diff --git a/bin/puppet b/bin/puppet index fa54b5ebd..025522417 100755 --- a/bin/puppet +++ b/bin/puppet @@ -1,206 +1,210 @@ #!/usr/bin/env ruby # # = Synopsis # # Run a stand-alone +puppet+ script. # # = Usage # # puppet [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] # [-l|--logfile ] # # = Description # # This is the standalone puppet execution script; use it to execute # individual scripts that you write. If you need to execute site-wide # scripts, use +puppetd+ and +puppetmasterd+. # # = Options # # Note that any configuration parameter that's valid in the configuration file # is also a valid long argument. For example, 'ssldir' is a valid configuration # parameter, so you can specify '--ssldir ' as an argument. # -# See the configuration file for the full list of acceptable parameters. +# See the configuration file documentation at +# http://reductivelabs.com/projects/puppet/documentation/configref.html for +# the full list of acceptable parameters. A commented list of all +# configuration options can also be generated by running puppet with +# '--genconfig'. # # debug:: # Enable full debugging. # # help:: # Print this help message # # loadclasses:: # Load any stored classes. +puppetd+ caches configured classes (usually at # /etc/puppet/classes.txt), and setting this option causes all of those classes # to be set in your +puppet+ manifest. # # logfile:: # Where to send messages. Choose between syslog, the console, and a log file. # Defaults to sending messages to the console. # # verbose:: # Print extra information. # # = Example # # puppet -l /tmp/script.log script.pp # # = Author # # Luke Kanies # # = Copyright # # Copyright (c) 2005 Reductive Labs, LLC # Licensed under the GNU Public License require 'puppet' require 'puppet/server' require 'puppet/client' require 'getoptlong' $haveusage = true begin require 'rdoc/usage' rescue Exception $haveusage = false end options = [ [ "--debug", "-d", GetoptLong::NO_ARGUMENT ], [ "--help", "-h", GetoptLong::NO_ARGUMENT ], [ "--logdest", "-l", GetoptLong::REQUIRED_ARGUMENT ], [ "--execute", "-e", GetoptLong::REQUIRED_ARGUMENT ], [ "--loadclasses", "-L", GetoptLong::NO_ARGUMENT ], [ "--verbose", "-v", GetoptLong::NO_ARGUMENT ], [ "--use-nodes", GetoptLong::NO_ARGUMENT ], [ "--version", "-V", GetoptLong::NO_ARGUMENT ] ] # Add all of the config parameters as valid options. Puppet.config.addargs(options) result = GetoptLong.new(*options) debug = false verbose = false noop = false logfile = false loadclasses = false code = nil master = { :Local => true } Puppet::Log.newdestination(:console) begin result.each { |opt,arg| case opt when "--version" puts "%s" % Puppet.version exit when "--help" if $haveusage RDoc::usage && exit else puts "No help available unless you have RDoc::usage installed" exit end when "--use-nodes" master[:UseNodes] = true when "--verbose" verbose = true when "--debug" debug = true when "--execute" code = arg when "--loadclasses" loadclasses = true when "--logdest" begin Puppet::Log.newdestination(arg) rescue => detail $stderr.puts detail.to_s end else Puppet.config.handlearg(opt, arg) end } rescue GetoptLong::InvalidOption => detail $stderr.puts "Try '#{$0} --help'" #if $haveusage # RDoc::usage(1,'usage') #end exit(1) end client = nil server = nil [:INT, :TERM].each do |signal| trap(signal) do Puppet.notice "Caught #{signal}; shutting down" [client, server].each { |obj| if obj obj.shutdown end } end end if debug Puppet::Log.level = :debug elsif verbose Puppet::Log.level = :info end # Now parse the config if Puppet[:config] and File.exists? Puppet[:config] Puppet.config.parse(Puppet[:config]) end Puppet.genconfig Puppet.genmanifest if code master[:Code] = code else master[:Manifest] = ARGV.shift end # Allow users to load the classes that puppetd creates. if loadclasses file = Puppet[:classfile] if FileTest.exists?(file) unless FileTest.readable?(file) $stderr.puts "%s is not readable" % file exit(63) end master[:Classes] = File.read(file).split(/[\s\n]+/) end end begin server = Puppet::Server::Master.new(master) client = Puppet::Client::MasterClient.new( :Master => server, :Cache => false ) if Puppet[:parseonly] exit(0) end client.getconfig client.apply rescue => detail $stderr.puts detail if Puppet[:debug] puts detail.backtrace end exit(1) end diff --git a/bin/puppetca b/bin/puppetca index 4bde92a11..34286f853 100755 --- a/bin/puppetca +++ b/bin/puppetca @@ -1,276 +1,280 @@ #!/usr/bin/env ruby # # = Synopsis # # Stand-alone certificate authority. Capable of generating certificates # but mostly meant for signing certificate requests from puppet clients. # # = Usage # # puppetca [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] # [-g|--generate] [-l|--list] [-s|--sign] [-r|--revoke] # [-c|--clean] [host] # # = Description # # Because the puppetmasterd daemon defaults to not signing client certificate # requests, this script is available for signing outstanding requests. It # can be used to list outstanding requests and then either sign them individually # or sign all of them. # # = Options # # Note that any configuration parameter that's valid in the configuration file # is also a valid long argument. For example, 'ssldir' is a valid configuration # parameter, so you can specify '--ssldir ' as an argument. # -# See the configuration file for the full list of acceptable parameters. +# See the configuration file documentation at +# http://reductivelabs.com/projects/puppet/documentation/configref.html for +# the full list of acceptable parameters. A commented list of all +# configuration options can also be generated by running puppetca with +# '--genconfig'. # # all:: # Operate on all outstanding requests. Only makes sense with '--sign'. # # clean:: # Remove all files related to a host from puppetca's storage. This is # useful when rebuilding hosts, since new certificate signing requests # will only be honored if puppetca does not have a copy of a signed # certificate for that host. The certificate of the host remains valid. # # debug:: # Enable full debugging. # # generate:: # Generate a certificate for a named client. A certificate/keypair will be # generated for each client named on the command line. # # help:: # Print this help message # # list:: # List outstanding certificate requests. # # revoke:: # Revoke the certificate of a client. The certificate can be specified # either by its serial number, given as a decimal number or a hexadecimal # number prefixed by '0x', or by its hostname. The certificate is revoked # by adding it to the Certificate Revocation List given by the 'cacrl' # config parameter. Note that the puppetmasterd needs to be restarted # after revoking certificates. # # sign:: # Sign an outstanding certificate request. Unless '--all' is specified, # hosts must be listed after all flags. # # verbose:: # Enable verbosity. # # = Example # # $ puppetca -l # culain.madstop.com # $ puppetca -s culain.madstop.com # # = Author # # Luke Kanies # # = Copyright # # Copyright (c) 2005 Reductive Labs, LLC # Licensed under the GNU Public License require 'puppet' require 'puppet/sslcertificates' require 'getoptlong' $haveusage = true begin require 'rdoc/usage' rescue Exception $haveusage = false end options = [ [ "--all", "-a", GetoptLong::NO_ARGUMENT ], [ "--clean", "-c", GetoptLong::NO_ARGUMENT ], [ "--debug", "-d", GetoptLong::NO_ARGUMENT ], [ "--generate", "-g", GetoptLong::NO_ARGUMENT ], [ "--help", "-h", GetoptLong::NO_ARGUMENT ], [ "--list", "-l", GetoptLong::NO_ARGUMENT ], [ "--revoke", "-r", GetoptLong::NO_ARGUMENT ], [ "--sign", "-s", GetoptLong::NO_ARGUMENT ], [ "--verbose", "-v", GetoptLong::NO_ARGUMENT ] ] # Add all of the config parameters as valid options. Puppet.config.addargs(options) result = GetoptLong.new(*options) mode = nil all = false generate = nil begin result.each { |opt,arg| case opt when "--all" all = true when "--clean" mode = :clean when "--debug" Puppet::Log.level = :debug when "--generate" generate = arg mode = :generate when "--help" if $haveusage RDoc::usage && exit else puts "No help available unless you have RDoc::usage installed" exit end when "--list" mode = :list when "--revoke" mode = :revoke when "--sign" mode = :sign when "--verbose" Puppet::Log.level = :info else Puppet.config.handlearg(opt, arg) end } rescue GetoptLong::InvalidOption => detail $stderr.puts "Try '#{$0} --help'" #if $haveusage # RDoc::usage_no_exit('usage') #end exit(1) end # Now parse the config if Puppet[:config] and File.exists? Puppet[:config] Puppet.config.parse(Puppet[:config]) end Puppet.genconfig Puppet.genmanifest begin ca = Puppet::SSLCertificates::CA.new() rescue => detail if Puppet[:debug] puts detail.backtrace end puts detail.to_s exit(23) end unless mode $stderr.puts "You must specify --list or --sign" exit(12) end if mode == :generate or mode == :clean or mode == :revoke hosts = ARGV else hosts = ca.list unless hosts.length > 0 puts "No certificates to sign" exit(0) end end case mode when :list puts hosts.join("\n") when :clean if hosts.empty? $stderr.puts "You must specify one or more hosts to clean" exit(24) end hosts.each do |host| ca.clean(host) end when :sign unless ARGV.length > 0 or all $stderr.puts( "You must specify to sign all certificates or you must specify hostnames" ) exit(24) end unless all ARGV.each { |host| unless hosts.include?(host) $stderr.puts "No waiting request for %s" % host end } hosts = hosts.find_all { |host| ARGV.include?(host) } end hosts.each { |host| begin csr = ca.getclientcsr(host) rescue => detail $stderr.puts "Could not retrieve request for %s: %s" % [host, detail] end begin ca.sign(csr) $stderr.puts "Signed %s" % host rescue => detail $stderr.puts "Could not sign request for %s: %s" % [host, detail] end begin ca.removeclientcsr(host) rescue => detail $stderr.puts "Could not remove request for %s: %s" % [host, detail] end } when :generate # we need to generate a certificate for a host hosts.each { |host| puts "Generating certificate for %s" % host cert = Puppet::SSLCertificates::Certificate.new( :name => host ) cert.mkcsr signedcert, cacert = ca.sign(cert.csr) cert.cert = signedcert cert.cacert = cacert cert.write } when :revoke hosts.each { |h| serial = nil if h =~ /^0x[0-9a-f]+$/ serial = h.to_i(16) elsif h =~ /^[0-9]+$/ serial = h.to_i else cert = ca.getclientcert(h)[0] if cert.nil? $stderr.puts "Could not find client certificate for %s" % h else serial = cert.serial end end unless serial.nil? ca.revoke(serial) puts "Revoked certificate with serial #{serial}" end } else $stderr.puts "Invalid mode %s" % mode exit(42) end # $Id$ diff --git a/bin/puppetd b/bin/puppetd index 24e3877e3..e0f7d2e1e 100755 --- a/bin/puppetd +++ b/bin/puppetd @@ -1,454 +1,456 @@ #!/usr/bin/env ruby # == Synopsis # # Retrieve the client configuration from the central puppet server and apply # it to the local host. # # Currently must be run out periodically, using cron or something similar. # # = Usage # # puppetd [-D|--daemonize] [-d|--debug] [--disable] [--enable] # [-h|--help] [--fqdn ] [-l|--logdest syslog||console] # [-o|--onetime] [--serve ] [-t|--test] # [-V|--version] [-v|--verbose] [-w|--waitforcert ] # # = Description # # This is the main puppet client. Its job is to retrieve the local machine's # configuration from a remote server and apply it. In order to successfully # communicate with the remote server, the client must have a certificate signed # by a certificate authority that the server trusts; the recommended method # for this, at the moment, is to run a certificate authority as part of the # puppet server (which is the default). The client will connect and request # a signed certificate, and will continue connecting until it receives one. # # Once the client has a signed certificate, it will retrieve its configuration # and apply it. # # = Usage Notes # # +puppetd+ does its best to find a compromise between interactive use and # daemon use. Run with no arguments and no configuration, it will go into the # backgroun, attempt to get a signed certificate, and retrieve and apply its # configuration every 30 minutes. # # Some flags are meant specifically for interactive use -- in particular, # +test+ and +tag+ are useful. +test+ enables verobse logging, causes # the daemon to stay in the foreground, exits if the server's configuration is # invalid (this happens if, for instance, you've left a syntax error on the # server), and exits after running the configuration once (rather than hanging # around as a long-running process). # # +tag+ allows you to specify what portions of a configuration you want to apply. # Puppet elements are tagged with all of the class or definition names that # contain them, and you can use the +tag+ flag to specify one of these names, # causing only configuration elements contained within that class or definition # to be applied. This is very useful when you are testing new configurations -- # for instance, if you are just starting to manage +ntpd+, you would put all of # the new elements into an +ntpd+ class, and call puppet with +--tag ntpd+, # which would only apply that small portion of the configuration during your # testing, rather than applying the whole thing. # # = Options # # Note that any configuration parameter that's valid in the configuration file # is also a valid long argument. For example, 'server' is a valid configuration # parameter, so you can specify '--server ' as an argument. # # See the configuration file documentation at -# http://reductivelabs.com/projects/puppet/documentation/puppet-executable-reference -# for the full list of acceptable parameters. +# http://reductivelabs.com/projects/puppet/documentation/configref.html for +# the full list of acceptable parameters. A commented list of all +# configuration options can also be generated by running puppetd with +# '--genconfig'. # # daemonize:: # Send the process into the background. This is the default unless # +verbose+ or +debug+ is enabled. # # debug:: # Enable full debugging. # # disable:: # Disable working on the local system. This puts a lock file in place, # causing +puppetd+ not to work on the system until the lock file is removed. # This is useful if you are testing a configuration and do not want the central # configuration to override the local state until everything is tested and # committed. # # +puppetd+ uses the same lock file while it is running, so no more than one # +puppetd+ process is working at a time. # # +puppetd+ exits after executing this. # # enable:: # Enable working on the local system. This removes any lock file, causing # +puppetd+ to start managing the local system again (although it will continue # to use its normal scheduling, so it might not start for another half hour). # # +puppetd+ exits after executing this. # # fqdn:: # Set the fully-qualified domain name of the client. This is only used for # certificate purposes, but can be used to override the discovered hostname. # If you need to use this flag, it is generally an indication of a setup problem. # # help:: # Print this help message # # logdest:: # Where to send messages. Choose between syslog, the console, and a log file. # Defaults to sending messages to syslog, or the console if debugging or # verbosity is enabled. # # onetime:: # Run the configuration once, rather than as a long-running daemon. This is # useful for interactively running puppetd. # # serve:: # Start another type of server. By default default, +puppetd+ will start # a server that allows authenticated and authorized remote nodes to trigger # the configuration to be pulled down and applied. You can specify # any other type of service here that does not require configuration, # e.g., filebucket, ca, or pelement. # # test:: # Enable the most common options used for testing. These are +onetime+, # +verbose+, and +no-usecacheonfailure+. # # verbose:: # Turn on verbose reporting. # # version:: # Print the puppet version number and exit. # # waitforcert:: # This option only matters for daemons that do not yet have certificates # and it is enabled by default, with a value of 120 (seconds). This causes # +puppetd+ to connect to the server every 2 minutes and ask it to sign a # certificate request. This is useful for the initial setup of a puppet # client. You can turn off waiting for certificates by specifying a time # of 0. # # = Example # # puppetd --server puppet.domain.com # # = Author # # Luke Kanies # # = Copyright # # Copyright (c) 2005, 2006 Reductive Labs, LLC # Licensed under the GNU Public License # Do an initial trap, so that cancels don't get a stack trace. trap(:INT) do $stderr.puts "Cancelling startup" exit(0) end require 'puppet' require 'puppet/server' require 'puppet/client' require 'getoptlong' $haveusage = true begin require 'rdoc/usage' rescue Exception $haveusage = false end options = [ [ "--centrallogging", GetoptLong::NO_ARGUMENT ], [ "--daemonize", "-D", GetoptLong::NO_ARGUMENT ], [ "--disable", GetoptLong::NO_ARGUMENT ], [ "--debug", "-d", GetoptLong::NO_ARGUMENT ], [ "--enable", GetoptLong::NO_ARGUMENT ], [ "--fqdn", "-f", GetoptLong::REQUIRED_ARGUMENT ], [ "--help", "-h", GetoptLong::NO_ARGUMENT ], [ "--logdest", "-l", GetoptLong::REQUIRED_ARGUMENT ], [ "--onetime", "-o", GetoptLong::NO_ARGUMENT ], [ "--test", "-t", GetoptLong::NO_ARGUMENT ], [ "--no-client", GetoptLong::NO_ARGUMENT ], [ "--verbose", "-v", GetoptLong::NO_ARGUMENT ], [ "--version", "-V", GetoptLong::NO_ARGUMENT ], [ "--waitforcert", "-w", GetoptLong::REQUIRED_ARGUMENT ] ] # Add all of the config parameters as valid options. Puppet.config.addargs(options) result = GetoptLong.new(*options) args = {} options = { :waitforcert => 120, # Default to checking for certs every 5 minutes :onetime => false, :centrallogs => false, :setdest => false, :enable => false, :disable => false, :client => true, :fqdn => nil, :serve => {} } begin result.each { |opt,arg| case opt # First check to see if the argument is a valid configuration parameter; # if so, set it. when "--daemonize" options[:daemonize] = true when "--disable" options[:disable] = true when "--serve" if klass = Puppet::Server::Handler.handler(arg) options[:serve][klass.name] = klass end when "--enable" options[:enable] = true when "--test" # Enable all of the most common test options. Puppet.config.handlearg("--no-usecacheonfailure") options[:onetime] = true unless Puppet::Log.level == :debug Puppet::Log.level = :info end Puppet::Log.newdestination(:console) when "--centrallogging" options[:centrallogs] = true when "--help" if $haveusage RDoc::usage && exit else puts "No help available unless you have RDoc::usage installed" exit end when "--version" puts "%s" % Puppet.version exit when "--verbose" Puppet::Log.level = :info Puppet::Log.newdestination(:console) when "--debug" Puppet::Log.level = :debug Puppet::Log.newdestination(:console) when "--fqdn" options[:fqdn] = arg when "--no-client" options[:client] = false when "--onetime" options[:onetime] = true when "--port" args[:Port] = arg when "--logdest" begin Puppet::Log.newdestination(arg) options[:setdest] = true rescue => detail $stderr.puts detail.to_s end when "--waitforcert" options[:waitforcert] = arg.to_i else Puppet.config.handlearg(opt, arg) end } rescue GetoptLong::InvalidOption => detail $stderr.puts detail $stderr.puts "Try '#{$0} --help'" # FIXME RDoc::usage doesn't seem to work #if $haveusage # RDoc::usage(1,'usage') #end exit(1) end Puppet.genconfig Puppet.genmanifest # Now parse the config if Puppet[:config] and File.exists? Puppet[:config] Puppet.config.parse(Puppet[:config]) end # Default to daemonizing, but if verbose or debug is specified, # default to staying in the foreground. unless options.include?(:daemonize) if Puppet::Log.level == :debug or Puppet::Log.level == :info options[:daemonize] = false else options[:daemonize] = true end end unless options[:setdest] Puppet::Log.newdestination(:syslog) end args[:Server] = Puppet[:server] if options[:fqdn] args[:FQDN] = options[:fqdn] end if options[:centrallogs] logdest = args[:Server] if args.include?(:Port) logdest += ":" + args[:Port] end Puppet::Log.newdestination(logdest) end if options[:onetime] Puppet[:setpidfile] = false end # We need tomake the client either way, we just don't start it # if --no-client is set. client = Puppet::Client::MasterClient.new(args) if options[:enable] client.enable elsif options[:disable] client.disable end if options[:enable] or options[:disable] exit(0) end server = nil # It'd be nice to daemonize later, but we have to daemonize before the # waitforcert happens. if options[:daemonize] client.daemonize end unless client.readcert # If we don't already have the certificate, then create a client to # request one. caclient = Puppet::Client::CA.new(args) if options[:waitforcert] > 0 begin while ! caclient.requestcert do Puppet.notice "Did not receive certificate" sleep options[:waitforcert] end rescue => detail Puppet.err "Could not request certificate: %s" % detail.to_s exit(23) end else unless caclient.requestcert Puppet.notice "No certificates; exiting" exit(1) end end # Now read the new cert in. unless client.readcert Puppet.err "Could not read certificates after retrieving them" exit(34) end end objects = [] # This has to go after the certs are dealt with. if Puppet[:listen] unless FileTest.exists?(Puppet[:authconfig]) $stderr.puts "Will not start without authorization file %s" % Puppet[:authconfig] exit(14) end # FIXME: we should really figure out how to distribute the CRL # to clients. In the meantime, we just disable CRL checking if # the CRL file doesn't exist unless File::exist?(Puppet[:cacrl]) Puppet[:cacrl] = 'none' end handlers = nil if options[:serve].empty? handlers = {:Runner => {}} else handlers = options[:serve].inject({}) do |hash, name, klass| hash[name] = {} end end handlers.each do |name, hash| Puppet.info "Starting handler for %s" % name end args[:Handlers] = handlers args[:Port] = Puppet[:puppetport] begin server = Puppet::Server.new(args) rescue => detail $stderr.puts detail puts detail.backtrace exit(1) end objects << server end # now set up the network client with the certs, now that we have them client.setcerts if options[:client] objects << client end # Set traps for INT and TERM Puppet.settraps # If --onetime is specified, we don't run 'start', which means we don't # create a pidfile. if options[:onetime] unless options[:client] $stderr.puts "onetime is specified but there is no client" exit(43) end if server Puppet.notice "Ignoring --listen on onetime run" end # Add the service, so the traps work correctly. Puppet.newservice(client) begin client.run rescue => detail Puppet.err detail.to_s if Puppet[:debug] puts detail.backtrace end end exit(0) else if server Puppet.newservice(server) end if options[:client] Puppet.notice "Starting Puppet client version %s" % [Puppet.version] Puppet.newservice(client) end Puppet.settraps Puppet.start end # $Id$ diff --git a/bin/puppetmasterd b/bin/puppetmasterd index 7e2cf815d..b38773ad9 100755 --- a/bin/puppetmasterd +++ b/bin/puppetmasterd @@ -1,292 +1,294 @@ #!/usr/bin/env ruby # # = Synopsis # # The central puppet server. Can also function as a certificate authority. # # = Usage # # puppetmasterd [-D|--daemonize] [-d|--debug] [-h|--help] # [-l|--logdest |console|syslog] [--noca] [--nobucket] [--nonodes] # [-v|--verbose] [-V|--version] # # = Description # # This is the puppet central daemon. # # = Options # # Note that any configuration parameter that's valid in the configuration file # is also a valid long argument. For example, 'ssldir' is a valid configuration # parameter, so you can specify '--ssldir ' as an argument. # # See the configuration file documentation at -# http://reductivelabs.com/projects/puppet/documentation/puppet-executable-reference -# for the full list of acceptable parameters. +# http://reductivelabs.com/projects/puppet/documentation/configref.html for +# the full list of acceptable parameters. A commented list of all +# configuration options can also be generated by running puppetmasterdd with +# '--genconfig'. # # daemonize:: # Send the process into the background. This is the default unless # +verbose+ or +debug+ is enabled. # # debug:: # Enable full debugging. Causes the daemon not to go into the background. # # help:: # Print this help message. # # logdest:: # Where to send messages. Choose between syslog, the console, and a log file. # Defaults to sending messages to /var/puppet/log/puppet.log, or the console # if debugging or verbosity is enabled. # # nobucket:: # Do not function as a file bucket. # # noca:: # Do not function as a certificate authority. # # nonodes:: # Do not use individual node designations; each node will receive the result # of evaluating the entire configuration. # # noreports:: # Do not start the reports server. # # verbose:: # Enable verbosity. Causes the daemon not to go into the background. # # version:: # Print the puppet version number and exit. # # = Example # # puppetmasterd # # = Author # # Luke Kanies # # = Copyright # # Copyright (c) 2005 Reductive Labs, LLC # Licensed under the GNU Public License # Do an initial trap, so