Puppet: how do I run a configtest before restarting a service

Question

Is there a way to run a configtest utility (e.g. apache2ctl -t) before trying to restart a service when one of its configuration files changed?

Use case here is that I want to be resilient against configuration errors in an apache config (because apache just stops when it sees the config error, leaving me with a stopped apache)

Answer 1

You can use a require => Exec[] and daisy chain the exec to require the config change(s).

If the Exec fails (exit status != 0) the subsequent tasks that require it should fail as well. I do something similar to execute ssh-keygen then set special permissions on .ssh when creating new users.

Example:

# Ensure the .ssh directory exists for each user
file { "${dot_ssh_dir}":
 ensure => directory,
 owner => $title,
 mode => 700,
 require => File["${home_dir}"],
}

# Run ssh-keygen (ONLY if id_rsa doesn't exist)
exec { "${title} ssh-keygen":
 command => "ssh-keygen -f ./id_rsa -q -N ''",
 cwd => $dot_ssh_dir,
 user => $title,
 creates => "${keyfile_private}",
 path => ['/usr/bin', '/usr/sbin/', '/usr/local/sbin'],
 require => File[$dot_ssh_dir],
}

# AuthorizedKeys should be 600
file { "${authorized_keys}": 
 source => "${keyfile_public}",
 ensure => present,
 mode => 600,
 owner => $title,
 group => 'sftpusers',
 require => Exec["${title} ssh-keygen"],
}