Puppet Community #puppet

William Myers

10/20/2022, 9:56 PM

So nesting can't be done with a type?

glee

10/20/2022, 9:57 PM

assuming you're using saz-ssh - then ssh::server_options works because server_options is the parameter for the ssh class (ie: ssh::server_options is fully qualified in that case https://github.com/saz/puppet-ssh/blob/master/manifests/init.pp#L157)

glee

10/20/2022, 9:57 PM

assuming you're using saz-ssh - then ssh::server_options works because server_options is a parameter (ie: ssh::server_options is fully qualified in that case https://github.com/saz/puppet-ssh/blob/master/manifests/init.pp#L157)

Dr Bunsen Honeydew

10/20/2022, 9:57 PM

See the

saz-ssh

module at https://forge.puppet.com/saz/ssh?src=slack&channel=puppet

William Myers

10/20/2022, 9:57 PM

this code does seem to work in a module, in order to translate them to Hiera each value would need to be fully qualified?

Copy code

class { 'apache::mod::ssl':
    ssl_protocol         => ['all','-SSLv3','-TLSv1','-TLSv1.1'],
    ssl_cipher           => 'HIGH:!aNULL:!NULL:!MD5:!IDEA:!DES:!3DES:!RC4',
    ssl_honorcipherorder => true,
    ssl_compression      => false,
    ssl_sessiontickets   => false,
  }

glee

10/20/2022, 9:57 PM

William Myers

10/20/2022, 9:57 PM

yea, saz-ssh

Dr Bunsen Honeydew

10/20/2022, 9:57 PM

See the

saz-ssh

module at https://forge.puppet.com/saz/ssh?src=slack&channel=puppet

William Myers

10/20/2022, 9:58 PM

this code does seem to work in a module, in order to translate them to Hiera each value would need to be fully qualified?

Copy code

class { 'apache::mod::ssl':
    ssl_protocol         => ['all','-SSLv3','-TLSv1','-TLSv1.1'],
    ssl_cipher           => 'HIGH:!aNULL:!NULL:!MD5:!IDEA:!DES:!3DES:!RC4',
    ssl_honorcipherorder => true,
    ssl_compression      => false,
    ssl_sessiontickets   => false,
  }

kenyon

10/20/2022, 10:04 PM

look at how data structures in YAML translate to data structures in puppet, that will help hiera make more sense

glee

10/20/2022, 10:04 PM

that's the apache:mod:ssl class, so fully qualified would be

Copy code

apache::mod::ssl::ssl_protocol: ['all','-SSLv3','-TLSv1','-TLSv1.1']
apache::mod::ssl::ssl_cipher: 'HIGH:!aNULL:!NULL:!MD5:!IDEA:!DES:!3DES:!RC4'
apache::mod::ssl::ssl_honorcipherorder: true
apache::mod::ssl::ssl_compression: false,
apache::mod::ssl::ssl_sessiontickets: false

Slackbot

10/20/2022, 10:06 PM

This message was deleted.

William Myers

10/20/2022, 10:08 PM

My end goal is to convert this to Hiera with the exception of the exec commands at the end. I would then just assign the apache class to the node.

Copy code

# @summary A short summary of the purpose of this class
#
# A description of what this class does
#
# @example
#   include onfig_phpipam::harden_apache
class config_phpipam::harden_apache {
  # <https://github.com/puppetlabs/puppetlabs-apache/blob/main/REFERENCE.md>

    class { 'apache':
    mpm_module          => false,
    purge_configs       => false,
    default_vhost       => false,
    default_mods        => false,
    purge_vhost_dir     => true,

    # Misc config
    log_level         => 'info',
    servername        => $fqdn,
    # Security Configuration
    trace_enable      => 'Off',
    server_tokens     => 'ProductOnly',
    server_signature  => 'Off',
    root_directory_options => ['None'],
    root_directory_secured => true,
    limitreqfields    => 100,
    limitreqfieldsize => 1024,

