From 981bc9504f061470705728a3bc15b1aee68859c8 Mon Sep 17 00:00:00 2001 From: dotconfig404 Date: Tue, 21 Jul 2026 15:34:37 +0200 Subject: [PATCH 1/2] feat: add external nodes config --- README.md | 1 + openvoxserver/files/container-entrypoint.d/61-set-enc.sh | 9 +++++++++ 2 files changed, 10 insertions(+) create mode 100755 openvoxserver/files/container-entrypoint.d/61-set-enc.sh diff --git a/README.md b/README.md index 73b8c631..42b778c9 100644 --- a/README.md +++ b/README.md @@ -123,6 +123,7 @@ The following environment variables are supported: | __CSR_ATTRIBUTES__ | Provide a JSON string of the csr_attributes.yaml content. e.g. `CSR_ATTRIBUTES='{"custom_attributes": { "challengePassword": "foobar" }, "extension_requests": { "pp_project": "foo" } }'`

Defaults to empty JSON object `{}`
Please note that within a compose file, you must provide all environment variables as Hash and not as Array!
environment:
`CSR_ATTRIBUTES: '{"extension_request": {...}}'` | | __DNS_ALT_NAMES__ | Additional DNS names to add to the servers SSL certificate
__Note__ only effective on initial run when certificates are generated | | __ENVIRONMENTPATH__ | Set an environmentpath

Defaults to `/etc/puppetlabs/code/environments` | +| __EXTERNAL_NODES__ | Command (script path plus any arguments) of an external node classifier (ENC) executed to classify nodes - sets `external_nodes` in puppet.conf and sets `node_terminus` to `exec`. | | __HIERACONFIG__ | Set a hiera_config entry in puppet.conf file

Defaults to `$confdir/hiera.yaml` | | __INTERMEDIATE_CA__ | Allows to import an existing intermediate CA. Needs `INTERMEDIATE_CA_BUNDLE`, `INTERMEDIATE_CA_CHAIN` and `INTERMEDIATE_CA_KEY`. See [Puppet Intermediat CA](https://www.puppet.com/docs/puppet/latest/server/intermediate_ca.html) | | __INTERMEDIATE_CA_BUNDLE__ | File path and name to the complete CA bundle (signing CA + Intermediate CA) | diff --git a/openvoxserver/files/container-entrypoint.d/61-set-enc.sh b/openvoxserver/files/container-entrypoint.d/61-set-enc.sh new file mode 100755 index 00000000..56dfcf59 --- /dev/null +++ b/openvoxserver/files/container-entrypoint.d/61-set-enc.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +set -e + +source /usr/local/share/openvox/config_lib.sh + +if [ -n "${EXTERNAL_NODES}" ]; then + config_set server external_nodes "$EXTERNAL_NODES" node_terminus exec +fi From a90f2f16cff99366816a0ef1b914c4f160180ad3 Mon Sep 17 00:00:00 2001 From: dotconfig404 Date: Tue, 21 Jul 2026 15:34:37 +0200 Subject: [PATCH 2/2] feat: add allow_duplicate_certs config --- README.md | 1 + openvoxserver/files/container-entrypoint.d/90-ca.sh | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/README.md b/README.md index 42b778c9..df417aa2 100644 --- a/README.md +++ b/README.md @@ -114,6 +114,7 @@ The following environment variables are supported: | Name | Usage / Default | |---------------------------------------------| --------------- | | __AUTOSIGN__ | Whether or not to enable autosigning on the openvoxserver instance. Valid values are `true`, `false`, and `/path/to/autosign.conf`.

Defaults to `true`. | +| __CA_ALLOW_DUPLICATE_CERTS__ | Whether or not the CA accepts a new CSR for a certname that already has a signed certificate. Valid values are `true` and `false`. Does nothing unless `CA_ENABLED=true`.

Defaults to `false` | | __CA_ALLOW_SUBJECT_ALT_NAMES__ | Whether or not SSL certificates containing Subject Alternative Names should be signed by the CA. Does nothing unless `CA_ENABLED=true`.

Defaults to `false` | | __CA_ENABLED__ | Whether or not this openvoxserver instance has a running CA (Certificate Authority)

Defaults to `true` | | __CA_HOSTNAME__ | The DNS hostname for the openvoxserver running the CA. Does nothing unless `CA_ENABLED=false`

Defaults to `puppet` | diff --git a/openvoxserver/files/container-entrypoint.d/90-ca.sh b/openvoxserver/files/container-entrypoint.d/90-ca.sh index 0c9a2e7f..142f26b1 100755 --- a/openvoxserver/files/container-entrypoint.d/90-ca.sh +++ b/openvoxserver/files/container-entrypoint.d/90-ca.sh @@ -40,6 +40,16 @@ EOF else # we are the CA config_set server ca_ttl "${CA_TTL}" ca_server "${CA_HOSTNAME}" ca_port "${CA_PORT}" + ca_allow_duplicate_certs="${CA_ALLOW_DUPLICATE_CERTS:-false}" + case "${ca_allow_duplicate_certs}" in + true|false) + config_set server allow_duplicate_certs "${ca_allow_duplicate_certs}" + ;; + *) + echo "Error: CA_ALLOW_DUPLICATE_CERTS must be true or false" + exit 99 + ;; + esac hocon -f /etc/puppetlabs/puppetserver/conf.d/ca.conf \ set certificate-authority.allow-subject-alt-names "${CA_ALLOW_SUBJECT_ALT_NAMES}"