Configure Puppet Master with Passenger and Apache on Centos

舒畅

What is Passenger?
　　Passenger (AKA mod_rails or mod_rack) is an Apache 2.x module which lets you run Rails or Rack applications inside a general purpose web server, like Apache httpd or nginx.
Install Apache and Passenger
　　Make sure puppet master has been run at least once (or puppet agent, if this master is not the CA), so that all required SSL certificates are in place.
Install Apache 2
　　[iyunv@centos ~]# yum install httpd httpd-devel mod_ssl ruby-devel rubygems gcc
　　Installed:
  gcc.x86_64 0:4.4.7-11.el6     httpd.x86_64 0:2.2.15-39.el6.centos     httpd-devel.x86_64 0:2.2.15-39.el6.centos     mod_ssl.x86_64 1:2.2.15-39.el6.centos     ruby-devel.x86_64 0:1.8.7.374-2.el6
　　Complete!
Install Rack/Passenger
　　[iyunv@centos ~]# gem install rack passenger
Successfully installed rack-1.5.2
Building native extensions.  This could take a while...
Successfully installed rake-10.3.2
Successfully installed daemon_controller-1.2.0
Successfully installed passenger-4.0.53
4 gems installed
Installing ri documentation for rack-1.5.2...
Installing ri documentation for rake-10.3.2...
Installing ri documentation for daemon_controller-1.2.0...
Installing ri documentation for passenger-4.0.53...
Installing RDoc documentation for rack-1.5.2...
Installing RDoc documentation for rake-10.3.2...
Installing RDoc documentation for daemon_controller-1.2.0...
Installing RDoc documentation for passenger-4.0.53...
　　[iyunv@centos ~]# yum install zlib-devel openssl-devel libcurl-devel gcc-c++
　　Installed:
  gcc-c++.x86_64 0:4.4.7-11.el6               libcurl-devel.x86_64 0:7.19.7-37.el6_5.3               openssl-devel.x86_64 0:1.0.1e-30.el6_6.2               zlib-devel.x86_64 0:1.2.3-29.el6  
　　Complete!
　　[iyunv@centos ~]# passenger-install-apache2-module
Welcome to the Phusion Passenger Apache 2 module installer, v4.0.53.
　　This installer will guide you through the entire installation process. It
shouldn't take more than 3 minutes in total.
　　Here's what you can expect from the installation process:
　　1. The Apache 2 module will be installed for you.
2. You'll learn how to configure Apache.
3. You'll learn how to deploy a Ruby on Rails application.
　　Don't worry if anything goes wrong. This installer will advise you on how to
solve any problems.
　　Press Enter to continue, or Ctrl-C to abort.
　　--------------------------------------------
　　Which languages are you interested in?
　　Use  to select.
If the menu doesn't display correctly, press '!'
　　??猬? Ruby
   猬? Python
   猬? Node.js
   猬? Meteor
　　--------------------------------------------
　　Checking for required software...
　　* Checking for C compiler...
      Found: yes
      Location: /usr/bin/cc
* Checking for C++ compiler...
      Found: yes
      Location: /usr/bin/c++
* Checking for Curl development headers with SSL support...
      Found: yes
      Usable: yes
      Header location: /usr/include/curl/curl.h
      Supports SSL: yes
      curl-config location: /usr/bin/curl-config
      Version: libcurl 7.19.7
* Checking for OpenSSL development headers...
      Found: yes
      Location: /usr/include/openssl/ssl.h
* Checking for Zlib development headers...
      Found: yes
      Location: /usr/include/zlib.h
* Checking for Apache 2...
      Found: yes
      Location of httpd: /usr/sbin/httpd
      Apache version: 2.2.15
* Checking for Apache 2 development headers...
      Found: yes
      Location of apxs2: /usr/sbin/apxs
* Checking for Rake (associated with /usr/bin/ruby)...
      Found: yes
      Location: /usr/bin/ruby /usr/bin/rake
* Checking for OpenSSL support for Ruby...
      Found: yes
* Checking for RubyGems...
      Found: yes
* Checking for Ruby development headers...
      Found: yes
      Location: /usr/lib64/ruby/1.8/x86_64-linux/ruby.h
* Checking for rack...
      Found: yes
* Checking for Apache Portable Runtime (APR) development headers...
      Found: yes
      Location: /usr/bin/apr-1-config
      Version: 1.3.9
* Checking for Apache Portable Runtime Utility (APU) development headers...
      Found: yes
      Location: /usr/bin/apu-1-config
      Version: 1.3.9
　　--------------------------------------------
　　Sanity checking Apache installation...
All good!
　　--------------------------------------------
Almost there!
　　Please edit your Apache configuration file, and add these lines:
　　LoadModule passenger_module /usr/lib/ruby/gems/1.8/gems/passenger-4.0.53/buildout/apache2/mod_passenger.so
   
