Peter Palfrader [Fri, 30 Aug 2019 10:20:18 +0000 (12:20 +0200)]
Now that we have site included before hiera things, we can do this again
Peter Palfrader [Fri, 30 Aug 2019 10:15:44 +0000 (12:15 +0200)]
having a module named site is really annoying
Peter Palfrader [Fri, 30 Aug 2019 10:10:15 +0000 (12:10 +0200)]
Move the single ipsec tunnel we have to my new system.
There are named ipsec "networks". And any host that is in a named
network will set up ipsec to all the other hosts on that network.
A host can be on more than one network at a time.
Currently we only have the fasolo-storace tunnel, though. It is
configured in modules/profile/manifests/ipsec/fasolo_storace.pp.
Peter Palfrader [Fri, 30 Aug 2019 06:58:35 +0000 (08:58 +0200)]
remove olin from bmdb1 access
olin does not need access to a postgres cluster. It was in the list
since its old IP address was in the list. That IP address was
previously used by oyens.debian.org, which was the openstack keystone
host before it was retired. It seems the IP address was not removed
from the access list, and then olin inherited it.
Aurelien Jarno [Thu, 29 Aug 2019 21:47:10 +0000 (23:47 +0200)]
multipath: remove olin (moved to csail)
Peter Palfrader [Thu, 29 Aug 2019 18:32:36 +0000 (20:32 +0200)]
move loghost from a "role" in hieradata/common.yaml to a role that is included via hiera
Peter Palfrader [Thu, 29 Aug 2019 18:22:57 +0000 (20:22 +0200)]
dsa_lvm is empty. remove it
Peter Palfrader [Thu, 29 Aug 2019 18:22:19 +0000 (20:22 +0200)]
The previos LVM config for the ppc cluster did not have issue_discards. Let's keep it that way.
Peter Palfrader [Thu, 29 Aug 2019 18:20:51 +0000 (20:20 +0200)]
spell OSUOSL better
Peter Palfrader [Thu, 29 Aug 2019 18:18:55 +0000 (20:18 +0200)]
transition osuosl ppc cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:12:46 +0000 (20:12 +0200)]
the arm ganeti cluster also wants issue_discards in its lvm config
Peter Palfrader [Thu, 29 Aug 2019 18:08:45 +0000 (20:08 +0200)]
transition ubc arm cluster to new lvm config
Similar to the cluster at conova, this effectively replaces filter
with global_filter, and re-enables monitoring. Also, explicitly set
preferred_names to the empty list.
Peter Palfrader [Thu, 29 Aug 2019 17:47:58 +0000 (19:47 +0200)]
fix filter setting for conova lvm
Peter Palfrader [Thu, 29 Aug 2019 17:43:51 +0000 (19:43 +0200)]
transition conova cluster to new lvm config
This re-enables use_lvmetad and monitoring which were disabled two years
ago. We will find out if this breaks anything. Maybe with the use
of global_filter instead of just filter it'll be fine.
Peter Palfrader [Thu, 29 Aug 2019 17:39:35 +0000 (19:39 +0200)]
also remove obsolete lvm-grnet-nodeX-ganeti.conf file
Peter Palfrader [Thu, 29 Aug 2019 17:35:18 +0000 (19:35 +0200)]
transition prokofiev to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:20:51 +0000 (19:20 +0200)]
transition grnet cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 17:12:38 +0000 (19:12 +0200)]
transition csail cluster to new lvm config, 2
Peter Palfrader [Thu, 29 Aug 2019 17:11:21 +0000 (19:11 +0200)]
transition csail cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 16:47:41 +0000 (18:47 +0200)]
transition bm cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 16:26:39 +0000 (18:26 +0200)]
transition manda cluster to new lvm config, 4
Peter Palfrader [Thu, 29 Aug 2019 16:25:31 +0000 (18:25 +0200)]
transition manda cluster to new lvm config, 3
Peter Palfrader [Thu, 29 Aug 2019 16:25:09 +0000 (18:25 +0200)]
transition manda cluster to new lvm config, 2
Peter Palfrader [Thu, 29 Aug 2019 16:24:15 +0000 (18:24 +0200)]
transition manda cluster to new lvm config
Peter Palfrader [Thu, 29 Aug 2019 16:11:37 +0000 (18:11 +0200)]
move ubc-enc2bl02, ubc-enc2bl09 and ubc-enc2bl10 to the new LVM config module
Peter Palfrader [Thu, 29 Aug 2019 15:58:14 +0000 (17:58 +0200)]
