Aurelien Jarno [Sat, 28 Sep 2019 11:22:31 +0000 (13:22 +0200)]
rename BM delfin volumes to OLD-
Aurelien Jarno [Sat, 28 Sep 2019 11:15:28 +0000 (13:15 +0200)]
autofs: delfin at ubc
Aurelien Jarno [Sat, 28 Sep 2019 11:12:38 +0000 (13:12 +0200)]
rename BM pejacevic volumes to OLD-
Aurelien Jarno [Sat, 28 Sep 2019 10:46:56 +0000 (12:46 +0200)]
add multipath volumes for delfin at ubc
Aurelien Jarno [Sat, 28 Sep 2019 09:31:57 +0000 (11:31 +0200)]
Drop HOST_PGBACKUPHOST_V4 and HOST_PGBACKUPHOST_V6
Aurelien Jarno [Sat, 28 Sep 2019 09:27:19 +0000 (11:27 +0200)]
ferm@serger: merge dsa-postgres-backup and dsa-postgres-backup6
Aurelien Jarno [Sat, 28 Sep 2019 09:21:28 +0000 (11:21 +0200)]
Drop HOST_DEBIAN_V4 and HOST_DEBIAN_V6
Peter Palfrader [Sat, 28 Sep 2019 08:23:26 +0000 (10:23 +0200)]
Get pubsub nodes from puppetdb
Peter Palfrader [Sat, 28 Sep 2019 07:41:15 +0000 (09:41 +0200)]
Use export/collect to get the intra-cluster firewall opened for pubsub
Peter Palfrader [Sat, 28 Sep 2019 07:39:52 +0000 (09:39 +0200)]
whitespace/quoting: pubsub
Aurelien Jarno [Fri, 27 Sep 2019 22:57:34 +0000 (00:57 +0200)]
pubsub: do not hardcode IPs
Aurelien Jarno [Fri, 27 Sep 2019 22:32:19 +0000 (00:32 +0200)]
stunnel: merge IPv4 and IPv6 rules in a single rule
Julien Cristau [Fri, 27 Sep 2019 18:35:51 +0000 (20:35 +0200)]
autofs: pejacevic at ubc
Aurelien Jarno [Fri, 27 Sep 2019 22:27:38 +0000 (00:27 +0200)]
pubsub: merge IPv4 and IPv6 rules in a single rule
Aurelien Jarno [Fri, 27 Sep 2019 22:04:53 +0000 (00:04 +0200)]
ferm: do not open PG to backup hosts for clusters defined in backup_source
Aurelien Jarno [Fri, 27 Sep 2019 21:56:45 +0000 (23:56 +0200)]
Correctly add tracker and wanna-build backups @ danzi
Aurelien Jarno [Fri, 27 Sep 2019 21:46:23 +0000 (23:46 +0200)]
pg@danzi: use a list of hosts instead of whitelisting the whole subnet
Julien Cristau [Fri, 27 Sep 2019 18:34:37 +0000 (20:34 +0200)]
add multipath volumes for pejacevic at ubc
Adam D. Barratt [Fri, 27 Sep 2019 18:31:08 +0000 (19:31 +0100)]
fail2ban: actually ship the dsa-exim-strict set up
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 27 Sep 2019 14:56:20 +0000 (15:56 +0100)]
exim/files/common/blacklist: update based on current issues
Each of the additional entries has been seen on d.o mail queues / logs
within the past day
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 27 Sep 2019 13:37:54 +0000 (14:37 +0100)]
eximconf: log the current rate at which penalised senders are sending
The use of the "strict" modifier ensures that the count is always updated.
The default "leaky" mode stops updating the count once the limit has
been reached.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 27 Sep 2019 13:36:41 +0000 (14:36 +0100)]
fail2ban: split dsa-exim into strict and not-so-strict checks
The not-so-strict checks need more provocation to add a ban
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 27 Sep 2019 11:35:10 +0000 (12:35 +0100)]
eximconf: simplify a sender domain check by using sender_domains
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 27 Sep 2019 11:33:39 +0000 (12:33 +0100)]
eximconf: log a few more details for messages
These make it easier to tie up incoming and outbound log entries
for a given mail.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Fri, 27 Sep 2019 09:36:20 +0000 (11:36 +0200)]
Fix typo in volume name
Peter Palfrader [Fri, 27 Sep 2019 07:03:49 +0000 (09:03 +0200)]
move appstream.debian.org static component to static-master-ubc-01 from dillon, since the source (mekeel) moved from bm to ubc
Peter Palfrader [Fri, 27 Sep 2019 06:33:08 +0000 (08:33 +0200)]
mekeel now gets the UBC autofs config
Peter Palfrader [Fri, 27 Sep 2019 06:32:26 +0000 (08:32 +0200)]
rename BM mekeel volumes to OLD-
Peter Palfrader [Fri, 27 Sep 2019 05:58:05 +0000 (07:58 +0200)]
Add volumes for mekeel
Adam D. Barratt [Fri, 27 Sep 2019 05:10:54 +0000 (06:10 +0100)]
eximconf: add debug messages for (remaining) transports
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 27 Sep 2019 05:10:38 +0000 (06:10 +0100)]
eximconf: add a debug message for relay_manualroute
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 26 Sep 2019 17:29:45 +0000 (18:29 +0100)]
fail2ban: make exim "AUTH LOGIN" match case-insensitive
Apparently people are trying it in lower-case as well
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 26 Sep 2019 17:28:03 +0000 (18:28 +0100)]
fail2ban: add more expressions to the Exim filter
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 26 Sep 2019 17:24:01 +0000 (18:24 +0100)]
eximconf: increase log detail
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 26 Sep 2019 17:20:55 +0000 (18:20 +0100)]
eximconf: split log_selector to one item per line
This makes it easier to add/remove items
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 26 Sep 2019 17:18:09 +0000 (18:18 +0100)]
eximconf: force mail to Google to be routed via IPv4
Delivering mail to Google over IPv6 is tricky unless the stars align
in precisely the right manner. Doing so over IPv4 can still be
awkard, but is generally much simpler.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 26 Sep 2019 17:07:17 +0000 (18:07 +0100)]
eximconf: make NDRs contain only headers, not bodies
This helps avoid us being used as a potential part of redirected
"bounce spam".
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 26 Sep 2019 17:04:12 +0000 (18:04 +0100)]
eximconf: add an alternative SMTP router for "single domain" domains
These are domains that only allow a single recipient domain per SMTP
connection, in order to allow simple differentiation of filtering
options.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Thu, 26 Sep 2019 12:57:22 +0000 (14:57 +0200)]
exim: fix syntax error in exim_surbl.pl
Julien Cristau [Thu, 26 Sep 2019 12:36:57 +0000 (14:36 +0200)]
exim: remove debconf hosts from debianhosts
debconf.org email goes through the debian MXs now.
Julien Cristau [Thu, 26 Sep 2019 12:14:16 +0000 (14:14 +0200)]
Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
Peter Palfrader [Thu, 26 Sep 2019 07:38:09 +0000 (09:38 +0200)]
Fix package name
Peter Palfrader [Thu, 26 Sep 2019 07:35:38 +0000 (09:35 +0200)]
And remove the file on or after 10.2
Peter Palfrader [Thu, 26 Sep 2019 07:34:59 +0000 (09:34 +0200)]
Ignore local package trapperkeeper-webserver-jetty9-clojure on puppetmaster, cf. Debian#924005, Debian#930562
Peter Palfrader [Wed, 25 Sep 2019 20:28:07 +0000 (22:28 +0200)]
remove non-standard From header from Bacula emails
re Debian#935886, by anarcat
Peter Palfrader [Wed, 25 Sep 2019 20:27:38 +0000 (22:27 +0200)]
simplify email_error default logic
(by anarcat)
Peter Palfrader [Wed, 25 Sep 2019 17:01:35 +0000 (19:01 +0200)]
Fix bacula email logic
Peter Palfrader [Wed, 25 Sep 2019 17:01:00 +0000 (19:01 +0200)]
Revert "Since the conditional does not work for default values for params, fall back to sane defaults in code"
This reverts commit
75ce99c03293e2df071bcbb7f56694d192652586.
Peter Palfrader [Wed, 25 Sep 2019 16:52:36 +0000 (18:52 +0200)]
Since the conditional does not work for default values for params, fall back to sane defaults in code
Peter Palfrader [Wed, 25 Sep 2019 16:44:00 +0000 (18:44 +0200)]
set email_error until we figure out how to fix it properly
Peter Palfrader [Wed, 25 Sep 2019 16:37:11 +0000 (18:37 +0200)]
Only realize the director-from-client config if the director-from-client-via-storage config is already there
Peter Palfrader [Wed, 25 Sep 2019 16:21:30 +0000 (18:21 +0200)]
Split up mail roles
Peter Palfrader [Wed, 25 Sep 2019 14:54:18 +0000 (16:54 +0200)]
Try to wait for both network-online *and* unbound
Peter Palfrader [Wed, 25 Sep 2019 12:57:31 +0000 (14:57 +0200)]
defaults for db_address, db_port; move dbsslmode = verify-ca into the case where we have a dbsslca
Peter Palfrader [Wed, 25 Sep 2019 12:21:32 +0000 (14:21 +0200)]
List non-optional params first
Peter Palfrader [Wed, 25 Sep 2019 12:20:25 +0000 (14:20 +0200)]
Move bacula::bacula_ssl_{server,client}_{cert,key} to hiera
Peter Palfrader [Wed, 25 Sep 2019 12:09:45 +0000 (14:09 +0200)]
Move bacula::bacula_ssl_ca_path to hiera
Peter Palfrader [Wed, 25 Sep 2019 12:01:48 +0000 (14:01 +0200)]
s/bacula_ca_path/bacula_ssl_ca_path/
Peter Palfrader [Wed, 25 Sep 2019 11:59:57 +0000 (13:59 +0200)]
Move operator_email to hiera
Peter Palfrader [Wed, 25 Sep 2019 11:58:01 +0000 (13:58 +0200)]
bacula_dsa_client_list and tag_bacula_dsa_client_list are not parameters
Peter Palfrader [Wed, 25 Sep 2019 11:41:15 +0000 (13:41 +0200)]
Document ferm::rule::simple
Peter Palfrader [Wed, 25 Sep 2019 11:05:06 +0000 (13:05 +0200)]
dsa_systemd::override: cleanup and make sure removal cleans the dir also
Peter Palfrader [Wed, 25 Sep 2019 09:50:42 +0000 (11:50 +0200)]
Make rentention periods configurable with hiera, per client
Peter Palfrader [Wed, 25 Sep 2019 09:40:05 +0000 (11:40 +0200)]
Globally enable Heartbeat Interval
Peter Palfrader [Wed, 25 Sep 2019 09:33:50 +0000 (11:33 +0200)]
Remove defaults
Peter Palfrader [Wed, 25 Sep 2019 09:31:24 +0000 (11:31 +0200)]
Unify name of the Messages Resource
Peter Palfrader [Wed, 25 Sep 2019 09:20:39 +0000 (11:20 +0200)]
Try after unbound.service instead of network-online.target
Doing the after network-online.target was not sufficient.
: Config error: Cannot add hostname(adayevskaya.debian.org) and port(9102) to addrlist (Cannot resolve hostname(adayevskaya.debian.org) Temporary failure in name resolution)
: : line 23, col 5 of file /etc/bacula/bacula-fd.conf
: }
Peter Palfrader [Wed, 25 Sep 2019 09:19:18 +0000 (11:19 +0200)]
All our systems are now at least Debian 9
Peter Palfrader [Wed, 25 Sep 2019 09:18:11 +0000 (11:18 +0200)]
sd and fd look up hostnames, so start them only after the network is online -a
Peter Palfrader [Wed, 25 Sep 2019 09:13:14 +0000 (11:13 +0200)]
Use a variable that still exists to define the listen hostname
Peter Palfrader [Wed, 25 Sep 2019 09:08:22 +0000 (11:08 +0200)]
fd: also use the grep in public_addresses to learn if we support v4/v6
Peter Palfrader [Wed, 25 Sep 2019 09:00:15 +0000 (11:00 +0200)]
Pass pool-name token to volumes-delete-old
Peter Palfrader [Wed, 25 Sep 2019 06:59:48 +0000 (08:59 +0200)]
Try to collect directors before we restart fd
Peter Palfrader [Wed, 25 Sep 2019 06:56:00 +0000 (08:56 +0200)]
Only restart once we have at least one file in the .d dir
Peter Palfrader [Wed, 25 Sep 2019 06:52:59 +0000 (08:52 +0200)]
another notify
Peter Palfrader [Wed, 25 Sep 2019 06:52:12 +0000 (08:52 +0200)]
Unnecessary requires
Peter Palfrader [Wed, 25 Sep 2019 06:50:45 +0000 (08:50 +0200)]
And correct location and template for dir snippet on fd
Peter Palfrader [Wed, 25 Sep 2019 06:49:33 +0000 (08:49 +0200)]
Correct notify for dir snippet on fd
Peter Palfrader [Wed, 25 Sep 2019 06:48:42 +0000 (08:48 +0200)]
Correct empty.conf location for fd
Peter Palfrader [Wed, 25 Sep 2019 06:47:59 +0000 (08:47 +0200)]
New default dir name
Peter Palfrader [Wed, 25 Sep 2019 06:46:35 +0000 (08:46 +0200)]
Create an empty file in the FD's conf.d dir
Peter Palfrader [Wed, 25 Sep 2019 06:46:07 +0000 (08:46 +0200)]
I do not think empty directories need a source => (these days)
Peter Palfrader [Wed, 25 Sep 2019 06:40:28 +0000 (08:40 +0200)]
Get director name from director
Peter Palfrader [Tue, 24 Sep 2019 22:40:26 +0000 (00:40 +0200)]
move director db pw to a more local thing
Peter Palfrader [Tue, 24 Sep 2019 22:35:48 +0000 (00:35 +0200)]
Get the ssl variables from bacula:: as we have not inherited them
Peter Palfrader [Tue, 24 Sep 2019 22:32:23 +0000 (00:32 +0200)]
continue with moving director address to a more local thing
Peter Palfrader [Tue, 24 Sep 2019 22:08:25 +0000 (00:08 +0200)]
continue with moving director name/address to a more local thing
Peter Palfrader [Tue, 24 Sep 2019 22:02:28 +0000 (00:02 +0200)]
retire unused var
Peter Palfrader [Tue, 24 Sep 2019 22:00:29 +0000 (00:00 +0200)]
Move ipv[46] check into the manifest
Peter Palfrader [Tue, 24 Sep 2019 21:53:42 +0000 (23:53 +0200)]
Make a few Strings be Stdlib::Host
Peter Palfrader [Tue, 24 Sep 2019 21:36:14 +0000 (23:36 +0200)]
Remove bacula-monitor. This seems unused for now, but we can always bring it back if we think it necessary
Peter Palfrader [Tue, 24 Sep 2019 21:31:05 +0000 (23:31 +0200)]
start with moving director name to a more local thing
Peter Palfrader [Tue, 24 Sep 2019 21:27:23 +0000 (23:27 +0200)]
And storage name is sd local
Peter Palfrader [Tue, 24 Sep 2019 21:20:59 +0000 (23:20 +0200)]
And pass the right variable
Peter Palfrader [Tue, 24 Sep 2019 21:19:15 +0000 (23:19 +0200)]
and use new variable in template
Peter Palfrader [Tue, 24 Sep 2019 21:15:01 +0000 (23:15 +0200)]
Create client name and secret in the fd and ship
Peter Palfrader [Tue, 24 Sep 2019 21:04:55 +0000 (23:04 +0200)]
and use fqdn in hkdf
Peter Palfrader [Tue, 24 Sep 2019 21:04:27 +0000 (23:04 +0200)]
Make director_secret for bconsole something local to the director class
Peter Palfrader [Tue, 24 Sep 2019 21:00:28 +0000 (23:00 +0200)]
Make bacula_director_port something local to the director class
Peter Palfrader [Tue, 24 Sep 2019 20:42:09 +0000 (22:42 +0200)]
explicitly pass client name around