You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/_openvox_8x/config_about_settings.markdown
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -144,17 +144,17 @@ export LANGUAGE=''
144
144
export LC_ALL=''
145
145
```
146
146
147
-
To set the locale for the Puppet agent service, you can add these `export` statements to:
147
+
To set the locale for the OpenVox agent service, you can add these `export` statements to:
148
148
149
149
-`/etc/sysconfig/puppet` on RHEL and its derivatives
150
150
-`/etc/default/puppet` on Debian, Ubuntu, and their derivatives
151
151
152
152
After updating the file, restart the Puppet service to apply the change.
153
153
154
154
{:.task}
155
-
### Setting your locale for the Puppet agent service on macOS
155
+
### Setting your locale for the OpenVox agent service on macOS
156
156
157
-
To set the locale for the Puppet agent service on macOS, update the `LANG` setting in the `/Library/LaunchDaemons/com.puppetlabs.puppet.plist` file.
157
+
To set the locale for the OpenVox agent service on macOS, update the `LANG` setting in the `/Library/LaunchDaemons/com.puppetlabs.puppet.plist` file.
158
158
159
159
```xml
160
160
<dict>
@@ -181,4 +181,4 @@ Set-WinSystemLocale en-US
181
181
182
182
Puppet 5.3.2 added the optional Boolean `disable_i18n` setting, which you can configure in `puppet.conf`. If set to `true`, Puppet disables localized strings in log messages, reports, and parts of the command-line interface. This can improve performance when using Puppet modules, especially if [environment caching](./environments_creating.markdown#environment_timeout) is disabled, and even if you don't need localized strings or the modules aren't localized. This setting is `false` by default in open source Puppet.
183
183
184
-
If you're experiencing performance issues, configure this setting in the `[master]` section of the Puppet master's `puppet.conf` file. To force unlocalized messages, which are in English by default, configure this section in a node's `[main]` or `[user]` sections of `puppet.conf`.
184
+
If you're experiencing performance issues, configure this setting in the `[server]` section of the OpenVox Server's `puppet.conf` file. To force unlocalized messages, which are in English by default, configure this section in a node's `[main]` or `[user]` sections of `puppet.conf`.
Copy file name to clipboardExpand all lines: docs/_openvox_8x/config_file_auth.markdown
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,9 +34,9 @@ Access to Puppet's HTTPS API is configured in `auth.conf`.
34
34
{:.concept}
35
35
## Puppet's HTTPS API
36
36
37
-
The Puppet agent service requests configurations over HTTPS, and the Puppet master application provides several HTTPS endpoints to support this. (For example, requesting a catalog uses a different endpoint than submitting a report.) There are also a few endpoints that aren't used by Puppet agent.
37
+
The OpenVox agent service requests configurations over HTTPS, and the OpenVox Server application provides several HTTPS endpoints to support this. (For example, requesting a catalog uses a different endpoint than submitting a report.) There are also a few endpoints that aren't used by OpenVox agent.
38
38
39
-
Because some endpoints should have restricted access (for example, a node shouldn't request another node's configuration catalog), the Puppet master has a list of access rules for all of its HTTPS services. You can edit these rules in `auth.conf`.
39
+
Because some endpoints should have restricted access (for example, a node shouldn't request another node's configuration catalog), the OpenVox Server has a list of access rules for all of its HTTPS services. You can edit these rules in `auth.conf`.
40
40
41
41
## Location
42
42
@@ -89,7 +89,7 @@ allow *
89
89
### clients can also access these paths, though they rarely need to.
90
90
91
91
# allow access to the CA certificate; unauthenticated nodes need this
92
-
# in order to validate the puppet master's certificate
92
+
# in order to validate the OpenVox Server's certificate
93
93
path /puppet-ca/v1/certificate/ca
94
94
auth any
95
95
method find
@@ -115,13 +115,13 @@ auth any
115
115
116
116
## Access control behavior
117
117
118
-
Whenever Puppet master receives a valid HTTPS request, it checks it against its full list of authorization rules, in order. As soon as it finds a rule that matches the request, it will use that rule's `allow` and `allow_ip` permissions to decide whether to allow the request. If the request isn't allowed, Puppet will deny it, and will not check any further authorization rules.
