diff --git a/manifests/agent/config.pp b/manifests/agent/config.pp index b67e566..8f2bd9c 100644 --- a/manifests/agent/config.pp +++ b/manifests/agent/config.pp @@ -1,71 +1,71 @@ # Puppet agent configuration # @api private class puppet::agent::config inherits puppet::config { puppet::config::agent{ - 'classfile': value => $::puppet::classfile; + 'classfile': value => $puppet::classfile; 'localconfig': value => '$vardir/localconfig'; 'default_schedules': value => false; - 'report': value => $::puppet::report; - 'masterport': value => $::puppet::port; - 'environment': value => $::puppet::environment; - 'splay': value => $::puppet::splay; - 'splaylimit': value => $::puppet::splaylimit; - 'runinterval': value => $::puppet::runinterval; - 'noop': value => $::puppet::agent_noop; - 'usecacheonfailure': value => $::puppet::usecacheonfailure; + 'report': value => $puppet::report; + 'masterport': value => $puppet::port; + 'environment': value => $puppet::environment; + 'splay': value => $puppet::splay; + 'splaylimit': value => $puppet::splaylimit; + 'runinterval': value => $puppet::runinterval; + 'noop': value => $puppet::agent_noop; + 'usecacheonfailure': value => $puppet::usecacheonfailure; } - if $::puppet::http_connect_timeout != undef { + if $puppet::http_connect_timeout != undef { puppet::config::agent { - 'http_connect_timeout': value => $::puppet::http_connect_timeout; + 'http_connect_timeout': value => $puppet::http_connect_timeout; } } - if $::puppet::http_read_timeout != undef { + if $puppet::http_read_timeout != undef { puppet::config::agent { - 'http_read_timeout': value => $::puppet::http_read_timeout; + 'http_read_timeout': value => $puppet::http_read_timeout; } } - if $::puppet::prerun_command { + if $puppet::prerun_command { puppet::config::agent { - 'prerun_command': value => $::puppet::prerun_command; + 'prerun_command': value => $puppet::prerun_command; } } - if $::puppet::postrun_command { + if $puppet::postrun_command { puppet::config::agent { - 'postrun_command': value => $::puppet::postrun_command; + 'postrun_command': value => $puppet::postrun_command; } } - unless $::puppet::pluginsync { + unless $puppet::pluginsync { if versioncmp($facts['puppetserver'], '6.0.0') >= 0 { fail('pluginsync is no longer a setting in Puppet 6') } else { puppet::config::agent { 'pluginsync': - value => $::puppet::pluginsync, + value => $puppet::pluginsync, } } } - $::puppet::agent_additional_settings.each |$key,$value| { + $puppet::agent_additional_settings.each |$key,$value| { puppet::config::agent { $key: value => $value } } - if $::puppet::runmode == 'service' { + if $puppet::runmode == 'service' { $should_start = 'yes' } else { $should_start = 'no' } - if $::osfamily == 'Debian' { + if $facts['os']['family'] == 'Debian' { augeas {'puppet::set_start': context => '/files/etc/default/puppet', changes => "set START ${should_start}", incl => '/etc/default/puppet', lens => 'Shellvars.lns', } - if $::puppet::remove_lock { + if $puppet::remove_lock { file {'/var/lib/puppet/state/agent_disabled.lock': ensure => absent, } } } } diff --git a/manifests/agent/install.pp b/manifests/agent/install.pp index e9e2cc6..388db46 100644 --- a/manifests/agent/install.pp +++ b/manifests/agent/install.pp @@ -1,17 +1,17 @@ # Install the puppet agent package # @api private class puppet::agent::install( - $manage_packages = $::puppet::manage_packages, - $package_name = $::puppet::client_package, - $package_version = $::puppet::version, - $package_provider = $::puppet::package_provider, - $package_source = $::puppet::package_source, + $manage_packages = $puppet::manage_packages, + $package_name = $puppet::client_package, + $package_version = $puppet::version, + $package_provider = $puppet::package_provider, + $package_source = $puppet::package_source, ) { if $manage_packages == true or $manage_packages == 'agent' { package { $package_name: ensure => $package_version, provider => $package_provider, source => $package_source, } } } diff --git a/manifests/agent/service.pp b/manifests/agent/service.pp index 3d0de2a..c254481 100644 --- a/manifests/agent/service.pp +++ b/manifests/agent/service.pp @@ -1,53 +1,53 @@ # Set up the puppet agent as a service # @api private class puppet::agent::service { - case $::puppet::runmode { + case $puppet::runmode { 'service': { $service_enabled = true $cron_enabled = false $systemd_enabled = false } 'cron': { $service_enabled = false $cron_enabled = true $systemd_enabled = false } 'systemd.timer', 'systemd': { $service_enabled = false $cron_enabled = false $systemd_enabled = true } 'none', 'unmanaged': { $service_enabled = false $cron_enabled = false $systemd_enabled = false } default: { fail("Runmode of ${puppet::runmode} not supported by puppet::agent::config!") } } - if $::puppet::runmode in $::puppet::unavailable_runmodes { + if $puppet::runmode in $puppet::unavailable_runmodes { fail("Runmode of ${puppet::runmode} not supported on ${::kernel} operating systems!") } class { 'puppet::agent::service::daemon': enabled => $service_enabled, } contain puppet::agent::service::daemon class { 'puppet::agent::service::systemd': enabled => $systemd_enabled, - hour => $::puppet::run_hour, - minute => $::puppet::run_minute, + hour => $puppet::run_hour, + minute => $puppet::run_minute, } contain puppet::agent::service::systemd class { 'puppet::agent::service::cron': enabled => $cron_enabled, - hour => $::puppet::run_hour, - minute => $::puppet::run_minute, + hour => $puppet::run_hour, + minute => $puppet::run_minute, } contain puppet::agent::service::cron } diff --git a/manifests/agent/service/cron.pp b/manifests/agent/service/cron.pp index a9b5819..2116481 100644 --- a/manifests/agent/service/cron.pp +++ b/manifests/agent/service/cron.pp @@ -1,28 +1,28 @@ # Set up running the agent via cron # @api private class puppet::agent::service::cron ( Boolean $enabled = false, Optional[Integer[0,23]] $hour = undef, Optional[Integer[0,59]] $minute = undef, ) { - unless $::puppet::runmode == 'unmanaged' or 'cron' in $::puppet::unavailable_runmodes { + unless $puppet::runmode == 'unmanaged' or 'cron' in $puppet::unavailable_runmodes { if $enabled { - $command = pick($::puppet::cron_cmd, "${::puppet::puppet_cmd} agent --config ${::puppet::dir}/puppet.conf --onetime --no-daemonize") - $times = extlib::ip_to_cron($::puppet::runinterval) + $command = pick($puppet::cron_cmd, "${puppet::puppet_cmd} agent --config ${puppet::dir}/puppet.conf --onetime --no-daemonize") + $times = extlib::ip_to_cron($puppet::runinterval) $_hour = pick($hour, $times[0]) $_minute = pick($minute, $times[1]) cron { 'puppet': command => $command, user => root, hour => $_hour, minute => $_minute, } } else{ cron { 'puppet': ensure => absent, } } } } diff --git a/manifests/agent/service/daemon.pp b/manifests/agent/service/daemon.pp index abcf5c2..d5d7841 100644 --- a/manifests/agent/service/daemon.pp +++ b/manifests/agent/service/daemon.pp @@ -1,25 +1,25 @@ # Set up running the agent as a daemon # @api private class puppet::agent::service::daemon ( Boolean $enabled = false, ) { - unless $::puppet::runmode == 'unmanaged' or 'service' in $::puppet::unavailable_runmodes { + unless $puppet::runmode == 'unmanaged' or 'service' in $puppet::unavailable_runmodes { if $enabled { service {'puppet': ensure => running, name => $puppet::service_name, hasstatus => true, hasrestart => $puppet::agent_restart_command != undef, enable => true, restart => $puppet::agent_restart_command, } } else { service {'puppet': ensure => stopped, name => $puppet::service_name, hasstatus => true, enable => false, } } } } diff --git a/manifests/config.pp b/manifests/config.pp index 9f39c1d..e55c2e9 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -1,101 +1,101 @@ # Set up the puppet config # @api private class puppet::config( - $allow_any_crl_auth = $::puppet::allow_any_crl_auth, - $auth_allowed = $::puppet::auth_allowed, - $auth_template = $::puppet::auth_template, - $ca_server = $::puppet::ca_server, - $ca_port = $::puppet::ca_port, - $dns_alt_names = $::puppet::dns_alt_names, - $module_repository = $::puppet::module_repository, - $pluginsource = $::puppet::pluginsource, - $pluginfactsource = $::puppet::pluginfactsource, - $puppet_dir = $::puppet::dir, - $puppetmaster = $::puppet::puppetmaster, - $syslogfacility = $::puppet::syslogfacility, - $srv_domain = $::puppet::srv_domain, - $use_srv_records = $::puppet::use_srv_records, - $additional_settings = $::puppet::additional_settings, - $client_certname = $::puppet::client_certname, + $allow_any_crl_auth = $puppet::allow_any_crl_auth, + $auth_allowed = $puppet::auth_allowed, + $auth_template = $puppet::auth_template, + $ca_server = $puppet::ca_server, + $ca_port = $puppet::ca_port, + $dns_alt_names = $puppet::dns_alt_names, + $module_repository = $puppet::module_repository, + $pluginsource = $puppet::pluginsource, + $pluginfactsource = $puppet::pluginfactsource, + $puppet_dir = $puppet::dir, + $puppetmaster = $puppet::puppetmaster, + $syslogfacility = $puppet::syslogfacility, + $srv_domain = $puppet::srv_domain, + $use_srv_records = $puppet::use_srv_records, + $additional_settings = $puppet::additional_settings, + $client_certname = $puppet::client_certname, ) { puppet::config::main{ - 'vardir': value => $::puppet::vardir; - 'logdir': value => $::puppet::logdir; - 'rundir': value => $::puppet::rundir; - 'ssldir': value => $::puppet::ssldir; + 'vardir': value => $puppet::vardir; + 'logdir': value => $puppet::logdir; + 'rundir': value => $puppet::rundir; + 'ssldir': value => $puppet::ssldir; 'privatekeydir': value => '$ssldir/private_keys { group = service }'; 'hostprivkey': value => '$privatekeydir/$certname.pem { mode = 640 }'; - 'show_diff': value => $::puppet::show_diff; - 'codedir': value => $::puppet::codedir; + 'show_diff': value => $puppet::show_diff; + 'codedir': value => $puppet::codedir; } if $module_repository and !empty($module_repository) { puppet::config::main{'module_repository': value => $module_repository; } } if $ca_server and !empty($ca_server) { puppet::config::main{'ca_server': value => $ca_server; } } if $ca_port { puppet::config::main{'ca_port': value => $ca_port; } } if $dns_alt_names and !empty($dns_alt_names) { puppet::config::main{'dns_alt_names': value => $dns_alt_names; } } if $use_srv_records { unless $srv_domain { fail('$::domain fact found to be undefined and $srv_domain is undefined') } puppet::config::main{ 'use_srv_records': value => true; 'srv_domain': value => $srv_domain; } } else { puppet::config::main { - 'server': value => pick($puppetmaster, $::fqdn); + 'server': value => pick($puppetmaster, $facts['networking']['fqdn']); } } if $pluginsource { puppet::config::main{'pluginsource': value => $pluginsource; } } if $pluginfactsource { puppet::config::main{'pluginfactsource': value => $pluginfactsource; } } if $syslogfacility and !empty($syslogfacility) { puppet::config::main{'syslogfacility': value => $syslogfacility; } } if $client_certname { puppet::config::main { 'certname': value => $client_certname; } } $additional_settings.each |$key,$value| { puppet::config::main { $key: value => $value } } file { $puppet_dir: ensure => directory, - owner => $::puppet::dir_owner, - group => $::puppet::dir_group, + owner => $puppet::dir_owner, + group => $puppet::dir_group, } - -> case $::osfamily { + -> case $facts['os']['family'] { 'Windows': { concat { "${puppet_dir}/puppet.conf": mode => '0674', ensure_newline => true, } } default: { concat { "${puppet_dir}/puppet.conf": owner => 'root', - group => $::puppet::params::root_group, + group => $puppet::params::root_group, mode => '0644', ensure_newline => true, } } } ~> file { "${puppet_dir}/auth.conf": content => template($auth_template), } } diff --git a/manifests/config/entry.pp b/manifests/config/entry.pp index 315a788..a9a1844 100644 --- a/manifests/config/entry.pp +++ b/manifests/config/entry.pp @@ -1,52 +1,52 @@ # Set a config entry # # @param key # The key of the config entry # @param value # The value for the config entry # @param section # The section for the config entry # @param sectionorder # How to order the section. This is only used on the first definition of the # section via ensure_resource. # @param joiner # How to join an array value into a string define puppet::config::entry ( String $key, Variant[Array[String], Boolean, String, Integer] $value, String $section, Variant[Integer[0], String] $sectionorder = 5, String $joiner = ',', ) { if ($value =~ Array) { $_value = join(flatten($value), $joiner) } elsif ($value =~ Boolean) { $_value = bool2str($value) } else { $_value = $value } # note the spaces at he end of the 'order' parameters, # they make sure that '1_main ' is ordered before '1_main_*' ensure_resource('concat::fragment', "puppet.conf_${section}", { - target => "${::puppet::dir}/puppet.conf", + target => "${puppet::dir}/puppet.conf", content => "\n[${section}]", order => "${sectionorder}_${section} ", }) # this adds the '$key =' for the first value, # otherwise it just appends it with the joiner to separate it from the previous value. if (!defined(Concat::Fragment["puppet.conf_${section}_${key}"])){ concat::fragment{"puppet.conf_${section}_${key}": - target => "${::puppet::dir}/puppet.conf", + target => "${puppet::dir}/puppet.conf", content => " ${key} = ${_value}", order => "${sectionorder}_${section}_${key} ", } } else { concat::fragment{"puppet.conf_${section}_${key}_${name}": - target => "${::puppet::dir}/puppet.conf", + target => "${puppet::dir}/puppet.conf", content => "${joiner}${_value}", order => "${sectionorder}_${section}_${key}_${name} ", } } } diff --git a/manifests/init.pp b/manifests/init.pp index 049b099..6cd3c71 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,744 +1,744 @@ # == Class: puppet # # This class installs and configures the puppet agent. # # === Parameters: # # $show_diff:: Show and report changed files with diff output # # $ca_server:: Use a different ca server. Should be either # a string with the location of the ca_server # or 'false'. # # == Advanced puppet parameters # # $version:: Specify a specific version of a package to # install. The version should be the exact # match for your distro. # You can also use certain values like 'latest'. # Note that when you specify exact versions you # should also override $server_version since # that defaults to $version. # # $manage_packages:: Should this module install packages or not. # Can also install only server packages with value # of 'server' or only agent packages with 'agent'. # # $port:: Override the port of the master we connect to. # # $pluginsync:: Enable pluginsync. # # $splay:: Switch to enable a random amount of time # to sleep before each run. # # $splaylimit:: The maximum time to delay before runs. # Defaults to being the same as the run interval. # This setting can be a time interval in seconds # (30 or 30s), minutes (30m), hours (6h), days (2d), # or years (5y). # # $runinterval:: Set up the interval (in seconds) to run # the puppet agent. # # $autosign:: If set to a boolean, autosign is enabled or disabled # for all incoming requests. Otherwise this has to be # set to the full file path of an autosign.conf file or # an autosign script. If this is set to a script, make # sure that script considers the content of autosign.conf # as otherwise Foreman functionality might be broken. # # $autosign_entries:: A list of certnames or domain name globs # whose certificate requests will automatically be signed. # Defaults to an empty Array. # # $autosign_mode:: mode of the autosign file/script # # $autosign_content:: If set, write the autosign file content # using the value of this parameter. # Cannot be used at the same time as autosign_entries # For example, could be a string, or # file('another_module/autosign.sh') or # template('another_module/autosign.sh.erb') # # $autosign_source:: If set, use this as the