mirror/dsa-puppet.git
5 years agoAdd puppet classes to store and collect ssh authkeys information
Peter Palfrader [Sat, 7 Sep 2019 15:05:24 +0000 (17:05 +0200)]
Add puppet classes to store and collect ssh authkeys information

5 years agoDefine public IP addresses in base since we cannot trust facter
Peter Palfrader [Sat, 7 Sep 2019 15:08:24 +0000 (17:08 +0200)]
Define public IP addresses in base since we cannot trust facter

5 years agofacter for git key
Peter Palfrader [Sat, 7 Sep 2019 14:19:33 +0000 (16:19 +0200)]
facter for git key

5 years agoremove adayevskaya volume from bm multipath config
Peter Palfrader [Sat, 7 Sep 2019 11:55:19 +0000 (13:55 +0200)]
remove adayevskaya volume from bm multipath config

5 years agoMove adayevskaya from bm to manda
Peter Palfrader [Sat, 7 Sep 2019 11:35:44 +0000 (13:35 +0200)]
Move adayevskaya from bm to manda

5 years agoOnly install intel microcode on amd64
Julien Cristau [Sat, 7 Sep 2019 07:59:17 +0000 (09:59 +0200)]
Only install intel microcode on amd64

Some other-arch hosts don't seem to have a "processor0" fact, so bypass
that.

5 years agoAlso install intel-microcode
Julien Cristau [Fri, 6 Sep 2019 16:58:25 +0000 (18:58 +0200)]
Also install intel-microcode

5 years agoInstall iucode-tool on physical machines with Intel CPUs
Julien Cristau [Fri, 6 Sep 2019 16:52:54 +0000 (18:52 +0200)]
Install iucode-tool on physical machines with Intel CPUs

5 years agoUse mail port 2025 for new-klecker
Julien Cristau [Fri, 6 Sep 2019 13:38:03 +0000 (15:38 +0200)]
Use mail port 2025 for new-klecker

5 years agosudo: add new-klecker to dell hosts list
Julien Cristau [Fri, 6 Sep 2019 13:35:34 +0000 (15:35 +0200)]
sudo: add new-klecker to dell hosts list

5 years agoSet up serial console on new-klecker
Julien Cristau [Fri, 6 Sep 2019 13:21:32 +0000 (15:21 +0200)]
Set up serial console on new-klecker

5 years agoInstall libxslt1.1 on dell hosts
Julien Cristau [Fri, 6 Sep 2019 13:03:43 +0000 (15:03 +0200)]
Install libxslt1.1 on dell hosts

omreport: error while loading shared libraries: libxslt.so.1: cannot open shared object file: No such file or directory

5 years agonagios-plugins-standard was renamed to monitoring-plugins-standard in 2014
Julien Cristau [Thu, 5 Sep 2019 12:47:41 +0000 (14:47 +0200)]
nagios-plugins-standard was renamed to monitoring-plugins-standard in 2014

And in buster the transitional package is gone.

5 years agoKeep postgresql-client-9.6 on storace
Julien Cristau [Thu, 5 Sep 2019 08:28:35 +0000 (10:28 +0200)]
Keep postgresql-client-9.6 on storace

5 years agoFix postgres-make-one-base-backup for pg 11
Julien Cristau [Wed, 4 Sep 2019 14:39:38 +0000 (16:39 +0200)]
Fix postgres-make-one-base-backup for pg 11

The default was changed to -X stream, which doesn't work when sending to
stdout.  There's no way to disable WAL that works with both 9.6 and 11,
so instead backup redundant WAL files with -X fetch.

