Peter Palfrader [Mon, 23 Sep 2019 07:24:21 +0000 (09:24 +0200)]
First attempt at a reboot script for the ubc arm cluster
Peter Palfrader [Mon, 23 Sep 2019 06:03:27 +0000 (08:03 +0200)]
No longer configure apache just because it is installed. Instead, fail if it is installed but not pulled in by puppet
Peter Palfrader [Mon, 23 Sep 2019 06:00:23 +0000 (08:00 +0200)]
lw08 runs the derivatives consensus
Aurelien Jarno [Sun, 22 Sep 2019 22:00:05 +0000 (00:00 +0200)]
Ditto for mirror-skroutz.debian.org
Aurelien Jarno [Sun, 22 Sep 2019 21:56:48 +0000 (23:56 +0200)]
Drop roles::debian_mirror::listen_addr for mirror-accumu
That way the ftp.debian.org vhost will listen on: < VirtualHost *:80 >
and will not hide other vhosts.
Peter Palfrader [Sun, 22 Sep 2019 21:36:37 +0000 (23:36 +0200)]
puppetmaster has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:36:22 +0000 (23:36 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 21:35:11 +0000 (23:35 +0200)]
ftpmaster has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:34:36 +0000 (23:34 +0200)]
muninmaster has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:33:59 +0000 (23:33 +0200)]
security_master has an apache
Peter Palfrader [Sun, 22 Sep 2019 21:32:55 +0000 (23:32 +0200)]
static_mirror_web includes apache
Aurelien Jarno [Sun, 22 Sep 2019 21:20:02 +0000 (23:20 +0200)]
update hardcoded ferm IPs
Peter Palfrader [Sun, 22 Sep 2019 21:19:53 +0000 (23:19 +0200)]
remove old mirror-health files in roles
Peter Palfrader [Sun, 22 Sep 2019 21:16:36 +0000 (23:16 +0200)]
security_mirror -> hiera role; part 2; also make security apache bind to the security specific addresses
Peter Palfrader [Sun, 22 Sep 2019 20:58:38 +0000 (22:58 +0200)]
security_mirror -> hiera role; part 1
Aurelien Jarno [Sun, 22 Sep 2019 19:40:40 +0000 (21:40 +0200)]
prefix donizetti volumes with OLD-
Peter Palfrader [Sun, 22 Sep 2019 19:29:30 +0000 (21:29 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 19:23:12 +0000 (21:23 +0200)]
on farmsync target collect ssh keys with the right tag
Peter Palfrader [Sun, 22 Sep 2019 19:19:25 +0000 (21:19 +0200)]
avoid duplicate ssh keygen for snapshot
Peter Palfrader [Sun, 22 Sep 2019 19:18:12 +0000 (21:18 +0200)]
avoid duplicate ssh keygen for snapshot
Peter Palfrader [Sun, 22 Sep 2019 19:12:20 +0000 (21:12 +0200)]
Set up ssh between snapshot nodes
Peter Palfrader [Sun, 22 Sep 2019 19:11:00 +0000 (21:11 +0200)]
make lint happy
Peter Palfrader [Sun, 22 Sep 2019 19:00:53 +0000 (21:00 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 18:59:57 +0000 (20:59 +0200)]
Put lw01,lw02,lw03,lw04,lw09,lw10 into a snapshot_base class and include that also from _web and _shell
Aurelien Jarno [Sun, 22 Sep 2019 19:05:55 +0000 (21:05 +0200)]
danzi: merge dsa-postgres2-danzi and dsa-postgres2-danzi6
Use a single rule for both. Also rename the rule and improve the
description to make it clear that it concerns the debconf cluster. Only
allow access from debussy instead of the whole subnet.
Aurelien Jarno [Sun, 22 Sep 2019 18:59:47 +0000 (20:59 +0200)]
danzi: merge dsa-postgres-danzi and dsa-postgres-danzi6
Use a single rule for both. Also rename the rule and improve the
description to make it clear that it concerns the main cluster. Drop the
old IP addresses of wuiet and the old UBC subnet. Ideally we should have
a least of host there, but that's already an improvement.
