Saltstack Official Linux Formula

README.rst 18KB

9 years ago
8 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833
  1. =====
  2. Linux
  3. =====
  4. Linux Operating Systems.
  5. * Ubuntu
  6. * CentOS
  7. * RedHat
  8. * Fedora
  9. * Arch
  10. Sample pillars
  11. ==============
  12. Linux system
  13. ------------
  14. Basic Linux box
  15. .. code-block:: yaml
  16. linux:
  17. system:
  18. enabled: true
  19. name: 'node1'
  20. domain: 'domain.com'
  21. cluster: 'system'
  22. environment: prod
  23. timezone: 'Europe/Prague'
  24. utc: true
  25. Linux with system users, sowe with password set
  26. .. code-block:: yaml
  27. linux:
  28. system:
  29. ...
  30. user:
  31. jdoe:
  32. name: 'jdoe'
  33. enabled: true
  34. sudo: true
  35. shell: /bin/bash
  36. full_name: 'Jonh Doe'
  37. home: '/home/jdoe'
  38. email: 'jonh@doe.com'
  39. jsmith:
  40. name: 'jsmith'
  41. enabled: true
  42. full_name: 'Password'
  43. home: '/home/jsmith'
  44. password: userpassword
  45. Linux with package, latest version
  46. .. code-block:: yaml
  47. linux:
  48. system:
  49. ...
  50. package:
  51. package-name:
  52. version: latest
  53. Linux with package from certail repo, version with no upgrades
  54. .. code-block:: yaml
  55. linux:
  56. system:
  57. ...
  58. package:
  59. package-name:
  60. version: 2132.323
  61. repo: 'custom-repo'
  62. hold: true
  63. Linux with package from certail repo, version with no GPG verification
  64. .. code-block:: yaml
  65. linux:
  66. system:
  67. ...
  68. package:
  69. package-name:
  70. version: 2132.323
  71. repo: 'custom-repo'
  72. verify: false
  73. Linux with cron jobs
  74. .. code-block:: yaml
  75. linux:
  76. system:
  77. ...
  78. job:
  79. cmd1:
  80. command: '/cmd/to/run'
  81. enabled: true
  82. user: 'root'
  83. hour: 2
  84. minute: 0
  85. Linux security limits (limit sensu user memory usage to max 1GB):
  86. .. code-block:: yaml
  87. linux:
  88. system:
  89. ...
  90. limit:
  91. sensu:
  92. enabled: true
  93. domain: sensu
  94. limits:
  95. - type: hard
  96. item: as
  97. value: 1000000
  98. Enable autologin on tty1 (may work only for Ubuntu 14.04):
  99. .. code-block:: yaml
  100. linux:
  101. system:
  102. console:
  103. tty1:
  104. autologin: root
  105. # Enable serial console
  106. ttyS0:
  107. autologin: root
  108. rate: 115200
  109. term: xterm
  110. To disable set autologin to `false`.
  111. Set ``policy-rc.d`` on Debian-based systems. Action can be any available
  112. command in ``while true`` loop and ``case`` context.
  113. Following will disallow dpkg to stop/start services for cassandra package automatically:
  114. .. code-block:: yaml
  115. linux:
  116. system:
  117. policyrcd:
  118. - package: cassandra
  119. action: exit 101
  120. - package: '*'
  121. action: switch
  122. Set system locales:
  123. .. code-block:: yaml
  124. linux:
  125. system:
  126. locale:
  127. en_US.UTF-8:
  128. default: true
  129. "cs_CZ.UTF-8 UTF-8":
  130. enabled: true
  131. Kernel
  132. ~~~~~~
  133. Install always up to date LTS kernel and headers from Ubuntu trusty:
  134. .. code-block:: yaml
  135. linux:
  136. system:
  137. kernel:
  138. type: generic
  139. lts: trusty
  140. headers: true
  141. Install specific kernel version and ensure all other kernel packages are
  142. not present. Also install extra modules and headers for this kernel:
  143. .. code-block:: yaml
  144. linux:
  145. system:
  146. kernel:
  147. type: generic
  148. extra: true
  149. headers: true
  150. version: 4.2.0-22
  151. Systcl kernel parameters
  152. .. code-block:: yaml
  153. linux:
  154. system:
  155. kernel:
  156. sysctl:
  157. net.ipv4.tcp_keepalive_intvl: 3
  158. net.ipv4.tcp_keepalive_time: 30
  159. net.ipv4.tcp_keepalive_probes: 8
  160. CPU
  161. ~~~
  162. Disable ondemand cpu mode service:
  163. .. code-block:: yaml
  164. linux:
  165. system:
  166. cpu:
  167. governor: performance
  168. Huge Pages
  169. ~~~~~~~~~~~~
  170. Huge Pages give a performance boost to applications that intensively deal
  171. with memory allocation/deallocation by decreasing memory fragmentation.
  172. .. code-block:: yaml
  173. linux:
  174. system:
  175. kernel:
  176. hugepages:
  177. small:
  178. size: 2M
  179. count: 107520
  180. mount_point: /mnt/hugepages_2MB
  181. mount: false/true # default false
  182. large:
  183. default: true # default automatically mounted
  184. size: 1G
  185. count: 210
  186. mount_point: /mnt/hugepages_1GB
  187. Note: not recommended to use both pagesizes in concurrently.
  188. Repositories
  189. ~~~~~~~~~~~~
  190. RedHat based Linux with additional OpenStack repo
  191. .. code-block:: yaml
  192. linux:
  193. system:
  194. ...
  195. repo:
  196. rdo-icehouse:
  197. enabled: true
  198. source: 'http://repos.fedorapeople.org/repos/openstack/openstack-icehouse/epel-6/'
  199. pgpcheck: 0
  200. Ensure system repository to use czech Debian mirror (``default: true``)
  201. Also pin it's packages with priority 900.
  202. .. code-block:: yaml
  203. linux:
  204. system:
  205. repo:
  206. debian:
  207. default: true
  208. source: "deb http://ftp.cz.debian.org/debian/ jessie main contrib non-free"
  209. # Import signing key from URL if needed
  210. key_url: "http://dummy.com/public.gpg"
  211. pin:
  212. - pin: 'origin "ftp.cz.debian.org"'
  213. priority: 900
  214. package: '*'
  215. rc.local example
  216. .. code-block:: yaml
  217. linux:
  218. system:
  219. rc:
  220. local: |
  221. #!/bin/sh -e
  222. #
  223. # rc.local
  224. #
  225. # This script is executed at the end of each multiuser runlevel.
  226. # Make sure that the script will "exit 0" on success or any other
  227. # value on error.
  228. #
  229. # In order to enable or disable this script just change the execution
  230. # bits.
  231. #
  232. # By default this script does nothing.
  233. exit 0
  234. Prompt
  235. ~~~~~~
  236. Setting prompt is implemented by creating ``/etc/profile.d/prompt.sh``. Every
  237. user can have different prompt.
  238. .. code-block:: yaml
  239. linux:
  240. system:
  241. prompt:
  242. root: \\n\\[\\033[0;37m\\]\\D{%y/%m/%d %H:%M:%S} $(hostname -f)\\[\\e[0m\\]\\n\\[\\e[1;31m\\][\\u@\\h:\\w]\\[\\e[0m\\]
  243. default: \\n\\D{%y/%m/%d %H:%M:%S} $(hostname -f)\\n[\\u@\\h:\\w]
  244. On Debian systems to set prompt system-wide it's necessary to remove setting
  245. PS1 in ``/etc/bash.bashrc`` and ``~/.bashrc`` (which comes from
  246. ``/etc/skel/.bashrc``). This formula will do this automatically, but will not
  247. touch existing user's ``~/.bashrc`` files except root.
  248. Bash
  249. ~~~~
  250. Fix bash configuration to preserve history across sessions (like ZSH does by
  251. default).
