This module provides a "standard library" of resources for developing Puppet\nModules. This modules will include the following additions to Puppet
\n\nThis module is officially curated and provided by Puppet Labs. The modules\nPuppet Labs writes and distributes will make heavy use of this standard\nlibrary.
\n\nTo report or research a bug with any part of this module, please go to\nhttp://projects.puppetlabs.com/projects/stdlib
\n\nThis module follows semver.org (v1.0.0) versioning guidelines. The standard\nlibrary module is released as part of Puppet\nEnterprise and as a result\nolder versions of Puppet Enterprise that Puppet Labs still supports will have\nbugfix maintenance branches periodically "merged up" into main. The current\nlist of integration branches are:
\n\nThe first Puppet Enterprise version including the stdlib module is Puppet\nEnterprise 1.2.
\n\nPuppet Versions | \n< 2.6 | \n2.6 | \n2.7 | \n3.x | \n
---|---|---|---|---|
stdlib 2.x | \nno | \nyes | \nyes | \nno | \n
stdlib 3.x | \nno | \nno | \nyes | \nyes | \n
stdlib 4.x | \nno | \nno | \nno | \nyes | \n
The stdlib module does not work with Puppet versions released prior to Puppet\n2.6.0.
\n\nAll stdlib releases in the 2.0 major version support Puppet 2.6 and Puppet 2.7.
\n\nThe 3.0 major release of stdlib drops support for Puppet 2.6. Stdlib 3.x\nsupports Puppet 2 and Puppet 3.
\n\nThe 4.0 major release of stdlib drops support for Puppet 2.7. Stdlib 4.x\nsupports Puppet 3. Notably, ruby 1.8.5 is no longer supported though ruby\n1.8.7, 1.9.3, and 2.0.0 are fully supported.
\n\nReturns the absolute value of a number, for example -34.56 becomes\n34.56. Takes a single integer and float value as an argument.
\n\nThis converts any object to an array containing that object. Empty argument\nlists are converted to an empty array. Arrays are left untouched. Hashes are\nconverted to arrays of alternating keys and values.
\n\nConverts a boolean to a number. Converts the values:\nfalse, f, 0, n, and no to 0\ntrue, t, 1, y, and yes to 1\n Requires a single boolean or string as an input.
\n\nCapitalizes the first letter of a string or array of strings.\nRequires either a single string or an array as an input.
\n\nRemoves the record separator from the end of a string or an array of\nstrings, for example hello\\n
becomes hello
.\nRequires a single string or array as an input.
Returns a new string with the last character removed. If the string ends\nwith \\r\\n
, both characters are removed. Applying chop to an empty\nstring returns an empty string. If you wish to merely remove record\nseparators then you should use the chomp
function.\nRequires a string or array of strings as input.
Appends the contents of array 2 onto array 1.
\n\nExample:
\n\nconcat(['1','2','3'],['4','5','6'])\n
\n\nWould result in:
\n\n['1','2','3','4','5','6']
\n\nTakes an array as first argument and an optional second argument.\nCount the number of elements in array that matches second argument.\nIf called with only an array it counts the number of elements that are not nil/undef.
\n\nTakes a resource reference and an optional hash of attributes.
\n\nReturns true if a resource with the specified attributes has already been added\nto the catalog, and false otherwise.
\n\nuser { 'dan':\n ensure => present,\n}\n\nif ! defined_with_params(User[dan], {'ensure' => 'present' }) {\n user { 'dan': ensure => present, }\n}\n
\n\nDeletes all instances of a given element from an array, substring from a\nstring, or key from a hash.
\n\nExamples:
\n\ndelete(['a','b','c','b'], 'b')\nWould return: ['a','c']\n\ndelete({'a'=>1,'b'=>2,'c'=>3}, 'b')\nWould return: {'a'=>1,'c'=>3}\n\ndelete('abracadabra', 'bra')\nWould return: 'acada'\n
\n\nDeletes a determined indexed value from an array.
\n\nExamples:
\n\ndelete_at(['a','b','c'], 1)\n
\n\nWould return: ['a','c']
\n\nReturns the dirname
of a path.
Examples:
\n\ndirname('/path/to/a/file.ext')\n
\n\nWould return: '/path/to/a'
\n\nConverts the case of a string or all strings in an array to lower case.
\n\nReturns true if the variable is empty.
\n\nTakes a list of packages and only installs them if they don't already exist.
\n\nTakes a resource type, title, and a list of attributes that describe a\nresource.
\n\nuser { 'dan':\n ensure => present,\n}\n
\n\nThis example only creates the resource if it does not already exist:
\n\nensure_resource('user, 'dan', {'ensure' => 'present' })\n
\n\nIf the resource already exists but does not match the specified parameters,\nthis function will attempt to recreate the resource leading to a duplicate\nresource definition error.
\n\nAn array of resources can also be passed in and each will be created with\nthe type and parameters specified if it doesn't already exist.
\n\nensure_resource('user', ['dan','alex'], {'ensure' => 'present'})\n
\n\nThis function flattens any deeply nested arrays and returns a single flat array\nas a result.
\n\nExamples:
\n\nflatten(['a', ['b', ['c']]])\n
\n\nWould return: ['a','b','c']
\n\nReturns the largest integer less or equal to the argument.\nTakes a single numeric value as an argument.
\n\nRotates an array a random number of times based on a nodes fqdn.
\n\nReturns the absolute path of the specified module for the current\nenvironment.
\n\nExample:\n $module_path = get_module_path('stdlib')
\n\nTakes a resource reference and name of the parameter and\nreturns value of resource's parameter.
\n\nExamples:
\n\ndefine example_resource($param) {\n}\n\nexample_resource { "example_resource_instance":\n param => "param_value"\n}\n\ngetparam(Example_resource["example_resource_instance"], "param")\n
\n\nWould return: param_value
\n\nLookup a variable in a remote namespace.
\n\nFor example:
\n\n$foo = getvar('site::data::foo')\n# Equivalent to $foo = $site::data::foo\n
\n\nThis is useful if the namespace itself is stored in a string:
\n\n$datalocation = 'site::data'\n$bar = getvar("${datalocation}::bar")\n# Equivalent to $bar = $site::data::bar\n
\n\nThis function searches through an array and returns any elements that match\nthe provided regular expression.
\n\nExamples:
\n\ngrep(['aaa','bbb','ccc','aaaddd'], 'aaa')\n
\n\nWould return:
\n\n['aaa','aaaddd']\n
\n\nReturns boolean based on kind and value:
\n\nhas_interface_with("macaddress", "x:x:x:x:x:x")\nhas_interface_with("ipaddress", "127.0.0.1") => true\netc.
\n\nIf no "kind" is given, then the presence of the interface is checked:\nhas_interface_with("lo") => true
\n\nReturns true if the client has the requested IP address on some interface.
\n\nThis function iterates through the 'interfaces' fact and checks the\n'ipaddress_IFACE' facts, performing a simple string comparison.
\n\nReturns true if the client has an IP address within the requested network.
\n\nThis function iterates through the 'interfaces' fact and checks the\n'network_IFACE' facts, performing a simple string comparision.
\n\nDetermine if a hash has a certain key value.
\n\nExample:
\n\n$my_hash = {'key_one' => 'value_one'}\nif has_key($my_hash, 'key_two') {\n notice('we will not reach here')\n}\nif has_key($my_hash, 'key_one') {\n notice('this will be printed')\n}\n
\n\nThis function converts an array into a hash.
\n\nExamples:
\n\nhash(['a',1,'b',2,'c',3])\n
\n\nWould return: {'a'=>1,'b'=>2,'c'=>3}
\n\nReturns true if the variable passed to this function is an array.
\n\nReturns true if the string passed to this function is a syntactically correct domain name.
\n\nReturns true if the variable passed to this function is a float.
\n\nThis function accepts a string as an argument, determines whether the\nPuppet runtime has access to a function by that name. It returns a\ntrue if the function exists, false if not.
\n\nReturns true if the variable passed to this function is a hash.
\n\nReturns true if the variable returned to this string is an integer.
\n\nReturns true if the string passed to this function is a valid IP address.
\n\nReturns true if the string passed to this function is a valid mac address.
\n\nReturns true if the variable passed to this function is a number.
\n\nReturns true if the variable passed to this function is a string.
\n\nThis function joins an array into a string using a seperator.
\n\nExamples:
\n\njoin(['a','b','c'], ",")\n
\n\nWould result in: "a,b,c"
\n\nThis function joins each key of a hash to that key's corresponding value with a\nseparator. Keys and values are cast to strings. The return value is an array in\nwhich each element is one joined key/value pair.
\n\nExamples:
\n\njoin_keys_to_values({'a'=>1,'b'=>2}, " is ")\n
\n\nWould result in: ["a is 1","b is 2"]
\n\nReturns the keys of a hash as an array.
\n\nLoad a YAML file containing an array, string, or hash, and return the data\nin the corresponding native data type.
\n\nFor example:
\n\n$myhash = loadyaml('/etc/puppet/data/myhash.yaml')\n
\n\nStrips leading spaces to the left of a string.
\n\nReturns the highest value of all arguments.\nRequires at least one argument.
\n\nThis function determines if a variable is a member of an array.
\n\nExamples:
\n\nmember(['a','b'], 'b')\n
\n\nWould return: true
\n\nmember(['a','b'], 'c')\n
\n\nWould return: false
\n\nMerges two or more hashes together and returns the resulting hash.
\n\nFor example:
\n\n$hash1 = {'one' => 1, 'two', => 2}\n$hash2 = {'two' => 'dos', 'three', => 'tres'}\n$merged_hash = merge($hash1, $hash2)\n# The resulting hash is equivalent to:\n# $merged_hash = {'one' => 1, 'two' => 'dos', 'three' => 'tres'}\n
\n\nWhen there is a duplicate key, the key in the rightmost hash will "win."
\n\nReturns the lowest value of all arguments.\nRequires at least one argument.
\n\nThis function converts a number or a string representation of a number into a\ntrue boolean. Zero or anything non-numeric becomes false. Numbers higher then 0\nbecome true.
\n\nThis function accepts JSON as a string and converts into the correct Puppet\nstructure.
\n\nThis function accepts YAML as a string and converts it into the correct\nPuppet structure.
\n\nThis function is similar to a coalesce function in SQL in that it will return\nthe first value in a list of values that is not undefined or an empty string\n(two things in Puppet that will return a boolean false value). Typically,\nthis function is used to check for a value in the Puppet Dashboard/Enterprise\nConsole, and failover to a default value like the following:
\n\n$real_jenkins_version = pick($::jenkins_version, '1.449')\n
\n\nThe value of $real_jenkins_version will first look for a top-scope variable\ncalled 'jenkins_version' (note that parameters set in the Puppet Dashboard/\nEnterprise Console are brought into Puppet as top-scope variables), and,\nfailing that, will use a default value of 1.449.
\n\nThis function applies a prefix to all elements in an array.
\n\nExamples:
\n\nprefix(['a','b','c'], 'p')\n
\n\nWill return: ['pa','pb','pc']
\n\nWhen given range in the form of (start, stop) it will extrapolate a range as\nan array.
\n\nExamples:
\n\nrange("0", "9")\n
\n\nWill return: [0,1,2,3,4,5,6,7,8,9]
\n\nrange("00", "09")\n
\n\nWill return: 0,1,2,3,4,5,6,7,8,9
\n\nrange("a", "c")\n
\n\nWill return: ["a","b","c"]
\n\nrange("host01", "host10")\n
\n\nWill return: ["host01", "host02", ..., "host09", "host10"]
\n\nThis function searches through an array and rejects all elements that match\nthe provided regular expression.
\n\nExamples:
\n\nreject(['aaa','bbb','ccc','aaaddd'], 'aaa')\n
\n\nWould return:
\n\n['bbb','ccc']\n
\n\nReverses the order of a string or array.
\n\nStrips leading spaces to the right of the string.
\n\nRandomizes the order of a string or array elements.
\n\nReturns the number of elements in a string or array.
\n\nSorts strings and arrays lexically.
\n\nReturns a new string where runs of the same character that occur in this set\nare replaced by a single character.
\n\nThis converts a string to a boolean. This attempt to convert strings that\ncontain things like: y, 1, t, true to 'true' and strings that contain things\nlike: 0, f, n, false, no to 'false'.
\n\nThis converts a string to a salted-SHA512 password hash (which is used for\nOS X versions >= 10.7). Given any simple string, you will get a hex version\nof a salted-SHA512 password hash that can be inserted into your Puppet\nmanifests as a valid password attribute.
\n\nThis function returns formatted time.
\n\nExamples:
\n\nTo return the time since epoch:
\n\nstrftime("%s")\n
\n\nTo return the date:
\n\nstrftime("%Y-%m-%d")\n
\n\nFormat meaning:
\n\n%a - The abbreviated weekday name (``Sun'')\n%A - The full weekday name (``Sunday'')\n%b - The abbreviated month name (``Jan'')\n%B - The full month name (``January'')\n%c - The preferred local date and time representation\n%C - Century (20 in 2009)\n%d - Day of the month (01..31)\n%D - Date (%m/%d/%y)\n%e - Day of the month, blank-padded ( 1..31)\n%F - Equivalent to %Y-%m-%d (the ISO 8601 date format)\n%h - Equivalent to %b\n%H - Hour of the day, 24-hour clock (00..23)\n%I - Hour of the day, 12-hour clock (01..12)\n%j - Day of the year (001..366)\n%k - hour, 24-hour clock, blank-padded ( 0..23)\n%l - hour, 12-hour clock, blank-padded ( 0..12)\n%L - Millisecond of the second (000..999)\n%m - Month of the year (01..12)\n%M - Minute of the hour (00..59)\n%n - Newline (\n
\n\n)\n %N - Fractional seconds digits, default is 9 digits (nanosecond)\n %3N millisecond (3 digits)\n %6N microsecond (6 digits)\n %9N nanosecond (9 digits)\n %p - Meridian indicator (AM'' or
PM'')\n %P - Meridian indicator (am'' or
pm'')\n %r - time, 12-hour (same as %I:%M:%S %p)\n %R - time, 24-hour (%H:%M)\n %s - Number of seconds since 1970-01-01 00:00:00 UTC.\n %S - Second of the minute (00..60)\n %t - Tab character ( )\n %T - time, 24-hour (%H:%M:%S)\n %u - Day of the week as a decimal, Monday being 1. (1..7)\n %U - Week number of the current year,\n starting with the first Sunday as the first\n day of the first week (00..53)\n %v - VMS date (%e-%b-%Y)\n %V - Week number of year according to ISO 8601 (01..53)\n %W - Week number of the current year,\n starting with the first Monday as the first\n day of the first week (00..53)\n %w - Day of the week (Sunday is 0, 0..6)\n %x - Preferred representation for the date alone, no time\n %X - Preferred representation for the time alone, no date\n %y - Year without a century (00..99)\n %Y - Year with century\n %z - Time zone as hour offset from UTC (e.g. +0900)\n %Z - Time zone name\n %% - Literal ``%'' character
This function removes leading and trailing whitespace from a string or from\nevery string inside an array.
\n\nExamples:
\n\nstrip(" aaa ")\n
\n\nWould result in: "aaa"
\n\nThis function applies a suffix to all elements in an array.
\n\nExamples:
\n\nsuffix(['a','b','c'], 'p')\n
\n\nWill return: ['ap','bp','cp']
\n\nThis function will swap the existing case of a string.
\n\nExamples:
\n\nswapcase("aBcD")\n
\n\nWould result in: "AbCd"
\n\nThis function will return the current time since epoch as an integer.
\n\nExamples:
\n\ntime()\n
\n\nWill return something like: 1311972653
\n\nConverts the argument into bytes, for example 4 kB becomes 4096.\nTakes a single string value as an argument.
\n\nReturns the type when passed a variable. Type can be one of:
\n\nboolean
Type: rvalue
This function will remove duplicates from strings and arrays.
\n\nExamples:
\n\nunique("aabbcc")\n
\n\nWill return:
\n\nabc\n
\n\nYou can also use this with arrays:
\n\nunique(["a","a","b","b","c","c"])\n
\n\nThis returns:
\n\n["a","b","c"]\n
\n\nConverts a string or an array of strings to uppercase.
\n\nExamples:
\n\nupcase("abcd")\n
\n\nWill return:
\n\nASDF\n
\n\nUrlencodes a string or array of strings.\nRequires either a single string or an array as an input.
\n\nValidate the string represents an absolute path in the filesystem. This function works\nfor windows and unix style paths.
\n\nThe following values will pass:
\n\n$my_path = "C:/Program Files (x86)/Puppet Labs/Puppet"\nvalidate_absolute_path($my_path)\n$my_path2 = "/var/lib/puppet"\nvalidate_absolute_path($my_path2)\n
\n\nThe following values will fail, causing compilation to abort:
\n\nvalidate_absolute_path(true)\nvalidate_absolute_path([ 'var/lib/puppet', '/var/foo' ])\nvalidate_absolute_path([ '/var/lib/puppet', 'var/foo' ])\n$undefined = undef\nvalidate_absolute_path($undefined)\n
\n\nValidate that all passed values are array data structures. Abort catalog\ncompilation if any value fails this check.
\n\nThe following values will pass:
\n\n$my_array = [ 'one', 'two' ]\nvalidate_array($my_array)\n
\n\nThe following values will fail, causing compilation to abort:
\n\nvalidate_array(true)\nvalidate_array('some_string')\n$undefined = undef\nvalidate_array($undefined)\n
\n\nPerform validation of a string using an Augeas lens\nThe first argument of this function should be a string to\ntest, and the second argument should be the name of the Augeas lens to use.\nIf Augeas fails to parse the string with the lens, the compilation will\nabort with a parse error.
\n\nA third argument can be specified, listing paths which should\nnot be found in the file. The $file
variable points to the location\nof the temporary file being tested in the Augeas tree.
For example, if you want to make sure your passwd content never contains\na user foo
, you could write:
validate_augeas($passwdcontent, 'Passwd.lns', ['$file/foo'])\n
\n\nOr if you wanted to ensure that no users used the '/bin/barsh' shell,\nyou could use:
\n\nvalidate_augeas($passwdcontent, 'Passwd.lns', ['$file/*[shell="/bin/barsh"]']\n
\n\nIf a fourth argument is specified, this will be the error message raised and\nseen by the user.
\n\nA helpful error message can be returned like this:
\n\nvalidate_augeas($sudoerscontent, 'Sudoers.lns', [], 'Failed to validate sudoers content with Augeas')\n
\n\nValidate that all passed values are either true or false. Abort catalog\ncompilation if any value fails this check.
\n\nThe following values will pass:
\n\n$iamtrue = true\nvalidate_bool(true)\nvalidate_bool(true, true, false, $iamtrue)\n
\n\nThe following values will fail, causing compilation to abort:
\n\n$some_array = [ true ]\nvalidate_bool("false")\nvalidate_bool("true")\nvalidate_bool($some_array)\n
\n\nPerform validation of a string with an external command.\nThe first argument of this function should be a string to\ntest, and the second argument should be a path to a test command\ntaking a file as last argument. If the command, launched against\na tempfile containing the passed string, returns a non-null value,\ncompilation will abort with a parse error.
\n\nIf a third argument is specified, this will be the error message raised and\nseen by the user.
\n\nA helpful error message can be returned like this:
\n\nExample:
\n\nvalidate_cmd($sudoerscontent, '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content')\n
\n\nValidate that all passed values are hash data structures. Abort catalog\ncompilation if any value fails this check.
\n\nThe following values will pass:
\n\n$my_hash = { 'one' => 'two' }\nvalidate_hash($my_hash)\n
\n\nThe following values will fail, causing compilation to abort:
\n\nvalidate_hash(true)\nvalidate_hash('some_string')\n$undefined = undef\nvalidate_hash($undefined)\n
\n\nPerform simple validation of a string against one or more regular\nexpressions. The first argument of this function should be a string to\ntest, and the second argument should be a stringified regular expression\n(without the // delimiters) or an array of regular expressions. If none\nof the regular expressions match the string passed in, compilation will\nabort with a parse error.
\n\nIf a third argument is specified, this will be the error message raised and\nseen by the user.
\n\nThe following strings will validate against the regular expressions:
\n\nvalidate_re('one', '^one$')\nvalidate_re('one', [ '^one', '^two' ])\n
\n\nThe following strings will fail to validate, causing compilation to abort:
\n\nvalidate_re('one', [ '^two', '^three' ])\n
\n\nA helpful error message can be returned like this:
\n\nvalidate_re($::puppetversion, '^2.7', 'The $puppetversion fact value does not match 2.7')\n
\n\nValidate that the first argument is a string (or an array of strings), and\nless/equal to than the length of the second argument. It fails if the first\nargument is not a string or array of strings, and if arg 2 is not convertable\nto a number.
\n\nThe following values will pass:
\n\nvalidate_slength("discombobulate",17)\n validate_slength(["discombobulate","moo"],17)
\n\nThe following valueis will not:
\n\nvalidate_slength("discombobulate",1)\n validate_slength(["discombobulate","thermometer"],5)
\n\nValidate that all passed values are string data structures. Abort catalog\ncompilation if any value fails this check.
\n\nThe following values will pass:
\n\n$my_string = "one two"\nvalidate_string($my_string, 'three')\n
\n\nThe following values will fail, causing compilation to abort:
\n\nvalidate_string(true)\nvalidate_string([ 'some', 'array' ])\n$undefined = undef\nvalidate_string($undefined)\n
\n\nWhen given a hash this function will return the values of that hash.
\n\nExamples:
\n\n$hash = {\n 'a' => 1,\n 'b' => 2,\n 'c' => 3,\n}\nvalues($hash)\n
\n\nThis example would return:
\n\n[1,2,3]\n
\n\nFinds value inside an array based on location.
\n\nThe first argument is the array you want to analyze, and the second element can\nbe a combination of:
\n\nExamples:
\n\nvalues_at(['a','b','c'], 2)\n
\n\nWould return ['c'].
\n\nvalues_at(['a','b','c'], ["0-1"])\n
\n\nWould return ['a','b'].
\n\nvalues_at(['a','b','c','d','e'], [0, "2-3"])\n
\n\nWould return ['a','c','d'].
\n\nTakes one element from first array and merges corresponding elements from second array. This generates a sequence of n-element arrays, where n is one more than the count of arguments.
\n\nExample:
\n\nzip(['1','2','3'],['4','5','6'])\n
\n\nWould result in:
\n\n["1", "4"], ["2", "5"], ["3", "6"]\n
\n\nThis page autogenerated on 2013-04-11 13:54:25 -0700
\n2013-05-06 - Jeff McCune <jeff@puppetlabs.com> - 4.1.0\n * (#20582) Restore facter_dot_d to stdlib for PE users (3b887c8)\n * (maint) Update Gemfile with GEM_FACTER_VERSION (f44d535)\n\n2013-05-06 - Alex Cline <acline@us.ibm.com> - 4.1.0\n * Terser method of string to array conversion courtesy of ethooz. (d38bce0)\n\n2013-05-06 - Alex Cline <acline@us.ibm.com> 4.1.0\n * Refactor ensure_resource expectations (b33cc24)\n\n2013-05-06 - Alex Cline <acline@us.ibm.com> 4.1.0\n * Changed str-to-array conversion and removed abbreviation. (de253db)\n\n2013-05-03 - Alex Cline <acline@us.ibm.com> 4.1.0\n * (#20548) Allow an array of resource titles to be passed into the ensure_resource function (e08734a)\n\n2013-05-02 - Raphaël Pinson <raphael.pinson@camptocamp.com> - 4.1.0\n * Add a dirname function (2ba9e47)\n\n2013-04-29 - Mark Smith-Guerrero <msmithgu@gmail.com> - 4.1.0\n * (maint) Fix a small typo in hash() description (928036a)\n\n2013-04-12 - Jeff McCune <jeff@puppetlabs.com> - 4.0.2\n * Update user information in gemspec to make the intent of the Gem clear.\n\n2013-04-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.1\n * Fix README function documentation (ab3e30c)\n\n2013-04-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0\n * stdlib 4.0 drops support with Puppet 2.7\n * stdlib 4.0 preserves support with Puppet 3\n\n2013-04-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0\n * Add ability to use puppet from git via bundler (9c5805f)\n\n2013-04-10 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0\n * (maint) Make stdlib usable as a Ruby GEM (e81a45e)\n\n2013-04-10 - Erik Dalén <dalen@spotify.com> - 4.0.0\n * Add a count function (f28550e)\n\n2013-03-31 - Amos Shapira <ashapira@atlassian.com> - 4.0.0\n * (#19998) Implement any2array (7a2fb80)\n\n2013-03-29 - Steve Huff <shuff@vecna.org> - 4.0.0\n * (19864) num2bool match fix (8d217f0)\n\n2013-03-20 - Erik Dalén <dalen@spotify.com> - 4.0.0\n * Allow comparisons of Numeric and number as String (ff5dd5d)\n\n2013-03-26 - Richard Soderberg <rsoderberg@mozilla.com> - 4.0.0\n * add suffix function to accompany the prefix function (88a93ac)\n\n2013-03-19 - Kristof Willaert <kristof.willaert@gmail.com> - 4.0.0\n * Add floor function implementation and unit tests (0527341)\n\n2012-04-03 - Eric Shamow <eric@puppetlabs.com> - 4.0.0\n * (#13610) Add is_function_available to stdlib (961dcab)\n\n2012-12-17 - Justin Lambert <jlambert@eml.cc> - 4.0.0\n * str2bool should return a boolean if called with a boolean (5d5a4d4)\n\n2012-10-23 - Uwe Stuehler <ustuehler@team.mobile.de> - 4.0.0\n * Fix number of arguments check in flatten() (e80207b)\n\n2013-03-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0\n * Add contributing document (96e19d0)\n\n2013-03-04 - Raphaël Pinson <raphael.pinson@camptocamp.com> - 4.0.0\n * Add missing documentation for validate_augeas and validate_cmd to README.markdown (a1510a1)\n\n2013-02-14 - Joshua Hoblitt <jhoblitt@cpan.org> - 4.0.0\n * (#19272) Add has_element() function (95cf3fe)\n\n2013-02-07 - Raphaël Pinson <raphael.pinson@camptocamp.com> - 4.0.0\n * validate_cmd(): Use Puppet::Util::Execution.execute when available (69248df)\n\n2012-12-06 - Raphaël Pinson <raphink@gmail.com> - 4.0.0\n * Add validate_augeas function (3a97c23)\n\n2012-12-06 - Raphaël Pinson <raphink@gmail.com> - 4.0.0\n * Add validate_cmd function (6902cc5)\n\n2013-01-14 - David Schmitt <david@dasz.at> - 4.0.0\n * Add geppetto project definition (b3fc0a3)\n\n2013-01-02 - Jaka Hudoklin <jakahudoklin@gmail.com> - 4.0.0\n * Add getparam function to get defined resource parameters (20e0e07)\n\n2013-01-05 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0\n * (maint) Add Travis CI Support (d082046)\n\n2012-12-04 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0\n * Clarify that stdlib 3 supports Puppet 3 (3a6085f)\n\n2012-11-30 - Erik Dalén <dalen@spotify.com> - 4.0.0\n * maint: style guideline fixes (7742e5f)\n\n2012-11-09 - James Fryman <james@frymanet.com> - 4.0.0\n * puppet-lint cleanup (88acc52)\n\n2012-11-06 - Joe Julian <me@joejulian.name> - 4.0.0\n * Add function, uriescape, to URI.escape strings. Redmine #17459 (fd52b8d)\n\n2012-09-18 - Chad Metcalf <chad@wibidata.com> - 3.2.0\n * Add an ensure_packages function. (8a8c09e)\n\n2012-11-23 - Erik Dalén <dalen@spotify.com> - 3.2.0\n * (#17797) min() and max() functions (9954133)\n\n2012-05-23 - Peter Meier <peter.meier@immerda.ch> - 3.2.0\n * (#14670) autorequire a file_line resource's path (dfcee63)\n\n2012-11-19 - Joshua Harlan Lifton <lifton@puppetlabs.com> - 3.2.0\n * Add join_keys_to_values function (ee0f2b3)\n\n2012-11-17 - Joshua Harlan Lifton <lifton@puppetlabs.com> - 3.2.0\n * Extend delete function for strings and hashes (7322e4d)\n\n2012-08-03 - Gary Larizza <gary@puppetlabs.com> - 3.2.0\n * Add the pick() function (ba6dd13)\n\n2012-03-20 - Wil Cooley <wcooley@pdx.edu> - 3.2.0\n * (#13974) Add predicate functions for interface facts (f819417)\n\n2012-11-06 - Joe Julian <me@joejulian.name> - 3.2.0\n * Add function, uriescape, to URI.escape strings. Redmine #17459 (70f4a0e)\n\n2012-10-25 - Jeff McCune <jeff@puppetlabs.com> - 3.1.1\n * (maint) Fix spec failures resulting from Facter API changes (97f836f)\n\n2012-10-23 - Matthaus Owens <matthaus@puppetlabs.com> - 3.1.0\n * Add PE facts to stdlib (cdf3b05)\n\n2012-08-16 - Jeff McCune <jeff@puppetlabs.com> - 3.0.1\n * Fix accidental removal of facts_dot_d.rb in 3.0.0 release\n\n2012-08-16 - Jeff McCune <jeff@puppetlabs.com> - 3.0.0\n * stdlib 3.0 drops support with Puppet 2.6\n * stdlib 3.0 preserves support with Puppet 2.7\n\n2012-08-07 - Dan Bode <dan@puppetlabs.com> - 3.0.0\n * Add function ensure_resource and defined_with_params (ba789de)\n\n2012-07-10 - Hailee Kenney <hailee@puppetlabs.com> - 3.0.0\n * (#2157) Remove facter_dot_d for compatibility with external facts (f92574f)\n\n2012-04-10 - Chris Price <chris@puppetlabs.com> - 3.0.0\n * (#13693) moving logic from local spec_helper to puppetlabs_spec_helper (85f96df)\n\n2012-10-25 - Jeff McCune <jeff@puppetlabs.com> - 2.5.1\n * (maint) Fix spec failures resulting from Facter API changes (97f836f)\n\n2012-10-23 - Matthaus Owens <matthaus@puppetlabs.com> - 2.5.0\n * Add PE facts to stdlib (cdf3b05)\n\n2012-08-15 - Dan Bode <dan@puppetlabs.com> - 2.5.0\n * Explicitly load functions used by ensure_resource (9fc3063)\n\n2012-08-13 - Dan Bode <dan@puppetlabs.com> - 2.5.0\n * Add better docs about duplicate resource failures (97d327a)\n\n2012-08-13 - Dan Bode <dan@puppetlabs.com> - 2.5.0\n * Handle undef for parameter argument (4f8b133)\n\n2012-08-07 - Dan Bode <dan@puppetlabs.com> - 2.5.0\n * Add function ensure_resource and defined_with_params (a0cb8cd)\n\n2012-08-20 - Jeff McCune <jeff@puppetlabs.com> - 2.5.0\n * Disable tests that fail on 2.6.x due to #15912 (c81496e)\n\n2012-08-20 - Jeff McCune <jeff@puppetlabs.com> - 2.5.0\n * (Maint) Fix mis-use of rvalue functions as statements (4492913)\n\n2012-08-20 - Jeff McCune <jeff@puppetlabs.com> - 2.5.0\n * Add .rspec file to repo root (88789e8)\n\n2012-06-07 - Chris Price <chris@puppetlabs.com> - 2.4.0\n * Add support for a 'match' parameter to file_line (a06c0d8)\n\n2012-08-07 - Erik Dalén <dalen@spotify.com> - 2.4.0\n * (#15872) Add to_bytes function (247b69c)\n\n2012-07-19 - Jeff McCune <jeff@puppetlabs.com> - 2.4.0\n * (Maint) use PuppetlabsSpec::PuppetInternals.scope (main) (deafe88)\n\n2012-07-10 - Hailee Kenney <hailee@puppetlabs.com> - 2.4.0\n * (#2157) Make facts_dot_d compatible with external facts (5fb0ddc)\n\n2012-03-16 - Steve Traylen <steve.traylen@cern.ch> - 2.4.0\n * (#13205) Rotate array/string randomley based on fqdn, fqdn_rotate() (fef247b)\n\n2012-05-22 - Peter Meier <peter.meier@immerda.ch> - 2.3.3\n * fix regression in #11017 properly (f0a62c7)\n\n2012-05-10 - Jeff McCune <jeff@puppetlabs.com> - 2.3.3\n * Fix spec tests using the new spec_helper (7d34333)\n\n2012-05-10 - Puppet Labs <support@puppetlabs.com> - 2.3.2\n * Make file_line default to ensure => present (1373e70)\n * Memoize file_line spec instance variables (20aacc5)\n * Fix spec tests using the new spec_helper (1ebfa5d)\n * (#13595) initialize_everything_for_tests couples modules Puppet ver (3222f35)\n * (#13439) Fix MRI 1.9 issue with spec_helper (15c5fd1)\n * (#13439) Fix test failures with Puppet 2.6.x (665610b)\n * (#13439) refactor spec helper for compatibility with both puppet 2.7 and main (82194ca)\n * (#13494) Specify the behavior of zero padded strings (61891bb)\n\n2012-03-29 Puppet Labs <support@puppetlabs.com> - 2.1.3\n* (#11607) Add Rakefile to enable spec testing\n* (#12377) Avoid infinite loop when retrying require json\n\n2012-03-13 Puppet Labs <support@puppetlabs.com> - 2.3.1\n* (#13091) Fix LoadError bug with puppet apply and puppet_vardir fact\n\n2012-03-12 Puppet Labs <support@puppetlabs.com> - 2.3.0\n* Add a large number of new Puppet functions\n* Backwards compatibility preserved with 2.2.x\n\n2011-12-30 Puppet Labs <support@puppetlabs.com> - 2.2.1\n* Documentation only release for the Forge\n\n2011-12-30 Puppet Labs <support@puppetlabs.com> - 2.1.2\n* Documentation only release for PE 2.0.x\n\n2011-11-08 Puppet Labs <support@puppetlabs.com> - 2.2.0\n* #10285 - Refactor json to use pson instead.\n* Maint - Add watchr autotest script\n* Maint - Make rspec tests work with Puppet 2.6.4\n* #9859 - Add root_home fact and tests\n\n2011-08-18 Puppet Labs <support@puppetlabs.com> - 2.1.1\n* Change facts.d paths to match Facter 2.0 paths.\n* /etc/facter/facts.d\n* /etc/puppetlabs/facter/facts.d\n\n2011-08-17 Puppet Labs <support@puppetlabs.com> - 2.1.0\n* Add R.I. Pienaar's facts.d custom facter fact\n* facts defined in /etc/facts.d and /etc/puppetlabs/facts.d are\n automatically loaded now.\n\n2011-08-04 Puppet Labs <support@puppetlabs.com> - 2.0.0\n* Rename whole_line to file_line\n* This is an API change and as such motivating a 2.0.0 release according to semver.org.\n\n2011-08-04 Puppet Labs <support@puppetlabs.com> - 1.1.0\n* Rename append_line to whole_line\n* This is an API change and as such motivating a 1.1.0 release.\n\n2011-08-04 Puppet Labs <support@puppetlabs.com> - 1.0.0\n* Initial stable release\n* Add validate_array and validate_string functions\n* Make merge() function work with Ruby 1.8.5\n* Add hash merging function\n* Add has_key function\n* Add loadyaml() function\n* Add append_line native\n\n2011-06-21 Jeff McCune <jeff@puppetlabs.com> - 0.1.7\n* Add validate_hash() and getvar() functions\n\n2011-06-15 Jeff McCune <jeff@puppetlabs.com> - 0.1.6\n* Add anchor resource type to provide containment for composite classes\n\n2011-06-03 Jeff McCune <jeff@puppetlabs.com> - 0.1.5\n* Add validate_bool() function to stdlib\n\n0.1.4 2011-05-26 Jeff McCune <jeff@puppetlabs.com>\n* Move most stages after main\n\n0.1.3 2011-05-25 Jeff McCune <jeff@puppetlabs.com>\n* Add validate_re() function\n\n0.1.2 2011-05-24 Jeff McCune <jeff@puppetlabs.com>\n* Update to add annotated tag\n\n0.1.1 2011-05-24 Jeff McCune <jeff@puppetlabs.com>\n* Add stdlib::stages class with a standard set of stages\n
Copyright (C) 2011 Puppet Labs Inc\n\nand some parts:\n\nCopyright (C) 2011 Krzysztof Wilczynski\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
The APT module provides a simple interface for managing APT source, key, and definitions with Puppet.
\n\nAPT automates obtaining and installing software packages on *nix systems.
\n\nWhat APT affects:
\n\nsources.list
file and sources.list.d
directory\n\npurge_sources_list
and purge_sources_list_d
parameters to 'true' will destroy any existing content that was not declared with Puppet. The default for these parameters is 'false'.To begin using the APT module with default parameters, declare the class
\n\nclass { 'apt': }\n
\n\nPuppet code that uses anything from the APT module requires that the core apt class be declared.
\n\nUsing the APT module consists predominantly in declaring classes that provide desired functionality and features.
\n\napt
provides a number of common resources and options that are shared by the various defined types in this module, so you MUST always include this class in your manifests.
The parameters for apt
are not required in general and are predominantly for development environment use-cases.
class { 'apt':\n always_apt_update => false,\n disable_keys => undef,\n proxy_host => false,\n proxy_port => '8080',\n purge_sources_list => false,\n purge_sources_list_d => false,\n purge_preferences_d => false,\n update_timeout => undef\n}\n
\n\nPuppet will manage your system's sources.list
file and sources.list.d
directory but will do its best to respect existing content.
If you declare your apt class with purge_sources_list
and purge_sources_list_d
set to 'true', Puppet will unapologetically purge any existing content it finds that wasn't declared with Puppet.
Installs the build depends of a specified package.
\n\napt::builddep { 'glusterfs-server': }\n
\n\nForces a package to be installed from a specific release. This class is particularly useful when using repositories, like Debian, that are unstable in Ubuntu.
\n\napt::force { 'glusterfs-server':\n release => 'unstable',\n version => '3.0.3',\n require => Apt::Source['debian_unstable'],\n}\n
\n\nAdds a key to the list of keys used by APT to authenticate packages.
\n\napt::key { 'puppetlabs':\n key => '4BD6EC30',\n key_server => 'pgp.mit.edu',\n}\n\napt::key { 'jenkins':\n key => 'D50582E6',\n key_source => 'http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key',\n}\n
\n\nNote that use of key_source
requires wget to be installed and working.
Adds an apt pin for a certain release.
\n\napt::pin { 'karmic': priority => 700 }\napt::pin { 'karmic-updates': priority => 700 }\napt::pin { 'karmic-security': priority => 700 }\n
\n\nNote you can also specifying more complex pins using distribution properties.
\n\napt::pin { 'stable':\n priority => -10,\n originator => 'Debian',\n release_version => '3.0',\n component => 'main',\n label => 'Debian'\n}\n
\n\nAdds a ppa repository using add-apt-repository
.
apt::ppa { 'ppa:drizzle-developers/ppa': }\n
\n\nSets the default apt release. This class is particularly useful when using repositories, like Debian, that are unstable in Ubuntu.
\n\nclass { 'apt::release':\n release_id => 'precise',\n}\n
\n\nAdds an apt source to /etc/apt/sources.list.d/
.
apt::source { 'debian_unstable':\n location => 'http://debian.mirror.iweb.ca/debian/',\n release => 'unstable',\n repos => 'main contrib non-free',\n required_packages => 'debian-keyring debian-archive-keyring',\n key => '55BE302B',\n key_server => 'subkeys.pgp.net',\n pin => '-10',\n include_src => true\n}\n
\n\nIf you would like to configure your system so the source is the Puppet Labs APT repository
\n\napt::source { 'puppetlabs':\n location => 'http://apt.puppetlabs.com',\n repos => 'main',\n key => '4BD6EC30',\n key_server => 'pgp.mit.edu',\n}\n
\n\nThe APT module is mostly a collection of defined resource types, which provide reusable logic that can be leveraged to manage APT. It does provide smoke tests for testing functionality on a target system, as well as spec tests for checking a compiled catalog against an expected set of resources.
\n\nThis test will set up a Puppet Labs apt repository. Start by creating a new smoke test in the apt module's test folder. Call it puppetlabs-apt.pp. Inside, declare a single resource representing the Puppet Labs APT source and gpg key
\n\napt::source { 'puppetlabs':\n location => 'http://apt.puppetlabs.com',\n repos => 'main',\n key => '4BD6EC30',\n key_server => 'pgp.mit.edu',\n}\n
\n\nThis resource creates an apt source named puppetlabs and gives Puppet information about the repository's location and key used to sign its packages. Puppet leverages Facter to determine the appropriate release, but you can set it directly by adding the release type.
\n\nCheck your smoke test for syntax errors
\n\n$ puppet parser validate tests/puppetlabs-apt.pp\n
\n\nIf you receive no output from that command, it means nothing is wrong. Then apply the code
\n\n$ puppet apply --verbose tests/puppetlabs-apt.pp\nnotice: /Stage[main]//Apt::Source[puppetlabs]/File[puppetlabs.list]/ensure: defined content as '{md5}3be1da4923fb910f1102a233b77e982e'\ninfo: /Stage[main]//Apt::Source[puppetlabs]/File[puppetlabs.list]: Scheduling refresh of Exec[puppetlabs apt update]\nnotice: /Stage[main]//Apt::Source[puppetlabs]/Exec[puppetlabs apt update]: Triggered 'refresh' from 1 events>\n
\n\nThe above example used a smoke test to easily lay out a resource declaration and apply it on your system. In production, you may want to declare your APT sources inside the classes where they’re needed.
\n\nAdds the necessary components to get backports for Ubuntu and Debian. The release name defaults to $lsbdistcodename
. Setting this manually can cause undefined behavior (read: universe exploding).
This module should work across all versions of Debian/Ubuntu and support all major APT repository management features.
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n\nA lot of great people have contributed to this module. A somewhat current list follows:
\n\n2013-10-08 1.4.0\n\nSummary:\n\nMinor bugfix and allow the timeout to be adjusted.\n\nFeatures:\n- Add an `updates_timeout` to apt::params\n\nFixes:\n- Ensure apt::ppa can readd a ppa removed by hand.\n\nSummary\n\n1.3.0\n=====\n\nSummary:\n\nThis major feature in this release is the new apt::unattended_upgrades class,\nallowing you to handle Ubuntu's unattended feature. This allows you to select\nspecific packages to automatically upgrade without any further user\ninvolvement.\n\nIn addition we extend our Wheezy support, add proxy support to apt:ppa and do\nvarious cleanups and tweaks.\n\nFeatures:\n- Add apt::unattended_upgrades support for Ubuntu.\n- Add wheezy backports support.\n- Use the geoDNS http.debian.net instead of the main debian ftp server.\n- Add `options` parameter to apt::ppa in order to pass options to apt-add-repository command.\n- Add proxy support for apt::ppa (uses proxy_host and proxy_port from apt).\n\nBugfixes:\n- Fix regsubst() calls to quote single letters (for future parser).\n- Fix lint warnings and other misc cleanup.\n\n1.2.0\n=====\n\nFeatures:\n- Add geppetto `.project` natures\n- Add GH auto-release\n- Add `apt::key::key_options` parameter\n- Add complex pin support using distribution properties for `apt::pin` via new properties:\n - `apt::pin::codename`\n - `apt::pin::release_version`\n - `apt::pin::component`\n - `apt::pin::originator`\n - `apt::pin::label`\n- Add source architecture support to `apt::source::architecture`\n\nBugfixes:\n- Use apt-get instead of aptitude in apt::force\n- Update default backports location\n- Add dependency for required packages before apt-get update\n\n\n1.1.1\n=====\n\nThis is a bug fix release that resolves a number of issues:\n\n* By changing template variable usage, we remove the deprecation warnings\n for Puppet 3.2.x\n* Fixed proxy file removal, when proxy absent\n\nSome documentation, style and whitespaces changes were also merged. This\nrelease also introduced proper rspec-puppet unit testing on Travis-CI to help\nreduce regression.\n\nThanks to all the community contributors below that made this patch possible.\n\n#### Detail Changes\n\n* fix minor comment type (Chris Rutter)\n* whitespace fixes (Michael Moll)\n* Update travis config file (William Van Hevelingen)\n* Build all branches on travis (William Van Hevelingen)\n* Standardize travis.yml on pattern introduced in stdlib (William Van Hevelingen)\n* Updated content to conform to README best practices template (Lauren Rother)\n* Fix apt::release example in readme (Brian Galey)\n* add @ to variables in template (Peter Hoeg)\n* Remove deprecation warnings for pin.pref.erb as well (Ken Barber)\n* Update travis.yml to latest versions of puppet (Ken Barber)\n* Fix proxy file removal (Scott Barber)\n* Add spec test for removing proxy configuration (Dean Reilly)\n* Fix apt::key listing longer than 8 chars (Benjamin Knofe)\n\n\n---------------------------------------\n\n1.1.0\n=====\n\nThis release includes Ubuntu 12.10 (Quantal) support for PPAs.\n\n---------------------------------------\n\n2012-05-25 Puppet Labs <info@puppetlabs.com> - 0.0.4\n * Fix ppa list filename when there is a period in the PPA name\n * Add .pref extension to apt preferences files\n * Allow preferences to be purged\n * Extend pin support\n\n2012-05-04 Puppet Labs <info@puppetlabs.com> - 0.0.3\n * only invoke apt-get update once\n * only install python-software-properties if a ppa is added\n * support 'ensure => absent' for all defined types\n * add apt::conf\n * add apt::backports\n * fixed Modulefile for module tool dependency resolution\n * configure proxy before doing apt-get update\n * use apt-get update instead of aptitude for apt::ppa\n * add support to pin release\n\n\n2012-03-26 Puppet Labs <info@puppetlabs.com> - 0.0.2\n41cedbb (#13261) Add real examples to smoke tests.\nd159a78 (#13261) Add key.pp smoke test\n7116c7a (#13261) Replace foo source with puppetlabs source\n1ead0bf Ignore pkg directory.\n9c13872 (#13289) Fix some more style violations\n0ea4ffa (#13289) Change test scaffolding to use a module & manifest dir fixture path\na758247 (#13289) Clean up style violations and fix corresponding tests\n99c3fd3 (#13289) Add puppet lint tests to Rakefile\n5148cbf (#13125) Apt keys should be case insensitive\nb9607a4 Convert apt::key to use anchors\n\n2012-03-07 Puppet Labs <info@puppetlabs.com> - 0.0.1\nd4fec56 Modify apt::source release parameter test\n1132a07 (#12917) Add contributors to README\n8cdaf85 (#12823) Add apt::key defined type and modify apt::source to use it\n7c0d10b (#12809) $release should use $lsbdistcodename and fall back to manual input\nbe2cc3e (#12522) Adjust spec test for splitting purge\n7dc60ae (#12522) Split purge option to spare sources.list\n9059c4e Fix source specs to test all key permutations\n8acb202 Add test for python-software-properties package\na4af11f Check if python-software-properties is defined before attempting to define it.\n1dcbf3d Add tests for required_packages change\nf3735d2 Allow duplicate $required_packages\n74c8371 (#12430) Add tests for changes to apt module\n97ebb2d Test two sources with the same key\n1160bcd (#12526) Add ability to reverse apt { disable_keys => true }\n2842d73 Add Modulefile to puppet-apt\nc657742 Allow the use of the same key in multiple sources\n8c27963 (#12522) Adding purge option to apt class\n997c9fd (#12529) Add unit test for apt proxy settings\n50f3cca (#12529) Add parameter to support setting a proxy for apt\nd522877 (#12094) Replace chained .with_* with a hash\n8cf1bd0 (#12094) Remove deprecated spec.opts file\n2d688f4 (#12094) Add rspec-puppet tests for apt\n0fb5f78 (#12094) Replace name with path in file resources\nf759bc0 (#11953) Apt::force passes $version to aptitude\nf71db53 (#11413) Add spec test for apt::force to verify changes to unless\n2f5d317 (#11413) Update dpkg query used by apt::force\ncf6caa1 (#10451) Add test coverage to apt::ppa\n0dd697d include_src parameter in example; Whitespace cleanup\nb662eb8 fix typos in "repositories"\n1be7457 Fix (#10451) - apt::ppa fails to "apt-get update" when new PPA source is added\n864302a Set the pin priority before adding the source (Fix #10449)\n1de4e0a Refactored as per mlitteken\n1af9a13 Added some crazy bash madness to check if the ppa is installed already. Otherwise the manifest tries to add it on every run!\n52ca73e (#8720) Replace Apt::Ppa with Apt::Builddep\n5c05fa0 added builddep command.\na11af50 added the ability to specify the content of a key\nc42db0f Fixes ppa test.\n77d2b0d reformatted whitespace to match recommended style of 2 space indentation.\n27ebdfc ignore swap files.\n377d58a added smoke tests for module.\n18f614b reformatted apt::ppa according to recommended style.\nd8a1e4e Created a params class to hold global data.\n636ae85 Added two params for apt class\n148fc73 Update LICENSE.\ned2d19e Support ability to add more than one PPA\n420d537 Add call to apt-update after add-apt-repository in apt::ppa\n945be77 Add package definition for python-software-properties\n71fc425 Abs paths for all commands\n9d51cd1 Adding LICENSE\n71796e3 Heading fix in README\n87777d8 Typo in README\nf848bac First commit\n
Copyright (c) 2011 Evolving Web Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the "Software"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n
The Firewall module lets you manage firewall rules with Puppet.
\n\nPuppetLabs' Firewall introduces the resource firewall
, which is used to manage and configure firewall rules from within the Puppet DSL. This module offers support for iptables, ip6tables, and ebtables.
The module also introduces the resource firewallchain
, which allows you to manage chains or firewall lists. At the moment, only iptables and ip6tables chains are supported.
Firewall uses Ruby-based providers, so you must have pluginsync enabled.
\n\nTo begin, you need to provide some initial top-scope configuration to ensure your firewall configurations are ordered properly and you do not lock yourself out of your box or lose any configuration.
\n\nPersistence of rules between reboots is handled automatically, although there are known issues with ip6tables on older Debian/Ubuntu, as well as known issues with ebtables.
\n\nIn your site.pp
(or some similarly top-scope file), set up a metatype to purge unmanaged firewall resources. This will clear any existing rules and make sure that only rules defined in Puppet exist on the machine.
resources { "firewall":\n purge => true\n}\n
\n\nNext, set up the default parameters for all of the firewall rules you will be establishing later. These defaults will ensure that the pre and post classes (you will be setting up in just a moment) are run in the correct order to avoid locking you out of your box during the first puppet run.
\n\nFirewall {\n before => Class['my_fw::post'],\n require => Class['my_fw::pre'],\n}\n
\n\nYou also need to declare the my_fw::pre
& my_fw::post
classes so that dependencies are satisfied. This can be achieved using an External Node Classifier or the following
class { ['my_fw::pre', 'my_fw::post']: }\n
\n\nFinally, you should include the firewall
class to ensure the correct packages are installed.
class { 'firewall': }\n
\n\nNow to create the my_fw::pre
and my_fw::post
classes. Firewall acts on your running firewall, making immediate changes as the catalog executes. Defining default pre and post rules allows you provide global defaults for your hosts before and after any custom rules; it is also required to avoid locking yourself out of your own boxes when Puppet runs. This approach employs a allowlist setup, so you can define what rules you want and everything else is ignored rather than removed.
The pre
class should be located in my_fw/manifests/pre.pp
and should contain any default rules to be applied first.
class my_fw::pre {\n Firewall {\n require => undef,\n }\n\n # Default firewall rules\n firewall { '000 accept all icmp':\n proto => 'icmp',\n action => 'accept',\n }->\n firewall { '001 accept all to lo interface':\n proto => 'all',\n iniface => 'lo',\n action => 'accept',\n }->\n firewall { '002 accept related established rules':\n proto => 'all',\n state => ['RELATED', 'ESTABLISHED'],\n action => 'accept',\n }\n}\n
\n\nThe rules in pre
should allow basic networking (such as ICMP and TCP), as well as ensure that existing connections are not closed.
The post
class should be located in my_fw/manifests/post.pp
and include any default rules to be applied last.
class my_fw::post {\n firewall { '999 drop all':\n proto => 'all',\n action => 'drop',\n before => undef,\n }\n}\n
\n\nTo put it all together: the before
parameter in Firewall {}
ensures my_fw::post
is run before any other rules and the the require
parameter ensures my_fw::pre
is run after any other rules. So the run order is:
my_fw::pre
my_fw::post
Upgrade the module with the puppet module tool as normal:
\n\npuppet module upgrade puppetlabs/firewall\n
\n\nStart by upgrading the module using the puppet module tool:
\n\npuppet module upgrade puppetlabs/firewall\n
\n\nPreviously, you would have required the following in your site.pp
(or some other global location):
# Always persist firewall rules\nexec { 'persist-firewall':\n command => $operatingsystem ? {\n 'debian' => '/sbin/iptables-save > /etc/iptables/rules.v4',\n /(RedHat|CentOS)/ => '/sbin/iptables-save > /etc/sysconfig/iptables',\n },\n refreshonly => true,\n}\nFirewall {\n notify => Exec['persist-firewall'],\n before => Class['my_fw::post'],\n require => Class['my_fw::pre'],\n}\nFirewallchain {\n notify => Exec['persist-firewall'],\n}\nresources { "firewall":\n purge => true\n}\n
\n\nWith the latest version, we now have in-built persistence, so this is no longer needed. However, you will still need some basic setup to define pre & post rules.
\n\nresources { "firewall":\n purge => true\n}\nFirewall {\n before => Class['my_fw::post'],\n require => Class['my_fw::pre'],\n}\nclass { ['my_fw::pre', 'my_fw::post']: }\nclass { 'firewall': }\n
\n\nConsult the the documentation below for more details around the classes my_fw::pre
and my_fw::post
.
There are two kinds of firewall rules you can use with Firewall: default rules and application-specific rules. Default rules apply to general firewall settings, whereas application-specific rules manage firewall settings of a specific application, node, etc.
\n\nAll rules employ a numbering system in the resource's title that is used for ordering. When titling your rules, make sure you prefix the rule with a number.
\n\n 000 this runs first\n 999 this runs last\n
\n\nYou can place default rules in either my_fw::pre
or my_fw::post
, depending on when you would like them to run. Rules placed in the pre
class will run first, rules in the post
class, last.
Depending on the provider, the title of the rule can be stored using the comment feature of the underlying firewall subsystem. Values can match /^\\d+[[:alpha:][:digit:][:punct:][:space:]]+$/
.
Basic accept ICMP request example:
\n\nfirewall { "000 accept all icmp requests":\n proto => "icmp",\n action => "accept",\n}\n
\n\nDrop all:
\n\nfirewall { "999 drop all other requests":\n action => "drop",\n}\n
\n\nApplication-specific rules can live anywhere you declare the firewall resource. It is best to put your firewall rules close to the service that needs it, such as in the module that configures it.
\n\nYou should be able to add firewall rules to your application-specific classes so firewalling is performed at the same time when the class is invoked.
\n\nFor example, if you have an Apache module, you could declare the class as below
\n\nclass apache {\n firewall { '100 allow http and https access':\n port => [80, 443],\n proto => tcp,\n action => accept,\n }\n # ... the rest of your code ...\n}\n
\n\nWhen someone uses the class, firewalling is provided automatically.
\n\nclass { 'apache': }\n
\n\nYou can also apply firewall rules to specific nodes. Usually, you will want to put the firewall rule in another class and apply that class to a node. But you can apply a rule to a node.
\n\nnode 'foo.bar.com' {\n firewall { '111 open port 111':\n dport => 111\n }\n}\n
\n\nYou can also do more complex things with the firewall
resource. Here we are doing some NAT configuration.
firewall { '100 snat for network foo2':\n chain => 'POSTROUTING',\n jump => 'MASQUERADE',\n proto => 'all',\n outiface => "eth0",\n source => '10.1.2.0/24',\n table => 'nat',\n}\n
\n\nIn the below example, we are creating a new chain and forwarding any port 5000 access to it.
\n\nfirewall { '100 forward to MY_CHAIN':\n chain => 'INPUT',\n jump => 'MY_CHAIN',\n}\n# The namevar here is in the format chain_name:table:protocol\nfirewallchain { 'MY_CHAIN:filter:IPv4':\n ensure => present,\n}\nfirewall { '100 my rule':\n chain => 'MY_CHAIN',\n action => 'accept',\n proto => 'tcp',\n dport => 5000,\n}\n
\n\nYou can access the inline documentation:
\n\npuppet describe firewall\n
\n\nOr
\n\npuppet doc -r type\n(and search for firewall)\n
\n\nClasses:
\n\nTypes:
\n\nFacts:
\n\n\n\nThis class is provided to do the basic setup tasks required for using the firewall resources.
\n\nAt the moment this takes care of:
\n\nYou should include the class for nodes that need to use the resources in this module. For example
\n\nclass { 'firewall': }\n
\n\nensure
Indicates the state of iptables
on your system, allowing you to disable iptables
if desired.
Can either be running
or stopped
. Default to running
.
This type provides the capability to manage firewall rules within puppet.
\n\nFor more documentation on the type, access the 'Types' tab on the Puppet Labs Forge:
\n\nhttp://forge.puppetlabs.com/puppetlabs/firewall#types
\n\nThis type provides the capability to manage rule chains for firewalls.
\n\nFor more documentation on the type, access the 'Types' tab on the Puppet Labs Forge:
\n\nhttp://forge.puppetlabs.com/puppetlabs/firewall#types
\n\nThe module provides a Facter fact that can be used to determine what the default version of ip6tables is for your operating system/distribution.
\n\nThe module provides a Facter fact that can be used to determine what the default version of iptables is for your operating system/distribution.
\n\nRetrieves the version of iptables-persistent from your OS. This is a Debian/Ubuntu specific fact.
\n\nWhile we aim to support as low as Puppet 2.6.x (for now), we recommend installing the latest Puppet version from the Puppetlabs official repos.
\n\nPlease note, we only aim support for the following distributions and versions - that is, we actually do ongoing system tests on these platforms:
\n\nIf you want a new distribution supported feel free to raise a ticket and we'll consider it. If you want an older revision supported we'll also consider it, but don't get insulted if we reject it. Specifically, we will not consider Redhat 4.x support - its just too old.
\n\nIf you really want to get support for your OS we suggest writing any patch fix yourself, and for continual system testing if you can provide a sufficient trusted Veewee template we could consider adding such an OS to our ongoing continuous integration tests.
\n\nAlso, as this is a 0.x release the API is still in flux and may change. Make sure\nyou read the release notes before upgrading.
\n\nBugs can be reported using Github Issues:
\n\nhttp://github.com/puppetlabs/puppetlabs-firewall/issues
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n\nFor this particular module, please also read CONTRIBUTING.md before contributing.
\n\nCurrently we support:
\n\nBut plans are to support lots of other firewall implementations:
\n\nIf you have knowledge in these technologies, know how to code, and wish to contribute to this project, we would welcome the help.
\n\nMake sure you have:
\n\nInstall the necessary gems:
\n\nbundle install\n
\n\nAnd run the tests from the root of the source code:
\n\nrake test\n
\n\nIf you have a copy of Vagrant 1.1.0 you can also run the system tests:
\n\nRSPEC_SET=debian-606-x64 rake spec:system\nRSPEC_SET=centos-58-x64 rake spec:system\n
\n\nNote: system testing is fairly alpha at this point, your mileage may vary.
\n## puppetlabs-firewall changelog\n\nRelease notes for puppetlabs-firewall module.\n\n---------------------------------------\n\n#### 0.4.2 - 2013-09-10\n\nAnother attempt to fix the packaging issue. We think we understand exactly\nwhat is failing and this should work properly for the first time.\n\n---------------------------------------\n\n#### 0.4.1 - 2013-08-09\n\nBugfix release to fix a packaging issue that may have caused puppet module\ninstall commands to fail.\n\n---------------------------------------\n\n#### 0.4.0 - 2013-07-11\n\nThis release adds support for address type, src/dest ip ranges, and adds\nadditional testing and bugfixes.\n\n#### Features\n* Add `src_type` and `dst_type` attributes (Nick Stenning)\n* Add `src_range` and `dst_range` attributes (Lei Zhang)\n* Add SL and SLC operatingsystems as supported (Steve Traylen)\n\n#### Bugfixes\n* Fix parser for bursts other than 5 (Chris Rutter)\n* Fix parser for -f in --comment (Georg Koester)\n* Add doc headers to class files (Dan Carley)\n* Fix lint warnings/errors (Wolf Noble)\n\n---------------------------------------\n\n#### 0.3.1 - 2013/6/10\n\nThis minor release provides some bugfixes and additional tests.\n\n#### Changes\n\n* Update tests for rspec-system-puppet 2 (Ken Barber)\n* Update rspec-system tests for rspec-system-puppet 1.5 (Ken Barber)\n* Ensure all services have 'hasstatus => true' for Puppet 2.6 (Ken Barber)\n* Accept pre-existing rule with invalid name (Joe Julian)\n* Swap log_prefix and log_level order to match the way it's saved (Ken Barber)\n* Fix log test to replicate bug #182 (Ken Barber)\n* Split argments while maintaining quoted strings (Joe Julian)\n* Add more log param tests (Ken Barber)\n* Add extra tests for logging parameters (Ken Barber)\n* Clarify OS support (Ken Barber)\n\n---------------------------------------\n\n#### 0.3.0 - 2013/4/25\n\nThis release introduces support for Arch Linux and extends support for Fedora 15 and up. There are also lots of bugs fixed and improved testing to prevent regressions.\n\n##### Changes\n\n* Fix error reporting for insane hostnames (Tomas Doran)\n* Support systemd on Fedora 15 and up (Eduardo Gutierrez)\n* Move examples to docs (Ken Barber)\n* Add support for Arch Linux platform (Ingmar Steen)\n* Add match rule for fragments (Georg Koester)\n* Fix boolean rules being recognized as changed (Georg Koester)\n* Same rules now get deleted (Anastasis Andronidis)\n* Socket params test (Ken Barber)\n* Ensure parameter can disable firewall (Marc Tardif)\n\n---------------------------------------\n\n#### 0.2.1 - 2012/3/13\n\nThis maintenance release introduces the new README layout, and fixes a bug with iptables_persistent_version.\n\n##### Changes\n\n* (GH-139) Throw away STDERR from dpkg-query in Fact\n* Update README to be consistent with module documentation template\n* Fix failing spec tests due to dpkg change in iptables_persistent_version\n\n---------------------------------------\n\n#### 0.2.0 - 2012/3/3\n\nThis release introduces automatic persistence, removing the need for the previous manual dependency requirement for persistent the running rules to the OS persistence file.\n\nPreviously you would have required the following in your site.pp (or some other global location):\n\n # Always persist firewall rules\n exec { 'persist-firewall':\n command => $operatingsystem ? {\n 'debian' => '/sbin/iptables-save > /etc/iptables/rules.v4',\n /(RedHat|CentOS)/ => '/sbin/iptables-save > /etc/sysconfig/iptables',\n },\n refreshonly => true,\n }\n Firewall {\n notify => Exec['persist-firewall'],\n before => Class['my_fw::post'],\n require => Class['my_fw::pre'],\n }\n Firewallchain {\n notify => Exec['persist-firewall'],\n }\n resources { "firewall":\n purge => true\n }\n\nYou only need:\n\n class { 'firewall': }\n Firewall {\n before => Class['my_fw::post'],\n require => Class['my_fw::pre'],\n }\n\nTo install pre-requisites and to create dependencies on your pre & post rules. Consult the README for more information.\n\n##### Changes\n\n* Firewall class manifests (Dan Carley)\n* Firewall and firewallchain persistence (Dan Carley)\n* (GH-134) Autorequire iptables related packages (Dan Carley)\n* Typo in #persist_iptables OS normalisation (Dan Carley)\n* Tests for #persist_iptables (Dan Carley)\n* (GH-129) Replace errant return in autoreq block (Dan Carley)\n\n---------------------------------------\n\n#### 0.1.1 - 2012/2/28\n\nThis release primarily fixes changing parameters in 3.x\n\n##### Changes\n\n* (GH-128) Change method_missing usage to define_method for 3.x compatibility\n* Update travis.yml gem specifications to actually test 2.6\n* Change source in Gemfile to use a specific URL for Ruby 2.0.0 compatibility\n\n---------------------------------------\n\n#### 0.1.0 - 2012/2/24\n\nThis release is somewhat belated, so no summary as there are far too many changes this time around. Hopefully we won't fall this far behind again :-).\n\n##### Changes\n\n* Add support for MARK target and set-mark property (Johan Huysmans)\n* Fix broken call to super for ruby-1.9.2 in munge (Ken Barber)\n* simple fix of the error message for allowed values of the jump property (Daniel Black)\n* Adding OSPF(v3) protocol to puppetlabs-firewall (Arnoud Vermeer)\n* Display multi-value: port, sport, dport and state command seperated (Daniel Black)\n* Require jump=>LOG for log params (Daniel Black)\n* Reject and document icmp => "any" (Dan Carley)\n* add firewallchain type and iptables_chain provider (Daniel Black)\n* Various fixes for firewallchain resource (Ken Barber)\n* Modify firewallchain name to be chain:table:protocol (Ken Barber)\n* Fix allvalidchain iteration (Ken Barber)\n* Firewall autorequire Firewallchains (Dan Carley)\n* Tests and docstring for chain autorequire (Dan Carley)\n* Fix README so setup instructions actually work (Ken Barber)\n* Support vlan interfaces (interface containing ".") (Johan Huysmans)\n* Add tests for VLAN support for iniface/outiface (Ken Barber)\n* Add the table when deleting rules (Johan Huysmans)\n* Fix tests since we are now prefixing -t)\n* Changed 'jump' to 'action', commands to lower case (Jason Short)\n* Support interface names containing "+" (Simon Deziel)\n* Fix for when iptables-save spews out "FATAL" errors (Sharif Nassar)\n* Fix for incorrect limit command arguments for ip6tables provider (Michael Hsu)\n* Document Util::Firewall.host_to_ip (Dan Carley)\n* Nullify addresses with zero prefixlen (Dan Carley)\n* Add support for --tcp-flags (Thomas Vander Stichele)\n* Make tcp_flags support a feature (Ken Barber)\n* OUTPUT is a valid chain for the mangle table (Adam Gibbins)\n* Enable travis-ci support (Ken Barber)\n* Convert an existing test to CIDR (Dan Carley)\n* Normalise iptables-save to CIDR (Dan Carley)\n* be clearer about what distributions we support (Ken Barber)\n* add gre protocol to list of acceptable protocols (Jason Hancock)\n* Added pkttype property (Ashley Penney)\n* Fix mark to not repeat rules with iptables 1.4.1+ (Sharif Nassar)\n* Stub iptables_version for now so tests run on non-Linux hosts (Ken Barber)\n* Stub iptables facts for set_mark tests (Dan Carley)\n* Update formatting of README to meet Puppet Labs best practices (Will Hopper)\n* Support for ICMP6 type code resolutions (Dan Carley)\n* Insert order hash included chains from different tables (Ken Barber)\n* rspec 2.11 compatibility (Jonathan Boyett)\n* Add missing class declaration in README (sfozz)\n* array_matching is contraindicated (Sharif Nassar)\n* Convert port Fixnum into strings (Sharif Nassar)\n* Update test framework to the modern age (Ken Barber)\n* working with ip6tables support (wuwx)\n* Remove gemfile.lock and add to gitignore (William Van Hevelingen)\n* Update travis and gemfile to be like stdlib travis files (William Van Hevelingen)\n* Add support for -m socket option (Ken Barber)\n* Add support for single --sport and --dport parsing (Ken Barber)\n* Fix tests for Ruby 1.9.3 from 3e13bf3 (Dan Carley)\n* Mock Resolv.getaddress in #host_to_ip (Dan Carley)\n* Update docs for source and dest - they are not arrays (Ken Barber)\n\n---------------------------------------\n\n#### 0.0.4 - 2011/12/05\n\nThis release adds two new parameters, 'uid' and 'gid'. As a part of the owner module, these params allow you to specify a uid, username, gid, or group got a match:\n\n firewall { '497 match uid':\n port => '123',\n proto => 'mangle',\n chain => 'OUTPUT',\n action => 'drop'\n uid => '123'\n }\n\nThis release also adds value munging for the 'log_level', 'source', and 'destination' parameters. The 'source' and 'destination' now support hostnames:\n\n firewall { '498 accept from puppetlabs.com':\n port => '123',\n proto => 'tcp',\n source => 'puppetlabs.com',\n action => 'accept'\n }\n\n\nThe 'log_level' parameter now supports using log level names, such as 'warn', 'debug', and 'panic':\n\n firewall { '499 logging':\n port => '123',\n proto => 'udp',\n log_level => 'debug',\n action => 'drop'\n }\n\nAdditional changes include iptables and ip6tables version facts, general whitespace cleanup, and adding additional unit tests.\n\n##### Changes\n\n* (#10957) add iptables_version and ip6tables_version facts\n* (#11093) Improve log_level property so it converts names to numbers\n* (#10723) Munge hostnames and IPs to IPs with CIDR\n* (#10718) Add owner-match support\n* (#10997) Add fixtures for ipencap\n* (#11034) Whitespace cleanup\n* (#10690) add port property support to ip6tables\n\n---------------------------------------\n\n#### 0.0.3 - 2011/11/12\n\nThis release introduces a new parameter 'port' which allows you to set both\nsource and destination ports for a match:\n\n firewall { "500 allow NTP requests":\n port => "123",\n proto => "udp",\n action => "accept",\n }\n\nWe also have the limit parameter finally working:\n\n firewall { "500 limit HTTP requests":\n dport => 80,\n proto => tcp,\n limit => "60/sec",\n burst => 30,\n action => accept,\n }\n\nState ordering has been fixed now, and more characters are allowed in the\nnamevar:\n\n* Alphabetical\n* Numbers\n* Punctuation\n* Whitespace\n\n##### Changes\n\n* (#10693) Ensure -m limit is added for iptables when using 'limit' param\n* (#10690) Create new port property\n* (#10700) allow additional characters in comment string\n* (#9082) Sort iptables --state option values internally to keep it consistent across runs\n* (#10324) Remove extraneous whitespace from iptables rule line in spec tests\n\n---------------------------------------\n\n#### 0.0.2 - 2011/10/26\n\nThis is largely a maintanence and cleanup release, but includes the ability to\nspecify ranges of ports in the sport/dport parameter:\n\n firewall { "500 allow port range":\n dport => ["3000-3030","5000-5050"],\n sport => ["1024-65535"],\n action => "accept",\n }\n\n##### Changes\n\n* (#10295) Work around bug #4248 whereby the puppet/util paths are not being loaded correctly on the primary Puppet server\n* (#10002) Change to dport and sport to handle ranges, and fix handling of name to name to port\n* (#10263) Fix tests on Puppet 2.6.x\n* (#10163) Cleanup some of the inline documentation and README file to align with general forge usage\n\n---------------------------------------\n\n#### 0.0.1 - 2011/10/18\n\nInitial release.\n\n##### Changes\n\n* (#9362) Create action property and perform transformation for accept, drop, reject value for iptables jump parameter\n* (#10088) Provide a customised version of CONTRIBUTING.md\n* (#10026) Re-arrange provider and type spec files to align with Puppet\n* (#10026) Add aliases for test,specs,tests to Rakefile and provide -T as default\n* (#9439) fix parsing and deleting existing rules\n* (#9583) Fix provider detection for gentoo and unsupported linuxes for the iptables provider\n* (#9576) Stub provider so it works properly outside of Linux\n* (#9576) Align spec framework with Puppet core\n* and lots of other earlier development tasks ...\n
Puppet Firewall Module - Puppet module for managing Firewalls\n\nCopyright (C) 2011-2013 Puppet Labs, Inc.\nCopyright (C) 2011 Jonathan Boyett\nCopyright (C) 2011 Media Temple, Inc.\n\nSome of the iptables code was taken from puppet-iptables which was:\n\nCopyright (C) 2011 Bob.sh Limited\nCopyright (C) 2008 Camptocamp Association\nCopyright (C) 2007 Dmitri Priimak\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
The Apache module allows you to set up virtual hosts and manage web services with minimal effort.
\n\nApache is a widely-used web server, and this module provides a simplified way of creating configurations to manage your infrastructure. This includes the ability to configure and manage a range of different virtual host setups, as well as a streamlined way to install and configure Apache modules.
\n\nWhat Apache affects:
\n\n/etc/make.conf
on FreeBSDTo install Apache with the default parameters
\n\n class { 'apache': }\n
\n\nThe defaults are determined by your operating system (e.g. Debian systems have one set of defaults, RedHat systems have another). These defaults will work well in a testing environment, but are not suggested for production. To establish customized parameters
\n\n class { 'apache':\n default_mods => false,\n default_confd_files => false,\n }\n
\n\nDeclaring the apache
class will create a default virtual host by setting up a vhost on port 80, listening on all interfaces and serving $apache::docroot
.
class { 'apache': }\n
\n\nTo configure a very basic, name-based virtual host
\n\n apache::vhost { 'first.example.com':\n port => '80',\n docroot => '/var/www/first',\n }\n
\n\nNote: The default priority is 15. If nothing matches this priority, the alphabetically first name-based vhost will be used. This is also true if you pass a higher priority and no names match anything else.
\n\nA slightly more complicated example, which moves the docroot owner/group
\n\n apache::vhost { 'second.example.com':\n port => '80',\n docroot => '/var/www/second',\n docroot_owner => 'third',\n docroot_group => 'third',\n }\n
\n\nTo set up a virtual host with SSL and default SSL certificates
\n\n apache::vhost { 'ssl.example.com':\n port => '443',\n docroot => '/var/www/ssl',\n ssl => true,\n }\n
\n\nTo set up a virtual host with SSL and specific SSL certificates
\n\n apache::vhost { 'fourth.example.com':\n port => '443',\n docroot => '/var/www/fourth',\n ssl => true,\n ssl_cert => '/etc/ssl/fourth.example.com.cert',\n ssl_key => '/etc/ssl/fourth.example.com.key',\n }\n
\n\nTo set up a virtual host with IP address different than '*'
\n\n apache::vhost { 'subdomain.example.com':\n ip => '127.0.0.1',\n port => '80',\n docrout => '/var/www/subdomain',\n }\n
\n\nTo set up a virtual host with wildcard alias for subdomain mapped to same named directory\nhttp://examle.com.loc => /var/www/example.com
apache::vhost { 'subdomain.loc':\n vhost_name => '*',\n port => '80',\n virtual_docroot' => '/var/www/%-2+',\n docroot => '/var/www',\n serveraliases => ['*.loc',],\n }\n
\n\nTo set up a virtual host with suPHP
\n\n apache::vhost { 'suphp.example.com':\n port => '80',\n docroot => '/home/appuser/myphpapp',\n suphp_addhandler => 'x-httpd-php',\n suphp_engine => 'on',\n suphp_configpath => '/etc/php5/apache2',\n directories => { path => '/home/appuser/myphpapp',\n 'suphp' => { user => 'myappuser', group => 'myappgroup' },\n }\n }\n
\n\nTo set up a virtual host with WSGI
\n\n apache::vhost { 'wsgi.example.com':\n port => '80',\n docroot => '/var/www/pythonapp',\n wsgi_daemon_process => 'wsgi',\n wsgi_daemon_process_options =>\n { processes => '2', threads => '15', display-name => '%{GROUP}' },\n wsgi_process_group => 'wsgi',\n wsgi_script_aliases => { '/' => '/var/www/demo.wsgi' },\n }\n
\n\nStarting 2.2.16, httpd supports FallbackResource which is a simple replace for common RewriteRules:
\n\n apache::vhost { 'wordpress.example.com':\n port => '80',\n docroot => '/var/www/wordpress',\n fallbackresource => '/index.php',\n }\n
\n\nPlease note that the disabled
argument to FallbackResource is only supported since 2.2.24.
To see a list of all virtual host parameters, please go here. To see an extensive list of virtual host examples please look here.
\n\nThis module modifies Apache configuration files and directories and will purge any configuration not managed by Puppet. Configuration of Apache should be managed by Puppet, as non-puppet configuration files can cause unexpected failures.
\n\nIt is possible to temporarily disable full Puppet management by setting the purge_configs
parameter within the base apache
class to 'false'. This option should only be used as a temporary means of saving and relocating customized configurations.
apache
The Apache module's primary class, apache
, guides the basic setup of Apache on your system.
You may establish a default vhost in this class, the vhost
class, or both. You may add additional vhost configurations for specific virtual hosts using a declaration of the vhost
type.
Parameters within apache
:
default_mods
Sets up Apache with default settings based on your OS. Defaults to 'true', set to 'false' for customized configuration.
\n\ndefault_vhost
Sets up a default virtual host. Defaults to 'true', set to 'false' to set up customized virtual hosts.
\n\ndefault_confd_files
Generates default set of include-able apache configuration files under ${apache::confd_dir}
directory. These configuration files correspond to what is usually installed with apache package on given platform.
default_ssl_vhost
Sets up a default SSL virtual host. Defaults to 'false'.
\n\n apache::vhost { 'default-ssl':\n port => 443,\n ssl => true,\n docroot => $docroot,\n scriptalias => $scriptalias,\n serveradmin => $serveradmin,\n access_log_file => "ssl_${access_log_file}",\n }\n
\n\nSSL vhosts only respond to HTTPS queries.
\n\ndefault_ssl_cert
The default SSL certification, which is automatically set based on your operating system (/etc/pki/tls/certs/localhost.crt
for RedHat, /etc/ssl/certs/ssl-cert-snakeoil.pem
for Debian, /usr/local/etc/apache22/server.crt
for FreeBSD). This default will work out of the box but must be updated with your specific certificate information before being used in production.
default_ssl_key
The default SSL key, which is automatically set based on your operating system (/etc/pki/tls/private/localhost.key
for RedHat, /etc/ssl/private/ssl-cert-snakeoil.key
for Debian, /usr/local/etc/apache22/server.key
for FreeBSD). This default will work out of the box but must be updated with your specific certificate information before being used in production.
default_ssl_chain
The default SSL chain, which is automatically set to 'undef'. This default will work out of the box but must be updated with your specific certificate information before being used in production.
\n\ndefault_ssl_ca
The default certificate authority, which is automatically set to 'undef'. This default will work out of the box but must be updated with your specific certificate information before being used in production.
\n\ndefault_ssl_crl_path
The default certificate revocation list path, which is automatically set to 'undef'. This default will work out of the box but must be updated with your specific certificate information before being used in production.
\n\ndefault_ssl_crl
The default certificate revocation list to use, which is automatically set to 'undef'. This default will work out of the box but must be updated with your specific certificate information before being used in production.
\n\nservice_name
Name of apache service to run. Defaults to: 'httpd'
on RedHat, 'apache2'
on Debian, and 'apache22'
on FreeBSD.
service_enable
Determines whether the 'httpd' service is enabled when the machine is booted. Defaults to 'true'.
\n\nservice_ensure
Determines whether the service should be running. Can be set to 'undef' which is useful when you want to let the service be managed by some other application like pacemaker. Defaults to 'running'.
\n\npurge_configs
Removes all other apache configs and vhosts, which is automatically set to true. Setting this to false is a stopgap measure to allow the apache module to coexist with existing or otherwise managed configuration. It is recommended that you move your configuration entirely to resources within this module.
\n\nserveradmin
Sets the server administrator. Defaults to 'root@localhost'.
\n\nservername
Sets the servername. Defaults to fqdn provided by facter.
\n\nserver_root
A value to be set as ServerRoot
in main configuration file (httpd.conf
). Defaults to /etc/httpd
on RedHat, /etc/apache2
on Debian and /usr/local
on FreeBSD.
sendfile
Makes Apache use the Linux kernel 'sendfile' to serve static files. Defaults to 'On'.
\n\nserver_root
A value to be set as ServerRoot
in main configuration file (httpd.conf
). Defaults to /etc/httpd
on RedHat and /etc/apache2
on Debian.
error_documents
Enables custom error documents. Defaults to 'false'.
\n\nhttpd_dir
Changes the base location of the configuration directories used for the service. This is useful for specially repackaged HTTPD builds but may have unintended consequences when used in combination with the default distribution packages. Default is based on your OS.
\n\nconfd_dir
Changes the location of the configuration directory your custom configuration files are placed in. Default is based on your OS.
\n\nvhost_dir
Changes the location of the configuration directory your virtual host configuration files are placed in. Default is based on your OS.
\n\nmod_dir
Changes the location of the configuration directory your Apache modules configuration files are placed in. Default is based on your OS.
\n\nmpm_module
Configures which mpm module is loaded and configured for the httpd process by the apache::mod::event
, apache::mod::itk
, apache::mod::peruser
, apache::mod::prefork
and apache::mod::worker
classes. Must be set to false
to explicitly declare apache::mod::event
, apache::mod::itk
, apache::mod::peruser
, apache::mod::prefork
or apache::mod::worker
classes with parameters. All possible values are event
, itk
, peruser
, prefork
, worker
(valid values depend on agent's OS), or the boolean false
. Defaults to prefork
on RedHat and FreeBSD and worker
on Debian. Note: on FreeBSD switching between different mpm modules is quite difficult (but possible). Before changing $mpm_module
one has to deinstall all packages that depend on currently installed apache
.
conf_template
Setting this allows you to override the template used for the main apache configuration file. This is a potentially risky thing to do as this module has been built around the concept of a minimal configuration file with most of the configuration coming in the form of conf.d/ entries. Defaults to 'apache/httpd.conf.erb'.
\n\nkeepalive
Setting this allows you to enable persistent connections.
\n\nkeepalive_timeout
Amount of time the server will wait for subsequent requests on a persistent connection. Defaults to '15'.
\n\nlogroot
Changes the location of the directory Apache log files are placed in. Defaut is based on your OS.
\n\nlog_level
Changes the verbosity level of the error log. Defaults to 'warn'. Valid values are emerg
, alert
, crit
, error
, warn
, notice
, info
or debug
.
ports_file
Changes the name of the file containing Apache ports configuration. Default is ${conf_dir}/ports.conf
.
server_tokens
Controls how much information Apache sends to the browser about itself and the operating system. See Apache documentation for 'ServerTokens'. Defaults to 'OS'.
\n\nserver_signature
Allows the configuration of a trailing footer line under server-generated documents. See Apache documentation for 'ServerSignature'. Defaults to 'On'.
\n\ntrace_enable
Controls, how TRACE requests per RFC 2616 are handled. See Apache documentation for 'TraceEnable'. Defaults to 'On'.
\n\nmanage_user
Setting this to false will avoid the user resource to be created by this module. This is useful when you already have a user created in another puppet module and that you want to used it to run apache. Without this, it would result in a duplicate resource error.
\n\nmanage_group
Setting this to false will avoid the group resource to be created by this module. This is useful when you already have a group created in another puppet module and that you want to used it for apache. Without this, it would result in a duplicate resource error.
\n\npackage_ensure
Allow control over the package ensure statement. This is useful if you want to make sure apache is always at the latest version or whether it is only installed.
\n\napache::default_mods
Installs default Apache modules based on what OS you are running
\n\n class { 'apache::default_mods': }\n
\n\napache::mod
Used to enable arbitrary Apache httpd modules for which there is no specific apache::mod::[name]
class. The apache::mod
defined type will also install the required packages to enable the module, if any.
apache::mod { 'rewrite': }\n apache::mod { 'ldap': }\n
\n\napache::mod::[name]
There are many apache::mod::[name]
classes within this module that can be declared using include
:
alias
auth_basic
auth_kerb
autoindex
cache
cgi
cgid
dav
dav_fs
dav_svn
deflate
dev
dir
*disk_cache
event
fastcgi
fcgid
headers
info
itk
ldap
mime
mime_magic
*mpm_event
negotiation
nss
*passenger
*perl
peruser
php
(requires mpm_module
set to prefork
)prefork
*proxy
*proxy_ajp
proxy_html
proxy_http
python
reqtimeout
rewrite
rpaf
*setenvif
ssl
* (see apache::mod::ssl below)status
*suphp
userdir
*vhost_alias
worker
*wsgi
(see apache::mod::wsgi below)xsendfile
Modules noted with a * indicate that the module has settings and, thus, a template that includes parameters. These parameters control the module's configuration. Most of the time, these parameters will not require any configuration or attention.
\n\nThe modules mentioned above, and other Apache modules that have templates, will cause template files to be dropped along with the mod install, and the module will not work without the template. Any mod without a template will install package but drop no files.
\n\napache::mod::ssl
Installs Apache SSL capabilities and utilizes ssl.conf.erb
template. These are the defaults:
class { 'apache::mod::ssl':\n ssl_compression => false,\n ssl_options => [ 'StdEnvVars' ],\n }\n
\n\nTo use SSL with a virtual host, you must either set thedefault_ssl_vhost
parameter in apache
to 'true' or set the ssl
parameter in apache::vhost
to 'true'.
apache::mod::wsgi
class { 'apache::mod::wsgi':\n wsgi_socket_prefix => "\\${APACHE_RUN_DIR}WSGI",\n wsgi_python_home => '/path/to/virtenv',\n wsgi_python_path => '/path/to/virtenv/site-packages',\n }\n
\n\napache::vhost
The Apache module allows a lot of flexibility in the set up and configuration of virtual hosts. This flexibility is due, in part, to vhost
's setup as a defined resource type, which allows it to be evaluated multiple times with different parameters.
The vhost
defined type allows you to have specialized configurations for virtual hosts that have requirements outside of the defaults. You can set up a default vhost within the base apache
class as well as set a customized vhost setup as default. Your customized vhost (priority 10) will be privileged over the base class vhost (15).
If you have a series of specific configurations and do not want a base apache
class default vhost, make sure to set the base class default host to 'false'.
class { 'apache':\n default_vhost => false,\n }\n
\n\nParameters within apache::vhost
:
The default values for each parameter will vary based on operating system and type of virtual host.
\n\naccess_log
Specifies whether *_access.log
directives should be configured. Valid values are 'true' and 'false'. Defaults to 'true'.
access_log_file
Points to the *_access.log
file. Defaults to 'undef'.
access_log_pipe
Specifies a pipe to send access log messages to. Defaults to 'undef'.
\n\naccess_log_syslog
Sends all access log messages to syslog. Defaults to 'undef'.
\n\naccess_log_format
Specifies either a LogFormat nickname or custom format string for access log. Defaults to 'undef'.
\n\nadd_listen
Determines whether the vhost creates a listen statement. The default value is 'true'.
\n\nSetting add_listen
to 'false' stops the vhost from creating a listen statement, and this is important when you combine vhosts that are not passed an ip
parameter with vhosts that are passed the ip
parameter.
aliases
Passes a list of hashes to the vhost to create Alias
or AliasMatch
statements as per the mod_alias
documentation. Each hash is expected to be of the form:
aliases => [\n { aliasmatch => '^/image/(.*)\\.jpg$', path => '/files/jpg.images/$1.jpg' }\n { alias => '/image', path => '/ftp/pub/image' },\n],\n
\n\nFor Alias
and AliasMatch
to work, each will need a corresponding <Directory /path/to/directory>
or <Location /path/to/directory>
block. The Alias
and AliasMatch
directives are created in the order specified in the aliases
paramter. As described in the mod_alias
documentation more specific Alias
or AliasMatch
directives should come before the more general ones to avoid shadowing.
Note: If apache::mod::passenger
is loaded and PassengerHighPerformance true
is set, then Alias
may have issues honouring the PassengerEnabled off
statement. See this article for details.
block
Specifies the list of things Apache will block access to. The default is an empty set, '[]'. Currently, the only option is 'scm', which blocks web access to .svn, .git and .bzr directories. To add to this, please see the Development section.
\n\ncustom_fragment
Pass a string of custom configuration directives to be placed at the end of the vhost configuration.
\n\ndefault_vhost
Sets a given apache::vhost
as the default to serve requests that do not match any other apache::vhost
definitions. The default value is 'false'.
directories
Passes a list of hashes to the vhost to create <Directory /path/to/directory>...</Directory>
directive blocks as per the Apache core documentation. The path
key is required in these hashes. An optional provider
defaults to directory
. Usage will typically look like:
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [\n { path => '/path/to/directory', <directive> => <value> },\n { path => '/path/to/another/directory', <directive> => <value> },\n ],\n }\n
\n\nNote: At least one directory should match docroot
parameter, once you start declaring directories apache::vhost
assumes that all required <Directory>
blocks will be declared.
Note: If not defined a single default <Directory>
block will be created that matches the docroot
parameter.
provider
can be set to any of directory
, files
, or location
. If the pathspec starts with a ~
, httpd will interpret this as the equivalent of DirectoryMatch
, FilesMatch
, or LocationMatch
, respectively.
apache::vhost { 'files.example.net':\n docroot => '/var/www/files',\n directories => [\n { path => '~ (\\.swp|\\.bak|~)$', 'provider' => 'files', 'deny' => 'from all' },\n ],\n }\n
\n\nThe directives will be embedded within the Directory
(Files
, or Location
) directive block, missing directives should be undefined and not be added, resulting in their default vaules in Apache. Currently this is the list of supported directives:
addhandlers
Sets AddHandler
directives as per the Apache Core documentation. Accepts a list of hashes of the form { handler => 'handler-name', extensions => ['extension']}
. Note that extensions
is a list of extenstions being handled by the handler.\nAn example:
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory',\n addhandlers => [ { handler => 'cgi-script', extensions => ['.cgi']} ],\n } ],\n }\n
\n\nallow
Sets an Allow
directive as per the Apache Core documentation. An example:
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', allow => 'from example.org' } ],\n }\n
\n\nallow_override
Sets the usage of .htaccess
files as per the Apache core documentation. Should accept in the form of a list or a string. An example:
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', allow_override => ['AuthConfig', 'Indexes'] } ],\n }\n
\n\ndeny
Sets an Deny
directive as per the Apache Core documentation. An example:
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', deny => 'from example.org' } ],\n }\n
\n\nerror_documents
A list of hashes which can be used to override the ErrorDocument settings for this directory. Example:
\n\n apache::vhost { 'sample.example.net':\n directories => [ { path => '/srv/www'\n error_documents => [\n { 'error_code' => '503', 'document' => '/service-unavail' },\n ],\n }]\n }\n
\n\nheaders
Adds lines for Header
directives as per the Apache Header documentation. An example:
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => {\n path => '/path/to/directory',\n headers => 'Set X-Robots-Tag "noindex, noarchive, nosnippet"',\n },\n }\n
\n\noptions
Lists the options for the given <Directory>
block
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', options => ['Indexes','FollowSymLinks','MultiViews'] }],\n }\n
\n\nindex_options
Styles the list
\n\n apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', options => ['Indexes','FollowSymLinks','MultiViews'], index_options => ['IgnoreCase', 'FancyIndexing', 'FoldersFirst', 'NameWidth=*', 'DescriptionWidth=*', 'SuppressHTMLPreamble'] }],\n }\n
\n\nindex_order_default
Sets the order of the list
\n\n apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', order => 'Allow,Deny', index_order_default => ['Descending', 'Date']}, ],\n }\n
\n\norder
Sets the order of processing Allow
and Deny
statements as per Apache core documentation. An example:
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', order => 'Allow,Deny' } ],\n }\n
\n\nauth_type
Sets the value for AuthType
as per the Apache AuthType\ndocumentation.
auth_name
Sets the value for AuthName
as per the Apache AuthName\ndocumentation.
auth_digest_algorithm
Sets the value for AuthDigestAlgorithm
as per the Apache\nAuthDigestAlgorithm\ndocumentation
auth_digest_domain
Sets the value for AuthDigestDomain
as per the Apache AuthDigestDomain\ndocumentation.
auth_digest_nonce_lifetime
Sets the value for AuthDigestNonceLifetime
as per the Apache\nAuthDigestNonceLifetime\ndocumentation
auth_digest_provider
Sets the value for AuthDigestProvider
as per the Apache AuthDigestProvider\ndocumentation.
auth_digest_qop
Sets the value for AuthDigestQop
as per the Apache AuthDigestQop\ndocumentation.
auth_digest_shmem_size
Sets the value for AuthAuthDigestShmemSize
as per the Apache AuthDigestShmemSize\ndocumentation.
auth_basic_authoritative
Sets the value for AuthBasicAuthoritative
as per the Apache\nAuthBasicAuthoritative\ndocumentation.
auth_basic_fake
Sets the value for AuthBasicFake
as per the Apache AuthBasicFake\ndocumentation.
auth_basic_provider
Sets the value for AuthBasicProvider
as per the Apache AuthBasicProvider\ndocumentation.
auth_user_file
Sets the value for AuthUserFile
as per the Apache AuthUserFile\ndocumentation.
auth_require
Sets the value for AuthName
as per the Apache Require\ndocumentation
passenger_enabled
Sets the value for the PassengerEnabled
directory to on
or off
as per the Passenger documentation.
apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n directories => [ { path => '/path/to/directory', passenger_enabled => 'off' } ],\n }\n
\n\nNote: This directive requires apache::mod::passenger
to be active, Apache may not start with an unrecognised directive without it.
Note: Be aware that there is an issue using the PassengerEnabled
directive with the PassengerHighPerformance
directive.
ssl_options
String or list of SSLOptions
for the given <Directory>
block. This overrides, or refines the SSLOptions
of the parent block (either vhost, or server).
apache::vhost { 'secure.example.net':\n docroot => '/path/to/directory',\n directories => [\n { path => '/path/to/directory', ssl_options => '+ExportCertData' }\n { path => '/path/to/different/dir', ssl_options => [ '-StdEnvVars', '+ExportCertData'] },\n ],\n }\n
\n\nsuphp
An array containing two values: User and group for the suPHP_UserGroup setting.\nThis directive must be used with suphp_engine => on
in the vhost declaration. This directive only works in <Directory>
or <Location>
.
apache::vhost { 'secure.example.net':\n docroot => '/path/to/directory',\n directories => [\n { path => '/path/to/directory', suphp => { user => 'myappuser', group => 'myappgroup' }\n ],\n }\n
\n\ncustom_fragment
Pass a string of custom configuration directives to be placed at the end of the\ndirectory configuration.
\n\ndirectoryindex
Set a DirectoryIndex directive, to set the list of resources to look for, when the client requests an index of the directory by specifying a / at the end of the directory name..
\n\ndocroot
Provides the DocumentRoot directive, identifying the directory Apache serves files from.
\n\ndocroot_group
Sets group access to the docroot directory. Defaults to 'root'.
\n\ndocroot_owner
Sets individual user access to the docroot directory. Defaults to 'root'.
\n\nerror_log
Specifies whether *_error.log
directives should be configured. Defaults to 'true'.
error_log_file
Points to the *_error.log
file. Defaults to 'undef'.
error_log_pipe
Specifies a pipe to send error log messages to. Defaults to 'undef'.
\n\nerror_log_syslog
Sends all error log messages to syslog. Defaults to 'undef'.
\n\nerror_documents
A list of hashes which can be used to override the ErrorDocument settings for this vhost. Defaults to []
. Example:
apache::vhost { 'sample.example.net':\n error_documents => [\n { 'error_code' => '503', 'document' => '/service-unavail' },\n { 'error_code' => '407', 'document' => 'https://example.com/proxy/login' },\n ],\n }\n
\n\nensure
Specifies if the vhost file is present or absent.
\n\nfastcgi_server
Specifies the filename as an external FastCGI application. Defaults to 'undef'.
\n\nfastcgi_socket
Filename used to communicate with the web server. Defaults to 'undef'.
\n\nfastcgi_dir
Directory to enable for FastCGI. Defaults to 'undef'.
\n\nadditional_includes
Specifies paths to additional static vhost-specific Apache configuration files.\nThis option is useful when you need to implement a unique and/or custom\nconfiguration not supported by this module.
\n\nip
The IP address the vhost listens on. Defaults to 'undef'.
\n\nip_based
Enables an IP-based vhost. This parameter inhibits the creation of a NameVirtualHost directive, since those are used to funnel requests to name-based vhosts. Defaults to 'false'.
\n\nlogroot
Specifies the location of the virtual host's logfiles. Defaults to /var/log/<apache log location>/
.
log_level
Specifies the verbosity level of the error log. Defaults to warn
for the global server configuration and can be overridden on a per-vhost basis using this parameter. Valid value for log_level
is one of emerg
, alert
, crit
, error
, warn
, notice
, info
or debug
.
no_proxy_uris
Specifies URLs you do not want to proxy. This parameter is meant to be used in combination with proxy_dest
.
options
Lists the options for the given virtual host
\n\n apache::vhost { 'site.name.fdqn':\n …\n options => ['Indexes','FollowSymLinks','MultiViews'],\n }\n
\n\noverride
Sets the overrides for the given virtual host. Accepts an array of AllowOverride arguments.
\n\nport
Sets the port the host is configured on.
\n\npriority
Sets the relative load-order for Apache httpd VirtualHost configuration files. Defaults to '25'.
\n\nIf nothing matches the priority, the first name-based vhost will be used. Likewise, passing a higher priority will cause the alphabetically first name-based vhost to be used if no other names match.
\n\nNote: You should not need to use this parameter. However, if you do use it, be aware that the default_vhost
parameter for apache::vhost
passes a priority of '15'.
proxy_dest
Specifies the destination address of a proxypass configuration. Defaults to 'undef'.
\n\nproxy_pass
Specifies an array of path => uri for a proxypass configuration. Defaults to 'undef'.
\n\nExample:
\n\n$proxy_pass = [\n { 'path' => '/a', 'url' => 'http://backend-a/' },\n { 'path' => '/b', 'url' => 'http://backend-b/' },\n { 'path' => '/c', 'url' => 'http://backend-a/c' }\n]\n\napache::vhost { 'site.name.fdqn':\n …\n proxy_pass => $proxy_pass,\n}\n
\n\nrack_base_uris
Specifies the resource identifiers for a rack configuration. The file paths specified will be listed as rack application roots for passenger/rack in the _rack.erb
template. Defaults to 'undef'.
redirect_dest
Specifies the address to redirect to. Defaults to 'undef'.
\n\nredirect_source
Specifies the source items? that will redirect to the destination specified in redirect_dest
. If more than one item for redirect is supplied, the source and destination must be the same length, and the items are order-dependent.
apache::vhost { 'site.name.fdqn':\n …\n redirect_source => ['/images','/downloads'],\n redirect_dest => ['http://img.example.com/','http://downloads.example.com/'],\n }\n
\n\nredirect_status
Specifies the status to append to the redirect. Defaults to 'undef'.
\n\n apache::vhost { 'site.name.fdqn':\n …\n redirect_status => ['temp','permanent'],\n }\n
\n\nrequest_headers
Specifies additional request headers.
\n\n apache::vhost { 'site.name.fdqn':\n …\n request_headers => [\n 'append MirrorID "mirror 12"',\n 'unset MirrorID',\n ],\n }\n
\n\nrewrite_base
Limits the rewrite_rule
to the specified base URL. Defaults to 'undef'.
apache::vhost { 'site.name.fdqn':\n …\n rewrite_rule => '^index\\.html$ welcome.html',\n rewrite_base => '/blog/',\n }\n
\n\nThe above example would limit the index.html -> welcome.html rewrite to only something inside of http://example.com/blog/.
\n\nrewrite_cond
Rewrites a URL via rewrite_rule
based on the truth of specified conditions. For example
apache::vhost { 'site.name.fdqn':\n …\n rewrite_cond => '%{HTTP_USER_AGENT} ^MSIE',\n }\n
\n\nwill rewrite URLs only if the visitor is using IE. Defaults to 'undef'.
\n\nNote: At the moment, each vhost is limited to a single list of rewrite conditions. In the future, you will be able to specify multiple rewrite_cond
and rewrite_rules
per vhost, so that different conditions get different rewrites.
rewrite_rule
Creates URL rewrite rules. Defaults to 'undef'. This parameter allows you to specify, for example, that anyone trying to access index.html will be served welcome.html.
\n\n apache::vhost { 'site.name.fdqn':\n …\n rewrite_rule => '^index\\.html$ welcome.html',\n }\n
\n\nscriptalias
Defines a directory of CGI scripts to be aliased to the path '/cgi-bin'
\n\nscriptaliases
Passes a list of hashes to the vhost to create ScriptAlias
or ScriptAliasMatch
statements as per the mod_alias
documentation. Each hash is expected to be of the form:
scriptaliases => [\n {\n alias => '/myscript',\n path => '/usr/share/myscript',\n },\n {\n aliasmatch => '^/foo(.*)',\n path => '/usr/share/fooscripts$1',\n },\n {\n aliasmatch => '^/bar/(.*)',\n path => '/usr/share/bar/wrapper.sh/$1',\n },\n {\n alias => '/neatscript',\n path => '/usr/share/neatscript',\n },\n ]\n
\n\nThese directives are created in the order specified. As with Alias
and AliasMatch
directives the more specific aliases should come before the more general ones to avoid shadowing.
serveradmin
Specifies the email address Apache will display when it renders one of its error pages.
\n\nserveraliases
Sets the server aliases of the site.
\n\nservername
Sets the primary name of the virtual host.
\n\nsetenv
Used by HTTPD to set environment variables for vhosts. Defaults to '[]'.
\n\nsetenvif
Used by HTTPD to conditionally set environment variables for vhosts. Defaults to '[]'.
\n\nssl
Enables SSL for the virtual host. SSL vhosts only respond to HTTPS queries. Valid values are 'true' or 'false'.
\n\nssl_ca
Specifies the certificate authority.
\n\nssl_cert
Specifies the SSL certification.
\n\nssl_protocol
Specifies the SSL Protocol (SSLProtocol).
\n\nssl_cipher
Specifies the SSLCipherSuite.
\n\nssl_honorcipherorder
Sets SSLHonorCipherOrder directive, used to prefer the server's cipher preference order
\n\nssl_certs_dir
Specifies the location of the SSL certification directory. Defaults to /etc/ssl/certs
on Debian and /etc/pki/tls/certs
on RedHat.
ssl_chain
Specifies the SSL chain.
\n\nssl_crl
Specifies the certificate revocation list to use.
\n\nssl_crl_path
Specifies the location of the certificate revocation list.
\n\nssl_key
Specifies the SSL key.
\n\nssl_verify_client
Sets SSLVerifyClient
directives as per the Apache Core documentation. Defaults to undef.\nAn example:
apache::vhost { 'sample.example.net':\n …\n ssl_verify_client => 'optional',\n }\n
\n\nssl_verify_depth
Sets SSLVerifyDepth
directives as per the Apache Core documentation. Defaults to undef.\nAn example:
apache::vhost { 'sample.example.net':\n …\n ssl_verify_depth => 1,\n }\n
\n\nssl_options
Sets SSLOptions
directives as per the Apache Core documentation. This is the global setting for the vhost and can be a string or an array. Defaults to undef. A single string example:
apache::vhost { 'sample.example.net':\n …\n ssl_options => '+ExportCertData',\n }\n
\n\nAn array of strings example:
\n\n apache::vhost { 'sample.example.net':\n …\n ssl_options => [ '+StrictRequire', '+ExportCertData' ],\n }\n
\n\nssl_proxyengine
Specifies whether to use SSLProxyEngine
or not. Defaults to false
.
vhost_name
This parameter is for use with name-based virtual hosting. Defaults to '*'.
\n\nitk
Hash containing infos to configure itk as per the ITK documentation.
\n\nKeys could be:
\n\nUsage will typically look like:
\n\n apache::vhost { 'sample.example.net':\n docroot => '/path/to/directory',\n itk => {\n user => 'someuser',\n group => 'somegroup',\n },\n }\n
\n\nThe Apache module allows you to set up pretty much any configuration of virtual host you might desire. This section will address some common configurations. Please see the Tests section for even more examples.
\n\nConfigure a vhost with a server administrator
\n\n apache::vhost { 'third.example.com':\n port => '80',\n docroot => '/var/www/third',\n serveradmin => 'admin@example.com',\n }\n
\n\nSet up a vhost with aliased servers
\n\n apache::vhost { 'sixth.example.com':\n serveraliases => [\n 'sixth.example.org',\n 'sixth.example.net',\n ],\n port => '80',\n docroot => '/var/www/fifth',\n }\n
\n\nConfigure a vhost with a cgi-bin
\n\n apache::vhost { 'eleventh.example.com':\n port => '80',\n docroot => '/var/www/eleventh',\n scriptalias => '/usr/lib/cgi-bin',\n }\n
\n\nSet up a vhost with a rack configuration
\n\n apache::vhost { 'fifteenth.example.com':\n port => '80',\n docroot => '/var/www/fifteenth',\n rack_base_uris => ['/rackapp1', '/rackapp2'],\n }\n
\n\nSet up a mix of SSL and non-SSL vhosts at the same domain
\n\n #The non-ssl vhost\n apache::vhost { 'first.example.com non-ssl':\n servername => 'first.example.com',\n port => '80',\n docroot => '/var/www/first',\n }\n\n #The SSL vhost at the same domain\n apache::vhost { 'first.example.com ssl':\n servername => 'first.example.com',\n port => '443',\n docroot => '/var/www/first',\n ssl => true,\n }\n
\n\nConfigure a vhost to redirect non-SSL connections to SSL
\n\n apache::vhost { 'sixteenth.example.com non-ssl':\n servername => 'sixteenth.example.com',\n port => '80',\n docroot => '/var/www/sixteenth',\n redirect_status => 'permanent'\n redirect_dest => 'https://sixteenth.example.com/'\n }\n apache::vhost { 'sixteenth.example.com ssl':\n servername => 'sixteenth.example.com',\n port => '443',\n docroot => '/var/www/sixteenth',\n ssl => true,\n }\n
\n\nSet up IP-based vhosts on any listen port and have them respond to requests on specific IP addresses. In this example, we will set listening on ports 80 and 81. This is required because the example vhosts are not declared with a port parameter.
\n\n apache::listen { '80': }\n apache::listen { '81': }\n
\n\nThen we will set up the IP-based vhosts
\n\n apache::vhost { 'first.example.com':\n ip => '10.0.0.10',\n docroot => '/var/www/first',\n ip_based => true,\n }\n apache::vhost { 'second.example.com':\n ip => '10.0.0.11',\n docroot => '/var/www/second',\n ip_based => true,\n }\n
\n\nConfigure a mix of name-based and IP-based vhosts. First, we will add two IP-based vhosts on 10.0.0.10, one SSL and one non-SSL
\n\n apache::vhost { 'The first IP-based vhost, non-ssl':\n servername => 'first.example.com',\n ip => '10.0.0.10',\n port => '80',\n ip_based => true,\n docroot => '/var/www/first',\n }\n apache::vhost { 'The first IP-based vhost, ssl':\n servername => 'first.example.com',\n ip => '10.0.0.10',\n port => '443',\n ip_based => true,\n docroot => '/var/www/first-ssl',\n ssl => true,\n }\n
\n\nThen, we will add two name-based vhosts listening on 10.0.0.20
\n\n apache::vhost { 'second.example.com':\n ip => '10.0.0.20',\n port => '80',\n docroot => '/var/www/second',\n }\n apache::vhost { 'third.example.com':\n ip => '10.0.0.20',\n port => '80',\n docroot => '/var/www/third',\n }\n
\n\nIf you want to add two name-based vhosts so that they will answer on either 10.0.0.10 or 10.0.0.20, you MUST declare add_listen => 'false'
to disable the otherwise automatic 'Listen 80', as it will conflict with the preceding IP-based vhosts.
apache::vhost { 'fourth.example.com':\n port => '80',\n docroot => '/var/www/fourth',\n add_listen => false,\n }\n apache::vhost { 'fifth.example.com':\n port => '80',\n docroot => '/var/www/fifth',\n add_listen => false,\n }\n
\n\napache::dev
Installs Apache development libraries
\n\n class { 'apache::dev': }\n
\n\nOn FreeBSD you're required to define apache::package
or apache
class before apache::dev
.
apache::listen
Controls which ports Apache binds to for listening based on the title:
\n\n apache::listen { '80': }\n apache::listen { '443': }\n
\n\nDeclaring this defined type will add all Listen
directives to the ports.conf
file in the Apache httpd configuration directory. apache::listen
titles should always take the form of: <port>
, <ipv4>:<port>
, or [<ipv6>]:<port>
Apache httpd requires that Listen
directives must be added for every port. The apache::vhost
defined type will automatically add Listen
directives unless the apache::vhost
is passed add_listen => false
.
apache::namevirtualhost
Enables named-based hosting of a virtual host
\n\n class { 'apache::namevirtualhost`: }\n
\n\nDeclaring this defined type will add all NameVirtualHost
directives to the ports.conf
file in the Apache https configuration directory. apache::namevirtualhost
titles should always take the form of: *
, *:<port>
, _default_:<port>
, <ip>
, or <ip>:<port>
.
apache::balancermember
Define members of a proxy_balancer set (mod_proxy_balancer). Very useful when using exported resources.
\n\nOn every app server you can export a balancermember like this:
\n\n @@apache::balancermember { "${::fqdn}-puppet00":\n balancer_cluster => 'puppet00',\n url => "ajp://${::fqdn}:8009"\n options => ['ping=5', 'disablereuse=on', 'retry=5', 'ttl=120'],\n }\n
\n\nAnd on the proxy itself you create the balancer cluster using the defined type apache::balancer:
\n\n apache::balancer { 'puppet00': }\n
\n\nIf you need to use ProxySet in the balncer config you can do as so:
\n\n apache::balancer { 'puppet01':\n proxy_set => {'stickysession' => 'JSESSIONID'},\n }\n
\n\nThe Apache module relies heavily on templates to enable the vhost
and apache::mod
defined types. These templates are built based on Facter facts around your operating system. Unless explicitly called out, most templates are not meant for configuration.
This has been tested on Ubuntu Precise, Debian Wheezy, CentOS 5.8, and FreeBSD 9.1.
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n\nThis project contains tests for both rspec-puppet and rspec-system to verify functionality. For in-depth information please see their respective documentation.
\n\nQuickstart:
\n\ngem install bundler\nbundle install\nbundle exec rake spec\nbundle exec rake spec:system\n
\n\nCopyright (C) 2012 Puppet Labs Inc
\n\nPuppet Labs can be contacted at: info@puppetlabs.com
\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at
\n\nhttp://www.apache.org/licenses/LICENSE-2.0
\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.
\nThis release adds FreeBSD osfamily support and various other improvements to some mods.
\n\nThis release adds more parameters to the base apache class and apache defined\nresource to make the module more flexible. It also adds or enhances SuPHP,\nWSGI, and Passenger mod support, and support for the ITK mpm module.
\n\nrewrite_base
apache::vhost
parameter; did not work anyway.a2mod
in favor of the apache::mod::*
classes and apache::mod
\ndefined resource.apache
class\n\nhttpd_dir
parameter to change the location of the configuration\nfiles.logroot
parameter to change the logrootports_file
parameter to changes the ports.conf
file locationkeepalive
parameter to enable persistent connectionskeepalive_timeout
parameter to change the timeoutdefault_mods
to be able to take an array of mods to enable.apache::vhost
\n\nwsgi_daemon_process
, wsgi_daemon_process_options
,\nwsgi_process_group
, and wsgi_script_aliases
parameters for per-vhost\nWSGI configuration.access_log_syslog
parameter to enable syslogging.error_log_syslog
parameter to enable syslogging of errors.directories
hash parameter. Please see README for documentation.sslproxyengine
parameter to enable SSLProxyEnginesuphp_addhandler
, suphp_engine
, and suphp_configpath
for\nconfiguring SuPHP.custom_fragment
parameter to allow for arbitrary apache\nconfiguration injection. (Feature pull requests are prefered over using\nthis, but it is available in a pinch.)apache::mod::suphp
class for configuring SuPHP.apache::mod::itk
class for configuring ITK mpm module.apache::mod::wsgi
class for global WSGI configuration with\nwsgi_socket_prefix
and wsgi_python_home
parameters.apache::mod::passenger
usage.\nAdded passenger_high_performance
, passenger_pool_idle_time
,\npassenger_max_requests
, passenger_stat_throttle_rate
, rack_autodetect
,\nand rails_autodetect
parameters.apache::service
class for\ndependency chaining of Class['apache'] -> <resource> ~>\nClass['apache::service']
apache::mod::proxy_balancer
class for apache::balancer
a2mod
$::hostname
if there is no $::fqdn
/etc/ssl/certs
the default ssl certs directory for RedHat non-5.php
the default php package for RedHat non-5.aliases
able to take a single alias hash instead of requiring an\narray.apache::mpm_module
detection for worker/preforkapache::mod::cgi
and apache::mod::cgid
detection for\nworker/preforkservername
parameter to apache
classproxy_set
parameter to apache::balancer
defineapache::balancer
clustersapache::mod::*
to notify the service on config changeapache::vhost
has many abilities -- see README.md for detailsapache::mod::*
classes provide httpd mod-loading capabilitiesapache
base class is much more configurableinclude apache
is now required when using apache::mod::*
Fix spec tests such that they pass
\n\n2012-05-08 Puppet Labs info@puppetlabs.com - 0.0.4\ne62e362 Fix broken tests for ssl, vhost, vhost::*\n42c6363 Changes to match style guide and pass puppet-lint without error\n42bc8ba changed name => path for file resources in order to name namevar by it's name\n72e13de One end too much\n0739641 style guide fixes: 'true' <> true, $operatingsystem needs to be $::operatingsystem, etc.\n273f94d fix tests\na35ede5 (#13860) Make a2enmod/a2dismo commands optional\n98d774e (#13860) Autorequire Package['httpd']\n05fcec5 (#13073) Add missing puppet spec tests\n541afda (#6899) Remove virtual a2mod definition\n976cb69 (#13072) Move mod python and wsgi package names to params\n323915a (#13060) Add .gitignore to repo\nfdf40af (#13060) Remove pkg directory from source tree\nfd90015 Add LICENSE file and update the ModuleFile\nd3d0d23 Re-enable local php class\nd7516c7 Make management of firewalls configurable for vhosts\n60f83ba Explicitly lookup scope of apache_name in templates.\nf4d287f (#12581) Add explicit ordering for vdir directory\n88a2ac6 (#11706) puppetlabs-apache depends on puppetlabs-firewall\na776a8b (#11071) Fix to work with latest firewall module\n2b79e8b (#11070) Add support for Scientific Linux\n405b3e9 Fix for a2mod\n57b9048 Commit apache::vhost::redirect Manifest\n8862d01 Commit apache::vhost::proxy Manifest\nd5c1fd0 Commit apache::mod::wsgi Manifest\na825ac7 Commit apache::mod::python Manifest\nb77062f Commit Templates\n9a51b4a Vhost File Declarations\n6cf7312 Defaults for Parameters\n6a5b11a Ensure installed\nf672e46 a2mod fix\n8a56ee9 add pthon support to apache
Copyright (C) 2012 Puppet Labs Inc\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
The MySQL module installs, configures, and manages the MySQL service.
\n\nThe MySQL module manages both the installation and configuration of MySQL as\nwell as extends Pupppet to allow management of MySQL resources, such as\ndatabases, users, and grants.
\n\nThis module has just undergone a very large rewrite. As a result it will no\nlonger work with the previous classes and configuration as before. We've\nattempted to handle backwards compatibility automatically by adding a\nattempt_compatibility_mode
parameter to the main mysql class. If you set\nthis to true it will attempt to map your previous parameters into the new\nmysql::server
class.
This may fail. It may eat your MySQL server. PLEASE test it before running it\nlive. Even if it's just a no-op and a manual comparision. Please be careful!
\n\nIf you just want a server installing with the default options you can run\ninclude '::mysql::server'
. If you need to customize options, such as the root\npassword or /etc/my.cnf settings then you can also include mysql::server
and\npass in an override hash as seen below:
class { '::mysql::server':\n root_password => 'strongpassword',\n override_options => { 'mysqld' => { 'max_connections' => '1024' } }\n}\n
\n\nAll interaction for the server is done via mysql::server
. To install the\nclient you use mysql::client
, and to install bindings you can use\nmysql::bindings
.
The hash structure for overrides in mysql::server
is as follows:
$override_options = {\n 'section' => {\n 'item' => 'thing',\n }\n}\n
\n\nFor items that you would traditionally represent as:
\n\n\n[section]\nthing\n\n\n
You can just make an entry like thing => true
in the hash. MySQL doesn't\ncare if thing is alone or set to a value, it'll happily accept both.
To add custom mysql configuration you can drop additional files into\n/etc/mysql/conf.d/
in order to override settings or add additional ones (if you\nchoose not to use override_options in mysql::server
). This location is\nhardcoded into the my.cnf template file.
mysql::server
: Installs and configures MySQL.mysql::server::account_security
: Deletes default MySQL accounts.mysql::server::monitor
: Sets up a monitoring user.mysql::server::mysqltuner
: Installs MySQL tuner script.mysql::server::backup
: Sets up MySQL backups via cron.mysql::bindings
: Installs various MySQL language bindings.mysql::client
: Installs MySQL client (for non-servers).mysql::server::install
: Installs packages.mysql::server::config
: Configures MYSQL.mysql::server::service
: Manages service.mysql::server::root_password
: Sets MySQL root password.mysql::server::providers
: Creates users, grants, and databases.mysql::bindings::java
: Installs Java bindings.mysql::bindings::perl
: Installs Perl bindings.mysql::bindings::python
: Installs Python bindings.mysql::bindings::ruby
: Installs Ruby bindings.mysql::client::install
: Installs MySQL client.root_password
What is the MySQL root password. Puppet will attempt to set it to this and update /root/.my.cnf
.
old_root_password
What was the previous root password (REQUIRED if you wish to change the root password via Puppet.)
\n\noverride_options
This is the hash of override options to pass into MySQL. It can be visualized\nlike a hash of the my.cnf file, so that entries look like:
\n\n$override_options = {\n 'section' => {\n 'item' => 'thing',\n }\n}\n
\n\nFor items that you would traditionally represent as:
\n\n\n[section]\nthing\n\n\n
You can just make an entry like thing => true
in the hash. MySQL doesn't\ncare if thing is alone or set to a value, it'll happily accept both.
config_file
The location of the MySQL configuration file.
\n\nmanage_config_file
Should we manage the MySQL configuration file.
\n\npurge_conf_dir
Should we purge the conf.d directory?
\n\nrestart
Should the service be restarted when things change?
\n\nroot_group
What is the group used for root?
\n\npackage_ensure
What to set the package to. Can be present, absent, or version.
\n\npackage_name
What is the name of the mysql server package to install.
\n\nremove_default_accounts
Boolean to decide if we should automatically include\nmysql::server::account_security
.
service_enabled
Boolean to decide if the service should be enabled.
\n\nservice_manage
Boolean to decide if the service should be managed.
\n\nservice_name
What is the name of the mysql server service.
\n\nservice_provider
Which provider to use to manage the service.
\n\nusers
Optional hash of users to create, which are passed to mysql_user. Example:
\n\n$users = {\n 'someuser@localhost' => {\n ensure => 'present',\n max_connections_per_hour => '0',\n max_queries_per_hour => '0',\n max_updates_per_hour => '0',\n max_user_connections => '0',\n password_hash => '*F3A2A51A9B0F2BE2468926B4132313728C250DBF',\n },\n}\n
\n\ngrants
Optional hash of grants, which are passed to mysql_grant. Example:
\n\n$grants = {\n 'someuser@localhost/somedb.*' => {\n ensure => 'present',\n options => ['GRANT'],\n privileges => ['SELECT', 'INSERT', 'UPDATE', 'DELETE'],\n table => 'somedb.*',\n user => 'someuser@localhost',\n },\n}\n
\n\ndatabases
Optional hash of databases to create, which are passed to mysql_database. Example:
\n\n$databases = {\n 'somedb' => {\n ensure => 'present',\n charset => 'utf8',\n },\n}\n
\n\nservice_provider
backupuser
MySQL user to create for backing up.
\n\nbackuppassword
MySQL user password for backups.
\n\nbackupdir
Directory to backup into.
\n\nbackupcompress
Boolean to determine if backups should be compressed.
\n\nbackuprotate
How many days to keep backups for.
\n\ndelete_before_dump
Boolean to determine if you should cleanup before backing up or after.
\n\nbackupdatabases
Array of databases to specifically backup.
\n\nfile_per_database
Should a seperate file be used per database.
\n\nensure
Present or absent, allows you to remove the backup scripts.
\n\ntime
An array of two elements to set the time to backup. Allows ['23', '5'] or ['3', '45'] for HH:MM times.
\n\nmysql_monitor_username
The username to create for MySQL monitoring.
\n\nmysql_monitor_password
The password to create for MySQL monitoring.
\n\nmysql_monitor_hostname
The hostname to allow to access the MySQL monitoring user.
\n\njava_enable
Boolean to decide if the Java bindings should be installed.
\n\nperl_enable
Boolean to decide if the Perl bindings should be installed.
\n\nphp_enable
Boolean to decide if the PHP bindings should be installed.
\n\npython_enable
Boolean to decide if the Python bindings should be installed.
\n\nruby_enable
Boolean to decide if the Ruby bindings should be installed.
\n\njava_package_ensure
What to set the package to. Can be present, absent, or version.
\n\njava_package_name
The name of the package to install.
\n\njava_package_provider
What provider should be used to install the package.
\n\nperl_package_ensure
What to set the package to. Can be present, absent, or version.
\n\nperl_package_name
The name of the package to install.
\n\nperl_package_provider
What provider should be used to install the package.
\n\npython_package_ensure
What to set the package to. Can be present, absent, or version.
\n\npython_package_name
The name of the package to install.
\n\npython_package_provider
What provider should be used to install the package.
\n\nruby_package_ensure
What to set the package to. Can be present, absent, or version.
\n\nruby_package_name
The name of the package to install.
\n\nruby_package_provider
What provider should be used to install the package.
\n\nbindings_enable
Boolean to automatically install all bindings.
\n\npackage_ensure
What to set the package to. Can be present, absent, or version.
\n\npackage_name
What is the name of the mysql client package to install.
\n\nCreates a database with a user and assign some privileges.
\n\n mysql::db { 'mydb':\n user => 'myuser',\n password => 'mypass',\n host => 'localhost',\n grant => ['SELECT', 'UPDATE'],\n }\n
\n\nmysql_database can be used to create and manage databases within MySQL:
\n\nmysql_database { 'information_schema':\n ensure => 'present',\n charset => 'utf8',\n collate => 'utf8_swedish_ci',\n}\nmysql_database { 'mysql':\n ensure => 'present',\n charset => 'latin1',\n collate => 'latin1_swedish_ci',\n}\n
\n\nmysql_user can be used to create and manage user grants within MySQL:
\n\nmysql_user { 'root@127.0.0.1':\n ensure => 'present',\n max_connections_per_hour => '0',\n max_queries_per_hour => '0',\n max_updates_per_hour => '0',\n max_user_connections => '0',\n}\n
\n\nmysql_grant can be used to create grant permissions to access databases within\nMySQL. To use it you must create the title of the resource as shown below,\nfollowing the pattern of username@hostname/database.table
:
mysql_grant { 'root@localhost/*.*':\n ensure => 'present',\n options => ['GRANT'],\n privileges => ['ALL'],\n table => '*.*',\n user => 'root@localhost',\n}\n
\n\nThis module has been tested on:
\n\nTesting on other platforms has been light and cannot be guaranteed.
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community\ncontributions are essential for keeping them great. We can’t access the\nhuge number of platforms and myriad of hardware, software, and deployment\nconfigurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our\nmodules work in your environment. There are a few guidelines that we need\ncontributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n\nThis module is based on work by David Schmitt. The following contributor have contributed patches to this module (beyond Puppet Labs):
\n\n2013-11-13 - Version 2.1.0\n\nSummary:\n\nThe most important changes in 2.1.0 are improvements to the my.cnf creation,\nas well as providers. Setting options to = true strips them to be just the\nkey name itself, which is required for some options.\n\nThe provider updates fix a number of bugs, from lowercase privileges to\ndeprecation warnings.\n\nLast, the new hiera integration functionality should make it easier to\nexternalize all your grantts, users, and, databases. Another great set of\ncommunity submissions helped to make this release.\n\nFeatures:\n- Some options can not take a argument. Gets rid of the '= true' when an\noption is set to true.\n- Easier hiera integration: Add hash parameters to mysql::server to allow\nspecifying grants, users, and databases.\n\nFixes:\n- Fix an issue with lowercase privileges in mysql_grant{} causing them to be reapplied needlessly.\n- Changed defaults-file to defaults-extra-file in providers.\n- Ensure /root/.my.cnf is 0600 and root owned.\n- database_user deprecation warning was incorrect.\n- Add anchor pattern for client.pp\n- Documentation improvements.\n- Various test fixes.\n\n2013-10-21 - Version 2.0.1\n\nSummary:\n\nThis is a bugfix release to handle an issue where unsorted mysql_grant{}\nprivileges could cause Puppet to incorrectly reapply the permissions on\neach run.\n\nFixes:\n- Mysql_grant now sorts privileges in the type and provider for comparision.\n- Comment and test tweak for PE3.1.\n\n2013-10-14 - Version 2.0.0\n\nSummary:\n\n(Previously detailed in the changelog for 2.0.0-rc1)\n\nThis module has been completely refactored and works significantly different.\nThe changes are broad and touch almost every piece of the module.\n\nSee the README.md for full details of all changes and syntax.\nPlease remain on 1.0.0 if you don't have time to fully test this in dev.\n\n* mysql::server, mysql::client, and mysql::bindings are the primary interface\nclasses.\n* mysql::server takes an `options_override` parameter to set my.cnf options,\nwith the hash format: { 'section' => { 'thing' => 'value' }}\n* mysql attempts backwards compatibility by forwarding all parameters to\nmysql::server.\n\n2013-10-09 - Version 2.0.0-rc5\n\nSummary:\n\nHopefully the final rc! Further fixes to mysql_grant (stripping out the\ncleverness so we match a much wider range of input.)\n\nFixes:\n- Make mysql_grant accept '.*'@'.*' in terms of input for user@host.\n\n2013-10-09 - Version 2.0.0-rc4\n\nSummary:\n\nBugfixes to mysql_grant and mysql_user form the bulk of this rc, as well as\nensuring that values in the override_options hash that contain a value of ''\nare created as just "key" in the conf rather than "key =" or "key = false".\n\nFixes:\n- Improve mysql_grant to work with IPv6 addresses (both long and short).\n- Ensure @host users work as well as user@host users.\n- Updated my.cnf template to support items with no values.\n\n2013-10-07 - Version 2.0.0-rc3\n\nSummary:\n\nFix mysql::server::monitor's use of mysql_user{}.\n\nFixes:\n- Fix myql::server::monitor's use of mysql_user{} to grant the proper\npermissions. Add specs as well. (Thanks to treydock!)\n\n2013-10-03 - Version 2.0.0-rc2\n\nSummary:\n\nBugfixes\n\nFixes:\n- Fix a duplicate parameter in mysql::server\n\n2013-10-03 - Version 2.0.0-rc1\n\nSummary:\n\nThis module has been completely refactored and works significantly different.\nThe changes are broad and touch almost every piece of the module.\n\nSee the README.md for full details of all changes and syntax.\nPlease remain on 1.0.0 if you don't have time to fully test this in dev.\n\n* mysql::server, mysql::client, and mysql::bindings are the primary interface\nclasses.\n* mysql::server takes an `options_override` parameter to set my.cnf options,\nwith the hash format: { 'section' => { 'thing' => 'value' }}\n* mysql attempts backwards compatibility by forwarding all parameters to\nmysql::server.\n\n2013-09-23 - Version 1.0.0\n\nSummary:\n\nThis release introduces a number of new type/providers, to eventually\nreplace the database_ ones. The module has been converted to call the\nnew providers rather than the previous ones as they have a number of\nfixes, additional options, and work with puppet resource.\n\nThis 1.0.0 release precedes a large refactoring that will be released\nalmost immediately after as 2.0.0.\n\nFeatures:\n- Added mysql_grant, mysql_database, and mysql_user.\n- Add `mysql::bindings` class and refactor all other bindings to be contained underneath mysql::bindings:: namespace.\n- Added support to back up specified databases only with 'mysqlbackup' parameter.\n- Add option to mysql::backup to set the backup script to perform a mysqldump on each database to its own file\n\nBugfixes:\n- Update my.cnf.pass.erb to allow custom socket support\n- Add environment variable for .my.cnf in mysql::db.\n- Add HOME environment variable for .my.cnf to mysqladmin command when\n(re)setting root password\n\n2013-07-15 - Version 0.9.0\nFeatures:\n- Add `mysql::backup::backuprotate` parameter\n- Add `mysql::backup::delete_before_dump` parameter\n- Add `max_user_connections` attribute to `database_user` type\n\nBugfixes:\n- Add client package dependency for `mysql::db`\n- Remove duplicate `expire_logs_days` and `max_binlog_size` settings\n- Make root's `.my.cnf` file path dynamic\n- Update pidfile path for Suse variants\n- Fixes for lint\n\n2013-07-05 - Version 0.8.1\nBugfixes:\n - Fix a typo in the Fedora 19 support.\n\n2013-07-01 - Version 0.8.0\nFeatures:\n - mysql::perl class to install perl-DBD-mysql.\n - minor improvements to the providers to improve reliability\n - Install the MariaDB packages on Fedora 19 instead of MySQL.\n - Add new `mysql` class parameters:\n - `max_connections`: The maximum number of allowed connections.\n - `manage_config_file`: Opt out of puppetized control of my.cnf.\n - `ft_min_word_len`: Fine tune the full text search.\n - `ft_max_word_len`: Fine tune the full text search.\n - Add new `mysql` class performance tuning parameters:\n - `key_buffer`\n - `thread_stack`\n - `thread_cache_size`\n - `myisam-recover`\n - `query_cache_limit`\n - `query_cache_size`\n - `max_connections`\n - `tmp_table_size`\n - `table_open_cache`\n - `long_query_time`\n - Add new `mysql` class replication parameters:\n - `server_id`\n - `sql_log_bin`\n - `log_bin`\n - `max_binlog_size`\n - `binlog_do_db`\n - `expire_logs_days`\n - `log_bin_trust_function_creators`\n - `replicate_ignore_table`\n - `replicate_wild_do_table`\n - `replicate_wild_ignore_table`\n - `expire_logs_days`\n - `max_binlog_size`\n\nBugfixes:\n - No longer restart MySQL when /root/.my.cnf changes.\n - Ensure mysql::config runs before any mysql::db defines.\n\n2013-06-26 - Version 0.7.1\nBugfixes:\n- Single-quote password for special characters\n- Update travis testing for puppet 3.2.x and missing Bundler gems\n\n2013-06-25 - Version 0.7.0\nThis is a maintenance release for community bugfixes and exposing\nconfiguration variables.\n\n* Add new `mysql` class parameters:\n - `basedir`: The base directory mysql uses\n - `bind_address`: The IP mysql binds to\n - `client_package_name`: The name of the mysql client package\n - `config_file`: The location of the server config file\n - `config_template`: The template to use to generate my.cnf\n - `datadir`: The directory MySQL's datafiles are stored\n - `default_engine`: The default engine to use for tables\n - `etc_root_password`: Whether or not to add the mysql root password to\n /etc/my.cnf\n - `java_package_name`: The name of the java package containing the java\n connector\n - `log_error`: Where to log errors\n - `manage_service`: Boolean dictating if mysql::server should manage the\n service\n - `max_allowed_packet`: Maximum network packet size mysqld will accept\n - `old_root_password`: Previous root user password\n - `php_package_name`: The name of the phpmysql package to install\n - `pidfile`: The location mysql will expect the pidfile to be\n - `port`: The port mysql listens on\n - `purge_conf_dir`: Value fed to recurse and purge parameters of the\n /etc/mysql/conf.d resource\n - `python_package_name`: The name of the python mysql package to install\n - `restart`: Whether to restart mysqld\n - `root_group`: Use specified group for root-owned files\n - `root_password`: The root MySQL password to use\n - `ruby_package_name`: The name of the ruby mysql package to install\n - `ruby_package_provider`: The installation suite to use when installing the\n ruby package\n - `server_package_name`: The name of the server package to install\n - `service_name`: The name of the service to start\n - `service_provider`: The name of the service provider\n - `socket`: The location of the MySQL server socket file\n - `ssl_ca`: The location of the SSL CA Cert\n - `ssl_cert`: The location of the SSL Certificate to use\n - `ssl_key`: The SSL key to use\n - `ssl`: Whether or not to enable ssl\n - `tmpdir`: The directory MySQL's tmpfiles are stored\n* Deprecate `mysql::package_name` parameter in favor of\n`mysql::client_package_name`\n* Fix local variable template deprecation\n* Fix dependency ordering in `mysql::db`\n* Fix ANSI quoting in queries\n* Fix travis support (but still messy)\n* Fix typos\n\n2013-01-11 - Version 0.6.1\n* Fix providers when /root/.my.cnf is absent\n\n2013-01-09 - Version 0.6.0\n* Add `mysql::server::config` define for specific config directives\n* Add `mysql::php` class for php support\n* Add `backupcompress` parameter to `mysql::backup`\n* Add `restart` parameter to `mysql::config`\n* Add `purge_conf_dir` parameter to `mysql::config`\n* Add `manage_service` parameter to `mysql::server`\n* Add syslog logging support via the `log_error` parameter\n* Add initial SuSE support\n* Fix remove non-localhost root user when fqdn != hostname\n* Fix dependency in `mysql::server::monitor`\n* Fix .my.cnf path for root user and root password\n* Fix ipv6 support for users\n* Fix / update various spec tests\n* Fix typos\n* Fix lint warnings\n\n2012-08-23 - Version 0.5.0\n* Add puppetlabs/stdlib as requirement\n* Add validation for mysql privs in provider\n* Add `pidfile` parameter to mysql::config\n* Add `ensure` parameter to mysql::db\n* Add Amazon linux support\n* Change `bind_address` parameter to be optional in my.cnf template\n* Fix quoting root passwords\n\n2012-07-24 - Version 0.4.0\n* Fix various bugs regarding database names\n* FreeBSD support\n* Allow specifying the storage engine\n* Add a backup class\n* Add a security class to purge default accounts\n\n2012-05-03 - Version 0.3.0\n* #14218 Query the database for available privileges\n* Add mysql::java class for java connector installation\n* Use correct error log location on different distros\n* Fix set_mysql_rootpw to properly depend on my.cnf\n\n2012-04-11 - Version 0.2.0\n\n2012-03-19 - William Van Hevelingen <blkperl@cat.pdx.edu>\n* (#13203) Add ssl support (f7e0ea5)\n\n2012-03-18 - Nan Liu <nan@puppetlabs.com>\n* Travis ci before script needs success exit code. (0ea463b)\n\n2012-03-18 - Nan Liu <nan@puppetlabs.com>\n* Fix Puppet 2.6 compilation issues. (9ebbbc4)\n\n2012-03-16 - Nan Liu <nan@puppetlabs.com>\n* Add travis.ci for testing multiple puppet versions. (33c72ef)\n\n2012-03-15 - William Van Hevelingen <blkperl@cat.pdx.edu>\n* (#13163) Datadir should be configurable (f353fc6)\n\n2012-03-16 - Nan Liu <nan@puppetlabs.com>\n* Document create_resources dependency. (558a59c)\n\n2012-03-16 - Nan Liu <nan@puppetlabs.com>\n* Fix spec test issues related to error message. (eff79b5)\n\n2012-03-16 - Nan Liu <nan@puppetlabs.com>\n* Fix mysql service on Ubuntu. (72da2c5)\n\n2012-03-16 - Dan Bode <dan@puppetlabs.com>\n* Add more spec test coverage (55e399d)\n\n2012-03-16 - Nan Liu <nan@puppetlabs.com>\n* (#11963) Fix spec test due to path changes. (1700349)\n\n2012-03-07 - François Charlier <fcharlier@ploup.net>\n* Add a test to check path for 'mysqld-restart' (b14c7d1)\n\n2012-03-07 - François Charlier <fcharlier@ploup.net>\n* Fix path for 'mysqld-restart' (1a9ae6b)\n\n2012-03-15 - Dan Bode <dan@puppetlabs.com>\n* Add rspec-puppet tests for mysql::config (907331a)\n\n2012-03-15 - Dan Bode <dan@puppetlabs.com>\n* Moved class dependency between sever and config to server (da62ad6)\n\n2012-03-14 - Dan Bode <dan@puppetlabs.com>\n* Notify mysql restart from set_mysql_rootpw exec (0832a2c)\n\n2012-03-15 - Nan Liu <nan@puppetlabs.com>\n* Add documentation related to osfamily fact. (8265d28)\n\n2012-03-14 - Dan Bode <dan@puppetlabs.com>\n* Mention osfamily value in failure message (e472d3b)\n\n2012-03-14 - Dan Bode <dan@puppetlabs.com>\n* Fix bug when querying for all database users (015490c)\n\n2012-02-09 - Nan Liu <nan@puppetlabs.com>\n* Major refactor of mysql module. (b1f90fd)\n\n2012-01-11 - Justin Ellison <justin.ellison@buckle.com>\n* Ruby and Python's MySQL libraries are named differently on different distros. (1e926b4)\n\n2012-01-11 - Justin Ellison <justin.ellison@buckle.com>\n* Per @ghoneycutt, we should fail explicitly and explain why. (09af083)\n\n2012-01-11 - Justin Ellison <justin.ellison@buckle.com>\n* Removing duplicate declaration (7513d03)\n\n2012-01-10 - Justin Ellison <justin.ellison@buckle.com>\n* Use socket value from params class instead of hardcoding. (663e97c)\n\n2012-01-10 - Justin Ellison <justin.ellison@buckle.com>\n* Instead of hardcoding the config file target, pull it from mysql::params (031a47d)\n\n2012-01-10 - Justin Ellison <justin.ellison@buckle.com>\n* Moved $socket to within the case to toggle between distros. Added a $config_file variable to allow per-distro config file destinations. (360eacd)\n\n2012-01-10 - Justin Ellison <justin.ellison@buckle.com>\n* Pretty sure this is a bug, 99% of Linux distros out there won't ever hit the default. (3462e6b)\n\n2012-02-09 - William Van Hevelingen <blkperl@cat.pdx.edu>\n* Changed the README to use markdown (3b7dfeb)\n\n2012-02-04 - Daniel Black <grooverdan@users.sourceforge.net>\n* (#12412) mysqltuner.pl update (b809e6f)\n\n2011-11-17 - Matthias Pigulla <mp@webfactory.de>\n* (#11363) Add two missing privileges to grant: event_priv, trigger_priv (d15c9d1)\n\n2011-12-20 - Jeff McCune <jeff@puppetlabs.com>\n* (minor) Fixup typos in Modulefile metadata (a0ed6a1)\n\n2011-12-19 - Carl Caum <carl@carlcaum.com>\n* Only notify Exec to import sql if sql is given (0783c74)\n\n2011-12-19 - Carl Caum <carl@carlcaum.com>\n* (#11508) Only load sql_scripts on DB creation (e3b9fd9)\n\n2011-12-13 - Justin Ellison <justin.ellison@buckle.com>\n* Require not needed due to implicit dependencies (3058feb)\n\n2011-12-13 - Justin Ellison <justin.ellison@buckle.com>\n* Bug #11375: puppetlabs-mysql fails on CentOS/RHEL (a557b8d)\n\n2011-06-03 - Dan Bode <dan@puppetlabs.com> - 0.0.1\n* initial commit\n
Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2013 Puppet Labs\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n
A Puppet module that can construct files from fragments.
