* origin/master:
Add sallinen to blacklist_acpi_power_meter list
We only have puppets >= 3.0 now
run puppet every 1.5 hrs instead of every 2
Remove wheezy-supporting cruft
fix apache version
our cipher suite is still the one recommended by mozilla
retire smetana
Apparently, no quoting
and use template after setting var
fix template
Use update-ca-certificates to update ca-global on stretch and later
Give us longer to notice degraded boot
only run /usr/local/sbin/update-ca-certificates-dsa if it exists
Allow debadmin to sudo to codesign
Make salsa.d.o the default ssl vhost on godard so lame clients can get to it
Comment out rate-limiting of https traffic on security-tracker
Increase https bandwidth for security-tracker
Keep things cached for at least 10min
Fix apache module name
Use mod_cache_disk on security-tracker
Fix typo in comment
drop things from 66.170.99.[12]
fix rule
disable deflate on security-tracker. we are cpu bound
do some basic traffic shaping on soriano
enable expires module for security-tracker
move apache config for security-tracker.debian.org.conf to puppet
Kill planet.debian.net (RT#7019)
The git user's sudo entries should be NOPASSWD (RT#7316)
fix rule name
snapshot - drop traffic from 61.69.254.110
Also give the git user sudo access to salsa-* on godard (RT#7316)
More users for salsa (RT#7316)
Add registry.salsa.debian.org vhost config (RT#7316)
unicamp renumbering
remove parth, re: RT#7334
setup-all-dchroots: wheezy is gone, jessie is limited to LTS architectures
get arm-arm-01 out of broken_rtc set
Install ganeti-reboot-cluster
Update my home ip ranges yet again
set Expires to 1 week also for .gz files
Enable HTTP/2 on sources.d.o
http rate limiting for dynamic hosts also on v6
snapshot: allow 6 requests per minute even to clients that we think are excessive
snapshot_web dynamic rules
snapshot_web dynamic rules
Drop apache2deb9 variable
Add data-protection@d.o to various exim config bits
port 6081 should be allowed via snapshot
try apache rate limiting on snapshot hosts, 2
try apache rate limiting on snapshot hosts
add template
parts of the nagios setup
nagios: install some packages and define service
debian nagios service does not use digest auth
nagios: we do not need proxy_http
add apache::authn_anon and apache::auth_digest
nagios master: apache vhost
start using nagios::server again, move cert setup there
remove obsolete stuff from nagios::server
restart stale icinga automatically
wider regex for clearing failed rsyncd service to catch rsyncd-snapshot-farm@
ignore ruby-dbi ruby-deprecated ruby-dbd-pg on snapshot hosts
ignore ruby-dbi ruby-deprecated ruby-dbd-pg on snapshot hosts
set expires: headers on alioth-archive
Add a few pointers on the anonscm index page
index page for anonscm, 2
index page for anonscm
put an /srv/anonscm.debian.org/htdocs in place
vhost cleanup
vhost update
non-SSL is on 80
Use anonscm.map
try to put anonscm.map onto host, 3
try to put anonscm.map onto host, 2
try to put anonscm.map onto host
prepare anonscm vhost
set hsts on snapshot
Try to put haproxy on snapshot hosts
Add a logging device for haproxy
Add haproxy module from tor
a haproxy facter
More verbose setup-all-dchroots when run in a terminal
install snapshot cert
sallinen: retire 443->5473 dnat
Fetch sallinen.debian.org snapshot backups from port 5473
pg ssh auth: danzi: remove read for sibelius; lw07: switch read sibelius to read sallinen; sallinen: remove read sibelius
backup sallinen pg
sallinen has a pg server
pg firewalling
add lw07 to snapshot_web group
start varnish only after network is online
Try an network_online target for stretch hosts
And setup ferm, 2
And setup ferm
add -j unix,user=vcache -F to varnishd call
and use array for listening ports
varnish on stretch now takes several -a arguments instead of one with multiple addresses
sallinen varnish, 2
sallinen varnish
a very basic generic varnish module
rename varnish to varnish_pkgmirror module
rename varnish to varnish_pkgmirror module
allow archvsync to trigger snapshot imports
block mails from @qq.com
fix kanboard role (php wants mpm_prefork)
add a kanboard role
kanboard group members can run stuff as kanboard on kantuser
Fixup previous commit, log directory permissions were already defined
pybuildd: ensure that the build and logs dir have the correct permissions
New IP ranges for jcristau
Fix acquire-reboot-lock molly-guard hook to actually keep the lock until shutdown
retire old basic-ssh_known_hosts setup
put initial ssh_known_hosts in place and run ud-replicate by puppet
and indexes on alioth-archive
