Compare commits
No commits in common. "main" and "main" have entirely different histories.
1457 changed files with 40047 additions and 28626 deletions
|
|
@ -1,159 +0,0 @@
|
|||
## Project Overview
|
||||
|
||||
**Purpose:** Ansible automation for the entire Fedora Project infrastructure — managing hundreds of bare-metal hosts, VMs, and OpenShift-deployed applications across production and staging environments.
|
||||
**Type:** Infrastructure as Code (Ansible)
|
||||
**Domain:** Linux distribution infrastructure (build systems, package repositories, CI/CD, web services, identity management)
|
||||
**Key Components:** `roles/` (134 reusable roles), `playbooks/` (groups, hosts, openshift-apps, manual), `inventory/` (host/group vars with constructed plugin)
|
||||
|
||||
## Technology Stack
|
||||
|
||||
### Versions (current as of 2026-03-05)
|
||||
- **Ansible** — core automation engine; playbooks target Fedora and RHEL/CentOS hosts
|
||||
- **yamllint** v1.35.1 — pre-commit hook for YAML validation
|
||||
- **ansible-lint** — CI linting (skips: `yaml`, `role-name[path]`, `var-naming[no-role-prefix]`, `no-changed-when`, `ignore-errors`)
|
||||
- **OpenShift 4** (OCP4) — hosts ~60 containerized applications via `openshift-apps/` playbooks
|
||||
|
||||
### Target Platforms
|
||||
- **Fedora** (current cycle: F43 stable, F44 branched, F45 rawhide)
|
||||
- **RHEL/CentOS** 8+ (EPEL 10, current minor: 10.3)
|
||||
- **OpenShift 4** cluster (rdu3 datacenter)
|
||||
|
||||
### Dev Tools
|
||||
- **Linting:** yamllint (pre-commit) + ansible-lint (CI)
|
||||
- **CI:** Forgejo Actions on `quay.io/fedora/fedora:latest` — runs yamllint and ansible-lint on changed files only
|
||||
- **Control host:** batcave01 (`/srv/web/infra/ansible` public, `/srv/private/ansible` private)
|
||||
|
||||
## Resource Organization
|
||||
|
||||
### Structure
|
||||
```
|
||||
├── main.yml # Master playbook — imports all group/host playbooks
|
||||
├── playbooks/
|
||||
│ ├── groups/ # 59 group playbooks (one per service group)
|
||||
│ ├── hosts/ # 2 host-specific playbooks (FQDN.yml)
|
||||
│ ├── openshift-apps/ # 60 OCP4 application deployments
|
||||
│ ├── manual/ # 39 admin-run-only playbooks
|
||||
│ └── include/ # Shared proxy/virt/cert playbook fragments
|
||||
├── roles/ # 134 roles
|
||||
│ ├── base/ # Applied to ALL hosts (packages, SSH, SELinux, nftables)
|
||||
│ ├── openshift/ # OCP4 primitives (project, object, keytab, route, rollout)
|
||||
│ └── openshift-apps/ # Per-app roles (templates, files for OCP4 deployments)
|
||||
├── inventory/
|
||||
│ ├── inventory/ # Host definitions
|
||||
│ ├── group_vars/ # 150 group variable files (incl. _stg variants)
|
||||
│ ├── host_vars/ # Per-host overrides
|
||||
│ └── zzz-inventory.config # Constructed inventory plugin (dynamic groups by datacenter, distro, vmhost)
|
||||
├── vars/
|
||||
│ ├── global.yml # Global vars (paths, SSL config, base packages)
|
||||
│ ├── all/ # Release cycle vars (Fedora versions, freeze states, EPEL)
|
||||
│ ├── apps/ # Per-application vars (bodhi, mirrormanager, etc.)
|
||||
│ ├── Fedora.yml # Distro-specific packages/services
|
||||
│ └── RedHat.yml / CentOS.yml
|
||||
├── tasks/ # Reusable task snippets (cloud, postfix, yumrepos, etc.)
|
||||
├── handlers/ # restart_services.yml
|
||||
├── library/ # Custom modules (delete_old_oci_images.py, virt_boot, etc.)
|
||||
├── callback_plugins/ # fedora_messaging_callback.py, logdetail.py
|
||||
├── files/ # Static files/templates organized by service
|
||||
└── scripts/ # Admin utility scripts (auth-keys-from-fas, freezelist, etc.)
|
||||
```
|
||||
|
||||
### Module/Role Structure
|
||||
|
||||
**Standard role layout:** `tasks/main.yml`, `templates/`, `files/`, `handlers/main.yml`, `meta/main.yml`
|
||||
|
||||
**OpenShift app pattern** — the dominant pattern for new services:
|
||||
1. Playbook in `playbooks/openshift-apps/<app>.yml` targets `os_control[0]:os_control_stg[0]`
|
||||
2. Uses composable `openshift/*` roles (`project`, `object`, `keytab`, `secret-file`, `imagestream`, `route`, `rollout`)
|
||||
3. App-specific templates in `roles/openshift-apps/<app>/templates/`
|
||||
4. Staging vs production controlled by `env` variable and `env_suffix`
|
||||
|
||||
**Group playbook pattern** — for traditional VM-based services:
|
||||
1. Playbook in `playbooks/groups/<group>.yml` with `hosts:` matching inventory group
|
||||
2. Must include standard `vars_files` triplet (see Review Guidance)
|
||||
|
||||
### Critical Resources
|
||||
|
||||
- **`vars/all/`** — Fedora release cycle variables. Changed every ~6 months during branching/release. Incorrect values break builds, composes, and Bodhi across the entire infrastructure.
|
||||
- **`roles/base/tasks/main.yml`** (700+ lines) — Applied to every managed host. Changes here have maximum blast radius.
|
||||
- **`inventory/group_vars/`** — 150 files controlling per-group behavior. Many have `_stg` counterparts for staging.
|
||||
- **`main.yml`** — Master playbook importing all groups. Nightly `--check --diff` cron runs all playbooks here.
|
||||
|
||||
## Review Guidance
|
||||
|
||||
### What Reviewers Must Know
|
||||
- **All playbooks must be idempotent.** They can be run at any time by the nightly cron. The checked-in state must always be the desired state.
|
||||
- **Standard vars_files triplet is required** in all group/host playbooks:
|
||||
```yaml
|
||||
vars_files:
|
||||
- /srv/web/infra/ansible/vars/global.yml
|
||||
- "{{ private }}/vars.yml"
|
||||
- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
|
||||
```
|
||||
Plus `include_vars` for `vars/all/` when release cycle vars are needed.
|
||||
- **Hardcoded paths are standard** — paths like `/srv/web/infra/ansible/` and `/srv/private/ansible/` are the production layout on batcave01. Don't suggest making them relative or configurable.
|
||||
- **Use `yml` not `yaml`** for Ansible files (per STYLEGUIDE). The exception is `vars/all/*.yaml` which uses `.yaml` historically.
|
||||
- **Add `.j2` extension** to all Jinja2 templates.
|
||||
- **YAML indentation is 2 spaces.** Line length is not enforced.
|
||||
- **Prefer readable multi-line module args** over single-line `module: name=x arg=y` format.
|
||||
- **Staging uses `_stg` suffixed group_vars** and `env_suffix` variable (empty string for prod, `.stg` for staging).
|
||||
- **Tags `packages` and `config`** should be applied to relevant tasks. `build` and `rollout` tags use `never` to prevent accidental execution.
|
||||
- **OpenShift apps target `os_control[0]:os_control_stg[0]`** — always the first control node. Don't suggest targeting all control nodes.
|
||||
|
||||
### Do NOT Flag (Known False Positives)
|
||||
- `ansible-lint` skip list includes `no-changed-when` and `ignore-errors` — these are intentionally suppressed project-wide
|
||||
- `yaml` rule category is skipped in ansible-lint — yamllint handles YAML validation separately
|
||||
- Hardcoded absolute paths in playbooks (e.g., `/srv/web/infra/ansible/...`) — this is the expected deployment layout
|
||||
- `mock_modules` and `mock_roles` in `.ansible-lint` — used to pass syntax checks without all dependencies
|
||||
- Octal values forbidden in yamllint — intentional policy to avoid ambiguous YAML parsing
|
||||
- `when: env == "production"` / `when: env == "staging"` conditional duplication in openshift-apps — standard pattern for different scaling/config per environment
|
||||
|
||||
### Common Pitfalls
|
||||
- **Forgetting to update `vars/all/` during release transitions** — these variables control Fedora version numbers, freeze states, and EPEL branches. Multiple files must be updated together (e.g., branching requires changes to `FedoraBranched.yaml`, `00-FedoraCycleNumber.yaml`, `FedoraBranchedBodhi.yaml`, and `Frozen.yaml`).
|
||||
- **Not testing with staging first** — staging group_vars (`*_stg`) should be updated before production. Changes that work in staging may still break production due to different scaling or secrets.
|
||||
- **Breaking idempotency** — a task that makes changes on every run will generate noise in the nightly `--check --diff` report and mask real drift.
|
||||
- **Wrong file extension for templates** — placing a `.yml` file in `templates/` instead of `.yml.j2` means Jinja2 expressions won't be rendered.
|
||||
- **ansible-lint file/role misclassification** — the `.ansible-lint` `kinds` section maps `tasks/*.yml` and `vars/*.yml` explicitly. New directories with tasks may need similar mappings.
|
||||
|
||||
## Internal & Proprietary
|
||||
|
||||
- **`/srv/private/ansible/`** — Private vars (secrets, credentials) stored on batcave01. Referenced as `{{ private }}/vars.yml`. Never committed to this repo.
|
||||
- **`callback_plugins/fedora_messaging_callback.py`** — Custom Ansible callback that publishes play results to Fedora's AMQP message bus. Don't suggest replacing with standard callback plugins.
|
||||
- **`callback_plugins/logdetail.py`** — Custom detailed logging callback for the nightly check-diff runs.
|
||||
- **`library/virt_boot`** / **`library/delete_old_oci_images.py`** — Custom Ansible modules for VM management and OCI image cleanup. Not upstream modules.
|
||||
- **`scripts/auth-keys-from-fas`** — Fetches SSH authorized keys from Fedora Account System (FAS). Referenced by `auth_keys_from_fas` global variable.
|
||||
- **Constructed inventory plugin** (`zzz-inventory.config`) — Dynamically creates groups by datacenter (`rdu3`), distro, vmhost, and virtualization role. The `zzz-` prefix ensures it loads last.
|
||||
|
||||
---
|
||||
<!-- MANUAL SECTIONS - DO NOT MODIFY THIS LINE -->
|
||||
|
||||
## Architecture & Design Decisions
|
||||
|
||||
- **Mostly flat role directory with some nesting**: Most roles live directly under `roles/`, but several use subdirectory namespacing — `openshift/` (OCP4 primitives), `openshift-apps/` (per-app deployments), `awx/`, `openqa/`, `rabbit/`, among others.
|
||||
- **OpenShift apps via Ansible, not Helm/Kustomize**: OCP4 applications are deployed through Ansible roles that template and apply OpenShift objects. This keeps all infrastructure in one tool and one repo.
|
||||
- **Staging/production parity through group_vars**: Rather than separate inventories, staging hosts are in the same inventory with `_stg` group_vars files providing overrides. The `env` and `env_suffix` variables control behavior.
|
||||
- **Release cycle managed through simple YAML vars**: Fedora's complex release lifecycle (rawhide, branched, stable, EOL) is encoded in `vars/all/` as a set of interdependent variables rather than a database or API. This is intentional — the variables are updated manually during each release milestone by the release engineering team.
|
||||
|
||||
## Business Logic
|
||||
|
||||
- **Fedora release cycle states**: Three main states — unbranched (rawhide only), branched (rawhide + pre-release), and post-release. Controlled by `FedoraBranched`, `FedoraCycleNumber`, `FedoraBranchedBodhi` (preenable/prebeta/postbeta), and freeze flags. These cascade through templates across the entire infrastructure.
|
||||
- **EPEL minor version lifecycle**: EPEL 10+ has minor versions that move through states: `epel_minor` (built against CentOS), `epel_branched_minor` (branched, built against CentOS snapshot), `epel_z_minor` (built against RHEL). Up to three active minor versions at once.
|
||||
- **Critical path applications**: forge, pagure, mirrormanager, bodhi, koji, dist-git, and ~20 others require two-reviewer PRs and coordinated downtime scheduling for risky changes.
|
||||
- **Nightly check-diff**: All playbooks under `playbooks/{groups,hosts}` are run nightly with `--check --diff`. The ideal state is zero changes reported.
|
||||
|
||||
## Domain-Specific Context
|
||||
|
||||
- **batcave01** — The Ansible control host. All playbooks are run from here via `sudo -i ansible-playbook`.
|
||||
- **env / env_suffix** — `env` is `"production"` or `"staging"`. `env_suffix` is `""` for prod, `".stg"` for staging. Used throughout to construct hostnames, queue names, and paths.
|
||||
- **FAS (Fedora Account System)** — Identity provider for the Fedora community. SSH keys, group memberships, and permissions come from FAS/IPA.
|
||||
- **Koji** — Fedora's build system. Build hosts (buildvm, buildhw) are managed here. Koji hub is VM-based (`playbooks/groups/koji-hub.yml` + `roles/koji_hub`), not on OpenShift.
|
||||
- **Bodhi** — Fedora's update management system. Runs on OpenShift with complex RabbitMQ messaging integration.
|
||||
- **dist-git / Pagure** — Package source repositories. The lookaside cache and git hosting are managed by separate roles.
|
||||
- **RabbitMQ / fedora-messaging** — AMQP message bus connecting Fedora services. Certificates managed per-service via `openshift/secret-file` role.
|
||||
|
||||
## Special Cases
|
||||
|
||||
- **`playbooks/openshift-apps/` uses `gather_facts: false`** — OCP4 playbooks target the control node to run `oc` commands, not the apps themselves. Facts aren't needed and would slow execution.
|
||||
- **`vars/all/*.yaml` uses `.yaml` extension** despite STYLEGUIDE mandating `.yml` — historical exception, don't "fix" this.
|
||||
- **`ansible-lint` runs in offline mode** (`offline: true`) — dependencies aren't installed during linting. `mock_modules` and `mock_roles` paper over missing dependencies.
|
||||
- **Some playbooks are excluded from ansible-lint** (e.g., `copr-db.yml`, `list-vms-per-host.yml`) due to known issues with hardcoded paths or unicode errors.
|
||||
- **`linux-system-roles.network`** is mocked in ansible-lint — it's an external role not available during CI.
|
||||
|
|
@ -67,4 +67,3 @@ skip_list:
|
|||
- role-name[path]
|
||||
- var-naming[no-role-prefix]
|
||||
- no-changed-when
|
||||
- ignore-errors
|
||||
|
|
|
|||
|
|
@ -1,17 +0,0 @@
|
|||
---
|
||||
name: AI Code Review
|
||||
on:
|
||||
pull_request_target:
|
||||
types: [labeled]
|
||||
|
||||
jobs:
|
||||
ai-review:
|
||||
runs-on: infra-1
|
||||
if: forgejo.event.label.name == 'ai-review-please'
|
||||
uses: quality/workflows/.forgejo/workflows/ai-review.yml@main
|
||||
with:
|
||||
pr: ${{ forgejo.event.pull_request.number }}
|
||||
config: |
|
||||
include_mr_summary: false
|
||||
secrets:
|
||||
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
|
||||
|
|
@ -1,71 +0,0 @@
|
|||
---
|
||||
name: Linter
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
yamllint:
|
||||
runs-on: infra-1
|
||||
container:
|
||||
image: quay.io/fedora/fedora:latest
|
||||
steps:
|
||||
- name: Install testing tools
|
||||
run: |
|
||||
dnf install -y yamllint nodejs git
|
||||
|
||||
- name: Checkout code
|
||||
uses: https://code.forgejo.org/actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Get changed files
|
||||
id: changed-files
|
||||
uses: https://code.forgejo.org/tj-actions/changed-files@v47
|
||||
|
||||
- name: Run yamllint
|
||||
if: steps.changed-files.outputs.any_changed == 'true'
|
||||
run: |
|
||||
for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
|
||||
if [[ "$file" == *.yml || "$file" == *.yaml ]]; then
|
||||
yamllint "$file"
|
||||
fi
|
||||
done
|
||||
|
||||
ansible-lint:
|
||||
runs-on: infra-1
|
||||
container:
|
||||
image: quay.io/fedora/fedora:latest
|
||||
steps:
|
||||
- name: Install testing tools
|
||||
run: |
|
||||
dnf install -y python3-pip nodejs git
|
||||
pip3 install ansible-core ansible-lint
|
||||
|
||||
- name: Install ansible collections
|
||||
run: |
|
||||
ansible-galaxy collection install \
|
||||
community.zabbix \
|
||||
community.general \
|
||||
ansible.posix
|
||||
|
||||
- name: Checkout code
|
||||
uses: https://code.forgejo.org/actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Create symlink to overcome absolute paths
|
||||
run: |
|
||||
mkdir -p /srv/web/infra/
|
||||
ln -s /workspace/infra/ansible /srv/web/infra/ansible
|
||||
|
||||
- name: Get changed files
|
||||
id: changed-files
|
||||
uses: https://code.forgejo.org/tj-actions/changed-files@v47
|
||||
|
||||
- name: Run ansible-lint
|
||||
if: steps.changed-files.outputs.any_changed == 'true'
|
||||
run: |
|
||||
for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
|
||||
ansible-lint "$file"
|
||||
done
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
---
|
||||
name: Differential yamllint
|
||||
|
||||
"on":
|
||||
push:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
yamllint-job:
|
||||
runs-on: infra-1
|
||||
steps:
|
||||
- name: Repository checkout
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 100
|
||||
|
||||
- name: VCS Diff Lint
|
||||
uses: https://github.com/fedora-copr/vcs-diff-lint-action@v1
|
||||
id: VCS_Diff_Lint
|
||||
with:
|
||||
linter_tags: |
|
||||
yamllint
|
||||
6
.gitignore
vendored
6
.gitignore
vendored
|
|
@ -1,11 +1,5 @@
|
|||
*.swp
|
||||
*.pyc
|
||||
|
||||
# Cursor workspace
|
||||
.cursor
|
||||
|
||||
# emacs projectile
|
||||
.projectile
|
||||
|
||||
# ansible-lint directory
|
||||
.ansible/
|
||||
|
|
|
|||
|
|
@ -1,22 +1,22 @@
|
|||
---
|
||||
# See https://pre-commit.com for more information
|
||||
# See https://pre-commit.com/hooks.html for more hooks
|
||||
repos:
|
||||
---
|
||||
# See https://pre-commit.com for more information
|
||||
# See https://pre-commit.com/hooks.html for more hooks
|
||||
repos:
|
||||
|
||||
# - repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
# rev: v3.2.0
|
||||
# hooks:
|
||||
# - id: trailing-whitespace
|
||||
# - id: end-of-file-fixer
|
||||
# - id: check-yaml
|
||||
# - id: check-added-large-files
|
||||
# - repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
# rev: v3.2.0
|
||||
# hooks:
|
||||
# - id: trailing-whitespace
|
||||
# - id: end-of-file-fixer
|
||||
# - id: check-yaml
|
||||
# - id: check-added-large-files
|
||||
|
||||
- repo: https://github.com/adrienverge/yamllint
|
||||
rev: v1.35.1
|
||||
hooks:
|
||||
- id: yamllint
|
||||
- repo: https://github.com/adrienverge/yamllint
|
||||
rev: v1.35.1
|
||||
hooks:
|
||||
- id: yamllint
|
||||
|
||||
# - repo: https://github.com/ansible/ansible-lint
|
||||
# rev: v24.12.1
|
||||
# hooks:
|
||||
# - id: ansible-lint
|
||||
# - repo: https://github.com/ansible/ansible-lint
|
||||
# rev: v24.12.1
|
||||
# hooks:
|
||||
# - id: ansible-lint
|
||||
|
|
|
|||
|
|
@ -23,8 +23,4 @@ rules:
|
|||
# level: warning
|
||||
truthy:
|
||||
allowed-values: ['true', 'false', 'yes', 'no']
|
||||
|
||||
ignore:
|
||||
- '*/templates/*'
|
||||
- '*/openshift-apps/*/templates/*'
|
||||
...
|
||||
|
|
|
|||
6
.zuul.yaml
Normal file
6
.zuul.yaml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
---
|
||||
- project:
|
||||
check:
|
||||
jobs:
|
||||
- fi-ansible-lint-diff
|
||||
- fi-yamllint-diff
|
||||
108
AGENTS.md
108
AGENTS.md
|
|
@ -1,108 +0,0 @@
|
|||
# AGENTS.md
|
||||
|
||||
This file provides guidance to AI coding agents when working with code in this repository.
|
||||
|
||||
## Project Overview
|
||||
|
||||
Ansible automation for the entire Fedora Project infrastructure. Manages hundreds of bare-metal hosts, VMs, and OpenShift 4 applications across production and staging environments. The control host is **batcave01** (`/srv/web/infra/ansible` public, `/srv/private/ansible` private).
|
||||
|
||||
Repository is hosted at https://forge.fedoraproject.org/infra/ansible
|
||||
|
||||
## Linting
|
||||
|
||||
Run yamllint on changed files:
|
||||
```sh
|
||||
yamllint path/to/file.yml
|
||||
```
|
||||
|
||||
Run ansible-lint on changed files:
|
||||
```sh
|
||||
ansible-lint path/to/file.yml
|
||||
```
|
||||
|
||||
CI runs both linters on changed files only (Forgejo Actions on `quay.io/fedora/fedora:latest`). The `community.zabbix` collection is installed before ansible-lint runs.
|
||||
|
||||
### Linting configuration
|
||||
|
||||
- **yamllint** (`.yamllint.yaml`): 2-space indentation (warning level), line-length disabled, octal values forbidden, truthy values restricted to `true/false/yes/no`, templates directories ignored.
|
||||
- **ansible-lint** (`.ansible-lint`): Runs in offline mode. Skipped rules: `yaml`, `role-name[path]`, `var-naming[no-role-prefix]`, `no-changed-when`, `ignore-errors`. Uses `mock_modules` and `mock_roles` to pass syntax checks without all dependencies.
|
||||
|
||||
## Architecture
|
||||
|
||||
### Directory structure
|
||||
|
||||
- `playbooks/groups/` — One playbook per service group (multi-host). Filename should be descriptive.
|
||||
- `playbooks/hosts/` — One playbook per unique host. Filename MUST be `FQDN.yml`.
|
||||
- `playbooks/openshift-apps/` — ~60 OCP4 application deployments.
|
||||
- `playbooks/manual/` — Admin-only playbooks, never run by cron.
|
||||
- `playbooks/include/` — Shared playbook fragments (proxy, virt, cert).
|
||||
- `roles/` — 134 roles. Flat structure with some namespacing (`openshift/`, `openshift-apps/`, `awx/`, `rabbit/`).
|
||||
- `roles/base/` — Applied to ALL managed hosts. Changes here have maximum blast radius.
|
||||
- `inventory/` — Host definitions, `group_vars/` (150 files), `host_vars/`, and `zzz-inventory.config` (constructed inventory plugin, loads last due to `zzz-` prefix).
|
||||
- `vars/all/` — Fedora release cycle variables. Changed every ~6 months during branching/release. Incorrect values break builds across the entire infrastructure.
|
||||
- `vars/global.yml` — Global vars (paths, SSL, base packages).
|
||||
- `tasks/` — Reusable task snippets included in playbooks.
|
||||
- `library/` — Custom Ansible modules (`delete_old_oci_images.py`, `virt_boot`, etc.).
|
||||
- `callback_plugins/` — Custom callbacks (`fedora_messaging_callback.py`, `logdetail.py`). Don't suggest replacing these.
|
||||
- `main.yml` — Master playbook importing all group/host playbooks. Used with `-t tag` to run specific tags across all hosts. Nightly `--check --diff` cron runs all playbooks.
|
||||
|
||||
### Two main deployment patterns
|
||||
|
||||
**OpenShift app pattern** (dominant for new services):
|
||||
1. Playbook in `playbooks/openshift-apps/<app>.yml` targets `os_control[0]:os_control_stg[0]`
|
||||
2. Uses composable `openshift/*` roles: `project`, `object`, `keytab`, `secret-file`, `imagestream`, `route`, `rollout`
|
||||
3. App templates in `roles/openshift-apps/<app>/templates/`
|
||||
4. Uses `gather_facts: false` (runs `oc` commands on control node, not on apps)
|
||||
|
||||
**Group playbook pattern** (traditional VM services):
|
||||
1. Playbook in `playbooks/groups/<group>.yml` with `hosts:` matching inventory group
|
||||
2. Must include standard vars_files (see below)
|
||||
|
||||
### Staging vs Production
|
||||
|
||||
Same inventory, not separate inventories. Staging hosts use `_stg` suffixed group_vars files. Controlled by:
|
||||
- `env` — `"production"` or `"staging"`
|
||||
- `env_suffix` — `""` for prod, `".stg"` for staging
|
||||
|
||||
## Fedora AI-Assisted Contribution Policy
|
||||
|
||||
This repository is part of the Fedora Project and subject to the [Fedora AI-Assisted Contributions Policy](https://docs.fedoraproject.org/en-US/council/policy/ai-contribution-policy/). Key requirements:
|
||||
|
||||
- **Accountability**: The human contributor is always the author and is fully accountable for the entirety of AI-assisted contributions. All submissions must meet project standards for quality, license compliance, and utility.
|
||||
- **Transparency**: Use of AI tools MUST be disclosed when the significant part of the contribution is taken from a tool without changes. For git contributions, use an `Assisted-by:` commit message trailer (e.g., `Assisted-by: ChatGPTv5` or `Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>`).
|
||||
- **No AI-only judgments**: AI MUST NOT be used as the sole or final arbiter for substantive or subjective judgments on contributions, nor for evaluating a person's standing in the community. Automated objective validation (CI/CD, testing, linting) is permitted.
|
||||
|
||||
When generating commit messages, always include the `Assisted-by:` trailer naming the specific AI model and version used.
|
||||
|
||||
## Coding Conventions
|
||||
|
||||
### Required vars_files in all group/host playbooks
|
||||
```yaml
|
||||
vars_files:
|
||||
- /srv/web/infra/ansible/vars/global.yml
|
||||
- "{{ private }}/vars.yml"
|
||||
- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
|
||||
```
|
||||
These hardcoded paths are the production layout on batcave01. Do not make them relative or configurable.
|
||||
|
||||
### Style rules
|
||||
- Use `.yml` not `.yaml` for file extensions. Exception: `vars/all/*.yaml` is historical — don't "fix" this.
|
||||
- Add `.j2` extension to all Jinja2 templates. A `.yml` file in `templates/` without `.j2` won't render Jinja expressions.
|
||||
- 2-space YAML indentation. Line length is not enforced.
|
||||
- Prefer readable multi-line module args over single-line `module: name=x arg=y` format.
|
||||
- Standard tags: `packages` (installs/removes packages), `config` (installs config files).
|
||||
- `build` and `rollout` tags use `never` to prevent accidental execution.
|
||||
- All playbooks must be **idempotent** — they can be run at any time by the nightly cron.
|
||||
|
||||
### Common pitfalls
|
||||
- Forgetting to update multiple files in `vars/all/` together during release transitions (e.g., branching requires `FedoraBranched.yaml`, `00-FedoraCycleNumber.yaml`, `FedoraBranchedBodhi.yaml`, and `Frozen.yaml`).
|
||||
- Breaking idempotency — generates noise in nightly `--check --diff` and masks real drift.
|
||||
- OpenShift apps must target `os_control[0]:os_control_stg[0]`, not all control nodes.
|
||||
|
||||
### Domain terminology
|
||||
- **batcave01** — Ansible control host
|
||||
- **FAS/IPA** — Fedora Account System (identity provider)
|
||||
- **Koji** — Build system (VM-based, not OpenShift)
|
||||
- **Bodhi** — Update management (runs on OpenShift)
|
||||
- **dist-git/src.fedoraproject.org** — Package source repositories
|
||||
- **fedora-messaging/RabbitMQ** — AMQP message bus connecting services
|
||||
31
README.md
31
README.md
|
|
@ -1,19 +1,19 @@
|
|||
Fedora Infrastructure
|
||||
=====================
|
||||
|
||||
Welcome! This is the Fedora Infrastructure Ansible Forge project.
|
||||
Welcome! This is the Fedora Infrastructure Ansible Pagure project.
|
||||
|
||||
Pull requests and forks can be made against this repository hosted
|
||||
at <https://forge.fedoraproject.org/infra/ansible>
|
||||
at https://pagure.io/fedora-infra/ansible
|
||||
|
||||
This repository is also mirrored for production runs to
|
||||
<https://infrastructure.fedoraproject.org/infra/ansible/>
|
||||
https://infrastructure.fedoraproject.org/infra/ansible/
|
||||
but this is the working repository where changes are made.
|
||||
|
||||
If you would like to help out with Fedora Infrastructure, see:
|
||||
|
||||
* <https://docs.fedoraproject.org/en-US/infra/gettingstarted/>
|
||||
* <https://docs.fedoraproject.org/en-US/infra/apprentice/>
|
||||
* https://docs.fedoraproject.org/en-US/infra/gettingstarted/
|
||||
* https://docs.fedoraproject.org/en-US/infra/apprentice/
|
||||
|
||||
Ansible repository/structure
|
||||
----------------------------
|
||||
|
|
@ -100,19 +100,19 @@ Contributing and Licensing
|
|||
Contributions to this repository are subject to the Fedora Project
|
||||
Contributor Agreement. If no license is specified, the MIT license is used, otherwise
|
||||
the contribution is under the specified acceptable Fedora License.
|
||||
See <https://docs.fedoraproject.org/en-US/legal/fpca/>
|
||||
See https://docs.fedoraproject.org/en-US/legal/fpca/
|
||||
for more information.
|
||||
|
||||
Contributing Pull Requests
|
||||
--------------------------
|
||||
|
||||
If found a way to improve this repository or fix an issue found in our
|
||||
infrastructure tracker (see <https://forge.fedoraproject.org/infra/tickets>)
|
||||
infrastructure tracker (see https://forge.fedoraproject.org/infra/tickets)
|
||||
open a pull-request.
|
||||
|
||||
You either should have capability to run the playbooks after they have been reviewed,
|
||||
and merged or find the person responsible and work with them to make sure the changes
|
||||
will be aplied afterwards.
|
||||
will be aplied afterwards.
|
||||
|
||||
We are currently working on a simple to use list of Point Of Contanct people for the applications
|
||||
here, untill it is done, you can, look at people that recently edited the ansible files,
|
||||
|
|
@ -120,7 +120,7 @@ or if you belong to sysadmin group, view the /etc/ansible_utils/rbac.yaml locate
|
|||
where you can see the groups of people that have capabilities to run the relevant playbooks.
|
||||
|
||||
For example, to upgrade Release Monitoring, you need to run playbook openshift-apps/release-monitoring.yaml.
|
||||
People in sysadmin-releasemonitoring have that capability, and you cand find the members in <https://accounts.fedoraproject.org/group/sysadmin-releasemonitoring/>
|
||||
People in sysadmin-releasemonitoring have that capability, and you cand find the members in https://accounts.fedoraproject.org/group/sysadmin-releasemonitoring/
|
||||
|
||||
If the application in question is not on the critical path it should be sufficient,
|
||||
if person responsible for the application reviews the PR.
|
||||
|
|
@ -131,12 +131,13 @@ at least two different people should review the PR.
|
|||
If there is any risk at all, that the application of the changes would induce downtime,
|
||||
work closely with other to ensure that the downtime is properly scheduled:
|
||||
|
||||
* there is an issue in <https://forge.fedoraproject.org/infra/tickets> specifying the downtime
|
||||
* there is an email sent to the devel-list
|
||||
* <https://status.fedoraproject.org> is updated (see <https://docs.fedoraproject.org/en-US/infra/sysadmin_guide/status-fedora/>)
|
||||
- there is an issue in https://forge.fedoraproject.org/infra/tickets specifying the downtime
|
||||
- there is an email sent to the devel-list
|
||||
- https://status.fedoraproject.org is updated (see https://docs.fedoraproject.org/en-US/infra/sysadmin_guide/status-fedora/)
|
||||
|
||||
Applications on critical path: forge, pagure, mirrormanager, toddlers, bodhi, noggin, mdapi, rpmautospec, pagure-dist-git, mirror_from_pagure, fedora-messaging, dist-git, PDC/FPDC, FMN, sigul
|
||||
Applications on critical path: pagure, mirrormanager, toddlers, bodhi, noggin, mdapi, rpmautospec, pagure-dist-git, mirror_from_pagure, fedora-messaging, dist-git, PDC/FPDC, FMN, sigul
|
||||
robosignatory, tag2distrepo, ci-resultsdb-listener, stylo, mirrorlist
|
||||
resultsdb, Nagios, koschei, wiki / mediawiki, wiki / moin, waiverdb,
|
||||
greenwave, ODCS, Mailman3 / HK, mailman 2, OSBS, pungi, koji, MBS,
|
||||
resultsdb, Nagios, koschei, wiki / mediawiki, wiki / moin, waiverdb,
|
||||
greenwave, ODCS, Mailman3 / HK, mailman 2, OSBS, pungi, koji, MBS,
|
||||
IPA, rabbitmq, geoip,ipsilon
|
||||
|
||||
|
|
|
|||
|
|
@ -1,29 +0,0 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGpQExgBEADP5+9qybH7gg2aapWmy7dBLL64j45ALFyYtZCFprsFALW4OdIH
|
||||
5jQwnt/k3ErygvVA2HTsN85f2vTnBUeRyCcZhgx6wLbfxSMqI1eCvWfTgTQ+Xyd/
|
||||
TB8eDUW5hVPtW3M/9lCNm3gW8FFsY8eo62gbKQFMEHqv4jzvycJHC+dLSJwqDhRo
|
||||
8QXcw8Xa3yyD1i4x/CJsxgnkbAuNN3FvJ0ALdc4QkeCslTV0R/APZYojOsdOxxj9
|
||||
6OM8KsHTofoM90x7uDH5SBYfszA/dV38s7IIRMdhQVff7Vyru1Wg19xWAV1DB/XD
|
||||
fIarhFV+UuzjdGBdYHCh8dJ7f+l3IvzeYtNDdgf1uho6TPU79OaGF5BQdyq3h3Ep
|
||||
n7MvP7kDmf3zp/169ED1KafBzKlCxCB1f6C5icaddl4GXHhsSnLVU6GNWVDYzs49
|
||||
PT1iJquGqQIVrdvZPVRxF9EajtOy2ihZrGuyu0CfEhmlxbxodRhl4QWxHtqI9VQf
|
||||
qr8hNt3PJjQ9ZXF+39u65aV8VmsZm0ifwLjXf028KHYEn/ZxIADJpf6cs3tST/FC
|
||||
NUdWydaRy15wHZGAW4DjITJYyOaxS/O88c0AYiPpyIzjcdM5X6yPd/Ks7jNp4jix
|
||||
xq5+in4kT6Ob6i/vLGPiMOg2lgoDyk9Se4Xnfj0mji8BA+0Kd8822UQZtQARAQAB
|
||||
tEBGZWRvcmEgSW5mcmFzdHJ1Y3R1cmUgKGluZnJhc3RydWN0dXJlKSA8YWRtaW5A
|
||||
ZmVkb3JhcHJvamVjdC5vcmc+iQJSBBMBCAA8FiEEZsXzm0iCia3GFtyfH6GpJwHY
|
||||
P8QFAmpQExgCGw8FCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEB+hqScB
|
||||
2D/ET3wP/RvrubZbpK5TGSnLnxbOx74RfjSW7B01cKuLEnZV4VMMlqZONTpvMPBT
|
||||
t69aifiuVYsD1Pynj+WA0HduZdLnoczrlIYAqeAPwGOPz/ogmsEeTtnlCLzAT8Gr
|
||||
VIT0MR/jhP/IUVuZQ0t7wY2Ezl7yYRnYiB4y8ZuofF8hmby363bceMsX0T/aDQNy
|
||||
brbWKF38Ag8FQfzhTnYHnlBVUdo0Sdu94uINoW0jh6Y+ml+zusx4rP+BBqEvSQIG
|
||||
xYEbWaDxxGyrCIIADz6yz6/0w6HYBh8LgqPOfRKqo/0KTe4ZuzX3Ao8r03ZIiQj4
|
||||
7N+dA8bC9lPgHsoa6hMXamR6Mh1m/561RIzPSN8bkygg3d+Og4sglGI0FojFmdF7
|
||||
C/WHZwXpMnLkaDIQgju0JCVO9Blut85u7u0WM5AcoEC7ODsv+kxAIFiTAZVf2zh2
|
||||
1fV+lDyMVOtbykdn7YjbRvFGj3++2CJq+jP3S0Pnsc34eKsY+bw0pmCV2Wu1VPeA
|
||||
V8hnpeGqz2vyhG8TqSXZnSgWaVR5T52GCNiohqPBMaOrNFa5xoV+FYPAZbPEJf/A
|
||||
m85HsYgzmE9DbExX9JxrPpPiCmBe/DDmweP7slq+016OUHafR0shOBXVH5OFLU+w
|
||||
esbMjQFiccYct/oGbfUZVIyDBxAL3Wq8yGzzI4sskR5HqoYIeNYb
|
||||
=2YPV
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
|
|
@ -1,10 +1,9 @@
|
|||
[epel]
