mirror/dsa-puppet.git
5 years agodebconf19 is not static just yet
Julien Cristau [Tue, 17 Sep 2019 18:00:20 +0000 (20:00 +0200)]
debconf19 is not static just yet

5 years agonew-klecker: enable the static trigger and provide onion services
Aurelien Jarno [Tue, 17 Sep 2019 17:56:40 +0000 (19:56 +0200)]
new-klecker: enable the static trigger and provide onion services

5 years agoEnable more static components for new-klecker
Aurelien Jarno [Tue, 17 Sep 2019 13:48:27 +0000 (15:48 +0200)]
Enable more static components for new-klecker

5 years agoDrop klecker from static_mirror_web
Aurelien Jarno [Tue, 17 Sep 2019 13:48:27 +0000 (15:48 +0200)]
Drop klecker from static_mirror_web

It will be replaced by new-klecker

5 years agoAs we are removing klecker from the static rotation, stop providing (static) onion...
Peter Palfrader [Tue, 17 Sep 2019 13:40:07 +0000 (15:40 +0200)]
As we are removing klecker from the static rotation, stop providing (static) onion services from it

5 years agoAdd new-klecker as a static mirror
Aurelien Jarno [Tue, 17 Sep 2019 12:13:09 +0000 (14:13 +0200)]
Add new-klecker as a static mirror

(not yet triggered)

5 years agopuppet still created /var/lib/misc/thishost/pkglist. remove that
Peter Palfrader [Tue, 17 Sep 2019 09:35:07 +0000 (11:35 +0200)]
puppet still created /var/lib/misc/thishost/pkglist.  remove that

5 years agopush debdeltas only to csail, isc, senfter; dropping klecker
Peter Palfrader [Tue, 17 Sep 2019 09:30:16 +0000 (11:30 +0200)]
push debdeltas only to csail, isc, senfter; dropping klecker

5 years agowuiet is no longer a static_source. apt.buildd.debian.org was retired months ago
Peter Palfrader [Tue, 17 Sep 2019 08:10:26 +0000 (10:10 +0200)]
wuiet is no longer a static_source.  apt.buildd.debian.org was retired months ago

5 years agoports/static mirror: if listen_addr are not explicitly set, use the host's public...
Peter Palfrader [Tue, 17 Sep 2019 08:04:16 +0000 (10:04 +0200)]
ports/static mirror: if listen_addr are not explicitly set, use the host's public IPv4 address for onion purposes

5 years agoUpdate wuiet IP address
Aurelien Jarno [Mon, 16 Sep 2019 23:12:30 +0000 (01:12 +0200)]
Update wuiet IP address

5 years agowannabuild has been moved from bmdb1 to danzi
Aurelien Jarno [Mon, 16 Sep 2019 22:41:32 +0000 (00:41 +0200)]
wannabuild has been moved from bmdb1 to danzi

5 years agowhitespace/quoting: modules/staticsync/manifests/static_mirror.pp (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 17:05:02 +0000 (19:05 +0200)]
whitespace/quoting: modules/staticsync/manifests/static_mirror.pp (make lint happy)

5 years agoRemove setting env vars in the static_mirror part of puppet-cron
Peter Palfrader [Mon, 16 Sep 2019 17:03:42 +0000 (19:03 +0200)]
Remove setting env vars in the static_mirror part of puppet-cron

This was re-setting MAILTO=root, which is already set at the top level,
and it was also setting PATH to only a subset of what it was before
(dropped the sbins).