alioth-archive needs mod rewrite
fix path
alioth-archive apache site
snapshot: rewrite module
Add apache vhost
put apache on sallinen
sudo for alioth-archive
create /srv/alioth-archive on alioth-archive host
dedication for grabbe
install apache on alioth archive
prepare alioth archive puppet role
fix grabbe-lvm volume name
add grabbe volumes
Fixup buildd manifest for jessie
pkg-ruby-extras.alioth.d.o on static
Give up on the distinction between /etc/ssl/certs and /etc/ssl/ca-debian
Remove CAs we no longer use from /etc/ssl/ca-debian/
Also remove /usr/local/share/ca-certificates/debian.org
Get rid of /etc/ssl/servicecerts
check-libs: ignore all access to /srv/salsa/repos by user git, regardless of process name
Decommission zemlinsky.d.o (RT#7208)
Remove buildd package on pybuildds based buildds
buildd: use a different configuration for buildd and pybuildd
Reorganize buildd module into different sections
buildd: drop old compat code, make more jessie code conditional
buildd: remove buildd-schroot-aptitude-kill.squeeze
Allow ftp-masters access to the dak-code user
Add video.debconf.org redirect on static (RT#7186)
Cleanup roles::signing some more
Delete scripts for code signing
buildd lingering: remove a bashism
buildd lingering: setup XDG_RUNTIME_DIR in .profile
Set up lists.alioth.debian.org to alioth-lists.debian.net redirect
buildd lingering: ensure /var/lib/systemd/linger directory exists
Enable lingering and persistent journal on buildds
Deploy ssl cert for bugs-devel.d.o on bugs-master
Fix logic in cleanup-watcher-pause-file: clean out files *after* they should be deleted
Only set headers in apache if they don't exist
buildd.d.o: update archive key
99porterbox-extra-sources: Enable debug archive for buster and beyond
99porterbox-extra-sources: Update security blacklist post-stretch
smaller timeout before we attempt to restart hpasmcli
restart hp-health on lobos and villa if they are broken
Do ignore raid controller cache failures on lw08
Try to make dsa-check-hpssacli cron entry setup code easier to read
raise warn-age for pg base backups to 11 days
There is no ferm-restart Exec to notify
postgres-make-base-backups: fix () formatting
format days differently
postgres-make-base-backups: and print seconds as times
postgres-make-base-backups: print more values
postgres-make-base-backups: rename variables to make them more obvious
postgres-make-base-backups: re-order logic for consistency
also print cutoff times
Format time deltas in a readable way instead of in seconds
Try to escape things differently
running every half hour should also suffice easily, with a semicolon
running every half hour should also suffice easily
postgres-make-base-backups: locks and logs
run postgres-make-base-backups every 10 minutes not only on Sunday
sane mode for state dir
And create state dir for postgres-make-base-backups
run base backups spread over time. This also should help us to recover from failures or reboots better
Have postgres-make-base-backups use postgres-make-one-base-backup
Make a postgres-make-one-base-backup script with the logic from postgres-make-base-backups
ferm::conf - include ferm
start ferm config with a 00-init and start SSH*SOURCES there
ferm::conf - merge with tor version
Revert "The debian.ch domain is obsolete"
Revert "Revert "massage log messages""
The debconf13.ch domain is obsolete
Revert "massage log messages"
The debian.ch domain is obsolete
massage log messages
massage log messages
Run our own bacula scheduler from cron
Update ntp init script to the stretch version (RT#6907)
Drop alioth zone from named config
Fix /etc/repro/radius-servers more
Fix /etc/repro/radius-servers
Configuration item "hashsize" is deprecated
Configuration item "allowmultiplekeys" is deprecated
Configuration item "ignorenislike" is deprecated
And fixup another path
Fix path to template
Disable default freeradius sites I don't think we want
Attempt to pull in some of the freeradius config from rtc.d.o
Also put bacula messages into syslog
Disable scheduling for backup jobs in preparation of deploying our own scheduler
Only add host to bacula dsa client list if we do backups for it
Update (c) year
Be more defensive when removing potentially obsolete pools
collect backup client list in a plain text file
bacula: remove obsolete pools
Redirect all of *.pages to https (re: RT#7072)
mirror-health: set User-Agent http header
Revert "Make security -> security-cdn redirect global, not just for the linux package"
Make security -> security-cdn redirect global, not just for the linux package
