etcmonit.dpuppetmaster

check process puppetmaster
  with pidfile /var/run/puppet/unicorn.pid
  start program "/bin/env unicorn -c /etc/puppet/unicorn.rb -E production /usr/share/puppet/ext/rack/files/config.ru -D"
  stop program "/bin/kill `cat /var/run/puppet/unicorn.pid`"

etcpuppetpuppet.conf

# Add this section in addition to your other sections
[puppetmasterd]
    ssl_client_header = HTTP_X_CLIENT_DN
    ssl_client_verify_header = HTTP_X_CLIENT_VERIFY

nginx.conf

user              nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}

http {
  default_type  application/x-raw;
  upstream puppet-production {
    server   unix:/var/run/puppet/unicorn.sock;
  }
  server {
    listen puppet:8140;

    ssl on;
    ssl_certificate /var/lib/puppet/ssl/certs/261660-file1.storage.mashable.com.pem;
    ssl_certificate_key /var/lib/puppet/ssl/private_keys/261660-file1.storage.mashable.com.pem;
    ssl_ciphers ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;
    ssl_client_certificate  /var/lib/puppet/ssl/ca/ca_crt.pem;
    ssl_verify_client       on;

    proxy_redirect      off;
    proxy_set_header    Host              $host;
    proxy_set_header    X-Real-IP         $remote_addr;
    proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header    X-Client-Verify   $ssl_client_verify;
    proxy_set_header    X-Client-DN       $ssl_client_s_dn;
    proxy_set_header    X-SSL-Subject     $ssl_client_s_dn;
    proxy_set_header    X-SSL-Issuer      $ssl_client_i_dn;

    location /production/file_content/ {
      rewrite ^/production/file_content/modules/([^/]+)/(.*) /$1/files/$2;
      break;
      root /etc/puppet/modules/;
    }

    location / {
      proxy_pass http://puppet-production;
    }
  }
}

unicorn.rb

worker_processes 4
timeout 30
listen "/var/run/puppet/unicorn.sock"
pid "/var/run/puppet/unicorn.pid"
user "puppet", "puppet"
working_directory "/etc/puppet"
if GC.respond_to?(:copy_on_write_friendly=)
  GC.copy_on_write_friendly = true
end