mirror/dsa-puppet.git
5 years agodgit_{browse,git} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:31:35 +0000 (15:31 +0200)]
dgit_{browse,git} -> hiera role; explicitly include apache2

5 years agosearch_{frontend,backend} -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:29:07 +0000 (15:29 +0200)]
search_{frontend,backend} -> hiera role; explicitly include apache2

5 years agopeople -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:26:04 +0000 (15:26 +0200)]
people -> hiera role; explicitly include apache2

5 years agodebtags -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:22:28 +0000 (15:22 +0200)]
debtags -> hiera role; explicitly include apache2

5 years agocontributors -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:20:03 +0000 (15:20 +0200)]
contributors -> hiera role; explicitly include apache2

5 years agowhitespace/quoting: modules/roles/manifests/nm.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 13:19:14 +0000 (15:19 +0200)]
whitespace/quoting: modules/roles/manifests/nm.pp (make lint happy)

5 years agonm -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:18:11 +0000 (15:18 +0200)]
nm -> hiera role; explicitly include apache2

5 years agodedup -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:15:58 +0000 (15:15 +0200)]
dedup -> hiera role; explicitly include apache2

5 years agoOne of the last changes broke dbmaster role based ferm rules
Peter Palfrader [Sun, 15 Sep 2019 13:11:28 +0000 (15:11 +0200)]
One of the last changes broke dbmaster role based ferm rules

In particular, we allowed HOST_DB ssh to all our hosts.  That does not
make semantic sense, since the db host does not need to ssh to all the
other hosts (the reverse is true).

However, since draghi makes for a useful fallback jumphost, we now
explictly allow it.  We need to figure something out for the other role
based ferm rules.

5 years agodo not use role-based ssh restrict
Peter Palfrader [Sun, 15 Sep 2019 13:06:30 +0000 (15:06 +0200)]
do not use role-based ssh restrict

For now we fall back to and continue to use hostnames, but we should
switch this to something more sane longterm.

5 years agowhitespace/quoting: modules/roles/manifests/dbmaster.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 13:03:43 +0000 (15:03 +0200)]
whitespace/quoting: modules/roles/manifests/dbpp (make lint happy)

5 years agohiera -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:02:50 +0000 (15:02 +0200)]
hiera -> hiera role; explicitly include apache2

5 years agoapi.ftp-master -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 13:00:31 +0000 (15:00 +0200)]
api.ftp-master -> hiera role; explicitly include apache2

5 years agopiuparts* -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 12:57:01 +0000 (14:57 +0200)]
piuparts* -> hiera role; explicitly include apache2

5 years agowhitespace/quoting: modules/roles/manifests/piuparts* (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 12:55:00 +0000 (14:55 +0200)]
whitespace/quoting: modules/roles/manifests/piuparts* (make lint happy)

5 years agotracker -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 12:53:08 +0000 (14:53 +0200)]
tracker -> hiera role; explicitly include apache2

5 years agowhitespace/quoting: modules/roles/manifests/tracker.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 12:51:43 +0000 (14:51 +0200)]
whitespace/quoting: modules/roles/manifests/tracker.pp (make lint happy)

5 years agowhitespace/quoting: modules/roles/manifests/vote.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 12:50:01 +0000 (14:50 +0200)]
whitespace/quoting: modules/roles/manifests/vote.pp (make lint happy)

5 years agovote -> hiera role; explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 12:48:45 +0000 (14:48 +0200)]
vote -> hiera role; explicitly include apache2

5 years agodebconf_wafer -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 08:18:03 +0000 (10:18 +0200)]
debconf_wafer -> hiera role

5 years agodebconf_wafer: explicitly include apache2
Peter Palfrader [Sun, 15 Sep 2019 08:17:47 +0000 (10:17 +0200)]
debconf_wafer: explicitly include apache2

5 years agowhitespace/quoting: modules/roles/manifests/debconf_wafer.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 08:17:19 +0000 (10:17 +0200)]
whitespace/quoting: modules/roles/manifests/debconf_wafer.pp (make lint happy)

5 years agoapache2: merge ipv4 and ipv6 ferm rule
Peter Palfrader [Sun, 15 Sep 2019 08:11:59 +0000 (10:11 +0200)]
apache2: merge ipv4 and ipv6 ferm rule

