pesign needs to map the socket into the chroot/container, but also set
acls to allow the users in the container to use it. We setup a
secureboot group to map these builders and only run this setup on them.
For now buildhw-x86-02 is the only builder we want to enable.
Once we know it's working well we can retire the bkernel role and repave
buildhw-x86-01. buildhw-a64-02 will be added once we fix the aarch64
signing.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
Change the pesign cert here to match the one that the kernel/grub/fwupd
already use in their spec files, this will allow us to switch over
without any changes to those packages.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This just sets it up to display the messages on prod. They are already
implemented on staging.
Resolves: forge/forge#432
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
This commit removes Natalie Pazmiño from the email alias for Fedora
Project swag orders and requests. It adds @shaunm, the CentOS Community
Architect, and sponsors email alias for the Design Team (currently, this
is @duffy, @ekidney, @jesschitas, @jflory7, @madelinepeck, and
@mleonova). This will make it easier to coordinate and provide
authoritative answers on Fedora and CentOS brand guidelines and
requirements with swag vendors and printers.
Signed-off-by: Justin Wheeler <jwheel@redhat.com>
This uses the upstream template which runs a bunch of SQL to query the
DB via a monitoring user.
Scoped to db01.stg for testing at the moment.
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
The host_group variable was missing in retrace group, so the postfix
role took standard rdu3 main.cf file instead. Let's define the variable.
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
Few machines were having issues with sending e-mails (retrace03 and
pkgs01). In both cases it was caused by postfix misconfiguration.
* retrace03 - It's RHEL8 machine, so lmdb is unavailable and it also
didn't used vpn to reach bastion
* pkgs01 - It had just bastion as relay name, which wasn't happy to
resolve through DNS, this is using FQDN instead
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
I mistakenly thought there was a GIT_PUSH_MESSAGE option, but there is
not. so removing this from staging.
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
This also relocates the `httpchecks` roles to the right place,
as putting it in it's own role was a bit of hack. Having it in
the proxy role is better.
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
This also removes the Nagios config - it'll be looking in the wrong
place. A Zabbix replacement check will follow in the next commit.
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
Use a log format closer to the "combined" log format on fedorapeople.
This log format includes the referrer and the user agent, it's like
Apache's combined log format plus the virtualhost at the beginning,
like what was used before.
Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
Fix the expire date.
Point users to a wiki page to hopefully cut down on begg bounties
Note that we do NOT have a bug bounty program.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
