Puppet Class: puppetmaster::puppetboard

Inherits:
puppetmaster::params
Defined in:
manifests/puppetboard.pp

Overview

Setup Puppetserver, PuppetDB and Puppetboard

Parameters:

$puppetdb_database_password

Password for the puppetdb database in postgresql

$puppetboard_password

Password for Puppetboard

$autosign

Set up autosign entries. Set to true to enable naive autosigning.

$autosign_entries

List of autosign entries. Requires that autosign is pointing to the path of autosign.conf.

$timezone

The timezone the server wants to be located in. Example: ‘Europe/Helsinki’ or ‘Etc/UTC’.

control repo parameters:

$control_repo

Enable control repo. You MUST also set up $provider, $repo_url, $key_path and $repo_host.

$provider

Your git repository provider. Providers ‘gitlab’ (gitlab.com) and ‘bitbucket’ are fully supported, but this parameter can be any string: you just need to add the public SSH key of the Git server to /root/.ssh/known_hosts manually.

$repo_url

The url to your control repository. Example: ‘git@gitlab.com:mycompany/control-repo.git’

$key_path

The private key to use for accessing $repo_url. defaults to ‘/etc/puppetlabs/r10k/ssh/r10k_key’

$repo_host

The fully qualified name of the $provider host. For example ‘gitlab.com’ or ‘bitbucket.org’.

iptables parameters:

$manage_packetfilter

Manage IPv4 and IPv6 rules. Defaults to false.

$puppetserver_allow_ipv4

Allow connections to puppetserver from this IPv4 address or subnet. Example: ‘10.0.0.0/8’. Defaults to ‘127.0.0.1’.

$puppetserver_allow_ipv6

Allow connections to puppetserver from this IPv6 address or subnet. Defaults to ‘::1’.

advanced parameters:

$puppetboard_require_auth

Require basic authentication in Puppetboard. Defaults to true, as Puppetboard exposes lots of information about your infrastructure and should not be accessible to anyone, not even internally within an organization or a network. So, you _should not_ disable this unless you are going to limit access to Puppetboard by some other means such as IP-based filtering or by using some other form of authentication.

$puppetboard_username

Username for accessing Puppetboard. Defaults to ‘admin’.

$server_reports

Where to store reports. Defaults to ‘store,puppetdb’.

$server_external_nodes

The path to the ENC executable. Defaults to empty string.

Parameters:

  • puppetdb_database_password (String)
  • puppetboard_password (String)
  • puppetboard_require_auth (Boolean) (defaults to: true)
  • puppetboard_username (String) (defaults to: 'admin')
  • timezone (String) (defaults to: 'Etc/UTC')
  • manage_packetfilter (Boolean) (defaults to: false)
  • puppetserver_allow_ipv4 (String) (defaults to: '127.0.0.1')
  • puppetserver_allow_ipv6 (String) (defaults to: '::1')
  • server_reports (String) (defaults to: 'store,puppetdb')
  • autosign (Variant[Boolean, String]) (defaults to: '/etc/puppetlabs/puppet/autosign.conf')
  • server_external_nodes (String) (defaults to: '')
  • autosign_entries (Optional[Array[String]]) (defaults to: undef)
  • key_path (String) (defaults to: '/etc/puppetlabs/r10k/ssh/r10k_key')
  • control_repo (Boolean) (defaults to: false)
  • provider (Optional[String]) (defaults to: undef)
  • repo_url (Optional[String]) (defaults to: undef)
  • repo_host (Optional[String]) (defaults to: undef) 


