Configure Apache with Salt Stack

Salt is a powerful configuration management tool. In this guide you will create Salt state files that are capable of installing and configuring Apache on Ubuntu 18.04, Debian 9, or CentOS 7.

Before You Begin

You will need at least two Linodes with Salt installed. If you have not already, read our Getting Started with Salt - Basic Installation and Setup Guide and follow the instructions for setting up a Salt master and minion.

The following steps will be performed on your Salt master.

Note
The steps in this guide require root privileges. Be sure to run the steps below as root or with the sudo prefix. For more information on privileges, see our Users and Groups guide.

Setting Up Your Salt Master and Managed Files

Salt Master SLS Files

Create the /srv/salt directory if it does not already exist:
```
mkdir /srv/salt
```
Create a Salt top file in /srv/salt that will be Salt’s entry point to the Apache configuration:
File: /srv/salt/top.sls
1 2 3 4 5 6 7 8
base: 'G@os_family:Debian': - match: compound - apache-debian 'G@os:CentOS': - match: compound - apache-centos
This top file uses compound matching to target your minions by operating system using Salt Grains. This will allow Salt to choose the appropriate Apache configuration depending on the Linux distribution. These matchers could be extended to be even more specific. For instance, if you wanted to only target minions with the ID of web-server that are running on Ubuntu, you can type web* and G@os:Ubuntu.

Pillar Files

Create the /srv/pillar directory if it does not already exist:
```
mkdir /srv/pillar
```
Create a Pillar top file. This top file references the apache.sls Pillar file that you will create in the next step:
File: /srv/pillar/top.sls
1 2 3
base: '*': - apache
Create the apache.sls file that was referenced in the previous step. This file defines Pillar data that will be used inside our Apache state file in the next section, in this case your domain name. Replace example.com with your domain:
File: /srv/pillar/apache.sls
1
domain: example.com

Website Files

Create a directory for your website files in the /srv/salt directory. Replace example.com with your website domain name:
```
mkdir /srv/salt/example.com
```
This directory will be accessible from your Salt state files at salt://example.com.
Create an index.html file for your website in the /srv/salt/example.com directory, substituting example.com for the folder name you chose in the previous step. You will use this file as a test to make sure your website is functioning correctly.
File: /srv/salt/example.com/index.html
1 2 3 4 5
<html> <body> <h1>Server Up and Running!</h1> </body> </html>

Configuration Files

Create a folder for your additional configuration files at /srv/salt/files. These files will be accessible at salt://files.
```
mkdir /srv/salt/files
```
Create a file called tune_apache.conf in /srv/salt/files and paste in the following block:
File: /srv/salt/files/tune_apache.conf
1 2 3 4 5 6 7
<IfModule mpm_prefork_module> StartServers 4 MinSpareServers 20 MaxSpareServers 40 MaxClients 200 MaxRequestsPerChild 4500 </IfModule>
This MPM prefork module provides additional tuning for your Apache installation. This file will be managed by Salt and installed into the appropriate configuration directory in a later step.
If you will be installing Apache on a CentOS machine, create a file called include_sites_enabled.conf in /srv/salt/files and paste in the following:
File: /srv/salt/files/include_sites_enabled.conf
1
IncludeOptional sites-enabled/*.conf
This file will allow us to use file directories like those found on Debian installations to help organize the Apache configuration.

Creating the Apache State File for Debian and Ubuntu

Individual Steps

This guide will be going through the process of creating the Apache for Debian and Ubuntu state file step by step. If you would like to view the entirety of the state file, you can view it at the end of this section.

Create a state file named apache-debian.sls in /srv/salt and open it in a text editor of your choice.
Instruct Salt to install the apache2 package and start the apache2 service:
File: /srv/salt/apache-debian.sls
1 2 3 4 5 6 7 8 9 10 11
apache2: pkg.installed apache2 Service: service.running: - name: apache2 - enable: True - require: - pkg: apache2 ...
Here Salt makes sure the apache2 package is installed with pkg.installed. Likewise, it ensures the apache2 service is running and enabled under service.running. Also under service.running, apache-debian.sls uses require to ensure that this command does not run before the apache2 package is installed. This require step will be repeated throughout apache-debian.sls.
Lastly, a watch statement is employed to restart the apache2 service if your site’s configuration file changes. You will define that configuration file in a later step. Note that this configuration file is named using the domain you supplied when creating your Salt Pillar file in the first section. This Pillar data will be used throughout apache-debian.sls.

Turn off KeepAlive:

File: /srv/salt/apache-debian.sls

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
...

Turn Off KeepAlive:
  file.replace:
    - name: /etc/apache2/apache2.conf
    - pattern: 'KeepAlive On'
    - repl: 'KeepAlive Off'
    - show_changes: True
    - require:
      - pkg: apache2
...

KeepAlive allows multiple requests to be sent over the same TCP connection. For the purpose of this guide KeepAlive will be disabled. To disable it, Salt is instructed to find the KeepAlive directive in /etc/apache2/apache2.conf by matching a pattern and replacing it with KeepAlive Off. show_changes instructs Salt to display any changes it has made during a highstate.