5 years agoslapd-ftmg.conf has credentials, lock down modes
Peter Palfrader [Mon, 16 Sep 2019 11:57:24 +0000 (13:57 +0200)]
slapd-ftmg.conf has credentials, lock down modes

5 years agodisable root access to DB
Peter Palfrader [Mon, 16 Sep 2019 11:55:54 +0000 (13:55 +0200)]
disable root access to DB

5 years agoDocument initial database contents
Peter Palfrader [Mon, 16 Sep 2019 11:55:37 +0000 (13:55 +0200)]
Document initial database contents

5 years agoShip an initial ftmg slapd config
Peter Palfrader [Mon, 16 Sep 2019 11:39:59 +0000 (13:39 +0200)]
Ship an initial ftmg slapd config

5 years agosso: add openssh-ldap.schema, re: RT#7454
Peter Palfrader [Mon, 16 Sep 2019 10:28:42 +0000 (12:28 +0200)]
sso: add openssh-ldap.schema, re: RT#7454

5 years agowhitespace/quoting: modules/roles/manifests/static_mirror_web (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 09:52:46 +0000 (11:52 +0200)]
whitespace/quoting: modules/roles/manifests/static_mirror_web (make lint happy)

5 years agostatic_mirror_web: replace the vhost_listen string with an Array of IP addresses
Peter Palfrader [Mon, 16 Sep 2019 09:50:45 +0000 (11:50 +0200)]
static_mirror_web: replace the vhost_listen string with an Array of IP addresses

5 years agoports_mirror: replace the vhost_listen string with an Array of IP addresses
Peter Palfrader [Mon, 16 Sep 2019 09:38:49 +0000 (11:38 +0200)]
ports_mirror: replace the vhost_listen string with an Array of IP addresses

5 years agowhitespace cleanup
Peter Palfrader [Mon, 16 Sep 2019 09:22:45 +0000 (11:22 +0200)]
whitespace cleanup

5 years agomake dns primary export and keyring host collect firewall rules for the openpgpkey...
Peter Palfrader [Mon, 16 Sep 2019 09:11:50 +0000 (11:11 +0200)]
make dns primary export and keyring host collect firewall rules for the openpgpkey zone transfer; retire old-style dns_primary role

5 years agoshorter rule name
Peter Palfrader [Mon, 16 Sep 2019 09:03:49 +0000 (11:03 +0200)]
shorter rule name

5 years agoIf the name is too long for netfilter, hash it
Peter Palfrader [Mon, 16 Sep 2019 09:02:30 +0000 (11:02 +0200)]
If the name is too long for netfilter, hash it

5 years agomove 3rd party nameserver info from the ferm template to hiera, retire geodns old...
Peter Palfrader [Mon, 16 Sep 2019 08:53:30 +0000 (10:53 +0200)]
move 3rd party nameserver info from the ferm template to hiera, retire geodns old-style role

5 years agore-arrange hieradata/common slightly
Peter Palfrader [Mon, 16 Sep 2019 08:37:25 +0000 (10:37 +0200)]
re-arrange hieradata/common slightly

5 years agopublish, store and collect ferm rules for dns primary access
Peter Palfrader [Mon, 16 Sep 2019 08:30:27 +0000 (10:30 +0200)]
publish, store and collect ferm rules for dns primary access

5 years agowhitespace/quoting: modules/nagiosmanifests/ (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 08:28:46 +0000 (10:28 +0200)]
whitespace/quoting: modules/nagiosmanifests/ (make lint happy)

5 years agoTry a new ferm rule class
Peter Palfrader [Mon, 16 Sep 2019 08:07:18 +0000 (10:07 +0200)]
Try a new ferm rule class

5 years agowhitespace/quoting: modules/ferm/manifests/ (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 06:12:22 +0000 (08:12 +0200)]
whitespace/quoting: modules/ferm/manifests/ (make lint happy)

5 years agowhitespace/quoting: modules/named/manifests/ (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 05:59:35 +0000 (07:59 +0200)]
whitespace/quoting: modules/named/manifests/ (make lint happy)

5 years agothis from setting is the default. no need to pass it on explicitly
Peter Palfrader [Sun, 15 Sep 2019 20:31:37 +0000 (22:31 +0200)]
this from setting is the default.  no need to pass it on explicitly

5 years agoMake ssh puppetkeys mode 0444 (instead of 0644)
Peter Palfrader [Sun, 15 Sep 2019 20:27:59 +0000 (22:27 +0200)]
Make ssh puppetkeys mode 0444 (instead of 0644)

5 years agohandle sync ssh keys for dgit
Peter Palfrader [Sun, 15 Sep 2019 20:21:28 +0000 (22:21 +0200)]
handle sync ssh keys for dgit

The dgit master host (gideon) is available only via ssh to DDs.
it syncs its data to a publicly accessible host (cgi-grnet-01) over
ssh.  Until now the authkeys file was maintained by hand, but
Ian Jackson asked if we could do that in puppet so updates in IP
addresses etc. get automatically handled.

