diff --git a/.forgejo/workflows/ai-review.yaml b/.forgejo/workflows/ai-review.yaml index 0b4ec71952..cbe046dc54 100644 --- a/.forgejo/workflows/ai-review.yaml +++ b/.forgejo/workflows/ai-review.yaml @@ -11,5 +11,7 @@ jobs: uses: quality/workflows/.forgejo/workflows/ai-review.yml@main with: pr: ${{ forgejo.event.pull_request.number }} + config: | + include_mr_summary: false secrets: GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml index 9e409437b3..780339659e 100644 --- a/.forgejo/workflows/ci.yaml +++ b/.forgejo/workflows/ci.yaml @@ -54,6 +54,11 @@ jobs: with: fetch-depth: 0 + - name: Create symlink to overcome absolute paths + run: | + mkdir -p /srv/web/infra/ + ln -s /workspace/infra/ansible /srv/web/infra/ansible + - name: Get changed files id: changed-files uses: https://code.forgejo.org/tj-actions/changed-files@v47 diff --git a/files/common/epel10.repo b/files/common/epel10.repo index 6c0fc38d62..9a0016fbdb 100644 --- a/files/common/epel10.repo +++ b/files/common/epel10.repo @@ -1,9 +1,10 @@ [epel] name=Extras Packages for Enterprise Linux $releasever - $basearch -# This is a bit too magic, esp. as we are using the infra. repo. and explicitly -# point to a 10.x variant ... might as well do the same here. +# We aren't using mirrormanager here, but pointing direct to our repos +# So, we want to just point to '10' here and depend on the link that exists +# to point us to the newest minor release. # baseurl=https://infrastructure.fedoraproject.org/pub/epel/$releasever${releasever_minor:+z}/Everything/$basearch/ -baseurl=https://infrastructure.fedoraproject.org/pub/epel/10.1/Everything/$basearch/ +baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/$basearch/ enabled=1 gpgcheck=1 gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 @@ -11,7 +12,7 @@ gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 [epel-testing] name=Extras Packages for Enterprise Linux $releasever - $basearch # baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/$releasever${releasever_minor:+z}/Everything/$basearch/ -baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/10.1/Everything/$basearch/ +baseurl=https://infrastructure.fedoraproject.org/pub/epel/testing/10/Everything/$basearch/ enabled=0 gpgcheck=1 gpgkey=https://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 diff --git a/files/common/rhel10.repo b/files/common/rhel10.repo index 4079046d70..8e7a6917ce 100644 --- a/files/common/rhel10.repo +++ b/files/common/rhel10.repo @@ -12,24 +12,25 @@ gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg enabled=1 gpgcheck=1 -# NOTE: When you change the 10.x here also change it in the epel10.repo file. +# These are not using mirrormanager, so point to '10' which will use the link +# to the latest minor release. [rhel10-BaseOS] name = rhel10 BaseOS $basearch -baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/baseos +baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/baseos gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release enabled=1 gpgcheck=1 [rhel10-AppStream] name = rhel10 AppStream $basearch -baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/appstream +baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/appstream gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release enabled=1 gpgcheck=1 [rhel10-CRB] name = rhel10 CodeReadyBuilder $basearch -baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.1/repos/$basearch/crb +baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/$basearch/crb gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release enabled=1 gpgcheck=1 diff --git a/files/httpd/fedorahosted-redirects.conf b/files/httpd/fedorahosted-redirects.conf index bbdb3bed6a..3b6eeee3ea 100644 --- a/files/httpd/fedorahosted-redirects.conf +++ b/files/httpd/fedorahosted-redirects.conf @@ -90,13 +90,13 @@ RewriteRule ^/gfs2-utils/report https://pagure.io/gfs2-utils/issues [R=301] RewriteRule ^/gfs2-utils/ticket/(.*) https://pagure.io/gfs2-utils/issue/$1 [R=301] RewriteRule ^/gfs2-utils https://pagure.io/gfs2-utils [R=301] -RewriteRule ^/elections/report https://pagure.io/elections/issues [R=301] -RewriteRule ^/elections/ticket/(.*) https://pagure.io/elections/issue/$1 [R=301] -RewriteRule ^/elections https://pagure.io/elections [R=301] +RewriteRule ^/elections/report https://forge.fedoraproject.org/apps/elections/issues [R=301] +RewriteRule ^/elections/ticket/(.*) https://forge.fedoraproject.org/apps/elections/issues/$1 [R=301] +RewriteRule ^/elections https://forge.fedoraproject.org/apps/elections [R=301] -RewriteRule ^/fedocal/report https://pagure.io/fedocal/issues [R=301] -RewriteRule ^/fedocal/ticket/(.*) https://pagure.io/fedocal/issue/$1 [R=301] -RewriteRule ^/fedocal https://pagure.io/fedocal [R=301] +RewriteRule ^/fedocal/report https://forge.fedoraproject.org/apps/fedocal/issues [R=301] +RewriteRule ^/fedocal/ticket/(.*) https://forge.fedoraproject.org/apps/fedocal/issue/$1 [R=301] +RewriteRule ^/fedocal https://forge.fedoraproject.org/apps/fedocal [R=301] RewriteRule ^/FedoraReview/report https://pagure.io/FedoraReview/issues [R=301] RewriteRule ^/FedoraReview/ticket/(.*) https://pagure.io/FedoraReview/issue/$1 [R=301] diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml index 47bf9ebc04..73ef1bb14a 100644 --- a/handlers/restart_services.yml +++ b/handlers/restart_services.yml @@ -80,13 +80,13 @@ action: service name=network state=restarted - name: Rebuild postfix transport - ansible.builtin.command: /usr/sbin/postmap /etc/postfix/transport + ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/transport - name: Rebuild postfix bysender - ansible.builtin.command: /usr/sbin/postmap /etc/postfix/bysender + ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/bysender - name: Rebuild postfix tls_policy - ansible.builtin.command: /usr/sbin/postmap /etc/postfix/tls_policy + ansible.builtin.command: /usr/sbin/postmap lmdb:/etc/postfix/tls_policy - name: Restart postfix service: name=postfix state=restarted diff --git a/inventory/builders b/inventory/builders index 13448e4fe8..6b480107de 100644 --- a/inventory/builders +++ b/inventory/builders @@ -297,6 +297,7 @@ buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org buildhw-x86-12.rdu3.fedoraproject.org buildhw-x86-13.rdu3.fedoraproject.org +buildhw-x86-14.rdu3.fedoraproject.org [buildhw_stg] buildhw-p10-01.stg.rdu3.fedoraproject.org @@ -323,6 +324,7 @@ buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org buildhw-x86-12.rdu3.fedoraproject.org buildhw-x86-13.rdu3.fedoraproject.org +buildhw-x86-14.rdu3.fedoraproject.org [buildhw_stg_rdu3] buildhw-p10-01.stg.rdu3.fedoraproject.org @@ -399,10 +401,9 @@ buildvm-ppc64le-30.rdu3.fedoraproject.org buildvm-ppc64le-31.rdu3.fedoraproject.org buildvm-ppc64le-32.rdu3.fedoraproject.org -[bkernel] -buildhw-x86-01.rdu3.fedoraproject.org - [secureboot] +buildhw-x86-01.rdu3.fedoraproject.org +buildhw-a64-01.rdu3.fedoraproject.org buildhw-x86-02.rdu3.fedoraproject.org buildhw-a64-02.rdu3.fedoraproject.org @@ -465,7 +466,7 @@ buildvm buildvm_aarch64 buildvm_ppc64le buildvm_s390x -bkernel +secureboot [builders_stg:children] buildhw_ppc64le_stg diff --git a/inventory/cloud b/inventory/cloud index 8032eb2bc6..245f731db0 100644 --- a/inventory/cloud +++ b/inventory/cloud @@ -46,6 +46,7 @@ aarch64-test02.fedorainfracloud.org # This is not in aws, but here is good enough for now ppc64le-test.fedorainfracloud.org ppc64le-test02.fedorainfracloud.org +s390x-test01.fedorainfracloud.org logdetective01.fedorainfracloud.org logdetective02.fedorainfracloud.org diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 2ae29716a2..c98886653e 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -44,38 +44,12 @@ communishift_projects: communishift-admins: name: communishift-admins do_not_delete: true # Marked do not delete 2024-11-25 - dkirwan - communishift-avant: - name: communishift-avant - cpu_limits: 2 - cpu_requests: 2 - memory_limits: 3Gi - memory_requests: 1.5Gi - pods: 6 - storage_requests: 10Gi - communishift-commops-analytics: - name: communishift-commops-analytics - communishift-commops-datanom: - name: communishift-commops-datanom - communishift-discoursepolls: - name: communishift-discoursepolls - communishift-eventbot: - name: communishift-eventbot communishift-fedora-coreos-ai-helpers: name: communishift-fedora-coreos-ai-helpers do_not_delete: true # Marked do not delete 2025-12-18 - dkirwan infra 12996 communishift-fedora-review-service: do_not_delete: true # Marked do not delete 2024-10-21 - dkirwan name: communishift-fedora-review-service - communishift-forgejo: - name: communishift-forgejo - communishift-fossology: - name: communishift-fossology - communishift-gitlabce: - name: communishift-gitlabce - communishift-jitsi: - name: communishift-jitsi - communishift-lightspeed-build: - name: communishift-lightspeed-build communishift-log-detective: name: communishift-log-detective do_not_delete: true # Marked do not delete 2024-10-21 - dkirwan @@ -83,31 +57,23 @@ communishift_projects: memory_requests: 4Gi storage_requests: 10Gi pods: 6 - communishift-mattdm: - name: communishift-mattdm - communishift-metrics: - name: communishift-metrics - communishift-ocm: - name: communishift-ocm - communishift-openscanhub: - name: communishift-openscanhub - cpu_limits: 2 - cpu_requests: 2 - memory_limits: 4Gi - memory_requests: 2Gi - pods: 16 - communishift-planet: - name: communishift-planet communishift-standupbot: name: communishift-standupbot do_not_delete: true # Marked do not delete 2026-05-01 - dkirwan communishift-weekly-bootc: do_not_delete: true # Marked do not delete 2024-11-26. Needed until end of bootc initative. - dkirwan name: communishift-weekly-bootc + communishift-release-schedule-planner: + name: communishift-release-schedule-planner communishift-draft-share: name: communishift-draft-share - communishift-happinesspackets: - name: communishift-happinesspackets + communishift-coreos-agent: + name: communishift-coreos-agent + communishift-rag-magazine-guidelines: + name: communishift-rag-magazine-guidelines + storage_requests: 15Gi + communishift-public-inbox-poc: + name: communishift-public-inbox-poc # true or false if we are or are not a copr build virthost. # Default to false copr_build_virthost: false @@ -188,6 +154,12 @@ nftables: True nft_custom6_rules: [] nft_custom_rules: [] nft_nat_rules: [] +# Table names for nft +# Note that the ip/ip6 prefix here means we only look at IPv4/IPv6 packets. +nft_table_filter: "ip cle_infra_filter" +nft_table_nat: "ip cle_infra_nat" +nft_table_raw: "ip cle_infra_raw" +nft_table6_filter: "ip6 cle_infra_filter" # usually we do not want to enable nested virt, only on some virthosts nested: false network_allow_restart: yes diff --git a/inventory/group_vars/autosign b/inventory/group_vars/autosign index 02cd91ccd1..73f28d9e59 100644 --- a/inventory/group_vars/autosign +++ b/inventory/group_vars/autosign @@ -10,7 +10,7 @@ ansible_ifcfg_allowlist: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/autosign_hardware b/inventory/group_vars/autosign_hardware index b4c54b6aeb..27344fac30 100644 --- a/inventory/group_vars/autosign_hardware +++ b/inventory/group_vars/autosign_hardware @@ -2,5 +2,5 @@ # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign diff --git a/inventory/group_vars/bastion b/inventory/group_vars/bastion index 6765f217f6..f399bf1571 100644 --- a/inventory/group_vars/bastion +++ b/inventory/group_vars/bastion @@ -8,8 +8,8 @@ # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bastion_stg b/inventory/group_vars/bastion_stg index f7d3fbdbc1..7aa56d1ddc 100644 --- a/inventory/group_vars/bastion_stg +++ b/inventory/group_vars/bastion_stg @@ -19,8 +19,8 @@ batcave_ipa_client_shell_groups: [] # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' ipa_client_shell_groups: "{{ (bastion_ipa_client_shell_groups + batcave_ipa_client_shell_groups) | sort | unique }}" # # allow a bunch of sysadmin groups here so they can access internal stuff diff --git a/inventory/group_vars/batcave b/inventory/group_vars/batcave index eb86f03654..b5dfb59109 100644 --- a/inventory/group_vars/batcave +++ b/inventory/group_vars/batcave @@ -4,8 +4,8 @@ ansible_base: /srv/web/infra # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bodhi_backend b/inventory/group_vars/bodhi_backend index 5e58673e3b..c0b4170202 100644 --- a/inventory/group_vars/bodhi_backend +++ b/inventory/group_vars/bodhi_backend @@ -7,7 +7,7 @@ bodhi_message_routing_keys: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.5.125.71 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/bodhi_backend_stg b/inventory/group_vars/bodhi_backend_stg index 3a8266fd26..e9f7b60028 100644 --- a/inventory/group_vars/bodhi_backend_stg +++ b/inventory/group_vars/bodhi_backend_stg @@ -9,7 +9,7 @@ bodhi_message_routing_keys: # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 # this is sign-bridge01.rdu3 ip 10.16.169.120 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/buildvm_ppc64le_stg b/inventory/group_vars/buildvm_ppc64le_stg index b808743da2..bb1c08a0e9 100644 --- a/inventory/group_vars/buildvm_ppc64le_stg +++ b/inventory/group_vars/buildvm_ppc64le_stg @@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" # Groups and individual hosts should ovveride them with specific info. koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/ppc64le/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/ppc64le/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 150000 main_bridge: br0 diff --git a/inventory/group_vars/buildvm_s390x_stg b/inventory/group_vars/buildvm_s390x_stg index ca78ce5723..fcfe3076a6 100644 --- a/inventory/group_vars/buildvm_s390x_stg +++ b/inventory/group_vars/buildvm_s390x_stg @@ -13,7 +13,7 @@ koji_server_url: "https://koji.stg.fedoraproject.org/kojihub" koji_instance: "primary" koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/43/Server/s390x/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/44/Server/s390x/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora-s390x virt_install_command: "{{ virt_install_command_s390x_one_nic_unsafe }}" lvm_size: 100000 diff --git a/inventory/group_vars/buildvm_stg b/inventory/group_vars/buildvm_stg index 4bc1c93cd1..57a7b41248 100644 --- a/inventory/group_vars/buildvm_stg +++ b/inventory/group_vars/buildvm_stg @@ -18,7 +18,7 @@ koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" # Groups and individual hosts should ovveride them with specific info. koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 150000 max_mem_size: "{{ mem_size }}" diff --git a/inventory/group_vars/certgetter b/inventory/group_vars/certgetter index d4988816fb..c1710af73f 100644 --- a/inventory/group_vars/certgetter +++ b/inventory/group_vars/certgetter @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/certgetter_stg b/inventory/group_vars/certgetter_stg index 177cf1b29b..0f6bf890d9 100644 --- a/inventory/group_vars/certgetter_stg +++ b/inventory/group_vars/certgetter_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/copr_aws b/inventory/group_vars/copr_aws index db4fb0dcf3..a516f30973 100644 --- a/inventory/group_vars/copr_aws +++ b/inventory/group_vars/copr_aws @@ -19,12 +19,12 @@ backend_base_url: "https://download.copr.fedorainfracloud.org" builders: # max|spawn_concurrently|prealloc aws: - aarch64: [8, 2, 1] - x86_64: [50, 10, 20] + aarch64: [50, 10, 1] + x86_64: [50, 10, 1] # put here the number -1 of the actuall reserved instances aws_reserved: - aarch64: [50, 20, 33] - x86_64: [70, 20, 52] + aarch64: [55, 20, 55] + x86_64: [70, 20, 70] aws_reserved_powerful: x86_64: [2, 2, 2] aws_powerful: diff --git a/inventory/group_vars/copr_back_aws b/inventory/group_vars/copr_back_aws index ade4ed605f..20c93fb26d 100644 --- a/inventory/group_vars/copr_back_aws +++ b/inventory/group_vars/copr_back_aws @@ -53,6 +53,9 @@ copr_backend_data_2_raid1_volumes: - nvme-Amazon_Elastic_Block_Store_vol0f226a7163d28d8fd-part1 - nvme-Amazon_Elastic_Block_Store_vol07293869d85a750b8-part1 +rpmeta_enabled: true +rpmeta_hostname: rpmeta.fedoraproject.org + notes: | Provide the backend for copr (3rd party packages) * Backend: Management of copr cloud infrastructure (OpenStack). diff --git a/inventory/group_vars/copr_back_dev_aws b/inventory/group_vars/copr_back_dev_aws index e6b8d38f34..77d4e14994 100644 --- a/inventory/group_vars/copr_back_dev_aws +++ b/inventory/group_vars/copr_back_dev_aws @@ -49,6 +49,9 @@ copr_backend_data_2_raid1_volumes: - nvme-Amazon_Elastic_Block_Store_vol0ce8220e998e2e32a-part1 - nvme-Amazon_Elastic_Block_Store_vol0038e042c49987b82-part1 +rpmeta_enabled: true +rpmeta_hostname: rpmeta.stg.fedoraproject.org + notes: | Provide the testing environment of copr's backend This host is the testing environment for the cloud infrastructure of copr's backend diff --git a/inventory/group_vars/copr_hypervisor b/inventory/group_vars/copr_hypervisor index 2dd7d4013e..6baf31d963 100644 --- a/inventory/group_vars/copr_hypervisor +++ b/inventory/group_vars/copr_hypervisor @@ -47,13 +47,13 @@ nbde_client_bindings: libvirt_host: "{{ inventory_hostname }}" nft_custom_rules: - - add rule ip filter INPUT iifname virbr0 udp dport bootps accept - - add rule ip filter INPUT iifname virbr0 udp dport 53 accept - - add rule ip filter INPUT iifname virbr0 tcp dport ssh accept - - add rule ip filter FORWARD iifname "virbr0" oif != "virbr0" counter accept - - add rule ip filter FORWARD iifname "virbr0" ct state new counter accept - - add rule ip filter FORWARD ct state established,related counter accept - - add rule ip filter FORWARD ip protocol icmp counter accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport bootps accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport 53 accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 tcp dport ssh accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" oif != "virbr0" counter accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" ct state new counter accept + - add rule {{nft_table_filter}} FORWARD ct state established,related counter accept + - add rule {{nft_table_filter}} FORWARD ip protocol icmp counter accept zabbix_macros: CPU.UTIL.CRIT: 100 diff --git a/inventory/group_vars/copr_keygen_aws b/inventory/group_vars/copr_keygen_aws index d5c426591b..e94a546e1a 100644 --- a/inventory/group_vars/copr_keygen_aws +++ b/inventory/group_vars/copr_keygen_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/copr_keygen_dev_aws b/inventory/group_vars/copr_keygen_dev_aws index e64237e875..33308f4ee9 100644 --- a/inventory/group_vars/copr_keygen_dev_aws +++ b/inventory/group_vars/copr_keygen_dev_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/download b/inventory/group_vars/download index 272948f7d0..1b63373ace 100644 --- a/inventory/group_vars/download +++ b/inventory/group_vars/download @@ -115,7 +115,7 @@ ipa_host_group_desc: Download servers nagios_Check_Services: swap: false nft_block_rules: - - 'add rule ip filter INPUT ip saddr 212.143.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 212.143.41.0/24 counter reject' primary_auth_source: ipa zabbix_macros: 'APACHE.STATUS.PORT': 443 # Proxies appear to ignore port 80 for apache-status diff --git a/inventory/group_vars/ipa b/inventory/group_vars/ipa index 0c023273a0..71f0c59e3d 100644 --- a/inventory/group_vars/ipa +++ b/inventory/group_vars/ipa @@ -1,7 +1,7 @@ --- # Define resources for this group of hosts here. custom_rules: ['-A INPUT -p udp -m udp -s 10.16.0.0/16 --dport 53 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] host_backup_targets: ['/var/lib/ipa/backup', '/var/log/dirsrv/slapd-FEDORAPROJECT-ORG'] ipa_client_shell_groups: - sysadmin-accounts diff --git a/inventory/group_vars/ipatuura_stg b/inventory/group_vars/ipatuura_stg index 3d09c4e75e..90d5d20b90 100644 --- a/inventory/group_vars/ipatuura_stg +++ b/inventory/group_vars/ipatuura_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipatuura ipa_host_group_desc: IPA-tuura SCIM application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon b/inventory/group_vars/ipsilon index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon +++ b/inventory/group_vars/ipsilon @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_rdu3 b/inventory/group_vars/ipsilon_rdu3 index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon_rdu3 +++ b/inventory/group_vars/ipsilon_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_stg b/inventory/group_vars/ipsilon_stg index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg +++ b/inventory/group_vars/ipsilon_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon_stg_rdu3 b/inventory/group_vars/ipsilon_stg_rdu3 index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg_rdu3 +++ b/inventory/group_vars/ipsilon_stg_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/kernel_qa b/inventory/group_vars/kernel_qa index 593edfd488..cfee9501db 100644 --- a/inventory/group_vars/kernel_qa +++ b/inventory/group_vars/kernel_qa @@ -1,6 +1,6 @@ --- custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.122.0/24 --dport 2049 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] freezes: false ipa_client_shell_groups: - sysadmin-kernel diff --git a/inventory/group_vars/koji b/inventory/group_vars/koji index 9f9b351aee..ec25cd2d60 100644 --- a/inventory/group_vars/koji +++ b/inventory/group_vars/koji @@ -5,8 +5,8 @@ custom_rules: [ '-A INPUT -d 224.0.0.0/8 -j ACCEPT', '-A INPUT -p vrrp -j ACCEPT'] # Needed for keepalived nft_custom_rules: - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' docker_registry: "candidate-registry.fedoraproject.org" ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/kojipkgs b/inventory/group_vars/kojipkgs index b8e6a711bb..e73a655f8a 100644 --- a/inventory/group_vars/kojipkgs +++ b/inventory/group_vars/kojipkgs @@ -6,8 +6,8 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] # Need for rsync from log01 for logs. nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_client_shell_groups: - sysadmin-noc - sysadmin-releng diff --git a/inventory/group_vars/memcached b/inventory/group_vars/memcached index 36de6ce023..d53ea3eaef 100644 --- a/inventory/group_vars/memcached +++ b/inventory/group_vars/memcached @@ -9,7 +9,7 @@ ipa_client_sudo_groups: - sysadmin-web ipa_host_group: memcached ipa_host_group_desc: Distributed Memory Caching service -lvm_size: 20000 +lvm_size: 25000 mem_size: 8192 num_cpus: 2 primary_auth_source: ipa diff --git a/inventory/group_vars/memcached_stg b/inventory/group_vars/memcached_stg index d23f6b5516..41d19cd247 100644 --- a/inventory/group_vars/memcached_stg +++ b/inventory/group_vars/memcached_stg @@ -9,7 +9,7 @@ ipa_client_sudo_groups: - sysadmin-web ipa_host_group: memcached ipa_host_group_desc: Distributed Memory Caching service -lvm_size: 20000 +lvm_size: 25000 mem_size: 4096 num_cpus: 1 # for systems that do not match the above - specify the same parameter in diff --git a/inventory/group_vars/openqa_tap_workers b/inventory/group_vars/openqa_tap_workers index ca322db3e0..7fb7eacf15 100644 --- a/inventory/group_vars/openqa_tap_workers +++ b/inventory/group_vars/openqa_tap_workers @@ -2,9 +2,9 @@ # uses interface definition from host vars custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter FORWARD iifname "br0" counter accept' - - 'add rule ip filter FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' - - 'add rule ip filter INPUT iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' + - 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept' # for iptables rules...maybe other stuff in future? both staging # and prod workers are in this group host_group: openqa-tap-workers diff --git a/inventory/group_vars/os_proxies b/inventory/group_vars/os_proxies index 97579daf6a..6d857ed86c 100644 --- a/inventory/group_vars/os_proxies +++ b/inventory/group_vars/os_proxies @@ -6,10 +6,10 @@ custom_rules: [ '-A INPUT -p tcp --dport 22623 --src 38.145.48.0/27 -j ACCEPT'] nft_custom_rules: # Needed for keepalived - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' # machinectl api - - 'add rule ip filter INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' datacenter: cloud host_group: cloud lvm_size: 20000 diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure index eb711ff83c..9606270220 100644 --- a/inventory/group_vars/pagure +++ b/inventory/group_vars/pagure @@ -8,35 +8,35 @@ custom_rules: [ '-A INPUT -s 47.76.99.127/32 -j REJECT' ] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 146.174.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 154.222.253.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 146.174.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 154.222.253.0/24 counter reject' # For the MOTD db_backup_dir: ['/backups'] dbs_to_backup: ['pagure'] @@ -72,6 +72,13 @@ vpn: true zabbix_host: zabbix01.vpn.fedoraproject.org zabbix_macros: 'VFS.DEV.WRITE.AWAIT.WARN': 60 # frequently saturated writes overnight +# Hotfixes +pagure_patches: + - b50d32b7c92f131ebcc3b633de6c6e91e28297ec + - 5529 + - readme-include + - 26bc9746 + - 5553 notes: | Run the pagure instances for fedora diff --git a/inventory/group_vars/pagure_stg b/inventory/group_vars/pagure_stg index a63e991bc9..b1a01ec7b3 100644 --- a/inventory/group_vars/pagure_stg +++ b/inventory/group_vars/pagure_stg @@ -41,6 +41,13 @@ zabbix_host: zabbix01.vpn.fedoraproject.org zabbix_server: "{{ zabbix_hostname }}" zabbix_auth_key: "{{ zabbix_apikey }}" # ansible-private repo zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo, pagure-stg is weird... +# Hotfixes +pagure_patches: + - b50d32b7c92f131ebcc3b633de6c6e91e28297ec + - 5529 + - readme-include + - 26bc9746 + - 5553 notes: | Run the pagure instances for fedora diff --git a/inventory/group_vars/people b/inventory/group_vars/people index 0d8398988a..2bb85c5fc1 100644 --- a/inventory/group_vars/people +++ b/inventory/group_vars/people @@ -6,7 +6,7 @@ clamscan_paths: # For the MOTD # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] git_basepath: / git_daemon_user: nobody git_port: 9418 diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 48354ae605..2bf758e66a 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -34,90 +34,91 @@ custom_rules: [ '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.128 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.129 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 152.53.36.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.69.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 159.138.218.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 188.75.180.46/32 counter reject' - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' - - 'add rule ip filter INPUT ip saddr 45.78.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.0.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.32.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.40.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.48.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.64.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.80.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.88.0/22 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.92.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.95.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.96.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.98.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.128.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.160.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.176.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.184.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.53.36.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.69.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 159.138.218.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 188.75.180.46/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 45.78.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.0.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.32.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.40.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.48.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.64.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.80.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.88.0/22 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.92.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.95.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.96.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.98.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.128.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.160.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.176.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.184.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.185.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.186.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 34.159.191.146/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 208.78.212.5/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice @@ -131,7 +132,9 @@ ipa_host_group_desc: Proxies between internal hosts and the Internet lvm_size: 100000 # This is used in the httpd.conf to determine the value for serverlimit and # maxrequestworkers. On proxies with 8 cpus it should be 300 * 8 = 3200 -maxrequestworkers: 3200 +# However, due to lots of very transitory connections, bumping up to 4000 +# to give some head room. +maxrequestworkers: 4000 mem_size: 8192 nagios_Check_Services: swap: false diff --git a/inventory/group_vars/proxies_stg b/inventory/group_vars/proxies_stg index f3bbd7020f..e19035b1b5 100644 --- a/inventory/group_vars/proxies_stg +++ b/inventory/group_vars/proxies_stg @@ -11,44 +11,44 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.16.163.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.115 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.116 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.117 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.118 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.119 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.120 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.121 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.122 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice @@ -63,7 +63,9 @@ ipa_host_group_desc: Proxies between internal hosts and the Internet lvm_size: 100000 # This is used in the httpd.conf to determine the value for serverlimit and # maxrequestworkers. On proxies with 8 cpus it should be 300 * 8 = 3200 -maxrequestworkers: 3200 +# However, due to lots of very transitory connections, bumping up to 4000 +# to give some head room. +maxrequestworkers: 4000 mem_size: 49152 num_cpus: 8 ocp_masters_stg: diff --git a/inventory/group_vars/rabbitmq b/inventory/group_vars/rabbitmq index c8521a8998..ea590e3e62 100644 --- a/inventory/group_vars/rabbitmq +++ b/inventory/group_vars/rabbitmq @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/rabbitmq_stg b/inventory/group_vars/rabbitmq_stg index c49e840c32..de7aae5d30 100644 --- a/inventory/group_vars/rabbitmq_stg +++ b/inventory/group_vars/rabbitmq_stg @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/retrace b/inventory/group_vars/retrace index e8ee077ab2..345b9d6322 100644 --- a/inventory/group_vars/retrace +++ b/inventory/group_vars/retrace @@ -3,8 +3,8 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 2049 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 5432 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' env: production freezes: false ipa_client_shell_groups: diff --git a/inventory/group_vars/staging b/inventory/group_vars/staging index 5c9d7004bb..ca7fb08b02 100644 --- a/inventory/group_vars/staging +++ b/inventory/group_vars/staging @@ -69,3 +69,5 @@ zabbix_tls_psk: "{{ zabbix_tls_stg_psk }}" # in ansible-private repo zabbix_inventory: # Env is not a valid key, so use this field for environment deployment_status: staging +zabbix_macros: + 'KOJI.HOST': koji.stg.fedoraproject.org diff --git a/inventory/group_vars/value b/inventory/group_vars/value index 6321063d96..9e794d8352 100644 --- a/inventory/group_vars/value +++ b/inventory/group_vars/value @@ -10,13 +10,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Needed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: prod ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/value_stg b/inventory/group_vars/value_stg index 02e65cdfdf..b6c3cea5ba 100644 --- a/inventory/group_vars/value_stg +++ b/inventory/group_vars/value_stg @@ -10,14 +10,14 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 (noc01.stg) pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: stg ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/hardware b/inventory/hardware index 500861d19b..c050cb8214 100644 --- a/inventory/hardware +++ b/inventory/hardware @@ -23,6 +23,7 @@ buildhw-x86-09.rdu3.fedoraproject.org buildhw-x86-10.rdu3.fedoraproject.org buildhw-x86-12.rdu3.fedoraproject.org buildhw-x86-13.rdu3.fedoraproject.org +buildhw-x86-14.rdu3.fedoraproject.org ## Build vm hosts bvmhost-x86-01.rdu3.fedoraproject.org bvmhost-x86-02.rdu3.fedoraproject.org diff --git a/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org index 291232794d..479e242431 100644 --- a/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org +++ b/inventory/host_vars/buildhw-x86-13.rdu3.fedoraproject.org @@ -1,6 +1,6 @@ --- bmc: - ip_address: 10.16.160.25 + ip_address: 10.16.160.87 ping: true http: true https: true diff --git a/inventory/host_vars/buildhw-x86-14.rdu3.fedoraproject.org b/inventory/host_vars/buildhw-x86-14.rdu3.fedoraproject.org new file mode 100644 index 0000000000..64df912d59 --- /dev/null +++ b/inventory/host_vars/buildhw-x86-14.rdu3.fedoraproject.org @@ -0,0 +1,70 @@ +--- +bmc: + ip_address: 10.16.160.88 + ping: true + http: true + https: true +br0_ipv4_ip: 10.16.169.44 +br0_ipv4_gw: 10.16.169.254 +br0_ipv4_nm: 24 +datacenter: rdu3 +dns1: 10.16.163.33 +dns2: 10.16.163.34 +dns_search1: "rdu3.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +mac0: b4:45:06:fb:84:2e +mac1: b4:45:06:fb:84:2f +mac2: 5c:6f:69:7f:ba:30 +mac3: 5c:6f:69:7f:ba:31 +network_connections: + # Bridge profile + - name: br0 + state: up + type: bridge + mtu: 1500 + autoconnect: yes + ip: + address: + - "{{ br0_ipv4_ip }}/{{ br0_ipv4_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + # Bond profile + - name: bond0 + type: bond + interface_name: bond0 + mtu: 1500 + controller: br0 + bond: + mode: 802.3ad + # Port profile for the 1st Ethernet device + - name: bond0-port1 + mac: "{{ mac2 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 + # Port profile for the 2nd Ethernet device + - name: bond0-port2 + mac: "{{ mac3 }}" + type: ethernet + controller: bond0 + state: up + mtu: 1500 +# This is used to populate the inventory fields, only specific keys are allowed, see +# https://www.zabbix.com/documentation/current/en/manual/api/reference/host/object#host-inventory +zabbix_inventory: + date_hw_expiry: "" + date_hw_purchase: "" + hardware: PowerEdge R450 + location: RDU3 + oob_ip: "{{ bmc.ip_address }}" + serialno_a: F922FZ3 + type: Prod_Dedicated_HW + vendor: Dell diff --git a/inventory/host_vars/certgetter01.rdu3.fedoraproject.org b/inventory/host_vars/certgetter01.rdu3.fedoraproject.org index 479af39f2a..ca639e6cda 100644 --- a/inventory/host_vars/certgetter01.rdu3.fedoraproject.org +++ b/inventory/host_vars/certgetter01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.47 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora mem_size: 4096 vmhost: vmhost-x86-04.rdu3.fedoraproject.org diff --git a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org index 593c7e5fbe..795abe9429 100644 --- a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org @@ -4,17 +4,17 @@ # nft_custom_rules: # Openshift nodes (egress policy will block connection from non-authorized projects) - - 'add rule ip filter INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' # noc01 needs to connect to check the db - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # Ipsilon VMs - - 'add rule ip filter INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org index c8b25167e0..6cacb03829 100644 --- a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ # # TODO: lock it down more nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org index d74bf88646..7be7e3184b 100644 --- a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org @@ -3,10 +3,10 @@ # Only allow postgresql access from the frontend node. # nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org index 7c0ad3f451..2b120673a3 100644 --- a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # Only allow postgresql access from the frontend node. # -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org index 332c62b5a6..ddfa86353d 100644 --- a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # This is a generic list, monitored by collectd custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.172.21 --dport 5432 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' databases: - koji datacenter: rdu3 diff --git a/inventory/host_vars/db01.rdu3.fedoraproject.org b/inventory/host_vars/db01.rdu3.fedoraproject.org index a2e97104fe..20973a7902 100644 --- a/inventory/host_vars/db01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - anitya diff --git a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org index c8ade85061..687ac8513e 100644 --- a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - askfedora diff --git a/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org b/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org index 68c6beb90c..8fc6069445 100644 --- a/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org +++ b/inventory/host_vars/debuginfod01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.109 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora sar_script_user: root virt_install_command: "{{ virt_install_command_one_nic }}" diff --git a/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org b/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org index 11ecfcd65c..3c49e68b91 100644 --- a/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/debuginfod01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.166.254 eth0_ipv4_ip: 10.16.166.62 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora vmhost: vmhost-x86-03.stg.rdu3.fedoraproject.org volgroup: /dev/vg_guests diff --git a/inventory/host_vars/dedicatedsolutions02.fedoraproject.org b/inventory/host_vars/dedicatedsolutions02.fedoraproject.org new file mode 100644 index 0000000000..ca42c543a4 --- /dev/null +++ b/inventory/host_vars/dedicatedsolutions02.fedoraproject.org @@ -0,0 +1,46 @@ +--- +br0_ipv4: 67.219.144.67 +br0_ipv4_gw: 67.219.144.65 +br0_ipv4_nm: 29 +br0_ipv6: "2604:1580:fe00:0:dead:beef:cafe:fe02" +br0_ipv6_gw: "2604:1580:fe00::1" +br0_ipv6_nm: 64 +br0_port0_mac: "{{ mac1 }}" +datacenter: dedicatedsolutions +dns1: 8.8.8.8 +dns2: 8.8.4.4 +dns_search1: "vpn.fedoraproject.org" +dns_search2: "fedoraproject.org" +has_ipv4: yes +has_ipv6: yes +mac1: 6c:c2:17:2b:73:40 +network_connections: + - autoconnect: yes + ip: + address: + - "{{ br0_ipv4 }}/{{ br0_ipv4_nm }}" + - "{{ br0_ipv6 }}/{{ br0_ipv6_nm }}" + dhcp4: no + dns: + - "{{ dns1 }}" + - "{{ dns2 }}" + dns_search: + - "{{ dns_search1 }}" + - "{{ dns_search2 }}" + gateway4: "{{ br0_ipv4_gw }}" + gateway6: "{{ br0_ipv6_gw }}" + name: br0 + state: up + type: bridge + - mac: "{{ br0_port0_mac }}" + master: br0 + name: br0-port0 + state: up + type: ethernet +nrpe_procs_crit: 1000 +nrpe_procs_warn: 900 +postfix_group: vpn +virthost: true +vpn: true +zabbix_macros: + 'VFS.DEV.WRITE.AWAIT.WARN': 100 diff --git a/inventory/host_vars/dl01.rdu3.fedoraproject.org b/inventory/host_vars/dl01.rdu3.fedoraproject.org index b9e8d57ca2..b5d366bc4a 100644 --- a/inventory/host_vars/dl01.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl01.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 diff --git a/inventory/host_vars/dl02.rdu3.fedoraproject.org b/inventory/host_vars/dl02.rdu3.fedoraproject.org index f700b455c6..63631199bf 100644 --- a/inventory/host_vars/dl02.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl02.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 diff --git a/inventory/host_vars/dl03.rdu3.fedoraproject.org b/inventory/host_vars/dl03.rdu3.fedoraproject.org index 1e118d8883..982c347e77 100644 --- a/inventory/host_vars/dl03.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl03.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 diff --git a/inventory/host_vars/dl04.rdu3.fedoraproject.org b/inventory/host_vars/dl04.rdu3.fedoraproject.org index 645e09e38d..d458a05a73 100644 --- a/inventory/host_vars/dl04.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl04.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 diff --git a/inventory/host_vars/dl05.rdu3.fedoraproject.org b/inventory/host_vars/dl05.rdu3.fedoraproject.org index 65ce0111c5..a783e60d67 100644 --- a/inventory/host_vars/dl05.rdu3.fedoraproject.org +++ b/inventory/host_vars/dl05.rdu3.fedoraproject.org @@ -29,8 +29,8 @@ network_connections: type: ethernet state: up mtu: 1500 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 20480 mem_size: 16384 diff --git a/inventory/host_vars/download-ib01.fedoraproject.org b/inventory/host_vars/download-ib01.fedoraproject.org index a363b91903..28796729e8 100644 --- a/inventory/host_vars/download-ib01.fedoraproject.org +++ b/inventory/host_vars/download-ib01.fedoraproject.org @@ -11,9 +11,9 @@ eth0_ipv6_ip: "2606:f640:6000:651::10" eth0_ipv6_gw: "2606:f640:6000:651::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel -lvm_size: 150000 +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 +lvm_size: 100000 main_bridge: br0 max_mem_size: 49152 mem_size: 32768 diff --git a/inventory/host_vars/download-iso01.rdu3.fedoraproject.org b/inventory/host_vars/download-iso01.rdu3.fedoraproject.org index 35e715d89c..a0a9fb02d5 100644 --- a/inventory/host_vars/download-iso01.rdu3.fedoraproject.org +++ b/inventory/host_vars/download-iso01.rdu3.fedoraproject.org @@ -10,8 +10,8 @@ eth0_ipv6_ip: 2620:52:6:1161::35 eth0_ipv6_nm: 64 eth0_nm: 255.255.255.0 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 lvm_size: 50000 max_mem_size: 49152 mem_size: 32768 diff --git a/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org b/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org index 6b94e08708..88838083ad 100644 --- a/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/ipsilon01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.166.254 eth0_ipv4_ip: 10.16.166.30 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora vmhost: vmhost-x86-04.stg.rdu3.fedoraproject.org volgroup: /dev/vg_guests diff --git a/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org b/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org index c05a1aebb2..744acaae55 100644 --- a/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/koji01.stg.rdu3.fedoraproject.org @@ -6,7 +6,7 @@ koji_instance: primary koji_server_url: "https://koji.stg.fedoraproject.org/kojihub" koji_topurl: "https://kojipkgs.stg.fedoraproject.org/" koji_weburl: "https://koji.stg.fedoraproject.org/koji" -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 1.5t nrpe_procs_crit: 1000 diff --git a/inventory/host_vars/memcached02.rdu3.fedoraproject.org b/inventory/host_vars/memcached01.rdu3.fedoraproject.org similarity index 83% rename from inventory/host_vars/memcached02.rdu3.fedoraproject.org rename to inventory/host_vars/memcached01.rdu3.fedoraproject.org index 4be2a60813..cef266f37a 100644 --- a/inventory/host_vars/memcached02.rdu3.fedoraproject.org +++ b/inventory/host_vars/memcached01.rdu3.fedoraproject.org @@ -1,8 +1,8 @@ --- datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 -eth0_ipv4_ip: 10.16.163.130 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +eth0_ipv4_ip: 10.16.163.59 +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-03.rdu3.fedoraproject.org volgroup: /dev/vg_guests diff --git a/inventory/host_vars/memcached02.stg.rdu3.fedoraproject.org b/inventory/host_vars/memcached01.stg.rdu3.fedoraproject.org similarity index 83% rename from inventory/host_vars/memcached02.stg.rdu3.fedoraproject.org rename to inventory/host_vars/memcached01.stg.rdu3.fedoraproject.org index ff01e13822..447ddd2bc1 100644 --- a/inventory/host_vars/memcached02.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/memcached01.stg.rdu3.fedoraproject.org @@ -1,8 +1,8 @@ --- datacenter: rdu3 eth0_ipv4_gw: 10.16.166.254 -eth0_ipv4_ip: 10.16.166.77 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +eth0_ipv4_ip: 10.16.166.41 +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-05.stg.rdu3.fedoraproject.org volgroup: /dev/vg_guests diff --git a/inventory/host_vars/noc01.rdu3.fedoraproject.org b/inventory/host_vars/noc01.rdu3.fedoraproject.org index f8b1f05238..53e7ab1f17 100644 --- a/inventory/host_vars/noc01.rdu3.fedoraproject.org +++ b/inventory/host_vars/noc01.rdu3.fedoraproject.org @@ -6,13 +6,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT' ] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' # needed to allow rsync from log01 - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # needed to allow 8080 (firmware-proxy from iDRAC mgmt vlans - - 'add rule ip filter INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.10 diff --git a/inventory/host_vars/ns01.rdu3.fedoraproject.org b/inventory/host_vars/ns01.rdu3.fedoraproject.org index 9948a16d38..5729a5c2a8 100644 --- a/inventory/host_vars/ns01.rdu3.fedoraproject.org +++ b/inventory/host_vars/ns01.rdu3.fedoraproject.org @@ -32,7 +32,7 @@ network_connections: # This host is externally reachable # external: true -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-01.rdu3.fedoraproject.org volgroup: /dev/vg_guests diff --git a/inventory/host_vars/ns02.fedoraproject.org b/inventory/host_vars/ns02.fedoraproject.org index d08931fa03..5f71d75e00 100644 --- a/inventory/host_vars/ns02.fedoraproject.org +++ b/inventory/host_vars/ns02.fedoraproject.org @@ -24,8 +24,8 @@ eth0_ipv6_ip: "2606:f640:6000:651::11" eth0_ipv6_gw: "2606:f640:6000:651::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 main_bridge: br0 network_connections: - autoconnect: yes diff --git a/inventory/host_vars/ns03.rdu3.fedoraproject.org b/inventory/host_vars/ns03.rdu3.fedoraproject.org index c4e599a6f2..584692856b 100644 --- a/inventory/host_vars/ns03.rdu3.fedoraproject.org +++ b/inventory/host_vars/ns03.rdu3.fedoraproject.org @@ -32,7 +32,7 @@ network_connections: # This host is externally reachable # external: true -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-03.rdu3.fedoraproject.org volgroup: /dev/vg_guests diff --git a/inventory/host_vars/ns05.fedoraproject.org b/inventory/host_vars/ns05.fedoraproject.org index edb8d29c7e..8f22d3c906 100644 --- a/inventory/host_vars/ns05.fedoraproject.org +++ b/inventory/host_vars/ns05.fedoraproject.org @@ -25,8 +25,8 @@ eth0_ipv6_ip: "2001:4178:2:1269:dead:beef:cafe:fed5" eth0_ipv6_nm: 64 eth0_nm: 255.255.255.240 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 network_connections: - autoconnect: yes ip: diff --git a/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org b/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org index 684163b49a..1236c567a5 100644 --- a/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-candidate-registry01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.167.254 eth0_ipv4_ip: 10.16.167.34 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 diff --git a/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org b/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org index 46a175682c..94838530f8 100644 --- a/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-registry01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.169.254 eth0_ipv4_ip: 10.16.169.119 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 diff --git a/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org b/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org index b655cd5622..52eb0ebdf1 100644 --- a/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-registry01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.167.254 eth0_ipv4_ip: 10.16.167.35 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 diff --git a/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org b/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org index 3670ce979f..428c28d6ff 100644 --- a/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org +++ b/inventory/host_vars/oci-registry02.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.169.254 eth0_ipv4_ip: 10.16.169.127 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora lvm_size: 120g max_mem_size: 16384 diff --git a/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org b/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org index 27203f1501..37210a6ed6 100644 --- a/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa-lab01.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.174.254 eth0_ipv4_ip: 10.16.174.57 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ ############################################################ # install ############################################################ diff --git a/inventory/host_vars/openqa01.rdu3.fedoraproject.org b/inventory/host_vars/openqa01.rdu3.fedoraproject.org index ba01b72976..0b532ca810 100644 --- a/inventory/host_vars/openqa01.rdu3.fedoraproject.org +++ b/inventory/host_vars/openqa01.