mirror/dsa-puppet.git
5 years agoDelete stray .orig file
Julien Cristau [Sat, 31 Aug 2019 11:29:27 +0000 (13:29 +0200)]
Delete stray .orig file

5 years agoNow that we have site included before hiera things, we can do this again
Peter Palfrader [Fri, 30 Aug 2019 10:20:18 +0000 (12:20 +0200)]
Now that we have site included before hiera things, we can do this again

5 years agohaving a module named site is really annoying
Peter Palfrader [Fri, 30 Aug 2019 10:15:44 +0000 (12:15 +0200)]
having a module named site is really annoying

5 years agoMove the single ipsec tunnel we have to my new system.
Peter Palfrader [Fri, 30 Aug 2019 10:10:15 +0000 (12:10 +0200)]
Move the single ipsec tunnel we have to my new system.

There are named ipsec "networks".  And any host that is in a named
network will set up ipsec to all the other hosts on that network.

A host can be on more than one network at a time.

Currently we only have the fasolo-storace tunnel, though.  It is
configured in modules/profile/manifests/ipsec/fasolo_storace.pp.

5 years agoremove olin from bmdb1 access
Peter Palfrader [Fri, 30 Aug 2019 06:58:35 +0000 (08:58 +0200)]
remove olin from bmdb1 access

olin does not need access to a postgres cluster.  It was in the list
since its old IP address was in the list.  That IP address was
previously used by oyens.debian.org, which was the openstack keystone
host before it was retired.  It seems the IP address was not removed
from the access list, and then olin inherited it.

5 years agomultipath: remove olin (moved to csail)
Aurelien Jarno [Thu, 29 Aug 2019 21:47:10 +0000 (23:47 +0200)]
multipath: remove olin (moved to csail)

5 years agomove loghost from a "role" in hieradata/common.yaml to a role that is included via...
Peter Palfrader [Thu, 29 Aug 2019 18:32:36 +0000 (20:32 +0200)]
move loghost from a "role" in hieradata/common.yaml to a role that is included via hiera

5 years agodsa_lvm is empty. remove it
Peter Palfrader [Thu, 29 Aug 2019 18:22:57 +0000 (20:22 +0200)]
dsa_lvm is empty.  remove it

5 years agoThe previos LVM config for the ppc cluster did not have issue_discards. Let's keep...
Peter Palfrader [Thu, 29 Aug 2019 18:22:19 +0000 (20:22 +0200)]
The previos LVM config for the ppc cluster did not have issue_discards.  Let's keep it that way.

5 years agospell OSUOSL better
Peter Palfrader [Thu, 29 Aug 2019 18:20:51 +0000 (20:20 +0200)]
spell OSUOSL better

5 years agotransition osuosl ppc cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:18:55 +0000 (20:18 +0200)]
transition osuosl ppc cluster to new lvm config

5 years agothe arm ganeti cluster also wants issue_discards in its lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:12:46 +0000 (20:12 +0200)]
the arm ganeti cluster also wants issue_discards in its lvm config

5 years agotransition ubc arm cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:08:45 +0000 (20:08 +0200)]
transition ubc arm cluster to new lvm config

Similar to the cluster at conova, this effectively replaces filter
with global_filter, and re-enables monitoring.  Also, explicitly set
preferred_names to the empty list.

5 years agofix filter setting for conova lvm
Peter Palfrader [Thu, 29 Aug 2019 17:47:58 +0000 (19:47 +0200)]
fix filter setting for conova lvm

5 years agotransition conova cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:43:51 +0000 (19:43 +0200)]
transition conova cluster to new lvm config

This re-enables use_lvmetad and monitoring which were disabled two years
ago.  We will find out if this breaks anything.  Maybe with the use
of global_filter instead of just filter it'll be fine.

5 years agoalso remove obsolete lvm-grnet-nodeX-ganeti.conf file
Peter Palfrader [Thu, 29 Aug 2019 17:39:35 +0000 (19:39 +0200)]
also remove obsolete lvm-grnet-nodeX-ganeti.conf file

5 years agotransition prokofiev to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:35:18 +0000 (19:35 +0200)]
transition prokofiev to new lvm config

5 years agotransition grnet cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:20:51 +0000 (19:20 +0200)]
transition grnet cluster to new lvm config

5 years agotransition csail cluster to new lvm config, 2
Peter Palfrader [Thu, 29 Aug 2019 17:12:38 +0000 (19:12 +0200)]
transition csail cluster to new lvm config, 2

5 years agotransition csail cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:11:21 +0000 (19:11 +0200)]
transition csail cluster to new lvm config

