3

Is there a way to run a configtest utility (e.g. apache2ctl -t) before trying to restart a service when one of its configuration files changed?

Use case here is that I want to be resilient against configuration errors in an apache config (because apache just stops when it sees the config error, leaving me with a stopped apache)

  • 1
    you can use kvm or docker for test your change before put it in production. – c4f4t0r Jan 13 '15 at 14:11
  • sure i can do that but i want to avoid the risk of anything slipping through and breaking my servers – Michael Siebert Jan 13 '15 at 16:28
  • But that only makes it worse. You commit a bad configuration. The services don't restart. You now have a broken configuration on your servers and not know it. Next time you reboot or provision a new server it won't start. Now you have to figure out when it actually broke. – faker Jan 15 '15 at 9:38
  • No, the idea is to have it tell me that it failed to restart the service. – Michael Siebert Jan 15 '15 at 12:05
  • How? It will pop up as a failed resource but only once. The next run will see that the config file is already the newest, it will not try to restart, it will not run a config check and all resources are ok => your dashboard or whatever you use to monitor will turn green. – faker Jan 15 '15 at 14:43
3

You can use a require => Exec[] and daisy chain the exec to require the config change(s).

If the Exec fails (exit status != 0) the subsequent tasks that require it should fail as well. I do something similar to execute ssh-keygen then set special permissions on .ssh when creating new users.

Example:

# Ensure the .ssh directory exists for each user
file { "${dot_ssh_dir}":
 ensure => directory,
 owner => $title,
 mode => 700,
 require => File["${home_dir}"],
}

# Run ssh-keygen (ONLY if id_rsa doesn't exist)
exec { "${title} ssh-keygen":
 command => "ssh-keygen -f ./id_rsa -q -N ''",
 cwd => $dot_ssh_dir,
 user => $title,
 creates => "${keyfile_private}",
 path => ['/usr/bin', '/usr/sbin/', '/usr/local/sbin'],
 require => File[$dot_ssh_dir],
}

# AuthorizedKeys should be 600
file { "${authorized_keys}": 
 source => "${keyfile_public}",
 ensure => present,
 mode => 600,
 owner => $title,
 group => 'sftpusers',
 require => Exec["${title} ssh-keygen"],
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.