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.174.254 eth0_ipv4_ip: 10.16.174.52 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ ############################################################ # install ############################################################ diff --git a/inventory/host_vars/pagure-stg02.fedoraproject.org b/inventory/host_vars/pagure-stg02.fedoraproject.org index 2aac4a638b..0237574972 100644 --- a/inventory/host_vars/pagure-stg02.fedoraproject.org +++ b/inventory/host_vars/pagure-stg02.fedoraproject.org @@ -2,9 +2,10 @@ datacenter: rdu3 dns1: 10.16.163.33 dns2: 10.16.163.34 -dns_search1: "stg.rdu3.fedoraproject.org" -dns_search2: "rdu3.fedoraproject.org" -dns_search3: "fedoraproject.org" +dns_search1: "vpn.fedoraproject.org" +dns_search2: "stg.rdu3.fedoraproject.org" +dns_search3: "rdu3.fedoraproject.org" +dns_search4: "fedoraproject.org" effective_cache_size: "6GB" eth0_ipv4_gw: 10.16.179.254 eth0_ipv4_ip: 10.16.179.61 @@ -29,6 +30,7 @@ network_connections: - "{{ dns_search1 }}" - "{{ dns_search2 }}" - "{{ dns_search3 }}" + - "{{ dns_search4 }}" gateway4: "{{ eth0_ipv4_gw }}" gateway6: "{{ eth0_ipv6_gw }}" mac: "{{ ansible_default_ipv4.macaddress }}" diff --git a/inventory/host_vars/proxy11.fedoraproject.org b/inventory/host_vars/proxy11.fedoraproject.org index 64412d4565..aea51013c5 100644 --- a/inventory/host_vars/proxy11.fedoraproject.org +++ b/inventory/host_vars/proxy11.fedoraproject.org @@ -13,7 +13,7 @@ eth0_ipv6_nm: 64 freezes: true has_ipv4: yes has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora max_mem_size: 32768 mem_size: 32768 @@ -43,7 +43,7 @@ postfix_group: vpn public_hostname: proxy11.fedoraproject.org # This is consumed by the roles/fedora-web/main role sponsor: dedicatedsolutions -vmhost: dedicatedsolutions01.fedoraproject.org +vmhost: dedicatedsolutions02.fedoraproject.org volgroup: /dev/vg_guests vpn: true zabbix_macros: diff --git a/inventory/host_vars/proxy12.fedoraproject.org b/inventory/host_vars/proxy12.fedoraproject.org index af895c509f..874a7fa91b 100644 --- a/inventory/host_vars/proxy12.fedoraproject.org +++ b/inventory/host_vars/proxy12.fedoraproject.org @@ -13,9 +13,8 @@ eth0_ipv6_nm: 64 freezes: true has_ipv4: yes has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/43/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora -mac0: "52:54:00:84:5d:9f" main_bridge: br0 max_mem_size: 20000 mem_size: 16384 @@ -35,12 +34,12 @@ network_connections: - "{{ dns_search2 }}" gateway4: "{{ eth0_ipv4_gw }}" gateway6: "{{ eth0_ipv6_gw }}" - mac: "{{ mac0 }}" + mac: "{{ ansible_default_ipv4.macaddress }}" name: eth0 type: ethernet nrpe_procs_crit: 1400 nrpe_procs_warn: 1200 -num_cpus: 8 +num_cpus: 16 postfix_group: vpn public_hostname: proxy12.fedoraproject.org # This is consumed by the roles/fedora-web/main role diff --git a/inventory/host_vars/s390x-test01.fedorainfracloud.org b/inventory/host_vars/s390x-test01.fedorainfracloud.org new file mode 100644 index 0000000000..191cc20db8 --- /dev/null +++ b/inventory/host_vars/s390x-test01.fedorainfracloud.org @@ -0,0 +1,4 @@ +--- +nagios_Can_Connect: false +nagios_Check_Services: + nrpe: false diff --git a/inventory/host_vars/smtp-mm-ib01.fedoraproject.org b/inventory/host_vars/smtp-mm-ib01.fedoraproject.org index f96b77a648..5216e72d7c 100644 --- a/inventory/host_vars/smtp-mm-ib01.fedoraproject.org +++ b/inventory/host_vars/smtp-mm-ib01.fedoraproject.org @@ -11,8 +11,8 @@ eth0_ipv6_ip: "2606:f640:6000:651::5" eth0_ipv6_gw: "2606:f640:6000:651::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 main_bridge: br0 network_connections: - autoconnect: yes diff --git a/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org b/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org index f16713ed1c..af10b84859 100644 --- a/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org +++ b/inventory/host_vars/smtp-mm-iso01.rdu3.fedoraproject.org @@ -10,8 +10,8 @@ eth0_ipv4_ip: 10.16.179.63 eth0_ipv6_gw: 2620:52:6:1161::1 eth0_ipv6_ip: 2620:52:6:1161::34 eth0_nm: 255.255.255.0 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 vmhost: vmhost-x86-iso02.rdu3.fedoraproject.org volgroup: /dev/vg_guests vpn: true diff --git a/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org b/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org index 33d6e95995..947ca0ff87 100644 --- a/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org +++ b/inventory/host_vars/smtp-mm-osuosl01.fedoraproject.org @@ -10,8 +10,8 @@ eth0_ipv6_ip: "2605:bc80:3010:600:dead:beef:cafe:fedb" eth0_ipv6_gw: "2605:bc80:3010:600::1" eth0_ipv6_nm: 64 has_ipv6: yes -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 mem_size: 4096 network_connections: - autoconnect: yes diff --git a/inventory/host_vars/tang01.rdu3.fedoraproject.org b/inventory/host_vars/tang01.rdu3.fedoraproject.org index 72013fc401..2ce099c0a9 100644 --- a/inventory/host_vars/tang01.rdu3.fedoraproject.org +++ b/inventory/host_vars/tang01.rdu3.fedoraproject.org @@ -6,10 +6,10 @@ dns_search1: "rdu3.fedoraproject.org" dns_search2: "fedoraproject.org" eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.37 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 # Define resources for this group of hosts here. -lvm_size: 20000 +lvm_size: 25000 mem_size: 4096 num_cpus: 2 vmhost: vmhost-x86-01.rdu3.fedoraproject.org diff --git a/inventory/host_vars/tang02.rdu3.fedoraproject.org b/inventory/host_vars/tang02.rdu3.fedoraproject.org index 4e5253cdda..6ba0dfee23 100644 --- a/inventory/host_vars/tang02.rdu3.fedoraproject.org +++ b/inventory/host_vars/tang02.rdu3.fedoraproject.org @@ -6,10 +6,10 @@ dns_search1: "rdu3.fedoraproject.org" dns_search2: "fedoraproject.org" eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.38 -ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel +ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel-10 # Define resources for this group of hosts here. -lvm_size: 20000 +lvm_size: 25000 mem_size: 4096 num_cpus: 2 vmhost: vmhost-x86-05.rdu3.fedoraproject.org diff --git a/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org b/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org index af1b366341..05f8939b27 100644 --- a/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/wiki01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ datacenter: rdu3 eth0_ipv4_gw: 10.16.166.254 eth0_ipv4_ip: 10.16.166.24 -ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/42/Server/x86_64/os/ +ks_repo: https://infrastructure.fedoraproject.org/pub/fedora/linux/releases/44/Server/x86_64/os/ ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-fedora vmhost: vmhost-x86-03.stg.rdu3.fedoraproject.org volgroup: /dev/vg_guests diff --git a/inventory/inventory b/inventory/inventory index 25542fccc8..bb608f103a 100644 --- a/inventory/inventory +++ b/inventory/inventory @@ -109,7 +109,7 @@ bvmhost-x86-02.stg.rdu3.fedoraproject.org bvmhost-x86-03.stg.rdu3.fedoraproject.org [colo_virt] -dedicatedsolutions01.fedoraproject.org +dedicatedsolutions02.fedoraproject.org ibiblio02.fedoraproject.org ibiblio05.fedoraproject.org internetx02.fedoraproject.org @@ -343,16 +343,16 @@ noc01.rdu3.fedoraproject.org noc01.rdu3.fedoraproject.org [memcached] -memcached02.rdu3.fedoraproject.org +memcached01.rdu3.fedoraproject.org [memcached_rdu3] -memcached02.rdu3.fedoraproject.org +memcached01.rdu3.fedoraproject.org [memcached_stg] -memcached02.stg.rdu3.fedoraproject.org +memcached01.stg.rdu3.fedoraproject.org [memcached_stg_rdu3] -memcached02.stg.rdu3.fedoraproject.org +memcached01.stg.rdu3.fedoraproject.org [mirrorlist_proxies] proxy02.fedoraproject.org @@ -642,7 +642,7 @@ ipatuura01.stg.rdu3.fedoraproject.org ipsilon01.stg.rdu3.fedoraproject.org koji01.stg.rdu3.fedoraproject.org mailman01.stg.rdu3.fedoraproject.org -memcached02.stg.rdu3.fedoraproject.org +memcached01.stg.rdu3.fedoraproject.org os-control01.stg.rdu3.fedoraproject.org pkgs01.stg.rdu3.fedoraproject.org proxy01.stg.rdu3.fedoraproject.org @@ -783,6 +783,7 @@ ppc64le-test.fedorainfracloud.org ppc64le-test02.fedorainfracloud.org aarch64-test01.fedorainfracloud.org aarch64-test02.fedorainfracloud.org +s390x-test01.fedorainfracloud.org [aarch64_test] aarch64-test01.fedorainfracloud.org @@ -816,7 +817,7 @@ colo_virt value staging builders -bkernel +secureboot buildvmhost [groupc] diff --git a/main.yml b/main.yml index be7ae57fa4..655a114100 100644 --- a/main.yml +++ b/main.yml @@ -33,6 +33,7 @@ - import_playbook: /srv/web/infra/ansible/playbooks/groups/koji-hub.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/kojipkgs.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/logserver.yml +- import_playbook: /srv/web/infra/ansible/playbooks/groups/logdetective.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/mailman.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/maintainer-test.yml - import_playbook: /srv/web/infra/ansible/playbooks/groups/mariadb-server.yml diff --git a/playbooks/groups/bodhi-backend.yml b/playbooks/groups/bodhi-backend.yml index f888a07e4d..bd8b46333e 100644 --- a/playbooks/groups/bodhi-backend.yml +++ b/playbooks/groups/bodhi-backend.yml @@ -25,6 +25,7 @@ - "/srv/web/infra/ansible/vars/all/FedoraRawhideNumber.yaml" - "/srv/private/ansible/vars.yml" - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + - /srv/web/infra/ansible/vars/apps/bodhi.yml pre_tasks: - include_vars: dir=/srv/web/infra/ansible/vars/all/ ignore_files=README diff --git a/playbooks/groups/buildhw.yml b/playbooks/groups/buildhw.yml index 72f828c52e..e9633d0f88 100644 --- a/playbooks/groups/buildhw.yml +++ b/playbooks/groups/buildhw.yml @@ -1,10 +1,10 @@ --- - import_playbook: "/srv/web/infra/ansible/playbooks/include/happy_birthday.yml" vars: - myhosts: "buildhw:bkernel:buildhw_stg" + myhosts: "buildhw:buildhw_stg" - name: make koji builder(s) on raw hw - hosts: buildhw:bkernel:buildhw_stg + hosts: buildhw:buildhw_stg remote_user: root gather_facts: true @@ -67,18 +67,14 @@ - koji_builder - - role: bkernel - when: "'bkernel' in group_names" - - role: siguldry/pesign_bridge - when: inventory_hostname.startswith(('buildhw-x86-02','buildhw-a64-02')) + when: "'secureboot' in group_names" - - { role: linux-system-roles.nbde_client, when: "inventory_hostname.startswith(('bkernel', 'buildhw'))" } - - { role: serial-console, when: "inventory_hostname.startswith(('bkernel', 'buildhw-x86'))" } + - { role: linux-system-roles.nbde_client, when: "inventory_hostname.startswith(('buildhw'))" } + - { role: serial-console, when: "inventory_hostname.startswith(('buildhw-x86'))" } - hosts - ipa/client - role: sudo - when: not inventory_hostname.startswith(('bkernel', 'buildhw-x86-01.rdu3')) - role: keytab/service kt_location: /etc/kojid/kojid.keytab diff --git a/playbooks/groups/buildvm.yml b/playbooks/groups/buildvm.yml index eaaf9be035..554d448d9d 100644 --- a/playbooks/groups/buildvm.yml +++ b/playbooks/groups/buildvm.yml @@ -33,7 +33,6 @@ } - ipa/client - role: sudo - when: not inventory_hostname.startswith('bkernel') and env == 'production' - koji_builder - role: nfs/client mnt_dir: '/mnt/koji/ostree' diff --git a/playbooks/groups/logdetective.yml b/playbooks/groups/logdetective.yml index 30245f8d0c..2e05acd22d 100644 --- a/playbooks/groups/logdetective.yml +++ b/playbooks/groups/logdetective.yml @@ -38,5 +38,6 @@ # Roles are run first, before tasks, regardless of where you place them here. roles: - base + - nvidia-cdi - logdetective - nagios_client diff --git a/playbooks/groups/virthost.yml b/playbooks/groups/virthost.yml index 58170976ca..ab1e317421 100644 --- a/playbooks/groups/virthost.yml +++ b/playbooks/groups/virthost.yml @@ -39,7 +39,7 @@ roles: - base - - {role: rkhunter, when: ansible_distribution_major_version|int < 10} + - role: rkhunter - role: nagios_client - zabbix/zabbix_agent - hosts diff --git a/playbooks/include/proxies-redirects.yml b/playbooks/include/proxies-redirects.yml index 35d3277502..58ad791f65 100644 --- a/playbooks/include/proxies-redirects.yml +++ b/playbooks/include/proxies-redirects.yml @@ -1022,6 +1022,7 @@ - role: httpd/redirectmatch shortname: provisioning-server website: provisioning.fedoraproject.org + regex: ^.* target: https://fedoraproject.org/iot/ tags: - provisioning diff --git a/playbooks/include/proxies-reverseproxy.yml b/playbooks/include/proxies-reverseproxy.yml index 386600e22c..a08e2db6c0 100644 --- a/playbooks/include/proxies-reverseproxy.yml +++ b/playbooks/include/proxies-reverseproxy.yml @@ -662,7 +662,7 @@ website: koji.fedoraproject.org destname: koji keephost: true - proxyopts: "keepalive=on ttl=10" + proxyopts: "keepalive=on ttl=5" balancer_name: koji balancer_members: - "koji01.{{ datacenter }}.fedoraproject.org" @@ -676,7 +676,7 @@ website: koji.fedoraproject.org destname: koji keephost: true - proxyopts: "keepalive=on ttl=10" + proxyopts: "keepalive=on ttl=5" balancer_name: koji balancer_members: - "koji01.stg.{{ datacenter }}.fedoraproject.org" diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index aa852ecb37..78fb9e3477 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -48,6 +48,7 @@ server_aliases: - stg.fedoraproject.org - localhost + - www.fedoraproject.org - hotspot-nocache.fedoraproject.org tags: fedoraproject.org diff --git a/playbooks/manual/communishift_delete_projects.yml b/playbooks/manual/communishift_delete_projects.yml new file mode 100644 index 0000000000..6e0fbf015e --- /dev/null +++ b/playbooks/manual/communishift_delete_projects.yml @@ -0,0 +1,48 @@ +--- +# Communishift project deletion (inventory + per-project eligibility). +# Run after workloads are shut down via communishift_disable_project.yml. +# Uses communishift_projects from inventory (e.g. inventory/group_vars/all) and each +# entry's do_not_delete to skip exempt namespaces. +# +# Omitting communishift_delete_projects_dry_run applies changes. Preview removals only: +# ansible-playbook .../communishift_delete_projects.yml --tags communishift_delete_projects \ +# -e communishift_delete_projects_dry_run=true +# +# Explicit live delete: +# ansible-playbook .../communishift_delete_projects.yml --tags communishift_delete_projects \ +# -e communishift_delete_projects_dry_run=false +# +# Run with an inventory that merges group_vars/all so communishift_projects is defined. +# +- hosts: localhost + user: root + gather_facts: false + + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + pre_tasks: + - name: Require communishift_projects from inventory + ansible.builtin.assert: + that: + - communishift_projects is defined + - communishift_projects is mapping + fail_msg: > + communishift_projects is missing. Run with an inventory that loads + inventory/group_vars/all (e.g. ansible-playbook -i path/to/inventory ...). + tags: + - always + + tasks: + - name: Communishift delete eligible projects (namespace, EFS, group) + ansible.builtin.include_role: + name: communishift + tasks_from: cleanup-administration-delete-projects + apply: + tags: + - communishift_delete_projects + loop: "{{ lookup('dict', communishift_projects) }}" + tags: + - communishift_delete_projects diff --git a/playbooks/manual/communishift_disable_project.yml b/playbooks/manual/communishift_disable_project.yml index a97a15f528..08ae52ff3b 100644 --- a/playbooks/manual/communishift_disable_project.yml +++ b/playbooks/manual/communishift_disable_project.yml @@ -1,7 +1,18 @@ --- # Communishift project disable / shutdown path (inventory + per-project eligibility). -# Uses communishift_projects and each entry's do_not_delete to skip exempt namespaces. -# Currently logs intent; scale-to-zero in the role is still commented out. +# Uses communishift_projects from inventory (e.g. inventory/group_vars/all) and each +# entry's do_not_delete to skip exempt namespaces. +# +# Default: report only (no API scale). To apply scale-to-zero on eligible namespaces: +# ansible-playbook .../communishift_disable_project.yml --tags communishift_disable_project \ +# -e communishift_disable_shutdown=true +# +# Tenant “disabled” emails (FASJSON BCC, same SMTP path as communishift_send_email_notifications.yml) run after +# shutdown when communishift_disable_shutdown=true, unless skipped (see below). Preview mail targets without SMTP: +# ... -e communishift_disabled_notifications_dry_run=true +# To skip kinit/FASJSON + disabled emails entirely (scale only): -e communishift_disabled_notifications_skip=true +# +# Run with an inventory that merges group_vars/all so communishift_projects is defined. # # Run disable tasks only: # ansible-playbook .../communishift_disable_project.yml --tags communishift_disable_project @@ -15,12 +26,53 @@ - "/srv/private/ansible/vars.yml" - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + pre_tasks: + - name: Require communishift_projects from inventory + ansible.builtin.assert: + that: + - communishift_projects is defined + - communishift_projects is mapping + fail_msg: > + communishift_projects is missing. Run with an inventory that loads + inventory/group_vars/all (e.g. ansible-playbook -i path/to/inventory ...). + tags: + - always + tasks: + - name: Communishift Retrieve FASJSON data (for disabled notices) + ansible.builtin.include_role: + name: communishift + tasks_from: cleanup-administration-retrieve-data + apply: + tags: + - communishift_disable_project + when: + - not (communishift_disabled_notifications_skip | default(false) | bool) + - (communishift_disable_shutdown | default(false) | bool) or (communishift_disabled_notifications_dry_run | default(false) | bool) + tags: + - communishift_disable_project + - name: Communishift project shutdown (eligible projects) - include_role: + ansible.builtin.include_role: name: communishift tasks_from: cleanup-administration-shutdown-services apply: tags: - communishift_disable_project loop: "{{ lookup('dict', communishift_projects) }}" + tags: + - communishift_disable_project + + - name: Communishift send project disabled notices + ansible.builtin.include_role: + name: communishift + tasks_from: cleanup-administration-send-disabled-notifications + apply: + tags: + - communishift_disable_project + loop: "{{ lookup('dict', communishift_projects) }}" + when: + - not (communishift_disabled_notifications_skip | default(false) | bool) + - (communishift_disable_shutdown | default(false) | bool) or (communishift_disabled_notifications_dry_run | default(false) | bool) + tags: + - communishift_disable_project diff --git a/playbooks/manual/communishift_send_email_notifications.yml b/playbooks/manual/communishift_send_email_notifications.yml index b42ccf1012..2fb0733444 100644 --- a/playbooks/manual/communishift_send_email_notifications.yml +++ b/playbooks/manual/communishift_send_email_notifications.yml @@ -1,6 +1,6 @@ --- # Sends Fedora Communishift lifecycle emails to project admins (FASJSON BCC). -# Notifications only — see communishift_disable_project.yml for shutdown-related tasks. +# Notifications only — see communishift_disable_project.yml for shutdown and post-disable tenant emails. # # Run notifications only: # ansible-playbook .../communishift_send_email_notifications.yml --tags communishift_send_notifications diff --git a/playbooks/openshift-apps/asknot.yml b/playbooks/openshift-apps/asknot.yml index 47470ed063..6437d921c3 100644 --- a/playbooks/openshift-apps/asknot.yml +++ b/playbooks/openshift-apps/asknot.yml @@ -64,7 +64,7 @@ - role: openshift/rollout rollout_app: asknot - rollout_dcname: asknot + rollout_dname: asknot tags: - never - rollout diff --git a/playbooks/openshift-apps/badges.yml b/playbooks/openshift-apps/badges.yml index 58a05b7338..3dd8dfb7d5 100644 --- a/playbooks/openshift-apps/badges.yml +++ b/playbooks/openshift-apps/badges.yml @@ -218,7 +218,7 @@ name: openshift/rollout vars: rollout_app: badges - rollout_dcname: "{{ dcname }}" + rollout_dname: "{{ dcname }}" loop: - fedbadges - tahrir diff --git a/playbooks/openshift-apps/bodhi.yml b/playbooks/openshift-apps/bodhi.yml index b2f288fbf8..d1cb7834b1 100644 --- a/playbooks/openshift-apps/bodhi.yml +++ b/playbooks/openshift-apps/bodhi.yml @@ -73,6 +73,16 @@ object_app: bodhi object_file: pvc.yml object_objectname: pvc.yml + - role: openshift/object + object_app: bodhi + object_template: pvc.yml.j2 + object_objectname: pvc-valkey.yml + when: env == "staging" + - role: openshift/object + object_app: bodhi + object_template: secret.yml.j2 + object_objectname: secret.yml + when: env == "staging" - role: openshift/keytab keytab_app: bodhi keytab_key: koji-keytab @@ -150,19 +160,19 @@ imagestream_imagename: bodhi-critpathcron - role: openshift/rollout rollout_app: bodhi - rollout_dcname: bodhi-web + rollout_dname: bodhi-web tags: - never - rollout - role: openshift/rollout rollout_app: bodhi - rollout_dcname: bodhi-consumer + rollout_dname: bodhi-consumer tags: - never - rollout - role: openshift/rollout rollout_app: bodhi - rollout_dcname: bodhi-celery + rollout_dname: bodhi-celery tags: - never - rollout @@ -184,7 +194,7 @@ ansible.builtin.command: oc -n bodhi scale deployment bodhi-celery --replicas={{ bodhi_openshift_pods }} when: env == "staging" - name: Scale up pods - ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas={{ bodhi_openshift_pods }} + ansible.builtin.command: oc -n bodhi scale deployment bodhi-web --replicas={{ bodhi_openshift_pods_stg_web }} when: env == "staging" - name: Set the timeout to the openshift route ansible.builtin.command: "oc -n bodhi annotate route bodhi-web --overwrite haproxy.router.openshift.io/timeout=180s" diff --git a/playbooks/openshift-apps/compose-tracker.yml b/playbooks/openshift-apps/compose-tracker.yml index 587d088d40..d228c51918 100644 --- a/playbooks/openshift-apps/compose-tracker.yml +++ b/playbooks/openshift-apps/compose-tracker.yml @@ -46,12 +46,12 @@ - role: openshift/object object_app: compose-tracker - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/rollout rollout_app: compose-tracker - rollout_dcname: compose-tracker + rollout_dname: compose-tracker tags: - never - rollout diff --git a/playbooks/openshift-apps/coreos-ci.yml b/playbooks/openshift-apps/coreos-ci.yml index 94678e9004..e3e8c7d965 100644 --- a/playbooks/openshift-apps/coreos-ci.yml +++ b/playbooks/openshift-apps/coreos-ci.yml @@ -14,6 +14,7 @@ project_description: CoreOS CI Infrastructure appowners: - aaradhak + - azukku - dustymabe - hhei - jbtrystram diff --git a/playbooks/openshift-apps/coreos-cincinnati.yml b/playbooks/openshift-apps/coreos-cincinnati.yml index bbbe7e77f6..71ef0bf45d 100644 --- a/playbooks/openshift-apps/coreos-cincinnati.yml +++ b/playbooks/openshift-apps/coreos-cincinnati.yml @@ -59,7 +59,7 @@ - role: openshift/rollout rollout_app: coreos-cincinnati - rollout_dcname: coreos-cincinnati + rollout_dname: coreos-cincinnati tags: [never, rollout] - role: openshift/object diff --git a/playbooks/openshift-apps/datagrepper.yml b/playbooks/openshift-apps/datagrepper.yml index f756298d63..61bfce72f0 100644 --- a/playbooks/openshift-apps/datagrepper.yml +++ b/playbooks/openshift-apps/datagrepper.yml @@ -108,7 +108,7 @@ # - role: openshift/rollout # rollout_app: datagrepper - # rollout_dcname: datagrepper + # rollout_dname: datagrepper # tags: # - never # - rollout diff --git a/playbooks/openshift-apps/discourse2fedmsg.yml b/playbooks/openshift-apps/discourse2fedmsg.yml index c0d15f1a28..1ed8ef73c1 100644 --- a/playbooks/openshift-apps/discourse2fedmsg.yml +++ b/playbooks/openshift-apps/discourse2fedmsg.yml @@ -80,7 +80,7 @@ # - role: openshift/rollout # rollout_app: discourse2fedmsg - # rollout_dcname: discourse2fedmsg + # rollout_dname: discourse2fedmsg # tags: # - never # - rollout diff --git a/playbooks/openshift-apps/fasjson.yml b/playbooks/openshift-apps/fasjson.yml index 748f19acd9..bf6a8ff5f5 100644 --- a/playbooks/openshift-apps/fasjson.yml +++ b/playbooks/openshift-apps/fasjson.yml @@ -119,7 +119,7 @@ # - role: openshift/rollout # rollout_app: noggin - # rollout_dcname: noggin + # rollout_dname: noggin # tags: # - never # - rollout diff --git a/playbooks/openshift-apps/greenwave.yml b/playbooks/openshift-apps/greenwave.yml index f09f1f92bd..1123ffd9b6 100644 --- a/playbooks/openshift-apps/greenwave.yml +++ b/playbooks/openshift-apps/greenwave.yml @@ -88,14 +88,14 @@ - role: openshift/rollout rollout_app: greenwave - rollout_dcname: greenwave-web + rollout_dname: greenwave-web tags: - never - rollout - role: openshift/rollout rollout_app: greenwave - rollout_dcname: greenwave-fedmsg-consumers + rollout_dname: greenwave-fedmsg-consumers tags: - never - rollout diff --git a/playbooks/openshift-apps/mdapi.yml b/playbooks/openshift-apps/mdapi.yml index 009b1b4ff2..44dd24f975 100644 --- a/playbooks/openshift-apps/mdapi.yml +++ b/playbooks/openshift-apps/mdapi.yml @@ -88,7 +88,7 @@ - role: openshift/rollout rollout_app: mdapi - rollout_dcname: mdapi + rollout_dname: mdapi tags: - never - rollout diff --git a/playbooks/openshift-apps/mirrormanager.yml b/playbooks/openshift-apps/mirrormanager.yml index 6a965741b8..13740f4be0 100644 --- a/playbooks/openshift-apps/mirrormanager.yml +++ b/playbooks/openshift-apps/mirrormanager.yml @@ -173,7 +173,7 @@ - role: openshift/rollout rollout_app: mirrormanager - rollout_dcname: frontend + rollout_dname: frontend tags: - never - rollout diff --git a/playbooks/openshift-apps/noggin-centos.yml b/playbooks/openshift-apps/noggin-centos.yml index 8f15a924dd..e3961ead0a 100644 --- a/playbooks/openshift-apps/noggin-centos.yml +++ b/playbooks/openshift-apps/noggin-centos.yml @@ -115,7 +115,7 @@ - role: openshift/rollout rollout_app: noggin-centos - rollout_dcname: noggin + rollout_dname: noggin tags: - never - rollout diff --git a/playbooks/openshift-apps/noggin.yml b/playbooks/openshift-apps/noggin.yml index 1bb8fac8db..b69649d1b9 100644 --- a/playbooks/openshift-apps/noggin.yml +++ b/playbooks/openshift-apps/noggin.yml @@ -111,7 +111,7 @@ - role: openshift/rollout rollout_app: noggin - rollout_dcname: noggin + rollout_dname: noggin tags: - never - rollout diff --git a/playbooks/openshift-apps/poddlers.yml b/playbooks/openshift-apps/poddlers.yml index c6101cdd6b..e8c19b1b3d 100644 --- a/playbooks/openshift-apps/poddlers.yml +++ b/playbooks/openshift-apps/poddlers.yml @@ -138,5 +138,5 @@ name: openshift/rollout vars: rollout_app: poddlers - rollout_dcname: "{{ item.name }}" + rollout_dname: "{{ item.name }}" loop: "{{ poddlers_toddlers }}" diff --git a/playbooks/openshift-apps/release-monitoring.yml b/playbooks/openshift-apps/release-monitoring.yml index a7d3e54376..ddda772552 100644 --- a/playbooks/openshift-apps/release-monitoring.yml +++ b/playbooks/openshift-apps/release-monitoring.yml @@ -67,7 +67,7 @@ object_objectname: deployment.yml - role: openshift/rollout rollout_app: release-monitoring - rollout_dcname: release-monitoring-web + rollout_dname: release-monitoring-web tags: - never - rollout diff --git a/playbooks/openshift-apps/resultsdb-ci-listener.yml b/playbooks/openshift-apps/resultsdb-ci-listener.yml index 24404c3e50..e3b28622d1 100644 --- a/playbooks/openshift-apps/resultsdb-ci-listener.yml +++ b/playbooks/openshift-apps/resultsdb-ci-listener.yml @@ -81,5 +81,5 @@ - role: openshift/object object_app: resultsdb-ci-listener - object_template: deploymentconfigs.yml.j2 - object_objectname: deploymentconfigs.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml diff --git a/playbooks/openshift-apps/resultsdb.yml b/playbooks/openshift-apps/resultsdb.yml index 64e6bb6cd1..5e36a137de 100644 --- a/playbooks/openshift-apps/resultsdb.yml +++ b/playbooks/openshift-apps/resultsdb.yml @@ -92,8 +92,8 @@ - role: openshift/object object_app: resultsdb - object_template: backend/deploymentconfigs.yml.j2 - object_objectname: backend-deploymentconfigs.yml + object_template: backend/deployment.yml.j2 + object_objectname: backend-deployment.yml - role: openshift/object object_app: resultsdb @@ -123,8 +123,8 @@ - role: openshift/object object_app: resultsdb - object_template: frontend/deploymentconfigs.yml.j2 - object_objectname: frontend-deploymentconfigs.yml + object_template: frontend/deployment.yml.j2 + object_objectname: frontend-deployment.yml - role: openshift/object object_app: resultsdb @@ -142,7 +142,7 @@ # rollouts - role: openshift/rollout rollout_app: resultsdb - rollout_dcname: "resultsdb-api" + rollout_dname: "resultsdb-api" failed_when: false tags: - never @@ -150,7 +150,7 @@ - role: openshift/rollout rollout_app: resultsdb - rollout_dcname: "resultsdb-frontend" + rollout_dname: "resultsdb-frontend" failed_when: false tags: - never diff --git a/playbooks/openshift-apps/the-new-hotness.yml b/playbooks/openshift-apps/the-new-hotness.yml index dd7c1a8708..7e2b4a5580 100644 --- a/playbooks/openshift-apps/the-new-hotness.yml +++ b/playbooks/openshift-apps/the-new-hotness.yml @@ -98,7 +98,7 @@ - role: openshift/rollout rollout_app: the-new-hotness - rollout_dcname: the-new-hotness + rollout_dname: the-new-hotness tags: - never - rollout diff --git a/playbooks/openshift-apps/waiverdb.yml b/playbooks/openshift-apps/waiverdb.yml index 7ea818db13..07eadd498e 100644 --- a/playbooks/openshift-apps/waiverdb.yml +++ b/playbooks/openshift-apps/waiverdb.yml @@ -110,12 +110,12 @@ - role: openshift/object object_app: waiverdb - object_template: deploymentconfig.yml.j2 - object_objectname: deploymentconfig.yml + object_template: deployment.yml.j2 + object_objectname: deployment.yml - role: openshift/rollout rollout_app: waiverdb - rollout_dcname: waiverdb-web + rollout_dname: waiverdb-web tags: - never - rollout diff --git a/playbooks/openshift-apps/webhook2fedmsg.yml b/playbooks/openshift-apps/webhook2fedmsg.yml index 448b9908bd..1abdd0509c 100644 --- a/playbooks/openshift-apps/webhook2fedmsg.yml +++ b/playbooks/openshift-apps/webhook2fedmsg.yml @@ -36,7 +36,7 @@ roles: - role: rabbit/user user_name: "webhook2fedmsg{{ env_suffix }}" - user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.(github|gitlab|discourse|forgejo)\..* + user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.(github|gitlab|discourse|forgejo|pretix)\..* - role: openshift/project project_app: webhook2fedmsg @@ -65,9 +65,10 @@ secret_file_key: webhook2fedmsg-key.pem secret_file_privatefile: "rabbitmq/{{env}}/pki/private/webhook2fedmsg{{env_suffix}}.key" - - role: openshift/imagestream - imagestream_app: webhook2fedmsg - imagestream_imagename: webhook2fedmsg + - role: openshift/object + object_app: webhook2fedmsg + object_file: imagestream.yml + object_objectname: imagestream.yml - role: openshift/object object_app: webhook2fedmsg @@ -122,7 +123,7 @@ # - role: openshift/rollout # rollout_app: webhook2fedmsg - # rollout_dcname: webhook2fedmsg + # rollout_dname: webhook2fedmsg # tags: # - never # - rollout diff --git a/playbooks/openshift-apps/zabbix-proxy.yml b/playbooks/openshift-apps/zabbix-proxy.yml new file mode 100644 index 0000000000..866da93894 --- /dev/null +++ b/playbooks/openshift-apps/zabbix-proxy.yml @@ -0,0 +1,18 @@ +--- +- name: Make the app be real + hosts: os_control_stg #:os_control + user: root + gather_facts: false + + vars: + placeholdervar: true # Incase any future vars need to be passed through to the helmchart + vars_files: + - /srv/web/infra/ansible/vars/global.yml + - "/srv/private/ansible/vars.yml" + - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml + + tasks: + - name: Zabbix Proxy Role + ansible.builtin.include_role: + name: zabbix/zabbix_openshift_proxy + tasks_from: main diff --git a/roles/apps-fp-o/files/apps.yaml b/roles/apps-fp-o/files/apps.yaml index af6762e528..d01cacb5b0 100644 --- a/roles/apps-fp-o/files/apps.yaml +++ b/roles/apps-fp-o/files/apps.yaml @@ -321,8 +321,8 @@ children: data: url: https://packages.fedoraproject.org/ package_url: https://apps.fedoraproject.org/packages/{package} - source_url: https://pagure.io/fedora-packages-static - bugs_url: https://pagure.io/fedora-packages-static/issues + source_url: https://forge.fedoraproject.org/apps/fedora-packages-static + bugs_url: https://forge.fedoraproject.org/apps/fedora-packages-static/issues docs_url: http://threebean.org/blog/history-of-fedora-packages/ sops: - https://infrastructure.fedoraproject.org/infra/docs/fedorapackages.rst diff --git a/roles/base/files/postfix/header_checks_submission.smtp-auth b/roles/base/files/postfix/header_checks_submission.smtp-auth new file mode 100644 index 0000000000..54be7b608e --- /dev/null +++ b/roles/base/files/postfix/header_checks_submission.smtp-auth @@ -0,0 +1,2 @@ +# Remove the received header before forwarding e-mail +/^Received: .*/ IGNORE diff --git a/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org b/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org index fc602a7f78..13b4d0f81e 100644 --- a/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org +++ b/roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org @@ -11,9 +11,14 @@ submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject + -o cleanup_service_name=ascleanup #628 inet n - n - - qmqpd pickup fifo n - n 60 1 pickup cleanup unix n - n - 0 cleanup +ascleanup unix n - y - 0 cleanup + -o header_checks=pcre:/etc/postfix/header_checks_submission + -o mime_header_checks= + -o nested_header_checks= qmgr fifo n - n 300 1 qmgr #qmgr fifo n - n 300 1 oqmgr tlsmgr unix - - n 1000? 1 tlsmgr diff --git a/roles/base/files/postfix/transports.smtp-mm b/roles/base/files/postfix/transports.smtp-mm index 8c6dd42673..6e5ee11e4a 100644 --- a/roles/base/files/postfix/transports.smtp-mm +++ b/roles/base/files/postfix/transports.smtp-mm @@ -4,6 +4,7 @@ redhat.com smtp:[mailman01.vpn.fedoraproject.org] lists2.fedoraproject.org smtp:[mailman01.vpn.fedoraproject.org] lists.pagure.io smtp:[mailman01.vpn.fedoraproject.org] fedorahosted.org smtp:[bastion.vpn.fedoraproject.org] +fedoraproject.org smtp:[bastion.vpn.fedoraproject.org] lists.stg.fedoraproject.org smtp:[bastion.vpn.fedoraproject.org] lists.stg.fedorahosted.org smtp:[bastion.vpn.fedoraproject.org] diff --git a/roles/base/files/postfix/zabbix-template.yml b/roles/base/files/postfix/zabbix-template.yml index ab8d9a308b..8acfdb1196 100644 --- a/roles/base/files/postfix/zabbix-template.yml +++ b/roles/base/files/postfix/zabbix-template.yml @@ -1,7 +1,7 @@ zabbix_export: version: '7.0' template_groups: - - uuid: 372f19ba622745aaa43b4fa0b5168262 + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec name: Fedora templates: - uuid: 76985efe0ea1479aa3d24a0a2c64e6d2 @@ -21,7 +21,9 @@ zabbix_export: value: queue triggers: - uuid: cc9ff19b502940af950215a931ee4079 - expression: 'monoinc(/Postfix Mail Queue/postfix.queue,15m,"weak")=0 and last(/Postfix Mail Queue/postfix.queue)>{$POSTFIX.QUEUE.WARN}' + expression: 'monoinc(/Postfix Mail Queue/postfix.queue,15m,"strict")=1 and last(/Postfix Mail Queue/postfix.queue)>{$POSTFIX.QUEUE.WARN}' + recovery_mode: RECOVERY_EXPRESSION + recovery_expression: 'monoinc(/Postfix Mail Queue/postfix.queue,15m,"strict")=0 and last(/Postfix Mail Queue/postfix.queue)<{$POSTFIX.QUEUE.WARN}' name: 'Postfix: increasing mails in mailq - {ITEM.LASTVALUE1} queued' opdata: '{ITEM.LASTVALUE1} mails queued' priority: HIGH diff --git a/roles/base/tasks/crypto-policies.yml b/roles/base/tasks/crypto-policies.yml index ae61a2c2e5..bdf5738371 100644 --- a/roles/base/tasks/crypto-policies.yml +++ b/roles/base/tasks/crypto-policies.yml @@ -29,7 +29,7 @@ - name: Set crypto-policy on RHEL9 dns servers to DEFAULT:SHA1 ansible.builtin.command: "update-crypto-policies --set DEFAULT:SHA1" - when: "inventory_hostname.startswith('ns') and (currentcryptopolicy.stdout.find('DEFAULT:SHA1') == -1 or cryptopolicyapplied.rc != 0)" + when: "inventory_hostname.startswith('ns') and (currentcryptopolicy.stdout.find('DEFAULT:SHA1') == -1 and (ansible_distribution_major_version|int == 9) or cryptopolicyapplied.rc != 0)" check_mode: no tags: - crypto-policies diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index 559ef516f4..71cf409754 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -46,7 +46,7 @@ - rootpw - base when: - - not inventory_hostname.startswith(('buildvm-','buildhw-','bkernel','compose')) + - not inventory_hostname.startswith(('buildvm-','buildhw-','compose')) - not inventory_hostname.startswith('copr') - name: Add ansible root key diff --git a/roles/base/tasks/postfix.yml b/roles/base/tasks/postfix.yml index 156064cf18..6f4dcf57f2 100644 --- a/roles/base/tasks/postfix.yml +++ b/roles/base/tasks/postfix.yml @@ -4,6 +4,7 @@ state: present name: - postfix + - postfix-pcre tags: - postfix @@ -69,6 +70,19 @@ - config - base +- name: Install /etc/postfix/header_checks_submission file + ansible.builtin.copy: + src: postfix/header_checks_submission.smtp-auth + dest: /etc/postfix/header_checks_submission + mode: "0644" + when: inventory_hostname.startswith("smtp-auth") + notify: + - Restart postfix + tags: + - postfix + - config + - base + - name: Deploy sender_access file ansible.builtin.copy: src: "{{ private }}/files/smtpd/sender_access.{{ postfix_group }}" diff --git a/roles/base/templates/nftables/_nft_accept_beg b/roles/base/templates/nftables/_nft_accept_beg new file mode 100644 index 0000000000..7c90f50719 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_beg @@ -0,0 +1,8 @@ +# {{ ansible_managed }} +# _nft_accept_beg +# Setup an ip filter table with default accept policy, and the std. allow rules. + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } diff --git a/roles/base/templates/nftables/_nft_accept_end b/roles/base/templates/nftables/_nft_accept_end new file mode 100644 index 0000000000..da906e3462 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_end @@ -0,0 +1,7 @@ +# _nft_accept_end +# Default accept policy, standard end rules +# This kind of makes it default drop, but the spelling is weird. + +# otherwise kick everything out +add rule {{_tn}} INPUT counter reject with icmp type host-prohibited +add rule {{_tn}} FORWARD counter reject with icmp type host-prohibited diff --git a/roles/base/templates/nftables/_nft_accept_http b/roles/base/templates/nftables/_nft_accept_http new file mode 100644 index 0000000000..564243a11c --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_http @@ -0,0 +1,6 @@ +# _nft_accept_http +# Accept HTTP(s) + +add rule {{_tn}} INPUT ct state new tcp dport 80 counter accept +add rule {{_tn}} INPUT ct state new tcp dport 443 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_monitoring b/roles/base/templates/nftables/_nft_accept_monitoring new file mode 100644 index 0000000000..7d28698920 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_monitoring @@ -0,0 +1,24 @@ +# _nft_accept_monitoring +# Default accept policy, let things be monitored + +# for nrpe - allow it from nocs +# NOTE: These were still here in staging, before the cleanup. +#add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept +#add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept +#add rule {{_tn}} INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept +# FIXME - this is the global nat-ip and we need the noc01-specific ip +add rule {{_tn}} INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept +# NOTE: This was in staging only, before the cleanup. But seems dead. +#add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept + +{% if env != 'staging' %} +# zabbix01 +add rule {{_tn}} INPUT tcp dport 10051 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept +{% else %} +# zabbix01.stg +add rule {{_tn}} INPUT tcp dport 10051 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_ports b/roles/base/templates/nftables/_nft_accept_ports new file mode 100644 index 0000000000..0583fb9104 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ports @@ -0,0 +1,16 @@ +# _nft_accept_ports +# Default accept policy, accept host defined tcp/udp ports + +# if the host/group defines incoming tcp_ports - allow them +{% if tcp_ports is defined %} +{% for port in tcp_ports %} +add rule {{_tn}} INPUT tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} + +# if the host/group defines incoming udp_ports - allow them +{% if udp_ports is defined %} +{% for port in udp_ports %} +add rule {{_tn}} INPUT udp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_proxy_ports b/roles/base/templates/nftables/_nft_accept_proxy_ports new file mode 100644 index 0000000000..24f8c14037 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_proxy_ports @@ -0,0 +1,17 @@ +# _nft_accept_proxy_ports +# Default accept policy, deal with proxy ports (if defined) + +# if there are any proxy-only tcp_ports - allow them +{% if proxy_tcp_ports is defined %} +{% for port in proxy_tcp_ports %} +{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} +{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% else %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% endif %} +{% endfor %} +# nagios +add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_ssh b/roles/base/templates/nftables/_nft_accept_ssh new file mode 100644 index 0000000000..24f0093058 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ssh @@ -0,0 +1,6 @@ +# _nft_accept_ssh +# Accept ssh + +# allow ssh - always +add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_staging_friends b/roles/base/templates/nftables/_nft_accept_staging_friends new file mode 100644 index 0000000000..f7fd1a0a56 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_staging_friends @@ -0,0 +1,13 @@ +# _nft_accept_staging_friends + +{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} +# +# In the rdu3 datacenter, both production and staging hosts are in different +# vlans, and different subnets. However, just as a precaution, we want prod machines to +# reject connections from any staging host just in case there's some globally enabled port. +# There are however a few hosts in production we have marked 'staging-friendly' +# that we do allow staging to talk to for mostly read-only data they need. +# +add rule {{_tn}} INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_std b/roles/base/templates/nftables/_nft_accept_std new file mode 100644 index 0000000000..493da9a8ae --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_std @@ -0,0 +1,12 @@ +# _nft_accept_std +# Standard accept lines, SSH is _not_ here. + +# allow ping and traceroute +add rule {{_tn}} INPUT ip protocol icmp counter accept + +# localhost is fine +add rule {{_tn}} INPUT iifname "lo" counter accept + +# Established connections allowed +add rule {{_tn}} INPUT ct state related,established counter accept +add rule {{_tn}} OUTPUT ct state related,established counter accept diff --git a/roles/base/templates/nftables/_nft_accept_vpn b/roles/base/templates/nftables/_nft_accept_vpn new file mode 100644 index 0000000000..7af23698e1 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_vpn @@ -0,0 +1,30 @@ +# _nft_accept_vpn +# Default accept policy, vpn stuff. +# NOTE: That the end of this file rejects all other VPN traffic. + +{% if vpn %} +# +# We want to have all vpn hosts reject most things from the 'less secure' vpn network +# +{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %} +# Allow all vpn hosts to talk to the log server for rsyslog +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept +{% endif %} + +{% if inventory_hostname in groups['ipa'] %} +# Allow all vpn hosts to talk to the ipa servers for auth +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept + +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept +{% endif %} + +# Reject all further connections from less secure vpn +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/_nft_block_rules b/roles/base/templates/nftables/_nft_block_rules new file mode 100644 index 0000000000..1e78f98ba3 --- /dev/null +++ b/roles/base/templates/nftables/_nft_block_rules @@ -0,0 +1,9 @@ +# _nft_block_rules +# Default accept policy, standard end rules + +{% if nft_block_rules is defined %} +# if there are block rules - put them in as-is +{% for rule in nft_block_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_blocked_ips b/roles/base/templates/nftables/_nft_blocked_ips index bb8f4df77a..f55aaad6dd 100644 --- a/roles/base/templates/nftables/_nft_blocked_ips +++ b/roles/base/templates/nftables/_nft_blocked_ips @@ -4,7 +4,6 @@ # if the blocked_ips is defined - drop them {% if blocked_ips is defined %} {% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop +add rule {{_tn}} INPUT ip saddr {{ ip }} counter drop {% endfor %} {% endif %} - diff --git a/roles/base/templates/nftables/_nft_custom_rules b/roles/base/templates/nftables/_nft_custom_rules new file mode 100644 index 0000000000..bf63274c8a --- /dev/null +++ b/roles/base/templates/nftables/_nft_custom_rules @@ -0,0 +1,9 @@ +# _nft_custom_rules +# Probably only use for: Default accept policy + +# if there are custom rules - put them in as-is +{% if nft_custom_rules is defined %} +{% for rule in nft_custom_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_drop_beg b/roles/base/templates/nftables/_nft_drop_beg new file mode 100644 index 0000000000..5546f1ea88 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_beg @@ -0,0 +1,11 @@ +# {{ ansible_managed }} +# _nft_drop_beg +# Setup an ip filter table with default drop policy. +# +# Note that there's no _nft_drop_end because _nft_accept_end drops everything +# and we don't need that. + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy drop; } diff --git a/roles/base/templates/nftables/_nft_drop_std b/roles/base/templates/nftables/_nft_drop_std new file mode 100644 index 0000000000..f0bbb6dee1 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_std @@ -0,0 +1,12 @@ +# _nft_drop_std +# Std. allow rules for the drop policy + + +{% include '_nft_accept_std' %} + +# MORE loopback allowed +add rule {{_tn}} OUTPUT oifname "lo" counter accept +add rule {{_tn}} INPUT iifname "virbr0" counter accept +add rule {{_tn}} OUTPUT oifname "virbr0" counter accept +add rule {{_tn}} INPUT ip daddr 127.0.0.0/8 counter accept +add rule {{_tn}} OUTPUT ip daddr 127.0.0.0/8 counter accept diff --git a/roles/base/templates/nftables/_nft_nat b/roles/base/templates/nftables/_nft_nat new file mode 100644 index 0000000000..f185cb2a4e --- /dev/null +++ b/roles/base/templates/nftables/_nft_nat @@ -0,0 +1,15 @@ +# _nft_nat +# Setup forwarding via. "ip nat" table, if we have nat rules. + +{% if nft_nat_rules is defined %} + +add table {{_tnat}} +add chain {{_tnat}} PREROUTING { type nat hook prerouting priority {{_nft_prio_preroute}}; policy accept; } +add chain {{_tnat}} INPUT { type nat hook input priority {{_nft_prio_input}}; policy accept; } +add chain {{_tnat}} OUTPUT { type nat hook output priority {{_nft_prio_output}}; policy accept; } +add chain {{_tnat}} POSTROUTING { type nat hook postrouting priority {{_nft_prio_postroute}}; policy accept; } + +{% for rule in nft_nat_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/nftables b/roles/base/templates/nftables/nftables index 6558908491..7a19fbc06b 100644 --- a/roles/base/templates/nftables/nftables +++ b/roles/base/templates/nftables/nftables @@ -1,128 +1,41 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept - -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept - -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept - -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept - -# rdu3 -# for nrpe - allow it from nocs -#add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -#add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept - -{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the rdu3 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited -{% endif %} - -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept - -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +# NOTE: This needs to be done at the top level because include inherits +# variables, but set variables don't escape. +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_beg' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_std' %} -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ssh' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_vpn' %} -{% if nft_nat_rules is defined %} +{% include '_nft_accept_staging_friends' %} -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } +{% include '_nft_block_rules' %} -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} + +{% include '_nft_accept_proxy_ports' %} + +{% include '_nft_custom_rules' %} + +{% include '_nft_accept_end' %} + + +{% set _nft_prio_preroute = "-100" %} +{% set _nft_prio_input = "100" %} +{% set _nft_prio_output = "-100" %} +{% set _nft_prio_postroute = "100" %} + +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables-ipv6 b/roles/base/templates/nftables/nftables-ipv6 index c1fa235ccf..09dc65915e 100644 --- a/roles/base/templates/nftables/nftables-ipv6 +++ b/roles/base/templates/nftables/nftables-ipv6 @@ -1,48 +1,51 @@ # {{ ansible_managed }} -add table ip6 filter -add chain ip6 filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip6 filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip6 filter OUTPUT { type filter hook output priority 0; policy accept; } + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn6 = nft_table6_filter %} + +add table {{_tn6}} +add chain {{_tn6}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn6}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn6}} OUTPUT { type filter hook output priority 0; policy accept; } # loopback allowed -add rule ip6 filter INPUT iifname "lo" counter accept +add rule {{_tn6}} INPUT iifname "lo" counter accept # Accept ping and traceroute (needs icmp) -add rule ip6 filter INPUT meta l4proto ipv6-icmp counter accept +add rule {{_tn6}} INPUT meta l4proto ipv6-icmp counter accept # Established connections allowed -add rule ip6 filter INPUT ct state related,established counter accept +add rule {{_tn6}} INPUT ct state related,established counter accept # Established connections allowed -add rule ip6 filter OUTPUT ct state related,established counter accept +add rule {{_tn6}} OUTPUT ct state related,established counter accept # allow dhcp6d from aws -add rule ip6 filter INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept +add rule {{_tn6}} INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept # if the blocked_ips is defined - drop them {% if blocked_ip_v6 is defined %} {% for ip in blocked_ip_v6 %} -add rule ip6 filter INPUT ip6 saddr {{ ip }} counter drop +add rule {{_tn6}} INPUT ip6 saddr {{ ip }} counter drop {% endfor %} {% endif %} # allow ssh - always -add rule ip6 filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe (if we want noc02 to be able to get into remote systems) -#add rule ip6 filter INPUT ip6 saddr 2600:2701:4000:5211:dead:beef:fe:fed9 tcp dport 5666 counter accept +add rule {{_tn6}} INPUT ct state new tcp dport 22 counter accept # if the host/group defines incoming tcp_ports - allow them {% if tcp_ports is defined %} {% for port in tcp_ports %} -add rule ip6 filter INPUT tcp dport {{ port }} counter accept +add rule {{_tn6}} INPUT tcp dport {{ port }} counter accept {% endfor %} {% endif %} # if the host/group defines incoming udp_ports - allow them {% if udp_ports is defined %} {% for port in udp_ports %} -add rule ip6 filter INPUT udp dport {{ port }} counter accept +add rule {{_tn6}} INPUT udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -54,5 +57,5 @@ add rule ip6 filter INPUT udp dport {{ port }} counter accept {% endif %} # otherwise kick everything out -add rule ip6 filter INPUT counter reject with icmpv6 type admin-prohibited -add rule ip6 filter FORWARD counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} INPUT counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} FORWARD counter reject with icmpv6 type admin-prohibited diff --git a/roles/base/templates/nftables/nftables.bastion b/roles/base/templates/nftables/nftables.bastion index 770674ec9c..2c7d25d42f 100644 --- a/roles/base/templates/nftables/nftables.bastion +++ b/roles/base/templates/nftables/nftables.bastion @@ -1,166 +1,75 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_beg' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_std' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# add rdu3 ips -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_ssh' %} -{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the rdu3 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited -{% endif %} - -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept - -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_monitoring' %} # smtp rules we want to allow vpn and out internal networks and mimecast -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept + +# This rejects all VPN traffic at the end. 192.168.100.0/24 +{% include '_nft_accept_vpn' %} + +{% include '_nft_accept_staging_friends' %} + +add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept {% if datacenter == 'rdu3' %} # Greg: This is a nasty hack and we need to fix it properly after the DC move, but right # now I don't see where we'd get the right ip/netmask from in vars -add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept {% else %} -add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept {% endif %} # s390x builders/virthost -add rule ip filter INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept # redhat mxes -add rule ip filter INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept # mimecast ips from # https://community.mimecast.com/s/article/email-security-cloud-gateway-data-centers-and-urls?r=297&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 -add rule ip filter INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_block_rules' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_proxy_ports' %} -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_end' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% set _nft_prio_preroute = "-100" %} +{% set _nft_prio_input = "100" %} +{% set _nft_prio_output = "-100" %} +{% set _nft_prio_postroute = "100" %} -{% if nft_nat_rules is defined %} - -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } - -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index 42dbfc4825..d663f410bf 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -1,28 +1,16 @@ # {{ ansible_managed }} -# Setup an ip filter table with default drop policy. +# {{ template_path }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy drop; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy drop; } +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# Std. allow rules for the drop policy -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept -add rule ip filter OUTPUT oifname "lo" counter accept -add rule ip filter INPUT iifname "virbr0" counter accept -add rule ip filter OUTPUT oifname "virbr0" counter accept -add rule ip filter INPUT ip daddr 127.0.0.0/8 counter accept -add rule ip filter OUTPUT ip daddr 127.0.0.0/8 counter accept +{% include '_nft_drop_beg' %} -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept -add rule ip filter OUTPUT ip protocol icmp counter accept - -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_drop_std' %} {% include '_nft_blocked_ips' %} @@ -31,9 +19,9 @@ add rule ip filter OUTPUT ct state related,established counter accept #!