mirror/dsa-puppet.git
5 years agoprepare for dak replica on danzi
Julien Cristau [Tue, 1 Oct 2019 12:50:44 +0000 (14:50 +0200)]
prepare for dak replica on danzi

5 years agoAdd a comment about why access to UDD is needed on wuiet
Aurelien Jarno [Mon, 30 Sep 2019 08:17:46 +0000 (10:17 +0200)]
Add a comment about why access to UDD is needed on wuiet

5 years agoadd missing new files for pet role
Peter Palfrader [Mon, 30 Sep 2019 08:04:23 +0000 (10:04 +0200)]
add missing new files for pet role

5 years agomanage bmdb1/main pg_hba
Peter Palfrader [Mon, 30 Sep 2019 08:02:06 +0000 (10:02 +0200)]
manage bmdb1/main pg_hba

5 years agosort entries
Peter Palfrader [Mon, 30 Sep 2019 07:45:45 +0000 (09:45 +0200)]
sort entries

5 years agoMove draghi finger/ldap/ldaps fw into dbmaster role
Peter Palfrader [Mon, 30 Sep 2019 06:17:35 +0000 (08:17 +0200)]
Move draghi finger/ldap/ldaps fw into dbmaster role

5 years agoMove gombert infinoted fw into gobby role
Peter Palfrader [Mon, 30 Sep 2019 06:16:14 +0000 (08:16 +0200)]
Move gombert infinoted fw into gobby role

5 years agoMove kaufmann keyserver fw into keyring role
Peter Palfrader [Mon, 30 Sep 2019 06:13:43 +0000 (08:13 +0200)]
Move kaufmann keyserver fw into keyring role

5 years agoudd: no ssl needed on localhost
Peter Palfrader [Mon, 30 Sep 2019 06:07:51 +0000 (08:07 +0200)]
udd: no ssl needed on localhost

5 years agobuildd/udd: do guest access earlier
Peter Palfrader [Mon, 30 Sep 2019 06:04:05 +0000 (08:04 +0200)]
buildd/udd: do guest access earlier

5 years agoudd wants guest access on localhost
Peter Palfrader [Mon, 30 Sep 2019 06:01:51 +0000 (08:01 +0200)]
udd wants guest access on localhost

5 years agobuildd/udd: do guest access earlier
Peter Palfrader [Mon, 30 Sep 2019 05:59:17 +0000 (07:59 +0200)]
buildd/udd: do guest access earlier

5 years agomanage ullmann/udd pg_hba
Peter Palfrader [Mon, 30 Sep 2019 05:55:30 +0000 (07:55 +0200)]
manage ullmann/udd pg_hba

5 years agopg config on ullmann, pt 1
Peter Palfrader [Mon, 30 Sep 2019 05:45:08 +0000 (07:45 +0200)]
pg config on ullmann, pt 1

5 years agomanage danzi/wanna-build pg_hba
Peter Palfrader [Sun, 29 Sep 2019 20:45:26 +0000 (22:45 +0200)]
manage danzi/wanna-build pg_hba

5 years agomanage danzi/main pg_hba
Peter Palfrader [Sun, 29 Sep 2019 20:30:15 +0000 (22:30 +0200)]
manage danzi/main pg_hba

5 years agomanage danzi/debconf pg_hba
Peter Palfrader [Sun, 29 Sep 2019 20:23:44 +0000 (22:23 +0200)]
manage danzi/debconf pg_hba

5 years agofqdn in name
Peter Palfrader [Sun, 29 Sep 2019 20:21:07 +0000 (22:21 +0200)]
fqdn in name

5 years agomanage danzi/tracker pg_hba
Peter Palfrader [Sun, 29 Sep 2019 20:16:20 +0000 (22:16 +0200)]
manage danzi/tracker pg_hba

5 years agoremove manual firewall allow snapshotdb-manda-01->sallinen
Peter Palfrader [Sun, 29 Sep 2019 19:18:13 +0000 (21:18 +0200)]
remove manual firewall allow snapshotdb-manda-01->sallinen

5 years agofix order of the guest trust on snapshot db (do it before the other localhost entries)
Peter Palfrader [Sun, 29 Sep 2019 19:17:32 +0000 (21:17 +0200)]
fix order of the guest trust on snapshot db (do it before the other localhost entries)

5 years agomanage pg_hba on sallinen
Peter Palfrader [Sun, 29 Sep 2019 19:15:05 +0000 (21:15 +0200)]
manage pg_hba on sallinen

5 years agoput a fqdn in a name in ftp_master_dak_replica
Peter Palfrader [Sun, 29 Sep 2019 19:13:02 +0000 (21:13 +0200)]
put a fqdn in a name in ftp_master_dak_replica

5 years agoroles::snapshot_db: make packages ignore conditional on running on buster
Peter Palfrader [Sun, 29 Sep 2019 19:09:02 +0000 (21:09 +0200)]
roles::snapshot_db: make packages ignore conditional on running on buster

5 years agoremove manual firewall allow leaseweb->snapshotdb-manda-01
Peter Palfrader [Sun, 29 Sep 2019 19:07:10 +0000 (21:07 +0200)]
remove manual firewall allow leaseweb->snapshotdb-manda-01

5 years agomanage pg_hba on snapshotdb-manda-01
Peter Palfrader [Sun, 29 Sep 2019 19:05:50 +0000 (21:05 +0200)]
manage pg_hba on snapshotdb-manda-01

5 years agomanage pg_hba on melartin
Peter Palfrader [Sun, 29 Sep 2019 18:50:14 +0000 (20:50 +0200)]
manage pg_hba on melartin

5 years agoremove manual firewall allow bmdb1->fasolo
Peter Palfrader [Sun, 29 Sep 2019 17:08:09 +0000 (19:08 +0200)]
remove manual firewall allow bmdb1->fasolo

5 years agounique names
Peter Palfrader [Sun, 29 Sep 2019 17:03:20 +0000 (19:03 +0200)]
unique names

5 years agoDo not require ssl on localhost
Peter Palfrader [Sun, 29 Sep 2019 17:02:19 +0000 (19:02 +0200)]
Do not require ssl on localhost

5 years agomove localhost guest access in front of catch-all localhost access
Peter Palfrader [Sun, 29 Sep 2019 17:00:45 +0000 (19:00 +0200)]
move localhost guest access in front of catch-all localhost access

5 years agoguest access for dak on ftp-master
Peter Palfrader [Sun, 29 Sep 2019 16:55:44 +0000 (18:55 +0200)]
guest access for dak on ftp-master

5 years agoFix spelling for a type
Peter Palfrader [Sun, 29 Sep 2019 16:52:11 +0000 (18:52 +0200)]
Fix spelling for a type

5 years agomanage pg_hba on fasolo
Peter Palfrader [Sun, 29 Sep 2019 16:50:17 +0000 (18:50 +0200)]
manage pg_hba on fasolo

5 years agomanage pg_hba on seger
Peter Palfrader [Sun, 29 Sep 2019 16:44:38 +0000 (18:44 +0200)]
manage pg_hba on seger

5 years agomanage pg_hba on vittoria
Peter Palfrader [Sun, 29 Sep 2019 16:43:23 +0000 (18:43 +0200)]
manage pg_hba on vittoria

5 years agoDo not enable replication from localhost
Peter Palfrader [Sun, 29 Sep 2019 16:42:19 +0000 (18:42 +0200)]
Do not enable replication from localhost

5 years agomanage pg_hba on buxtehude
Peter Palfrader [Sun, 29 Sep 2019 16:40:11 +0000 (18:40 +0200)]
manage pg_hba on buxtehude

5 years agoauth method trust also wants addresses
Peter Palfrader [Sun, 29 Sep 2019 14:38:41 +0000 (16:38 +0200)]
auth method trust also wants addresses

5 years agomanage debsources access to its DB on bmdb1
Peter Palfrader [Sun, 29 Sep 2019 14:36:38 +0000 (16:36 +0200)]
manage debsources access to its DB on bmdb1

5 years agoAllow us to gradually move a server with multiple clusters to move to managed hba
Peter Palfrader [Sun, 29 Sep 2019 14:30:28 +0000 (16:30 +0200)]
Allow us to gradually move a server with multiple clusters to move to managed hba