\n\nPlease see the comments in the various .pp files for details\nas well as posts on my blog at http://www.devco.net/
\n\nReleased under the Apache 2.0 licence
\n\nIf you wanted a /etc/motd file that listed all the major modules\non the machine. And that would be maintained automatically even\nif you just remove the include lines for other modules you could\nuse code like below, a sample /etc/motd would be:
\n\n\nPuppet modules on this server:\n\n -- Apache\n -- MySQL\n\n\n
Local sysadmins can also append to the file by just editing /etc/motd.local\ntheir changes will be incorporated into the puppet managed motd.
\n\n\n# class to setup basic motd, include on all nodes\nclass motd {\n $motd = \"/etc/motd\"\n\n concat{$motd:\n owner => root,\n group => root,\n mode => '0644',\n }\n\n concat::fragment{\"motd_header\":\n target => $motd,\n content => \"\\nPuppet modules on this server:\\n\\n\",\n order => 01,\n }\n\n # local users on the machine can append to motd by just creating\n # /etc/motd.local\n concat::fragment{\"motd_local\":\n target => $motd,\n ensure => \"/etc/motd.local\",\n order => 15\n }\n}\n\n# used by other modules to register themselves in the motd\ndefine motd::register($content=\"\", $order=10) {\n if $content == \"\" {\n $body = $name\n } else {\n $body = $content\n }\n\n concat::fragment{\"motd_fragment_$name\":\n target => \"/etc/motd\",\n content => \" -- $body\\n\"\n }\n}\n\n# a sample apache module\nclass apache {\n include apache::install, apache::config, apache::service\n\n motd::register{\"Apache\": }\n}\n\n\n
Detailed documentation of the class options can be found in the\nmanifest files.
\n\nPaul Elliot
\n\nChad Netzer
\n\nDavid Schmitt
\n\nPeter Meier
\n\nSharif Nassar
\n\nChristian G. Warden
\n\nReid Vandewiele
\n\nErik Dalén
\n\nGildas Le Nadan
\n\nPaul Belanger
\n\nBranan Purvine-Riley
\n\nDustin J. Mitchell
\n\nAndreas Jaggi
\n\nJan Vansteenkiste
\n\npuppet-users@ mailing list.
\n2013-08-09 1.0.0\n\nSummary:\n\nMany new features and bugfixes in this release, and if you're a heavy concat\nuser you should test carefully before upgrading. The features should all be\nbackwards compatible but only light testing has been done from our side before\nthis release.\n\nFeatures:\n- New parameters in concat:\n - `replace`: specify if concat should replace existing files.\n - `ensure_newline`: controls if fragments should contain a newline at the end.\n- Improved README documentation.\n- Add rspec:system tests (rake spec:system to test concat)\n\nBugfixes\n- Gracefully handle \\n in a fragment resource name.\n- Adding more helpful message for 'pluginsync = true'\n- Allow passing `source` and `content` directly to file resource, rather than\ndefining resource defaults.\n- Added -r flag to read so that filenames with \\ will be read correctly.\n- sort always uses LANG=C.\n- Allow WARNMSG to contain/start with '#'.\n- Replace while-read pattern with for-do in order to support Solaris.\n\nCHANGELOG:\n- 2010/02/19 - initial release\n- 2010/03/12 - add support for 0.24.8 and newer\n - make the location of sort configurable\n - add the ability to add shell comment based warnings to\n top of files\n - add the ablity to create empty files\n- 2010/04/05 - fix parsing of WARN and change code style to match rest\n of the code\n - Better and safer boolean handling for warn and force\n - Don't use hard coded paths in the shell script, set PATH\n top of the script\n - Use file{} to copy the result and make all fragments owned\n by root. This means we can chnage the ownership/group of the\n resulting file at any time.\n - You can specify ensure => "/some/other/file" in concat::fragment\n to include the contents of a symlink into the final file.\n- 2010/04/16 - Add more cleaning of the fragment name - removing / from the $name\n- 2010/05/22 - Improve documentation and show the use of ensure =>\n- 2010/07/14 - Add support for setting the filebucket behavior of files\n- 2010/10/04 - Make the warning message configurable\n- 2010/12/03 - Add flags to make concat work better on Solaris - thanks Jonathan Boyett\n- 2011/02/03 - Make the shell script more portable and add a config option for root group\n- 2011/06/21 - Make base dir root readable only for security\n- 2011/06/23 - Set base directory using a fact instead of hardcoding it\n- 2011/06/23 - Support operating as non privileged user\n- 2011/06/23 - Support dash instead of bash or sh\n- 2011/07/11 - Better solaris support\n- 2011/12/05 - Use fully qualified variables\n- 2011/12/13 - Improve Nexenta support\n- 2012/04/11 - Do not use any GNU specific extensions in the shell script\n- 2012/03/24 - Comply to community style guides\n- 2012/05/23 - Better errors when basedir isnt set\n- 2012/05/31 - Add spec tests\n- 2012/07/11 - Include concat::setup in concat improving UX\n- 2012/08/14 - Puppet Lint improvements\n- 2012/08/30 - The target path can be different from the $name\n- 2012/08/30 - More Puppet Lint cleanup\n- 2012/09/04 - RELEASE 0.2.0\n- 2012/12/12 - Added (file) $replace parameter to concat\n
Copyright 2012 R.I.Pienaar\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n
The PostgreSQL module allows you to easily manage postgres databases with Puppet.
\n\nPostgreSQL is a high-performance, free, open-source relational database server. The postgresql module allows you to manage PostgreSQL packages and services on several operating systems, while also supporting basic management of PostgreSQL databases and users. The module offers support for managing firewall for postgres ports on RedHat-based distros, as well as support for basic management of common security settings.
\n\nWhat puppetlabs-PostgreSQL affects:
\n\nIntroductory Questions
\n\nThe postgresql module offers many security configuration settings. Before getting started, you will want to consider:
\n\nYour answers to these questions will determine which of the module's parameters you'll want to specify values for.
\n\nThe main configuration you'll need to do will be around the postgresql::server
class. The default parameters are reasonable, but fairly restrictive regarding permissions for who can connect and from where. To manage a PostgreSQL server with sane defaults:
class { 'postgresql::server': }\n
\n\nFor a more customized configuration:
\n\nclass { 'postgresql::server':\n ip_mask_deny_postgres_user => '0.0.0.0/32',\n ip_mask_allow_all_users => '0.0.0.0/0',\n listen_addresses => '*',\n ipv4acls => ['hostssl all johndoe 192.168.0.0/24 cert'],\n manage_firewall => true,\n postgres_password => 'TPSrep0rt!',\n}\n
\n\nOnce you've completed your configuration of postgresql::server
, you can test out your settings from the command line:
$ psql -h localhost -U postgres\n$ psql -h my.postgres.server -U\n
\n\nIf you get an error message from these commands, it means that your permissions are set in a way that restricts access from where you're trying to connect. That might be a good thing or a bad thing, depending on your goals.
\n\nFor more details about server configuration parameters consult the PostgreSQL Runtime Configuration docs.
\n\nThere are many ways to set up a postgres database using the postgresql::server::db
class. For instance, to set up a database for PuppetDB:
class { 'postgresql::server': }\n\npostgresql::server::db { 'mydatabasename':\n user => 'mydatabaseuser',\n password => postgresql_password('mydatabaseuser', 'mypassword'),\n}\n
\n\nTo manage users, roles and permissions:
\n\nclass { 'postgresql::server': }\n\npostgresql::server::role { 'marmot':\n password_hash => postgresql_password('marmot', 'mypasswd'),\n}\n\npostgresql::server::database_grant { 'test1':\n privilege => 'ALL',\n db => 'test1',\n role => 'marmot',\n}\n\npostgresql::server::table_grant { 'my_table of test2':\n privilege => 'ALL',\n table => 'my_table',\n db => 'test2',\n role => 'marmot',\n}\n
\n\nIn this example, you would grant ALL privileges on the test1 database and on the my_table
table of the test2 database to the user or group specified by dan.
At this point, you would just need to plunk these database name/username/password values into your PuppetDB config files, and you are good to go.
\n\nNote: if you are upgrading for 2.x, you must read this, as just about everything has changed.
\n\nVersion 3 was a major rewrite to fix some internal dependency issues, and to make the new Public API more clear. As a consequence a lot of things have changed for version 3 and older revisions that we will try to outline here.
\n\npostgresql::server::
namespaceTo restructure server specific elements under the postgresql::server::
namespaces the following objects were renamed as such:
postgresql::database
-> postgresql::server::database
postgresql::database_grant
-> postgresql::server::database_grant
postgresql::db
-> postgresql::server::db
postgresql::grant
-> postgresql::server::grant
postgresql::pg_hba_rule
-> postgresql::server::pg_hba_rule
postgresql::plperl
-> postgresql::server::plperl
postgresql::contrib
-> postgresql::server::contrib
postgresql::role
-> postgresql::server::role
postgresql::table_grant
-> postgresql::server::table_grant
postgresql::tablespace
-> postgresql::server::tablespace
postgresql::server::config_entry
resource for managing configurationPreviously we used the file_line
resource to modify postgresql.conf
. This new revision now adds a new resource named postgresql::server::config_entry
for managing this file. For example:
postgresql::server::config_entry { 'check_function_bodies':\n value => 'off',\n}\n
\n\nIf you were using file_line
for this purpose, you should change to this new methodology.
postgresql_puppet_extras.conf
has been removedNow that we have a methodology for managing postgresql.conf
, and due to concerns over the file management methodology using an exec { 'touch ...': }
as a way to create an empty file the existing postgresql_puppet_extras.conf file is no longer managed by this module.
If you wish to recreate this methodology yourself, use this pattern:
\n\nclass { 'postgresql::server': }\n\n$extras = "/tmp/include.conf"\n\nfile { $extras:\n content => 'max_connections = 123',\n notify => Class['postgresql::server::service'],\n}->\npostgresql::server::config_entry { 'include':\n value => $extras,\n}\n
\n\ncharset
changed to encoding
Since PostgreSQL uses the terminology encoding
not charset
the parameter has been made consisent across all classes and resources.
postgresql
base class is no longer how you set globalsThe old global override pattern was less then optimal so it has been fixed, however we decided to demark this properly by specifying these overrides in the class postgresql::globals
. Consult the documentation for this class now to see what options are available.
Also, some parameter elements have been moved between this and the postgresql::server
class where it made sense.
config_hash
parameter collapsed for the postgresql::server
classBecause the config_hash
was really passing data through to what was in effect an internal class (postgresql::config
). And since we don't want this kind of internal exposure the parameters were collapsed up into the postgresql::server
class directly.
If you were using these before, these have changed names. You should only use what is documented in this README.md, and if you don't have what you need you should raise a patch to add that feature to a public API. All internal classes now have a comment at the top indicating them as private to make sure the message is clear that they are not supported as Public API.
\n\npg_hba_conf_defaults
parameter included to turn off default pg_hba rulesThe defaults should be good enough for most cases (if not raise a bug) but if you simply need an escape hatch, this setting will turn off the defaults. If you want to do this, it may affect the rest of the module so make sure you replace the rules with something that continues operation.
\n\npostgresql::database_user
has now been removedUse postgresql::server::role
instead.
postgresql::psql
resource has now been removedUse postgresql_psql
instead. In the future we may recreate this as a wrapper to add extra capability, but it will not match the old behaviour.
postgresql_default_version
fact has now been removedIt didn't make sense to have this logic in a fact any more, the logic has been moved into postgresql::params
.
ripienaar/concat
is no longer used, instead we use puppetlabs/concat
The older concat module is now deprecated and moved into the puppetlabs/concat
namespace. Functionality is more or less identical, but you may need to intervene during the installing of this package - as both use the same concat
namespace.
The postgresql module comes with many options for configuring the server. While you are unlikely to use all of the below settings, they allow you a decent amount of control over your security settings.
\n\nClasses:
\n\nResources:
\n\nFunctions:
\n\n\n\nNote: most server specific defaults should be overriden in the postgresql::server
class. This class should only be used if you are using a non-standard OS or if you are changing elements such as version
or manage_package_repo
that can only be changed here.
This class allows you to configure the main settings for this module in a global way, to be used by the other classes and defined resources. On its own it does nothing.
\n\nFor example, if you wanted to overwrite the default locale
and encoding
for all classes you could use the following combination:
class { 'postgresql::globals':\n encoding => 'UTF8',\n locale => 'en_NG',\n}->\nclass { 'postgresql::server':\n}\n
\n\nThat would make the encoding
and locale
the default for all classes and defined resources in this module.
If you want to use the upstream PostgreSQL packaging, and be specific about the version you wish to download, you could use something like this:
\n\nclass { 'postgresql::globals':\n manage_package_repo => true,\n version => '9.2',\n}->\nclass { 'postgresql::server': }\n
\n\nclient_package_name
This setting can be used to override the default postgresql client package name. If not specified, the module will use whatever package name is the default for your OS distro.
\n\nserver_package_name
This setting can be used to override the default postgresql server package name. If not specified, the module will use whatever package name is the default for your OS distro.
\n\ncontrib_package_name
This setting can be used to override the default postgresql contrib package name. If not specified, the module will use whatever package name is the default for your OS distro.
\n\ndevel_package_name
This setting can be used to override the default postgresql devel package name. If not specified, the module will use whatever package name is the default for your OS distro.
\n\njava_package_name
This setting can be used to override the default postgresql java package name. If not specified, the module will use whatever package name is the default for your OS distro.
\n\nplperl_package_name
This setting can be used to override the default postgresql PL/perl package name. If not specified, the module will use whatever package name is the default for your OS distro.
\n\npython_package_name
This setting can be used to override the default postgresql Python package name. If not specified, the module will use whatever package name is the default for your OS distro.
\n\nservice_name
This setting can be used to override the default postgresql service provider. If not specified, the module will use whatever service name is the default for your OS distro.
\n\nservice_status
This setting can be used to override the default status check command for your PostgreSQL service. If not specified, the module will use whatever service name is the default for your OS distro.
\n\ndefault_database
This setting is used to specify the name of the default database to connect with. On most systems this will be "postgres".
\n\ninitdb_path
Path to the initdb
command.
createdb_path
Path to the createdb
command.
psql_path
Path to the psql
command.
pg_hba_conf_path
Path to your pg\\_hba.conf
file.
postgresql_conf_path
Path to your postgresql.conf
file.
pg_hba_conf_defaults
If false, disables the defaults supplied with the module for pg\\_hba.conf
. This is useful if you disagree with the defaults and wish to override them yourself. Be sure that your changes of course align with the rest of the module, as some access is required to perform basic psql
operations for example.
datadir
This setting can be used to override the default postgresql data directory for the target platform. If not specified, the module will use whatever directory is the default for your OS distro.
\n\nconfdir
This setting can be used to override the default postgresql configuration directory for the target platform. If not specified, the module will use whatever directory is the default for your OS distro.
\n\nbindir
This setting can be used to override the default postgresql binaries directory for the target platform. If not specified, the module will use whatever directory is the default for your OS distro.
\n\nuser
This setting can be used to override the default postgresql super user and owner of postgresql related files in the file system. If not specified, the module will use the user name 'postgres'.
\n\ngroup
This setting can be used to override the default postgresql user group to be used for related files in the file system. If not specified, the module will use the group name 'postgres'.
\n\nversion
The version of PostgreSQL to install/manage. This is a simple way of providing a specific version such as '9.2' or '8.4' for example.
\n\nDefaults to your operating system default.
\n\nneeds_initdb
This setting can be used to explicitly call the initdb operation after server package is installed and before the postgresql service is started. If not specified, the module will decide whether to call initdb or not depending on your OS distro.
\n\nencoding
This will set the default encoding encoding for all databases created with this module. On certain operating systems this will be used during the template1
initialization as well so it becomes a default outside of the module as well. Defaults to the operating system default.
locale
This will set the default database locale for all databases created with this module. On certain operating systems this will be used during the template1
initialization as well so it becomes a default outside of the module as well. Defaults to undef
which is effectively C
.
firewall_supported
This allows you to override the automated detection to see if your OS supports the firewall
module.
manage_package_repo
If true
this will setup the official PostgreSQL repositories on your host. Defaults to false
.
The following list are options that you can set in the config_hash
parameter of postgresql::server
.
ensure
This value default to present
. When set to absent
it will remove all packages, configuration and data so use this with extreme caution.
version
This will set the version of the PostgreSQL software to install. Defaults to your operating systems default.
\n\npostgres_password
This value defaults to undef
, meaning the super user account in the postgres database is a user called postgres
and this account does not have a password. If you provide this setting, the module will set the password for the postgres
user to your specified value.
package_name
The name of the package to use for installing the server software. Defaults to the default for your OS distro.
\n\npackage_ensure
Value to pass through to the package
resource when creating the server instance. Defaults to undef
.
plperl_package_name
This sets the default package name for the PL/Perl extension. Defaults to utilising the operating system default.
\n\nservice_name
This setting can be used to override the default postgresql service name. If not specified, the module will use whatever service name is the default for your OS distro.
\n\nservice_name
This setting can be used to override the default postgresql service provider. If not specified, the module will use whatever service name is the default for your OS distro.
\n\nservice_status
This setting can be used to override the default status check command for your PostgreSQL service. If not specified, the module will use whatever service name is the default for your OS distro.
\n\ndefault_database
This setting is used to specify the name of the default database to connect with. On most systems this will be "postgres".
\n\nlisten_addresses
This value defaults to localhost
, meaning the postgres server will only accept connections from localhost. If you'd like to be able to connect to postgres from remote machines, you can override this setting. A value of *
will tell postgres to accept connections from any remote machine. Alternately, you can specify a comma-separated list of hostnames or IP addresses. (For more info, have a look at the postgresql.conf
file from your system's postgres package).
ip_mask_deny_postgres_user
This value defaults to 0.0.0.0/0
. Sometimes it can be useful to block the superuser account from remote connections if you are allowing other database users to connect remotely. Set this to an IP and mask for which you want to deny connections by the postgres superuser account. So, e.g., the default value of 0.0.0.0/0
will match any remote IP and deny access, so the postgres user won't be able to connect remotely at all. Conversely, a value of 0.0.0.0/32
would not match any remote IP, and thus the deny rule will not be applied and the postgres user will be allowed to connect.
ip_mask_allow_all_users
This value defaults to 127.0.0.1/32
. By default, Postgres does not allow any database user accounts to connect via TCP from remote machines. If you'd like to allow them to, you can override this setting. You might set it to 0.0.0.0/0
to allow database users to connect from any remote machine, or 192.168.0.0/16
to allow connections from any machine on your local 192.168 subnet.
ipv4acls
List of strings for access control for connection method, users, databases, IPv4 addresses; see postgresql documentation about pg_hba.conf
for information (please note that the link will take you to documentation for the most recent version of Postgres, however links for earlier versions can be found on that page).
ipv6acls
List of strings for access control for connection method, users, databases, IPv6 addresses; see postgresql documentation about pg_hba.conf
for information (please note that the link will take you to documentation for the most recent version of Postgres, however links for earlier versions can be found on that page).
inidb_path
Path to the initdb
command.
createdb_path
Path to the createdb
command.
psql_path
Path to the psql
command.
pg_hba_conf_path
Path to your pg\\_hba.conf
file.
postgresql_conf_path
Path to your postgresql.conf
file.
pg_hba_conf_defaults
If false, disables the defaults supplied with the module for pg\\_hba.conf
. This is useful if you di\nsagree with the defaults and wish to override them yourself. Be sure that your changes of course alig\nn with the rest of the module, as some access is required to perform basic psql
operations for exam\nple.
user
This setting can be used to override the default postgresql super user and owner of postgresql related files in the file system. If not specified, the module will use the user name 'postgres'.
\n\ngroup
This setting can be used to override the default postgresql user group to be used for related files in the file system. If not specified, the module will use the group name 'postgres'.
\n\nneeds_initdb
This setting can be used to explicitly call the initdb operation after server package is installed and before the postgresql service is started. If not specified, the module will decide whether to call initdb or not depending on your OS distro.
\n\nencoding
This will set the default encoding encoding for all databases created with this module. On certain operating systems this will be used during the template1
initialization as well so it becomes a default outside of the module as well. Defaults to the operating system default.
locale
This will set the default database locale for all databases created with this module. On certain operating systems this will be used during the template1
initialization as well so it becomes a default outside of the module as well. Defaults to undef
which is effectively C
.
manage_firewall
This value defaults to false
. Many distros ship with a fairly restrictive firewall configuration which will block the port that postgres tries to listen on. If you'd like for the puppet module to open this port for you (using the puppetlabs-firewall module), change this value to true. Check the documentation for puppetlabs/firewall
to ensure the rest of the global setup is applied, to ensure things like persistence and global rules are set correctly.
manage_pg_hba_conf
This value defaults to true
. Whether or not manage the pg_hba.conf. If set to true
, puppet will overwrite this file. If set to false
, puppet will not modify the file.
This class installs postgresql client software. Alter the following parameters if you have a custom version you would like to install (Note: don't forget to make sure to add any necessary yum or apt repositories if specifying a custom version):
\n\npackage_name
The name of the postgresql client package.
\n\npackage_ensure
The ensure parameter passed on to postgresql client package resource.
\n\nInstalls the postgresql contrib package.
\n\npackage_name
The name of the postgresql client package.
\n\npackage_ensure
The ensure parameter passed on to postgresql contrib package resource.
\n\nInstalls the packages containing the development libraries for PostgreSQL.
\n\npackage_ensure
Override for the ensure
parameter during package installation. Defaults to present
.
package_name
Overrides the default package name for the distribution you are installing to. Defaults to postgresql-devel
or postgresql<version>-devel
depending on your distro.
This class installs postgresql bindings for Java (JDBC). Alter the following parameters if you have a custom version you would like to install (Note: don't forget to make sure to add any necessary yum or apt repositories if specifying a custom version):
\n\npackage_name
The name of the postgresql java package.
\n\npackage_ensure
The ensure parameter passed on to postgresql java package resource.
\n\nThis class installs the postgresql Python libraries. For customer requirements you can customise the following parameters:
\n\npackage_name
The name of the postgresql python package.
\n\npackage_ensure
The ensure parameter passed on to postgresql python package resource.
\n\nThis class installs the PL/Perl procedural language for postgresql.
\n\npackage_name
The name of the postgresql PL/Perl package.
\n\npackage_ensure
The ensure parameter passed on to postgresql PL/Perl package resource.
\n\nThis resource can be used to modify your postgresql.conf
configuration file.
Each resource maps to a line inside your postgresql.conf
file, for example:
postgresql::server::config_entry { 'check_function_bodies':\n value => 'off',\n}\n
\n\nnamevar
Name of the setting to change.
\n\nensure
Set to absent
to remove an entry.
value
Value for the setting.
\n\nThis is a convenience resource that creates a database, user and assigns necessary permissions in one go.
\n\nFor example, to create a database called test1
with a corresponding user of the same name, you can use:
postgresql::server::db { 'test1':\n user => 'test1',\n password => 'test1',\n}\n
\n\nnamevar
The namevar for the resource designates the name of the database.
\n\nuser
User to create and assign access to the database upon creation. Mandatory.
\n\npassword
Password for the created user. Mandatory.
\n\nencoding
Override the character set during creation of the database. Defaults to the default defined during installation.
\n\nlocale
Override the locale during creation of the database. Defaults to the default defined during installation.
\n\ngrant
Grant permissions during creation. Defaults to ALL
.
tablespace
The name of the tablespace to allocate this database to. If not specifies, it defaults to the PostgreSQL default.
\n\nistemplate
Define database as a template. Defaults to false
.
This defined type can be used to create a database with no users and no permissions, which is a rare use case.
\n\nnamevar
The name of the database to create.
\n\ndbname
The name of the database, defaults to the namevar.
\n\nowner
Name of the database user who should be set as the owner of the database. Defaults to the $user variable set in postgresql::server
or postgresql::globals
.
tablespace
Tablespace for where to create this database. Defaults to the defaults defined during PostgreSQL installation.
\n\nencoding
Override the character set during creation of the database. Defaults to the default defined during installation.
\n\nlocale
Override the locale during creation of the database. Defaults to the default defined during installation.
\n\nistemplate
Define database as a template. Defaults to false
.
This defined type manages grant based access privileges for users, wrapping the postgresql::server::database_grant
for database specific permissions. Consult the PostgreSQL documentation for grant
for more information.
namevar
Used to uniquely identify this resource, but functionality not used during grant.
\n\nprivilege
Can be one of SELECT
, TEMPORARY
, TEMP
, CONNECT
. ALL
is used as a synonym for CREATE
. If you need to add multiple privileges, a space delimited string can be used.
db
Database to grant access to.
\n\nrole
Role or user whom you are granting access for.
\n\npsql_db
Database to execute the grant against. This should not ordinarily be changed from the default, which is postgres
.
psql_user
OS user for running psql
. Defaults to the default user for the module, usually postgres
.
This defined type allows you to create an access rule for pg_hba.conf
. For more details see the PostgreSQL documentation.
For example:
\n\npostgresql::server::pg_hba_rule { 'allow application network to access app database':\n description => "Open up postgresql for access from 200.1.2.0/24",\n type => 'host',\n database => 'app',\n user => 'app',\n address => '200.1.2.0/24',\n auth_method => 'md5',\n}\n
\n\nThis would create a ruleset in pg_hba.conf
similar to:
# Rule Name: allow application network to access app database\n# Description: Open up postgresql for access from 200.1.2.0/24\n# Order: 150\nhost app app 200.1.2.0/24 md5\n
\n\nnamevar
A unique identifier or short description for this rule. The namevar doesn't provide any functional usage, but it is stored in the comments of the produced pg_hba.conf
so the originating resource can be identified.
description
A longer description for this rule if required. Defaults to none
. This description is placed in the comments above the rule in pg_hba.conf
.
type
The type of rule, this is usually one of: local
, host
, hostssl
or hostnossl
.
database
A comma separated list of databases that this rule matches.
\n\nuser
A comma separated list of database users that this rule matches.
