Initialize the Puppet bridge: environment examples

To initialize the Puppet bridge, use the examples below to find the right command invocation for your environment.

Example 1: Minimal installation (Quick start)

Run the following command:

```bash
pe-bridge-cli init --bundle /path/to/bundle.gz
```

This is the simplest way to get the Puppet bridge running. However, be aware of two important defaults:

• Self-signed certificate using the local hostname: The init command generates a self-signed TLS certificate with the machine's hostname as the only DNS name. This certificate is used for mTLS with the Perforce Unified Compliance platform. In most production environments, the Perforce Unified Compliance platform will need to reach the Puppet bridge via an externally routable DNS name (similar to pebridge.example.com), not the machine's local hostname. If that applies to you, see Example 2: Recommended production installation.

• Puppet CA lookup from a local Puppet agent: The Puppet bridge needs the Puppet CA certificate to verify its connections to PuppetDB and Puppet Server. By default, it looks for this CA at /etc/puppetlabs/puppet/ssl/certs/ca.pem, which is where a locally installed Puppet agent stores it. If there is no Puppet agent on this machine (or the CA cert is in a different location), you must provide the path using the --pe-ca flag. See Example 2: Puppet bridge standard production installation.

Example 2: Standard production installation

In most production setups, you will need to specify the externally routable DNS name and might have to point to the Puppet CA certificate explicitly:

```bash
pe-bridge-cli init \
--bundle /path/to/bundle.gz \
--dns-names pebridge.example.com \
--pe-ca /path/to/puppet-ca.pem
```

• --dns-names: Adds pebridge.example.com as a Subject Alternative Name (SAN) on the generated TLS certificate. This should be the DNS name that the Perforce Unified Compliance platform uses to connect to this Puppet bridge instance. You can pass multiple names as a comma-separated list (similar to --dns-names pebridge.example.com,pebridge-alt.example.com).

• --pe-ca: Points to the Puppet CA certificate file. This is required whenever the Puppet CA cert is not available at the default path (/etc/puppetlabs/puppet/ssl/certs/ca.pem). For example, when the Puppet bridge runs on a host that does not have a Puppet agent installed, you must specify the location of the Puppet CA certificate file.

Example 3: Custom certificate infrastructure

If your organization manages its own certificate infrastructure (for example, an internal CA) and you want the Puppet bridge to use your certificates instead of generating self-signed ones, provide all three certificate files:

```bash
pe-bridge-cli init \
--bundle /path/to/bundle.gz \
--pe-ca /path/to/puppet-ca.pem \
--cacert /path/to/custom-ca.pem \
--cert /path/to/server-cert.pem \
--key /path/to/server-key.pem
```

• --pe-ca: The Puppet CA certificate, used to verify connections to PuppetDB and Puppet Server. This is separate from the custom CA (it is always the Puppet CA regardless of what certificates the Puppet bridge itself presents).

• --cacert: Your organization's CA certificate that issued the server certificate. The Puppet bridge will use this as its trust root for inter-service TLS.

• --cert: The server certificate the Puppet bridge will present. This certificate's SANs must include the DNS name or names that the Perforce Unified Compliance platform uses to reach the Puppet bridge.

• --key: The private key corresponding to the server certificate.

All three (--cacert, --cert, --key) must be provided together. When custom certs are supplied, the Puppet bridge skips its own certificate generation entirely.

pe-bridge init command flags

The pe-bridge init command accepts the following flags. You can use these options to provide certificate paths, override service URLs, or change default ports.