PuppetBoard -> PuppetDB SSL issues

root@sofx1013dckr309.home.lan:~/tests/puppet# docker ps -a
CONTAINER ID   IMAGE                                         COMMAND                  CREATED        STATUS                    PORTS                              NAMES
06613f67b5b8   ghcr.io/voxpupuli/puppetboard                 "/bin/sh -c 'gunicor…"   33 hours ago   Exited (2) 33 hours ago                                      puppet-puppetboard-1
4e5578f794b0   ghcr.io/voxpupuli/puppetdb:8.8.1-latest       "dumb-init /docker-e…"   2 days ago     Up 2 days (healthy)       8080/tcp, 0.0.0.0:8081->8081/tcp   puppet-puppetdb-1
d1c60dad6305   ghcr.io/voxpupuli/puppetserver:8.7.0-latest   "dumb-init /docker-e…"   2 days ago     Up 2 days (healthy)       0.0.0.0:8140->8140/tcp             puppet-puppet-1
df53cd6f1a71   postgres:17-alpine                            "docker-entrypoint.s…"   2 days ago     Up 2 days (healthy)       5432/tcp                           puppet-postgres-1
6db38997fdde   corentinth/it-tools                           "/docker-entrypoint.…"   9 days ago     Up 9 days                 0.0.0.0:8080->80/tcp               it-tools
root@sofx1013dckr309.home.lan:~/tests/puppet#

------------

root@sofx1013dckr309.home.lan:~/tests/puppet# docker exec -it puppet-puppetdb-1 bash
root@puppetdb:~# hostname -f
puppetdb
root@puppetdb:~#
exit
root@sofx1013dckr309.home.lan:~/tests/puppet#

------------

root@sofx1013dckr309.home.lan:~/tests/puppet# openssl x509 -noout -subject -in ./ssl_puppet/certs/puppetdb.pem
subject=CN = puppetdb
root@sofx1013dckr309.home.lan:~/tests/puppet#

------------

root@sofx1013dckr309.home.lan:~/tests/puppet# cat docker-compose.yml
---
services:
  puppet:
    image: ghcr.io/voxpupuli/puppetserver:8.7.0-latest
    hostname: puppet
    environment:
      PUPPETSERVER_HOSTNAME: puppet
      PUPPETSERVER_PORT: 8140
      PUPPETDB_HOSTNAME: puppetdb
      PUPPETDB_SSL_PORT: 8081
      USE_PUPPETDB: true
      PUPPET_STORECONFIGS_BACKEND: puppetdb
      PUPPET_STORECONFIGS: true
      PUPPET_REPORTS: "puppetdb,store"
      CA_ALLOW_SUBJECT_ALT_NAMES: true
      AUTOSIGN: true
    volumes:
      - ./ssl_puppet:/etc/puppetlabs/puppet/ssl
    ports:
      - 8140:8140
    restart: always

  puppetdb:
    image: ghcr.io/voxpupuli/puppetdb:8.8.1-latest
    hostname: puppetdb
    environment:
      USE_PUPPETSERVER: true
      PUPPETSERVER_HOSTNAME: puppet
      PUPPETSERVER_PORT: 8140
      PUPPETDB_SSL_PORT: 8081
      PUPPETDB_POSTGRES_HOSTNAME: postgres
      PUPPETDB_POSTGRES_PORT: 5432
      PUPPETDB_PASSWORD: puppetdb
      PUPPETDB_USER: puppetdb
      PUPPETDB_SSL_KEY: /etc/puppetlabs/puppet/ssl/private_keys/puppetdb.pem
      PUPPETDB_SSL_CERT: /etc/puppetlabs/puppet/ssl/public_keys/puppetdb.pem
      PUPPETDB_SSL_CA_CERT: /etc/puppetlabs/puppet/ssl/certs/ca.pem
      PUPPETDB_CERTIFICATE_ALLOWLIST: "puppet,puppet.home.lan,puppetdb,puppetdb.home.lan,puppetboard,puppetboard.home.lan"
    volumes:
      - ./ssl_puppet:/etc/puppetlabs/puppet/ssl
    ports:
      - 8081:8081
    restart: always

  postgres:
    image: docker.io/postgres:17-alpine
    hostname: postgres
    environment:
      POSTGRES_DB: puppetdb
      POSTGRES_USER: puppetdb
      POSTGRES_PASSWORD: puppetdb
    healthcheck:
      test: ["CMD-SHELL", "sh -c 'pg_isready -U puppetdb -d puppetdb'"]
      interval: 10s
      timeout: 3s
      retries: 3
    volumes:
      - ./enable_pg_trgm.sql:/docker-entrypoint-initdb.d/enable_pg_trgm.sql
      - ./postgres_data:/var/lib/postgresql/data
    restart: always

  puppetboard:
    image: ghcr.io/voxpupuli/puppetboard
    hostname: puppetboard
    environment:
      PUPPETDB_HOST: puppetdb
      PUPPETDB_PORT: 8081
      PUPPETBOARD_PORT: 8080
      ENABLE_CATALOG: true
      PUPPETDB_SSL_VERIFY: /etc/puppetlabs/puppet/ssl/ca-cert.pem
      PUPPETDB_KEY: /etc/puppetlabs/puppet/ssl/puppetboard-key.pem
      PUPPETDB_CERT: /etc/puppetlabs/puppet/ssl/puppetboard-key.pem
      SECRET_KEY: "495ed6e5e799015811d1d00bd424b464df1b9809dade7964b6e4dcf124d9e170"
      DEFAULT_ENVIRONMENT: "*"
    volumes:
      - ./ssl_puppetboard:/etc/puppetlabs/puppet/ssl
    ports:
      - 8282:8080
    restart: none

networks:
  default:
    name: crafty-minimal
root@sofx1013dckr309.home.lan:~/tests/puppet#

------------

root@sofx1013dckr309.home.lan:~/tests/puppet# openssl x509 -noout -subject -in ./ssl_puppetboard/puppetboard-cert.pem
subject=CN = puppetdb
root@sofx1013dckr309.home.lan:~/tests/puppet#

------------

root@puppet:~# puppetserver ca list --all
Signed Certificates:
    puppetdb              (SHA256)  93:E9:48:34:68:66:43:AA:43:CA:B5:DB:95:53:2E:18:64:E1:83:FC:C2:7F:3E:A1:71:7A:35:3D:9D:B4:84:7D     alt names: ["DNS:puppetdb", "DNS:puppetdb.home.lan"]
    puppet.home.lan       (SHA256)  45:13:A3:68:58:11:E5:B2:5E:45:7A:58:2F:E4:84:2E:9A:14:5A:FC:CB:6C:D5:3B:E3:08:CF:20:50:02:57:73     alt names: ["DNS:puppet", "DNS:puppet.home.lan"]     authorization extensions: [pp_cli_auth: true]
    puppetboard           (SHA256)  BA:3E:4E:54:51:27:C5:42:C5:AC:90:E0:2A:61:BD:AB:26:37:26:FD:DD:3A:72:0C:47:AE:F8:EC:2E:A9:8F:FE     alt names: ["DNS:puppetboard", "DNS:puppetboard.home.lan"]
root@puppet:~#