More secure default server setting

lib/puppet/defaults.rb

@@ -1650,7 +1650,7 @@ def self.initialize_default_settings!(settings)
       :desc     => "The root directory of devices' $confdir.",
     },
     :server => {
-      :default => "puppet",
+      :default => Puppet.features.root? ? 'puppet' : '', # use an empty string so dependent settings can resolve without crashing
       :desc => "The primary Puppet server to which the Puppet agent should connect.",
     },
     :server_list => {

lib/puppet/http/service.rb

@@ -32,6 +32,24 @@ class Puppet::HTTP::Service
   #
   # @api private
   def self.create_service(client, session, name, server = nil, port = nil)
+    # this is the entry point for creating all services, check and issue warning here.
+    unless Puppet.settings.set_by_config? :server
+      if Puppet.features.root?
+        Puppet.deprecation_warning('OpenVox will not default to `server=puppet` as of version 9.0. Please update your configuration appropriately.')
+      else
+        Puppet.deprecation_warning('OpenVox no longer defaults to `server=puppet` when running as a non-privileged user. (Did you mean to run as root?)')
+
+        case name
+        when :ca
+          raise ArgumentError, 'Neither `server` nor `ca_server` is specified.' unless Puppet.settings.set_by_config? :ca_server
+        when :report
+          raise ArgumentError, 'Neither `server` nor `report_server` is specified.' unless Puppet.settings.set_by_config? :report_server
+        when :fileserver, :puppet, :puppetserver
+          raise ArgumentError, 'Required setting `server` is not specified.'
+        end
+      end
+    end
+
     case name
     when :ca
       Puppet::HTTP::Service::Ca.new(client, session, server, port)

spec/unit/defaults_spec.rb

@@ -8,6 +8,31 @@
     end
   end
 
+  describe 'server' do
+    it 'should default to `puppet` when root' do
+      allow(Puppet.features).to receive(:root?).and_return(true)
+      foo = Puppet::Settings.new
+      Puppet.initialize_default_settings!(foo)
+      expect(foo[:server]).to eq('puppet')
+    end
+
+    it 'should default to empty value when non-root' do
+      allow(Puppet.features).to receive(:root?).and_return(false)
+      foo = Puppet::Settings.new
+      Puppet.initialize_default_settings!(foo)
+      expect(foo[:server]).to eq('')
+    end
+
+    it 'should fail when trying to establish a compiler connection without setting `server`' do
+      allow(Puppet.features).to receive(:root?).and_return(false)
+      expect {
+        client = Puppet.runtime[:http]
+        session = client.create_session
+        service = session.route_to(:puppet)
+      }.to raise_exception ArgumentError, /Required setting/
+    end
+  end
+
   describe 'strict' do
     it 'should accept the valid value :off' do
       expect {Puppet.settings[:strict] = 'off'}.to_not raise_exception