5 years agoallow the backup hosts to access the salsa pg again
Peter Palfrader [Sun, 29 Sep 2019 14:24:44 +0000 (16:24 +0200)]
allow the backup hosts to access the salsa pg again

5 years agoMerge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
Julien Cristau [Sun, 29 Sep 2019 14:21:12 +0000 (16:21 +0200)]
Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet

5 years agoVariables work better with $
Peter Palfrader [Sun, 29 Sep 2019 14:18:20 +0000 (16:18 +0200)]
Variables work better with $

5 years agofix ferm::rule::chain template
Peter Palfrader [Sun, 29 Sep 2019 14:17:15 +0000 (16:17 +0200)]
fix ferm::rule::chain template

5 years agoWe want variable expansion in this one
Peter Palfrader [Sun, 29 Sep 2019 14:16:23 +0000 (16:16 +0200)]
We want variable expansion in this one

5 years agoCreate an empty pg-nnn chain in case nobody else puts anything there
Peter Palfrader [Sun, 29 Sep 2019 14:14:46 +0000 (16:14 +0200)]
Create an empty pg-nnn chain in case nobody else puts anything there

5 years agopuppet rule to create an empty ferm chain
Peter Palfrader [Sun, 29 Sep 2019 14:13:55 +0000 (16:13 +0200)]
puppet rule to create an empty ferm chain

5 years agoeximconf: fix IPv4-only sending
Adam D. Barratt [Sun, 29 Sep 2019 14:11:20 +0000 (15:11 +0100)]
eximconf: fix IPv4-only sending

Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
5 years agoDon't hardcode bacula director host name
Julien Cristau [Sun, 29 Sep 2019 14:05:41 +0000 (16:05 +0200)]
Don't hardcode bacula director host name

5 years agobetter instance names for pg clusters
Peter Palfrader [Sun, 29 Sep 2019 14:00:57 +0000 (16:00 +0200)]
better instance names for pg clusters

5 years agoreload ferm when files are removed
Peter Palfrader [Sun, 29 Sep 2019 13:59:29 +0000 (15:59 +0200)]
reload ferm when files are removed

5 years agoroles::postgresql::server now sets up postgres::cluster for all clusters
Peter Palfrader [Sun, 29 Sep 2019 13:53:43 +0000 (15:53 +0200)]
roles::postgresql::server now sets up postgres::cluster for all clusters

Setting up backup moved to postgres::cluster which includes
postgres::backup_cluster if requested.

All the backup firewall access should be done via pg_hba entries now.

5 years agofail2ban: use "host_info" template expression
Adam D. Barratt [Sun, 29 Sep 2019 13:37:08 +0000 (14:37 +0100)]
fail2ban: use "host_info" template expression

This correctly handles items such as the port number that is now
included in log entries

Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
5 years agofail2ban: fix case-insensitive match in dsa-exim-strict
Adam D. Barratt [Sun, 29 Sep 2019 13:35:07 +0000 (14:35 +0100)]
fail2ban: fix case-insensitive match in dsa-exim-strict

Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
5 years agofail2ban: set explicit encoding for exim logs
Adam D. Barratt [Sun, 29 Sep 2019 13:34:08 +0000 (14:34 +0100)]
fail2ban: set explicit encoding for exim logs

Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
5 years agoeximconf: expand comments related to retries
Adam D. Barratt [Sun, 29 Sep 2019 13:33:50 +0000 (14:33 +0100)]
eximconf: expand comments related to retries

Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
5 years agofix entry name
Peter Palfrader [Sun, 29 Sep 2019 13:29:43 +0000 (15:29 +0200)]
fix entry name

5 years agoMake the bacula director node request DB access from its role
Peter Palfrader [Sun, 29 Sep 2019 13:27:54 +0000 (15:27 +0200)]
Make the bacula director node request DB access from its role

5 years agoMake the bacula storage node request DB access from its role
Peter Palfrader [Sun, 29 Sep 2019 13:24:51 +0000 (15:24 +0200)]
Make the bacula storage node request DB access from its role

5 years agoAlso collect entries that only knew the port
Peter Palfrader [Sun, 29 Sep 2019 13:23:08 +0000 (15:23 +0200)]
Also collect entries that only knew the port

