I'll update it.

The problem is that you're missing the

>

or

|

character after the yaml key's name.

There are examples of how to do multiline encrypted yaml here: https://github.com/voxpupuli/hiera-eyaml#encrypting-multiline-valueshttps://github.com/voxpupuli/hiera-eyaml#encrypting-multiline-values

Yeah, I've tried multiple permutations of those examples but I'm still getting unwanted indentation. I'm trying more stuff and will report back if I have success.

I'd try starting from scratch, with just the private key file on disk formatted exactly how you expect. Then:

eyaml encrypt -f <private_key>

Copy the the output that uses the multi line syntax, then paste that into your Hiera data file, in a key that uses the

>

character. Put the encrypted contents on a new line, after the

>

, indenting by 2 spaces. For example:

---
private_key_file: >
  ENC[PKCS7,MIIDTQYJKoZIhvcNAQcDoIIDPjCCAzoCAQAxggEhMIIBHQIBADAFMAACAQEw
  DQYJKoZIhvcNAQEBBQAEggEAXH7xB1xuzoMAqA/3jSXO0ZUR6+UCb3DsTTj3
  Lsrcx5oQBnJ/ml7GfBCPxBKfArZunLcnxmSk4hECKXdfgKsVjAa++JQWvtEm
  HUNTFqvwd76Ku+nMfI9c8g+X+l6obLjzWfJdg3t6Ja7CJKl8UNFtSmbfYKVi]

lsrcx5oqbnj/ml7gfbcpxbkfarzunlcnxmsk4heckxdfgksvjaa is on the rise! (Karma: 1)

```- took a dive. (Karma: -96)

I'd try starting from scratch, with just the private key file on disk formatted exactly how you expect. Then:

eyaml encrypt -f <private_key>

Copy the the output that uses the multi line syntax, then paste that into your Hiera data file, in a key that uses the

>

character. Put the encrypted contents on a new line, after the

>

, indenting by 2 spaces. For example:

---
private_key_file: >
  ENC[PKCS7,MIIDTQYJKoZIhvcNAQcDoIIDPjCCAzoCAQAxggEhMIIBHQIBADAFMAACAQEw
  DQYJKoZIhvcNAQEBBQAEggEAXH7xB1xuzoMAqA/3jSXO0ZUR6+UCb3DsTTj3
  Lsrcx5oQBnJ/ml7GfBCPxBKfArZunLcnxmSk4hECKXdfgKsVjAa++JQWvtEm
  HUNTFqvwd76Ku+nMfI9c8g+X+l6obLjzWfJdg3t6Ja7CJKl8UNFtSmbfYKVi]

Yep, I just did that. The resulting unencrypted yaml has some strange formatting. Openssl is complaining about the "BEGIN PRIVATE KEY" and "END PRIVATE KEY" stuff being indented. I'll try to eyaml encrypt just that stuff instead of the entire file.

how are you getting the data intoi something? because it should just be a file content =>

This message was deleted.

the strange formatting reminds me of https://github.com/voxpupuli/hiera-eyaml/issues/219

the strange formatting sounds like https://github.com/voxpupuli/hiera-eyaml/issues/219

the strange formatting reminds me of https://github.com/voxpupuli/hiera-eyaml/issues/219

This message was deleted.

@vchepkov thank you for your suggestion, you mean I should create the systemd timer via puppet ?

Hi all, before i could do something like:

puppet apply test.pp --ordering random

why i cannot do that with the new version? does anyone know how can I do that with new version ?

puppet apply --help | less

doesnt help my alot. puppet version is 7.21.0. thank you all

Are there any plans for Ubuntu 22 puppetserver packages? https://tickets.puppetlabs.com/browse/SERVER-3193

This message was deleted.

Revisiting this from a different perspective. What about putting 2+ CA servers behind a HAProxy configured in active/passive mode? Alternatively, what if I create additional SRV records (with different weights/priorities) for the CA servers? The CA servers would use a shared filesystem to store the CA related files. The objective here is to avoid a situation where CA requests from two agents get routed to different CAs at the same time.

I would go with https://github.com/fervidus/puppet_ca_utils or sync the CA files between to systems, but I wouldn't use a shared filesystem. that adds a lot of complexity but you don't gain much from it

kermit typing 🧑‍🏫Puppet Forge is about to start up in #CFD8Z9A4T

This message was deleted.

This message was deleted.

also check https://github.com/mrwilson/mrwilson-multipkg

This message was deleted.

dumb question, and i'm sure the answer is already out there and google is just being stupid today ... when configuring a service like apache/nginx, you need to do a "restart" when the service's config files change, but when the SSL key/cert files are updated you can do a restart, but should do a "reload" in order to not "hang up on" existing long-lived client connections ... the only two ways i've found to deal with this are (1) restart anyway, causing a flood of re-connects (the clients each have a long-lived websocket connection) and (2) an ugly hack involving an exec that usually works but not always, and which i'd like to get rid of, partly because if both the config and the SSL key/cert are updated at the same time, it restarts the service and then runs the exec ... can somebody point me to an example of a better way to handle this? at the very least, a way to "only run the exec if the service isn't also being told to restart"?

I think you can provide restart command to the service, which will reload it , instead of restarting

that's what i'm doing in the

exec

... the puppet language has the

notify

meta-parameter which makes the resource (1) "execute" before the target, and (2) send a "restart" signal to the target if the resource was updated ... is there something like this, but which sends a "reload" signal instead?

Does your init script have a reload option? Puppet talks directly to the init system