5 years agoKeep postgresql-client-9.6 on backuphost
Julien Cristau [Wed, 4 Sep 2019 13:59:37 +0000 (15:59 +0200)]
Keep postgresql-client-9.6 on backuphost

5 years agobuxtehude is on postgresql 11
Julien Cristau [Wed, 4 Sep 2019 13:47:34 +0000 (15:47 +0200)]
buxtehude is on postgresql 11

5 years agoconsolidate and expand ensure_packages on backup server
Peter Palfrader [Wed, 4 Sep 2019 12:49:15 +0000 (14:49 +0200)]
consolidate and expand ensure_packages on backup server

5 years agowhitespace change only -- replace tabs with 2 spaces
Peter Palfrader [Wed, 4 Sep 2019 12:48:36 +0000 (14:48 +0200)]
whitespace change only -- replace tabs with 2 spaces

5 years agoMove backup_server:: globals, register_backup_cluster, register_backup_clienthost...
Peter Palfrader [Wed, 4 Sep 2019 12:46:32 +0000 (14:46 +0200)]
Move backup_server:: globals, register_backup_cluster, register_backup_clienthost into their own files

5 years agoInstall ncurses-term everywhere for terminal infos like rxvt-unicode-256color which...
Peter Palfrader [Wed, 4 Sep 2019 10:13:51 +0000 (12:13 +0200)]
Install ncurses-term everywhere for terminal infos like rxvt-unicode-256color which is in -term on stretch (it is in -base on buster)

5 years agoAdd syncproxy name for smit
Julien Cristau [Tue, 3 Sep 2019 20:44:37 +0000 (22:44 +0200)]
Add syncproxy name for smit

5 years agoadd spam filters for community alias RT#7924
Héctor Orón Martínez [Tue, 3 Sep 2019 10:40:07 +0000 (12:40 +0200)]
add spam filters for community alias RT#7924

Signed-off-by: Héctor Orón Martínez <zumbi@debian.org>
5 years agosmit as syncproxy
Julien Cristau [Sat, 31 Aug 2019 11:29:45 +0000 (13:29 +0200)]
smit as syncproxy

5 years agoDelete stray .orig file
Julien Cristau [Sat, 31 Aug 2019 11:29:27 +0000 (13:29 +0200)]
Delete stray .orig file

5 years agoNow that we have site included before hiera things, we can do this again
Peter Palfrader [Fri, 30 Aug 2019 10:20:18 +0000 (12:20 +0200)]
Now that we have site included before hiera things, we can do this again

5 years agohaving a module named site is really annoying
Peter Palfrader [Fri, 30 Aug 2019 10:15:44 +0000 (12:15 +0200)]
having a module named site is really annoying

5 years agoMove the single ipsec tunnel we have to my new system.
Peter Palfrader [Fri, 30 Aug 2019 10:10:15 +0000 (12:10 +0200)]
Move the single ipsec tunnel we have to my new system.

There are named ipsec "networks".  And any host that is in a named
network will set up ipsec to all the other hosts on that network.

A host can be on more than one network at a time.

Currently we only have the fasolo-storace tunnel, though.  It is
configured in modules/profile/manifests/ipsec/fasolo_storace.pp.

5 years agoremove olin from bmdb1 access
Peter Palfrader [Fri, 30 Aug 2019 06:58:35 +0000 (08:58 +0200)]
remove olin from bmdb1 access

olin does not need access to a postgres cluster.  It was in the list
since its old IP address was in the list.  That IP address was
previously used by oyens.debian.org, which was the openstack keystone
host before it was retired.  It seems the IP address was not removed
from the access list, and then olin inherited it.

5 years agomultipath: remove olin (moved to csail)
Aurelien Jarno [Thu, 29 Aug 2019 21:47:10 +0000 (23:47 +0200)]
multipath: remove olin (moved to csail)

5 years agomove loghost from a "role" in hieradata/common.yaml to a role that is included via...
Peter Palfrader [Thu, 29 Aug 2019 18:32:36 +0000 (20:32 +0200)]
move loghost from a "role" in hieradata/common.yaml to a role that is included via hiera

5 years agodsa_lvm is empty. remove it
Peter Palfrader [Thu, 29 Aug 2019 18:22:57 +0000 (20:22 +0200)]
dsa_lvm is empty.  remove it

5 years agoThe previos LVM config for the ppc cluster did not have issue_discards. Let's keep...
Peter Palfrader [Thu, 29 Aug 2019 18:22:19 +0000 (20:22 +0200)]
The previos LVM config for the ppc cluster did not have issue_discards.  Let's keep it that way.

5 years agospell OSUOSL better
Peter Palfrader [Thu, 29 Aug 2019 18:20:51 +0000 (20:20 +0200)]
spell OSUOSL better

5 years agotransition osuosl ppc cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:18:55 +0000 (20:18 +0200)]
transition osuosl ppc cluster to new lvm config

5 years agothe arm ganeti cluster also wants issue_discards in its lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:12:46 +0000 (20:12 +0200)]
the arm ganeti cluster also wants issue_discards in its lvm config

5 years agotransition ubc arm cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:08:45 +0000 (20:08 +0200)]
transition ubc arm cluster to new lvm config

Similar to the cluster at conova, this effectively replaces filter
with global_filter, and re-enables monitoring.  Also, explicitly set
preferred_names to the empty list.

5 years agofix filter setting for conova lvm
Peter Palfrader [Thu, 29 Aug 2019 17:47:58 +0000 (19:47 +0200)]
fix filter setting for conova lvm

5 years agotransition conova cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:43:51 +0000 (19:43 +0200)]
transition conova cluster to new lvm config

This re-enables use_lvmetad and monitoring which were disabled two years
ago.  We will find out if this breaks anything.  Maybe with the use
of global_filter instead of just filter it'll be fine.

5 years agoalso remove obsolete lvm-grnet-nodeX-ganeti.conf file
Peter Palfrader [Thu, 29 Aug 2019 17:39:35 +0000 (19:39 +0200)]
also remove obsolete lvm-grnet-nodeX-ganeti.conf file

5 years agotransition prokofiev to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:35:18 +0000 (19:35 +0200)]
transition prokofiev to new lvm config

5 years agotransition grnet cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:20:51 +0000 (19:20 +0200)]
transition grnet cluster to new lvm config

5 years agotransition csail cluster to new lvm config, 2
Peter Palfrader [Thu, 29 Aug 2019 17:12:38 +0000 (19:12 +0200)]
transition csail cluster to new lvm config, 2

5 years agotransition csail cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:11:21 +0000 (19:11 +0200)]
transition csail cluster to new lvm config

5 years agotransition bm cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 16:47:41 +0000 (18:47 +0200)]
transition bm cluster to new lvm config

5 years agotransition manda cluster to new lvm config, 4
Peter Palfrader [Thu, 29 Aug 2019 16:26:39 +0000 (18:26 +0200)]
transition manda cluster to new lvm config, 4

5 years agotransition manda cluster to new lvm config, 3
Peter Palfrader [Thu, 29 Aug 2019 16:25:31 +0000 (18:25 +0200)]
transition manda cluster to new lvm config, 3

5 years agotransition manda cluster to new lvm config, 2
Peter Palfrader [Thu, 29 Aug 2019 16:25:09 +0000 (18:25 +0200)]
transition manda cluster to new lvm config, 2

5 years agotransition manda cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 16:24:15 +0000 (18:24 +0200)]
transition manda cluster to new lvm config

5 years agomove ubc-enc2bl02, ubc-enc2bl09 and ubc-enc2bl10 to the new LVM config module
Peter Palfrader [Thu, 29 Aug 2019 16:11:37 +0000 (18:11 +0200)]
move ubc-enc2bl02, ubc-enc2bl09 and ubc-enc2bl10 to the new LVM config module

5 years agodefine the update-initramfs exec
Peter Palfrader [Thu, 29 Aug 2019 15:58:14 +0000 (17:58 +0200)]
define the update-initramfs exec

5 years agomove the ubc-enc2bl01 LVM config to a profile included via hiera using the new LVM...
Peter Palfrader [Thu, 29 Aug 2019 15:56:31 +0000 (17:56 +0200)]
move the ubc-enc2bl01 LVM config to a profile included via hiera using the new LVM module

5 years agoAn lvm module that can set issue_discards and global_filter
Peter Palfrader [Thu, 29 Aug 2019 15:08:40 +0000 (17:08 +0200)]
An lvm module that can set issue_discards and global_filter

5 years agoAdd a pristine stretch and buster lvm.conf as a template for some lvm reconciliation...
Peter Palfrader [Thu, 29 Aug 2019 15:07:08 +0000 (17:07 +0200)]
Add a pristine stretch and buster lvm.conf as a template for some lvm reconciliation work