that cancels don't get a stack trace. trap(:INT) do $stderr.puts "Cancelling startup" exit(0) end require 'getoptlong' require 'puppet' require 'puppet/server' options = [ [ "--daemonize", "-D", GetoptLong::NO_ARGUMENT ], [ "--debug", "-d", GetoptLong::NO_ARGUMENT ], [ "--help", "-h", GetoptLong::NO_ARGUMENT ], [ "--logdest", "-l", GetoptLong::REQUIRED_ARGUMENT ], [ "--noca", GetoptLong::NO_ARGUMENT ], [ "--nobucket", GetoptLong::NO_ARGUMENT ], [ "--noreports", GetoptLong::NO_ARGUMENT ], [ "--nonodes", GetoptLong::NO_ARGUMENT ], [ "--verbose", "-v", GetoptLong::NO_ARGUMENT ], [ "--version", "-V", GetoptLong::NO_ARGUMENT ] ] #Puppet::Log.newdestination(:syslog) # Add all of the config parameters as valid options. Puppet.config.addargs(options) result = GetoptLong.new(*options) $haveusage = true begin require 'rdoc/usage' rescue Exception $haveusage = false end master = {} ca = {} report = {} fs = {} bucket = {} args = {} options = { :haveca => true, :havereport => true, :havebucket => true, :havemaster => true, :setdest => false, :verbose => false, :debug => false } begin result.each { |opt,arg| case opt when "--daemonize" options[:daemonize] = true when "--debug" options[:debug] = true when "--help" if $haveusage RDoc::usage && exit else puts "No help available unless you have RDoc::usage installed" exit end when "--noreports" options[:havereport] = false when "--noca" options[:haveca] = false when "--nomaster" options[:havemaster] = false when "--nobucket" options[:havebucket] = false when "--nonodes" master[:UseNodes] = false when "--logdest" begin Puppet::Log.newdestination(arg) options[:setdest] = true rescue => detail if Puppet[:debug] puts detail.backtrace end $stderr.puts detail.to_s end when "--version" puts "%s" % Puppet.version exit when "--verbose" options[:verbose] = true else Puppet.config.handlearg(opt, arg) end } rescue GetoptLong::InvalidOption => detail $stderr.puts "Try '#{$0} --help'" #$stderr.puts detail # FIXME RDoc::usage doesn't seem to work #if $haveusage # RDoc::usage(1,'usage') #end exit(1) end # Handle the logging settings. if options[:debug] or options[:verbose] if options[:debug] Puppet::Log.level = :debug else Puppet::Log.level = :info end unless options[:daemonize] Puppet::Log.newdestination(:console) options[:setdest] = true end end unless options[:setdest] Puppet::Log.newdestination(:syslog) end # Now parse the config if Puppet[:config] and File.exists? Puppet[:config] Puppet.config.parse(Puppet[:config]) end Puppet.genconfig Puppet.genmanifest require 'etc' # Default to daemonizing, but if verbose or debug is specified, # default to staying in the foreground. unless options.include?(:daemonize) if Puppet::Log.level == :debug or Puppet::Log.level == :info options[:daemonize] = false else options[:daemonize] = true end end handlers = { :Status => {}, } if options[:havemaster] handlers[:Master] = master end if options[:havereport] handlers[:Report] = report end if options[:haveca] handlers[:CA] = ca end if options[:havebucket] handlers[:FileBucket] = bucket end if File.exists?(Puppet[:fileserverconfig]) fs[:Config] = Puppet[:fileserverconfig] #else # Puppet.notice "File server config %s does not exist; skipping file serving" % # Puppet[:fileserverconfig] end if fs.include?(:Config) handlers[:FileServer] = fs end args[:Handlers] = handlers begin # use the default, um, everything #server = Puppet::Server.new(:CA => ca) server = Puppet::Server.new(args) rescue => detail if Puppet[:debug] puts detail.backtrace end $stderr.puts detail exit(1) end if Process.uid == 0 begin Puppet::Util.chuser rescue => detail if Puppet[:debug] puts detail.backtrace end $stderr.puts "Could not change user to %s: %s" % [Puppet[:user], detail] exit(39) end end if Puppet[:parseonly] # we would have already exited if the file weren't syntactically correct exit(0) end Puppet.newservice(server) Puppet.settraps if options[:daemonize] server.daemonize end Puppet.notice "Starting Puppet server version %s" % [Puppet.version] Puppet.start # $Id$ diff --git a/documentation/documentation/configref.page b/documentation/documentation/configref.page index 93b93f64f..909f50afe 100644 --- a/documentation/documentation/configref.page +++ b/documentation/documentation/configref.page @@ -1,415 +1,419 @@ --- inMenu: true title: Executable Reference --- # Puppet Executable Reference Every Puppet executable (with the exception of ``puppetdoc``) accepts all of these arguments, but not all of the arguments make sense for every executable. Each argument has a section listed with it in parentheses; often, that section will map to an executable (e.g., ``puppetd``), in which case it probably only makes sense for that one executable. If ``puppet`` is listed as the section, it is most likely an option that is valid for everyone. This will not always be the case. I have tried to be as thorough as possible in the descriptions of the arguments, so it should be obvious whether an argument is approprite or not. * **authconfig** (*puppet*) The configuration