# WARNING: This is very different... # -A OUTPUT -p tcp --dport 443 -m set --match-set osbuildapi dst -j ACCEPT -add set ip filter osbuildapi { type ipv4_addr ; size 65536; } +add set {{_tn}} osbuildapi { type ipv4_addr ; size 65536; } -add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept +add rule {{_tn}} OUTPUT tcp dport 443 ip daddr @osbuildapi accept # Then in the update script... # nft flush set global osbuildapi @@ -46,57 +34,57 @@ add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept # kojipkgs {% if host in groups['buildvm_s390x'] %} -add rule ip filter OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept {% endif %} # tang for buildhw -add rule ip filter OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept # DNS -add rule ip filter OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept # bastion smtp -add rule ip filter OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept # infra.fp.o -add rule ip filter OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept # rsyslog out to log01 -add rule ip filter OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept # SSH -add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept # add rdu3 ansible control host for now -add rule ip filter INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept # End of RDU3 {% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %} # Allow SSHFS binding to koji01 -add rule ip filter OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept {% endif %} -{% if inventory_hostname.startswith (('buildhw-x86-02', 'buildhw-a64-02')) %} +{% if inventory_hostname in groups['secureboot'] %} # Allow secure boot signing to contact the sign bridge -add rule ip filter OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept {% endif %} # http to pull sources from pkgs lookaside -#add rule ip filter OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept +#add rule {{_tn}} OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept # https git on pagure,io -add rule ip filter OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept # IP Helper: # 10.3. = .iad2. @@ -124,89 +112,89 @@ add rule ip filter OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept # admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10) {% if host in groups['staging'] %} -add rule ip filter OUTPUT ip daddr 10.16.166.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.75 tcp dport 443 counter accept {% endif %} -add rule ip filter OUTPUT ip daddr 10.16.163.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.75 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.76 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.76 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.77 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.77 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.76 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.76 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.77 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.77 tcp dport 443 counter accept {% if host in groups['rdu3_staging'] %} # ipa client ports -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept # rdu3 -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept {% elif host in groups['rdu3_production'] %} # rdu3 ports -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept {% endif %} {% if host in groups['staging'] %} @@ -214,44 +202,33 @@ add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept # **** # NOTE: There is NO koji01.stg.rdu3.fedoraproject.org YET # **** -add rule ip filter INPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept -add rule ip filter OUTPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept +add rule {{_tn}} INPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept {% endif %} # NFS for rdu3 # a little to wide-open - but kinda necessary -add rule ip filter INPUT ip saddr 10.16.162.11 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.11 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.11 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.11 counter accept #!# NOTE: tcp/udp doesn't translate without a port?? -add rule ip filter INPUT ip saddr 10.16.162.12 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.12 counter accept -add rule ip filter INPUT ip saddr 10.16.162.13 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.13 counter accept -add rule ip filter INPUT ip saddr 10.16.162.14 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.14 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.12 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.12 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.13 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.13 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.14 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.14 counter accept # ntp -add rule ip filter OUTPUT ip daddr 10.16.163.31 udp dport 123 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.32 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.32 udp dport 123 counter accept # dhcp -add rule ip filter OUTPUT ip daddr 10.16.163.10 udp dport 67 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.10 udp dport 67 counter accept # s390x builders ssh -add rule ip filter INPUT ip saddr 10.16.0.0/16 tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.0.0/16 tcp dport 22 counter accept -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} - -# if there are custom rules - put them in as-is -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} +{% include '_nft_custom_rules' %} diff --git a/roles/base/templates/nftables/nftables.osuosl b/roles/base/templates/nftables/nftables.osuosl index ac87505328..851f44c149 100644 --- a/roles/base/templates/nftables/nftables.osuosl +++ b/roles/base/templates/nftables/nftables.osuosl @@ -1,63 +1,29 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_beg' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_std' %} + +{% include '_nft_blocked_ips' %} # allow ssh only from needed ips # vpn in from tun0 -add rule ip filter INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp dport 22 counter accept +add rule {{_tn}} INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp dport 22 counter accept # external ip for rdu3 -add rule ip filter INPUT ip saddr 38.145.32.0/24 ct state new tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 38.145.32.0/24 ct state new tcp dport 22 counter accept -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept +{% include '_nft_accept_monitoring' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.releng b/roles/base/templates/nftables/nftables.releng index 725931529a..e4b2aaa620 100644 --- a/roles/base/templates/nftables/nftables.releng +++ b/roles/base/templates/nftables/nftables.releng @@ -1,92 +1,50 @@ # {{ ansible_managed }} +# {{ template_path }} + # # NOTE: Chaging this template updates iptables on all releng hosts :) # Please check with sysadmin-main before pushing out an update here. # -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +# NOTE: We don't use _nft_accept_beg because INPUT policy default is drop -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } -# Overwrite any global rules -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# add rdu3 ips -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# Zabbix -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_std' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} + +{% include '_nft_blocked_ips' %} # SSH #!# NOTE: Do we still need/wants these 13+ years later? # ssh block against uni in .cz where problem(s) have been cited # added by skvidal on jan 24 2011 - as per request from spot -add rule ip filter INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject +add rule {{_tn}} INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject # matches last rule for a service we want blocked -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset -add rule ip filter INPUT tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset +add rule {{_tn}} INPUT tcp dport 22 counter accept # Allow all netapp traffic -add rule ip filter INPUT ip saddr 10.16.162.0/24 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.0/24 counter accept +{% include '_nft_accept_ssh' %} -# Custom Services +{% include '_nft_accept_http' %} -# Services TCP -add rule ip filter INPUT tcp dport 22 counter accept -add rule ip filter INPUT tcp dport 80 counter accept -add rule ip filter INPUT tcp dport 443 counter accept +{% include '_nft_accept_ports' %} -# Services UDP +{% include '_nft_custom_rules' %} -# more services we use - ports for random services and TG listeners. -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_vpn' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# Extra protection for 192.168.100.x vpn hosts. -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited - -add rule ip filter INPUT counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.sign b/roles/base/templates/nftables/nftables.sign index cb26a74942..f908205a70 100644 --- a/roles/base/templates/nftables/nftables.sign +++ b/roles/base/templates/nftables/nftables.sign @@ -1,22 +1,18 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +{% include '_nft_accept_beg' %} + +{% include '_nft_accept_std' %} # Allow connections from client/server -add rule ip filter INPUT tcp dport 44333-44334 counter accept - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT tcp dport 44333-44334 counter accept +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.staging b/roles/base/templates/nftables/nftables.staging index b6c20eb0e5..f10ff19819 100644 --- a/roles/base/templates/nftables/nftables.staging +++ b/roles/base/templates/nftables/nftables.staging @@ -1,53 +1,27 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_beg' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_std' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -# zabbix01.stg -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept +{% include '_nft_accept_ssh' %} -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} +{% include '_nft_block_rules' %} -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} +{% include '_nft_accept_ports' %} + +# NOTE: This uses proxies_stg and not proxies. Also the VPN bits. ... so unique +# version of '_nft_accept_proxy_ports' # if there are any proxy-only tcp_ports - allow them {% if proxy_tcp_ports is defined %} @@ -55,24 +29,17 @@ add rule ip filter INPUT udp dport {{ port }} counter accept {% for proxy in groups['proxies_stg'] %} {% if hostvars[proxy]['vpn'] %} #!# FIXME: This test is the negation of the one in iptables. -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept {% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept {% endif %} {% endfor %} # No nagios {% endfor %} {% endif %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} # No nat rules diff --git a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org index fbb967c7f2..c88087cc92 100644 --- a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org +++ b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org @@ -1,42 +1,30 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_beg' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_std' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_ssh' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -# NOTE: we don't allow 10.16.163.10 / 10.16.166.10 or zabbix? +{% include '_nft_accept_monitoring' %} + +{% include '_nft_blocked_ips' %} + +# NOTE: This is _nft_accept_ports but with special variables. # if the host/group defines incoming tcp_ports - allow them # NOTE: These are specific to eth0 {% if tcp_ports_eth0 is defined %} {% for port in tcp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -44,7 +32,7 @@ add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept # NOTE: These are specific to eth0 {% if udp_ports_eth0 is defined %} {% for port in udp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -52,7 +40,7 @@ add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if tcp_ports_eth1 is defined %} {% for port in tcp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -60,30 +48,19 @@ add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if udp_ports_eth1 is defined %} {% for port in udp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" udp dport {{ port }} counter accept {% endfor %} {% endif %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_custom_rules' %} -{% if nft_nat_rules %} -#!# FIXME: These are different priority to iptables template... -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority 0; policy accept; } -add chain ip nat INPUT { type nat hook input priority 0; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority 0; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; } +{% include '_nft_accept_end' %} -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +# Why are these different from nftables?? +{% set _nft_prio_preroute = "0" %} +{% set _nft_prio_input = "0" %} +{% set _nft_prio_output = "0" %} +{% set _nft_prio_postroute = "0" %} + +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org index d384153524..3122c50af1 100644 --- a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org +++ b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org @@ -1,87 +1,38 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept - -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept - -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept - -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} - -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -# NOTE: This doesn't include 10.16.166.10 -# NOTE: This doesn't include zabbix. - -{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the phx2 datacenter, both production and staging hosts are in the same -# subnet/vlan. We want production hosts to reject connectons from staging group hosts -# to prevent them from interfering with production. There are however a few hosts in -# production we have marked 'staging-friendly' that we do allow staging to talk to for -# mostly read-only data they need. -# -{% for host in groups['staging']|sort %} -{% if 'eth0_ip' in hostvars[host] %}# {{ host }} -add rule ip filter INPUT ip saddr {{ hostvars[host]['eth0_ip'] }} counter reject with icmp type host-prohibited -{% else %}# {{ host }} has no 'eth0_ip' listed -{% endif %} -{% endfor %} -{% endif %} +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_beg' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_std' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_ssh' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_monitoring' %} -add table ip raw -add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; } -add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; } +{% include '_nft_blocked_ips' %} + +{% include '_nft_accept_ports' %} + +{% include '_nft_custom_rules' %} + +{% include '_nft_accept_end' %} + +# This is the special bit for torrents... +{% set _tnr = nft_table_raw %} + +add table {{_tnr}} +add chain {{_tnr}} PREROUTING { type filter hook prerouting priority -300; policy accept; } +add chain {{_tnr}} OUTPUT { type filter hook output priority -300; policy accept; } # # We don't want to track all the torrent tracker connections, there's too many. # -add rule ip raw PREROUTING tcp dport 6969 counter notrack -add rule ip raw OUTPUT tcp sport 6969 counter notrack +add rule {{_tnr}} PREROUTING tcp dport 6969 counter notrack +add rule {{_tnr}} OUTPUT tcp sport 6969 counter notrack diff --git a/roles/basessh/templates/sshd_config.j2 b/roles/basessh/templates/sshd_config.j2 index 3bb3d5f71e..fdb4eca656 100644 --- a/roles/basessh/templates/sshd_config.j2 +++ b/roles/basessh/templates/sshd_config.j2 @@ -40,8 +40,8 @@ UsePAM yes AllowAgentForwarding no X11Forwarding no PermitTunnel no -{% if ansible_hostname.startswith(('bastion')) %} -# This is a bastion host, we need tcp forwarding here. +{% if ansible_hostname.startswith(('bastion')) or ansible_hostname.startswith(('noc')) %} +# This is a bastion or noc host, we need tcp forwarding there. AllowTcpForwarding yes {% else %} AllowTcpForwarding no diff --git a/roles/batcave/files/rhel10-sync b/roles/batcave/files/rhel10-sync index 449f7c85fc..4d9c3429ea 100644 --- a/roles/batcave/files/rhel10-sync +++ b/roles/batcave/files/rhel10-sync @@ -1,6 +1,6 @@ #!/usr/bin/bash -RELEASEVERS=('10.1') +RELEASEVERS=('10.2') ARCHES=('aarch64' 'ppc64le' 's390x' 'x86_64') REPOS=('baseos' 'appstream' 'crb') diff --git a/roles/batcave/files/zabbix-ssh-agent.conf b/roles/batcave/files/zabbix-ssh-agent.conf new file mode 100644 index 0000000000..635f3ae8d9 --- /dev/null +++ b/roles/batcave/files/zabbix-ssh-agent.conf @@ -0,0 +1 @@ +UserParameter=ssh.discovery,awk 'BEGIN{printf "{\"data\":["}; {printf c"{\"{#SSH_HOST}\":\""$1"\"}";c=","}; END{print "]}"}' /etc/zabbix/ssh-targets.txt 2>/dev/null diff --git a/roles/batcave/files/zabbix-ssh-list.cron b/roles/batcave/files/zabbix-ssh-list.cron new file mode 100755 index 0000000000..d565e80f96 --- /dev/null +++ b/roles/batcave/files/zabbix-ssh-list.cron @@ -0,0 +1,18 @@ +#!/bin/bash +# Generate the host list Zabbix should monitor for SSH access from the Ansible +# inventory data + +# Right now this just gets all the virtservers which matches Nagios, but we +# should probably expand it to all known-available hosts + +TMP_FILE=$(mktemp) +/usr/bin/ansible 'bastion:virtservers' --list-hosts |grep -v "hosts.*:"|tr -d " " > "$TMP_FILE" + +if [ -s "$TMP_FILE" ]; then + mv "$TMP_FILE" /etc/zabbix/ssh-targets.txt + chmod 644 /etc/zabbix/ssh-targets.txt + # creating and moving a file breaks selinux, so set it to match a file the agent can already read + chcon --reference=/etc/zabbix/fedora.psk /etc/zabbix/ssh-targets.txt +else + rm -f "$TMP_FILE" +fi diff --git a/roles/batcave/files/zabbix-ssh-template.yml b/roles/batcave/files/zabbix-ssh-template.yml new file mode 100644 index 0000000000..b3749df259 --- /dev/null +++ b/roles/batcave/files/zabbix-ssh-template.yml @@ -0,0 +1,62 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: f5dbfadc0ccd42c4b04172f09268481f + template: 'SSH access from Batcave' + name: 'SSH access from Batcave' + description: 'Only applies to Batcave and tests SSH access works. Uses discovery from a file populated from the Ansible inventory in /etc/zabbix/ssh-targets.txt via a cronjob.' + groups: + - name: Fedora + discovery_rules: + - uuid: ad85fd77593f4f2aa8073ced51d943a7 + name: 'SSH Target discovery' + type: ZABBIX_ACTIVE + key: ssh.discovery + delay: 1h + enabled_lifetime_type: DISABLE_NEVER + item_prototypes: + - uuid: 1f78c9bd8e894f799bea27e8f0429b8c + name: 'SSH host {#SSH_HOST} response time' + type: ZABBIX_ACTIVE + key: 'net.tcp.service.perf[ssh,{#SSH_HOST},22]' + delay: 5m + value_type: FLOAT + units: ms + valuemap: + name: 'Service status' + preprocessing: + - type: MULTIPLIER + parameters: + - '1000' + tags: + - tag: application + value: ssh + - uuid: 8fe6bedbdcc9480a8c00bfa1ead93400 + name: 'SSH host {#SSH_HOST} port access' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[ssh,{#SSH_HOST},22]' + delay: 5m + valuemap: + name: 'Service status' + tags: + - tag: application + value: ssh + trigger_prototypes: + - uuid: 40b9cea515c6423fbcac99624676c1d0 + expression: 'last(/SSH access from Batcave/net.tcp.service[ssh,{#SSH_HOST},22]) = 0' + name: 'SSH host {#SSH_HOST} not reachable on 22' + priority: AVERAGE + tags: + - tag: scope + value: availability + valuemaps: + - uuid: a1b16e35c8e84f1c965fcfdde805297a + name: 'Service status' + mappings: + - value: '0' + newvalue: Down + - value: '1' + newvalue: Up diff --git a/roles/batcave/tasks/main.yml b/roles/batcave/tasks/main.yml index f9ec4f32e2..90ff923217 100644 --- a/roles/batcave/tasks/main.yml +++ b/roles/batcave/tasks/main.yml @@ -705,3 +705,52 @@ tags: - batcave - config + +# Monitoring setup for Batcave +- name: Setup cron for generating SSH monitoring hostlist + ansible.builtin.copy: + src: zabbix-ssh-list.cron + dest: /etc/cron.hourly/zabbix-ssh-list.cron + mode: '0755' + tags: + - batcave + - ssh + - zabbix_agent + +- name: Install Zabbix agent config drop-in + ansible.builtin.copy: + src: zabbix-ssh-agent.conf + dest: /etc/zabbix/zabbix_agentd.d/ssh-targets.conf + mode: '0644' + tags: + - batcave + - ssh + - zabbix_agent + notify: + - Restart zabbix agent + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_api + - batcave + - ssh + block: + - name: Import Batcave SSH template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-ssh-template.yml') }}" + state: present + + - name: Add self to SSH template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: SSH access from Batcave + force: false diff --git a/roles/bkernel/files/history_off.sh b/roles/bkernel/files/history_off.sh deleted file mode 100644 index be7ee75a3e..0000000000 --- a/roles/bkernel/files/history_off.sh +++ /dev/null @@ -1,2 +0,0 @@ -unset HISTFILE -set HISTSIZE=0 diff --git a/roles/bkernel/files/pesign-users b/roles/bkernel/files/pesign-users deleted file mode 100644 index 649d673d6c..0000000000 --- a/roles/bkernel/files/pesign-users +++ /dev/null @@ -1,2 +0,0 @@ -kojibuilder -pesign diff --git a/roles/bkernel/tasks/main.yml b/roles/bkernel/tasks/main.yml deleted file mode 100644 index 850962b108..0000000000 --- a/roles/bkernel/tasks/main.yml +++ /dev/null @@ -1,70 +0,0 @@ ---- -- name: Add pkgs for bkernel boxes - ansible.builtin.package: - state: present - name: - - pesign - - ccid - - pcsc-lite - - pcsc-lite-libs - - opensc - - nss-tools - tags: - - bkernel - -- name: Enable pcscd - service: name=pcscd state=started enabled=true - tags: - - bkernel - -- name: Setup opensc in pcscd - ansible.builtin.shell: modutil -dbdir /etc/pki/pesign -list | grep -q OpenSC || modutil -force -dbdir /etc/pki/pesign -add opensc -libfile /usr/lib64/pkcs11/opensc-pkcs11.so - check_mode: no - changed_when: "1 != 1" - tags: - - bkernel - -- name: Setup pesign users config - ansible.builtin.copy: src=pesign-users dest=/etc/pesign/users mode=0600 owner=root group=root - tags: - - bkernel - -- name: Enable pesign - service: name=pesign state=started enabled=true - tags: - - bkernel - -- name: /var/run/pesign directory perms (kojibuilder) - acl: path=/var/run/pesign entity=kojibuilder etype=user permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: /var/run/pesign directory perms (pesign) - acl: path=/var/run/pesign default=true entity=pesign etype=group permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: /var/run/pesign socket perms (kojibuilder) - acl: path=/var/run/pesign/socket entity=kojibuilder etype=user permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: /var/run/pesign socket perms (pesign) - acl: path=/var/run/pesign/socket default=true entity=pesign etype=group permissions=rwx recursive=true state=present - tags: - - bkernel - -- name: When you awake you will remember nothing - ansible.builtin.copy: src=history_off.sh dest=/etc/profile.d/history_off.sh mode=0644 - tags: - - bkernel - -- name: Mock site-defaults.cfg - ansible.builtin.template: - src: bkernel-site-defaults.cfg - dest: /etc/mock/site-defaults.cfg - mode: "0644" - owner: root - group: mock - tags: - - bkernel diff --git a/roles/bkernel/templates/bkernel-site-defaults.cfg b/roles/bkernel/templates/bkernel-site-defaults.cfg deleted file mode 100644 index f48419dd96..0000000000 --- a/roles/bkernel/templates/bkernel-site-defaults.cfg +++ /dev/null @@ -1,23 +0,0 @@ -# mount the pesign socket into the chroot -config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/var/run/pesign', '/var/run/pesign' )) -config_opts['nspawn_args'] += ['--bind=/var/run/pesign'] -config_opts['plugin_conf']['package_state_enable'] = False -config_opts['macros']['%bugurl'] = 'https://bugz.fedoraproject.org/%name' -#config_opts['nosync'] = True -#config_opts['nosync_force'] = True -config_opts['dnf_common_opts'] = ['--setopt=install_weak_deps=0'] -config_opts['environment']['LANG'] = 'C.UTF-8' -config_opts['use_bootstrap'] = False -config_opts['dnf_warning'] = False - -# dnf group install with '--allowerasing' is still to be released: -# https://github.com/rpm-software-management/dnf5/pull/1174 -config_opts["dnf5_avoid_opts"] = { - "group": ["--allowerasing"], -} - -config_opts['plugin_conf']['rpmautospec_enable'] = True -config_opts['plugin_conf']['rpmautospec_opts'] = { - 'requires': ['rpmautospec'], - 'cmd_base': ['/usr/bin/rpmautospec', 'process-distgit'], -} diff --git a/roles/blockerbugs/files/20210914-patched-bz_interface.py b/roles/blockerbugs/files/20210914-patched-bz_interface.py deleted file mode 100644 index 1f5b0ae480..0000000000 --- a/roles/blockerbugs/files/20210914-patched-bz_interface.py +++ /dev/null @@ -1,276 +0,0 @@ -# Copyright 2012, Red Hat, Inc -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License along -# with this program; if not, write to the Free Software Foundation, Inc., -# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -# -# Authors: -# Tim Flink - -"""Common methods for obtaining blocker/FE information from Bugzilla""" - -import logging -import datetime -from typing import Optional, Any - -import bugzilla -from bugzilla.bug import Bug as bzBug -from xmlrpc.client import Fault - -from blockerbugs import app - -# rhbz has been updated to have a max of 20 results returned -BUGZILLA_QUERY_LIMIT = 20 - -base_query = {'o1': 'anywords', - 'f1': 'blocked', - 'query_format': 'advanced', - 'extra_fields': ['flags'], - 'limit': BUGZILLA_QUERY_LIMIT} - -class BZInterfaceError(Exception): - """A custom wrapper for XMLRPC errors from Bugzilla""" - - def __init__(self, msg): - self.msg = msg - - def __str__(self): - return repr(self.msg) - - -class BlockerBugs(): - """The main class for querying Bugzilla""" - - def __init__(self, user: Optional[str] = None, password: Optional[str] = None, - url: Optional[str] = 'https://bugzilla.redhat.com/xmlrpc.cgi', - bz: Optional[bugzilla.Bugzilla] = None, - logger: Optional[logging.Logger] = None) -> None: - """:param user: Username to log in as. Use `None` for anonymous access. - :param password: User password. Use `None` for anonymous access. - :param url: Bugzilla API url. - :param bz: `Bugzilla` instance. Created automatically if not provided. If provided, - the `user`, `password` and `url` values are ignored. - :param logger: A custom `Logger` instance. Otherwise a default Logger is created. - """ - self.logger = logger or logging.getLogger('bz_interface') - self.bz: bugzilla.Bugzilla = bz - if not bz: - if not (user and password): - self.bz = bugzilla.Bugzilla(url=url, - cookiefile=None, - tokenfile=None) - else: - self.bz = bugzilla.Bugzilla(url=url, - user=user, - password=password, - cookiefile=None, - tokenfile=None) - self.logger.info('Using bugzilla URL: %s' % url) - - # https://bugzilla.stage.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED - # &bug_status=POST&bug_status=MODIFIED&classification=Fedora&component=anaconda&f1=component - # &o1=changedafter&product=Fedora&query_format=advanced&v1=2013-03-21%2012%3A25&version=19 - def get_bz_query(self, tracker: int, last_update: datetime.datetime = None, offset: int = 0 - ) -> dict[str, Any]: - """Build a Bugzilla query to retrieve all necessary info about all bugs which block the - `tracker` bug. - - :param last_update: If provided, the query is modified to ask only about bugs which have - recent modifications; otherwise asks about all bugs. - :offset: offset to the query instead of just getting the first N results - :returns: a dict which can be fed into `bugzilla.Bugzilla.query()`. - """ - query = {} - query.update(base_query) - query['v1'] = str(tracker) - - if last_update: - last_update_string = last_update.strftime("%Y-%m-%d %H:%M GMT") - - # Since this is kind of confusing, the idea here is to only grab only - # the bugs whose whiteboard, blocks or dependson has changed since - # the last sync or any bugs that have been created in the last day. - - # keep in mind that OP -> open parenthesis, CP -> closed parenthesis - # and the OR is to make sure that a bug is returned if ANY of the - # changed after conditions are met - - # FIXME: This seems to be tremendously slowing down Bugzilla5 - # Related: https://forge.fedoraproject.org/quality/blockerbugs/issues/184 - query.update({ - 'f2': 'OP', - 'j2': 'OR', - 'f3': 'blocked', - 'o3': 'changedafter', - 'v3': last_update_string, - 'f4': 'status_whiteboard', - 'o4': 'changedafter', - 'v4': last_update_string, - 'f5': 'bug_status', - 'o5': 'changedafter', - 'v5': last_update_string, - 'f6': 'dependson', - 'o6': 'changedafter', - 'v6': last_update_string, - 'f7': 'creation_ts', - 'o7': 'greaterthaneq', - 'v7': last_update_string, - 'f8': 'short_desc', - 'o8': 'changedafter', - 'v8': last_update_string, - 'f9': 'component', - 'o9': 'changedafter', - 'v9': last_update_string, - 'f10': 'CP' - }) - - # update query with the offset to use, no change in behavior if the default 0 is used - query.update({'offset': offset}) - - return query - - def query_tracker(self, tracker: int, last_update: Optional[datetime.datetime] = None - ) -> list[bzBug]: - """Perform a Bugzilla query and retrieve all necessary info about all bugs which block the - `tracker` bug (i.e. Blocker or FE bugs). - - :param last_update: If provided, the query is modified to ask only about bugs which have - recent modifications; otherwise asks about all bugs. - """ - - buglist = [] - last_query_len = BUGZILLA_QUERY_LIMIT - - - # this is a hotfix hack to work around the sudden config change in rhbz where the max - # number of bugs returned for a query is 20 - # it seems to be working for now but may need more work going forward - while last_query_len == BUGZILLA_QUERY_LIMIT: - - new_query = self.get_bz_query(tracker, last_update, offset=len(buglist)) - new_buglist = self.bz.query(new_query) - buglist.extend(new_buglist) - last_query_len = len(new_buglist) - - return buglist - - def query_prioritized(self) -> list[bzBug]: - """Perform a Bugzilla query and retrieve all necessary info about all Prioritized bugs.""" - # https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__& - # f1=flagtypes.name&o1=substring&query_format=advanced&v1=fedora_prioritized_bug%2B - query = self.bz.url_to_query( - "{}buglist.cgi?bug_status=__open__&f1=flagtypes.name&o1=substring" - "&query_format=advanced&v1=fedora_prioritized_bug%2B".format( - app.config['BUGZILLA_URL'])) - buglist = self.bz.query(query) - return buglist - - def get_deps(self, bugid: int) -> list[int]: - """Retrieve bug dependencies. - - :returns: A list of ticket numbers which `bugid` depends on. - """ - return self.bz.getbug(bugid).dependson - - -class BlockerProposal(): - def __init__(self, bz, bugid, trackers, is_blocker=False, is_fe=False, bz_user=''): - self.bz = bz - self.bugid = bugid - self.trackers = trackers - self.is_blocker = is_blocker - self.is_fe = is_fe - self.bz_user = bz_user - self.bugid_ok = False - self.proposal_ok = False - self.bugdata = None - self.blocks = None - - self.log = logging.getLogger('bz_interface.bugproposal') - - def get_bugdata(self): - # get bug data, will raise XMLRPC fault if the bug does not exist - try: - self.bugdata = self.bz.getbug(self.bugid) - except Fault as e: - if e.faultCode == 101: - raise BZInterfaceError(e.faultString) - else: - raise - - def get_tracker_type(self): - if self.is_blocker and self.is_fe: - return 'Blocker and Freeze Exception' - if self.is_blocker: - return 'Blocker' - if self.is_fe: - return 'Freeze Exception' - if self.is_prioritized: - return 'PrioritizedBug' - - def propose_bugs(self, bz_user, milestone_name, justification): - comment = ['Proposed as a', self.get_tracker_type(), 'for', milestone_name, 'by', - bz_user, 'using the blocker tracking app because:\n\n', - justification] - tracker_bugs = [] - if self.is_blocker: - tracker_bugs.append(self.trackers['blocker']) - if self.is_fe: - tracker_bugs.append(self.trackers['fe']) - self.log.info('comment: %s' % comment) - try: - self._do_proposal(tracker_bugs, self.bugid, ' '.join(comment), self.bz_user) - except Fault as e: - if e.faultCode == 51: - # bugzilla account does not exist, this should happen very rarely, if ever - # so just redo the call with nothing to add to cc - # TODO - it might be useful to ask the user to re-associate accounts again here - self._do_proposal(tracker_bugs, self.bugid, ' '.join(comment), '') - else: - raise BZInterfaceError(e.faultString) - - def _do_proposal(self, tracker, proposed_bugid, comment, bz_user): - bug_update = self.bz.build_update(blocks_add=tracker, - cc_add=[bz_user], - comment=comment) - self.bz.update_bugs(proposed_bugid, bug_update) - - def check_proposed_bug(self): - if not self.bugdata: - self.get_bugdata() - - # check to make sure that bug is not already CLOSED - bug_status = self.bugdata.bug_status - if 'CLOSED' in bug_status.split(): - raise BZInterfaceError('Bug %i is CLOSED: %s' % (self.bugid, bug_status)) - - def get_blocks(self): - if not self.bugdata: - self.get_bugdata() - self.blocks = self.bugdata.blocked - - def check_blocker_proposal(self): - if not self.blocks: - self.get_blocks() - - if self.trackers['blocker'] in self.blocks: - return False - return True - - def check_fe_proposal(self): - if not self.blocks: - self.get_blocks() - - if self.trackers['fe'] in self.blocks: - return False - return True diff --git a/roles/blockerbugs/tasks/main.yml b/roles/blockerbugs/tasks/main.yml index 2475a1bdf9..81efc80ebe 100644 --- a/roles/blockerbugs/tasks/main.yml +++ b/roles/blockerbugs/tasks/main.yml @@ -77,10 +77,3 @@ tags: - config - blockerbugs - -# this is a "short-term" patch that won't be needed for future versions of blockerbugs -- name: Patch bz_interface to work with rhbz changes - ansible.builtin.copy: src=20210914-patched-bz_interface.py dest=/usr/lib/python3.9/site-packages/blockerbugs/util/bz_interface.py - when: master_blockerbugs_node - tags: - - blockerbugs diff --git a/roles/blockerbugs/templates/blockerbugs-settings.py.j2 b/roles/blockerbugs/templates/blockerbugs-settings.py.j2 index 36c3adcdae..d192585074 100644 --- a/roles/blockerbugs/templates/blockerbugs-settings.py.j2 +++ b/roles/blockerbugs/templates/blockerbugs-settings.py.j2 @@ -8,12 +8,6 @@ BUGZILLA_XMLRPC = BUGZILLA_URL + 'xmlrpc.cgi' BODHI_URL = '{{ blockerbugs_bodhi_url }}' BLOCKERBUGS_URL = '{{ blockerbugs_url }}' BLOCKERBUGS_API = "{}api/v0/".format(BLOCKERBUGS_URL) -PAGURE_URL = '{{ blockerbugs_pagure_url }}' -PAGURE_API = PAGURE_URL + '/api/0/' -PAGURE_REPO_TOKEN = "{{ blockerbugs_pagure_repo_token_secret }}" -PAGURE_REPO_WEBHOOK_KEY = "{{ blockerbugs_pagure_repo_webhook_key_secret }}" -PAGURE_REPO = "fedora-qa/blocker-review" -PAGURE_BOT_USERNAME = 'blockerbot' {% if env == "staging" %} FAS_FLASK_COOKIE_REQUIRES_HTTPS = False diff --git a/roles/bodhi2/backend/files/new-updates-sync b/roles/bodhi2/backend/files/new-updates-sync index 307914cf55..625a08093a 100755 --- a/roles/bodhi2/backend/files/new-updates-sync +++ b/roles/bodhi2/backend/files/new-updates-sync @@ -121,54 +121,6 @@ RELEASES = {'f44': {'topic': 'fedora', {'arches': ['ppc64le', 's390x'], 'dest': os.path.join(FEDORAALTDEST, 'testing', '43', 'Everything')} ]}} - }, - 'f42': {'topic': 'fedora', - 'version': '42', - 'modules': ['fedora', 'fedora-secondary'], - 'repos': {'updates': { - 'from': 'f42-updates', - 'ostrees': [{'ref': 'fedora/42/%(arch)s/updates/silverblue', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/kinoite', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/sericea', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/onyx', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/updates/cosmic-atomic', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}], - 'to': [{'arches': ['x86_64', 'aarch64', 'source'], - 'dest': os.path.join(FEDORADEST, '42', 'Everything')}, - {'arches': ['ppc64le', 's390x'], - 'dest': os.path.join(FEDORAALTDEST, '42', 'Everything')} - ]}, - 'updates-testing': { - 'from': 'f42-updates-testing', - 'ostrees': [{'ref': 'fedora/42/%(arch)s/testing/silverblue', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/kinoite', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/sericea', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/onyx', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}, - {'ref': 'fedora/42/%(arch)s/testing/cosmic-atomic', - 'dest': OSTREEDEST, - 'arches': ['x86_64', 'aarch64']}], - 'to': [{'arches': ['x86_64', 'aarch64', 'source'], - 'dest': os.path.join(FEDORADEST, 'testing', '42', 'Everything')}, - {'arches': ['ppc64le', 's390x'], - 'dest': os.path.join(FEDORAALTDEST, 'testing', '42', 'Everything')} - ]}} }, 'epel10.3': {'topic': 'epel', 'version': '10.3', @@ -198,20 +150,6 @@ RELEASES = {'f44': {'topic': 'fedora', 'dest': os.path.join(EPELDEST, 'testing', '10.2', 'Everything')}, ]}} }, - 'epel10.1': {'topic': 'epel', - 'version': '10.1', - 'modules': ['epel'], - 'repos': {'epel': { - 'from': 'epel10.1', - 'to': [{'arches': ['x86_64', 'aarch64', 'ppc64le', 's390x', 'source'], - 'dest': os.path.join(EPELDEST, '10.1', 'Everything')}, - ]}, - 'epel-testing': { - 'from': 'epel10.1-testing', - 'to': [{'arches': ['x86_64', 'aarch64', 'ppc64le', 's390x', 'source'], - 'dest': os.path.join(EPELDEST, 'testing', '10.1', 'Everything')}, - ]}} - }, 'epel9': {'topic': 'epel', 'version': '9', 'modules': ['epel'], diff --git a/roles/bodhi2/backend/tasks/main.yml b/roles/bodhi2/backend/tasks/main.yml index de03b5c1e9..04a464a378 100644 --- a/roles/bodhi2/backend/tasks/main.yml +++ b/roles/bodhi2/backend/tasks/main.yml @@ -116,7 +116,7 @@ # bodhi2/backend/files/koji_sync_listener.py # This cronjob runs only once a day. The listener script runs reactively. cron: name="owner-sync" minute="15" hour="4" user="root" - job="/usr/local/bin/lock-wrapper owner-sync '/usr/local/bin/owner-sync-pagure f45 f44 f43 f42 {{ epel_tags | join(' ') }} epel9 epel9-next epel8'" + job="/usr/local/bin/lock-wrapper owner-sync '/usr/local/bin/owner-sync-pagure f45 f44 f43 {{ epel_tags | join(' ') }} epel9 epel9-next epel8'" cron_file=update-koji-owner user=apache when: env == "production" diff --git a/roles/bodhi2/backend/templates/koji_sync_listener.toml b/roles/bodhi2/backend/templates/koji_sync_listener.toml index 7e124c9cd2..877a31208a 100644 --- a/roles/bodhi2/backend/templates/koji_sync_listener.toml +++ b/roles/bodhi2/backend/templates/koji_sync_listener.toml @@ -43,9 +43,6 @@ taglist = [ "f43", "f43-container", "f43-flatpak", - "f42", - "f42-container", - "f42-flatpak", {% for tag in epel_tags %} "{{ tag }}", {% endfor %} diff --git a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 index f0958ded74..f345811ce8 100644 --- a/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 +++ b/roles/bodhi2/backend/templates/pungi.rpm.conf.j2 @@ -24,7 +24,7 @@ release_short = '[[ release.id_prefix.title() ]]' # GENERAL SETTINGS comps_file = { 'scm': 'git', - 'repo': 'https://pagure.io/fedora-comps.git', + 'repo': 'https://forge.fedoraproject.org/releng/fedora-comps.git', 'branch': 'main', # defaults to cvs/HEAD or git/main [% if release.id_prefix == 'FEDORA-EPEL' %] 'file': 'comps-epel[[ release.version | int ]].xml', @@ -181,7 +181,7 @@ ostree = { [% else %] "treefile": "fedora-silverblue.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -203,7 +203,7 @@ ostree = { [% else %] "treefile": "fedora-kinoite.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -225,7 +225,7 @@ ostree = { [% else %] "treefile": "fedora-sericea.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -243,7 +243,7 @@ ostree = { [% else %] "treefile": "fedora-onyx.yaml", [% endif %] - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -258,7 +258,7 @@ ostree = { "unified_core": True, "runroot_packages": ["selinux-policy-targeted"], "treefile": "cosmic-atomic-ostree.yaml", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "ostree_repo": "/mnt/koji/compose/ostree/repo", @@ -272,7 +272,7 @@ ostree = { ostree_container = { "^Silverblue$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -289,7 +289,7 @@ ostree_container = { }, "^Kinoite$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -306,7 +306,7 @@ ostree_container = { }, "^Sericea$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -319,7 +319,7 @@ ostree_container = { }, "^Onyx$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, [% if release.version_int >= 41 %] @@ -333,7 +333,7 @@ ostree_container = { [% if release.version_int >= 42 %] "^COSMIC-Atomic$": { "version": "!VERSION_FROM_VERSION_DATE_RESPIN", - "config_url": "https://pagure.io/workstation-ostree-config.git", + "config_url": "https://forge.fedoraproject.org/atomic-desktops/config.git", "config_branch": "f[[ release.version ]]", "repo": {{ repos }}, "treefile": "cosmic-atomic.yaml", diff --git a/roles/bodhi2/base/tasks/main.yml b/roles/bodhi2/base/tasks/main.yml index aae558451a..a95770cc31 100644 --- a/roles/bodhi2/base/tasks/main.yml +++ b/roles/bodhi2/base/tasks/main.yml @@ -36,6 +36,17 @@ - config - bodhi +- name: Copy auth file for quay.io + ansible.builtin.template: + src: flatpak-bot-auth.json.j2 + dest: /etc/bodhi/flatpak-bot-auth.json + owner: bodhi + group: root + mode: "0644" + tags: + - config + - bodhi + # Bodhi virtualhost in RabbitMQ - name: Configure the bodhi virtual host diff --git a/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 b/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 new file mode 100644 index 0000000000..db4061fe89 --- /dev/null +++ b/roles/bodhi2/base/templates/flatpak-bot-auth.json.j2 @@ -0,0 +1,12 @@ +{ + "auths": { + "quay.io": { +{% if env == 'staging' %} + "auth": "{{ bodhi2_quayio_auth_stg }}", +{% else %} + "auth": "{{ bodhi2_quayio_auth }}", +{% endif %} + "email": "" + } + } +} diff --git a/roles/bodhi2/base/templates/production.ini.j2 b/roles/bodhi2/base/templates/production.ini.j2 index 82f5155b10..bccafe60bd 100644 --- a/roles/bodhi2/base/templates/production.ini.j2 +++ b/roles/bodhi2/base/templates/production.ini.j2 @@ -204,14 +204,15 @@ pungi.extracmdline = --notification-script=/usr/bin/pungi-fedmsg-notification -- skopeo.cmd = /usr/bin/skopeo # Comma separated list of extra flags to pass to the skopeo copy command. -skopeo.extra_copy_flags = -a,--retry-times=10 +skopeo.extra_copy_flags = -a,--retry-times=10,--authfile=/etc/bodhi/flatpak-bot-auth.json # Container hostnames. You can specify a port as well, using the traditional syntax (i.e., localhost:5000). -# container.destination_registry = registry.fedoraproject.org -# container.source_registry = candidate-registry.fedoraproject.org {% if env == 'staging' %} -container.destination_registry = registry.stg.fedoraproject.org quay.io/fedora-testingflatpak +container.destination_registry = registry.stg.fedoraproject.org quay.io/fedora-flatpaks-testing container.source_registry = candidate-registry.stg.fedoraproject.org +{% else %} +container.destination_registry = registry.fedoraproject.org quay.io/fedora-flatpaks +container.source_registry = candidate-registry.fedoraproject.org {% endif %} @@ -365,12 +366,34 @@ top_testers_timeframe = 900 # stacks_enabled = False # Cache settings +{% if env == 'staging' %} +dogpile.cache.backend = dogpile.cache.redis +# Set expiration_time to one week +dogpile.cache.expiration_time = 604800 +dogpile.cache.dogpile_expire_time = 10 +dogpile.cache.arguments.url = redis://default:{{bodhi_valkey_secret}}@bodhi-valkey:6379/0 +# dogpile.cache.arguments.host = +# dogpile.cache.arguments.port = 6379 +# dogpile.cache.arguments.db = 0 +# dogpile.cache.arguments.username = default +# dogpile.cache.arguments.password = This_Is_JustAT3st +dogpile.cache.arguments.distributed_lock = True +dogpile.cache.arguments.thread_local_lock = False +dogpile.cache.arguments.lock_timeout = 5 +dogpile.cache.arguments.lock_sleep = 0.1 +dogpile.cache.arguments.lock_prefix = bodhi:dogpile_lock: +# Set redis expiration_time to one week + 1 hour +dogpile.cache.arguments.redis_expiration_time = 608400 +dogpile.cache.arguments.connection_pool_kwargs.max_connections = 20 +dogpile.cache.arguments.connection_pool_kwargs.socket_keepalive = True +{% else %} # dogpile.cache.backend = dogpile.cache.dbm # dogpile.cache.expiration_time = 100 # dogpile.cache.arguments.filename = /var/cache/bodhi-dogpile-cache.dbm dogpile.cache.backend = dogpile.cache.memory_pickle # Cache expires every 6 hours. dogpile.cache.expiration_time = 21600 +{% endif %} # Exclude sending emails to these users # exclude_mail = bodhi diff --git a/roles/communishift/library/communishift_storage_efs.py b/roles/communishift/library/communishift_storage_efs.py index 949099aa94..2c15d1a9e7 100644 --- a/roles/communishift/library/communishift_storage_efs.py +++ b/roles/communishift/library/communishift_storage_efs.py @@ -23,6 +23,13 @@ options: description: The name of the Communishift Project. required: true type: str + state: + description: Create access point or remove access points for this project from the filesystem. + type: str + default: present + choices: + - present + - absent aws_access_key_id: description: The AWS API access_key_id. required: true @@ -36,8 +43,11 @@ options: required: true type: str aws_efs_filesystem_id: - description: The AWS EFS FileSystemId of the resource that was previously created. - required: true + description: >- + The AWS EFS FileSystemId. Required when I(state=present). + Optional when I(state=absent); if omitted the filesystem is found by CreationToken matching I(project_name), + consistent with community.aws.efs I(name). + required: false type: str author: @@ -57,88 +67,153 @@ EXAMPLES = r""" {{create_efs_filesystem_response['efs']['file_system_id']}} register: create_efs_accesspoint_response ignore_errors: true + +- name: Delete access points for a Communishift project + communishift_storage_efs: + project_name: "{{ item.value.name }}" + state: absent + aws_access_key_id: "{{ communishift_efs_access_key }}" + aws_secret_access_key: "{{ communishift_efs_secret_key }}" + aws_region: "{{ communishift_region }}" """ RETURN = r""" - -# These are examples of possible return values, and in general should use other names for return values. accesspoint_id: - description: The AccessPointId returned by the AWS EFS API creation request. - type: str - returned: If the EFS Filesystem exists and the AccessPoint been successfully created or already exists. - sample: 'fsap-0938462b9b5f77388' -full_response: - description: The response returned by the AWS EFS boto3 client.create_access_point() or client.describe_access_points(). + description: The AccessPointId returned by create (present) when a single matching resource is summarized. type: str returned: If the EFS Filesystem exists and the AccessPoint has been successfully created or already exists. - sample: '{'ResponseMetadata': {'RequestId': '9c3d3e41-4332-4fe3-8388-f04ccf0400a2', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amzn-requ -estid': '9c3d3e41-4332-4fe3-8388-f04ccf0400a2', 'content-type': 'application/json', 'content-length': '503', 'date': 'Tue, 16 -Aug 2022 10:17:43 GMT'}, 'RetryAttempts': 0}, 'ClientToken': 'communishift_storage_efs', 'Tags': [{'Key': 'communishift', 'Val -ue': 'projectname'}], 'AccessPointId': 'fsap-0938462b9b5f77388', 'AccessPointArn': 'arn:aws:elasticfilesystem:us-east-1:XXXXXXXXXXXX: -access-point/fsap-0938462b9b5f77388', 'FileSystemId': 'fs-0343e73f7765a503b', 'PosixUser': {'Uid': 50000, 'Gid': 50000} -, 'RootDirectory': {'Path': '/', 'CreationInfo': {'OwnerUid': 50000, 'OwnerGid': 50000, 'Permissions': '775'}}, 'OwnerId': 'XXXX', -'LifeCycleState': 'creating'}' +deleted_access_point_ids: + description: Access point IDs deleted in absent mode. + type: list + elements: str + returned: absent +full_response: + description: Creation response or describe payload (present) or summarized absent action. + type: raw msg: description: The output message that the module generates. type: str returned: always - sample: 'AWS EFS AccessPoint already exists.' """ from ansible.module_utils.basic import AnsibleModule -def run_module(): - # define available arguments/parameters a user can pass to the module - module_args = dict( - project_name=dict(type="str", required=True), - aws_access_key_id=dict(type="str", required=True), - aws_secret_access_key=dict(type="str", required=True), - aws_region=dict(type="str", required=True), - aws_efs_filesystem_id=dict(type="str", required=True), - ) - - # seed the result dict in the object - # we primarily care about changed and state - # changed is if this module effectively modified the target - # state will include any data that you want your module to pass back - # for consumption, for example, in a subsequent task - result = dict(changed=False, accesspoint_id="", full_response="", msg="") - - # the AnsibleModule object will be our abstraction working with Ansible - # this includes instantiation, a couple of common attr would be the - # args/params passed to the execution, as well as if the module - # supports check mode - module = AnsibleModule(argument_spec=module_args, supports_check_mode=True) - - # if the user is working with this module in only check mode we do not - # want to make any changes to the environment, just return the current - # state with no modifications - if module.check_mode: - module.exit_json(**result) - - efs_client = boto3.client( +def build_efs_client(params): + return boto3.client( "efs", - aws_access_key_id=module.params["aws_access_key_id"], - aws_secret_access_key=module.params["aws_secret_access_key"], - region_name=module.params["aws_region"], + aws_access_key_id=params["aws_access_key_id"], + aws_secret_access_key=params["aws_secret_access_key"], + region_name=params["aws_region"], ) + +def find_filesystem_id_by_creation_token(efs_client, creation_token): + paginator = efs_client.get_paginator("describe_file_systems") + for page in paginator.paginate(): + for fs in page.get("FileSystems", []): + if fs.get("CreationToken") == creation_token: + return fs["FileSystemId"] + return None + + +def matching_access_points(efs_client, filesystem_id, project_name): + expected_path = "/{0}".format(project_name) + matching = [] + + # describe_access_points has no botocore paginator on many versions (OperationNotPageableError). + marker = None + while True: + kw = {"FileSystemId": filesystem_id} + if marker: + kw["Marker"] = marker + response = efs_client.describe_access_points(**kw) + for ap in response.get("AccessPoints", []): + tags = {t["Key"]: t["Value"] for t in ap.get("Tags", [])} + if tags.get("communishift") != project_name: + continue + root_path = ap.get("RootDirectory", {}).get("Path", "") + if root_path != expected_path: + continue + matching.append(ap["AccessPointId"]) + + marker = response.get("NextMarker") or response.get("NextToken") + if not marker: + break + return matching + + +def run_absent(module, efs_client, params, check_mode): + project_name = params["project_name"] + fs_id = params.get("aws_efs_filesystem_id") or "" + if not fs_id: + fs_id = find_filesystem_id_by_creation_token(efs_client, project_name) + if fs_id is None: + module.exit_json( + changed=False, + deleted_access_point_ids=[], + accesspoint_id="", + full_response=None, + msg="No EFS file system found with CreationToken matching project_name.", + ) + access_point_ids = matching_access_points(efs_client, fs_id, project_name) + if not access_point_ids: + module.exit_json( + changed=False, + deleted_access_point_ids=[], + accesspoint_id="", + full_response={"file_system_id": fs_id}, + msg="No matching