Drop security-cdn.d.o on stretch
storace also makes ACPI noises about power_meter
we do not need to backup clamav-unofficial-sigs files
push empty /var/lib/varnish/.nobackup
mirror-conova also does lots of ACPI power-meter dmesg noise
Decommission mirror-bytemark
Fix check url for security mirror health
Run dsa-check-openmanage on schumann and wieck
mirror-bytemark no longer a fastly backend for /debian/
make schumann a fastly backend for security
Remove /srv/ftp.root from security mirrors
Serve security mirrors from /srv/mirrors/debian-security
Import facts from schumann
Drop m68k@buildd.debian.org -> m68k-build@nocrew.org rewrite
Add schumann to the security_mirror role
Remove lobos from fastly security backends for now
dupload.conf: fix a thinko in the security upload hostname
buildd: do security uploads using SSH
rsync-ssh-wrap: force the permissions of uploaded files
planet-master.d.o: fix a thinko in my previous commit
planet-master.d.o: only allow access from localhost and local IP
99builddsourceslist: access the security archive using https
lintian.d.o: fix deflate output filter
Mock more certificates
RT#7092: Apache on godard adds an additional X-Xss-Protection
Import facts from godard
octocatalog: add dummy file for LE service certs
Mock ldapinfo during octocatalog runs
static_mirror: enable deflate and filter modules
Install ca-certificates in the buildd chroots
lintian.d.o: Move svg compression to the resources directory
lintian.d.o: Remove redundant + incorrect IfModule mod_userdir
Revert "99builddsourceslist: access the security archive using https"
99builddsourceslist: access the security archive using https
Fully retire spontini.d.o
Also drop security anycast-test mirrors
snapshot storage nodes want the toolchain to build the snapshot fsck utility
setup-dchroot: fix a typo
Install apt-transport-https in the buildd chroots
Drop anycast-test mirrors from apt
More kfreebsd removal
setup-all-dchroots: get rid of kfreebsd and ppc64
nagios: use dsa-check-systemd-services instead of systemctl is-system-running
Also systemctl reset-failed failed session-nnn.scope
Move failed rsync cleanup into systemd module
octocatalog: add dummy file for LE service certs
Fixup local-mirror.cdbuilder sites-enabled symlink name
Add {deb,security}.d.o aliases to local-mirror.cdbuilder
use ttyS1 for the serial console on casulana
Get trailing slashes right for aliases
First go at cdbuilder local mirror export (re: RT##7101)
Add a apache_not_public role where we do not add ferm allow rules and put casulana into it
no more experimental_apache (previously cgi-grnet-01, pejacevic, petrova)
Add cdbuilder-logs static component (re: RT##7101)
Add casulana as a static source for cdbuilder-logs (re: RT##7101)
RT#7092: Apache on godard adds an additional X-Xss-Protection
Test with Puppet 4.8
Update facts
Move nagios stuff
Move generated cert files to new location
Update octocatalog job
Test with Puppet 4.8
Update facts
Move nagios stuff
Move generated cert files to new location
Update octocatalog job
rsync on lw09,lw10
update lw autotab
update lw autotab
do nfs server setup on lw09/lw10
no more 10/8 network at leaseweb
remove sgran from root keys
remove sgran IP range. he can hop via master if needed
puppet does not have any mail config in /srv/puppet.debian.org/mail
backgrounding does not really work remotely
dsa-restart-all-idle-postgres: only restart pg instances that show up in dsa-check-libs
dsa-restart-all-idle-postgres: and do not keep fds open
dsa-restart-all-idle-postgres: disown background jobs instead of waiting for them
in practice make the sleep longer
fix filename
Add script to restart postgres clusters
ignore wb-buildd.more on buildd_master role hosts
samhain ignore /etc/ssh/userkeys/buildd-uploader on ssh upload hosts
Use "restrict" key option for buildd access to upload hosts
Use "restrict" key option for buildd access to wanna-build
Use "restrict" key option for storace's da-backup keys
Use "restrict" key option in debbackup authorized_keys
Simplify portforwarder authorized_keys options
Put ganeti VMs into their own systemd scope
modules/postgres/manifests/backup_source: add a comment re docs
Add a comment header to /etc/ssh/userkeys/debbackup
Do samhain checks only half as often
Update private IP range at leaseweb
Add debconf18.debconf.org config on debussy (rt#7089)
update sudo for new dsa-check-libs call
Clean up failed rsyncs every few minutes
ignore salsa fd leak in sidekiq for dsa-check-lib purposes
and log checksums correctly
also log failed target