5 years agotransition bm cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 16:47:41 +0000 (18:47 +0200)]
transition bm cluster to new lvm config

5 years agotransition manda cluster to new lvm config, 4
Peter Palfrader [Thu, 29 Aug 2019 16:26:39 +0000 (18:26 +0200)]
transition manda cluster to new lvm config, 4

5 years agotransition manda cluster to new lvm config, 3
Peter Palfrader [Thu, 29 Aug 2019 16:25:31 +0000 (18:25 +0200)]
transition manda cluster to new lvm config, 3

5 years agotransition manda cluster to new lvm config, 2
Peter Palfrader [Thu, 29 Aug 2019 16:25:09 +0000 (18:25 +0200)]
transition manda cluster to new lvm config, 2

5 years agotransition manda cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 16:24:15 +0000 (18:24 +0200)]
transition manda cluster to new lvm config

5 years agomove ubc-enc2bl02, ubc-enc2bl09 and ubc-enc2bl10 to the new LVM config module
Peter Palfrader [Thu, 29 Aug 2019 16:11:37 +0000 (18:11 +0200)]
move ubc-enc2bl02, ubc-enc2bl09 and ubc-enc2bl10 to the new LVM config module

5 years agodefine the update-initramfs exec
Peter Palfrader [Thu, 29 Aug 2019 15:58:14 +0000 (17:58 +0200)]
define the update-initramfs exec

5 years agomove the ubc-enc2bl01 LVM config to a profile included via hiera using the new LVM...
Peter Palfrader [Thu, 29 Aug 2019 15:56:31 +0000 (17:56 +0200)]
move the ubc-enc2bl01 LVM config to a profile included via hiera using the new LVM module

5 years agoAn lvm module that can set issue_discards and global_filter
Peter Palfrader [Thu, 29 Aug 2019 15:08:40 +0000 (17:08 +0200)]
An lvm module that can set issue_discards and global_filter

5 years agoAdd a pristine stretch and buster lvm.conf as a template for some lvm reconciliation...
Peter Palfrader [Thu, 29 Aug 2019 15:07:08 +0000 (17:07 +0200)]
Add a pristine stretch and buster lvm.conf as a template for some lvm reconciliation work

5 years agoThe syntax check won't let me include our site module, probably due to its name....
Peter Palfrader [Thu, 29 Aug 2019 15:50:09 +0000 (17:50 +0200)]
The syntax check won't let me include our site module, probably due to its name.  Try via hiera, but merge it into base eventually

5 years agoThe syntax check won't let me include our site module, probably due to its name
Peter Palfrader [Thu, 29 Aug 2019 15:49:40 +0000 (17:49 +0200)]
The syntax check won't let me include our site module, probably due to its name

5 years agoactually add the base module
Peter Palfrader [Thu, 29 Aug 2019 15:40:49 +0000 (17:40 +0200)]
actually add the base module

5 years agomove all the unconditional includes from the top-level site.pp into a base module...
Peter Palfrader [Thu, 29 Aug 2019 15:39:34 +0000 (17:39 +0200)]
move all the unconditional includes from the top-level site.pp into a base module which gets included by the default hiera entry

5 years agoInclude hiera classes
Peter Palfrader [Thu, 29 Aug 2019 15:35:10 +0000 (17:35 +0200)]
Include hiera classes

We want to be able to specify which puppet classes a node should include
using hiera.  Start by including hiera classes in the site manifest,
and move the site class so we include something using this mechanism.

Eventually we want to move all the include entries out of manifests/site.pp.

5 years agoupdate anonscm.map from formorer
Peter Palfrader [Wed, 28 Aug 2019 11:20:55 +0000 (13:20 +0200)]
update anonscm.map from formorer

5 years agoFix another typo
Aurelien Jarno [Wed, 28 Aug 2019 10:17:21 +0000 (12:17 +0200)]
Fix another typo

5 years agoFix typo in merged_usr fact
Aurelien Jarno [Wed, 28 Aug 2019 10:09:56 +0000 (12:09 +0200)]
Fix typo in merged_usr fact

5 years agosamhainrc: support merged usr layout
Aurelien Jarno [Wed, 28 Aug 2019 10:07:00 +0000 (12:07 +0200)]
samhainrc: support merged usr layout

5 years agoAdd a merged_usr fact
Aurelien Jarno [Wed, 28 Aug 2019 10:07:00 +0000 (12:07 +0200)]
Add a merged_usr fact

5 years agoFix CSAIL IPv6 subnet
Aurelien Jarno [Wed, 28 Aug 2019 08:46:44 +0000 (10:46 +0200)]
Fix CSAIL IPv6 subnet

5 years agoRemove debconf18 vhost from debussy
Julien Cristau [Wed, 28 Aug 2019 08:29:26 +0000 (10:29 +0200)]
Remove debconf18 vhost from debussy

It moved to static.