Communishift-tagged access points to delete.", + ) + if check_mode: + module.exit_json( + changed=True, + deleted_access_point_ids=[], + access_points_that_would_be_deleted=access_point_ids, + accesspoint_id="", + full_response={"file_system_id": fs_id}, + msg="Check mode: would delete {0} access point(s)".format(len(access_point_ids)), + ) + deleted = [] + for ap_id in access_point_ids: + efs_client.delete_access_point(AccessPointId=ap_id) + deleted.append(ap_id) + module.exit_json( + changed=True, + deleted_access_point_ids=deleted, + accesspoint_id=deleted[-1] if deleted else "", + full_response={ + "file_system_id": fs_id, + "deleted_access_point_ids": deleted, + }, + msg="Deleted {0} Communishift EFS access point(s).".format(len(deleted)), + ) + + +def run_present(module, efs_client, params, check_mode): + fs_id = params["aws_efs_filesystem_id"] + if check_mode: + module.exit_json( + changed=False, + accesspoint_id="", + full_response=None, + msg="Check mode: would create access point if missing.", + ) try: response = efs_client.create_access_point( - ClientToken=module.params["project_name"], + ClientToken=params["project_name"], Tags=[ - {"Key": "communishift", "Value": module.params["project_name"]}, - {"Key": "Name", "Value": module.params["project_name"]}, + {"Key": "communishift", "Value": params["project_name"]}, + {"Key": "Name", "Value": params["project_name"]}, ], - FileSystemId=module.params["aws_efs_filesystem_id"], + FileSystemId=fs_id, PosixUser={ "Uid": 1001, "Gid": 1001, - "SecondaryGids": [ 0 ], + "SecondaryGids": [0], }, RootDirectory={ - "Path": f"/{ module.params['project_name'] }", + "Path": "/{0}".format(params["project_name"]), "CreationInfo": { "OwnerUid": 0, "OwnerGid": 0, @@ -147,19 +222,49 @@ def run_module(): }, ) - result["accesspoint_id"] = response["AccessPointId"] - result["full_response"] = response - result["changed"] = True - result["msg"] = "AWS EFS AccessPoint created successfully." - module.exit_json(**result) - except efs_client.exceptions.AccessPointAlreadyExists: - response = efs_client.describe_access_points( - FileSystemId=module.params["aws_efs_filesystem_id"] + module.exit_json( + changed=True, + accesspoint_id=response["AccessPointId"], + full_response=response, + deleted_access_point_ids=[], + msg="AWS EFS AccessPoint created successfully.", ) - result["accesspoint_id"] = response["AccessPoints"][0]["AccessPointId"] - result["full_response"] = response - result["msg"] = "AWS EFS AccessPoint already exists." - module.fail_json(**result) + except efs_client.exceptions.AccessPointAlreadyExists: + ap_ids = matching_access_points(efs_client, fs_id, params["project_name"]) + chosen = ap_ids[0] if ap_ids else "" + module.exit_json( + changed=False, + accesspoint_id=chosen, + full_response=ap_ids, + deleted_access_point_ids=[], + msg="AWS EFS AccessPoint already exists.", + ) + + +def run_module(): + module_args = dict( + project_name=dict(type="str", required=True), + state=dict(type="str", default="present", choices=["present", "absent"]), + aws_access_key_id=dict(type="str", required=True), + aws_secret_access_key=dict(type="str", required=True), + aws_region=dict(type="str", required=True), + aws_efs_filesystem_id=dict(type="str", required=False), + ) + + module = AnsibleModule(argument_spec=module_args, supports_check_mode=True) + + params = module.params + state = params["state"] + + if state == "present" and not params.get("aws_efs_filesystem_id"): + module.fail_json(msg="aws_efs_filesystem_id is required when state=present.") + + efs_client = build_efs_client(params) + + if state == "absent": + run_absent(module, efs_client, params, module.check_mode) + else: + run_present(module, efs_client, params, module.check_mode) def main(): diff --git a/roles/communishift/tasks/cleanup-administration-delete-projects.yml b/roles/communishift/tasks/cleanup-administration-delete-projects.yml new file mode 100644 index 0000000000..53cf25aa97 --- /dev/null +++ b/roles/communishift/tasks/cleanup-administration-delete-projects.yml @@ -0,0 +1,60 @@ +--- +- name: Set Communishift deletion context for this project + ansible.builtin.set_fact: + communishift_namespace: "{{ item.value.name }}" + communishift_protected: "{{ item.value.do_not_delete | default(false) | bool }}" + +- name: Skip delete for protected Communishift project + ansible.builtin.debug: + msg: "Skipping deletion for {{ communishift_namespace }} (do_not_delete is true)" + when: communishift_protected | bool + +- name: Dry-run - eligible project deletion preview + ansible.builtin.debug: + msg: >- + Would delete Namespace {{ communishift_namespace }}, Communishift EFS access points and filesystem {{ communishift_namespace }}, + and Group {{ communishift_namespace }}-admins (set -e communishift_delete_projects_dry_run=false to apply). + when: + - not communishift_protected | bool + - communishift_delete_projects_dry_run | default(false) | bool + +- name: Delete Communishift namespace cluster resources then AWS/OpenShift teardown + when: + - not communishift_protected | bool + - not (communishift_delete_projects_dry_run | default(false) | bool) + block: + - name: Remove Communishift Kubernetes namespace + kubernetes.core.k8s: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: v1 + kind: Namespace + name: "{{ communishift_namespace }}" + state: absent + wait: true + + - name: Delete Communishift-tagged EFS access points for project + communishift_storage_efs: + project_name: "{{ communishift_namespace }}" + state: absent + aws_access_key_id: "{{ communishift_efs_access_key }}" + aws_secret_access_key: "{{ communishift_efs_secret_key }}" + aws_region: "{{ communishift_region }}" + + - name: Remove Communishift EFS filesystem (matches community.aws.efs creation token) + community.aws.efs: + aws_access_key: "{{ communishift_efs_access_key }}" + aws_secret_key: "{{ communishift_efs_secret_key }}" + region: "{{ communishift_region }}" + state: absent + name: "{{ communishift_namespace }}" + wait: true + + - name: Remove OpenShift group for project admins + community.okd.k8s: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + name: "{{ communishift_namespace }}-admins" + api_version: user.openshift.io/v1 + kind: Group + state: absent diff --git a/roles/communishift/tasks/cleanup-administration-send-disabled-notifications.yml b/roles/communishift/tasks/cleanup-administration-send-disabled-notifications.yml new file mode 100644 index 0000000000..1820b5c1f1 --- /dev/null +++ b/roles/communishift/tasks/cleanup-administration-send-disabled-notifications.yml @@ -0,0 +1,53 @@ +--- +# Sent after workloads are scaled down; requires communishift_project_emails (FASJSON) on the host. +- name: Set Communishift disabled-notice context for this project + ansible.builtin.set_fact: + communishift_dn_protected: "{{ item.value.do_not_delete | default(false) | bool }}" + +- name: Send Communishift project disabled notices to tenants + community.general.mail: + host: localhost + port: 25 + subject: "Fedora Communishift: project {{ item.value.name }} has been disabled" + body: > + Dear Fedora Communishift Project Administrators (BCC'd), + + + This message confirms that the Communishift project {{ item.value.name }} has been disabled: workloads in + this namespace have been scaled to zero as part of the Fedora Communishift cleanup aligned with the + post-release process. + + Persistent data volumes and configuration objects may still exist in the cluster; retrieve anything you still + need according to Openshift documentation. The project may be deleted in a later step of the same process. + + If you believe this action was taken in error, open a ticket with the Fedora Infrastructure team: + https://forge.fedoraproject.org/infra/tickets + + Please reference the project name and describe the issue. + from: admin@fedoraproject.org + to: "infrastructure@lists.fedoraproject.org" + bcc: "{{ communishift_project_emails[item.value.name]['email_list'] }}" + cc: admin@fedoraproject.org + headers: + - Reply-To=admin@fedoraproject.org + charset: us-ascii + when: + - not communishift_dn_protected + - communishift_disable_shutdown | default(false) | bool + - not communishift_disabled_notifications_dry_run | default(false) + tags: + - communishift_disable_project + +- name: Communishift disabled notice (dry-run preview, mail not sent) + ansible.builtin.debug: + msg: + dry_run: true + project: "{{ item.value.name }}" + to: infrastructure@lists.fedoraproject.org + bcc: "{{ communishift_project_emails[item.value.name]['email_list'] }}" + subject: "Fedora Communishift: project {{ item.value.name }} has been disabled" + when: + - not communishift_dn_protected + - communishift_disabled_notifications_dry_run | default(false) + tags: + - communishift_disable_project diff --git a/roles/communishift/tasks/cleanup-administration-shutdown-services.yml b/roles/communishift/tasks/cleanup-administration-shutdown-services.yml index 950016227a..8d0a230eab 100644 --- a/roles/communishift/tasks/cleanup-administration-shutdown-services.yml +++ b/roles/communishift/tasks/cleanup-administration-shutdown-services.yml @@ -1,35 +1,116 @@ --- -- name: Check if this project should be deleted +- name: Set Communishift shutdown context for this project ansible.builtin.set_fact: - should_not_delete: "{{ item.value.do_not_delete | default(false) }}" + communishift_namespace: "{{ item.value.name }}" + communishift_protected: "{{ item.value.do_not_delete | default(false) | bool }}" -- name: Debug - debug: - msg: "Project {{ item.value.name }} marked for shutdown" - when: "not should_not_delete" +- name: Skip shutdown for protected Communishift project + ansible.builtin.debug: + msg: "Skipping {{ communishift_namespace }} (do_not_delete is true)" + when: communishift_protected | bool +- name: Report eligible project (dry run, no API scale) + ansible.builtin.debug: + msg: >- + Would scale workloads to 0 in {{ communishift_namespace }} + (use -e communishift_disable_shutdown=true to apply). + when: + - not (communishift_protected | bool) + - not (communishift_disable_shutdown | default(false) | bool) +- name: Scale down workloads in eligible Communishift namespace + when: + - not (communishift_protected | bool) + - communishift_disable_shutdown | default(false) | bool + block: + - name: List Deployments + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: Deployment + namespace: "{{ communishift_namespace }}" + register: communishift_deployments -#- name: Loop over each project and scale its deployments to 0 -# block: -# - name: Get list of deployments in the current project -# kubernetes.core.k8s_info: -# kind: Deployment -# api_version: apps/v1 -# namespace: "{{ item }}" -# register: deployment_list -# loop: "{{ projects_list }}" -# -# - name: Scale each deployment to 0 replicas -# kubernetes.core.k8s_scale: -# api_version: apps/v1 -# kind: Deployment -# name: "{{ dep.metadata.name }}" -# namespace: "{{ item.item }}" # item.item is the project from the outer loop -# replicas: 0 -# wait: true # Optional: wait for scale to complete -# loop: "{{ deployment_list.results | selectattr('resources', 'defined') | map(attribute='resources') | flatten }}" -# loop_control: -# loop_var: dep -# when: deployment_list.results is defined and deployment_list.results | length > 0 -# when: projects_list is defined and projects_list | length > 0 + - name: Scale Deployments to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: Deployment + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_deployments.resources | default([]) }}" + loop_control: + loop_var: scale_target + + - name: List DeploymentConfigs + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps.openshift.io/v1 + kind: DeploymentConfig + namespace: "{{ communishift_namespace }}" + register: communishift_deploymentconfigs + + - name: Scale DeploymentConfigs to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps.openshift.io/v1 + kind: DeploymentConfig + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_deploymentconfigs.resources | default([]) }}" + loop_control: + loop_var: scale_target + + - name: List StatefulSets + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: StatefulSet + namespace: "{{ communishift_namespace }}" + register: communishift_statefulsets + + - name: Scale StatefulSets to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: StatefulSet + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_statefulsets.resources | default([]) }}" + loop_control: + loop_var: scale_target + + - name: List DaemonSets + kubernetes.core.k8s_info: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: DaemonSet + namespace: "{{ communishift_namespace }}" + register: communishift_daemonsets + + - name: Scale DaemonSets to zero + kubernetes.core.k8s_scale: + api_key: "{{ communishift_ocp_api_token }}" + host: "{{ communishift_ocp_api_host }}" + api_version: apps/v1 + kind: DaemonSet + name: "{{ scale_target.metadata.name }}" + namespace: "{{ communishift_namespace }}" + replicas: 0 + wait: true + loop: "{{ communishift_daemonsets.resources | default([]) }}" + loop_control: + loop_var: scale_target diff --git a/roles/copr/backend/tasks/main.yml b/roles/copr/backend/tasks/main.yml index 417ff01704..7aa2aade4b 100644 --- a/roles/copr/backend/tasks/main.yml +++ b/roles/copr/backend/tasks/main.yml @@ -273,6 +273,19 @@ - copr_infrastructure_password - provision_config +- name: Deploy rpmeta HW pools config + ansible.builtin.template: + src: rpmeta-hw-pools.yaml.j2 + dest: /etc/copr/rpmeta-hw-pools.yaml + owner: root + group: copr + mode: "0640" + when: rpmeta_enabled | default(false) | bool and rpmeta_hostname is defined + notify: + - Restart copr-backend + tags: + - config + - name: Create messaging config directory ansible.builtin.file: dest=/etc/copr/msgbuses state=directory owner=copr group=copr mode=0700 when: copr_messaging diff --git a/roles/copr/backend/templates/copr-be.conf.j2 b/roles/copr/backend/templates/copr-be.conf.j2 index bd21332638..88f4d3431c 100644 --- a/roles/copr/backend/templates/copr-be.conf.j2 +++ b/roles/copr/backend/templates/copr-be.conf.j2 @@ -70,7 +70,11 @@ builds_max_workers_owner=0 # Maximum number of concurrently running tasks per build sandbox. {% if env == 'production' %} -builds_max_workers_sandbox=35 +# Do not increase this number without cross-team discussion. Further increases +# will have consequences (individuals stealing majority of machines). +# Long-term, we should implement a dynamic quota system (e.g., something that +# analyzes the structure of the queue). +builds_max_workers_sandbox=50 {% else %} builds_max_workers_sandbox=4 {% endif %} @@ -118,6 +122,13 @@ pulp_content_url={{ pulp_content_url }} sentry_dsn={{ copr_sentry_dsn }} {% endif %} +{% if rpmeta_enabled | default(false) | bool and rpmeta_hostname is defined %} +rpmeta_enabled=true +rpmeta_url=https://{{ rpmeta_hostname }} +rpmeta_timeout={{ rpmeta_timeout | default(5) }} +rpmeta_hw_pools_config=/etc/copr/rpmeta-hw-pools.yaml +{% endif %} + [builder] # default is 1800, this probably has no effect! diff --git a/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 b/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 index cd94270960..0fe68e8bb7 100644 --- a/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 +++ b/roles/copr/backend/templates/lighttpd/pulp-redirect.lua.j2 @@ -66,6 +66,17 @@ function pulp_url(copr_path) local split = string_split(copr_path, "/") + -- Nobody should use devel repositories on user machines but in reality, + -- some people do. In such case we need to transform + -- @asahi/kernel/fedora-43-x86_64/devel/ into + -- @asahi/kernel/fedora-43-x86_64-devel/ + -- This is not needed for devel repositories in Copr buildroots, because + -- copr-frontend does the same kind of transformation + if split[4] == "devel" then + split[3] = split[3] .. "-devel" + table.remove(split, 4) + end + if copr_path:sub(-4) ~= ".rpm" then -- This is easy for .xml files inside the repodata, because in Pulp they are -- located at the same place where they would be on Copr backend. @@ -74,14 +85,14 @@ function pulp_url(copr_path) -- This is the only thing that is needed to make `dnf copr enable` work, and -- for the repos to use the https://download.copr.fedorainfracloud.org CDN. -- This alone will not `dnf install` from the repos, though. See below. - url = url .. copr_path + url = url .. table.concat(split, "/") elseif split[4] == "Packages" then -- This is a .rpm file but the path already contains /Packages/, therefore -- we know that this is a `dnf install` situation. The repo already points -- to the correct path in Pulp, we just need to translate the CDN hostname -- to the Pulp hostname - url = url .. copr_path + url = url .. table.concat(split, "/") else -- This is a .rpm file but we are not accessing it through a repository. diff --git a/roles/copr/backend/templates/rpmeta-hw-pools.yaml.j2 b/roles/copr/backend/templates/rpmeta-hw-pools.yaml.j2 new file mode 100644 index 0000000000..af98f40203 --- /dev/null +++ b/roles/copr/backend/templates/rpmeta-hw-pools.yaml.j2 @@ -0,0 +1,40 @@ +# Hardware specs of base builder machines per architecture. +# Used by copr-backend to call rpmeta with the correct HW info. +# Update when builder instance types change. +# +# x86_64: AWS c7i.xlarge (4 vCPU / 7.6 GiB / 143 GiB swap) +# aarch64: AWS c7g.xlarge (4 vCPU / 7.6 GiB / 143 GiB swap) +# ppc64le: POWER9 hypervisors in Fedora Community Cage (5 cores / 15 GiB / 140 GiB swap) +# s390x: IBM Cloud z15 (2 vCPU / 7.8 GiB / 143 GiB swap) + +x86_64: + cpu_model_name: "Intel(R) Xeon(R) Platinum 8488C" + cpu_arch: "x86_64" + cpu_model: "143" + cpu_cores: 4 + ram: 7.6 + swap: 143.0 + +aarch64: + cpu_model_name: "Neoverse-V1" + cpu_arch: "aarch64" + cpu_model: "1" + cpu_cores: 4 + ram: 7.6 + swap: 143.0 + +ppc64le: + cpu_model_name: "POWER9 (architected), altivec supported" + cpu_arch: "ppc64le" + cpu_model: "2.2 (pvr 004e 1202)" + cpu_cores: 5 + ram: 15.0 + swap: 140.0 + +s390x: + cpu_model_name: "IBM z15" + cpu_arch: "s390x" + cpu_model: "8562" + cpu_cores: 2 + ram: 7.8 + swap: 143.0 diff --git a/roles/copr/dist_git/files/dist-git.conf b/roles/copr/dist_git/files/dist-git.conf index 30c59e82ad..25d35b5fe4 100644 --- a/roles/copr/dist_git/files/dist-git.conf +++ b/roles/copr/dist_git/files/dist-git.conf @@ -11,7 +11,3 @@ gitolite = False # name of the default branch (a.k.a. master or main) default_branch = master - -{% if env == 'production' %} -sentry_dsn={{ copr_sentry_dsn }} -{% endif %} diff --git a/roles/copr/dist_git/files/patches/0001-import-file-with-slash-in-name.patch b/roles/copr/dist_git/files/patches/0001-import-file-with-slash-in-name.patch new file mode 100644 index 0000000000..37e123db5c --- /dev/null +++ b/roles/copr/dist_git/files/patches/0001-import-file-with-slash-in-name.patch @@ -0,0 +1,37 @@ +Hot-fix for https://github.com/fedora-copr/copr/issues/4318 + +Can be dropped once upstream deploys: https://pagure.io/rpkg/pull-request/777 + +diff --git a/pyrpkg/__init__.py b/pyrpkg/__init__.py +index 46ca599..7e923d1 100644 +--- a/pyrpkg/__init__.py ++++ b/pyrpkg/__init__.py +@@ -2069,17 +2069,14 @@ class Commands(object): + '.fmf/*', '*.fmf', 'changelog'] + + # Get a list of files we're currently tracking +- ourfiles = self.repo.git.ls_files().split('\n') +- if ourfiles == ['']: +- # Repository doesn't contain any files +- ourfiles = [] +- else: +- # Trim out sources and .gitignore +- for file in ('.gitignore', 'sources'): +- try: +- ourfiles.remove(file) +- except ValueError: +- pass ++ ourfiles = self.repo.git.ls_files('-z').rstrip('\0') ++ ourfiles = ourfiles.split('\0') if ourfiles else [] ++ # Trim out sources and .gitignore ++ for file in ('.gitignore', 'sources'): ++ try: ++ ourfiles.remove(file) ++ except ValueError: ++ pass + + # Things work better if we're in our repository directory + oldpath = os.getcwd() +-- +2.54.0 + diff --git a/roles/copr/dist_git/tasks/main.yml b/roles/copr/dist_git/tasks/main.yml index 84b7bac803..54dd87025a 100644 --- a/roles/copr/dist_git/tasks/main.yml +++ b/roles/copr/dist_git/tasks/main.yml @@ -32,6 +32,12 @@ - dist-git-selinux - copr-dist-git +- name: Patch https://github.com/fedora-copr/copr/issues/4318 + patch: + src: patches/0001-import-file-with-slash-in-name.patch + dest: /usr/lib/python3.14/site-packages/pyrpkg/__init__.py + tags: patches + - name: Switch selinux to enforcing selinux: policy=targeted state=enforcing diff --git a/roles/copr/dist_git/templates/copr-dist-git.conf.j2 b/roles/copr/dist_git/templates/copr-dist-git.conf.j2 index a8e5c60ab6..f6dff3de9a 100644 --- a/roles/copr/dist_git/templates/copr-dist-git.conf.j2 +++ b/roles/copr/dist_git/templates/copr-dist-git.conf.j2 @@ -18,3 +18,7 @@ per_task_log_dir=/var/lib/copr-dist-git/per-task-logs/ # which chroot to use for mock-scm builds mock_scm_chroot=fedora-24-x86_64 + +{% if env == 'production' %} +sentry_dsn={{ copr_sentry_dsn }} +{% endif %} diff --git a/roles/copr/frontend/files/pg/pg_hba.conf b/roles/copr/frontend/files/pg/pg_hba.conf index 3cf2f2cb65..133a94707a 100644 --- a/roles/copr/frontend/files/pg/pg_hba.conf +++ b/roles/copr/frontend/files/pg/pg_hba.conf @@ -1,7 +1,4 @@ -local coprdb copr-fe md5 -host coprdb copr-fe 127.0.0.1/8 md5 -host coprdb copr-fe ::1/128 md5 -local coprdb postgres ident +local coprdb copr-fe peer # TYPE DATABASE USER ADDRESS METHOD diff --git a/roles/copr/frontend/tasks/psql_setup.yml b/roles/copr/frontend/tasks/psql_setup.yml index c1933addc7..98ce1020e7 100644 --- a/roles/copr/frontend/tasks/psql_setup.yml +++ b/roles/copr/frontend/tasks/psql_setup.yml @@ -15,7 +15,12 @@ when: not postgres_initialized.stat.exists - name: Copy pg_hba.conf - ansible.builtin.copy: src="pg/pg_hba.conf" dest=/var/lib/pgsql/data/pg_hba.conf owner=postgres group=postgres mode=0600 + ansible.builtin.copy: + src: "pg/pg_hba.conf" + dest: /var/lib/pgsql/data/pg_hba.conf + owner: postgres + group: postgres + mode: '0600' notify: - Restart postgresql tags: @@ -52,7 +57,10 @@ become_user: postgres - name: Create db user - postgresql_user: db="coprdb" name="copr-fe" password="{{ copr_database_password }}" role_attr_flags=SUPERUSER,NOCREATEDB,NOCREATEROLE + postgresql_user: + db: "coprdb" + name: "copr-fe" + role_attr_flags: "NOSUPERUSER,NOCREATEDB,NOCREATEROLE" become: yes become_user: postgres @@ -134,15 +142,6 @@ group: copr-fe mode: "0600" -- name: Install pgpass file - ansible.builtin.copy: - content: | - localhost:*:coprdb:copr-fe:{{ copr_database_password }} - dest: "{{ copr_fe_homedir }}/.pgpass" - owner: copr-fe - group: copr-fe - mode: "0400" - - stat: path="{{ copr_fe_homedir }}/.psql_history" register: history_file diff --git a/roles/copr/frontend/templates/copr.conf b/roles/copr/frontend/templates/copr.conf index bbe58b5e5a..49d981c60c 100644 --- a/roles/copr/frontend/templates/copr.conf +++ b/roles/copr/frontend/templates/copr.conf @@ -33,7 +33,7 @@ RESALLOC_URL = "{{ backend_base_url }}/resalloc" #USE_ALLOWED_USERS = False #ALLOWED_USERS = ['bonnie', 'clyde'] -SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2://copr-fe:{{ copr_database_password }}@/coprdb' +SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2://copr-fe@/coprdb' # Token length, defaults to 30 (max 255) #API_TOKEN_LENGTH = 30 @@ -290,7 +290,11 @@ EXTRA_BUILDCHROOT_TAGS = [{ "tags": ["on_demand_powerful"], },{ # packages that always takes time to build - "pattern": ".*/.*/.*/(firefox|thunderbird)$", + "pattern": ".*/.*/.*(x86_64|aarch64|ppc64le)/(firefox|thunderbird|pytorch|llvm|gcc|kernel)$", + "tags": ["on_demand_powerful"], +},{ + # https://github.com/fedora-copr/copr/issues/4319 + "pattern": "^karlinator/texlive-2023/.*(x86_64|aarch64)/texlive*", "tags": ["on_demand_powerful"], }] {% endif %} diff --git a/roles/distgit/pagure/defaults/main.yml b/roles/distgit/pagure/defaults/main.yml index 8a2e959e0b..5ec6584715 100644 --- a/roles/distgit/pagure/defaults/main.yml +++ b/roles/distgit/pagure/defaults/main.yml @@ -3,4 +3,6 @@ pagure_patches: - b50d32b7c92f131ebcc3b633de6c6e91e28297ec - 5529 - readme-include + - 26bc9746 + - 5553 diff --git a/roles/distgit/pagure/files/pagure_cron.conf b/roles/distgit/pagure/files/pagure_cron.conf index 361a68748a..cddf1b6dfd 100644 --- a/roles/distgit/pagure/files/pagure_cron.conf +++ b/roles/distgit/pagure/files/pagure_cron.conf @@ -5,3 +5,10 @@ Alias /extras /srv/cache/extras Require all granted +Alias /git-fsck-failing-repos-archive /srv/cache/git-fsck-failing-repos-archive + + Options Indexes FollowSymLinks + AllowOverride None + Require all granted + + diff --git a/roles/distgit/tasks/main.yml b/roles/distgit/tasks/main.yml index 1c1f78375b..c1eac81a27 100644 --- a/roles/distgit/tasks/main.yml +++ b/roles/distgit/tasks/main.yml @@ -200,9 +200,9 @@ - src: "{{ private }}/files/rabbitmq/production/pki/private/git-hooks.key" dest: git-hooks.key owner: root - group: root + group: apache mode: "440" - - src: "{{ private }}/files/rabbitmq/production/pki/reqs/git-hooks.req" + - src: "{{ private }}/files/rabbitmq/production/pki/ca.crt" dest: git-hooks.ca owner: root group: root diff --git a/roles/dns/files/zabbix/template.yml b/roles/dns/files/zabbix/template.yml new file mode 100644 index 0000000000..e1f0f53f2b --- /dev/null +++ b/roles/dns/files/zabbix/template.yml @@ -0,0 +1,51 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 469d49d18d9f4da28aaf775b50084b08 + template: 'DNS checks' + name: 'DNS checks' + groups: + - name: Fedora + items: + - uuid: 681147b6755a453ab5e26e2ad8ad2402 + name: 'DNS performance for fedoraproject.org' + type: ZABBIX_ACTIVE + key: 'net.dns.perf[,fedoraproject.org,A]' + value_type: FLOAT + trends: '0' + units: s + tags: + - tag: component + value: dns + triggers: + - uuid: c5721fb738374074a26810e8e75b260d + expression: 'avg(/DNS checks/net.dns.perf[,fedoraproject.org,A],#3)>1' + name: 'DNS performance for fedoraproject.org is more than 1s' + priority: AVERAGE + tags: + - tag: scope + value: performance + - uuid: e189ee7aee2c451586573a1d03207a98 + name: 'DNS query for fedoraproject.org' + type: ZABBIX_ACTIVE + key: 'net.dns.record[,fedoraproject.org,A]' + value_type: CHAR + trends: '0' + tags: + - tag: component + value: dns + triggers: + - uuid: 225808c08f0a480a948d68ef43fe2d10 + expression: 'find(/DNS checks/net.dns.record[,fedoraproject.org,A],,"regexp","fedoraproject.org.*A")=0' + name: 'DNS query for fedoraproject.org is incorrect' + priority: HIGH + description: | + https://www.zabbix.com/documentation/7.0/en/manual/appendix/functions/history#find + + returns 0 if string not found, so we test for 0. look for fedoraproject.org because some are internal (10.x) records and some are external (38.x) records + tags: + - tag: scope + value: availability diff --git a/roles/dns/tasks/main.yml b/roles/dns/tasks/main.yml index d8c4863890..0f99452743 100644 --- a/roles/dns/tasks/main.yml +++ b/roles/dns/tasks/main.yml @@ -122,3 +122,30 @@ service: name=named state=started enabled=yes tags: - dns + +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_api + - zabbix_agent + - dns + block: + - name: Import DNS Zabbix template file + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix/template.yml') }}" + state: present + run_once: true + + - name: Add self to DNS template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: DNS checks + force: false diff --git a/roles/httpd/proxy/files/zabbix-selinux.te b/roles/httpd/proxy/files/zabbix-selinux.te new file mode 100644 index 0000000000..602f519e5b --- /dev/null +++ b/roles/httpd/proxy/files/zabbix-selinux.te @@ -0,0 +1,11 @@ +module zabbix_proxy 1.1; + +require { + type unreserved_port_t; + type zabbix_agent_t; + class tcp_socket name_connect; +} + +#============= zabbix_agent_t ============== + +allow zabbix_agent_t unreserved_port_t:tcp_socket name_connect; diff --git a/roles/httpd/proxy/files/zabbix-template-internal.yml b/roles/httpd/proxy/files/zabbix-template-internal.yml new file mode 100644 index 0000000000..f691cc8e5b --- /dev/null +++ b/roles/httpd/proxy/files/zabbix-template-internal.yml @@ -0,0 +1,109 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 847dc5c32ea342e5b20659747516f19d + template: 'Proxy checks - internal' + name: 'Proxy checks - internal' + description: 'Checks that only internal proxies can run' + groups: + - name: Fedora + items: + - uuid: e7604e57aa8a4b3caa474d95f49bec7e + name: 'Mirrorlist Docker Container TCP check' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[tcp,,18081]' + tags: + - tag: component + value: mirrorlist + triggers: + - uuid: 08fcae0ec58145609e85c2fc128e1861 + expression: 'last(/Proxy checks - internal/net.tcp.service[tcp,,18081])=0' + name: 'Mirrorlist Docker Container TCP check failed' + priority: AVERAGE + - uuid: 1f917349a49440c78e24daae9ac25b1f + name: http-fmn-api + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://fmn-api.apps.ocp.fedoraproject.org/api/v1/healthz/ready,,,OK]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: http + triggers: + - uuid: 0e93bf5f3449458fa24795fa03d1e0af + expression: 'last(/Proxy checks - internal/web.page.regexp[https://fmn-api.apps.ocp.fedoraproject.org/api/v1/healthz/ready,,,OK])<>"OK"' + name: 'http-fmn-api connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 1f0eba5fb89b47b1bc380a9f699c8564 + name: http-fmn-web + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://notifications.fedoraproject.org/,,,FMN]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: http + triggers: + - uuid: 96a1590776a74dc68736083d3b51319c + expression: 'last(/Proxy checks - internal/web.page.regexp[https://notifications.fedoraproject.org/,,,FMN])<>"FMN"' + name: 'http-fmn-web connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: de4cb57caa0a4776846c0327c4a1e2ac + name: http-oci-registry-webui + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://registry.fedoraproject.org/v2/fedora/tags/list,,,rawhide]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: http + triggers: + - uuid: 515fd69090b349e391be581c6e4dc82c + expression: 'last(/Proxy checks - internal/web.page.regexp[https://registry.fedoraproject.org/v2/fedora/tags/list,,,rawhide])<>"rawhide"' + name: 'http-oci-registry-webui connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 44286da1dca046b89d205f8db0a0cb56 + name: http-oci-registry-api + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://registry.fedoraproject.org/v2/_catalog?last=fedora,,,fedora]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 30s + tags: + - tag: component + value: http + triggers: + - uuid: afe0d6921c074089869e11ec59e6fe35 + expression: 'last(/Proxy checks - internal/web.page.regexp[https://registry.fedoraproject.org/v2/_catalog?last=fedora,,,fedora])<>"fedora"' + name: 'http-oci-registry-api connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity diff --git a/roles/httpd/proxy/files/zabbix-template.yml b/roles/httpd/proxy/files/zabbix-template.yml index 9f9b9a79c6..226c993472 100644 --- a/roles/httpd/proxy/files/zabbix-template.yml +++ b/roles/httpd/proxy/files/zabbix-template.yml @@ -5,8 +5,8 @@ zabbix_export: name: Fedora templates: - uuid: 248dc8195923413eb6fb9dd8a8e09332 - template: 'Proxy HTTPd checks' - name: 'Proxy HTTPd checks' + template: 'Proxy checks' + name: 'Proxy checks' groups: - name: Fedora items: @@ -16,19 +16,179 @@ zabbix_export: key: 'vfs.file.time[/etc/httpd/ticketkey.tkey,modify]' history: 1d trends: '0' + units: unixtime description: 'Date of the ticketkey file, based on "modify" stat output' tags: - tag: application value: ticketkey triggers: - uuid: bfd41861a3f6448cbf0013675f8a6c74 - expression: 'now() - last(/Proxy HTTPd checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 3900' + expression: 'now() - last(/Proxy checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 3900' name: 'TicketKey age is more than one hour' priority: WARNING + dependencies: + - name: 'TicketKey age is more than two hours' + expression: 'now() - last(/Proxy checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 7200' + tags: + - tag: scope + value: file_age - uuid: 8b004b185340490ea9fa1fce4bc92386 - expression: 'now() - last(/Proxy HTTPd checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 7200' + expression: 'now() - last(/Proxy checks/vfs.file.time[/etc/httpd/ticketkey.tkey,modify]) > 7200' name: 'TicketKey age is more than two hours' priority: AVERAGE + tags: + - tag: scope + value: file_age + - uuid: a9a117ebdc514b08af24633b1ac40448 + name: 'Mirrorlist 1 cache timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]' + history: 1d + trends: '0' + units: unixtime + description: 'Date of the ticketkey file, based on "modify" stat output' + tags: + - tag: application + value: ticketkey + triggers: + - uuid: af2a279be64f4044b9c159a565072062 + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]) > 14400' + name: 'Mirrorlist 1 cache age is more than 4 hours' + priority: WARNING + dependencies: + - name: 'Mirrorlist 1 cache age is more than 36 hours' + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]) > 129600' + tags: + - tag: scope + value: file_age + - uuid: 16f086125dd04d4ca7896cefad47b3de + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist1/mirrorlist_cache.proto,modify]) > 129600' + name: 'Mirrorlist 1 cache age is more than 36 hours' + priority: AVERAGE + tags: + - tag: scope + value: file_age + - uuid: dc236818b1e8480097dc7ffed3d179e9 + name: 'Mirrorlist 2 cache timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]' + history: 1d + trends: '0' + units: unixtime + description: 'Date of the ticketkey file, based on "modify" stat output' + tags: + - tag: application + value: ticketkey + triggers: + - uuid: 681164a1ffdb4c5ca7cd74f41c51d3d8 + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]) > 14400' + name: 'Mirrorlist 2 cache age is more than 4 hours' + priority: WARNING + dependencies: + - name: 'Mirrorlist 2 cache age is more than 36 hours' + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]) > 129600' + tags: + - tag: scope + value: file_age + - uuid: 40cf9c585fdf471d855ef3da6396cfc2 + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/mirrorlist/data/mirrorlist2/mirrorlist_cache.proto,modify]) > 129600' + name: 'Mirrorlist 2 cache age is more than 36 hours' + priority: AVERAGE + tags: + - tag: scope + value: file_age + - uuid: 07990ae5100f44208e7dab5da438c043 + name: 'OSTree Summary file timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/srv/web/ostree/summary,modify]' + history: 1d + trends: '0' + units: unixtime + description: 'Date of the ticketkey file, based on "modify" stat output' + tags: + - tag: application + value: ticketkey + triggers: + - uuid: bedc260eec06438097abdd7f0c7a6adb + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/web/ostree/summary,modify]) > 1800' + name: 'OSTree summary file age is more than 30 mins' + priority: WARNING + dependencies: + - name: 'OSTree summary file age is more than one hour' + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/web/ostree/summary,modify]) > 3600' + tags: + - tag: scope + value: file_age + - uuid: ea88d0ecaeff4896af3e836b4431c7ec + expression: 'now() - last(/Proxy checks/vfs.file.time[/srv/web/ostree/summary,modify]) > 3600' + name: 'OSTree summary file age is more than one hour' + priority: AVERAGE + tags: + - tag: scope + value: file_age + - uuid: 9047878841c3403ebfd1352424ca96d7 + name: http-accounts + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://accounts.fedoraproject.org/healthz/ready,,,OK]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 8830fee0972e42b0874bd1301c84bc58 + expression: 'last(/Proxy checks/web.page.regexp[https://accounts.fedoraproject.org/healthz/ready,,,OK])<>"OK"' + name: 'http-accounts connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: facba1ec8a224d728f329e7cef2e3fa2 + name: http-bodhi + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://bodhi.fedoraproject.org/,,,Active Testers]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 10s + tags: + - tag: component + value: infra + triggers: + - uuid: 777798b8704c4eb8a9a90d8b0054a900 + expression: 'last(/Proxy checks/web.page.regexp[https://bodhi.fedoraproject.org/,,,Active Testers])<>"Active Testers"' + name: 'http-bodhi connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 4edb5b8c43484515b525c3653da78fd6 + name: http-docs.fedoraproject.org + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://docs.fedoraproject.org/en-US/docs/index.html,,,Antora]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: d2111d480e404b349f14f400ff2a693a + expression: 'last(/Proxy checks/web.page.regexp[https://docs.fedoraproject.org/en-US/docs/index.html,,,Antora])<>"Antora"' + name: 'http-docs.fedoraproject.org connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity - uuid: 80960b21fa7146538d6ddd9a2ec78e84 name: http-fedoraproject.org type: ZABBIX_ACTIVE @@ -42,7 +202,7 @@ zabbix_export: value: infra triggers: - uuid: 1d55c842156c4290ac0d6f7bdcb02f13 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/,,,https://fedoraproject.org])<>"https://fedoraproject.org"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/,,,https://fedoraproject.org])<>"https://fedoraproject.org"' name: 'http-fedoraproject.org connection failed' priority: AVERAGE tags: @@ -63,7 +223,7 @@ zabbix_export: value: infra triggers: - uuid: bfd8143fda7b4c60bebc80086024e48b - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/static/hotspot.txt,,,OK])<>"OK"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/static/hotspot.txt,,,OK])<>"OK"' name: 'http-fedoraproject.org-hotspot.txt connection failed' priority: AVERAGE tags: @@ -84,7 +244,7 @@ zabbix_export: value: infra triggers: - uuid: 8efe34c0ade040d5b9d84ee06f31cc04 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/wiki/Fedora_Project_Wiki,,,Looking for help])<>"Looking for help"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/wiki/Fedora_Project_Wiki,,,Looking for help])<>"Looking for help"' name: 'http-fedoraproject.org-wiki connection failed' priority: AVERAGE tags: @@ -105,7 +265,7 @@ zabbix_export: value: infra triggers: - uuid: ca2817c97ef64ed08e35c08535b0bd41 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://fedoraproject.org/wiki/Special:Version,,,MediaWiki is free software])<>"MediaWiki is free software"' + expression: 'last(/Proxy checks/web.page.regexp[https://fedoraproject.org/wiki/Special:Version,,,MediaWiki is free software])<>"MediaWiki is free software"' name: 'http-fedoraproject.org-wiki-non-cached connection failed' priority: AVERAGE tags: @@ -113,6 +273,111 @@ zabbix_export: value: availability - tag: scope value: connectivity + - uuid: 81fe4d1f57d24fbab33de37e21b45cfc + name: http-greenwave + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://greenwave-web-greenwave.apps.ocp.fedoraproject.org/api/v1.0/policies,,,bodhi_update_push_stable]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: ea8cf6f662e74b04ad0b18731bf966ef + expression: 'last(/Proxy checks/web.page.regexp[https://greenwave-web-greenwave.apps.ocp.fedoraproject.org/api/v1.0/policies,,,bodhi_update_push_stable])<>"bodhi_update_push_stable"' + name: 'http-greenwave connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 0979be4b524e4dd4a5735b5a7640a69c + name: http-ipsilon + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://id.fedoraproject.org/,,,your Fedora Account]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 928062a012a54ce2b20a215c0d35e3af + expression: 'last(/Proxy checks/web.page.regexp[https://id.fedoraproject.org/,,,your Fedora Account])<>"your Fedora Account"' + name: 'http-ipsilon connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: bffc1489f8014272963b30f258082960 + name: http-koschei + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://koschei.fedoraproject.org/,,,Package summary]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: ebe02ba799684a2aa1e9948d1b56bd68 + expression: 'last(/Proxy checks/web.page.regexp[https://koschei.fedoraproject.org/,,,Package summary])<>"Package summary"' + name: 'http-koschei connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 3434b19611b74ce49dbb4ebbae0e71a9 + name: http-mirrorlist + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64&country=global,,,development]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 0d99a7de0ca94563b556cfc08eb39702 + expression: 'last(/Proxy checks/web.page.regexp[https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64&country=global,,,development])<>"development"' + name: 'http-mirrorlist connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: f3b7373f76f5430f817532aa33104387 + name: http-moby-regsitry + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://registry.fedoraproject.org/v2/,,,{}]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: 09fa67873d3745268a0a3f06c9c68a02 + expression: 'last(/Proxy checks/web.page.regexp[https://registry.fedoraproject.org/v2/,,,{}])<>"{}"' + name: 'http-moby-gresitry connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity - uuid: dc1cf4b6e1a643e5802428a6d37ab36c name: http-release-monitoring.org type: ZABBIX_ACTIVE @@ -126,7 +391,7 @@ zabbix_export: value: infra triggers: - uuid: 1861890b34894f27b1be9380f58c82b9 - expression: 'last(/Proxy HTTPd checks/web.page.regexp[https://release-monitoring.org/,,,Watch for releases of your favorite projects])<>"Watch for releases of your favorite projects"' + expression: 'last(/Proxy checks/web.page.regexp[https://release-monitoring.org/,,,Watch for releases of your favorite projects])<>"Watch for releases of your favorite projects"' name: 'http-release-monitoring.org connection failed' priority: AVERAGE tags: @@ -134,6 +399,27 @@ zabbix_export: value: availability - tag: scope value: connectivity + - uuid: d061c00b873f4777bc4f14679366062e + name: http-waiverdb + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://waiverdb-web-waiverdb.apps.ocp.fedoraproject.org/api/v1.0/waivers/,,,first]' + delay: 5m + value_type: CHAR + trends: '0' + timeout: 6s + tags: + - tag: component + value: infra + triggers: + - uuid: aaa3e2d4fb9d41cba1f5007c9521837d + expression: 'last(/Proxy checks/web.page.regexp[https://waiverdb-web-waiverdb.apps.ocp.fedoraproject.org/api/v1.0/waivers/,,,first])<>"first"' + name: 'http-waiverdb connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity tags: - tag: application value: proxies diff --git a/roles/httpd/proxy/tasks/main.yml b/roles/httpd/proxy/tasks/main.yml index a9e4e9b8b5..04bb0a41e5 100644 --- a/roles/httpd/proxy/tasks/main.yml +++ b/roles/httpd/proxy/tasks/main.yml @@ -115,27 +115,9 @@ notify: - Reload systemd -# Zabbix monitoring of the proxy sites & ticketkeys -- name: Zabbix API Block - vars: - ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" - ansible_network_os: "{{ zabbix_network_os }}" - ansible_connection: "{{ zabbix_connection }}" - ansible_httpapi_port: "{{ zabbix_httpapi_port }}" - ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" - ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" - ansible_host: "{{ zabbix_server }}" - ansible_zabbix_url_path: "{{ zabbix_url_path }}" +- name: Configure proxy http/misc monitoring in Zabbix + ansible.builtin.include_tasks: monitoring.yml tags: - httpd/proxy + - zabbix_agent - zabbix_api - block: - - name: Import Proxy HTTPd checks template - community.zabbix.zabbix_template: - template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" - state: present - - name: Add self to Proxy checks template in Zabbix - community.zabbix.zabbix_host: - host_name: "{{ inventory_hostname }}" - link_templates: Proxy HTTPd checks - force: false diff --git a/roles/httpd/proxy/tasks/monitoring.yml b/roles/httpd/proxy/tasks/monitoring.yml new file mode 100644 index 0000000000..8c9c32254b --- /dev/null +++ b/roles/httpd/proxy/tasks/monitoring.yml @@ -0,0 +1,74 @@ +# Custom SELinux requirements for Zabbix to run TCP port checks +- name: Ensure a directory exists for Proxy+Zabbix selinux module + ansible.builtin.file: + path: /usr/local/share/zabbix + state: directory + mode: '0755' + tags: + - selinux + - httpd/proxy + - zabbix_agent + +- name: Copy Proxy Zabbix SELinux module + ansible.builtin.copy: + src: zabbix-selinux.te + dest: /usr/local/share/zabbix/zabbix_proxy.te + owner: root + group: root + mode: '0644' + register: selinux_zabbix_file + tags: + - selinux + - httpd/proxy + - zabbix_agent + +- name: Compile and install SELinux module + ansible.builtin.include_tasks: "{{ tasks_path }}/compile-selinux.yml" + vars: + selinux_module_dir: /usr/local/share/zabbix + selinux_module_name: zabbix_proxy + when: selinux_zabbix_file.changed # noqa: no-handler + tags: + - selinux + - httpd/proxy + - zabbix_agent + +# Zabbix monitoring of the proxy sites & ticketkeys +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - httpd/proxy + - zabbix_api + block: + - name: Import Proxy checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" + state: present + run_once: true + + - name: Import Proxy internal checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template-internal.yml') }}" + state: present + run_once: true + + - name: Add self to Proxy checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Proxy checks + force: false + + - name: Add self to Proxy internal checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Proxy checks - internal + force: false + when: "'proxies_rdu3' in group_names" diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 b/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 index f5af7ffd83..25da0d1200 100644 --- a/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 +++ b/roles/httpd/reverseproxy/templates/reversepassproxy.conf-nonopenshift-rdu3 @@ -50,9 +50,9 @@ RewriteRule .* "balancer://{{ balancer_name }}-websocket%{REQUEST_URI}" [P] {% for member in balancer_members %} {% if http_not_https_yes_this_is_insecure_and_i_feel_bad %} - BalancerMember "http://{{ member }}" + BalancerMember "http://{{ member }}" {{ proxyopts|default('') }} {% else %} - BalancerMember "https://{{ member }}" + BalancerMember "https://{{ member }}" {{ proxyopts|default('') }} {% endif %} {% endfor %} diff --git a/roles/httpd/website/templates/website.conf b/roles/httpd/website/templates/website.conf index a94bd10b1a..94daaa29e4 100644 --- a/roles/httpd/website/templates/website.conf +++ b/roles/httpd/website/templates/website.conf @@ -142,13 +142,29 @@ ProxyRequests Off ProxyVia Off +{% if site_name == 'koji.fedoraproject.org' or site_name == 'riscv-koji.fedoraproject.org' %} + + # Long timeout for koji operations (completeBuild with texlive, watch-task, watch-logs) + ProxyTimeout 10800 +{% endif %} + +{% if site_name == 'koji.fedoraproject.org' or site_name == 'riscv-koji.fedoraproject.org' or site_name == 'src.fedoraproject.org' %} + # We allow POST thru anubis, but we are seeing a sporadic EOF error with replies + # coming from the backend. See https://forge.fedoraproject.org/infra/tickets/issues/12913 + # + # So, just bypass anubis for POST's + # + RewriteEngine On + RewriteCond %{REQUEST_METHOD} POST + RewriteRule ^(.