I try to configure a software, by sending a command to its running service. However, to apply the new configuration, the service needs to be restarted.

How can I do that?

I tried:

appsrv:
  service.running:
  - enable: True

configure_app:
  cmd.run:
  - name: configure_app_command
  - unless: app_already_configured_command
  - watch_in:
    - service: appsrv

But it's not working, as the service is both required before and after the configuration. I also tried to use two different states: one for the service running, and one for the restart, but it was not better.

I guess I'll end up restarting the service "manually" in the configure_app state, just after the configure_app_command.

Any better way?

I wish to use this .bash_logout script to check some things before the user log out and possibly deny to log out if things to do remains.

My use case is to check if a git repo is clean before allowing the user to log out.

I want to publish the auto-discovery wpad record for any domain the client is in, without having to declare those domains in my DNS server.

Is it possible to define a record for any domain. Such that these requests will all return the same IP:

• wpad.guest.local
• wpad.
• wpad.local
• wpad.google.com
• wpad.myenterprise.ad.domain.com

What I do today is I define a default record like in Configure DNS server to return same IP for all domains.

The issue

I'm using haproxy to load balance web servers. I use session persistence with additional cookies as some applications use session files and these are not synchronized between servers.

I want to disable a server for maintenance, but without breaking sessions. So I would like to allow existing clients to continue their application session, but not accept new clients.

haproxy behavior

• I set a server to "going to maintenance"
• if a client has the cookie set, use the server even if marked as "going into maintenance"
• if a new client (without cookie) come, it is directed to another server
• after all clients end their application sessions, no more client would have the cookie set to this particular server, and I'd be good to shut it down without user disruption.

Do you think this is achievable with some haproxy configuration? Or is there a clever way to do it?

Other ways

Non exhaustive list of other ways to achieve this need:

• synchronize session files between servers (needs a way to synchronize files between several servers, or a common single mountpoint)
• use database to store session information (needs to change application behavior)

More details

I use this kind of configuration:

frontend https-in
   bind xxx.xxx.xxx.xxx:443 ssl crt /etc/haproxy/ssl/_default.pem crt /etc/haproxy/ssl
   reqadd X-Forwarded-Proto:\ https

   acl APP1 hdr(host) -i APP1.atac.local
   use_backend APP1 if APP1

   default_backend _default

backend APP1
   redirect scheme https if !{ ssl_fc }
   mode http
   balance roundrobin
   cookie HAPROXY_SESSION insert indirect
   option httpchk HEAD /haproxy_test_page.php HTTP/1.0\nUser-Agent:\ HAProxy
   server SRV1 SRV1_IP:PORT cookie SRV1 check
   server SRV2 SRV2_IP:PORT cookie SRV2 check

If I just disable SRV1 (with haproxy cli command), I think all application sessions opened on SRV1 will break after the end of the current HTTP "session". Is that right?

Say I have a service on several servers, controled in a cluster way (heartbeat), disable (on startup) because I want it to run only on the active node:

haproxy:
  service.disabled: []

I want to be able to update its configuration file:

/etc/haproxy/haproxy.cfg:
  file.managed:
    - source: salt://haproxy.cfg
    - watch_in:
      - service: haproxy

By specifying that this file is watched by the haproxy service, it will trigger a service restart if this file is modified. That's what I would want, except that this service should be running only for the active server in the cluster.

So my question is: how can I achieve my goal to restart this service upon configuration modification, without starting it on all passive nodes?

The context

I'd like to restrict some AD users to a specific script, limiting what they can do on this particular machine.

So, instead of connecting them with /bin/bash (for instance), I'd like to force them to use /path/to/my/script. Those users are in a specific AD group.

Other people should be able to use the real shell.

The classic way

If those users where local users, I would just change the shell field in /etc/passwd.

The sssd way

Is there a way to provide a different shell value only for the members of that group?

If not, how would you do it?

I have to execute a state only once. I couldn't find a simple way to do this.

Now, the context

I install two MySQL servers through salt. I want to make one a slave of the other.

In order to setup the slave, I need to get the master status informations at the end of the master installation:

SHOW MASTER STATUS;

Now, I can use a custom state executing the mysql.query function to get it.

mysql_master_status:
  mystate.query:
    - query: SHOW MASTER STATUS

But it will be executed every time the highstate is executed for my server. Thus giving different master information every time.

I tried to use a file existence as a flag:

/tmp/only_once:
  file.missing: []
mysql_master_status:
  mystate.query:
    - query: SHOW MASTER STATUS
    - require:
      - file: /tmp/only_once

It's working but I was not happy since I now have two failing states every time.

My custom solution

I ended with a new parameter for mystate, flag that create a flag file the first time it is executed, and returns with success if the file exists:

mysql_master_status:
  mystate.query:
    - query: SHOW MASTER STATUS
    - flag:  /tmp/only_once

And the question again

Still, I'd like to know if, and how, one would execute a state only once.