source for the autosign file, # instead of autosign_content. # # $usecacheonfailure:: Switch to enable use of cached catalog on # failure of run. # # $runmode:: Select the mode to setup the puppet agent. # # $run_hour:: The hour at which to run the puppet agent # when runmode is cron or systemd.timer. # # $run_minute:: The minute at which to run the puppet agent # when runmode is cron or systemd.timer. # # $cron_cmd:: Specify command to launch when runmode is # set 'cron'. # # $systemd_cmd:: Specify command to launch when runmode is # set 'systemd.timer'. # # $systemd_randomizeddelaysec:: Adds a random delay between 0 and this value # (in seconds) to the timer. Only relevant when # runmode is 'systemd.timer'. # # $module_repository:: Use a different puppet module repository # # $ca_port:: Puppet CA port # # $ca_crl_filepath:: Path to CA CRL file, dynamically resolves based on # $::server_ca status. # # $dns_alt_names:: Use additional DNS names when generating a # certificate. Defaults to an empty Array. # # $hiera_config:: The hiera configuration file. # # $syslogfacility:: Facility name to use when logging to syslog # # $use_srv_records:: Whether DNS SRV records will be used to resolve # the Puppet master # # $srv_domain:: Search domain for SRV records # # $additional_settings:: A hash of additional main settings. # # $http_connect_timeout:: The maximum amount of time an agent waits # when establishing an HTTP connection. # # $http_read_timeout:: The time an agent waits for one block to be # read from an HTTP connection. If nothing is # read after the elapsed interval then the # connection will be closed. # # $user:: Override the name of the puppet user. # # $group:: Override the name of the puppet group. # # $dir:: Override the puppet directory. # # $codedir:: Override the puppet code directory. # # $vardir:: Override the puppet var directory. # # $logdir:: Override the log directory. # # $rundir:: Override the PID directory. # # $ssldir:: Override where SSL certificates are kept. # # $sharedir:: Override the system data directory. # # $package_provider:: The provider used to install the agent. # Defaults to chocolatey on Windows # Defaults to undef elsewhere # # $package_source:: The location of the file to be used by the # agent's package resource. # Defaults to undef. If 'windows' or 'msi' are # used as the provider then this setting is # required. # # $unavailable_runmodes:: Runmodes that are not available for the # current system. This module will not try # to disable these modes. Default is [] # on Linux, ['cron', 'systemd.timer'] on # Windows and ['systemd.timer'] on other # systems. # # $auth_template:: Use a custom template for the auth # configuration. # # $use_srv_records:: Whether DNS SRV records will be used to resolve # the Puppet master # # $srv_domain:: Search domain for SRV records # # $pluginsource:: URL to retrieve Puppet plugins from during pluginsync # # $pluginfactsource:: URL to retrieve Puppet facts from during pluginsync # # $classfile:: The file in which puppet agent stores a list # of the classes associated with the retrieved # configuration. # # == puppet::agent parameters # # $agent:: Should a puppet agent be installed # # $agent_noop:: Run the agent in noop mode. # # $puppetmaster:: Hostname of your puppetmaster (server # directive in puppet.conf) # # $prerun_command:: A command which gets excuted before each Puppet run # # $postrun_command:: A command which gets excuted after each Puppet run # # $environment:: Default environment of the Puppet agent # # $agent_additional_settings:: A hash of additional agent settings. # Example: {stringify_facts => true} # # $client_certname:: The node's certificate name, and the unique # identifier it uses when requesting catalogs. # # $report:: Send reports to the Puppet Master # # == advanced agent parameters # # $service_name:: The name of the puppet agent service. # # $agent_restart_command:: The command which gets excuted on puppet service restart # # $client_package:: Install a custom package to provide # the puppet client # # $systemd_unit_name:: The name of the puppet systemd units. # # $remove_lock:: Remove the agent lock when running. # # $dir_owner:: Owner of the base puppet directory, used when # puppet::server is false. # # $dir_group:: Group of the base puppet directory, used when # puppet::server is false. # # == puppet::server parameters # # $server:: Should a puppet master be installed as well as the client # # $server_ip:: Bind ip address of the puppetmaster # # $server_port:: Puppet master port # # $server_ca:: Provide puppet CA # # $server_ca_crl_sync:: Sync puppet CA crl file to compile masters, Puppet CA Must be the Puppetserver # for the compile masters. Defaults to false. # # $server_crl_enable:: Turn on crl checking. Defaults to true when server_ca is true. Otherwise # Defaults to false. Note unless you are using an external CA. It is recommended # to set this to true. See $server_ca_crl_sync to enable syncing from CA Puppet Master # # $server_reports:: List of report types to include on the puppetmaster # # $server_external_nodes:: External nodes classifier executable # # $server_trusted_external_command:: The external trusted facts script to use. # (Puppet >= 6.11 only). # # $server_git_repo:: Use git repository as a source of modules # # $server_environments_owner:: The owner of the environments directory # # $server_environments_group:: The group owning the environments directory # # $server_environments_mode:: Environments directory mode. # # $server_common_modules_path:: Common modules paths # # $server_git_repo_path:: Git repository path # # $server_git_repo_mode:: Git repository mode # # $server_git_repo_group:: Git repository group # # $server_git_repo_user:: Git repository user # # $server_git_branch_map:: Git branch to puppet env mapping for the # default post receive hook # # $server_storeconfigs_backend:: Do you use storeconfigs? # false if you don't, "puppetdb" for puppetdb # # $server_certname:: The name to use when handling certificates. # # $server_puppetdb_host:: PuppetDB host # # $server_puppetdb_port:: PuppetDB port # # $server_puppetdb_swf:: PuppetDB soft_write_failure # # === Advanced server parameters: # # $server_strict_variables:: if set to true, it will throw parse errors # when accessing undeclared variables. # # $server_additional_settings:: A hash of additional settings. # Example: {trusted_node_data => true, ordering => 'manifest'} # # $server_manage_user:: Whether to manage the server user resource # # $server_user:: Name of the puppetmaster user. # # $server_group:: Name of the puppetmaster group. # # $server_dir:: Puppet configuration directory # # $server_http:: Should the puppet master listen on HTTP as well as HTTPS. # Useful for load balancer or reverse proxy scenarios. # # $server_http_port:: Puppet master HTTP port; defaults to 8139. # # $server_config_version:: How to determine the configuration version. When # using git_repo, by default a git describe # approach will be installed. # # $server_foreman_facts:: Should foreman receive facts from puppet # # $server_foreman:: Should foreman integration be installed # # $server_foreman_url:: Foreman URL # # $server_foreman_ssl_ca:: SSL CA of the Foreman server # # $server_foreman_ssl_cert:: Client certificate for authenticating against Foreman server # # $server_foreman_ssl_key:: Key for authenticating against Foreman server # # $server_puppet_basedir:: Where is the puppet code base located # # $server_enc_api:: What version of enc script to deploy. # # $server_report_api:: What version of report processor to deploy. # # $server_request_timeout:: Timeout in node.rb script for fetching # catalog from Foreman (in seconds). # # $server_environment_timeout:: Timeout for cached compiled catalogs (10s, 5m, ...) # # $server_envs_dir:: Directory that holds puppet environments # # $server_envs_target:: Indicates that $envs_dir should be # a symbolic link to this target # # $server_jvm_java_bin:: Set the default java to use. # # $server_jvm_config:: Specify the puppetserver jvm configuration file. # # $server_jvm_min_heap_size:: Specify the minimum jvm heap space. # # $server_jvm_max_heap_size:: Specify the maximum jvm heap space. # # $server_jvm_extra_args:: Additional java options to pass through. # This can be used for Java versions prior to # Java 8 to specify the max perm space to use: # For example: '-XX:MaxPermSize=128m'. # # $server_jvm_cli_args:: Java options to use when using puppetserver # subcommands (eg puppetserver gem). # # $server_jruby_gem_home:: Where jruby gems are located for puppetserver # # $allow_any_crl_auth:: Allow any authentication for the CRL. This # is needed on the puppet CA to accept clients # from a the puppet CA proxy. # # $auth_allowed:: An array of authenticated nodes allowed to # access all catalog and node endpoints. # default to ['$1'] # # $server_default_manifest:: Toggle if default_manifest setting should # be added to the [main] section # # $server_default_manifest_path:: A string setting the path to the default_manifest # # $server_default_manifest_content:: A string to set the content of the default_manifest # If set to '' it will not manage the file # # $server_package:: Custom package name for puppet master # # $server_version:: Custom package version for puppet master # # $server_ssl_dir:: SSL directory # # $server_ssl_dir_manage:: Toggle if ssl_dir should be added to the [master] # configuration section. This is necessary to # disable in case CA is delegated to a separate instance # # $server_ssl_key_manage:: Toggle if "private_keys/${::puppet::server::certname}.pem" # should be created with default user and group. This is used in # the default Forman setup to reuse the key for TLS communication. # # $server_puppetserver_vardir:: The path of the puppetserver var dir # # $server_puppetserver_rundir:: The path of the puppetserver run dir # # $server_puppetserver_logdir:: The path of the puppetserver log dir # # $server_puppetserver_dir:: The path of the puppetserver config dir # # $server_puppetserver_version:: The version of puppetserver installed (or being installed) # Unfortunately, different versions of puppetserver need # configuring differently. The default is derived from the # installed puppet version. Generally it's not needed to # override this but when upgrading it might be. # # $server_max_active_instances:: Max number of active jruby instances. Defaults to # processor count # # $server_max_requests_per_instance:: Max number of requests a jruby instances will handle. Defaults to 0 (disabled) # # $server_max_queued_requests:: The maximum number of requests that may be queued waiting to borrow a # JRuby from the pool. (Puppetserver 5.x only) # Defaults to 0 (disabled) for Puppetserver >= 5.0 # # $server_max_retry_delay:: Sets the upper limit for the random sleep set as a Retry-After header on # 503 responses returned when max-queued-requests is enabled. (Puppetserver 5.x only) # Defaults to 1800 for Puppetserver >= 5.0 # # $server_multithreaded:: Use multithreaded jruby. (Puppetserver >= 6.8 only). Defaults to false. # # $server_idle_timeout:: How long the server will wait for a response on an existing connection # # $server_connect_timeout:: How long the server will wait for a response to a connection attempt # # $server_ssl_protocols:: Array of SSL protocols to use. # Defaults to [ 'TLSv1.2' ] # # $server_ssl_chain_filepath:: Path to certificate chain for puppetserver # Only used when $ca is true # Defaults to "${ssl_dir}/ca/ca_crt.pem" # # $server_cipher_suites:: List of SSL ciphers to use in negotiation # Defaults to [ 'TLS_RSA_WITH_AES_256_CBC_SHA256', 'TLS_RSA_WITH_AES_256_CBC_SHA', # 'TLS_RSA_WITH_AES_128_CBC_SHA256', 'TLS_RSA_WITH_AES_128_CBC_SHA', ] # # $server_ruby_load_paths:: List of ruby paths # Defaults based on $::puppetversion # # $server_ca_client_whitelist:: The whitelist of client certificates that # can query the certificate-status endpoint # Defaults to [ '127.0.0.1', '::1', $::ipaddress ] # # $server_custom_trusted_oid_mapping:: A hash of custom trusted oid mappings. Defaults to undef # Example: { 1.3.6.1.4.1.34380.1.2.1.1 => { shortname => 'myshortname' } } # # $server_admin_api_whitelist:: The whitelist of clients that # can query the puppet-admin-api endpoint # Defaults to [ '127.0.0.1', '::1', $::ipaddress ] # # $server_ca_auth_required:: Whether client certificates are needed to access the puppet-admin api # Defaults to true # # $server_ca_client_self_delete:: Adds a rule to auth.conf, that allows a client to delete its own certificate # Defaults to false # # $server_use_legacy_auth_conf:: Should the puppetserver use the legacy puppet auth.conf? # Defaults to false (the puppetserver will use its own conf.d/auth.conf) # # $server_check_for_updates:: Should the puppetserver phone home to check for available updates? # Defaults to true # # $server_post_hook_content:: Which template to use for git post hook # # $server_post_hook_name:: Name of a git hook # # $server_environment_class_cache_enabled:: Enable environment class cache in conjunction with the use of the # environment_classes API. # Defaults to false # # $server_allow_header_cert_info:: Enable client authentication over HTTP Headers # Defaults to false, is also activated by the $server_http setting # # $server_web_idle_timeout:: Time in ms that Jetty allows a socket to be idle, after processing has # completed. # Defaults to 30000, using the Jetty default of 30s # # $server_puppetserver_jruby9k:: For Puppetserver 5, use JRuby 9k? Defaults to false # # $server_puppetserver_metrics:: Enable metrics (Puppetserver 5.x only) and JRuby profiling? # Defaults to true on Puppetserver 5.x and to false on Puppetserver 2.x # # $server_metrics_jmx_enable:: Enable or disable JMX metrics reporter. Defaults to true # # $server_metrics_graphite_enable:: Enable or disable Graphite metrics reporter. Defaults to false # # $server_metrics_graphite_host:: Graphite server host. Defaults to "127.0.0.1" # # $server_metrics_graphite_port:: Graphite server port. Defaults to 2003 # # $server_metrics_server_id:: A server id that will be used as part of the namespace for metrics produced # Defaults to $fqdn # # $server_metrics_graphite_interval:: How often to send metrics to graphite (in seconds) # Defaults to 5 # # $server_metrics_allowed:: Specify metrics to allow in addition to those in the default list # Defaults to undef # # $server_puppetserver_experimental:: For Puppetserver 5, enable the /puppet/experimental route? Defaults to true # # $server_puppetserver_trusted_agents:: Certificate names of puppet agents that are allowed to fetch *all* catalogs # Defaults to [] and all agents are only allowed to fetch their own catalogs. # # $server_compile_mode:: Used to control JRuby's "CompileMode", which may improve performance. # Defaults to undef (off). # # $server_parser:: Sets the parser to use. Valid options are 'current' or 'future'. # Defaults to 'current'. # # $server_acceptor_threads:: This sets the number of threads that the webserver will dedicate to accepting # socket connections for unencrypted HTTP traffic. If not provided, the webserver # defaults to the number of virtual cores on the host divided by 8, with a minimum # of 1 and maximum of 4. # # $server_selector_threads:: This sets the number of selectors that the webserver will dedicate to processing # events on connected sockets for unencrypted HTTPS traffic. If not provided, # the webserver defaults to the minimum of: virtual cores on the host divided by 2 # or max-threads divided by 16, with a minimum of 1. # # $server_max_threads:: This sets the maximum number of threads assigned to responding to HTTP and/or # HTTPS requests for a single webserver, effectively changing how many # concurrent requests can be made at one time. If