5 years agoThe syntax check won't let me include our site module, probably due to its name....
Peter Palfrader [Thu, 29 Aug 2019 15:50:09 +0000 (17:50 +0200)]
The syntax check won't let me include our site module, probably due to its name.  Try via hiera, but merge it into base eventually

5 years agoThe syntax check won't let me include our site module, probably due to its name
Peter Palfrader [Thu, 29 Aug 2019 15:49:40 +0000 (17:49 +0200)]
The syntax check won't let me include our site module, probably due to its name

5 years agoactually add the base module
Peter Palfrader [Thu, 29 Aug 2019 15:40:49 +0000 (17:40 +0200)]
actually add the base module

5 years agomove all the unconditional includes from the top-level site.pp into a base module...
Peter Palfrader [Thu, 29 Aug 2019 15:39:34 +0000 (17:39 +0200)]
move all the unconditional includes from the top-level site.pp into a base module which gets included by the default hiera entry

5 years agoInclude hiera classes
Peter Palfrader [Thu, 29 Aug 2019 15:35:10 +0000 (17:35 +0200)]
Include hiera classes

We want to be able to specify which puppet classes a node should include
using hiera.  Start by including hiera classes in the site manifest,
and move the site class so we include something using this mechanism.

Eventually we want to move all the include entries out of manifests/site.pp.

5 years agoupdate anonscm.map from formorer
Peter Palfrader [Wed, 28 Aug 2019 11:20:55 +0000 (13:20 +0200)]
update anonscm.map from formorer

5 years agoFix another typo
Aurelien Jarno [Wed, 28 Aug 2019 10:17:21 +0000 (12:17 +0200)]
Fix another typo

5 years agoFix typo in merged_usr fact
Aurelien Jarno [Wed, 28 Aug 2019 10:09:56 +0000 (12:09 +0200)]
Fix typo in merged_usr fact

5 years agosamhainrc: support merged usr layout
Aurelien Jarno [Wed, 28 Aug 2019 10:07:00 +0000 (12:07 +0200)]
samhainrc: support merged usr layout

5 years agoAdd a merged_usr fact
Aurelien Jarno [Wed, 28 Aug 2019 10:07:00 +0000 (12:07 +0200)]
Add a merged_usr fact

5 years agoFix CSAIL IPv6 subnet
Aurelien Jarno [Wed, 28 Aug 2019 08:46:44 +0000 (10:46 +0200)]
Fix CSAIL IPv6 subnet

5 years agoRemove debconf18 vhost from debussy
Julien Cristau [Wed, 28 Aug 2019 08:29:26 +0000 (10:29 +0200)]
Remove debconf18 vhost from debussy

It moved to static.

5 years agoferm: drop FREEBSD_SSH_ACCESS
Aurelien Jarno [Wed, 28 Aug 2019 08:04:45 +0000 (10:04 +0200)]
ferm: drop FREEBSD_SSH_ACCESS

5 years agoferm: add syncproxy.na.debian.org IPv6
Aurelien Jarno [Wed, 28 Aug 2019 08:03:33 +0000 (10:03 +0200)]
ferm: add syncproxy.na.debian.org IPv6

5 years agoAdd CSAIL IPv6 range
Aurelien Jarno [Wed, 28 Aug 2019 07:54:39 +0000 (09:54 +0200)]
Add CSAIL IPv6 range

5 years agoBump the language cookie expiry for visits during the expiry period
Paul Wise [Sun, 25 Aug 2019 03:48:59 +0000 (11:48 +0800)]
Bump the language cookie expiry for visits during the expiry period

This ensures that if the user continues to visit the website then
they don't have to manually set the cookie again until they
stop visiting the website for more than the expiry period.

