Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have several servers that I'd like to start managing with Puppet. We have:

  • Linux servers in our California office that I access over a VPN
  • Linux servers in an Oklahoma data center that I access over SSH
  • Linux servers in Amazon Elastic Compute Cloud (North Virginia)

I see a two options:

  • Three puppet servers, local to each environment
  • One puppet server, exposed by public DNS

Does anyone have experience with one of these configurations? How would you do it?

share|improve this question
up vote 2 down vote accepted

IMHO, I don't think puppet servers should ever be available over the public internet. It seriously restricts the type of things you can push out.. No SSH keys, no SSL certs, etc.

Set up OpenVPN on the puppet server, then vpn to it from the guests you want to puppet.

I've done an EC2 node using vpnc to set up a tunnel back to my protected puppet server, although that was actually behind a Cisco ASA..

share|improve this answer
So, you are doing HTTPS over a VPN connection, using SSL certificates to verify host and client? It seems like one level too many of safety nets. – John Whitlock Jun 24 '10 at 16:31
I'm not sure I agree with that.. but there we go. It's your network. – Tom O'Connor Jun 24 '10 at 22:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.