Foreman and Cockpit

There used to be work in progress to integrate Cockpit into Foreman, and we would record the necessary manual steps here to make the it all work. Now it's all wrapped up and shipped, and things are a lot simpler.

Still, it's good to document exactly what is supposed to work and how.

The following instructions will set up a single new virtual machine that runs Foreman and you can seamlessly open Cockpit from Foreman for that same virtual machine.

Setting up the virtual machine

Create a new Centos 7 virtual machine with 4GiB RAM and 10GiB disk from this:

http://isoredirect.centos.org/centos/7/isos/x86_64/CentOS-7-x86_64-Minimal-1810.iso

In the installer, make sure that Network is switched on. Also in the installer, set the hostname of the new machine to "foreman.demo.lan".

Make sure that reverse DNS lookup gives consistent results inside the virtual machine. One easy way is to add a line like this to /etc/hosts on the virtual machine itself:

192.168.100.109 foreman.demo.lan foreman

Make sure to use the real IP address of the virtual machine, of course.

Make sure that the new virtual machine can also be reached via its "foreman.demo.lan" name from the outside. Again, a easy way is to add a line like above to /etc/hosts on the machine that will run the browser.

Installing Foreman

To install Foreman, you need to add a couple of RPM repositories, install foreman-installer, and then run it.

More information here: https://theforeman.org/manuals/1.24/quickstart_guide.html

# yum install https://yum.puppet.com/puppet6-release-el-7.noarch.rpm
# yum install http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
# yum install https://yum.theforeman.org/releases/1.24/el7/x86_64/foreman-release.rpm

# yum update
# yum install foreman-installer

# foreman-installer --enable-foreman-plugin-remote-execution \
                    --enable-foreman-proxy-plugin-remote-execution-ssh \
                    --enable-foreman-plugin-remote-execution-cockpit

# firewall-cmd --add-service https
# firewall-cmd --add-service https --permanent

Write down the admin password that the installer outputs.

Setting up password-less remote execution

In order to seamlessly open Cockpit on a host, you need to be able to execute remote commands on it without providing any credentials.

You can store the credentials in the remote_execution_ssh_user and remote_execution_ssh_password host parameters and Foreman will use these to connect to Cockpit.

Instead of storing the password in a host parameter, you can also copy the public key of the proxy over to the host:

# ssh-copy-id -i ~foreman-proxy/.ssh/id_rsa_foreman_proxy root@foreman.demo.lan

Now you can go to the page for the foreman.demo.lan host itself. You should see the "Web Console" button, and it should work.

Addendum: Puma

In the future, the Foreman smart proxy will offer a choice between Puma and Webrick. The Cockpit integration needs to be adapted for Puma, and here is how you can test that.

Patch the smart proxy to support Puma:

# yum install patch
# cd /usr/share/foreman-proxy
# curl https://raw.githubusercontent.com/mvollmer/foreman-cockpit/master/proxy-puma.patch | patch -p1

Install the Puma gem:

# yum install gcc ruby-devel openssl-devel
# gem install puma -v 3.10.0

Tell the proxy to use Puma:

# echo >>/etc/foreman-proxy/settings.yml ":http_server_type: 'puma'"

Tell the proxy to only listen on IPv4, because IPv6 is nothing but trouble:

# sed -i /etc/foreman-proxy/settings.yml -e 's/:bind_host: .*/:bind_host: "0.0.0.0"/'

Finally, patch the REX plugin to support SSH sessions also with Puma and restart:

# cd /usr/share/gems/gems/smart_proxy_remote_execution_ssh-0.2.1/
# curl https://raw.githubusercontent.com/mvollmer/foreman-cockpit/master/proxy-rex-puma.patch | patch -p1
# systemctl restart foreman-proxy