5 years agoferm: drop FREEBSD_SSH_ACCESS
Aurelien Jarno [Wed, 28 Aug 2019 08:04:45 +0000 (10:04 +0200)]
ferm: drop FREEBSD_SSH_ACCESS

5 years agoferm: add syncproxy.na.debian.org IPv6
Aurelien Jarno [Wed, 28 Aug 2019 08:03:33 +0000 (10:03 +0200)]
ferm: add syncproxy.na.debian.org IPv6

5 years agoAdd CSAIL IPv6 range
Aurelien Jarno [Wed, 28 Aug 2019 07:54:39 +0000 (09:54 +0200)]
Add CSAIL IPv6 range

5 years agoBump the language cookie expiry for visits during the expiry period
Paul Wise [Sun, 25 Aug 2019 03:48:59 +0000 (11:48 +0800)]
Bump the language cookie expiry for visits during the expiry period

This ensures that if the user continues to visit the website then
they don't have to manually set the cookie again until they
stop visiting the website for more than the expiry period.

5 years agoEnable linger for sreview user (RT#7917)
Julien Cristau [Thu, 22 Aug 2019 09:38:42 +0000 (11:38 +0200)]
Enable linger for sreview user (RT#7917)

5 years agofix ssl client path
Peter Palfrader [Thu, 22 Aug 2019 08:58:52 +0000 (10:58 +0200)]
fix ssl client path

5 years agostop hardcoding loghost names in syslog-ng template
Peter Palfrader [Thu, 22 Aug 2019 08:55:49 +0000 (10:55 +0200)]
stop hardcoding loghost names in syslog-ng template

5 years agomove syslog ferm into syslog role
Peter Palfrader [Thu, 22 Aug 2019 08:47:51 +0000 (10:47 +0200)]
move syslog ferm into syslog role

5 years agomake loghost into a role
Peter Palfrader [Thu, 22 Aug 2019 08:44:27 +0000 (10:44 +0200)]
make loghost into a role

5 years agoNo more sid/bullseye chroots for mips
Julien Cristau [Tue, 20 Aug 2019 14:16:17 +0000 (16:16 +0200)]
No more sid/bullseye chroots for mips

5 years agoRT#7893 Let wanna-build admins sudo to wbadm-web
Philipp Kern [Sun, 18 Aug 2019 09:10:55 +0000 (11:10 +0200)]
RT#7893 Let wanna-build admins sudo to wbadm-web

5 years agoRT#7862 Let the community team sudo to the community user
Tollef Fog Heen [Thu, 15 Aug 2019 19:14:58 +0000 (21:14 +0200)]
RT#7862 Let the community team sudo to the community user

5 years agoHandle ipv6 addresses in named.conf.options
Julien Cristau [Tue, 13 Aug 2019 14:53:47 +0000 (16:53 +0200)]
Handle ipv6 addresses in named.conf.options

5 years agoAdd mipsel-osuosl-02.debian.org
Aurelien Jarno [Tue, 13 Aug 2019 10:26:12 +0000 (12:26 +0200)]
Add mipsel-osuosl-02.debian.org

5 years agoRedirect unsetlang to the correct location
Paul Wise [Sun, 11 Aug 2019 09:31:09 +0000 (17:31 +0800)]
Redirect unsetlang to the correct location

The substitution was using the wrong match group.

Fixes: commit eef0d1229a8d2627ffc8663eda9bd2d68a0ef09c

5 years agoSet the cookie domain based on the HTTP domain.
Paul Wise [Sun, 11 Aug 2019 04:18:21 +0000 (12:18 +0800)]
Set the cookie domain based on the HTTP domain.

Avoids issues with setting cookies on www-staging.d.o or other mirrors.

Fixes: commit eef0d1229a8d2627ffc8663eda9bd2d68a0ef09c

5 years agoAdd basic support for influencing language selection via cookies.
Paul Wise [Sat, 3 Aug 2019 02:23:04 +0000 (10:23 +0800)]
Add basic support for influencing language selection via cookies.

The UI for language selection in browsers is rarely used or known about
by visitors so websites need to provide a way for visitors to influence
content negotiation using the website itself in addition to the browser.

Setting a cookie is the simplest option for us as the URLs don't change.

The GDPR does not apply and to satisfy the EU cookie law we can include
some explanatory text around the form that sets the cookie.

