Julien Cristau [Tue, 17 Sep 2019 18:00:20 +0000 (20:00 +0200)]
debconf19 is not static just yet
Aurelien Jarno [Tue, 17 Sep 2019 17:56:40 +0000 (19:56 +0200)]
new-klecker: enable the static trigger and provide onion services
Aurelien Jarno [Tue, 17 Sep 2019 13:48:27 +0000 (15:48 +0200)]
Enable more static components for new-klecker
Aurelien Jarno [Tue, 17 Sep 2019 13:48:27 +0000 (15:48 +0200)]
Drop klecker from static_mirror_web
It will be replaced by new-klecker
Peter Palfrader [Tue, 17 Sep 2019 13:40:07 +0000 (15:40 +0200)]
As we are removing klecker from the static rotation, stop providing (static) onion services from it
Aurelien Jarno [Tue, 17 Sep 2019 12:13:09 +0000 (14:13 +0200)]
Add new-klecker as a static mirror
(not yet triggered)
Peter Palfrader [Tue, 17 Sep 2019 09:35:07 +0000 (11:35 +0200)]
puppet still created /var/lib/misc/thishost/pkglist. remove that
Peter Palfrader [Tue, 17 Sep 2019 09:30:16 +0000 (11:30 +0200)]
push debdeltas only to csail, isc, senfter; dropping klecker
Peter Palfrader [Tue, 17 Sep 2019 08:10:26 +0000 (10:10 +0200)]
wuiet is no longer a static_source. apt.buildd.debian.org was retired months ago
Peter Palfrader [Tue, 17 Sep 2019 08:04:16 +0000 (10:04 +0200)]
ports/static mirror: if listen_addr are not explicitly set, use the host's public IPv4 address for onion purposes
Aurelien Jarno [Mon, 16 Sep 2019 23:12:30 +0000 (01:12 +0200)]
Update wuiet IP address
Aurelien Jarno [Mon, 16 Sep 2019 22:41:32 +0000 (00:41 +0200)]
wannabuild has been moved from bmdb1 to danzi
Peter Palfrader [Mon, 16 Sep 2019 17:05:02 +0000 (19:05 +0200)]
whitespace/quoting: modules/staticsync/manifests/static_mirror.pp (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 17:03:42 +0000 (19:03 +0200)]
Remove setting env vars in the static_mirror part of puppet-cron
This was re-setting MAILTO=root, which is already set at the top level,
and it was also setting PATH to only a subset of what it was before
(dropped the sbins).
Peter Palfrader [Mon, 16 Sep 2019 11:57:24 +0000 (13:57 +0200)]
slapd-ftmg.conf has credentials, lock down modes
Peter Palfrader [Mon, 16 Sep 2019 11:55:54 +0000 (13:55 +0200)]
disable root access to DB
Peter Palfrader [Mon, 16 Sep 2019 11:55:37 +0000 (13:55 +0200)]
Document initial database contents
Peter Palfrader [Mon, 16 Sep 2019 11:39:59 +0000 (13:39 +0200)]
Ship an initial ftmg slapd config
Peter Palfrader [Mon, 16 Sep 2019 10:28:42 +0000 (12:28 +0200)]
sso: add openssh-ldap.schema, re: RT#7454
Peter Palfrader [Mon, 16 Sep 2019 09:52:46 +0000 (11:52 +0200)]
whitespace/quoting: modules/roles/manifests/static_mirror_web (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 09:50:45 +0000 (11:50 +0200)]
static_mirror_web: replace the vhost_listen string with an Array of IP addresses
Peter Palfrader [Mon, 16 Sep 2019 09:38:49 +0000 (11:38 +0200)]
ports_mirror: replace the vhost_listen string with an Array of IP addresses
Peter Palfrader [Mon, 16 Sep 2019 09:22:45 +0000 (11:22 +0200)]
whitespace cleanup
Peter Palfrader [Mon, 16 Sep 2019 09:11:50 +0000 (11:11 +0200)]
make dns primary export and keyring host collect firewall rules for the openpgpkey zone transfer; retire old-style dns_primary role
Peter Palfrader [Mon, 16 Sep 2019 09:03:49 +0000 (11:03 +0200)]
shorter rule name
Peter Palfrader [Mon, 16 Sep 2019 09:02:30 +0000 (11:02 +0200)]
If the name is too long for netfilter, hash it
Peter Palfrader [Mon, 16 Sep 2019 08:53:30 +0000 (10:53 +0200)]
move 3rd party nameserver info from the ferm template to hiera, retire geodns old-style role
Peter Palfrader [Mon, 16 Sep 2019 08:37:25 +0000 (10:37 +0200)]
re-arrange hieradata/common slightly
Peter Palfrader [Mon, 16 Sep 2019 08:30:27 +0000 (10:30 +0200)]
publish, store and collect ferm rules for dns primary access
Peter Palfrader [Mon, 16 Sep 2019 08:28:46 +0000 (10:28 +0200)]
whitespace/quoting: modules/nagiosmanifests/ (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 08:07:18 +0000 (10:07 +0200)]
Try a new ferm rule class
Peter Palfrader [Mon, 16 Sep 2019 06:12:22 +0000 (08:12 +0200)]
whitespace/quoting: modules/ferm/manifests/ (make lint happy)
Peter Palfrader [Mon, 16 Sep 2019 05:59:35 +0000 (07:59 +0200)]
whitespace/quoting: modules/named/manifests/ (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 20:31:37 +0000 (22:31 +0200)]
this from setting is the default. no need to pass it on explicitly
Peter Palfrader [Sun, 15 Sep 2019 20:27:59 +0000 (22:27 +0200)]
Make ssh puppetkeys mode 0444 (instead of 0644)
Peter Palfrader [Sun, 15 Sep 2019 20:21:28 +0000 (22:21 +0200)]
handle sync ssh keys for dgit
The dgit master host (gideon) is available only via ssh to DDs.
