Julien Cristau [Mon, 23 Sep 2019 18:57:56 +0000 (20:57 +0200)]
stop procps messing with our protected_hardlinks setting on debian-cd hosts
Peter Palfrader [Mon, 23 Sep 2019 17:00:28 +0000 (19:00 +0200)]
storage.pp: fix spacing
Peter Palfrader [Mon, 23 Sep 2019 16:58:22 +0000 (18:58 +0200)]
Drop explicit 5.153.231.125 and 5.153.231.126 from the bacula-sd firewall allow. If we still need them we should learn that this way
Peter Palfrader [Mon, 23 Sep 2019 16:56:43 +0000 (18:56 +0200)]
merge ipv4 and ipv6 rules to bacula-sd
Peter Palfrader [Mon, 23 Sep 2019 15:43:49 +0000 (17:43 +0200)]
rename jerea (bm) volumes to OLD-
Peter Palfrader [Mon, 23 Sep 2019 15:40:39 +0000 (17:40 +0200)]
there no longer is a system-service called jenkins; update sudoers
Peter Palfrader [Mon, 23 Sep 2019 15:38:39 +0000 (17:38 +0200)]
give the jenkins roles home directories
Peter Palfrader [Mon, 23 Sep 2019 15:36:12 +0000 (17:36 +0200)]
install jenkins metapackage
Peter Palfrader [Mon, 23 Sep 2019 15:23:52 +0000 (17:23 +0200)]
the jenins apache config needs rewrite
Peter Palfrader [Mon, 23 Sep 2019 15:22:34 +0000 (17:22 +0200)]
the jenins apache config needs authn_file
Peter Palfrader [Mon, 23 Sep 2019 15:19:09 +0000 (17:19 +0200)]
the jenins apache config needs auth_digest
Peter Palfrader [Mon, 23 Sep 2019 14:52:45 +0000 (16:52 +0200)]
Add jerea multipath devices
Julien Cristau [Mon, 23 Sep 2019 12:31:39 +0000 (14:31 +0200)]
delete /etc/logrotate.d/puppetdb
puppetdb seems to handle log rotation itself so let's not have two
conflicting mechanisms to do the same thing.
Julien Cristau [Mon, 23 Sep 2019 11:53:52 +0000 (13:53 +0200)]
Update bacula db location in bacula-dir config
Julien Cristau [Mon, 23 Sep 2019 11:50:37 +0000 (13:50 +0200)]
bacula cluster moved to postgresql-manda-01
Aurelien Jarno [Mon, 23 Sep 2019 11:06:51 +0000 (13:06 +0200)]
add tracker db @ danzi to backuppg
Peter Palfrader [Mon, 23 Sep 2019 07:24:21 +0000 (09:24 +0200)]
First attempt at a reboot script for the ubc arm cluster
Peter Palfrader [Mon, 23 Sep 2019 06:03:27 +0000 (08:03 +0200)]
No longer configure apache just because it is installed. Instead, fail if it is installed but not pulled in by puppet
Peter Palfrader [Mon, 23 Sep 2019 06:00:23 +0000 (08:00 +0200)]
lw08 runs the derivatives consensus
Aurelien Jarno [Sun, 22 Sep 2019 22:00:05 +0000 (00:00 +0200)]
Ditto for mirror-skroutz.debian.org
Aurelien Jarno [Sun, 22 Sep 2019 21:56:48 +0000 (23:56 +0200)]
Drop roles::debian_mirror::listen_addr for mirror-accumu
That way the ftp.debian.org vhost will listen on: < VirtualHost *:80 >
and will not hide other vhosts.
Peter Palfrader [Sun, 22 Sep 2019 21:36:37 +0000 (23:36 +0200)]
puppetmaster has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:36:22 +0000 (23:36 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 21:35:11 +0000 (23:35 +0200)]
ftpmaster has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:34:36 +0000 (23:34 +0200)]
muninmaster has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:33:59 +0000 (23:33 +0200)]
security_master has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:32:55 +0000 (23:32 +0200)]
static_mirror_web includes apache
Aurelien Jarno [Sun, 22 Sep 2019 21:20:02 +0000 (23:20 +0200)]
update hardcoded ferm IPs
Peter Palfrader [Sun, 22 Sep 2019 21:19:53 +0000 (23:19 +0200)]
remove old mirror-health files in roles
Peter Palfrader [Sun, 22 Sep 2019 21:16:36 +0000 (23:16 +0200)]
security_mirror -> hiera role; part 2; also make security apache bind to the security specific addresses
Peter Palfrader [Sun, 22 Sep 2019 20:58:38 +0000 (22:58 +0200)]
security_mirror -> hiera role; part 1
Aurelien Jarno [Sun, 22 Sep 2019 19:40:40 +0000 (21:40 +0200)]
prefix donizetti volumes with OLD-
Peter Palfrader [Sun, 22 Sep 2019 19:29:30 +0000 (21:29 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 19:23:12 +0000 (21:23 +0200)]
on farmsync target collect ssh keys with the right tag
Peter Palfrader [Sun, 22 Sep 2019 19:19:25 +0000 (21:19 +0200)]
avoid duplicate ssh keygen for snapshot
Peter Palfrader [Sun, 22 Sep 2019 19:18:12 +0000 (21:18 +0200)]
avoid duplicate ssh keygen for snapshot
Peter Palfrader [Sun, 22 Sep 2019 19:12:20 +0000 (21:12 +0200)]
Set up ssh between snapshot nodes
Peter Palfrader [Sun, 22 Sep 2019 19:11:00 +0000 (21:11 +0200)]
make lint happy
Peter Palfrader [Sun, 22 Sep 2019 19:00:53 +0000 (21:00 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 18:59:57 +0000 (20:59 +0200)]
Put lw01,lw02,lw03,lw04,lw09,lw10 into a snapshot_base class and include that also from _web and _shell
Aurelien Jarno [Sun, 22 Sep 2019 19:05:55 +0000 (21:05 +0200)]
danzi: merge dsa-postgres2-danzi and dsa-postgres2-danzi6
Use a single rule for both. Also rename the rule and improve the
description to make it clear that it concerns the debconf cluster. Only
allow access from debussy instead of the whole subnet.
Aurelien Jarno [Sun, 22 Sep 2019 18:59:47 +0000 (20:59 +0200)]
danzi: merge dsa-postgres-danzi and dsa-postgres-danzi6
Use a single rule for both. Also rename the rule and improve the
description to make it clear that it concerns the main cluster. Drop the
old IP addresses of wuiet and the old UBC subnet. Ideally we should have
a least of host there, but that's already an improvement.
Aurelien Jarno [Sun, 22 Sep 2019 18:48:01 +0000 (20:48 +0200)]
Allow access to the tracker db @ danzi from ticharich
Aurelien Jarno [Sun, 22 Sep 2019 16:56:09 +0000 (18:56 +0200)]
donizetti is now at ubc
Peter Palfrader [Sun, 22 Sep 2019 18:53:33 +0000 (20:53 +0200)]
No longer allow nagios to recurse on our binds
Peter Palfrader [Sun, 22 Sep 2019 17:39:20 +0000 (19:39 +0200)]
nagiosmaster -> hiera role; bind acls still not converted
Peter Palfrader [Sun, 22 Sep 2019 17:32:28 +0000 (19:32 +0200)]
merge SSH_SOURCES and SSH_V6_SOURCES
Peter Palfrader [Sun, 22 Sep 2019 17:23:11 +0000 (19:23 +0200)]
Our (DSA) home networks do not need to access rabbitmq services
Peter Palfrader [Sun, 22 Sep 2019 16:48:40 +0000 (18:48 +0200)]
Move archvsync ferm sshs from the input chain to the new ssh chain
Peter Palfrader [Sun, 22 Sep 2019 16:47:44 +0000 (18:47 +0200)]
Allow nagios to ssh to our hosts
Peter Palfrader [Sun, 22 Sep 2019 16:41:12 +0000 (18:41 +0200)]
avoid top-scope variable being used without an explicit namespace
Peter Palfrader [Sun, 22 Sep 2019 16:40:23 +0000 (18:40 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 16:39:56 +0000 (18:39 +0200)]
Make an explicit iptables ssh chain
Aurelien Jarno [Sun, 22 Sep 2019 16:35:09 +0000 (18:35 +0200)]
add donizetti volumes at ubc
Aurelien Jarno [Sun, 22 Sep 2019 16:19:27 +0000 (18:19 +0200)]
prefix ticharich volumes with OLD-
Peter Palfrader [Sun, 22 Sep 2019 16:13:38 +0000 (18:13 +0200)]
Remove empty ferm::zivit
Peter Palfrader [Sun, 22 Sep 2019 16:12:52 +0000 (18:12 +0200)]
iptables -vnL on zelenka suggests that zivit no longer does rrdcollect and zabbix against our machine
Peter Palfrader [Sun, 22 Sep 2019 16:11:45 +0000 (18:11 +0200)]
Apparently we no longer monitor the time service on zivit hosts
Peter Palfrader [Sun, 22 Sep 2019 15:22:19 +0000 (17:22 +0200)]
fix param name
Peter Palfrader [Sun, 22 Sep 2019 15:21:29 +0000 (17:21 +0200)]
bgp -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 15:14:50 +0000 (17:14 +0200)]
Merge branch 'debianmirrorrole'
* debianmirrorrole:
Do not ship sbin/mirror-health from the roles version while we migrate
debian_mirror -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 15:13:31 +0000 (17:13 +0200)]
Do not ship sbin/mirror-health from the roles version while we migrate
Peter Palfrader [Sun, 22 Sep 2019 15:07:38 +0000 (17:07 +0200)]
debian_mirror -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 14:59:25 +0000 (16:59 +0200)]
Move allow-all smtp from the mta class to the exim and the lists class
We have some hosts that get their @host mail from the smarthost,
but that still accept mail from the internet.