5 years agomigrate packagesmaster and packagesqamaster role
Peter Palfrader [Sun, 15 Sep 2019 19:58:51 +0000 (21:58 +0200)]
migrate packagesmaster and packagesqamaster role

5 years agowhitespace/quoting: modules/exim/manifests/* (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 19:53:59 +0000 (21:53 +0200)]
whitespace/quoting: modules/exim/manifests/* (make lint happy)

5 years agoPartially migrate the mailrelay role. ferm still needs the old style.
Peter Palfrader [Sun, 15 Sep 2019 19:51:18 +0000 (21:51 +0200)]
Partially migrate the mailrelay role.  ferm still needs the old style.

5 years agoretire bugsmx role
Peter Palfrader [Sun, 15 Sep 2019 19:41:22 +0000 (21:41 +0200)]
retire bugsmx role

5 years agomake sure exim on reger does the rtmaster stuff
Peter Palfrader [Sun, 15 Sep 2019 19:39:02 +0000 (21:39 +0200)]
make sure exim on reger does the rtmaster stuff

5 years agortmaster -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 19:36:43 +0000 (21:36 +0200)]
rtmaster -> hiera role

5 years agowhitespace/quoting: modules/exim/manifests/init.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 19:32:33 +0000 (21:32 +0200)]
whitespace/quoting: modules/exim/manifests/init.pp (make lint happy)

5 years agort require apache2
Peter Palfrader [Sun, 15 Sep 2019 19:30:30 +0000 (21:30 +0200)]
rt require apache2

5 years agosreview and veyepar require apache2
Peter Palfrader [Sun, 15 Sep 2019 19:28:55 +0000 (21:28 +0200)]
sreview and veyepar require apache2

5 years agoa few more notes in common.yaml
Peter Palfrader [Sun, 15 Sep 2019 18:52:47 +0000 (20:52 +0200)]
a few more notes in common.yaml

5 years agohieradata/common: note which "roles" are used by ferm to gather lists
Peter Palfrader [Sun, 15 Sep 2019 18:49:14 +0000 (20:49 +0200)]
hieradata/common: note which "roles" are used by ferm to gather lists

5 years agokeyring: explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 18:46:22 +0000 (20:46 +0200)]
keyring: explicitly include apache2

5 years agowhitespace/quoting: modules/roles/manifests/keyring.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 18:45:54 +0000 (20:45 +0200)]
whitespace/quoting: modules/roles/manifests/keyring.pp (make lint happy)

5 years agopopcon -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 18:43:28 +0000 (20:43 +0200)]
popcon -> hiera role; explicitly include apache2

5 years agoRetire static_mirror_onion and move IP address lists out of static_mirror_web and...
Peter Palfrader [Sun, 15 Sep 2019 18:38:26 +0000 (20:38 +0200)]
Retire static_mirror_onion and move IP address lists out of static_mirror_web and into hiera

5 years agosnapshot_web -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 18:30:00 +0000 (20:30 +0200)]
snapshot_web -> hiera role

5 years agoudd -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 18:26:06 +0000 (20:26 +0200)]
udd -> hiera role; explicitly include apache2

5 years agowhitespace/quoting: modules/apache2/manifests/dynamic.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 18:06:12 +0000 (20:06 +0200)]
whitespace/quoting: modules/apache2/manifests/dynamic.pp (make lint happy)

5 years agorename one ferm block
Peter Palfrader [Sun, 15 Sep 2019 18:02:56 +0000 (20:02 +0200)]
rename one ferm block

5 years agoRetire the apache_ratelimited role
Peter Palfrader [Sun, 15 Sep 2019 17:59:31 +0000 (19:59 +0200)]
Retire the apache_ratelimited role

And introduce a rate_limit param to the apache2 class.  The
bugs_web role sets that option to true on inclusion, as does
the packages role.

The snapshot role had slightly different rate limiting in the
apache class.  This has now been removed in favor of rate limiting
in the snapshot_web class.

To enable this, all web traffic (even on not-ratelimited systems)
is sent to the http chain.  At the end, all traffic gets accepted
and services that want to interfere can do things before prio 90.

5 years agowhitespace/quoting: modules/roles/manifests/snapshot_web.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 17:52:04 +0000 (19:52 +0200)]
whitespace/quoting: modules/roles/manifests/snapshot_web.pp (make lint happy)

5 years agoReplace apache_prefork role with an mpm class option for apache2
Peter Palfrader [Sun, 15 Sep 2019 17:32:17 +0000 (19:32 +0200)]
Replace apache_prefork role with an mpm class option for apache2

5 years agothe linter only wants 4-digit modes
Peter Palfrader [Sun, 15 Sep 2019 17:07:53 +0000 (19:07 +0200)]
the linter only wants 4-digit modes

5 years agosnapshot_shell -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 17:05:50 +0000 (19:05 +0200)]
snapshot_shell -> hiera role

5 years agosecurity_tracker -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 17:02:19 +0000 (19:02 +0200)]
security_tracker -> hiera role; explicitly include apache2

5 years agodrop has_role includes for sso*
Peter Palfrader [Sun, 15 Sep 2019 17:00:07 +0000 (19:00 +0200)]
drop has_role includes for sso*

5 years agoRetire sso_rp (SSO, relying party) role for hosts
Peter Palfrader [Sun, 15 Sep 2019 16:57:09 +0000 (18:57 +0200)]
Retire sso_rp (SSO, relying party) role for hosts

Instead, relying services should include roles::sso_rp.

5 years agotemporary fix for sso_rp/ca.crl.erb using the now-removed roles[sso] hostlist
Peter Palfrader [Sun, 15 Sep 2019 16:55:52 +0000 (18:55 +0200)]
temporary fix for sso_rp/ca.crl.erb using the now-removed roles[sso] hostlist

5 years agosso -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:45:03 +0000 (18:45 +0200)]
sso -> hiera role; explicitly include apache2

5 years agowiki -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:28:08 +0000 (18:28 +0200)]
wiki -> hiera role; explicitly include apache2

5 years agogit_master -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 16:26:40 +0000 (18:26 +0200)]
git_master -> hiera role

5 years agosecurity_upload -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 16:25:06 +0000 (18:25 +0200)]
security_upload -> hiera role

5 years agoi18n, l10n -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:21:34 +0000 (18:21 +0200)]
i18n, l10n -> hiera role; explicitly include apache2

5 years agoGet this hosts public IP address for the apache allow rather than going via roles
Peter Palfrader [Sun, 15 Sep 2019 16:20:25 +0000 (18:20 +0200)]
Get this hosts public IP address for the apache allow rather than going via roles

5 years agospell apache better
Peter Palfrader [Sun, 15 Sep 2019 16:16:32 +0000 (18:16 +0200)]
spell apache better

5 years agoplanet_{search,master} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:13:36 +0000 (18:13 +0200)]
planet_{search,master} -> hiera role; explicitly include apache2

5 years agohistoricalpackages -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:11:07 +0000 (18:11 +0200)]
historicalpackages -> hiera role; explicitly include apache2

5 years agopackages -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:08:21 +0000 (18:08 +0200)]
packages -> hiera role; explicitly include apache2

5 years agowww_master -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 15:17:11 +0000 (17:17 +0200)]
www_master -> hiera role; explicitly include apache2

5 years agoRevert "Revert "ssh_upload -> hiera role""
Peter Palfrader [Sun, 15 Sep 2019 15:09:29 +0000 (17:09 +0200)]
Revert "Revert "ssh_upload -> hiera role""

This reverts commit 13581ee3cf37c33606b8c8317c0901459e34c313.

