1
0
Fork 0
forked from infra/ansible
Commit graph

99 commits

Author SHA1 Message Date
6eac650a10
Nagios: remove nrpe from a bunch of smaller things
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-07-01 14:22:40 +01:00
969a94bd18
Zabbix: add tags missed in previous commit
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-06-30 12:48:53 +01:00
a0c7bf49ad
Zabbix: migrate still-in-use Nagios plugins to the relevant roles
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-06-30 12:42:26 +01:00
6236fc9d67
Zabbix: Migrate Pagure checks from Nagios
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-06-11 17:12:40 +01:00
05eb12595e
Apply hotfix patches to pagure.io too (staging for now)
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2026-05-22 16:44:18 +02:00
c49ea00759 Pagure.io: display the sunset message on web and on git push
This just sets it up to display the messages on prod. They are already
implemented on staging.

Resolves: forge/forge#432

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-03-18 13:14:22 +10:00
a7040abb2b pagure-staging - add sunset warning to git post-recieve
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-03-17 12:28:32 +10:00
65aa2a1dcc pagure-staging: add sunset message to top of page
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2026-03-16 13:21:24 +10:00
aedf43d1f3 Restore arcane breadcrumbs (broken Forge links)
Also some minor changes to satisfy yamllint.

Signed-off-by: Michael Winters <fedora@mwinters.net>
2026-03-11 21:09:36 +00:00
a754144f19 Update infra pagure.io links to forge.fp.o (WIP)
This should update all the references we have to
https://pagure.io/fedora-infrastructure to the
new https://forge.fedoraproject.org/infra/tickets/ area.

Do not merge this before the migration on tuesday.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2026-01-20 14:39:40 -08:00
140a6eb752
Zabbix: Don't hardcode trigger hostnames
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2025-12-11 11:52:51 +00:00
69fd257fd9
Zabbix: add external-check on Pagure certs
This is a POC on cert checks - it assigns an item to the Pagure host
(not via a template) but the actual check is executed on the Zabbix
server.

In reality, we should probably add LLD to certgetter01 for all the LE
certs, but this is a useful example for other cert types

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2025-12-11 11:47:02 +00:00
33b5710bb0 pagure: move python3-httplib2 to the right place
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-11-18 18:52:11 -08:00
f9a589fc50 pagure: actually install python3-httplib2 before trying to hotfix it
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-11-18 18:42:34 -08:00
03b49682a5 pagure: Only apply srcfpo hotfix on src.fp.o
We don't want to try and apply this on pagure.io/stg.pagure.io, it's
src.fedoraproject.org specific.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-11-18 18:17:47 -08:00
James Antill
db3727afb1 pagure: Fix rsyslog logrotate.
Signed-off-by: James Antill <james@and.org>
2025-08-26 13:38:11 -04:00
James Antill
9eb29f21e9 pagure: Revert part of the lint cleanup. Prev=c5ca51336411...
Signed-off-by: James Antill <james@and.org>
2025-08-26 13:17:08 -04:00
Lenka Segura
a2cfb0a360 pagure: hotfix for links to accounts.fpo
Signed-off-by: Lenka Segura <lsegura@redhat.com>
2025-08-07 21:15:42 +00:00
Lenka Segura
c5ca513364 pagure: Fix lint errors in main task
Signed-off-by: Lenka Segura <lsegura@redhat.com>
2025-08-07 22:21:42 +02:00
f67d942dbb pagure: http.logrotate is a template now
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-05-24 21:21:27 -07:00
a0046b5b4b [distgit] Fixing ansible lint errors
This commit is fixing ansible lint errors for distgit role.

It also introduces two new addition to skip list as the structure of our
ansible repository doesn't adhere to ansible standards.

The errors that will be now skipped are:
- role-name[path] - we have plenty of roles that have sub-roles inside
  them and we need to access them
- var-naming[no-role-prefix] - variables for roles are not usually
  prefixed correctly in our repository and forcing people to change that
  will introduce more issues than what it solves
2025-04-30 10:07:35 +00:00
d884a0f8ba
Use the combined RabbitMQ CA cert in the clients
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2025-04-11 15:15:45 +02:00
2ec055db6f Use first uppercase letter for all handlers
This will unify all the handlers to use first uppercase letter for
ansible-lint to stop complaining.

I went through all `notify:` occurrences and fixed them by running
```
set TEXT "text_to_replace"; set REPLACEMENT "replacement_text"; git grep
-rlz "$TEXT" . | xargs -0 sed -i "s/$TEXT/$REPLACEMENT/g"
```

Then I went through all the changes and removed the ones that wasn't
expected to be changed.

Fixes https://pagure.io/fedora-infrastructure/issue/12391

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2025-02-10 20:31:49 +00:00
7b58dfdce8 Remove fedmsg and github2fedmsg from staging
The messaging bridges openshift project and github2fedmsg VM were
already removed in staging. This is to clean the ansible playbooks.

I will create a separate one for production after this one is merged.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2025-02-04 09:13:40 +01:00
a6c874f45e pagure: fix overzellous shell call that should be a variable
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-01-24 20:18:38 -08:00
47c68f478d ansiblelint fixes - fqcn[action-core] - template to ansible.builtin.template
Replaces references to template: with ansible.builtin.template

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:30:29 +10:00
3c41882bb0 ansiblelint fixes - fqcn[action-core] - shell to ansible.builtin.shell
Replaces references to shell: with ansible.builtin.shell

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:29:10 +10:00
25391e95b7 ansiblelint fixes - fqcn[action-core] - package to ansible.builtin.package
Replaces many references to  package: with ansible.builtin.package

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:28:00 +10:00
462176464b ansiblelint fixes-- fqcn[action-core] - command to ansible.builtin.command
Replaces many references to  command: with ansible.builtin.command

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:26:47 +10:00
6a3816dfdc ansiblelint fixes-- fqcn[action-core] - copy to ansible.builtin.copy
Replaces many references to 'copy' with ansible.builtin.copy

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 10:43:31 +10:00
62952df107 ansiblelint fixes-- fqcn[action-core] - file to ansible.builtin.file
Replaces many references to  file: with ansible.builtin.file

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 10:41:52 +10:00
691adee6ee Fix name[casing] ansible-lint issues
fix 1900 failures of the following case issue:

`name[casing]: All names should start with an uppercase letter.`

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:20:07 +10:00
89f6f1fc32 Fix majority of remaining yamllint warnings and errors
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2024-11-28 17:31:45 +10:00
205e2c9ed5 distgit/pagure: Set git directories as safe
This was fixed previously for pagure.io in the context of
paguremirroring. Turns out, it affects all kinds of git operations, so
document and move accordingly.

Fixes: releng#12181
Fixes: fedora-infrastructure#12010

Signed-off-by: Nils Philippsen <nils@redhat.com>
2024-06-27 11:21:19 +02:00
abe14b6489 [pagure] Change the folder permission for pagure
To create a new log file the as paguremirroring user we need to add write
permissions to /var/log/pagure/ folder as well. This is correctly set for
distgit/pagure role, but not for pagure itself.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-04 11:52:42 +02:00
c897c9c197 [pagure] Add tags to acl fix
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-04 10:28:39 +02:00
4701fd8783 pagure: fix typo
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-06-03 14:13:40 -07:00
c5b14f29fa [pagure] Add default ACLs to /var/log/pagure
This is a permanent fix for https://pagure.io/fedora-infrastructure/issue/11957

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-03 21:10:36 +00:00
17f02d725a [Pagure] Enable safe directories for production
See https://pagure.io/fedora-infrastructure/issue/11330 for more details.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2023-09-21 17:19:38 +02:00
ba7424bdf2 [Pagure] The value needs to be string
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2023-09-06 10:17:33 +02:00
3c9cd1ad34 [Pagure] Set git directories as safe system-wide
This will solve https://pagure.io/fedora-infrastructure/issue/11330

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2023-09-06 10:12:02 +02:00
88f7258c7b [Pagure] Enable OIDC on production
As OIDC authentication works without issue on staging let's enable it on
production as well.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2023-08-14 11:25:39 +02:00
a4ddf54509 [Pagure] Limit the httplib2 task by tags
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2023-08-11 12:04:09 +02:00
1e26cf9246 Some more fixes to get Pagure to work with OIDC on staging
- patch the httplib2 library to avoid hardcoding TLSv1
- set the missing configuration variables in `pagure.cfg` (they have no
  defaults)
- set the password for the future production version of
  `client_secrets.json`

Also note that in the private ansible repo, the Pagure client
configuration in Ipsilon was fixed: the `token_endpoint_auth_method`
variable was set to `"client_secret_post"`.

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
2023-08-11 11:39:03 +02:00
5238a92325 [Pagure] Add flask OIDC package to dependencies
Signed-off-by: Michal Konečný <mkonecny@redhat.com>
2023-07-18 16:12:05 +02:00
e54dae6574 [Pagure] Use correct staging env variable
Also change the client_secrets.json permissions to match pagure.cfg.

Signed-off-by: Michal Konečný <mkonecny@redhat.com>
2023-07-18 14:53:16 +02:00
4e14997780 [Pagure] Fix yamllint errors
Signed-off-by: Michal Konečný <mkonecny@redhat.com>
2023-07-17 18:04:18 +02:00
d1dc3f649b [Pagure] Enable OIDC in staging
Signed-off-by: Michal Konečný <mkonecny@redhat.com>
2023-07-17 17:35:38 +02:00
d44bc3991c pagure: handle stunnel bundled cert in letsencrypt renews
This commit removes the old tasks to try and create a cert/intermediate
bundle file for stunnel in favor of just doing it when we renew/get the
cert. It also fixes stunnel to use the correct bundled cert.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-01-20 11:55:13 -08:00
f183f5262b pagure-stg01 / ipsilon*.stg: split db passwords from stg and prod
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2022-09-19 13:53:15 -07:00