Transfer tune_apache.conf to your minion and enable it:

File: /srv/salt/apache-debian.sls

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
...

/etc/apache2/conf-available/tune_apache.conf:
  file.managed:
    - source: salt://files/tune_apache.conf
    - require:
      - pkg: apache2

Enable tune_apache:
  apache_conf.enabled:
    - name: tune_apache
    - require:
      - pkg: apache2

...

This step takes the tune_apache.conf file you created in the Configuration Files step and transfers it to your Salt minion. Then, Salt enables that configuration file with the apache_conf module.

Create the necessary directories:

File: /srv/salt/apache-debian.sls

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
...

/var/www/html/{{ pillar['domain'] }}:
  file.directory

/var/www/html/{{ pillar['domain'] }}/log:
  file.directory

/var/www/html/{{ pillar['domain'] }}/backups:
  file.directory

/var/www/html/{{ pillar['domain'] }}/public_html:
  file.directory

...

Disable the default virtual host configuration file:
File: /srv/salt/apache-debian.sls
1 2 3 4 5 6 7 8
... 000-default: apache_site.disabled: - require: - pkg: apache2 ...
This step uses Salt’s apache_site module to disable the default Apache virtual host configuration file, and is the same as running a2dissite on a Debian-based machine.

Create your site’s virtual host configuration file:

File: /srv/salt/apache-debian.sls

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
...

/etc/apache2/sites-available/{{ pillar['domain'] }}.conf:
  apache.configfile:
    - config:
      - VirtualHost:
          this: '*:80'
          ServerName:
            - {{ pillar['domain'] }}
          ServerAlias:
            - www.{{ pillar['domain'] }}
          DocumentRoot: /var/www/html/{{ pillar['domain'] }}/public_html
          ErrorLog: /var/www/html/{{ pillar['domain'] }}/log/error.log
          CustomLog: /var/www/html/{{ pillar['domain'] }}/log/access.log combined

...

This step uses Salt’s apache module, (not to be confused with the apache_site module used in the previous step), to create your site’s virtual host configuration file. The this variable signifies what would traditionally be include with VirtualHost within angle brackets in an Apache configuration file: <VirtualHost *:80>.

Enable your new virtual host configuration file:
File: /srv/salt/apache-debian.sls
1 2 3 4 5 6 7 8
... {{ pillar['domain'] }}: apache_site.enabled: - require: - pkg: apache2 ...
This step uses the same apache_site module you used to disable the default virtual host file to enable your newly created virtual host file. apache_site.enabled creates a symlink from /etc/apache2/sites-available/example.com.conf to /etc/apache2/sites-enabled/example.com.conf and is the same as running a2ensite on a Debian-based machine.
Transfer your index.html website file to your minion:
File: /srv/salt/apache-debian.sls
1 2 3 4 5
... /var/www/html/{{ pillar['domain'] }}/public_html/index.html: file.managed: - source: salt://{{ pillar['domain'] }}/index.html
Any changes made to your index.html file on your Salt master will be propagated to your minion.
Note
Since Salt is not watching configuration files for a change to trigger a restart for Apache, you may need to use the command below from your Salt master.
```
salt '*' apache.signal restart
```

Complete State File

The complete apache-debian.sls file looks like this:

File: /srv/salt/apache-debian.sls

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
apache2:
  pkg.installed

apache2 Service:
  service.running:
    - name: apache2
    - enable: True
    - require:
      - pkg: apache2

Turn Off KeepAlive:
  file.replace:
    - name: /etc/apache2/apache2.conf
    - pattern: 'KeepAlive On'
    - repl: 'KeepAlive Off'
    - show_changes: True
    - require:
      - pkg: apache2

/etc/apache2/conf-available/tune_apache.conf:
  file.managed:
    - source: salt://files/tune_apache.conf
    - require:
      - pkg: apache2

Enable tune_apache:
  apache_conf.enabled:
    - name: tune_apache
    - require:
      - pkg: apache2

/var/www/html/{{ pillar['domain'] }}:
  file.directory

/var/www/html/{{ pillar['domain'] }}/log:
  file.directory

/var/www/html/{{ pillar['domain'] }}/backups:
  file.directory

/var/www/html/{{ pillar['domain'] }}/public_html:
  file.directory

000-default:
  apache_site.disabled:
    - require:
      - pkg: apache2

/etc/apache2/sites-available/{{ pillar['domain'] }}.conf:
  apache.configfile:
    - config:
      - VirtualHost:
          this: '*:80'
          ServerName:
            - {{ pillar['domain'] }}
          ServerAlias:
            - www.{{ pillar['domain'] }}
          DocumentRoot: /var/www/html/{{ pillar['domain'] }}/public_html
          ErrorLog: /var/www/html/{{ pillar['domain'] }}/log/error.log
          CustomLog: /var/www/html/{{ pillar['domain'] }}/log/access.log combined

{{ pillar['domain'] }}:
  apache_site.enabled:
    - require:
      - pkg: apache2

/var/www/html/{{ pillar['domain'] }}/public_html/index.html:
  file.managed:
    - source: salt://{{ pillar['domain'] }}/index.html