define the update-initramfs exec
Peter Palfrader [Thu, 29 Aug 2019 15:56:31 +0000 (17:56 +0200)]
move the ubc-enc2bl01 LVM config to a profile included via hiera using the new LVM module
Peter Palfrader [Thu, 29 Aug 2019 15:08:40 +0000 (17:08 +0200)]
An lvm module that can set issue_discards and global_filter
Peter Palfrader [Thu, 29 Aug 2019 15:07:08 +0000 (17:07 +0200)]
Add a pristine stretch and buster lvm.conf as a template for some lvm reconciliation work
Peter Palfrader [Thu, 29 Aug 2019 15:50:09 +0000 (17:50 +0200)]
The syntax check won't let me include our site module, probably due to its name. Try via hiera, but merge it into base eventually
Peter Palfrader [Thu, 29 Aug 2019 15:49:40 +0000 (17:49 +0200)]
The syntax check won't let me include our site module, probably due to its name
Peter Palfrader [Thu, 29 Aug 2019 15:40:49 +0000 (17:40 +0200)]
actually add the base module
Peter Palfrader [Thu, 29 Aug 2019 15:39:34 +0000 (17:39 +0200)]
move all the unconditional includes from the top-level site.pp into a base module which gets included by the default hiera entry
Peter Palfrader [Thu, 29 Aug 2019 15:35:10 +0000 (17:35 +0200)]
Include hiera classes
We want to be able to specify which puppet classes a node should include
using hiera. Start by including hiera classes in the site manifest,
and move the site class so we include something using this mechanism.
Eventually we want to move all the include entries out of manifests/site.pp.
Peter Palfrader [Wed, 28 Aug 2019 11:20:55 +0000 (13:20 +0200)]
update anonscm.map from formorer
Aurelien Jarno [Wed, 28 Aug 2019 10:17:21 +0000 (12:17 +0200)]
Fix another typo
Aurelien Jarno [Wed, 28 Aug 2019 10:09:56 +0000 (12:09 +0200)]
Fix typo in merged_usr fact
Aurelien Jarno [Wed, 28 Aug 2019 10:07:00 +0000 (12:07 +0200)]
samhainrc: support merged usr layout
Aurelien Jarno [Wed, 28 Aug 2019 10:07:00 +0000 (12:07 +0200)]
Add a merged_usr fact
Aurelien Jarno [Wed, 28 Aug 2019 08:46:44 +0000 (10:46 +0200)]
Fix CSAIL IPv6 subnet
Julien Cristau [Wed, 28 Aug 2019 08:29:26 +0000 (10:29 +0200)]
Remove debconf18 vhost from debussy
It moved to static.
Aurelien Jarno [Wed, 28 Aug 2019 08:04:45 +0000 (10:04 +0200)]
ferm: drop FREEBSD_SSH_ACCESS
Aurelien Jarno [Wed, 28 Aug 2019 08:03:33 +0000 (10:03 +0200)]
ferm: add syncproxy.na.debian.org IPv6
Aurelien Jarno [Wed, 28 Aug 2019 07:54:39 +0000 (09:54 +0200)]
Add CSAIL IPv6 range
Paul Wise [Sun, 25 Aug 2019 03:48:59 +0000 (11:48 +0800)]
Bump the language cookie expiry for visits during the expiry period
This ensures that if the user continues to visit the website then
they don't have to manually set the cookie again until they
stop visiting the website for more than the expiry period.
Julien Cristau [Thu, 22 Aug 2019 09:38:42 +0000 (11:38 +0200)]
Enable linger for sreview user (RT#7917)
Peter Palfrader [Thu, 22 Aug 2019 08:58:52 +0000 (10:58 +0200)]
fix ssl client path
Peter Palfrader [Thu, 22 Aug 2019 08:55:49 +0000 (10:55 +0200)]
stop hardcoding loghost names in syslog-ng template
Peter Palfrader [Thu, 22 Aug 2019 08:47:51 +0000 (10:47 +0200)]
move syslog ferm into syslog role
Peter Palfrader [Thu, 22 Aug 2019 08:44:27 +0000 (10:44 +0200)]
make loghost into a role
Julien Cristau [Tue, 20 Aug 2019 14:16:17 +0000 (16:16 +0200)]
No more sid/bullseye chroots for mips
Philipp Kern [Sun, 18 Aug 2019 09:10:55 +0000 (11:10 +0200)]
RT#7893 Let wanna-build admins sudo to wbadm-web
Tollef Fog Heen [Thu, 15 Aug 2019 19:14:58 +0000 (21:14 +0200)]
RT#7862 Let the community team sudo to the community user
Julien Cristau [Tue, 13 Aug 2019 14:53:47 +0000 (16:53 +0200)]
Handle ipv6 addresses in named.conf.options
Aurelien Jarno [Tue, 13 Aug 2019 10:26:12 +0000 (12:26 +0200)]
Add mipsel-osuosl-02.debian.org
Paul Wise [Sun, 11 Aug 2019 09:31:09 +0000 (17:31 +0800)]
Redirect unsetlang to the correct location
The substitution was using the wrong match group.