*)$ http://127.0.0.1:8345$1 [P,L] +{% endif %} {% if site_name.startswith('openqa') %} # Openqa uses websockets, so allow them through anubis proxying. - ProxyPass / http://127.0.0.1:8987/ upgrade=websocket + ProxyPass / http://127.0.0.1:8987/ upgrade=websocket keepalive=on ttl=15 ProxyPassReverse / http://127.0.0.1:8987/ {% else %} - ProxyPass / http://127.0.0.1:8987/ + ProxyPass / http://127.0.0.1:8987/ keepalive=on ttl=15 ProxyPassReverse / http://127.0.0.1:8987/ {% endif %} {% else %} diff --git a/roles/ipa/server/files/zabbix/template-ipa.yml b/roles/ipa/server/files/zabbix/template-ipa.yml index c5cd7590c6..670766c363 100644 --- a/roles/ipa/server/files/zabbix/template-ipa.yml +++ b/roles/ipa/server/files/zabbix/template-ipa.yml @@ -31,6 +31,382 @@ zabbix_export: name: 'IPA Backups out of date' opdata: 'Last IPA backup: {ITEM.LASTVALUE}' priority: HIGH + - uuid: a96ec3f5464447ea81acbd970c2c4317 + name: 'IPA Healthcheck - certmonger status' + type: DEPENDENT + key: ipa.heathcheck.certmonger + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="certmonger"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: 7bd9b1b5c2b949feb7f02f34b3469534 + expression: 'last(/IPA Monitoring/ipa.heathcheck.certmonger)=0' + name: 'IPA Healthcheck - Certmonger is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: dc2c79b597244634a0af1b69929bae04 + name: 'IPA Healthcheck - chronyd status' + type: DEPENDENT + key: ipa.heathcheck.chronyd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="chronyd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: ecfe65f4a9d04728a959255918262ae8 + expression: 'last(/IPA Monitoring/ipa.heathcheck.chronyd)=0' + name: 'IPA Healthcheck - Chronyd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: debd42eea62d43d98ba6d40cf250ef84 + name: 'IPA Healthcheck - criticals' + type: DEPENDENT + key: ipa.heathcheck.critical + delay: '0' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_healthcheck{result="CRITICAL"}' + - value + - '' + error_handler: CUSTOM_VALUE + error_handler_params: '0' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: d1945ad2ed56480c946feb7b06650567 + name: 'IPA Healthcheck - dirsrv status' + type: DEPENDENT + key: ipa.heathcheck.dirsrv + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="dirsrv"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: b7efb68e7ee1404b966144818f432fbf + expression: 'last(/IPA Monitoring/ipa.heathcheck.dirsrv)=0' + name: 'IPA Healthcheck - Dirsrv is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 7aba7dae57994c718eae5a91810e5de3 + name: 'IPA Healthcheck - errors' + type: DEPENDENT + key: ipa.heathcheck.errors + delay: '0' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_healthcheck{result="ERROR"}' + - value + - '' + error_handler: CUSTOM_VALUE + error_handler_params: '0' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: f48be409cff9497d85090c0d01a4b3c7 + expression: 'last(/IPA Monitoring/ipa.heathcheck.errors)>0' + name: 'IPA Healthcheck - Errors reported' + priority: HIGH + - uuid: 5072ed9c95fc4dd8ab498b22c03e2d68 + name: 'IPA Healthcheck - gssproxy status' + type: DEPENDENT + key: ipa.heathcheck.gssproxy + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="gssproxy"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: beeea8f684a241c4972501f9a58515f7 + expression: 'last(/IPA Monitoring/ipa.heathcheck.gssproxy)=0' + name: 'IPA Healthcheck - GSSproxy is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 38432d1a65a448e3aa0c14dbea5502a6 + name: 'IPA Healthcheck - httpd status' + type: DEPENDENT + key: ipa.heathcheck.httpd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="httpd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: a204143b9ac94b7c9d3a71a54b8149c3 + expression: 'last(/IPA Monitoring/ipa.heathcheck.httpd)=0' + name: 'IPA Healthcheck - HTTPd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 4211bbb549354421a3f223b5bdbb0ddc + name: 'IPA Healthcheck - ipa_otpd status' + type: DEPENDENT + key: ipa.heathcheck.ipa_otpd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="ipa_otpd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: f7e5b0ac99da49d6bbd6eaf5b522e20c + expression: 'last(/IPA Monitoring/ipa.heathcheck.ipa_otpd)=0' + name: 'IPA Healthcheck - IPA-OTPd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 5ad91fe41cc64843b414e9de89505ef6 + name: 'IPA Healthcheck - kadmin status' + type: DEPENDENT + key: ipa.heathcheck.kadmin + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="kadmin"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: efa252721828486697c667a003237ef2 + expression: 'last(/IPA Monitoring/ipa.heathcheck.kadmin)=0' + name: 'IPA Healthcheck - KAdmin is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: d2c1f01faa7441bdb9757725728cf3f8 + expression: 'last(/IPA Monitoring/ipa.heathcheck.kadmin)=0' + name: 'IPA Healthcheck - Krb5kdc is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 713f0ae284ee49eb9335bedd14f2c986 + expression: 'last(/IPA Monitoring/ipa.heathcheck.kadmin)=0' + name: 'IPA Healthcheck - PKI-Tomcat is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 1c787c3c0acb4c51b2c2747cf4dfbf4a + name: 'IPA Healthcheck - krb5kdc status' + type: DEPENDENT + key: ipa.heathcheck.krb5kdc + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="krb5kdc"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: bfcf381c945e45b2b1c7bdabebc9886d + name: 'IPA Healthcheck - sssd status' + type: DEPENDENT + key: ipa.heathcheck.sssd + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="sssd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + triggers: + - uuid: df7c3371fc904515915c50e4b3d3b0ce + expression: 'last(/IPA Monitoring/ipa.heathcheck.sssd)=0' + name: 'IPA Healthcheck - SSSd is not running' + priority: AVERAGE + tags: + - tag: scope + value: availability + - uuid: 78857b815aa344bbbdbe6e36a9005657 + name: 'IPA Healthcheck - pki-tomcat status' + type: DEPENDENT + key: ipa.heathcheck.tomcat + delay: '0' + valuemap: + name: 'Service status' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_service_state{service="pki_tomcatd"}' + - value + - '' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: 604059d7f8ca4062aec34a7fbe8f5b62 + name: 'IPA Healthcheck - warnings' + type: DEPENDENT + key: ipa.heathcheck.warning + delay: '0' + preprocessing: + - type: PROMETHEUS_PATTERN + parameters: + - 'ipa_healthcheck{result="WARNING"}' + - value + - '' + error_handler: CUSTOM_VALUE + error_handler_params: '0' + master_item: + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: a44655ad1c974ea28ef22634afa1ca01 + name: 'IPA Healthcheck raw output' + type: ZABBIX_ACTIVE + key: 'vfs.file.contents[/etc/zabbix/ipa-healthcheck.log]' + delay: 5m + history: 1h + value_type: TEXT + trends: '0' + timeout: 15s + tags: + - tag: component + value: ipa + - tag: type + value: healthcheck + - uuid: 93b94a89acdb40f6a40fe5a1bfd49b49 + name: 'IPA Healthcheck logfile age' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/etc/zabbix/ipa-healthcheck.log]' + delay: 5m + history: 7d + units: unixtime + description: 'Verify the ipa-healthcheck cron is still running' + tags: + - tag: component + value: ipa + - tag: type + value: fileage + triggers: + - uuid: 2429f94bc41845a09a7f7ef5277e836c + expression: 'change(/IPA Monitoring/vfs.file.time[/etc/zabbix/ipa-healthcheck.log])>600' + name: 'IPA Healthcheck logfile is too old' + priority: AVERAGE + description: 'The healthcheck cron should run every 300s' - uuid: b6f2575965414e9b8a50e7e2a2aec586 name: 'http-ipa-internal check' type: ZABBIX_ACTIVE @@ -51,3 +427,11 @@ zabbix_export: tags: - tag: application value: ipa + valuemaps: + - uuid: 59ebe776ee264da79ea1af894847fbe3 + name: 'Service status' + mappings: + - value: '1' + newvalue: Up + - value: '0' + newvalue: Down diff --git a/roles/ipsilon/templates/httpd.conf.j2 b/roles/ipsilon/templates/httpd.conf.j2 index 0764c10eec..b2b8256a5e 100644 --- a/roles/ipsilon/templates/httpd.conf.j2 +++ b/roles/ipsilon/templates/httpd.conf.j2 @@ -47,6 +47,7 @@ WSGIApplicationGroup %{GLOBAL} AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:/etc/krb5.HTTP_id{{ env_suffix }}.fedoraproject.org.keytab AuthType GSSAPI + BrowserMatch Windows gssapi-no-negotiate # This is off because Apache (and thus mod_auth_gssapi) doesn't know this is proxied over TLS GssapiSSLonly Off GssapiLocalName on diff --git a/roles/ipsilon/templates/openidc.staging.static.j2 b/roles/ipsilon/templates/openidc.staging.static.j2 index 938d65655f..f4eaca3934 100644 --- a/roles/ipsilon/templates/openidc.staging.static.j2 +++ b/roles/ipsilon/templates/openidc.staging.static.j2 @@ -944,6 +944,33 @@ tahrir default_max_age=null tahrir default_acr_values=null tahrir client_secret_expires_at=0 +tahrir-frontend client_name="Badges Staging" +tahrir-frontend client_secret="" +tahrir-frontend redirect_uris=["https://badges.stg.fedoraproject.org/callback"] +tahrir-frontend client_uri="https://badges.stg.fedoraproject.org/" +tahrir-frontend ipsilon_internal={"type":"static","client_id":"tahrir-frontend","trusted":true} +tahrir-frontend contacts=["admin@fedoraproject.org"] +tahrir-frontend client_id=null +tahrir-frontend policy_uri="https://fedoraproject.org/wiki/Legal:PrivacyPolicy" +tahrir-frontend grant_types="authorization_code" +tahrir-frontend response_types="code" +tahrir-frontend application_type="native" +tahrir-frontend subject_type="public" +tahrir-frontend logo_uri=null +tahrir-frontend tos_uri=null +tahrir-frontend jwks_uri=null +tahrir-frontend jwks=null +tahrir-frontend sector_identifier_uri=null +tahrir-frontend request_uris=[] +tahrir-frontend require_auth_time=null +tahrir-frontend token_endpoint_auth_method="none" +tahrir-frontend id_token_signed_response_alg="RS256" +tahrir-frontend request_object_signing_alg="none" +tahrir-frontend initiate_login_uri=null +tahrir-frontend default_max_age=null +tahrir-frontend default_acr_values=null +tahrir-frontend client_secret_expires_at=0 + mailman3 client_name="Mailman Staging" mailman3 client_secret="{{ mailman_stg_oidc_pass }}" mailman3 redirect_uris=["https://lists.stg.fedoraproject.org/accounts/fedora/login/callback/", "https://lists.stg.fedorahosted.org/accounts/fedora/login/callback/", "https://lists.stg.pagure.io/accounts/fedora/login/callback/"] diff --git a/roles/kickstarts/tasks/main.yml b/roles/kickstarts/tasks/main.yml index a3e40acefd..f31e889926 100644 --- a/roles/kickstarts/tasks/main.yml +++ b/roles/kickstarts/tasks/main.yml @@ -8,6 +8,7 @@ - kvm-fedora-s390x - kvm-rhel - kvm-rhel-8 + - kvm-rhel-10 - hardware-rhel-9-08disk - hardware-rhel-9-06disk - hardware-rhel-9-06disk-aarch64 diff --git a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 index eee3d4c7c5..d8b49c1b4f 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-06disk-aarch64.j2 @@ -1,11 +1,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-aarch64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/aarch64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-aarch64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/aarch64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/aarch64/crb/ # Firewall configuration firewall --disabled @@ -84,6 +84,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 index 0a751643bf..ba392a0014 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-08disk.j2 @@ -5,11 +5,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled @@ -97,6 +97,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 index b6018af9ba..9617db767a 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk-copr.j2 @@ -5,11 +5,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled @@ -127,6 +127,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 index ea06369b52..f3c925ae96 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-10disk.j2 @@ -5,11 +5,11 @@ # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled @@ -103,6 +103,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 index 979c4d8106..79e278d159 100644 --- a/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-10-nodisk.j2 @@ -2,14 +2,12 @@ ## This kickstart is for Dell systems with 8 disks. It will build either a virthost or cloud. ## -# Use network installation -vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/baseos/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/appstream/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel10/10.0/repos/x86_64/crb/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ # Firewall configuration firewall --disabled @@ -56,6 +54,7 @@ patch postfix rsync screen +selinux-policy-extra strace s-nail tmpwatch diff --git a/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 b/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 index 682a311e61..48d37f5235 100644 --- a/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 +++ b/roles/kickstarts/templates/hardware-rhel-9-08disk.j2 @@ -7,11 +7,11 @@ auth --enableshadow --passalgo=sha512 # Use network installation vnc --password "{{ kickstart_vnc_password }}" # Use network install -url --url=http://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ -repo --name=epel --baseurl=http://infrastructure.fedoraproject.org/pub/epel/9/Everything/x86_64/ -repo --name="net-baseos" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-baseos-rpms/ -repo --name="net-appstream" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-appstream-rpms/ -repo --name="net-crb" --baseurl=http://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/codeready-builder-for-rhel-9-x86_64-rpms/ +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/9/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-baseos-rpms/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/rhel-9-for-x86_64-appstream-rpms/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel9/x86_64/codeready-builder-for-rhel-9-x86_64-rpms/ # Firewall configuration firewall --disabled diff --git a/roles/kickstarts/templates/kvm-rhel-10.j2 b/roles/kickstarts/templates/kvm-rhel-10.j2 new file mode 100644 index 0000000000..6ceb468ce3 --- /dev/null +++ b/roles/kickstarts/templates/kvm-rhel-10.j2 @@ -0,0 +1,77 @@ +text +skipx +# License Agreement +eula --agreed +# Network information + +# Setup Repository info +url --url=https://infrastructure.fedoraproject.org/repo/rhel/RHEL10-x86_64/ +repo --name=epel --baseurl=https://infrastructure.fedoraproject.org/pub/epel/10/Everything/x86_64/ +repo --name="net-baseos" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/baseos/ +repo --name="net-appstream" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/appstream/ +repo --name="net-crb" --baseurl=https://infrastructure.fedoraproject.org/repo/rhel/rhel10/10/repos/x86_64/crb/ +# Run the Setup Agent on first boot +firstboot --disable +# Keyboard layouts +keyboard --vckeymap=us --xlayouts='us' +# System language +lang en_US.UTF-8 --addsupport=en_GB.UTF-8 +# Root password +rootpw --iscrypted "{{ kickstart_initial_password_encrypted }}" +# System timezone +timezone UTC --utc +# System bootloader configuration +zerombr +bootloader --append="net.ifnames=0 crashkernel=auto" --location=mbr --boot-drive=vda +# Partition clearing information +clearpart --initlabel --all +# Filesystem Data +reqpart --add-boot +part pv.100 --fstype="lvmpv" --size=1000 --grow +volgroup vg_vm --pesize=4096 pv.100 +logvol / --fstype="xfs" --size=10000 --name=LogVol00 --vgname=vg_vm --grow +logvol swap --fstype="swap" --size=8192 --name=LogVol01 --vgname=vg_vm +# What to do at the end +reboot + +%packages +@core +bash-completion +bind-utils +cronie-noanacron +crontabs +iptables-services +nfs-utils +nmap-ncat +openssh-clients +openssh-server +patch +postfix +python3 +python3-libselinux +rsync +rsyslog +selinux-policy-targeted-extra +strace +telnet +tmpwatch +tmux +traceroute +vim-enhanced +yum +yum-utils +zsh +-biosdevname +-cronie-anacron +-subscription-manager +-insights-client +-rhc +-iwl* +-yum-rhn-plugin +%end + +%post --nochroot --log=/mnt/sysimage/root/post.output --erroronfail +mkdir /mnt/sysimage/root/tmp +chroot /mnt/sysimage /usr/bin/curl https://infrastructure.fedoraproject.org/rhel/ks/post/rhel10-post.sh -o /root/tmp/rhel10-post.sh +chroot /mnt/sysimage /bin/bash /root/tmp/rhel10-post.sh +%end diff --git a/roles/koji_builder/tasks/main.yml b/roles/koji_builder/tasks/main.yml index a7ca34ae7e..b6344b32a0 100644 --- a/roles/koji_builder/tasks/main.yml +++ b/roles/koji_builder/tasks/main.yml @@ -226,7 +226,7 @@ - name: Mock site-defaults.cfg ansible.builtin.template: src=builders/site-defaults.cfg dest=/etc/mock/site-defaults.cfg mode=0644 owner=root group=mock - when: not inventory_hostname.startswith(('bkernel')) + when: "'secureboot' not in group_names" tags: - koji_builder - site-defaults diff --git a/roles/koji_builder/templates/osbuildapi-update-nft.sh b/roles/koji_builder/templates/osbuildapi-update-nft.sh index 7c729551ad..79fce3aa3a 100644 --- a/roles/koji_builder/templates/osbuildapi-update-nft.sh +++ b/roles/koji_builder/templates/osbuildapi-update-nft.sh @@ -14,16 +14,16 @@ # 2. Checking if it exists and failing with a "nice" message, if it doesn't. # 3. Waiting for it to exist. -# if ! nft list set ip filter osbuildapi >& /dev/null; then +# if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then # exit 0 # fi -if ! nft list set ip filter osbuildapi >& /dev/null; then - echo "OSBUILD: nft set ip filter osbuildapi: Doesn't exist" 1>&2; +if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then + echo "OSBUILD: nft set {{nft_table_filter}} osbuildapi: Doesn't exist" 1>&2; exit 2 fi -while ! nft list set ip filter osbuildapi >& /dev/null; do +while ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; do sleep 10 done @@ -47,15 +47,15 @@ NEWIDENTITYIPS=`echo "$RESOLVEQUERY" | grep link | sed -E 's/.* ([0-9]+\.[0-9]+\ # Empty the filter: We do this at the end for a small window.` # NOTE: We aren't flushing old entries anymore. # See commit: e7b50aaee469fdded0ea650c7e7f4dd06e929609 -# nft flush set ip filter osbuildapi +# nft flush set {{nft_table_filter}} osbuildapi # Add the IPs... for j in $NEWIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done for j in $NEWIDENTITYIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done diff --git a/roles/koji_hub/files/zabbix-template.yml b/roles/koji_hub/files/zabbix-template.yml new file mode 100644 index 0000000000..f06c2e96a0 --- /dev/null +++ b/roles/koji_hub/files/zabbix-template.yml @@ -0,0 +1,59 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: cd834c9a477042fdadba6fb6c1cdcc56 + template: 'Koji checks' + name: 'Koji checks' + description: 'Checks on Koji wellness' + groups: + - name: Fedora + items: + - uuid: dda31efd4386498a9b3176ad80e50eb2 + name: 'http-koji localhost' + type: ZABBIX_ACTIVE + key: 'web.page.regexp[http://localhost/koji/,,,Recent]' + value_type: CHAR + trends: '0' + tags: + - tag: application + value: koji + - tag: component + value: infra + triggers: + - uuid: f95efffe36024e8a94b5f8fa582cc86b + expression: 'last(/Koji checks/web.page.regexp[http://localhost/koji/,,,Recent])<>"Recent"' + name: 'http-koji localhost connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + - uuid: 6dcf20635db1441892d51884bff34037 + name: http-koji + type: ZABBIX_ACTIVE + key: 'web.page.regexp[https://{$KOJI.HOST}/koji/hosts,,,fedoraproject.org]' + value_type: CHAR + trends: '0' + tags: + - tag: application + value: koji + - tag: component + value: infra + triggers: + - uuid: f85aa3969eb241ed857e21e07964ca5c + expression: 'last(/Koji checks/web.page.regexp[https://{$KOJI.HOST}/koji/hosts,,,fedoraproject.org])<>"fedoraproject.org"' + name: 'http-koji connection failed' + priority: AVERAGE + tags: + - tag: scope + value: availability + - tag: scope + value: connectivity + macros: + - macro: '{$KOJI.HOST}' + value: koji.fedoraproject.org + description: 'Target for koji checks (override for stg)' diff --git a/roles/koji_hub/tasks/main.yml b/roles/koji_hub/tasks/main.yml index 06ae93fb6a..800d5c0dc1 100644 --- a/roles/koji_hub/tasks/main.yml +++ b/roles/koji_hub/tasks/main.yml @@ -484,3 +484,28 @@ tags: - koji_hub - koji_hub/oomd + +# Zabbix monitoring of the koji sites +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - koji_hub + - zabbix_api + block: + - name: Import Proxy checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" + state: present + - name: Add self to Koji checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Koji checks + force: false diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2 index af8ea40c5a..05f34eadfe 100644 --- a/roles/koji_hub/templates/hub.conf.j2 +++ b/roles/koji_hub/templates/hub.conf.j2 @@ -249,7 +249,6 @@ sidetag = tag f45-build :: allow tag f44-build :: allow tag f43-build :: allow - tag f42-build :: allow tag eln-build :: allow {% for tag in epel_tags %} tag {{ tag }}-build :: allow diff --git a/roles/koji_hub/templates/kojihub.conf.j2 b/roles/koji_hub/templates/kojihub.conf.j2 index 7a28811667..0bb3e97f05 100644 --- a/roles/koji_hub/templates/kojihub.conf.j2 +++ b/roles/koji_hub/templates/kojihub.conf.j2 @@ -3,6 +3,7 @@ # KeepAlive On +KeepAliveTimeout 30 MaxKeepAliveRequests 0 Alias /kojihub /usr/share/koji-hub/kojiapp.py diff --git a/roles/logdetective/files/logdetective.service b/roles/logdetective/files/logdetective.service new file mode 100644 index 0000000000..2950d33a27 --- /dev/null +++ b/roles/logdetective/files/logdetective.service @@ -0,0 +1,15 @@ +[Unit] +Description=LogDetective compose stack +After=network-online.target nvidia-cdi-generate.service +Wants=network-online.target nvidia-cdi-generate.service + +[Service] +Type=simple +WorkingDirectory=/root/logdetective +ExecStart=/usr/bin/podman-compose -f /root/logdetective/docker-compose-prod.yaml up --abort-on-container-failure +ExecStopPost=/usr/bin/podman-compose -f /root/logdetective/docker-compose-prod.yaml down +Restart=on-failure +RestartSec=20 + +[Install] +WantedBy=multi-user.target diff --git a/roles/logdetective/handlers/main.yml b/roles/logdetective/handlers/main.yml new file mode 100644 index 0000000000..c28484f735 --- /dev/null +++ b/roles/logdetective/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: Reload systemd + ansible.builtin.systemd: + daemon_reload: true diff --git a/roles/logdetective/tasks/main.yml b/roles/logdetective/tasks/main.yml index b3f6a414d5..973d648c1d 100644 --- a/roles/logdetective/tasks/main.yml +++ b/roles/logdetective/tasks/main.yml @@ -144,3 +144,22 @@ with_items: - http - https + +- name: Install logdetective systemd service + ansible.builtin.copy: + src: logdetective.service + dest: /etc/systemd/system/logdetective.service + owner: root + group: root + mode: "0644" + notify: + - Reload systemd + tags: + - config + +- name: Enable and start logdetective service + ansible.builtin.systemd: + name: logdetective.service + enabled: true + state: started + daemon_reload: true diff --git a/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch b/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch new file mode 100644 index 0000000000..c19234f2a7 --- /dev/null +++ b/roles/mailman3/files/mailman_patch/xapian_haystack_term_too_long.patch @@ -0,0 +1,16 @@ +diff --git xapian_backend.py xapian_backend.py +index 05e8fed..c2bdd95 100755 +--- xapian_backend.py ++++ xapian_backend.py +@@ -498,7 +498,10 @@ class XapianSearchBackend(BaseSearchBackend): + document.add_term(document_id) + + # finally, replace or add the document to the database +- database.replace_document(document_id, document) ++ try: ++ database.replace_document(document_id, document) ++ except xapian.InvalidArgumentError as ex: ++ sys.stderr.write(str(ex) + '\n') + + except UnicodeDecodeError: + sys.stderr.write('Chunk failed.\n') diff --git a/roles/mailman3/tasks/main.yml b/roles/mailman3/tasks/main.yml index 384a25e9e1..339f732473 100644 --- a/roles/mailman3/tasks/main.yml +++ b/roles/mailman3/tasks/main.yml @@ -436,6 +436,16 @@ notify: - Restart mailman3 +# This is needed till https://github.com/notanumber/xapian-haystack/issues/77 +# is resolved +- name: Apply xapian_haystack patch + ansible.posix.patch: + src: mailman_patch/xapian_haystack_term_too_long.patch + basedir: /usr/lib/python3.9/site-packages/ + tags: + - mailman + - patch + # Memcached - name: Set the memcached sysconfig file ansible.builtin.copy: diff --git a/roles/mailman3/templates/settings.py.j2 b/roles/mailman3/templates/settings.py.j2 index 6124c75978..cdba26f6f0 100644 --- a/roles/mailman3/templates/settings.py.j2 +++ b/roles/mailman3/templates/settings.py.j2 @@ -370,7 +370,7 @@ LOGGING = { CACHES = { 'default': { 'BACKEND': 'django.core.cache.backends.memcached.PyLibMCCache', - 'LOCATION': 'memcached02:11211', + 'LOCATION': 'memcached01:11211', } } diff --git a/roles/mediawiki/templates/LocalSettings.php.fp.j2 b/roles/mediawiki/templates/LocalSettings.php.fp.j2 index ed749e2367..2abf8b1cdf 100644 --- a/roles/mediawiki/templates/LocalSettings.php.fp.j2 +++ b/roles/mediawiki/templates/LocalSettings.php.fp.j2 @@ -158,7 +158,7 @@ $wgParserCacheType = CACHE_MEMCACHED; $wgMessageCacheType = CACHE_MEMCACHED; $wgSessionsInMemcached = true; $wgMemCachedServers = array ( - 0 => 'memcached02:11211', + 0 => 'memcached01:11211', ); ## To enable image uploads, make sure the 'images' directory diff --git a/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes b/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes index 869fd96b6e..58bcd29e24 100644 --- a/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes +++ b/roles/mirrormanager/mirrorlist_proxy/files/restart-mirrorlist-processes @@ -52,7 +52,7 @@ else fi # check mirrorlist2 (old protbuf cache and see that it's processing ok) -curl -q -H mirrors.fedoraproject.org ${mirrorlist2} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null +curl -q -H 'Host: mirrors.fedoraproject.org' ${mirrorlist2} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null if [ $? != 0 ]; then echo "ERROR: mirrorlist2 not processing correctly" exit 1 @@ -72,7 +72,7 @@ check_and_restart mirrorlist1 sleep ${TIME_RESTART} -curl -q -H mirrors.fedoraproject.org ${mirrorlist1} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null +curl -q -H 'Host: mirrors.fedoraproject.org' ${mirrorlist1} -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 | grep "sha512" >/dev/null if [ $? != 0 ]; then echo "ERROR: mirrorlist1 did not restart correctly" exit 1 @@ -97,7 +97,7 @@ sleep 1 check_and_restart mirrorlist2 sleep ${TIME_RESTART} -curl -q -H mirrors.fedoraproject.org ${mirrorlist2} -o/dev/null -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 +curl -q -H 'Host: mirrors.fedoraproject.org' ${mirrorlist2} -o/dev/null -s -f --retry 50 --retry-delay 10 --retry-connrefused --retry-max-time 180 if [ $? != 0 ]; then echo "ERROR: mirrorlist2 did not restart correctly" exit 1 diff --git a/roles/nagios_server/files/nagios/services/dns.cfg b/roles/nagios_server/files/nagios/services/dns.cfg deleted file mode 100644 index dbf24b4007..0000000000 --- a/roles/nagios_server/files/nagios/services/dns.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - hostgroup_name dns - service_description DNS: fp.o - check_command check_dns_fpo - use criticaltemplate -} diff --git a/roles/nagios_server/files/nagios/services/haproxy.cfg b/roles/nagios_server/files/nagios/services/haproxy.cfg deleted file mode 100644 index d4e87d0314..0000000000 --- a/roles/nagios_server/files/nagios/services/haproxy.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - hostgroup_name proxies - service_description Check proxies for oversubscription - check_command check_by_nrpe!check_haproxy_conns - use defaulttemplate -} diff --git a/roles/nagios_server/files/nagios/services/procs.cfg b/roles/nagios_server/files/nagios/services/procs.cfg index c58c106347..7c4a867649 100644 --- a/roles/nagios_server/files/nagios/services/procs.cfg +++ b/roles/nagios_server/files/nagios/services/procs.cfg @@ -1,10 +1,3 @@ -define service { - hostgroup proxies - service_description Varnish Process - check_command check_by_nrpe!check_varnish_proc - use defaulttemplate -} - define service { hostgroup sign_bridge service_description Sigul bridge Process diff --git a/roles/nagios_server/files/nagios/services/rdu3_internal/certgetter.cfg b/roles/nagios_server/files/nagios/services/rdu3_internal/certgetter.cfg deleted file mode 100644 index 13bdc2e38e..0000000000 --- a/roles/nagios_server/files/nagios/services/rdu3_internal/certgetter.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - host_name certgetter01.rdu3.fedoraproject.org - service_description certgetter-http - check_command check_http!certgetter01.rdu3.fedoraproject.org - use defaulttemplate -} diff --git a/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg b/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg index 64ccda46fd..41e910cdac 100644 --- a/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg +++ b/roles/nagios_server/files/nagios/services/rdu3_internal/file_age.cfg @@ -1,30 +1,3 @@ -define service { - hostgroup_name proxies - service_description Check MirrorList 1 Cache - check_command check_by_nrpe!check_mirrorlist1_cache - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - hostgroup_name proxies - service_description Check MirrorList 2 Cache - check_command check_by_nrpe!check_mirrorlist2_cache - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - hostgroup_name proxies - service_description Check ostree summary age - check_command check_by_nrpe!check_ostree_summary_file_age - use defaulttemplate - check_interval 120 - notification_interval 130 -} - define service { host_name log01.rdu3.fedoraproject.org service_description Check Merged Log @@ -34,95 +7,3 @@ define service { notification_interval 130 event_handler restart_rsyslog } - -# Fedora Countme: -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme raw DB age - check_command check_by_nrpe!check_countme_fedora_raw - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme totals DB age - check_command check_by_nrpe!check_countme_fedora_tot - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme web DB1 age - check_command check_by_nrpe!check_countme_fedora_web1 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme web DB2 age - check_command check_by_nrpe!check_countme_fedora_web2 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check Fedora countme web DB3 age - check_command check_by_nrpe!check_countme_fedora_web3 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -# CentOS countme -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme raw DB age - check_command check_by_nrpe!check_countme_centos_raw - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme totals DB age - check_command check_by_nrpe!check_countme_centos_tot - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme web DB1 age - check_command check_by_nrpe!check_countme_centos_web1 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme web DB2 age - check_command check_by_nrpe!check_countme_centos_web2 - use defaulttemplate - check_interval 120 - notification_interval 130 -} - -define service { - host_name log01.rdu3.fedoraproject.org - service_description Check CentOS countme web DB3 age - check_command check_by_nrpe!check_countme_centos_web3 - use defaulttemplate - check_interval 120 - notification_interval 130 -} diff --git a/roles/nagios_server/files/nagios/services/rdu3_internal/pgsql.cfg b/roles/nagios_server/files/nagios/services/rdu3_internal/pgsql.cfg deleted file mode 100644 index 0ea186d0e8..0000000000 --- a/roles/nagios_server/files/nagios/services/rdu3_internal/pgsql.cfg +++ /dev/null @@ -1,14 +0,0 @@ -define service { - host_name db-koji01.rdu3.fedoraproject.org - service_description Check Koji DB - check_command check_pgsql!koji - use criticaltemplate -} - -define service { - host_name db-fas01.rdu3.fedoraproject.org - service_description Check FAS DB - check_command check_pgsql!fas2 - use criticaltemplate - servicegroups fas -} diff --git a/roles/nagios_server/files/nagios/services/ssh.cfg b/roles/nagios_server/files/nagios/services/ssh.cfg deleted file mode 100644 index 9a86529df5..0000000000 --- a/roles/nagios_server/files/nagios/services/ssh.cfg +++ /dev/null @@ -1,37 +0,0 @@ -define service { - hostgroup_name virtservers - service_description SSH-virtservers - check_command check_ssh - use defaulttemplate -} - -define service { - hostgroup_name bastion - service_description SSH-bastion - check_command check_ssh - use defaulttemplate -} - -#define service { -# hostgroup_name buildservers -# service_description SSH -# check_command check_ssh -# use defaulttemplate -# retry_interval 5 -# max_check_attempts 12 -#} - -#define service { -# hostgroup_name autoqa -# service_description SSH -# check_command check_ssh -# use autoqatemplate -#} - -# TODO: uncomment once retrace exists again -#define service { -# hostgroup_name retrace -# service_description SSH-retrace -# check_command check_ssh -# use retracetemplate -#} diff --git a/roles/nagios_server/files/nagios/services/ssl.cfg b/roles/nagios_server/files/nagios/services/ssl.cfg deleted file mode 100644 index 676492111f..0000000000 --- a/roles/nagios_server/files/nagios/services/ssl.cfg +++ /dev/null @@ -1,89 +0,0 @@ -define service { - hostgroup_name oneproxy - service_description https-admin.fedoraproject.org - check_command check_ssl_cert!admin.fedoraproject.org!60 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-translate.fedoraproject.org-cert - check_command check_ssl_cert!translate.fedoraproject.org!60 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-whatcanidoforfedora-cert - check_command check_ssl_cert!whatcanidoforfedora.org!25 - use defaulttemplate -} - -define service { - host_name pagure.io - service_description https-pagure-cert - check_command check_ssl_cert!pagure.io!25 - use defaulttemplate -} - -define service { - host_name stg.pagure.io - service_description https-pagure-stg-cert - check_command check_ssl_cert!stg.pagure.io!25 - use defaulttemplate -} - -# fedora coreos endpoints - -define service { - hostgroup_name oneproxy - service_description https-updates-coreos-cert - check_command check_ssl_cert!updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-raw-updates-coreos-cert - check_command check_ssl_cert!raw-updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-status-updates-coreos-cert - check_command check_ssl_cert!status.updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -define service { - hostgroup_name oneproxy - service_description https-status-raw-updates-coreos-cert - check_command check_ssl_cert!status.raw-updates.coreos.fedoraproject.org!25 - use defaulttemplate -} - -# ocp4 cluster prod - -define service { - hostgroup_name oneproxy - service_description https-ocp4-prod-cert - check_command check_ssl_cert!console-openshift-console.apps.ocp.fedoraproject.org!25 - use defaulttemplate -} - -# ocp4 cluster stg - -define service { - hostgroup_name oneproxy-stg - service_description https-ocp4-stg-cert - check_command check_ssl_cert!console-openshift-console.apps.ocp.stg.fedoraproject.org!25 - use defaulttemplate -} - -define service { - host_name retrace.fedoraproject.org - service_description http-cert-retrace.fedoraproject.org - check_command check_ssl_cert!retrace.fedoraproject.org!25 - use defaulttemplate -} diff --git a/roles/nagios_server/files/nagios/services/vpnclients.cfg b/roles/nagios_server/files/nagios/services/vpnclients.cfg deleted file mode 100644 index 13142f0f2c..0000000000 --- a/roles/nagios_server/files/nagios/services/vpnclients.cfg +++ /dev/null @@ -1,6 +0,0 @@ -define service { - hostgroup_name vpnclients - service_description vpnclients - check_command check_by_nrpe!check_openvpn_link - use defaulttemplate -} diff --git a/roles/nagios_server/tasks/main.yml b/roles/nagios_server/tasks/main.yml index b91c26fd47..1c07b3664a 100644 --- a/roles/nagios_server/tasks/main.yml +++ b/roles/nagios_server/tasks/main.yml @@ -182,7 +182,6 @@ - name: Copy /etc/nagios/services (RDU3 specific files) ansible.builtin.copy: src=nagios/services/rdu3_internal/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - - certgetter.cfg - db_backups.cfg - disk.cfg - fedora_messaging.cfg @@ -191,7 +190,6 @@ - locking.cfg - mailman.cfg - nrpe.cfg - - pgsql.cfg tags: - nagios_config - nagios_server @@ -202,7 +200,6 @@ - name: Copy /etc/nagios/services (RDU3 specific files) ansible.builtin.copy: src=nagios/services/rdu3_internal/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - - certgetter.cfg - db_backups.cfg - disk.cfg - fedora_messaging.cfg @@ -211,7 +208,6 @@ - locking.cfg - mailman.cfg - nrpe.cfg - - pgsql.cfg tags: - nagios_config - nagios_server @@ -223,19 +219,14 @@ ansible.builtin.copy: src=nagios/services/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - copr.cfg - - dns.cfg - - haproxy.cfg - memcached.cfg - nagios.cfg - pagure_redis.cfg - procs.cfg - raid.cfg - smtp-mm.cfg - - ssh.cfg - - ssl.cfg - swap.cfg - templates.cfg - - vpnclients.cfg - vpn_server.cfg tags: - nagios_config @@ -248,7 +239,6 @@ - name: Copy /etc/nagios/services (External) ansible.builtin.copy: src=nagios/services/{{ item }} dest=/etc/nagios/services/{{ item }} with_items: - - dns.cfg - smtp-mm.cfg - templates.cfg - ping-ipv6.cfg @@ -384,7 +374,6 @@ ansible.builtin.template: src=nagios/services/{{item}}.j2 dest=/etc/nagios/services/{{item}} mode=0644 owner=root group=root with_items: - ipa.cfg - - mirrorlist-proxies.cfg when: env == "production" and nagios_location == 'rdu3_internal' tags: - nagios_server diff --git a/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 b/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 index 8886bbf391..97d2a72f35 100644 --- a/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/ipa.cfg.j2 @@ -1,12 +1,3 @@ -define service { - host_name {% for host in groups['ipa'] %}{% if hostvars[host].nagios_Can_Connect == true %}{{host}},{% endif%}{% endfor %} - - service_description IPA Replication Status - check_command check_by_nrpe!check_ipa_replication - use lighttemplate - servicegroups ipa -} - define service { host_name {{ groups['ipa'][0] }} service_description IPA Free IDs diff --git a/roles/nagios_server/templates/nagios/services/mirrorlist-proxies.cfg.j2 b/roles/nagios_server/templates/nagios/services/mirrorlist-proxies.cfg.j2 deleted file mode 100644 index 9776422083..0000000000 --- a/roles/nagios_server/templates/nagios/services/mirrorlist-proxies.cfg.j2 +++ /dev/null @@ -1,8 +0,0 @@ -{% for host in groups['mirrorlist_proxies'] if hostvars[host].datacenter == datacenter %} -define service { - host_name {{ host }} - service_description {{ host }} mirrorlist docker container - check_command check_by_nrpe!check_mirrorlist_docker_proxy - use defaulttemplate -} -{% endfor %} diff --git a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 index 1a157ba035..3400960f36 100644 --- a/roles/nagios_server/templates/nagios/services/websites.cfg.j2 +++ b/roles/nagios_server/templates/nagios/services/websites.cfg.j2 @@ -1,122 +1,3 @@ -define service { - hostgroup_name proxies - service_description http-ipsilon - check_command check_website_ssl!id.fedoraproject.org!/!your Fedora Account - use websitetemplate -} - -define service { - hostgroup_name proxies - service_description http-mirrors.fedoraproject.org-mirrorlist - check_command check_website!mirrors.fedoraproject.org!/mirrorlist?repo=rawhide&arch=x86_64&country=global!development - use websitetemplate - servicegroups mirrorlist -} - -define service { - hostgroup_name proxies - service_description http-docs.fedoraproject.org - check_command check_website_ssl!docs.fedoraproject.org!/en-US/docs/index.html!Antora - use websitetemplate -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-accounts - check_command check_website_ssl!accounts.fedoraproject.org!/healthz/ready!OK - use websitetemplate -# servicegroups fas -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-bodhi - check_command check_website_ssl!bodhi.fedoraproject.org!/!Fedora - max_check_attempts 8 - use websitetemplate - servicegroups bodhi -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-bodhi2 - check_command check_website_ssl!bodhi.fedoraproject.org!/!Active Testers - max_check_attempts 8 - use websitetemplate -} - -define service { - hostgroup_name proxies - service_description http-koschei - check_command check_website_ssl!koschei.fedoraproject.org!/!Package summary - max_check_attempts 8 - use websitetemplate -} - -define service { - hostgroup_name proxies - service_description http-moby-registry - check_command check_website_ssl!registry.fedoraproject.org!/v2/!{} - max_check_attempts 8 - use websitetemplate -} - -define service { - host_name registry-cdn - service_description http-moby-registry-cdn - check_command check_website_ssl!cdn.registry.fedoraproject.org!/v2/!{} - max_check_attempts 8 - use websitetemplate -} - -define service { - host_name proxy01.fedoraproject.org, proxy10.fedoraproject.org - service_description http-oci-registry-api - check_command check_website_ssl!registry.fedoraproject.org!/v2/_catalog?last=fedora!fedora - use websitetemplate -} - -define service { - host_name proxy01.fedoraproject.org, proxy10.fedoraproject.org - service_description http-oci-registry-webui - check_command check_website_ssl!registry.fedoraproject.org!/v2/fedora/tags/list!rawhide - use websitetemplate -} - -# Some openshift apps -define service { - hostgroup_name proxies - service_description http-waiverdb - check_command check_website_ssl!waiverdb-web-waiverdb.apps.ocp.fedoraproject.org!/api/v1.0/waivers/!first - max_check_attempts 8 - use websitetemplate -} - -define service { - hostgroup_name proxies - service_description http-greenwave - check_command check_website_ssl!greenwave-web-greenwave.apps.ocp.fedoraproject.org!/api/v1.0/policies!bodhi_update_push_stable - max_check_attempts 8 - use websitetemplate -} - -## -## Individual hosts - -define service { - host_name status - service_description http-status.fedoraproject.org - check_command check_website_ssl!www.fedorastatus.org!/index.html!Fedora Infrastructure Status - use websitetemplate -} - -define service { - host_name lists.fedoraproject.org - service_description http-lists.fedoraproject.org - check_command check_website_ssl!lists.fedoraproject.org!/archives/!Fedora Mailing-Lists - use websitetemplate -} - {% if vars['nagios_location'] == 'rdu3_internal' %} ## ## Other Frontend Websites @@ -129,65 +10,6 @@ define service { use internalwebsitetemplate } -#define service { -# hostgroup_name fas -# service_description http-accounts -# check_command check_website!localhost!/accounts/help/get_help/user_telephone!emergency -# use internalwebsitetemplate -# servicegroups fas -#} - -define service { - hostgroup_name ipa - service_description http-ipa-internal - check_command check_website!localhost!/ipa/ui/!Identity Management - max_check_attempts 8 - use internalwebsitetemplate - event_handler restart_httpd -} - -define service { - hostgroup_name ocp_workers - service_description http-koschei-internal - check_command check_website_ssl!koschei.fedoraproject.org!/!Package summary - max_check_attempts 8 - use internalwebsitetemplate -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-fmn-web - check_command check_website_ssl!notifications.fedoraproject.org!/!FMN - use websitetemplate -} - -define service { - hostgroup_name proxies_ocp4 - service_description http-fmn-api - check_command check_website_ssl!fmn-api.apps.ocp.fedoraproject.org!/api/v1/healthz/ready!OK - use websitetemplate -} - -#define service { -# hostgroup_name packages -# service_description http-packages-internal -# check_command check_website!localhost!/packages/!Packages -# max_check_attempts 8 -# use internalwebsitetemplate -# event_handler restart_httpd -#} -# -#define service { -# hostgroup_name packages -# service_description http-packages-internal-bugstab -# check_command check_website!localhost!/packages/fcomm_connector/bugzilla/query/query_bugs/%7B%22filters%22:%7B%22package%22:%22nethack%22,%22version%22:%22%22%7D,%22rows_per_page%22:10,%22start_row%22:0%7D!total_rows -# max_check_attempts 8 -# use internalwebsitetemplate -# # When this thing dies, you usually just need to nuke /var/cache/fedoracommunity/bugzillacookies -# #event_handler nuke_bugzillacookies_handler -#} - - define service { hostgroup_name pkgs service_description http-pkgs-pagure @@ -195,44 +17,6 @@ define service { use websitetemplate } -define service { - hostgroup_name sundries - service_description http-freemedia-internal - check_command check_website!localhost!/freemedia/FreeMedia-form.html!Media - use internalwebsitetemplate - servicegroups freemedia -} - - -## Internal services - -define service { - hostgroup_name koji - service_description http-koji - check_command check_website!koji.fedoraproject.org!/koji/hosts!fedoraproject.org - use websitetemplate -} - -define service { - hostgroup_name koji - service_description http-koji-frontend - check_command check_website_ppc!localhost!/koji/!Recent - use ppc-secondarytemplate -} - -## Auxillary to websites but necessary to make them happen - -{% endif %} - -{% if vars['nagios_location'] == 'rdu3_internal' %} - -define service { - host_name mailman01.rdu3.fedoraproject.org - service_description http-mailman-internal - check_command check_website!mailman01.rdu3.fedoraproject.org!/archives/!Fedora Mailing-Lists - use websitetemplate -} - {% endif %} define service { @@ -242,11 +26,3 @@ define service { max_check_attempts 8 use websitetemplate } - -define service { - host_name pagure.io - service_description https://forge.fedoraproject.org/infra/tickets - check_command check_website_follow!pagure.io!https://pagure.io/fedora-infrastructure/issues!Issues - max_check_attempts 8 - use websitetemplate -} diff --git a/roles/nvidia-cdi/files/nvidia-cdi-generate.service b/roles/nvidia-cdi/files/nvidia-cdi-generate.service new file mode 100644 index 0000000000..e159d4e24c --- /dev/null +++ b/roles/nvidia-cdi/files/nvidia-cdi-generate.service @@ -0,0 +1,11 @@ +[Unit] +Description=Generate Nvidia CDI configuration +Before=logdetective.service + +[Service] +Type=oneshot +ExecStart=/usr/bin/nvidia-ctk cdi generate --output=/etc/cdi/nvidia.yaml +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/roles/nvidia-cdi/handlers/main.yml b/roles/nvidia-cdi/handlers/main.yml new file mode 100644 index 0000000000..c28484f735 --- /dev/null +++ b/roles/nvidia-cdi/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: Reload systemd + ansible.builtin.systemd: + daemon_reload: true diff --git a/roles/nvidia-cdi/tasks/main.yml b/roles/nvidia-cdi/tasks/main.yml new file mode 100644 index 0000000000..eeaa849c57 --- /dev/null +++ b/roles/nvidia-cdi/tasks/main.yml @@ -0,0 +1,41 @@ +--- +- name: Add nvidia-container-toolkit repo + ansible.builtin.get_url: + url: https://nvidia.github.io/libnvidia-container/stable/rpm/nvidia-container-toolkit.repo + dest: /etc/yum.repos.d/nvidia-container-toolkit.repo + mode: "0644" + tags: + - packages + +- name: Install nvidia-container-toolkit + ansible.builtin.package: + name: nvidia-container-toolkit + tags: + - packages + +- name: Ensure /etc/cdi directory exists + ansible.builtin.file: + path: /etc/cdi + state: directory + owner: root + group: root + mode: "0755" + +- name: Install nvidia-cdi-generate systemd service + ansible.builtin.copy: + src: nvidia-cdi-generate.service + dest: /etc/systemd/system/nvidia-cdi-generate.service + owner: root + group: root + mode: "0644" + notify: + - Reload systemd + tags: + - config + +- name: Enable and start nvidia-cdi-generate service + ansible.builtin.systemd: + name: nvidia-cdi-generate.service + enabled: true + state: started + daemon_reload: true diff --git a/roles/openshift-apps/badges/files/imagestream.yml b/roles/openshift-apps/badges/files/imagestream.yml index 1f724d219f..59bd546d7b 100644 --- a/roles/openshift-apps/badges/files/imagestream.yml +++ b/roles/openshift-apps/badges/files/imagestream.yml @@ -11,11 +11,11 @@ items: kind: ImageStream metadata: name: tahrir - # The Python 3.10 builder image + # The Python 3.13 builder image - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-310 + name: python-313 spec: lookupPolicy: local: false @@ -23,16 +23,16 @@ items: - name: latest from: kind: DockerImage - name: quay.io/fedora/python-310:latest + name: quay.io/fedora/python-313:latest importPolicy: scheduled: true referencePolicy: type: Source - # The Python 3.10 builder image plus custom packages + # The Python 3.13 builder image plus custom packages - apiVersion: image.openshift.io/v1 kind: ImageStream metadata: - name: python-310-custom-builder + name: python-313-custom-builder # Redis (for caching) - apiVersion: image.openshift.io/v1 kind: ImageStream diff --git a/roles/openshift-apps/badges/templates/Dockerfile-builder-image b/roles/openshift-apps/badges/templates/Dockerfile-builder-image index 1ff18aa2d4..32daa1a111 100644 --- a/roles/openshift-apps/badges/templates/Dockerfile-builder-image +++ b/roles/openshift-apps/badges/templates/Dockerfile-builder-image @@ -1,6 +1,6 @@ -FROM quay.io/fedora/python-310:latest +FROM quay.io/fedora/python-313:latest LABEL \ - name="python-310-badges-custom-builder" \ + name="python-313-badges-custom-builder" \ vendor="Fedora Infrastructure" \ license="MIT" USER root diff --git a/roles/openshift-apps/badges/templates/buildconfig.yml.j2 b/roles/openshift-apps/badges/templates/buildconfig.yml.j2 index 98162aee4e..778eb10224 100644 --- a/roles/openshift-apps/badges/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/badges/templates/buildconfig.yml.j2 @@ -3,10 +3,10 @@ apiVersion: build.openshift.io/v1 kind: BuildConfig metadata: - name: python-310-custom-builder + name: python-313-custom-builder labels: app: badges - build: python-310-custom-builder + build: python-313-custom-builder spec: runPolicy: Serial source: @@ -18,11 +18,11 @@ spec: dockerStrategy: from: kind: ImageStreamTag - name: python-310:latest + name: python-313:latest output: to: kind: ImageStreamTag - name: python-310-custom-builder:latest + name: python-313-custom-builder:latest triggers: - type: ImageChange --- @@ -46,7 +46,7 @@ spec: sourceStrategy: from: kind: ImageStreamTag - name: python-310-custom-builder:latest + name: python-313-custom-builder:latest output: to: kind: ImageStreamTag @@ -81,7 +81,12 @@ spec: sourceStrategy: from: kind: ImageStreamTag - name: python-310-custom-builder:latest + name: python-313-custom-builder:latest + env: + # The .s2i/bin/assemble script uses this to build the frontend with the + # correct API and Ipsilon addresses. + - name: FEDORA_ENV + value: "{{ env }}" output: to: kind: ImageStreamTag diff --git a/roles/openshift-apps/badges/templates/checkout-rules-repo.sh b/roles/openshift-apps/badges/templates/checkout-rules-repo.sh index 2bf2e1d2ac..bc7822215a 100644 --- a/roles/openshift-apps/badges/templates/checkout-rules-repo.sh +++ b/roles/openshift-apps/badges/templates/checkout-rules-repo.sh @@ -6,7 +6,7 @@ set -x DIR=/var/lib/badges if [ ! -d "$DIR/.git" ]; then - git clone https://pagure.io/fedora-badges.git $DIR + git clone https://forge.fedoraproject.org/apps/badges-assets.git $DIR fi git config --global --add safe.directory $DIR diff --git a/roles/openshift-apps/badges/templates/deployment.yml.j2 b/roles/openshift-apps/badges/templates/deployment.yml.j2 index ad22b68600..098837a8e4 100644 --- a/roles/openshift-apps/badges/templates/deployment.yml.j2 +++ b/roles/openshift-apps/badges/templates/deployment.yml.j2 @@ -1,5 +1,5 @@ --- -# Frontend component (Python/Pyramid served by gunicorn) +# Frontend component (Python/Flask served by gunicorn) apiVersion: apps/v1 kind: Deployment metadata: @@ -118,6 +118,8 @@ metadata: labels: app: badges deployment: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: replicas: {{ (env == 'production')|ternary(2, 1) }} selector: @@ -131,8 +133,6 @@ spec: labels: app: badges deployment: consumer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedbadges:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: initContainers: - name: db-sync @@ -205,6 +205,8 @@ metadata: app: badges service: redis deployment: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: replicas: 1 selector: @@ -218,8 +220,6 @@ spec: app: badges service: redis deployment: redis - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis diff --git a/roles/openshift-apps/badges/templates/tahrir.cfg.py b/roles/openshift-apps/badges/templates/tahrir.cfg.py index dd11d0c112..223b958bb4 100644 --- a/roles/openshift-apps/badges/templates/tahrir.cfg.py +++ b/roles/openshift-apps/badges/templates/tahrir.cfg.py @@ -51,7 +51,7 @@ CACHE = { "backend": "dogpile.cache.null", "expiration_time": 100, "arguments": { - "url": "memcached02{{env_suffix}}:11211", + "url": "memcached01{{env_suffix}}:11211", "distributed_lock": True, "lock_timeout": 5, }, diff --git a/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 b/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 index 8019f924af..6976c63981 100644 --- a/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 +++ b/roles/openshift-apps/blockerbugs/templates/cron.yml.j2 @@ -37,16 +37,8 @@ spec: value: "{{ stg_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ stg_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ stg_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ stg_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ stg_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://stg.pagure.io/" - - name: PAGURE_API - value: "https://stg.pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.stage.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -58,16 +50,8 @@ spec: value: "{{ prod_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ prod_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ prod_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ prod_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ prod_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://pagure.io/" - - name: PAGURE_API - value: "https://pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -83,12 +67,6 @@ spec: value: "https://admin{{ env_suffix }}.fedoraproject.org/accounts/" - name: FAS_ADMIN_GROUP value: "qa-admin" - - name: PAGURE_BOT_USERNAME - value: "blockerbot" - - name: PAGURE_BOT_ENABLED - value: "True" - - name: PAGURE_REPO - value: "fedora-qa/blocker-review" - name: FORGEJO_REPO value: "quality/blocker-review" - name: FORGEJO_BOT_USERNAME @@ -101,8 +79,6 @@ spec: value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/" - name: FORGEJO_ADMIN_ORG value: "quality" - - name: FORGEJO_ADMIN_TEAM - value: "members" - name: BODHI_URL value: "https://bodhi{{ env_suffix }}.fedoraproject.org/" - name: OPENSHIFT_PROD diff --git a/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 b/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 index 1d8f51ee53..fe66813a5c 100644 --- a/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 +++ b/roles/openshift-apps/blockerbugs/templates/deployment.yml.j2 @@ -46,16 +46,8 @@ spec: value: "{{ stg_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ stg_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ stg_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ stg_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ stg_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://stg.pagure.io/" - - name: PAGURE_API - value: "https://stg.pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.stage.