hi If you have a centralized ca you can proxy the certificate traffic to the central puppet ca service (1).
And forward all the other traffic to the local puppet server (2, 3). The snippet requires puppetlabs-apache module > 1.4.1 as it won't include the proxy template with $proxy_pass_match only (it's already fixed on github). - Thomas Docs: 1) https://docs.puppetlabs.com/guides/scaling_multiple_masters.html#option-2-proxy-certificate-traffic 2) https://docs.puppetlabs.com/puppetserver/2.1/external_ssl_termination.html 3) https://docs.puppetlabs.com/puppetserver/2.1/external_ca_configuration.html (relevant: Disabling the Internal Puppet CA Service) include '::apache' apache::vhost { $::fqdn: servername => "${::fqdn}:8140", serveraliases => [ 'puppet', "puppet.${::domain}" ], port => 8140, docroot => '/var/www/html', ssl => true, ssl_ca => '/etc/puppetlabs/puppet/ssl/certs/ca.pem', ssl_cert => "*/etc/puppetlabs/puppet/ssl/certs/*${::fqdn}.pem", ssl_key => "*/etc/puppetlabs/puppet/ssl/private_keys/*${::fqdn}.pem", ssl_crl => '/etc/puppetlabs/puppet/ssl/crl.pem', ssl_verify_client => 'optional', ssl_verify_depth => 1, ssl_proxyengine => true, ssl_options => ['+StdEnvVars', '+ExportCertData'], proxy_pass_match => [ { 'path' => '^/([^/]+/certificate.*)$', 'url' => 'https://puppetca:8140/$1 <https://centralpuppetca:8140/$1>' }, { 'path' => '/(.*)', 'url' => 'http://localhost:18140/$1' }, ], request_headers => [ 'set X-Client-Verify %{SSL_CLIENT_VERIFY}e', 'set X-Client-DN %{SSL_CLIENT_S_DN}e', #'set X-Client-Cert %{SSL_CLIENT_CERT}e', # disabled because of bug SERVER-217 'edit X-Client-DN ^/(CN=.+)$ $1', # workaround for bug SERVER-213 ] } -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/74e381e7-33f2-40a6-b238-33401aff6e8d%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