  252. .. code-block:: yaml
  253. linux:
  254. system:
  255. bash:
  256. preserve_history: true
  257. Message of the day
  258. ~~~~~~~~~~~~~~~~~~
  259. ``pam_motd`` from package ``update-motd`` is used for dynamic messages of the
  260. day. Setting custom motd will cleanup existing ones.
  261. .. code-block:: yaml
  262. linux:
  263. system:
  264. motd:
  265. - release: |
  266. #!/bin/sh
  267. [ -r /etc/lsb-release ] && . /etc/lsb-release
  268. if [ -z "$DISTRIB_DESCRIPTION" ] && [ -x /usr/bin/lsb_release ]; then
  269. # Fall back to using the very slow lsb_release utility
  270. DISTRIB_DESCRIPTION=$(lsb_release -s -d)
  271. fi
  272. printf "Welcome to %s (%s %s %s)\n" "$DISTRIB_DESCRIPTION" "$(uname -o)" "$(uname -r)" "$(uname -m)"
  273. - warning: |
  274. #!/bin/sh
  275. printf "This is [company name] network.\n"
  276. printf "Unauthorized access strictly prohibited.\n"
  277. RHEL / CentOS
  278. ^^^^^^^^^^^^^
  279. Unfortunately ``update-motd`` is currently not available for RHEL so there's
  280. no native support for dynamic motd.
  281. You can still set static one, only pillar structure differs:
  282. .. code-block:: yaml
  283. linux:
  284. system:
  285. motd: |
  286. This is [company name] network.
  287. Unauthorized access strictly prohibited.
  288. Haveged
  289. ~~~~~~~
  290. If you are running headless server and are low on entropy, it may be a good
  291. idea to setup Haveged.
  292. .. code-block:: yaml
  293. linux:
  294. system:
  295. haveged:
  296. enabled: true
  297. Linux network
  298. -------------
  299. Linux with network manager
  300. .. code-block:: yaml
  301. linux:
  302. network:
  303. enabled: true
  304. network_manager: true
  305. Linux with default static network interfaces, default gateway interface and DNS servers
  306. .. code-block:: yaml
  307. linux:
  308. network:
  309. enabled: true
  310. interface:
  311. eth0:
  312. enabled: true
  313. type: eth
  314. address: 192.168.0.102
  315. netmask: 255.255.255.0
  316. gateway: 192.168.0.1
  317. name_servers:
  318. - 8.8.8.8
  319. - 8.8.4.4
  320. mtu: 1500
  321. Linux with bonded interfaces and disabled NetworkManager
  322. .. code-block:: yaml
  323. linux:
  324. network:
  325. enabled: true
  326. interface:
  327. eth0:
  328. type: eth
  329. ...
  330. eth1:
  331. type: eth
  332. ...
  333. bond0:
  334. enabled: true
  335. type: bond
  336. address: 192.168.0.102
  337. netmask: 255.255.255.0
  338. mtu: 1500
  339. use_in:
  340. - interface: ${linux:interface:eth0}
  341. - interface: ${linux:interface:eth0}
  342. network_manager:
  343. disable: true
  344. Linux with vlan interface_params
  345. .. code-block:: yaml
  346. linux:
  347. network:
  348. enabled: true
  349. interface:
  350. vlan69:
  351. type: vlan
  352. use_interfaces:
  353. - interface: ${linux:interface:bond0}
  354. Linux with wireless interface parameters
  355. .. code-block:: yaml
  356. linux:
  357. network:
  358. enabled: true
  359. gateway: 10.0.0.1
  360. default_interface: eth0
  361. interface:
  362. wlan0:
  363. type: eth
  364. wireless:
  365. essid: example
  366. key: example_key
  367. security: wpa
  368. priority: 1
  369. Linux networks with routes defined
  370. .. code-block:: yaml
  371. linux:
  372. network:
  373. enabled: true
  374. gateway: 10.0.0.1
  375. default_interface: eth0
  376. interface:
  377. eth0:
  378. type: eth
  379. route:
  380. default:
  381. address: 192.168.0.123
  382. netmask: 255.255.255.0
  383. gateway: 192.168.0.1
  384. Native Linux Bridges
