Is Puppet (or similar) a suitable technology for taking care of basic but critical mass changes?
Yes, it can be used this way. I use it this to support external clients systems.
I don't want any server to be able to see any config it shouldn't
If you are using puppet, you must not enable autosign then. Autosign permits hosts to automatically request a certificate. Your configuration and permissions will almost certainly be tied directly to the CN in the certificate. You don't want random computer coming online and being able to claim that they are actually the system with all the secret high security stuff.
If you are really paranoid you can adjust the puppets fileserver settings to create shares that only some systems can access. The fileserver access is based on the certificates.
I don't want Puppet to make any changes which it shouldn't, or revert any manual changes done on the server.
There are a couple different approaches to permitting local changes.
One method I frequently use is below. Basically if you pass an list to a source
, then the puppet try each item in the list. So I add the first item in the list to point at a local file.
file { '/etc/ssh/sshd_config':
ensure => present,
source => ["/etc/ssh/sshd_config_local",
"puppet:///modules/ssh/$ssh_config_file"],
...
}
Another option would be to make use of symlinks. If someone wants to use the puppet version they symlink to the puppet version of a file. If they want maintain their config locally, then they don't create a symlink.
file { '/etc/ssh/sshd_config_puppet':
ensure => present,
source => "puppet:///modules/ssh/$ssh_config_file",
...
}
The other possibility is to use augeas to make line-level changes instead of changing entire files. Be very conservative about what you change.