Julien Cristau [Sun, 22 Sep 2019 14:23:09 +0000 (16:23 +0200)]
ticharich at ubc
Peter Palfrader [Sun, 22 Sep 2019 13:58:19 +0000 (15:58 +0200)]
retire obsolete muninmaster entry from common.yaml
Peter Palfrader [Sun, 22 Sep 2019 13:56:45 +0000 (15:56 +0200)]
mirror_health: this_host_service_name is now optional
Peter Palfrader [Sun, 22 Sep 2019 13:35:04 +0000 (15:35 +0200)]
munin/master_per_node: no longer needs to be backwards compatible
Peter Palfrader [Sun, 22 Sep 2019 13:26:33 +0000 (15:26 +0200)]
munin/master_per_node: try to be backwards compatible
Peter Palfrader [Sun, 22 Sep 2019 13:23:54 +0000 (15:23 +0200)]
muninmaster -> hiera role, new ssh store/collect, no more plain text munin fetching firewall rules (it is all async via ssh these days)
Peter Palfrader [Sun, 22 Sep 2019 13:21:59 +0000 (15:21 +0200)]
All our munin is munin-async these days
Peter Palfrader [Sun, 22 Sep 2019 13:11:13 +0000 (15:11 +0200)]
munin class cleanup
Peter Palfrader [Sun, 22 Sep 2019 13:01:28 +0000 (15:01 +0200)]
All our munin is munin-async these days
Julien Cristau [Sun, 22 Sep 2019 13:21:27 +0000 (15:21 +0200)]
mirror_health: add param description
Julien Cristau [Sun, 22 Sep 2019 12:55:00 +0000 (14:55 +0200)]
add ticharich volumes at ubc
Peter Palfrader [Sun, 22 Sep 2019 12:49:29 +0000 (14:49 +0200)]
Use variable correctly
Peter Palfrader [Sun, 22 Sep 2019 12:48:08 +0000 (14:48 +0200)]
Move debug healthcheck info to hiera
Peter Palfrader [Sun, 22 Sep 2019 12:42:17 +0000 (14:42 +0200)]
Move debug to store/collect health checker
Aurelien Jarno [Sun, 22 Sep 2019 11:42:47 +0000 (13:42 +0200)]
Fix previous commit
Aurelien Jarno [Sun, 22 Sep 2019 11:41:48 +0000 (13:41 +0200)]
The klecker-ftp.d.o address has been moved to new-klecker
Therefore:
- move the corresponding listen addresses to new-klecker
- drop the debian_mirror role from klecker
Julien Cristau [Sun, 22 Sep 2019 11:35:07 +0000 (13:35 +0200)]
As debian.mirrors.d.o gets checked by the health checker, explicitly listen on localhost
Peter Palfrader [Sun, 22 Sep 2019 11:28:14 +0000 (13:28 +0200)]
As debug.mirrors.d.o gets checked by the health checker, explicitly listen on localhost
Peter Palfrader [Sun, 22 Sep 2019 11:19:47 +0000 (13:19 +0200)]
debug_mirror -> hiera role, first step
Peter Palfrader [Sun, 22 Sep 2019 11:15:26 +0000 (13:15 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 11:07:52 +0000 (13:07 +0200)]
remove historical_mirror has_role call for inclusion; no longer needed
Peter Palfrader [Sun, 22 Sep 2019 11:04:43 +0000 (13:04 +0200)]
historical_mirror -> hiera role
Since there are no onion mirrors right now, remove that code from the
role.
Peter Palfrader [Sun, 22 Sep 2019 10:51:28 +0000 (12:51 +0200)]
historical_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:47:52 +0000 (12:47 +0200)]
ports_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:46:24 +0000 (12:46 +0200)]
ftp_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:45:13 +0000 (12:45 +0200)]
include signing from the ftp_master role
Peter Palfrader [Sun, 22 Sep 2019 10:44:48 +0000 (12:44 +0200)]
whitespace/quoting: modules/roles/manifests/signing (make lint happy)
Peter Palfrader [Sun, 22 Sep 2019 10:44:21 +0000 (12:44 +0200)]
make ftp-master include dakmaster directly
Peter Palfrader [Sun, 22 Sep 2019 10:43:40 +0000 (12:43 +0200)]
whitespace/quoting: modules/roles/manifests/dakmaster (make lint happy)
Peter Palfrader [Sun, 22 Sep 2019 10:42:11 +0000 (12:42 +0200)]
security_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:33:38 +0000 (12:33 +0200)]
retire old HOST_MAILRELAY ferm variable
Peter Palfrader [Sun, 22 Sep 2019 10:32:09 +0000 (12:32 +0200)]
retire mail_port config from local.yaml
Peter Palfrader [Sun, 22 Sep 2019 10:28:42 +0000 (12:28 +0200)]
Merge virtualdomains setup into exim/init
Peter Palfrader [Sun, 22 Sep 2019 10:26:01 +0000 (12:26 +0200)]
move the remaining virtualdomains to the mailrelay class
Peter Palfrader [Sun, 22 Sep 2019 10:22:36 +0000 (12:22 +0200)]
remove manualroute cleanup; it has run everywhere
Peter Palfrader [Sun, 22 Sep 2019 10:15:00 +0000 (12:15 +0200)]
And fix name in manualroute.pp