use a hardcoded dhparam.pem

it doesn't need to be secret, and generating a 4096-bit dhparam takes
quite a long time (long enough to make initial server provisioning
annoyingly long)

1 files changed, 2 insertions, 7 deletions

diff --git a/modules/nginx/manifests/config.pp b/modules/nginx/manifests/config.pp
index 4987851..8a95edd 100644
--- a/modules/nginx/manifests/config.pp
+++ b/modules/nginx/manifests/config.pp
@@ -12,12 +12,7 @@ class nginx::config {
       source => 'puppet:///modules/nginx/mime.types.paste';
     "/etc/nginx/nginx.conf":
       source => 'puppet:///modules/nginx/nginx.conf';
-  }
-
-  exec { 'openssl dhparam -out /etc/nginx/dhparam.pem 4096':
-    path => '/usr/bin',
-    creates => '/etc/nginx/dhparam.pem',
-    timeout => 3600,
-    require => Class["haveged"];
+    "/etc/nginx/dhparam.pem":
+      source => 'puppet:///modules/nginx/dhparam.pem';
   }
 }