5 years agowe care about the first element of the array
Peter Palfrader [Sun, 29 Sep 2019 13:19:25 +0000 (15:19 +0200)]
we care about the first element of the array

5 years agoproviding either a port or a version/clustername pair to hba_entry should suffice
Peter Palfrader [Sun, 29 Sep 2019 13:17:17 +0000 (15:17 +0200)]
providing either a port or a version/clustername pair to hba_entry should suffice

5 years agoeximconf: fix typo in comment
Julien Cristau [Sun, 29 Sep 2019 11:50:54 +0000 (13:50 +0200)]
eximconf: fix typo in comment

5 years agoMerge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
Julien Cristau [Sun, 29 Sep 2019 11:48:50 +0000 (13:48 +0200)]
Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet

5 years agounique postgres::cluster::hba_entry names for hosts with more than one cluster
Peter Palfrader [Sun, 29 Sep 2019 10:43:19 +0000 (12:43 +0200)]
unique postgres::cluster::hba_entry names for hosts with more than one cluster

5 years agoMove backup replication hba_entry to backup_cluster
Peter Palfrader [Sun, 29 Sep 2019 10:39:59 +0000 (12:39 +0200)]
Move backup replication hba_entry to backup_cluster

5 years agoRemove manual fw for dinis/storace access to postgresql-manda-01
Peter Palfrader [Sun, 29 Sep 2019 09:02:18 +0000 (11:02 +0200)]
Remove manual fw for dinis/storace access to postgresql-manda-01

5 years agoFirst attempt to configure pg_hba of the bacula cluster
Peter Palfrader [Sun, 29 Sep 2019 09:00:37 +0000 (11:00 +0200)]
First attempt to configure pg_hba of the bacula cluster

We will want to split this and hardcode less in the future.

5 years agoStart with pg cluster configuration
Peter Palfrader [Sun, 29 Sep 2019 08:57:49 +0000 (10:57 +0200)]
Start with pg cluster configuration

5 years agofirwalling for pg basebackup
Peter Palfrader [Sat, 28 Sep 2019 20:18:02 +0000 (22:18 +0200)]
firwalling for pg basebackup

5 years agoFix path in postgres-make-base-backups file redirection
Peter Palfrader [Sat, 28 Sep 2019 20:08:36 +0000 (22:08 +0200)]
Fix path in postgres-make-base-backups file redirection

5 years agoold-style roles are gone
Peter Palfrader [Sat, 28 Sep 2019 19:47:56 +0000 (21:47 +0200)]
old-style roles are gone

5 years agoenable snapshotdb-manda-01.debian.org to read sallinen's backups
Peter Palfrader [Sat, 28 Sep 2019 19:45:14 +0000 (21:45 +0200)]
enable snapshotdb-manda-01.debian.org to read sallinen's backups

5 years agolw07 no longer runs a snapshot pg db
Peter Palfrader [Sat, 28 Sep 2019 19:39:58 +0000 (21:39 +0200)]
lw07 no longer runs a snapshot pg db

5 years agoTry to configure --read-allow via hiera
Peter Palfrader [Sat, 28 Sep 2019 19:30:55 +0000 (21:30 +0200)]
Try to configure --read-allow via hiera

5 years agomove debbackup-ssh-wrap from dsa-misc to puppet
Peter Palfrader [Sat, 28 Sep 2019 19:16:13 +0000 (21:16 +0200)]
move debbackup-ssh-wrap from dsa-misc to puppet

5 years agoTry to modernize pg wal shipping ssh setup, step 2
Peter Palfrader [Sat, 28 Sep 2019 19:13:27 +0000 (21:13 +0200)]
Try to modernize pg wal shipping ssh setup, step 2

5 years agoTry to modernize pg wal shipping ssh setup
Peter Palfrader [Sat, 28 Sep 2019 19:07:28 +0000 (21:07 +0200)]
Try to modernize pg wal shipping ssh setup

5 years agoUse template variable from the correct scope
Peter Palfrader [Sat, 28 Sep 2019 19:01:41 +0000 (21:01 +0200)]
Use template variable from the correct scope