Fixes: commit
eef0d1229a8d2627ffc8663eda9bd2d68a0ef09c
Paul Wise [Sun, 11 Aug 2019 04:18:21 +0000 (12:18 +0800)]
Set the cookie domain based on the HTTP domain.
Avoids issues with setting cookies on www-staging.d.o or other mirrors.
Fixes: commit
eef0d1229a8d2627ffc8663eda9bd2d68a0ef09c
Paul Wise [Sat, 3 Aug 2019 02:23:04 +0000 (10:23 +0800)]
Add basic support for influencing language selection via cookies.
The UI for language selection in browsers is rarely used or known about
by visitors so websites need to provide a way for visitors to influence
content negotiation using the website itself in addition to the browser.
Setting a cookie is the simplest option for us as the URLs don't change.
The GDPR does not apply and to satisfy the EU cookie law we can include
some explanatory text around the form that sets the cookie.
Visitors should not get their language cookie changed when other folks link
them to URLs for other languages and search engines should not set language
cookies at all. Using POST requests ensures each cookie is only set explictly.
Since Apache mod_rewrite cannot inspect POST data, we use URLs instead.
The default cookie lifetime is about one month (60*24*7*4 minutes).
<CAKTje6EzfE89jBqpLQu1_a3ybYkV7pPcquKzQb6Uz8uu=pGudA@mail.gmail.com>
<
f849fde79a325422af9a9553f6672a96382ae262.camel@debian.org>
https://httpd.apache.org/docs/current/content-negotiation.html#exceptions
Aurelien Jarno [Sat, 10 Aug 2019 07:45:01 +0000 (09:45 +0200)]
Add mipsel-osuosl-01.debian.org
Julien Cristau [Fri, 9 Aug 2019 14:03:47 +0000 (16:03 +0200)]
Add sso_rp role on wuiet (RT#7892)
Stefano Rivera [Tue, 30 Jul 2019 14:50:06 +0000 (11:50 -0300)]
debconf20.dc.o vhost
Stefano Rivera [Tue, 30 Jul 2019 00:28:24 +0000 (21:28 -0300)]
Switch wafertest to dc20
Aurelien Jarno [Fri, 26 Jul 2019 15:05:13 +0000 (17:05 +0200)]
samhain: ignore /etc/exim4/conf.d
This directory is removed by puppet
Paul Wise [Tue, 23 Jul 2019 23:46:37 +0000 (07:46 +0800)]
Enable proxy module for wiki.debconf.org pass-thru rewrite
Fixes: commit
f33e5b0b7749df9e3bf60b7b816898f3d07ecc8b
Fixes: commit
f3cf7b1e16b58065689c4ae0ded3e41d6782fb13
Requested-by: tumbleweed on #debian-admin
Paul Wise [Tue, 23 Jul 2019 23:40:11 +0000 (07:40 +0800)]
Enable proxy module for wiki.debconf.org pass-thru rewrite
Fixes: commit
f33e5b0b7749df9e3bf60b7b816898f3d07ecc8b
Requested-by: tumbleweed on #debian-admin
Tollef Fog Heen [Tue, 23 Jul 2019 20:12:25 +0000 (22:12 +0200)]
Merge branch 'pass-through-slash' of https://salsa.debian.org/stefanor/dsa-puppet
Signed-off-by: Tollef Fog Heen <tfheen@err.no>
Stefano Rivera [Tue, 23 Jul 2019 19:44:26 +0000 (16:44 -0300)]
PassThrough / to /wiki/
So that the response has a Content-Type header (via the ForceType on
/wiki/).