|
||||
name=Extras Packages for Enterprise Linux $releasever - $basearch
|
||||
# We aren't using mirrormanager here, but pointing direct to our repos
|
||||
# So, we want to just point to '10' here and depend on the link that exists
|
||||
# to point us to the newest minor release.
|
||||
# This is a bit too magic, esp. as we are using the infra. repo. and explicitly
|
||||
# point to a 10.x variant ... might as well do the same here.
|
||||
# baseurl=https://infrastructure.fedoraproject.org/pub/epel/$releasever${releasever_minor:+z}/Everything/$basearch/
|
||||
baseurl=https://infrastructure.fedoraproject.org/pub/epel/10z/Everything/$basearch/
|
||||
baseurl=https://infrastructure.fedoraproject.org/pub/epel/10.1/Everything/$basearch/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10
|
||||
|
|
@ -12,7 +11,7 @@ gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10
|
|||
[epel-testing]
|
||||
name=Extras Packages for Enterprise Linux $releasever - $basearch
|
||||
# baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/$releasever${releasever_minor:+z}/Everything/$basearch/
|
||||
baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/10z/Everything/$basearch/
|
||||
baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/10.1/Everything/$basearch/
|
||||
enabled=0
|
||||
gpgcheck=1
|
||||
gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10
|
||||
|
|
|
|||
|
|
@ -1,6 +0,0 @@
|
|||
[infrastructure-tags]
|
||||
name=Fedora Infrastructure tag $releasever - $basearch
|
||||
baseurl=https://kojipkgs.fedoraproject.org/repos-dist/epel$releasever-infra/latest/$basearch/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS-20260709
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
[infrastructure-tags-stg]
|
||||
name=Fedora Infrastructure tag $releasever - $basearch
|
||||
baseurl=https://kojipkgs.fedoraproject.org/repos-dist/epel$releasever-infra-stg/latest/$basearch/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS-20260709
|
||||
|
|
@ -12,25 +12,24 @@ gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg
|
|||
enabled=1
|
||||
gpgcheck=1
|
||||
|
||||
# These are not using mirrormanager, so point to '10' which will use the link
|
||||
# to the latest minor release.
|
||||
# NOTE: When you change the 10.x here also change it in the epel10.repo file.
|
||||
[rhel10-BaseOS]
|
||||
name = rhel10 BaseOS $basearch
|
||||
baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/baseos
|
||||
baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/baseos
|
||||
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
|
||||
[rhel10-AppStream]
|
||||
name = rhel10 AppStream $basearch
|
||||
baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/appstream
|
||||
baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/appstream
|
||||
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
|
||||
[rhel10-CRB]
|
||||
name = rhel10 CodeReadyBuilder $basearch
|
||||
baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/crb
|
||||
baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/crb
|
||||
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
|
|
|
|||
|
|
@ -1,2 +1,4 @@
|
|||
# Run quick mirror fedora every 10minutes
|
||||
*/10 * * * * root flock -n -E0 /tmp/download-sync -c '/root/quick-fedora-mirror/quick-fedora-mirror -c /root/quick-fedora-mirror/quick-fedora-mirror.conf'
|
||||
## Need to run this to keep centos mirror up to date.
|
||||
00 1,7,13,19 * * * root /usr/local/bin/lock-wrapper sync-up-downloads "/usr/local/bin/sync-up-centos"
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
# Run quick mirror fedora every 10minutes
|
||||
MAILTO=root@fedoraproject.org
|
||||
*/10 * * * * root flock -n -E0 /tmp/download-sync -c '/root/quick-fedora-mirror/quick-fedora-mirror -c /root/quick-fedora-mirror.conf'
|
||||
## Need to run this to keep centos mirror up to date.
|
||||
00 1,7,13,19 * * * root /usr/local/bin/lock-wrapper sync-up-downloads "/usr/local/bin/sync-up-centos"
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
RSYNC='/usr/bin/rsync'
|
||||
RS_OPT="-avSHP --numeric-ids"
|
||||
RS_DEADLY="--delete --delete-excluded --delete-delay --delay-updates"
|
||||
ALT_EXCLUDES="--exclude 44_Beta*" # 2026-04-16 - tmp. running out of space
|
||||
ALT_EXCLUDES=""
|
||||
EPL_EXCLUDES=""
|
||||
FED_EXCLUDES=""
|
||||
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ RewriteRule ^/released/i/m/imapsync https://pagure.io/releases/imapsync [R=301]
|
|||
RewriteRule ^/released/imapsync https://pagure.io/releases/imapsync [R=301]
|
||||
|
||||
RewriteRule ^/fedora-infrastructure/report https://forge.fedoraproject.org/infra/tickets [R=301]
|
||||
RewriteRule ^/fedora-infrastructure/ticket/(.*) https://forge.fedoraproject.org/infra/tickets/issues/$1 [R=301]
|
||||
RewriteRule ^/fedora-infrastructure/ticket/(.*) https://forge.fedoraproject.org/infra/tickets/$1 [R=301]
|
||||
RewriteRule ^/fedora-infrastructure https://forge.fedoraproject.org/infra/tickets [R=301]
|
||||
|
||||
RewriteRule ^/fesco/report https://pagure.io/fesco/issues [R=301]
|
||||
|
|
@ -90,13 +90,13 @@ RewriteRule ^/gfs2-utils/report https://pagure.io/gfs2-utils/issues [R=301]
|
|||
RewriteRule ^/gfs2-utils/ticket/(.*) https://pagure.io/gfs2-utils/issue/$1 [R=301]
|
||||
RewriteRule ^/gfs2-utils https://pagure.io/gfs2-utils [R=301]
|
||||
|
||||
RewriteRule ^/elections/report https://forge.fedoraproject.org/apps/elections/issues [R=301]
|
||||
RewriteRule ^/elections/ticket/(.*) https://forge.fedoraproject.org/apps/elections/issues/$1 [R=301]
|
||||
RewriteRule ^/elections https://forge.fedoraproject.org/apps/elections [R=301]
|
||||
RewriteRule ^/elections/report https://pagure.io/elections/issues [R=301]
|
||||
RewriteRule ^/elections/ticket/(.*) https://pagure.io/elections/issue/$1 [R=301]
|
||||
RewriteRule ^/elections https://pagure.io/elections [R=301]
|
||||
|
||||
RewriteRule ^/fedocal/report https://forge.fedoraproject.org/apps/fedocal/issues [R=301]
|
||||
RewriteRule ^/fedocal/ticket/(.*) https://forge.fedoraproject.org/apps/fedocal/issue/$1 [R=301]
|
||||
RewriteRule ^/fedocal https://forge.fedoraproject.org/apps/fedocal [R=301]
|
||||
RewriteRule ^/fedocal/report https://pagure.io/fedocal/issues [R=301]
|
||||
RewriteRule ^/fedocal/ticket/(.*) https://pagure.io/fedocal/issue/$1 [R=301]
|
||||
RewriteRule ^/fedocal https://pagure.io/fedocal [R=301]
|
||||
|
||||
RewriteRule ^/FedoraReview/report https://pagure.io/FedoraReview/issues [R=301]
|
||||
RewriteRule ^/FedoraReview/ticket/(.*) https://pagure.io/FedoraReview/issue/$1 [R=301]
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -1,94 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: ts=4:sw=4:expandtab:tw=100
|
||||
|
||||
# This script manages a set of backup files which are prefixed with ISO dates (YYYY-MM-DD).
|
||||
# - As new files come in, we want to delete the old ones.
|
||||
# - RETENTION_DAYS decides how old is "old".
|
||||
# - But if no new files come in (e.g. the backup process is broken), we don't want to
|
||||
# end up deleting _all_ the files, just because they're old.
|
||||
# - MIN_KEEP decides how many files to keep.
|
||||
#
|
||||
# Usage: ./retain.sh --dry-run <directory>
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
DRY_RUN=false
|
||||
DIR=""
|
||||
|
||||
# Parse arguments (extremely verbosely to satisfy the LLM reviewing this PR)
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--dry-run)
|
||||
DRY_RUN=true
|
||||
shift
|
||||
;;
|
||||
-*)
|
||||
echo "Error: Unknown flag '$1'" >&2
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
if [[ -z "$DIR" ]]; then
|
||||
DIR="$1"
|
||||
shift
|
||||
else
|
||||
echo "Error: Multiple positional arguments provided. Expected only DIR." >&2
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
# Validate required argument
|
||||
if [[ -z "$DIR" ]]; then
|
||||
echo "Error: DIR argument is required." >&2
|
||||
echo "Usage: $0 [--dry-run] DIR" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
RETENTION_DAYS="${RETENTION_DAYS:-31}"
|
||||
MIN_KEEP="${MIN_KEEP:-31}"
|
||||
CUTOFF=$(date -d "${RETENTION_DAYS} days ago" +%Y-%m-%d)
|
||||
|
||||
# Collect all dated files (basename matches YYYY-MM-DD-*)
|
||||
mapfile -t DATED_FILES < <(
|
||||
find "$DIR" -maxdepth 1 -type f -name "[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]-*" \
|
||||
| sort -r # sort descending by filename (date first)
|
||||
)
|
||||
|
||||
total=${#DATED_FILES[@]}
|
||||
|
||||
$DRY_RUN && echo "*** DRY RUN — no files will be deleted ***"
|
||||
echo ""
|
||||
|
||||
if [[ $total -eq 0 ]]; then
|
||||
echo "No dated files found in '$DIR'."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
deleted=0
|
||||
skipped_retention=0
|
||||
|
||||
for i in "${!DATED_FILES[@]}"; do
|
||||
filepath="${DATED_FILES[$i]}"
|
||||
filename=$(basename "$filepath")
|
||||
file_date="${filename:0:10}" # extract YYYY-MM-DD
|
||||
|
||||
# Always keep the MIN_KEEP most-recent files (indices 0..MIN_KEEP-1)
|
||||
if [[ $i -lt $MIN_KEEP ]]; then
|
||||
echo "KEEP (newest ${MIN_KEEP}): $filename"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Delete if the file's date is before the cutoff
|
||||
if [[ "$file_date" < "$CUTOFF" ]]; then
|
||||
echo "DELETE (expired): $filename"
|
||||
$DRY_RUN || rm -- "$filepath"
|
||||
deleted="$((deleted + 1))"
|
||||
else
|
||||
echo "KEEP (within retention): $filename"
|
||||
skipped_retention="$((skipped_retention + 1))"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Deleted: $deleted files (dry-run=$DRY_RUN). Kept by min-count: $(( total < MIN_KEEP ? total : MIN_KEEP )). Kept by date window: $skipped_retention."
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
---
|
||||
# Optional annotations for openshift-app-image-report.py.
|
||||
#
|
||||
# The scanner reads the OpenShift app files directly. Use this file for cases
|
||||
# that static scanning cannot infer, such as Jinja variables, external
|
||||
# Dockerfiles, or manually maintained tags.
|
||||
|
||||
# fill in like
|
||||
# annotations:
|
||||
# - app: <roles/openshift-apps/THIS>
|
||||
# match: <string to match in image/source or path>
|
||||
# os_version: <replacemet version text>
|
||||
# kind: <optional replacement kind>
|
||||
# note: <display note>
|
||||
# EXAMPLE:
|
||||
# annotations:
|
||||
# - app: transtats
|
||||
# match: registry.fedoraproject.org/fedora:34
|
||||
# os_version: Fedora 34
|
||||
# note: Inline Dockerfile base image; should be reviewed for EOL.
|
||||
|
||||
annotations: []
|
||||
|
|
@ -1,522 +0,0 @@
|
|||
#! /usr/bin/python3
|
||||
|
||||
import argparse
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
from dataclasses import dataclass
|
||||
from pathlib import Path
|
||||
|
||||
try:
|
||||
import yaml
|
||||
except ImportError:
|
||||
yaml = None
|
||||
|
||||
|
||||
SCRIPT_DIR = Path(__file__).resolve().parent
|
||||
NOTES_FILE = SCRIPT_DIR / "openshift-app-image-notes.yml"
|
||||
|
||||
|
||||
def find_repo_root(start):
|
||||
for path in (start, *start.parents):
|
||||
if (path / "roles" / "openshift-apps").is_dir():
|
||||
return path
|
||||
print("Error: could not find roles/openshift-apps above script path", file=sys.stderr)
|
||||
sys.exit(2)
|
||||
|
||||
|
||||
REPO_ROOT = find_repo_root(SCRIPT_DIR)
|
||||
APP_ROOT = REPO_ROOT / "roles" / "openshift-apps"
|
||||
|
||||
IMAGE_PREFIXES = (
|
||||
"docker.io/",
|
||||
"docker-registry.",
|
||||
"fedora:",
|
||||
"image-registry.",
|
||||
"quay.io/",
|
||||
"redis:",
|
||||
"registry.access.redhat.com/",
|
||||
"registry.fedoraproject.org/",
|
||||
"solr:",
|
||||
"valkey/",
|
||||
"busybox",
|
||||
)
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class Finding:
|
||||
app: str
|
||||
env: str
|
||||
kind: str
|
||||
image: str
|
||||
os_version: str
|
||||
floating: bool
|
||||
unresolved: bool
|
||||
path: str
|
||||
line: int
|
||||
note: str = ""
|
||||
|
||||
|
||||
def _strip_value(value):
|
||||
value = value.strip()
|
||||
if value.startswith(("'", '"')) and value.endswith(("'", '"')):
|
||||
value = value[1:-1]
|
||||
return value.strip()
|
||||
|
||||
|
||||
def _looks_like_image(value):
|
||||
value = _strip_value(value)
|
||||
if not value:
|
||||
return False
|
||||
if value.startswith(IMAGE_PREFIXES):
|
||||
return True
|
||||
if "/" in value and ":" in value:
|
||||
return True
|
||||
if ":" in value and not value.startswith(("http://", "https://")):
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def _tag_from_image(image):
|
||||
if "@" in image:
|
||||
return image.rsplit("@", 1)[1]
|
||||
# Only inspect the image-name tail so registry ports are not treated as tags.
|
||||
tail = image.rsplit("/", 1)[-1]
|
||||
if ":" not in tail:
|
||||
return ""
|
||||
return tail.rsplit(":", 1)[1]
|
||||
|
||||
|
||||
def _is_floating(image):
|
||||
if "{{" in image:
|
||||
return False
|
||||
tag = _tag_from_image(image)
|
||||
return tag in ("", "latest")
|
||||
|
||||
|
||||
def _python_version(text):
|
||||
match = re.search(r"python[-:]?(\d)(\d{1,2})", text)
|
||||
if not match:
|
||||
return ""
|
||||
major, minor = match.groups()
|
||||
return f"Python {major}.{minor}"
|
||||
|
||||
|
||||
def _infer_os_version(image):
|
||||
low = image.lower()
|
||||
|
||||
match = re.search(
|
||||
r"(?:registry\.fedoraproject\.org/|quay\.io/fedora/)?fedora:(\d+|latest)", low
|
||||
)
|
||||
if match:
|
||||
return f"Fedora {match.group(1)}"
|
||||
|
||||
match = re.search(r"ubi(\d+)", low)
|
||||
if match:
|
||||
parts = [f"UBI {match.group(1)}"]
|
||||
pyver = _python_version(low)
|
||||
if pyver:
|
||||
parts.append(pyver)
|
||||
nginx = re.search(r"nginx[-:]?(\d)(\d{2})", low)
|
||||
if nginx:
|
||||
parts.append(f"nginx {nginx.group(1)}.{nginx.group(2)}")
|
||||
return " / ".join(parts)
|
||||
|
||||
pyver = _python_version(low)
|
||||
if pyver:
|
||||
return pyver
|
||||
|
||||
if low.startswith("busybox"):
|
||||
return "busybox"
|
||||
if low.startswith("redis:"):
|
||||
return "redis"
|
||||
if "bitnami" in low and re.search(r"(^|[/:_-])redis($|[/:_.-])", low):
|
||||
return "redis"
|
||||
if low.startswith("solr:"):
|
||||
return "Solr"
|
||||
if low.startswith("valkey/") or low.startswith("valkey:"):
|
||||
return "Valkey"
|
||||
|
||||
return "?"
