Provision With Salt

[mlavin]

This is still a work in progress

This breaks up the duty of the Fabric script to focus on deployment and uses the masterless salt-minion for the provisioning. This addresses #11, #18, #26, #27, #28. It removes the requirement of argyle. A few things that still need to be sorted out before this is merged:

• Better documentation (related to Setup template-specific security policy docs #30)
• Sort out the non-zero return value of salt-call
• Fix MEDIA_ROOT and STATIC_ROOT settings along with Nginx configuration
• Firewall Firewall By Default #29

Follow up issues include:

• SSL SSL by Default #31
• Gunicorn updates gunicorn needs update for Django 1.5 #20 and Consider switching to gunicorn sync worker by default #24
• pylibmc Consider Making pylibmc the Default #15
• Support multiple projects/environments on a single server Support for Multiple Project/Environments on a Single Server #33

[mlavin]

Updated with documentation and updated static/media settings.

[ironfroggy]

Determine if we want to support multiple projects/environments on a single server

Personally, I would love to, but I think if there is any considerable complexity added, we should push this to another ticket and add it in the future, and focus more on this initial salt branch.

[ironfroggy]

What version of Postgres?

[mlavin]

It's using the default for 12.04 which is 9.1. I thought about adding all the version numbers but it would be messy (mostly for Gunicorn which isn't managed in apt).

[mlavin]

Updated docs based on @ironfroggy's notes. Reworked the directory structure and configurations to make it easier to run multiple projects on the same server.

[mlavin]

More offline discussion of multiple projects/environments. To support multiple environments as well as multiple projects we would need to update references which are only unique at the project level.

• root_dir(in web.sls) and related paths (perhaps use /var/www/{{ project }}-{{ env }}/)
• nginx_conf file name and upstream declaration
• group_conf file name and group declaration
• gunicorn_conf file name a program declaration
• fabfile setup_path and deploy commands
• settings.staging PUBLIC_ROOT

[dpoirier]

Is there a reason we don't suggest adding the host address to the env.hosts first, so we can skip the -H argument on fab?

[mlavin]

The explicit -H in the documentation is more a product of larger setups where this is needed/desired. In the case that there is more than one server in the environment (which isn't really handled right now) fab staging -u root provision would execute on all machines. However, it would fail on already provisioned machines since we don't allow root login after the initial provision. I'm fine with reordering the steps.

[mlavin]

Added firewall support and broke out multiple environments into its own case. Is there anything remaining that should block this from being merged into master? @copelco @ironfroggy @dpoirier @Scottm-Caktus

[ironfroggy]

🚀