So you’re having trouble getting started with Puppet, eh? I had a beast of a time with that too - getting a working practical configuration took some doing. Allow me to share my bare-bones apache setup with you. It consists of a simple Puppet module, plus a single manifest which I call directly with puppet apply
First, context. I have a single production Ubuntu server, which I more or less, sort of, mirror on my dev box. Recently I realized that my internal wiki posting of disaster recovery instructions was sorely out of date, and went about rewriting it, checking each step on a clean Ubuntu VM. Then I said, hey, I’m manually recreating this whole installation… maybe I can just rig up Puppet (which I’d heard about at a conference last year) to do it automatically! I get an added benefit if I do it TDD-style, and change config via the Puppet modules; then I don’t have random undocumented tweaks to configuration that are lost in the event of a disaster, or inadvertent deletion. Plus the automatic benefit of easily trickling changes down to dev and testing environments.
First, the module. I set up a puppet directory in my home directory on the clean testing install, with this tree:
yitznewton@syslib-restore:~/puppet$ tree .
.
├── modules
│ └── apache2
│ ├── files
│ │ ├── startssl.ca.pem
│ │ ├── startssl.sub.class2.server.ca.pem
│ │ ├── tuning.conf
│ │ ├── wildcard.mydomain.org.crt
│ │ └── wildcard.mydomain.org.key
│ ├── manifests
│ │ └── init.pp
│ └── templates
│ └── httpd.conf.erb
└── server.pp
The files directory includes some ssl certs and server-specific tuning settings for Apache. The main files are init.pp:
class apache2 {
package { 'apache2':
ensure => present,
}
service { 'apache2':
ensure => running,
enable => true,
hasrestart => true,
hasstatus => false,
}
file {
'/etc/apache2/tuning.conf':
owner => root,
group => root,
mode => 644,
require => Package[apache2],
source => "modules/apache2/tuning.conf",
replace => false,
notify => Service[apache2];
'/etc/apache2/httpd.conf':
owner => root,
group => root,
mode => 644,
require => Package[apache2],
content => template("apache2/httpd.conf.erb"),
replace => true,
notify => Service[apache2];
'/etc/apache2/ssl':
ensure => directory,
owner => www-data,
group => root,
mode => 600;
'/etc/apache2/ssl/wildcard.mydomain.org.crt':
owner => www-data,
group => root,
mode => 600,
source => 'modules/apache2/wildcard.mydomain.org.crt';
'/etc/apache2/ssl/wildcard.mydomain.org.key':
owner => www-data,
group => root,
mode => 600,
source => 'modules/apache2/wildcard.mydomain.org.key';
'/etc/apache2/ssl/startssl.ca.pem':
owner => www-data,
group => root,
mode => 600,
source => 'modules/apache2/startssl.ca.pem';
'/etc/apache2/ssl/startssl.sub.class2.server.ca.pem':
owner => www-data,
group => root,
mode => 600,
source => 'modules/apache2/startssl.sub.class2.server.ca.pem';
}
}
and httpd.conf.erb:
Include /etc/apache2/tuning.conf
NameVirtualHost <%= ip %>:80
NameVirtualHost <%= ip %>:443
ServerName www.<%= mydomain %>
SetEnv LD_LIBRARY_PATH /usr/lib
ServerAdmin yitznewton@mydomain.org
ErrorLog "|/usr/sbin/rotatelogs /www/logs/errorlog.%Y-%m-%d 5M"
#BrowserMatch ".*MSIE.*" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
<Directory />
Options -ExecCGI -Indexes +FollowSymLinks
AllowOverride none
Order deny,allow
Deny from all
</Directory>
# This is the catch-all to redirect traffic that's not
# covered by one of the other active vhosts
<VirtualHost <%= ip %>:80>
ServerName default.<%= mydomain %>
CustomLog "|/usr/sbin/rotatelogs /www/logs/accesslog.%Y-%m-%d 86400" combined
RewriteEngine On
RewriteRule .* http://www.<%= mydomain %>/ [R=307,L]
</VirtualHost>
Then I just call the module in server.pp:
$ip = '192.168.65.180'
$mydomain = 'mydomain.org'
include apache2
and invoke it with sudo puppet apply server.pp --modulepath=modules
Huzzah!