not provided, the # webserver defaults to 200. # # $server_ssl_acceptor_threads:: This sets the number of threads that the webserver will dedicate to accepting # socket connections for encrypted HTTPS traffic. If not provided, defaults to # the number of virtual cores on the host divided by 8, with a minimum of 1 and maximum of 4. # # $server_ssl_selector_threads:: This sets the number of selectors that the webserver will dedicate to processing # events on connected sockets for encrypted HTTPS traffic. Defaults to the number of # virtual cores on the host divided by 2, with a minimum of 1 and maximum of 4. # The number of selector threads actually used by Jetty is twice the number of selectors # requested. For example, if a value of 3 is specified for the ssl-selector-threads setting, # Jetty will actually use 6 selector threads. # # $server_ca_allow_sans:: Allow CA to sign certificate requests that have Subject Alternative Names # Defaults to false # # $server_ca_allow_auth_extensions:: Allow CA to sign certificate requests that have authorization extensions # Defaults to false # # $server_ca_enable_infra_crl:: Enable the separate CRL for Puppet infrastructure nodes # Defaults to false # # $server_max_open_files:: Increase the max open files limit for Puppetserver. # Defaults to undef # # $server_versioned_code_id:: The path to an executable script that Puppet Server invokes to generate a code_id # Defaults to undef # # $server_versioned_code_content:: Contains the path to an executable script that Puppet Server # invokes when on static_file_content requests. # Defaults to undef # # === Usage: # # * Simple usage: # # include puppet # # * Installing a puppetmaster # # class {'puppet': # server => true, # } # # * Advanced usage: # # class {'puppet': # agent_noop => true, # version => '6.11.0-1', # } # class puppet ( String $version = $puppet::params::version, String $user = $puppet::params::user, String $group = $puppet::params::group, Stdlib::Absolutepath $dir = $puppet::params::dir, Stdlib::Absolutepath $codedir = $puppet::params::codedir, Stdlib::Absolutepath $vardir = $puppet::params::vardir, Stdlib::Absolutepath $logdir = $puppet::params::logdir, Stdlib::Absolutepath $rundir = $puppet::params::rundir, Stdlib::Absolutepath $ssldir = $puppet::params::ssldir, Stdlib::Absolutepath $sharedir = $puppet::params::sharedir, Variant[Boolean, Enum['server', 'agent']] $manage_packages = $puppet::params::manage_packages, Optional[String] $dir_owner = $puppet::params::dir_owner, Optional[String] $dir_group = $puppet::params::dir_group, Optional[String] $package_provider = $puppet::params::package_provider, Optional[Variant[Stdlib::Absolutepath, Stdlib::HTTPUrl]] $package_source = $puppet::params::package_source, Integer[0, 65535] $port = $puppet::params::port, Boolean $pluginsync = $puppet::params::pluginsync, Boolean $splay = $puppet::params::splay, Variant[Integer[0],Pattern[/^\d+[smhdy]?$/]] $splaylimit = $puppet::params::splaylimit, Variant[Boolean, Stdlib::Absolutepath] $autosign = $puppet::params::autosign, Array[String] $autosign_entries = $puppet::params::autosign_entries, Pattern[/^[0-9]{3,4}$/] $autosign_mode = $puppet::params::autosign_mode, Optional[String] $autosign_content = $puppet::params::autosign_content, Optional[String] $autosign_source = $puppet::params::autosign_source, Variant[Integer[0],Pattern[/^\d+[smhdy]?$/]] $runinterval = $puppet::params::runinterval, Boolean $usecacheonfailure = $puppet::params::usecacheonfailure, Enum['cron', 'service', 'systemd.timer', 'none', 'unmanaged'] $runmode = $puppet::params::runmode, Optional[Integer[0,23]] $run_hour = undef, Optional[Integer[0,59]] $run_minute = undef, Array[Enum['cron', 'service', 'systemd.timer', 'none']] $unavailable_runmodes = $puppet::params::unavailable_runmodes, Optional[String] $cron_cmd = $puppet::params::cron_cmd, Optional[String] $systemd_cmd = $puppet::params::systemd_cmd, Integer[0] $systemd_randomizeddelaysec = $puppet::params::systemd_randomizeddelaysec, Boolean $agent_noop = $puppet::params::agent_noop, Boolean $show_diff = $puppet::params::show_diff, Optional[Stdlib::HTTPUrl] $module_repository = $puppet::params::module_repository, Optional[Integer[0]] $http_connect_timeout = $puppet::params::http_connect_timeout, Optional[Integer[0]] $http_read_timeout = $puppet::params::http_read_timeout, Optional[Variant[String, Boolean]] $ca_server = $puppet::params::ca_server, Optional[Integer[0, 65535]] $ca_port = $puppet::params::ca_port, Optional[String] $ca_crl_filepath = $puppet::params::ca_crl_filepath, Optional[String] $prerun_command = $puppet::params::prerun_command, Optional[String] $postrun_command = $puppet::params::postrun_command, Array[String] $dns_alt_names = $puppet::params::dns_alt_names, Boolean $use_srv_records = $puppet::params::use_srv_records, Optional[String] $srv_domain = $puppet::params::srv_domain, String $pluginsource = $puppet::params::pluginsource, String $pluginfactsource = $puppet::params::pluginfactsource, Hash[String, Data] $additional_settings = $puppet::params::additional_settings, Hash[String, Data] $agent_additional_settings = $puppet::params::agent_additional_settings, Optional[String] $agent_restart_command = $puppet::params::agent_restart_command, String $classfile = $puppet::params::classfile, String $hiera_config = $puppet::params::hiera_config, String $auth_template = $puppet::params::auth_template, Boolean $allow_any_crl_auth = $puppet::params::allow_any_crl_auth, Array[String] $auth_allowed = $puppet::params::auth_allowed, Variant[String, Array[String]] $client_package = $puppet::params::client_package, Boolean $agent = $puppet::params::agent, Boolean $remove_lock = $puppet::params::remove_lock, Boolean $report = $puppet::params::report, Variant[String, Boolean] $client_certname = $puppet::params::client_certname, Optional[String] $puppetmaster = $puppet::params::puppetmaster, String $systemd_unit_name = $puppet::params::systemd_unit_name, String $service_name = $puppet::params::service_name, Optional[String] $syslogfacility = $puppet::params::syslogfacility, String $environment = $puppet::params::environment, Boolean $server = $puppet::params::server, Array[String] $server_admin_api_whitelist = $puppet::params::server_admin_api_whitelist, Boolean $server_manage_user = $puppet::params::manage_user, String $server_user = $puppet::params::user, String $server_group = $puppet::params::group, String $server_dir = $puppet::params::dir, String $server_ip = $puppet::params::ip, Integer $server_port = $puppet::params::port, Boolean $server_ca = $puppet::params::server_ca, Boolean $server_ca_crl_sync = $puppet::params::server_ca_crl_sync, Optional[Boolean] $server_crl_enable = $puppet::params::server_crl_enable, Boolean $server_ca_auth_required = $puppet::params::server_ca_auth_required, Boolean $server_ca_client_self_delete = $puppet::params::server_ca_client_self_delete, Array[String] $server_ca_client_whitelist = $puppet::params::server_ca_client_whitelist, Optional[Puppet::Custom_trusted_oid_mapping] $server_custom_trusted_oid_mapping = $puppet::params::server_custom_trusted_oid_mapping, Boolean $server_http = $puppet::params::server_http, Integer $server_http_port = $puppet::params::server_http_port, String $server_reports = $puppet::params::server_reports, Optional[Stdlib::Absolutepath] $server_puppetserver_dir = $puppet::params::server_puppetserver_dir, Optional[Stdlib::Absolutepath] $server_puppetserver_vardir = $puppet::params::server_puppetserver_vardir, Optional[Stdlib::Absolutepath] $server_puppetserver_rundir = $puppet::params::server_puppetserver_rundir, Optional[Stdlib::Absolutepath] $server_puppetserver_logdir = $puppet::params::server_puppetserver_logdir, Optional[Pattern[/^[\d]\.[\d]+\.[\d]+$/]] $server_puppetserver_version = $puppet::params::server_puppetserver_version, Variant[Undef, String[0], Stdlib::Absolutepath] $server_external_nodes = $puppet::params::server_external_nodes, Optional[Stdlib::Absolutepath] $server_trusted_external_command = $puppet::params::server_trusted_external_command, Array[String] $server_cipher_suites = $puppet::params::server_cipher_suites, Optional[String] $server_config_version = $puppet::params::server_config_version, Integer[0] $server_connect_timeout = $puppet::params::server_connect_timeout, Boolean $server_git_repo = $puppet::params::server_git_repo, Boolean $server_default_manifest = $puppet::params::server_default_manifest, Stdlib::Absolutepath $server_default_manifest_path = $puppet::params::server_default_manifest_path, String $server_default_manifest_content = $puppet::params::server_default_manifest_content, String $server_environments_owner = $puppet::params::server_environments_owner, Optional[String] $server_environments_group = $puppet::params::server_environments_group, Pattern[/^[0-9]{3,4}$/] $server_environments_mode = $puppet::params::server_environments_mode, Stdlib::Absolutepath $server_envs_dir = $puppet::params::server_envs_dir, Optional[Stdlib::Absolutepath] $server_envs_target = $puppet::params::server_envs_target, Variant[Undef, String[0], Array[Stdlib::Absolutepath]] $server_common_modules_path = $puppet::params::server_common_modules_path, Pattern[/^[0-9]{3,4}$/] $server_git_repo_mode = $puppet::params::server_git_repo_mode, Stdlib::Absolutepath $server_git_repo_path = $puppet::params::server_git_repo_path, String $server_git_repo_group = $puppet::params::server_git_repo_group, String $server_git_repo_user = $puppet::params::server_git_repo_user, Hash[String, String] $server_git_branch_map = $puppet::params::server_git_branch_map, Integer[0] $server_idle_timeout = $puppet::params::server_idle_timeout, String $server_post_hook_content = $puppet::params::server_post_hook_content, String $server_post_hook_name = $puppet::params::server_post_hook_name, Variant[Undef, Boolean, Enum['active_record', 'puppetdb']] $server_storeconfigs_backend = $puppet::params::server_storeconfigs_backend, Array[Stdlib::Absolutepath] $server_ruby_load_paths = $puppet::params::server_ruby_load_paths, Stdlib::Absolutepath $server_ssl_dir = $puppet::params::server_ssl_dir, Boolean $server_ssl_dir_manage = $puppet::params::server_ssl_dir_manage, Boolean $server_ssl_key_manage = $puppet::params::server_ssl_key_manage, Array[String] $server_ssl_protocols = $puppet::params::server_ssl_protocols, Optional[Stdlib::Absolutepath] $server_ssl_chain_filepath = $puppet::params::server_ssl_chain_filepath, Optional[Variant[String, Array[String]]] $server_package = $puppet::params::server_package, Optional[String] $server_version = $puppet::params::server_version, String $server_certname = $puppet::params::server_certname, Enum['v2'] $server_enc_api = $puppet::params::server_enc_api, Enum['v2'] $server_report_api = $puppet::params::server_report_api, Integer[0] $server_request_timeout = $puppet::params::server_request_timeout, Boolean $server_strict_variables = $puppet::params::server_strict_variables, Hash[String, Data] $server_additional_settings = $puppet::params::server_additional_settings, Boolean $server_foreman = $puppet::params::server_foreman, Stdlib::HTTPUrl $server_foreman_url = $puppet::params::server_foreman_url, Optional[Stdlib::Absolutepath] $server_foreman_ssl_ca = $puppet::params::server_foreman_ssl_ca, Optional[Stdlib::Absolutepath] $server_foreman_ssl_cert = $puppet::params::server_foreman_ssl_cert, Optional[Stdlib::Absolutepath] $server_foreman_ssl_key = $puppet::params::server_foreman_ssl_key, Boolean $server_foreman_facts = $puppet::params::server_foreman_facts, Optional[Stdlib::Absolutepath] $server_puppet_basedir = $puppet::params::server_puppet_basedir, Optional[String] $server_puppetdb_host = $puppet::params::server_puppetdb_host, Integer[0, 65535] $server_puppetdb_port = $puppet::params::server_puppetdb_port, Boolean $server_puppetdb_swf = $puppet::params::server_puppetdb_swf, Enum['current', 'future'] $server_parser = $puppet::params::server_parser, Variant[Undef, Enum['unlimited'], Pattern[/^\d+[smhdy]?$/]] $server_environment_timeout = $puppet::params::server_environment_timeout, String $server_jvm_java_bin = $puppet::params::server_jvm_java_bin, String $server_jvm_config = $puppet::params::server_jvm_config, Pattern[/^[0-9]+[kKmMgG]$/] $server_jvm_min_heap_size = $puppet::params::server_jvm_min_heap_size, Pattern[/^[0-9]+[kKmMgG]$/] $server_jvm_max_heap_size = $puppet::params::server_jvm_max_heap_size, Optional[Variant[String,Array[String]]] $server_jvm_extra_args = $puppet::params::server_jvm_extra_args, Optional[String] $server_jvm_cli_args = $puppet::params::server_jvm_cli_args, Optional[Stdlib::Absolutepath] $server_jruby_gem_home = $puppet::params::server_jruby_gem_home, Integer[1] $server_max_active_instances = $puppet::params::server_max_active_instances, Integer[0] $server_max_requests_per_instance = $puppet::params::server_max_requests_per_instance, Integer[0] $server_max_queued_requests = $puppet::params::server_max_queued_requests, Integer[0] $server_max_retry_delay = $puppet::params::server_max_retry_delay, Boolean $server_multithreaded = $puppet::params::server_multithreaded, Boolean $server_use_legacy_auth_conf = $puppet::params::server_use_legacy_auth_conf, Boolean $server_check_for_updates = $puppet::params::server_check_for_updates, Boolean $server_environment_class_cache_enabled = $puppet::params::server_environment_class_cache_enabled, Boolean $server_allow_header_cert_info = $puppet::params::server_allow_header_cert_info, Integer[0] $server_web_idle_timeout = $puppet::params::server_web_idle_timeout, Boolean $server_puppetserver_jruby9k = $puppet::params::server_puppetserver_jruby9k, Optional[Boolean] $server_puppetserver_metrics = $puppet::params::server_puppetserver_metrics, - Boolean $server_metrics_jmx_enable = $::puppet::params::server_metrics_jmx_enable, - Boolean $server_metrics_graphite_enable = $::puppet::params::server_metrics_graphite_enable, - String $server_metrics_graphite_host = $::puppet::params::server_metrics_graphite_host, - Integer $server_metrics_graphite_port = $::puppet::params::server_metrics_graphite_port, - String $server_metrics_server_id = $::puppet::params::server_metrics_server_id, - Integer $server_metrics_graphite_interval = $::puppet::params::server_metrics_graphite_interval, - Optional[Array] $server_metrics_allowed = $::puppet::params::server_metrics_allowed, + Boolean $server_metrics_jmx_enable = $puppet::params::server_metrics_jmx_enable, + Boolean $server_metrics_graphite_enable = $puppet::params::server_metrics_graphite_enable, + String $server_metrics_graphite_host = $puppet::params::server_metrics_graphite_host, + Integer $server_metrics_graphite_port = $puppet::params::server_metrics_graphite_port, + String $server_metrics_server_id = $puppet::params::server_metrics_server_id, + Integer $server_metrics_graphite_interval = $puppet::params::server_metrics_graphite_interval, + Optional[Array] $server_metrics_allowed = $puppet::params::server_metrics_allowed, Boolean $server_puppetserver_experimental = $puppet::params::server_puppetserver_experimental, Array[String] $server_puppetserver_trusted_agents = $puppet::params::server_puppetserver_trusted_agents, Optional[Enum['off', 'jit', 'force']] $server_compile_mode = $puppet::params::server_compile_mode, Optional[Integer[1]] $server_acceptor_threads = undef, Optional[Integer[1]] $server_selector_threads = undef, Optional[Integer[1]] $server_ssl_acceptor_threads = undef, Optional[Integer[1]] $server_ssl_selector_threads = undef, Optional[Integer[1]] $server_max_threads = undef, Boolean $server_ca_allow_sans = $puppet::params::server_ca_allow_sans, Boolean $server_ca_allow_auth_extensions = $puppet::params::server_ca_allow_auth_extensions, Boolean $server_ca_enable_infra_crl = $puppet::params::server_ca_enable_infra_crl, Optional[Integer[1]] $server_max_open_files = $puppet::params::server_max_open_files, Optional[Stdlib::Absolutepath] $server_versioned_code_id = undef, Optional[Stdlib::Absolutepath] $server_versioned_code_content = undef, ) inherits puppet::params { contain puppet::config if $agent == true { contain puppet::agent } if $server == true { contain puppet::server } # Ensure the server is running before the agent needs it, and that # certificates are generated in the server config (if enabled) if $server == true and $agent == true { Class['puppet::server'] -> Class['puppet::agent::service'] } } diff --git a/manifests/params.pp b/manifests/params.pp index 2411247..ea4895f 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -1,447 +1,442 @@ # Default parameters # @api private class puppet::params { # Basic config $version = 'present' $manage_user = true $user = 'puppet' $group = 'puppet' $ip = '0.0.0.0' $port = 8140 $pluginsync = true $splay = false $splaylimit = 1800 $runinterval = 1800 $runmode = 'service' $report = true # Not defined here as the commands depend on module parameter "dir" $cron_cmd = undef $systemd_cmd = undef $agent_noop = false $show_diff = false $module_repository = undef $hiera_config = '$confdir/hiera.yaml' $usecacheonfailure = true $ca_server = undef $ca_port = undef $ca_crl_filepath = undef $server_crl_enable = undef $prerun_command = undef $postrun_command = undef $server_compile_mode = undef $dns_alt_names = [] $use_srv_records = false if defined('$::domain') { - $srv_domain = $::domain + $srv_domain = $facts['networking']['domain'] } else { $srv_domain = undef } # lint:ignore:puppet_url_without_modules $pluginsource = 'puppet:///plugins' $pluginfactsource = 'puppet:///pluginfacts' # lint:endignore $classfile = '$statedir/classes.txt' $syslogfacility = undef $environment = $::environment - $aio_package = ($::osfamily == 'Windows' or $::rubysitedir =~ /\/opt\/puppetlabs\/puppet/) + $aio_package = ($facts['os']['family'] == 'Windows' or $facts['ruby']['sitedir'] =~ /\/opt\/puppetlabs\/puppet/) $systemd_randomizeddelaysec = 0 - case $::osfamily { + case $facts['os']['family'] { 'Windows' : { # Windows prefixes normal paths with the Data Directory's path and leaves 'puppet' off the end $dir_prefix = 'C:/ProgramData/PuppetLabs/puppet' $dir = "${dir_prefix}/etc" $codedir = "${dir_prefix}/etc" $logdir = "${dir_prefix}/var/log" $rundir = "${dir_prefix}/var/run" $ssldir = "${dir_prefix}/etc/ssl" $vardir = "${dir_prefix}/var" $sharedir = "${dir_prefix}/share" $bindir = "${dir_prefix}/bin" $root_group = undef $server_puppetserver_dir = undef $server_puppetserver_vardir = undef $server_puppetserver_rundir = undef $server_puppetserver_logdir = undef $server_ruby_load_paths = [] $server_jruby_gem_home = undef } /^(FreeBSD|DragonFly)$/ : { $dir = '/usr/local/etc/puppet' $codedir = '/usr/local/etc/puppet' $logdir = '/var/log/puppet' $rundir = '/var/run/puppet' $ssldir = '/var/puppet/ssl' $vardir = '/var/puppet' $sharedir = '/usr/local/share/puppet' $bindir = '/usr/local/bin' $root_group = undef $server_puppetserver_dir = '/usr/local/etc/puppetserver' $server_puppetserver_vardir = '/var/puppet/server/data/puppetserver' $server_puppetserver_rundir = '/var/run/puppetserver' $server_puppetserver_logdir = '/var/log/puppetserver' - $ruby_gem_dir = regsubst($::rubyversion, '^(\d+\.\d+).*$', '/usr/local/lib/ruby/gems/\1/gems') - $server_ruby_load_paths = [$::rubysitedir, "${ruby_gem_dir}/facter-${::facterversion}/lib"] + $ruby_gem_dir = regsubst($facts['ruby']['version'], '^(\d+\.\d+).*$', '/usr/local/lib/ruby/gems/\1/gems') + $server_ruby_load_paths = [$facts['ruby']['sitedir'], "${ruby_gem_dir}/facter-${::facterversion}/lib"] $server_jruby_gem_home = '/var/puppet/server/data/puppetserver/jruby-gems' } 'Archlinux' : { $dir = '/etc/puppetlabs/puppet' $codedir = '/etc/puppetlabs/code' $logdir = '/var/log/puppetlabs/puppet' $rundir = '/var/run/puppetlabs' $ssldir = '/etc/puppetlabs/puppet/ssl' $vardir = '/opt/puppetlabs/puppet/cache' $sharedir = '/opt/puppetlabs/puppet' $bindir = '/usr/bin' $root_group = undef $server_puppetserver_dir = undef $server_puppetserver_vardir = undef $server_puppetserver_rundir = undef $server_puppetserver_logdir = undef $server_ruby_load_paths = [] $server_jruby_gem_home = undef } default : { if $aio_package { $dir = '/etc/puppetlabs/puppet' $codedir = '/etc/puppetlabs/code' $logdir = '/var/log/puppetlabs/puppet' $rundir = '/var/run/puppetlabs' $ssldir = '/etc/puppetlabs/puppet/ssl' $vardir = '/opt/puppetlabs/puppet/cache' $sharedir = '/opt/puppetlabs/puppet' $bindir = '/opt/puppetlabs/bin' $server_puppetserver_dir = '/etc/puppetlabs/puppetserver' $server_puppetserver_vardir = '/opt/puppetlabs/server/data/puppetserver' $server_puppetserver_rundir = '/var/run/puppetlabs/puppetserver' $server_puppetserver_logdir = '/var/log/puppetlabs/puppetserver' $server_ruby_load_paths = ['/opt/puppetlabs/puppet/lib/ruby/vendor_ruby'] $server_jruby_gem_home = '/opt/puppetlabs/server/data/puppetserver/jruby-gems' } else { $dir = '/etc/puppet' - $codedir = $::osfamily ? { + $codedir = $facts['os']['family'] ? { 'Debian' => '/etc/puppet/code', default => '/etc/puppet', } $logdir = '/var/log/puppet' $rundir = '/var/run/puppet' $ssldir = '/var/lib/puppet/ssl' $vardir = '/var/lib/puppet' $sharedir = '/usr/share/puppet' $bindir = '/usr/bin' $server_puppetserver_dir = '/etc/puppetserver' $server_puppetserver_vardir = $vardir $server_puppetserver_rundir = undef $server_puppetserver_logdir = undef $server_ruby_load_paths = [] $server_jruby_gem_home = '/var/lib/puppet/jruby-gems' } $root_group = undef } } $http_connect_timeout = undef $http_read_timeout = undef $autosign = "${dir}/autosign.conf" $autosign_entries = [] $autosign_mode = '0664' $autosign_content = undef $autosign_source = undef $puppet_cmd = "${bindir}/puppet" $puppetserver_cmd = "${bindir}/puppetserver" $manage_packages = true - if $::osfamily == 'Windows' { + if $facts['os']['family'] == 'Windows' { $dir_owner = undef $dir_group = undef - } elsif $aio_package or $::osfamily == 'Suse' { + } elsif $aio_package or $facts['os']['family'] == 'Suse' { $dir_owner = 'root' $dir_group = $root_group } else { $dir_owner = $user $dir_group = $group } - $package_provider = $::osfamily ? { + $package_provider = $facts['os']['family'] ? { 'windows' => 'chocolatey', default => undef, } $package_source = undef # Need your own config templates? Specify here: $auth_template = 'puppet/auth.conf.erb' # Allow any to the CRL. Needed in case of puppet CA proxy $allow_any_crl_auth = false # Authenticated nodes to allow $auth_allowed = ['$1'] # Will this host be a puppet agent ? $agent = true $remove_lock = true $client_certname = $::clientcert if defined('$::puppetmaster') { $puppetmaster = $::puppetmaster } else { $puppetmaster = undef } # Hashes containing additional settings $additional_settings = {} $agent_additional_settings = {} $server_additional_settings = {} # Will this host be a puppetmaster? $server = false $server_ca = true $server_ca_crl_sync = false $server_reports = 'foreman' $server_external_nodes = "${dir}/node.rb" $server_trusted_external_command = undef $server_enc_api = 'v2' $server_report_api = 'v2' $server_request_timeout = 60 $server_certname = $::clientcert $server_strict_variables = false $server_http = false $server_http_port = 8139 # Need a new master template for the server? $server_template = 'puppet/server/puppet.conf.erb' # Template for server settings in [main] $server_main_template = 'puppet/server/puppet.conf.main.erb' # The script that is run to determine the reported manifest version. Undef # means we determine it in server.pp $server_config_version = undef # Set 'false' for static environments, or 'true' for git-based workflow $server_git_repo = false # Git branch to puppet env mapping for the post receive hook $server_git_branch_map = {} # Owner of the environments dir: for cases external service needs write # access to manage it. $server_environments_owner = $user $server_environments_group = $root_group $server_environments_mode = '0755' # Where we store our puppet environments $server_envs_dir = "${codedir}/environments" $server_envs_target = undef # Modules in this directory would be shared across all environments $server_common_modules_path = unique(["${server_envs_dir}/common", "${codedir}/modules", "${sharedir}/modules", '/usr/share/puppet/modules']) # Dynamic environments config, ignore if the git_repo is 'false' # Path to the repository $server_git_repo_path = "${vardir}/puppet.git" # mode of the repository $server_git_repo_mode = '0755' # user of the repository $server_git_repo_user = $user # group of the repository $server_git_repo_group = $user # Override these if you need your own hooks $server_post_hook_content = 'puppet/server/post-receive.erb' $server_post_hook_name = 'post-receive' $server_custom_trusted_oid_mapping = undef # PuppetDB config $server_puppetdb_host = undef $server_puppetdb_port = 8081 $server_puppetdb_swf = false # Do you use storeconfigs? (note: not required) # - undef if you don't # - active_record for 2.X style db # - puppetdb for puppetdb $server_storeconfigs_backend = undef $puppet_major = regsubst($::puppetversion, '^(\d+)\..*$', '\1') - if ($::osfamily =~ /(FreeBSD|DragonFly)/ and versioncmp($puppet_major, '5') >= 0) { + if ($facts['os']['family'] =~ /(FreeBSD|DragonFly)/ and versioncmp($puppet_major, '5') >= 0) { $server_package = "puppetserver${puppet_major}" } else { $server_package = undef } $server_ssl_dir = $ssldir $server_version = undef if $aio_package { $client_package = ['puppet-agent'] - } elsif ($::osfamily =~ /(FreeBSD|DragonFly)/) { + } elsif ($facts['os']['family'] =~ /(FreeBSD|DragonFly)/) { $client_package = ["puppet${puppet_major}"] } else { $client_package = ['puppet'] } # Puppet service name $service_name = 'puppet' # Puppet onedshot systemd service and timer name $systemd_unit_name = 'puppet-run' # Mechanisms to manage and reload/restart the agent # If supported on the OS, reloading is prefered since it does not kill a currently active puppet run - case $::osfamily { + case $facts['os']['family'] { 'Debian' : { $agent_restart_command = "/usr/sbin/service ${service_name} reload" $unavailable_runmodes = [] } 'Redhat' : { # PSBM is a CentOS 6 based distribution # it reports its $osreleasemajor as 2, not 6. # thats why we're matching for '2' in both parts # Amazon Linux is like RHEL6 but reports its osreleasemajor as 2017 or 2018. - $osreleasemajor = regsubst($::operatingsystemrelease, '^(\d+)\..*$', '\1') # workaround for the possibly missing operatingsystemmajrelease - $agent_restart_command = $osreleasemajor ? { + $agent_restart_command = $facts['os']['release']['major'] ? { /^(2|5|6|2017|2018)$/ => "/sbin/service ${service_name} reload", '7' => "/usr/bin/systemctl reload-or-restart ${service_name}", default => undef, } - $unavailable_runmodes = $osreleasemajor ? { + $unavailable_runmodes = $facts['os']['release']['major'] ? { /^(2|5|6|2017|2018)$/ => ['systemd.timer'], default => [], } } 'Windows': { $agent_restart_command = undef $unavailable_runmodes = ['cron', 'systemd.timer'] } 'Archlinux': { $agent_restart_command = "/usr/bin/systemctl reload-or-restart ${service_name}" $unavailable_runmodes = ['cron'] } default : { $agent_restart_command = undef $unavailable_runmodes = ['systemd.timer'] } } # Foreman parameters - $lower_fqdn = downcase($::fqdn) + $lower_fqdn = downcase($facts['networking']['fqdn']) $server_foreman = true $server_foreman_facts = true $server_puppet_basedir = $aio_package ? { true => '/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet', false => undef, } $server_foreman_url = "https://${lower_fqdn}" $server_foreman_ssl_ca = undef $server_foreman_ssl_cert = undef $server_foreman_ssl_key = undef # Which Parser do we want to use? https://docs.puppetlabs.com/references/latest/configuration.html#parser $server_parser = 'current' # Timeout for cached environments, changed in puppet 3.7.x $server_environment_timeout = undef # puppet server configuration file - $server_jvm_config = $::osfamily ? { + $server_jvm_config = $facts['os']['family'] ? { 'RedHat' => '/etc/sysconfig/puppetserver', 'Debian' => '/etc/default/puppetserver', default => '/etc/default/puppetserver', } $server_jvm_java_bin = '/usr/bin/java' $server_jvm_extra_args = undef $server_jvm_cli_args = undef # This is some very trivial "tuning". See the puppet reference: # https://docs.puppet.com/puppetserver/latest/tuning_guide.html - if ($::memorysize_mb =~ String) { - $mem_in_mb = scanf($::memorysize_mb, '%i')[0] - } else { - $mem_in_mb = 0 + $::memorysize_mb - } + $mem_in_mb = $facts['memory']['system']['total_bytes'] / 1024 / 1024 if $mem_in_mb >= 3072 { $server_jvm_min_heap_size = '2G' $server_jvm_max_heap_size = '2G' - $server_max_active_instances = min(abs($::processorcount), 4) + $server_max_active_instances = min(abs($facts['processors']['count']), 4) } elsif $mem_in_mb >= 1024 { $server_max_active_instances = 1 $server_jvm_min_heap_size = '1G' $server_jvm_max_heap_size = '1G' } else { # VMs with 1GB RAM and a crash kernel enabled usually have an effective 992MB RAM $server_max_active_instances = 1 $server_jvm_min_heap_size = '768m' $server_jvm_max_heap_size = '768m' } $server_ssl_dir_manage = true $server_ssl_key_manage = true $server_default_manifest = false $server_default_manifest_path = '/etc/puppet/manifests/default_manifest.pp' $server_default_manifest_content = '' # lint:ignore:empty_string_assignment $server_max_requests_per_instance = 0 $server_max_queued_requests = 0 $server_max_retry_delay = 1800 $server_multithreaded = false $server_idle_timeout = 1200000 $server_web_idle_timeout = 30000 $server_connect_timeout = 120000 $server_ca_auth_required = true $server_ca_client_self_delete = false $server_admin_api_whitelist = [ 'localhost', $lower_fqdn ] $server_ca_client_whitelist = [ 'localhost', $lower_fqdn ] $server_cipher_suites = [ 'TLS_DHE_RSA_WITH_AES_128_GCM_SHA256', 'TLS_DHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256', 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', ] $server_ssl_protocols = [ 'TLSv1.2' ] $server_ssl_chain_filepath = "${server_ssl_dir}/ca/ca_crt.pem" $server_check_for_updates = true $server_environment_class_cache_enabled = false $server_allow_header_cert_info = false $server_ca_allow_sans = false $server_ca_allow_auth_extensions = false $server_ca_enable_infra_crl = false $server_max_open_files = undef $server_puppetserver_version = undef # Puppetserver 5.x Which auth.conf shall we use? $server_use_legacy_auth_conf = false # For Puppetserver 5, use JRuby 9k? $server_puppetserver_jruby9k = false # this switch also controls Ruby profiling, by default disabled for Puppetserver 2.x, enabled for 5.x $server_puppetserver_metrics = undef # Puppetserver metrics shipping $server_metrics_jmx_enable = true $server_metrics_graphite_enable = false $server_metrics_graphite_host = '127.0.0.1' $server_metrics_graphite_port = 2003 $server_metrics_server_id = $lower_fqdn $server_metrics_graphite_interval = 5 $server_metrics_allowed = undef # For Puppetserver 5, should the /puppet/experimental route be enabled? $server_puppetserver_experimental = true # Normally agents can only fetch their own catalogs. If you want some nodes to be able to fetch *any* catalog, add them here. $server_puppetserver_trusted_agents = [] } diff --git a/manifests/server.pp b/manifests/server.pp index 0093c4e..95132a8 100644 --- a/manifests/server.pp +++ b/manifests/server.pp @@ -1,516 +1,519 @@ # == Class: puppet::server # # Sets up a puppet master. # # == puppet::server parameters # # $autosign:: If set to a boolean, autosign is enabled or disabled # for all incoming requests. Otherwise this has to be # set to the full file path of an autosign.conf file or # an autosign script. If this is set to a script, make # sure that script considers the content of autosign.conf # as otherwise Foreman functionality