|
||||
|
||||
|
||||
def _source_kind(line, value):
|
||||
stripped = line.strip()
|
||||
if stripped.startswith("FROM "):
|
||||
return "dockerfile-from"
|
||||
if stripped.startswith("image:"):
|
||||
return "runtime-image"
|
||||
if stripped.startswith("dockerfilePath:"):
|
||||
return "dockerfile-path"
|
||||
if stripped.startswith("uri:"):
|
||||
return "git-source"
|
||||
if stripped.startswith("ref:"):
|
||||
return "git-ref"
|
||||
if stripped.startswith("name:"):
|
||||
if value.startswith("image-registry.") or value.startswith("docker-registry."):
|
||||
return "internal-image"
|
||||
return "image-or-builder"
|
||||
return "image-reference"
|
||||
|
||||
|
||||
def _env_from_jinja_condition(line):
|
||||
if "env" not in line:
|
||||
return None
|
||||
if re.search(r"env\s*==\s*['\"]staging['\"]", line):
|
||||
return "staging"
|
||||
if re.search(r"env\s*==\s*['\"]production['\"]", line):
|
||||
return "production"
|
||||
return "conditional"
|
||||
|
||||
|
||||
def _opposite_env(env):
|
||||
if env == "staging":
|
||||
return "production"
|
||||
if env == "production":
|
||||
return "staging"
|
||||
return "conditional"
|
||||
|
||||
|
||||
def _update_env_scope(line, env_stack, current_env):
|
||||
stripped = line.strip()
|
||||
if not stripped.startswith("{%"):
|
||||
return current_env
|
||||
|
||||
if re.match(r"{%-?\s*if\b", stripped):
|
||||
next_env = _env_from_jinja_condition(stripped)
|
||||
env_stack.append((current_env, next_env))
|
||||
return next_env or current_env
|
||||
|
||||
if re.match(r"{%-?\s*elif\b", stripped):
|
||||
next_env = _env_from_jinja_condition(stripped)
|
||||
if env_stack:
|
||||
previous_env, _old_env = env_stack[-1]
|
||||
env_stack[-1] = (previous_env, next_env)
|
||||
return next_env or current_env
|
||||
|
||||
if re.match(r"{%-?\s*else\s*-?%}", stripped):
|
||||
if not env_stack:
|
||||
return "conditional"
|
||||
_previous_env, if_env = env_stack[-1]
|
||||
if if_env is None:
|
||||
return current_env
|
||||
return _opposite_env(if_env)
|
||||
|
||||
if re.match(r"{%-?\s*endif\s*-?%}", stripped):
|
||||
if not env_stack:
|
||||
return "all"
|
||||
previous_env, _if_env = env_stack.pop()
|
||||
return previous_env
|
||||
|
||||
return current_env
|
||||
|
||||
|
||||
def _line_env(line, current_env):
|
||||
if "{{" in line and "env" in line and "ternary" in line:
|
||||
return "conditional"
|
||||
return current_env
|
||||
|
||||
|
||||
def _iter_scan_files(app_dir):
|
||||
for path in sorted(app_dir.rglob("*")):
|
||||
if not path.is_file():
|
||||
continue
|
||||
rel_parts = path.relative_to(app_dir).parts
|
||||
if not rel_parts or rel_parts[0] not in ("files", "templates", "vars"):
|
||||
continue
|
||||
name = path.name.lower()
|
||||
suffix = path.suffix.lower()
|
||||
if suffix in (".yml", ".yaml", ".j2", ".toml", ".cfg"):
|
||||
yield path
|
||||
continue
|
||||
if "dockerfile" in name or "containerfile" in name:
|
||||
yield path
|
||||
|
||||
|
||||
def _scan_line(line):
|
||||
stripped = line.strip()
|
||||
if not stripped or stripped.startswith("#"):
|
||||
return None
|
||||
|
||||
if stripped.startswith("FROM "):
|
||||
parts = stripped.split()
|
||||
if len(parts) > 1:
|
||||
return parts[1], True
|
||||
return None
|
||||
|
||||
for key in ("image:", "name:", "dockerfilePath:", "uri:", "ref:"):
|
||||
if not stripped.startswith(key):
|
||||
continue
|
||||
value = _strip_value(stripped[len(key) :])
|
||||
if key == "dockerfilePath:":
|
||||
return value, False
|
||||
if key in ("uri:", "ref:"):
|
||||
if "github.com" in value or "gitlab" in value or "{{" in value:
|
||||
return value, False
|
||||
return None
|
||||
if key == "image:" and "{{" in value:
|
||||
return value, True
|
||||
if _looks_like_image(value):
|
||||
return value, True
|
||||
return None
|
||||
|
||||
return None
|
||||
|
||||
|
||||
def scan_apps(app_filter=None):
|
||||
findings = []
|
||||
wanted = set(app_filter or [])
|
||||
for app_dir in sorted(APP_ROOT.iterdir()):
|
||||
if not app_dir.is_dir():
|
||||
continue
|
||||
app = app_dir.name
|
||||
if wanted and app not in wanted:
|
||||
continue
|
||||
for path in _iter_scan_files(app_dir):
|
||||
rel_path = path.relative_to(REPO_ROOT).as_posix()
|
||||
try:
|
||||
lines = path.read_text(encoding="utf-8").splitlines()
|
||||
except UnicodeDecodeError:
|
||||
continue
|
||||
env_stack = []
|
||||
current_env = "all"
|
||||
for lineno, line in enumerate(lines, 1):
|
||||
current_env = _update_env_scope(line, env_stack, current_env)
|
||||
scanned = _scan_line(line)
|
||||
if not scanned:
|
||||
continue
|
||||
value, is_image = scanned
|
||||
unresolved = "{{" in value or "{%" in value
|
||||
if line.strip().startswith("dockerfilePath:"):
|
||||
unresolved = True
|
||||
kind = _source_kind(line, value)
|
||||
os_version = _infer_os_version(value) if is_image else "?"
|
||||
findings.append(
|
||||
Finding(
|
||||
app=app,
|
||||
env=_line_env(line, current_env),
|
||||
kind=kind,
|
||||
image=value,
|
||||
os_version=os_version,
|
||||
floating=_is_floating(value) if is_image else False,
|
||||
unresolved=unresolved,
|
||||
path=rel_path,
|
||||
line=lineno,
|
||||
)
|
||||
)
|
||||
return findings
|
||||
|
||||
|
||||
def load_annotations(notes_file):
|
||||
if not notes_file.exists():
|
||||
return []
|
||||
if yaml is None:
|
||||
print(
|
||||
"Error: python3-yaml is required to read openshift-app-image-notes.yml",
|
||||
file=sys.stderr,
|
||||
)
|
||||
sys.exit(2)
|
||||
with notes_file.open(encoding="utf-8") as stream:
|
||||
data = yaml.safe_load(stream) or {}
|
||||
annotations = data.get("annotations", [])
|
||||
if not isinstance(annotations, list):
|
||||
print(
|
||||
"Error: annotations must be a list in openshift-app-image-notes.yml",
|
||||
file=sys.stderr,
|
||||
)
|
||||
sys.exit(2)
|
||||
return annotations
|
||||
|
||||
|
||||
def apply_annotations(findings, annotations):
|
||||
by_key = {}
|
||||
for item in annotations:
|
||||
if not isinstance(item, dict):
|
||||
continue
|
||||
app = item.get("app")
|
||||
match = item.get("match", "")
|
||||
note = item.get("note", "")
|
||||
os_version = item.get("os_version", "")
|
||||
kind = item.get("kind", "")
|
||||
if not app or not match:
|
||||
continue
|
||||
by_key[(app, match)] = (note, os_version, kind)
|
||||
|
||||
used = set()
|
||||
updated = []
|
||||
for finding in findings:
|
||||
note = finding.note
|
||||
os_version = finding.os_version
|
||||
kind = finding.kind
|
||||
for (app, match), values in by_key.items():
|
||||
if app != finding.app:
|
||||
continue
|
||||
if match not in finding.image and match not in finding.path:
|
||||
continue
|
||||
used.add((app, match))
|
||||
ann_note, ann_os, ann_kind = values
|
||||
note = ann_note or note
|
||||
os_version = ann_os or os_version
|
||||
kind = ann_kind or kind
|
||||
updated.append(
|
||||
Finding(
|
||||
app=finding.app,
|
||||
env=finding.env,
|
||||
kind=kind,
|
||||
image=finding.image,
|
||||
os_version=os_version,
|
||||
floating=finding.floating,
|
||||
unresolved=finding.unresolved,
|
||||
path=finding.path,
|
||||
line=finding.line,
|
||||
note=note,
|
||||
)
|
||||
)
|
||||
return updated, sorted(set(by_key) - used)
|
||||
|
||||
|
||||
def filter_findings(findings, args):
|
||||
filtered = findings
|
||||
if args.env:
|
||||
wanted = set(args.env)
|
||||
env_matches = set(wanted)
|
||||
if "staging" in wanted or "production" in wanted:
|
||||
env_matches.add("all")
|
||||
filtered = [item for item in filtered if item.env in env_matches]
|
||||
if args.kind:
|
||||
wanted = set(args.kind)
|
||||
filtered = [item for item in filtered if item.kind in wanted]
|
||||
if args.floating_only:
|
||||
filtered = [item for item in filtered if item.floating]
|
||||
if args.unresolved_only:
|
||||
filtered = [item for item in filtered if item.unresolved]
|
||||
return filtered
|
||||
|
||||
|
||||
def _short_path(finding):
|
||||
prefix = f"roles/openshift-apps/{finding.app}/"
|
||||
path = finding.path
|
||||
if path.startswith(prefix):
|
||||
path = path[len(prefix) :]
|
||||
return f"{path}:{finding.line}"
|
||||
|
||||
|
||||
def _clip(value, width):
|
||||
if len(value) <= width:
|
||||
return value
|
||||
if width <= 1:
|
||||
return value[:width]
|
||||
return value[: width - 3] + "..."
|
||||
|
||||
|
||||
def print_table(findings):
|
||||
columns = (
|
||||
("APP", 22),
|
||||
("ENV", 11),
|
||||
("KIND", 16),
|
||||
("OS/VERSION", 20),
|
||||
("FLOAT", 5),
|
||||
("PATH", 58),
|
||||
("NOTE", 30),
|
||||
("IMAGE/SOURCE", None),
|
||||
)
|
||||
rows = []
|
||||
for finding in findings:
|
||||
rows.append(
|
||||
(
|
||||
finding.app,
|
||||
finding.env,
|
||||
finding.kind,
|
||||
finding.os_version,
|
||||
"yes" if finding.floating else "",
|
||||
_short_path(finding),
|
||||
finding.note,
|
||||
("?" if finding.unresolved else "") + finding.image,
|
||||
)
|
||||
)
|
||||
|
||||
print(
|
||||
" ".join(
|
||||
name if width is None else name.ljust(width) for name, width in columns
|
||||
)
|
||||
)
|
||||
print(
|
||||
" ".join(
|
||||
"-" * len(name) if width is None else "-" * width for name, width in columns
|
||||
)
|
||||
)
|
||||
for row in rows:
|
||||
print(
|
||||
" ".join(
|
||||
value if width is None else _clip(value, width).ljust(width)
|
||||
for value, (_name, width) in zip(row, columns)
|
||||
)
|
||||
)
|
||||
print(f"\n{len(rows)} findings")
|
||||
|
||||
|
||||
def parse_args(argv):
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Print OpenShift app image and base-image references found in roles/openshift-apps.",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--app",
|
||||
action="append",
|
||||
help="Only report one app. May be used more than once.",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--kind",
|
||||
action="append",
|
||||
help="Only report one finding kind. May be used more than once.",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--env",
|
||||
action="append",
|
||||
choices=("all", "staging", "production", "conditional"),
|
||||
help=(
|
||||
"Only report one environment scope. May be used more than once. "
|
||||
"staging and production also include all."
|
||||
),
|
||||
)
|
||||
parser.add_argument(
|
||||
"--floating-only",
|
||||
action="store_true",
|
||||
help="Only show unpinned/latest image references.",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--unresolved-only",
|
||||
action="store_true",
|
||||
help="Only show Jinja or external Dockerfile references.",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--notes", default=os.fspath(NOTES_FILE), help="Annotation YAML file to load."
|
||||
)
|
||||
parser.add_argument(
|
||||
"--no-note-warnings",
|
||||
action="store_true",
|
||||
help="Do not warn about annotations that match no rows.",
|
||||
)
|
||||
return parser.parse_args(argv)
|
||||
|
||||
|
||||
def main(argv=None):
|
||||
args = parse_args(argv or sys.argv[1:])
|
||||
notes_file = Path(args.notes)
|
||||
findings = scan_apps(args.app)
|
||||
findings, unused_annotations = apply_annotations(findings, load_annotations(notes_file))
|
||||
findings = filter_findings(findings, args)
|
||||
findings = sorted(
|
||||
findings, key=lambda item: (item.app, item.path, item.line, item.env, item.image)
|
||||
)
|
||||
if unused_annotations and not args.no_note_warnings:
|
||||
for app, match in unused_annotations:
|
||||
print(
|
||||
f"Warning: annotation for {app!r} with match {match!r} matched no rows",
|
||||
file=sys.stderr,
|
||||
)
|
||||
print_table(findings)
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
|
|
@ -13,10 +13,10 @@ import sys
|
|||
|
||||
import argparse
|
||||
import fnmatch
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import time
|
||||
from functools import total_ordering
|
||||
|
||||
# Use utf8 prefixes in diff, these need to be a "normal" width 1 character
|
||||
conf_utf8 = True
|
||||
|
|
@ -194,9 +194,9 @@ def natcmp(x, y):
|
|||
https://en.wikipedia.org/wiki/Natural_sort_order
|
||||
Aka. vercmp() """
|
||||
|
||||
def _cmp_xy_mix(val): # One is a digit, the other isn't.
|
||||
def _cmp_xy_mix(): # One is a digit, the other isn't.
|
||||
if inum is not None: # 0/1 vs. x/.
|
||||
return val
|
||||
return 1
|
||||
if x[i] > y[i]:
|
||||
return 1
|
||||
else:
|
||||
|
|
@ -206,9 +206,9 @@ def natcmp(x, y):
|
|||
check_zeros = False
|
||||
for i in range(min(len(x), len(y))):
|
||||
if x[i] in "0123456789" and y[i] not in "0123456789":
|
||||
return _cmp_xy_mix(1)
|
||||
return _cmp_xy_mix()
|
||||
if x[i] not in "0123456789" and y[i] in "0123456789":
|
||||
return _cmp_xy_mix(-1)
|
||||
return _cmp_xy_mix()
|
||||
|
||||
if x[i] in "0123456789": # Both are digits...
|
||||
if inum is None:
|
||||
|
|
@ -264,7 +264,6 @@ def natcmp(x, y):
|
|||
return inum
|
||||
|
||||
|
||||
@total_ordering
|
||||
class NatCmp():
|
||||
__slots__ = ['s',]
|
||||
def __init__(self, s):
|
||||
|
|
@ -374,6 +373,10 @@ def _ui_date(d1, align=None, prev=None):
|
|||
return _ui_t_align(d1.date, align)
|
||||
if prev is not None and d1.date == prev:
|
||||
return _ui_t_align(" \" ", align)
|
||||
if False and d1.date == backup_today: # Better, or no?
|
||||
return _ui_t_align("today", align)
|
||||
if False and d1.date == backup_yesterday:
|
||||
return _ui_t_align("yesterday", align)
|
||||
# YYYY-MM-DD
|
||||
# 1234567890
|
||||
if prev is None:
|
||||
|
|
@ -469,7 +472,6 @@ def _wild_eq(s1, s2):
|
|||
|
||||
_max_len_osnm = 0 # osname_small
|
||||
_max_len_osvr = 0 # osvers ... upto the first '.'
