Jakub Kadlcik
de353ebd8a
copr-be: update blocked owners
2026-10-04 19:19:16 +02:00
f62c48a107
download: adjust ipv6 blocking
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-10-02 13:31:39 -07:00
459458e6fe
download: block a ipv6 address
...
This address has been hitting dl01 about 30k times per day to sync epel7
(which is never ever ever going to change now).
Lets block them to reduce log spam.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-10-02 13:24:24 -07:00
Adam Williamson
fc1d558dd8
openqa/worker: set installonly_limit to 2 on aarch64 workers
...
They have 1GB /boot and three aarch64 kernels apparently no longer
fits in 1GB.
Signed-off-by: Adam Williamson <adamwill@fedoraproject.org>
2026-10-02 10:47:26 -07:00
Jakub Kadlcik
0927349d85
copr-be: cache repomd.xml files that are 404
...
See https://github.com/fedora-copr/copr/issues/4509
2026-10-02 13:26:27 +00:00
c4316df575
Zabbix: disable 12h prediction, and don't predict on /boot
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-10-02 14:21:28 +01:00
14661d27ee
database migration: db-datanommer, db-fas, db-koji, db-openqa, db01, db03
...
This deletes the temporary rhel10 instances, since we have migrated to
them and renamed them back (to avoid acl issues).
The exception is db-datanommer, which we just are keeping the 01
name now instead of 02.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-10-01 14:45:24 -07:00
Jakub Kadlcik
e586bd0c90
copr-be: update blocked owners
2026-10-01 14:58:44 +02:00
c5be51c3f6
[OIDC] Fix the contact for cryptpad
...
I left the one from copied entry. Oops!
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-10-01 13:27:56 +02:00
fd1dcb297f
[OIDC] Add entry for cryptpad-communishift
...
infra/tickets#13596
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-10-01 12:33:11 +02:00
e178f07ad7
forge-src: update ipsilon to the new subdomain
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-10-01 19:01:24 +10:00
fc32e3f264
forgejo-src: setup proxies for new subdomain properly
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-10-01 14:38:38 +10:00
57d22f33bc
forgejo-src: setup proxies for new subdomain
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-10-01 14:34:16 +10:00
638f5dea8e
forge staging: fix issue with permissions granted to service for syncgroups
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-10-01 14:34:16 +10:00
edc7059863
Revert "forgedistgit: add anubis rules for challenge on web"
...
This reverts commit dcd5315079
2026-10-01 14:18:57 +10:00
dcd5315079
forgedistgit: add anubis rules for challenge on web
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-10-01 13:56:41 +10:00
1ddeba8d1b
batcave: add sysadmin-eln group access
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-30 13:52:42 -07:00
e8b580f110
communishift: communishift-coreos-agent: increase memory. See infra/tickets#13592
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-30 13:47:01 -07:00
a322d0ff57
proxies / www.fedoraproject.org: redirect to main site and only block referrer on wiki
...
See: infra/tickets#13586
Split out www.fedoraproject.org to it's own site, then just redirect
everything to fedoraproject.org
Also scope the wiki referrer block to just /wiki/ and /w/
We may have to adjust this is scrapers still hit non wiki sites on www.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-30 20:44:00 +00:00
5178022ab5
pagure-ro01: fix ipv6 address
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-30 11:55:11 -07:00
4caf509a4e
proxies / koji: disable the referrer == request block
...
This was causing some real legit 403's. So, we may need to scope it
smaller or perhaps it's not doing all that much good and we can just do
without it.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-30 10:39:16 -07:00
Jakub Kadlcik
9400e3d924
copr-be: update blocked owners
2026-09-30 13:23:24 +02:00
406c405595
Ipsilon: Try pairwise subject mapping in OIDC Matrix ESS
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-09-30 12:16:36 +01:00
cc598d799c
Ipsilon: Fix redirect URI in STG OIDC endpoint for Matrix ESS
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-09-30 11:45:56 +01:00
7f2cb973d2
Ipsilon: Add OIDC endpoint for Matrix ESS
...
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-09-30 11:27:31 +01:00
0b1830f08f
proxies / koji: just drop all opengraph for koji
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-29 18:09:11 -07:00
5a625d9cf1
proxies / koji: stop anubis opengraph from hitting heavy db endpoints
...
