Home / server / Questions / 355214
Accepted
troutwine
Asked: 2012-01-31 14:20:45 +0800 CST

Why does this nginx/thin run puppet master interpret paths differently than a lone puppetmasterd?

  • 772

For the purposes of this question I need to make a distinction between my Production puppet master and my Development puppet master. In either case, my /etc/puppet/puppet.conf is:

[main]
ssldir=$vardir/ssl

[master]
certname=puppet

Development puppet master is run:

# puppetmasterd --debug --no-daemonize

and Production puppet master is a thin/nginx affair. The relevant nginx configuration files:

# /etc/nginx/sites-enabled/default
upstream puppet-production {
    server   unix:/var/run/puppet/master.00.sock;
    server   unix:/var/run/puppet/master.01.sock;
    server   unix:/var/run/puppet/master.02.sock;
}

server {
    listen puppet:8140;
    include conf.d/puppet_ssl.conf;
    include conf.d/puppet_proxy_set_header.conf;

    default_type application/x-raw;

    location /production/file_content/ {
        rewrite ^/production/file_content/([^/]+)/(.*) /$1/files/$2;
        break;
        root /etc/puppet/modules/;
    }
    location / {
        proxy_pass http://puppet-production;
    }
}

and

# /etc/nginx/conf.d/puppet_proxy_set_header.conf 
proxy_redirect         off; 
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $remote_addr;
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header    X-Client-Verify  $ssl_client_verify;
proxy_set_header    X-Client-Verify  SUCCESS;
proxy_set_header    X-Client-DN $ssl_client_s_dn;
proxy_set_header    X-SSL-Subject    $ssl_client_s_dn;
proxy_set_header    X-SSL-Issuer     $ssl_client_i_dn;

and

# /etc/nginx/conf.d/puppet_ssl.conf

ssl on; 
ssl_certificate /var/lib/puppet/ssl/certs/puppet.pem;
ssl_certificate_key /var/lib/puppet/ssl/private_keys/puppet.pem;
ssl_ciphers ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;
ssl_client_certificate  /var/lib/puppet/ssl/ca/ca_crt.pem;
ssl_verify_client       on;

The relevant thin configuration files:

#/etc/puppet/config.ru 

# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.

# if puppet is not in your RUBYLIB:
# $:.unshift('/opt/puppet/lib')

$0 = "master"

# if you want debugging:
# ARGV << "--debug"

ARGV << "--rack"
require 'puppet/application/master'
# we're usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Application[:master].run

and

# /etc/supervisor/conf.d/puppetmaster.conf 

# This file is autogenerated by Puppet. Manual changes will be overwritten!
[program:puppetmaster]
command=/usr/bin/thin start -e development --socket /var/run/puppet/master.%(process_num)02d.sock --user puppet --group puppet --chdir /etc/puppet -R /etc/puppet/config.ru
process_name=%(program_name)s_%(process_num)02d
numprocs=3
priority=999
autostart=true
autorestart=unexpected
startsecs=3
startretries=3
exitcodes=0,2
stopsignal=TERM
stopwaitsecs=10
redirect_stderr=false
stdout_logfile=/var/log/supervisor/puppetmaster/puppetmaster.out
stdout_logfile_maxbytes=250MB
stdout_logfile_backups=10
stderr_logfile=/var/log/supervisor/puppetmaster/puppetmaster.err
stderr_logfile_maxbytes=250MB
stderr_logfile_backups=10

Using puppet-module-supervisor I find that the source line path in manifests/init.pp causes a 404 when running in Production mode:

'/etc/logrotate.d/supervisor':
 source => 'puppet:///modules/supervisor/logrotate',
 require => Package[$supervisor::params::package];

but if I modify the path to be simply puppet:///supervisor/logrotate all is well. The first and second form succeed in Development mode. It's my understanding that the first form is correct and that my Production mode should have no issues with it.

Running puppet agent --test when master is configured in Production mode results in:

# puppet agent --test
info: Caching catalog for puppet.troutwine.us
info: Applying configuration version '1327957286'
err: /Stage[main]/Supervisor/File[/etc/logrotate.d/supervisor]/ensure: change from absent to file failed: Could not set 'file on ensure: Error 404 on SERVER: <html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.1.8</center>
</body>
</html>
 at /etc/puppet/modules/supervisor/manifests/init.pp:32
notice: Finished catalog run in 1.65 seconds

and the logs from /var/log/nginx/access.log

# cat /var/log/nginx/{access,error}.log
127.0.1.1 - - [30/Jan/2012:20:50:58 +0000] "POST /production/catalog/puppet.troutwine.us HTTP/1.1" 200 13290 "-" "Ruby"
127.0.1.1 - - [30/Jan/2012:20:51:00 +0000] "GET  /production/file_metadata/modules/supervisor/logrotate? HTTP/1.1" 200 308 "-" "Ruby"
127.0.1.1 - - [30/Jan/2012:20:51:00 +0000] "GET /production/file_content/modules/supervisor/logrotate HTTP/1.1" 404 168 "-" "Ruby"
127.0.1.1 - - [30/Jan/2012:20:51:01 +0000] "PUT /production/report/puppet.troutwine.us HTTP/1.1" 200 14 "-" "Ruby"

2012/01/30 20:51:00 [error] 10716#0: *222 open() "/etc/puppet/modules/modules/files/supervisor/logrotate" failed (2: No such file or directory), client: 127.0.1.1, server: , request: "GET /production/file_content/modules/supervisor/logrotate HTTP/1.1", host: "puppet:8140"

Details about my environment:

# puppet --version
2.7.9
# cat /etc/debian_version
6.0.3
# ruby -v
ruby 1.9.2p0 (2010-08-18 revision 29036) [i486-linux]

Anyone have an inkling of what's going wrong?

debian puppet nginx thin

1 Answers

  1. Best Answer

    The path that the client node is requesting is:

    /production/file_content/modules/supervisor/logrotate

    While the nginx config as written seems to be expecting:

    /production/file_content/supervisor/logrotate

    So, modules is caught by the first capture and supervisor/logrotate is caught by the second capture; the files that needs to go between the module name and the file name is not in the right place and modules gets doubled:

    "/etc/puppet/modules/modules/files/supervisor/logrotate" failed (2: No such file or directory)

    Seems like you could just change your rewrite rule to this:

    rewrite ^/production/file_content/modules/([^/]+)/(.*) /$1/files/$2;
    • 1