45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
 
# File 'manifests/puppetboard.pp', line 45

class puppetmaster::puppetboard
(
  String                   $puppetdb_database_password,
  String                   $puppetboard_password,
  Boolean                  $puppetboard_require_auth = true,
  String                   $puppetboard_username = 'admin',
  String                   $timezone = 'Etc/UTC',
  Boolean                  $manage_packetfilter = false,
  String                   $puppetserver_allow_ipv4 = '127.0.0.1',
  String                   $puppetserver_allow_ipv6 = '::1',
  String                   $server_reports = 'store,puppetdb',
  Variant[Boolean, String] $autosign = '/etc/puppetlabs/puppet/autosign.conf',
  String                   $server_external_nodes = '',
  Optional[Array[String]]  $autosign_entries = undef,
  String                   $key_path = '/etc/puppetlabs/r10k/ssh/r10k_key',
  Boolean                  $control_repo = false,
  Optional[String]         $provider = undef,
  Optional[String]         $repo_url = undef,
  Optional[String]         $repo_host = undef,
) inherits puppetmaster::params
{
  $apache_conf_dir    = $::puppetmaster::params::apache_conf_dir
  $apache_confd_dir   = $::puppetmaster::params::apache_confd_dir
  $seltype            = $::puppetmaster::params::seltype
  $wsgi_mod_path      = $::puppetmaster::params::wsgi_mod_path
  $wsgi_package_name  = $::puppetmaster::params::wsgi_package_name
  $wsgi_socket_prefix = $::puppetmaster::params::wsgi_socket_prefix

  include ::puppetmaster::package_cache

  $puppetboard_puppetdb_host              = $facts['fqdn']
  $puppetboard_puppetdb_port              = 8081
  $puppetboard_puppetdb_dashboard_address = "http://${facts['fqdn']}:8080/pdb/dashboard"
  $puppetboard_puppetdb_address           = "https://${facts['fqdn']}:8081/v2/commands"
  $puppetdb_server                        = $facts['fqdn']
  $puppetboard_manage_git                 = true
  $puppetboard_manage_virtualenv          = true
  $puppetboard_reports_count              = 40
  $puppetboard_puppetdb_key               = "${::settings::ssldir}/private_keys/${::fqdn}.pem"
  $puppetboard_puppetdb_ssl_verify        = "${::settings::ssldir}/certs/ca.pem"
  $puppetboard_puppetdb_cert              = "${::settings::ssldir}/certs/${::fqdn}.pem"
  $puppetboard_groups                     = 'puppet'
  # Copy over Puppet keys to a place where Puppetboard can access them
  $puppet_ssldir                          = '/etc/puppetlabs/puppet/ssl'
  $puppetboard_config_dir                 = '/etc/puppetlabs/puppetboard'
  $puppetboard_htpasswd_file              = "${apache_conf_dir}/puppetboard.htpasswd"
  $puppetboard_ssl_dir                    = "${puppetboard_config_dir}/ssl"
  $puppetdb_cert                          = "${puppetboard_ssl_dir}/${::fqdn}.crt"
  $puppetdb_key                           = "${puppetboard_ssl_dir}/${::fqdn}.key"
  $puppetdb_ca_cert                       = "${puppetboard_ssl_dir}/ca.pem"

  class { '::puppetmaster::puppetdb':
    manage_packetfilter        => $manage_packetfilter,
    puppetserver_allow_ipv4    => $puppetserver_allow_ipv4,
    puppetserver_allow_ipv6    => $puppetserver_allow_ipv6,
    server_reports             => $server_reports,
    autosign                   => $autosign,
    autosign_entries           => $autosign_entries,
    puppetdb_database_password => $puppetdb_database_password,
    timezone                   => $timezone,
    server_external_nodes      => $server_external_nodes,
    provider                   => $provider,
    key_path                   => $key_path,
    control_repo               => $control_repo,
    repo_url                   => $repo_url,
    repo_host                  => $repo_host,
    before                     => Class['::puppetboard'],
  }

  include ::puppetmaster::puppetboard::ssl_workarounds

  file { [ $puppetboard_config_dir, $puppetboard_ssl_dir ]:
    ensure  => directory,
    owner   => 'root',
    group   => 'puppetboard',
    mode    => '0750',
    require => Class['::puppetboard'],
  }

