<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">

<!--

 CDDL HEADER START

 The contents of this file are subject to the terms of the

 Common Development and Distribution License (the "License").

 You may not use this file except in compliance with the License.

 You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 or http://www.opensolaris.org/os/licensing.

 See the License for the specific language governing permissions

 and limitations under the License.

 When distributing Covered Code, include this CDDL HEADER in each

 file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 If applicable, add the following below this CDDL HEADER, with the

 fields enclosed by brackets "[]" replaced with your own identifying

 information: Portions Copyright [yyyy] [name of copyright owner]

 CDDL HEADER END

 NOTE:  This service manifest is not editable; its contents will

 be overwritten by package or patch operations, including

 operating system upgrade.  Make customizations in a different

 file.

-->

<service_bundle type="manifest" name="puppet">

  <service name="application/puppet" type="service" version="1">

    <dependency name="filesystem" grouping="require_all" restart_on="error" type="service">

      <service_fmri value="svc:/system/filesystem/minimal"/>

    </dependency>

    <dependency name="network" grouping="require_all" restart_on="error" type="service">

      <service_fmri value="svc:/milestone/network"/>

    </dependency>

    <dependency name="identity" grouping="require_all" restart_on="error" type="service">

      <service_fmri value="svc:/system/identity:node"/>

    </dependency>

    <exec_method type="method" name="start" exec=":true" timeout_seconds="60"/>

    <exec_method type="method" name="stop" exec=":kill" timeout_seconds="60"/>

    <exec_method type="method" name="refresh" exec=":true" timeout_seconds="0"/>

    <property_group name="general" type="framework">

      <!-- to start stop puppet -->

      <propval name="action_authorization" type="astring" value="solaris.smf.manage.puppet"/>

      <!-- to change puppet properties -->

      <propval name="value_authorization" type="astring" value="solaris.smf.value.puppet"/>

    </property_group>

    <property_group name="puppet_stencil" type="configfile">

      <propval name="path" type="astring" value="/etc/puppet/puppet.conf"/>

      <propval name="stencil" type="astring" value="puppet.stencil"/>

      <propval name="mode" type="astring" value="0444"/>

    </property_group>

    <instance name="master" enabled="false">

      <exec_method type="method" name="start" exec="/usr/sbin/puppet master --logdest %{config/logdest}" timeout_seconds="600"/>

      <property_group name="config" type="application">

        <propval name="logdest" type="astring" value="/var/log/puppet/puppet-master.log"/>

      </property_group>

    </instance>

    <instance name="agent" enabled="false">

      <exec_method type="method" name="start" exec="/usr/sbin/puppet agent --logdest %{config/logdest}" timeout_seconds="600"/>

      <property_group name="config" type="application">

        <propval name="logdest" type="astring" value="/var/log/puppet/puppet-agent.log"/>

      </property_group>

    </instance>

    <stability value="Unstable"/>

    <template>

      <common_name>

      </common_name>

      <documentation>

        <manpage title="puppet-master" section="8" manpath="/usr/share/man"/>

      </documentation>

      <pg_pattern required="false" type="application" name="config">

        <prop_pattern required="false" type="astring" name="agent_catalog_run_lockfile">

          <description>

            <loctext xml:lang="C">

A lock file to indicate that a puppet agent catalog run is currently in progress.

The file contains the pid of the process that holds the lock on the catalog run.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="agent_disabled_lockfile">

          <description>

            <loctext xml:lang="C">

A lock file to indicate that puppet agent runs have been administratively

disabled.  File contains a JSON object with state information.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="allow_duplicate_certs">

          <description>

            <loctext xml:lang="C">

Whether to allow a new certificate

request to overwrite an existing certificate.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="allow_variables_with_dashes">

          <description>

            <loctext xml:lang="C">

Permit hyphens (`-`) in variable names and issue deprecation warnings about

them. This setting **should always be `false`;** setting it to `true`

will cause subtle and wide-ranging bugs. It will be removed in a future version.