Aurelien Jarno [Sun, 22 Sep 2019 18:48:01 +0000 (20:48 +0200)]
Allow access to the tracker db @ danzi from ticharich
Aurelien Jarno [Sun, 22 Sep 2019 16:56:09 +0000 (18:56 +0200)]
donizetti is now at ubc
Peter Palfrader [Sun, 22 Sep 2019 18:53:33 +0000 (20:53 +0200)]
No longer allow nagios to recurse on our binds
Peter Palfrader [Sun, 22 Sep 2019 17:39:20 +0000 (19:39 +0200)]
nagiosmaster -> hiera role; bind acls still not converted
Peter Palfrader [Sun, 22 Sep 2019 17:32:28 +0000 (19:32 +0200)]
merge SSH_SOURCES and SSH_V6_SOURCES
Peter Palfrader [Sun, 22 Sep 2019 17:23:11 +0000 (19:23 +0200)]
Our (DSA) home networks do not need to access rabbitmq services
Peter Palfrader [Sun, 22 Sep 2019 16:48:40 +0000 (18:48 +0200)]
Move archvsync ferm sshs from the input chain to the new ssh chain
Peter Palfrader [Sun, 22 Sep 2019 16:47:44 +0000 (18:47 +0200)]
Allow nagios to ssh to our hosts
Peter Palfrader [Sun, 22 Sep 2019 16:41:12 +0000 (18:41 +0200)]
avoid top-scope variable being used without an explicit namespace
Peter Palfrader [Sun, 22 Sep 2019 16:40:23 +0000 (18:40 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 16:39:56 +0000 (18:39 +0200)]
Make an explicit iptables ssh chain
Aurelien Jarno [Sun, 22 Sep 2019 16:35:09 +0000 (18:35 +0200)]
add donizetti volumes at ubc
Aurelien Jarno [Sun, 22 Sep 2019 16:19:27 +0000 (18:19 +0200)]
prefix ticharich volumes with OLD-
Peter Palfrader [Sun, 22 Sep 2019 16:13:38 +0000 (18:13 +0200)]
Remove empty ferm::zivit
Peter Palfrader [Sun, 22 Sep 2019 16:12:52 +0000 (18:12 +0200)]
iptables -vnL on zelenka suggests that zivit no longer does rrdcollect and zabbix against our machine
Peter Palfrader [Sun, 22 Sep 2019 16:11:45 +0000 (18:11 +0200)]
Apparently we no longer monitor the time service on zivit hosts
Peter Palfrader [Sun, 22 Sep 2019 15:22:19 +0000 (17:22 +0200)]
fix param name
Peter Palfrader [Sun, 22 Sep 2019 15:21:29 +0000 (17:21 +0200)]
bgp -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 15:14:50 +0000 (17:14 +0200)]
Merge branch 'debianmirrorrole'
* debianmirrorrole:
Do not ship sbin/mirror-health from the roles version while we migrate
debian_mirror -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 15:13:31 +0000 (17:13 +0200)]
Do not ship sbin/mirror-health from the roles version while we migrate
Peter Palfrader [Sun, 22 Sep 2019 15:07:38 +0000 (17:07 +0200)]
debian_mirror -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 14:59:25 +0000 (16:59 +0200)]
Move allow-all smtp from the mta class to the exim and the lists class
We have some hosts that get their @host mail from the smarthost,
but that still accept mail from the internet.
