Puppet Server

:warning: Tails still uses a different Puppet Server than TPA, but this should change with tpo/tpa/team#41948 and this page should then become obsolete.

SSH config

Add to ~/.ssh/config:

Host puppet.lizard
User puppet
HostName lizard.tails.net
Port 3005

Git repository

git clone puppet.lizard:puppet-code.git --recurse-submodules

We have hooks in place so the above repository mirrors to Tails' GitLab at https://gitlab.tails.boum.org/tails/puppet-code via the role-mirror-to-GitLab GitLab user. For mirroring to work, an SSH key for the puppet@puppet.lizard user must be manually created and uploaded to GitLab:

  1. In the Puppet Server, generate an SSH key for the puppet user with an empty passphrase:

sudo -u puppet ssh-keygen

  1. Login as root to https://gitlab.tails.boum.org and impersonate the role-mirror-to-GitLab user at:

    https://gitlab.tails.boum.org/admin/users/role-mirror-to-GitLab

  2. Add the public part of the generated SSH key to the role-mirror-to-GitLab user's settings at:

    https://gitlab.tails.boum.org/-/profile/keys

SSH "keymaster" and access to GitLab

The Puppet Server is also a "keymaster", as implemented by the puppet-sshkeys module. Keys created and distributed by the keymaster can be seen in the hiera param tails::profile::sshkeymaster::keynames.

Some of those keys need to be installed in GitLab by impersonating specific users and uploading the public part of the generated keys to the user's SSH keys settings (see the section bove for an example).

This is a (possibly non-exhaustive) list of SSH keys generated by Puppet that need to be manually uploaded to GitLab every time the server is reinstalled:

GitLab user SSH key
role-jenkins-isotester root@isoworker*.*
role-jenkins-isotester root@isotester*.*
role-jenkins-isotester root@isobuilder*.*
role-mirror-to-GitLab gitolite@puppet-git.lizard
role-weblate-gatekeeper gitolite@puppet-git.lizard_role-weblate-gatekeeper
role-update-website tails-website@www

Known issues

  • The hiera-eyaml gem needs to be installed manually in the Puppet Server:

puppetserver gem install hiera-eyaml

See: https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1927662.html

  • The gpgme gem from the ruby-gpgme Debian package is not detected by the Puppet Server, and the attempt to install it using puppetserver gem install gpgme fails to build. Because of this, usage of the export_key() function from puppet-yapgp during catalog compilation does not work. Deferring the function to have it run in the node during catalog application seems to work fine.