Merge pull request #3496 from Icinga/bugfix/puppet-http-mitm

Vagrant/Puppet: prevent man-in-the-middle attacks

.puppet/manifests/puppet.sh

@@ -10,7 +10,7 @@ RELEASEVER=$(rpm -q --qf "%{VERSION}" $(rpm -q --whatprovides redhat-release))
 
 case $RELEASEVER in
     6|7)
-        PUPPET="http://yum.puppetlabs.com/puppetlabs-release-el-${RELEASEVER}.noarch.rpm"
+        PUPPET="https://yum.puppetlabs.com/puppetlabs-release-el-${RELEASEVER}.noarch.rpm"
         ;;
     *)
         echo "Unknown release version: $RELEASEVER" >&2

.puppet/modules/epel/manifests/init.pp

@@ -13,12 +13,12 @@
 #   include epel
 #
 class epel {
-
-  yumrepo { 'epel':
-    mirrorlist => "http://mirrors.fedoraproject.org/mirrorlist?repo=epel-${::operatingsystemmajrelease}&arch=${::architecture}",
-    enabled    => '1',
-    gpgcheck   => '0',
-    descr      => "Extra Packages for Enterprise Linux ${::operatingsystemmajrelease} - ${::architecture}"
+  exec { 'rpm --import RPM-GPG-KEY-EPEL':
+    command => '/bin/rpm --import https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7',
+  }
+  -> exec { 'yum install epel-release-latest':
+    command => '/bin/yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm',
+    creates => '/etc/yum.repos.d/epel.repo',
   }
 }
 

.puppet/modules/icinga_packages/manifests/init.pp

@@ -8,10 +8,10 @@
 #
 class icinga_packages {
   yumrepo { 'icinga_packages':
-    baseurl   => "http://packages.icinga.com/epel/${::operatingsystemmajrelease}/snapshot/",
+    baseurl   => "https://packages.icinga.com/epel/${::operatingsystemmajrelease}/snapshot/",
     enabled   => '1',
     gpgcheck  => '1',
-    gpgkey    => 'http://packages.icinga.com/icinga.key',
+    gpgkey    => 'https://packages.icinga.com/icinga.key',
     descr     => "Icinga Repository - ${::architecture}"
   }
 }