might be broken. # # $autosign_entries:: A list of certnames or domain name globs # whose certificate requests will automatically be signed. # Defaults to an empty Array. # # $autosign_mode:: mode of the autosign file/script # # $autosign_content:: If set, write the autosign file content # using the value of this parameter. # Cannot be used at the same time as autosign_entries # For example, could be a string, or # file('another_module/autosign.sh') or # template('another_module/autosign.sh.erb') # # $autosign_source:: If set, use this as the source for the autosign file, # instead of autosign_content. # # $hiera_config:: The hiera configuration file. # # $manage_user:: Whether to manage the puppet user resource # # $user:: Name of the puppetmaster user. # # $group:: Name of the puppetmaster group. # # $dir:: Puppet configuration directory # # $ip:: Bind ip address of the puppetmaster # # $port:: Puppet master port # # $ca:: Provide puppet CA # # $ca_crl_filepath:: Path to ca_crl file # # $ca_crl_sync:: Sync the puppet ca crl to compile masters. Requires compile masters to # be agents of the CA master (MOM) defaults to false # # $crl_enable:: Enable CRL processing, defaults to true when $ca is true else defaults # to false # # $http:: Should the puppet master listen on HTTP as well as HTTPS. # Useful for load balancer or reverse proxy scenarios. # # $http_port:: Puppet master HTTP port; defaults to 8139. # # $reports:: List of report types to include on the puppetmaster # # $external_nodes:: External nodes classifier executable # -# $server_trusted_external_command:: The external trusted facts script to use. +# $trusted_external_command:: The external trusted facts script to use. # (Puppet >= 6.11 only). # # $git_repo:: Use git repository as a source of modules # # $environments_owner:: The owner of the environments directory # # $environments_group:: The group owning the environments directory # # $environments_mode:: Environments directory mode. # # $envs_dir:: Directory that holds puppet environments # # $envs_target:: Indicates that $envs_dir should be # a symbolic link to this target # # $common_modules_path:: Common modules paths # # $git_repo_path:: Git repository path # # $git_repo_mode:: Git repository mode # # $git_repo_group:: Git repository group # # $git_repo_user:: Git repository user # # $git_branch_map:: Git branch to puppet env mapping for the # default post receive hook # # $post_hook_content:: Which template to use for git post hook # # $post_hook_name:: Name of a git hook # # $storeconfigs_backend:: Do you use storeconfigs? (note: not required) # false if you don't, "active_record" for 2.X # style db, "puppetdb" for puppetdb # # $ssl_dir:: SSL directory # # $package:: Custom package name for puppet master # # $version:: Custom package version for puppet master # # $certname:: The name to use when handling certificates. # # $strict_variables:: if set to true, it will throw parse errors # when accessing undeclared variables. # # $additional_settings:: A hash of additional settings. # Example: {trusted_node_data => true, ordering => 'manifest'} # # $puppetdb_host:: PuppetDB host # # $puppetdb_port:: PuppetDB port # # $puppetdb_swf:: PuppetDB soft_write_failure # # $parser:: Sets the parser to use. Valid options are 'current' or 'future'. # Defaults to 'current'. # +# $max_open_files:: Increase the max open files limit for Puppetserver. +# +# # === Advanced server parameters: # # $codedir:: Override the puppet code directory. # # $config_version:: How to determine the configuration version. When # using git_repo, by default a git describe # approach will be installed. # # $server_foreman_facts:: Should foreman receive facts from puppet # # $foreman:: Should foreman integration be installed # # $foreman_url:: Foreman URL # # $foreman_ssl_ca:: SSL CA of the Foreman server # # $foreman_ssl_cert:: Client certificate for authenticating against Foreman server # # $foreman_ssl_key:: Key for authenticating against Foreman server # # $puppet_basedir:: Where is the puppet code base located # # $enc_api:: What version of enc script to deploy. # # $report_api:: What version of report processor to deploy. # # $compile_mode:: Used to control JRuby's "CompileMode", which may improve performance. # # # $request_timeout:: Timeout in node.rb script for fetching # catalog from Foreman (in seconds). # # $environment_timeout:: Timeout for cached compiled catalogs (10s, 5m, ...) # # $jvm_java_bin:: Set the default java to use. # # $jvm_config:: Specify the puppetserver jvm configuration file. # # $jvm_min_heap_size:: Specify the minimum jvm heap space. # # $jvm_max_heap_size:: Specify the maximum jvm heap space. # # $jvm_extra_args:: Additional java options to pass through. # This can be used for Java versions prior to # Java 8 to specify the max perm space to use: # For example: '-XX:MaxPermSize=128m'. # # $jvm_cli_args:: Java options to use when using puppetserver # subcommands (eg puppetserver gem). # # $jruby_gem_home:: Where jruby gems are located for puppetserver # # $allow_any_crl_auth:: Allow any authentication for the CRL. This # is needed on the puppet CA to accept clients # from a the puppet CA proxy. # # $auth_allowed:: An array of authenticated nodes allowed to # access all catalog and node endpoints. # default to ['$1'] # # $default_manifest:: Toggle if default_manifest setting should # be added to the [main] section # # $default_manifest_path:: A string setting the path to the default_manifest # # $default_manifest_content:: A string to set the content of the default_manifest # If set to '' it will not manage the file # # $ssl_dir_manage:: Toggle if ssl_dir should be added to the [master] # configuration section. This is necessary to # disable in case CA is delegated to a separate instance # # $ssl_key_manage:: Toggle if "private_keys/${::puppet::server::certname}.pem" # should be created with default user and group. This is used in # the default Forman setup to reuse the key for TLS communication. # # $puppetserver_vardir:: The path of the puppetserver var dir # # $puppetserver_rundir:: The path of the puppetserver run dir # # $puppetserver_logdir:: The path of the puppetserver log dir # # $puppetserver_dir:: The path of the puppetserver config dir # # $puppetserver_version:: The version of puppetserver installed (or being installed) # Unfortunately, different versions of puppetserver need configuring differently. # By default we attempt to derive the version from the puppet version itself but # can be overriden if you're installing an older version. # # $max_active_instances:: Max number of active jruby instances. Defaults to # processor count # # $max_requests_per_instance:: Max number of requests per jruby instance. Defaults to 0 (disabled) # # $max_queued_requests:: The maximum number of requests that may be queued waiting to borrow a # JRuby from the pool. (Puppetserver 5.x only) # Defaults to 0 (disabled) for Puppetserver >= 5.0 # # $max_retry_delay:: Sets the upper limit for the random sleep set as a Retry-After header on # 503 responses returned when max-queued-requests is enabled. (Puppetserver 5.x only) # Defaults to 1800 for Puppetserver >= 5.0 # # $multithreaded:: Use multithreaded jruby. (Puppetserver >= 6.8 only). Defaults to false. # # $idle_timeout:: How long the server will wait for a response on an existing connection # # $connect_timeout:: How long the server will wait for a response to a connection attempt # # $web_idle_timeout:: Time in ms that Jetty allows a socket to be idle, after processing has completed. # Defaults to the Jetty default of 30s # # $ssl_protocols:: Array of SSL protocols to use. # Defaults to [ 'TLSv1.2' ] # # $ssl_chain_filepath:: Path to certificate chain for puppetserver # Defaults to "${ssl_dir}/ca/ca_crt.pem" # # $cipher_suites:: List of SSL ciphers to use in negotiation # Defaults to [ 'TLS_RSA_WITH_AES_256_CBC_SHA256', 'TLS_RSA_WITH_AES_256_CBC_SHA', # 'TLS_RSA_WITH_AES_128_CBC_SHA256', 'TLS_RSA_WITH_AES_128_CBC_SHA', ] # # $ruby_load_paths:: List of ruby paths # Defaults based on $::puppetversion # # $ca_client_whitelist:: The whitelist of client certificates that # can query the certificate-status endpoint # Defaults to [ '127.0.0.1', '::1', $::ipaddress ] # $custom_trusted_oid_mapping:: A hash of custom trusted oid mappings. # Example: { 1.3.6.1.4.1.34380.1.2.1.1 => { shortname => 'myshortname' } } # # $admin_api_whitelist:: The whitelist of clients that # can query the puppet-admin-api endpoint # Defaults to [ '127.0.0.1', '::1', $::ipaddress ] # # $ca_auth_required:: Whether client certificates are needed to access the puppet-admin api # Defaults to true # # $ca_client_self_delete:: Adds a rule to auth.conf, that allows a client to self delete its own certificate # Defaults to false # # $use_legacy_auth_conf:: Should the puppetserver use the legacy puppet auth.conf? # Defaults to false (the puppetserver will use its own conf.d/auth.conf) # # $check_for_updates:: Should the puppetserver phone home to check for available updates? # # $environment_class_cache_enabled:: Enable environment class cache in conjunction with the use of the # environment_classes API. # # # $allow_header_cert_info:: Allow client authentication over HTTP Headers # Defaults to false, is also activated by the $http setting # # $puppetserver_jruby9k:: For Puppetserver 5, use JRuby 9k? Defaults to false # # $puppetserver_metrics:: Enable metrics (Puppetserver 5.x only) and JRuby profiling? # Defaults to true on Puppetserver 5.x and to false on Puppetserver 2.x # # # $metrics_jmx_enable:: Enable or disable JMX metrics reporter. Defaults to true # # $metrics_graphite_enable:: Enable or disable Graphite metrics reporter. Defaults to false # # $metrics_graphite_host:: Graphite server host. Defaults to "127.0.0.1" # # $metrics_graphite_port:: Graphite server port. Defaults to 2003 # # $metrics_server_id:: A server id that will be used as part of the namespace for metrics produced # Defaults to $fqdn # # $metrics_graphite_interval:: How often to send metrics to graphite (in seconds) # Defaults to 5 # # $metrics_allowed:: Specify metrics to allow in addition to those in the default list # Defaults to undef # # $puppetserver_experimental:: For Puppetserver 5, enable the /puppet/experimental route? Defaults to true # # $puppetserver_trusted_agents:: Certificate names of agents that are allowed to fetch *all* catalogs. Defaults to empty array # # # $ca_allow_sans:: Allow CA to sign certificate requests that have Subject Alternative Names # Defaults to false # # $ca_allow_auth_extensions:: Allow CA to sign certificate requests that have authorization extensions # Defaults to false # # $ca_enable_infra_crl:: Enable the separate CRL for Puppet infrastructure nodes # Defaults to false # # $acceptor_threads:: This sets the number of threads that the webserver will dedicate to accepting # socket connections for unencrypted HTTP traffic. If not provided, the webserver # defaults to the number of virtual cores on the host divided by 8, with a minimum # of 1 and maximum of 4. # # $selector_threads:: This sets the number of selectors that the webserver will dedicate to processing # events on connected sockets for unencrypted HTTPS traffic. If not provided, # the webserver defaults to the minimum of: virtual cores on the host divided by 2 # or max-threads divided by 16, with a minimum of 1. # # $max_threads:: This sets the maximum number of threads assigned to responding to HTTP and/or # HTTPS requests for a single webserver, effectively changing how many # concurrent requests can be made at one time. If not provided, the # webserver defaults to 200. # # $ssl_acceptor_threads:: This sets the number of threads that the webserver will dedicate to accepting # socket connections for encrypted HTTPS traffic. If not provided, defaults to # the number of virtual cores on the host divided by 8, with a minimum of 1 and maximum of 4. # # $ssl_selector_threads:: This sets the number of selectors that the webserver will dedicate to processing # events on connected sockets for encrypted HTTPS traffic. Defaults to the number of # virtual cores on the host divided by 2, with a minimum of 1 and maximum of 4. # The number of selector threads actually used by Jetty is twice the number of selectors # requested. For example, if a value of 3 is specified for the ssl-selector-threads setting, # Jetty will actually use 6 selector threads. # # $versioned_code_id:: The path to an executable script that Puppet Server invokes to generate a code_id # # $versioned_code_content:: Contains the path to an executable script that Puppet Server invokes when an agent makes # a static_file_content API request for the contents of a file resource that # has a source attribute with a puppet:/// URI value. class puppet::server( - Variant[Boolean, Stdlib::Absolutepath] $autosign = $::puppet::autosign, - Array[String] $autosign_entries = $::puppet::autosign_entries, - Pattern[/^[0-9]{3,4}$/] $autosign_mode = $::puppet::autosign_mode, - Optional[String] $autosign_content = $::puppet::autosign_content, - Optional[String] $autosign_source = $::puppet::autosign_source, - String $hiera_config = $::puppet::hiera_config, - Array[String] $admin_api_whitelist = $::puppet::server_admin_api_whitelist, - Boolean $manage_user = $::puppet::server_manage_user, - String $user = $::puppet::server_user, - String $group = $::puppet::server_group, - String $dir = $::puppet::server_dir, - Stdlib::Absolutepath $codedir = $::puppet::codedir, - Integer $port = $::puppet::server_port, - String $ip = $::puppet::server_ip, - Boolean $ca = $::puppet::server_ca, - Optional[String] $ca_crl_filepath = $::puppet::ca_crl_filepath, - Boolean $ca_crl_sync = $::puppet::server_ca_crl_sync, - Optional[Boolean] $crl_enable = $::puppet::server_crl_enable, - Boolean $ca_auth_required = $::puppet::server_ca_auth_required, - Boolean $ca_client_self_delete = $::puppet::server_ca_client_self_delete, - Array[String] $ca_client_whitelist = $::puppet::server_ca_client_whitelist, - Optional[Puppet::Custom_trusted_oid_mapping] $custom_trusted_oid_mapping = $::puppet::server_custom_trusted_oid_mapping, - Boolean $http = $::puppet::server_http, - Integer $http_port = $::puppet::server_http_port, - String $reports = $::puppet::server_reports, - Stdlib::Absolutepath $puppetserver_vardir = $::puppet::server_puppetserver_vardir, - Optional[Stdlib::Absolutepath] $puppetserver_rundir = $::puppet::server_puppetserver_rundir, - Optional[Stdlib::Absolutepath] $puppetserver_logdir = $::puppet::server_puppetserver_logdir, - Stdlib::Absolutepath $puppetserver_dir = $::puppet::server_puppetserver_dir, - Optional[Pattern[/^[\d]\.[\d]+\.[\d]+$/]] $puppetserver_version = $::puppet::server_puppetserver_version, - Variant[Undef, String[0], Stdlib::Absolutepath] $external_nodes = $::puppet::server_external_nodes, - Optional[Stdlib::Absolutepath] $trusted_external_command = $::puppet::server_trusted_external_command, - Array[String] $cipher_suites = $::puppet::server_cipher_suites, - Optional[String] $config_version = $::puppet::server_config_version, - Integer[0] $connect_timeout = $::puppet::server_connect_timeout, + Variant[Boolean, Stdlib::Absolutepath] $autosign = $puppet::autosign, + Array[String] $autosign_entries = $puppet::autosign_entries, + Pattern[/^[0-9]{3,4}$/] $autosign_mode = $puppet::autosign_mode, + Optional[String] $autosign_content = $puppet::autosign_content, + Optional[String] $autosign_source = $puppet::autosign_source, + String $hiera_config = $puppet::hiera_config, + Array[String] $admin_api_whitelist = $puppet::server_admin_api_whitelist, + Boolean $manage_user = $puppet::server_manage_user, + String $user = $puppet::server_user, + String $group = $puppet::server_group, + String $dir = $puppet::server_dir, + Stdlib::Absolutepath $codedir = $puppet::codedir, + Integer $port = $puppet::server_port, + String $ip = $puppet::server_ip, + Boolean $ca = $puppet::server_ca, + Optional[String] $ca_crl_filepath = $puppet::ca_crl_filepath, + Boolean $ca_crl_sync = $puppet::server_ca_crl_sync, + Optional[Boolean] $crl_enable = $puppet::server_crl_enable, + Boolean $ca_auth_required = $puppet::server_ca_auth_required, + Boolean $ca_client_self_delete = $puppet::server_ca_client_self_delete, + Array[String] $ca_client_whitelist = $puppet::server_ca_client_whitelist, + Optional[Puppet::Custom_trusted_oid_mapping] $custom_trusted_oid_mapping = $puppet::server_custom_trusted_oid_mapping, + Boolean $http = $puppet::server_http, + Integer $http_port = $puppet::server_http_port, + String $reports = $puppet::server_reports, + Stdlib::Absolutepath $puppetserver_vardir = $puppet::server_puppetserver_vardir, + Optional[Stdlib::Absolutepath] $puppetserver_rundir = $puppet::server_puppetserver_rundir, + Optional[Stdlib::Absolutepath] $puppetserver_logdir = $puppet::server_puppetserver_logdir, + Stdlib::Absolutepath $puppetserver_dir = $puppet::server_puppetserver_dir, + Optional[Pattern[/^[\d]\.