|
||||
@total_ordering
|
||||
class Host():
|
||||
""" Class for holding the Host data from a line in the files. """
|
||||
|
||||
|
|
@ -691,7 +693,7 @@ def line2data(line):
|
|||
return Host(locals())
|
||||
|
||||
def lines2datas(lines):
|
||||
return list(sorted(line2data(line) for line in lines))
|
||||
return (line2data(line) for line in lines)
|
||||
|
||||
# Filter datas using name as a filename wildcard match.
|
||||
def filter_name_datas(datas, names):
|
||||
|
|
@ -802,7 +804,7 @@ def _maybe_dynamic_uptime(data):
|
|||
|
||||
mtime = os.path.getmtime(fname)
|
||||
since = int(time.time()) - int(mtime)
|
||||
data = data.copy()
|
||||
data = list(sorted(data))
|
||||
for d1 in data:
|
||||
d1.uptime += since
|
||||
return data
|
||||
|
|
@ -947,12 +949,12 @@ def _diffstats(data1, data2):
|
|||
d1 = data1[0]
|
||||
d2 = data2[0]
|
||||
|
||||
if natcmp(d1.name, d2.name) < 0:
|
||||
if d1.name < d2.name:
|
||||
udel -= d1.rpms
|
||||
data1.pop(0)
|
||||
continue
|
||||
|
||||
if natcmp(d1.name, d2.name) > 0:
|
||||
if d1.name > d2.name:
|
||||
uadd += d2.rpms
|
||||
data2.pop(0)
|
||||
boot += 1
|
||||
|
|
@ -1150,6 +1152,10 @@ def _cmd_update(args):
|
|||
cmd = "update-daily" # This does the sorting etc.
|
||||
elif fname_today is None:
|
||||
cmd = "update-daily"
|
||||
elif False: # -fast and -flush are the same now, so who cares.
|
||||
mtime = os.path.getmtime(fname)
|
||||
if (int(time.time()) - mtime) > conf_dur_flush_cache:
|
||||
cmd = "update-fast"
|
||||
|
||||
if cmd == "update-host":
|
||||
os.chdir("/srv/web/infra/ansible/playbooks")
|
||||
|
|
@ -1207,7 +1213,7 @@ def _hist_lengths(hosts=None):
|
|||
# Whatever, it's less memory than holding all history at once if you want
|
||||
# to enable it..
|
||||
for backup in reversed(backups):
|
||||
data = lines2datas(bfname2lines(backup))
|
||||
data = list(sorted(lines2datas(bfname2lines(backup))))
|
||||
data = list(filter_name_datas(data, hosts))
|
||||
updates = _ui_int(sum(d.rpms for d in data))
|
||||
hl = max(hl, len(_ui_int(len(data))))
|
||||
|
|
@ -1236,7 +1242,7 @@ def _cmd_history(args):
|
|||
_ui_t_title("Boots", rl))
|
||||
|
||||
for backup in reversed(backups):
|
||||
data = lines2datas(bfname2lines(backup))
|
||||
data = list(sorted(lines2datas(bfname2lines(backup))))
|
||||
data = list(filter_name_datas(data, args.hosts))
|
||||
data = list(filter_osname_datas(data, args.osnames))
|
||||
updates = sum(d.rpms for d in last_data)
|
||||
|
|
@ -1505,6 +1511,10 @@ def _cmd_info(args):
|
|||
if args.host:
|
||||
# print("JDBG:", args.host)
|
||||
hosts = [args.host]
|
||||
if False and args.all:
|
||||
for b in backups:
|
||||
print("History:", b)
|
||||
_print_info(hosts, lines2datas(bfname2lines(b)))
|
||||
if args.hists:
|
||||
hists = args.hists[:]
|
||||
for hist in hists:
|
||||
|
|
@ -1631,6 +1641,7 @@ def _cmd_created(args):
|
|||
dur += 60*60*24 # Broken, but mostly works. Do backups daily, or mtime.
|
||||
|
||||
data = lines2datas(bfname2lines(backup))
|
||||
data = list(sorted(data))
|
||||
|
||||
# If a machine is missing from an older backup, it's marked as being
|
||||
# (re)installed ... even though it might appear in an even older
|
||||
|
|
@ -1675,12 +1686,12 @@ def _diff_hosts(data1, data2, show_both=False, show_utf8=True, skip_eq=False):
|
|||
d1 = data1[0]
|
||||
d2 = data2[0]
|
||||
|
||||
if natcmp(d1.name, d2.name) < 0:
|
||||
if d1.name < d2.name:
|
||||
_print_line('-', d1, prev=pdata)
|
||||
pdata = data1.pop(0)
|
||||
continue
|
||||
|
||||
if natcmp(d1.name, d2.name) > 0:
|
||||
if d1.name > d2.name:
|
||||
_print_line('+', d2, prev=pdata)
|
||||
pdata = data2.pop(0)
|
||||
continue
|
||||
|
|
@ -1786,6 +1797,7 @@ def _cmd_host(args):
|
|||
# Would be a lot faster if we could exit early here, but it's difficult
|
||||
for backup in hbackups:
|
||||
data = filter_name_datas(lines2datas(bfname2lines(backup)), hosts)
|
||||
data = list(sorted(data))
|
||||
data = list(filter_osname_datas(data, args.osnames))
|
||||
_max_update(data)
|
||||
_max_update_correct(' ')
|
||||
|
|
@ -1799,6 +1811,7 @@ def _cmd_host(args):
|
|||
thostnum = 0
|
||||
for backup in hbackups:
|
||||
data = filter_name_datas(lines2datas(bfname2lines(backup)), hosts)
|
||||
data = list(sorted(data))
|
||||
data = list(filter_osname_datas(data, args.osnames))
|
||||
|
||||
if done and skipped_num < 1:
|
||||
|
|
@ -1848,9 +1861,9 @@ def _cmd_host(args):
|
|||
|
||||
def _cmdline_arg_ansi(oval):
|
||||
val = oval.lower()
|
||||
if val in ("true", "y", "yes", "on", "1", "always"):
|
||||
if val in ("yes", "on", "1", "always"):
|
||||
return True
|
||||
if val in ("false", "n", "no", "off", "0", "never"):
|
||||
if val in ("no", "off", "0", "never"):
|
||||
return False
|
||||
if val in ("automatic", "?", "tty", "auto"):
|
||||
return None
|
||||
|
|
|
|||
|
|
@ -11,6 +11,9 @@
|
|||
- name: Reload apache
|
||||
action: service name=httpd state=reloaded
|
||||
|
||||
- name: Restart collectd
|
||||
action: service name=collectd state=restarted
|
||||
|
||||
- name: Restart crond
|
||||
action: service name=crond state=restarted
|
||||
|
||||
|
|
@ -77,13 +80,13 @@
|
|||
action: service name=network state=restarted
|
||||
|
||||
- name: Rebuild postfix transport
|
||||
ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/transport
|
||||
ansible.builtin.command: /usr/sbin/postmap /etc/postfix/transport
|
||||
|
||||
- name: Rebuild postfix bysender
|
||||
ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/bysender
|
||||
ansible.builtin.command: /usr/sbin/postmap /etc/postfix/bysender
|
||||
|
||||
- name: Rebuild postfix tls_policy
|
||||
ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/tls_policy
|
||||
ansible.builtin.command: /usr/sbin/postmap /etc/postfix/tls_policy
|
||||
|
||||
- name: Restart postfix
|
||||
service: name=postfix state=restarted
|
||||
|
|
|
|||
|
|
@ -289,17 +289,11 @@ buildhw-x86-01.rdu3.fedoraproject.org
|
|||
buildhw-x86-02.rdu3.fedoraproject.org
|
||||
buildhw-x86-03.rdu3.fedoraproject.org
|
||||
buildhw-x86-04.rdu3.fedoraproject.org
|
||||
buildhw-x86-05.rdu3.fedoraproject.org
|
||||
buildhw-x86-06.rdu3.fedoraproject.org
|
||||
buildhw-x86-07.rdu3.fedoraproject.org
|
||||
buildhw-x86-08.rdu3.fedoraproject.org
|
||||
buildhw-x86-09.rdu3.fedoraproject.org
|
||||
buildhw-x86-10.rdu3.fedoraproject.org
|
||||
buildhw-x86-12.rdu3.fedoraproject.org
|
||||
buildhw-x86-13.rdu3.fedoraproject.org
|
||||
buildhw-x86-14.rdu3.fedoraproject.org
|
||||
buildhw-x86-16.rdu3.fedoraproject.org
|
||||
buildhw-x86-17.rdu3.fedoraproject.org
|
||||
|
||||
[buildhw_stg]
|
||||
buildhw-p10-01.stg.rdu3.fedoraproject.org
|
||||
|
|
@ -318,17 +312,11 @@ buildhw-x86-02.rdu3.fedoraproject.org
|
|||
buildhw-x86-03.rdu3.fedoraproject.org
|
||||
buildhw-x86-04.rdu3.fedoraproject.org
|
||||
# old iad2 hw
|
||||
buildhw-x86-05.rdu3.fedoraproject.org
|
||||
buildhw-x86-06.rdu3.fedoraproject.org
|
||||
buildhw-x86-07.rdu3.fedoraproject.org
|
||||
buildhw-x86-08.rdu3.fedoraproject.org
|
||||
buildhw-x86-09.rdu3.fedoraproject.org
|
||||
buildhw-x86-10.rdu3.fedoraproject.org
|
||||
buildhw-x86-12.rdu3.fedoraproject.org
|
||||
buildhw-x86-13.rdu3.fedoraproject.org
|
||||
buildhw-x86-14.rdu3.fedoraproject.org
|
||||
buildhw-x86-16.rdu3.fedoraproject.org
|
||||
buildhw-x86-17.rdu3.fedoraproject.org
|
||||
|
||||
[buildhw_stg_rdu3]
|
||||
buildhw-p10-01.stg.rdu3.fedoraproject.org
|
||||
|
|
@ -405,11 +393,8 @@ buildvm-ppc64le-30.rdu3.fedoraproject.org
|
|||
buildvm-ppc64le-31.rdu3.fedoraproject.org
|
||||
buildvm-ppc64le-32.rdu3.fedoraproject.org
|
||||
|
||||
[secureboot]
|
||||
[bkernel]
|
||||
buildhw-x86-01.rdu3.fedoraproject.org
|
||||
buildhw-a64-01.rdu3.fedoraproject.org
|
||||
buildhw-x86-02.rdu3.fedoraproject.org
|
||||
buildhw-a64-02.rdu3.fedoraproject.org
|
||||
|
||||
# These hosts get the runroot plugin installed.
|
||||
# They should be added to their own 'compose' channel in the koji db
|
||||
|
|
@ -426,6 +411,7 @@ buildvm-ppc64le-02.rdu3.fedoraproject.org
|
|||
buildvm-ppc64le-03.rdu3.fedoraproject.org
|
||||
buildvm-s390x-11.s390.fedoraproject.org
|
||||
buildvm-s390x-12.s390.fedoraproject.org
|
||||
buildvm-s390x-13.s390.fedoraproject.org
|
||||
buildvm-a64-01.stg.rdu3.fedoraproject.org
|
||||
buildvm-s390x-01.stg.s390.fedoraproject.org
|
||||
buildvm-x86-01.stg.rdu3.fedoraproject.org
|
||||
|
|
@ -469,7 +455,7 @@ buildvm
|
|||
buildvm_aarch64
|
||||
buildvm_ppc64le
|
||||
buildvm_s390x
|
||||
secureboot
|
||||
bkernel
|
||||
|
||||
[builders_stg:children]
|
||||
buildhw_ppc64le_stg
|
||||
|
|
|
|||
|
|
@ -33,10 +33,8 @@ copr-keygen.aws.fedoraproject.org
|
|||
copr-keygen-dev.aws.fedoraproject.org
|
||||
#copr-be-dev.cloud.fedoraproject.org
|
||||
copr-dist-git-dev.fedorainfracloud.org
|
||||
rpmeta.stg.fedoraproject.org
|
||||
rpmeta.fedoraproject.org
|
||||
f42-test.fedorainfracloud.org
|
||||
f43-test.fedorainfracloud.org
|
||||
f44-test.fedorainfracloud.org
|
||||
rawhide-test.fedorainfracloud.org
|
||||
el9-test.fedorainfracloud.org
|
||||
el10-test.fedorainfracloud.org
|
||||
|
|
@ -45,7 +43,6 @@ aarch64-test02.fedorainfracloud.org
|
|||
# This is not in aws, but here is good enough for now
|
||||
ppc64le-test.fedorainfracloud.org
|
||||
ppc64le-test02.fedorainfracloud.org
|
||||
s390x-test01.fedorainfracloud.org
|
||||
logdetective01.fedorainfracloud.org
|
||||
logdetective02.fedorainfracloud.org
|
||||
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# BEGIN: Ansible roles_path variables
|
||||
#
|
||||
# Background/reference about external repos pulled in:
|
||||
# https://forge.fedoraproject.org/infra/tickets/issues/5476
|
||||
# https://forge.fedoraproject.org/infra/tickets/5476
|
||||
#
|
||||
# IPA settings
|
||||
additional_host_keytabs: []
|
||||
|
|
@ -36,47 +36,72 @@ baseiptables: True
|
|||
become: false
|
||||
br0_nm: 255.255.255.0
|
||||
br1_nm: 255.255.255.0
|
||||
# assume collectd apache
|
||||
collectd_apache: true
|
||||
# communishift project resource overrides
|
||||
communishift_projects:
|
||||
# please keep these sorted alphabetically for readability
|
||||
communishift-admins:
|
||||
name: communishift-admins
|
||||
do_not_delete: true # Marked do not delete 2024-11-25 - dkirwan
|
||||
communishift-avant:
|
||||
name: communishift-avant
|
||||
cpu_limits: 2
|
||||
cpu_requests: 2
|
||||
memory_limits: 3Gi
|
||||
memory_requests: 1.5Gi
|
||||
pods: 6
|
||||
storage_requests: 10Gi
|
||||
communishift-commops-analytics:
|
||||
name: communishift-commops-analytics
|
||||
communishift-commops-datanom:
|
||||
name: communishift-commops-datanom
|
||||
communishift-discoursepolls:
|
||||
name: communishift-discoursepolls
|
||||
communishift-eventbot:
|
||||
name: communishift-eventbot
|
||||
communishift-fedora-coreos-ai-helpers:
|
||||
name: communishift-fedora-coreos-ai-helpers
|
||||
do_not_delete: true # Marked do not delete 2025-12-18 - dkirwan infra 12996
|
||||
communishift-fedora-review-service:
|
||||
do_not_delete: true # Marked do not delete 2024-10-21 - dkirwan
|
||||
name: communishift-fedora-review-service
|
||||
communishift-forgejo:
|
||||
name: communishift-forgejo
|
||||
communishift-fossology:
|
||||
name: communishift-fossology
|
||||
communishift-gitlabce:
|
||||
name: communishift-gitlabce
|
||||
communishift-jitsi:
|
||||
name: communishift-jitsi
|
||||
communishift-lightspeed-build:
|
||||
name: communishift-lightspeed-build
|
||||
communishift-log-detective:
|
||||
name: communishift-log-detective
|
||||
do_not_delete: true # Marked do not delete 2024-10-21 - dkirwan
|
||||
memory_limits: 7Gi
|
||||
memory_limits: 6Gi
|
||||
memory_requests: 4Gi
|
||||
storage_requests: 10Gi
|
||||
pods: 6
|
||||
communishift-mattdm:
|
||||
name: communishift-mattdm
|
||||
communishift-metrics:
|
||||
name: communishift-metrics
|
||||
communishift-ocm:
|
||||
name: communishift-ocm
|
||||
communishift-openscanhub:
|
||||
name: communishift-openscanhub
|
||||
cpu_limits: 2
|
||||
cpu_requests: 2
|
||||
memory_limits: 4Gi
|
||||
memory_requests: 2Gi
|
||||
pods: 16
|
||||
communishift-planet:
|
||||
name: communishift-planet
|
||||
communishift-standupbot:
|
||||
name: communishift-standupbot
|
||||
do_not_delete: true # Marked do not delete 2026-05-01 - dkirwan
|
||||
communishift-weekly-bootc:
|
||||
do_not_delete: true # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan
|
||||
name: communishift-weekly-bootc
|
||||
communishift-release-schedule-planner:
|
||||
name: communishift-release-schedule-planner
|
||||
communishift-draft-share:
|
||||
name: communishift-draft-share
|
||||
communishift-coreos-agent:
|
||||
name: communishift-coreos-agent
|
||||
communishift-rag-magazine-guidelines:
|
||||
name: communishift-rag-magazine-guidelines
|
||||
storage_requests: 15Gi
|
||||
communishift-public-inbox-poc:
|
||||
name: communishift-public-inbox-poc
|
||||
communishift-copr:
|
||||
name: communishift-copr
|
||||
communishift-happinesspackets:
|
||||
name: communishift-happinesspackets
|
||||
pvcs: 3
|
||||
# true or false if we are or are not a copr build virthost.
|
||||
# Default to false
|
||||
copr_build_virthost: false
|
||||
|
|
@ -157,12 +182,6 @@ nftables: True
|
|||
nft_custom6_rules: []
|
||||
nft_custom_rules: []
|
||||
nft_nat_rules: []
|
||||
# Table names for nft
|
||||
# Note that the ip/ip6 prefix here means we only look at IPv4/IPv6 packets.
|
||||
nft_table_filter: "ip cle_infra_filter"
|
||||
nft_table_nat: "ip cle_infra_nat"
|
||||
nft_table_raw: "ip cle_infra_raw"
|
||||
nft_table6_filter: "ip6 cle_infra_filter"
|
||||
# usually we do not want to enable nested virt, only on some virthosts
|
||||
nested: false
|
||||
network_allow_restart: yes
|
||||
|
|
@ -314,7 +333,6 @@ zabbix_httpapi_use_ssl: true
|
|||
zabbix_httpapi_validate_certs: false
|
||||
zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu
|
||||
# Zabbix agent vars
|
||||
zabbix_agentd: /etc/zabbix_agentd.conf # Needed for zabbix_sender in other roles
|
||||
zabbix_host: "zabbix01{{ env_suffix }}.{{ datacenter }}.fedoraproject.org"
|
||||
zabbix_tls_psk_identity: "Fedora"
|
||||
zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo
|
||||
|
|
@ -323,8 +341,6 @@ zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo
|
|||
zabbix_inventory:
|
||||
# Env is not a valid key, so use this field for environment
|
||||
deployment_status: production
|
||||
zabbix_base_hostgroups:
|
||||
- All servers
|
||||
|
||||
notes: |
|
||||
Unspecified.
