--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To post to this group, send email to puppet...@googlegroups.com.
To unsubscribe from this group, send email to puppet-users...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
mkdir -p /usr/share/puppet/rack/puppetmasterd
mkdir /usr/share/puppet/rack/puppetmasterd/public /usr/share/puppet/rack/puppetmasterd/tmp
cp config.ru /usr/share/puppet/rack/puppetmasterd
chown puppet /usr/share/puppet/rack/puppetmasterd/config.ru
I'm assuming you aren't using passenger for a different web application. Is that true?
> To unsubscribe from this group, send email to puppet-users...@googlegroups.com.
Excerpts from Martin Willemsma's message of Wed Sep 08 04:43:21 -0400 2010:
> 2010/9/8 FreddieB <freddie...@gmail.com>
>
> > I'm testing Puppet 2.6 and got all the basic stuff working with the
> > default webricks. I read that it doesn't scale very well and is not
> > suited for production environments and the recommended setup is Apache/
> > Passenger.
> >
> > Is there a step-by-step-guide on how to set it up?
> >
>
> There is detailed information regarding puppetmaster using passenger/apache
> on centos and ubuntu
>
> http://projects.reductivelabs.com/projects/puppet/wiki/Using_Passenger
>
You may wanna give a try to the puppetmaster-passenger package available
in Ubuntu Maverick and Debian experimental. The package will
automatically setup everything for you.
--
Mathias Gug
Ubuntu Developer http://www.ubuntu.com
I just tried to install puppet/puppetmaster/passenger on squeeze, and it worked perfectly.
Since squeeze is already frozen, I consider using it as okey. :-)
Packages to install:
* puppetmaster
* libapache2-mod-passenger
Apache modules to enable:
a2enmod headers
a2enmod ssl
I had to change config.ru to use master instead of puppetmasterd, see the following
Debian bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=593557
/usr/share/puppet/rack/puppetmasterd/config.ru:
# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.
# if puppet is not in your RUBYLIB:
# $:.unshift('/opt/puppet/lib')
$0 = "puppetmasterd"
require 'puppet'
# if you want debugging:
# ARGV << "--debug"
ARGV << "--rack"
require 'puppet/application/master'
# we're usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Application[:master].run
Disabled my puppetmaster (/etc/defaults/puppetmaster):
# Defaults for puppetmaster - sourced by /etc/init.d/puppetmaster
# Start puppetmaster on boot? If you are using passenger, you should
# have this set to "no"
START=no
The following represents my puppet configuration (/etc/puppet/puppet.conf)
[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
templatedir=$confdir/templates
[master]
certname=puppet.ono.at
ssl_client_header=SSL_CLIENT_S_DN
ssl_client_verify_header=SSL_CLIENT_VERIFY
And below goes my Apache configuration:
## Puppetmaster Configuration
## Passenger Limits
PassengerHighPerformance on
PassengerMaxPoolSize 12
PassengerPoolIdleTime 1500
# PassengerMaxRequests 1000
PassengerStatThrottleRate 120
RackAutoDetect Off
RailsAutoDetect Off
Listen 8140
<VirtualHost *:8140>
ServerName puppet.ono.at
SSLEngine on
SSLCipherSuite SSLv2:-LOW:-EXPORT:RC4+RSA
SSLCertificateFile /var/lib/puppet/ssl/certs/puppet.ono.at.pem
SSLCertificateKeyFile /var/lib/puppet/ssl/private_keys/puppet.ono.at.pem
SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCACertificateFile /var/lib/puppet/ssl/ca/ca_crt.pem
## CRL checking should be enabled; if you have problems with
## Apache complaining about the CRL, disable the next line
SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVars
## The following client headers allow the same configuration
## to work with Pound.
RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
RackAutoDetect On
DocumentRoot /usr/share/puppet/rack/puppetmasterd/public/
<Directory /usr/share/puppet/rack/puppetmasterd/>
Options None
AllowOverride None
Order allow,deny
allow from all
</Directory>
</VirtualHost>
After everything is in place, restart apache and open up a web browser
to test whether everything is working: https://puppet:8140
If everything is working you should see a line saying:
"The environment must be purely alphanumeric, not ''"
Regards,
Stefan.
> --
> You received this message because you are subscribed to the Google Groups "Puppet Users" group.
> To post to this group, send email to puppet...@googlegroups.com.
> To unsubscribe from this group, send email to puppet-users...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
>
--
Stefan Schlesinger ////////////////////////////////////////// ///////
s...@ono.at +43.676.4911123
Excerpts from Stefan Schlesinger's message of Wed Sep 08 13:51:05 -0400 2010:
>
> I just tried to install puppet/puppetmaster/passenger on squeeze, and it worked perfectly.
> Since squeeze is already frozen, I consider using it as okey. :-)
>
>
> After everything is in place, restart apache and open up a web browser
> to test whether everything is working: https://puppet:8140
>
I'd recommend to also remove all ports from /etc/apache2/ports.conf and
disable the default site - so that apache2 *only* listens on port 8140
for puppet.
> Hi Stefan and Mathias!