This should stop anubis from trying to get these endpoints for
opengraph. There's not even anything to preview here.
Assistedby: claude the clanker
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-29 18:01:05 -07:00
1481136641
proxies / koji: tweak the referrer blocking
...
This actually should work.
Assisted by: claude the clanker
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-29 17:29:57 -07:00
24538774d0
proxies / koji: block requests with the referrer and request exactly the same
...
This seems like a bot pattern, so lets try and block it.
Assisted by: claude the clanker
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-29 16:57:52 -07:00
eabd08d2c9
Revert "proxies / koji: try and add another common old UA"
...
This reverts commit 7ca4d3e204
2026-09-29 15:35:20 -07:00
7ca4d3e204
proxies / koji: try and add another common old UA
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-29 15:29:46 -07:00
a02ace4079
proxies: add another ip that is abusing the koji db
...
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-29 15:19:47 -07:00
8a223ad341
New 2026 wildcard cert for fedoraproject.org
...
This cert is only going to last 199 days since thats the new 'longest'
that they do.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-29 14:19:11 -07:00
cfebfc0d9d
[poddlers] Add missing quotes in config
...
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-09-29 14:21:13 +02:00
56f0481974
Add ci_resultsdb_listener toddler
...
This adds a new toddler to poddlers deployment. It should replace the
standalone resultsdb-ci-listener deployment in openshift.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-09-29 12:11:46 +00:00
6b92fdc626
Add banner for staging ipsilon
...
This adds a banner to id.stg.fedoraproject.org to notify user that this
is a staging instance and it needs staging account. For more details see infra/tickets#13506
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2026-09-29 11:35:10 +00:00
f9c04cc627
forge staging: fix issue with permissions granted to service for syncgroups
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-09-29 11:37:02 +10:00
27c87a1a51
forge staging: fix issue with permissions granted to service for syncgroups
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-09-29 11:34:40 +10:00
debc02b33f
forge staging: add service for group sync workflow testing
...
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-09-29 11:27:10 +10:00
72b23c50ec
anubis: allow /api to avoid some challenge issues
...
See infra/tickets#13581
We want to see if enabling this is ok or results in too much scraper
activity.
If it does, we can revert this.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-28 16:32:31 -07:00
Lenka Segura
e96447c85c
distgit: override some vars for runnerhost vms
...
Signed-off-by: Lenka Segura <lsegura@redhat.com>
2026-09-28 11:52:12 +02:00
Jakub Kadlcik
623e68c79a
copr-be: update blocked owners
2026-09-27 19:26:08 +02:00
deb5792aae
bodhi-stg: retry f45 with a fix for SSL4.0
...
Signed-off-by: Mattia Verga <mattia.verga@proton.me>
2026-09-27 14:55:06 +02:00
3ee1529986
bodhi-stg: revert back to f44
...
Signed-off-by: Mattia Verga <mattia.verga@proton.me>
2026-09-26 18:16:38 +02:00
cf28c0f68c
bodhi-stg: fix valkey dockerfile for staging F45
...
Signed-off-by: Mattia Verga <mattia.verga@proton.me>
2026-09-26 17:50:21 +02:00
f28f69d267
bodhi-stg: fix python path for patch in dockerfile
...
Signed-off-by: Mattia Verga <mattia.verga@proton.me>
2026-09-26 17:40:15 +02:00
79bd516b6c
bodhi-stg: move to f45 and use dogpile.cache.valkey
...
Signed-off-by: Mattia Verga <mattia.verga@proton.me>
2026-09-26 17:31:23 +02:00
James Antill
5340540635
siguldry: Add stg. helper users for testing, and keys.
...
Signed-off-by: James Antill <james@and.org>
2026-09-25 16:40:57 -04:00
James Antill
c7c886e1ec
siguldry: OCD removal of a space.
...
Signed-off-by: James Antill <james@and.org>
2026-09-25 16:09:00 -04:00
5ebe414bcd
anubis / proxies: try and get opengraph working for bodhi and probibly other apps
...
This should hopefully get opengraph working for bodhi
(and other apps that behave similarly)
infra/tickets#12946
Will test in staging before rolling to prod
Assisted-by: claude the clanker
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-09-25 11:53:02 -07:00
