h1. Setting up Nginx + Passenger 

Passenger packages/repos are available at http://passenger.stealthymonkeys.com/

Install packages

<pre>

    # yum install -y nginx-passenger

</pre>

Create self signed certificate

<pre>

    # cd /etc/nginx/

    # openssl genrsa -des3 -out server.key 1024

    # openssl req -new -key server.key -out server.csr

    # cp server.key server.key.org

    # openssl rsa -in server.key.org -out server.key

    # openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

</pre>

Make a local copy of the apps `public` directory (local to rails, as nginx/passenger doesn't seem to like symbolic links)

<pre>

    # cd /usr/share/foreman

    # rm public

    # cp -a /var/lib/foreman/public .

</pre>

Add to `/etc/nginx/nginx.conf`:

<pre>

    env PATH;

</pre>

Create foreman application config file `/etc/nginx/conf.d/foreman.conf`:

<pre>

    server {

        listen 443;

        server_name _;

        ssl on;

        ssl_certificate /etc/nginx/server.crt;

        ssl_certificate_key /etc/nginx/server.key;

        # Verify puppetmaster clients against Puppet CA

        ssl_crl /var/lib/puppet/ssl/ca/ca_crl.pem;

        ssl_client_certificate /var/lib/puppet/ssl/certs/ca.pem;

        ssl_verify_client optional;

        ssl_verify_depth 1;

        access_log /var/log/nginx/foreman_access.log;

        error_log /var/log/nginx/foreman_error.log debug;

        root /usr/share/foreman/public;

        passenger_enabled on;

        passenger_set_cgi_param HTTPS on;

        passenger_set_cgi_param SSL_CLIENT_S_DN $ssl_client_s_dn;

        passenger_set_cgi_param SSL_CLIENT_VERIFY $ssl_client_verify;

        #location / {

        #}

    }

</pre>

The SSL configuration here can verify clients for SSL communications with puppetmaster scripts, as per the "Securing Communications with SSL":http://theforeman.org/manuals/1.1/index.html#5.4SecuringCommunicationswithSSL documentation.  It verifies clients using the Puppet CA and passes the information to Passenger and Foreman.

This guide uses a self-signed certificate for the Foreman server, so the ENC and report scripts will need to reference the certificate generated here in the @:ssl_ca@ and @$foreman_ssl_ca@ settings.