5 years agoEnable linger for sreview user (RT#7917)
Julien Cristau [Thu, 22 Aug 2019 09:38:42 +0000 (11:38 +0200)]
Enable linger for sreview user (RT#7917)

5 years agofix ssl client path
Peter Palfrader [Thu, 22 Aug 2019 08:58:52 +0000 (10:58 +0200)]
fix ssl client path

5 years agostop hardcoding loghost names in syslog-ng template
Peter Palfrader [Thu, 22 Aug 2019 08:55:49 +0000 (10:55 +0200)]
stop hardcoding loghost names in syslog-ng template

5 years agomove syslog ferm into syslog role
Peter Palfrader [Thu, 22 Aug 2019 08:47:51 +0000 (10:47 +0200)]
move syslog ferm into syslog role

5 years agomake loghost into a role
Peter Palfrader [Thu, 22 Aug 2019 08:44:27 +0000 (10:44 +0200)]
make loghost into a role

5 years agoNo more sid/bullseye chroots for mips
Julien Cristau [Tue, 20 Aug 2019 14:16:17 +0000 (16:16 +0200)]
No more sid/bullseye chroots for mips

5 years agoRT#7893 Let wanna-build admins sudo to wbadm-web
Philipp Kern [Sun, 18 Aug 2019 09:10:55 +0000 (11:10 +0200)]
RT#7893 Let wanna-build admins sudo to wbadm-web

5 years agoRT#7862 Let the community team sudo to the community user
Tollef Fog Heen [Thu, 15 Aug 2019 19:14:58 +0000 (21:14 +0200)]
RT#7862 Let the community team sudo to the community user

5 years agoHandle ipv6 addresses in named.conf.options
Julien Cristau [Tue, 13 Aug 2019 14:53:47 +0000 (16:53 +0200)]
Handle ipv6 addresses in named.conf.options

5 years agoAdd mipsel-osuosl-02.debian.org
Aurelien Jarno [Tue, 13 Aug 2019 10:26:12 +0000 (12:26 +0200)]
Add mipsel-osuosl-02.debian.org

5 years agoRedirect unsetlang to the correct location
Paul Wise [Sun, 11 Aug 2019 09:31:09 +0000 (17:31 +0800)]
Redirect unsetlang to the correct location

The substitution was using the wrong match group.

Fixes: commit eef0d1229a8d2627ffc8663eda9bd2d68a0ef09c

5 years agoSet the cookie domain based on the HTTP domain.
Paul Wise [Sun, 11 Aug 2019 04:18:21 +0000 (12:18 +0800)]
Set the cookie domain based on the HTTP domain.

Avoids issues with setting cookies on www-staging.d.o or other mirrors.

Fixes: commit eef0d1229a8d2627ffc8663eda9bd2d68a0ef09c

5 years agoAdd basic support for influencing language selection via cookies.
Paul Wise [Sat, 3 Aug 2019 02:23:04 +0000 (10:23 +0800)]
Add basic support for influencing language selection via cookies.

The UI for language selection in browsers is rarely used or known about
by visitors so websites need to provide a way for visitors to influence
content negotiation using the website itself in addition to the browser.

Setting a cookie is the simplest option for us as the URLs don't change.

The GDPR does not apply and to satisfy the EU cookie law we can include
some explanatory text around the form that sets the cookie.

Visitors should not get their language cookie changed when other folks link
them to URLs for other languages and search engines should not set language
cookies at all. Using POST requests ensures each cookie is only set explictly.

Since Apache mod_rewrite cannot inspect POST data, we use URLs instead.

The default cookie lifetime is about one month (60*24*7*4 minutes).

<CAKTje6EzfE89jBqpLQu1_a3ybYkV7pPcquKzQb6Uz8uu=pGudA@mail.gmail.com>
<f849fde79a325422af9a9553f6672a96382ae262.camel@debian.org>
https://httpd.apache.org/docs/current/content-negotiation.html#exceptions

5 years agoAdd mipsel-osuosl-01.debian.org
Aurelien Jarno [Sat, 10 Aug 2019 07:45:01 +0000 (09:45 +0200)]
Add mipsel-osuosl-01.debian.org

5 years agoAdd sso_rp role on wuiet (RT#7892)
Julien Cristau [Fri, 9 Aug 2019 14:03:47 +0000 (16:03 +0200)]
Add sso_rp role on wuiet (RT#7892)

