When `nftables=True` the base role deploys nftables rules and enables the
nftables service, but never disables the iptables service. On freshly
provisioned hosts the iptables service can be left running from cloud-init,
overwriting nftables rules and silently dropping traffic on ports defined
in `tcp_ports`.
Stop and disable the iptables service explicitly when nftables is the
intended firewall backend.
Today the bastion relayhost didn't work for sign-bridge. So we changed
it to bastion01.rdu3.fedoraproject.org. This worked, so let's reflect
that change in ansible as well.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
This pr attempts to move sshd to port 222 on proxy01.stg and
proxy02.stg.
We want to do this (first here and then in prod) because we want to nat
in ssh from external and use haproxy to send that into
forge.fedoraproject.org. If we were using port 22 to connect here
it would conflict with forwarding it on to haproxy.
Note that we still need to actually get networking folks to make the nat
mapping and we still need to add haproxy config to send it into forge in
openshift, but this is the first step we need to get working before we
can do those things.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
* nftables: (2 commits)
Cleanup nft merge. Chg osbuildapi and nft_custom_rules to use nft_table_filter.
...
Signed-off-by: James Antill <james@and.org>
We are no longer using the bkernel role (using the old card thats in
buildhw-x86-01), so this removes that role and mentions of it.
Also, because we are urgently building kernels all the time now,
add one more buildhw-x86 and one more buildhw-a64 to secure-boot channel
so we can build more/faster kernels.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This will update configuration to clean Received header from e-mail
forwarded by smtp-auth-iso01 server to prevent leaking of internal IPs.
See infra/tickets#12835
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
This relocates the work done via the Zabbix API to create & configure
a host to the base role, such that it is done for *every* host, even the
ones that don't run the agent (such as builders). This covers:
- Creating the host
- Adding the hostgroups
- Creating a set of items/triggers that ping the DNS name
- Creating a set of items/triggers that check the BMC interface (if defined)
The zabbix_agent role then deals with installing the agent and assigning
the agent template, as the rest has already been done in base.
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
Few machines were having issues with sending e-mails (retrace03 and
pkgs01). In both cases it was caused by postfix misconfiguration.
* retrace03 - It's RHEL8 machine, so lmdb is unavailable and it also
didn't used vpn to reach bastion
* pkgs01 - It had just bastion as relay name, which wasn't happy to
resolve through DNS, this is using FQDN instead
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
This also removes the Nagios config - it'll be looking in the wrong
place. A Zabbix replacement check will follow in the next commit.
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
These two maps are generated by a script, so we should adjust that
script to make lmdb if we want to switch them.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
After merging I found out that the handler can't handle blocks. The
workaround is to include tasks from separate file.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
Missing space in variable for pkgs group ansible config
Revert changes in pagure and pkgs configs to use hash instead of btree
as before
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
