Forge Home


The octopass module handles installing and configuring octopass, management linux user and authn with the org/team on GitHub.


4,884 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 0.1.1 (latest)
  • 0.1.0
released Dec 12th 2018
This version is compatible with:
  • Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >= 4.7.0 < 6.0.0
  • , , , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'hfm-octopass', '0.1.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add hfm-octopass
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install hfm-octopass --version 0.1.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



hfm/octopass — version 0.1.1 Dec 12th 2018

puppet-octopass Build Status Puppet Forge

Table of Contents

  1. Description
  2. Setup - The basics of getting started with octopass
  3. Usage - Configuration options and additional functionality
  4. Limitations - OS compatibility, etc.
  5. Development - Guide for contributing to the module


The octopass module handles installing and configuring octopass.


Setup Requirements

The octopass module requires the following puppet module:

note: puppetlabs-apt is soft dependencies. If you are installing on Debian systems, you will need to configure appropriate versions of this module.


Configuring modules in Puppet

To set up the octopass in Puppet codes, you can configure like the following:

class { '::octopass':
  token        => 'iad87dih122ce66a1e20a751664c8a9dkoak87g7',
  organization => 'yourorganization',
  team         => 'yourteam',

Configuring modules from Hiera

To set up octopass using Hiera, you declare include ::octopass in puppet manifests and configure in Hiera like the following:

include ::octopass
octopass::token: iad87dih122ce66a1e20a751664c8a9dkoak87g7
octopass::organization: yourorganization
octopass::team: yourteam

Configure with owner/repository

If you want to use a repository instead of team, you'd set owner and repository:

octopass::token: iad87dih122ce66a1e20a751664c8a9dkoak87g7
octopass::owner: hfm
octopass::repository: puppet-octopass

Change group name

If you want to use other name of group than team or repository, you'd set group:

octopass::token: iad87dih122ce66a1e20a751664c8a9dkoak87g7
octopass::organization: yourorganization
octopass::team: yourteam
octopass::group: othergroupname

For GitHub Enterprise

With GitHub Enterprise, you'd change endpoint:

octopass::endpoint: ''

Combination with other modules

Octopass in production requires nsswitch.conf for resolving name, and sshd and PAM like the following:

include ::octopass

include ::nsswitch

include ::ssh

pam { 'Set sss entry to system-auth auth':
  ensure    => present,
  service   => 'sshd',
  type      => 'auth',
  control   => 'requisite',
  module    => '',
  arguments => ['quiet', 'expose_authtok', '/usr/bin/octopass', 'pam'],
octopass::token: iad87dih122ce66a1e20a751664c8a9dkoak87g7
octopass::organization: yourorganization
octopass::team: yourteam

  - files
  - octopass
  - sss
nsswitch::passwd: "%{alias('nsswitch::octopass')}"
nsswitch::shadow: "%{alias('nsswitch::octopass')}"
nsswitch::group: "%{alias('nsswitch::octopass')}"

ssh::sshd_authorized_keys_command: '/usr/bin/octopass'
ssh::sshd_authorized_keys_command_user: 'root'
ssh::sshd_use_pam: 'yes'


See operatingsystem_support in metadata.json


Running tests

The octopass puppet module contains tests for both rspec-puppet (unit tests) and beaker-rspec (acceptance tests) to verify functionality. For detailed information on using these tools, please see their respective documentation.

Testing quickstart

  • Unit tests:
$ bundle install
$ bundle exec rake
  • Acceptance tests:
# Set your DOCKER_HOST variable
$ eval "$(docker-machine env default)"

# List available beaker nodesets
$ bundle exec rake beaker_nodes

# Run beaker acceptance tests
$ BEAKER_set=debian9 bundle exec rake beaker