5 years agofix a class name
Peter Palfrader [Sat, 28 Sep 2019 18:59:17 +0000 (20:59 +0200)]
fix a class name

5 years agoReplace debbackup with parameterized username in most places
Peter Palfrader [Sat, 28 Sep 2019 18:58:10 +0000 (20:58 +0200)]
Replace debbackup with parameterized username in most places

5 years agocleanup
Peter Palfrader [Sat, 28 Sep 2019 18:50:49 +0000 (20:50 +0200)]
cleanup

5 years agoTry something else to get a default for postgres::backup_cluster::db_backup_role
Peter Palfrader [Sat, 28 Sep 2019 18:48:16 +0000 (20:48 +0200)]
Try something else to get a default for postgres::backup_cluster::db_backup_role

5 years agowhitespace
Peter Palfrader [Sat, 28 Sep 2019 18:44:46 +0000 (20:44 +0200)]
whitespace

5 years agoMove backup role name to hiera
Peter Palfrader [Sat, 28 Sep 2019 18:30:27 +0000 (20:30 +0200)]
Move backup role name to hiera

5 years agoMove pg-receive-file-from-backup to postgres module
Peter Palfrader [Sat, 28 Sep 2019 18:28:32 +0000 (20:28 +0200)]
Move pg-receive-file-from-backup to postgres module

5 years agofix paths
Peter Palfrader [Sat, 28 Sep 2019 18:27:20 +0000 (20:27 +0200)]
fix paths

5 years agopg-backup-file.conf.erb: Remove obsolete special casing
Peter Palfrader [Sat, 28 Sep 2019 18:26:39 +0000 (20:26 +0200)]
pg-backup-file.conf.erb: Remove obsolete special casing

5 years agoMove files for pg-backup-file from roles to postgres module
Peter Palfrader [Sat, 28 Sep 2019 18:25:07 +0000 (20:25 +0200)]
Move files for pg-backup-file from roles to postgres module

5 years agoMove backup-server specific sudoers entries out of debian-global sudo
Peter Palfrader [Sat, 28 Sep 2019 18:20:37 +0000 (20:20 +0200)]
Move backup-server specific sudoers entries out of debian-global sudo

5 years agoMove $make_base_backups to postgres::backup_server as it is local there; make some...
Peter Palfrader [Sat, 28 Sep 2019 18:14:21 +0000 (20:14 +0200)]
Move $make_base_backups to postgres::backup_server as it is local there; make some strings in postgres::backup_server::globals parameters

5 years agosibelius and chopin no longer run relevant pg instances or even exist
Peter Palfrader [Sat, 28 Sep 2019 17:59:51 +0000 (19:59 +0200)]
sibelius and chopin no longer run relevant pg instances or even exist

5 years agorename dsa-check-backuppg-manual.conf
Peter Palfrader [Sat, 28 Sep 2019 17:58:53 +0000 (19:58 +0200)]
rename dsa-check-backuppg-manual.conf

5 years agomigrate away from old postgres_backup_server role
Peter Palfrader [Sat, 28 Sep 2019 17:53:19 +0000 (19:53 +0200)]
migrate away from old postgres_backup_server role

5 years agonote why lw07 and snapshotdb-manda-01 are still in postgresql_server in data/common...
Peter Palfrader [Sat, 28 Sep 2019 17:47:59 +0000 (19:47 +0200)]
note why lw07 and snapshotdb-manda-01 are still in postgresql_server in data/common.yaml

5 years agoFix crontab entry
Peter Palfrader [Sat, 28 Sep 2019 17:40:43 +0000 (19:40 +0200)]
Fix crontab entry

5 years agopg cluster facter: port is an integer
Peter Palfrader [Sat, 28 Sep 2019 17:37:20 +0000 (19:37 +0200)]
pg cluster facter: port is an integer

5 years agoTypes for params of postgres::backup_cluster
Peter Palfrader [Sat, 28 Sep 2019 17:35:38 +0000 (19:35 +0200)]
Types for params of postgres::backup_cluster

5 years agomodules/postgres/manifests: quoting, spacing, linting
Peter Palfrader [Sat, 28 Sep 2019 17:31:37 +0000 (19:31 +0200)]
modules/postgres/manifests: quoting, spacing, linting