Skip to content

Add switch to configure database SSL connection #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kbarber merged 3 commits into from
Oct 19, 2013
Merged

Add switch to configure database SSL connection #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
84c5fa7
Add switch to configure database SSL connection
stdietrich Aug 21, 2013
d6202bd
Disable database validation, if SSL is enabled
stdietrich Aug 21, 2013
c7ef407
Document new database_ssl option in README
stdietrich Oct 19, 2013
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,6 +210,11 @@ The password for the database user (defaults to `puppetdb`; ignored for `embedde

The name of the database instance to connect to (defaults to `puppetdb`; ignored for `embedded` db).

####`database_ssl`

If true, puppetdb will use SSL to connect to the postgres database (defaults to false; ignored for `embedded` db).
Setting up proper trust- and keystores has to be managed outside of the puppetdb module.

####`node_ttl`

The length of time a node can go without receiving any new data before it's automatically deactivated. (defaults to '0', which disables auto-deactivation). This option is supported in PuppetDB >= 1.1.0.
Expand Down
2 changes: 2 additions & 0 deletions manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
$database_username = $puppetdb::params::database_username,
$database_password = $puppetdb::params::database_password,
$database_name = $puppetdb::params::database_name,
$database_ssl = $puppetdb::params::database_ssl,
$node_ttl = $puppetdb::params::node_ttl,
$node_purge_ttl = $puppetdb::params::node_purge_ttl,
$report_ttl = $puppetdb::params::report_ttl,
Expand Down Expand Up @@ -94,6 +95,7 @@
database_username => $database_username,
database_password => $database_password,
database_name => $database_name,
database_ssl => $database_ssl,
node_ttl => $node_ttl,
node_purge_ttl => $node_purge_ttl,
report_ttl => $report_ttl,
Expand Down
1 change: 1 addition & 0 deletions manifests/params.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
$database_name = 'puppetdb'
$database_username = 'puppetdb'
$database_password = 'puppetdb'
$database_ssl = false

# These settings manage the various auto-deactivation and auto-purge settings
$node_ttl = '0s'
Expand Down
32 changes: 17 additions & 15 deletions manifests/server.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
$database_username = $puppetdb::params::database_username,
$database_password = $puppetdb::params::database_password,
$database_name = $puppetdb::params::database_name,
$database_ssl = $puppetdb::params::database_ssl,

@kbarber kbarber Oct 18, 2013

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, should have picked this up before, this needs to be documented now in README.md

@kbarber kbarber Oct 18, 2013

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also as per convention it needs to be available in the main class puppetdb as well, I think that is what is normally documented. For good or bad.

$node_ttl = $puppetdb::params::node_ttl,
$node_purge_ttl = $puppetdb::params::node_purge_ttl,
$report_ttl = $puppetdb::params::report_ttl,
Expand Down Expand Up @@ -99,22 +100,23 @@
}

class { 'puppetdb::server::database_ini':
database => $database,
database_host => $database_host,
database_port => $database_port,
database_username => $database_username,
database_password => $database_password,
database_name => $database_name,
node_ttl => $node_ttl,
node_purge_ttl => $node_purge_ttl,
report_ttl => $report_ttl,
gc_interval => $gc_interval,
database => $database,
database_host => $database_host,
database_port => $database_port,
database_username => $database_username,
database_password => $database_password,
database_name => $database_name,
database_ssl => $database_ssl,
node_ttl => $node_ttl,
node_purge_ttl => $node_purge_ttl,
report_ttl => $report_ttl,
gc_interval => $gc_interval,
log_slow_statements => $log_slow_statements,
conn_max_age => $conn_max_age,
conn_keep_alive => $conn_keep_alive,
conn_lifetime => $conn_lifetime,
confdir => $confdir,
notify => Service[$puppetdb_service],
conn_max_age => $conn_max_age,
conn_keep_alive => $conn_keep_alive,
conn_lifetime => $conn_lifetime,
confdir => $confdir,
notify => Service[$puppetdb_service],
}

class { 'puppetdb::server::jetty_ini':
Expand Down
7 changes: 6 additions & 1 deletion manifests/server/database_ini.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
$database_username = $puppetdb::params::database_username,
$database_password = $puppetdb::params::database_password,
$database_name = $puppetdb::params::database_name,
$database_ssl = $puppetdb::params::database_ssl,
$node_ttl = $puppetdb::params::node_ttl,
$node_purge_ttl = $puppetdb::params::node_purge_ttl,
$report_ttl = $puppetdb::params::report_ttl,
Expand Down Expand Up @@ -46,7 +47,11 @@
} elsif $database == 'postgres' {
$classname = 'org.postgresql.Driver'
$subprotocol = 'postgresql'
$subname = "//${database_host}:${database_port}/${database_name}"

$subname = $database_ssl ? {
true => "//${database_host}:${database_port}/${database_name}?ssl=true",
default => "//${database_host}:${database_port}/${database_name}",
}

##Only setup for postgres
ini_setting {'puppetdb_psdatabase_username':
Expand Down
7 changes: 5 additions & 2 deletions manifests/server/validate_db.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,11 +48,14 @@
$database_port = $puppetdb::params::database_port,
$database_username = $puppetdb::params::database_username,
$database_password = $puppetdb::params::database_password,
$database_name = $puppetdb::params::database_name
$database_name = $puppetdb::params::database_name,
$database_ssl = $puppetdb::params::database_ssl
) inherits puppetdb::params {

# We don't need any validation for the embedded database, presumably.
if ($database == 'postgres' and $database_password != undef) {
if ($database == 'postgres' and (
$database_password != undef and $database_ssl == false)

@kbarber kbarber Sep 26, 2013

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this because validate_db_connection doesn't support SSL?

@stdietrich stdietrich Sep 26, 2013

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

validate_db_connection does support SSL, because it uses psql. psql expects certificates to be located in a .postgresql folder inside the home folder of the executing user.
Now one would have to store the certificates multiple times on the machine, once for the validate_db_connection and another time inside the JKS.
To circumvent this, I disabled DB validation if SSL is enabled.

@kbarber kbarber Oct 4, 2013

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I like this feature, I really do - but can't help but think this is incomplete because of our inability to use validate_db_connection. I do however realise that getting everything working is going to be a hassle, but it feels like a bad line to draw. Maybe I'm just being pedantic, but I would like to find a better incremental release of this feature somehow. Let me ponder some more, but I don't suppose you have any ideas on doing something that is a stop-gap?

@stdietrich stdietrich Oct 7, 2013

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you insist on validate_db_connection, then there is only one way to solve this :)
The paths to the certificates are hardcoded in the libpq C library, which is used by psql.
So, you have to store the certificates multiple times or symlinking the contents of the .postgres folder to a different location.
This should probably handled by the puppetlabs-postgresql module.
Let me know, if you come up with any other solution.

) {
postgresql::validate_db_connection { 'validate puppetdb postgres connection':
database_host => $database_host,
database_port => $database_port,
Expand Down