SaltStack states
Posted: Thu Mar 16, 2017 5:07 pm
This is just to document the work that I have done with SaltStack so far. I want to use it on the VM server to build up some support infrastructure first and eventually manage every server using Salt. First task is being able to use Salt to deal with jails. There's a Salt formula for it out there but that's a bit too advanced for me right now so I'll stick with doing simple things for now.
Generally on the freshly installed system it's only necessary to install SaltStack, put the contents below into a state file and run SaltStack:
# pkg install -y py27-salt
# vi bootstrap.sls
# salt-call --local --file-root=. state.apply bootstrap
The code below should bring up Pf and prepare the system for simple NATing, setup the newly python-based iocage (not yet in :quarterly, so for now the repo has to be changed to :latest) and create a test jail that can access the net even though it uses an address of the 10.x.x.x range. Not terribly impressive, but at least it is fully idempotent and hey, it's a start.
Next task: Install a Git server into a jail and look into port forwarding so that it can be accessed from the internet, too. That Git server will later hold non-public repos for internal use, e.g. project documentation and SaltStack states, files and the pillar.
Generally on the freshly installed system it's only necessary to install SaltStack, put the contents below into a state file and run SaltStack:
# pkg install -y py27-salt
# vi bootstrap.sls
# salt-call --local --file-root=. state.apply bootstrap
The code below should bring up Pf and prepare the system for simple NATing, setup the newly python-based iocage (not yet in :quarterly, so for now the repo has to be changed to :latest) and create a test jail that can access the net even though it uses an address of the 10.x.x.x range. Not terribly impressive, but at least it is fully idempotent and hey, it's a start.
Code: Select all
#########
# NAT #
#########
create_lo1_if:
file.append:
- name: /etc/rc.conf
- text:
- cloned_interfaces="lo1"
- ifconfig_lo1="inet 10.0.0.254 netmask 255.255.255.0"
cmd.run:
- name: ifconfig lo1 create
- unless: ifconfig -l | grep lo1
basic_pf_nat_rules:
file.managed:
- name: /etc/pf.conf
- contents: |
ext_if="vtnet0"
int_if="lo1"
localnet=$int_if:network
scrub in all fragment reassemble
set skip on lo0
set skip on lo1
#nat for jails
nat on $ext_if inet from $localnet to any -> ($ext_if)
load_pf_ko:
cmd.run:
- name: kldload pf.ko
- unless: 'service pf status | grep -v "pf.ko is not loaded"'
activate_pf:
file.append:
- name: /etc/rc.conf
- text:
- pf_enable="YES"
- pflog_enable="YES"
cmd.run:
- name: pfctl -e -f /etc/pf.conf
- unless: 'service pf status | grep "Status: Enabled for"'
##########
# Jail #
##########
prepare_latest_repo:
file.directory:
- name: /usr/local/etc/pkg/repos
- makedirs: True
activate_latest_repo:
file.managed:
- name: /usr/local/etc/pkg/repos/FreeBSD.conf
- contents: |
FreeBSD: {
url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest"
}
install_iocage_package:
pkg.installed:
- name: py27-iocage
jail_fetch_fbsd11:
cmd.run:
- name: 'iocage fetch --release 11.0-RELEASE'
- creates: /iocage/releases/11.0-RELEASE
create_testjail:
cmd.run:
- name: iocage create tag=testjail ip4_addr="lo1|10.0.0.1/24" -r 11.0-RELEASE
- unless: iocage list | grep testjail
[/rant])
And even though I know that PF is not nearly as horrible, thanks to netfilter/iptables I still hate firewalling enough to have stayed away from it so far. 