118
+
Whenever OpenVox Server receives a valid HTTPS request, it checks it against its full list of authorization rules, in order. As soon as it finds a rule that matches the request, it will use that rule's `allow` and `allow_ip` permissions to decide whether to allow the request. If the request isn't allowed, Puppet will deny it, and will not check any further authorization rules.
119
119
120
120
In other words, authorization rules work like simple firewall rules. If you want to specifically allow a request that could be caught and rejected by some more general rule, you need to put the more specific rule earlier in the auth.conf file.
121
121
122
122
### Default auth rules
123
123
124
-
Puppet master uses two sets of auth rules: the rules from auth.conf, which it checks first, and a set of hardcoded default rules, which it only checks if a request doesn't match any rules in auth.conf.
124
+
OpenVox Server uses two sets of auth rules: the rules from auth.conf, which it checks first, and a set of hardcoded default rules, which it only checks if a request doesn't match any rules in auth.conf.
125
125
126
126
If you are modifying auth.conf at all, **you should never rely on the hardcoded default rules.** Start with [a default auth.conf that explicitly includes copies of all of the default rules][default_file].
127
127
@@ -174,7 +174,7 @@ Which URLs the ACL applies to. **Required.** Must be the first directive in the
174
174
175
175
path /puppet/v3/report
176
176
177
-
If the value of `path` is just an absolute path, Puppet master interprets it as a prefix. The ACL will match any URL that _begins_ with that string.
177
+
If the value of `path` is just an absolute path, OpenVox Server interprets it as a prefix. The ACL will match any URL that _begins_ with that string.
178
178
179
179
#### Regular expression
180
180
@@ -215,7 +215,7 @@ Whether the ACL applies to client-verified or non-client-verified HTTPS requests
215
215
216
216
**Allowed values:**`yes`, `any`, `no` (with `on` and `off` as synonyms). Must be a single value. Optional; defaults to `yes` (verified) if omitted.
217
217
218
-
Puppet agent makes client-verified requests to fetch configuration data and submit reports, but makes unverified requests to ask for a certificate.
218
+
OpenVox agent makes client-verified requests to fetch configuration data and submit reports, but makes unverified requests to ask for a certificate.
219
219
220
220
If you set `auth any`, it allows nodes to access an endpoint without a valid certificate. (Setting it to `no` is not very useful, since it will _reject_ requests that have valid certificates.)
The `autosign.conf` file can allow certain certificate requests to be automatically signed. It is only valid on the CA Puppet master server; a Puppet master not serving as a CA does not use `autosign.conf`.
10
+
The `autosign.conf` file can allow certain certificate requests to be automatically signed. It is only valid on the CA OpenVox Server server; an OpenVox Server not serving as a CA does not use `autosign.conf`.
11
11
12
12
## More about autosigning
13
13
14
-
> **Warning:** Because any host can provide any certname when requesting a certificate, basic autosigning is essentially **insecure**. Use it only when you fully trust any computer capable of connecting to the Puppet master.
14
+
> **Warning:** Because any host can provide any certname when requesting a certificate, basic autosigning is essentially **insecure**. Use it only when you fully trust any computer capable of connecting to the OpenVox Server.
15
15
16
16
Puppet also provides a policy-based autosigning interface using custom policy executables, which can be more flexible and secure than the `autosign.conf` whitelist but more complex to configure.
17
17
18
18
For more information, see [the documentation about certificate autosigning][autosigning].
19
19
20
20
## Location
21
21
22
-
Puppet looks for `autosign.conf` at `$confdir/autosign.conf` by default. To change this path, configure the [`autosign` setting][autosign setting] in the `[master]` section of `puppet.conf`.
22
+
Puppet looks for `autosign.conf` at `$confdir/autosign.conf` by default. To change this path, configure the [`autosign` setting][autosign setting] in the `[server]` section of `puppet.conf`.
