This commit updates the assignments for various Fedora Marketing and
Fedora Ambassadors aliases to send mail to specific leadership roles
(i.e., @jspaleta the Fedora Project Leader, @jflory7 the Fedora
Community Architect, @amoloney the Fedora Operations Architect, and some
specific groups such as the Fedora Council private mailing list, Fedora
Mindshare Committee members, and Fedora Marketing Team.
The overall goal is to ensure an accountable person receives email sent
to some of these aliases, and to use FAS group membership to dynamically
add and remove members from the mail alias in the future.
Signed-off-by: Justin Wheeler <jwheel@redhat.com>
When running the playbook with specific tag it will skip pre_tasks and
some of the vars are missing if that happens. Let's add tags: always to
run it everytime.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
The repos created through docker push are created as private by default.
This script will run every hour and sets any private repo visibility to
public.
This should be next step to finish
infra/tickets#11543
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
Seems like there are a ton of really small connections and it starts
hitting the limit (although it never logs that it's out, I think because
they free up quickly).
See if this solves the transitory alerts we see.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
If a host has a secondary ipv4 or ipv6 address, only have sshd listen on
the primary ip. This will allow hosts with secondary ips to use ssh port
on secondary ip's for other things.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This pr attempts to move sshd to port 222 on proxy01.stg and
proxy02.stg.
We want to do this (first here and then in prod) because we want to nat
in ssh from external and use haproxy to send that into
forge.fedoraproject.org. If we were using port 22 to connect here
it would conflict with forwarding it on to haproxy.
Note that we still need to actually get networking folks to make the nat
mapping and we still need to add haproxy config to send it into forge in
openshift, but this is the first step we need to get working before we
can do those things.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
There are six global 'fedora' runners in staging forgejo, each with a
different label. This makes it awkward to create workflows as you have to
arbitrarily tie them to a single runner for no very good reason. If we
give them all the 'fedora' label you can just set your workflow to run on
'fedora' and it will run on any available runner.
Also, at least for the quality org, our prod runners have the 'fedora' label,
so if the global staging runners have the same label, we can reuse workflows
between staging and prod.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
- split off the template into a node template and a cluster template
(that only needs to be instanciated on one node)
- add certificate expiration monitoring in the cluster template
This is only on staging for now.
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
See infra/tickets#13422
for details on this. It seems like rabbitmq staging has been
switch to the 'new' CA cert, and the consumers don't actually
read/trust both certs in the combined CA cert file, only the
first (old) one, so they don't trust the new one. This should
deploy and use a new file with only the new CA cert in it. We
copy it out of the private repo for convenience but it's not
actually private, hence the 0644 perms.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
I'm having auth issues on openQA staging, I believe it *may* be
to do with the changes Aurelien made in
6fe8b98de21747dc16d59dcf5096da719a541296 . Let's see if using the
old key and cert helps.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