  }
  
  class { 'apache::mod::ssl':
    ssl_protocol         => ['all','-SSLv3','-TLSv1','-TLSv1.1'],
    ssl_cipher           => 'HIGH:!aNULL:!NULL:!MD5:!IDEA:!DES:!3DES:!RC4',
    ssl_honorcipherorder => true,
    ssl_compression      => false,
    ssl_sessiontickets   => false,
  }
  # Install Modules
  class { 'apache::mod::alias': }
  class { 'apache::mod::auth_basic': }
  class { 'apache::mod::authn_file': }
  class { 'apache::mod::dav': }
  class { 'apache::mod::dav_fs': }
  class { 'apache::mod::deflate': }
  class { 'apache::mod::dir': }
  class { 'apache::mod::negotiation': }
  class { 'apache::mod::security': }
  class { 'apache::mod::setenvif': }
  class { 'apache::mod::rewrite': }
  class { 'apache::mod::reqtimeout': }

  apache::vhost { 'phpipam':
    docroot           => '/var/www/html/phpipam',
    error_log_file    => '/var/log/apache2/phpipam-error_log',
    access_log_file   => '/var/log/apache2/phpipam-access_log',
    port              => 80,
    ssl               => false,
    serveradmin       => '<mailto:webmaster@britanniahome.net|webmaster@britanniahome.net>',
    servername        => '<http://ipam.britanniahome.net|ipam.britanniahome.net>',
    serveraliases     => $fqdn,
    override          => ['all'],
    limitreqline      => 512,
    limitreqbody      => 102400,
    directories       => [
      { 'path'          => '/var/www/html/phpipam',
        options         => ['Indexes','FollowSymLinks'],
        allow_override  => ['All'],
      },  
    ],
    rewrites           => [
      { 
        comment     => 'Restrict IP-Based Requests',
        rewrite_cond => ['%{HTTP_HOST} !^<http://ipam.britanniahome.net|ipam.britanniahome.net> [NC]','%{REQUEST_URI} !^/error [NC]'],
        rewrite_rule => ['^.(.*) - [L,F]'],
      },
    ],
  }

  # disable status module
  exec { 'a2dismod status':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/status.load',
  }
    # disable status module
  exec { 'a2dismod autoindex -f':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/autoindex.load',
  }
}

William Myers

10/20/2022, 10:09 PM

My end goal is to convert this to Hiera with the exception os the exec commands at the end.

Copy code

# @summary A short summary of the purpose of this class
#
# A description of what this class does
#
# @example
#   include onfig_phpipam::harden_apache
class config_phpipam::harden_apache {
  # <https://github.com/puppetlabs/puppetlabs-apache/blob/main/REFERENCE.md>

    class { 'apache':
    mpm_module          => false,
    purge_configs       => false,
    default_vhost       => false,
    default_mods        => false,
    purge_vhost_dir     => true,

    # Misc config
    log_level         => 'info',
    servername        => $fqdn,
    # Security Configuration
    trace_enable      => 'Off',
    server_tokens     => 'ProductOnly',
    server_signature  => 'Off',
    root_directory_options => ['None'],
    root_directory_secured => true,
    limitreqfields    => 100,
    limitreqfieldsize => 1024,

  }
  
  class { 'apache::mod::ssl':
    ssl_protocol         => ['all','-SSLv3','-TLSv1','-TLSv1.1'],
    ssl_cipher           => 'HIGH:!aNULL:!NULL:!MD5:!IDEA:!DES:!3DES:!RC4',
    ssl_honorcipherorder => true,
    ssl_compression      => false,
    ssl_sessiontickets   => false,
  }
  # Install Modules
  class { 'apache::mod::alias': }
  class { 'apache::mod::auth_basic': }
  class { 'apache::mod::authn_file': }
  class { 'apache::mod::dav': }
  class { 'apache::mod::dav_fs': }
  class { 'apache::mod::deflate': }
  class { 'apache::mod::dir': }
  class { 'apache::mod::negotiation': }
  class { 'apache::mod::security': }
  class { 'apache::mod::setenvif': }
  class { 'apache::mod::rewrite': }
  class { 'apache::mod::reqtimeout': }

  apache::vhost { 'phpipam':
    docroot           => '/var/www/html/phpipam',
    error_log_file    => '/var/log/apache2/phpipam-error_log',
    access_log_file   => '/var/log/apache2/phpipam-access_log',
    port              => 80,
    ssl               => false,
    serveradmin       => '<mailto:webmaster@britanniahome.net|webmaster@britanniahome.net>',
    servername        => '<http://ipam.britanniahome.net|ipam.britanniahome.net>',
    serveraliases     => $fqdn,
    override          => ['all'],
    limitreqline      => 512,
    limitreqbody      => 102400,
    directories       => [
      { 'path'          => '/var/www/html/phpipam',
        options         => ['Indexes','FollowSymLinks'],
        allow_override  => ['All'],
      },  
    ],
    rewrites           => [
      { 
        comment     => 'Restrict IP-Based Requests',
        rewrite_cond => ['%{HTTP_HOST} !^<http://ipam.britanniahome.net|ipam.britanniahome.net> [NC]','%{REQUEST_URI} !^/error [NC]'],
        rewrite_rule => ['^.(.*) - [L,F]'],
      },
    ],
  }

  # disable status module
  exec { 'a2dismod status':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/status.load',
  }
    # disable status module
  exec { 'a2dismod autoindex -f':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/autoindex.load',
  }
}

William Myers

10/20/2022, 10:09 PM

My end goal is to convert this to Hiera with the exception of the exec commands at the end.