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -67,16 +59,8 @@ spec: value: "{{ prod_blockerbugs_db_password }}" - name: SECRET_KEY value: "{{ prod_blockerbugs_secret_key }}" - - name: PAGURE_REPO_TOKEN - value: "{{ prod_blockerbugs_pagure_repo_token_secret }}" - - name: PAGURE_REPO_WEBHOOK_KEY - value: "{{ prod_blockerbugs_pagure_repo_webhook_key_secret }}" - name: BUGZILLA_API_KEY value: "{{ prod_blockerbugs_bz_api_key }}" - - name: PAGURE_URL - value: "https://pagure.io/" - - name: PAGURE_API - value: "https://pagure.io/api/0/" - name: BUGZILLA_URL value: "https://bugzilla.redhat.com" - name: FORGEJO_BOT_ACCESS_TOKEN @@ -92,12 +76,6 @@ spec: value: "https://admin{{ env_suffix }}.fedoraproject.org/accounts/" - name: FAS_ADMIN_GROUP value: "qa-admin" - - name: PAGURE_BOT_USERNAME - value: "blockerbot" - - name: PAGURE_BOT_ENABLED - value: "True" - - name: PAGURE_REPO - value: "fedora-qa/blocker-review" - name: FORGEJO_REPO value: "quality/blocker-review" - name: FORGEJO_BOT_USERNAME @@ -110,8 +88,6 @@ spec: value: "https://forge{{ env_suffix }}.fedoraproject.org/api/v1/" - name: FORGEJO_ADMIN_ORG value: "quality" - - name: FORGEJO_ADMIN_TEAM - value: "members" - name: BODHI_URL value: "https://bodhi{{ env_suffix }}.fedoraproject.org/" - name: OPENSHIFT_PROD diff --git a/roles/openshift-apps/bodhi/files/service.yml b/roles/openshift-apps/bodhi/files/service.yml index e44d011aca..b1af97cc6f 100644 --- a/roles/openshift-apps/bodhi/files/service.yml +++ b/roles/openshift-apps/bodhi/files/service.yml @@ -13,3 +13,5 @@ spec: targetPort: 8080 selector: app: bodhi-web +# bodhi-valkey service is configured in deployment_yml.j2 +# because it exists only for staging, at the moment diff --git a/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 b/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 index 2bb0f66498..4da72744d5 100644 --- a/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/buildconfig.yml.j2 @@ -49,5 +49,27 @@ items: to: kind: ImageStreamTag name: bodhi-critpathcron:latest +{% if env == "staging" %} +- apiVersion: build.openshift.io/v1 + kind: BuildConfig + metadata: + labels: + build: bodhi-valkey + name: bodhi-valkey + spec: + runPolicy: Serial + source: + dockerfile: |- + {{ load_file('dockerfile-valkey') | indent(8) }} + type: Dockerfile + strategy: + type: Docker + dockerStrategy: + noCache: True + output: + to: + kind: ImageStreamTag + name: bodhi-valkey:latest +{% endif %} kind: List metadata: {} diff --git a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 index 9487ebeafd..fd6043b7e0 100644 --- a/roles/openshift-apps/bodhi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/deployment.yml.j2 @@ -3,9 +3,11 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: bodhi-web labels: app: bodhi-web - name: bodhi-web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]' spec: replicas: {{ bodhi_openshift_pods }} selector: @@ -20,8 +22,6 @@ spec: {% if env == "staging" %} monitoring-key: cpe {% endif %} - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-web\")].image"}]' spec: initContainers: - name: alembic-upgrade @@ -34,6 +34,17 @@ spec: - name: config-volume mountPath: /etc/bodhi readOnly: true +{% if env == "staging" %} + - name: wait-for-valkey + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest + command: ['/bin/sh', '-c', 'until valkey-cli -h bodhi-valkey -p 6379 -a "$VALKEY_PASSWORD" ping; do echo "Waiting for Valkey..."; sleep 2; done'] + env: + - name: VALKEY_PASSWORD + valueFrom: + secretKeyRef: + name: valkey-secret + key: password +{% endif %} containers: - name: bodhi-web image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-base:latest @@ -114,9 +125,11 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: bodhi-consumer labels: app: bodhi-consumer - name: bodhi-consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]' spec: {% if env == 'staging' %} replicas: {{ bodhi_openshift_pods_stg_consumers }} @@ -135,8 +148,6 @@ spec: metadata: labels: app: bodhi-consumer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-consumer\")].image"}]' spec: containers: - name: bodhi-consumer @@ -196,14 +207,16 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: bodhi-celery labels: app: bodhi-celery - name: bodhi-celery spec: replicas: {{ bodhi_openshift_pods }} selector: matchLabels: app: bodhi-celery + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]' strategy: type: RollingUpdate rollingUpdate: @@ -213,8 +226,6 @@ spec: metadata: labels: app: bodhi-celery - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery\")].image"}]' spec: containers: - name: bodhi-celery @@ -277,6 +288,8 @@ metadata: labels: app: bodhi-celery-beat name: bodhi-celery-beat + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]' spec: replicas: 1 selector: @@ -291,8 +304,6 @@ spec: metadata: labels: app: bodhi-celery-beat - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-base:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-celery-beat\")].image"}]' spec: containers: - name: bodhi-celery-beat @@ -348,3 +359,78 @@ spec: - name: fedora-messaging-key-volume secret: secretName: bodhi-fedora-messaging-key +{% if env == "staging" %} +--- +# bodhi-valkey +apiVersion: apps/v1 +kind: Deployment +metadata: + name: bodhi-valkey + labels: + app: bodhi-valkey + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bodhi-valkey:latest","namespace":"bodhi"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bodhi-valkey\")].image"}]' +spec: + replicas: 1 + selector: + matchLabels: + app: bodhi-valkey + strategy: + type: Recreate + template: + metadata: + labels: + app: bodhi-valkey + spec: + containers: + - name: bodhi-valkey + image: image-registry.openshift-image-registry.svc:5000/bodhi/bodhi-valkey:latest + command: ["valkey-server"] + args: ["/etc/valkey/valkey.conf", "--bind", "0.0.0.0", "--pidfile", "", "--unixsocket", "", "--dir", "/data", "--logfile", "", "--loglevel", "{{ 'verbose' if env == 'staging' else 'warning' }}", "--requirepass", "$(VALKEY_PASSWORD)"] + env: + - name: VALKEY_PASSWORD + valueFrom: + secretKeyRef: + name: valkey-secret + key: password + resources: {} + volumeMounts: + - name: bodhi-valkey-data-volume + mountPath: /data + ports: + - containerPort: 6379 + protocol: TCP + readinessProbe: + timeoutSeconds: 10 + initialDelaySeconds: 5 + periodSeconds: 60 + exec: + command: ['/bin/sh', '-c', 'valkey-cli -a "$VALKEY_PASSWORD" ping'] + livenessProbe: + timeoutSeconds: 30 + initialDelaySeconds: 30 + periodSeconds: 120 + failureThreshold: 5 + exec: + command: ['/bin/sh', '-c', 'valkey-cli -a "$VALKEY_PASSWORD" ping'] + volumes: + - name: bodhi-valkey-data-volume + persistentVolumeClaim: + claimName: "bodhi-valkey-storage{{ '-stg' if env == 'staging' else '' }}" +--- +# bodhi-valkey Service +apiVersion: v1 +kind: Service +metadata: + name: bodhi-valkey + labels: + app: bodhi-valkey +spec: + selector: + app: bodhi-valkey + ports: + - port: 6379 + targetPort: 6379 + protocol: TCP + type: ClusterIP +{% endif %} diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-base b/roles/openshift-apps/bodhi/templates/dockerfile-base index fd62514999..df3f376b27 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-base +++ b/roles/openshift-apps/bodhi/templates/dockerfile-base @@ -1,7 +1,7 @@ {% if env == "staging" %} -FROM fedora:43 +FROM quay.io/fedora/fedora:44 {% else %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% endif %} LABEL \ name="bodhi-base" \ @@ -14,7 +14,7 @@ RUN curl -o /etc/yum.repos.d/infra-tags-stg.repo https://infrastructure.fedorapr RUN curl -o /etc/yum.repos.d/infra-tags.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags.repo {% endif %} {% if env == "staging" %} -RUN dnf install -y bodhi-server python3-koji-fedoramessaging-messages python3-gunicorn sed --refresh +RUN dnf install -y bodhi-server python3-koji-fedoramessaging-messages python3-gunicorn python3-redis sed valkey --refresh {% else %} RUN dnf install -y bodhi-server-{{bodhi_version}} python3-koji-fedoramessaging-messages python3-gunicorn sed {% endif %} diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron b/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron index d4b2173c3a..bfdfc82e52 100644 --- a/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron +++ b/roles/openshift-apps/bodhi/templates/dockerfile-critpathcron @@ -1,7 +1,7 @@ {% if env == "staging" %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% else %} -FROM fedora:43 +FROM quay.io/fedora/fedora:43 {% endif %} LABEL \ name="bodhi-critpathcron" \ diff --git a/roles/openshift-apps/bodhi/templates/dockerfile-valkey b/roles/openshift-apps/bodhi/templates/dockerfile-valkey new file mode 100644 index 0000000000..d552110377 --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/dockerfile-valkey @@ -0,0 +1,30 @@ +{% if env == "staging" %} +FROM quay.io/fedora/fedora:44 +{% else %} +FROM quay.io/fedora/fedora:43 +{% endif %} + +LABEL \ + name="bodhi-valkey" \ + vendor="Fedora Infrastructure" \ + license="MIT" + +{% if env == "staging" %} +RUN curl -o /etc/yum.repos.d/infra-tags.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags.repo +RUN curl -o /etc/yum.repos.d/infra-tags-stg.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags-stg.repo +{% else %} +RUN curl -o /etc/yum.repos.d/infra-tags.repo https://infrastructure.fedoraproject.org/infra/ansible/files/common/fedora-infra-tags.repo +{% endif %} + +RUN dnf -y update && dnf install -y valkey && dnf clean all + +RUN chmod 0770 /etc/valkey +RUN mkdir /run/valkey && chown valkey:valkey /run/valkey + +RUN mkdir -m 0770 /data && chown valkey:0 /data +VOLUME /data +WORKDIR /data + +USER valkey +EXPOSE 6379 +CMD ["valkey-server", "/etc/valkey/valkey.conf"] diff --git a/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 b/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 index 3826fc64a2..12b8053e56 100644 --- a/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 +++ b/roles/openshift-apps/bodhi/templates/imagestreams-tagged.yml.j2 @@ -22,3 +22,14 @@ items: name: staging referencePolicy: type: Source +{% if env == "staging" %} +- apiVersion: image.openshift.io/v1 + kind: ImageStream + metadata: + name: bodhi-valkey + labels: + build: bodhi-valkey + spec: + lookupPolicy: + local: false +{% endif %} diff --git a/roles/openshift-apps/bodhi/templates/pvc.yml.j2 b/roles/openshift-apps/bodhi/templates/pvc.yml.j2 new file mode 100644 index 0000000000..5c22bca00f --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/pvc.yml.j2 @@ -0,0 +1,12 @@ +{% if env == "staging" %} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: bodhi-valkey-storage-stg +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +{% endif %} diff --git a/roles/openshift-apps/bodhi/templates/secret.yml.j2 b/roles/openshift-apps/bodhi/templates/secret.yml.j2 new file mode 100644 index 0000000000..c5f17fad11 --- /dev/null +++ b/roles/openshift-apps/bodhi/templates/secret.yml.j2 @@ -0,0 +1,7 @@ +--- +kind: Secret +apiVersion: v1 +metadata: + name: valkey-secret +stringData: + password: {{ bodhi_valkey_secret }} diff --git a/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 index ce502eb8ac..f222650513 100644 --- a/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 +++ b/roles/openshift-apps/bugzilla2fedmsg/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: labels: app: bugzilla2fedmsg service: bugzilla2fedmsg + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bugzilla2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bugzilla2fedmsg\")].image"}]' spec: replicas: 1 selector: @@ -16,8 +18,6 @@ spec: metadata: labels: app: bugzilla2fedmsg - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"bugzilla2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"bugzilla2fedmsg\")].image"}]' spec: containers: - name: bugzilla2fedmsg diff --git a/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 b/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 index ddf3934fca..6cb1b9424d 100644 --- a/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/cloud-image-uploader/templates/buildconfig.yml.j2 @@ -12,7 +12,7 @@ items: source: type: git git: - uri: https://pagure.io/cloud-image-uploader.git + uri: https://forge.fedoraproject.org/apps/cloud-image-uploader.git {% if env == 'staging' %} ref: main {% else %} @@ -39,7 +39,7 @@ items: source: type: git git: - uri: https://pagure.io/cloud-image-uploader.git + uri: https://forge.fedoraproject.org/apps/cloud-image-uploader.git {% if env == 'staging' %} ref: main {% else %} diff --git a/roles/openshift-apps/cloud-image-uploader/templates/config.toml b/roles/openshift-apps/cloud-image-uploader/templates/config.toml index df87b78705..1953f595bd 100644 --- a/roles/openshift-apps/cloud-image-uploader/templates/config.toml +++ b/roles/openshift-apps/cloud-image-uploader/templates/config.toml @@ -19,7 +19,7 @@ certfile = "/etc/pki/rabbitmq/cert/cloud-image-uploader.crt" [client_properties] app = "Fedora Cloud Image Uploader ({{ queue_suffix }})" -app_url = "https://pagure.io/cloud-image-uploader" +app_url = "https://forge.fedoraproject.org/apps/cloud-image-uploader" app_contacts_email = "cloud@lists.fedoraproject.org" [[bindings]] diff --git a/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml b/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml index 63a8bf0cca..8b0e9c8220 100644 --- a/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml +++ b/roles/openshift-apps/cloud-image-uploader/templates/image-tester-fm-conf.toml @@ -19,7 +19,7 @@ certfile = "/etc/pki/rabbitmq/cert/cloud-image-uploader.crt" [client_properties] app = "Fedora Cloud Image Uploader ({{ queue_suffix }})" -app_url = "https://pagure.io/cloud-image-uploader" +app_url = "https://forge.fedoraproject.org/apps/cloud-image-uploader" app_contacts_email = "cloud@lists.fedoraproject.org" [[bindings]] diff --git a/roles/openshift-apps/compose-tracker/templates/deployment.yml.j2 b/roles/openshift-apps/compose-tracker/templates/deployment.yml.j2 new file mode 100644 index 0000000000..5bdd3a20a0 --- /dev/null +++ b/roles/openshift-apps/compose-tracker/templates/deployment.yml.j2 @@ -0,0 +1,45 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: compose-tracker + name: compose-tracker + annotations: + image.openshift.io/triggers: >- + [{"from":{"kind":"ImageStreamTag","name":"compose-tracker-img:latest","namespace":"compose-tracker"},"fieldPath":"spec.template.spec.containers[?(@.name==\"compose-tracker\")].image","pause":"false"}] +spec: + replicas: 1 + selector: + matchLabels: + app: compose-tracker + template: + metadata: + labels: + app: compose-tracker + name: compose-tracker + spec: + containers: + - name: compose-tracker + image: image-registry.openshift-image-registry.svc:5000/compose-tracker/compose-tracker-img:latest + imagePullPolicy: IfNotPresent + envFrom: + - secretRef: + name: compose-tracker-forgejo-token + env: + - name: FORGEJO_NAMESPACE + value: "releng" + - name: FORGEJO_REPO + value: "compose-tracker-issues" + - name: FORGEJO_DOMAIN +{% if env == "staging" %} + value: "https://forge.stg.fedoraproject.org/" +{% else %} + value: "https://forge.fedoraproject.org/" +{% endif %} + # sleep infinity is useful for debugging environment issues + # comment out when not debugging +# args: ['infinity'] +# command: ['/usr/bin/sleep'] + resources: {} + restartPolicy: Always diff --git a/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 b/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 index e79bd7766e..4c70372c17 100644 --- a/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 +++ b/roles/openshift-apps/datagrepper/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: datagrepper labels: app: Datagrepper + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datagrepper:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datagrepper\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: Datagrepper - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datagrepper:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datagrepper\")].image"}]' spec: containers: - name: datagrepper diff --git a/roles/openshift-apps/datanommer/templates/deployment.yml.j2 b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 index 1fa0dd2523..ad0430f4e0 100644 --- a/roles/openshift-apps/datanommer/templates/deployment.yml.j2 +++ b/roles/openshift-apps/datanommer/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: datanommer labels: app: Datanommer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datanommer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datanommer\")].image"}]' spec: replicas: 1 selector: @@ -16,8 +18,6 @@ spec: metadata: labels: app: Datanommer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"datanommer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"datanommer\")].image"}]' spec: initContainers: - name: alembic-upgrade diff --git a/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 index 120e647ab6..763806e228 100644 --- a/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 +++ b/roles/openshift-apps/discourse2fedmsg/templates/deployment.yml.j2 @@ -2,10 +2,12 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: discourse2fedmsg labels: app: discourse2fedmsg service: discourse2fedmsg - name: discourse2fedmsg + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"discourse2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"discourse2fedmsg\")].image"}]' spec: replicas: 1 selector: @@ -16,8 +18,6 @@ spec: metadata: labels: app: discourse2fedmsg - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"discourse2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"discourse2fedmsg\")].image"}]' spec: containers: - name: discourse2fedmsg diff --git a/roles/openshift-apps/elections/templates/buildconfig.yml.j2 b/roles/openshift-apps/elections/templates/buildconfig.yml.j2 index 62c89fb909..e3bfeb6370 100644 --- a/roles/openshift-apps/elections/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/elections/templates/buildconfig.yml.j2 @@ -13,7 +13,7 @@ spec: source: type: Git git: - uri: https://pagure.io/elections.git + uri: https://forge.fedoraproject.org/apps/elections.git {% if env == 'staging' %} ref: "staging" {% else %} diff --git a/roles/openshift-apps/elections/templates/fedora-elections.cfg b/roles/openshift-apps/elections/templates/fedora-elections.cfg index e680a00bd1..09a129b5d1 100644 --- a/roles/openshift-apps/elections/templates/fedora-elections.cfg +++ b/roles/openshift-apps/elections/templates/fedora-elections.cfg @@ -51,7 +51,7 @@ SESSION_COOKIE_NAME = 'elections' DOGPILE_CACHE = { 'backend': 'dogpile.cache.memcached', 'arguments': { - 'url': ["memcached02:11211"], + 'url': ["memcached01:11211"], 'distributed_lock': True, }, } diff --git a/roles/openshift-apps/fasjson/templates/deployment.yml.j2 b/roles/openshift-apps/fasjson/templates/deployment.yml.j2 index b901afd27f..05e6a2bc03 100644 --- a/roles/openshift-apps/fasjson/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fasjson/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: fasjson labels: app: fasjson + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fasjson:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fasjson\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: fasjson - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fasjson:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fasjson\")].image"}]' spec: containers: - name: fasjson diff --git a/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 b/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 index 48024dc458..69cc9fdfd9 100644 --- a/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/fedocal/templates/buildconfig.yml.j2 @@ -13,7 +13,7 @@ spec: source: type: Git git: - uri: https://pagure.io/fedocal.git + uri: https://forge.fedoraproject.org/apps/fedocal.git {% if env == 'staging' %} ref: "staging" {% else %} diff --git a/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 b/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 index 1c9c7c1ea6..b67215ef81 100644 --- a/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/fedora-packages-static/templates/buildconfig.yml.j2 @@ -13,7 +13,7 @@ spec: source: type: Git git: - uri: https://pagure.io/fedora-packages-static.git + uri: https://forge.fedoraproject.org/apps/fedora-packages-static.git {% if env == 'staging' %} ref: "staging" {% else %} diff --git a/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 b/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 index 82230087be..c38cd517db 100644 --- a/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fedora-packages-static/templates/deployment.yml.j2 @@ -3,6 +3,8 @@ apiVersion: apps/v1 kind: Deployment metadata: name: fedora-packages-static + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedora-packages-static:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedora-packages-static\")].image"}]' spec: replicas: 1 selector: @@ -14,8 +16,6 @@ spec: metadata: labels: app: fedora-packages-static - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fedora-packages-static:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedora-packages-static\")].image"}]' spec: initContainers: - name: init-solr diff --git a/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml b/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml index 4b91a53d58..7f7e6f895d 100644 --- a/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml +++ b/roles/openshift-apps/fedora-packages-static/templates/packages/schema.xml @@ -19,7 +19,7 @@ - + diff --git a/roles/openshift-apps/firmitas/default/main.yml b/roles/openshift-apps/firmitas/default/main.yml deleted file mode 100644 index a8702d95f6..0000000000 --- a/roles/openshift-apps/firmitas/default/main.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- -firmitas_namespace: "firmitas" -firmitas_project_description: "Firmitas is a monitoring application which alerts about the expiration of RabbitMQ certs." -firmitas_application_name: "{{ firmitas_namespace }}" -firmitas_pagure_secret_volume_name: "firmitas-pagure-volume" -firmitas_pagure_secret_name: "firmitas-pagure-secret" -firmitas_stg_pagure_apikey: "OVERRIDEME" # in the ansible-private repo -firmitas_stg_pagure_username: "OVERRIDEME" # in the ansible-private repo -firmitas_stg_pagure_host: "OVERRIDEME" # in the ansible-private repo -firmitas_pagure_apikey: "OVERRIDEME" # in the ansible-private repo -firmitas_pagure_username: "OVERRIDEME" # in the ansible-private repo -firmitas_pagure_host: "OVERRIDEME" # in the ansible-private repo -firmitas_certs_location: "https://infrastructure.fedoraproject.org/infra/rabbitmq-certs/" -firmitas_requester: "t0xic0der" -firmitas_image: "image-registry.openshift-image-registry.svc:5000/{{ firmitas_namespace }}/{{ firmitas_application_name }}:latest" diff --git a/roles/openshift-apps/firmitas/defaults/main.yml b/roles/openshift-apps/firmitas/defaults/main.yml new file mode 100644 index 0000000000..6579ddf7f9 --- /dev/null +++ b/roles/openshift-apps/firmitas/defaults/main.yml @@ -0,0 +1,15 @@ +--- +firmitas_namespace: "firmitas" +firmitas_project_description: "Firmitas is a monitoring application which alerts about the expiration of RabbitMQ certs." +firmitas_application_name: "{{ firmitas_namespace }}" +firmitas_forgejo_secret_volume_name: "firmitas-forgejo-volume" +firmitas_forgejo_secret_name: "firmitas-forgejo-secret" +firmitas_stg_forgejo_apikey: "OVERRIDEME" # in the ansible-private repo +firmitas_stg_forgejo_username: "firmitas-automata" +firmitas_stg_forgejo_reponame: "playground/firmitas-test" +firmitas_forgejo_apikey: "OVERRIDEME" # in the ansible-private repo +firmitas_forgejo_username: "firmitas-automata" +firmitas_forgejo_reponame: "infra/tickets" +firmitas_certs_location: "https://infrastructure.fedoraproject.org/infra/rabbitmq-certs/" +firmitas_requester: "t0xic0der" +firmitas_image: "image-registry.openshift-image-registry.svc:5000/{{ firmitas_namespace }}/{{ firmitas_application_name }}:latest" diff --git a/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml b/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml index 9c587d4f43..a52e85b576 100644 --- a/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml +++ b/roles/openshift-apps/firmitas/tasks/create-buildconfig.yml @@ -11,5 +11,5 @@ ansible.builtin.command: "oc apply -f /root/ocp4/openshift-apps/firmitas/buildconfig.yml" # Start a build -- name: "Run oc start-build {{ firmitas_application_name }}-build" +- name: "Run oc start-build" ansible.builtin.command: "oc start-build {{ firmitas_application_name }}-build -n {{ firmitas_namespace }}" diff --git a/roles/openshift-apps/firmitas/tasks/create-pagure-apikey-secret.yml b/roles/openshift-apps/firmitas/tasks/create-forgejo-apikey-secret.yml similarity index 53% rename from roles/openshift-apps/firmitas/tasks/create-pagure-apikey-secret.yml rename to roles/openshift-apps/firmitas/tasks/create-forgejo-apikey-secret.yml index 52f916b400..fb69827aa1 100644 --- a/roles/openshift-apps/firmitas/tasks/create-pagure-apikey-secret.yml +++ b/roles/openshift-apps/firmitas/tasks/create-forgejo-apikey-secret.yml @@ -1,11 +1,11 @@ --- # generate the templates for project to be created -- name: Create the pagure api secret template +- name: Create the Forgejo api secret template ansible.builtin.template: - src: "secret-pagure-apikey.yml.j2" - dest: "/root/ocp4/openshift-apps/firmitas/secret-pagure-apikey.yml" + src: "secret-forgejo-apikey.yml.j2" + dest: "/root/ocp4/openshift-apps/firmitas/secret-forgejo-apikey.yml" mode: "0770" # apply created openshift resources - name: Oc apply resources - ansible.builtin.command: "oc apply -f /root/ocp4/openshift-apps/firmitas/secret-pagure-apikey.yml" + ansible.builtin.command: "oc apply -f /root/ocp4/openshift-apps/firmitas/secret-forgejo-apikey.yml" diff --git a/roles/openshift-apps/firmitas/tasks/main.yml b/roles/openshift-apps/firmitas/tasks/main.yml index 601c12decf..a830bb0e55 100644 --- a/roles/openshift-apps/firmitas/tasks/main.yml +++ b/roles/openshift-apps/firmitas/tasks/main.yml @@ -3,12 +3,19 @@ ansible.builtin.file: path: "/root/ocp4/openshift-apps/firmitas/" state: directory + mode: "0770" -- include_tasks: create-namespace.yml -- include_tasks: create-pagure-apikey-secret.yml -- include_tasks: create-firmitas-configuration-secret.yml -- include_tasks: create-persistent-volume-claim.yml -- include_tasks: create-imagestream.yml -- include_tasks: create-buildconfig.yml -- include_tasks: create-cronjob.yml -# - include_tasks: create-deployment.yml +- name: Create namespace + ansible.builtin.include_tasks: create-namespace.yml +- name: Create Forgejo APIkey secret + ansible.builtin.include_tasks: create-forgejo-apikey-secret.yml +- name: Create Firmitas configuration secret + ansible.builtin.include_tasks: create-firmitas-configuration-secret.yml +- name: Create persistent volume claim + ansible.builtin.include_tasks: create-persistent-volume-claim.yml +- name: Create imagestream + ansible.builtin.include_tasks: create-imagestream.yml +- name: Create buildconfig + ansible.builtin.include_tasks: create-buildconfig.yml +- name: Create cronjob + ansible.builtin.include_tasks: create-cronjob.yml diff --git a/roles/openshift-apps/firmitas/templates/myconfig.py.j2 b/roles/openshift-apps/firmitas/templates/myconfig.py.j2 index e73839c90f..4dfccf2c0f 100644 --- a/roles/openshift-apps/firmitas/templates/myconfig.py.j2 +++ b/roles/openshift-apps/firmitas/templates/myconfig.py.j2 @@ -1,6 +1,6 @@ """ Firmitas -Copyright (C) 2023-2024 Akashdeep Dhar +Copyright (C) 2023-2026 Akashdeep Dhar This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software @@ -27,26 +27,23 @@ Variables related to notifications # The limit for how long a single request must be attempted for rqsttime = 30 -# The source code forge on which the issue tickets need to be created -gitforge = "pagure" - # The location of the ticketing repository -repoloca = "" +repoloca = "https://forge.{{ (env == 'staging')|ternary('stg.', '') }}fedoraproject.org" # The name of the ticketing repository with namespace -reponame = "{{ (env == 'staging')|ternary(firmitas_stg_pagure_host, firmitas_pagure_host) }}" +reponame = "{{ (env == 'staging')|ternary(firmitas_stg_forgejo_reponame, firmitas_forgejo_reponame) }}" # The username to masquerade as in order to create notification tickets -username = "{{ (env == 'staging')|ternary(firmitas_stg_pagure_user, firmitas_pagure_user) }}" +username = "{{ (env == 'staging')|ternary(firmitas_stg_forgejo_username, firmitas_forgejo_username) }}" # The API key for the source code forge pertaining to the user -password = "{{ (env == 'staging')|ternary(firmitas_stg_pagure_apikey, firmitas_pagure_apikey) }}" +password = "{{ (env == 'staging')|ternary(firmitas_stg_forgejo_apikey, firmitas_forgejo_apikey) }}" # Number of days from validity expiry to make the notification for daysqant = {{ (env == 'staging')|ternary(firmitas_stg_expiry_days, firmitas_expiry_days) }} # List of labels to tag the notification tickets with -tagslist = ["firmitas", "automate", "notifier"] +tagslist = [] # Maximum number of retries to opening the notification ticket maxretry = 5 diff --git a/roles/openshift-apps/firmitas/templates/secret-forgejo-apikey.yml.j2 b/roles/openshift-apps/firmitas/templates/secret-forgejo-apikey.yml.j2 new file mode 100644 index 0000000000..d703424d1e --- /dev/null +++ b/roles/openshift-apps/firmitas/templates/secret-forgejo-apikey.yml.j2 @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: "{{ firmitas_namespace }}-forgejo-apikey-secret" + namespace: "{{ firmitas_namespace }}" +data: + firmitas-forgejo-apikey: + "{{ (env == 'production')|ternary(firmitas_forgejo_apikey, firmitas_stg_forgejo_apikey) | b64encode }}" + firmitas-forgejo-reponame: + "{{ (env == 'production')|ternary(firmitas_forgejo_reponame, firmitas_stg_forgejo_reponame) | b64encode }}" diff --git a/roles/openshift-apps/firmitas/templates/secret-pagure-apikey.yml.j2 b/roles/openshift-apps/firmitas/templates/secret-pagure-apikey.yml.j2 deleted file mode 100644 index cc6609e103..0000000000 --- a/roles/openshift-apps/firmitas/templates/secret-pagure-apikey.yml.j2 +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: v1 -kind: Secret -metadata: - name: "{{ firmitas_namespace }}-pagure-apikey-secret" - namespace: "{{ firmitas_namespace }}" -data: - firmitas-pagure-apikey: - "{{ (env == 'production')|ternary(firmitas_pagure_apikey, firmitas_stg_pagure_apikey) | b64encode }}" - firmitas-pagure-host: - "{{ (env == 'production')|ternary( firmitas_pagure_host, firmitas_stg_pagure_host) | b64encode }}" diff --git a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 index 4bbbc78f37..1f1595fea4 100644 --- a/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 +++ b/roles/openshift-apps/flatpak-indexer/templates/deployment.yml.j2 @@ -2,9 +2,11 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: flatpak-indexer labels: app: flatpak-indexer - name: flatpak-indexer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: flatpak-indexer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"flatpak-indexer:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"flatpak-indexer\")].image"}]' spec: containers: - name: flatpak-indexer diff --git a/roles/openshift-apps/fmn/templates/deployment.yml.j2 b/roles/openshift-apps/fmn/templates/deployment.yml.j2 index 593f076b78..bd19d090ed 100644 --- a/roles/openshift-apps/fmn/templates/deployment.yml.j2 +++ b/roles/openshift-apps/fmn/templates/deployment.yml.j2 @@ -7,6 +7,8 @@ metadata: labels: app: fmn component: frontend + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: replicas: 1 selector: @@ -23,8 +25,6 @@ spec: labels: app: fmn component: frontend - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"frontend\")].image"}]' spec: containers: - name: frontend @@ -62,6 +62,8 @@ metadata: labels: app: fmn component: api + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' spec: replicas: 1 selector: @@ -78,8 +80,6 @@ spec: labels: app: fmn component: api - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' spec: containers: - name: api @@ -170,6 +170,8 @@ metadata: labels: app: fmn component: consumer + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: replicas: 1 selector: @@ -183,8 +185,6 @@ spec: labels: app: fmn component: consumer - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"consumer\")].image"}]' spec: initContainers: - name: database-sync @@ -262,6 +262,8 @@ metadata: labels: app: fmn component: sender-email + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-email\")].image"}]' spec: replicas: 1 selector: @@ -275,8 +277,6 @@ spec: labels: app: fmn component: sender-email - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-email\")].image"}]' spec: containers: - name: sender-email @@ -320,6 +320,8 @@ metadata: labels: app: fmn component: sender-irc + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-irc\")].image"}]' spec: replicas: {{ (env == 'production')|ternary('1', '0') }} selector: @@ -333,8 +335,6 @@ spec: labels: app: fmn component: sender-irc - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-irc\")].image"}]' spec: containers: - name: sender-irc @@ -378,6 +378,8 @@ metadata: labels: app: fmn component: sender-matrix + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-matrix\")].image"}]' spec: replicas: 1 selector: @@ -391,8 +393,6 @@ spec: labels: app: fmn component: sender-matrix - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sender-matrix\")].image"}]' spec: containers: - name: sender-matrix @@ -436,6 +436,8 @@ metadata: labels: app: fmn component: redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: replicas: 1 selector: @@ -448,8 +450,6 @@ spec: labels: app: fmn component: redis - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"redis\")].image"}]' spec: containers: - name: redis @@ -479,6 +479,8 @@ metadata: labels: app: fmn component: collectd + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"collectd\")].image"}]' spec: replicas: 1 selector: @@ -492,8 +494,6 @@ spec: labels: app: fmn component: collectd - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"fmn:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"collectd\")].image"}]' spec: containers: - name: collectd @@ -526,10 +526,12 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: sendria labels: app: fmn component: sendria - name: sendria + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"sendria:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sendria\")].image"}]' spec: replicas: 1 selector: @@ -543,8 +545,6 @@ spec: labels: app: fmn component: sendria - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"sendria:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"sendria\")].image"}]' spec: containers: - name: sendria diff --git a/roles/openshift-apps/forgejo/README.md b/roles/openshift-apps/forgejo/README.md new file mode 100644 index 0000000000..008818832c --- /dev/null +++ b/roles/openshift-apps/forgejo/README.md @@ -0,0 +1,95 @@ +# Forgejo OpenShift App Role + +Deploys Fedora Forgejo (git forge) on OpenShift: namespace, storage, PostgreSQL, Valkey, Helm release, CI runners, and control-host backups. + +**Playbook:** [`playbooks/openshift-apps/forgejo.yml`](../../../playbooks/openshift-apps/forgejo.yml) + +## Entry point and execution model + +- **Hosts:** `os_control_stg:os_control` (OpenShift control nodes), `gather_facts: false` +- **Where work runs:** On the control host under `/root/ocp4/openshift-apps/forgejo/` — templates are rendered there, then applied with `kubernetes.core.k8s`, `oc apply`, or `kubernetes.core.helm` +- **Pattern:** Hybrid OpenShift app — raw manifests plus the upstream [forgejo-helm](https://codeberg.org/fedora/forgejo-helm) chart (not the composable `openshift/*` roles) +- **Secrets/config:** Production vs staging uses `env` (`production` / `staging`) and ternaries in `templates/values.yaml.j2`. Sensitive vars (passwords, OIDC keys, runner secrets) come from private vars (`/srv/private/ansible/vars.yml`), not this repo + +## Task flow (`tasks/main.yaml`) + +### 1. Control-host backup infrastructure + +Before cluster resources: + +- Creates `/root/ocp4/openshift-apps/forgejo/backups/{script,dump,log}/` +- Copies backup scripts from `files/` +- Cron on the control host: + - **02:00** — `run_forgejo_backup.sh` (rsync scripts into Forgejo pod, DB dump, pull dump back) + - **03:00** — `run_forgejo_pruning.sh` (prune old dumps) + +Backup dumps are NFS-mounted on `os-control01` (see `inventory/host_vars/os-control01.rdu3.fedoraproject.org`). + +### 2. Kubernetes foundation + +| Step | Task file | Deploys | +|------|-----------|---------| +| Namespace | `create-forgejo-namespace.yaml` | `forgejo` namespace | +| Storage | `create-forgejo-pvc.yaml` | PV + PVC `gitea-shared-storage` (NetApp NFS `forgejo-volume`, RWX 100Gi) | +| Database | `create-postgres-operator-config.yaml` | Crunchy `PostgresCluster` `forgejo-ha` (PG 17, 2 replicas, pgBackRest); 30s wait | +| Cache | `deploy-valkey.yaml` | 6-replica Valkey StatefulSet + Service + ConfigMap + Secret (`valkey` tag, `oc apply`) | +| App | `call-helm.yaml` | Forgejo Helm release | + +Custom theme ConfigMap task is **commented out** in `main.yaml` (`create-custom-theme-configmap.yaml`). Theme CSS is in `files/themes/` and referenced in Helm values (`fedora-auto`, etc.). + +### 3. Forgejo application (Helm) + +`call-helm.yaml`: + +1. Renders `templates/values.yaml.j2` → `helm-values.yaml` +2. Clones https://codeberg.org/fedora/forgejo-helm.git to `/tmp/forgejo-helm_repo` +3. Runs `helm dependency update` +4. Deploys release `forgejo` in namespace `forgejo` via `kubernetes.core.helm` + +Notable Helm settings: + +- **Image:** Quay (`forgejo_prod_quay_image` / `forgejo_stg_quay_image`), rootless +- **Route:** OpenShift Route (not Ingress); `forgejo_hostname` / `forgejo_stg_hostname` +- **Persistence:** Pre-created PVC `gitea-shared-storage` (`persistence.create: false`) +- **DB:** External Crunchy Postgres, not chart PostgreSQL +- **Cache:** External Valkey via `redis+cluster://` in `gitea.config.cache` (chart `redis-cluster` subchart enabled; live cache is the separate Valkey StatefulSet) +- **Auth:** OpenID Connect to Fedora Accounts with `group-team-map` for org/team RBAC +- **Admin:** Private vars; `passwordMode: keepUpdated` + +### 4. CI runners (Forgejo Actions) + +| Step | Task file | Purpose | +|------|-----------|---------| +| Load runners | `load-forgejo-runners.yaml` | Merges `runners//*.yml` with private registration secrets | +| Runner vars | `copy-forgejo-runner-vars.yaml` | Renders runner vars from `forgejo-runners.yaml.j2` | +| Runner secret | `create-forgejo-runner-config-secret.yaml` | K8s Secret for runner VM | +| VM RBAC | `create-forgejo-runnerhost-sa-rbac.yaml` | ServiceAccount, Role, RoleBinding, token Secret | +| Runner VM | `create-forgejo-runnerhost-vm.yaml` | KubeVirt VM + headless Service | +| Registration | `register-runners.yaml` | `forgejo-cli actions register` in Forgejo pod | + +Runner host: + +- KubeVirt VM `forgejo-runnerhost-vm` (Fedora `u1.xlarge`, 30Gi) +- Packages in `defaults/main.yml` (`ansible`, `podman`, `python3-kubernetes`, etc.) +- SA token via serial disk `SATOKEN000001` +- Cloud-init runs **ansible-pull** from [ansible-role-forgejo-runner](https://codeberg.org/fedora/ansible-role-forgejo-runner) (in-repo clone is commented out) +- `load-forgejo-runners.yaml` merges `runners//*.yml` with secret dicts from private vars, then `register-runners.yaml` registers them (idempotent; tolerates duplicate key) + +## Variables + +- `defaults/main.yml` — namespace, headless service name, runnerhost packages +- `vars/main.yml` — `openshift_user_id` for PV ownership + +Most operational variables live in private/group vars (hostnames, DB, OIDC, runner secrets, Valkey password, etc.). + +## Related code + +- **`roles/openshift-apps/dist-git`** — reuses `/root/ocp4/openshift-apps/forgejo/` for theme ConfigMaps +- **`.forgejo/workflows/`** — CI for this ansible repo runs on this Forgejo instance + +## Design notes + +1. Mixed deploy paths: `kubernetes.core.k8s`, `oc apply` (Valkey), and Helm +2. Runner registration is in Ansible; runner daemons are configured via ansible-pull on the VM +3. Backups are control-host cron jobs using `oc rsync` / `oc exec`, not in-cluster CronJobs +4. Same playbook runs prod and staging; `env` selects all branching diff --git a/roles/openshift-apps/forgejo/defaults/main.yml b/roles/openshift-apps/forgejo/defaults/main.yml index 8864206d04..497cdfdb3b 100644 --- a/roles/openshift-apps/forgejo/defaults/main.yml +++ b/roles/openshift-apps/forgejo/defaults/main.yml @@ -1,5 +1,8 @@ --- forgejo_namespace: "forgejo" +# KubeVirt headless Service name; must match spec.template.spec.subdomain and the +# network.kubevirt.io/headlessService label (cluster DNS: ...svc.cluster.local). +forgejo_runnerhost_headless_service_name: "forgejo-runnerhost" forgejo_project_description: "Forgejo Gitforge" forgejo_application_name: "{{ forgejo_namespace }}" diff --git a/roles/openshift-apps/forgejo/runners/README.md b/roles/openshift-apps/forgejo/runners/README.md new file mode 100644 index 0000000000..0be5536dc8 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/README.md @@ -0,0 +1,38 @@ +# Forgejo runner definitions + +Each runner has one YAML file under `production/` or `staging/`. These files are public (this repo) and contain everything **except** the registration secret. + +## File format + +```yaml +--- +name: releng-1 +scope: releng +labels: + - releng-1 +image: code.forgejo.org/forgejo/runner:11 +``` + +- **name** — Unique runner name (must match the filename stem). +- **scope** — Forgejo org scope for `forgejo-cli actions register --scope` (omit or use `global` for instance-wide runners). +- **labels** — Workflow `runs-on` labels. Quote values that contain colons. +- **image** — Runner container image on the runner host. +- **capacity** — Optional concurrent job limit (passed through to runner host config). + +## Secrets (private ansible repo) + +Registration secrets stay in `ansible-private/vars.yml` as a dict keyed by runner name: + +```yaml +forgejo_runner_secrets: + releng-1: "01c729e8f65dea42ddaf335dbfcf3841c71e58c8" + infra-1: "c4ebefbdc76b023bd7c7ef06a483fae045bb2f3d" + # ... + +forgejo_stg_runner_secrets: + # staging runners, same shape +``` + +Generate a new secret with: `openssl rand -hex 20` + +`tasks/load-forgejo-runners.yaml` merges each definition file with its secret before templating and CLI registration. diff --git a/roles/openshift-apps/forgejo/runners/production/ai-ml-1.yml b/roles/openshift-apps/forgejo/runners/production/ai-ml-1.yml new file mode 100644 index 0000000000..fdda2f2d4d --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/ai-ml-1.yml @@ -0,0 +1,6 @@ +--- +name: ai-ml-1 +scope: ai-ml +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/apps-1.yml b/roles/openshift-apps/forgejo/runners/production/apps-1.yml new file mode 100644 index 0000000000..0588e4dc38 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/apps-1.yml @@ -0,0 +1,6 @@ +--- +name: apps-1 +scope: apps +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml b/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml new file mode 100644 index 0000000000..5605f9270a --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/atomic-desktops-1.yml @@ -0,0 +1,8 @@ +--- +name: atomic-desktops-1 +scope: atomic-desktops +labels: + - "docker:docker://node:22-bookworm" + - "docker-slim:docker://node:22-alpine" +image: code.forgejo.org/forgejo/runner:11 +capacity: 20 diff --git a/roles/openshift-apps/forgejo/runners/production/ci-1.yml b/roles/openshift-apps/forgejo/runners/production/ci-1.yml new file mode 100644 index 0000000000..0755f453a5 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/ci-1.yml @@ -0,0 +1,8 @@ +--- +name: ci-1 +scope: ci +labels: + - "docker:docker://node:22-bookworm" + - "docker-slim:docker://node:22-alpine" +image: code.forgejo.org/forgejo/runner:11 +capacity: 20 diff --git a/roles/openshift-apps/forgejo/runners/production/commops-1.yml b/roles/openshift-apps/forgejo/runners/production/commops-1.yml new file mode 100644 index 0000000000..db51e3cdcd --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/commops-1.yml @@ -0,0 +1,6 @@ +--- +name: commops-1 +scope: commops +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/council-1.yml b/roles/openshift-apps/forgejo/runners/production/council-1.yml new file mode 100644 index 0000000000..917d349389 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/council-1.yml @@ -0,0 +1,6 @@ +--- +name: council-1 +scope: council +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/dei-1.yml b/roles/openshift-apps/forgejo/runners/production/dei-1.yml new file mode 100644 index 0000000000..bc98d65d47 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/dei-1.yml @@ -0,0 +1,6 @@ +--- +name: dei-1 +scope: dei +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/design-1.yml b/roles/openshift-apps/forgejo/runners/production/design-1.yml new file mode 100644 index 0000000000..1260852c3b --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/design-1.yml @@ -0,0 +1,6 @@ +--- +name: design-1 +scope: design +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/docs-1.yml b/roles/openshift-apps/forgejo/runners/production/docs-1.yml new file mode 100644 index 0000000000..965c7733bd --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/docs-1.yml @@ -0,0 +1,6 @@ +--- +name: docs-1 +scope: docs +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/forge-1.yml b/roles/openshift-apps/forgejo/runners/production/forge-1.yml new file mode 100644 index 0000000000..fe915e239f --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/forge-1.yml @@ -0,0 +1,6 @@ +--- +name: forge-1 +scope: forge +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/infra-1.yml b/roles/openshift-apps/forgejo/runners/production/infra-1.yml new file mode 100644 index 0000000000..20aff67cba --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/infra-1.yml @@ -0,0 +1,6 @@ +--- +name: infra-1 +scope: infra +labels: + - infra-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/marketing-1.yml b/roles/openshift-apps/forgejo/runners/production/marketing-1.yml new file mode 100644 index 0000000000..4a441f4e10 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/marketing-1.yml @@ -0,0 +1,6 @@ +--- +name: marketing-1 +scope: marketing +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/mentored-projects-1.yml b/roles/openshift-apps/forgejo/runners/production/mentored-projects-1.yml new file mode 100644 index 0000000000..80f4be9974 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/mentored-projects-1.yml @@ -0,0 +1,6 @@ +--- +name: mentored-projects-1 +scope: mentored-projects +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/mindshare-1.yml b/roles/openshift-apps/forgejo/runners/production/mindshare-1.yml new file mode 100644 index 0000000000..9d8acdb1e6 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/mindshare-1.yml @@ -0,0 +1,6 @@ +--- +name: mindshare-1 +scope: mindshare +labels: + - podman +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/operations-1.yml b/roles/openshift-apps/forgejo/runners/production/operations-1.yml new file mode 100644 index 0000000000..b7d8116b38 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/operations-1.yml @@ -0,0 +1,6 @@ +--- +name: operations-1 +scope: operations +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/podcast-1.yml b/roles/openshift-apps/forgejo/runners/production/podcast-1.yml new file mode 100644 index 0000000000..90d533718d --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/podcast-1.yml @@ -0,0 +1,6 @@ +--- +name: podcast-1 +scope: podcast +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/production/quality-1.yml b/roles/openshift-apps/forgejo/runners/production/quality-1.yml new file mode 100644 index 0000000000..3467d2a6ec --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/quality-1.yml @@ -0,0 +1,6 @@ +--- +name: quality-1 +scope: quality +labels: + - fedora +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/releng-1.yml b/roles/openshift-apps/forgejo/runners/production/releng-1.yml new file mode 100644 index 0000000000..515a5e4b5e --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/releng-1.yml @@ -0,0 +1,6 @@ +--- +name: releng-1 +scope: releng +labels: + - releng-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/releng-2.yml b/roles/openshift-apps/forgejo/runners/production/releng-2.yml new file mode 100644 index 0000000000..3519c4e7eb --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/releng-2.yml @@ -0,0 +1,6 @@ +--- +name: releng-2 +scope: releng +labels: + - docker +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/production/security-1.yml b/roles/openshift-apps/forgejo/runners/production/security-1.yml new file mode 100644 index 0000000000..eb2a573578 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/production/security-1.yml @@ -0,0 +1,6 @@ +--- +name: security-1 +scope: security +labels: + - podman +image: code.forgejo.org/forgejo/runner:12 diff --git a/roles/openshift-apps/forgejo/runners/staging/cle-1.yml b/roles/openshift-apps/forgejo/runners/staging/cle-1.yml new file mode 100644 index 0000000000..4f52b97e40 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/cle-1.yml @@ -0,0 +1,6 @@ +--- +name: cle-1 +scope: cle +labels: + - cle-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/docs-1.yml b/roles/openshift-apps/forgejo/runners/staging/docs-1.yml new file mode 100644 index 0000000000..83ee715436 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/docs-1.yml @@ -0,0 +1,6 @@ +--- +name: docs-1 +scope: docs +labels: + - docs-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-1.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-1.yml new file mode 100644 index 0000000000..5fbb4fcab4 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-1.yml @@ -0,0 +1,6 @@ +--- +name: fedora-1 +scope: global +labels: + - fedora-1 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-2.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-2.yml new file mode 100644 index 0000000000..da6b891b04 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-2.yml @@ -0,0 +1,6 @@ +--- +name: fedora-2 +scope: global +labels: + - fedora-2 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-3.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-3.yml new file mode 100644 index 0000000000..58a5123e43 --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-3.yml @@ -0,0 +1,6 @@ +--- +name: fedora-3 +scope: global +labels: + - fedora-3 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-4.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-4.yml new file mode 100644 index 0000000000..93ffcb104d --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-4.yml @@ -0,0 +1,6 @@ +--- +name: fedora-4 +scope: global +labels: + - fedora-4 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-5.