add dirs and files - https://gitlab.confdroid.com/internal/confdroid_management/-/issues/292

templates/puppetdb/auth.conf.erb

@@ -0,0 +1,50 @@
+authorization: {
+    version: 1
+    rules: [
+        {
+            # Allow unauthenticated access to the status service endpoint
+            match-request: {
+                path: "/status/v1/services"
+                type: path
+                method: get
+            }
+            allow-unauthenticated: true
+            sort-order: 500
+            name: "puppetlabs status service - full"
+        },
+        {
+            match-request: {
+                path: "/status/v1/simple"
+                type: path
+                method: get
+            }
+            allow-unauthenticated: true
+            sort-order: 500
+            name: "puppetlabs status service - simple"
+        },
+        {
+            # Allow nodes to access the metrics service
+            # for puppetdb, the metrics service is the only
+            # service using the authentication service
+            match-request: {
+                path: "/metrics"
+                type: path
+                method: [get, post]
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs puppetdb metrics"
+        },
+        {
+            # Deny everything else. This ACL is not strictly
+            # necessary, but illustrates the default policy
+            match-request: {
+                path: "/"
+                type: path
+            }
+            deny: "*"
+            sort-order: 999
+            name: "puppetlabs deny all"
+        }
+    ]
+}

templates/puppetdb/bootstrap.cfg.erb

@@ -0,0 +1,34 @@
+###############################################################################
+######### File created by Puppet - manual changes will be overwritten #########
+###############################################################################
+
+# This file is used by the application framework (trapperkeeper) to
+# determine what services should be loaded at boot time.
+# For more info, see:
+#  https://github.com/puppetlabs/trapperkeeper/wiki/Bootstrapping
+
+# Web Server
+puppetlabs.trapperkeeper.services.webserver.jetty10-service/jetty10-service
+
+# Webrouting
+puppetlabs.trapperkeeper.services.webrouting.webrouting-service/webrouting-service
+
+# TK metrics - the authorization service is currently only used by the metrics service
+puppetlabs.trapperkeeper.services.authorization.authorization-service/authorization-service
+puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-webservice
+# TK status
+puppetlabs.trapperkeeper.services.status.status-service/status-service
+puppetlabs.trapperkeeper.services.scheduler.scheduler-service/scheduler-service
+
+# PuppetDB Services
+puppetlabs.puppetdb.cli.services/puppetdb-service
+puppetlabs.puppetdb.command/command-service
+puppetlabs.puppetdb.pdb-routing/maint-mode-service
+puppetlabs.puppetdb.pdb-routing/pdb-routing-service
+puppetlabs.puppetdb.config/config-service
+
+# NREPL
+puppetlabs.trapperkeeper.services.nrepl.nrepl-service/nrepl-service
+
+# Dashboard redirect for "/" (not "/pdb"): remove to disable
+puppetlabs.puppetdb.dashboard/dashboard-redirect-service

templates/puppetdb/config.ini.erb

@@ -0,0 +1,20 @@
+###############################################################################
+######### File created by Puppet - manual changes will be overwritten #########
+###############################################################################
+
+# See README.md for more thorough explanations of each section and
+# option.
+
+[global]
+# Store mq/db data in a custom directory
+vardir = /opt/puppetlabs/server/data/puppetdb
+
+# Use an external logback config file
+logging-config = /etc/puppetlabs/puppetdb/logback.xml
+
+[command-processing]
+# How many command-processing threads to use, defaults to (CPUs / 2)
+# threads = 4
+
+# How many threads can write to disk at once, defaults to min(CPUs / 2, 4)
+# concurrent-writes = 4

templates/puppetdb/database.ini.erb

@@ -0,0 +1,17 @@
+###############################################################################
+######### File created by Puppet - manual changes will be overwritten #########
+###############################################################################
+
+[database]
+
+# The database address, i.e. //HOST:PORT/DATABASE_NAME
+subname = <%= @pt_db_subname %>
+
+# Connect as a specific user
+username = <%= @pt_db_username %>
+
+# Use a specific password
+password = <%= @pt_db_password %>
+
+# How often (in minutes) to compact the database
+gc-interval = <%= @pt_gc_interval %>