file that defines the rights to the different namespaces and methods. This can be used as a coarse-grained authorization system for both ``puppetd`` and ``puppetmasterd``. * **autosign** (*ca*) Whether to enable autosign. Valid values are true (which autosigns any key request, and is a very bad idea), false (which never autosigns any key request), and the path to a file, which uses that configuration file to determine which keys to sign. * **bucketdir** (*filebucket*) Where FileBucket files are stored. * **ca_days** (*ca*) - How long a certificate should be valid. + How long a certificate should be valid. *Deprecated. Use ``ca_ttl'' instead* * **ca_md** (*ca*) The type of hash used in certificates. * **cacert** (*ca*) The CA certificate. * **cacrl** (*ca*) The certificate revocation list (CRL) for the CA. * **cadir** (*ca*) The root directory for the certificate authority. * **cakey** (*ca*) The CA private key. * **capass** (*ca*) Where the CA stores the password for the private key * **caprivatedir** (*ca*) Where the CA stores private certificate information. * **capub** (*ca*) The CA public key. +* **ca_ttl** (*ca*) + + How long newly issued certificates should be valid + * **certdir** (*certificates*) The certificate directory. * **classfile** (*puppetd*) The file in which puppetd stores a list of the classes associated with the retrieved configuratiion. Can be loaded in the separate ``puppet`` executable using the ``--loadclasses`` option. * **color** (*puppet*) Whether to use ANSI colors when logging to the console. * **confdir** (*puppet*) The main Puppet configuration directory. * **config** (*puppetdoc*) The configuration file for puppetdoc. * **configprint** (*puppet*) Print the value of a specific configuration parameter. If a parameter is provided for this, then the value is printed and puppet exits. Comma-separate multiple values. For a list of all values, specify 'all'. * **csrdir** (*ca*) Where the CA stores certificate requests * **dbadapter** (*puppetmaster*) The type of database to use. * **dblocation** (*puppetmaster*) The database cache for client configurations. Used for querying within the language. * **dbname** (*puppetmaster*) The name of the database to use. * **dbpassword** (*puppetmaster*) The database password for Client caching. Only used when networked databases are used. * **dbserver** (*puppetmaster*) The database server for Client caching. Only used when networked databases are used. * **dbuser** (*puppetmaster*) The database user for Client caching. Only used when networked databases are used. * **fileserverconfig** (*fileserver*) Where the fileserver configuration is stored. * **filetimeout** (*puppet*) The minimum time to wait between checking for updates in configuration files. * **genconfig** (*puppet*) Whether to just print a configuration to stdout and exit. Only makes sense when used interactively. Takes into account arguments specified on the CLI. * **genmanifest** (*puppet*) Whether to just print a manifest to stdout and exit. Only makes sense when used interactively. Takes into account arguments specified on the CLI. * **group** (*puppetmasterd*) The group puppetmasterd should run as. * **hostcert** (*certificates*) Where individual hosts store and look for their certificates. * **hostprivkey** (*certificates*) Where individual hosts store and look for their private key. * **hostpubkey** (*certificates*) Where individual hosts store and look for their public key. * **httplog** (*puppetd*) Where the puppetd web server logs. * **ignoreschedules** (*puppetd*) Boolean; whether puppetd should ignore schedules. This is useful for initial puppetd runs. * **keylength** (*ca*) The bit length of keys. * **ldapattrs** (*ldap*) The LDAP attributes to use to define Puppet classes. Values should be comma-separated. * **ldapbase** (*ldap*) The search base for LDAP searches. It's impossible to provide a meaningful default here, although the LDAP libraries might have one already set. Generally, it should be the 'ou=Hosts' branch under your main directory. * **ldapnodes** (*ldap*) Whether to search for node configurations in LDAP. * **ldapparentattr** (*ldap*) The attribute to use to define the parent node. * **ldappassword** (*ldap*) The password to use to connect to LDAP. * **ldapport** (*ldap*) The LDAP port. Only used if ``ldapnodes`` is enabled. * **ldapserver** (*ldap*) The LDAP server. Only used if ``ldapnodes`` is enabled. * **ldapssl** (*ldap*) Whether SSL should be used when searching for nodes. Defaults to false because SSL usually requires certificates to be set up on the client side. * **ldapstring** (*ldap*) The search string used to find an LDAP node. * **ldaptls** (*ldap*) Whether TLS should be used when searching for nodes. Defaults to false because TLS usually requires certificates to be set up on the client side. * **ldapuser** (*ldap*) The user to use to connect to LDAP. Must be specified as a full DN. * **lexical** (*puppet*) Whether to use lexical scoping (vs. dynamic). * **listen** (*puppetd*) Whether