pg-backup-file: continue after failures and only report at the end
Decommission fano and finzi
mirror-anu should not actually have an onion address
Improve kpartx rule
Disable default kpartx udev rule
Get rid of obsolete vsftpd::site→absent resources
No more conntrackd in bm, so drop firewall opening
Retire ftp.d.o role, it is unused
Clean up debugging foo
steve probably does not care about samhain mails very much
Get rid of unused role
Get rid of some intermediate variables
Move onion IP addresses into hiera
Simplify debian_mirror for hiera-hash
Whitespace
Move debian_mirror over to being a hash
Use .dig to dig into hiera structs
Debugging
Cleanup obsolete absent resource
Get rid of security_mirror_onion role in favour of just keying off the ip address in hiera
sshd: Raise MaxStartups on ssh upload hosts
Decommission fils and fayrfax
sshd_config: Remove UsePrivilegeSeparation yes. on stretch the default is sandbox which seems better
sshd_config: remove commented out options and options where we just use the default value (according to the stretch manpage)
Simplify lookups now that security_mirror is a hash
Switch the security mirror role over to using a hash
Add support to hashes for has_role
Whitespace fixups
Add localhost listens when listen-addresses is set
Whitespace
Pull out listen addresses from hiera again
Set service-hostname for mirror-conova too
mirror-conova is a fastly backend, mark it as such
Fix typo
Hard code listen IPs while I debug hiera again
Avoid redeclaring the mirror-health file resource
Stop hard coding host list for debian_mirror and use the same code we use for security
Refactor hiera lookup for security mirrors slightly
Gah, puppet!
Use notify, not notice for debugging
Revert "Correct hiera function call syntax"
Fix has_role to handle richer data structures properly
Hard code deb.d.o backend hosts while debugging
Revert "Debugging"
Debugging
Debugging
Correct hiera function call syntax
Also redirect mips64el to the mips port family page
Fix a thinko in previous commit
lobos and villa do not have a battery on their raid controller
More debugging
Fix typo
More gunking around to see if we can make this work
Make all entries in security_mirror into hashes
More syntax fixing
YAML is hard
Use hiera data for pulling health check data for security hosts
Typos-r-us
Pull list of hosts to health check from hiera
Remove backup access from franck.d.o
dsa-check_puppet_agent was renamed to dsa-check-puppet_agent
get rid of pizzetti
Move listen-address information out of manifest and into hiera
Use ensure_packages to avoid problems with puppet redeclaring resources
remove falla and fischer
Pull listen addresses for apache mirrors from hiera
remove bendel/lists blackhole rules that are probably long obsolete
Fix yaml syntax
Add extra metadata for debian_mirror hosts
remove busoni
Import cron entries from dsa-nagios-check package
Use the right path to health checks on security hosts
Decommission ubc-bl*.debian.org
Publish security mirror health on _health
Fix hiera function call syntax
Start setting up mirror health checking for security too
Cut down a tiny bit on exim config distributed everywhere
Remove obsolete block
Try harder at handling connection timeouts for mirror-health
fasolo, klecker: blacklist acpi power meter. rt#6974
systemd: do not reload journald
godard: enable persistent journald storage. rt#7049
wafer: only ask for client certs on the login page
Django sites rely on Referrer headers for XSS protection
wafer wants to be able to write its log, make it run with the debconf-web gid
wafer config uses expires apache module
debussy wants sso_rp for wafer
fixup debconf_wafer role
apache config for wafertest.debconf.org
Use a specific IP address for pages.d.n's vhost
Add debussy to the insecure_ssl role
fix pages port once more
fix port for pages
ssl cert for pages.debian.net
do proxypass for pages
SSL for pages.debian.org
ProxyPass everything so we can set nocanon (re: RT#7057)
change redirections about policy manual to 302, since a change back to the multi-page format is under consideration
79.124.75.18 sends us hotel booking spam
update recursors for grnet
Decommission asachi, arm-linaro-01 and arm-linaro-03 (RT#6895)
use ttyS1 for the kernel console on fasolo
Try to get ipsec between storace and fasolo
And ensure wsgi module gets loaded
Switch debtags to wsgi python3
lower heartbeat intervals
Set Heartbeat Interval in the Director resource instead of each client's Client resource
only manage grub if we have it
projects / mirror / dsa-puppet.git / commitdiff