[\d]+\.[\d]+$/]] $puppetserver_version = $puppet::server_puppetserver_version, + Variant[Undef, String[0], Stdlib::Absolutepath] $external_nodes = $puppet::server_external_nodes, + Optional[Stdlib::Absolutepath] $trusted_external_command = $puppet::server_trusted_external_command, + Array[String] $cipher_suites = $puppet::server_cipher_suites, + Optional[String] $config_version = $puppet::server_config_version, + Integer[0] $connect_timeout = $puppet::server_connect_timeout, Integer[0] $web_idle_timeout = $puppet::server_web_idle_timeout, - Boolean $git_repo = $::puppet::server_git_repo, - Boolean $default_manifest = $::puppet::server_default_manifest, - Stdlib::Absolutepath $default_manifest_path = $::puppet::server_default_manifest_path, - String $default_manifest_content = $::puppet::server_default_manifest_content, - String $environments_owner = $::puppet::server_environments_owner, - Optional[String] $environments_group = $::puppet::server_environments_group, - Pattern[/^[0-9]{3,4}$/] $environments_mode = $::puppet::server_environments_mode, - Stdlib::Absolutepath $envs_dir = $::puppet::server_envs_dir, - Optional[Stdlib::Absolutepath] $envs_target = $::puppet::server_envs_target, - Variant[Undef, String[0], Array[Stdlib::Absolutepath]] $common_modules_path = $::puppet::server_common_modules_path, - Pattern[/^[0-9]{3,4}$/] $git_repo_mode = $::puppet::server_git_repo_mode, - Stdlib::Absolutepath $git_repo_path = $::puppet::server_git_repo_path, - String $git_repo_group = $::puppet::server_git_repo_group, - String $git_repo_user = $::puppet::server_git_repo_user, - Hash[String, String] $git_branch_map = $::puppet::server_git_branch_map, - Integer[0] $idle_timeout = $::puppet::server_idle_timeout, - String $post_hook_content = $::puppet::server_post_hook_content, - String $post_hook_name = $::puppet::server_post_hook_name, - Variant[Undef, Boolean, Enum['active_record', 'puppetdb']] $storeconfigs_backend = $::puppet::server_storeconfigs_backend, - Array[Stdlib::Absolutepath] $ruby_load_paths = $::puppet::server_ruby_load_paths, - Stdlib::Absolutepath $ssl_dir = $::puppet::server_ssl_dir, - Boolean $ssl_dir_manage = $::puppet::server_ssl_dir_manage, - Boolean $ssl_key_manage = $::puppet::server_ssl_key_manage, - Array[String] $ssl_protocols = $::puppet::server_ssl_protocols, - Optional[Stdlib::Absolutepath] $ssl_chain_filepath = $::puppet::server_ssl_chain_filepath, - Optional[Variant[String, Array[String]]] $package = $::puppet::server_package, - Optional[String] $version = $::puppet::server_version, - String $certname = $::puppet::server_certname, - Enum['v2'] $enc_api = $::puppet::server_enc_api, - Enum['v2'] $report_api = $::puppet::server_report_api, - Integer[0] $request_timeout = $::puppet::server_request_timeout, - Boolean $strict_variables = $::puppet::server_strict_variables, - Hash[String, Data] $additional_settings = $::puppet::server_additional_settings, - Boolean $foreman = $::puppet::server_foreman, - Stdlib::HTTPUrl $foreman_url = $::puppet::server_foreman_url, - Optional[Stdlib::Absolutepath] $foreman_ssl_ca = $::puppet::server_foreman_ssl_ca, - Optional[Stdlib::Absolutepath] $foreman_ssl_cert = $::puppet::server_foreman_ssl_cert, - Optional[Stdlib::Absolutepath] $foreman_ssl_key = $::puppet::server_foreman_ssl_key, - Boolean $server_foreman_facts = $::puppet::server_foreman_facts, - Optional[Stdlib::Absolutepath] $puppet_basedir = $::puppet::server_puppet_basedir, - Optional[String] $puppetdb_host = $::puppet::server_puppetdb_host, - Integer[0, 65535] $puppetdb_port = $::puppet::server_puppetdb_port, - Boolean $puppetdb_swf = $::puppet::server_puppetdb_swf, - Enum['current', 'future'] $parser = $::puppet::server_parser, - Variant[Undef, Enum['unlimited'], Pattern[/^\d+[smhdy]?$/]] $environment_timeout = $::puppet::server_environment_timeout, - String $jvm_java_bin = $::puppet::server_jvm_java_bin, - String $jvm_config = $::puppet::server_jvm_config, - Pattern[/^[0-9]+[kKmMgG]$/] $jvm_min_heap_size = $::puppet::server_jvm_min_heap_size, - Pattern[/^[0-9]+[kKmMgG]$/] $jvm_max_heap_size = $::puppet::server_jvm_max_heap_size, - Optional[Variant[String,Array[String]]] $jvm_extra_args = $::puppet::server_jvm_extra_args, - Optional[String] $jvm_cli_args = $::puppet::server_jvm_cli_args, - Optional[Stdlib::Absolutepath] $jruby_gem_home = $::puppet::server_jruby_gem_home, - Integer[1] $max_active_instances = $::puppet::server_max_active_instances, - Integer[0] $max_requests_per_instance = $::puppet::server_max_requests_per_instance, + Boolean $git_repo = $puppet::server_git_repo, + Boolean $default_manifest = $puppet::server_default_manifest, + Stdlib::Absolutepath $default_manifest_path = $puppet::server_default_manifest_path, + String $default_manifest_content = $puppet::server_default_manifest_content, + String $environments_owner = $puppet::server_environments_owner, + Optional[String] $environments_group = $puppet::server_environments_group, + Pattern[/^[0-9]{3,4}$/] $environments_mode = $puppet::server_environments_mode, + Stdlib::Absolutepath $envs_dir = $puppet::server_envs_dir, + Optional[Stdlib::Absolutepath] $envs_target = $puppet::server_envs_target, + Variant[Undef, String[0], Array[Stdlib::Absolutepath]] $common_modules_path = $puppet::server_common_modules_path, + Pattern[/^[0-9]{3,4}$/] $git_repo_mode = $puppet::server_git_repo_mode, + Stdlib::Absolutepath $git_repo_path = $puppet::server_git_repo_path, + String $git_repo_group = $puppet::server_git_repo_group, + String $git_repo_user = $puppet::server_git_repo_user, + Hash[String, String] $git_branch_map = $puppet::server_git_branch_map, + Integer[0] $idle_timeout = $puppet::server_idle_timeout, + String $post_hook_content = $puppet::server_post_hook_content, + String $post_hook_name = $puppet::server_post_hook_name, + Variant[Undef, Boolean, Enum['active_record', 'puppetdb']] $storeconfigs_backend = $puppet::server_storeconfigs_backend, + Array[Stdlib::Absolutepath] $ruby_load_paths = $puppet::server_ruby_load_paths, + Stdlib::Absolutepath $ssl_dir = $puppet::server_ssl_dir, + Boolean $ssl_dir_manage = $puppet::server_ssl_dir_manage, + Boolean $ssl_key_manage = $puppet::server_ssl_key_manage, + Array[String] $ssl_protocols = $puppet::server_ssl_protocols, + Optional[Stdlib::Absolutepath] $ssl_chain_filepath = $puppet::server_ssl_chain_filepath, + Optional[Variant[String, Array[String]]] $package = $puppet::server_package, + Optional[String] $version = $puppet::server_version, + String $certname = $puppet::server_certname, + Enum['v2'] $enc_api = $puppet::server_enc_api, + Enum['v2'] $report_api = $puppet::server_report_api, + Integer[0] $request_timeout = $puppet::server_request_timeout, + Boolean $strict_variables = $puppet::server_strict_variables, + Hash[String, Data] $additional_settings = $puppet::server_additional_settings, + Boolean $foreman = $puppet::server_foreman, + Stdlib::HTTPUrl $foreman_url = $puppet::server_foreman_url, + Optional[Stdlib::Absolutepath] $foreman_ssl_ca = $puppet::server_foreman_ssl_ca, + Optional[Stdlib::Absolutepath] $foreman_ssl_cert = $puppet::server_foreman_ssl_cert, + Optional[Stdlib::Absolutepath] $foreman_ssl_key = $puppet::server_foreman_ssl_key, + Boolean $server_foreman_facts = $puppet::server_foreman_facts, + Optional[Stdlib::Absolutepath] $puppet_basedir = $puppet::server_puppet_basedir, + Optional[String] $puppetdb_host = $puppet::server_puppetdb_host, + Integer[0, 65535] $puppetdb_port = $puppet::server_puppetdb_port, + Boolean $puppetdb_swf = $puppet::server_puppetdb_swf, + Enum['current', 'future'] $parser = $puppet::server_parser, + Variant[Undef, Enum['unlimited'], Pattern[/^\d+[smhdy]?$/]] $environment_timeout = $puppet::server_environment_timeout, + String $jvm_java_bin = $puppet::server_jvm_java_bin, + String $jvm_config = $puppet::server_jvm_config, + Pattern[/^[0-9]+[kKmMgG]$/] $jvm_min_heap_size = $puppet::server_jvm_min_heap_size, + Pattern[/^[0-9]+[kKmMgG]$/] $jvm_max_heap_size = $puppet::server_jvm_max_heap_size, + Optional[Variant[String,Array[String]]] $jvm_extra_args = $puppet::server_jvm_extra_args, + Optional[String] $jvm_cli_args = $puppet::server_jvm_cli_args, + Optional[Stdlib::Absolutepath] $jruby_gem_home = $puppet::server_jruby_gem_home, + Integer[1] $max_active_instances = $puppet::server_max_active_instances, + Integer[0] $max_requests_per_instance = $puppet::server_max_requests_per_instance, Integer[0] $max_queued_requests = $puppet::server_max_queued_requests, Integer[0] $max_retry_delay = $puppet::server_max_retry_delay, Boolean $multithreaded = $puppet::server_multithreaded, - Boolean $use_legacy_auth_conf = $::puppet::server_use_legacy_auth_conf, - Boolean $check_for_updates = $::puppet::server_check_for_updates, - Boolean $environment_class_cache_enabled = $::puppet::server_environment_class_cache_enabled, - Boolean $allow_header_cert_info = $::puppet::server_allow_header_cert_info, - Boolean $puppetserver_jruby9k = $::puppet::server_puppetserver_jruby9k, - Optional[Boolean] $puppetserver_metrics = $::puppet::server_puppetserver_metrics, - Boolean $metrics_jmx_enable = $::puppet::server_metrics_jmx_enable, - Boolean $metrics_graphite_enable = $::puppet::server_metrics_graphite_enable, - String $metrics_graphite_host = $::puppet::server_metrics_graphite_host, - Integer $metrics_graphite_port = $::puppet::server_metrics_graphite_port, - String $metrics_server_id = $::puppet::server_metrics_server_id, - Integer $metrics_graphite_interval = $::puppet::server_metrics_graphite_interval, - Variant[Undef, Array] $metrics_allowed = $::puppet::server_metrics_allowed, - Boolean $puppetserver_experimental = $::puppet::server_puppetserver_experimental, - Array[String] $puppetserver_trusted_agents = $::puppet::server_puppetserver_trusted_agents, - Optional[Enum['off', 'jit', 'force']] $compile_mode = $::puppet::server_compile_mode, - Optional[Integer[1]] $selector_threads = $::puppet::server_selector_threads, - Optional[Integer[1]] $acceptor_threads = $::puppet::server_acceptor_threads, - Optional[Integer[1]] $ssl_selector_threads = $::puppet::server_ssl_selector_threads, - Optional[Integer[1]] $ssl_acceptor_threads = $::puppet::server_ssl_acceptor_threads, - Optional[Integer[1]] $max_threads = $::puppet::server_max_threads, - Boolean $ca_allow_sans = $::puppet::server_ca_allow_sans, - Boolean $ca_allow_auth_extensions = $::puppet::server_ca_allow_auth_extensions, - Boolean $ca_enable_infra_crl = $::puppet::server_ca_enable_infra_crl, - Optional[Integer[1]] $max_open_files = $::puppet::server_max_open_files, - Optional[Stdlib::Absolutepath] $versioned_code_id = $::puppet::server_versioned_code_id, - Optional[Stdlib::Absolutepath] $versioned_code_content = $::puppet::server_versioned_code_content, + Boolean $use_legacy_auth_conf = $puppet::server_use_legacy_auth_conf, + Boolean $check_for_updates = $puppet::server_check_for_updates, + Boolean $environment_class_cache_enabled = $puppet::server_environment_class_cache_enabled, + Boolean $allow_header_cert_info = $puppet::server_allow_header_cert_info, + Boolean $puppetserver_jruby9k = $puppet::server_puppetserver_jruby9k, + Optional[Boolean] $puppetserver_metrics = $puppet::server_puppetserver_metrics, + Boolean $metrics_jmx_enable = $puppet::server_metrics_jmx_enable, + Boolean $metrics_graphite_enable = $puppet::server_metrics_graphite_enable, + String $metrics_graphite_host = $puppet::server_metrics_graphite_host, + Integer $metrics_graphite_port = $puppet::server_metrics_graphite_port, + String $metrics_server_id = $puppet::server_metrics_server_id, + Integer $metrics_graphite_interval = $puppet::server_metrics_graphite_interval, + Variant[Undef, Array] $metrics_allowed = $puppet::server_metrics_allowed, + Boolean $puppetserver_experimental = $puppet::server_puppetserver_experimental, + Array[String] $puppetserver_trusted_agents = $puppet::server_puppetserver_trusted_agents, + Optional[Enum['off', 'jit', 'force']] $compile_mode = $puppet::server_compile_mode, + Optional[Integer[1]] $selector_threads = $puppet::server_selector_threads, + Optional[Integer[1]] $acceptor_threads = $puppet::server_acceptor_threads, + Optional[Integer[1]] $ssl_selector_threads = $puppet::server_ssl_selector_threads, + Optional[Integer[1]] $ssl_acceptor_threads = $puppet::server_ssl_acceptor_threads, + Optional[Integer[1]] $max_threads = $puppet::server_max_threads, + Boolean $ca_allow_sans = $puppet::server_ca_allow_sans, + Boolean $ca_allow_auth_extensions = $puppet::server_ca_allow_auth_extensions, + Boolean $ca_enable_infra_crl = $puppet::server_ca_enable_infra_crl, + Optional[Integer[1]] $max_open_files = $puppet::server_max_open_files, + Optional[Stdlib::Absolutepath] $versioned_code_id = $puppet::server_versioned_code_id, + Optional[Stdlib::Absolutepath] $versioned_code_content = $puppet::server_versioned_code_content, ) { if $ca { $ssl_ca_cert = "${ssl_dir}/ca/ca_crt.pem" $ssl_ca_crl = "${ssl_dir}/ca/ca_crl.pem" $ssl_chain = $ssl_chain_filepath $crl_enable_real = pick($crl_enable, true) } else { $ssl_ca_cert = "${ssl_dir}/certs/ca.pem" $ssl_ca_crl = pick($ca_crl_filepath, "${ssl_dir}/crl.pem") $ssl_chain = false $crl_enable_real = pick($crl_enable, false) } $ssl_cert = "${ssl_dir}/certs/${certname}.pem" $ssl_cert_key = "${ssl_dir}/private_keys/${certname}.pem" if $config_version == undef { if $git_repo { $config_version_cmd = "git --git-dir ${envs_dir}/\$environment/.git describe --all --long" } else { $config_version_cmd = undef } } else { $config_version_cmd = $config_version } # For Puppetserver, certain configuration parameters are version specific. We # assume a particular version here. if $puppetserver_version { $real_puppetserver_version = $puppetserver_version } elsif versioncmp($::puppetversion, '6.0.0') >= 0 { $real_puppetserver_version = '6.0.0' } else { $real_puppetserver_version = '5.3.6' } # Prefer the user setting,otherwise disable for Puppetserver 2.x, enabled for 5.x $real_puppetserver_metrics = pick($puppetserver_metrics, true) if $jvm_extra_args { $real_jvm_extra_args = $jvm_extra_args } else { $real_jvm_extra_args = '-Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger' } contain puppet::server::install contain puppet::server::config contain puppet::server::service Class['puppet::server::install'] ~> Class['puppet::server::config'] Class['puppet::config', 'puppet::server::config'] ~> Class['puppet::server::service'] } diff --git a/manifests/server/config.pp b/manifests/server/config.pp index 7d82757..399b6cf 100644 --- a/manifests/server/config.pp +++ b/manifests/server/config.pp @@ -1,321 +1,321 @@ # Set up the puppet server config # @api private class puppet::server::config inherits puppet::config { contain 'puppet::server::puppetserver' - unless