Hyphenated variables caused major problems in the language, but were allowed

between Puppet 2.7.3 and 2.7.14. If you used them during this window, we

apologize for the inconvenience --- you can temporarily set this to `true`

in order to upgrade, and can rename your variables at your leisure. Please

revert it to `false` after you have renamed all affected variables.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="host" name="archive_file_server">

          <description>

            <loctext xml:lang="C">

During an inspect run, the file bucket server to archive files to if archive_files is set.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="archive_files">

          <description>

            <loctext xml:lang="C">

During an inspect run, whether to archive files whose contents are audited to a file bucket.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="async_storeconfigs">

          <description>

            <loctext xml:lang="C">

Whether to use a queueing system to provide asynchronous database integration.

Requires that `puppet queue` be running.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="autoflush">

          <description>

            <loctext xml:lang="C">

Whether log files should always flush to disk.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="autosign">

          <description>

            <loctext xml:lang="C">

Whether (and how) to autosign certificate requests. This setting

is only relevant on a puppet master acting as a certificate authority (CA).

Valid values are true (autosigns all certificate requests; not recommended),

false (disables autosigning certificates), or the absolute path to a file.

The file specified in this setting may be either a **configuration file**

or a **custom policy executable.** Puppet will automatically determine

what it is: If the Puppet user (see the `user` setting) can execute the

file, it will be treated as a policy executable; otherwise, it will be

treated as a config file.

If a custom policy executable is configured, the CA puppet master will run it

every time it receives a CSR. The executable will be passed the subject CN of the

request _as a command line argument,_ and the contents of the CSR in PEM format

_on stdin._ It should exit with a status of 0 if the cert should be autosigned

and non-zero if the cert should not be autosigned.

If a certificate request is not autosigned, it will persist for review. An admin

user can use the `puppet cert sign` command to manually sign it, or can delete

the request.

For info on autosign configuration files, see

[the guide to Puppet's config files](http://docs.puppetlabs.com/guides/configuring.html).

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="basemodulepath">

          <description>

            <loctext xml:lang="C">

The search path for **global** modules. Should be specified as a

list of directories separated by the system path separator character. (The

POSIX path separator is ':', and the Windows path separator is ';'.)

If you are using directory environments, these are the modules that will

be used by _all_ environments. Note that the `modules` directory of the active

environment will have priority over any global directories. For more info, see

http://docs.puppetlabs.com/puppet/latest/reference/environments.html

This setting also provides the default value for the deprecated `modulepath`

setting, which is used when directory environments are disabled.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="net_address" name="bindaddress">

          <description>

            <loctext xml:lang="C">

The address a listening server should bind to.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="binder">

          <description>

            <loctext xml:lang="C">

Turns the binding system on or off. This includes bindings in modules.

The binding system aggregates data from modules and other locations and makes them available for lookup.

The binding system is experimental and any or all of it may change.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="binder_config">

          <description>

            <loctext xml:lang="C">

The binder configuration file. Puppet reads this file on each request to configure the bindings system.

If set to nil (the default), a $confdir/binder_config.yaml is optionally loaded. If it does not exists, a default configuration

is used. If the setting :binding_config is specified, it must reference a valid and existing yaml file.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="bucketdir">

          <description>

            <loctext xml:lang="C">

Where FileBucket files are stored.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="ca">

          <description>

            <loctext xml:lang="C">

Whether the master should function as a certificate authority.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="ca_name">

          <description>

            <loctext xml:lang="C">

The name to use the Certificate Authority certificate.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="integer" name="ca_port">

          <description>

            <loctext xml:lang="C">

The port to use for the certificate authority.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="host" name="ca_server">

          <description>

            <loctext xml:lang="C">

The server to use for certificate

authority requests.  It's a separate server because it cannot

and does not need to horizontally scale.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="integer" name="ca_ttl">

          <description>

            <loctext xml:lang="C">

The default TTL for new certificates.