Visitors should not get their language cookie changed when other folks link
them to URLs for other languages and search engines should not set language
cookies at all. Using POST requests ensures each cookie is only set explictly.

Since Apache mod_rewrite cannot inspect POST data, we use URLs instead.

The default cookie lifetime is about one month (60*24*7*4 minutes).

<CAKTje6EzfE89jBqpLQu1_a3ybYkV7pPcquKzQb6Uz8uu=pGudA@mail.gmail.com>
<f849fde79a325422af9a9553f6672a96382ae262.camel@debian.org>
https://httpd.apache.org/docs/current/content-negotiation.html#exceptions

5 years agoAdd mipsel-osuosl-01.debian.org
Aurelien Jarno [Sat, 10 Aug 2019 07:45:01 +0000 (09:45 +0200)]
Add mipsel-osuosl-01.debian.org

5 years agoAdd sso_rp role on wuiet (RT#7892)
Julien Cristau [Fri, 9 Aug 2019 14:03:47 +0000 (16:03 +0200)]
Add sso_rp role on wuiet (RT#7892)

5 years agodebconf20.dc.o vhost
Stefano Rivera [Tue, 30 Jul 2019 14:50:06 +0000 (11:50 -0300)]
debconf20.dc.o vhost

5 years agoSwitch wafertest to dc20
Stefano Rivera [Tue, 30 Jul 2019 00:28:24 +0000 (21:28 -0300)]
Switch wafertest to dc20

5 years agosamhain: ignore /etc/exim4/conf.d
Aurelien Jarno [Fri, 26 Jul 2019 15:05:13 +0000 (17:05 +0200)]
samhain: ignore /etc/exim4/conf.d

This directory is removed by puppet

5 years agoEnable proxy module for wiki.debconf.org pass-thru rewrite
Paul Wise [Tue, 23 Jul 2019 23:46:37 +0000 (07:46 +0800)]
Enable proxy module for wiki.debconf.org pass-thru rewrite

Fixes: commit f33e5b0b7749df9e3bf60b7b816898f3d07ecc8b
Fixes: commit f3cf7b1e16b58065689c4ae0ded3e41d6782fb13
Requested-by: tumbleweed on #debian-admin
5 years agoEnable proxy module for wiki.debconf.org pass-thru rewrite
Paul Wise [Tue, 23 Jul 2019 23:40:11 +0000 (07:40 +0800)]
Enable proxy module for wiki.debconf.org pass-thru rewrite

Fixes: commit f33e5b0b7749df9e3bf60b7b816898f3d07ecc8b
Requested-by: tumbleweed on #debian-admin
5 years agoMerge branch 'pass-through-slash' of https://salsa.debian.org/stefanor/dsa-puppet
Tollef Fog Heen [Tue, 23 Jul 2019 20:12:25 +0000 (22:12 +0200)]
Merge branch 'pass-through-slash' of https://salsa.debian.org/stefanor/dsa-puppet

Signed-off-by: Tollef Fog Heen <tfheen@err.no>
5 years agoPassThrough / to /wiki/
Stefano Rivera [Tue, 23 Jul 2019 19:44:26 +0000 (16:44 -0300)]
PassThrough / to /wiki/

So that the response has a Content-Type header (via the ForceType on
/wiki/).

5 years agoBlock 198.108.67.48 from security mirrors for breaking rsync
Peter Palfrader [Fri, 19 Jul 2019 14:05:22 +0000 (16:05 +0200)]
Block 198.108.67.48 from security mirrors for breaking rsync

5 years agomove pg rule from veyepar to sreview
Peter Palfrader [Fri, 19 Jul 2019 11:01:39 +0000 (13:01 +0200)]
move pg rule from veyepar to sreview

5 years agoAllow DC19 access to the PG on vittoria, re: RT#7845
Peter Palfrader [Fri, 19 Jul 2019 10:06:13 +0000 (12:06 +0200)]
Allow DC19 access to the PG on vittoria, re: RT#7845

5 years agosreview is sreview.debian.net
Peter Palfrader [Fri, 19 Jul 2019 09:57:41 +0000 (11:57 +0200)]
sreview is sreview.debian.net

5 years agoMove veyepar and sreview into own manifests
Peter Palfrader [Fri, 19 Jul 2019 09:55:53 +0000 (11:55 +0200)]
Move veyepar and sreview into own manifests

5 years agowww.do: stop doing permanent redirects
Peter Palfrader [Thu, 18 Jul 2019 11:32:26 +0000 (13:32 +0200)]
www.do: stop doing permanent redirects

Permanent redirects may be cached permanently.  Don't do that.

