Learn Chef - Chef Infra Server

#Introduction

In episode 8 you mastered knife as the infrastructure remote control from the workstation. You know how to upload cookbooks, create data bags, bootstrap nodes, and manage environments along with version freezing. All those commands talk to a central component you haven't opened up yet: the chef-server.

Without the chef-server, all node data, cookbooks, data bags, and chef-client run results have no home. The server is what stores the infrastructure state and serves the API for both knife and chef-client. Understanding how to install and manage it is the skill that separates a Chef user from a Chef administrator.

Episode 9 will cover installing Chef Infra Server from the chef-server-core package, the chef-server-ctl commands, creating organizations and users, SSL configuration, and advanced management such as backups with knife-ec-backup, high availability, and the upgrade path.

#Installing Chef Infra Server

Chef Infra Server is distributed as a server package containing all its components: PostgreSQL for the database, Elasticsearch for search, Nginx for proxying, and RabbitMQ for the queue. In the past this package was called chef-server-core; today it's available as chef-server for the latest versions.

Download the package that matches your platform, then install it with your package manager. Example for Ubuntu:

wget https://packages.chef.io/files/stable/chef-server/15.10.20/ubuntu/22.04/chef-server-core_15.10.20-1_amd64.deb
sudo dpkg -i chef-server-core_15.10.20-1_amd64.deb

After the package is installed, run the initial configuration step. The command chef-server-ctl reconfigure wires together all the internal components, creates the database schema, and generates default certificates:

sudo chef-server-ctl reconfigure
sudo chef-server-ctl status

chef-server-ctl reconfigure is the most important command: every time you change the /etc/chef-server/chef-server.rb file, re-run this command to apply the changes. chef-server-ctl status shows a health summary of each component like this:

run: bookshelf: (pid 1024) 3s; run: log: (pid 1021) 3s
run: elasticsearch: (pid 1040) 2s; run: log: (pid 1036) 2s
run: nginx: (pid 1055) 2s; run: log: (pid 1052) 2s
run: postgresql: (pid 1068) 1s; run: log: (pid 1065) 1s
run: rabbitmq: (pid 1083) 1s; run: log: (pid 1080) 1s
run: redis_lb: (pid 1097) 1s; run: log: (pid 1094) 1s

The word run: at the start of each line means the component is running normally. If a component shows as down: or exit:, you can investigate with chef-server-ctl tail <component> to view its logs directly.

#Organizations and Users

The chef-server uses a two-layer model: users are human accounts that communicate through knife, while organizations (orgs) are containers that hold cookbooks, nodes, data bags, and the users authorized to manage them. One user can be a member of many organizations.

First create the server admin user, then create the organization that houses your infrastructure:

sudo chef-server-ctl user-create arman \
  "Arman Dwi" \
  arman@devnull.vercel.app \
  'S3cur3P@ss' \
  --filename /home/arman/.chef/arman.pem
 
sudo chef-server-ctl org-create devnull \
  "Devnull Organization" \
  --association_user arman \
  --filename /home/arman/.chef/devnull-validator.pem

The --filename option saves the user's private key and the validator key to local files. The user key (arman.pem) is used by knife to communicate with the server as arman. The validator key (devnull-validator.pem) is used only when bootstrapping a node for the first time.

You can also add other users to an organization:

sudo chef-server-ctl user-create sari "Sari Wulandari" sari@devnull.vercel.app 'P@ssw0rd' --filename /home/sari/.chef/sari.pem
sudo chef-server-ctl org-user-add devnull sari --admin

#SSL Configuration

By default the chef-server uses a self-signed certificate. For production, replace it with a certificate from a trusted CA by editing /etc/chef-server/chef-server.rb:

nginx['ssl_certificate'] = "/etc/chef-server/certs/fullchain.pem"
nginx['ssl_certificate_key'] = "/etc/chef-server/certs/privkey.pem"
nginx['server_name'] = "chef.example.com"

After saving, apply it with reconfigure and verify:

sudo chef-server-ctl reconfigure
openssl s_client -connect chef.example.com:443 -servername chef.example.com

openssl s_client shows the certificate chain sent by the server. Make sure the line Verify return code: 0 (ok) appears so there are no certificate errors when knife or chef-client communicate.

On the workstation side, add the following entry in config.rb so knife trusts the certificate:

current_dir = File.dirname(__FILE__)
log_level :info
log_location STDOUT
node_name 'arman'
client_key "#{current_dir}/arman.pem"
chef_server_url 'https://chef.example.com/organizations/devnull'

#Users vs Organizations Comparison

#Backup, HA, and Upgrade

A server that stores the entire infrastructure state must be backed up. The official tool for this is knife-ec-backup, a plugin that creates a copy of all server data including nodes, cookbooks, data bags, and users.

chef gem install knife-ec-backup
knife ec backup /backups/chef-server-$(date +%F)

The command above writes the entire state to the /backups/chef-server-2026-08-09 directory in a format that can be restored with knife ec restore. Run backups on a schedule through cron or a CI pipeline so snapshots are always fresh.

For high availability, Chef Infra Server provides frontend and backend modes. These modes use PostgreSQL replication for data and require at least three backend servers. Because of the high complexity, Chef releases the HA mode as a separate package called automate-ha, managed with dedicated commands:

sudo chef-server-ctl install-frontend
sudo chef-server-ctl install-backend
sudo chef-server-ctl setup-backend

The upgrade path for Chef Infra Server follows major versions step by step. The official guide forbids skipping across multiple major versions at once. The general process is:

sudo chef-server-ctl stop
sudo dpkg -i chef-server-core_15.10.20-1_amd64.deb
sudo chef-server-ctl reconfigure
sudo chef-server-ctl status

Always take a full backup before upgrading, test in a similar staging environment, and read the release notes to know about internal component changes such as Elasticsearch to OpenSearch.

#Conclusion

In episode 9 you understood how to install Chef Infra Server from the chef-server-core package, run chef-server-ctl reconfigure for initial configuration and changes, and read the health of all components with chef-server-ctl status. You also learned to create users and organizations, configure SSL for production, back up the server with knife-ec-backup, and plan high availability and safe upgrade paths.

Key takeaways:

• chef-server-ctl reconfigure is the key command that applies every server configuration change.
• Users and organizations are two identity layers: users for human accounts, orgs for infrastructure data containers.
• A user's private key appears only once at creation and must be stored in a safe location.
• SSL uses a certificate from a trusted CA so knife and chef-client connect without warnings.
• Backups with knife-ec-backup and staged upgrades keep the server safe to restore.

In the next episode, episode 10, we'll discuss the modern way to define infrastructure completely: Policyfiles. You'll learn Policyfile.rb along with its lockfile for full reproducibility, and policy groups for deterministic per-environment releases without mutating cookbooks on the server. See you there.