Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the purposes of this question I need to make a distinction between my Production puppet master and my Development puppet master. In either case, my /etc/puppet/puppet.conf is:



Development puppet master is run:

# puppetmasterd --debug --no-daemonize

and Production puppet master is a thin/nginx affair. The relevant nginx configuration files:

# /etc/nginx/sites-enabled/default
upstream puppet-production {
    server   unix:/var/run/puppet/master.00.sock;
    server   unix:/var/run/puppet/master.01.sock;
    server   unix:/var/run/puppet/master.02.sock;

server {
    listen puppet:8140;
    include conf.d/puppet_ssl.conf;
    include conf.d/puppet_proxy_set_header.conf;

    default_type application/x-raw;

    location /production/file_content/ {
        rewrite ^/production/file_content/([^/]+)/(.*) /$1/files/$2;
        root /etc/puppet/modules/;
    location / {
        proxy_pass http://puppet-production;


# /etc/nginx/conf.d/puppet_proxy_set_header.conf 
proxy_redirect         off; 
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $remote_addr;
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header    X-Client-Verify  $ssl_client_verify;
proxy_set_header    X-Client-Verify  SUCCESS;
proxy_set_header    X-Client-DN $ssl_client_s_dn;
proxy_set_header    X-SSL-Subject    $ssl_client_s_dn;
proxy_set_header    X-SSL-Issuer     $ssl_client_i_dn;


# /etc/nginx/conf.d/puppet_ssl.conf

ssl on; 
ssl_certificate /var/lib/puppet/ssl/certs/puppet.pem;
ssl_certificate_key /var/lib/puppet/ssl/private_keys/puppet.pem;
ssl_ciphers ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;
ssl_client_certificate  /var/lib/puppet/ssl/ca/ca_crt.pem;
ssl_verify_client       on;

The relevant thin configuration files:


# a, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.

# if puppet is not in your RUBYLIB:
# $:.unshift('/opt/puppet/lib')

$0 = "master"

# if you want debugging:
# ARGV << "--debug"

ARGV << "--rack"
require 'puppet/application/master'
# we're usually running inside a {} block,
# therefore we need to call run *here*.
run Puppet::Application[:master].run


# /etc/supervisor/conf.d/puppetmaster.conf 

# This file is autogenerated by Puppet. Manual changes will be overwritten!
command=/usr/bin/thin start -e development --socket /var/run/puppet/master.%(process_num)02d.sock --user puppet --group puppet --chdir /etc/puppet -R /etc/puppet/

Using puppet-module-supervisor I find that the source line path in manifests/init.pp causes a 404 when running in Production mode:

 source => 'puppet:///modules/supervisor/logrotate',
 require => Package[$supervisor::params::package];

but if I modify the path to be simply puppet:///supervisor/logrotate all is well. The first and second form succeed in Development mode. It's my understanding that the first form is correct and that my Production mode should have no issues with it.

Running puppet agent --test when master is configured in Production mode results in:

# puppet agent --test
info: Caching catalog for
info: Applying configuration version '1327957286'
err: /Stage[main]/Supervisor/File[/etc/logrotate.d/supervisor]/ensure: change from absent to file failed: Could not set 'file on ensure: Error 404 on SERVER: <html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
 at /etc/puppet/modules/supervisor/manifests/init.pp:32
notice: Finished catalog run in 1.65 seconds

and the logs from /var/log/nginx/access.log

# cat /var/log/nginx/{access,error}.log - - [30/Jan/2012:20:50:58 +0000] "POST /production/catalog/ HTTP/1.1" 200 13290 "-" "Ruby" - - [30/Jan/2012:20:51:00 +0000] "GET  /production/file_metadata/modules/supervisor/logrotate? HTTP/1.1" 200 308 "-" "Ruby" - - [30/Jan/2012:20:51:00 +0000] "GET /production/file_content/modules/supervisor/logrotate HTTP/1.1" 404 168 "-" "Ruby" - - [30/Jan/2012:20:51:01 +0000] "PUT /production/report/ HTTP/1.1" 200 14 "-" "Ruby"

2012/01/30 20:51:00 [error] 10716#0: *222 open() "/etc/puppet/modules/modules/files/supervisor/logrotate" failed (2: No such file or directory), client:, server: , request: "GET /production/file_content/modules/supervisor/logrotate HTTP/1.1", host: "puppet:8140"

Details about my environment:

# puppet --version
# cat /etc/debian_version
# ruby -v
ruby 1.9.2p0 (2010-08-18 revision 29036) [i486-linux]

Anyone have an inkling of what's going wrong?

share|improve this question
up vote 1 down vote accepted

The path that the client node is requesting is:


While the nginx config as written seems to be expecting:


So, modules is caught by the first capture and supervisor/logrotate is caught by the second capture; the files that needs to go between the module name and the file name is not in the right place and modules gets doubled:

"/etc/puppet/modules/modules/files/supervisor/logrotate" failed (2: No such file or directory)

Seems like you could just change your rewrite rule to this:

rewrite ^/production/file_content/modules/([^/]+)/(.*) /$1/files/$2;
share|improve this answer
D'oh! Interesting what the eye skips over. Thanks very much. – troutwine Jan 30 '12 at 23:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.