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ ansible_ifcfg_allowlist:
|
|||
# Make connections from signing bridges stateless, they break sigul connections
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
host_group: autosign
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-releng
|
||||
|
|
|
|||
|
|
@ -2,5 +2,5 @@
|
|||
# Make connections from signing bridges stateless, they break sigul connections
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
host_group: autosign
|
||||
|
|
|
|||
|
|
@ -8,12 +8,20 @@
|
|||
#
|
||||
custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
#
|
||||
# This host is externally reachable
|
||||
#
|
||||
external: true
|
||||
#
|
||||
# Set this to get fasclient cron to make the aliases file
|
||||
#
|
||||
fas_aliases: true
|
||||
#
|
||||
# Set this to get fasjson-client cron to make the aliases file
|
||||
#
|
||||
fasjson_aliases: false
|
||||
fasjson_url: https://fasjson.fedoraproject.org/
|
||||
host_group: bastion
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -19,8 +19,12 @@ batcave_ipa_client_shell_groups: []
|
|||
#
|
||||
custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
#
|
||||
# Set this to get fasjson-client cron to make the aliases file
|
||||
#
|
||||
fasjson_aliases: true
|
||||
ipa_client_shell_groups: "{{ (bastion_ipa_client_shell_groups + batcave_ipa_client_shell_groups) | sort | unique }}"
|
||||
#
|
||||
# allow a bunch of sysadmin groups here so they can access internal stuff
|
||||
|
|
|
|||
|
|
@ -4,8 +4,8 @@ ansible_base: /srv/web/infra
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
#
|
||||
# This host is externally reachable
|
||||
#
|
||||
|
|
@ -24,7 +24,6 @@ ipa_client_shell_groups:
|
|||
- sysadmin-datanommer
|
||||
- sysadmin-debuginfod
|
||||
- sysadmin-epel
|
||||
- sysadmin-gpu
|
||||
- sysadmin-koschei
|
||||
- sysadmin-libravatar
|
||||
- sysadmin-messaging
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ bodhi_message_routing_keys:
|
|||
# Make connections from signing bridges stateless, they break sigul connections
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.5.125.71 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept']
|
||||
host_group: bodhi2
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-bodhi
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ bodhi_message_routing_keys:
|
|||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
# this is sign-bridge01.rdu3 ip 10.16.169.120
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
host_group: bodhi2
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-bodhi
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ koji_root: "koji.fedoraproject.org/koji"
|
|||
koji_server_url: "https://koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 262144
|
||||
max_mem_size: "{{ mem_size }}"
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ koji_root: "koji.fedoraproject.org/koji"
|
|||
koji_server_url: "https://koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/aarch64/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 300000
|
||||
max_cpu: "{{ num_cpus }}"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ koji_root: "koji.fedoraproject.org/koji"
|
|||
koji_server_url: "https://koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/aarch64/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 300000
|
||||
max_cpu: "{{ num_cpus }}"
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/"
|
|||
# Groups and individual hosts should ovveride them with specific info.
|
||||
|
||||
koji_weburl: "https://koji.stg.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/aarch64/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/aarch64/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 140000
|
||||
max_cpu: "{{ num_cpus }}"
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ koji_instance: "primary"
|
|||
koji_server_url: "https://koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/ppc64le/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/ppc64le/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 262144
|
||||
#
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ koji_root: "koji.fedoraproject.org/koji"
|
|||
koji_server_url: "https://koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/ppc64le/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/ppc64le/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 300000
|
||||
main_bridge: br0
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/"
|
|||
# Groups and individual hosts should ovveride them with specific info.
|
||||
|
||||
koji_weburl: "https://koji.stg.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/ppc64le/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/ppc64le/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 150000
|
||||
main_bridge: br0
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ koji_root: "koji.fedoraproject.org/koji"
|
|||
koji_server_url: "https://koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 300000
|
||||
max_mem_size: "{{ mem_size }}"
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ koji_instance: "primary"
|
|||
koji_server_url: "https://koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/s390x/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/s390x/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora-s390x
|
||||
lvm_size: 128000
|
||||
main_bridge: br0
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ dns2: 10.16.163.34
|
|||
dns_search1: "rdu3.fedoraproject.org"
|
||||
dns_search2: "fedoraproject.org"
|
||||
eth0_ipv4_gw: 10.16.0.254
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/s390x/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/s390x/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 102400
|
||||
main_bridge: vmbr
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"
|
|||
koji_instance: "primary"
|
||||
koji_topurl: "https://kojipkgs.stg.fedoraproject.org/"
|
||||
koji_weburl: "https://koji.stg.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/s390x/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/s390x/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora-s390x
|
||||
virt_install_command: "{{ virt_install_command_s390x_one_nic_unsafe }}"
|
||||
lvm_size: 100000
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/"
|
|||
# Groups and individual hosts should ovveride them with specific info.
|
||||
|
||||
koji_weburl: "https://koji.stg.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 150000
|
||||
max_mem_size: "{{ mem_size }}"
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ koji_root: "riscv-koji.fedoraproject.org/koji"
|
|||
koji_server_url: "https://riscv-koji.fedoraproject.org/kojihub"
|
||||
koji_topurl: "https://riscv-kojipkgs.fedoraproject.org/"
|
||||
koji_weburl: "https://riscv-koji.fedoraproject.org/koji"
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/
|
||||
ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/
|
||||
ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora
|
||||
lvm_size: 262144
|
||||
max_mem_size: "{{ mem_size }}"
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
lvm_size: 20000
|
||||
mem_size: 2048
|
||||
num_cpus: 2
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
lvm_size: 20000
|
||||
mem_size: 2048
|
||||
num_cpus: 2
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
---
|
||||
collectd_apache: false
|
||||
freezes: false
|
||||
nagios_Check_Services:
|
||||
nrpe: true
|
||||
|
|
|
|||
|
|
@ -11,4 +11,3 @@ zabbix_server: "{{ zabbix_hostname }}"
|
|||
zabbix_auth_key: "{{ zabbix_apikey }}" # ansible-private repo
|
||||
zabbix_macros:
|
||||
NET.IF.IFNAME.NOT_MATCHES: "^vnet.*"
|
||||
postfix_group: vpn
|
||||
|
|
|
|||
|
|
@ -19,20 +19,25 @@ backend_base_url: "https://download.copr.fedorainfracloud.org"
|
|||
builders:
|
||||
# max|spawn_concurrently|prealloc
|
||||
aws:
|
||||
aarch64: [50, 10, 1]
|
||||
x86_64: [50, 10, 1]
|
||||
aarch64: [8, 2, 1]
|
||||
x86_64: [50, 10, 20]
|
||||
# put here the number -1 of the actuall reserved instances
|
||||
aws_reserved:
|
||||
aarch64: [55, 20, 55]
|
||||
x86_64: [70, 20, 70]
|
||||
aarch64: [50, 20, 33]
|
||||
x86_64: [58, 20, 52]
|
||||
aws_reserved_powerful:
|
||||
x86_64: [2, 2, 2]
|
||||
x86_64: [1, 1, 1]
|
||||
aws_powerful:
|
||||
aarch64: [10, 2, 0]
|
||||
x86_64: [10, 2, 1]
|
||||
aws_spot:
|
||||
aarch64: [30, 4, 1]
|
||||
x86_64: [70, 8, 16]
|
||||
ppc64le_hypervisor_01:
|
||||
ppc64le: [0, 4, 15]
|
||||
# There's the ppc64le-test machine, so keep 2 builders less.
|
||||
ppc64le_hypervisor_02:
|
||||
ppc64le: [0, 4, 13]
|
||||
p09_hypervisor_01:
|
||||
ppc64le: [15, 5, 15]
|
||||
p09_hypervisor_02:
|
||||
|
|
@ -41,14 +46,6 @@ builders:
|
|||
ppc64le: [15, 5, 15]
|
||||
p09_hypervisor_04:
|
||||
ppc64le: [15, 5, 15]
|
||||
hp_p09_hypervisor_01:
|
||||
ppc64le: [1, 1, 1]
|
||||
hp_p09_hypervisor_02:
|
||||
ppc64le: [1, 1, 1]
|
||||
hp_p09_hypervisor_03:
|
||||
ppc64le: [1, 1, 1]
|
||||
hp_p09_hypervisor_04:
|
||||
ppc64le: [1, 1, 1]
|
||||
x86_hypervisor_01:
|
||||
x86_64: [20, 4, 20]
|
||||
x86_hypervisor_02:
|
||||
|
|
@ -62,36 +59,36 @@ builders:
|
|||
s390x: [2, 1, 0]
|
||||
|
||||
ibm_cloud_br_sao_1:
|
||||
s390x: [3, 3, 1]
|
||||
s390x: [3, 1, 1]
|
||||
ibm_cloud_br_sao_2:
|
||||
s390x: [3, 3, 1]
|
||||
s390x: [3, 1, 1]
|
||||
ibm_cloud_br_sao_3:
|
||||
s390x: [3, 3, 1]
|
||||
s390x: [3, 1, 1]
|
||||
|
||||
ibm_cloud_eu_es_1:
|
||||
s390x: [3, 3, 1]
|
||||
s390x: [3, 1, 1]
|
||||
ibm_cloud_eu_es_2:
|
||||
s390x: [3, 3, 1]
|
||||
s390x: [3, 1, 1]
|
||||
ibm_cloud_eu_es_3:
|
||||
s390x: [3, 3, 1]
|
||||
s390x: [3, 1, 1]
|
||||
|
||||
cloud_instance_types:
|
||||
ibm_cloud:
|
||||
s390x: bz2-2x8
|
||||
s390x: mz2-2x16
|
||||
s390x_hp: bz2-16x64
|
||||
|
||||
ibm_cloud_regions:
|
||||
eu_es:
|
||||
name: eu-es
|
||||
name_humans: Madrid, Spain
|
||||
ssh_key: r050-4e396a17-294c-4197-9c56-e126185025a1
|
||||
ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5
|
||||
vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9
|
||||
security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a
|
||||
images: "{{ copr_builder_images.ibm_cloud.eu_es }}"
|
||||
br_sao:
|
||||
name: br-sao
|
||||
name_humans: Sao Paulo, Brazil
|
||||
ssh_key: r042-b30ff308-ef4f-43bf-bdd6-e16f1cc614cd
|
||||
ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152
|
||||
vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba
|
||||
security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7
|
||||
images: "{{ copr_builder_images.ibm_cloud.br_sao }}"
|
||||
|
|
@ -168,34 +165,34 @@ copr_aws_region: us-east-1
|
|||
# eth0, eth1
|
||||
copr_backend_ips: ["52.44.175.77", "172.30.2.105"]
|
||||
|
||||
copr_builder_fedora_version: 44
|
||||
copr_builder_fedora_version: 42
|
||||
|
||||
copr_builder_images:
|
||||
aws:
|
||||
# WARNING: when changing, always remove images N-2 and older
|
||||
# WARNING: never forget to tag FedoraGroup=copr!
|
||||
# n-1: aarch64: ami-0b8871c5be60af626
|
||||
# n-1: x86_64: ami-0a3a77adba2c726a2
|
||||
aarch64: ami-0bf371a5a377d2736
|
||||
x86_64: ami-0d2b557a440dafef7
|
||||
# n-1: aarch64: ami-016278526bb5e2a63
|
||||
# n-1: x86_64: ami-01f4000c6312cc58e
|
||||
aarch64: ami-0b8871c5be60af626
|
||||
x86_64: ami-0a3a77adba2c726a2
|
||||
hypervisor:
|
||||
# n-1: ppc64le: copr-builder-ppc64le-2026-01-20
|
||||
# n-1: x86_64: copr-builder-x86_64-2026-01-20
|
||||
ppc64le: copr-builder-ppc64le-2026-06-05
|
||||
x86_64: copr-builder-x86_64-2026-06-05
|
||||
# n-1: ppc64le: copr-builder-ppc64le-2025-09-13
|
||||
# n-1: x86_64: copr-builder-x86_64-2025-09-13
|
||||
ppc64le: copr-builder-ppc64le-2026-01-20
|
||||
x86_64: copr-builder-x86_64-2026-01-20
|
||||
ibm_cloud:
|
||||
br_sao: # São Paulo
|
||||
# n-1: s390x: r042-8ea365c9-fcdd-4611-848c-75ccb3e56a5d
|
||||
s390x: r042-50ddb25b-7a13-4f30-8ba3-b262b07222a5
|
||||
# n-1: s390x: r042-e3538e98-9297-422f-b30d-b566ad8b0ac7
|
||||
s390x: r042-8ea365c9-fcdd-4611-848c-75ccb3e56a5d
|
||||
eu_es: # Madrid
|
||||
# n-1: s390x: r050-3afb8f3d-5552-43e7-8eee-de6511ca41dc
|
||||
s390x: r050-f8f68391-bdb2-49b9-926c-c43cba69c8df
|
||||
# n-1: s390x: r050-39129a43-d427-41a1-8aa0-26ae65305fbf
|
||||
s390x: r050-3afb8f3d-5552-43e7-8eee-de6511ca41dc
|
||||
us_east: # Washington
|
||||
# n-1: s390x: r014-43e2144b-2795-402a-92b2-066d1f989b5c
|
||||
s390x: r014-c32be609-f5ea-4171-b50f-e6a5b94df0a4
|
||||
# n-1: s390x: r014-1c40f060-69c7-42a1-83ed-005626de5e81
|
||||
s390x: r014-43e2144b-2795-402a-92b2-066d1f989b5c
|
||||
osuosl:
|
||||
# n-1: ppc64le: copr-builder-ppc64le-2026-01-14
|
||||
ppc64le: copr-builder-ppc64le-2026-06-05
|
||||
# n-1: ppc64le: copr-builder-ppc64le-2025-09-13
|
||||
ppc64le: copr-builder-ppc64le-2026-01-14
|
||||
|
||||
copr_messaging: true
|
||||
datacenter: aws
|
||||
|
|
@ -211,7 +208,7 @@ aws_cloudfront_distribution: E2PUZIRCXCOXTG
|
|||
nrpe_client_uid: 500
|
||||
|
||||
rsnapshot_push:
|
||||
server_host: storinator01.fedoraproject.org
|
||||
server_host: storinator01.rdu-cc.fedoraproject.org
|
||||
backup_dir: /srv/nfs/copr-be
|
||||
cases:
|
||||
copr-be-copr-user:
|
||||
|
|
@ -224,7 +221,7 @@ rsnapshot_push:
|
|||
|
||||
deployment_type: prod
|
||||
|
||||
pulp_content_url: "https://packages.redhat.com/api/pulp-content/public-copr/"
|
||||
pulp_content_url: "https://console.redhat.com/api/pulp-content/public-copr/"
|
||||
|
||||
zabbix_host: 38.145.32.41
|
||||
zabbix_macros:
|
||||
|
|
|
|||
|
|
@ -53,9 +53,6 @@ copr_backend_data_2_raid1_volumes:
|
|||
- nvme-Amazon_Elastic_Block_Store_vol0f226a7163d28d8fd-part1
|
||||
- nvme-Amazon_Elastic_Block_Store_vol07293869d85a750b8-part1
|
||||
|
||||
rpmeta_enabled: true
|
||||
rpmeta_hostname: rpmeta.fedoraproject.org
|
||||
|
||||
notes: |
|
||||
Provide the backend for copr (3rd party packages)
|
||||
* Backend: Management of copr cloud infrastructure (OpenStack).
