diff --git a/docs/deploy/create_server.rst b/docs/deploy/create_server.rst index 188d655d4..ca99500a1 100644 --- a/docs/deploy/create_server.rst +++ b/docs/deploy/create_server.rst @@ -49,7 +49,7 @@ Create the server via the :ref:`host`'s interface. The swap size should be at most 200% of RAM and: - - If RAM is less than 2 GB: at least 100% of RAM + - If RAM is less than 8 GB: set to 4096MB - If RAM is less than 32 GB: at least 50% of RAM - Otherwise, at least 16 GB or 25% of RAM, whichever is greater diff --git a/salt/apache/init.sls b/salt/apache/init.sls index 456e5ba55..e9a13ecee 100644 --- a/salt/apache/init.sls +++ b/salt/apache/init.sls @@ -8,10 +8,26 @@ {{ unset_firewall('PUBLIC_HTTPS') }} {% endif %} +apache2 dependencies: + pip.installed: + - names: + - saltext-apache + - reload_modules: true +{% if grains.osmajorrelease|int >= 24 %} + # https://peps.python.org/pep-0668/ + - extra_args: + - --break-system-packages + - --ignore-installed +{% endif %} + - require: + - pkg: pip + apache2: pkg.installed: - pkgs: - apache2 + - require: + - pip: saltext-apache service.running: - name: apache2 - enable: True @@ -25,7 +41,7 @@ apache2-reload: - name: service.reload - m_name: apache2 -# https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.webutil.html +# Installing htpasswd for basicauth apache2-utils: pkg.installed: - name: apache2-utils diff --git a/salt/aws/init.sls b/salt/aws/init.sls index 99a53f0ae..d5a85a2bb 100644 --- a/salt/aws/init.sls +++ b/salt/aws/init.sls @@ -1,9 +1,6 @@ {% from 'lib.sls' import set_config %} awscli: - pkg.installed: - - name: python3-pip - - install_recommends: False pip.installed: - name: awscli {% if grains.osmajorrelease|int >= 24 %} @@ -12,7 +9,7 @@ awscli: - --break-system-packages {% endif %} - require: - - pkg: awscli + - pkg: pip /home/sysadmin-tools/aws-settings.local: file.managed: diff --git a/salt/core/customization.sls b/salt/core/customization.sls index 3b851f2b5..a0d2daad4 100644 --- a/salt/core/customization.sls +++ b/salt/core/customization.sls @@ -1,4 +1,5 @@ # These are all non-essential changes for added usability on our systems. +{% set editor = '/usr/bin/vim.tiny' %} useful commands for general purpose: pkg.installed: @@ -18,8 +19,9 @@ vim: # Set vim as the default editor now that we've installed it. editor: - alternatives.set: - - path: /usr/bin/vim.basic + cmd.run: + - name: update-alternatives --set editor {{ editor }} + - unless: test "$(readlink /etc/alternatives/editor)" = "{{ editor }}" - require: - pkg: vim diff --git a/salt/core/init.sls b/salt/core/init.sls index 9da1f5901..7606da1b3 100644 --- a/salt/core/init.sls +++ b/salt/core/init.sls @@ -18,6 +18,26 @@ debconf-utils: pkg.installed: - name: debconf-utils +# Required for salt-extensions and some python applications. +pip: + pkg.installed: + - pkgs: + - python3-pip + - build-essential + - python3-dev + - install_recommends: False + pip.installed: + - name: pip + - upgrade: True +{% if grains.osmajorrelease|int >= 24 %} + # https://peps.python.org/pep-0668/ + - extra_args: + - --break-system-packages + - --ignore-installed +{% endif %} + - require: + - pkg: pip + # Several states add scripts to this directory. /home/sysadmin-tools/bin: file.directory: diff --git a/salt/core/swap.sls b/salt/core/swap.sls index 1bc2a8540..5d3612982 100644 --- a/salt/core/swap.sls +++ b/salt/core/swap.sls @@ -1,14 +1,15 @@ +# Set desired swap size {% if grains.mem_total > 32768 %} {% set swap_size = [grains.mem_total // 4, 16384] | max %} -{% elif grains.mem_total > 2048 %} +{% elif grains.mem_total > 8192 %} {% set swap_size = grains.mem_total // 2 %} {% else %} - {% set swap_size = grains.mem_total %} + {% set swap_size = 4096 %} {% endif %} {% if salt['pillar.get']('vm:swappiness') %} {% set vm_swappiness = pillar.vm.swappiness %} -{% elif grains.mem_total > 2048 %} +{% elif grains.mem_total > 4096 %} {% set vm_swappiness = 10 %} {% else %} {% set vm_swappiness = 40 %} @@ -17,12 +18,13 @@ {% set swap_path = '/swapfile' %} # Some systems will have swap configured already, if it is sufficient then don't configure more. -{% if swap_size > grains['swap_total'] %} +{% set swap_diff = swap_size - grains.swap_total %} +{% if swap_diff >= 512 %} # Create swap file and mount. Only runs if `swap_path` has not been created. {{ swap_path }}: cmd.run: - name: | - fallocate -l {{ swap_size }}M {{ swap_path }} + fallocate -l {{ swap_diff }}M {{ swap_path }} chmod 0600 {{ swap_path }} mkswap {{ swap_path }} - creates: {{ swap_path }} diff --git a/salt/kingfisher/init.sls b/salt/kingfisher/init.sls index 590af66f5..db8125950 100644 --- a/salt/kingfisher/init.sls +++ b/salt/kingfisher/init.sls @@ -11,16 +11,6 @@ useful commands for data support: - ripgrep - unrar -pip: - pkg.installed: - - name: python3-pip - - install_recommends: False - pip.installed: - - name: pip - - upgrade: True - - require: - - pkg: pip - useful packages for data support: pip.installed: - names: diff --git a/salt/lib.sls b/salt/lib.sls index 34737587f..4b5a9e85b 100644 --- a/salt/lib.sls +++ b/salt/lib.sls @@ -176,16 +176,25 @@ enable site {{ name }}.conf: - watch_in: - module: apache2-reload +{% if "htpasswd" in entry %} +{% set htpasswd_file = '/etc/apache2/.htpasswd-'+name %} +.htpasswd-{{ name }}: + file.exists: + - name: {{ htpasswd_file }} + {% for username, password in entry.htpasswd|items %} -add .htpasswd-{{ name }}-{{ username }}: - webutil.user_exists: - - name: {{ username }} - - password: {{ password }} - - htpasswd_file: /etc/apache2/.htpasswd-{{ name }} - - update: True +{{ htpasswd_file }} {{ username}}: + cmd.run: + - name: "htpasswd -bB {{ htpasswd_file }} \"{{ username }}\" \"$PASSWORD\"" + - unless: "htpasswd -vb {{ htpasswd_file }} \"{{ username }}\" \"$PASSWORD\"" + # Using `env` to prevent displaying the password on run. + - env: + - PASSWORD: {{ password }} - require: - - pkg: apache2 + - pkg: apache2-utils + - file: {{ htpasswd_file }} {% endfor %} +{% endif %} {% if pillar.apache.get('site_logs') and not name[:1].isdigit() %} /var/log/apache2/{{ name }}: diff --git a/salt/mysql/init.sls b/salt/mysql/init.sls index e35b9cb94..e68a27403 100644 --- a/salt/mysql/init.sls +++ b/salt/mysql/init.sls @@ -5,6 +5,18 @@ mysql dependencies: pkg.installed: - pkgs: - python3-mysqldb + pip.installed: + - names: + - saltext-mysql + - reload_modules: true +{% if grains.osmajorrelease|int >= 24 %} + # https://peps.python.org/pep-0668/ + - extra_args: + - --break-system-packages + - --ignore-installed +{% endif %} + - require: + - pkg: pip # Using Percona's official tool "percona-release" to configure their repositories and signing keys. percona-release: