Skip to content

Commit 6b26a28

Browse files
ajroetkerajroetker
committed
Merge pull request #228 from kbarber/ticket/master/pdb-2571-fix-perms-of-config-files
(PDB-2571) Ensure puppetdb.ini file has correct permissions
2 parents e5d8c6b + 59100fd commit 6b26a28

15 files changed

Lines changed: 228 additions & 20 deletions

‎.gitignore‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,23 @@
1+
# Final publish location for module build
12
pkg/
3+
4+
# VIM files
25
*.swp
6+
7+
# Mac files
38
.DS_Store
9+
10+
# Generated directory for coverage results
411
coverage/
5-
spec/fixtures/modules/*
12+
13+
# Gem & bundler related files we do not want persisted to the repository
614
Gemfile.lock
715
.bundle
816
vendor/
9-
.rspec_system/
17+
18+
# Used by rake spec, for temp modules and other test requirements
19+
spec/fixtures/
20+
21+
# RVM files that are specific to developers implementation
22+
.ruby-version
23+
.ruby-gemset

‎manifests/server.pp‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,14 @@
135135
}
136136
}
137137

138+
class { 'puppetdb::server::global':
139+
vardir => $vardir,
140+
confdir => $confdir,
141+
puppetdb_user => $puppetdb_user,
142+
puppetdb_group => $puppetdb_group,
143+
notify => Service[$puppetdb_service],
144+
}
145+
138146
class { 'puppetdb::server::command_processing':
139147
command_threads => $command_threads,
140148
store_usage => $store_usage,
@@ -163,6 +171,8 @@
163171
conn_keep_alive => $conn_keep_alive,
164172
conn_lifetime => $conn_lifetime,
165173
confdir => $confdir,
174+
puppetdb_user => $puppetdb_user,
175+
puppetdb_group => $puppetdb_group,
166176
notify => Service[$puppetdb_service],
167177
}
168178

@@ -181,6 +191,8 @@
181191
conn_keep_alive => $read_conn_keep_alive,
182192
conn_lifetime => $read_conn_lifetime,
183193
confdir => $confdir,
194+
puppetdb_user => $puppetdb_user,
195+
puppetdb_group => $puppetdb_group,
184196
notify => Service[$puppetdb_service],
185197
}
186198

@@ -193,7 +205,7 @@
193205

194206
if str2bool($ssl_deploy_certs) == true {
195207
validate_absolute_path($ssl_dir)
196-
file{
208+
file {
197209
$ssl_dir:
198210
ensure => directory,
199211
owner => $puppetdb_user,
@@ -238,12 +250,16 @@
238250
confdir => $confdir,
239251
max_threads => $max_threads,
240252
notify => Service[$puppetdb_service],
253+
puppetdb_user => $puppetdb_user,
254+
puppetdb_group => $puppetdb_group,
241255
}
242256

243257
class { 'puppetdb::server::puppetdb':
244258
certificate_whitelist_file => $certificate_whitelist_file,
245259
certificate_whitelist => $certificate_whitelist,
246260
confdir => $confdir,
261+
puppetdb_user => $puppetdb_user,
262+
puppetdb_group => $puppetdb_group,
247263
notify => Service[$puppetdb_service],
248264
}
249265

‎manifests/server/command_processing.pp‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,6 @@
66
$confdir = $puppetdb::params::confdir,
77
) inherits puppetdb::params {
88

9-
10-
file { "${confdir}/config.ini":
11-
ensure => 'present',
12-
mode => '0644',
13-
}
14-
159
# Set the defaults
1610
Ini_setting {
1711
path => "${confdir}/config.ini",

‎manifests/server/database.pp‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
$conn_keep_alive = $puppetdb::params::conn_keep_alive,
2020
$conn_lifetime = $puppetdb::params::conn_lifetime,
2121
$confdir = $puppetdb::params::confdir,
22+
$puppetdb_user = $puppetdb::params::puppetdb_user,
23+
$puppetdb_group = $puppetdb::params::puppetdb_group,
2224
) inherits puppetdb::params {
2325

2426
if str2bool($database_validate) {
@@ -40,9 +42,17 @@
4042
}
4143
}
4244

45+
file { "${confdir}/database.ini":
46+
ensure => file,
47+
owner => $puppetdb_user,
48+
group => $puppetdb_group,
49+
mode => '0600',
50+
}
51+
52+
$file_require = File["${confdir}/database.ini"]
4353
$ini_setting_require = str2bool($database_validate) ? {
44-
false => undef,
45-
default => Class['puppetdb::server::validate_db'],
54+
false => $file_require,
55+
default => [$file_require, Class['puppetdb::server::validate_db']],
4656
}
4757
# Set the defaults
4858
Ini_setting {

