You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -66,9 +66,9 @@ Basic things you need:
66
66
- a host with internet access, preferable a puppet master. This will be known as *dehydrated\_host* now.
67
67
- a working hook script for dehydrated, for exampes and documentation see [dehydrated-io/dehydrated](https://github.com/dehydrated-io/dehydrated/tree/master/docs)
68
68
- bzed-dehydrated installed as `dehydrated` module in your Puppet environment.
69
-
You will also need recent versions of `puppetlabs-stdlib`, `puppetlabs-concat`, `puppetlabs-vcsrepo`.
70
-
For puppet >= 6.0 you'll also need `puppetlabs-cron\_core`.
71
-
-I'd assume at least puppet version 4.8. Not tested or developed for older version.
69
+
You will also need recent versions of `puppetlabs-stdlib`, `puppetlabs-concat`, `puppetlabs-vcsrepo`, and `puppet-systemd`.
70
+
You'll also need `puppetlabs-cron\_core` (to ensure the legacy cron job is cleaned up).
71
+
-Requires at least Puppet version 8.0.0.
72
72
- Working exportable ressources. Make sure your puppetdb is working well, this module
73
73
heavily depends on it.
74
74
@@ -107,7 +107,7 @@ So for a basic setup, the following steps should give you a running setup.
107
107
}
108
108
109
109
5. Wait.... it will take a few puppet runs until your certificate will appear.
110
-
The certificates will be requestd by a cronjob, not directly from puppet.
110
+
The certificates will be requested by a systemd timer, not directly from puppet.
111
111
Otherwise puppet runs will take way too much time. For detailed description of the workflow see [Deployment workflow
112
112
](#deployment-workflow)
113
113
@@ -140,10 +140,10 @@ With the yaml snippet above you'd request the following certificates:
140
140
141
141
### Monitoring & debugging
142
142
- usual Puppet debugging rules apply >:-)
143
-
- you'll find the output and errors from the last cronjob run in **/opt/dehydrated/status.json**.
143
+
- you'll find the output and errors from the last systemd timer run in **/opt/dehydrated/status.json**.
144
144
Unfortunately proper logging and maybe a better error handling is not implemented yet.
145
145
Pull requests are welcome :-)
146
-
- monitoring the cronjob results is possible by using check\_statusfile. On Debian and derivates
146
+
- monitoring the timer results is possible by using check\_statusfile. On Debian and derivates
147
147
this is available in the _nagios-plugins-contrib_ package. Or find the source here: [check_statusfile](https://github.com/bzed/pkg-nagios-plugins-contrib/blob/master/dsa/checks/dsa-check-statusfile)
@@ -169,7 +169,7 @@ There is also a markdown version in REFERENCE.md
169
169
170
170
## Monitoring
171
171
172
-
The cron-triggered dehydrated worker creates a status file in a format compatible with check\_statusfile, which is - in Debian and derivates - packaged in the _nagios-plugins-contrib_ package.
172
+
The timer-triggered dehydrated worker creates a status file in a format compatible with check\_statusfile, which is - in Debian and derivates - packaged in the _nagios-plugins-contrib_ package.
173
173
If you ar enot using Debian you can retrieve the source code here: [check_statusfile](https://github.com/bzed/pkg-nagios-plugins-contrib/blob/master/dsa/checks/dsa-check-statusfile)
174
174
175
175
## Limitations
@@ -186,8 +186,8 @@ The cerfificates take some time to appear on the target host. This is due to the
186
186
|----|:-----|:-----|:----------|:--------------|
187
187
|1|target|puppet|Create Key and CSR|[dehydrated::certificate](manifests/certificate.pp#L115) [dehydrated::certificate::csr](manifests/certificate/csr.pp#L52-L81)|
188
188
|2|target|puppet|get CSR from `$fact['dehydrated_domains']` and export it as a `dehydrated::certificate::request`.|[dehydrated](manifests/init.pp#L217-L222)|
189
-
|3|*dehydrated\_host*|puppet|Collect all `dehydrated::certificate::request` and save them for the cronjob.|[dehydrated](manifests/init.pp#L235) [dehydrated::certificate::request](manifests/certificate/request.pp) |
190
-
|4|*dehydrated\_host*|cron|finds the files from previous step and requests the certificates.|[dehydrated_job_runner](files/dehydrated_job_runner.rb)|
189
+
|3|*dehydrated\_host*|puppet|Collect all `dehydrated::certificate::request` and save them for the systemd timer.|[dehydrated](manifests/init.pp#L235) [dehydrated::certificate::request](manifests/certificate/request.pp) |
190
+
|4|*dehydrated\_host*|systemd|finds the files from previous step and requests the certificates.|[dehydrated_job_runner](files/dehydrated_job_runner.rb)|
191
191
|5|*dehydrated\_host*|puppet|Find the certificates and export them as `dehydrated::certificate::transfer`|[dehydrated](manifests/init.pp#L243-L247) [dehydrated::certificate:collect](manifests/certificate/collect.pp#L76-L111)|
192
192
|6|target|puppet|Collect all `dehydrated::certificate::transfer` and save them to the files.|[dehydrated](manifests/init.pp#L225-L228) [dehydrated::certificate::transfer](manifests/certificate/transfer.pp)|
193
193
|7.|target|puppet|identify deployed certificates by `$fact['dehydrated_domains::`*dn*`::'ready_for_merge]` and create joined files like `*_fullchain.pem`.|[dehydrated::certificate](manifests/certificate.pp#L123-L131) [dehydrated::certificate::deploy](manifests/certificate/deploy.pp)|
0 commit comments