23
23
24
24
The default `confdir` path depends on your operating system. [See the confdir documentation for more information.][confdir]
25
25
26
-
> **Note:** The `autosign.conf` file must not be executable by the Puppet master's user account. If the `autosign` setting points to an executable file, Puppet instead treats it like a custom policy executable even if it contains a valid `autosign.conf` whitelist.
26
+
> **Note:** The `autosign.conf` file must not be executable by the OpenVox Server's user account. If the `autosign` setting points to an executable file, Puppet instead treats it like a custom policy executable even if it contains a valid `autosign.conf` whitelist.
27
27
28
28
## Format
29
29
30
-
The `autosign.conf` file is a line-separated list of certnames or domain name globs. Each line represents a node name or group of node names for which the CA Puppet master will automatically sign certificate requests.
30
+
The `autosign.conf` file is a line-separated list of certnames or domain name globs. Each line represents a node name or group of node names for which the CA OpenVox Server will automatically sign certificate requests.
31
31
32
32
```
33
33
rebuilt.example.com
@@ -39,4 +39,4 @@ Domain name globs do not function as normal globs: an asterisk can only represen
39
39
40
40
> **Note:** The `autosign.conf` file can safely be an empty file or not-existent, even if the `autosign` setting is enabled. An empty or non-existent `autosign.conf` file is an empty whitelist, meaning that Puppet does not autosign any requests. If you create `autosign.conf` as a non-executable file and add certnames to it, Puppet then automatically uses the file to whitelist incoming requests without needing to modify `puppet.conf`.
41
41
>
42
-
> To _explicitly_ disable autosigning, set `autosign = false` in the `[master]` section of the CA Puppet master's `puppet.conf`, which disables CA autosigning even if `autosign.conf` or a custom policy executable exists.
42
+
> To _explicitly_ disable autosigning, set `autosign = false` in the `[server]` section of the CA OpenVox Server's `puppet.conf`, which disables CA autosigning even if `autosign.conf` or a custom policy executable exists.
Any [environment][] can contain an `environment.conf` file. This file can override several settings whenever the Puppet master is serving nodes assigned to that environment.
14
+
Any [environment][] can contain an `environment.conf` file. This file can override several settings whenever the OpenVox Server is serving nodes assigned to that environment.
15
15
16
16
## Location
17
17
@@ -68,7 +68,7 @@ That is, Puppet will add the environment's `modules` directory to the value of t
68
68
69
69
### `manifest`
70
70
71
-
The [main manifest][] the Puppet master will use when compiling catalogs for this environment. This can be one file or a directory of manifests to be evaluated in alphabetical order. Puppet manages this path as a directory if one exists or if the path ends with a slash (`/`) or dot (`.`).
71
+
The [main manifest][] the OpenVox Server will use when compiling catalogs for this environment. This can be one file or a directory of manifests to be evaluated in alphabetical order. Puppet manages this path as a directory if one exists or if the path ends with a slash (`/`) or dot (`.`).
72
72
73
73
If this setting isn't set, Puppet will use the environment's `manifests` directory as the main manifest, even if it is empty or absent. A directory environment will never use the global `manifest` from [puppet.conf][].
74
74
@@ -86,7 +86,7 @@ If this setting isn't set, the config version will be the **time** at which the
86
86
87
87
### `environment_timeout`
88
88
89
-
How long the Puppet master should cache the data it loads from an environment. If present, this will override the value of `environment_timeout` from [puppet.conf][].
89
+
How long the OpenVox Server should cache the data it loads from an environment. If present, this will override the value of `environment_timeout` from [puppet.conf][].
90
90
91
91
* Unless you have a specific reason, we recommend only setting `environment_timeout` globally, in puppet.conf.
92
92
* We also don't recommend using any value other than `0` or `unlimited`.
The `puppet.conf` file is Puppet's main config file. It configures all of the Puppet commands and services, including Puppet agent, Puppet master, Puppet apply, and Puppet cert. Nearly all of the settings listed in the [configuration reference][conf_ref] can be set in puppet.conf.
18
+
The `puppet.conf` file is Puppet's main config file. It configures all of the Puppet commands and services, including OpenVox agent, OpenVox Server, Puppet apply, and Puppet cert. Nearly all of the settings listed in the [configuration reference][conf_ref] can be set in puppet.conf.