it syncs its data to a publicly accessible host (cgi-grnet-01) over
ssh. Until now the authkeys file was maintained by hand, but
Ian Jackson asked if we could do that in puppet so updates in IP
addresses etc. get automatically handled.
Peter Palfrader [Sun, 15 Sep 2019 19:58:51 +0000 (21:58 +0200)]
migrate packagesmaster and packagesqamaster role
Peter Palfrader [Sun, 15 Sep 2019 19:53:59 +0000 (21:53 +0200)]
whitespace/quoting: modules/exim/manifests/* (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 19:51:18 +0000 (21:51 +0200)]
Partially migrate the mailrelay role. ferm still needs the old style.
Peter Palfrader [Sun, 15 Sep 2019 19:41:22 +0000 (21:41 +0200)]
retire bugsmx role
Peter Palfrader [Sun, 15 Sep 2019 19:39:02 +0000 (21:39 +0200)]
make sure exim on reger does the rtmaster stuff
Peter Palfrader [Sun, 15 Sep 2019 19:36:43 +0000 (21:36 +0200)]
rtmaster -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 19:32:33 +0000 (21:32 +0200)]
whitespace/quoting: modules/exim/manifests/init.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 19:30:30 +0000 (21:30 +0200)]
rt require apache2
Peter Palfrader [Sun, 15 Sep 2019 19:28:55 +0000 (21:28 +0200)]
sreview and veyepar require apache2
Peter Palfrader [Sun, 15 Sep 2019 18:52:47 +0000 (20:52 +0200)]
a few more notes in common.yaml
Peter Palfrader [Sun, 15 Sep 2019 18:49:14 +0000 (20:49 +0200)]
hieradata/common: note which "roles" are used by ferm to gather lists
Peter Palfrader [Sun, 15 Sep 2019 18:46:22 +0000 (20:46 +0200)]
keyring: explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 18:45:54 +0000 (20:45 +0200)]
whitespace/quoting: modules/roles/manifests/keyring.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 18:43:28 +0000 (20:43 +0200)]
popcon -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 18:38:26 +0000 (20:38 +0200)]
Retire static_mirror_onion and move IP address lists out of static_mirror_web and into hiera
Peter Palfrader [Sun, 15 Sep 2019 18:30:00 +0000 (20:30 +0200)]
snapshot_web -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 18:26:06 +0000 (20:26 +0200)]
udd -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 18:06:12 +0000 (20:06 +0200)]
whitespace/quoting: modules/apache2/manifests/dynamic.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 18:02:56 +0000 (20:02 +0200)]
rename one ferm block
Peter Palfrader [Sun, 15 Sep 2019 17:59:31 +0000 (19:59 +0200)]
Retire the apache_ratelimited role
And introduce a rate_limit param to the apache2 class. The
bugs_web role sets that option to true on inclusion, as does
the packages role.
The snapshot role had slightly different rate limiting in the
apache class. This has now been removed in favor of rate limiting
in the snapshot_web class.
To enable this, all web traffic (even on not-ratelimited systems)
is sent to the http chain. At the end, all traffic gets accepted
and services that want to interfere can do things before prio 90.