5 years agoand note that casulana's apache is not public
Peter Palfrader [Sun, 15 Sep 2019 08:11:00 +0000 (10:11 +0200)]
and note that casulana's apache is not public

5 years agocdbuilder_local_mirror role cleanup
Peter Palfrader [Sun, 15 Sep 2019 08:09:45 +0000 (10:09 +0200)]
cdbuilder_local_mirror role cleanup

5 years agowhitespace/quoting: modules/roles/manifests/cdbuilder_local_mirror.pp (make lint...
Peter Palfrader [Sun, 15 Sep 2019 08:03:54 +0000 (10:03 +0200)]
whitespace/quoting: modules/roles/manifests/cdbuilder_local_mirror.pp (make lint happy)

5 years agobugs role cleanup
Peter Palfrader [Sun, 15 Sep 2019 07:59:12 +0000 (09:59 +0200)]
bugs role cleanup

5 years agoMake apache nproc rlimit not depend on role memberships
Peter Palfrader [Sun, 15 Sep 2019 07:56:42 +0000 (09:56 +0200)]
Make apache nproc rlimit not depend on role memberships

5 years agoFix bugs_mirror role include for beach
Peter Palfrader [Sun, 15 Sep 2019 07:48:36 +0000 (09:48 +0200)]
Fix bugs_mirror role include for beach

5 years agoMake apache worker config not depend on role memberships
Peter Palfrader [Sun, 15 Sep 2019 07:47:05 +0000 (09:47 +0200)]
Make apache worker config not depend on role memberships

5 years agowhitespace change only: modules/apache2/manifests/init.pp (make lint happy)
Peter Palfrader [Sun, 15 Sep 2019 07:42:12 +0000 (09:42 +0200)]
whitespace change only: modules/apache2/manifests/init.pp (make lint happy)

5 years agoMake the lists class include apache2
Peter Palfrader [Sun, 15 Sep 2019 07:31:00 +0000 (09:31 +0200)]
Make the lists class include apache2

5 years agoroles/lists: whitespace change
Peter Palfrader [Sun, 15 Sep 2019 07:30:25 +0000 (09:30 +0200)]
roles/lists: whitespace change

5 years agolists -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 07:28:23 +0000 (09:28 +0200)]
lists -> hiera role

5 years agopostfix: whether or not we touch main.cf is not dependent on membership in the lists...
Peter Palfrader [Sun, 15 Sep 2019 07:26:01 +0000 (09:26 +0200)]
postfix: whether or not we touch main.cf is not dependent on membership in the lists role

5 years agopostfix/init: whitespace change
Peter Palfrader [Sun, 15 Sep 2019 07:24:05 +0000 (09:24 +0200)]
postfix/init: whitespace change

5 years agobugs_mirror -> hiera role
Peter Palfrader [Sun, 15 Sep 2019 07:18:22 +0000 (09:18 +0200)]
bugs_mirror -> hiera role

5 years agoMake the bugs_mirror class include apache2
Peter Palfrader [Sun, 15 Sep 2019 07:18:10 +0000 (09:18 +0200)]
Make the bugs_mirror class include apache2

5 years agoDo tcp bbr and fq scheduling not only on busy hosts but all of them
Peter Palfrader [Sun, 15 Sep 2019 06:56:31 +0000 (08:56 +0200)]
Do tcp bbr and fq scheduling not only on busy hosts but all of them

5 years agortc -> hiera role
Peter Palfrader [Sat, 14 Sep 2019 22:34:31 +0000 (00:34 +0200)]
rtc -> hiera role

5 years agokeyring -> hiera role
Peter Palfrader [Sat, 14 Sep 2019 22:31:41 +0000 (00:31 +0200)]
keyring -> hiera role

5 years agoweblog_destination -> hiera role
Peter Palfrader [Sat, 14 Sep 2019 21:51:31 +0000 (23:51 +0200)]
weblog_destination -> hiera role

5 years agoEvery weblog provider except mirror-umn is a static_mirror_web. So include weblog...
Peter Palfrader [Sat, 14 Sep 2019 21:50:36 +0000 (23:50 +0200)]
Every weblog provider except mirror-umn is a static_mirror_web.  So include weblog provider from static_mirror_web.  umn was one of those at one point but is not at the time.  this effectively drops it from the weblog providers