|
||||
|
|
|
|||
|
|
@ -49,12 +49,6 @@ copr_backend_data_2_raid1_volumes:
|
|||
- nvme-Amazon_Elastic_Block_Store_vol0ce8220e998e2e32a-part1
|
||||
- nvme-Amazon_Elastic_Block_Store_vol0038e042c49987b82-part1
|
||||
|
||||
rpmeta_enabled: true
|
||||
rpmeta_hostname: rpmeta.stg.fedoraproject.org
|
||||
|
||||
notes: |
|
||||
Provide the testing environment of copr's backend
|
||||
This host is the testing environment for the cloud infrastructure of copr's backend
|
||||
|
||||
zabbix_macros:
|
||||
'COPR.FE_URL': copr.stg.fedoraproject.org
|
||||
|
|
|
|||
|
|
@ -33,6 +33,10 @@ builders:
|
|||
aws_spot:
|
||||
aarch64: [3, 3, 1]
|
||||
x86_64: [0, 0, 1]
|
||||
ppc64le_hypervisor_01:
|
||||
ppc64le: [0, 1, 1]
|
||||
ppc64le_hypervisor_02:
|
||||
ppc64le: [0, 1, 1]
|
||||
p09_hypervisor_01:
|
||||
ppc64le: [1, 1, 1]
|
||||
p09_hypervisor_02:
|
||||
|
|
@ -41,14 +45,6 @@ builders:
|
|||
ppc64le: [1, 1, 1]
|
||||
p09_hypervisor_04:
|
||||
ppc64le: [1, 1, 1]
|
||||
hp_p09_hypervisor_01:
|
||||
ppc64le: [1, 1, 1]
|
||||
hp_p09_hypervisor_02:
|
||||
ppc64le: [1, 1, 1]
|
||||
hp_p09_hypervisor_03:
|
||||
ppc64le: [1, 1, 1]
|
||||
hp_p09_hypervisor_04:
|
||||
ppc64le: [1, 1, 1]
|
||||
x86_hypervisor_01:
|
||||
x86_64: [2, 1, 1]
|
||||
x86_hypervisor_02:
|
||||
|
|
@ -64,34 +60,34 @@ builders:
|
|||
ibm_cloud_br_sao_1:
|
||||
s390x: [1, 1, 0]
|
||||
ibm_cloud_br_sao_2:
|
||||
s390x: [0, 0, 0]
|
||||
s390x: [1, 1, 0]
|
||||
ibm_cloud_br_sao_3:
|
||||
s390x: [0, 0, 0]
|
||||
s390x: [1, 1, 0]
|
||||
|
||||
ibm_cloud_eu_es_1:
|
||||
s390x: [0, 0, 0]
|
||||
s390x: [1, 1, 0]
|
||||
ibm_cloud_eu_es_2:
|
||||
s390x: [0, 0, 0]
|
||||
s390x: [1, 1, 0]
|
||||
ibm_cloud_eu_es_3:
|
||||
s390x: [0, 0, 0]
|
||||
s390x: [1, 1, 0]
|
||||
|
||||
cloud_instance_types:
|
||||
ibm_cloud:
|
||||
s390x: bz2-2x8
|
||||
s390x: mz2-2x16
|
||||
s390x_hp: bz2-16x64
|
||||
|
||||
ibm_cloud_regions:
|
||||
eu_es:
|
||||
name: eu-es
|
||||
name_humans: Madrid, Spain
|
||||
ssh_key: r050-ea3b598c-39ca-4963-b8ef-c9d6ac146fad
|
||||
ssh_key: r050-cbd10ece-a28f-45c8-bc3a-15ecb9ff66d5
|
||||
vpc: r050-190b8bac-3bae-47cf-9be7-ac70fc54ccb9
|
||||
security_group: r050-cfc3db07-8cde-4807-9756-db91b242092a
|
||||
images: "{{ copr_builder_images.ibm_cloud.eu_es }}"
|
||||
br_sao:
|
||||
name: br-sao
|
||||
name_humans: Sao Paulo, Brazil
|
||||
ssh_key: r042-3ec7f0e1-3eb3-4f55-a922-915c85da09c2
|
||||
ssh_key: r042-4fb65a23-e7bd-440f-8d71-ff57b83a4152
|
||||
vpc: r042-c902f12d-556f-4334-95cb-d181ebb3d8ba
|
||||
security_group: r042-22ef3881-fa20-4caa-9873-c8dc41c5dcb7
|
||||
images: "{{ copr_builder_images.ibm_cloud.br_sao }}"
|
||||
|
|
@ -155,25 +151,25 @@ copr_aws_region: us-east-1
|
|||
# eth0, eth1
|
||||
copr_backend_ips: ["18.208.10.131", "172.30.2.11"]
|
||||
|
||||
copr_builder_fedora_version: 44
|
||||
copr_builder_fedora_version: 42
|
||||
|
||||
copr_builder_images:
|
||||
aws:
|
||||
# WARNING: never forget to tag FedoraGroup=copr!
|
||||
aarch64: ami-0bf371a5a377d2736
|
||||
x86_64: ami-0d2b557a440dafef7
|
||||
aarch64: ami-0b8871c5be60af626
|
||||
x86_64: ami-0a3a77adba2c726a2
|
||||
hypervisor:
|
||||
ppc64le: copr-builder-ppc64le-2026-06-05
|
||||
x86_64: copr-builder-x86_64-2026-06-05
|
||||
ppc64le: copr-builder-ppc64le-2026-01-20
|
||||
x86_64: copr-builder-x86_64-2026-01-20
|
||||
ibm_cloud:
|
||||
br_sao: # São Paulo
|
||||
s390x: r042-50ddb25b-7a13-4f30-8ba3-b262b07222a5
|
||||
s390x: r042-8ea365c9-fcdd-4611-848c-75ccb3e56a5d
|
||||
eu_es: # Madrid
|
||||
s390x: r050-f8f68391-bdb2-49b9-926c-c43cba69c8df
|
||||
s390x: r050-3afb8f3d-5552-43e7-8eee-de6511ca41dc
|
||||
us_east: # Washington
|
||||
s390x: r014-c32be609-f5ea-4171-b50f-e6a5b94df0a4
|
||||
s390x: r014-43e2144b-2795-402a-92b2-066d1f989b5c
|
||||
osuosl:
|
||||
ppc64le: copr-builder-ppc64le-2026-06-05
|
||||
ppc64le: copr-builder-ppc64le-2026-01-14
|
||||
|
||||
copr_messaging: true
|
||||
datacenter: aws
|
||||
|
|
@ -188,14 +184,6 @@ aws_cloudfront_distribution: EX55ITR8LVMOH
|
|||
|
||||
nrpe_client_uid: 500
|
||||
|
||||
pulp_content_url: "https://packages.redhat.com/api/pulp-content/public-copr-stage/"
|
||||
pulp_content_url: "https://console.redhat.com/api/pulp-content/public-copr-stage/"
|
||||
|
||||
zabbix_host: 38.145.32.42
|
||||
zabbix_server: zabbix.stg.fedoraproject.org
|
||||
zabbix_auth_key: "{{ zabbix_stg_apikey }}" # in ansible-private repo
|
||||
zabbix_tls_psk: "{{ zabbix_tls_stg_psk }}" # in ansible-private repo
|
||||
# This is used to populate the inventory fields, only specific keys are allowed, see
|
||||
# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory
|
||||
zabbix_inventory:
|
||||
# Env is not a valid key, so use this field for environment
|
||||
deployment_status: staging
|
||||
|
|
|
|||
|
|
@ -41,6 +41,3 @@ aws_ipv6_addr: "2600:1f18:8ee:ae00:66a:fd15:3f16:4092/128"
|
|||
notes: |
|
||||
Provide the testing environment of copr's frontend
|
||||
This host is the testing environment for copr's web interface
|
||||
|
||||
zabbix_macros:
|
||||
'COPR.BE_URL': copr-be-dev.aws.fedoraproject.org
|
||||
|
|
|
|||
|
|
@ -19,8 +19,6 @@ primary_auth_source: ipa
|
|||
|
||||
nbde: true
|
||||
nbde_device: /dev/md2
|
||||
nbde_device2: /dev/md3
|
||||
nbde_device3: /dev/md4
|
||||
nbde_client_bindings:
|
||||
- device: "{{ nbde_device }}"
|
||||
encryption_password: "{{ nbde_password }}"
|
||||
|
|
@ -29,31 +27,17 @@ nbde_client_bindings:
|
|||
servers:
|
||||
- http://tang01.rdu3.fedoraproject.org
|
||||
- http://tang02.rdu3.fedoraproject.org
|
||||
- device: "{{ nbde_device2 }}"
|
||||
encryption_password: "{{ nbde_password }}"
|
||||
password_temporary: no
|
||||
threshold: 1
|
||||
servers:
|
||||
- http://tang01.rdu3.fedoraproject.org
|
||||
- http://tang02.rdu3.fedoraproject.org
|
||||
- device: "{{ nbde_device3 }}"
|
||||
encryption_password: "{{ nbde_password }}"
|
||||
password_temporary: no
|
||||
threshold: 1
|
||||
servers:
|
||||
- http://tang01.rdu3.fedoraproject.org
|
||||
- http://tang02.rdu3.fedoraproject.org
|
||||
|
||||
libvirt_host: "{{ inventory_hostname }}"
|
||||
|
||||
nft_custom_rules:
|
||||
- add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport bootps accept
|
||||
- add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport 53 accept
|
||||
- add rule {{nft_table_filter}} INPUT iifname virbr0 tcp dport ssh accept
|
||||
- add rule {{nft_table_filter}} FORWARD iifname "virbr0" oif != "virbr0" counter accept
|
||||
- add rule {{nft_table_filter}} FORWARD iifname "virbr0" ct state new counter accept
|
||||
- add rule {{nft_table_filter}} FORWARD ct state established,related counter accept
|
||||
- add rule {{nft_table_filter}} FORWARD ip protocol icmp counter accept
|
||||
- add rule ip filter INPUT iifname virbr0 udp dport bootps accept
|
||||
- add rule ip filter INPUT iifname virbr0 udp dport 53 accept
|
||||
- add rule ip filter INPUT iifname virbr0 tcp dport ssh accept
|
||||
- add rule ip filter FORWARD iifname "virbr0" oif != "virbr0" counter accept
|
||||
- add rule ip filter FORWARD iifname "virbr0" ct state new counter accept
|
||||
- add rule ip filter FORWARD ct state established,related counter accept
|
||||
- add rule ip filter FORWARD ip protocol icmp counter accept
|
||||
|
||||
zabbix_macros:
|
||||
CPU.UTIL.CRIT: 100
|
||||
|
|
|
|||
|
|
@ -9,10 +9,10 @@ custom_rules:
|
|||
- '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 80 -j ACCEPT'
|
||||
- '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 5167 -j ACCEPT'
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept'
|
||||
freezes: false
|
||||
tcp_ports: [22,
|
||||
# node_exporter/prometheus
|
||||
|
|
|
|||
|
|
@ -9,10 +9,10 @@ custom_rules:
|
|||
- '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 80 -j ACCEPT'
|
||||
- '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 5167 -j ACCEPT'
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept'
|
||||
freezes: false
|
||||
tcp_ports: [22,
|
||||
# node_exporter/prometheus
|
||||
|
|
|
|||
|
|
@ -1,28 +0,0 @@
|
|||
---
|
||||
copr_machine_type: rpmeta
|
||||
copr_hostbase: copr-rpmeta
|
||||
|
||||
rpmeta_hostname: rpmeta.fedoraproject.org
|
||||
rpmeta_port: 44882
|
||||
rpmeta_model_name: xgboost
|
||||
|
||||
rpmeta_hf_repo_base: https://huggingface.co/fedora-copr/rpmeta/resolve
|
||||
rpmeta_hf_model_ref: v2025.12.24
|
||||
|
||||
letsencrypt:
|
||||
certificates:
|
||||
rpmeta.fedoraproject.org:
|
||||
challenge_dir: /var/www/html
|
||||
domains:
|
||||
- rpmeta.fedoraproject.org
|
||||
mail: copr-devel@lists.fedorahosted.org
|
||||
predefined_deploy_script: nginx
|
||||
|
||||
tcp_ports: [22, 80, 443,
|
||||
# node_exporter/prometheus
|
||||
9100,
|
||||
]
|
||||
services_disabled: false
|
||||
|
||||
notes: |
|
||||
Production instance for RPMeta build duration prediction service.
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
---
|
||||
copr_machine_type: rpmeta
|
||||
copr_hostbase: copr-rpmeta-dev
|
||||
|
||||
rpmeta_hostname: rpmeta.stg.fedoraproject.org
|
||||
rpmeta_port: 44882
|
||||
rpmeta_model_name: xgboost
|
||||
|
||||
rpmeta_hf_repo_base: https://huggingface.co/fedora-copr/rpmeta/resolve
|
||||
rpmeta_hf_model_ref: v2025.12.24
|
||||
|
||||
letsencrypt:
|
||||
certificates:
|
||||
rpmeta.stg.fedoraproject.org:
|
||||
challenge_dir: /var/www/html
|
||||
domains:
|
||||
- rpmeta.stg.fedoraproject.org
|
||||
mail: copr-devel@lists.fedorahosted.org
|
||||
predefined_deploy_script: nginx
|
||||
|
||||
tcp_ports: [22, 80, 443,
|
||||
# node_exporter/prometheus
|
||||
9100,
|
||||
]
|
||||
services_disabled: false
|
||||
|
||||
notes: |
|
||||
Staging instance for RPMeta build duration prediction service.
|
||||
|
|
@ -106,16 +106,12 @@ dl_tier1:
|
|||
- zaphod.gtlib.gatech.edu # 128.61.111.12
|
||||
- sv.mirrors.kernel.org
|
||||
- dfw.mirrors.kernel.org
|
||||
- mirror.raiolanetworks.com # 91.132.103.246 / 2a12:d282:102:f6::1
|
||||
- ftp-osl.osuosl.org # 140.211.166.134 / 2605:bc80:3010::134
|
||||
- ftp-chi.osuosl.org # 64.50.236.52 / 2600:3402:200:227::2
|
||||
- ftp-nyc.osuosl.org # 64.50.233.100
|
||||
ipa_host_group: download
|
||||
ipa_host_group_desc: Download servers
|
||||
nagios_Check_Services:
|
||||
swap: false
|
||||
nft_block_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 212.143.41.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 212.143.41.0/24 counter reject'
|
||||
primary_auth_source: ipa
|
||||
zabbix_macros:
|
||||
'APACHE.STATUS.PORT': 443 # Proxies appear to ignore port 80 for apache-status
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
---
|
||||
primary_auth_source: ipa
|
||||
freezes: false
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-gpu
|
||||
- forge-cle-members
|
||||
- forge-ai-ml-members
|
||||
ipa_client_sudo_groups:
|
||||
- sysadmin-gpu
|
||||
ipa_host_group: gpu
|
||||
ipa_host_group_desc: gpu servers
|
||||
|
||||
notes: |
|
||||
gpu machine for testing fedora with gpus
|
||||
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
# Define resources for this group of hosts here.
|
||||
custom_rules: ['-A INPUT -p udp -m udp -s 10.16.0.0/16 --dport 53 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept']
|
||||
host_backup_targets: ['/var/lib/ipa/backup', '/var/log/dirsrv/slapd-FEDORAPROJECT-ORG']
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-accounts
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipatuura
|
||||
ipa_host_group_desc: IPA-tuura SCIM application
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org"
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org"
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.122.0/24 --dport 2049 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept']
|
||||
freezes: false
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-kernel
|
||||
|
|
|
|||
|
|
@ -5,8 +5,8 @@ custom_rules: [
|
|||
'-A INPUT -d 224.0.0.0/8 -j ACCEPT', '-A INPUT -p vrrp -j ACCEPT']
|
||||
# Needed for keepalived
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept'
|
||||
- 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule ip filter INPUT ip protocol vrrp counter accept'
|
||||
docker_registry: "candidate-registry.fedoraproject.org"
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-releng
|
||||
|
|
|
|||
|
|
@ -11,8 +11,8 @@ ipa_host_group_desc: riscv Koji Hub hosts
|
|||
koji_hub: "riscv-koji.fedoraproject.org/kojihub"
|
||||
koji_root: "riscv-koji.fedoraproject.org/koji"
|
||||
lvm_size: 100000
|
||||
mem_size: 45056
|
||||
max_mem_size: 90112
|
||||
mem_size: 32768
|
||||
max_mem_size: 65536
|
||||
nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=4"