Peter Palfrader [Sun, 15 Sep 2019 17:52:04 +0000 (19:52 +0200)]
whitespace/quoting: modules/roles/manifests/snapshot_web.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 17:32:17 +0000 (19:32 +0200)]
Replace apache_prefork role with an mpm class option for apache2
Peter Palfrader [Sun, 15 Sep 2019 17:07:53 +0000 (19:07 +0200)]
the linter only wants 4-digit modes
Peter Palfrader [Sun, 15 Sep 2019 17:05:50 +0000 (19:05 +0200)]
snapshot_shell -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 17:02:19 +0000 (19:02 +0200)]
security_tracker -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 17:00:07 +0000 (19:00 +0200)]
drop has_role includes for sso*
Peter Palfrader [Sun, 15 Sep 2019 16:57:09 +0000 (18:57 +0200)]
Retire sso_rp (SSO, relying party) role for hosts
Instead, relying services should include roles::sso_rp.
Peter Palfrader [Sun, 15 Sep 2019 16:55:52 +0000 (18:55 +0200)]
temporary fix for sso_rp/ca.crl.erb using the now-removed roles[sso] hostlist
Peter Palfrader [Sun, 15 Sep 2019 16:45:03 +0000 (18:45 +0200)]
sso -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:28:08 +0000 (18:28 +0200)]
wiki -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:26:40 +0000 (18:26 +0200)]
git_master -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 16:25:06 +0000 (18:25 +0200)]
security_upload -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 16:21:34 +0000 (18:21 +0200)]
i18n, l10n -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:20:25 +0000 (18:20 +0200)]
Get this hosts public IP address for the apache allow rather than going via roles
Peter Palfrader [Sun, 15 Sep 2019 16:16:32 +0000 (18:16 +0200)]
spell apache better
Peter Palfrader [Sun, 15 Sep 2019 16:13:36 +0000 (18:13 +0200)]
planet_{search,master} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:11:07 +0000 (18:11 +0200)]
historicalpackages -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 16:08:21 +0000 (18:08 +0200)]
packages -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 15:17:11 +0000 (17:17 +0200)]
www_master -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 15:09:29 +0000 (17:09 +0200)]
Revert "Revert "ssh_upload -> hiera role""
This reverts commit
13581ee3cf37c33606b8c8317c0901459e34c313.
Try this again, now with an extra change in sshd_config
Peter Palfrader [Sun, 15 Sep 2019 15:08:50 +0000 (17:08 +0200)]
This file no longer exists
Peter Palfrader [Sun, 15 Sep 2019 15:06:41 +0000 (17:06 +0200)]
Revert "ssh_upload -> hiera role"
This reverts commit
fe6c9108858446d5081a4d3505280bafe018cbdc.
This change is not a nop as expected. Revert until we figure out why.
Peter Palfrader [Sun, 15 Sep 2019 15:02:17 +0000 (17:02 +0200)]
ssh_upload -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:58:30 +0000 (16:58 +0200)]
ftp_upload -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:55:37 +0000 (16:55 +0200)]
bacula_storage -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:52:08 +0000 (16:52 +0200)]
bacula_director -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 14:46:25 +0000 (16:46 +0200)]
gobby -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:43:05 +0000 (16:43 +0200)]
manpages_dyn -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:40:30 +0000 (16:40 +0200)]
pet -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:37:37 +0000 (16:37 +0200)]
whitespace/quoting: modules/roles/manifests/ports_pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 14:35:37 +0000 (16:35 +0200)]
Remove IP addresses from ports_mirror role and move them to hiera
Peter Palfrader [Sun, 15 Sep 2019 14:30:58 +0000 (16:30 +0200)]
ports_mirror* -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:10:28 +0000 (16:10 +0200)]
cdimage_search -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 14:08:35 +0000 (16:08 +0200)]
pubsub -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 13:42:59 +0000 (15:42 +0200)]
Make a proper role for cgi.debian.org on wolkenstein
Peter Palfrader [Sun, 15 Sep 2019 13:40:02 +0000 (15:40 +0200)]
debsources -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:37:11 +0000 (15:37 +0200)]
no arithmetic in yaml :(
Peter Palfrader [Sun, 15 Sep 2019 13:35:32 +0000 (15:35 +0200)]
partially get rlimitmem from class param
Peter Palfrader [Sun, 15 Sep 2019 13:32:14 +0000 (15:32 +0200)]
whitespace/quoting: modules/roles/manifests/dgit*.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 13:31:35 +0000 (15:31 +0200)]
dgit_{browse,git} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:29:07 +0000 (15:29 +0200)]
search_{frontend,backend} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:26:04 +0000 (15:26 +0200)]
people -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:22:28 +0000 (15:22 +0200)]
debtags -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:20:03 +0000 (15:20 +0200)]
contributors -> hiera role; explicitly include apache2