Ashay Humane ashayh

The problem

There's enough trouble with puppet's ssl model (mandatory client certs) that people go and do odd things to get around it. The primary problem is that for lab/preproduction environments, if you reinstall machines frequently, you lose access to the private key that generated the original cert but (absent some puppet cert --clean [node] operation) the cert still exists, leading to the dreaded Retrieved certificate doesn't match private key error.

A solution

Generate a single client certificate which all your nodes use, and have the master determine node names from facter rather than the SSL DN. This way you can re-install nodes with impunity and as long as your bootstrap plops down the correct config and the cert+key, you don't have any more SSL issues.

The caveats

If you have autosign turned on, this change represents a shift in security tradeoffs: you can turn off autosign and therefore more tightly control which clients can talk to your server because they need to have your clie

Add the following chunk to your existing ISC dhcpd.conf file.

if exists user-class and ( option user-class = "iPXE" ) {
    filename "http://boot.smidsrod.lan/boot.ipxe";
}
else {
    filename "undionly.kpxe";
}

(or see https://gist.github.com/4008017 for a more elaborate setup

OS X Screencast to animated GIF

This gist shows how to create a GIF screencast using only free OS X tools: QuickTime, ffmpeg, and gifsicle.

Instructions

To capture the video (filesize: 19MB), using the free "QuickTime Player" application:

	## DNS

	@dns = Fog::DNS.new(:provider => 'Linode', :linode_api_key => LINODE_KEY)
	if @zone = @dns.zones.all.find { \|z\| z.domain == ZONE }
	puts "Found zone #{@zone.inspect}"
	else
	@zone = @dns.zones.create(:domain => ZONE, :email => ZONE_EMAIL)
	puts "Creating zone #{@zone.inspect}"
	end

	Then(/^I should see (.+) table$/) do \|table_id, expected_table\|
	html_table = table_at("##{table_id.parameterize.tableize}").to_a
	html_table.map! { \|r\| r.map! { \|c\| c.gsub(/<.+?>/, '').gsub(/[\n\t\r]/, '') } }
	expected_table.diff!(html_table)
	end

	.DS_Store
	Gemfile.lock
	*.pem
	node.json
	tmp/*
	!tmp/.gitignore

	#!/usr/bin/env ruby

	require 'rubygems'
	require 'rest-client'
	require 'json'
	client = RestClient::Resource.new('http://0.0.0.0:3000',
	:user => 'admin',
	:password => 'changeme',
	:headers => { :accept => :json })

	#!/usr/bin/env ruby

	require 'ostruct'

	class LinuxProcess < OpenStruct

	def initialize(args)
	super
	read_status!
	end

	# This is free and unencumbered software released into the public domain.
	#
	# Anyone is free to copy, modify, publish, use, compile, sell, or
	# distribute this software, either in source code form or as a compiled
	# binary, for any purpose, commercial or non-commercial, and by any
	# means.
	#
	# In jurisdictions that recognize copyright laws, the author or authors
	# of this software dedicate any and all copyright interest in the
	# software to the public domain. We make this dedication for the benefit

	#!/usr/bin/env python2.7
	# Matt's DNS management tool
	# Manage DNS using DDNS features
	#
	# See http://planetfoo.org/blog/archive/2012/01/24/a-better-nsupdate/
	#
	# Usage: dnsupdate -s server -k key -t ttl add _minecraft._tcp.mc.example.com SRV 0 0 25566 mc.example.com.
	# -h HELP!
	# -s the server
	# -k the key