  $keys = { "${puppet_ssldir}/certs/${::fqdn}.pem" => $puppetdb_cert,
  "${puppet_ssldir}/private_keys/${::fqdn}.pem"    => $puppetdb_key,
  "${puppet_ssldir}/certs/ca.pem"                  => $puppetdb_ca_cert, }

  $keys.each |$key| {
    exec { $key[1]:
      command => "cp -f ${key[0]} ${key[1]}",
      unless  => "cmp ${key[0]} ${key[1]}",
      path    => ['/bin', '/usr/bin/' ],
      require => [ Class['::puppetmaster::puppetserver'], File[$puppetboard_ssl_dir] ],
    }

    file { $key[1]:
      group   => 'puppetboard',
      mode    => '0640',
      seltype => $seltype,
      require => Exec[$key[1]],
    }
  }

  class { '::apache':
    purge_configs     => false,
    mpm_module        => 'event',
    default_vhost     => true,
    default_ssl_vhost => true,
    default_mods      => false,
    confd_dir         => $apache_confd_dir,
  }

  if $facts['osfamily'] == 'RedHat' {
    include ::apache::mod::version
  }

  class { '::apache::mod::wsgi':
    wsgi_socket_prefix => $wsgi_socket_prefix,
    package_name       => $wsgi_package_name,
    mod_path           => $wsgi_mod_path,
  }

  class { '::puppetboard':
    # puppet-puppetboard clones puppetboard from Git, so we need to specify a known-good version
    revision            => '18120d520b7ea15bfc734b57742530c3d2b769ff',
    groups              => $puppetboard_groups,
    puppetdb_host       => $puppetboard_puppetdb_host,
    puppetdb_port       => $puppetboard_puppetdb_port,
    manage_git          => $puppetboard_manage_git,
    manage_virtualenv   => $puppetboard_manage_virtualenv,
    reports_count       => $puppetboard_reports_count,
    puppetdb_key        => $puppetdb_key,
    puppetdb_ssl_verify => $puppetdb_ca_cert,
    puppetdb_cert       => $puppetdb_cert,
    require             => Class['::puppet'],
  }

  file { '/srv/puppetboard/puppetboard/puppetboard/app.py':
    ensure  => 'present',
    content => template('puppetmaster/app.py.erb'),
    owner   => 'root',
    group   => 'root',
    mode    => '0644',
    require => Class['::puppetboard'],
  }

  class { '::puppetboard::apache::conf': }

  if $puppetboard_require_auth {
    include ::apache::mod::auth_basic
    include ::apache::mod::authn_core
    include ::apache::mod::authn_file
    include ::apache::mod::authz_user

    file { "${apache_confd_dir}/puppetboard-basic-auth.conf":
      ensure  => 'present',
      content => template('puppetmaster/puppetboard-basic-auth.conf.erb'),
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      notify  => Class['::apache::service'],
    }

    # Create basic auth user and set password as needed. Note that if either
    # the username or password changes the file is recreated (see "man htpasswd").
    exec { 'set-puppetdb-password':
      command   => "echo ${puppetboard_password}|htpasswd -i -c ${puppetboard_htpasswd_file} ${puppetboard_username}",
      unless    => "echo ${puppetboard_password}|htpasswd -i -v ${puppetboard_htpasswd_file} ${puppetboard_username}",
      path      => ['/bin','/usr/bin'],
      logoutput => false,
    }

  } else {
    # If we could easily ensure that the above modules are disabled we would
    # do that. But we can't, not at least in a cross-platform way. So we just
    # get rid of the config file to disable authentication itself.
    file { "${apache_confd_dir}/puppetboard-basic-auth.conf":
      ensure => 'absent',
      notify => Class['::apache::service'],
    }

    file { $puppetboard_htpasswd_file:
      ensure => 'absent',
    }
  }

  if $manage_packetfilter {
    @firewall { '00443 accept tls traffic to puppetserver':
      dport  => '443',
      proto  => 'tcp',
      action => 'accept',
      tag    => 'default',
    }
  }
}