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-5.yml new file mode 100644 index 0000000000..2e213c41cc --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-5.yml @@ -0,0 +1,6 @@ +--- +name: fedora-5 +scope: global +labels: + - fedora-5 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/fedora-6.yml b/roles/openshift-apps/forgejo/runners/staging/fedora-6.yml new file mode 100644 index 0000000000..63efb98cde --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/fedora-6.yml @@ -0,0 +1,6 @@ +--- +name: fedora-6 +scope: global +labels: + - fedora-6 +image: code.forgejo.org/forgejo/runner:11 diff --git a/roles/openshift-apps/forgejo/runners/staging/test.yml b/roles/openshift-apps/forgejo/runners/staging/test.yml new file mode 100644 index 0000000000..44d9e8c9dd --- /dev/null +++ b/roles/openshift-apps/forgejo/runners/staging/test.yml @@ -0,0 +1,8 @@ +--- +name: test +scope: playground +labels: + - "docker:docker://node:22-bookworm" + - "docker-slim:docker://node:22-alpine" +image: code.forgejo.org/forgejo/runner:11 +capacity: 4 diff --git a/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml b/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml index fe5ae1b45f..ad6141678f 100644 --- a/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml +++ b/roles/openshift-apps/forgejo/tasks/create-forgejo-runnerhost-vm.yaml @@ -1,4 +1,15 @@ --- +- name: Generate the forgejo-runnerhost-headless-service.yaml from template + ansible.builtin.template: + src: "forgejo-runnerhost-headless-service.yaml.j2" + dest: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-headless-service.yaml" + mode: "0770" + +- name: Deploy the forgejo-runnerhost headless Service + kubernetes.core.k8s: + state: present + src: "/root/ocp4/openshift-apps/forgejo/forgejo-runnerhost-headless-service.yaml" + - name: Generate the forgejo-runnerhost-vm.yaml from template ansible.builtin.template: src: "forgejo-runnerhost-vm.yaml.j2" diff --git a/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml b/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml new file mode 100644 index 0000000000..cb9e15cf0a --- /dev/null +++ b/roles/openshift-apps/forgejo/tasks/load-forgejo-runners.yaml @@ -0,0 +1,38 @@ +--- +# Build forgejo_runners from per-runner YAML files in runners// plus secrets in private vars. +# Private vars (forgejo_runner_secrets / forgejo_stg_runner_secrets) must be a dict keyed by runner name: +# forgejo_runner_secrets: +# releng-1: "0123...hex40" + +- name: Find forgejo runner definition files + ansible.builtin.set_fact: + _forgejo_runner_def_paths: "{{ query('ansible.builtin.fileglob', role_path ~ '/runners/' ~ env ~ '/*.yml') | sort }}" + +- name: Build forgejo_runners from definitions and private secrets + ansible.builtin.set_fact: + forgejo_runners: "{{ forgejo_runners | default([]) + [_runner] }}" + loop: "{{ _forgejo_runner_def_paths }}" + vars: + _def: "{{ lookup('ansible.builtin.file', item) | from_yaml }}" + _secrets: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" + _runner: "{{ _def | combine({'secret': _secrets[_def.name]}) }}" + when: _forgejo_runner_def_paths | length > 0 + +- name: Set empty forgejo_runners when no definition files exist + ansible.builtin.set_fact: + forgejo_runners: [] + when: _forgejo_runner_def_paths | length == 0 + +- name: Validate each runner has a secret in private vars + ansible.builtin.assert: + that: + - _secrets[item.name] is defined + - _secrets[item.name] | length > 0 + fail_msg: >- + Missing secret for runner '{{ item.name }}'. + Add it to {{ (env == 'production') | ternary('forgejo_runner_secrets', 'forgejo_stg_runner_secrets') }} + in the ansible private repo. + loop: "{{ forgejo_runners }}" + vars: + _secrets: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" + when: forgejo_runners | length > 0 diff --git a/roles/openshift-apps/forgejo/tasks/main.yaml b/roles/openshift-apps/forgejo/tasks/main.yaml index 47a16540ad..e6bb6da416 100644 --- a/roles/openshift-apps/forgejo/tasks/main.yaml +++ b/roles/openshift-apps/forgejo/tasks/main.yaml @@ -57,6 +57,7 @@ # - include_tasks: create-custom-theme-configmap.yaml - include_tasks: deploy-valkey.yaml - include_tasks: call-helm.yaml +- include_tasks: load-forgejo-runners.yaml - include_tasks: copy-forgejo-runner-vars.yaml - include_tasks: create-forgejo-runner-config-secret.yaml - include_tasks: create-forgejo-runnerhost-sa-rbac.yaml diff --git a/roles/openshift-apps/forgejo/tasks/register-runners.yaml b/roles/openshift-apps/forgejo/tasks/register-runners.yaml index d5ce4e1bd1..1dc9446cd8 100644 --- a/roles/openshift-apps/forgejo/tasks/register-runners.yaml +++ b/roles/openshift-apps/forgejo/tasks/register-runners.yaml @@ -14,8 +14,8 @@ kubernetes.core.k8s_exec: namespace: forgejo pod: "{{ forgejo_pods.resources[0].metadata.name }}" - command: "forgejo forgejo-cli actions register --name {{ item['name'] }} --labels {{ item['labels'] | join(',') }} --secret {{ item['secret'] }}{{ ' --scope ' + item['scope'] if item['scope'] is defined and item['scope'] != 'global' else '' }}" - loop: "{{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }}" + command: "forgejo forgejo-cli actions register --name {{ item['name'] }} --labels {{ item['labels'] | map('regex_replace', ':.*', '') | join(',') }} --secret {{ item['secret'] }}{{ ' --scope ' + item['scope'] if item['scope'] is defined and item['scope'] != 'global' else '' }}" + loop: "{{ forgejo_runners }}" register: forgejo_cli_outputs failed_when: >- (forgejo_cli_outputs.rc is defined diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-headless-service.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-headless-service.yaml.j2 new file mode 100644 index 0000000000..ae47479d3c --- /dev/null +++ b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-headless-service.yaml.j2 @@ -0,0 +1,18 @@ +--- +# Headless Service for KubeVirt VM pod DNS (subdomain + network.kubevirt.io/headlessService on the VM). +# VirtualMachine FQDN: .{{ forgejo_runnerhost_headless_service_name }}.{{ forgejo_namespace }}.svc.cluster.local +apiVersion: v1 +kind: Service +metadata: + name: "{{ forgejo_runnerhost_headless_service_name }}" + namespace: {{ forgejo_namespace }} +spec: + clusterIP: None + selector: + network.kubevirt.io/headlessService: "{{ forgejo_runnerhost_headless_service_name }}" + ports: + # Required by Service; not used for VM connectivity (masquerade handles traffic). + - name: placeholder + port: 15017 + targetPort: 15017 + protocol: TCP diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 index e4f4ca1bef..97d3787479 100644 --- a/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/forgejo-runnerhost-vm.yaml.j2 @@ -29,7 +29,7 @@ spec: metadata: creationTimestamp: null labels: - network.kubevirt.io/headlessService: headless + network.kubevirt.io/headlessService: "{{ forgejo_runnerhost_headless_service_name }}" spec: serviceAccountName: forgejo-runner-vm architecture: amd64 @@ -50,7 +50,7 @@ spec: networks: - name: default pod: {} - subdomain: headless + subdomain: "{{ forgejo_runnerhost_headless_service_name }}" volumes: - dataVolume: name: forgejo-runnerhost-vm-volume diff --git a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 index cc8bf93dc0..9fd9e6daad 100644 --- a/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/forgejo-runners.yaml.j2 @@ -4,18 +4,11 @@ # Internal URL (accessible from VM): http://forgejo-http.forgejo.svc.cluster.local:3000 forgejo_instance_url: "{{ (env == 'production') | ternary(forgejo_runner_instance_url, forgejo_stg_runner_instance_url) }}" -# Forgejo runners to register and configure -# Note: Generate secrets with: openssl rand -hex 20 +# Forgejo runners to register and configure (built by load-forgejo-runners.yaml). +# Non-secret fields live in roles/openshift-apps/forgejo/runners//*.yml; +# registration secrets live in private vars (forgejo_runner_secrets / forgejo_stg_runner_secrets). # -# Runner configuration: -# - name: Unique runner name -# - labels: List of label names (the runner container will automatically add schema:arg based on its environment) -# These are the label names that workflows will use in "runs-on" -# - image: Container image to use for the runner -# The image determines what execution environment and tools are available -# - secret: 40-character hex string for idempotent registration -# -forgejo_runners: {{ (env == 'production') | ternary(forgejo_runner_secrets, forgejo_stg_runner_secrets) }} +forgejo_runners: {{ forgejo_runners }} # Configuration for the zabbix agent running on the runnerhost forgejo_runnerhost_zabbix_agent_identity: {{ zabbix_tls_psk_identity }} diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2 index 66d1abc5fd..af3e59e13d 100644 --- a/roles/openshift-apps/forgejo/templates/values.yaml.j2 +++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2 @@ -401,9 +401,9 @@ gitea: ## @param gitea.metrics.serviceMonitor.enabled Enable Forgejo metrics service monitor ## @param gitea.metrics.serviceMonitor.namespace Namespace in which Prometheus is running metrics: - enabled: false + enabled: "{{ (env == 'production') | ternary(forgejo_metrics, forgejo_stg_metrics) }}" serviceMonitor: - enabled: false + enabled: "{{ (env == 'production') | ternary(forgejo_metrics_servicemonitor, forgejo_stg_metrics_servicemonitor) }}" namespace: '' # additionalLabels: # prometheus-release: prom1 @@ -454,7 +454,11 @@ gitea: "forge-playground-owners":{"playground":["Owners"]}, "forge-playground-members":{"playground":["Members"]}, "forge-quality-members":{"quality":["Members"]}, - "forge-quality-owners":{"quality":["Owners"]} + "forge-quality-owners":{"quality":["Owners"]}, + "forge-atomic-desktops-owners":{"atomic-desktops":["Owners"]}, + "forge-bootc-owners":{"bootc":["Owners"]}, + "forge-releng-members":{"releng":["Members"]}, + "forge-releng-owners":{"releng":["Owners"]} }' {% else %} group-team-map: '{ @@ -472,7 +476,7 @@ gitea: "forge-council-members":{"council":["Members"]}, "forge-server-owners":{"server":["Owners"]}, "forge-server-members":{"server":["Members"]}, - "forge-docs-owners":{"docs":["Owners"]}, + "forge-docs-owners":{"docs":["Owners"], "docs-archive":["Owners"]}, "forge-docs-members":{"docs":["Members"]}, "forge-docs-quickdocs":{"docs":["Quickdocs"]}, "forge-forge-owners":{"forge":["Owners"]}, @@ -491,6 +495,7 @@ gitea: "forge-dei-owners":{"dei":["Owners"]}, "forge-dei-members":{"dei":["Members"]}, "forge-dei-pride":{"dei":["Pride"]}, + "forge-dei-mentorsummitorg":{"dei":["mentor-summit-org"]}, "forge-rust-owners":{"rust":["Owners"]}, "forge-rust-members":{"rust":["Members"]}, "forge-mobility-owners":{"mobility":["Owners"]}, @@ -564,7 +569,17 @@ gitea: "forge-packaging-committee":{"packaging":["Committee"]}, "forge-packaging-packager":{"packaging":["Packager"]}, "forge-packaging-provenpackager":{"packaging":["ProvenPackager"]}, - "forge-dotnet-owners":{"dotnet":["Owners"]} + "forge-dotnet-owners":{"dotnet":["Owners"]}, + "forge-magazine-owners":{"magazine":["Owners"]}, + "forge-magazine-members":{"magazine":["Members"]}, + "forge-matrix-owners":{"matrix":["Owners"]}, + "forge-hummingbird-owners":{"hummingbird":["Owners"]}, + "forge-r-owners":{"r":["Owners"]}, + "forge-fdwg-owners":{"fdwg":["Owners"]}, + "forge-fdwg-members":{"fdwg":["Members"]}, + "forge-pungi-owners":{"pungi":["Owners"]}, + "forge-action-owners":{"action":["Owners"]}, + "forge-atomic-owners":{"atomic":["Owners"]} }' {% endif %} # - name: 'OAuth 1' @@ -784,7 +799,7 @@ gitea: ## @param gitea.config.migrations Settings for Git repository migrations migrations: - ALLOWED_DOMAINS: "*.fedoraproject.org,pagure.io,stg.pagure.io,gitlab.com,codeberg.org,github.com,*.github.com,*.githubusercontent.com" + ALLOWED_DOMAINS: "*.fedoraproject.org,pagure.io,stg.pagure.io,gitlab.com,codeberg.org,github.com,*.github.com,*.githubusercontent.com,*.forgejo.org" ## @param gitea.config.federation Federation configuration federation: {} @@ -811,7 +826,8 @@ gitea: proxy: {} ## @param gitea.config.actions Configuration for [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/) - actions: {} + actions: + DEFAULT_ACTIONS_URL: https://forge.fedoraproject.org ## @param gitea.config.other Uncategorized configuration options other: {} diff --git a/roles/openshift-apps/greenwave/templates/deployment.yml.j2 b/roles/openshift-apps/greenwave/templates/deployment.yml.j2 index 5fcfce3ab3..bc47ed97b7 100644 --- a/roles/openshift-apps/greenwave/templates/deployment.yml.j2 +++ b/roles/openshift-apps/greenwave/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: labels: app: greenwave service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: replicas: 2 selector: @@ -18,8 +20,6 @@ spec: labels: app: greenwave service: web - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: containers: - name: web @@ -57,6 +57,8 @@ metadata: labels: app: greenwave service: fedmsg-consumers + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedmsg-consumers\")].image"}]' spec: replicas: 0 selector: @@ -68,8 +70,6 @@ spec: labels: app: greenwave service: fedmsg-consumers - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"greenwave:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"fedmsg-consumers\")].image"}]' spec: containers: - name: fedmsg-consumers diff --git a/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 b/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 index c265682be9..28513d1322 100644 --- a/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 +++ b/roles/openshift-apps/koschei/templates/config-backend.cfg.j2 @@ -159,7 +159,7 @@ config = { "backend": "dogpile.cache.memcached", "expiration_time": None, "arguments": { - "url": "memcached02", + "url": "memcached01", }, }, }, diff --git a/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 b/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 index 2d66ef00ad..3b112a8b7a 100644 --- a/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 +++ b/roles/openshift-apps/koschei/templates/config-frontend.cfg.j2 @@ -54,7 +54,7 @@ config = { "backend": "dogpile.cache.memcached", "expiration_time": 3600, # 1 hour "arguments": { - "url": "memcached02:11211", + "url": "memcached01:11211", }, }, }, diff --git a/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 b/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 index b961f1ca14..d3105351c4 100644 --- a/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/maubot/templates/buildconfig.yml.j2 @@ -14,6 +14,8 @@ spec: FROM fedora:43 RUN dnf -y install python3-pip python3-gssapi git libpq-devel gcc gcc-c++ python-devel cmake && dnf -y clean all RUN pip install maubot[encryption] python-slugify httpx httpx_gssapi jinja2 fedora-messaging meetbot-messages pydantic maubot-fedora-messages backoff arrow python-gitlab pytz + # Python 3.14: register_handler_class must skip dir() names where getattr raises (__provides__) + RUN python3 -c 'import importlib.util, pathlib, sys; p=pathlib.Path(importlib.util.find_spec("maubot").origin).parent/"plugin_base.py"; old=" for key in dir(obj):\n val = getattr(obj, key)\n"; new=" for key in dir(obj):\n try:\n val = getattr(obj, key)\n except AttributeError:\n continue\n"; t=p.read_text(); (sys.exit(0) if "except AttributeError:\n continue" in t else sys.exit("maubot patch: pattern not found") if old not in t else p.write_text(t.replace(old, new, 1)))' RUN \ curl https://raw.githubusercontent.com/fedora-infra/matrix-bots/main/install-plugins-from-git.py -o /usr/local/bin/install-maubot-plugins && \ chmod +x /usr/local/bin/install-maubot-plugins && \ diff --git a/roles/openshift-apps/mdapi/templates/deployment.yml.j2 b/roles/openshift-apps/mdapi/templates/deployment.yml.j2 index 03286eb796..d94cc8185c 100644 --- a/roles/openshift-apps/mdapi/templates/deployment.yml.j2 +++ b/roles/openshift-apps/mdapi/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: labels: app: mdapi service: mdapi + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mdapi:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mdapi\")].image"}]' spec: replicas: 1 selector: @@ -18,8 +20,6 @@ spec: labels: app: mdapi service: mdapi - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mdapi:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mdapi\")].image"}]' spec: containers: - name: mdapi diff --git a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 index 44347637c9..5ed8be3740 100644 --- a/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 +++ b/roles/openshift-apps/mirrormanager/templates/deployment.yml.j2 @@ -6,6 +6,8 @@ metadata: name: frontend labels: app: mirrormanager + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mirrormanager2:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mirrormanager\")].image"}]' spec: replicas: 1 selector: @@ -20,8 +22,6 @@ spec: metadata: labels: app: mirrormanager - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"mirrormanager2:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"mirrormanager\")].image"}]' spec: containers: - name: mirrormanager diff --git a/roles/openshift-apps/noggin/templates/deployment.yml.j2 b/roles/openshift-apps/noggin/templates/deployment.yml.j2 index 2b998bd2dd..596c7a5543 100644 --- a/roles/openshift-apps/noggin/templates/deployment.yml.j2 +++ b/roles/openshift-apps/noggin/templates/deployment.yml.j2 @@ -5,6 +5,8 @@ metadata: name: noggin labels: app: {{ object_app }} + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"noggin:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"noggin\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: metadata: labels: app: {{ object_app }} - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"noggin:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"noggin\")].image"}]' spec: containers: - name: noggin diff --git a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 index b399a3f539..ff0eef24e0 100644 --- a/roles/openshift-apps/poddlers/templates/deployment.yml.j2 +++ b/roles/openshift-apps/poddlers/templates/deployment.yml.j2 @@ -7,6 +7,8 @@ metadata: name: {{ toddler.name }} labels: app: poddlers + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"toddlers:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"toddlers\")].image"}]' spec: replicas: {{ toddler.replicas|default(1) }} selector: @@ -20,8 +22,6 @@ spec: labels: app: poddlers deployment: {{ toddler.name }} - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"toddlers:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"toddlers\")].image"}]' spec: containers: - name: toddlers diff --git a/roles/openshift-apps/poddlers/templates/fedora-messaging.toml b/roles/openshift-apps/poddlers/templates/fedora-messaging.toml index 8d7ab9d3bb..fa78720345 100644 --- a/roles/openshift-apps/poddlers/templates/fedora-messaging.toml +++ b/roles/openshift-apps/poddlers/templates/fedora-messaging.toml @@ -56,7 +56,7 @@ blocked_toddlers = [ backend = "dogpile.cache.pylibmc" expiration_time = 3600 [consumer_config.cache.arguments] -url = ["memcached02{{ env_suffix }}.rdu3.fedoraproject.org"] +url = ["memcached01{{ env_suffix }}.rdu3.fedoraproject.org"] binary = true behaviors = {"tcp_nodelay" = true, "ketama" = true} diff --git a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 index 03e1db04ff..a5ce963f05 100644 --- a/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 +++ b/roles/openshift-apps/release-monitoring/templates/deployment.yml.j2 @@ -2,10 +2,12 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: release-monitoring-web labels: app: release-monitoring-web service: web - name: release-monitoring-web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: replicas: 1 selector: @@ -18,8 +20,6 @@ spec: labels: app: release-monitoring-web service: web - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: initContainers: - name: alembic-upgrade @@ -88,10 +88,12 @@ spec: apiVersion: apps/v1 kind: Deployment metadata: + name: release-monitoring-check-service labels: app: release-monitoring-check-service service: web - name: release-monitoring-check-service + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: {% if env == 'staging' %} replicas: 0 @@ -108,8 +110,6 @@ spec: labels: app: release-monitoring-check-service service: web - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-monitoring-web:latest","namespace":"release-monitoring"},"fieldPath":"spec.template.spec.containers[?(@.name==\"release-monitoring-web\")].image"}]' spec: initContainers: - name: alembic-check diff --git a/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 b/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 index 459a275a5c..a25777812e 100644 --- a/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/resultsdb-ci-listener/templates/buildconfig.yml.j2 @@ -14,7 +14,7 @@ spec: source: type: Git git: - uri: https://pagure.io/ci-resultsdb-listener.git + uri: https://forge.fedoraproject.org/apps/ci-resultsdb-listener.git ref: "{{ env }}" strategy: type: Source diff --git a/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 b/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 index 9bae0933be..4a5d92de31 100644 --- a/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 +++ b/roles/openshift-apps/resultsdb-ci-listener/templates/configmaps.yml.j2 @@ -69,7 +69,7 @@ data: app = "resultsdb_listener" # Some suggested extra fields: # URL of the project that provides this consumer - app_url = "https://pagure.io/ci-resultsdb-listener/" + app_url = "https://forge.fedoraproject.org/apps/ci-resultsdb-listener" # Contact emails for the maintainer(s) of the consumer - in case the # broker admin needs to contact them, for e.g. app_contacts_email = [ diff --git a/roles/openshift-apps/resultsdb-ci-listener/templates/deploymentconfigs.yml.j2 b/roles/openshift-apps/resultsdb-ci-listener/templates/deployment.yml.j2 similarity index 92% rename from roles/openshift-apps/resultsdb-ci-listener/templates/deploymentconfigs.yml.j2 rename to roles/openshift-apps/resultsdb-ci-listener/templates/deployment.yml.j2 index 679360b502..17be007863 100644 --- a/roles/openshift-apps/resultsdb-ci-listener/templates/deploymentconfigs.yml.j2 +++ b/roles/openshift-apps/resultsdb-ci-listener/templates/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: "resultsdb-ci-listener" labels: @@ -8,9 +8,11 @@ metadata: spec: replicas: 1 selector: - app: resultsdb-ci-listener + matchLabels: + app: resultsdb-ci-listener strategy: - type: Rolling + type: RollingUpdate + rollingUpdate: {} template: metadata: labels: @@ -57,5 +59,3 @@ spec: - name: fedora-messaging-key-volume secret: secretName: resultsdb-ci-listener-fedora-messaging-key - triggers: - - type: ConfigChange diff --git a/roles/openshift-apps/resultsdb/templates/backend/deploymentconfigs.yml.j2 b/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 similarity index 81% rename from roles/openshift-apps/resultsdb/templates/backend/deploymentconfigs.yml.j2 rename to roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 index a79576f8d3..17da418c61 100644 --- a/roles/openshift-apps/resultsdb/templates/backend/deploymentconfigs.yml.j2 +++ b/roles/openshift-apps/resultsdb/templates/backend/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: "resultsdb-api" labels: @@ -9,15 +9,23 @@ metadata: spec: replicas: 2 selector: - app: resultsdb - service: api + matchLabels: + app: resultsdb + service: api strategy: - type: Rolling - rollingParams: - pre: - failurePolicy: Abort - execNewPod: - containerName: api + type: RollingUpdate + rollingUpdate: {} + template: + metadata: + labels: + service: api + app: resultsdb + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"resultsdb-api:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"api\")].image"}]' + spec: + initContainers: + - name: db-init + image: image-registry.openshift-image-registry.svc:5000/resultsdb/resultsdb-api command: - /bin/sh - -i @@ -37,18 +45,16 @@ spec: fi done exit 1 - volumes: - - config-volume - - httpd-config-volume - template: - metadata: - labels: - service: api - app: resultsdb - spec: + volumeMounts: + - name: config-volume + mountPath: /etc/resultsdb + readOnly: true + - name: httpd-config-volume + mountPath: /etc/httpd/conf.d + readOnly: true containers: - name: api - image: resultsdb-api + image: image-registry.openshift-image-registry.svc:5000/resultsdb/resultsdb-api imagePullPolicy: Always env: - name: RESULTSDB_WSGI_SCRIPT_PATH @@ -135,13 +141,3 @@ spec: - name: fedora-messaging-key-volume secret: secretName: resultsdb-fedora-messaging-key - triggers: - - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - api - from: - kind: ImageStreamTag - name: resultsdb-api:latest diff --git a/roles/openshift-apps/resultsdb/templates/frontend/deploymentconfigs.yml.j2 b/roles/openshift-apps/resultsdb/templates/frontend/deployment.yml.j2 similarity index 84% rename from roles/openshift-apps/resultsdb/templates/frontend/deploymentconfigs.yml.j2 rename to roles/openshift-apps/resultsdb/templates/frontend/deployment.yml.j2 index b796855ada..aed4e1d263 100644 --- a/roles/openshift-apps/resultsdb/templates/frontend/deploymentconfigs.yml.j2 +++ b/roles/openshift-apps/resultsdb/templates/frontend/deployment.yml.j2 @@ -1,6 +1,6 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: "resultsdb-frontend" labels: @@ -9,10 +9,12 @@ metadata: spec: replicas: 2 selector: - app: resultsdb - service: web + matchLabels: + app: resultsdb + service: web strategy: - type: Rolling + type: RollingUpdate + rollingUpdate: {} template: metadata: labels: @@ -68,9 +70,6 @@ spec: path: /results?limit=0 port: 5002 - # Limit to 384MB memory. This is probably *not* enough but it is - # necessary in the current environment to allow for 2 replicas and - # rolling updates, without hitting the (very aggressive) memory quota. resources: limits: memory: 384Mi @@ -82,5 +81,3 @@ spec: - name: httpd-config-volume configMap: name: "resultsdb-frontend-httpd-config" - triggers: - - type: ConfigChange diff --git a/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 b/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 index d2a65d9968..3b4b115aeb 100644 --- a/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/testdays/templates/buildconfig.yml.j2 @@ -24,7 +24,7 @@ spec: sourceStrategy: from: kind: DockerImage - name: registry.access.redhat.com/ubi9/python-39 + name: registry.access.redhat.com/ubi9/python-312 triggers: - type: ConfigChange - type: ImageChange diff --git a/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 b/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 index 5617b8c8e4..3e8dc64c83 100644 --- a/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 +++ b/roles/openshift-apps/the-new-hotness/templates/deployment.yml.j2 @@ -3,6 +3,8 @@ apiVersion: apps/v1 kind: Deployment metadata: name: the-new-hotness + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness:latest","namespace":"the-new-hotness"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness\")].image"}]' spec: replicas: 1 selector: @@ -14,8 +16,6 @@ spec: metadata: labels: app: the-new-hotness - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness:latest","namespace":"the-new-hotness"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness\")].image"}]' spec: containers: - name: the-new-hotness @@ -71,6 +71,8 @@ apiVersion: apps/v1 kind: Deployment metadata: name: the-new-hotness-redis + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness-redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness-redis\")].image"}]' spec: replicas: 1 selector: @@ -81,8 +83,6 @@ spec: metadata: labels: app: the-new-hotness-redis - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"the-new-hotness-redis:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"the-new-hotness-redis\")].image"}]' spec: containers: - name: the-new-hotness-redis diff --git a/roles/openshift-apps/waiverdb/templates/deploymentconfig.yml.j2 b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 similarity index 65% rename from roles/openshift-apps/waiverdb/templates/deploymentconfig.yml.j2 rename to roles/openshift-apps/waiverdb/templates/deployment.yml.j2 index 1b234c474e..a482255524 100644 --- a/roles/openshift-apps/waiverdb/templates/deploymentconfig.yml.j2 +++ b/roles/openshift-apps/waiverdb/templates/deployment.yml.j2 @@ -1,43 +1,60 @@ --- -apiVersion: apps.openshift.io/v1 -kind: DeploymentConfig +apiVersion: apps/v1 +kind: Deployment metadata: name: waiverdb-web labels: app: waiverdb service: web + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"waiverdb:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"web\")].image"}]' spec: replicas: 2 selector: - app: waiverdb - service: web + matchLabels: + app: waiverdb + service: web strategy: - type: Rolling - rollingParams: - pre: - failurePolicy: Abort - execNewPod: - containerName: web - command: - - /bin/sh - - -c - - >- - if [ -f /app/entrypoint.sh ]; - then /app/entrypoint.sh waiverdb db upgrade; - else waiverdb db upgrade; - fi - volumes: - - config-volume - - secret-volume + type: RollingUpdate + rollingUpdate: {} template: metadata: labels: app: waiverdb service: web spec: + initContainers: + - name: db-upgrade + image: image-registry.openshift-image-registry.svc:5000/waiverdb/waiverdb:latest + command: + - /bin/sh + - -c + - | + if [ -f /app/entrypoint.sh ]; + then /app/entrypoint.sh waiverdb db upgrade; + else waiverdb db upgrade; + fi + volumeMounts: + - name: config-volume + mountPath: /etc/waiverdb + readOnly: true + - name: secret-volume + mountPath: /etc/secret + readOnly: true + env: + - name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: waiverdb-secret + key: database-password + - name: SECRET_KEY + valueFrom: + secretKeyRef: + name: waiverdb-secret + key: flask-secret-key containers: - name: web - image: waiverdb + image: image-registry.openshift-image-registry.svc:5000/waiverdb/waiverdb:latest ports: - containerPort: 8080 volumeMounts: @@ -109,13 +126,3 @@ spec: - name: fedora-messaging-key-volume secret: secretName: waiverdb-fedora-messaging-key - triggers: - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - web - from: - kind: ImageStreamTag - name: waiverdb:latest - - type: ConfigChange diff --git a/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml b/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml index f755f14b32..040f2a07c2 100644 --- a/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml +++ b/roles/openshift-apps/webhook2fedmsg/files/imagestream.yml @@ -1,10 +1,30 @@ --- apiVersion: image.openshift.io/v1 -kind: ImageStream -metadata: - name: webhook2fedmsg -spec: - lookupPolicy: - local: false -status: - dockerImageRepository: "" +kind: List +items: + - apiVersion: image.openshift.io/v1 + kind: ImageStream + metadata: + name: webhook2fedmsg + spec: + lookupPolicy: + local: false + status: + dockerImageRepository: "" + # The Python 3.13 builder image + - apiVersion: image.openshift.io/v1 + kind: ImageStream + metadata: + name: python-313 + spec: + lookupPolicy: + local: false + tags: + - name: latest + from: + kind: DockerImage + name: quay.io/fedora/python-313:latest + importPolicy: + scheduled: true + referencePolicy: + type: Source diff --git a/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 index 366420288c..6753351a4a 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/buildconfig.yml.j2 @@ -21,8 +21,7 @@ spec: sourceStrategy: from: kind: ImageStreamTag - namespace: openshift - name: python:3.11-ubi9 + name: python-313:latest env: # The .s2i/bin/assemble script uses this to build the frontend with the # correct API and Ipsilon addresses. diff --git a/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 index ec7341211a..1d1137cbc0 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/deployment.yml.j2 @@ -2,10 +2,12 @@ apiVersion: apps/v1 kind: Deployment metadata: + name: app labels: app: webhook2fedmsg service: webhook2fedmsg - name: app + annotations: + image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"webhook2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"app\")].image"}]' spec: replicas: 1 selector: @@ -19,8 +21,6 @@ spec: labels: app: webhook2fedmsg service: webhook2fedmsg - annotations: - image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"webhook2fedmsg:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"app\")].image"}]' spec: initContainers: - name: setup diff --git a/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 b/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 index f4c4f12a2f..40822df4b5 100644 --- a/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 +++ b/roles/openshift-apps/webhook2fedmsg/templates/w2fm.cfg.j2 @@ -4,3 +4,4 @@ FASJSON_URL="https://fasjson{{ env_suffix }}.fedoraproject.org" OIDC__PROVIDER_URL="https://id{{ env_suffix }}.fedoraproject.org/openidc" OIDC__CLIENT_ID="webhook2fedmsg" DATAGREPPER_URL="https://apps{{ env_suffix }}.fedoraproject.org/datagrepper" +PRETIX__TOKEN="{{ (env == 'staging')|ternary(webhook2fedmsg_stg_pretix_token, webhook2fedmsg_prod_pretix_token) }}" diff --git a/roles/openshift/rollout/tasks/main.yml b/roles/openshift/rollout/tasks/main.yml index 630aaae2a4..8e423698c9 100644 --- a/roles/openshift/rollout/tasks/main.yml +++ b/roles/openshift/rollout/tasks/main.yml @@ -1,3 +1,3 @@ --- - name: Run `oc rollout latest` - ansible.builtin.shell: oc -n {{rollout_app}} rollout latest {{rollout_dcname}} + ansible.builtin.shell: oc -n {{rollout_app}} rollout restart deployment {{rollout_dname}} diff --git a/roles/openvpn/client/files/zabbix/template-openvpn.yml b/roles/openvpn/client/files/zabbix/template-openvpn.yml index a9cb1770b2..9930e9940b 100644 --- a/roles/openvpn/client/files/zabbix/template-openvpn.yml +++ b/roles/openvpn/client/files/zabbix/template-openvpn.yml @@ -11,6 +11,44 @@ zabbix_export: groups: - name: Fedora items: + - uuid: eb73132afa214eb483990804bd4cb4bf + name: 'OpenVPN Client connectivity performance' + type: ZABBIX_ACTIVE + key: 'net.tcp.service.perf[http,bastion.vpn.fedoraproject.org,25]' + value_type: FLOAT + units: ms + preprocessing: + - type: MULTIPLIER + parameters: + - '1000' + tags: + - tag: application + value: openvpn + - tag: component + value: network + - tag: scope + value: performance + triggers: + - uuid: d81b2b0d733f4cb09cb83d8fbf627b4f + expression: 'min(/OpenVPN Client/net.tcp.service.perf[http,bastion.vpn.fedoraproject.org,25],5m)>{$OPENVPN.PING_TIME.MAX}' + name: 'OpenVPN: Ping time is too high (over {$OPENVPN.PING_TIME.MAX}ms for 5m)' + priority: WARNING + - uuid: cd9f75e2ee7540d3a5d00a48c5aa00f1 + name: 'OpenVPN Client connectivity' + type: ZABBIX_ACTIVE + key: 'net.tcp.service[http,bastion.vpn.fedoraproject.org,25]' + tags: + - tag: application + value: openvpn + - tag: component + value: network + - tag: scope + value: connectivity + triggers: + - uuid: d82801a9fe9b405890b0a46705fe6599 + expression: 'max(/OpenVPN Client/net.tcp.service[http,bastion.vpn.fedoraproject.org,25],#3)=0' + name: 'OpenVPN: Client cannot ping batcave01' + priority: AVERAGE - uuid: 93da423abd37459e9d5478e183048bd9 name: 'Time left on OpenVPN Cert' type: TRAP @@ -45,3 +83,7 @@ zabbix_export: tags: - tag: service value: openvpn + macros: + - macro: '{$OPENVPN.PING_TIME.MAX}' + value: '1000' + description: 'ms warning time for openvpn performance' diff --git a/roles/openvpn/server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org b/roles/openvpn/server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org new file mode 100644 index 0000000000..fa71bde4ac --- /dev/null +++ b/roles/openvpn/server/files/ccd-rdu3/s390x-test01.fedorainfracloud.org @@ -0,0 +1,2 @@ +# ifconfig-push actualIP PtPIP +ifconfig-push 192.168.100.39 192.168.100.39 diff --git a/roles/packager_alias/files/package-owner-aliases.sh b/roles/packager_alias/files/package-owner-aliases.sh index 9c62527bf7..0ae6a9bbcb 100755 --- a/roles/packager_alias/files/package-owner-aliases.sh +++ b/roles/packager_alias/files/package-owner-aliases.sh @@ -16,10 +16,10 @@ cp $output $dest chmod +r $output mv $output $dest /usr/sbin/restorecon /etc/postfix/package-owner -/usr/sbin/postalias /etc/postfix/package-owner +/usr/sbin/postalias lmdb:/etc/postfix/package-owner cp $moutput $mdest chmod +r $moutput mv $moutput $mdest /usr/sbin/restorecon /etc/postfix/package-maintainers -/usr/sbin/postalias /etc/postfix/package-maintainers +/usr/sbin/postalias lmdb:/etc/postfix/package-maintainers diff --git a/roles/pagure/files/hotfix/004-commit-hash-traceback.patch b/roles/pagure/files/hotfix/004-commit-hash-traceback.patch new file mode 100644 index 0000000000..0b6fb6441f --- /dev/null +++ b/roles/pagure/files/hotfix/004-commit-hash-traceback.patch @@ -0,0 +1,18 @@ +diff --git a/pagure/ui/filters.py b/pagure/ui/filters.py +index 17a97160..e5a1ef1d 100644 +--- a/pagure/ui/filters.py 2024-05-24 10:43:47.000000000 -0400 ++++ b/pagure/ui/filters.py 2026-05-19 17:56:07.900604131 -0400 +@@ -144,8 +144,11 @@ + output = ['
', ''] + + commit_hash = commit +- if hasattr(commit_hash, "hex"): ++ # This can traceback, so try/except ++ try: + commit_hash = commit_hash.hex ++ except: ++ commit_hash = commit + + comments = {} + if prequest and not isinstance(prequest, flask.wrappers.Request): +Only in pagure-5.14.1-build-new/pagure-5.14.1/pagure/ui: filters.py~ diff --git a/roles/pagure/tasks/main.yml b/roles/pagure/tasks/main.yml index 3d7b874e26..96cdb5f381 100644 --- a/roles/pagure/tasks/main.yml +++ b/roles/pagure/tasks/main.yml @@ -429,6 +429,12 @@ - fedora-messaging +- name: Apply patches + ansible.builtin.import_tasks: patches.yml + tags: + - pagure + - patches + # Set-up Pagure - name: Create the folders used for releases and archives diff --git a/roles/pagure/tasks/patches.yml b/roles/pagure/tasks/patches.yml new file mode 100644 index 0000000000..1c3b4495b6 --- /dev/null +++ b/roles/pagure/tasks/patches.yml @@ -0,0 +1,35 @@ +--- +- name: Install patch and filterdiff + ansible.builtin.dnf: + name: + - patch + - patchutils + +- name: Prepare the patches directory + ansible.builtin.file: + path: /opt/patches + state: directory + mode: "0755" + +- name: Download patches + ansible.builtin.copy: + src: /srv/web/infra/bigfiles/hotfixes/pagure/{{ item }}.patch + dest: /opt/patches/{{ item }}.patch + owner: root + group: root + mode: "0644" + loop: "{{ pagure_patches }}" + +- name: Apply patches + ansible.builtin.shell: + chdir: "{{ ansible_facts['python3']['sitelib'] }}" + cmd: filterdiff --include '?/pagure/*' /opt/patches/{{ item }}.patch | patch -p1 --forward --fuzz=0 --reject-file=- --batch + loop: "{{ pagure_patches }}" + register: result + ignore_errors: true + changed_when: + - "'Reversed (or previously applied) patch detected!' not in result.stdout" + - result.rc == 0 + failed_when: "'FAILED' in result.stdout" + notify: + - Restart apache diff --git a/roles/people/templates/people.conf b/roles/people/templates/people.conf index 3e18e101fb..5d9b693e2f 100644 --- a/roles/people/templates/people.conf +++ b/roles/people/templates/people.conf @@ -59,6 +59,13 @@ NameVirtualHost *:80 ProxyPass / http://[::1]:8923/ ProxyPassReverse / http://[::1]:8923/ + # This tells the proxy to remove the ports on redirects ... I think + # we need to use mod_rewrite if we want it to work for *.fp.o + ProxyPassReverse / http://fedorapeople.org:8923/ + ProxyPassReverse / http://ols.fedorapeople.org:8923/ + ProxyPassReverse / http://people.fedorapeople.org:8923/ + ProxyPassReverse / http://people1.fedorapeople.org:8923/ + SetHandler server-status diff --git a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json index 5bed8416ac..b9776c0dad 100644 --- a/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json +++ b/roles/pkgdb-proxy/files/pkgdb-gnome-software-collections.json @@ -37,11 +37,11 @@ "allow_retire": true, "branchname": "f42", "date_created": "2024-05-14 12:36:15", - "date_updated": "2025-02-04 14:07:23", + "date_updated": "2026-05-28 14:07:23", "dist_tag": ".fc42", "koji_name": "f42", "name": "Fedora Linux", - "status": "Active", + "status": "EOL", "version": "42" }, { diff --git a/roles/rabbitmq_cluster/tasks/apps.yml b/roles/rabbitmq_cluster/tasks/apps.yml index bf0a0b8fc1..31761fbb14 100644 --- a/roles/rabbitmq_cluster/tasks/apps.yml +++ b/roles/rabbitmq_cluster/tasks/apps.yml @@ -161,24 +161,22 @@ # ELN END -# ELN CS BEGIN -# -# - name: Eln cs queue -# run_once: true -# include_role: -# name: rabbit/queue -# vars: -# queue_username: distrobuildsync-cs -# user_sent_topics: ^$ -# queue_name: distrobuildsync-cs -# # TTL: 10 days (in miliseconds) -# queue_message_ttl: 864000000 -# queue_routing_keys: -# - "#.buildsys.repo.init" -# - "#.buildsys.repo.done" -# - "#.buildsys.tag" -# -# ELN END +# ELN-CentOS Stream Syncing BEGIN + +- name: ELN-CS Sync queue + run_once: true + include_role: + name: rabbit/queue + vars: + queue_username: eln-cxs-sync + user_sent_topics: ^$ + queue_name: eln-cxs-sync + # TTL: 10 days (in miliseconds) + queue_message_ttl: 864000000 + queue_routing_keys: + - "#.buildsys.tag" + +# ELN-CentOS Stream Syncing END - name: LogDetective - Packit run_once: true @@ -187,3 +185,11 @@ vars: user_name: logdetective-packit{{ env_suffix }} user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.logdetective\..* + +- name: Lookaside cache + run_once: true + include_role: + name: rabbit/user + vars: + user_name: git-hooks{{ env_suffix }} + user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.git\.lookaside\..* diff --git a/roles/robosignatory/templates/robosignatory.toml.j2 b/roles/robosignatory/templates/robosignatory.toml.j2 index e83ce598b0..5929d53301 100644 --- a/roles/robosignatory/templates/robosignatory.toml.j2 +++ b/roles/robosignatory/templates/robosignatory.toml.j2 @@ -112,13 +112,6 @@ handlers = ["console"] key = "{{ (env == 'production')|ternary('fedora-infra', 'testkey') }}" keyid = "{{ (env == 'production')|ternary('47dd8ef9', 'd300e724') }}" - [[consumer_config.koji_instances.primary.tags]] - from = "f42-infra-candidate" - to = "f42-infra-stg" - key = "{{ (env == 'production')|ternary('fedora-infra', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('47dd8ef9', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - [[consumer_config.koji_instances.primary.tags]] from = "f43-infra-candidate" to = "f43-infra-stg" @@ -142,13 +135,6 @@ handlers = ["console"] # Gated coreos-pool tag - [[consumer_config.koji_instances.primary.tags]] - from = "f42-coreos-signing-pending" - to = "coreos-pool" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('105ef944', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - [[consumer_config.koji_instances.primary.tags]] from = "f43-coreos-signing-pending" to = "coreos-pool" @@ -232,20 +218,6 @@ handlers = ["console"] trusted_taggers = ['bodhi'] file_signing_key = "fedora-43-ima" - [[consumer_config.koji_instances.primary.tags]] - from = "f42-signing-pending" - to = "f42-updates-testing-pending" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('105ef944', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - - [consumer_config.koji_instances.primary.tags.sidetags] - pattern = 'f42-build-side-' - from = '-signing-pending' - to = '-testing-pending' - trusted_taggers = ['bodhi'] - file_signing_key = "fedora-42-ima" - # Gated bodhi updates {% for tag in epel_tags %} @@ -363,13 +335,6 @@ handlers = ["console"] keyid = "{{ (env == 'production')|ternary('31645531', 'd300e724') }}" file_signing_key = "fedora-43-ima" - [[consumer_config.koji_instances.primary.tags]] - from = "f42-openh264" - to = "f42-openh264" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('105ef944', 'd300e724') }}" - file_signing_key = "fedora-42-ima" - [[consumer_config.koji_instances.primary.tags]] from = "epel9-openh264" to = "epel9-openh264" @@ -385,13 +350,13 @@ handlers = ["console"] keyid = "{{ (env == 'production')|ternary('31645531', 'd300e724') }}" file_signing_key = "fedora-43-ima" - # F43 Python Side tag (f43-python) + # F45 Python Side tag (f45-python) [[consumer_config.koji_instances.primary.tags]] - from = "f43-python" - to = "f43-python" - key = "{{ (env == 'production')|ternary('fedora-43', 'testkey') }}" - keyid = "{{ (env == 'production')|ternary('31645531', 'd300e724') }}" - file_signing_key = "fedora-43-ima" + from = "f45-python" + to = "f45-python" + key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" + keyid = "{{ (env == 'production')|ternary('f577861e', 'd300e724') }}" + file_signing_key = "fedora-45-ima" [consumer_config.ostree_refs] @@ -418,44 +383,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/iot/repo/" key = "{{ (env == 'production')|ternary('fedora-44', 'testkey') }}" - # f42 silveblue ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/silverblue"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 silveblue ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/silverblue"] @@ -546,44 +473,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 kinoite ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/kinoite"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 kinoite ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/kinoite"] @@ -674,44 +563,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 sericea ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/sericea"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 sericea ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/sericea"] @@ -802,44 +653,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 onyx ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/updates/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/ppc64le/testing/onyx"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 onyx ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/onyx"] @@ -930,32 +743,6 @@ handlers = ["console"] directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" key = "{{ (env == 'production')|ternary('fedora-45', 'testkey') }}" - # f42 cosmic-atomic ostree refs - - [consumer_config.ostree_refs."fedora/42/x86_64/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/updates/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/x86_64/testing/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/updates/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - - [consumer_config.ostree_refs."fedora/42/aarch64/testing/cosmic-atomic"] - directory = "/mnt/fedora_koji/koji/compose/ostree/repo/" - key = "{{ (env == 'production')|ternary('fedora-42', 'testkey') }}" - # f43 cosmic-atomic ostree refs [consumer_config.ostree_refs."fedora/43/x86_64/cosmic-atomic"] diff --git a/roles/siguldry/bridge/handlers/main.yml b/roles/siguldry/bridge/handlers/main.yml new file mode 100644 index 0000000000..4dc212b8ec --- /dev/null +++ b/roles/siguldry/bridge/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-bridge + ansible.builtin.systemd: + name: siguldry-bridge.service + state: restarted + tags: + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/tasks/main.yml b/roles/siguldry/bridge/tasks/main.yml new file mode 100644 index 0000000000..790ca8fe1f --- /dev/null +++ b/roles/siguldry/bridge/tasks/main.yml @@ -0,0 +1,116 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/bridge + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Create siguldry-bridge systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-bridge.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge systemd override file + ansible.builtin.template: + src: override.conf.j2 + dest: /etc/systemd/system/siguldry-bridge.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup siguldry-bridge config file + ansible.builtin.template: + src: bridge.toml.j2 + dest: /etc/siguldry/bridge.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-bridge + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup bridge certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-bridge.crt" + dest: /etc/siguldry/bridge.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/bridge + +- name: Enable and start siguldry-bridge service + ansible.builtin.systemd: + name: siguldry-bridge.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/bridge diff --git a/roles/siguldry/bridge/templates/bridge.toml.j2 b/roles/siguldry/bridge/templates/bridge.toml.j2 new file mode 100644 index 0000000000..4b2a168565 --- /dev/null +++ b/roles/siguldry/bridge/templates/bridge.toml.j2 @@ -0,0 +1,21 @@ +# The socket address to listen on for incoming connections from Siguldry servers. +# +# The default is to listen on all interfaces on port 44333. +server_listening_address = "[::]:44333" + +# The socket address to listen on for incoming connections from Siguldry clients. +# +# The default is to listen on all interfaces on port 44334. +client_listening_address = "[::]:44334" + +# The TLS credentials for the server and client listeners. +# +# Both clients and servers connect to the above addresses and perform mutual TLS. +# Note that the certificate must have `serverAuth` in its extended key usage extension. +# +# Paths that aren't absolute are loaded relative to systemd's credentials directory, +# which are encrypted, see https://systemd.io/CREDENTIALS/ +[credentials] +private_key = "siguldry.bridge.private_key.pem" +certificate = "/etc/siguldry/bridge.crt" +ca_certificate = "/etc/siguldry/ca.crt" diff --git a/roles/siguldry/bridge/templates/override.conf.j2 b/roles/siguldry/bridge/templates/override.conf.j2 new file mode 100644 index 0000000000..a33171f49c --- /dev/null +++ b/roles/siguldry/bridge/templates/override.conf.j2 @@ -0,0 +1,12 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_BRIDGE_LOG="WARN,siguldry=INFO" + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/defaults/main.yml b/roles/siguldry/server/defaults/main.yml new file mode 100644 index 0000000000..45d5f3c18c --- /dev/null +++ b/roles/siguldry/server/defaults/main.yml @@ -0,0 +1,7 @@ +--- + +siguldry_kryoptic_conf: "/etc/siguldry/kryoptic.toml" +siguldry_kryoptic_db: "/var/lib/siguldry/kryoptic.sqlite" + +siguldry_kryoptic_so_pin: "12345678" +siguldry_kryoptic_user_pin: "123456" diff --git a/roles/siguldry/server/handlers/main.yml b/roles/siguldry/server/handlers/main.yml new file mode 100644 index 0000000000..a956d31dca --- /dev/null +++ b/roles/siguldry/server/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: Restart siguldry-server + ansible.builtin.systemd: + name: siguldry-server.service + state: restarted + tags: + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/kryoptic.yml b/roles/siguldry/server/tasks/kryoptic.yml new file mode 100644 index 0000000000..bb474bd97c --- /dev/null +++ b/roles/siguldry/server/tasks/kryoptic.yml @@ -0,0 +1,151 @@ +--- +# For staging, use Kryoptic as a software HSM for binding +- name: Install kryoptic and PKCS#11 tools (staging only) + ansible.builtin.package: + state: present + name: + - kryoptic + - opensc + - openssl + - pkcs11-provider + tags: + - packages + - siguldry + - siguldry/server + +- name: Setup kryoptic configuration + ansible.builtin.template: + src: kryoptic.toml.j2 + dest: "{{ siguldry_kryoptic_conf }}" + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Check if kryoptic token is initialized + ansible.builtin.stat: + path: "{{ siguldry_kryoptic_db }}" + register: kryoptic_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic PKCS#11 token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --init-token + --label siguldry-stg-token + --so-pin env:KRYOPTIC_SO_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize kryoptic user PIN + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --so-pin env:KRYOPTIC_SO_PIN + --init-pin + --new-pin env:KRYOPTIC_USER_PIN + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: not kryoptic_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Check for existing binding key + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --list-objects + --type privkey + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + register: kryoptic_objects + changed_when: false + tags: + - config + - siguldry + - siguldry/server + +- name: Generate RSA binding key pair + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server + +- name: Create self-signed x509 binding certificate + ansible.builtin.command: + cmd: >- + openssl req -x509 + -provider pkcs11 + -subj /CN=siguldry-binding-key + -passin pass:{{ siguldry_kryoptic_user_pin }} + -key pkcs11:token=siguldry-stg-token;type=private + -out /etc/siguldry/kryoptic-binding.crt + creates: /etc/siguldry/kryoptic-binding.crt + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + tags: + - config + - siguldry + - siguldry/server + +- name: Import x509 certificate to token + ansible.builtin.command: + cmd: >- + pkcs11-tool + --module /usr/lib64/pkcs11/libkryoptic_pkcs11.so + --login + --pin env:KRYOPTIC_USER_PIN + --keypairgen + --key-type rsa:4096 + --usage-sign + --usage-decrypt + --id 1 + --label siguldry-binding-key + environment: + KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}" + KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}" + when: "'siguldry-binding-key' not in kryoptic_objects.stdout" + tags: + - config + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/tasks/main.yml b/roles/siguldry/server/tasks/main.yml new file mode 100644 index 0000000000..c205deb2bc --- /dev/null +++ b/roles/siguldry/server/tasks/main.yml @@ -0,0 +1,202 @@ +--- +- name: Install siguldry package + ansible.builtin.package: + state: present + name: siguldry + tags: + - packages + - siguldry + - siguldry/server + +# We only need to grant the service explicit access to the TPM on systemd < 258 +- name: Get systemd version + ansible.builtin.command: systemctl --version + register: systemd_version_output + changed_when: systemd_version_output.rc != 0 + +- name: Set whether explicit AllowDevice override is needed + ansible.builtin.set_fact: + explicit_allow_tpm: "{{ (systemd_version_output.stdout_lines[0] | regex_search('\\d+') | int) < 258 }}" + +- name: Create siguldry config directory + ansible.builtin.file: + path: /etc/siguldry + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Create credstore.encrypted directory + ansible.builtin.file: + path: /etc/credstore.encrypted + state: directory + owner: root + group: root + mode: '0700' + tags: + - config + - siguldry + - siguldry/server + +- name: Ensure the siguldry state directory exists + ansible.builtin.file: + path: /var/lib/siguldry + state: directory + owner: siguldry + group: siguldry + mode: '0750' + tags: + - siguldry + - siguldry/server + +- name: Create siguldry-signer systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-signer@.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-signer systemd override file + ansible.builtin.template: + src: signer-override.conf.j2 + dest: /etc/systemd/system/siguldry-signer@.