\n\naddress
If the type is not 'local' you can provide a CIDR based address here for rule matching.
\n\nauth_method
The auth_method
is described further in the pg_hba.conf
documentation, but it provides the method that is used for authentication for the connection that this rule matches.
auth_option
For certain auth_method
settings there are extra options that can be passed. Consult the PostgreSQL pg_hba.conf
documentation for further details.
order
An order for placing the rule in pg_hba.conf
. Defaults to 150
.
target
This provides the target for the rule, and is generally an internal only property. Use with caution.
\n\nThis resource creates a role or user in PostgreSQL.
\n\nnamevar
The role name to create.
\n\npassword_hash
The hash to use during password creation. If the password is not already pre-encrypted in a format that PostgreSQL supports, use the postgresql_password
function to provide an MD5 hash here, for example:
postgresql::role { "myusername":\n password_hash => postgresql_password('myusername', 'mypassword'),\n}\n
\n\ncreatedb
Whether to grant the ability to create new databases with this role. Defaults to false
.
createrole
Whether to grant the ability to create new roles with this role. Defaults to false
.
login
Whether to grant login capability for the new role. Defaults to false
.
superuser
Whether to grant super user capability for the new role. Defaults to false
.
replication
If true
provides replication capabilities for this role. Defaults to false
.
connection_limit
Specifies how many concurrent connections the role can make. Defaults to -1
meaning no limit.
username
The username of the role to create, defaults to namevar
.
This defined type manages grant based access privileges for users. Consult the PostgreSQL documentation for grant
for more information.
namevar
Used to uniquely identify this resource, but functionality not used during grant.
\n\nprivilege
Can be one of SELECT
, INSERT
, UPDATE
, REFERENCES
. ALL
is used as a synonym for CREATE
. If you need to add multiple privileges, a space delimited string can be used.
table
Table to grant access on.
\n\ndb
Database of table.
\n\nrole
Role or user whom you are granting access for.
\n\npsql_db
Database to execute the grant against. This should not ordinarily be changed from the default, which is postgres
.
psql_user
OS user for running psql
. Defaults to the default user for the module, usually postgres
.
This defined type can be used to create a tablespace. For example:
\n\npostgresql::tablespace { 'tablespace1':\n location => '/srv/space1',\n}\n
\n\nIt will create the location if necessary, assigning it the same permissions as your\nPostgreSQL server.
\n\nnamevar
The tablespace name to create.
\n\nlocation
The path to locate this tablespace.
\n\nowner
The default owner of the tablespace.
\n\nspcname
Name of the tablespace. Defaults to namevar
.
This resource can be utilised inside composite manifests to validate that a client has a valid connection with a remote PostgreSQL database. It can be ran from any node where the PostgreSQL client software is installed to validate connectivity before commencing other dependent tasks in your Puppet manifests, so it is often used when chained to other tasks such as: starting an application server, performing a database migration.
\n\nExample usage:
\n\npostgresql::validate_db_connection { 'validate my postgres connection':\n database_host => 'my.postgres.host',\n database_username => 'mydbuser',\n database_password => 'mydbpassword',\n database_name => 'mydbname',\n}->\nexec { 'rake db:migrate':\n cwd => '/opt/myrubyapp',\n}\n
\n\nnamevar
Uniquely identify this resource, but functionally does nothing.
\n\ndatabase_host
The hostname of the database you wish to test. Defaults to 'undef' which generally uses the designated local unix socket.
\n\ndatabase_port
Port to use when connecting. Default to 'undef' which generally defaults to 5432 depending on your PostgreSQL packaging.
\n\ndatabase_name
The name of the database you wish to test. Defaults to 'postgres'.
\n\ndatabase_username
Username to connect with. Defaults to 'undef', which when using a unix socket and ident auth will be the user you are running as. If the host is remote you must provide a username.
\n\ndatabase_password
Password to connect with. Can be left blank, but that is not recommended.
\n\nrun_as
The user to run the psql
command with for authenticiation. This is important when trying to connect to a database locally using Unix sockets and ident
authentication. It is not needed for remote testing.
sleep
Upon failure, sets the number of seconds to sleep for before trying again.
\n\ntries
Upon failure, sets the number of attempts before giving up and failing the resource.
\n\ncreate_db_first
This will ensure the database is created before running the test. This only really works if your test is local. Defaults to true
.
If you need to generate a postgres encrypted password, use postgresql_password
. You can call it from your production manifests if you don't mind them containing the clear text versions of your passwords, or you can call it from the command line and then copy and paste the encrypted password into your manifest:
$ puppet apply --execute 'notify { "test": message => postgresql_password("username", "password") }'\n
\n\nThis internal function converts a list of pg_hba.conf
based acls (passed in as an array of strings) to a format compatible with the postgresql::pg_hba_rule
resource.
This function should only be used internally by the module.
\n\nWorks with versions of PostgreSQL from 8.1 through 9.2.
\n\nCurrent it is only actively tested with the following operating systems:
\n\nAlthough patches are welcome for making it work with other OS distros, it is considered best effort.
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can't access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n\nThere are two types of tests distributed with the module. Unit tests with rspec-puppet and system tests using rspec-system.
\n\nFor unit testing, make sure you have:
\n\nInstall the necessary gems:
\n\nbundle install --path=vendor\n
\n\nAnd then run the unit tests:
\n\nbundle exec rake spec\n
\n\nThe unit tests are ran in Travis-CI as well, if you want to see the results of your own tests regsiter the service hook through Travis-CI via the accounts section for your Github clone of this project.
\n\nIf you want to run the system tests, make sure you also have:
\n\nThen run the tests using:
\n\nbundle exec rake spec:system\n
\n\nTo run the tests on different operating systems, see the sets available in .nodeset.yml and run the specific set with the following syntax:
\n\nRSPEC_SET=debian-607-x64 bundle exec rake spec:system\n
\n\nThis Puppet module was originally authored by Inkling Systems. The maintainer preferred that Puppet Labs take ownership of the module for future improvement and maintenance as Puppet Labs is using it in the PuppetDB module. Existing pull requests and issues were transferred over, please fork and continue to contribute here instead of Inkling.
\n\nPreviously: https://github.com/inkling/puppet-postgresql
\n\n2013-11-05 - Version 3.2.0\n\nSummary:\n\nAdd's support for Ubuntu 13.10 (and 14.04) as well as x, y, z.\n\nFeatures:\n- Add versions for Ubuntu 13.10 and 14.04.\n- Use default_database in validate_db_connection instead of a hardcoded\n'postgres'\n- Add globals/params layering for default_database.\n- Allow specification of default database name.\n\nBugs:\n- Fixes to the README.\n\n\n2013-10-25 - Version 3.1.0\n\nSummary:\n\nThis is a minor feature and bug fix release.\n\nFirstly, the postgresql_psql type now includes a new parameter `search_path` which is equivalent to using `set search_path` which allows you to change the default schema search path.\n\nThe default version of Fedora 17 has now been added, so that Fedora 17 users can enjoy the module.\n\nAnd finally we've extended the capabilities of the defined type postgresql::validate_db_connection so that now it can handle retrying and sleeping between retries. This feature has been monopolized to fix a bug we were seeing with startup race conditions, but it can also be used by remote systems to 'wait' for PostgreSQL to start before their Puppet run continues.\n\nFeatures:\n- Defined $default_version for Fedora 17 (Bret Comnes)\n- add search_path attribute to postgresql_psql resource (Jeremy Kitchen)\n- (GH-198) Add wait and retry capability to validate_db_connection (Ken Barber)\n\nBugs:\n- enabling defined postgres user password without resetting on every puppet run (jonoterc)\n- periods are valid in configuration variables also (Jeremy Kitchen)\n- Add zero length string to join() function (Jarl Stefansson)\n- add require of install to reload class (cdenneen)\n- (GH-198) Fix race condition on postgresql startup (Ken Barber)\n- Remove concat::setup for include in preparation for the next concat release (Ken Barber)\n\n\n2013-10-14 - Version 3.0.0\n\nFinal release of 3.0, enjoy!\n\n2013-10-14 - Version 3.0.0-rc3\n\nSummary:\n\nAdd a parameter to unmanage pg_hba.conf to fix a regression from 2.5, as well\nas allowing owner to be passed into x.\n\nFeatures:\n- `manage_pg_hba_conf` parameter added to control pg_hba.conf management.\n- `owner` parameter added to server::db.\n\n2013-10-09 - Version 3.0.0-rc2\n\nSummary:\n\nA few bugfixes have been found since -rc1.\n\nFixes:\n- Special case for $datadir on Amazon\n- Fix documentation about username/password for the postgresql_hash function\n\n2013-10-01 - Version 3.0.0-rc1\n\nSummary:\n\nVersion 3 was a major rewrite to fix some internal dependency issues, and to\nmake the new Public API more clear. As a consequence a lot of things have\nchanged for version 3 and older revisions that we will try to outline here.\n\n(NOTE: The format of this CHANGELOG differs to normal in an attempt to\nexplain the scope of changes)\n\n* Server specific objects now moved under `postgresql::server::` namespace:\n\nTo restructure server specific elements under the `postgresql::server::`\nnamespaces the following objects were renamed as such:\n\n`postgresql::database` -> `postgresql::server::database`\n`postgresql::database_grant` -> `postgresql::server::database_grant`\n`postgresql::db` -> `postgresql::server::db`\n`postgresql::grant` -> `postgresql::server::grant`\n`postgresql::pg_hba_rule` -> `postgresql::server::pg_hba_rule`\n`postgresql::plperl` -> `postgresql::server::plperl`\n`postgresql::contrib` -> `postgresql::server::contrib`\n`postgresql::role` -> `postgresql::server::role`\n`postgresql::table_grant` -> `postgresql::server::table_grant`\n`postgresql::tablespace` -> `postgresql::server::tablespace`\n\n* New `postgresql::server::config_entry` resource for managing configuration:\n\nPreviously we used the `file_line` resource to modify `postgresql.conf`. This\nnew revision now adds a new resource named `postgresql::server::config_entry`\nfor managing this file. For example:\n\n```puppet\n postgresql::server::config_entry { 'check_function_bodies':\n value => 'off',\n }\n```\n\nIf you were using `file_line` for this purpose, you should change to this new\nmethodology.\n\n* `postgresql_puppet_extras.conf` has been removed:\n\nNow that we have a methodology for managing `postgresql.conf`, and due to\nconcerns over the file management methodology using an `exec { 'touch ...': }`\nas a way to create an empty file the existing postgresql\\_puppet\\_extras.conf\nfile is no longer managed by this module.\n\nIf you wish to recreate this methodology yourself, use this pattern:\n\n```puppet\n class { 'postgresql::server': }\n\n $extras = "/tmp/include.conf"\n\n file { $extras:\n content => 'max_connections = 123',\n notify => Class['postgresql::server::service'],\n }->\n postgresql::server::config_entry { 'include':\n value => $extras,\n }\n```\n\n* All uses of the parameter `charset` changed to `encoding`:\n\nSince PostgreSQL uses the terminology `encoding` not `charset` the parameter\nhas been made consisent across all classes and resources.\n\n* The `postgresql` base class is no longer how you set globals:\n\nThe old global override pattern was less then optimal so it has been fixed,\nhowever we decided to demark this properly by specifying these overrides in\nthe class `postgresql::global`. Consult the documentation for this class now\nto see what options are available.\n\nAlso, some parameter elements have been moved between this and the\n`postgresql::server` class where it made sense.\n\n* `config_hash` parameter collapsed for the `postgresql::server` class:\n\nBecause the `config_hash` was really passing data through to what was in\neffect an internal class (`postgresql::config`). And since we don't want this\nkind of internal exposure the parameters were collapsed up into the\n`postgresql::server` class directly.\n\n* Lots of changes to 'private' or 'undocumented' classes:\n\nIf you were using these before, these have changed names. You should only use\nwhat is documented in this README.md, and if you don't have what you need you\nshould raise a patch to add that feature to a public API. All internal classes\nnow have a comment at the top indicating them as private to make sure the\nmessage is clear that they are not supported as Public API.\n\n* `pg_hba_conf_defaults` parameter included to turn off default pg\\_hba rules:\n\nThe defaults should be good enough for most cases (if not raise a bug) but if\nyou simply need an escape hatch, this setting will turn off the defaults. If\nyou want to do this, it may affect the rest of the module so make sure you\nreplace the rules with something that continues operation.\n\n* `postgresql::database_user` has now been removed:\n\nUse `postgresql::server::role` instead.\n\n* `postgresql::psql` resource has now been removed:\n\nUse `postgresql_psql` instead. In the future we may recreate this as a wrapper\nto add extra capability, but it will not match the old behaviour.\n\n* `postgresql_default_version` fact has now been removed:\n\nIt didn't make sense to have this logic in a fact any more, the logic has been\nmoved into `postgresql::params`.\n\n* `ripienaar/concat` is no longer used, instead we use `puppetlabs/concat`:\n\nThe older concat module is now deprecated and moved into the\n`puppetlabs/concat` namespace. Functionality is more or less identical, but\nyou may need to intervene during the installing of this package - as both use\nthe same `concat` namespace.\n\n2013-09-09 Release 2.5.0\n=======================\n\nSummary\n-------\n\nThe focus of this release is primarily to capture the fixes done to the\ntypes and providers to make sure refreshonly works properly and to set\nthe stage for the large scale refactoring work of 3.0.0.\n\nFeatures\n--------\n\nBugfixes \n--------\n- Use boolean for refreshonly.\n- Fix postgresql::plperl documentation.\n- Add two missing parameters to config::beforeservice\n- Style fixes\n\n\n2013-08-01 Release 2.4.1\n========================\n\nSummary\n-------\n\nThis minor bugfix release solves an idempotency issue when using plain text\npasswords for the password_hash parameter for the postgresql::role defined\ntype. Without this, users would continually see resource changes everytime\nyour run Puppet.\n\nBugfixes\n---------\n- Alter role call not idempotent with cleartext passwords (Ken Barber)\n\n2013-07-19 Release 2.4.0\n========================\n\nSummary\n-------\nThis updates adds the ability to change permissions on tables, create template\ndatabases from normal databases, manage PL-Perl's postgres package, and\ndisable the management of `pg_hba.conf`.\n\nFeatures\n--------\n- Add `postgresql::table_grant` defined resource\n- Add `postgresql::plperl` class\n- Add `manage_pg_hba_conf` parameter to the `postgresql::config` class\n- Add `istemplate` parameter to the `postgresql::database` define\n\nBugfixes\n--------\n- Update `postgresql::role` class to be able to update roles when modified\ninstead of only on creation.\n- Update tests\n- Fix documentation of `postgresql::database_grant`\n\n2.3.0\n=====\n\nThis feature release includes the following changes:\n\n* Add a new parameter `owner` to the `database` type. This can be used to\n grant ownership of a new database to a specific user. (Bruno Harbulot)\n* Add support for operating systems other than Debian/RedHat, as long as the\n user supplies custom values for all of the required paths, package names, etc.\n (Chris Price)\n* Improved integration testing (Ken Barber)\n\n2.2.1\n=====\n\nThis release fixes a bug whereby one of our shell commands (psql) were not ran from a globally accessible directory. This was causing permission denied errors when the command attempted to change user without changing directory.\n\nUsers of previous versions might have seen this error:\n\n Error: Error executing SQL; psql returned 256: 'could not change directory to "/root"\n\nThis patch should correct that.\n\n#### Detail Changes\n\n* Set /tmp as default CWD for postgresql_psql\n\n2.2.0\n=====\n\nThis feature release introduces a number of new features and bug fixes.\n\nFirst of all it includes a new class named `postgresql::python` which provides you with a convenient way of install the python Postgresql client libraries.\n\n class { 'postgresql::python':\n }\n\nYou are now able to use `postgresql::database_user` without having to specify a password_hash, useful for different authentication mechanisms that do not need passwords (ie. cert, local etc.).\n\nWe've also provided a lot more advanced custom parameters now for greater control of your Postgresql installation. Consult the class documentation for PuppetDB in the README.\n\nThis release in particular has largely been contributed by the community members below, a big thanks to one and all.\n\n#### Detailed Changes\n\n* Add support for psycopg installation (Flaper Fesp and Dan Prince)\n* Added default PostgreSQL version for Ubuntu 13.04 (Kamil Szymanski)\n* Add ability to create users without a password (Bruno Harbulot)\n* Three Puppet 2.6 fixes (Dominic Cleal)\n* Add explicit call to concat::setup when creating concat file (Dominic Cleal)\n* Fix readme typo (Jordi Boggiano)\n* Update postgres_default_version for Ubuntu (Kamil Szymanski)\n* Allow to set connection for noew role (Kamil Szymanski)\n* Fix pg_hba_rule for postgres local access (Kamil Szymanski)\n* Fix versions for travis-ci (Ken Barber)\n* Add replication support (Jordi Boggiano)\n* Cleaned up and added unit tests (Ken Barber)\n* Generalization to provide more flexability in postgresql configuration (Karel Brezina)\n* Create dependent directory for sudoers so tests work on Centos 5 (Ken Barber)\n* Allow SQL commands to be run against a specific DB (Carlos Villela)\n* Drop trailing comma to support Puppet 2.6 (Michael Arnold)\n\n2.1.1\n=====\n\nThis release provides a bug fix for RHEL 5 and Centos 5 systems, or specifically systems using PostgreSQL 8.1 or older. On those systems one would have received the error:\n\n Error: Could not start Service[postgresqld]: Execution of ‘/sbin/service postgresql start’ returned 1:\n\nAnd the postgresql log entry:\n\n FATAL: unrecognized configuration parameter "include"\n\nThis bug is due to a new feature we had added in 2.1.0, whereby the `include` directive in `postgresql.conf` was not compatible. As a work-around we have added checks in our code to make sure systems running PostgreSQL 8.1 or older do not have this directive added.\n\n#### Detailed Changes\n\n2013-01-21 - Ken Barber <ken@bob.sh>\n* Only install `include` directive and included file on PostgreSQL >= 8.2\n* Add system tests for Centos 5\n\n2.1.0\n=====\n\nThis release is primarily a feature release, introducing some new helpful constructs to the module.\n\nFor starters, we've added the line `include 'postgresql_conf_extras.conf'` by default so extra parameters not managed by the module can be added by other tooling or by Puppet itself. This provides a useful escape-hatch for managing settings that are not currently managed by the module today.\n\nWe've added a new defined resource for managing your tablespace, so you can now create new tablespaces using the syntax:\n\n postgresql::tablespace { 'dbspace':\n location => '/srv/dbspace',\n }\n\nWe've added a locale parameter to the `postgresql` class, to provide a default. Also the parameter has been added to the `postgresql::database` and `postgresql::db` defined resources for changing the locale per database:\n\n postgresql::db { 'mydatabase':\n user => 'myuser',\n password => 'mypassword',\n encoding => 'UTF8',\n locale => 'en_NG',\n }\n\nThere is a new class for installing the necessary packages to provide the PostgreSQL JDBC client jars:\n\n class { 'postgresql::java': }\n\nAnd we have a brand new defined resource for managing fine-grained rule sets within your pg_hba.conf access lists:\n\n postgresql::pg_hba { 'Open up postgresql for access from 200.1.2.0/24':\n type => 'host',\n database => 'app',\n user => 'app',\n address => '200.1.2.0/24',\n auth_method => 'md5',\n }\n\nFinally, we've also added Travis-CI support and unit tests to help us iterate faster with tests to reduce regression. The current URL for these tests is here: https://travis-ci.org/puppetlabs/puppet-postgresql. Instructions on how to run the unit tests available are provided in the README for the module.\n\nA big thanks to all those listed below who made this feature release possible :-).\n\n#### Detailed Changes\n\n2013-01-18 - Simão Fontes <simaofontes@gmail.com> & Flaper Fesp <flaper87@gmail.com>\n* Remove trailing commas from params.pp property definition for Puppet 2.6.0 compatibility\n\n2013-01-18 - Lauren Rother <lauren.rother@puppetlabs.com>\n* Updated README.md to conform with best practices template\n\n2013-01-09 - Adrien Thebo <git@somethingsinistral.net>\n* Update postgresql_default_version to 9.1 for Debian 7.0\n\n2013-01-28 - Karel Brezina <karel.brezina@gmail.com>\n* Add support for tablespaces\n\n2013-01-16 - Chris Price <chris@puppetlabs.com> & Karel Brezina <karel.brezina@gmail.com>\n* Provide support for an 'include' config file 'postgresql_conf_extras.conf' that users can modify manually or outside of the module.\n\n2013-01-31 - jv <jeff@jeffvier.com>\n* Fix typo in README.pp for postgresql::db example\n\n2013-02-03 - Ken Barber <ken@bob.sh>\n* Add unit tests and travis-ci support\n\n2013-02-02 - Ken Barber <ken@bob.sh>\n* Add locale parameter support to the 'postgresql' class\n\n2013-01-21 - Michael Arnold <github@razorsedge.org>\n* Add a class for install the packages containing the PostgreSQL JDBC jar\n\n2013-02-06 - fhrbek <filip.hbrek@gmail.com>\n* Coding style fixes to reduce warnings in puppet-lint and Geppetto\n\n2013-02-10 - Ken Barber <ken@bob.sh>\n* Provide new defined resource for managing pg_hba.conf\n\n2013-02-11 - Ken Barber <ken@bob.sh>\n* Fix bug with reload of Postgresql on Redhat/Centos\n\n2013-02-15 - Erik Dalén <dalen@spotify.com>\n* Fix more style issues to reduce warnings in puppet-lint and Geppetto\n\n2013-02-15 - Erik Dalén <dalen@spotify.com>\n* Fix case whereby we were modifying a hash after creation\n\n2.0.1\n=====\n\nMinor bugfix release.\n\n2013-01-16 - Chris Price <chris@puppetlabs.com>\n * Fix revoke command in database.pp to support postgres 8.1 (43ded42)\n\n2013-01-15 - Jordi Boggiano <j.boggiano@seld.be>\n * Add support for ubuntu 12.10 status (3504405)\n\n2.0.0\n=====\n\nMany thanks to the following people who contributed patches to this\nrelease:\n\n* Adrien Thebo\n* Albert Koch\n* Andreas Ntaflos\n* Brett Porter\n* Chris Price\n* dharwood\n* Etienne Pelletier\n* Florin Broasca\n* Henrik\n* Hunter Haugen\n* Jari Bakken\n* Jordi Boggiano\n* Ken Barber\n* nzakaria\n* Richard Arends\n* Spenser Gilliland\n* stormcrow\n* William Van Hevelingen\n\nNotable features:\n\n * Add support for versions of postgres other than the system default version\n (which varies depending on OS distro). This includes optional support for\n automatically managing the package repo for the "official" postgres yum/apt\n repos. (Major thanks to Etienne Pelletier <epelletier@maestrodev.com> and\n Ken Barber <ken@bob.sh> for their tireless efforts and patience on this\n feature set!) For example usage see `tests/official-postgresql-repos.pp`.\n\n * Add some support for Debian Wheezy and Ubuntu Quantal\n\n * Add new `postgres_psql` type with a Ruby provider, to replace the old\n exec-based `psql` type. This gives us much more flexibility around\n executing SQL statements and controlling their logging / reports output.\n\n * Major refactor of the "spec" tests--which are actually more like\n acceptance tests. We now support testing against multiple OS distros\n via vagrant, and the framework is in place to allow us to very easily add\n more distros. Currently testing against Cent6 and Ubuntu 10.04.\n\n * Fixed a bug that was preventing multiple databases from being owned by the\n same user\n (9adcd182f820101f5e4891b9f2ff6278dfad495c - Etienne Pelletier <epelletier@maestrodev.com>)\n\n * Add support for ACLs for finer-grained control of user/interface access\n (b8389d19ad78b4fb66024897097b4ed7db241930 - dharwood <harwoodd@cat.pdx.edu>)\n\n * Many other bug fixes and improvements!\n\n\n1.0.0\n=====\n2012-09-17 - Version 0.3.0 released\n\n2012-09-14 - Chris Price <chris@puppetlabs.com>\n * Add a type for validating a postgres connection (ce4a049)\n\n2012-08-25 - Jari Bakken <jari.bakken@gmail.com>\n * Remove trailing commas. (e6af5e5)\n\n2012-08-16 - Version 0.2.0 released\n
\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2013 Puppet Labs\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n
The NTP module installs, configures, and manages the ntp service.
\n\nThe NTP module handles running NTP across a range of operating systems and\ndistributions. Where possible we use the upstream ntp templates so that the\nresults closely match what you'd get if you modified the package default conf\nfiles.
\n\ninclude '::ntp' is enough to get you up and running. If you wish to pass in\nparameters like which servers to use then you can use:
\n\nclass { '::ntp':\n servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],\n}\n
\n\nAll interaction with the ntp module can do be done through the main ntp class.\nThis means you can simply toggle the options in the ntp class to get at the\nfull functionality.
\n\ninclude '::ntp'\n
\n\nclass { '::ntp':\n servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],\n}\n
\n\nclass { '::ntp':\n servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],\n restrict => ['127.0.0.1'],\n}\n
\n\nclass { '::ntp':\n servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],\n restrict => ['127.0.0.1'],\n manage_service => false,\n}\n
\n\nclass { '::ntp':\n servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],\n restrict => ['127.0.0.1'],\n manage_service => false,\n config_template => 'different/module/custom.template.erb',\n}\n
\n\nThe following parameters are available in the ntp module
\n\nautoupdate
Deprecated: This parameter previously determined if the ntp module should be\nautomatically updated to the latest version available. Replaced by package_\nensure.
\n\nconfig
This sets the file to write ntp configuration into.
\n\nconfig_template
This determines which template puppet should use for the ntp configuration.
\n\ndriftfile
This sets the location of the driftfile for ntp.
\n\nkeys_controlkey
Which of the keys is used as the control key.
\n\nkeys_enable
Should the ntp keys functionality be enabled.
\n\nkeys_file
Location of the keys file.
\n\nkeys_requestkey
Which of the keys is used as the request key.
\n\npackage_ensure
This can be set to 'present' or 'latest' or a specific version to choose the\nntp package to be installed.
\n\npackage_name
This determines the name of the package to install.
\n\npanic
This determines if ntp should 'panic' in the event of a very large clock skew.\nWe set this to false if you're on a virtual machine by default as they don't\ndo a great job with keeping time.
\n\npreferred_servers
List of ntp servers to prefer. Will append prefer for any server in this list\nthat also appears in the servers list.
\n\nrestrict
This sets the restrict options in the ntp configuration. The lines are\npreappended with restrict so you just need to list the rest of the restriction.
\n\nservers
This selects the servers to use for ntp peers.
\n\nservice_enable
This determines if the service should be enabled at boot.
\n\nservice_ensure
This determines if the service should be running or not.
\n\nservice_manage
This selects if puppet should manage the service in the first place.
\n\nservice_name
This selects the name of the ntp service for puppet to manage.
\n\nudlc
Enables configs for undisciplined local clock regardless of\nstatus as a virtual machine.
\n\nThis module has been built on and tested against Puppet 2.7 and higher.
\n\nThe module has been tested on:
\n\nTesting on other platforms has been light and cannot be guaranteed.
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community\ncontributions are essential for keeping them great. We can’t access the\nhuge number of platforms and myriad of hardware, software, and deployment\nconfigurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our\nmodules work in your environment. There are a few guidelines that we need\ncontributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\nWork around a packaging bug with symlinks, no other functional changes.
\n\nFinal release of 3.0, enjoy!
\n\nThis release changes the behavior of restrict and adds AIX osfamily support.
\n\nrestrict
no longer requires you to pass in parameters as:
restrict => [ 'restrict x', 'restrict y' ]
\n\nbut just as:
\n\nrestrict => [ 'x', 'y' ]
\n\nAs the template now prefixes each line with restrict.
\n\nFeatures:
\n\nrestrict
so you no longer need the restrict\nkeyword.udlc
parameter to enable undisciplined local clock regardless of the\nmachines status as a virtual machine.Fixes:
\n\n2013-09-05 - Version 2.0.1
\n\nSummary:
\n\nCorrect the LICENSE file.
\n\nBugfixes:
\n\n2013-07-31 - Version 2.0.0
\n\nSummary:
\n\nThe 2.0 release focuses on merging all the distro specific\ntemplates into a single reusable template across all platforms.
\n\nTo aid in that goal we now allow you to change the driftfile,\nntp keys, and perferred_servers.
\n\nBackwards-incompatible changes:
\n\nAs all the distro specific templates have been removed and a\nunified one created you may be missing functionality you\npreviously relied on. Please test carefully before rolling\nout globally.
\n\nConfiguration directives that might possibly be affected:
\n\nfilegen
fudge
(for virtual machines)keys
logfile
restrict
restrictkey
statistics
trustedkey
Features:
\n\nntp
class:\n\ndriftfile
: path for the ntp driftfile.keys_enable
: Enable NTP keys feature.keys_file
: Path for the NTP keys file.keys_trusted
: Which keys to trust.keys_controlkey
: Which key to use for the control key.keys_requestkey
: Which key to use for the request key.preferred_servers
: Array of servers to prefer.restrict
: Array of restriction options to apply.2013-07-15 - Version 1.0.1\nBugfixes:
\n\nautoupdate
parameter.2013-07-08 - Version 1.0.0\nFeatures:
\n\nntp
class:\n\nautoupdate
: deprecated in favor of directly setting package_ensure.panic
: set to false if you wish to allow large clock skews. 2011-11-10 Dan Bode dan@puppetlabs.com - 0.0.4\nAdd Amazon Linux as a supported platform\nAdd unit tests\n2011-06-16 Jeff McCune jeff@puppetlabs.com - 0.0.3\nInitial release under puppetlabs
\nApache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [2013] [Puppet Labs]\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n
This provides a single type, vcsrepo
.
This type can be used to describe:
\n\nThis module supports a wide range of VCS types, each represented by a\nseparate provider.
\n\nFor information on how to use this module with a specific VCS, see\nREADME.<VCS>.markdown
.
See LICENSE.
\n2013-11-13 - Version 0.2.0\n\nSummary:\n\nThis release mainly focuses on a number of bugfixes, which should\nsignificantly improve the reliability of Git and SVN. Thanks to\nour many contributors for all of these fixes!\n\nFeatures:\n- Git:\n - Add autorequire for Package['git']\n- HG:\n - Allow user and identity properties.\n- Bzr:\n - "ensure => latest" support.\n- SVN:\n - Added configuration parameter.\n - Add support for main svn repositories.\n- CVS:\n - Allow for setting the CVS_RSH environment variable.\n\nFixes:\n- Handle Puppet::Util[::Execution].withenv for 2.x and 3.x properly.\n- Change path_empty? to not do full directory listing.\n- Overhaul spec tests to work with rspec2.\n- Git:\n - Improve Git SSH usage documentation.\n - Add ssh session timeouts to prevent network issues from blocking runs.\n - Fix git provider checkout of a remote ref on an existing repo.\n - Allow unlimited submodules (thanks to --recursive).\n - Use git checkout --force instead of short -f everywhere.\n - Update git provider to handle checking out into an existing (empty) dir.\n- SVN:\n - Handle force property. for svn.\n - Adds support for changing upstream repo url.\n - Check that the URL of the WC matches the URL from the manifest.\n - Changed from using "update" to "switch".\n - Handle revision update without source switch.\n - Fix svn provider to look for '^Revision:' instead of '^Last Changed Rev:'.\n- CVS:\n - Documented the "module" attribute.\n
Copyright (C) 2010-2012 Puppet Labs Inc.\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nThis program and entire repository is free software; you can\nredistribute it and/or modify it under the terms of the GNU\nGeneral Public License as published by the Free Software\nFoundation; either version 2 of the License, or any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program; if not, write to the Free Software\nFoundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n
Simple module that can install git or gitosis
\n\nThis module installs the git revision control system on a target node. It does not manage a git server or any associated services; it simply ensures a bare minimum set of features (e.g. just a package) to use git.
\n\nThe specifics managed by the module may vary depending on the platform.
\n\nSimply include the git
class.
include git\n
\n\nThis module is known to work with the following operating system families:
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\nApache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n
By guiding puppetdb setup and configuration with a primary Puppet server, the PuppetDB module provides fast, streamlined access to data on puppetized infrastructure.
\n\nThe PuppetDB module provides a quick way to get started using PuppetDB, an open source inventory resource service that manages storage and retrieval of platform-generated data. The module will install PostgreSQL and PuppetDB if you don't have them, as well as set up the connection to primary Puppet server. The module will also provide a dashboard you can use to view the current state of your system.
\n\nFor more information about PuppetDB please see the official PuppetDB documentation.
\n\nWhat PuppetDB affects:
\n\npuppetdb::config
class will cause your routes.yaml file to be overwritten entirely (see Usage below for options and more information )Introductory Questions
\n\nTo begin using PuppetDB, you’ll have to make a few decisions:
\n\nThe answers to those questions will be largely dependent on your answers to questions about your Puppet environment:
\n\nDepending on your answers to all of the questions above, you will likely fall under one of these set-up options:
\n\n\n\nThis approach assumes you will use our default database (PostgreSQL) and run everything (PostgreSQL, PuppetDB, primary Puppet server) all on the same node. This setup will be great for a testing or experimental environment. In this case, your manifest will look like:
\n\nnode primary Puppet server {\n # Configure puppetdb and its underlying database\n class { 'puppetdb': }\n # Configure the primary Puppet server to use puppetdb\n class { 'puppetdb::config': }\n}\n
\n\nYou can provide some parameters for these classes if you’d like more control, but that is literally all that it will take to get you up and running with the default configuration.
