==================================================================
Checklist to install puppet 4 server and initially attach clients:
==================================================================

Server:
=======

1.  Install the latest puppetlabs collection repo::

        yum -y install \
        http://yum.puppetlabs.com/puppetlabs-release-pc1-el-6.noarch.rpm

2.  Install the puppet server::

        yum install puppetserver

3.  Update firewall as needed::

        # iptables -I INPUT 5 -p tcp --dport 8140 -j ACCEPT
        # show input
        Chain INPUT (policy ACCEPT)
        num  target     prot opt source               destination         
        1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
        2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
        3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
        4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
        5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8140 
        6    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

4.  Configure the puppet server:

    *   Config files:

        *   Primary config file at /etc/puppetlabs/puppetserver/conf.d
        *   Historic config file at /etc/puppetlabs/puppet/puppet.conf

    *   Any config options available in the conf.d files will be ignored in 
        puppet.conf.  Another warning: a setting left undefined in config files
        will revert to default value rather than using the values from 
        puppet.conf.  Long story short: don't use puppet.conf for puppet 
        server.  ``puppet`` commands, though, **will** use this file so keep 
        the parameters in sync.  Options to keep in sync:

+-----------------+-------------+------------------------------------------+
| puppet.server   | puppet.conf | Default                                  |
+=================+=============+==========================================+
| master-conf-dir | confdir     | /etc/puppetlabs/puppet                   |
+-----------------+-------------+------------------------------------------+
| master-code-dir | codedir     | /etc/puppetlabs/code                     |
+-----------------+-------------+------------------------------------------+
| master-var-dir  | vardir      | /opt/puppetlabs/server/data/puppetserver |
+-----------------+-------------+------------------------------------------+
| master-run-dir  | rundir      | /var/run/puppetlabs/puppetserver         |
+-----------------+-------------+------------------------------------------+
| master-log-dir  | logdir      | /var/log/puppetlabs/puppetserver         |
+-----------------+-------------+------------------------------------------+

    *   Update puppet.conf to put volatile files under /var in puppet.conf and
        puppetserver.conf.  Update ownership and perms::

            # /etc/puppetlabs/puppet/puppet.conf
            [agent]  # req for puppet agent runs
              vardir = /var/opt/puppetlabs/puppetserver
              ssldir = $vardir/ssl
            
            [user]
              vardir = /var/opt/puppetlabs/puppetserver
              ssldir = $vardir/ssl
            
            [master]
              vardir = /var/opt/puppetlabs/puppetserver
              ssldir = $vardir/ssl

            # /etc/puppetlabs/puppetserver/conf.d/puppetserver.conf
            # (optional) path to puppet conf dir; if not specified, will use
            # /etc/puppetlabs/puppet
            master-var-dir: /var/opt/puppetlabs/puppetserver

            # mkdir -p -m 755 /var/opt/puppetlabs/puppetserver && \
                chown puppet:puppet /var/opt/puppetlabs/puppetserver

    *   Update memory usage in /etc/sysconfig/puppetserver.  In test system,
        decrease to 512m.  In production env, increase... How much?  when?
        how to tell?

    *   Update TLS cert info, if desired in 
        /etc/puppetlabs/puppetserver/conf.d/webserver.conf.  Book suggests
        not doing this as CA info is still in puppet.conf

::

    ssl-cert     = /var/opt/puppetlabs/puppetserver/ssl/certs/osps.olearycomputers.com.pem
    ssl-key      = /var/opt/puppetlabs/puppetserver/ssl/private_keys/osps.olearycomputers.com.pem
    ssl-ca-cert  = /var/opt/puppetlabs/puppetserver/ssl/certs/ca.pem
    ssl-crl-cert = /var/opt/puppetlabs/puppetserver/ssl/certs/crl.pem

    *   Update logging if so desired.  Option to send logs to syslog.
    *   Update authorization as needed.  Book quite literally says::

            If you are new to puppet, skip ahead to running puppet server 
            and come back later.

5.  Update hiera.yaml to reflect hiearchy of your choice and to change
    the datadir so that all environments share data.

Client:
=======