection of HTTP". The puppet:// is still there and it might be confusing for somebody.

[benpriestman]

This one got me, too. Fair enough as a change, but should surely have been marked as a breaking change?