Skip to content

Commit a313832

Browse files
cprice404cprice404
committed
Merge pull request #22 from bke-drewb/17594
This is great, thank you!
2 parents eabee54 + 0cf9632 commit a313832

6 files changed

Lines changed: 189 additions & 44 deletions

File tree

‎manifests/init.pp‎

Lines changed: 85 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,50 @@
1515
# puppetdb. You can use the `puppetdb::master::config` class to accomplish this.
1616
#
1717
# Parameters:
18-
# ['database'] - Which database backend to use; legal values are
19-
# `postgres` (default) or `embedded`. (The `embedded`
20-
# db can be used for very small installations or for
21-
# testing, but is not recommended for use in production
22-
# environments. For more info, see the puppetdb docs.)
18+
# ['listen_address'] - The address that the web server should bind to
19+
# for HTTP requests. (defaults to `localhost`.
20+
# '0.0.0.0' = all)
21+
# ['listen_port'] - The port on which the puppetdb web server should
22+
# accept HTTP requests (defaults to 8080).
23+
# ['open_listen_port'] - If true, open the http listen port on the firewall.
24+
# (defaults to false).
25+
# ['ssl_listen_address'] - The address that the web server should bind to
26+
# for HTTPS requests. (defaults to `$::clientcert`.)
27+
# Set to '0.0.0.0' to listen on all addresses.
28+
# ['ssl_listen_port'] - The port on which the puppetdb web server should
29+
# accept HTTPS requests (defaults to 8081).
30+
# ['open_ssl_listen_port'] - If true, open the ssl listen port on the firewall.
31+
# (defaults to true).
32+
# ['database'] - Which database backend to use; legal values are
33+
# `postgres` (default) or `embedded`. (The `embedded`
34+
# db can be used for very small installations or for
35+
# testing, but is not recommended for use in production
36+
# environments. For more info, see the puppetdb docs.)
37+
# ['database_port'] - The port that the database server listens on.
38+
# (defaults to `5432`; ignored for `embedded` db)
39+
# ['database_username'] - The name of the database user to connect as.
40+
# (defaults to `puppetdb`; ignored for `embedded` db)
41+
# ['database_password'] - The password for the database user.
42+
# (defaults to `puppetdb`; ignored for `embedded` db)
43+
# ['database_name'] - The name of the database instance to connect to.
44+
# (defaults to `puppetdb`; ignored for `embedded` db)
45+
# ['database_package'] - The puppetdb package name in the package manager
2346
# ['puppetdb_version'] - The version of the `puppetdb` package that should
24-
# be installed. You may specify an explicit version
25-
# number, 'present', or 'latest'. Defaults to
26-
# 'present'.
47+
# be installed. You may specify an explicit version
48+
# number, 'present', or 'latest'. (defaults to
49+
# 'present')
50+
# ['puppetdb_service'] - The name of the puppetdb service.
51+
# ['manage_redhat_firewall'] - DEPRECATED: Use open_ssl_listen_port instead.
52+
# boolean indicating whether or not the module
53+
# should open a port in the firewall on redhat-based
54+
# systems. Defaults to `false`. This parameter is
55+
# likely to change in future versions. Possible
56+
# changes include support for non-RedHat systems and
57+
# finer-grained control over the firewall rule
58+
# (currently, it simply opens up the postgres port to
59+
# all TCP connections).
60+
# ['confdir'] - The puppetdb configuration directory; defaults to
61+
# `/etc/puppetdb/conf.d`.
2762
#
2863
# Actions:
2964
# - Creates and manages a puppetdb server and its database server/instance.
@@ -34,30 +69,56 @@
3469
# Sample Usage:
3570
# include puppetdb
3671
#
37-
#
38-
# TODO: expose more parameters
39-
#
4072
class puppetdb(
41-
$database = $puppetdb::params::database,
42-
$puppetdb_package = $puppetdb::params::puppetdb_package,
43-
$puppetdb_version = $puppetdb::params::puppetdb_version,
44-
$puppetdb_service = $puppetdb::params::puppetdb_service,
45-
$confdir = $puppetdb::params::confdir,
46-
$manage_redhat_firewall = $puppetdb::params::manage_redhat_firewall,
73+
$listen_address = $puppetdb::params::listen_address,
74+
$listen_port = $puppetdb::params::listen_port,
75+
$open_listen_port = $puppetdb::params::open_listen_port,
76+
$ssl_listen_address = $puppetdb::params::ssl_listen_address,
77+
$ssl_listen_port = $puppetdb::params::ssl_listen_port,
78+
$open_ssl_listen_port = $puppetdb::params::open_ssl_listen_port,
79+
$database = $puppetdb::params::database,
80+
$database_port = $puppetdb::params::database_port,
81+
$database_username = $puppetdb::params::database_username,
82+
$database_password = $puppetdb::params::database_password,
83+
$database_name = $puppetdb::params::database_name,
84+
$puppetdb_package = $puppetdb::params::puppetdb_package,
85+
$puppetdb_version = $puppetdb::params::puppetdb_version,
86+
$puppetdb_service = $puppetdb::params::puppetdb_service,
87+
$open_postgres_port = $puppetdb::params::open_postgres_port,
88+
$manage_redhat_firewall = $puppetdb::params::manage_redhat_firewall,
89+
$confdir = $puppetdb::params::confdir
4790
) inherits puppetdb::params {
4891