templates/puppetdb/jetty.ini.erb

@@ -0,0 +1,37 @@
+###############################################################################
+######### File created by Puppet - manual changes will be overwritten #########
+###############################################################################
+
+[jetty]
+# IP address or hostname to listen for clear-text HTTP. To avoid resolution
+# issues, IP addresses are recommended over hostnames.
+# Default is `localhost`.
+# host = <host>
+
+# Port to listen on for clear-text HTTP.
+port = <%= @pt_http_port %>
+
+# The following are SSL specific settings. They can be configured
+# automatically with the tool `puppetdb ssl-setup`, which is normally
+# ran during package installation.
+
+# IP address to listen on for HTTPS connections. Hostnames can also be used
+# but are not recommended to avoid DNS resolution issues. To listen on all
+# interfaces, use `0.0.0.0`.
+ssl-host = 0.0.0.0
+
+# The port to listen on for HTTPS connections
+ssl-port = <%= @pt_https_port %>
+
+# Private key path
+ssl-key = /etc/puppetlabs/puppetdb/ssl/private.pem
+
+# Public certificate path
+ssl-cert = /etc/puppetlabs/puppetdb/ssl/public.pem
+
+# Certificate authority path
+ssl-ca-cert = /etc/puppetlabs/puppetdb/ssl/ca.pem
+
+# Access logging configuration path. To turn off access logging
+# comment out the line with `access-log-config=...`
+access-log-config = /etc/puppetlabs/puppetdb/request-logging.xml

templates/puppetdb/logback.xml.erb

@@ -0,0 +1,52 @@
+<configuration scan="true" scanPeriod="60 seconds">
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{yyyy-MM-dd'T'HH:mm:ss.SSSXXX} %-5p [%c{2}] %m%n</pattern>
+        </encoder>
+    </appender>
+
+    <appender name="F1" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <file>/var/log/puppetlabs/puppetdb/puppetdb.log</file>
+        <append>true</append>
+        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
+            <fileNamePattern>/var/log/puppetlabs/puppetdb/puppetdb-%d{yyyy-MM-dd}.%i.log.gz</fileNamePattern>
+            <!-- each file should be at most 200MB, keep 90 days worth of history, but at most 1GB total-->
+            <maxFileSize>200MB</maxFileSize>
+            <maxHistory>90</maxHistory>
+            <totalSizeCap>1GB</totalSizeCap>
+        </rollingPolicy>
+        <encoder>
+            <pattern>%d{yyyy-MM-dd'T'HH:mm:ss.SSSXXX} %-5p [%c{2}] %m%n</pattern>
+        </encoder>
+    </appender>
+
+    <!-- Supress internal Spring Framework logging -->
+    <logger name="org.springframework.jms.connection" level="warn"/>
+
+    <appender name="STATUS" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <file>/var/log/puppetlabs/puppetdb/puppetdb-status.log</file>
+        <append>true</append>
+        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
+            <!-- rollover daily -->
+            <fileNamePattern>/var/log/puppetlabs/puppetdb/puppetdb-status-%d{yyyy-MM-dd}.%i.log.gz</fileNamePattern>
+            <!-- each file should be at most 200MB, keep 90 days worth of history, but at most 1GB total-->
+            <maxFileSize>200MB</maxFileSize>
+            <maxHistory>90</maxHistory>
+            <totalSizeCap>1GB</totalSizeCap>
+        </rollingPolicy>
+        <encoder>
+            <!-- note that this will only log the JSON message (%m) and a newline (%n)-->
+            <pattern>%m%n</pattern>
+        </encoder>
+    </appender>
+
+    <!-- without additivity="false", the status log messages will be sent to every other appender as well-->
+    <logger name="puppetlabs.trapperkeeper.services.status.status-debug-logging" level="debug" additivity="false">
+        <appender-ref ref="STATUS"/>
+    </logger>
+
+    <root level="info">
+        <appender-ref ref="${logappender:-DUMMY}" />
+        <appender-ref ref="F1" />
+    </root>
+</configuration>