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Create siguldry-server systemd override directory + ansible.builtin.file: + path: /etc/systemd/system/siguldry-server.service.d + state: directory + owner: root + group: root + mode: '0755' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server systemd override file + ansible.builtin.template: + src: server-override.conf.j2 + dest: /etc/systemd/system/siguldry-server.service.d/override.conf + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup siguldry-server config file + ansible.builtin.template: + src: server.toml.j2 + dest: /etc/siguldry/server.toml + owner: root + group: root + mode: '0644' + notify: Restart siguldry-server + tags: + - config + - siguldry + - siguldry/server + +- name: Setup server certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/issued/siguldry-server.crt" + dest: /etc/siguldry/server.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup CA certificate + ansible.builtin.copy: + src: "{{ private }}/files/siguldryca/{{ env }}/pki/ca.crt" + dest: /etc/siguldry/ca.crt + owner: root + group: root + mode: '0644' + tags: + - config + - siguldry + - siguldry/server + +- name: Setup binding certificates + ansible.builtin.copy: + src: "{{ private }}/files/sigul/{{ item }}" + dest: "/etc/siguldry/{{ item }}" + owner: root + group: root + mode: '0644' + with_items: + - yubikey_sv03.pem + - yubikey_sv04.pem + - yubikey_sv05.pem + - yubikey_sv06.pem + when: env == "production" + tags: + - config + - siguldry + - siguldry/server + +- name: Setup software HSM for binding certificate in staging + ansible.builtin.include_tasks: kryoptic.yml + when: env != "production" + tags: + - siguldry + - siguldry/server + +- name: Check if siguldry database is initialized + ansible.builtin.stat: + path: /var/lib/siguldry/siguldry.sqlite + register: siguldry_db + tags: + - config + - siguldry + - siguldry/server + +- name: Initialize Siguldry database + ansible.builtin.command: + cmd: >- + systemd-run --pty --wait --collect + --working-directory=/var/lib/siguldry + --setenv=SIGULDRY_SERVER_CONFIG=/etc/siguldry/server.toml + --property=UMask=017 + --uid=siguldry + --gid=siguldry + siguldry-server manage migrate + when: not siguldry_db.stat.exists + tags: + - config + - siguldry + - siguldry/server + +- name: Enable and start siguldry-server service + ansible.builtin.systemd: + name: siguldry-server.service + enabled: yes + state: started + daemon_reload: yes + tags: + - services + - siguldry + - siguldry/server diff --git a/roles/siguldry/server/templates/kryoptic.toml.j2 b/roles/siguldry/server/templates/kryoptic.toml.j2 new file mode 100644 index 0000000000..4880b0a7cf --- /dev/null +++ b/roles/siguldry/server/templates/kryoptic.toml.j2 @@ -0,0 +1,4 @@ +[[slots]] +slot = 1 +dbtype = "sqlite" +dbargs = "{{ siguldry_kryoptic_db }}" diff --git a/roles/siguldry/server/templates/server-override.conf.j2 b/roles/siguldry/server/templates/server-override.conf.j2 new file mode 100644 index 0000000000..60aa35e97c --- /dev/null +++ b/roles/siguldry/server/templates/server-override.conf.j2 @@ -0,0 +1,12 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +{% if explicit_allow_tpm %} +# Credentials require the TPM to decrypt. +# +# For systemd 257 and older you'll need to explicitly allow access to the TPM +# Refer to https://github.com/systemd/systemd/issues/35959. +DeviceAllow=/dev/tpmrm0 +{% endif %} diff --git a/roles/siguldry/server/templates/server.toml.j2 b/roles/siguldry/server/templates/server.toml.j2 new file mode 100644 index 0000000000..759673e6c6 --- /dev/null +++ b/roles/siguldry/server/templates/server.toml.j2 @@ -0,0 +1,101 @@ +# The location where the server should store its state. +# +# To back up the service, back up this directory. +state_directory = "/var/lib/siguldry/" + +# The hostname of the Siguldry bridge. +{% if env == "production" %} +bridge_hostname = "sign-bridge.{{datacenter}}.fedoraproject.org" +{% else %} +bridge_hostname = "sign-bridge.stg.{{datacenter}}.fedoraproject.org" +{% endif %} + +# The port to use when connecting to the Siguldry bridge. +bridge_port = 44333 + +# The number of ready connections to maintain with the bridge. This decreases the latency of +# responses when multiple client connections are established, at the expense of some idle +# connections. Be aware that the bridge has its own limits on the allowable number of idle +# server connections. If you use multiple servers with a single bridge, be sure that the +# bridge allows enough idle connections to cover each server's pool size. The default is 32. +connection_pool_size = 32 + +# The minimum length for user's access password, in *bytes*. For example, the multi-byte +# UTF-8 character "🪿" counts as 4 bytes. +user_password_length = 64 + +# The user ID to use when creating OpenPGP keys. +# +# This is typically an email like "Signing Key ". +openpgp_user_id = "Fedora " + +# The set of certificates to encrypt passwords with. +# +# At least one entry should include a PKCS#11 URI for a private key. Signing keys are encrypted +# using each certificate, so providing more than one binding means *any* of the private keys +# associated with the certificates will allow you to access the signing key, assuming you have +# the user-set password for the key as well. +# +# When binding is used, the admin needs to unlock the token by entering the PIN using +# "siguldry-server enter-pin". +# +# If no bindings are configured, the keys are protected using only the user-provided +# password. +# +# An example binding entry: +# +# [[pkcs11_bindings]] +# certificate = "/path/to/cert.pem" +# private_key = "pkcs11:token=some-token;type=private" +# +# [[pkcs11_bindings]] +# certificate = "/path/to/a/second/cert.pem" +{% if env == "production" %} +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv03.pem" +{% if inventory_hostname.startswith('sign-vault03') %} +private_key = "pkcs11:serial=8f2a341e00d7a665;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/sigul/yubikey_sv04.pem" +{% if inventory_hostname.startswith('sign-vault04') %} +private_key = "pkcs11:serial=b38ee13e56b3b987;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv05.pem" +{% if inventory_hostname.startswith('sign-vault05') %} +private_key = "pkcs11:serial=e8dae68ae187ff13;id=%03;type=private" +{% endif %} + +[[pkcs11_bindings]] +certificate = "/etc/siguldry/yubikey_sv06.pem" +{% if inventory_hostname.startswith('sign-vault06') or inventory_hostname == "sign-vault01.rdu3.fedoraproject.org" %} +private_key = "pkcs11:serial=e3c4804a6631dd5f;id=%03;type=private" +{% endif %} + +{% else %} +# In staging, use Kryoptic as a software HSM for binding +[[pkcs11_bindings]] +certificate = "/etc/siguldry/kryoptic-binding.crt" +private_key = "pkcs11:token=siguldry-stg-token;type=private" +{% endif %} + +# The credentials to use when connecting to the bridge and when accepting client connections +# tunneled through the bridge. Note that the certificate must have both `clientAuth` and +# `serverAuth` in its extended key usage extension. +[credentials] +private_key = "siguldry.server.private_key.pem" +certificate = "/etc/siguldry/server.crt" +ca_certificate = "/etc/siguldry/ca.crt" + +# Certificates created by Siguldry allow the user to specify the subject's common name. +# +# The rest of the certificate's subject is specified here. +[certificate_subject] +country = "US" +state_or_province = "North Carolina" +locality = "Raleigh" +organization = "Red Hat, Inc." +organizational_unit = "The Fedora Project" diff --git a/roles/siguldry/server/templates/signer-override.conf.j2 b/roles/siguldry/server/templates/signer-override.conf.j2 new file mode 100644 index 0000000000..38c8eb1397 --- /dev/null +++ b/roles/siguldry/server/templates/signer-override.conf.j2 @@ -0,0 +1,16 @@ +[Service] +# Tweak for lower/higher log verbosity. +# Refer to https://docs.rs/tracing-subscriber/0.3.19/tracing_subscriber/filter/struct.EnvFilter.html#directives +Environment=SIGULDRY_SERVER_LOG="WARN,siguldry=INFO" + +{% if env != "production" %} +# Kryoptic software HSM configuration for staging +Environment=KRYOPTIC_CONF="{{ siguldry_kryoptic_conf }}" +{% endif %} + +# Unbinding keys requires access to a Yubikey +# I'm not sure there's a good way to allow _only_ the Yubikey device. +# +# TODO: also need to add access to whatever device has the Secure Boot keys. +# Also TODO: is this even the right way to expose USB devices? +DeviceAllow=/dev/bus/usb diff --git a/roles/varnish/files/zabbix/template.yml b/roles/varnish/files/zabbix/template.yml index 9c489ce896..709fe67117 100644 --- a/roles/varnish/files/zabbix/template.yml +++ b/roles/varnish/files/zabbix/template.yml @@ -40,8 +40,8 @@ zabbix_export: dependencies: - name: 'Varnish: Process is not running' expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' - - name: 'Varnish: Service is down' - expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - name: 'Varnish: Service is down (3 tries)' + expression: 'count(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],#3,,0)=3' - uuid: 80295421232547dfba8159e974c236d6 name: 'Varnish: Service ping' type: ZABBIX_ACTIVE @@ -52,8 +52,8 @@ zabbix_export: value: Varnish triggers: - uuid: 4c754b657d944992b309c0a92bb01499 - expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' - name: 'Varnish: Service is down' + expression: 'count(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],#3,,0)=3' + name: 'Varnish: Service is down (3 tries)' priority: AVERAGE manual_close: 'YES' dependencies: @@ -363,8 +363,8 @@ zabbix_export: dependencies: - name: 'Varnish: Process is not running' expression: 'last(/Varnish Cache Monitoring/proc.num["{$VARNISH.PROCESS_NAME}"])=0' - - name: 'Varnish: Service is down' - expression: 'last(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"])=0' + - name: 'Varnish: Service is down (3 tries)' + expression: 'count(/Varnish Cache Monitoring/net.tcp.service[http,"{$VARNISH.STATUS.HOST}","{$VARNISH.STATUS.PORT}"],#3,,0)=3' - uuid: 017f130075e44226ab676b4758445a6c name: 'Varnish: Total request bytes' type: DEPENDENT diff --git a/roles/web-data-analysis/files/zabbix-template.yml b/roles/web-data-analysis/files/zabbix-template.yml new file mode 100644 index 0000000000..d888ad650a --- /dev/null +++ b/roles/web-data-analysis/files/zabbix-template.yml @@ -0,0 +1,293 @@ +zabbix_export: + version: '7.0' + template_groups: + - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec + name: Fedora + templates: + - uuid: 447d0b4d8918402a916f8412a7c96f34 + template: 'Web-Data checks' + name: 'Web-Data checks' + description: 'Checks on log01 for the CountMe datasets' + groups: + - name: Fedora + items: + - uuid: de95b200d3dd4f73a598d1dbbab53f4e + name: 'CentOS countme raw DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/raw-centos.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: ade949dbd0a94e24925a2d291b85e65a + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw-centos.db,modify]) > 86400' + name: 'CentOS countme raw DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'CentOS countme raw DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw-centos.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: 0d7a51ceb35e4016b10ba66224134d1a + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw-centos.db,modify]) > 172800' + name: 'CentOS countme raw DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 19fce9d2507a4e1b847687c8489d6a8e + name: 'Fedora countme raw DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/raw.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: c26d7114364f4024b2c578941ec33e25 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw.db,modify]) > 86400' + name: 'Fedora countme raw DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'Fedora countme raw DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: 32ab177829ac4f3c9c7dedf2554e7cf3 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/raw.db,modify]) > 172800' + name: 'Fedora countme raw DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 9b5d2df694ec4b6b82bece288fdb6b09 + name: 'CentOS countme totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/totals-centos.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: c5dc12e66f1f49209bfd415d462faab2 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals-centos.db,modify]) > 604800' + name: 'CentOS countme totals DB timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'CentOS countme totals DB timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals-centos.db,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: ec0ed1a4fc2f4e9fa214426cbb81459e + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals-centos.db,modify]) > 691200' + name: 'CentOS countme totals DB timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 7f066857c5df40378be6e82bb9d5df0f + name: 'Fedora countme totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/lib/countme/totals.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 7e500bd165284a3aa73bd683b341711a + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals.db,modify]) > 604800' + name: 'Fedora countme totals DB timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'Fedora countme totals DB timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals.db,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: c396067105874fe69ab37663cc8b643e + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/lib/countme/totals.db,modify]) > 691200' + name: 'Fedora countme totals DB timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 900bf5585bdf45618e5759ee24dfad9e + name: 'CentOS countme web totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: e8e05a96d13e470cb6e9284cd44c192f + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]) > 604800' + name: 'CentOS countme web totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'CentOS countme web totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: afe95177e98e4c3fb022aa07cbfedb3d + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-countme.db.gz,modify]) > 691200' + name: 'CentOS countme web totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: d31e85b93bb14ba1907a24783919261e + name: 'CentOS countme web unique totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 969db33400f24ef7a8739bc4cd481418 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]) > 604800' + name: 'CentOS countme web unique totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'CentOS countme web unique totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: f2f699582e4f4d0c9b6ce48aa4113cb0 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos-unique.db.gz,modify]) > 691200' + name: 'CentOS countme web unique totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 6830cb82c2bf47e99d8f7472c41c63ed + name: 'CentOS countme web totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 9fff0bccd1c9471a8eb201b9224a0462 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]) > 86400' + name: 'CentOS countme web totals DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'CentOS countme web totals DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: 2dcfc8ceddd34aaabecd90ce8ac3aa51 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-centos.db,modify]) > 172800' + name: 'CentOS countme web totals DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 489ac2f375ed4efcaba287f1f49647fa + name: 'Fedora countme web totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 91a373f54ac54a678c74eee83e2cd876 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]) > 604800' + name: 'Fedora countme web totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'Fedora countme web totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: 24e361f74ad248e2a2acba7b6327a1b4 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-countme.db.gz,modify]) > 691200' + name: 'Fedora countme web totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: c1f87919fe4a4c22a7f9e28d9ab24ef9 + name: 'Fedora countme web unique totals DB (gzip) timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: f887f1c0bd884b75b8825c87526df479 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]) > 604800' + name: 'Fedora countme web unique totals DB (gzip) timestamp is more than 7 days old' + priority: WARNING + dependencies: + - name: 'Fedora countme web unique totals DB (gzip) timestamp is more than 8 days old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]) > 691200' + tags: + - tag: scope + value: file_age + - uuid: 55df9f8ee62d4c9691bf4f9071df52cf + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals-unique.db.gz,modify]) > 691200' + name: 'Fedora countme web unique totals DB (gzip) timestamp is more than 8 days old' + priority: HIGH + tags: + - tag: scope + value: file_age + - uuid: 044a800e8fd6440a86810a44aa3f2b19 + name: 'Fedora countme web totals DB timestamp' + type: ZABBIX_ACTIVE + key: 'vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]' + history: 1d + trends: '0' + units: unixtime + tags: + - tag: application + value: countme + triggers: + - uuid: 5c24063c245a40899aea54d62357864b + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]) > 86400' + name: 'Fedora countme web totals DB timestamp is more than 24 hours old' + priority: WARNING + dependencies: + - name: 'Fedora countme web totals DB timestamp is more than 48 hours old' + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]) > 172800' + tags: + - tag: scope + value: file_age + - uuid: e3970e1a01e1460b928eea98c4534ff3 + expression: 'now() - last(/Web-Data checks/vfs.file.time[/var/www/html/csv-reports/countme/totals.db,modify]) > 172800' + name: 'Fedora countme web totals DB timestamp is more than 48 hours old' + priority: HIGH + tags: + - tag: scope + value: file_age diff --git a/roles/web-data-analysis/tasks/main.yml b/roles/web-data-analysis/tasks/main.yml index 3b7f338bf6..f7135eaf9a 100644 --- a/roles/web-data-analysis/tasks/main.yml +++ b/roles/web-data-analysis/tasks/main.yml @@ -252,3 +252,30 @@ tags: - config - web-data + +# Zabbix monitoring of the CountMe datasets +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - web-data + - zabbix_api + block: + - name: Import web-data checks template + community.zabbix.zabbix_template: + template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}" + state: present + run_once: true + + - name: Add self to web-data checks template in Zabbix + community.zabbix.zabbix_host: + host_name: "{{ inventory_hostname }}" + link_templates: Web-Data checks + force: false diff --git a/roles/zabbix/sslchecks/tasks/httpcheck.yml b/roles/zabbix/sslchecks/tasks/httpcheck.yml new file mode 100644 index 0000000000..7834834cd1 --- /dev/null +++ b/roles/zabbix/sslchecks/tasks/httpcheck.yml @@ -0,0 +1,40 @@ +--- +- name: Zabbix API Block + vars: + ansible_zabbix_auth_key: "{{ zabbix_auth_key }}" + ansible_network_os: "{{ zabbix_network_os }}" + ansible_connection: "{{ zabbix_connection }}" + ansible_httpapi_port: "{{ zabbix_httpapi_port }}" + ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}" + ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}" + ansible_host: "{{ zabbix_server }}" + ansible_zabbix_url_path: "{{ zabbix_url_path }}" + tags: + - zabbix_agent + - zabbix_api + block: + - name: Create {{ item.name }} http connection item + community.zabbix.zabbix_item: + name: "{{ item.name }}" + host_name: "{{ inventory_hostname }}" + params: + type: zabbix_agent_active + key: "web.page.regexp[{{ item.name }},,,{{ item.string }}]" + value_type: character + interval: 1m + tags: + - tag: component + value: http + + - name: Create {{ item.name }} http connection trigger + community.zabbix.zabbix_trigger: + name: "{{ item.name }} - text not found" + host_name: "{{ inventory_hostname }}" + params: + severity: average + expression: "last(/{{ inventory_hostname }}/web.page.regexp[{{ item.name }},,,{{ item.string }}])<>'{{ item.string }}'" + enabled: true + manual_close: true + tags: + - tag: scope + value: availability diff --git a/roles/zabbix/sslchecks/tasks/main.yml b/roles/zabbix/sslchecks/tasks/main.yml index e1a845238e..fe3b149416 100644 --- a/roles/zabbix/sslchecks/tasks/main.yml +++ b/roles/zabbix/sslchecks/tasks/main.yml @@ -2,13 +2,17 @@ - name: Create SSL checks for other hosts include_tasks: sslcheck.yml loop: + - { name: '*.apps.ocp.fedoraproject.org', cert: 'console-openshift-console.apps.ocp.fedoraproject.org', port: '443' } - { name: '*.fedorapeople.org', cert: 'fedorapeople.org', port: '443' } - { name: '*.fedoraproject.org', cert: 'fedoraproject.org', port: '443' } - - { name: '*.apps.ocp.fedoraproject.org', cert: 'console-openshift-console.apps.ocp.fedoraproject.org', port: '443' } + - { name: 'admin.fedoraproject.org', cert: 'admin.fedoraproject.org', port: '443' } - { name: 'api.ocp.fedoraproject.org', cert: 'api.ocp.fedoraproject.org', port: '6443' } + - { name: 'pagure.io', cert: 'pagure.io', port: '443' } - { name: 'raw-updates.coreos.fedoraproject.org', cert: 'raw-updates.coreos.fedoraproject.org', port: '443' } + - { name: 'retrace.fedoraproject.org', cert: 'retrace.fedoraproject.org', port: '443' } - { name: 'status.raw-updates.coreos.fedoraproject.org', cert: 'status.raw-updates.coreos.fedoraproject.org', port: '443' } - { name: 'status.updates.coreos.fedoraproject.org', cert: 'status.updates.coreos.fedoraproject.org', port: '443' } + - { name: 'translate.fedoraproject.org', cert: 'translate.fedoraproject.org', port: '443' } - { name: 'updates.coreos.fedoraproject.org', cert: 'updates.coreos.fedoraproject.org', port: '443' } - { name: 'whatcanidoforfedora.org', cert: 'whatcanidoforfedora.org', port: '443' } tags: @@ -20,6 +24,20 @@ loop: - { name: '*.apps.ocp.stg.fedoraproject.org', cert: 'console-openshift-console.apps.ocp.stg.fedoraproject.org', port: '443' } - { name: 'api.ocp.stg.fedoraproject.org', cert: 'api.ocp.stg.fedoraproject.org', port: '6443' } + - { name: 'stg.pagure.io', cert: 'stg.pagure.io', port: '443' } tags: - zabbix_api when: inventory_hostname == 'zabbix01.stg.rdu3.fedoraproject.org' + +# HTTP service checks on DNS names +- name: Create HTTP checks for other hosts + include_tasks: httpcheck.yml + loop: + - { name: 'http://certgetter01.rdu3.fedoraproject.org', string: 'Index' } + - { name: 'https://lists.fedoraproject.org/archives/', string: 'Fedora Mailing-Lists' } + - { name: 'https://cdn.registry.fedoraproject.org/v2/', string: '{}' } + - { name: 'https://www.fedorastatus.org/index.html', string: 'Fedora Infrastructure Status' } + - { name: 'https://pagure.io/fedora-infrastructure/issues', string: 'Issues' } + tags: + - zabbix_api + when: inventory_hostname == 'zabbix01.rdu3.fedoraproject.org' diff --git a/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml new file mode 100644 index 0000000000..a9903c5f91 --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/defaults/main.yml @@ -0,0 +1,17 @@ +--- +# Used by templates/zabbix-values.yaml.j2 for zabbixProxy TLS-PSK (incoming client connections). +# Inventory sets zabbix_tls_psk_identity and zabbix_tls_psk (private) in group_vars; staging +# layers map zabbix_tls_psk -> zabbix_tls_stg_psk. This fallback keeps the template valid when +# only zabbix_tls_stg_psk is provided (e.g. narrow play / extra-vars). +zabbix_tls_psk_identity: "Fedora" +zabbix_tls_stg_psk: "" + +# Upstream Zabbix *server* the proxy connects to (host:port → proxy ZBX_SERVER_HOST). +zabbix_openshift_proxy_upstream_server_host: "zabbix01.stg.rdu3.fedoraproject.org:10051" +# DaemonSet agent passive Server= (kube DNS name of proxy Service, no port). Agent resolves this to +# the ClusterIP proxies use for passive polls. Helm chart installs Service zabbix-zabbix-helm-chart-proxy in ns zabbix. +zabbix_openshift_agent_server_hostname: zabbix-zabbix-helm-chart-proxy.zabbix.svc.cluster.local +# Extra DaemonSet passive allowlist only (comma-separated IPs/hostnames/CIDR). Do NOT repeat +# zabbix_openshift_agent_server_hostname — it is already in ZBX_SERVER_HOST; duplication breaks startup. +# Proxy / cluster egress IPs if DNS→ClusterIP does not match SYN source addresses. +zabbix_openshift_agent_passiveservers_extra: "10.16.166.118,10.16.166.119,10.16.166.120" diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml new file mode 100644 index 0000000000..e513f3989d --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml @@ -0,0 +1,30 @@ +--- +- name: Generate the zabbix-values.yaml from template + ansible.builtin.template: + src: "zabbix-values.yaml.j2" + dest: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-values.yaml" + mode: "0770" + + +- name: Git clone the Zabbix Helm Chart + ansible.builtin.git: + repo: "https://git.zabbix.com/scm/zt/kubernetes-helm.git" + dest: /tmp/zabbix-kubernetes-helm + version: "release/7.0" + force: true + +- name: Build Helm chart dependencies + ansible.builtin.command: + cmd: helm dependency update + chdir: /tmp/zabbix-kubernetes-helm/ + changed_when: true + +- name: Deploy Forgejo chart from local path + kubernetes.core.helm: + name: zabbix + create_namespace: true + chart_ref: /tmp/zabbix-kubernetes-helm/ + release_name: zabbix + release_namespace: zabbix + values_files: + - "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-values.yaml" diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-namespace.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-namespace.yaml new file mode 100644 index 0000000000..803b578e29 --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-namespace.yaml @@ -0,0 +1,11 @@ +--- +- name: Generate the zabbix-proxy-namespace.yaml from template + ansible.builtin.template: + src: "zabbix-proxy-namespace.yaml.j2" + dest: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-proxy-namespace.yaml" + mode: "0770" + +- name: Deploy the zabbix-proxy-namespace.yaml config + kubernetes.core.k8s: + state: present + src: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-proxy-namespace.yaml" diff --git a/roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml b/roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml new file mode 100644 index 0000000000..6e9f797c56 --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml @@ -0,0 +1,8 @@ +--- +- name: Ensures /root/ocp4/openshift-apps/zabbix-proxy/ dir exists + ansible.builtin.file: + path: "/root/ocp4/openshift-apps/zabbix-proxy/" + state: directory + +- include_tasks: create-zabbix-proxy-namespace.yaml +- include_tasks: call-helm.yaml diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-proxy-namespace.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-proxy-namespace.yaml.j2 new file mode 100644 index 0000000000..d0a380fc38 --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-proxy-namespace.yaml.j2 @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: "zabbix" diff --git a/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 new file mode 100644 index 0000000000..01d073985c --- /dev/null +++ b/roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2 @@ -0,0 +1,476 @@ +## nameOverride -- Override name of app +nameOverride: "" +## fullnameOverride -- Override the full qualified app name +fullnameOverride: "" +## kubeStateMetrics.enabled -- If true, deploys the kube-state-metrics deployment +kubeStateMetrics: + enabled: true + +## Service account for Kubernetes API +rbac: + ## rbac.create Specifies whether the RBAC resources should be created + create: true + additionalRulesForClusterRole: [] + ## - apiGroups: [ "" ] + ## resources: + ## - nodes/proxy + ## verbs: [ "get", "list", "watch" ] +serviceAccount: + ## serviceAccount.create Specifies whether a service account should be created + create: true + ## serviceAccount.name The name of the service account to use. If not set name is generated using the fullname template + name: "" + + +## **Zabbix proxy** configurations +zabbixProxy: + ## Enable use of **Zabbix proxy** + enabled: true + securityContext: + runAsNonRoot: false # Must be false because agent often needs root for host access + # runAsUser: 0 # Explicit root if needed (default is often root) + # fsGroup: 0 # Optional +# Container-level securityContext + containerSecurityContext: + allowPrivilegeEscalation: false # Satisfies one violation (safe to set false) + privileged: false # Ensure not privileged (chart probably doesn't set it) + capabilities: + drop: + - ALL # Drop all extra caps (helps restricted) + seccompProfile: + type: RuntimeDefault # Or "Localhost" if you have a profile + # runAsNonRoot: false # Usually pod-level overrides, but can duplicate + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + resources: {} + image: + ## Zabbix proxy Docker image name + repository: zabbix/zabbix-proxy-sqlite3 + ## Tag of Docker image of Zabbix proxy + tag: alpine-7.0.17 + pullPolicy: IfNotPresent + ## List of dockerconfig secrets names to use when pulling images. Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry + pullSecrets: [] + + env: + ## The variable allows to switch Zabbix proxy mode. By default, value is 0 - active proxy. Allowed values are 0 and 1. + - name: ZBX_PROXYMODE + value: 0 + ## Zabbix proxy hostname + - name: ZBX_HOSTNAME + value: openshift-cluster-proxy + ## Zabbix server host + ## If ProxyMode is set to active mode: + ## IP address or DNS name of Zabbix server to get configuration data from and send data to. + + ## If ProxyMode is set to passive mode: + ## List of comma delimited IP addresses, optionally in CIDR notation, or DNS names of Zabbix server. Incoming connections will be accepted only from the addresses listed here. If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally and '::/0' will allow any IPv4 or IPv6 address. '0.0.0.0/0' can be used to allow any IPv4 address. + ## Example: Server=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.example.com + + ## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value. + - name: ZBX_SERVER_HOST + value: "{{ zabbix_openshift_proxy_upstream_server_host }}" + ## TLS split: proxy -> Zabbix server = plaintext; clients/agents -> proxy = TLS-PSK only. + ## (TLSConnect outbound vs TLSAccept inbound — see Zabbix proxy TLS docs.) + ## zabbix-docker builds TLSPSKFile from ZBX_TLSPSK for incoming PSK; TLSConnect must still be set + ## explicitly (unencrypted) so startup does not require server-side PSK. + - name: ZBX_TLSCONNECT + value: "unencrypted" + - name: ZBX_TLSACCEPT + value: "psk" + - name: ZBX_TLSPSKIDENTITY + value: "{{ zabbix_tls_psk_identity }}" + - name: ZBX_TLSPSK + value: "{{ (env == 'production') | ternary(zabbix_tls_psk, zabbix_tls_stg_psk) }}" + ## The variable is used to specify debug level. By default, value is 3 + - name: ZBX_DEBUGLEVEL + value: 3 + ## Cache size + - name: ZBX_CACHESIZE + value: 128M + ## This variable is specified amount of pre-forked instances of Java pollers. By default, value is 0. If zabbixJavaGateway enable value is 5. + - name: ZBX_STARTJAVAPOLLERS + value: 0 + ## How often the proxy retrieves configuration data from Zabbix server in seconds. Active proxy parameter. Ignored for passive proxies. + - name: ZBX_PROXYCONFIGFREQUENCY + value: 10 + ## List can be extended with other environment variables listed here: https://github.com/zabbix/zabbix-docker/tree/7.0/Dockerfiles/proxy-sqlite3#other-variables + ## For example: + ## The variable is list of comma separated loadable Zabbix modules. + ## - name: ZBX_LOADMODULE + ## value : dummy1.so,dummy2.so + + ## The startupProbe, livenessProbe, readinessProbe variables + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ + + livenessProbe: + enabled: true + tcpSocket: + port: zabbix-proxy + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + readinessProbe: + enabled: false + tcpSocket: + port: zabbix-proxy + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + startupProbe: + enabled: true + tcpSocket: + port: zabbix-proxy + initialDelaySeconds: 30 + timeoutSeconds: 3 + failureThreshold: 5 + periodSeconds: 10 + successThreshold: 1 + + service: + annotations: {} + labels: {} + ## Type of service for Zabbix proxy + type: ClusterIP + ## Port to expose service + port: 10051 + ## Port of application pod + targetPort: 10051 + ## Zabbix proxy Ingress externalIPs with optional path + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## Must be provided if ProxyMode is set to passive mode + externalIPs: [] + ## Loadbalancer IP + ## Only use if service.type is "LoadBalancer" + loadBalancerIP: "" + loadBalancerSourceRanges: [] + + + ## Node selector for Zabbix proxy + nodeSelector: {} + + ## Tolerations configuration for Zabbix proxy + tolerations: {} + + ## Affinity configuration for Zabbix proxy + affinity: {} + + persistentVolume: + ## If true, Zabbix proxy will create/use a Persistent Volume Claim + ## + enabled: true + + ## Zabbix proxy data Persistent Volume access modes + ## Must match those of existing PV or dynamic provisioner + ## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + accessModes: + - ReadWriteOnce + + ## Zabbix proxy data Persistent Volume Claim annotations + ## + annotations: {} + + ## Zabbix proxy data Persistent Volume existing claim name + ## Requires zabbixProxy.persistentVolume.enabled: true + ## If defined, PVC must be created manually before volume will be bound + existingClaim: "zabbix-zabbix-helm-chart-proxy" + + ## Zabbix proxy data Persistent Volume mount root path + ## + mountPath: /data + + ## Zabbix proxy data Persistent Volume size + ## + size: 2Gi + + ## Zabbix proxy data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "ocs-storagecluster-ceph-rbd" + + ## Zabbix proxy data Persistent Volume Binding Mode + ## If defined, volumeBindingMode: + ## If undefined (the default) or set to null, no volumeBindingMode spec is + ## set, choosing the default mode. + ## + volumeBindingMode: "" + + ## Subdirectory of Zabbix proxy data Persistent Volume to mount + ## Useful if the volume's root directory is not empty + ## + subPath: "" + +## **Zabbix agent** configurations +zabbixAgent: + ## Enable use of Zabbix agent + enabled: true + ## Set resource requests/limits for Zabbix agents + resources: {} + ## requests: + ## cpu: 100m + ## memory: 54Mi + ## limits: + ## cpu: 100m + ## memory: 54Mi + + securityContext: + runAsNonRoot: true # Must be false because agent often needs root for host access + # runAsUser: 0 # Explicit root if needed (default is often root) + # fsGroup: 0 # Optional + # fsGroup: 65534 + # runAsGroup: 65534 + # runAsNonRoot: true + # runAsUser: 65534 + + containerSecurityContext: + allowPrivilegeEscalation: false # Satisfies one violation (safe to set false) + privileged: false # Ensure not privileged (chart probably doesn't set it) + capabilities: + drop: + - ALL # Drop all extra caps (helps restricted) + seccompProfile: + type: RuntimeDefault # Or "Localhost" if you have a profile + # runAsNonRoot: false # Usually pod-level overrides, but can duplicate + ## capabilities: + ## add: + ## - SYS_TIME + + ## Expose the service to the host network + hostNetwork: true + + # Specify dns configuration options for agent containers e.g ndots + ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config + dnsConfig: {} + # options: + # - name: ndots + # value: "1" + + ## Share the host process ID namespace + hostPID: true + ## If true, agent pods mounts host / at /host/root + ## + hostRootFsMount: true + extraHostVolumeMounts: [] + ## - name: + ## hostPath: + ## mountPath: + ## readOnly: true|false + ## mountPropagation: None|HostToContainer|Bidirectional + image: + ## Zabbix agent Docker image name + repository: zabbix/zabbix-agent2 + ## Tag of Docker image of Zabbix agent + tag: alpine-7.0.17 + pullPolicy: IfNotPresent + ## List of dockerconfig secrets names to use when pulling images. Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry + pullSecrets: [] + env: + ## Passive checks: pollers reach agent :10050. ZBX_SERVER_HOST becomes Server= (must list each address once). + ## zabbix-docker also merges ZBX_PASSIVESERVERS into Server=; extras must never repeat addresses + ## already resolved from ZBX_SERVER_HOST (duplicate hostnames/IP sets break agent startup). +{% if zabbix_openshift_agent_passiveservers_extra | default('') | trim | length > 0 %} + - name: ZBX_PASSIVESERVERS + value: "{{ zabbix_openshift_agent_passiveservers_extra | trim }}" +{% endif %} + - name: ZBX_SERVER_HOST + value: "{{ zabbix_openshift_agent_server_hostname }}" + - name: ZBX_SERVER_PORT + value: "10051" + ## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true + - name: ZBX_PASSIVE_ALLOW + value: true + ## This variable is boolean (true or false) and enables or disables feature of active checks + - name: ZBX_ACTIVE_ALLOW + value: false + ## The variable is used to specify debug level, from 0 to 5 + - name: ZBX_DEBUGLEVEL + value: 3 + ## The variable is used to specify timeout for processing checks. By default, value is 4. + - name: ZBX_TIMEOUT + value: 4 + ## List can be extended with other environment variables listed here: https://github.com/zabbix/zabbix-docker/tree/7.0/Dockerfiles/agent2/alpine#other-variables + ## For example: + ## The variable is comma separated list of allowed Zabbix server or proxy hosts for connections to Zabbix agent 2 container. You may specify port of Zabbix server or Zabbix proxy in such syntax: zabbix-server:10061,zabbix-proxy:10072 + ## - name: ZBX_ACTIVESERVERS + ## value: '' + ## The variable is comma separated list of allowed Zabbix server or proxy hosts for connections to Zabbix agent 2 container. + ## - name: ZBX_PASSIVESERVERS + ## value: 0.0.0.0/0 + ## The variable is list of comma separated loadable Zabbix modules. It works with volume /var/lib/zabbix/modules. + ## - name: ZBX_LOADMODULE + ## value: '' + + ## The startupProbe, livenessProbe, readinessProbe variables + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ + + livenessProbe: + enabled: true + tcpSocket: + port: zabbix-agent + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + readinessProbe: + enabled: false + tcpSocket: + port: zabbix-agent + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + startupProbe: + enabled: true + tcpSocket: + port: zabbix-agent + initialDelaySeconds: 10 + periodSeconds: 5 + timeoutSeconds: 3 + failureThreshold: 5 + + ## Node selector for Agent. Only supports Linux. + nodeSelector: + kubernetes.io/os: linux + + ## Tolerations configuration + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + ## Affinity configuration + affinity: {} + serviceAccount: + ## Specifies whether a ServiceAccount should be created + create: true + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fullname template + name: "" + annotations: {} + imagePullSecrets: [] + automountServiceAccountToken: false + + service: + type: ClusterIP + port: 10050 + targetPort: 10050 + nodePort: 10050 + portName: zabbix-agent + listenOnAllInterfaces: true + annotations: + agent.zabbix/monitor: "true" + + rbac: + ## If true, create & use RBAC resources + ## + create: true + ## If true, create & use Pod Security Policy resources + ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + ## PodSecurityPolicies disabled by default because they are deprecated in Kubernetes 1.21 and will be removed in Kubernetes 1.25. + ## If you are using PodSecurityPolicies you can enable the previous behaviour by setting `rbac.pspEnabled: true` + pspEnabled: false + pspAnnotations: {} + +## **Zabbix Java Gateway** configurations +zabbixJavaGateway: + ## Enable use of **Zabbix Java Gateway** + enabled: false + containerSecurityContext: {} + ## Resource management for Pods and Containers. + ## More details: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers + resources: {} + image: + ## Zabbix Java Gateway Docker image name. + repository: zabbix/zabbix-java-gateway + ## Tag of Docker image of Zabbix Java Gateway Docker + tag: alpine-7.0.17 + pullPolicy: IfNotPresent + ## List of dockerconfig secrets names to use when pulling images. Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry + pullSecrets: [] + + env: + ## This variable is specified amount of pollers. By default, value is 5 + - name: ZBX_START_POLLERS + value: 5 + ## This variable is used to specify timeout for outgoing connections. By default, value is 3 + - name: ZBX_TIMEOUT + value: 3 + ## This variable is used to specify log level. By default, value is info. Possible values: trace, debug, info, warn, error, all, off + - name: ZBX_DEBUGLEVEL + value: info + ## List can be extended with other environment variables listed here: https://github.com/zabbix/zabbix-docker/tree/7.0/Dockerfiles/java-gateway/alpine + + ## The startupProbe, livenessProbe, readinessProbe variables + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ + + livenessProbe: + enabled: true + tcpSocket: + port: zabbix-jmx + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + readinessProbe: + enabled: false + tcpSocket: + port: zabbix-jmx + initialDelaySeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + + startupProbe: + enabled: true + tcpSocket: + port: zabbix-jmx + initialDelaySeconds: 30 + timeoutSeconds: 3 + failureThreshold: 5 + periodSeconds: 10 + successThreshold: 1 + + service: + annotations: {} + labels: {} + ## Type of service for Zabbix Java Gateway + type: ClusterIP + ## Port to expose service + port: 10052 + externalIPs: [] + ## Loadbalancer IP + ## Only use if service.type is "LoadBalancer" + loadBalancerIP: "" + loadBalancerSourceRanges: [] + loadBalancerClass: "" + sessionAffinity: None + + ## Node selector for Zabbix Java Gateway + nodeSelector: {} + + ## Tolerations configurations for Zabbix Java Gateway + tolerations: {} + + ## Affinity configurations for Zabbix Java Gateway + affinity: {} diff --git a/scripts/README b/scripts/README index 400203287f..eaf3f90789 100644 --- a/scripts/README +++ b/scripts/README @@ -1,3 +1,6 @@ +communishift_prune_projects - trims communishift_projects in group_vars/all (in-place + splice; only that mapping); see --help / --diff + ans-needs-reboot - check which hosts need to be rebooted due to kernel or other critical updates diff --git a/scripts/communishift_prune_projects b/scripts/communishift_prune_projects new file mode 100755 index 0000000000..9d4c3a9b9f --- /dev/null +++ b/scripts/communishift_prune_projects @@ -0,0 +1,278 @@ +#!/usr/bin/env python3 +""" +Prune communishift_projects under ansible/inventory/group_vars/all: + + - Keeps entries where do_not_delete is truthy (true / yes / 1 / on, case-insensitive strings). + - Removes every other child mapping under communishift_projects. + +Only the communishift_projects mapping (that key plus its body up to—but not including—the +next line at indentation 0) is rewritten. All other bytes in the file are preserved. + +Default: dry-run (no writes). Print summary; use --diff for a unified file diff. + +Dependencies: PyYAML (python3-pyyaml). + +Examples: + + ansible/scripts/communishift_prune_projects + ansible/scripts/communishift_prune_projects --diff + ansible/scripts/communishift_prune_projects --write +""" + +from __future__ import annotations + +import argparse +import difflib +import os +import re +import sys +from pathlib import Path +from tempfile import NamedTemporaryFile +from typing import Any, Dict, List, Mapping, Sequence, Tuple + +try: + import yaml +except ImportError as exc: + sys.stderr.write( + "This script requires PyYAML (install python3-pyyaml on this host).\n" + ) + raise SystemExit(1) from exc + + +_STANZA_START = re.compile(r"^([A-Za-z0-9_.-]+):\s*(?:\#.*)?\s*$") +_CHILD_INDENT = 2 + + +def ansible_truthy(value: Any) -> bool: + if isinstance(value, bool): + return value + if isinstance(value, str): + return value.strip().lower() in {"true", "yes", "1", "on"} + return False + + +def _expanded_indent(raw: str) -> int: + return len(raw.expandtabs()) - len(raw.expandtabs().lstrip(" ")) + + +def locate_communishift_block(lines: Sequence[str]) -> Tuple[int, int]: + start = None + for i, line in enumerate(lines): + if line.lstrip("\ufeff").startswith("communishift_projects:"): + start = i + break + if start is None: + raise ValueError('No root key line starting with "communishift_projects:"') + + root_indent = _expanded_indent(lines[start]) + j = start + 1 + n_lines = len(lines) + while j < n_lines: + line = lines[j] + if line.strip("\r\n") == "": + j += 1 + continue + if _expanded_indent(line) <= root_indent: + break + j += 1 + return start, j + + +def parse_stanza_blocks( + section_body: Sequence[str], +) -> Tuple[List[str], Dict[str, List[str]]]: + """ + Lines AFTER the communishift_projects: line. Preamble = comments/blanks/stanzas whose + first line is not a two-space child key line. + """ + preamble: List[str] = [] + blocks: Dict[str, List[str]] = {} + + idx = 0 + maximum = len(section_body) + while idx < maximum: + line = section_body[idx] + stripped_for_match = line.rstrip("\r\n") + indent = _expanded_indent(line) + matched = indent == _CHILD_INDENT and bool( + _STANZA_START.match(stripped_for_match.lstrip(" ")) + ) + if matched: + key_match = _STANZA_START.match(stripped_for_match.lstrip(" ")) + assert key_match is not None + key = key_match.group(1) + if key in blocks: + raise ValueError("Duplicate Communishift stanza key {0!r}".format(key)) + stanza_lines: List[str] = [line] + idx += 1 + while idx < maximum: + nxt = section_body[idx] + n_indent = _expanded_indent(nxt) + nn = _STANZA_START.match(nxt.rstrip("\r\n").lstrip(" ")) + if n_indent == _CHILD_INDENT and nn: + break + stanza_lines.append(nxt) + idx += 1 + blocks[key] = list(stanza_lines) + continue + + preamble.append(line) + idx += 1 + + return preamble, blocks + + +def stanza_keeps(meta: Any) -> bool: + return isinstance(meta, Mapping) and ansible_truthy(meta.get("do_not_delete")) + + +def load_projects_map(path: Path) -> Mapping[str, Any]: + raw = yaml.safe_load(path.read_text(encoding="utf-8")) + if not isinstance(raw, dict): + raise ValueError("YAML root must be a mapping") + proj = raw.get("communishift_projects") + if proj is None: + raise ValueError("communishift_projects missing from YAML") + if not isinstance(proj, dict): + raise ValueError("communishift_projects must be a mapping") + + return proj + + +def splice_communishift_projects( + text: str, + proj_data: Mapping[str, Any], +) -> Tuple[str, Dict[str, Any]]: + lines = text.splitlines(keepends=True) + start, end = locate_communishift_block(lines) + header_line = lines[start] + + body = lines[start + 1 : end] + preamble, blocks = parse_stanza_blocks(body) + + removed: List[str] = [] + skipped_non_mapping: List[str] = [] + kept_names: List[str] = [] + + for key in sorted(blocks.keys()): + meta = proj_data.get(key) + if not stanza_keeps(meta): + removed.append(key) + if not isinstance(meta, dict): + skipped_non_mapping.append(key) + continue + kept_names.append(str(meta.get("name", key))) + + sorted_kept = sorted(k for k in blocks if stanza_keeps(proj_data.get(k))) + new_section: List[str] = [header_line] + new_section.extend(preamble) + for k in sorted_kept: + new_section.extend(blocks[k]) + + after = "".join(lines[:start] + new_section + lines[end:]) + stats = { + "kept_count": len(sorted_kept), + "kept_names": sorted(kept_names), + "removed": removed, + "skipped_non_mapping": skipped_non_mapping, + } + return after, stats + + +def main(argv: List[str]) -> int: + ansible_root = Path(__file__).resolve().parent.parent + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument( + "--group-vars", + type=Path, + default=ansible_root / "inventory" / "group_vars" / "all", + help="YAML file defining communishift_projects", + ) + parser.add_argument( + "--diff", + action="store_true", + help="Print unified diff of the whole file", + ) + parser.add_argument( + "--write", + action="store_true", + help="Write the updated file", + ) + args = parser.parse_args(argv) + + group_vars_path = Path(args.group_vars) + original_text = group_vars_path.read_text(encoding="utf-8") + + try: + proj_data = load_projects_map(group_vars_path) + except ValueError as err: + sys.stderr.write("{0}: {1}\n".format(group_vars_path, err)) + return 1 + + try: + after_text, stats = splice_communishift_projects(original_text, proj_data) + except ValueError as err: + sys.stderr.write("{0}: {1}\n".format(group_vars_path, err)) + return 1 + + print("File: {0}".format(group_vars_path)) + extra = "" + if stats["skipped_non_mapping"]: + extra = " (+ {0} non-mapping skipped)".format(len(stats["skipped_non_mapping"])) + + print( + "Keeping {0} project stanza(s){1}".format(stats["kept_count"], extra), + ) + if stats["kept_names"]: + print(" " + ", ".join(sorted(stats["kept_names"]))) + + print("Removing {0} stanza key(s)".format(len(stats["removed"]))) + for name in sorted(stats["removed"], key=lambda s: str(s).lower()): + print(" - {0}".format(name)) + + if args.diff: + sys.stdout.writelines( + difflib.unified_diff( + original_text.splitlines(True), + after_text.splitlines(True), + fromfile="{0} (before)".format(group_vars_path), + tofile="{0} (after)".format(group_vars_path), + ) + ) + + if after_text == original_text: + print("\nNo changes needed.") + return 0 + + if not args.write: + print("\nDry-run only — no file modified. Pass --write to apply.") + return 0 + + fh = NamedTemporaryFile( + mode="w", + encoding="utf-8", + suffix=".tmp", + prefix="communishift-prune.", + dir=str(group_vars_path.parent), + delete=False, + ) + tmp_path = fh.name + try: + fh.write(after_text) + fh.flush() + os.fsync(fh.fileno()) + fh.close() + os.replace(tmp_path, group_vars_path) + except OSError: + fh.close() + try: + os.unlink(tmp_path) + except OSError: + pass + raise + print("\nUpdated {0}".format(group_vars_path)) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main(sys.argv[1:])) diff --git a/scripts/maint-update-reboot.sh b/scripts/maint-update-reboot.sh index 1fc34fbbd5..bc17444a16 100755 --- a/scripts/maint-update-reboot.sh +++ b/scripts/maint-update-reboot.sh @@ -8,7 +8,7 @@ ssh "$host" dnf --refresh -y up if [ "$(ssh $host who | wc -l)" = "1" ]; then ansible -m reboot "$host" - ssh "$host" rkhunter --propupd + ssh "$host" rkhunter --propupd || true else echo " ** Skipping reboot as Users on: $host" fi diff --git a/vars/all/EPEL.yaml b/vars/all/EPEL.yaml index 7cce42d521..1b974201f0 100644 --- a/vars/all/EPEL.yaml +++ b/vars/all/EPEL.yaml @@ -11,10 +11,10 @@ epel_minor: 3 # The EPEL minor version that has been branched, but doesn't have a matching # RHEL minor version released yet. Set to false if not available. -epel_branched_minor: 2 +epel_branched_minor: false # The EPEL minor version that matches RHEL. Set to false prior to the RHEL GA. -epel_z_minor: 1 +epel_z_minor: 2 # Assemble a list of EPEL tag names. When a minor version is set to false, # that list item will be an empty string, which is then removed with select in diff --git a/vars/all/FedoraPreviousPrevious.yaml b/vars/all/FedoraPreviousPrevious.yaml index af1e22a3b2..519608fa95 100644 --- a/vars/all/FedoraPreviousPrevious.yaml +++ b/vars/all/FedoraPreviousPrevious.yaml @@ -1,2 +1,2 @@ --- -FedoraPreviousPrevious: True +FedoraPreviousPrevious: False diff --git a/vars/apps/badges.yml b/vars/apps/badges.yml index 52e704afbc..32c1f652df 100644 --- a/vars/apps/badges.yml +++ b/vars/apps/badges.yml @@ -12,5 +12,5 @@ badges_award_cronjobs: schedule: "40 2 * * 3" - name: badges-dev schedule: "40 2 * * 4" -# oc describe project/fedora-packages-static | grep supplemental-groups -openshift_user_id: 1000840000 +# oc describe project/badges | grep supplemental-groups +openshift_user_id: "{{ (env == 'production')|ternary(1001000000, 1000980000) }}" diff --git a/vars/apps/bodhi.yml b/vars/apps/bodhi.yml index 5dc9b91e97..e356b61775 100644 --- a/vars/apps/bodhi.yml +++ b/vars/apps/bodhi.yml @@ -1,6 +1,7 @@ --- # Set the Bodhi variables -bodhi_version: "{{ (env == 'production')|ternary('25.11.3', '25.11.3') }}" +bodhi_version: "{{ (env == 'production')|ternary('26.4.0', '26.4.0') }}" bodhi_openshift_pods: 1 bodhi_openshift_pods_stg_consumers: 15 +bodhi_openshift_pods_stg_web: 2 bodhi_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.(bodhi|pungi)\..*