My two ¢'s » puppet

puppetmasterd and passenger

daniel — Thu, 18 Mar 2010 17:30:16 +0000

It seems like some people have trouble configuring/undestanding how to combine puppetmasterd and Passenger (aka mod_rails). Let’s get it on:

Install depencies

You need the following components on your puppetmaster server:

Phusion Passenger (http://modrails.com/)
Rack (http://rubyforge.org/projects/rack)

Configure puppetmaster

Your puppet package should contain a config.ru. I found mine in /usr/share/doc/puppet-0.25.4-r1/ext/rack/files/config.ru.bz2 (Gentoo).

mkdir /etc/puppet/rack
mkdir /etc/puppet/rack/public
cp [YOUR_CONFIG.RU] /etc/puppet/rack
chown puppet:root /etc/puppet/rack/config.ru

The final chown line is important! This way rack determines under which user to run the puppetmaster processes.

Add the following lines to your puppet.conf:

[puppetmasterd]
...
ssl_client_header = SSL_CLIENT_S_DN
ssl_client_verify_header = SSL_CLIENT_VERIFY

Apache config

You can keep your passenger config as is and modify it when required. Here’s a example vhost config:

Listen 8140
 
<VirtualHost *:8140>
    ServerName puppet
    DocumentRoot /etc/puppet/rack/public/
 
    CustomLog "|/usr/sbin/rotatelogs /var/www/puppet/logs/access_log.%Y%m%d-%H%M 86400" common
    ErrorLog  "|/usr/sbin/rotatelogs /var/www/puppet/logs/error_log.%Y%m%d-%H%M 86400"
 
    PassengerHighPerformance on
    PassengerMaxPoolSize 15
    PassengerPoolIdleTime 300
    PassengerUseGlobalQueue on
    PassengerStatThrottleRate 120
    RackAutoDetect Off
    RailsAutoDetect Off
 
    RackBaseURI /
 
    SSLEngine on
    SSLProtocol -ALL +SSLv3 +TLSv1
    SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
    SSLCertificateFile /var/lib/puppet/ssl/certs/XXXXXXXXXXXX.pem
    SSLCertificateKeyFile /var/lib/puppet/ssl/private_keys/XXXXXXXXXXXX.pem
    SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
    SSLCACertificateFile /var/lib/puppet/ssl/ca/ca_crt.pem
    SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem
    SSLVerifyClient optional
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars
 
    <Directory "/etc/puppet/rack/public/">
        Options None
        AllowOverride None
 
        Order allow,deny
        Allow from all
    Directory>
Virtualhost>

Restart apache and when clients connect are are triggered via puppetrun you may see something like this with passenger-status:

passenger-status
----------- General information -----------
max      = 20
count    = 9
active   = 0
inactive = 9
Waiting on global queue: 0
 
----------- Domains -----------
/etc/puppet/rack:
  PID: 19160   Sessions: 0    Processed: 39      Uptime: 20s
  PID: 19202   Sessions: 0    Processed: 70      Uptime: 17s
  PID: 18934   Sessions: 0    Processed: 95      Uptime: 45s
  PID: 18977   Sessions: 0    Processed: 66      Uptime: 42s
  PID: 19008   Sessions: 0    Processed: 63      Uptime: 40s
  PID: 19184   Sessions: 0    Processed: 2       Uptime: 19s
  PID: 19103   Sessions: 0    Processed: 8       Uptime: 28s
 
/var/www/puppet-dashboard/htdocs:
  PID: 19158   Sessions: 0    Processed: 6       Uptime: 22s
  PID: 19236   Sessions: 0    Processed: 3       Uptime: 10s

Also refer to the offical puppet documentation on passenger here.

That’s it.

Puppet addons

daniel — Wed, 27 Jan 2010 21:26:57 +0000

I have made some extension for Facter to match my requirements. Most of these extensions are only useful for Gentoo installations. Please leave a comment if you like the addons.

gcc_profile.rb

Facter plugin to get the currently active GCC profile on Gentoo installations. It may work on other distributions too.

Facter.add(:gcc_profile) do
    confine :operatingsystem => :Gentoo
    setcode do
        profile = nil
        output = %x{/usr/bin/gcc-config -c}
        profile = output.chop!
        profile
    end
end

system_profile.rb

Facter plugin to get the currently active Gentoo system profile. Plugin uses eselect so you need to have it installed.

Facter.add(:system_profile) do
    confine :operatingsystem => :Gentoo
    setcode do
        profile = nil
        output = %x{/usr/bin/eselect --brief --no-color profile show | tr -d ' '}
        profile = output.chop!
        profile
    end
end

default_gw.rb

Facter plugin to return the deault gw set in systems routing table. Requires iproute2 package installed.

Facter.add(:default_gw) do
    confine :kernel => :linux
    setcode do
        gw = nil
        output = %x{/sbin/ip route show}
 
        output.each { |line|
            if line =~ /^default\s+via\s+([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})/
                gw = $1
                break
            end
        }
        gw
    end
end

Short review: Puppet for Gentoo servers

admin — Fri, 18 Dec 2009 10:51:58 +0000

I recently started to integrate Puppet with my company’s OS installer to build custom Gentoo servers in almost no time. The install/build system reached a stable state and i want to share some information’s on what i did to get it working. The Gentoo support of puppet is not perfect but sufficient for my use case. There are still some issues to solve:

Slots don’t work (I’m working on a patch for the portage provider to address this issue)
No nice way to manage /etc/conf.d/net
Only the runlevel “default” can be managed (This is sufficient for most cases)
No built in USE flag support (i use a binhost so this doesn’t really affect my setup). Check this site for a possible solution

The missing slots integration is especially important when it comes to Tomcat. Tomcat requires sun-jdk-1.5 and sun-jdk-1.6. I solved this by adding sun-jdk-1.5 to our install image. Apart from this problems it works very well.

Binhost setup

The easiest way to ensure that all systems run the same software (version, use flags) is to setup a portage binhost and force all clients to use this server as only package source. There are a lot of howto’s out there on creating a binhost so i won’t explain it detail. To force all clients to use only binary packages set the following statements in make.conf (Puppet distribution!):

PORTAGE_BINHOST="http://192.168.1.1/x86_64"
EMERGE_DEFAULT_OPTS="--getbinpkgonly --usepkgonly"

The parameter EMERGE_DEFAULT_OPTS is important because Puppet will run the command “emerge xxx/yyy” so you can’t specify extra parameters. This parameter setup ensures that the package cannot be installed when the binary package is missing on the binhost.