The server configuration file contains a list of all configuration options that are available for the Chef Infra Server. Some of these values should be modified for large-scale installations.
Customize the Config File
/etc/opscode/chef-server.rb file contains all of the non-default
configuration settings used by the Chef Infra Server. The default
settings are built into the Chef Infra Server configuration and should
only be added to the
chef-server.rb file to apply non-default values.
These configuration settings are processed when the
chef-server-ctl reconfigure command is run. The
is a Ruby file, which means that conditional statements can be used
case statement to apply different values based on whether the
setting exists on the front-end or back-end servers. Add code to the
server configuration file similar to the following:
role_name = ChefServer['servers'][node['fqdn']]['role'] case role_name when 'backend' # backend-specific configuration here when 'frontend' # frontend-specific configuration here end
The following settings are typically added to the server configuration file (no equal sign is necessary to set the value):
The FQDN for the Chef Infra Server. This setting is not in the server configuration file by default. When added, its value should be equal to the FQDN for the service URI used by the Chef Infra Server. FQDNs must always be in lowercase. For example:
Use to set the IP version:
"ipv6". When set to
"ipv6", the API listens on IPv6 and front end and back end services communicate using IPv6 when a high availability configuration is used. When configuring for IPv6 in a high availability configuration, be sure to set the netmask on the IPv6
backend_vipattribute. Default value:
The following settings are often modified from the default as part of the tuning effort for the nginx service and to configure the Chef Infra Server to use SSL certificates:
The SSL certificate used to verify communication over HTTPS. Default value:
The certificate key used for SSL communication. Default value:
The list of supported cipher suites that are used to establish a secure connection. To favor AES256 with ECDHE forward security, drop the
RC4-SHA:RC4-MD5:RC4:RSAprefix. For example:
nginx['ssl_ciphers'] = "HIGH:MEDIUM:!LOW:!kEDH: \ !aNULL:!ADH:!eNULL:!EXP: \ !SSLv2:!SEED:!CAMELLIA: \ !PSK"
The SSL protocol versions that are enabled for the Chef Infra Server API. For enhanced security set this value to
'TLSv1.2'. TLS 1.2 is supported on Chef Infra Client 10.16.4 and later on Linux, Unix, and macOS, and on Chef Infra Client 12.8 and later on Windows. If it is necessary to support these older end-of-life Chef Infra Client releases, set this value to
'TLSv1.1 TLSv1.2'. For example:
nginx['ssl_protocols'] = 'TLSv1.2'
See https://www.openssl.org/docs/man1.0.2/man1/ciphers.html for more
information about the values used with the
For example, after copying the SSL certificate files to the Chef Infra
Server, update the
nginx['ssl_certificate_key'] settings to specify the paths to those
files, and then (optionally) update the
nginx['ssl_protocols'] settings to reflect the desired level of
hardness for the Chef Infra Server:
nginx['ssl_certificate'] = '/etc/pki/tls/private/name.of.pem' nginx['ssl_certificate_key'] = '/etc/pki/tls/private/name.of.key' nginx['ssl_ciphers'] = 'HIGH:MEDIUM:!LOW:!kEDH:!aNULL:!ADH:!eNULL:!EXP:!SSLv2:!SEED:!CAMELLIA:!PSK' nginx['ssl_protocols'] = 'TLSv1 TLSv1.1 TLSv1.2'
Optional Services Tuning
The following settings are often used to for performance tuning of the Chef Infra Server in larger installations.
When changes are made to the chef-server.rb file the Chef Infra Server must be reconfigured by running the following command:
The following setting is often modified from the default as part of the tuning effort for the bookshelf service:
The virtual IP address. Default value:
The following settings are often modified from the default as part of the tuning effort for the opscode-erchef service:
The number of open connections to PostgreSQL that are maintained by the service. If failures indicate that the opscode-erchef service ran out of connections, try increasing the
postgresql['max_connections']setting. If failures persist, then increase this value (in small increments) and also increase the value for
postgresql['max_connections']. Default value:
The amount of time (in seconds) before connections to the server expire. If Chef Infra Client runs are timing out, increase this setting to
3600, and then adjust again if necessary. Default value:
Use to specify that search results only return objects to which an actor (user, client, etc.) has read access, as determined by ACL settings. This affects all searches. When
true, the performance of the Chef management console may increase because it enables the Chef management console to skip redundant ACL checks. To ensure the Chef management console is configured properly, after this setting has been applied with a
chef-manage-ctl reconfigureto ensure the Chef management console also picks up the setting. Default value:
opscode_erchef['strict_search_result_acls']affects all search results and any actor (user, client, etc.) that does not have read access to a search result will not be able to view it. For example, this could affect search results returned during a Chef Infra Client runs if a Chef Infra Client does not have permission to read the information.
The following setting is often modified from the default as part of the tuning effort for the postgresql service:
The maximum number of allowed concurrent connections. This value should only be tuned when the
opscode_erchef['db_pool_size']value used by the opscode-erchef service is modified. Default value:
350. If there are more than two front end machines in a cluster, the
postgresql['max_connections']setting should be increased. The increased value depends on the number of machines in the front end, but also the number of services that are running on each of these machines.
- Each front end machine always runs the oc_bifrost and opscode-erchef services.
- The Reporting add-on adds the reporting service.
Each of these services requires 25 connections, above the default value.
Use the following formula to help determine what the increased value should be:
new_value = current_value + [ (# of front end machines - 2) * (25 * # of services) ]
For example, if the current value is 350, there are four front end machines, and all add-ons are installed, then the formula looks like:
550 = 350 + [(4 - 2) * (25 * 4)]