  385. .. code-block:: yaml
  386. linux:
  387. network:
  388. interface:
  389. eth1:
  390. enabled: true
  391. type: eth
  392. proto: manual
  393. up_cmds:
  394. - ip address add 0/0 dev $IFACE
  395. - ip link set $IFACE up
  396. down_cmds:
  397. - ip link set $IFACE down
  398. br-ex:
  399. enabled: true
  400. type: bridge
  401. address: ${linux:network:host:public_local:address}
  402. netmask: 255.255.255.0
  403. use_interfaces:
  404. - eth1
  405. OpenVswitch Bridges
  406. .. code-block:: yaml
  407. linux:
  408. network:
  409. bridge: openvswitch
  410. interface:
  411. eth1:
  412. enabled: true
  413. type: eth
  414. proto: manual
  415. up_cmds:
  416. - ip address add 0/0 dev $IFACE
  417. - ip link set $IFACE up
  418. down_cmds:
  419. - ip link set $IFACE down
  420. br-ex:
  421. enabled: true
  422. type: bridge
  423. address: ${linux:network:host:public_local:address}
  424. netmask: 255.255.255.0
  425. use_interfaces:
  426. - eth1
  427. Linux with proxy
  428. .. code-block:: yaml
  429. linux:
  430. network:
  431. ...
  432. proxy:
  433. host: proxy.domain.com
  434. port: 3128
  435. Linux with hosts
  436. Parameter purge_hosts will enforce whole /etc/hosts file, removing entries
  437. that are not defined in model except defaults for both IPv4 and IPv6 localhost
  438. and hostname + fqdn.
  439. It's good to use this option if you want to ensure /etc/hosts is always in a
  440. clean state however it's not enabled by default for safety.
  441. .. code-block:: yaml
  442. linux:
  443. network:
  444. ...
  445. purge_hosts: true
  446. host:
  447. # No need to define this one if purge_hosts is true
  448. hostname:
  449. address: 127.0.1.1
  450. names:
  451. - ${linux:network:fqdn}
  452. - ${linux:network:hostname}
  453. node1:
  454. address: 192.168.10.200
  455. names:
  456. - node2.domain.com
  457. - service2.domain.com
  458. node2:
  459. address: 192.168.10.201
  460. names:
  461. - node2.domain.com
  462. - service2.domain.com
  463. Setup resolv.conf, nameservers, domain and search domains
  464. .. code-block:: yaml
  465. linux:
  466. network:
  467. resolv:
  468. dns:
  469. - 8.8.4.4
  470. - 8.8.8.8
  471. domain: my.example.com
  472. search:
  473. - my.example.com
  474. - example.com
  475. options:
  476. - ndots:5
  477. - timeout:2
  478. - attempts:2
  479. Linux storage pillars
  480. ---------------------
  481. Linux with mounted Samba
  482. .. code-block:: yaml
  483. linux:
  484. storage:
  485. enabled: true
  486. mount:
  487. samba1:
  488. - enabled: true
  489. - path: /media/myuser/public/
  490. - device: //192.168.0.1/storage
  491. - file_system: cifs
  492. - options: guest,uid=myuser,iocharset=utf8,file_mode=0777,dir_mode=0777,noperm
  493. Linux with file swap
  494. .. code-block:: yaml
  495. linux:
  496. storage:
  497. enabled: true
  498. swap:
  499. file:
  500. enabled: true
  501. engine: file
  502. device: /swapfile
  503. size: 1024
  504. Linux with partition swap
  505. .. code-block:: yaml
  506. linux:
  507. storage:
  508. enabled: true
  509. swap:
  510. partition:
  511. enabled: true
  512. engine: partition
  513. device: /dev/vg0/swap
  514. LVM group `vg1` with one device and `data` volume mounted into `/mnt/data`
  515. .. code-block:: yaml
  516. parameters:
  517. linux:
  518. storage:
  519. mount:
  520. data:
  521. enabled: true
  522. device: /dev/vg1/data
  523. file_system: ext4
  524. path: /mnt/data
  525. lvm:
  526. vg1:
  527. enabled: true
  528. devices:
  529. - /dev/sdb
  530. volume:
  531. data:
  532. size: 40G
  533. mount: ${linux:storage:mount:data}
  534. Multipath with Fujitsu Eternus DXL
  535. .. code-block:: yaml
  536. parameters:
  537. linux:
  538. storage:
  539. multipath:
  540. enabled: true
  541. blacklist_devices:
  542. - /dev/sda
  543. - /dev/sdb
  544. backends:
  545. - fujitsu_eternus_dxl
  546. Multipath with Hitachi VSP 1000
  547. .. code-block:: yaml
  548. parameters:
  549. linux:
  550. storage:
  551. multipath:
  552. enabled: true
  553. blacklist_devices:
  554. - /dev/sda
  555. - /dev/sdb
  556. backends:
  557. - hitachi_vsp1000
  558. Multipath with IBM Storwize
  559. .. code-block:: yaml
  560. parameters:
  561. linux:
  562. storage:
  563. multipath:
  564. enabled: true
  565. blacklist_devices:
  566. - /dev/sda
  567. - /dev/sdb
  568. backends:
  569. - ibm_storwize
  570. Multipath with multiple backends
  571. .. code-block:: yaml
  572. parameters:
  573. linux:
  574. storage:
  575. multipath:
  576. enabled: true
  577. blacklist_devices:
  578. - /dev/sda
  579. - /dev/sdb
  580. - /dev/sdc
  581. - /dev/sdd
  582. backends:
  583. - ibm_storwize
  584. - fujitsu_eternus_dxl
  585. - hitachi_vsp1000
  586. Disabled multipath (the default setup)
  587. .. code-block:: yaml
  588. parameters:
  589. linux:
  590. storage:
  591. multipath:
  592. enabled: false
  593. Linux with local loopback device
  594. .. code-block:: yaml
  595. linux:
  596. storage:
  597. loopback:
  598. disk1:
  599. file: /srv/disk1
  600. size: 50G
  601. External config generation
  602. --------------------------
  603. You are able to use config support metadata between formulas and only generate
  604. config files for external use, eg. docker, etc.
  605. .. code-block:: yaml
  606. parameters:
  607. linux:
  608. system:
  609. config:
  610. pillar:
  611. jenkins:
  612. master:
  613. home: /srv/volumes/jenkins
  614. approved_scripts:
  615. - method java.net.URL openConnection
  616. credentials:
  617. - type: username_password
  618. scope: global
  619. id: test
  620. desc: Testing credentials
  621. username: test
  622. password: test
  623. Usage
  624. =====
  625. Set mtu of network interface eth0 to 1400
  626. .. code-block:: bash
  627. ip link set dev eth0 mtu 1400
  628. Read more
  629. =========
  630. * https://www.archlinux.org/
  631. * http://askubuntu.com/questions/175172/how-do-i-configure-proxies-in-ubuntu-server-or-minimal-cli-ubuntu
  632. Documentation and Bugs
  633. ======================
  634. To learn how to install and update salt-formulas, consult the documentation
  635. available online at:
  636. http://salt-formulas.readthedocs.io/
  637. In the unfortunate event that bugs are discovered, they should be reported to
  638. the appropriate issue tracker. Use Github issue tracker for specific salt
  639. formula:
  640. https://github.com/salt-formulas/salt-formula-linux/issues
  641. For feature requests, bug reports or blueprints affecting entire ecosystem,
  642. use Launchpad salt-formulas project:
  643. https://launchpad.net/salt-formulas
  644. You can also join salt-formulas-users team and subscribe to mailing list:
  645. https://launchpad.net/~salt-formulas-users
  646. Developers wishing to work on the salt-formulas projects should always base
  647. their work on master branch and submit pull request against specific formula.
  648. https://github.com/salt-formulas/salt-formula-linux
  649. Any questions or feedback is always welcome so feel free to join our IRC
  650. channel:
  651. #salt-formulas @ irc.freenode.net