puppet: Read camo key from zulip-secrets.conf.

puppet/zulip/manifests/camo.pp

@@ -5,7 +5,16 @@ class zulip::camo {
                     ]
   package { $camo_packages: ensure => "installed" }
 
-  # The configuration file is generated at install time
+  $camo_key = zulipsecret("secrets", "camo_key", '')
+
+  file { "/etc/default/camo":
+    require => Package[camo],
+    ensure => file,
+    owner  => "root",
+    group  => "root",
+    mode => 644,
+    content => template("zulip/camo_defaults.template.erb"),
+  }
 }
 
 

puppet/zulip/templates/camo_defaults.template.erb

@@ -0,0 +1,3 @@
+ENABLED=yes
+PORT=9292
+CAMO_KEY=<%= scope["zulip::camo::camo_key"] %>

puppet/zulip_internal/files/camo_defaults

@@ -1,3 +0,0 @@
-ENABLED=yes
-PORT=9292
-CAMO_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

puppet/zulip_internal/manifests/loadbalancer.pp

@@ -28,15 +28,6 @@ class zulip_internal::loadbalancer {
     notify => Service["nginx"],
   }
 
-  file { "/etc/default/camo":
-    require => Package[camo],
-    ensure => file,
-    owner  => "root",
-    group  => "root",
-    mode => 644,
-    source => "puppet:///modules/zulip_internal/camo_defaults",
-  }
-
   file { '/etc/log2zulip.conf':
     ensure     => file,
     owner      => "zulip",

scripts/setup/generate_secrets.py

@@ -23,6 +23,8 @@ CAMO_CONFIG_FILENAME = '/etc/default/camo'
 AUTOGENERATED_SETTINGS = ['shared_secret', 'avatar_salt', 'rabbitmq_password', 'local_database_password',
                           'initial_password_salt']
 
+# TODO: We can eliminate this function if we refactor the install
+# script to run generate_secrets before zulip-puppet-apply.
 def generate_camo_config_file(camo_key):
     camo_config = """ENABLED=yes
 PORT=9292