do not display a diff when the password file changes

CHANGELOG.md

@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Added
 * Add defined type to manage backup jobs: `ds_389::backup`
 
+### Fixed
+* Protect passwords by not displaying a diff when the password file changes
+
 ## [2.2.0] - 2020-11-16
 This release fixes a major bug when using self-signed certificates. In previous
 releases the internal CA certificate was created without the required

manifests/instance.pp

@@ -155,13 +155,14 @@
   }
 
   file { "${instance_path}/pin.txt":
-    ensure  => file,
-    mode    => '0440',
-    owner   => $user,
-    group   => $group,
-    content => "Internal (Software) Token:${root_dn_pass}\n",
-    require => Exec["setup ds: ${server_id}"],
-    notify  => Exec["restart ${server_id} to pick up new token"],
+    ensure    => file,
+    mode      => '0440',
+    owner     => $user,
+    group     => $group,
+    content   => "Internal (Software) Token:${root_dn_pass}\n",
+    show_diff => false,
+    require   => Exec["setup ds: ${server_id}"],
+    notify    => Exec["restart ${server_id} to pick up new token"],
   }
 
   # If we have existing certs, create cert db and import certs.