>
> I'll definitely try this out. If that doesn't work for some reason
> I'll probably wait for the package in experimental to move up the
> "ladder" (performance is not critical yet).
One warning, Webrick's bad performance can cause strange intermittent errors. Mostly request timeout errors.
> On Sep 9, 1:16 am, Mathias Gug <math...@ubuntu.com> wrote:
>> Hi,
>>
>> Excerpts from Stefan Schlesinger's message of Wed Sep 08 13:51:05 -0400 2010:
>>
>>
>>
>>> I just tried to install puppet/puppetmaster/passenger on squeeze, and it worked perfectly.
>>> Since squeeze is already frozen, I consider using it as okey. :-)
>>
>>> After everything is in place, restart apache and open up a web browser
>>> to test whether everything is working:https://puppet:8140
>>
>> I'd recommend to also remove all ports from /etc/apache2/ports.conf and
>> disable the default site - so that apache2 *only* listens on port 8140
>> for puppet.
>>
>> --
>> Mathias Gug
>> Ubuntu Developer http://www.ubuntu.com
>
Well, if you install puppet/apache/rack/rails/passenger from testing,
you could as well use squeeze instead of lenny. ;-)
I've got the following packages installed on my system:
ii apache2-mpm-worker 2.2.16-2
ii puppetmaster 2.6.0-2
ii libapache2-mod-passenger 2.2.11debian-1
ii librack-ruby1.8 1.1.0-3
ii rails 2.3.5-1.1
> I'm stumped on one thing though, maybe someone one this list can offer
> some pointers/advice.
>
> The guide talks about creating /usr/share/puppet/rack/puppetmasterd/
> public/ and /usr/share/puppet/rack/puppetmasterd/tmp/ which I have
> done, however when my clients make a request I get the following
> Apache error:-
>
> File does not exist: /usr/share/puppet/rack/puppetmasterd/public/
> production
Since "public/" should be the apache document root, I suppose there is
something wrong with your Apache configuration.
Puppet agents will create a http request to the following url:
"https://puppet:8140/production/...anything..."
Everything below the first slash should be interpreted by Apache
to be passed to the Rack application running in Passenger.
Did you try it with the apache configuration I sent in my last email?
Also adding Passenger options[1][2] might help:
PassengerRoot /usr
PassengerRuby /usr/bin/ruby
RailsAutoDetect On
RailsBaseURI /
Also try to tune Apache's log level and have a look at the logfiles.
Regards,
Stefan.
[1] RailsAutoDetect - http://www.modrails.com/documentation/Users%20guide%20Apache.html#_railsautodetect_lt_on_off_gt
[2] RailsBaseURI - http://www.modrails.com/documentation/Users%20guide%20Apache.html#RailsBaseURI
Actually I think I can reproduce your problem when I turn that
option off in puppetmaster vhost: RackAutoDetect On
;-)
Regards, Stefan.
I'm trying to use puppet with passenger as well. I'm running puppet 2.6.1 and I'm running into the issue mentioned under the troubleshooting section of http://projects.reductivelabs.com/projects/puppet/wiki/Using_Passenger. The instructions there are very vague. I've tried adding the ca_name setting to puppet.conf on the puppet master, but it doesn't seem to have any effect. I took a look at http://docs.puppetlabs.com/references/stable/configuration.html and there does not appear to be a ca_name option. On the other hand, there is a certname option. When I set this option to something like "ca-foo.bar.com" and restart the puppet master, I do see a new certificate generated, however, I get errors on the client side stating that the cert is incorrect "Could not retrieve catalog from remote server: hostname was not match with the server certificate". Any suggestions?
--
Restarting the puppet master with the certdnsname option set did not change the certificate in /var/lib/puppet/ssl/certs/admin.baz.bar.com at all.
My understanding from the documentation is that the issue was with ca.pem.
Is that not the case? Is there some trick to get puppet to regenerate the certs properly? From what I've been able to find, this seems to be at least partially related to Bug #4226.
Thanks,
Nan
--
Hi Stefan,
Thanks for the pointers however I am still not coming right with this.
I still get the 'File does not exist' error: File does not exist:
/usr/share/puppet/rack/puppetmasterd/public/production
My installed packages look almost identical to yours:-
ii apache2-mpm-worker 2.2.9-10+lenny8
ii libapache2-mod-passenger 2.2.11debian-1
ii puppetmaster 2.6.0-4
ii librack-ruby1.8 1.1.0-4
ii rails 2.1.0-7
My Apache vhost is confugured as follows:-
PassengerHighPerformance on
PassengerMaxPoolSize 12
PassengerPoolIdleTime 1500
# PassengerMaxRequests 1000
PassengerStatThrottleRate 120
RackAutoDetect Off
RailsAutoDetect Off
Listen 8140
<VirtualHost *:8140>
SSLEngine on
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
SSLCertificateFile
/var/lib/puppet/ssl/certs/puppet.issecurity.co.za.pem
SSLCertificateKeyFile
/var/lib/puppet/ssl/private_keys/puppet.issecurity.co.za.pem
SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCACertificateFile /var/lib/puppet/ssl/ca/ca_crt.pem
# CRL checking should be enabled; if you have problems with Apache
complaining about the CRL, disable the next line
SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVars
# The following client headers allow the same configuration to
work with Pound.
RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
PassengerRoot /usr
PassengerRuby /usr/bin/ruby
RailsAutoDetect On
#RackAutoDetect On
DocumentRoot /usr/share/puppet/rack/puppetmasterd/public/
RackBaseURI /
<Directory /usr/share/puppet/rack/puppetmasterd/>
Options None
AllowOverride None
Order allow,deny
allow from all
</Directory>
</VirtualHost>
~
Here is what my config.ru looks like:
# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.
# if puppet is not in your RUBYLIB:
# $:.unshift('/opt/puppet/lib')
$0 = "puppetmasterd"
require 'puppet'
# if you want debugging:
# ARGV << "--debug"
ARGV << "--rack"
require 'puppet/application/puppetmasterd'
# we're usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Application[:puppetmasterd].run
And here are the file permissions:-
puppet:~# ls -lah /usr/share/puppet/rack/puppetmasterd/
total 20K
drwxr-xr-x 4 puppet puppet 4.0K Sep 29 13:54 .
drwxr-xr-x 3 root root 4.0K Sep 1 10:58 ..
-rw-r--r-- 1 puppet puppet 470 Sep 22 16:38 config.ru
drwxr-xr-x 2 puppet puppet 4.0K Jul 28 21:02 public
drwxr-xr-x 2 puppet puppet 4.0K Jul 28 21:02 tmp
I tried to play around with all of the options in the apache config,
ie: On/Off, doc root, etc, and no matter what I do I still get the
same error.
I upped the log level of Apache and can see all the debug logs but the
only useful line in the logs tells me about the error as described
above.
I'm trying to deploy Puppet here in our DC and we have hundreds of
servers to manage, so Passenger is our only option.
Do you or anyone else perhaps have any other pointers that may assist
me in getting to the bottom of this ??
Thanks again for your help so far.
Regards,
Gavin
> On 10 September 2010 18:54, Stefan Schlesinger <s...@ono.at> wrote:
>>
>> On Sep 10, 2010, at 15:47 , Gavin wrote:
>>> File does not exist: /usr/share/puppet/rack/puppetmasterd/public/
>>> production.
>>
>> Actually I think I can reproduce your problem when I turn that
>> option off in puppetmaster vhost: RackAutoDetect On
>
> Hi Stefan,
>
> Thanks for the pointers however I am still not coming right with this.
>
> I still get the 'File does not exist' error: File does not exist:
> /usr/share/puppet/rack/puppetmasterd/public/production
>
> My installed packages look almost identical to yours:-
>
> ii apache2-mpm-worker 2.2.9-10+lenny8
> ii libapache2-mod-passenger 2.2.11debian-1
> ii puppetmaster 2.6.0-4
> ii librack-ruby1.8 1.1.0-4
> ii rails 2.1.0-7
>
> Here is what my config.ru looks like:
>
> # a config.ru, for use with every rack-compatible webserver.
> # SSL needs to be handled outside this, though.
>
> # if puppet is not in your RUBYLIB:
> # $:.unshift('/opt/puppet/lib')
>
> $0 = "puppetmasterd"
> require 'puppet'
>
> # if you want debugging:
> # ARGV << "--debug"
>
> ARGV << "--rack"
> require 'puppet/application/puppetmasterd'
> # we're usually running inside a Rack::Builder.new {} block,
> # therefore we need to call run *here*.
> run Puppet::Application[:puppetmasterd].run
>
> Do you or anyone else perhaps have any other pointers that may assist
> me in getting to the bottom of this ??
Looks like it might be http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=593557
Ok, so I have managed to resolve the issue that I was having by
totally un-installing Puppet, rack, rails and passenger, and upgrading
my entire Debian server to 'testing' and reinstalling.
I can't say exactly what the issue was but it seems to have been a
conflicting/older package.
Thanks to all for the help and pointers!! Now to get back to this
installation!!
Regards,
Gavin
I notice you're using Puppet 2.6 and the config.ru you pasted does not
work with puppet 2.6 but did work with puppet 0.25.x.
The config.ru file contents have changed for version 2.6. This is a
result of the change in Application controller names and the shift to
a single executable.
Take a look at the config.ru file that ships with the puppet 2.6.1
source code for information about how it's changed. If you have any
questions, I'm happy to help.
The file you're looking for is in ext/rack/files/config.ru
--
Jeff McCune
http://www.puppetlabs.com/
We should be shipping the correct config.ru for you in the 2.6.x
Debian packages. Did that not work?
>
> Regards,
> Gavin
Hi Nigel,
Yes, I got the new config.ru file with the Debian package, my mistake
was starting off with the Lenny packages then trying to selectively
install puppet and it's dependencies from the 'testing' branch.
I got fed up and uninstalled puppet and it's dependencies completely,
upgraded the entire server to testing, and installed puppet again.
All started working perfectly after that.
Thanks to all for the help and advice!!
Regards,
Gavin