     PassengerRoot /usr/lib/ruby/gems/1.8/gems/passenger-4.0.53
     PassengerDefaultRuby /usr/bin/ruby
   
　　After you restart Apache, you are ready to deploy any number of web
applications on Apache, with a minimum amount of configuration!
　　Press ENTER to continue.
Configure Apache
Keepalive Timeout
　　Make sure Apache’s KeepAliveTimeout setting is set to at least 5. (my default is 15, [iyunv@centos ~]# vim /etc/httpd/conf/httpd.conf)
Install the Puppet Master Rack Application
　　Your copy of Puppet includes a config.ru file, which tells Rack how to spawn puppet master processes. To install this Rack application in a form Passenger can use, you’ll need to:

• Create three directories for the application (a parent directory, a “public” directory, and a “tmp” directory)
  
• Copy the ext/rack/config.ru file from the Puppet source code into the parent directory
  
• Set the ownership of the config.ru file
  

　　[iyunv@centos ~]# mkdir -p /usr/share/puppet/rack/puppetmasterd
[iyunv@centos ~]# mkdir /usr/share/puppet/rack/puppetmasterd/public /usr/share/puppet/rack/puppetmasterd/tmp
[iyunv@centos ~]# cp /usr/share/puppet/ext/rack/config.ru /usr/share/puppet/rack/puppetmasterd/
[iyunv@centos ~]# chown puppet:puppet /usr/share/puppet/rack/puppetmasterd/config.ru
Create and Enable the Puppet Master Vhost
　　See “Example Vhost Configuration” below for the contents of this vhost file. Note that the vhost’sDocumentRoot directive refers to the Rack application directory you created above.
　　[iyunv@centos ~]# cp /usr/share/puppet/ext/rack/example-passenger-vhost.conf /etc/httpd/conf.d/puppetmaster.conf
　　[iyunv@centos httpd]# vim /etc/httpd/conf.d/puppetmaster.conf
　　# you probably want to tune these settings
#
LoadModule passenger_module /usr/lib/ruby/gems/1.8/gems/passenger-4.0.53/buildout/apache2/mod_passenger.so
   
     PassengerRoot /usr/lib/ruby/gems/1.8/gems/passenger-4.0.53
     PassengerDefaultRuby /usr/bin/ruby
   
　　PassengerHighPerformance on
PassengerMaxPoolSize 12
PassengerPoolIdleTime 1500
# PassengerMaxRequests 1000
PassengerStatThrottleRate 120
#RackAutoDetect Off
#RailsAutoDetect Off
　　Listen 8140
　　
        SSLEngine on
        SSLProtocol             ALL -SSLv2 -SSLv3
        SSLCipherSuite          EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
        SSLHonorCipherOrder     on
　　SSLCertificateFile      /var/lib/puppet/ssl/certs/centos.test.com.pem
        SSLCertificateKeyFile   /var/lib/puppet/ssl/private_keys/centos.test.com.pem
        SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
        SSLCACertificateFile    /var/lib/puppet/ssl/ca/ca_crt.pem
        # If Apache complains about invalid signatures on the CRL, you can try disabling
        # CRL checking by commenting the next line, but this is not recommended.
        SSLCARevocationFile     /var/lib/puppet/ssl/ca/ca_crl.pem
        # SSLCARevocationCheck chain
        SSLVerifyClient optional
        SSLVerifyDepth  1
        # The `ExportCertData` option is needed for agent certificate expiration warnings
        SSLOptions +StdEnvVars +ExportCertData
　　# This header needs to be set if using a loadbalancer or proxy
        RequestHeader unset X-Forwarded-For
　　RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
        RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
        RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
　　DocumentRoot /usr/share/puppet/rack/puppetmasterd/public/
        RackBaseURI /
        
                Options None
                AllowOverride None
                Order allow,deny
                allow from all
        
ErrorLog /var/log/httpd/centos.test.com_error.log
CustomLog /var/log/httpd/centos.test.com_ssl_access.log combined
　　
Start or Restart the Apache service
　　[iyunv@centos httpd]# /etc/init.d/puppetmaster stop
　　[iyunv@centos httpd]# /etc/init.d/httpd start
Test on puppet agent
　　[iyunv@yum01 ~]# puppet agent --test
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for yum01.test.com
Info: Applying configuration version '1414995991'
Reference
　　https://docs.puppetlabs.com/guides/passenger.html