Thursday, April 9, 2015

Build a Puppet Master on CentOS 7 -- Hella Quick-Style

I build Puppet environments all the time, which means I need to set up Puppet Masters all the time.  Here's what I do to get a Master (with PuppetDB) running on CentOS 7 "hella quick-style."

Build a CentOS 7 machine and set its hostname. I'm going to call mine "kermit.localdomain."

hostnamectl set-hostname kermit.localdomain

Then add the official PuppetLabs yum repo to the system's sources.

rpm -ivh http://yum.puppetlabs.com/puppetlabs-release-el-7.noarch.rpm

Now yum can install the Puppet Master for you.

yum -y install puppet-server

The easiest way to generate the Master's SSL keypair and self-sign its certificate is to just start up the Master in the foreground and then control-C out of it once it's done the SSL bits. (There must be a more elegant way to do this.)

puppet master --verbose --no-daemonize
[Ctrl-C]

Aim the Master's own Agent at itself. The last stanza in a stock Puppet install's puppet.conf is the [agent] section, so we can get away with just appending to it. (Again, using "kermit" in this example.)

echo 'server = kermit.localdomain' >> /etc/puppet/puppet.conf

Add a [master] stanza to the puppet.conf file. On a stock install, it's safe to just append to the file.

cat >> /etc/puppet/puppet.conf <<EOF
[master]
    environmentpath = \$confdir/environments
    basemodulepath = /etc/puppet/modules
    reports = store,log,puppetdb
    storeconfigs = true
    storeconfigs_backend = puppetdb
EOF


The Master won't start without a production environment, so make an empty one.

mkdir -p /etc/puppet/environments/production/{modules,manifests}
echo 'node default {}' > /etc/puppet/environments/production/manifests/site.pp

Install PuppetDB.

yum -y install puppetdb puppetdb-terminus openssl

Configure PuppetDB. (Calling the machine "kermit," like before.)

cat > /etc/puppet/puppetdb.conf <<EOF
[main]
    server = kermit.localdomain
    port = 8081
EOF

And set up PuppetDB as a terminus.

cat > /etc/puppet/routes.yaml <<EOF
---
master:
  facts:
    terminus: puppetdb
    cache: yaml
EOF

Copy the package-supplied Hiera configuration file to a place where the Master can find it. You'll likely need to update the 'datadir' and your hierarchy later, but for now the stock one is fine.

cp /etc/hiera.yaml /etc/puppet/hiera.yaml

Set up firewalld with a rule for Puppet traffic on port 8140.

cat > /etc/firewalld/services/puppetmaster.xml <<EOF
<?xml version="1.0" encoding="utf-8"?>
  <service>
    <short>puppetmaster</short>
    <description>Puppet Master</description>
    <port protocol="tcp" port="8140"/>
  </service>
EOF

Tell firewalld to use the rule.

firewall-cmd --permanent --add-service=puppetmaster   # may take two tries
firewall-cmd --reload

And finally, start up all the pieces.

puppet resource service puppetdb ensure=running enable=true
puppet resource service puppetmaster ensure=running enable=true
puppet resource service puppet ensure=running enable=true

That's it! If you have to troubleshoot, tail /var/log/messages for clues. Remember, you can kick off Puppet runs manually with `puppet agent -t` to see what's going on during a run.

Tuesday, July 29, 2014

Right Turn on Red?

Okay, so I drive in lots of different places.  I figured I'd better get a grip on which states allow you to turn right at a red light after stopping.  (Little known fact: in California, "stop" is an acronym.  It stands for "softly touch other pedal.")

The Wikipedia article on the subject is, well, a festival of "citation needed" requests.  So I wandered around a little to try to sort it out.

It looks like it's a Federal guideline.  Maybe.  It actually might be just a recommendation of the National Committee on Uniform Traffic Laws and Ordinances.  Their idea was that you should be able to expect similar driving laws in all the states of the union.  (Think base speed limit, dui, dwb, &c.)  If you collect antiques, you're in luck, their website says "Copyright 1997."  Take that, time travel naysayers!

Ostensibly, it's for fuel economy, and seems to've been promoted in the late seventies when the US was enjoying an early beta-test of the Manufactured Fuel Shortage(tm) system.  You don't want cars idling at a red light if they can safely proceed through the intersection and down to a nearby gas station.  Feed the beast.

The exception?  The five boroughs of New York.  Which means New Jersey wishes they had the same thing, but just can't manage to pull it off in a cheap-but-still-classy way.  Anywhere else though, you're probably fine unless otherwise posted.  Clever tip from a site's comments: stay stopped at the red light, and if the person behind you honks, it's legal to turn there.

Thursday, May 1, 2014

Polyglot Shoe Money

I run in so many interesting cities now, and my intended routes don't always match up with reality.  So, I keep a twenty dollar bill under the insole of one of my shoes.  If I get completely lost, I'm hailing a cab.  I've done the math; my running distance is within twenty bucks, including tip.

But here's what happens when I go running through three nations.  I've got twenty dollar bills from the US, New Zealand, and Australia all in there.  I won't remember to swap them around each time I cross a border, so I figure I'd better keep all three for these two months in the southern hemisphere.

True story; funny story.  This is actually a brand new pair of shoes.    I left my old pair on top of a recycling bin in San Francisco.  They've still got some life as normal shoes, even if all the spring has gone out of them for running.  Well, as I was stuffing the stack of twenties into my new pair, I realized I left the twenty in my old pair.

I wonder if the next wearer will ever find it.

Friday, November 1, 2013

The "C21 Pentagram" Photo Filter

Click for the Flickr set.
My photos of the Space Needle just came back and the Kodak Vest Pocket has once again opened a portal back in time.  The Space Needle was built for the 1962 "Century 21" world's fair, by the "Pentagram Corporation."  When the digital crowd asks what filter I used to get the effect, I'm going to tell them it's called "C21 Pentagram."