5 years agoswitch weblogsync to other ssh facter
Peter Palfrader [Sat, 14 Sep 2019 21:46:48 +0000 (23:46 +0200)]
switch weblogsync to other ssh facter

5 years agoinsecure_ssl "role" -> ssl class parameter
Peter Palfrader [Sat, 14 Sep 2019 21:41:26 +0000 (23:41 +0200)]
insecure_ssl "role" -> ssl class parameter

5 years agosalsa -> hiera role
Peter Palfrader [Sat, 14 Sep 2019 21:36:27 +0000 (23:36 +0200)]
salsa -> hiera role

5 years agosreview, veyepar -> hiera role
Peter Palfrader [Sat, 14 Sep 2019 21:34:18 +0000 (23:34 +0200)]
sreview, veyepar -> hiera role

5 years agoanonscm -> hiera role
Peter Palfrader [Sat, 14 Sep 2019 21:30:05 +0000 (23:30 +0200)]
anonscm -> hiera role

5 years agono hosts (directly) in roles::archvsync_base
Peter Palfrader [Sat, 14 Sep 2019 21:28:05 +0000 (23:28 +0200)]
no hosts (directly) in roles::archvsync_base

5 years agothe ipsec role is no longer relevant. both nodes in it load profile::ipsec::fasolo_s...
Peter Palfrader [Sat, 14 Sep 2019 21:16:16 +0000 (23:16 +0200)]
the ipsec role is no longer relevant.  both nodes in it load profile::ipsec::fasolo_storace

5 years agoalioth_archive -> hiera role
Peter Palfrader [Sat, 14 Sep 2019 21:13:02 +0000 (23:13 +0200)]
alioth_archive -> hiera role

5 years agoWe no longer need the roleaccounts staticsync fact, we are using the new ssh_keys_use...
Peter Palfrader [Sat, 14 Sep 2019 14:53:17 +0000 (16:53 +0200)]
We no longer need the roleaccounts staticsync fact, we are using the new ssh_keys_users fact instead

5 years agoswitch the statis hosts to hiera roles
Peter Palfrader [Sat, 14 Sep 2019 14:49:34 +0000 (16:49 +0200)]
switch the statis hosts to hiera roles

5 years agoreplace some checks for roles::static_master with staticync::static_master
Peter Palfrader [Sat, 14 Sep 2019 14:41:28 +0000 (16:41 +0200)]
replace some checks for roles::static_master with staticync::static_master

5 years agoSwitch to collected clients.conf
Peter Palfrader [Sat, 14 Sep 2019 14:39:34 +0000 (16:39 +0200)]
Switch to collected clients.conf

5 years agoMerge branch 'staticsync-as-a-module'
Peter Palfrader [Sat, 14 Sep 2019 14:24:04 +0000 (16:24 +0200)]
Merge branch 'staticsync-as-a-module'

* staticsync-as-a-module:
  Make staticsync a module and update references
  staticsync-ssh-wrap: drop wheezy compatible rsync call in allowed list
  move things from modules/roles/static* to modules/static*

5 years agoMake staticsync a module and update references
Peter Palfrader [Sat, 14 Sep 2019 14:22:27 +0000 (16:22 +0200)]
Make staticsync a module and update references

5 years agostaticsync-ssh-wrap: drop wheezy compatible rsync call in allowed list
Peter Palfrader [Sat, 14 Sep 2019 13:24:29 +0000 (15:24 +0200)]
staticsync-ssh-wrap: drop wheezy compatible rsync call in allowed list

5 years agomove things from modules/roles/static* to modules/static*
Peter Palfrader [Sat, 14 Sep 2019 13:20:59 +0000 (15:20 +0200)]
move things from modules/roles/static* to modules/static*

Files and headers etc. have not yet been modified.  That's the next
step.  This was strictly a git mv.

