I’ve been using a lot of time on puppet lately. I had to setup a Puppetmaster with Puppet Dashboard, all running on passenger. I didn’t find any good howtos on the subject, so i’ll write one myself. Here is a step by step guide for how to setup a puppetmaster-server with puppet dashboard on a Ubuntu Server. I’m using the latest version of puppet from gems (2.6.2) instead of the one that ships with ubuntu (0.25.4). I’m also using mysql for the databases.
Puppetmaster:
First of all install rubygems and libmysql:
apt-get install rubygems1.8 libopenssl-ruby1.8 mysql-server libmysql-ruby
Create the database:
mysql> create database puppet;
mysql> grant all privileges on puppet.* to puppet@localhost identified by ‘password’;
Install puppet:
gem install rubygems-update
/var/lib/gems/1.8/bin/update_rubygems
gem install puppet activerecord
Deploy /etc/puppet/puppet.conf with the following content (adapt for your needs, see the comments):
[main]
# Basic config:
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/etc/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
pluginsync=false
templatedir=$confdir/templates#Puppetmaster-config:
[master]
storeconfigs = true
# MySQL-configuration:
dbadapter = mysql
dbuser = puppet
dbpassword = password
dbserver = localhost
dbsocket = /var/run/mysqld/mysqld.sock
# SSL-config:
ssl_client_header = SSL_CLIENT_S_DN
ssl_client_verify_header = SSL_CLIENT_VERIFY
# Reports to puppet-dashboard for each run:
reports = http, store
reporturl = http://localhost:3000/reports# Puppet client config enables reporting from the client
# This HAS to be enabled on ALL clients you want reports from
[agent]
report = true
You should also deploy init-scripts for puppet (not puppetmaster, it will run through apache) if needed, and logrotate if needed, here is my /etc/logrotate.d/puppet:
/var/log/puppet/*log {
missingok
create 0644 puppet puppet
compress
rotate 4postrotate
[ -e /etc/init.d/puppetmaster ] && /etc/init.d/puppetmaster restart >/dev/null 2>&1 || true
[ -e /etc/init.d/puppet ] && /etc/init.d/puppet reload > /dev/null 2>&1 || true
endscript
}
Start puppetmasterd with «–mkusers» the first time to create the puppet-group and user:
puppetmasterd –mkusers
Puppet Dashboard
Now it’s time to install Puppet Dashboard. We’ll install this using Puppetlabs’ apt-repo. This will install Puppet Dashboard to /usr/share/puppet-dashboard.
Add puppetlabs’ apt-repo by adding the following lines to your /etc/apt/sources.list:
deb http://apt.puppetlabs.com/ubuntu lucid main
deb-src http://apt.puppetlabs.com/ubuntu lucid main
Fetch puppetlabs’ GPG-key and import it into apt:
gpg –recv-key 4BD6EC30
gpg -a –export 4BD6EC30 | sudo apt-key add –
Run apt-get update and install puppet-dashboard:
apt-get update
apt-get install puppet-dashboard
Create the database:
mysql -p
mysql > create database dashboard;
mysql > GRANT ALL PRIVILEGES ON dashboard.* to ‘dashboard’@’localhost’ IDENTIFIED BY ‘password’;
Edit /etc/puppet-dashboard/database.yml with the proper settings, i will assume that you want to use the production enviroment for the rest of this howto:
production:
database: dashboard
username: dashboard
password: password
encoding: utf8
adapter: mysql
Initialize the database:
rake RAILS_ENV=production db:migrate
Passenger
Now we’ve finished the basic setup of the Puppetmaster and Puppet Dashboard. Now it’s time to install passenger and make everything run through apache.
First of all, install passenger (it will also install dependencies such as apache):
apt-get install libapache2-mod-passenger
Enable SSL:
a2enmod ssl
Change the ownership of /etc/puppet/rack/config.ru to puppet:puppet:
chown puppet:puppet /etc/puppet/rack/config.ru
Copy /usr/share/puppet-dashboard/vendor/rails/railties/dispatches/config.ru to /usr/share/puppet-dashboard/config.ru and set the proper ownership:
cp /usr/share/puppet-dashboard/vendor/rails/railties/dispatches/config.ru /usr/share/puppet-dashboard/config.ru
chown www-data:www-data /usr/share/puppet-dashboard/config.ru
Deploy /etc/apache2/sites-enabled/puppetmaster with the following content (remember to edit hostname, tune as you see fit):
# You probably want to tune these settings
PassengerHighPerformance on
PassengerMaxPoolSize 12
PassengerPoolIdleTime 1500
# PassengerMaxRequests 1000
PassengerStatThrottleRate 120
RackAutoDetect Off
RailsAutoDetect OffListen 8140
SSLEngine on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXPSSLCertificateFile /etc/puppet/ssl/certs/puppet.domain.tld.pem
SSLCertificateKeyFile /etc/puppet/ssl/private_keys/puppet.domain.tld.pem
SSLCertificateChainFile /etc/puppet/ssl/ca/ca_crt.pem
SSLCACertificateFile /etc/puppet/ssl/ca/ca_crt.pem
# If Apache complains about invalid signatures on the CRL, you can try disabl$
# CRL checking by commenting the next line, but this is not recommended.
SSLCARevocationFile /etc/puppet/ssl/ca/ca_crl.pem
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVarsDocumentRoot /etc/puppet/rack/public/
RackBaseURI /
Options None
AllowOverride None
Order allow,deny
allow from all
Then deploy /etc/apache2/sites-enabled/puppet-dashboard with the following content:
# Dashboard configuration
Listen 3000
DocumentRoot /usr/share/puppet-dashboard/public/# Use the production-enviroment:
SetEnv RAILS_ENV production
RackBaseURI /
Options None
AllowOverride AuthConfig
Order allow,deny
Allow from all
ServerSignature On
# Logs
ErrorLog /var/log/apache2/dashboard.domain.tld_error.log
LogLevel warn
CustomLog /var/log/apache2/dashboard.domain.tld_access.log combined
Then you just restart apache2, make sure it starts at boot and you should be good to go.
Puppet Dashboard should then be accessible via http://puppet.domain.tld:3000 while puppet should run properly on port 8140 (Test with a client).
UFW
I’ll also add a quick set of commands for securing the server, i’m using Ubuntu’s uncomplicated firewall, edit the rules to fit your IP-series, these rules will close down all ports on the server except port 22, 3000 and 8140 which will be open for specific ip-ranges:
ufw default deny
ufw allow from 192.168.0.0/24 to any port 22
ufw allow from 192.168.0.0/24 to any port 8140
ufw allow from 192.168.0.0/24 to any port 3000
ufw enable
This concludes this howto, i hope you will find it useful.
-Eivind