templates/puppetdb/repl.ini.erb

@@ -0,0 +1,13 @@
+###############################################################################
+######### File created by Puppet - manual changes will be overwritten #########
+###############################################################################
+
+[nrepl]
+# Set to true to enable the remote REPL
+enabled = <%= @pt_repl_on %>
+
+# What port the REPL should listen on
+port = <%= @pt_repl_port %>
+
+# IP address to listen on
+host = <%= @pt_repl_host %>

templates/puppetdb/request_logging.xml.erb

@@ -0,0 +1,17 @@
+<configuration debug="false">
+    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <file>/var/log/puppetlabs/puppetdb/puppetdb-access.log</file>
+        <append>true</append>
+        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
+            <fileNamePattern>/var/log/puppetlabs/puppetdb/puppetdb-access-%d{yyyy-MM-dd}.%i.log.gz</fileNamePattern>
+            <!-- each file should be at most 200MB, keep 90 days worth of history, but at most 1GB total-->
+            <maxFileSize>200MB</maxFileSize>
+            <maxHistory>90</maxHistory>
+            <totalSizeCap>1GB</totalSizeCap>
+        </rollingPolicy>
+        <encoder>
+            <pattern>%h %l %u [%t] "%r" %s %b "%i{Referer}" "%i{User-Agent}" %D %header{X-Uncompressed-Length}</pattern>
+        </encoder>
+    </appender>
+    <appender-ref ref="FILE" />
+</configuration>

templates/puppetdb/service.conf.erb

@@ -0,0 +1,51 @@
+###############################################################################
+######### File created by Puppet - manual changes will be overwritten #########
+###############################################################################
+#
+# Local settings can be configured without being overwritten by package upgrades, for example
+# if you want to increase puppetdb open-files-limit to 10000,
+# you need to increase systemd's LimitNOFILE setting, so create a file named
+# "/etc/systemd/system/puppetdb.service.d/limits.conf" containing:
+#	[Service]
+#	LimitNOFILE=10000
+# You can confirm it worked by running systemctl daemon-reload
+# then running systemctl show puppetdb | grep LimitNOFILE
+#
+[Unit]
+Description=puppetdb Service
+After=syslog.target network.target nss-lookup.target
+
+[Service]
+Type=forking
+EnvironmentFile=/etc/sysconfig/puppetdb
+User=puppetdb
+TimeoutStartSec=14400
+TimeoutStopSec=60
+Restart=on-failure
+StartLimitBurst=5
+PIDFile=/run/puppetlabs/puppetdb/puppetdb.pid
+
+# https://tickets.puppetlabs.com/browse/EZ-129
+# Prior to systemd v228, TasksMax was unset by default, and unlimited. Starting in 228 a default of '512'
+# was implemented. This is low enough to cause problems for certain applications. In systemd 231, the
+# default was changed to be 15% of the default kernel limit. This explicitly sets TasksMax to 4915,
+# which should match the default in systemd 231 and later.
+# See https://github.com/systemd/systemd/issues/3211#issuecomment-233676333
+TasksMax=4915
+
+#set default privileges to -rw-r-----
+UMask=027
+
+
+ExecReload=/opt/puppetlabs/server/apps/puppetdb/bin/puppetdb reload
+ExecStart=/opt/puppetlabs/server/apps/puppetdb/bin/puppetdb start
+ExecStop=/opt/puppetlabs/server/apps/puppetdb/bin/puppetdb stop
+
+KillMode=process
+
+SuccessExitStatus=143
+
+StandardOutput=journal
+
+[Install]
+WantedBy=multi-user.target