On 27/07/17 16:34, Adam Bishop wrote:
On 27 Jul 2017, at 16:20, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
As others have said, we put the entire repo into a git directory, and just push it out to servers.
This, and I split the config into more files than default, not less.
I have a file (/etc/raddb/variables) that is not stored in the git tree that contains the host name of the system, and a bunch of values for whether it's a Dev or Production system, vlan id's, policy enablement etc.
We do very similar things. We actually run our various services (wireless, eduroam IdP, eduroam SP, macauth, VPN) as separate processes as opposed to one big radius process, which provides a measure of protection against crash bugs and the disruption of a full restart or having to toggle into debug mode; as such, I have huge sections of our config in "common" includes, and we use a setup like: instance.conf serviceopts { name = instance # port for nagios to check this # instance over authentication nagios_port = 16000 # ditto via status-server status_port = 16001 sql_socks = 10 redis_socks = 20 # etc. etc. } # global user-supplied $INCLUDE global.conf # server-local, not in git $INCLUDE local.conf # most of normal radiusd.conf $INCLUDE common.conf $INCLUDE sites-enabled/instance $INCLUDE sites-enabled/instance-inner $INCLUDE sites-enabled/common-radmin $INCLUDE sites-enabled/common-status ...and the various included files will make use of ${serviceopts.blah} expansions to hook all this in. Works great. Very happy with it.