How can i set up a remote smart-proxy in a segmented network

I am about to setup a foreman smart-proxy in a network where the hosts will
not be able to reach foreman directly - a segmented network, if you look at
the diagram in the manual:

<http://theforeman.org/static/images/foreman_architecture.png>
I was trying to find a guide for this, but i couldn't. Can anyone tell me
how. I know the smart-proxy needs to be able to communicate to foreman, but
what modules do i need? Dns, tftp, dhcp… anything else?

> I am about to setup a foreman smart-proxy in a network where the hosts
> will not be able to reach foreman directly - a segmented network, if you
> look at the diagram in the manual:
>
> <http://theforeman.org/static/images/foreman_architecture.png>
> I was trying to find a guide for this, but i couldn't. Can anyone tell me
> how. I know the smart-proxy needs to be able to communicate to foreman, but
> what modules do i need? Dns, tftp, dhcp… anything else?
>

Since 1.7, there is a template feature, which allows the proxy to act as
the provisioning source (e.g. your kickstart, preseed etc), this was the
missing piece for full disconnected implementation.

Ohad

··· On Thu, Nov 13, 2014 at 12:14 PM, Dennis Højgaard wrote:


You received this message because you are subscribed to the Google Groups
"Foreman users" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.

I have now setup foreman with a "remote" proxy, and on the remote network
second network, which does not have connection to foreman i want machines
to provision from. As for now they can get tftp start and the debian
installer comes up, but i get the errror that it tries to get information
from the foreman host which is not the plan… So how do i set it up from
here? You are talking about a template feature… WHere do i find that?

··· Den torsdag den 13. november 2014 13.36.34 UTC+1 skrev Daniel Lobato: > > It can be done if you can live without provisioning until then. You can > configure your hosts with Puppet and the proxy in a segmented network in > 1.6.2, and manage DHCP/DNS from Foreman, provisioning would not work. > > https://groups.google.com/forum/#!topic/foreman-users/aGFY_v-9ubc 1.7.0 > RC1 was released 2 days ago > The soft schedule for the release lives here: > http://projects.theforeman.org/projects/foreman/wiki/Foreman_17_Schedule > > It'd help us immensely if you start setting this up and encounter any bugs > that apply to your setup so we can get a solid final release :) > > On Thu, Nov 13, 2014 at 1:25 PM, Dennis Højgaard > wrote: > >> So what i am aiming cannot be done with 1.6.2? >> >> Do you know when 1.7 will be released? >> >> >> med venlig hilsen >> >> >> >> 2014-11-13 13:19 GMT+01:00 Ohad Levy <ohad...@gmail.com >: >> >>> >>> >>> On Thu, Nov 13, 2014 at 12:14 PM, Dennis Højgaard >> > wrote: >>> >>>> I am about to setup a foreman smart-proxy in a network where the hosts >>>> will not be able to reach foreman directly - a segmented network, if you >>>> look at the diagram in the manual: >>>> >>>> >>>> I was trying to find a guide for this, but i couldn't. Can anyone tell >>>> me how. I know the smart-proxy needs to be able to communicate to foreman, >>>> but what modules do i need? Dns, tftp, dhcp.. anything else? >>>> >>> >>> Since 1.7, there is a template feature, which allows the proxy to act as >>> the provisioning source (e.g. your kickstart, preseed etc), this was the >>> missing piece for full disconnected implementation. >>> >>> Ohad >>> >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "Foreman users" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to foreman-user...@googlegroups.com . >>>> To post to this group, send email to forema...@googlegroups.com >>>> . >>>> Visit this group at http://groups.google.com/group/foreman-users. >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> >>> -- >>> You received this message because you are subscribed to a topic in the >>> Google Groups "Foreman users" group. >>> To unsubscribe from this topic, visit >>> https://groups.google.com/d/topic/foreman-users/oTXhK6qi99M/unsubscribe. >>> To unsubscribe from this group and all its topics, send an email to >>> foreman-user...@googlegroups.com . >>> To post to this group, send email to forema...@googlegroups.com >>> . >>> Visit this group at http://groups.google.com/group/foreman-users. >>> For more options, visit https://groups.google.com/d/optout. >>> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Foreman users" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to foreman-user...@googlegroups.com . >> To post to this group, send email to forema...@googlegroups.com >> . >> Visit this group at http://groups.google.com/group/foreman-users. >> For more options, visit https://groups.google.com/d/optout. >> > > > > -- > Daniel Lobato > > @elobatoss > blog.daniellobato.me > daniellobato.me > > GPG: http://keys.gnupg.net/pks/lookup?op=get&search=0x7A92D6DD38D6DE30 >

So what i am aiming cannot be done with 1.6.2?

Do you know when 1.7 will be released?

med venlig hilsen

··· 2014-11-13 13:19 GMT+01:00 Ohad Levy :

On Thu, Nov 13, 2014 at 12:14 PM, Dennis Højgaard < > dennishojgaard@gmail.com> wrote:

I am about to setup a foreman smart-proxy in a network where the hosts
will not be able to reach foreman directly - a segmented network, if you
look at the diagram in the manual:

http://theforeman.org/static/images/foreman_architecture.png
I was trying to find a guide for this, but i couldn’t. Can anyone tell
me how. I know the smart-proxy needs to be able to communicate to foreman,
but what modules do i need? Dns, tftp, dhcp… anything else?

Since 1.7, there is a template feature, which allows the proxy to act as
the provisioning source (e.g. your kickstart, preseed etc), this was the
missing piece for full disconnected implementation.

Ohad


You received this message because you are subscribed to the Google Groups
"Foreman users" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


You received this message because you are subscribed to a topic in the
Google Groups “Foreman users” group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/foreman-users/oTXhK6qi99M/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.

It can be done if you can live without provisioning until then. You can
configure your hosts with Puppet and the proxy in a segmented network in
1.6.2, and manage DHCP/DNS from Foreman, provisioning would not work.

https://groups.google.com/forum/#!topic/foreman-users/aGFY_v-9ubc 1.7.0 RC1
was released 2 days ago
The soft schedule for the release lives here:
Foreman 17 Schedule - Foreman

It'd help us immensely if you start setting this up and encounter any bugs
that apply to your setup so we can get a solid final release :slight_smile:

··· On Thu, Nov 13, 2014 at 1:25 PM, Dennis Højgaard wrote:

So what i am aiming cannot be done with 1.6.2?

Do you know when 1.7 will be released?

med venlig hilsen

2014-11-13 13:19 GMT+01:00 Ohad Levy ohadlevy@gmail.com:

On Thu, Nov 13, 2014 at 12:14 PM, Dennis Højgaard < >> dennishojgaard@gmail.com> wrote:

I am about to setup a foreman smart-proxy in a network where the hosts
will not be able to reach foreman directly - a segmented network, if you
look at the diagram in the manual:

http://theforeman.org/static/images/foreman_architecture.png
I was trying to find a guide for this, but i couldn’t. Can anyone tell
me how. I know the smart-proxy needs to be able to communicate to foreman,
but what modules do i need? Dns, tftp, dhcp… anything else?

Since 1.7, there is a template feature, which allows the proxy to act as
the provisioning source (e.g. your kickstart, preseed etc), this was the
missing piece for full disconnected implementation.

Ohad


You received this message because you are subscribed to the Google
Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send
an email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


You received this message because you are subscribed to a topic in the
Google Groups “Foreman users” group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/foreman-users/oTXhK6qi99M/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


You received this message because you are subscribed to the Google Groups
"Foreman users" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


Daniel Lobato

@elobatoss
blog.daniellobato.me
daniellobato.me

GPG: http://keys.gnupg.net/pks/lookup?op=get&search=0x7A92D6DD38D6DE30

Are you using the 1.7.0RC1 version of the proxy? If so, you can find an
example of the configuration file for the templates part of the proxy here

··· - https://github.com/theforeman/smart-proxy/blob/1.7-stable/config/settings.d/templates.yml.example

On Thu, Nov 13, 2014 at 4:18 PM, Dennis Højgaard dennishojgaard@gmail.com wrote:

I have now setup foreman with a “remote” proxy, and on the remote network
second network, which does not have connection to foreman i want machines
to provision from. As for now they can get tftp start and the debian
installer comes up, but i get the errror that it tries to get information
from the foreman host which is not the plan… So how do i set it up from
here? You are talking about a template feature… WHere do i find that?

Den torsdag den 13. november 2014 13.36.34 UTC+1 skrev Daniel Lobato:

It can be done if you can live without provisioning until then. You can
configure your hosts with Puppet and the proxy in a segmented network in
1.6.2, and manage DHCP/DNS from Foreman, provisioning would not work.

https://groups.google.com/forum/#!topic/foreman-users/aGFY_v-9ubc 1.7.0
RC1 was released 2 days ago
The soft schedule for the release lives here: http://projects.theforeman.
org/projects/foreman/wiki/Foreman_17_Schedule

It’d help us immensely if you start setting this up and encounter any
bugs that apply to your setup so we can get a solid final release :slight_smile:

On Thu, Nov 13, 2014 at 1:25 PM, Dennis Højgaard dennish...@gmail.com >> wrote:

So what i am aiming cannot be done with 1.6.2?

Do you know when 1.7 will be released?

med venlig hilsen

2014-11-13 13:19 GMT+01:00 Ohad Levy ohad...@gmail.com:

On Thu, Nov 13, 2014 at 12:14 PM, Dennis Højgaard <dennish...@gmail.com >>>> > wrote:

I am about to setup a foreman smart-proxy in a network where the hosts
will not be able to reach foreman directly - a segmented network, if you
look at the diagram in the manual:

http://theforeman.org/static/images/foreman_architecture.png
I was trying to find a guide for this, but i couldn’t. Can anyone
tell me how. I know the smart-proxy needs to be able to communicate to
foreman, but what modules do i need? Dns, tftp, dhcp… anything else?

Since 1.7, there is a template feature, which allows the proxy to act
as the provisioning source (e.g. your kickstart, preseed etc), this was the
missing piece for full disconnected implementation.

Ohad


You received this message because you are subscribed to the Google
Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send
an email to foreman-user...@googlegroups.com.
To post to this group, send email to forema...@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


You received this message because you are subscribed to a topic in the
Google Groups “Foreman users” group.
To unsubscribe from this topic, visit https://groups.google.com/d/
topic/foreman-users/oTXhK6qi99M/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
foreman-user...@googlegroups.com.
To post to this group, send email to forema...@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


You received this message because you are subscribed to the Google
Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send
an email to foreman-user...@googlegroups.com.
To post to this group, send email to forema...@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


Daniel Lobato

@elobatoss
blog.daniellobato.me
daniellobato.me

GPG: http://keys.gnupg.net/pks/lookup?op=get&search=0x7A92D6DD38D6DE30


You received this message because you are subscribed to the Google Groups
"Foreman users" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.


Daniel Lobato

@elobatoss
blog.daniellobato.me
daniellobato.me

GPG: http://keys.gnupg.net/pks/lookup?op=get&search=0x7A92D6DD38D6DE30

I did set that up with the template_url, but in the default pxe template i
can see this:
ppend initrd=<%= @initrd %> interface=auto url=<%=
foreman_url('provision')%> which means that it is still looking for foreman
to get the preconfiguration file, and that fails since they are not on the
same network? Do i need to go through provisioning setup again?

··· Den torsdag den 13. november 2014 19.43.13 UTC+1 skrev Daniel Lobato: > > Are you using the 1.7.0RC1 version of the proxy? If so, you can find an > example of the configuration file for the templates part of the proxy here > - > https://github.com/theforeman/smart-proxy/blob/1.7-stable/config/settings.d/templates.yml.example > > > On Thu, Nov 13, 2014 at 4:18 PM, Dennis Højgaard > wrote: > >> I have now setup foreman with a "remote" proxy, and on the remote network >> second network, which does not have connection to foreman i want machines >> to provision from. As for now they can get tftp start and the debian >> installer comes up, but i get the errror that it tries to get information >> from the foreman host which is not the plan.. So how do i set it up from >> here? You are talking about a template feature.. WHere do i find that? >> >> Den torsdag den 13. november 2014 13.36.34 UTC+1 skrev Daniel Lobato: >>> >>> It can be done if you can live without provisioning until then. You can >>> configure your hosts with Puppet and the proxy in a segmented network in >>> 1.6.2, and manage DHCP/DNS from Foreman, provisioning would not work. >>> >>> https://groups.google.com/forum/#!topic/foreman-users/aGFY_v-9ubc 1.7.0 >>> RC1 was released 2 days ago >>> The soft schedule for the release lives here: >>> http://projects.theforeman.org/projects/foreman/wiki/Foreman_17_Schedule >>> >>> It'd help us immensely if you start setting this up and encounter any >>> bugs that apply to your setup so we can get a solid final release :) >>> >>> On Thu, Nov 13, 2014 at 1:25 PM, Dennis Højgaard >>> wrote: >>> >>>> So what i am aiming cannot be done with 1.6.2? >>>> >>>> Do you know when 1.7 will be released? >>>> >>>> >>>> med venlig hilsen >>>> >>>> >>>> >>>> 2014-11-13 13:19 GMT+01:00 Ohad Levy : >>>> >>>>> >>>>> >>>>> On Thu, Nov 13, 2014 at 12:14 PM, Dennis Højgaard < >>>>> dennish...@gmail.com> wrote: >>>>> >>>>>> I am about to setup a foreman smart-proxy in a network where the >>>>>> hosts will not be able to reach foreman directly - a segmented network, if >>>>>> you look at the diagram in the manual: >>>>>> >>>>>> >>>>>> I was trying to find a guide for this, but i couldn't. Can anyone >>>>>> tell me how. I know the smart-proxy needs to be able to communicate to >>>>>> foreman, but what modules do i need? Dns, tftp, dhcp.. anything else? >>>>>> >>>>> >>>>> Since 1.7, there is a template feature, which allows the proxy to act >>>>> as the provisioning source (e.g. your kickstart, preseed etc), this was the >>>>> missing piece for full disconnected implementation. >>>>> >>>>> Ohad >>>>> >>>>>> >>>>>> -- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "Foreman users" group. >>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>> send an email to foreman-user...@googlegroups.com. >>>>>> To post to this group, send email to forema...@googlegroups.com. >>>>>> Visit this group at http://groups.google.com/group/foreman-users. >>>>>> For more options, visit https://groups.google.com/d/optout. >>>>>> >>>>> >>>>> -- >>>>> You received this message because you are subscribed to a topic in the >>>>> Google Groups "Foreman users" group. >>>>> To unsubscribe from this topic, visit https://groups.google.com/d/ >>>>> topic/foreman-users/oTXhK6qi99M/unsubscribe. >>>>> To unsubscribe from this group and all its topics, send an email to >>>>> foreman-user...@googlegroups.com. >>>>> To post to this group, send email to forema...@googlegroups.com. >>>>> Visit this group at http://groups.google.com/group/foreman-users. >>>>> For more options, visit https://groups.google.com/d/optout. >>>>> >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "Foreman users" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to foreman-user...@googlegroups.com. >>>> To post to this group, send email to forema...@googlegroups.com. >>>> Visit this group at http://groups.google.com/group/foreman-users. >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> >>> >>> >>> -- >>> Daniel Lobato >>> >>> @elobatoss >>> blog.daniellobato.me >>> daniellobato.me >>> >>> GPG: http://keys.gnupg.net/pks/lookup?op=get&search=0x7A92D6DD38D6DE30 >>> >> -- >> You received this message because you are subscribed to the Google Groups >> "Foreman users" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to foreman-user...@googlegroups.com . >> To post to this group, send email to forema...@googlegroups.com >> . >> Visit this group at http://groups.google.com/group/foreman-users. >> For more options, visit https://groups.google.com/d/optout. >> > > > > -- > Daniel Lobato > > @elobatoss > blog.daniellobato.me > daniellobato.me > > GPG: http://keys.gnupg.net/pks/lookup?op=get&search=0x7A92D6DD38D6DE30 >

PXE templates are written when the host is put into build mode, so if you
set up the templates feature after creating the host, you'll need to cause
Foreman to rewrite it. Simply go to the Host page, click Cancel Build, and
then click it again (now labelled just Build) to re-enable it.

You can also verify what Foreman will write to the tftp server from the
Host page - click the Templates tab, then Review next to the PXE template
to see the rendered version for that host.

··· On 14 November 2014 07:26, Dennis Højgaard wrote:

I did set that up with the template_url, but in the default pxe template i
can see this:
ppend initrd=<%= @initrd %> interface=auto url=<%=
foreman_url(‘provision’)%> which means that it is still looking for foreman
to get the preconfiguration file, and that fails since they are not on the
same network? Do i need to go through provisioning setup again?