Hellstorm's questions

I have a dual stack IPv4/IPv6 home connection and want to create an OpenVPN server. My ISP assigns me an /59 IPv6 block, which is not stable and can change at any point (not daily, but it still does). The server runs on a Raspberry Pi with Debian Buster.

Let's say my current prefix assigned from the ISP is dead::beef::/59 and my server has two IPv6 addresses via SLAAC. The first host id is ::1234 (temporary) and the second one is ::9876 (stable). I have a DynDNS entry pointing to dead::beef::9876.

The OpenVPN client connects to dead::beef::9876 via UDP6, the OpenVPN server receives the initial packet but responds via dead::beef::1234. Therefore the connection does not work.

I have managed to bind the OpenVPN server to the stable address via

local dead::beef::9876

, which at least make the client connect. Unfortunately the block could change at any time, so I want to avoid this.

Is there any way to bind the server to the stable host id ::9876, but don't specify the prefix in the host id?

In addition, if I want to use a /64 block for the clients (via the server directive), I can retrieve one via DHCPv6 Prefix delegation from my router. Unfortunately, then I also have to specify the fixed prefix in my config file.

Is there any way to make this specific, too?

Or should I somehow configure a trigger whenever the IP address changes, then generate a new config file and restart the server?

I would like to collect a variable over different classes in Puppet. Is this possible?

For example, I want to assign two classes to a node:

class { "webapplication1": url => 'webapp1.example.com' }
class { "webapplication2": url => 'webapp2.example.com' }

Then I would like to include a different class, webserver which sets up two virtual hosts for each of these two classes. Therefore it should get the two URL variables from both classes. I do not want to pass the URLs as parameters to the new class. For further fun, maybe sometimes I only want to add one class, or some other time I want to add a completely different class (all only with the similarity that they have a url parameter.

How can I collect these? I thought about adding a tag to each class and then collecting them via a resource collector (ok, does not work with classes). But how do I access their parameters?

So then I rather create a defined resource for webapplications, e.g.

webapplication { "webapplication1": url => 'webapp1.example.com' }
webapplication { "webapplication2": url => 'webapp2.example.com' }

But how would I then collect all urls from all webapplications?

Webapplication <| |>

This does not give me any functionality, it seems. Should I put a class around the webapplications which will then create resources?

class webapps (
  Hash $webapps,
) {
  $webapps.each | String $appname, String $parameters | {
    webapp { $appname: 
      * => $parameters,
    }

    apache::vhost { $parameters["url"]:
      #...
    }
  }
}

class { webapps: 
    webapps => {
      'webapplication1' = {
        'url' => 'webapp1.example.com'
      },
      'webapplication2' = {
        'url' => 'webapp2.example.com'
      },
    }
}

(not tested and might look simpler in YAML...). And tips how to start would be greatly appreciated. Just don't know how to nicely do this.

Thanks!

I want to test my control repo (having profiles and roles in it) with rspec-puppet and beaker-rspec. I am still having some trouble with beaker-rspec:

• I would like to test the profiles individually, for example profile::postgresql and see if the database has been installed.
• Then I would also like to test my roles individually, e.g. role::fileserver or role::webserver.

I have set-up beaker-rspec and it works, but it takes a considerable amount of time because it will apply all the profiles one after another. I see the following problems in this:

• If too many profiles get applied to the Vagrant VM, it will get polluted (leftover packages, files etc. from another run, so that the test is not representative anymore)
• Some profiles do not have anything in common or might even contradict them (e.g. nginx vs. apache; they will never be in one role, but are both defined in the control-repo).

What I rather would do is:

• beaker-rspec should check which roles have been defined and then spin up an individual virtual machine for each of the roles.
• These should be done either serially or (better) in parallel.
• How can I reduce the time for each run, especially if having a rather large Puppet setup with multiple roles and different OS versions etc. Maybe select the type of tests (“only role tests” or “only profile tests”).

It would also be ok if beaker-rspec tested every profile in a new VM (but then I would like to switch of the tests for other usage).

How can I accomplish this? Thanks :)

I am currently trying to move our Puppet setup to further use Hiera. In regard to this, I would like to create the users with Hiera, but having some problems how to do this when moving up in the hierarchy.

The scenario is that I want to have a set of base users which are included in every installation. Also, I sometimes need to add some specific users only for a different subset of nodes, maybe specific to some datacenters or to some nodes.

So I thought about the following setup:

hiera.yaml:

:hierarchy:
  - "nodes/%{::trusted.certname}"
  - "datacenter/${::datacenter}"
  - "common"

users.pp:

class profile::users {
  $user_accounts = hiera('user_accounts')
  create_resources(user, $user_accounts)
}

and in common.yaml:

user_accounts:
  bob:
    comment: "Bob"
    managehome: true

and then go up the hierarchy. The main problems I see with this is:

• How do I implement default attributes for each user? For example, in this example, I want to set managehome: true for all users, and not explicitly write it every time. I maybe want to disable it sometimes, though.
• If I have user_accounts further up in the hierarchy, it would overwrite the user_accounts hash from common.yaml, so that I would need to duplicate the entries. I stumbled across the deep merging in Hiera, but wonder if this is actually used or is best practice. Also, it would not solve the first problem, and I need to set merge_behavior in hiera.yaml, which I want to avoid.
• How could I insert ssh keys for every user here? The nicest solution would be to just add the ssh keys as an attribute to the user account.

So, does anyone have an insight how user management is actually nicely done with Puppet? Thanks :)

I am trying to create a letsencrypt module in Puppet. Basically, what I am trying to achieve is the following:

1. Adding a new node and importing my module: class { "letsencrypt": url => "example.com" }
2. The puppet master will then check in his file folder if there is already a private key and a CSR for the given URL and then either:
   • copy the private key and the CSR to the node, or
   • run openssl openssl genrsa 4096 > example.com.key (and one key for the letsencrypt account and the certificate signing request), save it to the puppet files folder and run step 2 again.
3. Setup a cron job on the node to run acme-tiny once every three months.
4. Run acme-tiny once on the node and get the first certificate and reload/start the web server.

Basically my problem is how to do run a command on the puppet master. I would like to run the key generation on the puppet master and have the private key there, and only have the certificate request run on the node.

Is this even possible with Puppet? Or should I pass the complete procedure to the node entirely, not tracking anything in Puppet at all (just setting up the cronjob etc)?

Thanks!