92+
if ($manage_redhat_firewall) {
93+
notify {'Deprecation notice: `$manage_redhat_firewall` has been deprecated in `puppetdb` class and will be removed in a future versions. Use $open_ssl_listen_port and $open_postgres_port instead.':}
94+
}
95+
4996
class { 'puppetdb::server':
50-
database => $database,
51-
puppetdb_package => $puppetdb_package,
52-
puppetdb_version => $puppetdb_version,
53-
puppetdb_service => $puppetdb_service,
54-
confdir => $confdir,
55-
manage_redhat_firewall => $manage_redhat_firewall,
97+
listen_address => $listen_address,
98+
listen_port => $listen_port,
99+
open_listen_port => $open_listen_port,
100+
ssl_listen_address => $ssl_listen_address,
101+
ssl_listen_port => $ssl_listen_port,
102+
open_ssl_listen_port => $open_ssl_listen_port,
103+
database => $database,
104+
database_port => $database_port,
105+
database_username => $database_username,
106+
database_password => $database_password,
107+
database_name => $database_name,
108+
puppetdb_package => $puppetdb_package,
109+
puppetdb_version => $puppetdb_version,
110+
puppetdb_service => $puppetdb_service,
111+
manage_redhat_firewall => $manage_redhat_firewall,
112+
confdir => $confdir
56113
}
57114

58115
if ($database == 'postgres') {
59116
class { 'puppetdb::database::postgresql':
60-
manage_redhat_firewall => $manage_redhat_firewall,
117+
manage_redhat_firewall => $manage_redhat_firewall ? {
118+
true => $manage_redhat_firewall,
119+
false => $open_postgres_port,
120+
},
121+
listen_addresses => $postgres_listen_addresses,
61122
before => Class['puppetdb::server']
62123
}
63124
}

‎manifests/params.pp‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,16 @@
1111
# Sample Usage:
1212
#
1313
class puppetdb::params {
14-
$ssl_listen_address = $::clientcert
15-
$ssl_listen_port = '8081'
14+
$listen_address = 'localhost'
15+
$listen_port = '8080'
16+
$open_listen_port = false
17+
$ssl_listen_address = $::clientcert
18+
$ssl_listen_port = '8081'
19+
$open_ssl_listen_port = true
20+
$postgres_listen_addresses = 'localhost'
21+
$open_postgres_port = true
1622

17-
$database = 'postgres'
23+
$database = 'postgres'
1824

1925
# The remaining database settings are not used for an embedded database
2026
$database_host = 'localhost'
@@ -26,7 +32,7 @@
2632
$puppetdb_version = 'present'
2733

2834
# TODO: figure out a way to make this not platform-specific
29-
$manage_redhat_firewall = true
35+
$manage_redhat_firewall = false
3036

