概要

之前做过 apache + passenger 作为 puppetmaster 前端的实验,

这次试试由 nginx + passenger 来作为 puppetmaster 的前端.

nginx + passenger 配置

package 安装

虽然debian 上有 puppetmaster-passenger 这个包, 但是它是针对 apache 服务器的,

安装这个包会顺带把 apache 也安装上, 然后passenger的配置都是在 apache 中.

所以, 我们通过 gem 的方式来安装 passenger,

root@master-2:~# gem install rake rack passenger --no-rdoc --no-riSuccessfully installed rake-10.4.2Successfully installed rack-1.6.0Fetching: passenger-4.0.57.gem (100%)Building native extensions.  This could take a while...Successfully installed passenger-4.0.573 gems installed

安装完成之后, nginx 不能直接从 apt-get 的源来安装, 但是可以用下面的命令来安装,

这样安装的 nginx 中就包含了 passenger 模块.

root@master-2:~# passenger-install-nginx-module# 根据提示完成安装, 中途可能会提示用 apt-get 安装一些缺失的包.# 安装完缺失的包后, 再次执行 passenger-install-nginx-module 即可.# 安装 nginx 之前, 会有如下选择Do you want this installer to download, compile and install Nginx for you? 1. Yes: download, compile and install Nginx for me. (recommended)    The easiest way to get started. A stock Nginx 1.6.2 with Passenger    support, but with no other additional third party modules, will be    installed for you to a directory of your choice. 2. No: I want to customize my Nginx installation. (for advanced users)    Choose this if you want to compile Nginx with more third party modules    besides Passenger, or if you need to pass additional options to Nginx's    'configure' script. This installer will  1) ask you for the location of    the Nginx source code,  2) run the 'configure' script according to your    instructions, and  3) run 'make install'.Whichever you choose, if you already have an existing Nginx configuration file,then it will be preserved.Enter your choice (1 or 2) or press Ctrl-C to abort: 1# 根据情况, 如果熟悉的话, 可以选择2, 否则选择1 即可自动编译安装 nginx

配置文件设置

nginx 配置文件 nginx.conf

root@master-1:~# cat /opt/nginx/conf/nginx.conf#user  nobody;worker_processes  1;#error_log  logs/error.log;#error_log  logs/error.log  notice;#error_log  logs/error.log  info;#pid        logs/nginx.pid;events {    worker_connections  1024;}http {    passenger_root /var/lib/gems/1.9.1/gems/passenger-4.0.57;    passenger_ruby /usr/bin/ruby1.9.1;    include       mime.types;    default_type  application/octet-stream;    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '    #                  '$status $body_bytes_sent "$http_referer" '    #                  '"$http_user_agent" "$http_x_forwarded_for"';    #access_log  logs/access.log  main;    sendfile        on;    #tcp_nopush     on;    #keepalive_timeout  0;    keepalive_timeout  65;    #gzip  on;    include /etc/nginx/conf.d/*.conf;    server {        listen       80;        server_name  localhost;        #charset koi8-r;        #access_log  logs/host.access.log  main;        location / {            root   html;            index  index.html index.htm;        }        #error_page  404              /404.html;        # redirect server error pages to the static page /50x.html        #        error_page   500 502 503 504  /50x.html;        location = /50x.html {            root   html;        }    }}

nginx中作为puppet前端的配置.

root@master-1:~# cat /etc/nginx/conf.d/puppet.confserver {  listen                     8140 ssl;  server_name                master-1 master-1.puppet.com;  passenger_enabled          on;  passenger_set_cgi_param    HTTP_X_CLIENT_DN $ssl_client_s_dn;  passenger_set_cgi_param    HTTP_X_CLIENT_VERIFY $ssl_client_verify;  access_log                 /var/log/nginx/puppet_access.log;  error_log                  /var/log/nginx/puppet_error.log;  root                       /usr/share/puppet/rack/puppetmasterd/public;  ssl_certificate            /var/lib/puppet/ssl/certs/master-1.puppet.com.pem;  ssl_certificate_key        /var/lib/puppet/ssl/private_keys/master-1.puppet.com.pem;  ssl_crl                    /var/lib/puppet/ssl/ca/ca_crl.pem;  ssl_client_certificate     /var/lib/puppet/ssl/certs/ca.pem;  ssl_ciphers                SSLv2:-LOW:-EXPORT:RC4+RSA;  ssl_prefer_server_ciphers  on;  ssl_verify_client          optional;  ssl_verify_depth           1;  ssl_session_cache          shared:SSL:128m;  ssl_session_timeout        5m;}

测试配置结果

# 上面的配置完成后, master 上重启 nginx 服务root@master-2:~# /opt/nginx/sbin/nginx -s reload# agent 上允许测试, 查看是否连通root@node-1:~# rm -rf /var/lib/puppet/ssl/*root@node-1:~# puppet agent  -tInfo: Creating a new SSL key for node-1.puppet.comInfo: Caching certificate for caInfo: csr_attributes file loading from /etc/puppet/csr_attributes.yamlInfo: Creating a new SSL certificate request for node-1.puppet.comInfo: Certificate Request fingerprint (SHA256): 7E:F9:4A:EA:B1:BE:A4:0B:33:1D:55:44:9B:4C:83:8D:74:49:25:0E:8B:A2:80:23:D0:6B:A5:0D:FB:E4:6F:07Info: Caching certificate for caExiting; no certificate found and waitforcert is disabled# master 上许可证书root@master-2:~# puppet cert list --all  "node-1.puppet.com"   (SHA256) 7E:F9:4A:EA:B1:BE:A4:0B:33:1D:55:44:9B:4C:83:8D:74:49:25:0E:8B:A2:80:23:D0:6B:A5:0D:FB:E4:6F:07+ "master-2.puppet.com" (SHA256) 86:12:B9:BE:B2:2C:26:B2:15:FE:07:11:A1:ED:E5:BC:95:0C:8F:D1:8B:E6:40:FB:C5:0D:D6:DD:F6:DC:ED:00root@master-2:~# puppet cert sign node-1.puppet.comNotice: Signed certificate request for node-1.puppet.comNotice: Removing file Puppet::SSL::CertificateRequest node-1.puppet.com at '/var/lib/puppet/ssl/ca/requests/node-1.puppet.com.pem'root@master-2:~# puppet cert list --all+ "master-2.puppet.com" (SHA256) 86:12:B9:BE:B2:2C:26:B2:15:FE:07:11:A1:ED:E5:BC:95:0C:8F:D1:8B:E6:40:FB:C5:0D:D6:DD:F6:DC:ED:00+ "node-1.puppet.com"   (SHA256) 8C:EA:3E:05:A0:90:D4:89:75:B6:9A:A8:55:BC:48:F8:C3:E8:60:D9:E0:51:9A:3F:E6:49:FE:B5:EA:1B:05:F3# agent 再次测试, 可以正常连接 master 了root@node-1:~# puppet agent  -tInfo: Caching certificate for node-1.puppet.comInfo: Caching certificate_revocation_list for caInfo: Caching certificate for node-1.puppet.comInfo: Retrieving pluginfactsInfo: Retrieving pluginInfo: Caching catalog for node-1.puppet.comInfo: Applying configuration version '1420875451'Notice: Finished catalog run in 0.02 seconds