\n\nThis approach is for those who prefer not to install PuppetDB on the same node as the primary Puppet server. Your environment will be easier to scale if you are able to dedicate hardware to the individual system components. You may even choose to run the puppetdb server on a different node from the PostgreSQL database that it uses to store its data. So let’s have a look at what a manifest for that scenario might look like:
\n\nThis is an example of a very basic 3-node setup for PuppetDB.
\n\nThis node is our primary Puppet server:
\n\nnode puppet {\n # Here we configure the primary Puppet server to use PuppetDB,\n # and tell it that the hostname is ‘puppetdb’\n class { 'puppetdb::config':\n puppetdb_server => 'puppetdb',\n }\n}\n
\n\nThis node is our postgres server:
\n\nnode puppetdb-postgres {\n # Here we install and configure postgres and the puppetdb\n # database instance, and tell postgres that it should\n # listen for connections to the hostname ‘puppetdb-postgres’\n class { 'puppetdb::database::postgresql':\n listen_addresses => 'puppetdb-postgres',\n }\n}\n
\n\nThis node is our main puppetdb server:
\n\nnode puppetdb {\n # Here we install and configure PuppetDB, and tell it where to\n # find the postgres database.\n class { 'puppetdb::server':\n database_host => 'puppetdb-postgres',\n }\n}\n
\n\nThis should be all it takes to get a 3-node, distributed installation of PuppetDB up and running. Note that, if you prefer, you could easily move two of these classes to a single node and end up with a 2-node setup instead.
\n\nWhether you choose a single node development setup or a multi-node setup, a basic setup of PuppetDB will cause: PostgreSQL to install on the node if it’s not already there; PuppetDB postgres database instance and user account to be created; the postgres connection to be validated and, if successful, PuppetDB to be installed and configured; PuppetDB connection to be validated and, if successful, the primary Puppet server config files to be modified to use PuppetDB; and the primary Puppet server to be restarted so that it will pick up the config changes.
\n\nIf your logging level is set to INFO or finer, you should start seeing PuppetDB-related log messages appear in both your primary Puppet server log and your puppetdb log as subsequent agent runs occur.
\n\nIf you’d prefer to use PuppetDB’s embedded database rather than PostgreSQL, have a look at the database parameter on the puppetdb class:
\n\nclass { 'puppetdb':\n database => 'embedded',\n}\n
\n\nThe embedded database can be useful for testing and very small production environments, but it is not recommended for production environments since it consumes a great deal of memory as your number of nodes increase.
\n\nIt is worth noting that there are some cross-node dependencies, which means that the first time you add the module's configurations to your manifests, you may see a few failed puppet runs on the affected nodes.
\n\nPuppetDB handles cross-node dependencies by taking a sort of “eventual consistency” approach. There’s nothing that the module can do to control the order in which your nodes check in, but the module can check to verify that the services it depends on are up and running before it makes configuration changes--so that’s what it does.
\n\nWhen your primary Puppet server node checks in, it will validate the connectivity to the puppetdb server before it applies its changes to the primary Puppet server config files. If it can’t connect to puppetdb, then the puppet run will fail and the previous config files will be left intact. This prevents your primary Puppet server from getting into a broken state where all incoming puppet runs fail because the primary Puppet server is configured to use a puppetdb server that doesn’t exist yet. The same strategy is used to handle the dependency between the puppetdb server and the postgres server.
\n\nHence the failed puppet runs. These failures should be limited to 1 failed run on the puppetdb node, and up to 2 failed runs on the primary Puppet server node. After that, all of the dependencies should be satisfied and your puppet runs should start to succeed again.
\n\nYou can also manually trigger puppet runs on the nodes in the correct order (Postgres, PuppetDB, primary Puppet server), which will avoid any failed runs.
\n\nFor this release a major dependency has changed. The module pupppetlabs/postgresql
must now be version 3.x. Upgrading the module should upgrade the puppetlabs/postgresql
module for you, but if another module has a fixed dependency that module will have to be fixed before you can continue.
Some other changes include:
\n\nmanage_redhat_firewall
for the class puppetdb
has now been removed completely in favor of open_postgres_port
and open_ssl_listen_port
.manage_redhat_firewall
for the class puppetdb::database::postgresql
, has now been renamed to manage_firewall
.manage_redhat_firewall
for the class puppetdb::server
has now been removed completely in favor of open_listen_port
and open_ssl_listen_port
.puppetdb::database::postgresql_db
has been removed. If you were using this, it is now defunct.puppetdb::server::firewall
has been marked as private, do not use it directly.puppetdb::server::jetty_ini
and puppetdb::server::database_ini
have been marked as private, do not use it directly.A major dependency has been changed, so now when you upgrade to 2.0 the dependency cprice404/inifile
has been replaced with puppetlabs/inifile
. This may interfer with other modules as they may depend on the old cprice404/inifile
instead, so upgrading should be done with caution. Check that your other modules use the newer puppetlabs/inifile
module as interoperation with the old cprice404/inifile
module will no longer be supported by this module.
Depending on how you install your modules, changing the dependency may require manual intervention. Double check your modules contains the newer puppetlabs/inifile
after installing this latest module.
Otherwise, all existing parameters from 1.x should still work correctly.
\n\nPuppetDB supports a large number of configuration options for both configuring the puppetdb service and connecting that service to the primary Puppet server.
\n\nThe puppetdb
class is intended as a high-level abstraction (sort of an 'all-in-one' class) to help simplify the process of getting your puppetdb server up and running. It wraps the slightly-lower-level classes puppetdb::server
and puppetdb::database::*
, and it'll get you up and running with everything you need (including database setup and management) on the server side. For maximum configurability, you may choose not to use this class. You may prefer to use the puppetdb::server
class directly, or manage your puppetdb setup on your own.
You must declare the class to use it:
\n\nclass { 'puppetdb': }\n
\n\nParameters within puppetdb
:
listen_address
The address that the web server should bind to for HTTP requests (defaults to localhost
.'0.0.0.0' = all).
listen_port
The port on which the puppetdb web server should accept HTTP requests (defaults to '8080').
\n\nopen_listen_port
If true, open the http_listen_port on the firewall (defaults to false).
\n\nssl_listen_address
The address that the web server should bind to for HTTPS requests (defaults to $::clientcert
). Set to '0.0.0.0' to listen on all addresses.
ssl_listen_port
The port on which the puppetdb web server should accept HTTPS requests (defaults to '8081').
\n\ndisable_ssl
If true, the puppetdb web server will only serve HTTP and not HTTPS requests (defaults to false).
\n\nopen_ssl_listen_port
If true, open the ssl_listen_port on the firewall (defaults to true).
\n\ndatabase
Which database backend to use; legal values are postgres
(default) or embedded
. The embedded
db can be used for very small installations or for testing, but is not recommended for use in production environments. For more info, see the puppetdb docs.
database_port
The port that the database server listens on (defaults to 5432
; ignored for embedded
db).
database_username
The name of the database user to connect as (defaults to puppetdb
; ignored for embedded
db).
database_password
The password for the database user (defaults to puppetdb
; ignored for embedded
db).
database_name
The name of the database instance to connect to (defaults to puppetdb
; ignored for embedded
db).
database_ssl
If true, puppetdb will use SSL to connect to the postgres database (defaults to false; ignored for embedded
db).\nSetting up proper trust- and keystores has to be managed outside of the puppetdb module.
node_ttl
The length of time a node can go without receiving any new data before it's automatically deactivated. (defaults to '0', which disables auto-deactivation). This option is supported in PuppetDB >= 1.1.0.
\n\nnode_purge_ttl
The length of time a node can be deactivated before it's deleted from the database. (defaults to '0', which disables purging). This option is supported in PuppetDB >= 1.2.0.
\n\nreport_ttl
The length of time reports should be stored before being deleted. (defaults to '7d', which is a 7-day period). This option is supported in PuppetDB >= 1.1.0.
\n\ngc_interval
This controls how often, in minutes, to compact the database. The compaction process reclaims space and deletes unnecessary rows. If not supplied, the default is every 60 minutes. This option is supported in PuppetDB >= 0.9.
\n\nlog_slow_statements
This sets the number of seconds before an SQL query is considered "slow." Slow SQL queries are logged as warnings, to assist in debugging and tuning. Note PuppetDB does not interrupt slow queries; it simply reports them after they complete.
\n\nThe default value is 10 seconds. A value of 0 will disable logging of slow queries. This option is supported in PuppetDB >= 1.1.
\n\nconn_max_age
The maximum time (in minutes), for a pooled connection to remain unused before it is closed off.
\n\nIf not supplied, we default to 60 minutes. This option is supported in PuppetDB >= 1.1.
\n\nconn_keep_alive
This sets the time (in minutes), for a connection to remain idle before sending a test query to the DB. This is useful to prevent a DB from timing out connections on its end.
\n\nIf not supplied, we default to 45 minutes. This option is supported in PuppetDB >= 1.1.
\n\nconn_lifetime
The maximum time (in minutes) a pooled connection should remain open. Any connections older than this setting will be closed off. Connections currently in use will not be affected until they are returned to the pool.
\n\nIf not supplied, we won't terminate connections based on their age alone. This option is supported in PuppetDB >= 1.4.
\n\npuppetdb_package
The puppetdb package name in the package manager.
\n\npuppetdb_version
The version of the puppetdb
package that should be installed. You may specify an explicit version number, 'present', or 'latest' (defaults to 'present').
puppetdb_service
The name of the puppetdb service.
\n\npuppetdb_service_status
Sets whether the service should be running or stopped. When set to stopped the service doesn't start on boot either. Valid values are 'true', 'running', 'false', and 'stopped'.
\n\nconfdir
The puppetdb configuration directory (defaults to /etc/puppetdb/conf.d
).
java_args
Java VM options used for overriding default Java VM options specified in PuppetDB package (defaults to {}
). See PuppetDB Configuration to get more details about the current defaults.
Example: to set -Xmx512m -Xms256m
options use { '-Xmx' => '512m', '-Xms' => '256m' }
The puppetdb::server
class manages the puppetdb server independently of the underlying database that it depends on. It will manage the puppetdb package, service, config files, etc., but will still allow you to manage the database (e.g. postgresql) however you see fit.
class { 'puppetdb::server':\n database_host => 'puppetdb-postgres',\n}\n
\n\nParameters within puppetdb::server
:
Uses the same parameters as puppetdb
, with one addition:
database_host
The hostname or IP address of the database server (defaults to localhost
; ignored for embedded
db).
The puppetdb::config
class directs your primary Puppet server to use PuppetDB, which means that this class should be used on your primary Puppet server node. It’ll verify that it can successfully communicate with your puppetdb server, and then configure your primary Puppet server to use PuppetDB.
Using this class involves allowing the module to manipulate your puppet configuration files; in particular: puppet.conf and routes.yaml. The puppet.conf changes are supplemental and should not affect any of your existing settings, but the routes.yaml file will be overwritten entirely. If you have an existing routes.yaml file, you will want to take care to use the manage_routes parameter of this class to prevent the module from managing that file, and you’ll need to manage it yourself.
\n\nclass { 'puppetdb::config':\n puppetdb_server => 'my.host.name',\n puppetdb_port => 8081,\n}\n
\n\nParameters within puppetdb::config
:
puppetdb_server
The dns name or ip of the puppetdb server (defaults to the certname of the current node).
\n\npuppetdb_port
The port that the puppetdb server is running on (defaults to 8081).
\n\npuppetdb_soft_write_failure
Boolean to fail in a soft-manner if PuppetDB is not accessable for command submission (defaults to false).
\n\nmanage_routes
If true, the module will overwrite the primary Puppet server's routes file to configure it to use PuppetDB (defaults to true).
\n\nmanage_storeconfigs
If true, the module will manage the primary Puppet server's storeconfig settings (defaults to true).
\n\nmanage_report_processor
If true, the module will manage the 'reports' field in the puppet.conf file to enable or disable the puppetdb report processor. Defaults to 'false'.
\n\nmanage_config
If true, the module will store values from puppetdb_server and puppetdb_port parameters in the puppetdb configuration file.\nIf false, an existing puppetdb configuration file will be used to retrieve server and port values.
\n\nstrict_validation
If true, the module will fail if puppetdb is not reachable, otherwise it will preconfigure puppetdb without checking.
\n\nenable_reports
Ignored unless manage_report_processor
is true
, in which case this setting will determine whether or not the puppetdb report processor is enabled (true
) or disabled (false
) in the puppet.conf file.
puppet_confdir
Puppet's config directory (defaults to /etc/puppet
).
puppet_conf
Puppet's config file (defaults to /etc/puppet/puppet.conf
).
puppetdb_version
The version of the puppetdb
package that should be installed. You may specify an explicit version number, 'present', or 'latest' (defaults to 'present').
terminus_package
Name of the package to use that represents the PuppetDB terminus code.
\n\npuppet_service_name
Name of the service that represents Puppet. You can change this to apache2
or httpd
depending on your operating system, if you plan on having Puppet run using Apache/Passenger for example.
puppetdb_startup_timeout
The maximum amount of time that the module should wait for PuppetDB to start up. This is most important during the initial install of PuppetDB (defaults to 15 seconds).
\n\nrestart_puppet
If true, the module will restart the primary Puppet server when PuppetDB configuration files are changed by the module. The default is 'true'. If set to 'false', you must restart the service manually in order to pick up changes to the config files (other than puppet.conf
).
The puppetdb::database::postgresql
class manages a postgresql server for use by PuppetDB. It can manage the postgresql packages and service, as well as creating and managing the puppetdb database and database user accounts.
class { 'puppetdb::database::postgresql':\n listen_addresses => 'my.postgres.host.name',\n}\n
\n\nlisten_addresses
The listen_address
is a comma-separated list of hostnames or IP addresses on which the postgres server should listen for incoming connections. This defaults to localhost
. This parameter maps directly to postgresql's listen_addresses
config option; use a *
to allow connections on any accessible address.
manage_firewall
If set to true
this will enable open the local firewall for PostgreSQL protocol access. Defaults to false
.
database_name
Sets the name of the database. Defaults to puppetdb
.
database_username
Creates a user for access the database. Defaults to puppetdb
.
database_password
Sets the password for the database user above. Defaults to puppetdb
.
In addition to the classes and variables mentioned above, PuppetDB includes:
\n\npuppetdb::routes
\n\nConfigures the primary Puppet server to use PuppetDB as the facts terminus. WARNING: the current implementation simply overwrites your routes.yaml file; if you have an existing routes.yaml file that you are using for other purposes, you should not use this.
\n\nclass { 'puppetdb::routes':\n puppet_confdir => '/etc/puppet'\n}\n
\n\npuppetdb::storeconfigs
\n\nConfigures the primary Puppet server to enable storeconfigs and to use PuppetDB as the storeconfigs backend.
\n\nclass { 'puppetdb::storeconfigs':\n puppet_conf => '/etc/puppet/puppet.conf'\n}\n
\n\npuppetdb::server::validate_db
\n\nValidates that a successful database connection can be established between the node on which this resource is run and the specified puppetdb database instance (host/port/user/password/database name).
\n\npuppetdb::server::validate_db { 'validate my puppetdb database connection':\n database_host => 'my.postgres.host',\n database_username => 'mydbuser',\n database_password => 'mydbpassword',\n database_name => 'mydbname',\n}\n
\n\npuppetdb_conn_validator
\n\nVerifies that a connection can be successfully established between a node and the puppetdb server. Its primary use is as a precondition to prevent configuration changes from being applied if the puppetdb server cannot be reached, but it could potentially be used for other purposes such as monitoring.
\n\nCurrently, PuppetDB is compatible with:
\n\nPuppet Version: 2.7+\n
\n\nPlatforms:
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n## puppetlabs-puppetdb changelog\n\nRelease notes for the puppetlabs-puppetdb module.\n\n------------------------------------------\n\n#### 3.0.0 - 2013/10/27\n\nThis major release changes the main dependency for the postgresql module from\nversion 2.5.x to 3.x. Since the postgresql module is not backwards compatible,\nthis release is also not backwards compatible. As a consequence we have taken\nsome steps to deprecate some of the older functionality:\n\n* The parameter manage_redhat_firewall for the class puppetdb has now been removed completely in favor of open_postgres_port and open_ssl_listen_port.\n* The parameter manage_redhat_firewall for the class puppetdb::database::postgresql, has now been renamed to manage_firewall.\n* The parameter manage_redhat_firewall for the class puppetdb::server has now been removed completely in favor of open_listen_port and open_ssl_listen_port.\n* The internal class: puppetdb::database::postgresql_db has been removed. If you were using this, it is now defunct.\n* The class puppetdb::server::firewall has been marked as private, do not use it directly.\n* The class puppetdb::server::jetty_ini and puppetdb::server::database_ini have been marked as private, do not use it directly.\n\nAll of this is documented in the upgrade portion of the README.\n\nAdditionally some features have been included in this release as well:\n\n* soft_write_failure can now be enabled in your puppetdb.conf with this\n module to handle failing silently when your PuppetDB is not available\n during writes.\n* There is a new switch to enable SSL connectivity to PostgreSQL. While this\n functionality is only in its infancy this is a good start.\n\nDetailed Changes:\n\n* FM-103: Add metadata.json to all modules. (Ashley Penney)\n* Add soft_write_failure to puppetdb.conf (Garrett Honeycutt)\n* Add switch to configure database SSL connection (Stefan Dietrich)\n* (GH-91) Update to use rspec-system-puppet 2.x (Ken Barber)\n* (GH-93) Switch to using puppetlabs-postgresql 3.x (Ken Barber)\n* Fix copyright and project notice (Ken Barber)\n* Adjust memory for PuppetDB tests to avoid OOM killer (Ken Barber)\n* Ensure ntpdate executes early during testing (Ken Barber)\n\n------------------------------------------\n\n#### 2.0.0 - 2013/10/04\n\nThis major release changes the main dependency for the inifile module from\nthe deprecated `cprice404/inifile` to `puppetlabs/inifile` to remove\ndeprecation warnings and to move onto the latest and greatest implementation\nof that code.\n\nIts a major release, because it may affect other dependencies since modules\ncannot have overlapping second part dependencies (that is inifile cannot be from\ntwo different locations).\n\nIt also adds the parameter `puppetdb_service_status` to the class `puppetdb` to\nallow users to specify whether the module manages the puppetdb service for you.\n\nThe `database_password` parameter is now optional, and initial Arch Linux\nsupport has been added.\n\nDetailed Changes:\n\n* (GH-73) Switch to puppetlabs/inifile from cprice/inifile (Ken Barber)\n* Make database_password an optional parameter (Nick Lewis)\n* add archlinux support (Niels Abspoel)\n* Added puppetdb service control (Akos Hencz)\n\n------------------------------------------\n\n#### 1.6.0 - 2013/08/07\n\nThis minor feature release provides extra parameters for new configuration\nitems available in PuppetDB 1.4, and also provides some older parameters\nthat were missed previously:\n\n* gc_interval\n* log_slow_statements\n* conn_max_age\n* conn_keep_alive\n* conn_lifetime\n\nConsult the README.md file, or the PuppetDB documentation for more details.\n\n------------------------------------------\n\n#### 1.5.0 - 2013/07/18\n\nThis minor feature release provides the following new functionality:\n\n* The module is now capable of managing PuppetDB on SUSE systems\n for which PuppetDB packages are available\n* The ruby code for validating the PuppetDB connection now\n supports validating on a non-SSL HTTP port.\n\n------------------------------------------\n\n#### 1.4.0 - 2013/05/13\n\nThis feature release provides support for managing the puppetdb report\nprocessor on your primary Puppet server.\n\nTo enable the report processor, you can do something like this:\n\n class { 'puppetdb::config':\n manage_report_processor => true,\n enable_reports => true\n }\n\nThis will add the 'puppetdb' report processor to the list of `reports`\ninside your primary Puppet server's `puppet.conf` file.\n\n------------------------------------------\n\n#### 1.3.0 - 2013/05/13\n\nThis feature release provides us with a few new features for the PuppetDB\nmodule.\n\nYou can now disable SSL when using the `puppetdb` class by using the new\nparameter `disable_ssl`:\n\n class { 'puppetdb':\n disable_ssl => true,\n }\n\nThis will remove the SSL settings from your `jetty.ini` configuration file\ndisabling any SSL communication. This is useful when you want to offload SSL\nto another web server, such as Apache or Nginx.\n\nWe have now added an option `java_args` for passing in Java options to\nPuppetDB. The format is a hash that is passed in when declaring the use of the\n`puppetdb` class:\n\n class { 'puppetdb':\n java_args => {\n '-Xmx' => '512m',\n '-Xms' => '256m',\n }\n }\n\nAlso, the default `report-ttl` was set to `14d` in PuppetDB to align it with an\nupcoming PE release, so we've also reflected that default here now.\n\nAnd finally we've fixed the issue whereby the options `report_ttl`, `node_ttl`,\n`node_purge_ttl` and `gc_interval` were not making the correct changes. On top\nof that you can now set these values to zero in the module, and the correct\ntime modifier (`s`, `m`, `h` etc.) will automatically get applied for you.\n\nBehind the scenes we've also added system and unit testing, which was\npreviously non-existent. This should help us reduce regression going forward.\n\nThanks to all the contributing developers in the list below that made this\nrelease possible :-).\n\n#### Changes\n\n* Allows for 0 _ttl's without time signifier and enables tests (Garrett Honeycutt)\n* Add option to disable SSL in Jetty, including tests and documentation (Christian Berg)\n* Cleaned up ghoneycutt's code a tad (Ken Barber)\n* the new settings report_ttl, node_ttl and node_purge_ttl were added but they are not working, this fixes it (fsalum)\n* Also fix gc_interval (Ken Barber)\n* Support for remote puppetdb (Filip Hrbek)\n* Added support for Java VM options (Karel Brezina)\n* Add initial rspec-system tests and scaffolding (Ken Barber)\n\n------------------------------------------\n\n#### 1.2.1 - 2013/04/08\n\nThis is a minor bugfix that solves the PuppetDB startup exception:\n\n java.lang.AssertionError: Assert failed: (string? s)\n\nThis was due to the default `node-ttl` and `node-purge-ttl` settings not having a time suffix by default. These settings required 's', 'm', 'd' etc. to be suffixed, even if they are zero.\n\n#### Changes\n\n* (Ken Barber) Add 's' suffix to period settings to avoid exceptions in PuppetDB\n\n------------------------------------------\n\n#### 1.2.0 - 2013/04/05\n\nThis release is primarily about providing full configuration file support in the module for PuppetDB 1.2.0. (The alignment of version is a coincidence I assure you :-).\n\nThis feature release adds the following new configuration parameters to the main `puppetdb` class:\n\n* node_ttl\n* node_purge_ttl (available in >=1.2.0)\n* report_ttl\n\nConsult the README for futher details about these new configurable items.\n\n##### Changes\n\n* (Nick Lewis) Add params and ini settings for node/purge/report ttls and document them\n\n------------------------------------------\n\n1.1.5\n=====\n\n2013-02-13 - Karel Brezina\n * Fix database creation so database_username, database_password and\n database_name are correctly passed during database creation.\n\n2013-01-29 - Lauren Rother\n * Change README to conform to new style and various other README improvements\n\n2013-01-17 - Chris Price\n * Improve documentation in init.pp\n\n------------------------------------------\n\n1.1.4\n=====\n\nThis is a bugfix release, mostly around fixing backward-compatibility for the\ndeprecated `manage_redhat_firewall` parameter. It wasn't actually entirely\nbackwards-compatible in the 1.1.3 release.\n\n2013-01-17 - Chris Price <chris@puppetlabs.com>\n * Fix backward compatibility of `manage_redhat_firewall` parameter (de20b44)\n\n2013-01-16 - Chris Price <chris@puppetlabs.com>\n * Fix deprecation warnings around manage_redhat_firewall (448f8bc)\n\n------------------------------------------\n\n1.1.3\n=====\n\nThis is mostly a maintenance release, to update the module dependencies to newer\nversions in preparation for some new features. This release does include some nice\nadditions around the ability to set the listen address for the HTTP port on Jetty\nand manage the firewall for that port. Thanks very much to Drew Blessing for those\nsubmissions!\n\n2013-01-15 - Chris Price <chris@puppetlabs.com>\n * Update Modulefile for 1.1.3 release (updates dependencies\n on postgres and inifile modules to the latest versions) (76bfd9e)\n\n2012-12-19 - Garrett Honeycutt <garrett@puppetlabs.com>\n * (#18228) updates README for style (fd2e990)\n\n2012-11-29 - Drew Blessing <Drew.Blessing@Buckle.com>\n * 17594 - Fixes suggested by cprice-puppet (0cf9632)\n\n2012-11-14 - Drew Blessing <Drew.Blessing@Buckle.com>\n * Adjust examples in tests to include new port params (0afc276)\n\n2012-11-13 - Drew Blessing <Drew.Blessing@Buckle.com>\n * 17594 - PuppetDB - Add ability to set standard host listen address and open firewall\n\n------------------------------------------\n\n1.1.2\n=====\n\n2012-10-26 - Chris Price <chris@puppetlabs.com> (1.1.2)\n * 1.1.2 release\n\n2012-10-26 - Chris Price <chris@puppetlabs.com>\n * Add some more missing `inherit`s for `puppetdb::params` (a72cc7c)\n\n2012-10-26 - Chris Price <chris@puppetlabs.com> (1.1.2)\n * 1.1.1 release\n\n2012-10-26 - Chris Price <chris@puppetlabs.com> (1.1.1)\n * Add missing `inherit` for `puppetdb::params` (ea9b379)\n\n2012-10-24 - Chris Price <chris@puppetlabs.com>\n * 1.1.0 release\n\n2012-10-24 - Chris Price <chris@puppetlabs.com> (1.1.0)\n * Update postgres dependency to puppetlabs/postgresql (bea79b4)\n\n2012-10-17 - Reid Vandewiele <reid@puppetlabs.com> (1.1.0)\n * Fix embedded db setup in Puppet Enterprise (bf0ab45)\n\n2012-10-17 - Chris Price <chris@puppetlabs.com> (1.1.0)\n * Update manifests/main/config.pp (b119a30)\n\n2012-10-16 - Chris Price <chris@puppetlabs.com> (1.1.0)\n * Make puppetdb startup timeout configurable (783b595)\n\n2012-10-01 - Hunter Haugen <h.haugen@gmail.com> (1.1.0)\n * Add condition to detect PE installations and provide different parameters (63f1c52)\n\n2012-10-01 - Hunter Haugen <h.haugen@gmail.com> (1.1.0)\n * Add example manifest code for pe primary Puppet server (a598edc)\n\n2012-10-01 - Chris Price <chris@puppetlabs.com> (1.1.0)\n * Update comments and docs w/rt PE params (b5df5d9)\n\n2012-10-01 - Hunter Haugen <h.haugen@gmail.com> (1.1.0)\n * Adding pe_puppetdb tests class (850e039)\n\n2012-09-28 - Hunter Haugen <h.haugen@gmail.com> (1.1.0)\n * Add parameters to enable usage of enterprise versions of PuppetDB (df6f7cc)\n\n2012-09-23 - Chris Price <chris@puppetlabs.com>\n * 1.0.3 release\n\n2012-09-23 - Chris Price <chris@puppetlabs.com>\n * Add a parameter for restarting primary Puppet server (179b337)\n\n2012-09-21 - Chris Price <chris@puppetlabs.com>\n * 1.0.2 release\n\n2012-09-21 - Chris Price <chris@puppetlabs.com>\n * Pass 'manage_redhat_firewall' param through to postgres (f21740b)\n\n2012-09-20 - Chris Price <chris@puppetlabs.com>\n * 1.0.1 release\n\n2012-09-20 - Garrett Honeycutt <garrett@puppetlabs.com>\n * complies with style guide (1aab5d9)\n\n2012-09-19 - Chris Price <chris@puppetlabs.com>\n * Fix invalid subname in database.ini (be683b7)\n\n2011-09-18 Chris Price <chris@puppetlabs.com> - 1.0.0\n* Initial 1.0.0 release\n
\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n
This module manages Ruby and Rubygems on Debian and Redhat based systems.
\n\nversion: (default installed) -\nSet the version of Ruby to install
gems_version: (default installed) -\nSet the version of Rubygems to be installed
rubygems_update: (default true) -\nIf set to true, the module will ensure that the rubygems package is installed\nbut will use rubygems-update (same as gem update --system but versionable) to\nupdate Rubygems to the version defined in $gems_version. If set to false then\nthe rubygems package resource will be versioned from $gems_version
ruby_package: (default ruby) -\nSet the package name for ruby
rubygems_package: (default rubygems) -\nSet the package name for rubygems
For a standard install using the latest Rubygems provided by rubygems-update on\nCentOS or Redhat use:
\n\nclass { 'ruby':\n gems_version => 'latest'\n}\n
\n\nOn Redhat this is equivilant to
\n\n$ yum install ruby rubygems\n$ gem update --system\n
\n\nTo install a specific version of ruby and rubygems but not use\nrubygems-update use:
\n\nclass { 'ruby':\n version => '1.8.7',\n gems_version => '1.8.24',\n rubygems_update => false\n}\n
\n\nOn Redhat this is equivilant to
\n\n$ yum install ruby-1.8.7 rubygems-1.8.24\n
\n\nIf you need to use different packages for either ruby or rubygems you\ncan. This could be for different versions or custom packages. For\ninstance the following installs ruby 1.9 on Ubuntu 12.04.
\n\nclass { 'ruby':\n ruby_package => 'ruby1.9.1-full',\n rubygems_package => 'rubygems1.9.1',\n gems_version => 'latest',\n}\n
\n2013-10-08 - Version 0.1.0\n\nSummary:\n\nRelease an updated version of this. Highlights include OpenSUSE and general\nspring cleaning done by our wonderful community members!\n\nFeatures:\n- OpenSUSE support\n- Allow `rubygems_package` override.\n- Add gemhome fact.\n- Add ri package.\n\nFixes:\n- Lint fixes.\n- Remove virtual irb package.\n- Update dev packages for Ubuntu/Debian\n
Copyright (C) 2012 Puppet Labs Inc\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
Install nodejs package and npm package provider for Debian, Ubuntu, Fedora, and RedHat.
\n\nInstalls nodejs and npm per nodejs documentation.
\n\nExample:
\n\ninclude nodejs\n
\n\nYou may want to use apt::pin to pin package installation priority on sqeeze. See puppetlabs-apt for more information.
\n\napt::pin { 'sid': priority => 100 }\n
\n\nTwo types of npm packages are supported.
\n\nFor more information regarding global vs. local installation see nodejs blog
\n\nnpm package provider is an extension of puppet package type which supports versionable and upgradeable. The package provider only handles global installation:
\n\nExample:
\n\npackage { 'express':\n ensure => latest,\n provider => 'npm',\n}\n\npackage { 'mime':\n ensure => '1.2.4',\n provider => 'npm',\n}\n
\n\nnodejs::npm is suitable for local installation of npm packages:
\n\nnodejs::npm { '/opt/razor:express':\n ensure => present,\n version => '2.5.9',\n}\n
\n\nnodejs::npm title consists of filepath and package name seperate via ':', and support the following attributes:
\n\nThe module have been tested on the following operating systems. Testing and patches for other platforms are welcomed.
\n\nCopyright (C) 2012 Puppet Labs Inc\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
Manage the Java runtime for use with other application software.
\n\nCurrently this deploys the correct Java package on a variety of platforms.
\n1.0.1 (2013-08-01)\n\nMatthaus Owens <matthaus@puppetlabs.com>\n* Update java packages for Fedora systems\n\n1.0.0 (2013-07-29)\n\nKrzysztof SuszyÅski <krzysztof.suszynski@coi.gov.pl>\n* Adding support for Oracle Enterprise Linux\n\nPeter Drake <pdrake@allplayers.com>\n* Add support for natty\n\nRobert Munteanu <rmuntean@adobe.com>\n* Add support for OpenSUSE\n\nMartin Jackson <martin@uncommonsense-uk.com>\n* Added support Amazon Linux using facter >= 1.7.x\n\nGareth Rushgrove <gareth@morethanseven.net>\nBrett Porter <brett@apache.org>\n* Fixes for older versions of CentOS\n* Improvements to module build and tests\n\nNathan R Valentine <nrvale0@gmail.com>\n* Add support for Ubuntu quantal and raring\n\nSharif Nassar <sharif@mediatemple.net>\n* Add support for Debian alternatives, and more than one JDK/JRE per platform.\n\n2013-04-04 Reid Vandewiele <reid@puppetlabs.com> - 0.3.0\n* Refactor, introduce params pattern\n\n2012-11-15 Scott Schneider <sschneider@puppetlabs.com> - 0.2.0\n* Add Solaris support\n\n2011-06-16 Jeff McCune <jeff@puppetlabs.com> - 0.1.5\n* Add Debian based distro (Lucid) support\n\n2011-06-02 Jeff McCune <jeff@puppetlabs.com> - 0.1.4\n* Fix class composition ordering problems\n\n2011-05-28 Jeff McCune <jeff@puppetlabs.com> - 0.1.3\n* Remove stages\n\n2011-05-26 Jeff McCune <jeff@puppetlabs.com> - 0.1.2\n* Changes JRE/JDK selection class parameter to $distribution\n\n2011-05-25 Jeff McCune <jeff@puppetlabs.com> - 0.1.1\n* Re-did versioning to follow semantic versioning\n\n2011-05-25 Jeff McCune <jeff@puppetlabs.com> - 1.0.1\n* Add validation of class parameters\n\n2011-05-24 Jeff McCune <jeff@puppetlabs.com> - 1.0.0\n* Default to JDK version 6u25\n\n2011-05-24 Jeff McCune <jeff@puppetlabs.com> - 0.0.1\n* Initial release\n
Puppet Java Module - Puppet module for managing Java\n\nCopyright (C) 2011 Puppet Labs Inc\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
Installs MongoDB on RHEL/Ubuntu/Debian from OS repo, or alternatively from\n10gen repository installation documentation.
