Puppet defined type for regular dhparams re-generation

dhparams.pp

# create and refresh dh params
define profile::security::dhparams(
  String $path = $name,
  Integer $length,
  $recreate_after = null,
  Boolean $selinux = false,
  $owner = 'root',
  $group = 0,
) {
  $tmpfile = "${dirname($path)}/.puppet-${basename($path)}"
  if $recreate_after {
    tidy { "tidy-refresh dhparams ${name}":
      path => $tmpfile,
      age  => $recreate_after,
      type => mtime,
    }
  } ->
  exec { "generate dhparams ${name}":
    command => "/usr/bin/openssl dhparam -out ${tmpfile} ${length}",
    creates  => $tmpfile,
    timeout => '-1'
  } -> file { $name:
    ensure  => present,
    source  => $tmpfile,
    owner   => $owner,
    group   => $group,
    mode    => '0644';
  }
  if $selinux {
    File[$name]{
      seltype => 'cert_t',
    }
  }
}

Use like

    profile::security::dhparams { "${datadir}/dh2048.pem":
      length => 2048,
      recreate_after => "2w",
      notify => Service[postfix],
    }
    profile::security::dhparams { "${datadir}/dh512.pem":
      length => 512,
      recreate_after => "2w",
      notify => Service[postfix],
    }