Issue 4078 - Apply Nginx work-around for CVE-2015-4000

modules/nginx/manifests/init.pp

 class nginx (
     $worker_processes = $nginx::params::worker_processes,
     $worker_connections = $nginx::params::worker_connections,
     $ssl_session_cache =  $nginx::params::ssl_session_cache,
     $geoip_country = undef,
     $geoip_city = undef,
   ) inherits nginx::params {
 
   apt::ppa {'ppa:nginx/stable':
   }
@@ skipping 47 matching lines @@
     ensure => directory,
     require => Package['nginx']
   }
 
   file {'/var/cache/nginx':
     before => Service['nginx'],
     ensure => directory,
     require => Package['nginx'],
   }
 
+  @file {'/etc/nginx/dhparam.pem':
+    ensure => 'present',
+    mode => 0600,
+    notify => Service['nginx'],
+    require => Package['nginx'],
+    source => 'puppet:///modules/private/dhe_rsa_export.pem',
+  }
+
   define hostconfig (
       $domain = $title,
       $alt_names = [],
       $log,
       $log_format = 'main',
       $is_default = false,
       $source = undef,
       $content = undef,
       $global_config = undef,
       $certificate = undef,
       $private_key = undef,
       $enabled = true) {
     file {"/etc/nginx/sites-available/${domain}":
       ensure  => file,
       content => template('nginx/site.erb'),
       require => Package['nginx'],
       notify => Service['nginx'],
     }
 
     if $certificate and $private_key {
+      realize(File['/etc/nginx/dhparam.pem'])
+
       if !defined(File["/etc/nginx/${certificate}"]) {
         file {"/etc/nginx/${certificate}":
           ensure => file,
           mode => 0400,
           notify => Service['nginx'],
           before => File["/etc/nginx/sites-available/${domain}"],
           require => Package['nginx'],
           source => "puppet:///modules/private/${certificate}"
         }
       }
@@ skipping 96 matching lines @@
     subscribe => File['/etc/nginx/nginx.conf'],
   }
 
   file {'/usr/share/nginx/html/50x.html':
     mode => 0644,
     owner => 'root',
     require => Package['nginx'],
     source => 'puppet:///modules/nginx/50x.html',
   }
 }