Alan DeKok wrote:
On Jul 27, 2017, at 8:21 AM, adrian.p.smith@bt.com wrote:
3. We use another tool called Ansible (similar to Puppet) that the uploads and uzips to the production servers after first backing up the existing config. FreeRadius is then automatically restarted.
I've used Salt with good success. But it handles subdirectories. :( I just create the config I want in a subdirectory in salt, and then tell it to sync the subdirectory to another machine.
Your config dir might need different user/group ownership and permissions for certain files within your directory structure. While puppet/ansible/whatever config management can all of course "handle" subdirectories it's tricky to get ownership/permissions right while strictly preserving idempotency. Reason: In environments with high security requirements you might have file integrity monitoring running on all systems (with DB directories or similar excluded). So you definitely aim to avoid every unnecessary write access during config run because a security auditor has to manually acknowledge every change, even if only the mtime changed. Copying files recursively and fixing ownership/permissions afterwards is an anti-pattern in such an environment. So I tend to let the config management write only very few config files without too much sophisticated include dir structure. Ciao, Michael.