Julien Cristau [Sun, 22 Sep 2019 14:23:09 +0000 (16:23 +0200)]
ticharich at ubc
Peter Palfrader [Sun, 22 Sep 2019 13:58:19 +0000 (15:58 +0200)]
retire obsolete muninmaster entry from common.yaml
Peter Palfrader [Sun, 22 Sep 2019 13:56:45 +0000 (15:56 +0200)]
mirror_health: this_host_service_name is now optional
Peter Palfrader [Sun, 22 Sep 2019 13:35:04 +0000 (15:35 +0200)]
munin/master_per_node: no longer needs to be backwards compatible
Peter Palfrader [Sun, 22 Sep 2019 13:26:33 +0000 (15:26 +0200)]
munin/master_per_node: try to be backwards compatible
Peter Palfrader [Sun, 22 Sep 2019 13:23:54 +0000 (15:23 +0200)]
muninmaster -> hiera role, new ssh store/collect, no more plain text munin fetching firewall rules (it is all async via ssh these days)
Peter Palfrader [Sun, 22 Sep 2019 13:21:59 +0000 (15:21 +0200)]
All our munin is munin-async these days
Peter Palfrader [Sun, 22 Sep 2019 13:11:13 +0000 (15:11 +0200)]
munin class cleanup
Peter Palfrader [Sun, 22 Sep 2019 13:01:28 +0000 (15:01 +0200)]
All our munin is munin-async these days
Julien Cristau [Sun, 22 Sep 2019 13:21:27 +0000 (15:21 +0200)]
mirror_health: add param description
Julien Cristau [Sun, 22 Sep 2019 12:55:00 +0000 (14:55 +0200)]
add ticharich volumes at ubc
Peter Palfrader [Sun, 22 Sep 2019 12:49:29 +0000 (14:49 +0200)]
Use variable correctly
Peter Palfrader [Sun, 22 Sep 2019 12:48:08 +0000 (14:48 +0200)]
Move debug healthcheck info to hiera
Peter Palfrader [Sun, 22 Sep 2019 12:42:17 +0000 (14:42 +0200)]
Move debug to store/collect health checker
Aurelien Jarno [Sun, 22 Sep 2019 11:42:47 +0000 (13:42 +0200)]
Fix previous commit
Aurelien Jarno [Sun, 22 Sep 2019 11:41:48 +0000 (13:41 +0200)]
The klecker-ftp.d.o address has been moved to new-klecker
Therefore:
- move the corresponding listen addresses to new-klecker
- drop the debian_mirror role from klecker
Julien Cristau [Sun, 22 Sep 2019 11:35:07 +0000 (13:35 +0200)]
As debian.mirrors.d.o gets checked by the health checker, explicitly listen on localhost
Peter Palfrader [Sun, 22 Sep 2019 11:28:14 +0000 (13:28 +0200)]
As debug.mirrors.d.o gets checked by the health checker, explicitly listen on localhost
Peter Palfrader [Sun, 22 Sep 2019 11:19:47 +0000 (13:19 +0200)]
debug_mirror -> hiera role, first step
Peter Palfrader [Sun, 22 Sep 2019 11:15:26 +0000 (13:15 +0200)]
whitespace change
Peter Palfrader [Sun, 22 Sep 2019 11:07:52 +0000 (13:07 +0200)]
remove historical_mirror has_role call for inclusion; no longer needed
Peter Palfrader [Sun, 22 Sep 2019 11:04:43 +0000 (13:04 +0200)]
historical_mirror -> hiera role
Since there are no onion mirrors right now, remove that code from the
role.