3137
$gc_interval = '60'
3238

‎manifests/server.pp‎

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,20 @@
2222
# use the `puppetdb::master::config` class to accomplish this.
2323
#
2424
# Parameters:
25+
# ['listen_address'] - The address that the web server should bind to
26+
# for HTTP requests. (defaults to `localhost`.)
27+
# Set to '0.0.0.0' to listen on all addresses.
28+
# ['listen_port'] - The port on which the puppetdb web server should
29+
# accept HTTP requests (defaults to 8080).
30+
# ['open_listen_port'] - If true, open the http listen port on the firewall.
31+
# (defaults to false).
2532
# ['ssl_listen_address'] - The address that the web server should bind to
2633
# for HTTPS requests. (defaults to `$::clientcert`.)
34+
# Set to '0.0.0.0' to listen on all addresses.
2735
# ['ssl_listen_port'] - The port on which the puppetdb web server should
28-
# accept HTTPS requests.
36+
# accept HTTPS requests (defaults to 8081).
37+
# ['open_ssl_listen_port'] - If true, open the ssl listen port on the firewall.
38+
# (defaults to true).
2939
# ['database'] - Which database backend to use; legal values are
3040
# `postgres` (default) or `embedded`. (The `embedded`
3141
# db can be used for very small installations or for
@@ -35,17 +45,20 @@
3545
# (defaults to `localhost`; ignored for `embedded` db)
3646
# ['database_port'] - The port that the database server listens on.
3747
# (defaults to `5432`; ignored for `embedded` db)
38-
# ['database_user'] - The name of the database user to connect as.
48+
# ['database_username'] - The name of the database user to connect as.
3949
# (defaults to `puppetdb`; ignored for `embedded` db)
4050
# ['database_password'] - The password for the database user.
4151
# (defaults to `puppetdb`; ignored for `embedded` db)
4252
# ['database_name'] - The name of the database instance to connect to.
4353
# (defaults to `puppetdb`; ignored for `embedded` db)
54+
# ['database_package'] - The puppetdb package name in the package manager
4455
# ['puppetdb_version'] - The version of the `puppetdb` package that should
4556
# be installed. You may specify an explicit version
4657
# number, 'present', or 'latest'. Defaults to
4758
# 'present'.
48-
# ['manage_redhat_firewall'] - boolean indicating whether or not the module
59+
# ['puppetdb_service'] - The name of the puppetdb service.
60+
# ['manage_redhat_firewall'] - DEPRECATED: Use open_ssl_listen_port instead.
61+
# boolean indicating whether or not the module
4962
# should open a port in the firewall on redhat-based
5063
# systems. Defaults to `true`. This parameter is
5164
# likely to change in future versions. Possible
@@ -68,8 +81,12 @@
6881
# }
6982
#
7083
class puppetdb::server(
84+
$listen_address = $puppetdb::params::listen_address,
85+
$listen_port = $puppetdb::params::listen_port,
86+
$open_listen_port = $puppetdb::params::open_listen_port,
7187
$ssl_listen_address = $puppetdb::params::ssl_listen_address,
7288
$ssl_listen_port = $puppetdb::params::ssl_listen_port,
89+
$open_ssl_listen_port = $puppetdb::params::open_ssl_listen_port,
7390
$database = $puppetdb::params::database,
7491
$database_host = $puppetdb::params::database_host,
7592
$database_port = $puppetdb::params::database_port,
@@ -81,7 +98,6 @@
8198
$puppetdb_service = $puppetdb::params::puppetdb_service,
8299
$manage_redhat_firewall = $puppetdb::params::manage_redhat_firewall,
83100
$confdir = $puppetdb::params::confdir,
84-
$gc_interval = $puppetdb::params::gc_interval,
85101
) inherits puppetdb::params {
86102

87103
package { $puppetdb_package:
@@ -90,8 +106,11 @@
90106
}
91107

92108
class { 'puppetdb::server::firewall':
93-
port => $ssl_listen_port,
94-
manage_redhat_firewall => $manage_redhat_firewall,
109+
http_port => $listen_port,
110+
open_http_port => $open_listen_port,
111+
ssl_port => $ssl_listen_port,
112+
open_ssl_port => $open_ssl_listen_port,
113+
manage_redhat_firewall => $manage_redhat_firewall
95114
}
96115

97116
class { 'puppetdb::server::database_ini':
@@ -106,6 +125,8 @@
106125
}
107126

108127
class { 'puppetdb::server::jetty_ini':
128+
listen_address => $listen_address,
129+
listen_port => $listen_port,
109130
ssl_listen_address => $ssl_listen_address,
110131
ssl_listen_port => $ssl_listen_port,
111132
confdir => $confdir,

‎manifests/server/firewall.pp‎

Lines changed: 41 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,23 @@
11
class puppetdb::server::firewall(
2-
$port = $puppetdb::params::ssl_listen_port,
2+
$port = '',
3+
$http_port = $puppetdb::params::listen_port,
4+
$open_http_port = $puppetdb::params::open_listen_port,
5+
$ssl_port = $puppetdb::params::ssl_listen_port,
6+
$open_ssl_port = $puppetdb::params::open_ssl_listen_port,
37
$manage_redhat_firewall = $puppetdb::params::manage_redhat_firewall,
48
) inherits puppetdb::params {
59
# TODO: figure out a way to make this not platform-specific; debian and ubuntu
610
# have an out-of-the-box firewall configuration that seems trickier to manage.
711
# TODO: the firewall module should be able to handle this itself
8-
if ($manage_redhat_firewall and $puppetdb::params::firewall_supported) {
12+
if ($puppetdb::params::firewall_supported) {
13+
14+
if ($manage_redhat_firewall) {
15+
notify {'Deprecation notice: `$manage_redhat_firewall` is deprecated in the `puppetdb::service::firewall` class and will be removed in a future version. Use `open_http_port` and `open_ssl_port` instead.':}
16+
17+
if ($open_ssl_port) {
18+
fail('`$manage_redhat_firewall` and `$open_ssl_port` cannot both be specified.')
19+
}
20+
}
921