5 years agorename dsa-puppet-stuff to puppet-crontab
Peter Palfrader [Sat, 14 Sep 2019 14:11:28 +0000 (16:11 +0200)]
rename dsa-puppet-stuff to puppet-crontab

5 years agoUpdate manifests/static/ssh.pp to new authorized_key_add interface
Peter Palfrader [Sat, 14 Sep 2019 11:04:07 +0000 (13:04 +0200)]
Update manifests/static/ssh.pp to new authorized_key_add interface

5 years agoCopy updated and documented authorized_key_add from Tor
Peter Palfrader [Sat, 14 Sep 2019 11:01:41 +0000 (13:01 +0200)]
Copy updated and documented authorized_key_add from Tor

The interface changed slightly:
 - from_hosts is from
 - restrict is now an options array that defaults to ['restrict']

callers will be updated with the next commit.

5 years agoauthorized_key_collect: do away with manual ordering, and set ensure_newline on the...
Peter Palfrader [Sat, 14 Sep 2019 10:58:15 +0000 (12:58 +0200)]
authorized_key_collect: do away with manual ordering, and set ensure_newline on the concat

5 years agoCopy improved ssh::keygen from tor
Peter Palfrader [Sat, 14 Sep 2019 10:57:26 +0000 (12:57 +0200)]
Copy improved ssh::keygen from tor

This supports providing the name for the key (defaults to id_rsa).

It also uses a more generic facter, one that doesn't require us manually
listing every single role we care about.

5 years agoCopy the ssh_keys_users facter from Tor
Peter Palfrader [Sat, 14 Sep 2019 10:51:24 +0000 (12:51 +0200)]
Copy the ssh_keys_users facter from Tor

5 years agoSplit the web stuff out of the static_mirror role
Peter Palfrader [Sat, 14 Sep 2019 10:39:07 +0000 (12:39 +0200)]
Split the web stuff out of the static_mirror role

5 years agore-enable puppet access
Peter Palfrader [Fri, 13 Sep 2019 11:22:47 +0000 (13:22 +0200)]
re-enable puppet access

5 years agoTry to avoid reserved site keyword; s///g would have been a good idea
Peter Palfrader [Fri, 13 Sep 2019 11:20:54 +0000 (13:20 +0200)]
Try to avoid reserved site keyword; s///g would have been a good idea

5 years agoTry to avoid reserved site keyword
Peter Palfrader [Fri, 13 Sep 2019 10:55:23 +0000 (12:55 +0200)]
Try to avoid reserved site keyword

5 years agodisallow puppet access from clients for now
Peter Palfrader [Fri, 13 Sep 2019 10:34:55 +0000 (12:34 +0200)]
disallow puppet access from clients for now

5 years agoDrop unused file
Aurelien Jarno [Thu, 12 Sep 2019 18:03:20 +0000 (20:03 +0200)]
Drop unused file

5 years agoAdd wuiet volumes at UBC
Aurelien Jarno [Thu, 12 Sep 2019 18:02:08 +0000 (20:02 +0200)]
Add wuiet volumes at UBC

5 years agosplit out onionmaster into its own role
Peter Palfrader [Thu, 12 Sep 2019 07:19:07 +0000 (09:19 +0200)]
split out onionmaster into its own role

5 years agoRemove the pkglist fact. It's a) unused and b) slightly buggy
Peter Palfrader [Wed, 11 Sep 2019 11:38:43 +0000 (13:38 +0200)]
Remove the pkglist fact.  It's a) unused and b) slightly buggy

5 years agoMake static-master-ubc-01 a static-master
Peter Palfrader [Wed, 11 Sep 2019 08:46:40 +0000 (10:46 +0200)]
Make static-master-ubc-01 a static-master

5 years agoinclude static_master class using hiera
Peter Palfrader [Wed, 11 Sep 2019 08:45:15 +0000 (10:45 +0200)]
include static_master class using hiera

5 years agoRetire unused ferm varible definitions for HOST_STATIC*
Peter Palfrader [Wed, 11 Sep 2019 08:31:36 +0000 (10:31 +0200)]
Retire unused ferm varible definitions for HOST_STATIC*

5 years agossh between static hosts should be handled by the ssh::authkey storedconf stuff
Peter Palfrader [Wed, 11 Sep 2019 08:31:19 +0000 (10:31 +0200)]
ssh between static hosts should be handled by the ssh::authkey storedconf stuff

5 years agoWe do not do bittorrent between static hosts (yet/these days)
Peter Palfrader [Wed, 11 Sep 2019 08:30:13 +0000 (10:30 +0200)]
We do not do bittorrent between static hosts (yet/these days)

