To work through this recipe, you will need the following:

Our objective is to create two users—John and Mary. Here's a table of the required information:

$ htpasswd -n -b mary s3cur3
mary:$apr1$eR7H0C5r$OrhOQUTXfUEIdvWyeGGGy/

We want to store that piece of information (username and password), inside a single entity: this is the data bag. Let's name it webusers, and we'll store our users under this directory.

$ knife data bag show webusers
john
mary

Now the data is globally available from the Chef server, how do we access it dynamically from inside our code? This is where the search feature in Chef is useful to create dynamically generated content.

Before starting any work in the mysite cookbook, let's bump the version in mysite/metadata.rb so we're sure not to break anything:

version '0.2.0'

Don't forget the last step: we have to call this new recipe from our main, default.rb recipe! In mysite/recipes/default.rb, include our new recipe, so it gets picked up by the client:

include_recipe "mysite::htaccess"

Just upload the new version of the cookbook:

$ knife cookbook upload mysite

After you've run chef-client on your node, the site will be protected and users mary and john will be able to use basic HTTP authentication.

With Puppet, we can do it using Hiera. Hiera can be seen as datastore keeping site information out of manifests. Hiera can be customized in the way data is stored, but this will be out of the scope of this chapter; we will use default configuration.

First of all, we need to define the data in Hiera. This will be done by creating web.pomes.pro.yaml in the Hiera tree:

$ cd puppetcode/hieradata
$ mkdir nodes
$ cat > nodes/web.pomes.pro.yaml
webusers:
 - id: john
   htpasswd: $apr1$AUI2Y5pj$0v0PaSlLfc6QxZx1Vx5Se
 - id: mary
   htpasswd: $apr1$eR7H0C5r$OrhOQUTXfUEIdvWyeGGGy/
^D

This file now contains an array of hashes for authorized users, for the node web.pomes.pro.

From the main manifest, we need to look up our Hiera data using the following code:

$users=hiera('webusers');

Now it's easy to generate the password file using a new apache::htpasswd define statement, that we need to create in modules/apache/manifests/htpasswd.pp:

define apache::htpasswd (
     $filepath,
     $users
) {

  file { "$filepath":
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0644',
     content => template('apache/htpasswd.erb'),
  }
}

For the corresponding template, this time, let's try an ERB template in modules/apache/templates/htpasswd.erb:

<% @users.each do |user| -%>
<%= user['id'] %>:<%= user['htpasswd'] %>
<% end -%>

From the main manifest, we can now create the password file:

apache::htpasswd{'htpasswd':
       filepath => '/etc/apache2/htpasswd',
       users    => hiera('webusers'),
}

We also need to create a .htaccess file. Let's create a new apache::htaccess statement in modules/apache/manifests/htaccess.pp:

define apache::htaccess (
     $filepath,
     $docroot
) {

  file { "$docroot/.htaccess":
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0644',
     content => template('apache/htaccess.erb'),
  }
}

The associated template in modules/apache/templates/htaccess.erb is:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile <%= @filepath %>
Require valid-user

From the main manifest, we can now create the .htaccess file:

apache::htaccess{"$docroot-htaccess":
   filepath => '/etc/apache2/htpasswd',
     docroot  => $docroot,
  }

As a result, here is the main manifest of the web.pomes.pro node:

node 'web.pomes.pro' {
    $website=$fqdn;
    $docroot="/var/www/$fqdn";
    $users=hiera('webusers');

    class {
      'apache':;
      'php':;
      'mariadb':;
    }
    apache::vhost{$website:
       website => $website,
       docroot => $docroot,
    }
    apache::htpasswd{'htpasswd':
       filepath => '/etc/apache2/htpasswd',
       users    => hiera('webusers'),
    }
    apache::htaccess{"$docroot-htaccess":
       filepath => '/etc/apache2/htpasswd',
       docroot  => $docroot,
    }
    file { $docroot:
      ensure => directory,
      owner   => 'www-data',
      group   => 'www-data',
      mode    => '0755',
    }
    file {"$docroot/index.php":
      ensure => present,
      owner   => 'www-data',
      group   => 'www-data',
      mode    => '0644',
      content => "<?php phpinfo() ?>",
    }
}

After running the Puppet agent, http://web.pomes.pro will now ask you for a login/password.