Copy code

# @summary A short summary of the purpose of this class
#
# A description of what this class does
#
# @example
#   include onfig_phpipam::harden_apache
class config_phpipam::harden_apache {
  # <https://github.com/puppetlabs/puppetlabs-apache/blob/main/REFERENCE.md>

    class { 'apache':
    mpm_module          => false,
    purge_configs       => false,
    default_vhost       => false,
    default_mods        => false,
    purge_vhost_dir     => true,

    # Misc config
    log_level         => 'info',
    servername        => $fqdn,
    # Security Configuration
    trace_enable      => 'Off',
    server_tokens     => 'ProductOnly',
    server_signature  => 'Off',
    root_directory_options => ['None'],
    root_directory_secured => true,
    limitreqfields    => 100,
    limitreqfieldsize => 1024,

  }
  
  class { 'apache::mod::ssl':
    ssl_protocol         => ['all','-SSLv3','-TLSv1','-TLSv1.1'],
    ssl_cipher           => 'HIGH:!aNULL:!NULL:!MD5:!IDEA:!DES:!3DES:!RC4',
    ssl_honorcipherorder => true,
    ssl_compression      => false,
    ssl_sessiontickets   => false,
  }
  # Install Modules
  class { 'apache::mod::alias': }
  class { 'apache::mod::auth_basic': }
  class { 'apache::mod::authn_file': }
  class { 'apache::mod::dav': }
  class { 'apache::mod::dav_fs': }
  class { 'apache::mod::deflate': }
  class { 'apache::mod::dir': }
  class { 'apache::mod::negotiation': }
  class { 'apache::mod::security': }
  class { 'apache::mod::setenvif': }
  class { 'apache::mod::rewrite': }
  class { 'apache::mod::reqtimeout': }

  apache::vhost { 'phpipam':
    docroot           => '/var/www/html/phpipam',
    error_log_file    => '/var/log/apache2/phpipam-error_log',
    access_log_file   => '/var/log/apache2/phpipam-access_log',
    port              => 80,
    ssl               => false,
    serveradmin       => '<mailto:webmaster@britanniahome.net|webmaster@britanniahome.net>',
    servername        => '<http://ipam.britanniahome.net|ipam.britanniahome.net>',
    serveraliases     => $fqdn,
    override          => ['all'],
    limitreqline      => 512,
    limitreqbody      => 102400,
    directories       => [
      { 'path'          => '/var/www/html/phpipam',
        options         => ['Indexes','FollowSymLinks'],
        allow_override  => ['All'],
      },  
    ],
    rewrites           => [
      { 
        comment     => 'Restrict IP-Based Requests',
        rewrite_cond => ['%{HTTP_HOST} !^<http://ipam.britanniahome.net|ipam.britanniahome.net> [NC]','%{REQUEST_URI} !^/error [NC]'],
        rewrite_rule => ['^.(.*) - [L,F]'],
      },
    ],
  }

  # disable status module
  exec { 'a2dismod status':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/status.load',
  }
    # disable status module
  exec { 'a2dismod autoindex -f':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/autoindex.load',
  }
}

William Myers

10/20/2022, 10:10 PM

My end goal is to convert this to Hiera with the exception of the exec commands at the end. I would then just assign the apache class to the node.

Copy code

# @summary A short summary of the purpose of this class
#
# A description of what this class does
#
# @example
#   include onfig_phpipam::harden_apache
class config_phpipam::harden_apache {
  # <https://github.com/puppetlabs/puppetlabs-apache/blob/main/REFERENCE.md>

    class { 'apache':
    mpm_module          => false,
    purge_configs       => false,
    default_vhost       => false,
    default_mods        => false,
    purge_vhost_dir     => true,

    # Misc config
    log_level         => 'info',
    servername        => $fqdn,
    # Security Configuration
    trace_enable      => 'Off',
    server_tokens     => 'ProductOnly',
    server_signature  => 'Off',
    root_directory_options => ['None'],
    root_directory_secured => true,
    limitreqfields    => 100,
    limitreqfieldsize => 1024,

