# A Heat environment file to enable the barbican PKCS11 crypto backend with
# a Lunasa HSM.
# Note that barbican needs to be enabled in order to use this.
parameter_defaults:
  # In order to use this backend, you need to uncomment these values and
  # provide the appropriate values.
  #
  # BarbicanPkcs11CryptoLogin: Password (PIN) to login to PKCS11 session
  # BarbicanPkcs11CryptoSlotId: Slot Id for the HSM.  Note that this parameter is only
  #   strictly required when setting up the Lunasa client in non-HA mode.  In HA
  #   mode, whatever value is placed here will be overridden by the dynamically generated
  #   slot for the HA group created on the client.
  # BarbicanPkcs11CryptoGlobalDefault: Whether this plugin is the global default plugin

  BarbicanPkcs11CryptoLibraryPath:         '/usr/lib/libCryptoki2_64.so'
  BarbicanPkcs11CryptoEncryptionMechanism: 'CKM_AES_CBC'
  BarbicanPkcs11CryptoHMACKeyType:         'CKK_AES'
  BarbicanPkcs11CryptoHMACKeygenMechanism: 'CKM_AES_KEY_GEN'
  BarbicanPkcs11CryptoMKEKLabel:           'barbican_mkek_0'
  BarbicanPkcs11CryptoMKEKLength:          '32'
  BarbicanPkcs11CryptoHMACLabel:           'barbican_hmac_0'
  BarbicanPkcs11CryptoLunasaEnabled:       true
  BarbicanPkcs11CryptoEnabled:             true
  BarbicanPkcs11AlwaysSetCkaSensitive:     true
  LunasaVars:
    # lunasa_client_tarball_location: URI where the CipherTools tarball can be downloaded.
    # lunasa_client_tarball_name: Filename for the CipherTools tarball.
    # lunasa_client_installer_path: path to install.sh in the tarball.
    # lunasa_hsms:  A list of HSMs with the following format:
    # lunasa_hsms:
    #  - name: Name of the HSM
    #    hostname: Hostname for the HSM
    #    admin_password: admin password for the HSM
    #    partition: HSM partition for this client to be assigned
    #    partition_serial: serial number for the partition
    #    client_ip: IP for the client - TODO: figure out how to pass this correctly
    # lunasa_ha_label: HA group label Required only for HA mode.  This will trigger the
    #    installer to create an HA group comprising of the HSMs in lunasa_hsms.
    # lunasa_partition_password: PKCS#11 password for the partitition
resource_registry:
  OS::TripleO::Services::BarbicanBackendPkcs11Crypto: ../deployment/barbican/barbican-backend-pkcs11-crypto-puppet.yaml