# A Heat environment file to enable the barbican PKCS11 crypto backend with
# a Thales HSM.
# Note that barbican needs to be enabled in order to use this.
parameter_defaults:
  # In order to use this backend, you need to uncomment these values and
  # provide the appropriate values.
  #
  # BarbicanPkcs11CryptoLogin: Password (PIN) to login to PKCS11 session
  # BarbicanPkcs11CryptoSlotId: Slot Id for the HSM
  # BarbicanPkcs11CryptoGlobalDefault: Whether this plugin is the global default plugin

  BarbicanPkcs11CryptoLibraryPath:         '/opt/nfast/toolkits/pkcs11/libcknfast.so'
  BarbicanPkcs11CryptoEncryptionMechanism: 'CKM_AES_CBC'
  BarbicanPkcs11CryptoHMACKeyType:         'CKK_SHA256_HMAC'
  BarbicanPkcs11CryptoHMACKeygenMechanism: 'CKM_NC_SHA256_HMAC_KEY_GEN'
  BarbicanPkcs11CryptoMKEKLabel:           'barbican_mkek_0'
  BarbicanPkcs11CryptoMKEKLength:          '32'
  BarbicanPkcs11CryptoHMACLabel:           'barbican_hmac_0'
  BarbicanPkcs11CryptoThalesEnabled:       true
  BarbicanPkcs11CryptoEnabled:             true
  BarbicanPkcs11AlwaysSetCkaSensitive:     false
  ThalesVars:
    thales_client_working_dir: /tmp/thales_client_install
    # thales_client_tarball_location: URI where the CipherTools tarball can be downloaded.
    # thales_client_tarball_name: Filename for the CipherTools tarball.
    thales_client_path: linux/libc6_11/amd64/nfast
    thales_client_uid:  42481
    thales_client_gid:  42481
    # thales_km_data_location: URL where the RFS kmdata tarball can be downloaded.
    # thales_km_data_tarball_name: Filename for the kmdata tarball.
    # thales_hsm_ip_address: IP address for the HSM
    # thales_rfs_server_ip_address: IP address for the RFS Server.
    # thales_hsm_config_location: The directory where the hsm configuration is stored in
    #                             your RFS server.  e.g. hsm-XXXX-XXXX-XXXX.
    # thales_rfs_user: Username used to log into RFS server.
    # thales_rfs_key: RSA Private key in PEM format used to log into RFS server.

resource_registry:
  OS::TripleO::Services::BarbicanBackendPkcs11Crypto: ../deployment/barbican/barbican-backend-pkcs11-crypto-puppet.yaml