  }
  
  class { 'apache::mod::ssl':
    ssl_protocol         => ['all','-SSLv3','-TLSv1','-TLSv1.1'],
    ssl_cipher           => 'HIGH:!aNULL:!NULL:!MD5:!IDEA:!DES:!3DES:!RC4',
    ssl_honorcipherorder => true,
    ssl_compression      => false,
    ssl_sessiontickets   => false,
  }
  # Install Modules
  class { 'apache::mod::alias': }
  class { 'apache::mod::auth_basic': }
  class { 'apache::mod::authn_file': }
  class { 'apache::mod::dav': }
  class { 'apache::mod::dav_fs': }
  class { 'apache::mod::deflate': }
  class { 'apache::mod::dir': }
  class { 'apache::mod::negotiation': }
  class { 'apache::mod::security': }
  class { 'apache::mod::setenvif': }
  class { 'apache::mod::rewrite': }
  class { 'apache::mod::reqtimeout': }

  apache::vhost { 'phpipam':
    docroot           => '/var/www/html/phpipam',
    error_log_file    => '/var/log/apache2/phpipam-error_log',
    access_log_file   => '/var/log/apache2/phpipam-access_log',
    port              => 80,
    ssl               => false,
    serveradmin       => '<mailto:webmaster@britanniahome.net|webmaster@britanniahome.net>',
    servername        => '<http://ipam.britanniahome.net|ipam.britanniahome.net>',
    serveraliases     => $fqdn,
    override          => ['all'],
    limitreqline      => 512,
    limitreqbody      => 102400,
    directories       => [
      { 'path'          => '/var/www/html/phpipam',
        options         => ['Indexes','FollowSymLinks'],
        allow_override  => ['All'],
      },  
    ],
    rewrites           => [
      { 
        comment     => 'Restrict IP-Based Requests',
        rewrite_cond => ['%{HTTP_HOST} !^<http://ipam.britanniahome.net|ipam.britanniahome.net> [NC]','%{REQUEST_URI} !^/error [NC]'],
        rewrite_rule => ['^.(.*) - [L,F]'],
      },
    ],
  }

  # disable status module
  exec { 'a2dismod status':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/status.load',
  }
    # disable status module
  exec { 'a2dismod autoindex -f':
    path     => '/usr/bin:/usr/sbin:/bin',
    provider => shell,
    onlyif   => 'test -f /etc/apache2/mods-enabled/autoindex.load',
  }
}

whatsaranjit

10/20/2022, 10:31 PM

This is a good place to get started: https://puppet.com/docs/puppet/7/hiera.html

Slackbot

10/21/2022, 1:05 AM

This message was deleted.

kenyon

10/21/2022, 2:39 AM

that doesn't look like the real reason. probably those other errors. probably need to look at the full report it points to.

Yorokobi

10/21/2022, 2:46 AM

Good point. I added it as a comment to the gist

Slackbot

10/21/2022, 10:51 AM

This message was deleted.

helindbe

10/21/2022, 10:59 AM

i.e. just

alias

instead of `lookup`in the interpolation

Ganaparthi Nikhil

10/21/2022, 12:53 PM

Hi team ,

Slackbot

10/21/2022, 12:53 PM

This message was deleted.

Joel Wilson

10/21/2022, 1:22 PM

Right. I just think that minor profile parameter switches can be used to alter their behavior slightly at the role level, so I don’t particularly mind bending that rule a bit, even though it’s a minor anti-pattern from what is in the docs

Yorokobi

10/21/2022, 2:23 PM

Whilst troubleshooting Puppet server start failures on a new system, I discovered that this error

Copy code

"Execution error (RuntimeError) at RUBY/<main> (/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/feature/base.rb:19).\n(Error) Cannot determine basic system flavour\n",

can be caused by setting

noexec

on /tmp. This is a no-no for CIS-compliant systems. Is there any effort to move execution from /tmp to /var/tmp ?

vchepkov

10/21/2022, 2:27 PM

PE sets

JAVA_ARGS="-<http://Djava.io|Djava.io>.tmpdir=/opt/puppetlabs/server/apps/puppetserver/tmp"

Yorokobi

10/21/2022, 2:33 PM

OSS Puppet doesn't seem to like that (yes, I created the tmpdir).

Lumiere

10/21/2022, 2:34 PM

that does work, you just have to make sure that the ownership/group on it works

Lumiere

10/21/2022, 2:34 PM

(the java arg thing)