Try this again, now with an extra change in sshd_config

5 years agoThis file no longer exists
Peter Palfrader [Sun, 15 Sep 2019 15:08:50 +0000 (17:08 +0200)]
This file no longer exists

5 years agoRevert "ssh_upload -> hiera role"
Peter Palfrader [Sun, 15 Sep 2019 15:06:41 +0000 (17:06 +0200)]
Revert "ssh_upload -> hiera role"

This reverts commit fe6c9108858446d5081a4d3505280bafe018cbdc.

This change is not a nop as expected.  Revert until we figure out why.

5 years agossh_upload -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 15:02:17 +0000 (17:02 +0200)]
ssh_upload -> hiera role

5 years agoftp_upload -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:58:30 +0000 (16:58 +0200)]
ftp_upload -> hiera role

5 years agobacula_storage -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:55:37 +0000 (16:55 +0200)]
bacula_storage -> hiera role

5 years agobacula_director -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:52:08 +0000 (16:52 +0200)]
bacula_director -> hiera role

5 years agogobby -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:46:25 +0000 (16:46 +0200)]
gobby -> hiera role; explicitly include apache2

5 years agomanpages_dyn -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:43:05 +0000 (16:43 +0200)]
manpages_dyn -> hiera role; explicitly include apache2

5 years agopet -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:40:30 +0000 (16:40 +0200)]
pet -> hiera role; explicitly include apache2

5 years agowhitespace/quoting: modules/roles/manifests/ports_master.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 14:37:37 +0000 (16:37 +0200)]
whitespace/quoting: modules/roles/manifests/ports_pp (make lint happy)

5 years agoRemove IP addresses from ports_mirror role and move them to hiera
Peter Palfrader [Sun, 15 Sep 2019 14:35:37 +0000 (16:35 +0200)]
Remove IP addresses from ports_mirror role and move them to hiera

5 years agoports_mirror* -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:30:58 +0000 (16:30 +0200)]
ports_mirror* -> hiera role; explicitly include apache2

5 years agocdimage_search -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:10:28 +0000 (16:10 +0200)]
cdimage_search -> hiera role; explicitly include apache2

5 years agopubsub -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:08:35 +0000 (16:08 +0200)]
pubsub -> hiera role

5 years agoMake a proper role for cgi.debian.org on wolkenstein
Peter Palfrader [Sun, 15 Sep 2019 13:42:59 +0000 (15:42 +0200)]
Make a proper role for cgi.debian.org on wolkenstein

5 years agodebsources -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:40:02 +0000 (15:40 +0200)]
debsources -> hiera role; explicitly include apache2

5 years agono arithmetic in yaml :(
Peter Palfrader [Sun, 15 Sep 2019 13:37:11 +0000 (15:37 +0200)]
no arithmetic in yaml :(

5 years agopartially get rlimitmem from class param
Peter Palfrader [Sun, 15 Sep 2019 13:35:32 +0000 (15:35 +0200)]
partially get rlimitmem from class param

5 years agowhitespace/quoting: modules/roles/manifests/dgit*.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 13:32:14 +0000 (15:32 +0200)]
whitespace/quoting: modules/roles/manifests/dgit*.pp (make lint happy)

5 years agodgit_{browse,git} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:31:35 +0000 (15:31 +0200)]
dgit_{browse,git} -> hiera role; explicitly include apache2

5 years agosearch_{frontend,backend} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:29:07 +0000 (15:29 +0200)]
search_{frontend,backend} -> hiera role; explicitly include apache2

5 years agopeople -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:26:04 +0000 (15:26 +0200)]
people -> hiera role; explicitly include apache2

5 years agodebtags -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:22:28 +0000 (15:22 +0200)]
debtags -> hiera role; explicitly include apache2

5 years agocontributors -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:20:03 +0000 (15:20 +0200)]
contributors -> hiera role; explicitly include apache2