puppetd should listen for connections. If this is true, then by default only the ``runner`` server is started, which allows remote authorized and authenticated nodes to connect and trigger ``puppetd`` runs. * **localcacert** (*certificates*) Where each client stores the CA certificate. * **localconfig** (*puppetd*) Where puppetd caches the local configuration. An extension indicating the cache format is added automatically. * **lockdir** (*puppet*) Where lock files are kept. * **logdir** (*puppet*) The Puppet log directory. * **manifest** (*puppetmasterd*) The entry-point manifest for puppetmasterd. * **manifestdir** (*puppetmasterd*) Where puppetmasterd looks for its manifests. * **masterhttplog** (*puppetmasterd*) Where the puppetmasterd web server logs. * **masterlog** (*puppetmasterd*) Where puppetmasterd logs. This is generally not used, since syslog is the default log destination. * **masterport** (*puppetmasterd*) Which port puppetmasterd listens on. * **mkusers** (*puppet*) Whether to create the necessary user and group that puppetd will run as. * **noop** (*puppetd*) Whether puppetd should be run in noop mode. * **paramcheck** (*ast*) Whether to validate parameters during parsing. * **parseonly** (*puppetmasterd*) Just check the syntax of the manifests. * **passfile** (*certificates*) Where puppetd stores the password for its private key. Generally unused. * **plugindest** (*puppet*) Where Puppet should store plugins that it pulls down from the central server. * **pluginpath** (*puppet*) Where Puppet should look for plugins. Multiple directories should be colon-separated, like normal PATH variables. * **pluginsignore** (*puppet*) What files to ignore when pulling down plugins.. * **pluginsource** (*puppet*) From where to retrieve plugins. The standard Puppet ``file`` type is used for retrieval, so anything that is a valid file source can be used here. * **pluginsync** (*puppet*) Whether plugins should be synced with the central server. * **privatedir** (*certificates*) Where the client stores private certificate information. * **privatekeydir** (*certificates*) The private key directory. * **publickeydir** (*certificates*) The public key directory. * **puppetdlockfile** (*puppetd*) A lock file to temporarily stop puppetd from doing anything. * **puppetdlog** (*puppetd*) The log file for puppetd. This is generally not used. * **puppetport** (*puppetd*) Which port puppetd listens on. * **railslog** (*puppetmaster*) Where Rails-specific logs are sent * **report** (*puppetd*) Whether to send reports after every transaction. * **reportdirectory** (*reporting*) The directory in which to store reports received from the client. Each client gets a separate subdirectory. * **reports** (*reporting*) The list of reports to generate. All reports are looked for in puppet/reports/.rb, and multiple report names should be comma-separated (whitespace is okay). * **reportserver** (*puppetd*) The server to which to send transaction reports. * **req_bits** (*ca*) The bit length of the certificates. * **rrddir** (*metrics*) The directory where RRD database files are stored. * **rrdgraph** (*metrics*) Whether RRD information should be graphed. * **rundir** (*puppet*) Where Puppet PID files are kept. * **runinterval** (*puppetd*) How often puppetd applies the client configuration; in seconds * **serial** (*ca*) Where the serial number for certificates is stored. * **server** (*puppetd*) The server to which server puppetd should connect * **setpidfile** (*puppet*) Whether to store a PID file for the daemon. * **signeddir** (*ca*) Where the CA stores signed certificates. * **ssldir** (*puppet*) Where SSL certificates are kept. * **statedir** (*puppet*) The directory where Puppet state is stored. Generally, this directory can be removed without causing harm (although it might result in spurious service restarts). * **statefile** (*puppet*) Where puppetd and puppetmasterd store state associated with the running configuration. In the case of puppetmasterd, this file reflects the state discovered through interacting with clients. * **storeconfigs** (*puppetmaster*) Whether to store each client's configuration. This requires ActiveRecord from Ruby on Rails. * **tags** (*transaction*) Tags to use to find objects. If this is set, then only objects tagged with the specified tags will be applied. Values must be comma-separated. * **templatedir** (*puppet*) Where Puppet looks for template files. * **typecheck** (*ast*) Whether to validate types during parsing. * **usecacheonfailure** (*puppetd*) Whether to use the cached configuration when the remote configuration will not compile. This option is useful for testing new configurations, where you want to fix the broken configuration rather than reverting to a known-good one. * **user** (*puppetmasterd*) The user puppetmasterd should run as. * **vardir** (*puppet*) Where Puppet stores dynamic and growing data. ---------------- *This page autogenerated on Mon Aug 28 02:01:32 CDT 2006*