\n\nThis release is a major refactoring of the module which means that the API may\nhave changed in backwards incompatible ways. If your project depends on the old API, \nplease pin your dependencies to 0.3 version to ensure your environments don't break.
\n\nThe current module design is undergoing review for potential 1.0 release. We welcome\nany feedback with regard to the APIs and patterns used in this release.
\n\nThe MongoDB module manages mongod server installation and configuration of the mongod daemon. For the time being it supports only a single\nMongoDB server instance, without sharding and limited replica set \nfunctionality (you can define the replica set parameter in the config file, however\nrs.initiate() has to be done manually).
\n\nIf you just want a server installation with the default options you can run\ninclude '::mongodb:server'
. If you need to customize configuration\noptions you need to do the following:
class {'::mongodb::server':\n port => 27018,\n verbose => true,\n}\n
\n\nAlthough most distro comes with a prepacked MongoDB server we recommend to\nuse the 10gen/MongoDB software repository, because most of the current OS\npackages are outdated and not appropriate for a production environment.\nTo install MongoDB from 10gen repository:
\n\nclass {'::mongodb::globals':\n manage_package_repo => true,\n}->\nclass {'::mongodb::server': }\n
\n\nMost of the interaction for the server is done via mongodb::server
. For\nmore options please have a look at monogbd::server.\nAlso in this version we introduced mongodb::globals
, which is meant more\nfor future implementation, where you can configure the main settings for\nthis module in a global way, to be used by other classes and defined resources. \nOn its own it does nothing.
mongodb::server
: Installs and configure MongoDBmongodb::globals
: Configure main settings on a global waymongodb::repo
: Manage 10gen/MongoDB software repositorymongodb::repo::apt
: Manage Debian/Ubuntu apt 10gen/MongoDB repositorymongodb::repo::yum
: Manage Redhat/CentOS apt 10gen/MongoDB repositorymongodb::server::config
: Configures MongoDB configuration filesmongodb::server::install
: Install MongoDB software packagesmongodb::server::service
: Manages serviceNote: most server specific defaults should be overridden in the mongodb::server
\nclass. This class should only be used if you are using a non-standard OS or\nif you are changing elements such as version
or manage_package_repo
that\ncan only be changed here.
This class allows you to configure the main settings for this module in a\nglobal way, to be used by the other classes and defined resources. On its\nown it does nothing.
\n\nserver_package_name
This setting can be used to override the default MongoDB server package\nname. If not specified, the module will use whatever package name is the\ndefault for your OS distro.
\n\nservice_name
This setting can be used to override the default MongoDB service name. If not\nspecified, the module will use whatever service name is the default for your OS distro.
\n\nservice_provider
This setting can be used to override the default MongoDB service provider. If\nnot specified, the module will use whatever service provider is the default for\nyour OS distro.
\n\nservice_status
This setting can be used to override the default status check command for\nyour MongoDB service. If not specified, the module will use whatever service\nname is the default for your OS distro.
\n\nuser
This setting can be used to override the default MongoDB user and owner of the\nservice and related files in the file system. If not specified, the module will\nuse the default for your OS distro.
\n\ngroup
This setting can be used to override the default MongoDB user group to be used\nfor related files in the file system. If not specified, the module will use\nthe default for your OS distro.
\n\nbind_ip
This setting can be used to configure MonogDB process to bind to and listen\nfor connections from applications on this address. If not specified, the\nmodule will use the default for your OS distro.\nNote: This value should be passed an an array.
\n\nversion
The version of MonogDB to install/manage. This is a simple way of providing\na specific version such as '2.2' or '2.4' for example. If not specified,\nthe module will use the default for your OS distro.
\n\nMost of the parameters manipulates the mongod.conf file.
\n\nFor more details about configuration parameters consult the MongoDB Configuration File Options.
\n\nensure
enable or disable the service
\n\nconfig
Path of the config file. If not specified, the module will use the default\nfor your OS distro.
\n\ndbpath
Set this value to designate a directory for the mongod instance to store\nit's data. If not specified, the module will use the default for your OS distro.
\n\npidfilepath
Specify a file location to hold the PID or process ID of the mongod process.\nIf not specified, the module will use the default for your OS distro.
\n\nlogpath
Specify the path to a file name for the log file that will hold all diagnostic\nlogging information. Unless specified, mongod will output all log information\nto the standard output.
\n\nbind_ip
Set this option to configure the mongod or mongos process to bind to and listen\nfor connections from applications on this address. If not specified, the module\nwill use the default for your OS distro. Example: bind_ip=['127.0.0.1', '192.168.0.3']\nNote: bind_ip accept array as a value.
\n\nlogappend
Set to true to add new entries to the end of the logfile rather than overwriting\nthe content of the log when the process restarts. Default: True
\n\nfork
Set to true to enable database authentication for users connecting from remote\nhosts. If not specified, the module will use the default for your OS distro.
\n\nport
Specifies a TCP port for the server instance to listen for client connections. \nDefault: 27017
\n\njournal
Set to true to enable operation journaling to ensure write durability and\ndata consistency. Default: on 64-bit systems true and on 32-bit systems false
\n\nnojournal
Set nojournal = true to disable durability journaling. By default, mongod\nenables journaling in 64-bit versions after v2.0. \nDefault: on 64-bit systems false and on 32-bit systems true
\n\nNote: You must use journal to enable journaling on 32-bit systems.
\n\nsmallfiles
Set to true to modify MongoDB to use a smaller default data file size. \nSpecifically, smallfiles reduces the initial size for data files and\nlimits them to 512 megabytes. Default: false
\n\ncpu
Set to true to force mongod to report every four seconds CPU utilization\nand the amount of time that the processor waits for I/O operations to\ncomplete (i.e. I/O wait.) Default: false
\n\nauth
Set to true to enable database authentication for users connecting from\nremote hosts. If no users exist, the localhost interface will continue\nto have access to the database until you create the first user. \nDefault: false
\n\nnoauth
Disable authentication. Currently the default. Exists for future compatibility\n and clarity.
\n\nverbose
Increases the amount of internal reporting returned on standard output or in\nthe log file generated by logpath
. Default: false
verbositylevel
MongoDB has the following levels of verbosity: v, vv, vvv, vvvv and vvvvv.\nDefault: None
\n\nobjcheck
Forces the mongod to validate all requests from clients upon receipt to ensure\nthat clients never insert invalid documents into the database. \nDefault: on v2.4 default to true and on earlier version to false
\n\nquota
Set to true to enable a maximum limit for the number data files each database\ncan have. The default quota is 8 data files, when quota is true. Default: false
\n\nquotafiles
Modify limit on the number of data files per database. This option requires the\nquota
setting. Default: 8
diaglog
Creates a very verbose diagnostic log for troubleshooting and recording various\nerrors. Valid values: 0, 1, 2, 3 and 7. \nFor more information please refer to MongoDB Configuration File Options.
\n\ndirectoryperdb
Set to true to modify the storage pattern of the data directory to store each\ndatabase’s files in a distinct folder. Default: false
\n\nprofile
Modify this value to changes the level of database profiling, which inserts\ninformation about operation performance into output of mongod or the\nlog file if specified by logpath
.
maxconns
Specifies a value to set the maximum number of simultaneous connections\nthat MongoDB will accept. Default: depends on system (i.e. ulimit and file descriptor)\nlimits. Unless set, MongoDB will not limit its own connections.
\n\noplog_size
Specifies a maximum size in megabytes for the replication operation log \n(e.g. oplog.) mongod creates an oplog based on the maximum amount of space\navailable. For 64-bit systems, the oplog is typically 5% of available disk space.
\n\nnohints
Ignore query hints. Default: None
\n\nnohttpinterface
Set to true to disable the HTTP interface. This command will override the rest\nand disable the HTTP interface if you specify both. Default: false
\n\nnoscripting
Set noscripting = true to disable the scripting engine. Default: false
\n\nnotablescan
Set notablescan = true to forbid operations that require a table scan. Default: false
\n\nnoprealloc
Set noprealloc = true to disable the preallocation of data files. This will shorten\nthe start up time in some cases, but can cause significant performance penalties\nduring normal operations. Default: false
\n\nnssize
Use this setting to control the default size for all newly created namespace f\niles (i.e .ns). Default: 16
\n\nmms_token
MMS token for mms monitoring. Default: None
\n\nmms_name
MMS identifier for mms monitoring. Default: None
\n\nmms_interval
MMS interval for mms monitoring. Default: None
\n\nreplset
Use this setting to configure replication with replica sets. Specify a replica\nset name as an argument to this set. All hosts must have the same set name.
\n\nrest
Set to true to enable a simple REST interface. Default: false
\n\nslowms
Sets the threshold for mongod to consider a query “slow” for the database profiler. \nDefault: 100 ms
\n\nkeyfile
Specify the path to a key file to store authentication information. This option \nis only useful for the connection between replica set members. Default: None
\n\nprimary Puppet server
Set to true to configure the current instance to act as primary Puppet server instance in a\nreplication configuration. Default: False Note: deprecated – use replica sets
\n\nreplica
Set to true to configure the current instance to act as replica instance in a\nreplication configuration. Default: false\nNote: deprecated – use replica sets
\n\nonly
Used with the replica option, only specifies only a single database to\nreplicate. Default: <> \nNote: deprecated – use replica sets
\n\nsource
Used with the replica setting to specify the primary Puppet server instance from which\nthis replica instance will replicate. Default: <> \nNote: deprecated – use replica sets
\n\nThis module has been tested on:
\n\nFor a for list of tested OS please have a look at the .nodeset.xml definition.
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community\ncontributions are essential for keeping them great. We can’t access the\nhuge number of platforms and myriad of hardware, software, and deployment\nconfigurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our\nmodules work in your environment. There are a few guidelines that we need\ncontributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n\nThere are two types of tests distributed with this module. Unit tests with\nrspec-puppet and system tests using rspec-system.
\n\nunit tests should be run under Bundler with the gem versions as specified\nin the Gemfile. To install the necessary gems:
\n\nbundle install --path=vendor\n
\n\nTest setup and teardown is handled with rake tasks, so the\nsupported way of running tests is with
\n\nbundle exec rake spec\n
\n\nFor system test you will also need to install vagrant > 1.3.x and virtualbox > 4.2.10.\nTo run the system tests
\n\nbundle exec rake spec:system\n
\n\nTo run the tests on different operating systems, see the sets available in .nodeset.xml\nand run the specific set with the following syntax:
\n\nRSPEC_SET=ubuntu-server-12042-x64 bundle exec rake spec:system\n
\n\nWe would like to thank everyone who has contributed issues and pull requests to this modules.\nA complete list of contributors can be found on the \nGitHub Contributor Graph\nfor the puppetlabs-mongodb module.
\n2013-10-31 - Version 0.3.0\n\nSummary:\n\nAdds a number of parameters and fixes some platform\nspecific bugs in module deployment.\n\n2013-09-25 - Version 0.2.0\n\nSummary:\n\nThis release fixes a duplicate parameter.\n\nFixes:\n- Fix a duplicated parameter.\n\n2012-07-13 Puppet Labs <info@puppetlabs.com> - 0.1.0\n* Add support for RHEL/CentOS\n* Change default mongodb install location to OS repo\n\n2012-05-29 Puppet Labs <info@puppetlabs.com> - 0.0.2\n* Fix Modulefile typo.\n* Remove repo pin.\n* Update spec tests and add travis support.\n\n2012-05-03 Puppet Labs <info@puppetlabs.com> - 0.0.1\n* Initial Release.\n
Copyright (C) 2012 Puppet Labs Inc\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n
2013-08-14 - Release 0.1.0\n\nFeatures:\n- Support osfamily instead of using `$operatingsystem`. Note that\nAmazon Linux is RedHat osfamily on facter version 1.7\n\n2011-06-03 - Dan Bode <dan@puppetlabs.com> - 0.0.3\n* committed source to git\n* added tests\n
Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n
This module manages RabbitMQ (www.rabbitmq.com)
\n\nThe rabbitmq module sets up rabbitmq and has a number of providers to manage\neverything from vhosts to exchanges after setup.
\n\nThis module has been tested against 2.7.1 and is known to not support\nall features against earlier versions.
\n\ninclude '::rabbitmq'\n
\n\nAll options and configuration can be done through interacting with the parameters\non the main rabbitmq class. These are documented below.
\n\nTo begin with the rabbitmq class controls the installation of rabbitmq. In here\nyou can control many parameters relating to the package and service, such as\ndisabling puppet support of the service:
\n\nclass { '::rabbitmq':\n service_manage => false\n port => '5672',\n delete_guest_user => true,\n}\n
\n\nTo use RabbitMQ Environment Variables, use the parameters environment_variables
e.g.:
class { 'rabbitmq':\n port => '5672',\n environment_variables => {\n 'RABBITMQ_NODENAME' => 'node01',\n 'RABBITMQ_SERVICENAME' => 'RabbitMQ'\n }\n}\n
\n\nTo change RabbitMQ Config Variables in rabbitmq.config, use the parameters config_variables
e.g.:
class { 'rabbitmq':\n port => '5672',\n config_variables => {\n 'hipe_compile' => true,\n 'frame_max' => 131072,\n 'log_levels' => "[{connection, info}]"\n }\n}\n
\n\nTo use RabbitMQ clustering and H/A facilities, use the rabbitmq::server\nparameters config_cluster
, cluster_nodes
, and cluster_node_type
, e.g.:
class { 'rabbitmq':\n config_cluster => true, \n cluster_nodes => ['rabbit1', 'rabbit2'],\n cluster_node_type => 'ram',\n}\n
\n\nNOTE: You still need to use x-ha-policy: all
in your client \napplications for any particular queue to take advantage of H/A.
You should set the 'config_mirrored_queues' parameter if you plan\non using RabbitMQ Mirrored Queues within your cluster:
\n\nclass { 'rabbitmq':\n config_cluster => true,\n config_mirrored_queues => true,\n cluster_nodes => ['rabbit1', 'rabbit2'],\n}\n
\n\nadmin_enable
If enabled sets up the management interface/plugin for RabbitMQ.
\n\ncluster_disk_nodes
DEPRECATED AND REPLACED BY CLUSTER_NODES.
\n\ncluster_node_type
Choose between disk and ram nodes.
\n\ncluster_nodes
An array of nodes for clustering.
\n\nconfig
The file to use as the rabbitmq.config template.
\n\nconfig_cluster
Boolean to enable or disable clustering support.
\n\nconfig_mirrored_queues
Boolean to enable or disable mirrored queues.
\n\nconfig_path
The path to write the RabbitMQ configuration file to.
\n\nconfig_stomp
Boolean to enable or disable stomp.
\n\ndelete_guest_user
Boolean to decide if we should delete the default guest user.
\n\nenv_config
The template file to use for rabbitmq_env.config.
\n\nenv_config_path
The path to write the rabbitmq_env.config file to.
\n\nerlang_cookie
The erlang cookie to use for clustering - must be the same between all nodes.
\n\nerlang_enable
If true then we include an erlang module.
\n\nconfig_variables
To set config variables in rabbitmq.config
\n\nnode_ip_address
The value of RABBITMQ_NODE_IP_ADDRESS in rabbitmq_env.config
\n\nenvironment_variables
RabbitMQ Environment Variables in rabbitmq_env.config
\n\npackage_ensure
Determines the ensure state of the package. Set to installed by default, but could\nbe changed to latest.
\n\npackage_name
The name of the package to install.
\n\npackage_provider
What provider to use to install the package.
\n\npackage_source
Where should the package be installed from?
\n\nplugin_dir
Location of RabbitMQ plugins.
\n\nport
The RabbitMQ port.
\n\nmanagement_port
The port for the RabbitMQ management interface.
\n\nservice_ensure
The state of the service.
\n\nservice_manage
Determines if the service is managed.
\n\nservice_name
The name of the service to manage.
\n\nstomp_port
The port to use for Stomp.
\n\nwipe_db_on_cookie_change
Boolean to determine if we should DESTROY AND DELETE the RabbitMQ database.
\n\nversion
Sets the version to install.
\n\nquery all current users: $ puppet resource rabbitmq_user
rabbitmq_user { 'dan':\n admin => true,\n password => 'bar',\n}\n
\n\nquery all current vhosts: $ puppet resource rabbitmq_vhost
rabbitmq_vhost { 'myhost':\n ensure => present,\n}\n
\n\nrabbitmq_user_permissions { 'dan@myhost':\n configure_permission => '.*',\n read_permission => '.*',\n write_permission => '.*',\n}\n
\n\nquery all currently enabled plugins $ puppet resource rabbitmq_plugin
rabbitmq_plugin {'rabbitmq_stomp':\n ensure => present,\n}\n
\n\nThis module has been built on and tested against Puppet 2.7 and higher.
\n\nThe module has been tested on:
\n\nTesting on other platforms has been light and cannot be guaranteed.
\n\nPuppet Labs modules on the Puppet Forge are open projects, and community\ncontributions are essential for keeping them great. We can’t access the\nhuge number of platforms and myriad of hardware, software, and deployment\nconfigurations that Puppet is intended to serve.
\n\nWe want to keep it as easy as possible to contribute changes so that our\nmodules work in your environment. There are a few guidelines that we need\ncontributors to follow so that we can have a chance of keeping on top of things.
\n\nYou can read the complete module contribution guide on the Puppet Labs wiki.
\n\n2013-09-14 - Version 3.1.0\n\nSummary:\n\nThis release focuses on a few small (but critical) bugfixes as well as extends\nthe amount of custom RabbitMQ configuration you can do with the module.\n\nFeatures:\n- You can now change RabbitMQ 'Config Variables' via the parameter `config_variables`.\n- You can now change RabbitMQ 'Environment Variables' via the parameter `environment_variables`.\n- ArchLinux support added.\n\nFixes:\n- Make use of the user/password parameters in rabbitmq_exchange{}\n- Correct the read/write parameter order on set_permissions/list_permissions as\n they were reversed.\n- Make the module pull down 3.1.5 by default.\n\n* 2013-07-18 3.0.0\nSummary:\nThis release heavily refactors the RabbitMQ and changes functionality in\nseveral key ways. Please pay attention to the new README.md file for\ndetails of how to interact with the class now. Puppet 3 and RHEL are\nnow fully supported. The default version of RabbitMQ has changed to\na 3.x release.\n\nBugfixes:\n- Improve travis testing options.\n- Stop reimporting the GPG key on every run on RHEL and Debian.\n- Fix documentation to make it clear you don't have to set provider => each time.\n- Reference the standard rabbitmq port in the documentation instead of a custom port.\n- Fixes to the README formatting.\n\nFeatures:\n- Refactor the module to fix RHEL support. All interaction with the module\nis now done through the main rabbitmq class.\n- Add support for mirrored queues (Only on Debian family distributions currently)\n- Add rabbitmq_exchange provider (using rabbitmqadmin)\n- Add new `rabbitmq` class parameters:\n - `manage_service`: Boolean to choose if Puppet should manage the service. (For pacemaker/HA setups)\n- Add SuSE support.\n\nIncompatible Changes:\n- Rabbitmq::server has been removed and is now rabbitmq::config. You should\nnot use this class directly, only via the main rabbitmq class.\n\n* 2013-04-11 2.1.0\n- remove puppetversion from rabbitmq.config template\n- add cluster support\n- escape resource names in regexp\n\n* 2012-07-31 Jeff McCune <jeff@puppetlabs.com> 2.0.2\n- Re-release 2.0.1 with $EDITOR droppings cleaned up\n\n* 2012-05-03 2.0.0\n- added support for new-style admin users\n- added support for rabbitmq 2.7.1\n\n* 2011-06-14 Dan Bode <dan@Puppetlabs.com> 2.0.0rc1\n- Massive refactor:\n- added native types for user/vhost/user_permissions\n- added apt support for vendor packages\n- added smoke tests\n\n* 2011-04-08 Jeff McCune <jeff@puppetlabs.com> 1.0.4\n- Update module for RabbitMQ 2.4.1 and rabbitmq-plugin-stomp package.\n\n2011-03-24 1.0.3\n- Initial release to the forge. Reviewed by Cody. Whitespace is good.\n\n2011-03-22 1.0.2\n- Whitespace only fix again... ack '\\t' is my friend...\n\n2011-03-22 1.0.1\n- Whitespace only fix.\n\n2011-03-22 1.0.0\n- Initial Release. Manage the package, file and service.\n
Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2013 Puppet Labs\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n
xinetd\n\nThis is the xinetd module.\n\n# Definition: xinetd::service\n#\n# sets up a xinetd service\n# all parameters match up with xinetd.conf(5) man page\n#\n# Parameters:\n# $cps - optional\n# $flags - optional\n# $per_source - optional\n# $port - required - determines the service port\n# $server - required - determines the program to execute for this service\n# $server_args - optional\n# $disable - optional - defaults to "no"\n# $socket_type - optional - defaults to "stream"\n# $protocol - optional - defaults to "tcp"\n# $user - optional - defaults to "root"\n# $group - optional - defaults to "root"\n# $instances - optional - defaults to "UNLIMITED"\n# $wait - optional - based on $protocol will default to "yes" for udp and "no" for tcp\n# $service_type - optional - type setting in xinetd\n#\n# Actions:\n# setups up a xinetd service by creating a file in /etc/xinetd.d/\n#\n# Requires:\n# $server must be set\n#\n# Sample Usage:\n# # setup tftp service\n# xinetd::service {"tftp":\n# port => "69",\n# server => "/usr/sbin/in.tftpd",\n# server_args => "-s $base",\n# socket_type => "dgram",\n# protocol => "udp",\n# cps => "100 2",\n# flags => "IPv4",\n# per_source => "11",\n# } # xinetd::service\n
2013-07-30 Release 1.2.0\nFeatures:\n- Add `confdir`, `conffile`, `package_name`, and `service_name` parameters to\n`Class['xinetd']`\n- Add support for FreeBSD and Suse.\n- Add `log_on_failure`, `service_name`, `groups`, `no_access`, `access_times`,\n`log_type`, `only_from`, and `xtype` parameters to `Xinetd::Service` define\n\nBugfixes:\n- Redesign for `xinetd::params` pattern\n- Add validation\n- Add unit testing\n\n* 2012-06-07 1.1.0\n- Add port and bind options to services\n- make services deletable\n\n1.0.1 - 20100812\n * added documentation\n\n1.0.0 - 20100624\n * initial release\n
Xinetd Puppet Module. Copyright (C) 2010 Garrett Honeycutt\n\nGarrett Honeycutt can be contacted at: contact@garretthoneycutt.com.\n\nThis program and entire repository is free software; you can\nredistribute it and/or modify it under the terms of the GNU\nGeneral Public License version 2 as published by the Free Software\nFoundation.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program; if not, write to the Free Software\nFoundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n
This module provides resource types for use in managing INI-style configuration\nfiles. The main resource type is ini_setting
, which is used to manage an\nindividual setting in an INI file. Here's an example usage:
ini_setting { "sample setting":\n path => '/tmp/foo.ini',\n section => 'foo',\n setting => 'foosetting',\n value => 'FOO!',\n ensure => present,\n}\n
\n\nA supplementary resource type is ini_subsetting
, which is used to manage\nsettings that consist of several arguments such as
JAVA_ARGS="-Xmx192m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/pe-puppetdb/puppetdb-oom.hprof "\n\nini_subsetting {'sample subsetting':\n ensure => present,\n section => '',\n key_val_separator => '=',\n path => '/etc/default/pe-puppetdb',\n setting => 'JAVA_ARGS',\n subsetting => '-Xmx',\n value => '512m',\n}\n
\n\nThe ini_setting class can be overridden by child providers in order to implement the management of ini settings for a specific configuration file.
\n\nIn order to implement this, you will need to specify your own Type (as shown below). This type needs to implement a namevar (name), and a property called value:
\n\nexample:
\n\n#my_module/lib/puppet/type/glance_api_config.rb\nPuppet::Type.newtype(:glance_api_config) do\n ensurable\n newparam(:name, :namevar => true) do\n desc 'Section/setting name to manage from glance-api.conf'\n # namevar should be of the form section/setting\n newvalues(/\\S+\\/\\S+/)\n end\n newproperty(:value) do\n desc 'The value of the setting to be defined.'\n munge do |v|\n v.to_s.strip\n end\n end\nend\n
\n\nThis type also must have a provider that utilizes the ini_setting provider as its parent:
\n\nexample:
\n\n# my_module/lib/puppet/provider/glance_api_config/ini_setting.rb\nPuppet::Type.type(:glance_api_config).provide(\n :ini_setting,\n # set ini_setting as the parent provider\n :parent => Puppet::Type.type(:ini_setting).provider(:ruby)\n) do\n # implement section as the first part of the namevar\n def section\n resource[:name].split('/', 2).first\n end\n def setting\n # implement setting as the second part of the namevar\n resource[:name].split('/', 2).last\n end\n # hard code the file path (this allows purging)\n def self.file_path\n '/etc/glance/glance-api.conf'\n end\nend\n
\n\nNow, the individual settings of the /etc/glance/glance-api.conf file can be managed as individual resources:
\n\nglance_api_config { 'HEADER/important_config':\n value => 'secret_value',\n}\n
\n\nProvided that self.file_path has been implemented, you can purge with the following puppet syntax:
\n\nresources { 'glance_api_config'\n purge => true,\n}\n
\n\nIf the above code is added, then the resulting configured file will only contain lines implemented as Puppet resources
\n\n2013-07-16 - Version 1.0.0\nFeatures:\n- Handle empty values.\n- Handle whitespace in settings names (aka: server role = something)\n- Add mechanism for allowing ini_setting subclasses to override the\nformation of the namevar during .instances, to allow for ini_setting\nderived types that manage flat ini-file-like files and still purge\nthem.\n\n2013-05-28 - Chris Price <chris@puppetlabs.com> - 0.10.3\n * Fix bug in subsetting handling for new settings (cbea5dc)\n\n2013-05-22 - Chris Price <chris@puppetlabs.com> - 0.10.2\n * Better handling of quotes for subsettings (1aa7e60)\n\n2013-05-21 - Chris Price <chris@puppetlabs.com> - 0.10.1\n * Change constants to class variables to avoid ruby warnings (6b19864)\n\n2013-04-10 - Erik Dalén <dalen@spotify.com> - 0.10.1\n * Style fixes (c4af8c3)\n\n2013-04-02 - Dan Bode <dan@puppetlabs.com> - 0.10.1\n * Add travisfile and Gemfile (c2052b3)\n\n2013-04-02 - Chris Price <chris@puppetlabs.com> - 0.10.1\n * Update README.markdown (ad38a08)\n\n2013-02-15 - Karel Brezina <karel.brezina@gmail.com> - 0.10.0\n * Added 'ini_subsetting' custom resource type (4351d8b)\n\n2013-03-11 - Dan Bode <dan@puppetlabs.com> - 0.10.0\n * guard against nil indentation values (5f71d7f)\n\n2013-01-07 - Dan Bode <dan@puppetlabs.com> - 0.10.0\n * Add purging support to ini file (2f22483)\n\n2013-02-05 - James Sweeny <james.sweeny@puppetlabs.com> - 0.10.0\n * Fix test to use correct key_val_parameter (b1aff63)\n\n2012-11-06 - Chris Price <chris@puppetlabs.com> - 0.10.0\n * Added license file w/Apache 2.0 license (5e1d203)\n\n2012-11-02 - Chris Price <chris@puppetlabs.com> - 0.9.0\n * Version 0.9.0 released\n\n2012-10-26 - Chris Price <chris@puppetlabs.com> - 0.9.0\n * Add detection for commented versions of settings (a45ab65)\n\n2012-10-20 - Chris Price <chris@puppetlabs.com> - 0.9.0\n * Refactor to clarify implementation of `save` (f0d443f)\n\n2012-10-20 - Chris Price <chris@puppetlabs.com> - 0.9.0\n * Add example for `ensure=absent` (e517148)\n\n2012-10-20 - Chris Price <chris@puppetlabs.com> - 0.9.0\n * Better handling of whitespace lines at ends of sections (845fa70)\n\n2012-10-20 - Chris Price <chris@puppetlabs.com> - 0.9.0\n * Respect indentation / spacing for existing sections and settings (c2c26de)\n\n2012-10-17 - Chris Price <chris@puppetlabs.com> - 0.9.0\n * Minor tweaks to handling of removing settings (cda30a6)\n\n2012-10-10 - Dan Bode <dan@puppetlabs.com> - 0.9.0\n * Add support for removing lines (1106d70)\n\n2012-10-02 - Dan Bode <dan@puppetlabs.com> - 0.9.0\n * Make value a property (cbc90d3)\n\n2012-10-02 - Dan Bode <dan@puppetlabs.com> - 0.9.0\n * Make ruby provider a better parent. (1564c47)\n\n2012-09-29 - Reid Vandewiele <reid@puppetlabs.com> - 0.9.0\n * Allow values with spaces to be parsed and set (3829e20)\n\n2012-09-24 - Chris Price <chris@pupppetlabs.com> - 0.0.3\n * Version 0.0.3 released\n\n2012-09-20 - Chris Price <chris@puppetlabs.com> - 0.0.3\n * Add validation for key_val_separator (e527908)\n\n2012-09-19 - Chris Price <chris@puppetlabs.com> - 0.0.3\n * Allow overriding separator string between key/val pairs (8d1fdc5)\n\n2012-08-20 - Chris Price <chris@pupppetlabs.com> - 0.0.2\n * Version 0.0.2 released\n\n2012-08-17 - Chris Price <chris@pupppetlabs.com> - 0.0.2\n * Add support for "global" section at beginning of file (c57dab4)\n
Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n "License" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n "Licensor" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n "Legal Entity" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n "control" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n "You" (or "Your") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n "Source" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n "Object" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n "Work" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n "Derivative Works" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n "Contribution" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, "submitted"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as "Not a Contribution."\n\n "Contributor" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a "NOTICE" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets "[]"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same "printed page" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2012 Chris Price\n\n Licensed under the Apache License, Version 2.0 (the "License");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an "AS IS" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n
Install tftp-hpa package and configuration files
\n\nThis module will install TFTP as a xinetd service by default. It can be overridden to run as a standalone daemon by setting the inetd parameter to false.
\n\nParameters:
\n\nExample:
\n\nclass tftp {\n directory => '/opt/tftp',\n address => $::ipaddress,\n options => '--ipv6 --timeout 60',\n}\n
\n\nParameters:
\n\nExample:
\n\ntftp::file { 'pxelinux.0':\n source => 'puppet:///modules/acme/pxelinux.0',\n}\n\ntftp::file { 'pxelinux.cfg':\n ensure => directory,\n}\n\ntftp::file { 'pxelinux.cfg/default':\n ensure => file,\n source => 'puppet:///modules/acme/pxelinux.cfg/default',\n}\n
\n\nThe last example can be abbreviated to the following if it's in the acme module:
\n\ntftp::file { 'pxelinux.cfg/default': }\n
\n\nExample:
\n\nfile { '/opt/tftp':\n ensure => directory,\n}\n\nclass { 'tftp':\n directory => '/opt/tftp',\n address => $::ipaddress,\n}\n\ntftp::file { 'pxelinux.0':\n source => 'puppet:///modules/acme/pxelinux.0',\n}\n
\n\nThe examples use a module acme and the tftp files should be placed in calling module path i.e. (/etc/puppet/modules/acme/files).
\n\nThe module have been tested on the following operating systems. Testing and patches for other platforms are welcomed.
\n\n0.2.1 2012-08-21 Puppet Labs <info@puppetlabs.com>\n\n* Fix permission issues related to xinetd\n\n0.2.0 2012-07-27 Puppet Labs <info@puppetlabs.com>\n\n* Add support for RHEL/CentOS\n* Use xinetd rather than inetd\n* Enable xinetd by default\n\n0.1.1 2012-06-25 Puppet Labs <info@puppetlabs.com>\n\n* Add recurse support for tftp::file.\n* Add source defaults for tftp::file.\n* Add travis ci and puppet spec_helper support.\n\n0.1.0 2012-05-1 Puppet Labs <info@puppetlabs.com>\n\n* Initial release of module.\n
Copyright (C) 2012 Puppet Labs Inc\n\nPuppet Labs can be contacted at: info@puppetlabs.com\n\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n