setup fileserver and add access rights to /etc/puppetlabs/puppetserver/conf.d/auth.conf

[tepecat]

Hey,
I would like setup a fileserver and set access rights, https://puppet.com/docs/puppet/latest/file_serving.html

Atm I did not find a possibility to use this module to configure /etc/puppetlabs/puppetserver/conf.d/auth.conf to add an access rule.

Did I not find the right parameter to configure auth.conf or is it atm not possible to add own config to auth.conf?

Best regards.
thomas.

[ekohl]

There is a parameter auth_template if you want full flexibility. Is that good enough?

[vchepkov]

It would be convenient to just add a rule. For example, this module is very useful
https://github.com/camptocamp/puppet-catalog-diff and one can't easily modify auth.conf to allow necessary access

[ekohl]

Since I don't use that, I don't have time to write a patch but will certainly accept a PR.

[tepecat]

thank you for your suggestions, I will try auth_template and puppet-catalog-diff.

[tepecat]

auth_template is connected to ${puppet_dir}/auth.conf (see manifests/config.pp )and it is only useable, if use-legacy-auth-conf is true.
I am using use-legacy-auth-conf = false, so auth_template is not useable for new auth.conf (puppetserver/conf.d/auth.conf)

I add needed rule for my fileserver into templates/server/puppetserver/conf.d/auth.conf.erb now. Perhaps in a later version of this module it is possible to add additional rules into new auth.conf.

Thank you for your help!

[ekohl]

Ah, you're right. It does appear to be hardcoded:

puppet-puppet/manifests/server/puppetserver.pp

Lines 247 to 250 in f63fdaa

	file { "${server_puppetserver_dir}/conf.d/auth.conf":
	ensure => file,
	content => template('puppet/server/puppetserver/conf.d/auth.conf.erb'),
	}

Sadly, I don't have time to dive into this but a PR is welcome.

[chadh]

My use case is different, but relevant. I need to update the allowed hosts for catalog, node, and report (we use a different node_name_fact than certname). I think allowing the module user to provide a template for the puppetserver auth.conf is probably a good workaround for now. Ideally maybe we would have types for building that file, but I know I don't have the cycles to implement that right now.