Peter Palfrader [Fri, 19 Jul 2019 14:05:22 +0000 (16:05 +0200)]
Block 198.108.67.48 from security mirrors for breaking rsync
Peter Palfrader [Fri, 19 Jul 2019 11:01:39 +0000 (13:01 +0200)]
move pg rule from veyepar to sreview
Peter Palfrader [Fri, 19 Jul 2019 10:06:13 +0000 (12:06 +0200)]
Allow DC19 access to the PG on vittoria, re: RT#7845
Peter Palfrader [Fri, 19 Jul 2019 09:57:41 +0000 (11:57 +0200)]
sreview is sreview.debian.net
Peter Palfrader [Fri, 19 Jul 2019 09:55:53 +0000 (11:55 +0200)]
Move veyepar and sreview into own manifests
Peter Palfrader [Thu, 18 Jul 2019 11:32:26 +0000 (13:32 +0200)]
www.do: stop doing permanent redirects
Permanent redirects may be cached permanently. Don't do that.
Laura Arjona Reina [Thu, 18 Jul 2019 11:10:43 +0000 (13:10 +0200)]
Add redirects for all the /misc section, and group all the redirects related to /misc
Signed-off-by: Peter Palfrader <peter@palfrader.org>
Aurelien Jarno [Mon, 8 Jul 2019 19:28:05 +0000 (21:28 +0200)]
manda: entropykey moved from czerny to manda-node04
Peter Palfrader [Sun, 7 Jul 2019 18:54:16 +0000 (20:54 +0200)]
give keyring the ability to reload bind9
Peter Palfrader [Sun, 7 Jul 2019 18:14:18 +0000 (20:14 +0200)]
Notify on _openpgpkey.debian.org
Peter Palfrader [Sun, 7 Jul 2019 18:12:11 +0000 (20:12 +0200)]
do nsec3 via puppet
Peter Palfrader [Sun, 7 Jul 2019 18:09:38 +0000 (20:09 +0200)]
Sign _openpgpkey.debian.org
Peter Palfrader [Sun, 7 Jul 2019 18:05:49 +0000 (20:05 +0200)]
Add a flag to the dns-helper tooling
Peter Palfrader [Sun, 7 Jul 2019 18:04:05 +0000 (20:04 +0200)]
Add a flag to the dns-helper tooling
Peter Palfrader [Sun, 7 Jul 2019 10:16:27 +0000 (12:16 +0200)]
geo ferm
Peter Palfrader [Sun, 7 Jul 2019 10:15:26 +0000 (12:15 +0200)]
geo ferm
Peter Palfrader [Sun, 7 Jul 2019 10:13:50 +0000 (12:13 +0200)]
fw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:09:22 +0000 (12:09 +0200)]
fw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:07:32 +0000 (12:07 +0200)]
fw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:06:39 +0000 (12:06 +0200)]
fw on kaufmann
Peter Palfrader [Sun, 7 Jul 2019 10:04:33 +0000 (12:04 +0200)]
notify bind9
Peter Palfrader [Sun, 7 Jul 2019 10:04:09 +0000 (12:04 +0200)]
Set masters
Peter Palfrader [Sun, 7 Jul 2019 10:01:30 +0000 (12:01 +0200)]
Fetch openpgpkey zone to denis
Peter Palfrader [Sun, 7 Jul 2019 10:01:23 +0000 (12:01 +0200)]
reindent
Peter Palfrader [Sun, 7 Jul 2019 09:56:49 +0000 (11:56 +0200)]
We no longer have secondaries for the debian zones
Peter Palfrader [Sun, 7 Jul 2019 09:42:39 +0000 (11:42 +0200)]
add a ;
Peter Palfrader [Sun, 7 Jul 2019 09:38:16 +0000 (11:38 +0200)]
Try to add openpgpkey zone
Peter Palfrader [Sun, 7 Jul 2019 09:31:36 +0000 (11:31 +0200)]
fix array
Peter Palfrader [Sun, 7 Jul 2019 09:31:15 +0000 (11:31 +0200)]
set up a shared keypair between kaufmann and denis
Peter Palfrader [Sun, 7 Jul 2019 09:29:48 +0000 (11:29 +0200)]
reorder ACLs and shared keys on primary
Peter Palfrader [Sun, 7 Jul 2019 09:26:59 +0000 (11:26 +0200)]
Include local shared keys on primary
Peter Palfrader [Sun, 7 Jul 2019 09:23:19 +0000 (11:23 +0200)]
move ACLs for 3rd party things from the named.conf.options template to named.conf.puppet-misc
Peter Palfrader [Sun, 7 Jul 2019 09:10:42 +0000 (11:10 +0200)]
Add a named.conf.puppet-misc