empty($::puppet::server::puppetserver_vardir) { + unless empty($puppet::server::puppetserver_vardir) { puppet::config::master { - 'vardir': value => $::puppet::server::puppetserver_vardir; + 'vardir': value => $puppet::server::puppetserver_vardir; } } - unless empty($::puppet::server::puppetserver_rundir) { + unless empty($puppet::server::puppetserver_rundir) { puppet::config::master { - 'rundir': value => $::puppet::server::puppetserver_rundir; + 'rundir': value => $puppet::server::puppetserver_rundir; } } - unless empty($::puppet::server::puppetserver_logdir) { + unless empty($puppet::server::puppetserver_logdir) { puppet::config::master { - 'logdir': value => $::puppet::server::puppetserver_logdir; + 'logdir': value => $puppet::server::puppetserver_logdir; } } # Mirror the relationship, as defined() is parse-order dependent # Ensures puppetmasters certs are generated before the proxy is needed if defined(Class['foreman_proxy::config']) and $foreman_proxy::ssl { Class['puppet::server::config'] ~> Class['foreman_proxy::config'] Class['puppet::server::config'] ~> Class['foreman_proxy::service'] } # And before Foreman's cert-using service needs it if defined(Class['foreman::service']) and $foreman::ssl { Class['puppet::server::config'] -> Class['foreman::service'] } ## General configuration - $ca_server = $::puppet::ca_server - $ca_port = $::puppet::ca_port - $server_storeconfigs_backend = $::puppet::server::storeconfigs_backend - $server_external_nodes = $::puppet::server::external_nodes - $server_environment_timeout = $::puppet::server::environment_timeout - $trusted_external_command = $::puppet::server::trusted_external_command + $ca_server = $puppet::ca_server + $ca_port = $puppet::ca_port + $server_storeconfigs_backend = $puppet::server::storeconfigs_backend + $server_external_nodes = $puppet::server::external_nodes + $server_environment_timeout = $puppet::server::environment_timeout + $trusted_external_command = $puppet::server::trusted_external_command if $server_external_nodes and $server_external_nodes != '' { - class{ '::puppet::server::enc': + class{ 'puppet::server::enc': enc_path => $server_external_nodes, } } if $trusted_external_command { if versioncmp($::puppetversion, '6.11') < 0 { fail('$server_trusted_external_command is only available for Puppet > 6.11') } puppet::config::master { 'trusted_external_command': value => $trusted_external_command, } } - $autosign = ($::puppet::server::autosign =~ Boolean)? { - true => $::puppet::server::autosign, - false => "${::puppet::server::autosign} { mode = ${::puppet::server::autosign_mode} }" + $autosign = ($puppet::server::autosign =~ Boolean)? { + true => $puppet::server::autosign, + false => "${puppet::server::autosign} { mode = ${puppet::server::autosign_mode} }" } puppet::config::main { - 'reports': value => $::puppet::server::reports; + 'reports': value => $puppet::server::reports; 'environmentpath': value => $puppet::server::envs_dir; } - if $::puppet::server::hiera_config and !empty($::puppet::server::hiera_config){ + if $puppet::server::hiera_config and !empty($puppet::server::hiera_config){ puppet::config::main { - 'hiera_config': value => $::puppet::server::hiera_config; + 'hiera_config': value => $puppet::server::hiera_config; } } if $puppet::server::common_modules_path and !empty($puppet::server::common_modules_path) { puppet::config::main { 'basemodulepath': value => $puppet::server::common_modules_path, joiner => ':'; } } if $puppet::server::default_manifest { puppet::config::main { 'default_manifest': value => $puppet::server::default_manifest_path; } } puppet::config::master { 'autosign': value => $autosign; - 'ca': value => $::puppet::server::ca; - 'certname': value => $::puppet::server::certname; - 'parser': value => $::puppet::server::parser; - 'strict_variables': value => $::puppet::server::strict_variables; + 'ca': value => $puppet::server::ca; + 'certname': value => $puppet::server::certname; + 'parser': value => $puppet::server::parser; + 'strict_variables': value => $puppet::server::strict_variables; } - if $::puppet::server::ssl_dir_manage { + if $puppet::server::ssl_dir_manage { puppet::config::master { - 'ssldir': value => $::puppet::server::ssl_dir; + 'ssldir': value => $puppet::server::ssl_dir; } } if $server_environment_timeout { puppet::config::master { 'environment_timeout': value => $server_environment_timeout; } } if $server_storeconfigs_backend { puppet::config::master { 'storeconfigs': value => true; 'storeconfigs_backend': value => $server_storeconfigs_backend; } } - $::puppet::server_additional_settings.each |$key,$value| { + $puppet::server_additional_settings.each |$key,$value| { puppet::config::master { $key: value => $value } } file { "${puppet::vardir}/reports": ensure => directory, - owner => $::puppet::server::user, - group => $::puppet::server::group, + owner => $puppet::server::user, + group => $puppet::server::group, mode => '0750', } if '/usr/share/puppet/modules' in $puppet::server::common_modules_path { # Create Foreman share dir which does not depend on Puppet version exec { 'mkdir -p /usr/share/puppet/modules': creates => '/usr/share/puppet/modules', path => ['/usr/bin', '/bin'], } } ## SSL and CA configuration # Open read permissions to private keys to puppet group for foreman, proxy etc. - file { "${::puppet::server::ssl_dir}/private_keys": + file { "${puppet::server::ssl_dir}/private_keys": ensure => directory, - owner => $::puppet::server::user, - group => $::puppet::server::group, + owner => $puppet::server::user, + group => $puppet::server::group, mode => '0750', require => Exec['puppet_server_config-create_ssl_dir'], } if $puppet::server::ssl_key_manage { - file { "${::puppet::server::ssl_dir}/private_keys/${::puppet::server::certname}.pem": - owner => $::puppet::server::user, - group => $::puppet::server::group, + file { "${puppet::server::ssl_dir}/private_keys/${puppet::server::certname}.pem": + owner => $puppet::server::user, + group => $puppet::server::group, mode => '0640', } } if $puppet::server::custom_trusted_oid_mapping { $_custom_trusted_oid_mapping = { oid_mapping => $puppet::server::custom_trusted_oid_mapping, } - file { "${::puppet::dir}/custom_trusted_oid_mapping.yaml": + file { "${puppet::dir}/custom_trusted_oid_mapping.yaml": ensure => file, owner => 'root', - group => $::puppet::params::root_group, + group => $puppet::params::root_group, mode => '0644', content => to_yaml($_custom_trusted_oid_mapping), } } # If the ssl dir is not the default dir, it needs to be created before running # the generate ca cert or it will fail. exec {'puppet_server_config-create_ssl_dir': - creates => $::puppet::server::ssl_dir, - command => "/bin/mkdir -p ${::puppet::server::ssl_dir}", + creates => $puppet::server::ssl_dir, + command => "/bin/mkdir -p ${puppet::server::ssl_dir}", umask => '0022', } # Generate a new CA and host cert if our host cert doesn't exist - if $::puppet::server::ca { + if $puppet::server::ca { if versioncmp($::puppetversion, '6.0') > 0 { - $command = "${::puppet::puppetserver_cmd} ca setup" + $command = "${puppet::puppetserver_cmd} ca setup" } else { - $command = "${::puppet::puppet_cmd} cert --generate ${::puppet::server::certname} --allow-dns-alt-names" + $command = "${puppet::puppet_cmd} cert --generate ${puppet::server::certname} --allow-dns-alt-names" } exec {'puppet_server_config-generate_ca_cert': - creates => $::puppet::server::ssl_cert, + creates => $puppet::server::ssl_cert, command => $command, umask => '0022', require => [ - Concat["${::puppet::server::dir}/puppet.conf"], + Concat["${puppet::server::dir}/puppet.conf"], Exec['puppet_server_config-create_ssl_dir'], ], } - } elsif $::puppet::server::ca_crl_sync { + } elsif $puppet::server::ca_crl_sync { # If not a ca AND sync the crl from the ca master if defined('$::servername') { - file { $::puppet::server::ssl_ca_crl: + file { $puppet::server::ssl_ca_crl: ensure => file, - owner => $::puppet::server::user, - group => $::puppet::server::group, + owner => $puppet::server::user, + group => $puppet::server::group, mode => '0644', content => file($::settings::cacrl, $::settings::hostcrl, '/dev/null'), } } } # autosign file - if $::puppet::server_ca and !($puppet::server::autosign =~ Boolean) { - if $::puppet::server::autosign_content or $::puppet::server::autosign_source { - if !empty($::puppet::server::autosign_entries) { + if $puppet::server_ca and !($puppet::server::autosign =~ Boolean) { + if $puppet::server::autosign_content or $puppet::server::autosign_source { + if !empty($puppet::server::autosign_entries) { fail('Cannot set both autosign_content/autosign_source and autosign_entries') } - $autosign_content = $::puppet::server::autosign_content - } elsif !empty($::puppet::server::autosign_entries) { + $autosign_content = $puppet::server::autosign_content + } elsif !empty($puppet::server::autosign_entries) { $autosign_content = template('puppet/server/autosign.conf.erb') } else { $autosign_content = undef } - file { $::puppet::server::autosign: + file { $puppet::server::autosign: ensure => file, - owner => $::puppet::server::user, - group => $::puppet::server::group, - mode => $::puppet::server::autosign_mode, + owner => $puppet::server::user, + group => $puppet::server::group, + mode => $puppet::server::autosign_mode, content => $autosign_content, - source => $::puppet::server::autosign_source, + source => $puppet::server::autosign_source, } } # only manage this file if we provide content - if $::puppet::server::default_manifest and $::puppet::server::default_manifest_content != '' { - file { $::puppet::server::default_manifest_path: + if $puppet::server::default_manifest and $puppet::server::default_manifest_content != '' { + file { $puppet::server::default_manifest_path: ensure => file, owner => $puppet::user, group => $puppet::group, mode => '0644', - content => $::puppet::server::default_manifest_content, + content => $puppet::server::default_manifest_content, } } ## Environments # location where our puppet environments are located - if $::puppet::server::envs_target and $::puppet::server::envs_target != '' { + if $puppet::server::envs_target and $puppet::server::envs_target != '' { $ensure = 'link' } else { $ensure = 'directory' } - file { $::puppet::server::envs_dir: + file { $puppet::server::envs_dir: ensure => $ensure, - owner => $::puppet::server::environments_owner, - group => $::puppet::server::environments_group, - mode => $::puppet::server::environments_mode, - target => $::puppet::server::envs_target, + owner => $puppet::server::environments_owner, + group => $puppet::server::environments_group, + mode => $puppet::server::environments_mode, + target => $puppet::server::envs_target, force => true, } - if $::puppet::server::git_repo { - include ::git + if $puppet::server::git_repo { + include git - if $::puppet::server::manage_user { - Class['git'] -> User[$::puppet::server::user] + if $puppet::server::manage_user { + Class['git'] -> User[$puppet::server::user] } - file { $::puppet::vardir: + file { $puppet::vardir: ensure => directory, owner => 'root', group => 'root', } git::repo { 'puppet_repo': bare => true, - target => $::puppet::server::git_repo_path, - mode => $::puppet::server::git_repo_mode, - user => $::puppet::server::git_repo_user, - group => $::puppet::server::git_repo_group, - require => File[$::puppet::vardir, $::puppet::server::envs_dir], + target => $puppet::server::git_repo_path, + mode => $puppet::server::git_repo_mode, + user => $puppet::server::git_repo_user, + group => $puppet::server::git_repo_group, + require => File[$puppet::vardir, $puppet::server::envs_dir], } - $git_branch_map = $::puppet::server::git_branch_map + $git_branch_map = $puppet::server::git_branch_map # git post hook to auto generate an environment per branch - file { "${::puppet::server::git_repo_path}/hooks/${::puppet::server::post_hook_name}": - content => template($::puppet::server::post_hook_content), - owner => $::puppet::server::git_repo_user, - group => $::puppet::server::git_repo_group, - mode => $::puppet::server::git_repo_mode, + file { "${puppet::server::git_repo_path}/hooks/${puppet::server::post_hook_name}": + content => template($puppet::server::post_hook_content), + owner => $puppet::server::git_repo_user, + group => $puppet::server::git_repo_group, + mode => $puppet::server::git_repo_mode, require => Git::Repo['puppet_repo'], } } file { $puppet::sharedir: ensure => directory, } - if $::puppet::server::common_modules_path and !empty($::puppet::server::common_modules_path) { - file { $::puppet::server::common_modules_path: + if $puppet::server::common_modules_path and !empty($puppet::server::common_modules_path) { + file { $puppet::server::common_modules_path: ensure => directory, - owner => $::puppet::server_environments_owner, - group => $::puppet::server_environments_group, - mode => $::puppet::server_environments_mode, + owner => $puppet::server_environments_owner, + group => $puppet::server_environments_group, + mode => $puppet::server_environments_mode, } } ## Foreman - if $::puppet::server::foreman { + if $puppet::server::foreman { # Include foreman components for the puppetmaster # ENC script, reporting script etc. class { 'foreman::puppetmaster': - foreman_url => $::puppet::server::foreman_url, - receive_facts => $::puppet::server::server_foreman_facts, - puppet_home => $::puppet::server::puppetserver_vardir, - puppet_basedir => $::puppet::server::puppet_basedir, + foreman_url => $puppet::server::foreman_url, + receive_facts => $puppet::server::server_foreman_facts, + puppet_home => $puppet::server::puppetserver_vardir, + puppet_basedir => $puppet::server::puppet_basedir, puppet_etcdir => $puppet::dir, - enc_api => $::puppet::server::enc_api, - report_api => $::puppet::server::report_api, - timeout => $::puppet::server::request_timeout, - ssl_ca => pick($::puppet::server::foreman_ssl_ca, $::puppet::server::ssl_ca_cert), - ssl_cert => pick($::puppet::server::foreman_ssl_cert, $::puppet::server::ssl_cert), - ssl_key => pick($::puppet::server::foreman_ssl_key, $::puppet::server::ssl_cert_key), + enc_api => $puppet::server::enc_api, + report_api => $puppet::server::report_api, + timeout => $puppet::server::request_timeout, + ssl_ca => pick($puppet::server::foreman_ssl_ca, $puppet::server::ssl_ca_cert), + ssl_cert => pick($puppet::server::foreman_ssl_cert, $puppet::server::ssl_cert), + ssl_key => pick($puppet::server::foreman_ssl_key, $puppet::server::ssl_cert_key), } contain foreman::puppetmaster } ## PuppetDB - if $::puppet::server::puppetdb_host { - class { '::puppetdb::master::config': - puppetdb_server => $::puppet::server::puppetdb_host, - puppetdb_port => $::puppet::server::puppetdb_port, - puppetdb_soft_write_failure => $::puppet::server::puppetdb_swf, + if $puppet::server::puppetdb_host { + class { 'puppetdb::master::config': + puppetdb_server => $puppet::server::puppetdb_host, + puppetdb_port => $puppet::server::puppetdb_port, + puppetdb_soft_write_failure => $puppet::server::puppetdb_swf, manage_storeconfigs => false, restart_puppet => false, } Class['puppetdb::master::puppetdb_conf'] ~> Class['puppet::server::service'] } } diff --git a/manifests/server/enc.pp b/manifests/server/enc.pp index 872f0bb..8991848 100644 --- a/manifests/server/enc.pp +++ b/manifests/server/enc.pp @@ -1,10 +1,10 @@ # Set up the ENC config # @api private class puppet::server::enc( - $enc_path = $::puppet::server::external_nodes + $enc_path = $puppet::server::external_nodes ) { puppet::config::master { 'external_nodes': value => $enc_path; 'node_terminus': value => 'exec'; } } diff --git a/manifests/server/install.pp b/manifests/server/install.pp index 18e3222..d82a68a 100644 --- a/manifests/server/install.pp +++ b/manifests/server/install.pp @@ -1,40 +1,40 @@ # Install the puppet server # @api private class puppet::server::install { # Mirror the relationship, as