‎manifests/server/global.pp‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,18 @@
11
# PRIVATE CLASS - do not use directly
22
class puppetdb::server::global (
3-
$vardir = $puppetdb::params::vardir,
4-
$confdir = $puppetdb::params::confdir,
3+
$vardir = $puppetdb::params::vardir,
4+
$confdir = $puppetdb::params::confdir,
5+
$puppetdb_user = $puppetdb::params::puppetdb_user,
6+
$puppetdb_group = $puppetdb::params::puppetdb_group,
57
) inherits puppetdb::params {
68

9+
file { "${confdir}/config.ini":
10+
ensure => file,
11+
owner => $puppetdb_user,
12+
group => $puppetdb_group,
13+
mode => '0600',
14+
}
15+
716
# Set the defaults
817
Ini_setting {
918
path => "${confdir}/config.ini",

‎manifests/server/jetty.pp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,23 @@
1313
$ssl_protocols = $puppetdb::params::ssl_protocols,
1414
$confdir = $puppetdb::params::confdir,
1515
$max_threads = $puppetdb::params::max_threads,
16+
$puppetdb_user = $puppetdb::params::puppetdb_user,
17+
$puppetdb_group = $puppetdb::params::puppetdb_group,
1618
) inherits puppetdb::params {
1719

20+
file { "${confdir}/jetty.ini":
21+
ensure => file,
22+
owner => $puppetdb_user,
23+
group => $puppetdb_group,
24+
mode => '0600',
25+
}
26+
1827
# Set the defaults
1928
Ini_setting {
2029
path => "${confdir}/jetty.ini",
2130
ensure => present,
2231
section => 'jetty',
32+
require => File["${confdir}/puppetdb.ini"],
2333
}
2434

2535
$cleartext_setting_ensure = $disable_cleartext ? {

‎manifests/server/puppetdb.pp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,23 @@
33
$certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file,
44
$certificate_whitelist = $puppetdb::params::certificate_whitelist,
55
$confdir = $puppetdb::params::confdir,
6+
$puppetdb_user = $puppetdb::params::puppetdb_user,
7+
$puppetdb_group = $puppetdb::params::puppetdb_group,
68
) inherits puppetdb::params {
79

10+
file { "${confdir}/puppetdb.ini":
11+
ensure => file,
12+
owner => $puppetdb_user,
13+
group => $puppetdb_group,
14+
mode => '0600',
15+
}
16+
817
# Set the defaults
918
Ini_setting {
1019
path => "${confdir}/puppetdb.ini",
1120
ensure => present,
1221
section => 'puppetdb',
22+
require => File["${confdir}/puppetdb.ini"],
1323
}
1424

1525
$certificate_whitelist_setting_ensure = empty($certificate_whitelist) ? {

‎manifests/server/read_database.pp‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,13 @@
4343
ensure => file,
4444
owner => $puppetdb_user,
4545
group => $puppetdb_group,
46-
mode => '0600';
46+
mode => '0600',
4747
}
4848

49+
$file_require = File["${confdir}/read_database.ini"]
4950
$ini_setting_require = str2bool($database_validate) ? {
50-
false => undef,
51-
default => Class['puppetdb::server::validate_read_db'],
51+
false => $file_require,
52+
default => [$file_require, Class['puppetdb::server::validate_read_db']],
5253
}
5354
# Set the defaults
5455
Ini_setting {
@@ -74,13 +75,13 @@
7475

7576
$subname = "//${database_host}:${database_port}/${database_name}${database_suffix}"
7677

77-
ini_setting { 'puppetdb_read_psdatabase_username':
78+
ini_setting { 'puppetdb_read_database_username':
7879
setting => 'username',
7980
value => $database_username,
8081
}
8182

8283
if $database_password != undef {
83-
ini_setting { 'puppetdb_read_psdatabase_password':
84+
ini_setting { 'puppetdb_read_database_password':
8485
setting => 'password',
8586
value => $database_password,
8687
}

‎spec/unit/classes/init_spec.rb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222

2323
describe 'when using default values for puppetdb class' do
2424
it { should contain_class('puppetdb') }
25+
it { should contain_class('puppetdb::server') }
26+
it { should contain_class('puppetdb::database::postgresql') }
2527
end
2628
end
2729

‎spec/unit/classes/server/database_ini_spec.rb‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,13 @@
1414
it { should contain_class('puppetdb::server::database') }
1515

1616
describe 'when using default values' do
17+
it { should contain_file('/etc/puppetlabs/puppetdb/conf.d/database.ini').
18+
with(
19+
'ensure' => 'file',
20+
'owner' => 'puppetdb',
21+
'group' => 'puppetdb',
22+
'mode' => '0600'
23+
)}
1724
it { should contain_ini_setting('puppetdb_psdatabase_username').
1825
with(
1926
'ensure' => 'present',

0 commit comments

Comments
 (0)
⚡