This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="cacert">

          <description>

            <loctext xml:lang="C">

The CA certificate.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="cacrl">

          <description>

            <loctext xml:lang="C">

The certificate revocation list (CRL) for the CA. Will be used if present but otherwise ignored.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="cadir">

          <description>

            <loctext xml:lang="C">

The root directory for the certificate authority.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="cakey">

          <description>

            <loctext xml:lang="C">

The CA private key.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="capass">

          <description>

            <loctext xml:lang="C">

Where the CA stores the password for the private key.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="caprivatedir">

          <description>

            <loctext xml:lang="C">

Where the CA stores private certificate information.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="capub">

          <description>

            <loctext xml:lang="C">

The CA public key.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="catalog_cache_terminus">

          <description>

            <loctext xml:lang="C">

How to store cached catalogs. Valid values are 'json', 'msgpack' and 'yaml'. The agent application defaults to 'json'.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="catalog_format">

          <description>

            <loctext xml:lang="C">

(Deprecated for 'preferred_serialization_format') What format to

use to dump the catalog.  Only supports 'marshal' and 'yaml'.  Only

matters on the client, since it asks the server for a specific format.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="catalog_terminus">

          <description>

            <loctext xml:lang="C">

Where to get node catalogs.  This is useful to change if, for instance,

you'd like to pre-compile catalogs and store them in memcached or some other easily-accessed store.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="cert_inventory">

          <description>

            <loctext xml:lang="C">

The inventory file. This is a text file to which the CA writes a

complete listing of all certificates.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="certdir">

          <description>

            <loctext xml:lang="C">

The certificate directory.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="certdnsnames">

          <description>

            <loctext xml:lang="C">

The `certdnsnames` setting is no longer functional,

after CVE-2011-3872. We ignore the value completely.

For your own certificate request you can set `dns_alt_names` in the

configuration and it will apply locally.  There is no configuration option to

set DNS alt names, or any other `subjectAltName` value, for another nodes

certificate.

Alternately you can use the `--dns_alt_names` command line option to set the

labels added while generating your own CSR.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="integer" name="certificate_expire_warning">

          <description>

            <loctext xml:lang="C">

The window of time leading up to a certificate's expiration that a notification

will be logged. This applies to CA, master, and agent certificates. This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="boolean" name="certificate_revocation">

          <description>

            <loctext xml:lang="C">

Whether certificate revocation should be supported by downloading a

Certificate Revocation List (CRL)

to all clients.  If enabled, CA chaining will almost definitely not work.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="hostname" name="certname">

          <description>

            <loctext xml:lang="C">

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="classfile">

          <description>

            <loctext xml:lang="C">

The file in which puppet agent stores a list of the classes

associated with the retrieved configuration.  Can be loaded in

the separate `puppet` executable using the `--loadclasses`

option.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="client_datadir">

          <description>

            <loctext xml:lang="C">

The directory in which serialized data is stored on the client.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="clientbucketdir">

          <description>

            <loctext xml:lang="C">

Where FileBucket files are stored locally.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="clientyamldir">

          <description>

            <loctext xml:lang="C">

The directory in which client-side YAML data is stored.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="code">

          <description>

            <loctext xml:lang="C">

Code to parse directly.  This is essentially only used

by `puppet`, and should only be set if you're writing your own Puppet

executable.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="color">

          <description>

            <loctext xml:lang="C">

Whether to use colors when logging to the console.  Valid values are

`ansi` (equivalent to `true`), `html`, and `false`, which produces no color.

Defaults to false on Windows, as its console does not support ansi colors.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="confdir">

          <description>

            <loctext xml:lang="C">

The main Puppet configuration directory.  The default for this setting

is calculated based on the user.  If the process is running as root or

the user that Puppet is supposed to run as, it defaults to a system

directory, but if it's running as any other user, it defaults to being

in the user's home directory.

	    </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required="false" type="astring" name="config">