defined() is parse-order dependent # Ensures 'puppet' user group is present before managing users if defined(Class['foreman_proxy::config']) { Class['puppet::server::install'] -> Class['foreman_proxy::config'] } if defined(Class['foreman::config']) { Class['puppet::server::install'] -> Class['foreman::config'] } - if $::puppet::server::manage_user { - $shell = $::puppet::server::git_repo ? { - true => $::osfamily ? { + if $puppet::server::manage_user { + $shell = $puppet::server::git_repo ? { + true => $facts['os']['family'] ? { /^(FreeBSD|DragonFly)$/ => '/usr/local/bin/git-shell', default => '/usr/bin/git-shell' }, default => undef, } - user { $::puppet::server::user: + user { $puppet::server::user: shell => $shell, } } - if $::puppet::manage_packages == true or $::puppet::manage_packages == 'server' { - $server_package = pick($::puppet::server::package, 'puppetserver') - $server_version = pick($::puppet::server::version, $::puppet::version) + if $puppet::manage_packages == true or $puppet::manage_packages == 'server' { + $server_package = pick($puppet::server::package, 'puppetserver') + $server_version = pick($puppet::server::version, $puppet::version) package { $server_package: ensure => $server_version, } - if $::puppet::server::manage_user { - Package[$server_package] -> User[$::puppet::server::user] + if $puppet::server::manage_user { + Package[$server_package] -> User[$puppet::server::user] } } } diff --git a/manifests/server/puppetserver.pp b/manifests/server/puppetserver.pp index be74638..f92138c 100644 --- a/manifests/server/puppetserver.pp +++ b/manifests/server/puppetserver.pp @@ -1,271 +1,271 @@ # Configures the puppetserver jvm configuration file using augeas. # # @api private # # @param java_bin # Path to the java executable to use # # @param config # Path to the jvm configuration file. # This file is usually either /etc/default/puppetserver or # /etc/sysconfig/puppetserver depending on your *nix flavor. # # @param jvm_min_heap_size # Translates into the -Xms option and is added to the JAVA_ARGS # # @param jvm_max_heap_size # Translates into the -Xmx option and is added to the JAVA_ARGS # # @param jvm_extra_args # Custom options to pass through to the java binary. These get added to # the end of the JAVA_ARGS variable # # @param jvm_cli_args # Custom options to pass through to the java binary when using a # puppetserver subcommand, (eg puppetserver gem). These get used # in the JAVA_ARGS_CLI variable. # # @param server_puppetserver_dir # Puppetserver config directory # # @param server_puppetserver_vardir # Puppetserver var directory # # @param server_jruby_gem_home # Puppetserver jruby gemhome # # @param server_cipher_suites # Puppetserver array of acceptable ciphers # # @param server_ssl_protocols # Puppetserver array of acceptable ssl protocols # # @param server_max_active_instances # Puppetserver number of max jruby instances # # @param server_max_requests_per_instance # Puppetserver number of max requests per jruby instance # # @param server_max_queued_requests # The maximum number of requests that may be queued waiting # to borrow a JRuby from the pool. # # @param server_max_retry_delay # Sets the upper limit for the random sleep set as a Retry-After # header on 503 responses returned when max-queued-requests is enabled. # # @param server_multithreaded # Configures the puppetserver to use multithreaded jruby. # # @example # # # configure memory for java < 8 # class {'::puppet::server::puppetserver': # jvm_min_heap_size => '1G', # jvm_max_heap_size => '3G', # jvm_extra_args => '-XX:MaxPermSize=256m', # } # class puppet::server::puppetserver ( - $config = $::puppet::server::jvm_config, - $java_bin = $::puppet::server::jvm_java_bin, - $jvm_extra_args = $::puppet::server::real_jvm_extra_args, - $jvm_cli_args = $::puppet::server::jvm_cli_args, - $jvm_min_heap_size = $::puppet::server::jvm_min_heap_size, - $jvm_max_heap_size = $::puppet::server::jvm_max_heap_size, - $server_puppetserver_dir = $::puppet::server::puppetserver_dir, - $server_puppetserver_vardir = $::puppet::server::puppetserver_vardir, - $server_puppetserver_rundir = $::puppet::server::puppetserver_rundir, - $server_puppetserver_logdir = $::puppet::server::puppetserver_logdir, - $server_jruby_gem_home = $::puppet::server::jruby_gem_home, - $server_ruby_load_paths = $::puppet::server::ruby_load_paths, - $server_cipher_suites = $::puppet::server::cipher_suites, - $server_max_active_instances = $::puppet::server::max_active_instances, - $server_max_requests_per_instance = $::puppet::server::max_requests_per_instance, - $server_max_queued_requests = $::puppet::server::max_queued_requests, - $server_max_retry_delay = $::puppet::server::max_retry_delay, - $server_multithreaded = $::puppet::server::multithreaded, - $server_ssl_protocols = $::puppet::server::ssl_protocols, - $server_ssl_ca_crl = $::puppet::server::ssl_ca_crl, - $server_ssl_ca_cert = $::puppet::server::ssl_ca_cert, - $server_ssl_cert = $::puppet::server::ssl_cert, - $server_ssl_cert_key = $::puppet::server::ssl_cert_key, - $server_ssl_chain = $::puppet::server::ssl_chain, - $server_crl_enable = $::puppet::server::crl_enable_real, - $server_ip = $::puppet::server::ip, - $server_port = $::puppet::server::port, - $server_http = $::puppet::server::http, - $server_http_port = $::puppet::server::http_port, - $server_ca = $::puppet::server::ca, - $server_dir = $::puppet::server::dir, - $codedir = $::puppet::server::codedir, - $server_idle_timeout = $::puppet::server::idle_timeout, - $server_web_idle_timeout = $::puppet::server::web_idle_timeout, - $server_connect_timeout = $::puppet::server::connect_timeout, - $server_ca_auth_required = $::puppet::server::ca_auth_required, - $server_ca_client_self_delete = $::puppet::server::ca_client_self_delete, - $server_ca_client_whitelist = $::puppet::server::ca_client_whitelist, - $server_admin_api_whitelist = $::puppet::server::admin_api_whitelist, - $server_puppetserver_version = $::puppet::server::real_puppetserver_version, - $server_use_legacy_auth_conf = $::puppet::server::use_legacy_auth_conf, - $server_check_for_updates = $::puppet::server::check_for_updates, - $server_environment_class_cache_enabled = $::puppet::server::environment_class_cache_enabled, - $server_jruby9k = $::puppet::server::puppetserver_jruby9k, - $server_metrics = $::puppet::server::real_puppetserver_metrics, - $metrics_jmx_enable = $::puppet::server::metrics_jmx_enable, - $metrics_graphite_enable = $::puppet::server::metrics_graphite_enable, - $metrics_graphite_host = $::puppet::server::metrics_graphite_host, - $metrics_graphite_port = $::puppet::server::metrics_graphite_port, - $metrics_server_id = $::puppet::server::metrics_server_id, - $metrics_graphite_interval = $::puppet::server::metrics_graphite_interval, - $metrics_allowed = $::puppet::server::metrics_allowed, - $server_experimental = $::puppet::server::puppetserver_experimental, - $server_trusted_agents = $::puppet::server::puppetserver_trusted_agents, - $allow_header_cert_info = $::puppet::server::allow_header_cert_info, - $compile_mode = $::puppet::server::compile_mode, - $acceptor_threads = $::puppet::server::acceptor_threads, - $selector_threads = $::puppet::server::selector_threads, - $ssl_acceptor_threads = $::puppet::server::ssl_acceptor_threads, - $ssl_selector_threads = $::puppet::server::ssl_selector_threads, - $max_threads = $::puppet::server::max_threads, - $ca_allow_sans = $::puppet::server::ca_allow_sans, - $ca_allow_auth_extensions = $::puppet::server::ca_allow_auth_extensions, - $ca_enable_infra_crl = $::puppet::server::ca_enable_infra_crl, - $max_open_files = $::puppet::server::max_open_files, - $versioned_code_id = $::puppet::server::versioned_code_id, - $versioned_code_content = $::puppet::server::versioned_code_content, + $config = $puppet::server::jvm_config, + $java_bin = $puppet::server::jvm_java_bin, + $jvm_extra_args = $puppet::server::real_jvm_extra_args, + $jvm_cli_args = $puppet::server::jvm_cli_args, + $jvm_min_heap_size = $puppet::server::jvm_min_heap_size, + $jvm_max_heap_size = $puppet::server::jvm_max_heap_size, + $server_puppetserver_dir = $puppet::server::puppetserver_dir, + $server_puppetserver_vardir = $puppet::server::puppetserver_vardir, + $server_puppetserver_rundir = $puppet::server::puppetserver_rundir, + $server_puppetserver_logdir = $puppet::server::puppetserver_logdir, + $server_jruby_gem_home = $puppet::server::jruby_gem_home, + $server_ruby_load_paths = $puppet::server::ruby_load_paths, + $server_cipher_suites = $puppet::server::cipher_suites, + $server_max_active_instances = $puppet::server::max_active_instances, + $server_max_requests_per_instance = $puppet::server::max_requests_per_instance, + $server_max_queued_requests = $puppet::server::max_queued_requests, + $server_max_retry_delay = $puppet::server::max_retry_delay, + $server_multithreaded = $puppet::server::multithreaded, + $server_ssl_protocols = $puppet::server::ssl_protocols, + $server_ssl_ca_crl = $puppet::server::ssl_ca_crl, + $server_ssl_ca_cert = $puppet::server::ssl_ca_cert, + $server_ssl_cert = $puppet::server::ssl_cert, + $server_ssl_cert_key = $puppet::server::ssl_cert_key, + $server_ssl_chain = $puppet::server::ssl_chain, + $server_crl_enable = $puppet::server::crl_enable_real, + $server_ip = $puppet::server::ip, + $server_port = $puppet::server::port, + $server_http = $puppet::server::http, + $server_http_port = $puppet::server::http_port, + $server_ca = $puppet::server::ca, + $server_dir = $puppet::server::dir, + $codedir = $puppet::server::codedir, + $server_idle_timeout = $puppet::server::idle_timeout, + $server_web_idle_timeout = $puppet::server::web_idle_timeout, + $server_connect_timeout = $puppet::server::connect_timeout, + $server_ca_auth_required = $puppet::server::ca_auth_required, + $server_ca_client_self_delete = $puppet::server::ca_client_self_delete, + $server_ca_client_whitelist = $puppet::server::ca_client_whitelist, + $server_admin_api_whitelist = $puppet::server::admin_api_whitelist, + $server_puppetserver_version = $puppet::server::real_puppetserver_version, + $server_use_legacy_auth_conf = $puppet::server::use_legacy_auth_conf, + $server_check_for_updates = $puppet::server::check_for_updates, + $server_environment_class_cache_enabled = $puppet::server::environment_class_cache_enabled, + $server_jruby9k = $puppet::server::puppetserver_jruby9k, + $server_metrics = $puppet::server::real_puppetserver_metrics, + $metrics_jmx_enable = $puppet::server::metrics_jmx_enable, + $metrics_graphite_enable = $puppet::server::metrics_graphite_enable, + $metrics_graphite_host = $puppet::server::metrics_graphite_host, + $metrics_graphite_port = $puppet::server::metrics_graphite_port, + $metrics_server_id = $puppet::server::metrics_server_id, + $metrics_graphite_interval = $puppet::server::metrics_graphite_interval, + $metrics_allowed = $puppet::server::metrics_allowed, + $server_experimental = $puppet::server::puppetserver_experimental, + $server_trusted_agents = $puppet::server::puppetserver_trusted_agents, + $allow_header_cert_info = $puppet::server::allow_header_cert_info, + $compile_mode = $puppet::server::compile_mode, + $acceptor_threads = $puppet::server::acceptor_threads, + $selector_threads = $puppet::server::selector_threads, + $ssl_acceptor_threads = $puppet::server::ssl_acceptor_threads, + $ssl_selector_threads = $puppet::server::ssl_selector_threads, + $max_threads = $puppet::server::max_threads, + $ca_allow_sans = $puppet::server::ca_allow_sans, + $ca_allow_auth_extensions = $puppet::server::ca_allow_auth_extensions, + $ca_enable_infra_crl = $puppet::server::ca_enable_infra_crl, + $max_open_files = $puppet::server::max_open_files, + $versioned_code_id = $puppet::server::versioned_code_id, + $versioned_code_content = $puppet::server::versioned_code_content, ) { - include ::puppet::server + include puppet::server if versioncmp($server_puppetserver_version, '5.3.6') < 0 { fail('puppetserver <5.3.6 is not supported by this module version') } - $puppetserver_package = pick($::puppet::server::package, 'puppetserver') + $puppetserver_package = pick($puppet::server::package, 'puppetserver') $jvm_cmd_arr = ["-Xms${jvm_min_heap_size}", "-Xmx${jvm_max_heap_size}", $jvm_extra_args] $jvm_cmd = strip(join(flatten($jvm_cmd_arr), ' ')) - if $::osfamily == 'FreeBSD' { + if $facts['os']['family'] == 'FreeBSD' { $server_gem_paths = [ '${jruby-puppet.gem-home}', "\"${server_puppetserver_vardir}/vendored-jruby-gems\"", ] # lint:ignore:single_quote_string_with_variables augeas { 'puppet::server::puppetserver::jvm': context => '/files/etc/rc.conf', changes => [ "set puppetserver_java_opts '\"${jvm_cmd}\"'" ], } } else { if $jvm_cli_args { $changes = [ "set JAVA_ARGS '\"${jvm_cmd}\"'", "set JAVA_BIN ${java_bin}", "set JAVA_ARGS_CLI '\"${jvm_cli_args}\"'", ] } else { $changes = [ "set JAVA_ARGS '\"${jvm_cmd}\"'", "set JAVA_BIN ${java_bin}", ] } augeas { 'puppet::server::puppetserver::jvm': lens => 'Shellvars.lns', incl => $config, context => "/files${config}", changes => $changes, } $bootstrap_paths = "${server_puppetserver_dir}/services.d/,/opt/puppetlabs/server/apps/puppetserver/config/services.d/" $server_gem_paths = [ '${jruby-puppet.gem-home}', "\"${server_puppetserver_vardir}/vendored-jruby-gems\"", "\"/opt/puppetlabs/puppet/lib/ruby/vendor_gems\""] # lint:ignore:single_quote_string_with_variables augeas { 'puppet::server::puppetserver::bootstrap': lens => 'Shellvars.lns', incl => $config, context => "/files${config}", changes => "set BOOTSTRAP_CONFIG '\"${bootstrap_paths}\"'", } $jruby_jar_changes = $server_jruby9k ? { true => "set JRUBY_JAR '\"/opt/puppetlabs/server/apps/puppetserver/jruby-9k.jar\"'", default => 'rm JRUBY_JAR' } augeas { 'puppet::server::puppetserver::jruby_jar': lens => 'Shellvars.lns', incl => $config, context => "/files${config}", changes => $jruby_jar_changes, } $ensure_max_open_files = $max_open_files ? { undef => 'absent', default => 'present', } if $facts['service_provider'] == 'systemd' { systemd::dropin_file { 'puppetserver.service-limits.conf': ensure => $ensure_max_open_files, filename => 'limits.conf', unit => 'puppetserver.service', content => "[Service]\nLimitNOFILE=${max_open_files}\n", } } else { file_line { 'puppet::server::puppetserver::max_open_files': ensure => $ensure_max_open_files, path => $config, line => "ulimit -n ${max_open_files}", match => '^ulimit\ -n', } } } $servicesd = "${server_puppetserver_dir}/services.d" file { $servicesd: ensure => directory, } file { "${servicesd}/ca.cfg": ensure => file, content => template('puppet/server/puppetserver/services.d/ca.cfg.erb'), } - unless $::osfamily == 'FreeBSD' { + unless $facts['os']['family'] == 'FreeBSD' { file { '/opt/puppetlabs/server/apps/puppetserver/config': ensure => directory, } file { '/opt/puppetlabs/server/apps/puppetserver/config/services.d': ensure => directory, } } file { "${server_puppetserver_dir}/conf.d/ca.conf": ensure => file, content => template('puppet/server/puppetserver/conf.d/ca.conf.erb'), } file { "${server_puppetserver_dir}/conf.d/puppetserver.conf": ensure => file, content => template('puppet/server/puppetserver/conf.d/puppetserver.conf.erb'), } file { "${server_puppetserver_dir}/conf.d/auth.conf": ensure => file, content => template('puppet/server/puppetserver/conf.d/auth.conf.erb'), } file { "${server_puppetserver_dir}/conf.d/webserver.conf": ensure => file, content => template('puppet/server/puppetserver/conf.d/webserver.conf.erb'), } file { "${server_puppetserver_dir}/conf.d/product.conf": ensure => file, content => template('puppet/server/puppetserver/conf.d/product.conf.erb'), } $metrics_conf_ensure = $server_metrics ? { true => file, default => absent } file { "${server_puppetserver_dir}/conf.d/metrics.conf": ensure => $metrics_conf_ensure, content => template('puppet/server/puppetserver/conf.d/metrics.conf.erb'), } }