5 years agoAdd redirects for all the /misc section, and group all the redirects related to ...
Laura Arjona Reina [Thu, 18 Jul 2019 11:10:43 +0000 (13:10 +0200)]
Add redirects for all the /misc section, and group all the redirects related to /misc

Signed-off-by: Peter Palfrader <peter@palfrader.org>
5 years agomanda: entropykey moved from czerny to manda-node04
Aurelien Jarno [Mon, 8 Jul 2019 19:28:05 +0000 (21:28 +0200)]
manda: entropykey moved from czerny to manda-node04

5 years agogive keyring the ability to reload bind9
Peter Palfrader [Sun, 7 Jul 2019 18:54:16 +0000 (20:54 +0200)]
give keyring the ability to reload bind9

5 years agoNotify on _openpgpkey.debian.org
Peter Palfrader [Sun, 7 Jul 2019 18:14:18 +0000 (20:14 +0200)]
Notify on _openpgpkey.debian.org

5 years agodo nsec3 via puppet
Peter Palfrader [Sun, 7 Jul 2019 18:12:11 +0000 (20:12 +0200)]
do nsec3 via puppet

5 years agoSign _openpgpkey.debian.org
Peter Palfrader [Sun, 7 Jul 2019 18:09:38 +0000 (20:09 +0200)]
Sign _openpgpkey.debian.org

5 years agoAdd a flag to the dns-helper tooling
Peter Palfrader [Sun, 7 Jul 2019 18:05:49 +0000 (20:05 +0200)]
Add a flag to the dns-helper tooling

5 years agoAdd a flag to the dns-helper tooling
Peter Palfrader [Sun, 7 Jul 2019 18:04:05 +0000 (20:04 +0200)]
Add a flag to the dns-helper tooling

5 years agogeo ferm
Peter Palfrader [Sun, 7 Jul 2019 10:16:27 +0000 (12:16 +0200)]
geo ferm

5 years agogeo ferm
Peter Palfrader [Sun, 7 Jul 2019 10:15:26 +0000 (12:15 +0200)]
geo ferm

5 years agofw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:13:50 +0000 (12:13 +0200)]
fw on kaufmann

5 years agofw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:09:22 +0000 (12:09 +0200)]
fw on kaufmann

5 years agofw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:07:32 +0000 (12:07 +0200)]
fw on kaufmann

5 years agofw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:06:39 +0000 (12:06 +0200)]
fw on kaufmann

5 years agonotify bind9
Peter Palfrader [Sun, 7 Jul 2019 10:04:33 +0000 (12:04 +0200)]
notify bind9

5 years agoSet masters
Peter Palfrader [Sun, 7 Jul 2019 10:04:09 +0000 (12:04 +0200)]
Set masters

5 years agoFetch openpgpkey zone to denis
Peter Palfrader [Sun, 7 Jul 2019 10:01:30 +0000 (12:01 +0200)]
Fetch openpgpkey zone to denis

5 years agoreindent
Peter Palfrader [Sun, 7 Jul 2019 10:01:23 +0000 (12:01 +0200)]
reindent

5 years agoWe no longer have secondaries for the debian zones
Peter Palfrader [Sun, 7 Jul 2019 09:56:49 +0000 (11:56 +0200)]
We no longer have secondaries for the debian zones

5 years agoadd a ;
Peter Palfrader [Sun, 7 Jul 2019 09:42:39 +0000 (11:42 +0200)]
add a ;

5 years agoTry to add openpgpkey zone
Peter Palfrader [Sun, 7 Jul 2019 09:38:16 +0000 (11:38 +0200)]
Try to add openpgpkey zone

5 years agofix array
Peter Palfrader [Sun, 7 Jul 2019 09:31:36 +0000 (11:31 +0200)]
fix array

5 years agoset up a shared keypair between kaufmann and denis
Peter Palfrader [Sun, 7 Jul 2019 09:31:15 +0000 (11:31 +0200)]
set up a shared keypair between kaufmann and denis

5 years agoreorder ACLs and shared keys on primary
Peter Palfrader [Sun, 7 Jul 2019 09:29:48 +0000 (11:29 +0200)]
reorder ACLs and shared keys on primary

5 years agoInclude local shared keys on primary
Peter Palfrader [Sun, 7 Jul 2019 09:26:59 +0000 (11:26 +0200)]
Include local shared keys on primary

5 years agomove ACLs for 3rd party things from the named.conf.options template to named.conf...
Peter Palfrader [Sun, 7 Jul 2019 09:23:19 +0000 (11:23 +0200)]
move ACLs for 3rd party things from the named.conf.options template to named.conf.puppet-misc