Puppet单台架构扩展（nginx/apache + passenger）

gqinvs

　　系统环境：rhel6.5，puppet 3.7.4
　　Master server1.example.com(192.168.88.128)
　　Agent server2.example.com(192.168.88.129)
　　原理：使用apache或nginx代替puppet原生态的Webrick以提升master的吞吐量，在master上启webserver以负责监听8140端口并处理客户端的请求、file文件以及验证的客户端请求，将编译部分代理转发到后端的master。极大扩展master能够管理的节点的数量。
Apache+passenger；
　　一．安装apache和passenger：
　　yum install httpd httpd-devel  mod_ssl  gcc gcc-c++ ruby-devel rubygems
　　安装passenger
　　gem installrack passenger（安装过程较慢）#rack 用来让webserver和puppet交换请求和相应的一些                                         常用API
　　passenger-install-apache2-module   #安装apache模版
　　#有时gem安装失败，基本是网络原因，更换gem仓库
　　gem sources –-remove https://rubygems.org/
　　gem sources -a  http://ruby.taobao.org/                    #淘宝的gem镜像源
　　二．配置apache
　　[root@server1 rack]# pwd
　　/usr/share/puppet/ext/rack                                #配置文件模板位置
　　[root@server1 rack]# passenger-config   --root #passengerroot 目录
　　/usr/lib/ruby/gems/1.8/gems/passenger-5.0.6
　　mkdir /etc/puppet/rack/
　　cd /etc/puppet/rack
　　cp example-passenger-vhost.conf/etc/httpd/conf.d/passenger.conf
　　cp config.ru   /etc/puppet/rack/
　　[root@server1 rack]# ll
　　-rw-r--r-- 1 puppet puppet 1229 Apr 19 09:21 config.ru
　　drwxr-xr-x 2 root   root  4096 Apr 19 09:20 public
　　drwxr-xr-x 2 root   root  4096 Apr 19 09:22 tmp
　　[root@server1 rack]# cat/etc/httpd/conf.d/passenger.conf
　　# This Apache 2 virtual host config showshow to use Puppet as a Rack
　　# application via Passenger. See
　　#http://docs.puppetlabs.com/guides/passenger.html for more information.
　　LoadModule passenger_module/usr/lib/ruby/gems/1.8/gems/passenger-5.0.6/buildout/apache2/mod_passenger.so
　　PassengerRoot /usr/lib/ruby/gems/1.8/gems/passenger-5.0.6
　　PassengerDefaultRuby /usr/bin/ruby             # passenger-install-apache2-module提供的模块
　　# You can also use the included config.rufile to run Puppet with other Rack
　　# servers instead of Passenger.
　　# you probably want to tune these settings
　　PassengerHighPerformance on
　　PassengerMaxPoolSize 12
　　PassengerPoolIdleTime 1500
　　# PassengerMaxRequests 1000
　　PassengerStatThrottleRate 120
　　#RackAutoDetectOff
　　#RailsAutoDetectOff
　　Listen 8140
　　<VirtualHost *:8140>
　　SSLEngine on
　　SSLProtocol             ALL -SSLv2-SSLv3
　　SSLCipherSuite         EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
　　SSLHonorCipherOrder     on
　　SSLCertificateFile      /var/lib/puppet/ssl/certs/server1.example.com.pem
　　SSLCertificateKeyFile   /var/lib/puppet/ssl/private_keys/server1.example.com.pem
　　SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
　　SSLCACertificateFile    /var/lib/puppet/ssl/ca/ca_crt.pem
　　# If Apache complains about invalid signatures on the CRL, you can trydisabling
　　# CRL checking by commenting the next line, but this is not recommended.
　　SSLCARevocationFile     /var/lib/puppet/ssl/ca/ca_crl.pem
　　# Apache 2.4 introduces the SSLCARevocationCheck directive and sets itto none
　　# which effectively disables CRL checking; if you are using Apache 2.4+you must
　　# specify 'SSLCARevocationCheck chain' to actually use the CRL.
　　# SSLCARevocationCheck chain
　　SSLVerifyClient optional
　　SSLVerifyDepth  1
　　# The `ExportCertData` option is needed for agent certificate expirationwarnings
　　SSLOptions +StdEnvVars +ExportCertData
　　# This header needs to be set if using a loadbalancer or proxy
　　RequestHeader unset X-Forwarded-For
　　RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
　　RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
　　RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
　　DocumentRoot /etc/puppet/rack/public/
　　RackBaseURI /
　　<Directory /etc/puppet/rack/>
　　Options None
　　AllowOverride None
　　Order allow,deny
　　allow from all
　　</Directory>
　　</VirtualHost>
　　Stop puppetmaster(8140) ;start httpd;
　　检测：端口；在agent上测试：puppet agent --server=server1.example.com --test
　　Master日志：
　　[root@server1 rack]# cat  /etc/httpd/logs/access_log
　　192.168.88.129 - - [19/Apr/2015:09:45:49+0800] "GET /production/node/server2.example.com?fail_on_404=true&transaction_uuid=9823f7a3-0603-48c4-8c27-613697be985cHTTP/1.1" 200 4437 "-" "-"
　　192.168.88.129 - - [19/Apr/2015:09:45:51+0800] "GET/production/file_metadatas/pluginfacts?checksum_type=md5&ignore=.svn&ignore=CVS&ignore=.git&recurse=true&links=manageHTTP/1.1" 200283 "-" "-"
　　192.168.88.129 - - [19/Apr/2015:09:45:51+0800] "GET/production/file_metadatas/plugins?checksum_type=md5&ignore=.svn&ignore=CVS&ignore=.git&recurse=true&links=manageHTTP/1.1" 200 283 "-" "-"
　　192.168.88.129 - - [19/Apr/2015:09:45:51+0800] "POST /production/catalog/server2.example.com HTTP/1.1" 20040146 "-" "-"
　　192.168.88.129 - - [19/Apr/2015:09:45:53+0800] "PUT/production/report/server2.example.com HTTP/1.1" 200 8 "-""
　　查看passenger状态：passenger-status

