Puppet

While trying to simplify configuring a system to run the puppetmaster process under passenger, I’ve noticed that setting hostcert, hostcsr, hostprivkey, hostpubkey in /etc/puppet/puppet.conf doesn’t work.

I’ve tried to simplify apache2 site configuration file so that SSLCertificateFile and SSLCertificateKeyFile point to well-know places.

With the following puppet.conf file:

[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
templatedir=$confdir/templates
prerun_command=/etc/puppet/etckeeper-commit-pre
postrun_command=/etc/puppet/etckeeper-commit-post
# Store host ssl files in wellknwon places so that 
# apache2 ssl can be easily configured
hostcert=$ssldir/my_cert.pem
hostcsr=$ssldir/my_csr.pem
hostprivkey=$ssldir/my_priv_key.pem
hostpubkey=$ssldir/my_pub_key.pem

[master]
# These are needed when the puppetmaster is run by passenger
# and can safely be removed if you webrick (default) or mongrel is used.
ssl_client_header = SSL_CLIENT_S_DN 
ssl_client_verify_header = SSL_CLIENT_VERIFY

The apache2 configuration would be identical for every puppetmaster system:

Listen 8140



        SSLEngine on
        SSLProtocol -ALL +SSLv3 +TLSv1
        SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP

        SSLCertificateFile      /var/lib/puppet/ssl/my_cert.pem
        SSLCertificateKeyFile   /var/lib/puppet/ssl/my_priv_key.pem
        SSLCertificateChainFile /var/lib/puppet/ssl/certs/ca.pem
        SSLCACertificateFile    /var/lib/puppet/ssl/certs/ca.pem
        SSLCARevocationFile     /var/lib/puppet/ssl/crl.pem
        # Set to 2 if this puppetmaster doesn't issue certificates
        # to puppet clients
        SSLVerifyDepth 1
        SSLOptions +StdEnvVars
        # Set to require if this puppetmaster doesn't issue certificates
        # to puppet clients
        SSLVerifyClient optional

        PassengerHighPerformance on
        PassengerStatThrottleRate 120
        PassengerUseGlobalQueue on
        RackAutoDetect Off
        RackBaseURI /
        RailsAutoDetect Off

        DocumentRoot /usr/share/puppet/rack/puppetmasterd/public
        
                Options None
                AllowOverride None
                Order allow,deny
                allow from all