5 years agodebconf20.dc.o vhost
Stefano Rivera [Tue, 30 Jul 2019 14:50:06 +0000 (11:50 -0300)]
debconf20.dc.o vhost

5 years agoSwitch wafertest to dc20
Stefano Rivera [Tue, 30 Jul 2019 00:28:24 +0000 (21:28 -0300)]
Switch wafertest to dc20

5 years agosamhain: ignore /etc/exim4/conf.d
Aurelien Jarno [Fri, 26 Jul 2019 15:05:13 +0000 (17:05 +0200)]
samhain: ignore /etc/exim4/conf.d

This directory is removed by puppet

5 years agoEnable proxy module for wiki.debconf.org pass-thru rewrite
Paul Wise [Tue, 23 Jul 2019 23:46:37 +0000 (07:46 +0800)]
Enable proxy module for wiki.debconf.org pass-thru rewrite

Fixes: commit f33e5b0b7749df9e3bf60b7b816898f3d07ecc8b
Fixes: commit f3cf7b1e16b58065689c4ae0ded3e41d6782fb13
Requested-by: tumbleweed on #debian-admin
5 years agoEnable proxy module for wiki.debconf.org pass-thru rewrite
Paul Wise [Tue, 23 Jul 2019 23:40:11 +0000 (07:40 +0800)]
Enable proxy module for wiki.debconf.org pass-thru rewrite

Fixes: commit f33e5b0b7749df9e3bf60b7b816898f3d07ecc8b
Requested-by: tumbleweed on #debian-admin
5 years agoMerge branch 'pass-through-slash' of https://salsa.debian.org/stefanor/dsa-puppet
Tollef Fog Heen [Tue, 23 Jul 2019 20:12:25 +0000 (22:12 +0200)]
Merge branch 'pass-through-slash' of https://salsa.debian.org/stefanor/dsa-puppet

Signed-off-by: Tollef Fog Heen <tfheen@err.no>
5 years agoPassThrough / to /wiki/
Stefano Rivera [Tue, 23 Jul 2019 19:44:26 +0000 (16:44 -0300)]
PassThrough / to /wiki/

So that the response has a Content-Type header (via the ForceType on
/wiki/).

5 years agoBlock 198.108.67.48 from security mirrors for breaking rsync
Peter Palfrader [Fri, 19 Jul 2019 14:05:22 +0000 (16:05 +0200)]
Block 198.108.67.48 from security mirrors for breaking rsync

5 years agomove pg rule from veyepar to sreview
Peter Palfrader [Fri, 19 Jul 2019 11:01:39 +0000 (13:01 +0200)]
move pg rule from veyepar to sreview

5 years agoAllow DC19 access to the PG on vittoria, re: RT#7845
Peter Palfrader [Fri, 19 Jul 2019 10:06:13 +0000 (12:06 +0200)]
Allow DC19 access to the PG on vittoria, re: RT#7845

5 years agosreview is sreview.debian.net
Peter Palfrader [Fri, 19 Jul 2019 09:57:41 +0000 (11:57 +0200)]
sreview is sreview.debian.net

5 years agoMove veyepar and sreview into own manifests
Peter Palfrader [Fri, 19 Jul 2019 09:55:53 +0000 (11:55 +0200)]
Move veyepar and sreview into own manifests

5 years agowww.do: stop doing permanent redirects
Peter Palfrader [Thu, 18 Jul 2019 11:32:26 +0000 (13:32 +0200)]
www.do: stop doing permanent redirects

Permanent redirects may be cached permanently.  Don't do that.

5 years agoAdd redirects for all the /misc section, and group all the redirects related to ...
Laura Arjona Reina [Thu, 18 Jul 2019 11:10:43 +0000 (13:10 +0200)]
Add redirects for all the /misc section, and group all the redirects related to /misc

Signed-off-by: Peter Palfrader <peter@palfrader.org>
5 years agomanda: entropykey moved from czerny to manda-node04
Aurelien Jarno [Mon, 8 Jul 2019 19:28:05 +0000 (21:28 +0200)]
manda: entropykey moved from czerny to manda-node04