1022
exec { 'puppetdb-persist-firewall':
1123
command => $puppetdb::params::persist_firewall_command,
@@ -15,11 +27,34 @@
1527
Firewall {
1628
notify => Exec['puppetdb-persist-firewall']
1729
}
30+
31+
if ($port) {
32+
notify { 'Deprecation notice: `port` parameter will be removed in future versions of the puppetdb module. Please use ssl_port instead.': }
33+
}
34+
35+
if ($port and $ssl_port) {
36+
fail('`port` and `ssl_port` cannot both be defined. `port` is deprecated in favor of `ssl_port`')
37+
}
38+
39+
if ($open_http_port) {
40+
firewall { "${http_port} accept - puppetdb":
41+
port => $http_port,
42+
proto => 'tcp',
43+
action => 'accept',
44+
}
45+
}
1846

19-
firewall { "${port} accept - puppetdb":
20-
port => $port,
21-
proto => 'tcp',
22-
action => 'accept',
47+
if ($open_ssl_port or $manage_redhat_firewall) {
48+
if ($ssl_port) {
49+
$final_ssl_port = $ssl_port
50+
} else {
51+
$final_ssl_port = $port
52+
}
53+
firewall { "${final_ssl_port} accept - puppetdb":
54+
port => $final_ssl_port,
55+
proto => 'tcp',
56+
action => 'accept',
57+
}
2358
}
2459
}
2560
}

‎manifests/server/jetty_ini.pp‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@
44
# for puppetdb's embedded web server.
55
#
66
# Parameters:
7+
# ['listen_address'] - The address that the web server should bind to
8+
# for HTTP requests. (defaults to `localhost`.)
9+
# ['listen_port'] - The port on which the puppetdb web server should
10+
# accept HTTP requests (defaults to 8080).
711
# ['ssl_listen_address'] - The address that the web server should bind to
812
# for HTTPS requests. (defaults to `$::clientcert`.)
913
# ['ssl_listen_port'] - The port on which the puppetdb web server should
@@ -25,9 +29,9 @@
2529
# ssl_listen_port => 8081,
2630
# }
2731
#
28-
#TODO add support for non-ssl config
29-
#
3032
class puppetdb::server::jetty_ini(
33+
$listen_address = $puppetdb::params::listen_address,
34+
$listen_port = $puppetdb::params::listen_port,
3135
$ssl_listen_address = $puppetdb::params::ssl_listen_address,
3236
$ssl_listen_port = $puppetdb::params::ssl_listen_port,
3337
$confdir = $puppetdb::params::confdir,
@@ -43,6 +47,16 @@
4347
# TODO: figure out some way to make sure that the ini_file module is installed,
4448
# because otherwise these will silently fail to do anything.
4549

50+
ini_setting {'puppetdb_host':
51+
setting => 'host',
52+
value => $listen_address,
53+
}
54+
55+
ini_setting {'puppetdb_port':
56+
setting => 'port',
57+
value => $listen_port,
58+
}
59+
4660
ini_setting {'puppetdb_sslhost':
4761
setting => 'ssl-host',
4862
value => $ssl_listen_address,

‎tests/puppetdb-postgres-distributed.pp‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,24 @@
1111
# This node is our postgres server
1212
node puppetdb-postgres {
1313
# Here we install and configure postgres and the puppetdb database instance
14+
# Optionally, open the firewall port for postgres so puppetdb server can
15+
# gain access.
1416
class { 'puppetdb::database::postgresql':
15-
listen_addresses => 'puppetdb-postgres',
17+
listen_addresses => 'puppetdb-postgres',
18+
manage_redhat_firewall => true,
1619
}
1720
}
1821

1922
# This node is our main puppetdb server
2023
node puppetdb {
2124
# Here we install and configure the puppetdb server, and tell it where to
2225
# find the postgres database.
26+
# Set open_ssl_listen_port to allow the puppet master to gain access to
27+
# puppetdb. Optionally, set open_listen_port to open the HTTP port so
28+
# you can access the PuppetDB dashboard.
2329
class { 'puppetdb::server':
24-
database_host => 'puppetdb-postgres',
30+
database_host => 'puppetdb-postgres',
31+
open_ssl_listen_port => true,
32+
open_listen_port => true,
2533
}
2634
}

0 commit comments

Comments
 (0)
⚡