Salt 3008 migration

docs/deploy/create_server.rst

@@ -49,7 +49,7 @@ Create the server via the :ref:`host<hosting>`'s interface.
 
                The swap size should be at most 200% of RAM and:
 
-               -  If RAM is less than 2 GB: at least 100% of RAM
+               -  If RAM is less than 8 GB: set to 4096MB
                -  If RAM is less than 32 GB: at least 50% of RAM
                -  Otherwise, at least 16 GB or 25% of RAM, whichever is greater
 

salt/apache/init.sls

@@ -8,10 +8,26 @@
   {{ unset_firewall('PUBLIC_HTTPS') }}
 {% endif %}
 
+apache2 dependencies:
+  pip.installed:
+    - names:
+      - saltext-apache
+    - reload_modules: true
+{% if grains.osmajorrelease|int >= 24 %}
+    # https://peps.python.org/pep-0668/
+    - extra_args:
+      - --break-system-packages
+      - --ignore-installed
+{% endif %}
+    - require:
+      - pkg: pip
+
 apache2:
   pkg.installed:
     - pkgs:
       - apache2
+    - require:
+      - pip: saltext-apache
   service.running:
     - name: apache2
     - enable: True
@@ -25,7 +41,7 @@ apache2-reload:
     - name: service.reload
     - m_name: apache2
 
-# https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.webutil.html
+# Installing htpasswd for basicauth
 apache2-utils:
   pkg.installed:
     - name: apache2-utils

salt/aws/init.sls

@@ -1,9 +1,6 @@
 {% from 'lib.sls' import set_config %}
 
 awscli:
-  pkg.installed:
-    - name: python3-pip
-    - install_recommends: False
   pip.installed:
     - name: awscli
 {% if grains.osmajorrelease|int >= 24 %}
@@ -12,7 +9,7 @@ awscli:
       - --break-system-packages
 {% endif %}
     - require:
-      - pkg: awscli
+      - pkg: pip
 
 /home/sysadmin-tools/aws-settings.local:
   file.managed:

salt/core/customization.sls

@@ -1,4 +1,5 @@
 # These are all non-essential changes for added usability on our systems.
+{% set editor = '/usr/bin/vim.tiny' %}
 
 useful commands for general purpose:
   pkg.installed:
@@ -18,8 +19,9 @@ vim:
 
 # Set vim as the default editor now that we've installed it.
 editor:
-  alternatives.set:
-    - path: /usr/bin/vim.basic
+  cmd.run:
+    - name: update-alternatives --set editor {{ editor }}
+    - unless: test "$(readlink /etc/alternatives/editor)" = "{{ editor }}"
     - require:
       - pkg: vim
 

salt/core/init.sls

@@ -18,6 +18,26 @@ debconf-utils:
   pkg.installed:
     - name: debconf-utils
 
+# Required for salt-extensions and some python applications.
+pip:
+  pkg.installed:
+    - pkgs:
+      - python3-pip
+      - build-essential
+      - python3-dev
+    - install_recommends: False
+  pip.installed:
+    - name: pip
+    - upgrade: True
+{% if grains.osmajorrelease|int >= 24 %}
+    # https://peps.python.org/pep-0668/
+    - extra_args:
+      - --break-system-packages
+      - --ignore-installed
+{% endif %}
+    - require:
+      - pkg: pip
+
 # Several states add scripts to this directory.
 /home/sysadmin-tools/bin:
   file.directory:

salt/core/swap.sls

@@ -1,14 +1,15 @@
+# Set desired swap size
 {% if grains.mem_total > 32768 %}
   {% set swap_size = [grains.mem_total // 4, 16384] | max %}
-{% elif grains.mem_total > 2048 %}
+{% elif grains.mem_total > 8192 %}
   {% set swap_size = grains.mem_total // 2 %}
 {% else %}
-  {% set swap_size = grains.mem_total %}
+  {% set swap_size = 4096 %}
 {% endif %}
 
 {% if salt['pillar.get']('vm:swappiness') %}
   {% set vm_swappiness = pillar.vm.swappiness %}
-{% elif grains.mem_total > 2048 %}
+{% elif grains.mem_total > 4096 %}
   {% set vm_swappiness = 10 %}
 {% else %}
   {% set vm_swappiness = 40 %}
@@ -17,12 +18,13 @@
 {% set swap_path = '/swapfile' %}
 
 # Some systems will have swap configured already, if it is sufficient then don't configure more.
-{% if swap_size > grains['swap_total'] %}
+{% set swap_diff = swap_size - grains.swap_total %}
+{% if swap_diff >= 512 %}
 # Create swap file and mount. Only runs if `swap_path` has not been created.
 {{ swap_path }}:
   cmd.run:
     - name: |
-        fallocate -l {{ swap_size }}M {{ swap_path }}
+        fallocate -l {{ swap_diff }}M {{ swap_path }}
         chmod 0600 {{ swap_path }}
         mkswap {{ swap_path }}
     - creates: {{ swap_path }}

salt/kingfisher/init.sls

@@ -11,16 +11,6 @@ useful commands for data support:
       - ripgrep
       - unrar
 
-pip:
-  pkg.installed:
-    - name: python3-pip
-    - install_recommends: False
-  pip.installed:
-    - name: pip
-    - upgrade: True
-    - require:
-      - pkg: pip
-
 useful packages for data support:
   pip.installed:
     - names:

salt/lib.sls

@@ -176,16 +176,25 @@ enable site {{ name }}.conf:
     - watch_in:
       - module: apache2-reload
 
+{% if "htpasswd" in entry %}
+{% set htpasswd_file = '/etc/apache2/.htpasswd-'+name %}
+.htpasswd-{{ name }}:
+  file.exists:
+    - name: {{ htpasswd_file }}
+
 {% for username, password in entry.htpasswd|items %}
-add .htpasswd-{{ name }}-{{ username }}:
-  webutil.user_exists:
-    - name: {{ username }}
-    - password: {{ password }}
-    - htpasswd_file: /etc/apache2/.htpasswd-{{ name }}
-    - update: True
+{{ htpasswd_file }} {{ username}}:
+  cmd.run:
+    - name: "htpasswd -bB {{ htpasswd_file }} \"{{ username }}\" \"$PASSWORD\""
+    - unless: "htpasswd -vb {{ htpasswd_file }} \"{{ username }}\" \"$PASSWORD\""
+    # Using `env` to prevent displaying the password on run.
+    - env:
+      - PASSWORD: {{ password }}
     - require:
-      - pkg: apache2
+      - pkg: apache2-utils
+      - file: {{ htpasswd_file }}
 {% endfor %}
+{% endif %}
 
 {% if pillar.apache.get('site_logs') and not name[:1].isdigit() %}
 /var/log/apache2/{{ name }}:

salt/mysql/init.sls

@@ -5,6 +5,18 @@ mysql dependencies:
   pkg.installed:
     - pkgs:
       - python3-mysqldb
+  pip.installed:
+    - names:
+      - saltext-mysql
+    - reload_modules: true
+{% if grains.osmajorrelease|int >= 24 %}
+    # https://peps.python.org/pep-0668/
+    - extra_args:
+      - --break-system-packages
+      - --ignore-installed
+{% endif %}
+    - require:
+      - pkg: pip
 
 # Using Percona's official tool "percona-release" to configure their repositories and signing keys.
 percona-release: