class pantin::certes(
	Boolean $ca = false,
	String $bootstrap_key = "",
	String $min_serial = "",
	String $max_serial = "",
	Array[String] $peer_authorities = [],
) {
	if $facts['os']['family'] == 'OpenBSD' {
		$certes_bin = '/usr/local/sbin/certes'
		$var_path = '/var/certes'
		$certes_uid = '_certes'
		$certes_gid = '_certes'
		$mdrd_uid = '_certesmdrd'
		$mdrd_gid = '_certesmdrd'

		# TODO: those should be created by the port
		group { $certes_gid:
		} ->
		user { $certes_uid:
			gid => $certes_gid,
			home => $var_path,
		}
		group { $mdrd_gid:
		} ->
		user { $mdrd_uid:
			gid => $mdrd_gid,
			home => $var_path,
		}
	} else {
		package { 'mdrd':
			ensure => present,
		}
		$certes_bin = '/usr/sbin/certes'
		$var_path = '/var/lib/certes'
		$certes_uid = 'certes'
		$certes_gid = 'certes'
		$mdrd_uid = 'certesmdrd'
		$mdrd_gid = 'certesmdrd'
		group { $certes_gid:
			system => true,
		} ->
		user { $certes_uid:
			gid => $certes_gid,
			home => $var_path,
			system => true,
		}
		group { $mdrd_gid:
			system => true,
		} ->
		user { $mdrd_uid:
			gid => $mdrd_gid,
			home => $var_path,
			system => true,
		}
		file { '/etc/init.d/certes':
			mode => '0755',
			content => file('pantin/etc/init.d/certes'),
		}
	}

	package { 'certes':
		ensure => present,
	}

	file { '/etc/certes':
		ensure => directory,
		require => [
			User[$certes_uid],
			User[$mdrd_uid],
		],
	}
	file { '/etc/facter/facts.d/certes_ca_status.pl':
		mode => '0755',
		content => file('pantin/etc/facter/facts.d/certes_ca_status.pl'),
	}
	file { '/etc/certes/root.pem':
		content => file('pantin/etc/certes/root.pem'),
	}

	$domain = $facts['networking']['domain']
	$fqdn = $facts['networking']['fqdn']

	file { '/etc/certes/mdrd.conf':
		content => template('pantin/etc/certes/mdrd.conf.erb'),
	}
	file { '/etc/certes/certes.conf':
		content => template('pantin/etc/certes/certes.conf.erb'),
	}
	file { '/etc/certes/openssl.cnf':
		content => template('pantin/etc/certes/openssl.cnf.erb'),
	}

	file { "$var_path":
		owner => $certes_uid,
		group => $certes_gid,
		ensure => directory,
		require => User[$certes_uid],
	}
	file { "$var_path/crls":
		owner => $certes_uid,
		group => $certes_gid,
		ensure => directory,
		require => User[$certes_uid],
	}
	file { "$var_path/crls/root.crl":
		owner => $certes_uid,
		group => $certes_gid,
		content => file('pantin/var/certes/crls/root.crl'),
	}

	if $ca {
		exec { 'setup-ca-reqs':
			command => "/usr/local/share/certes/setup_ca.sh -O 'MinMaxiste Inc.' -C 'certes.${domain}' ca-reqs DNS:${fqdn},DNS:certes.${domain}",
			creates => '/etc/certes/ca_key.pem',
			require => [
				File['/etc/certes/openssl.cnf'],
				File['/etc/certes/certes.conf'],
				File['/etc/certes/mdrd.conf'],
			],
		}

		# Currently CAs are always OpenBSD, so no need to do
		# conditionals on login.conf.d
		file { '/etc/login.conf.d/certes':
			content => template('pantin/etc/login.conf.d/certes.erb'),
			notify => Service['certes'],
		}

		service { 'certes':
			ensure => $facts['certes_ca_status'] ? {
				'ready' => 'running',
				# Leave it running even when expired as it may take
				# special actions on cert expiry
				'expired' => 'running',
				default => 'stopped',
			},
			enable => $facts['certes_ca_status'] ? {
				'ready' => true,
				default => false,
			},
			subscribe => [
				File['/etc/certes/root.pem'],
				File['/etc/certes/certes.conf'],
				File['/etc/certes/mdrd.conf'],
			],
			require => Package['certes'],
		}
	} else {
		exec { 'certes-init':
			command => "$certes_bin -config /etc/certes/certes.conf init && chown $certes_uid:$mdrd_gid /etc/certes/key.pem $var_path/cert.pem && chmod 640 /etc/certes/key.pem $var_path/cert.pem",
			creates => '/etc/certes/key.pem',
			require => [
				User[$certes_uid],
				Group[$mdrd_gid],
				Package['certes'],
				File['/etc/certes/openssl.cnf'],
				File['/etc/certes/certes.conf'],
				File['/etc/certes/mdrd.conf'],
			],
		}
		service { 'certes':
			ensure => 'running',
			enable => true,
			subscribe => [
				File['/etc/certes/root.pem'],
				File['/etc/certes/certes.conf'],
				File['/etc/certes/mdrd.conf'],
				File['/etc/init.d/certes'],
			],
			require => [
				Package['mdrd'],
				Package['certes'],
				Exec['certes-init'],
			],
		}

		file { '/etc/ssl/private/certes.key':
			mode => '0600',
			source => '/etc/certes/key.pem',
			require => Exec['certes-init'],
		} ->
		file { '/etc/ssl/certs/certes.pem':
			source => "$var_path/cert.pem",
			require => Service['certes'],
		}
	}
}