|
||||
num_cpus: 8
|
||||
primary_auth_source: ipa
|
||||
|
|
|
|||
|
|
@ -6,8 +6,8 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
# Need for rsync from log01 for logs.
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-noc
|
||||
- sysadmin-releng
|
||||
|
|
@ -26,8 +26,6 @@ num_cpus: 16
|
|||
primary_auth_source: ipa
|
||||
tcp_ports: [80, 8080]
|
||||
varnish_group: kojipkgs
|
||||
zabbix_macros:
|
||||
'VARNISH.STATUS.PORT': 80
|
||||
|
||||
notes: |
|
||||
Cache packages from koji for builders and others
|
||||
|
|
|
|||
|
|
@ -10,8 +10,6 @@ ipa_client_sudo_nopasswd_groups:
|
|||
ipa_host_group: maintainer_test
|
||||
ipa_host_group_desc: Test hosts for package maintainers
|
||||
primary_auth_source: ipa
|
||||
postfix_group: vpn
|
||||
sudoers: "{{ private }}/files/sudo/arm-packager-sudoers"
|
||||
sudoers_main: nopasswd
|
||||
vpn: true
|
||||
zabbix_host: 38.145.32.41
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ ipa_client_sudo_groups:
|
|||
- sysadmin-web
|
||||
ipa_host_group: memcached
|
||||
ipa_host_group_desc: Distributed Memory Caching service
|
||||
lvm_size: 25000
|
||||
lvm_size: 20000
|
||||
mem_size: 8192
|
||||
num_cpus: 2
|
||||
primary_auth_source: ipa
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ ipa_client_sudo_groups:
|
|||
- sysadmin-web
|
||||
ipa_host_group: memcached
|
||||
ipa_host_group_desc: Distributed Memory Caching service
|
||||
lvm_size: 25000
|
||||
lvm_size: 20000
|
||||
mem_size: 4096
|
||||
num_cpus: 1
|
||||
# for systems that do not match the above - specify the same parameter in
|
||||
|
|
|
|||
|
|
@ -18,7 +18,6 @@ openqa_dbname: openqa
|
|||
openqa_dbpassword: "{{ prod_openqa_dbpassword }}"
|
||||
openqa_dbuser: openqa
|
||||
openqa_env: production
|
||||
openqa_env_prefix:
|
||||
openqa_env_suffix:
|
||||
openqa_key: "{{ prod_openqa_apikey }}"
|
||||
# all our workers need NFS access
|
||||
|
|
@ -26,8 +25,6 @@ openqa_nfs_workers: "{{ groups['openqa_workers'] }}"
|
|||
openqa_resultsdb_url: https://resultsdb.fedoraproject.org/api/v2.0/
|
||||
openqa_resultsdb_user: "{{ prod_resultsdb_httpd_user }}"
|
||||
openqa_resultsdb_password: "{{ prod_resultsdb_httpd_password }}"
|
||||
# using u-t for prod temporarily to get 202606 snapshots
|
||||
openqa_repo: updates-testing
|
||||
openqa_secret: "{{ prod_openqa_apisecret }}"
|
||||
openqa_update_arches: ['aarch64', 'x86_64']
|
||||
openqa_webapi_plugins: FedoraMessaging
|
||||
|
|
|
|||
|
|
@ -24,10 +24,6 @@ openqa_amqp_this_url: "{{ openqa_amqp_stg_url }}"
|
|||
openqa_amqp_this_username: "{{ openqa_amqp_stg_username }}"
|
||||
openqa_amqp_scheduler_queue: "{{ openqa_amqp_prod_username }}_scheduler_stg"
|
||||
|
||||
# fedora-messaging dist-git reporter settings (not enabled on prod yet)
|
||||
openqa_amqp_distgit_reporter_queue: "{{ openqa_amqp_this_username }}_distgit_reporter"
|
||||
openqa_amqp_distgit_reporter_routing_keys: ["org.fedoraproject.{{ deployment_type }}.openqa.job.done"]
|
||||
|
||||
# auth stuff
|
||||
openqa_oauth2_secret: "{{ openqa_stg_oidc_secret }}"
|
||||
|
||||
|
|
@ -38,7 +34,6 @@ openqa_dbname: openqa-stg
|
|||
openqa_dbpassword: "{{ stg_openqa_dbpassword }}"
|
||||
openqa_dbuser: openqastg
|
||||
openqa_env: staging
|
||||
openqa_env_prefix: stg-
|
||||
openqa_env_suffix: .stg
|
||||
openqa_key: "{{ stg_openqa_apikey }}"
|
||||
# all our workers need NFS access
|
||||
|
|
|
|||
|
|
@ -2,9 +2,9 @@
|
|||
# uses interface definition from host vars
|
||||
custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept'
|
||||
- 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept'
|
||||
- 'add rule ip filter FORWARD iifname "br0" counter accept'
|
||||
- 'add rule ip filter FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept'
|
||||
- 'add rule ip filter INPUT iifname "br0" counter accept'
|
||||
# for iptables rules...maybe other stuff in future? both staging
|
||||
# and prod workers are in this group
|
||||
host_group: openqa-tap-workers
|
||||
|
|
@ -13,4 +13,4 @@ nat_rules: [
|
|||
'-A POSTROUTING -o {{ openqa_tap_iface }} -j MASQUERADE']
|
||||
nft_nat_rules: [
|
||||
# masquerade for openQA openvswitch workers to reach the outside
|
||||
'add rule {{ nft_table_nat }} POSTROUTING oifname "{{ openqa_tap_iface }}" counter masquerade']
|
||||
'add rule ip nat POSTROUTING oifname "{{ openqa_tap_iface }}" counter masquerade']
|
||||
|
|
|
|||
|
|
@ -21,7 +21,8 @@ openqa_hostname: openqa01.rdu3.fedoraproject.org
|
|||
openqa_key: "{{ prod_openqa_apikey }}"
|
||||
# we are all NFS workers for now at least
|
||||
openqa_nfs_worker: true
|
||||
# using u-t for prod temporarily to get 202606 snapshots
|
||||
# using u-t for prod temporarily to get QMP USB disconnect feature
|
||||
# drop when https://bodhi.fedoraproject.org/updates/FEDORA-2025-8a79a3d9af is stable
|
||||
openqa_repo: updates-testing
|
||||
openqa_secret: "{{ prod_openqa_apisecret }}"
|
||||
openqa_workers: 4
|
||||
|
|
|
|||
|
|
@ -6,10 +6,10 @@ custom_rules: [
|
|||
'-A INPUT -p tcp --dport 22623 --src 38.145.48.0/27 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
# Needed for keepalived
|
||||
- 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept'
|
||||
- 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule ip filter INPUT ip protocol vrrp counter accept'
|
||||
# machinectl api
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept'
|
||||
datacenter: cloud
|
||||
host_group: cloud
|
||||
lvm_size: 20000
|
||||
|
|
|
|||
|
|
@ -8,35 +8,35 @@ custom_rules: [
|
|||
'-A INPUT -s 47.76.99.127/32 -j REJECT'
|
||||
]
|
||||
nft_block_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 146.174.128.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 154.222.253.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 146.174.128.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 154.222.253.0/24 counter reject'
|
||||
# For the MOTD
|
||||
db_backup_dir: ['/backups']
|
||||
dbs_to_backup: ['pagure']
|
||||
|
|
@ -72,13 +72,6 @@ vpn: true
|
|||
zabbix_host: zabbix01.vpn.fedoraproject.org
|
||||
zabbix_macros:
|
||||
'VFS.DEV.WRITE.AWAIT.WARN': 60 # frequently saturated writes overnight
|
||||
# Hotfixes
|
||||
pagure_patches:
|
||||
- b50d32b7c92f131ebcc3b633de6c6e91e28297ec
|
||||
- 5529
|
||||
- readme-include
|
||||
- 26bc9746
|
||||
- 5553
|
||||
|
||||
notes: |
|
||||
Run the pagure instances for fedora
|
||||
|
|
|
|||
|
|
@ -41,13 +41,6 @@ zabbix_host: zabbix01.vpn.fedoraproject.org
|
|||
zabbix_server: "{{ zabbix_hostname }}"
|
||||
zabbix_auth_key: "{{ zabbix_apikey }}" # ansible-private repo
|
||||
zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo, pagure-stg is weird...
|
||||
# Hotfixes
|
||||
pagure_patches:
|
||||
- b50d32b7c92f131ebcc3b633de6c6e91e28297ec
|
||||
- 5529
|
||||
- readme-include
|
||||
- 26bc9746
|
||||
- 5553
|
||||
|
||||
notes: |
|
||||
Run the pagure instances for fedora
|
||||
|
|
|
|||
|
|
@ -1,30 +0,0 @@
|
|||
---
|
||||
env_prefix: stg.
|
||||
env_suffix: .stg
|
||||
env_short: stg
|
||||
freezes: false
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-noc
|
||||
- sysadmin-web
|
||||
- sysadmin-veteran
|
||||
ipa_client_sudo_groups:
|
||||
- sysadmin-web
|
||||
ipa_host_group: pagure_stg_ro
|
||||
ipa_host_group_desc: Pagure read only
|
||||
lvm_size: 50000
|
||||
mem_size: 8192
|
||||
num_cpus: 4
|
||||
postfix_group: vpn.pagure-stg
|
||||
tcp_ports: [22, 25, 80, 443, 9418,
|
||||
# Used for the eventsource server
|
||||
8088]
|
||||
vpn: true
|
||||
# Pagure-stg has special needs for monitoring
|
||||
zabbix_host: zabbix01.vpn.fedoraproject.org
|
||||
zabbix_server: "{{ zabbix_hostname }}"
|
||||
zabbix_auth_key: "{{ zabbix_apikey }}" # ansible-private repo
|
||||
zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo, pagure-stg is weird...
|
||||
|
||||
notes: |
|
||||
Run the pagure read only instances for fedora
|
||||
This host runs a read-only copy of the pagure forge
|
||||
|
|
@ -6,7 +6,7 @@ clamscan_paths:
|
|||
# For the MOTD
|
||||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept']
|
||||
git_basepath: /
|
||||
git_daemon_user: nobody
|
||||
git_port: 9418
|
||||
|
|
|
|||
|
|
@ -48,4 +48,3 @@ wsgi_procs: 20
|
|||
wsgi_threads: 5
|
||||
zabbix_macros:
|
||||
'VFS.FS.FSTYPE.MATCHES': '^(btrfs|ext2|ext3|ext4|reiser|xfs|ffs|ufs|jfs|jfs2|vxfs|hfs|apfs|refs|ntfs|fat32|zfs|nfs)$'
|
||||
postfix_group: pkgs
|
||||
|
|
|
|||
|
|
@ -43,4 +43,3 @@ wsgi_procs: 4
|
|||
wsgi_threads: 4
|
||||
zabbix_macros:
|
||||
'VFS.FS.FSTYPE.MATCHES': '^(btrfs|ext2|ext3|ext4|reiser|xfs|ffs|ufs|jfs|jfs2|vxfs|hfs|apfs|refs|ntfs|fat32|zfs|nfs)$'
|
||||
postfix_group: pkgs
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
# Define resources for this group of hosts here.
|
||||
blocked_ip_v6: []
|
||||
blocked_ips: ['14.102.69.78', '104.219.54.236', '103.38.177.2', '110.172.140.98', '183.80.131.253', '113.190.178.137', '115.76.39.108', '116.109.31.204', '209.64.155.56']
|
||||
collectd_apache: true
|
||||
# For the MOTD
|
||||
custom_rules: [
|
||||
# Need for rsync from log01 for logs.
|
||||
|
|
@ -33,91 +34,90 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.128 -j ACCEPT',
|
||||
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.129 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 152.53.36.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.69.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 159.138.218.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 188.75.180.46/32 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 45.78.192.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.0.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.32.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.40.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.48.0/20 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.64.0/20 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.80.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.88.0/22 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.92.0/23 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.95.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.96.0/23 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.98.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.128.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.160.0/20 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.176.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.184.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.185.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.186.0/23 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 34.159.191.146/32 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 208.78.212.5/32 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 152.53.36.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 66.249.69.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 159.138.218.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 188.75.180.46/32 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 45.78.192.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.0.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.32.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.40.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.48.0/20 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.64.0/20 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.80.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.88.0/22 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.92.0/23 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.95.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.96.0/23 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.98.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.128.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.160.0/20 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.176.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.184.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject'
|
||||
nft_custom_rules:
|
||||
# Need for rsync from log01 for logs.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept'
|
||||
# allow varnish from localhost
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
# also allow varnish from internal for purge requests
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
external: true
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
@ -131,9 +131,7 @@ ipa_host_group_desc: Proxies between internal hosts and the Internet
|
|||
lvm_size: 100000
|
||||
# This is used in the httpd.conf to determine the value for serverlimit and
|
||||
# maxrequestworkers. On proxies with 8 cpus it should be 300 * 8 = 3200
|
||||
# However, due to lots of very transitory connections, bumping up to 6000
|
||||
# to give some head room.
|
||||
maxrequestworkers: 6000
|
||||
maxrequestworkers: 3200
|
||||
mem_size: 8192
|
||||
nagios_Check_Services:
|
||||
swap: false
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
---
|
||||
# Define resources for this group of hosts here.
|
||||
collectd_apache: true
|
||||
# For the MOTD
|
||||
custom_rules: [
|
||||
# Need for rsync from log01 for logs.
|
||||
|
|
@ -10,44 +11,44 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 192.168.1.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.16.163.0/24 --dport 6081 -j ACCEPT',
|
||||
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.115 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.116 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.117 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.118 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.119 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.120 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.121 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.122 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.123 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
nft_custom_rules:
|
||||
# Need for rsync from log01 for logs.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# allow varnish from localhost
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
# also allow varnish from internal for purge requests
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
# Need for rsync from log01 for logs.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept'
|
||||
# allow varnish from localhost
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
# also allow varnish from internal for purge requests
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
external: true
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
@ -62,9 +63,7 @@ ipa_host_group_desc: Proxies between internal hosts and the Internet
|
|||
lvm_size: 100000
|
||||
# This is used in the httpd.conf to determine the value for serverlimit and
|
||||
# maxrequestworkers. On proxies with 8 cpus it should be 300 * 8 = 3200
|
||||
# However, due to lots of very transitory connections, bumping up to 4000
|
||||
# to give some head room.
|
||||
maxrequestworkers: 4000
|
||||
maxrequestworkers: 3200
|
||||
mem_size: 49152
|
||||
num_cpus: 8
|
||||
ocp_masters_stg:
|
||||
|
|
@ -76,6 +75,8 @@ ocp_nodes_stg:
|
|||
- worker01.ocp.stg.rdu3.fedoraproject.org
|
||||
- worker02.ocp.stg.rdu3.fedoraproject.org
|
||||
- worker03.ocp.stg.rdu3.fedoraproject.org
|
||||
- worker04.ocp.stg.rdu3.fedoraproject.org
|
||||
- worker05.ocp.stg.rdu3.fedoraproject.org
|
||||
ocp_masters_rdu3_stg:
|
||||
- bootstrap.ocp.stg.rdu3.fedoraproject.org
|
||||
ocp_nodes_rdu3_stg:
|
||||
|
|
|
|||
|
|
@ -9,16 +9,16 @@ custom_rules: [
|
|||
]
|
||||
nft_custom_rules:
|
||||
# Neeed for rsync from log01 for logs.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Inter-node traffic
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
# In RDU3
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
ipa_host_group: rabbitmq
|
||||
ipa_host_group_desc: RabbitMQ service
|
||||
ipa_shell_groups:
|
||||
|
|
@ -38,8 +38,6 @@ tcp_ports: [
|
|||
# HTTP API
|
||||
#15672,
|
||||
]
|
||||
zabbix_macros:
|
||||
'RABBITMQ.MESSAGES.MAX.HIGH:"fmn"': 4000
|
||||
zabbix_templates:
|
||||
- group: "rabbitmq" # Ansible group
|
||||
template: "RabbitMQ node by Zabbix agent" # Template name in roles/zabbix/zabbix_templates/files/templatename.json
|
||||
|
|
|
|||
|
|
@ -9,16 +9,16 @@ custom_rules: [
|
|||
]
|
||||
nft_custom_rules:
|
||||
# Neeed for rsync from log01 for logs.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Inter-node traffic
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
# In RDU3
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
ipa_host_group: rabbitmq
|
||||
ipa_host_group_desc: RabbitMQ service
|
||||
ipa_shell_groups:
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@ custom_rules:
|
|||
- '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 2049 -j ACCEPT'
|
||||
- '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 5432 -j ACCEPT'
|
||||
nft_custom_rules:
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept'
|
||||
env: production
|
||||
freezes: false
|
||||
ipa_client_shell_groups:
|
||||
|
|
@ -18,7 +18,6 @@ nrpe_procs_warn: 1800
|
|||
primary_auth_source: ipa
|
||||
tcp_ports: [80, 443]
|
||||
vpn: true
|
||||
host_group: retrace
|
||||
|
||||
notes: |
|
||||
Provide a web interface and backend for ABRT Analytics and Retrace Server.
|
||||
|
|
|
|||
|
|
@ -26,6 +26,6 @@ tcp_ports: [25]
|
|||
vpn: true
|
||||
zabbix_macros:
|
||||
# We don't care *too much* about mail here
|
||||
POSTFIX.QUEUE.WARN: 300
|
||||
POSTFIX.QUEUE.AVG: 400
|
||||
POSTFIX.QUEUE.CRIT: 500
|
||||
POSTFIX.QUEUE.WARN: 100
|
||||
POSTFIX.QUEUE.AVG: 150
|
||||
POSTFIX.QUEUE.CRIT: 200
|
||||
|
|
|
|||
|
|
@ -69,5 +69,3 @@ zabbix_tls_psk: "{{ zabbix_tls_stg_psk }}" # in ansible-private repo
|
|||
zabbix_inventory:
|
||||
# Env is not a valid key, so use this field for environment
|
||||
deployment_status: staging
|
||||
zabbix_macros:
|
||||
'KOJI.HOST': koji.stg.fedoraproject.org
|
||||
|
|
|
|||
|
|
@ -10,13 +10,13 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
# Needed for rsync from log01 for logs.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept'
|
||||
# batcave01 also needs access to announce commits.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
deployment_type: prod
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
|
|||
|
|
@ -10,14 +10,14 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
# Neeed for rsync from log01 for logs.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Needed to let nagios on noc01 and noc02 (noc01.stg) pipe alerts to zodbot here
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept'
|
||||
# batcave01 also needs access to announce commits.
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
deployment_type: stg
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ lvm_size: 30000
|
|||
max_mem_size: 8192
|
||||
mem_size: 8192
|
||||
nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3"
|
||||
num_cpus: 16
|
||||
num_cpus: 4
|
||||
primary_auth_source: ipa
|
||||
tcp_ports: [80]
|
||||
# mediawiki variables
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ nagios_Check_Services:
|
|||
num_cpus: 4
|
||||
# for systems that do not match the above - specify the same parameter in
|
||||
# the host_vars/$hostname file
|
||||
tcp_ports: [80, 443, 10051]
|
||||
tcp_ports: [80, 443]
|
||||
notes: Test instanec for zabbix server
|
||||
zabbix_matrix_roomid: "!ypZEUFVkgStvzXNAnr:matrix.org"
|
||||
zabbix_base_hostgroups:
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue