I'd like to re-raise or maybe generalize the original question: are there any recommended practices or tools for managing locally-created and/or locally-customized files under /usr/local/etc?
[...]
Surely there must be some best practice or tooling to help out here, right?
Keep in mind that on Unix
everything is like elastic. There are no hard rules on doing things and with a bit of scripting you can set up a ton of flexible behavior. Still...
The following is probably a bit unorthodox here and there but I can assure you that it saved my skin several times...
#1 Include the structure(s) into a local (?) Git repository.
This can be done in multiple ways, either you set up several local repositories (
/etc,
/usr/local/etc and maybe keep things like
/usr/local/etc/apache24 separate) but it's also not too hard to push all those repositories into a central one, now referring to
git-worktree(1). I usually keep the main repository in
/root/etc which then provides access to all these separate ones. Something like this:
Code:
$ git branch -lv
+ apache 9a3a6ff Added Breve's VPN address to allow Git repository access.
+ bind 9f2403e Added vps and removed old name 'unicron'.
+ etc a003a7e Changes due to Git upgrade.
+ etc.local 8a2cbbc Various changes for VPN usage: - Allow older Windows clients access to Samba. - Disable the FreeBSD repository.
+ kernel 33ff944 Added extra sound module
* master 27be3b0 Fixed some incorrect & outdated information.
$ git worktree list
/usr/local/etc/apache24 9a3a6ff [apache] prunable
/usr/local/etc/namedb 9f2403e [bind] prunable
/etc a003a7e [etc] prunable
/usr/local/etc 8a2cbbc [etc.local] prunable
/root/kernels 33ff944 [kernel] prunable
/home/peter/etc 27be3b0 [master]
This setup allows me to keep tap on everyting from one location (as shown above) and better yet... I can even push this 'main' repository into yet another one as a submodule (see
git-submodule(1)) so that I can even maintain a "network repo" for a full server overview:
Code:
$ git submodule status
+13d85acc1fb7e32fefacc1cdbd08d7f4dc8ce932 breve (heads/etc.local)
a6b8d1f46227ee6a549120ea5415ff5b3c357696 feliner (heads/master)
4a1f97e7632041b2645748ec4a1198d50ed2e438 vps (start-2-g4a1f97e)
^ That's back from the good old days when I managed 3 servers at once, where some also included jails.
See, there is a
major advantage to keep in mind here:
retention. A normal backup probably has a retention of a few weeks, maybe a few months but eventually there's only so much you can go back. So including a whole Git repository into your backup will ensure that you always have a full history of everything you did (assuming you're careful with all your commits). Oh... the reason I prefer using worktrees is because I don't get "ugly"
.git folders everywhere, but merely a few
repo.git files.
#2 Try going for modular setups
Should be self explaining I think but if possible then I prefer using several config files vs. one huge one, this also makes it easier to maintain the whole lot. For example... I keep a local Portmaster logfile, I have logfiles from RKHunter (rootkit / security checks), my IDS (Tripwire), etc. So I use
newsyslog(8) to mainain all those. Now, for my local server which only has a few logfiles it's sufficient to use
/usr/local/etc/newsyslog.conf, but back when I maintained 3 servers at once I kept everything in separate configfiles that got stored in
/usr/local/etc/newsyslog.conf.d and pushed onto relevant servers (using that Git structure btw.).
#3 Try to keep away from 'system files'
This is what I hinted at above, but truth be told.. I don't think it's possible to be fully consistent with this. Some services provide support for 'includes' or "*.local" files, whereas others don't. When it comes to my systems startup configuration then I simply maintain
/etc/rc.conf and/or
/boot/loader.conf, easy.
In other cases I always copy an 'example' file to the main one and use that for my configuration (
portmaster.rc.sample vs.
portmaster.rc, or
pksd.conf.sample vs.
pksd.conf).
But sometimes you simply don't have much of a choice. Like with, say,
/usr/local/etc/smb4.conf (though this is probably a bad example considering that it usually gets generated, after which you customize it). Or... how about
~postgres/data16/postgresql.conf?
Still, having said that I would never directly mess around with files in "d directories" (like
/etc/cron.d,
/usr/local/etc/man.d and of course
/usr/local/etc/rc.d).
#4 Always use whatever works best for you
IMO this is the most important rule. I know of people who probably shudder at the thought of those Git repositories, and that's fair enough (!). Fact remains that now, 5 years after date, I still have full access to the full custom configuration of all my previous 3 servers, and all their services. Without any issue. From important stuff like Apache, my firewall(s) and of course profiles. But also less serious things like my old IRC server, its services and I even managed to keep a hold on my old Irssi config.
Your milage may vary, as the saying goes.
Hope this can still give you some ideas!
(edit => note to self: I should use 'preview' some more
)
