config.sls
No OneTemporary
Actions

Size

3 KB

Referenced Files

None

Subscribers

None

config.sls
View Options

	# -------------------------------------------------------------
	# Salt — Webserver core units for all webservers roles
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	# Project: Nasqueron
	# License: Trivial work, not eligible to copyright
	# -------------------------------------------------------------

	{% from "map.jinja" import dirs with context %}
	{% from "roles/webserver-core/map.jinja" import options with context %}

	{% set has_selinux = salt['grains.get']('selinux:enabled', False) %}

	# -------------------------------------------------------------
	# Accounts - web group
	#
	# A group shared between nginx, back-end and content directories
	# to allow ACL giving access to the nginx process.
	#
	# This group will so be used by:
	# - nginx process (configured in nginx.conf)
	# - back-end UNIX sockets like php-fpm sockets can be 660
	# - more private folders can use 007 as umask
	#
	# An user is created in that group to run tools needing access
	# to those resources.
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	webserver_core_group:
	group.present:
	- name: web
	- gid: 9003
	- system: True

	webserver_core_user:
	user.present:
	- name: web-admin
	- uid: 8000
	- gid: 9003

	# -------------------------------------------------------------
	# Base configuration
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	{{ dirs.etc }}/nginx/nginx.conf:
	file.managed:
	- source: salt://roles/webserver-core/nginx/files/nginx.conf
	- template: jinja
	- context:
	nginx_dir: {{ dirs.etc }}/nginx
	nginx_options: {{ options }}

	# -------------------------------------------------------------
	# includes folder
	#
	# :: general configuration
	# :: application-specific code
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	webserver_core_nginx_includes:
	file.recurse:
	- name: {{ dirs.etc }}/nginx/includes
	- source: salt://roles/webserver-core/nginx/files/includes
	- dir_mode: 755
	- file_mode: 644
	- template: jinja
	- context:
	nginx_version: {{ salt["nginx.version"]() }}
	nginx_dir: {{ dirs.etc }}/nginx
	nginx_options: {{ options }}
	certbot_dir: /var/letsencrypt-auto

	# -------------------------------------------------------------
	# Parameters for Diffie-Hellman
	#
	# Some ciphers still require DH exchange. They contain "DHE" in
	# the name, e.g. DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	webserver_core_nginx_dh:
	cmd.run:
	- name: openssl dhparam -out {{ dirs.etc }}/nginx/dhparams.pem 4096
	- creates: {{ dirs.etc }}/nginx/dhparams.pem

	# -------------------------------------------------------------
	# Logs
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	/var/log/www:
	file.directory:
	- user: {{ options["www_user"] }}
	- group: web
	- dir_mode: 711

	{% if has_selinux %}
	selinux_context_nginx_logs:
	selinux.fcontext_policy_present:
	- name: "/var/log/www(/.*)?"
	- sel_type: httpd_log_t

	selinux_context_nginx_logs_applied:
	selinux.fcontext_policy_applied:
	- name: /var/log/www
	- recursive: True
	{% endif %}

	# -------------------------------------------------------------
	# vhost folder
	#
	# To be filled by the specific web role or unit
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	{{ dirs.etc }}/nginx/vhosts:
	file.directory

File Metadata

Mime Type: text/plain
Expires: Thu, Sep 18, 19:09 (4 h, 34 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 2991405
Default Alt Text: config.sls (3 KB)

config.slsNo OneTemporaryActions

config.slsView Options

File Metadata

Event Timeline

config.sls
No OneTemporary
Actions

config.sls
View Options