Add support for IPv6

docker/puppetdb/Dockerfile

@@ -69,7 +69,7 @@ COPY docker/puppetdb/docker-entrypoint.d /docker-entrypoint.d
 
 # hadolint ignore=DL3009
 RUN apt-get update && \
-    apt-get install --no-install-recommends -y ca-certificates curl dnsutils netcat && \
+    apt-get install --no-install-recommends -y ca-certificates curl dnsutils netcat-openbsd && \
     chmod +x /ssl.sh /wtfc.sh /docker-entrypoint.sh /healthcheck.sh /docker-entrypoint.d/*.sh && \
     dpkg -i dumb-init_"$DUMB_INIT_VERSION"_amd64.deb
 

docker/puppetdb/conf.d/jetty.ini

@@ -2,7 +2,7 @@
 # IP address or hostname to listen for clear-text HTTP. To avoid resolution
 # issues, IP addresses are recommended over hostnames.
 # Default is `localhost`.
-host = 0.0.0.0
+host = ::
 
 # Port to listen on for clear-text HTTP.
 port = 8080
@@ -13,8 +13,8 @@ port = 8080
 
 # IP address to listen on for HTTPS connections. Hostnames can also be used
 # but are not recommended to avoid DNS resolution issues. To listen on all
-# interfaces, use `0.0.0.0`.
-# ssl-host = 0.0.0.0
+# interfaces, use `::`.
+# ssl-host = ::
 
 # The port to listen on for HTTPS connections
 # ssl-port = 8081

documentation/configure.markdown

@@ -623,7 +623,7 @@ The `[jetty]` section configures HTTP for PuppetDB.
 Sets the IP interface to listen on for **unencrypted** HTTP
 traffic. If not supplied, we bind to `localhost`, which will reject
 connections from anywhere but the PuppetDB server itself. To listen on
-all available interfaces, use `0.0.0.0`.
+all available interfaces, use `::`.
 
 To avoid DNS resolution confusion, if you wish to set this to something other than `localhost`, we reccomend using an IP address instead of a hostname.
 
@@ -654,7 +654,7 @@ can be made at one time. Defaults to 50.
 
 Sets which IP interface to listen on for **encrypted** HTTPS traffic. If
 not supplied, we bind to `localhost`. To listen on all available
-interfaces, use `0.0.0.0`.
+interfaces, use `::`.
 
 To avoid DNS resolution confusion, if you wish to set this to something other than `localhost`, we reccomend using an IP address instead of a hostname
 
@@ -821,7 +821,7 @@ Specifies the host or IP address for the REPL service to listen on. By
 default this is `127.0.0.1` only. As this is an insecure channel this
 is the only recommended setting for production environments.
 
-If you wish to listen on all interfaces, you can specify `0.0.0.0`, for example, although this is generally not recommended for production.
+If you wish to listen on all interfaces, you can specify `::`, for example, although this is generally not recommended for production.
 
 ## `[developer]` settings
 

documentation/load_testing_tool.markdown

@@ -67,7 +67,7 @@ below.
 
 * On the primary server, modify `/etc/puppetlabs/puppetdb/conf.d/jetty.ini`.
 In the `[jetty]` section, set either:
-    * `host=0.0.0.0 # http access from all agents`
+    * `host=:: # http access from all agents`
     * `host=<agent ip address> # access from specific agent`
 
 * Install java on the agent

resources/ext/cli/ssl-setup.erb

@@ -349,7 +349,7 @@ chown -R "$user:$group" "$ssl_dir"
 if [ -f "$jettyfile" ] ; then
   # Check settings are correct and fix or warn
   settings=(
-    "ssl-host:0.0.0.0"
+    "ssl-host:::"
     "ssl-port:8081"
     "ssl-key:${private_file}"
     "ssl-cert:${public_file}"
@@ -423,7 +423,7 @@ then
   echo "    [jetty]"
   echo "    #host       = localhost"
   echo "    port        = 8080"
-  echo "    ssl-host    = 0.0.0.0"
+  echo "    ssl-host    = ::"
   echo "    ssl-port    = 8081"
   echo "    ssl-key     = ${private_file}"
   echo "    ssl-cert    = ${public_file}"

resources/ext/config/conf.d/jetty.ini

@@ -13,7 +13,7 @@ port = 8080
 
 # IP address to listen on for HTTPS connections. Hostnames can also be used
 # but are not recommended to avoid DNS resolution issues. To listen on all
-# interfaces, use `0.0.0.0`.
+# interfaces, use `::`.
 # ssl-host = <host>
 
 # The port to listen on for HTTPS connections

resources/puppetlabs/puppetdb/benchmark/config.ini

@@ -2,5 +2,5 @@
 logging-config = resources/logback.xml
 
 [jetty]
-host = 0.0.0.0
+host = ::
 port = 8080

test-resources/integration-puppetdb.conf

@@ -19,10 +19,10 @@ nrepl: {
 }
 
 jetty: {
-  host: 0.0.0.0
+  host: ::
   port: 0
 
-  ssl-host: 0.0.0.0
+  ssl-host: ::
   ssl-port: 0 # filled out by the test harness
 
   # Original settings

test-resources/puppetserver/puppetserver.conf

@@ -12,9 +12,9 @@ webserver: {
     access-log-config: ./dev/request-logging-dev.xml
     client-auth: want
     # ssl-host controls what networks the server will accept connections from.
-    # The default value below is '0.0.0.0', so will accept connections from
+    # The default value below is '::', so will accept connections from
     # any client.  For better security, you might wish to set this to 'localhost'.
-    ssl-host: 0.0.0.0
+    ssl-host: ::
     #ssl-host: localhost
     ssl-port: 8140
 }

test/puppetlabs/puppetdb/cli/services_test.clj

@@ -214,7 +214,7 @@
            (assoc :database *db*)
            (assoc :jetty (merge cert-config
                                 {:ssl-port 0
-                                 :ssl-host "0.0.0.0"
+                                 :ssl-host "::"
                                  :ssl-protocols "TLSv1,TLSv1.1,TLSv1.2"}))
            (assoc-in [:puppetdb :certificate-allowlist] (str allowlist-file)))
        (fn []