19
19
20
20
It resembles a standard INI file, with a few syntax extensions. Settings can go into application-specific sections, or into a `[main]` section that affects all applications.
@@ -85,15 +85,15 @@ As soon as a new config section `[name]` appears in the file, the former config
85
85
Puppet uses four **config sections**:
86
86
87
87
*`main` is the global section used by all commands and services. It can be overridden by the other sections.
88
-
*`master` is used by the Puppet master service and the Puppet cert command.
89
-
*`agent` is used by the Puppet agent service.
88
+
*`master` is used by the OpenVox Server service and the Puppet cert command.
89
+
*`agent` is used by the OpenVox agent service.
90
90
*`user` is used by the Puppet apply command, as well as many of the less common [Puppet subcommands][subcommands].
91
91
92
92
Puppet prefers to use settings from one of the three application-specific sections (`master`, `agent`, or `user`). If it doesn't find a setting in the application section, it will use the value from `main`. (If `main` doesn't set one, it will fall back to the default value.)
93
93
94
94
### Puppet Server ignores some config settings
95
95
96
-
If you're using Puppet Server, you should note that it honors almost all settings in `puppet.conf` and should pick them up automatically. However, [some Puppet Server settings differ from a Ruby Puppet master’s `puppet.conf` settings][puppetserver_diff].
96
+
If you're using Puppet Server, you should note that it honors almost all settings in `puppet.conf` and should pick them up automatically. However, [some Puppet Server settings differ from a Ruby OpenVox Server’s `puppet.conf` settings][puppetserver_diff].
97
97
98
98
### Comment lines
99
99
@@ -144,7 +144,7 @@ You generally shouldn't do this, as the defaults are good for most users. Howeve
144
144
The allowed keys in the hash are `owner`, `group`, and `mode`. There are only two valid values for the `owner` and `group` keys:
145
145
146
146
*`root` --- the root or Administrator user or group should own the file.
147
-
*`service` --- the user or group that the Puppet service is running as should own the file. (The service's user and group are specified by the `user` and `group` settings. On a Puppet master running open source Puppet, these default to `puppet`; on Puppet Enterprise they default to `pe-puppet`.)
147
+
*`service` --- the user or group that the Puppet service is running as should own the file. (The service's user and group are specified by the `user` and `group` settings. On an OpenVox Server running open source Puppet, these default to `puppet`; on Puppet Enterprise they default to `pe-puppet`.)
The `custom_trusted_oid_mapping.yaml` file lets you set your own short names for [certificate extension][extensions] object identifiers (OIDs), which can make [the `$trusted` variable][trusted] more useful.
13
13
14
-
It is only valid on a Puppet master server; in Puppet apply, the compiler doesn't add certificate extensions to `$trusted`.
14
+
It is only valid on an OpenVox Server server; in Puppet apply, the compiler doesn't add certificate extensions to `$trusted`.
15
15
16
16
## More about certificate extensions
17
17
18
-
When a node requests a certificate, it can ask the CA to include some additional, permanent metadata in that cert. (Puppet agent uses [the `csr_attributes.yaml` file][csr_attributes] to decide what extensions to request.)
18
+
When a node requests a certificate, it can ask the CA to include some additional, permanent metadata in that cert. (OpenVox agent uses [the `csr_attributes.yaml` file][csr_attributes] to decide what extensions to request.)
19
19
20
20
If the CA signs a certificate with extensions included, those extensions are available as [trusted facts][trusted] in the top-scope `$trusted` variable. Your manifests or node classifier can then use those trusted facts to decide which nodes can receive which configurations.
The `puppetdb.conf` file configures how Puppet should connect to one or more [PuppetDB](/openvoxdb/latest/) servers. It is only used if you are using PuppetDB and have [connected your Puppet master to it](/openvoxdb/latest/connect_puppet_master.html).
9
+
The `puppetdb.conf` file configures how Puppet should connect to one or more [PuppetDB](/openvoxdb/latest/) servers. It is only used if you are using PuppetDB and have [connected your OpenVox Server to it](/openvoxdb/latest/connect_puppet_master.html).
0 commit comments