Nginx+passenger
　　yum install -y gcc gcc-c++ curl-devel zlib-devel openssl-develruby-devel
　　gem install rack passenger
　　passenger-install-nginx-module
　　脚本会自动安装nginx支持，按提示操作，基本就是一路回车。(中间选1自动下载安装，选2为安装本地nginx包)
　　http {
　　passenger_root/usr/lib/ruby/gems/1.8/gems/passenger-5.0.6;
　　passenger_ruby/usr/bin/ruby;                     #默认已配置好
　　server {
　　listen 8140;
　　server_name server1.example.com;
　　root /etc/puppet/rack/public;
　　passenger_enabled on;
　　#passenger5.0后换成这个命令，之前的是
　　#passenger_set_cgi_param HTTP_X_CLIENT_DN           $ssl_client_s_dn;
　　#passenger_set_cgi_param HTTP_X_CLIENT_VERIFY    $ssl_client_verify;
　　passenger_set_headerX_CLIENT_DN $ssl_client_s_dn;
　　passenger_set_headerX_CLIENT_VERIFY $ssl_client_verify;
　　ssl on;
　　ssl_session_timeout 5m;
　　ssl_certificate        /var/lib/puppet/ssl/certs/server1.example.com.pem;
　　ssl_certificate_key    /var/lib/puppet/ssl/private_keys/server1.example.com.pem;
　　ssl_client_certificate  /var/lib/puppet/ssl/ca/ca_crt.pem;
　　ssl_crl        /var/lib/puppet/ssl/ca/ca_crl.pem;
　　ssl_verify_client        optional;
　　ssl_ciphers     SSLv2:-LOW:-EXPORT:RC4+RSA;
　　ssl_prefer_server_ciphers       on;
　　ssl_verify_depth        1;
　　ssl_session_cache      shared:SSL:128m;
　　}
　　启动nginx即可；