add puppet call to copy/paste rules

[mirror/dsa-wiki.git] / input / howto / puppet-setup.mdwn

diff --git a/input/howto/puppet-setup.mdwn b/input/howto/puppet-setup.mdwn
index aad6e4e..6a155d6 100644 (file)
--- a/input/howto/puppet-setup.mdwn
+++ b/input/howto/puppet-setup.mdwn
@@ -27,7 +27,9 @@ client cert.  Now is the time to abort if you are getting cold feet.
 Compare incoming csr request:
 on handel, paste the sha256output::
 
-        : __handel__ && echo "paste sha256sum output now:" &&
+        : __handel__ &&
+                ud-replicate && sudo -u puppet make -C /srv/puppet.debian.org/ca/ install &&
+                echo "paste sha256sum output now:" &&
                 read sha256 filename &&
                 cd /var/lib/puppet/ssl/ca/requests &&
                 ( [ -e $filename ] || (echo "$filename does not exist."; exit 1) ) &&
@@ -40,7 +42,8 @@ on handel, paste the sha256output::
                 echo "cat > /var/lib/puppet/ssl/certs/$filename << EOF " &&
                 cat /var/lib/puppet/ssl/ca/signed/$filename &&
                 echo 'EOF' &&
-                cd /
+                cd / &&
+                echo 'puppet agent -t --pluginsync'
 
 and execute this on the client.
 
@@ -49,21 +52,36 @@ and execute this on the client.
 If this is a busy mail host, you might want to stop exim before proceeding
 although the config files should remain identical before and after.
 
+Try this once if you're nervous:
+
+        : ::client:: && puppet agent -t --pluginsync --noop
+
+It will tell you what would have changed without actually doing it.
+
 Then run (this will change the configs in /etc):
 
         : ::client:: && puppet agent -t --pluginsync
 
-This run will start puppet after reconfiguring it, so if you are 
-unhappy with what just happened, you'll need to stop it again to do 
+This run will start puppet after reconfiguring it, so if you are
+unhappy with what just happened, you'll need to stop it again to do
 repair.
 
 Double check apt - the puppet setup usually results in duplicate apt
 sources, since we ship a few under sources.list.d.  Remove any unnecessary
 entries from sources.list.
 
+On handel, make sure the certs exist for the new host
+
+
 We ship a samhain config file that includes /lib and /usr/lib.  This will
 almost certainly be different than the config file on the machine, so it
 will result in 1000s of files changed.
 You may need to run samhain update after getting puppet going.
 
-# vim:textwidth=72 sw=8 ts=8 et
+The puppet repository is public, but we sometimes need to keep passwords
+in puppet.  There are many ways to do this - hiera-gpg, ENC, etc.  We've
+settled on a fairly simple one.  Log into handel, create a new manifest
+in the relevant module (call is something like "params.pp").  You can add
+passwords to this file.  To stop git complaining on push, make sure you
+update .gitignore for the new file.  Now you can import this file where
+you need passwords and use them.