5 years agorestrict ssh to static-master-ubc-01 by default. we really really should move this...
Peter Palfrader [Wed, 11 Sep 2019 08:23:52 +0000 (10:23 +0200)]
restrict ssh to static-master-ubc-01 by default.  we really really should move this config out of the template

5 years agorestrict ssh to static-master-grnet-01 by default. we really should move this config...
Peter Palfrader [Wed, 11 Sep 2019 08:22:56 +0000 (10:22 +0200)]
restrict ssh to static-master-grnet-01 by default.  we really should move this config out of the template

5 years agoAdd static-master-ubc-01 volumes
Peter Palfrader [Wed, 11 Sep 2019 07:08:51 +0000 (09:08 +0200)]
Add static-master-ubc-01 volumes

5 years agofix a typo
Peter Palfrader [Wed, 11 Sep 2019 07:08:45 +0000 (09:08 +0200)]
fix a typo

5 years agoretire long obsolete file removals
Peter Palfrader [Tue, 10 Sep 2019 20:49:30 +0000 (22:49 +0200)]
retire long obsolete file removals

5 years agoremove stray file
Peter Palfrader [Tue, 10 Sep 2019 20:49:16 +0000 (22:49 +0200)]
remove stray file

5 years agofix undefined variable issue
Peter Palfrader [Tue, 10 Sep 2019 20:35:29 +0000 (22:35 +0200)]
fix undefined variable issue

5 years agoget list of mirrors from puppet
Peter Palfrader [Tue, 10 Sep 2019 20:33:55 +0000 (22:33 +0200)]
get list of mirrors from puppet

5 years agoMake static-components.conf.erb more readable, maybe
Peter Palfrader [Tue, 10 Sep 2019 20:30:31 +0000 (22:30 +0200)]
Make static-components.conf.erb more readable, maybe

5 years agosort mirror names
Peter Palfrader [Tue, 10 Sep 2019 20:25:49 +0000 (22:25 +0200)]
sort mirror names

5 years agoDocument static-components.yaml
Peter Palfrader [Tue, 10 Sep 2019 19:58:33 +0000 (21:58 +0200)]
Document static-components.yaml

5 years agostatic-components: rename variables
Peter Palfrader [Tue, 10 Sep 2019 19:58:23 +0000 (21:58 +0200)]
static-components: rename variables

5 years agofix a fact name. sed was too eager
Peter Palfrader [Tue, 10 Sep 2019 19:29:40 +0000 (21:29 +0200)]
fix a fact name.  sed was too eager

5 years agomake manziarly a static master
Julien Cristau [Tue, 10 Sep 2019 19:16:34 +0000 (21:16 +0200)]
make manziarly a static master

5 years agoTell apt to use ca-global for cdn-aws.deb.debian.org
Julien Cristau [Tue, 10 Sep 2019 18:57:57 +0000 (20:57 +0200)]
Tell apt to use ca-global for cdn-aws.deb.debian.org

5 years agoautofs: manziarly is now ubc
Julien Cristau [Tue, 10 Sep 2019 18:15:50 +0000 (20:15 +0200)]
autofs: manziarly is now ubc

5 years agoTry to make resolv.conf options actual class parameters
Peter Palfrader [Tue, 10 Sep 2019 17:13:02 +0000 (19:13 +0200)]
Try to make resolv.conf options actual class parameters

5 years agoUse https on deb.debian.org
Peter Palfrader [Tue, 10 Sep 2019 16:10:56 +0000 (18:10 +0200)]
Use https on deb.debian.org

5 years agoThe trick for merge options to work is to use lookup() rather than hiera()
Peter Palfrader [Tue, 10 Sep 2019 15:05:01 +0000 (17:05 +0200)]
The trick for merge options to work is to use lookup() rather than hiera()

5 years agotemporarily hardcode debian.org and end of searchpaths
Peter Palfrader [Tue, 10 Sep 2019 14:57:35 +0000 (16:57 +0200)]
temporarily hardcode debian.org and end of searchpaths

5 years agoresolv.conf cleanup, fix 1
Peter Palfrader [Tue, 10 Sep 2019 14:55:26 +0000 (16:55 +0200)]
resolv.conf cleanup, fix 1