Peter Palfrader [Sun, 22 Sep 2019 10:51:28 +0000 (12:51 +0200)]
historical_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:47:52 +0000 (12:47 +0200)]
ports_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:46:24 +0000 (12:46 +0200)]
ftp_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:45:13 +0000 (12:45 +0200)]
include signing from the ftp_master role
Peter Palfrader [Sun, 22 Sep 2019 10:44:48 +0000 (12:44 +0200)]
whitespace/quoting: modules/roles/manifests/signing (make lint happy)
Peter Palfrader [Sun, 22 Sep 2019 10:44:21 +0000 (12:44 +0200)]
make ftp-master include dakmaster directly
Peter Palfrader [Sun, 22 Sep 2019 10:43:40 +0000 (12:43 +0200)]
whitespace/quoting: modules/roles/manifests/dakmaster (make lint happy)
Peter Palfrader [Sun, 22 Sep 2019 10:42:11 +0000 (12:42 +0200)]
security_master -> hiera role
Peter Palfrader [Sun, 22 Sep 2019 10:33:38 +0000 (12:33 +0200)]
retire old HOST_MAILRELAY ferm variable
Peter Palfrader [Sun, 22 Sep 2019 10:32:09 +0000 (12:32 +0200)]
retire mail_port config from local.yaml
Peter Palfrader [Sun, 22 Sep 2019 10:28:42 +0000 (12:28 +0200)]
Merge virtualdomains setup into exim/init
Peter Palfrader [Sun, 22 Sep 2019 10:26:01 +0000 (12:26 +0200)]
move the remaining virtualdomains to the mailrelay class
Peter Palfrader [Sun, 22 Sep 2019 10:22:36 +0000 (12:22 +0200)]
remove manualroute cleanup; it has run everywhere
Peter Palfrader [Sun, 22 Sep 2019 10:15:00 +0000 (12:15 +0200)]
And fix name in manualroute.pp
Peter Palfrader [Sun, 22 Sep 2019 10:10:49 +0000 (12:10 +0200)]
Use correct variable scope in manualroute.pp
Peter Palfrader [Sun, 22 Sep 2019 10:08:43 +0000 (12:08 +0200)]
Move to collected manualroute
Peter Palfrader [Sun, 22 Sep 2019 10:04:57 +0000 (12:04 +0200)]
Register manualroutes from the service class for the three services that had it hardcoded in the exim class; and make a roles::salsa
Peter Palfrader [Sun, 22 Sep 2019 10:04:15 +0000 (12:04 +0200)]
Create an exim::manualroute define
Peter Palfrader [Sun, 22 Sep 2019 09:51:44 +0000 (11:51 +0200)]
Switch to the hiera optional mail_port
Peter Palfrader [Sun, 22 Sep 2019 09:46:44 +0000 (11:46 +0200)]
remove smtp_sources from ferm's me.conf, retire old-style heavy_{exim,postfix} roles
Peter Palfrader [Sun, 22 Sep 2019 09:43:35 +0000 (11:43 +0200)]
Move TLSA for submission port from exim::mx role to the mailrelay role
Peter Palfrader [Sun, 22 Sep 2019 09:42:28 +0000 (11:42 +0200)]
remove default firewall accept to port submission on the MXes
Peter Palfrader [Sun, 22 Sep 2019 09:40:55 +0000 (11:40 +0200)]
Retire debian_org::mail_incoming_port which did the default firewalling for the mail ports
Peter Palfrader [Sun, 22 Sep 2019 09:39:51 +0000 (11:39 +0200)]
Move tlsa setup from mail_incoming_port to mta role
Peter Palfrader [Sun, 22 Sep 2019 09:39:09 +0000 (11:39 +0200)]
Make the manualroute explicitly send to port 25 by default as that simplifies the logic here
Peter Palfrader [Sun, 22 Sep 2019 09:35:31 +0000 (11:35 +0200)]
Try to add firewalling to enable mail satellites to connect to the submission port on the mail relays
Peter Palfrader [Sun, 22 Sep 2019 09:25:40 +0000 (11:25 +0200)]
bugs_master: allow incoming mail to the submission port from the role
Peter Palfrader [Sun, 22 Sep 2019 09:18:09 +0000 (11:18 +0200)]
Have the nagios-server export an smtp-allow rule to the mail satellites
Peter Palfrader [Sun, 22 Sep 2019 09:17:45 +0000 (11:17 +0200)]
Re-tag the store/collect ferm rule for mailrelays to satelliltes from smtp::server::from::mailrelay to smtp::server::to::mail-satellite
Peter Palfrader [Sun, 22 Sep 2019 09:17:13 +0000 (11:17 +0200)]
On non-satellites, allow smtp from the world