$openemrdir = "/var/www/html/openemr"

class openemr {
	include openemr::install
}

class openemr::install {
	# http://www.learncomputer.com/secure-apache/
	class {'apache': 
		default_vhost => false, 
		default_mods => false,
		server_signature => "Off",
		server_tokens => "Prod",
		# error_log => true,
		# error_log_file => "error_log",
		# access_log_file => "access_log",
	}
	apache::mod {"security2": }
	apache::mod {"unique_id": }
	apache::vhost { "www.healthisp.com":
		ip	=> '192.168.200.80',
		port    => '443',
		docroot => "$openemrdir",
		options => "None",
		ssl     => true,
		# logroot => "/var/log/httpd",
		# logroot => "syslog",
                error_log => true,
		# error_log_syslog => 'syslog:local7',
                error_log_file => "ssl_error_log",
                access_log_file => "ssl_access_log",
		# error_log_file => ":local443",
                # access_log_file => ":local443",
                log_level => "debug",

#   ssl_ca
#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
		ssl_ca => '/etc/pki/tls/certs/ca-bundle.crt',
#		ssl_chain => '/etc/pki/tls/certs/server-chain.crt',
#		ssl_chain => '/etc/pki/tls/certs/ca-bundle.trust.crt',
		ssl_verify_client => 'require',
#		ssl_verify_client => 'optional',
		ssl_verify_depth => 3,

#   ssl_cert
#   Server Certificate:
#   Point SSLCertificateFile at a PEM encoded certificate.  If
#   the certificate is encrypted, then you will be prompted for a
#   pass phrase.  Note that a kill -HUP will prompt again.  A new
#   certificate can be generated using the genkey(1) command.
#   AS SSLCertificateFile  Directive in original SSL FILE
		ssl_cert => '/etc/pki/tls/certs/localhost.crt',
# 	was>>>>	ssl_cert => '/etc/pki/tls/certs/MicrosoftRootCASignedCert.crt',

#   ssl_key
#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
		ssl_key => '/etc/pki/tls/private/localhost.key',
#	was>>>	ssl_key => '/etc/pki/tls/private/www_healthisp_com_prvkey.key',
		ssl_protocol => 'all -SSLv3 -SSLv3',
#		ssl_protocol => 'all -SSLv2 -TLSv1.1',
#		ssl_cipher => 'HIGH:MEDIUM:!aNULL:!MD5',
		ssl_cipher => 'AES256-SHA',
		ssl_certs_dir => '/etc/ssl/certs',
		ssl_options => '+StdEnvVars',

#   Do not allow direct web access to the following directories 
#   Apache module does not have a way to do this directly for version 2.4 yet
		custom_fragment => "
 
# ADDITIONAL SSL STUFF OCSP  
 SSLOCSPEnable on
 SSLOCSPDefaultResponder http://healthitca.healthisp.com:8080/ca/ocsp
 SSLOCSPOverrideResponder on

  <Directory \"$openemrdir/sites/*/documents\">
    Require all denied
  </Directory>
  <Directory \"$openemrdir/sites/*/era\">
    Require all denied
  </Directory>
  <Directory \"$openemrdir/sites/*/edi\">
    Require all denied
  </Directory>"
	}
	class {'::apache::mod::php': }
	file {"$openemrdir": ensure => directory, recurse => true, owner => root, group => apache, mode => 750}

	class { '::mysql::server': }
#	root_password already seems to be set

	apache::custom_config {"mod_security":
	  content	=> template ('/etc/puppet/manifests/openemrconcat.pp'),
	}
}
class openemr::security {

	# http://www.open-emr.org/wiki/index.php/OpenEMR_4.1.2_Linux_Installation
	file {"$openemrdir/library/sqlconf.php": mode => 640, owner => root, group => apache}
	#file {"$openemrdir/acl_setup.php":  mode => 600}
	#file {"$openemrdir/acl_upgrade.php": mode => 600}
	#file {"$openemrdir/sl_convert.php": mode => 600}
	#file {"$openemrdir/setup.php": mode => 600}
	#file {"$openemrdir/sql_upgrade.php": mode => 600}
	#file {"$openemrdir/gacl/setup.php": mode => 600}
	#file {"$openemrdir/ippf_upgrade.php": mode => 600}

	# OpenEMR versions 4.1.1 or less
	# http://www.open-emr.org/wiki/index.php/Securing_OpenEMR
	#file {"$openemrdir/library/openflashchart/php-ofc-library/ofc_upload_image.php": ensure => absent}
	#file {"$openemrdir/library/openflashchart/tmp-upload-images": ensure => absent}

	# just diable the files
	#file {"$openemrdir/admin.php": mode => 000}
	#file {"$openemrdir/acl_setup.php":  mode => 000}
	#file {"$openemrdir/acl_upgrade.php": mode => 000}
	#file {"$openemrdir/sl_convert.php": mode => 000}
	#file {"$openemrdir/setup.php": mode => 000}
	#file {"$openemrdir/sql_upgrade.php": mode => 000}
	#file {"$openemrdir/gacl/setup.php": mode => 000}
	#file {"$openemrdir/ippf_upgrade.php": mode => 000}
	#file {"$openemrdir/contrib": ensure => directory, recurse => true, mode => 000}
	#file {"$openemrdir/phpmyadmin": ensure => directory, recurse => true, mode => 000}
	#file {"$openemrdir/sql_patch.php": mode => 000}

	# completely remove the files
	file {"$openemrdir/acl_setup.php": ensure => absent}
	file {"$openemrdir/acl_upgrade.php": ensure => absent}
	file {"$openemrdir/admin.php": ensure => absent}
	file {"$openemrdir/sl_convert.php": ensure => absent}
	file {"$openemrdir/setup.php": ensure => absent}
	file {"$openemrdir/sql_upgrade.php": ensure => absent}
	file {"$openemrdir/gacl/setup.php": ensure => absent}
	file {"$openemrdir/ippf_upgrade.php": ensure => absent}
	file {"$openemrdir/contrib": ensure => absent, force => true, backup => false}
	file {"$openemrdir/phpmyadmin": ensure => absent, force => true, backup => false}
	file {"$openemrdir/sql_patch.php": ensure => absent}

}
