forked from infra/ansible
Nils Philippsen
dbbf94a411
Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-*` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-*` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com>
68 lines
1.8 KiB
Text
68 lines
1.8 KiB
Text
---
|
|
# Define resources for this group of hosts here.
|
|
lvm_size: 250000
|
|
mem_size: 8192
|
|
num_cpus: 8
|
|
|
|
# for systems that do not match the above - specify the same parameter in
|
|
# the host_vars/$hostname file
|
|
tcp_ports: [ 80, 443, 111, 2049,
|
|
# These 8 ports are used by fedmsg. One for each wsgi thread.
|
|
3000, 3001, 3002, 3003, 3004, 3005, 3006, 3007]
|
|
|
|
udp_ports: [ 111, 2049 ]
|
|
|
|
ipa_host_group: kojihub
|
|
ipa_host_group_desc: Koji Hub hosts
|
|
ipa_client_shell_groups:
|
|
- fi-apprentice
|
|
- sysadmin-noc
|
|
- sysadmin-osbs
|
|
- sysadmin-releng
|
|
- sysadmin-veteran
|
|
ipa_client_sudo_groups:
|
|
- sysadmin-noc
|
|
- sysadmin-osbs
|
|
- sysadmin-releng
|
|
- sysadmin-veteran
|
|
|
|
# These are consumed by a task in roles/fedmsg/base/main.yml
|
|
fedmsg_certs:
|
|
- service: shell
|
|
owner: root
|
|
group: sysadmin
|
|
can_send:
|
|
- logger.log
|
|
- service: koji
|
|
owner: root
|
|
group: apache
|
|
can_send:
|
|
- buildsys.build.state.change
|
|
- buildsys.package.list.change
|
|
- buildsys.repo.done
|
|
- buildsys.repo.init
|
|
- buildsys.rpm.sign
|
|
- buildsys.tag
|
|
- buildsys.task.state.change
|
|
- buildsys.untag
|
|
|
|
# NOTE -- staging mounts read-only
|
|
nfs_mount_opts: "ro,hard,bg,intr,noatime,nodev,nosuid,nfsvers=3"
|
|
|
|
koji_server_url: "https://koji.stg.fedoraproject.org/kojihub"
|
|
koji_weburl: "https://koji.stg.fedoraproject.org/koji"
|
|
koji_topurl: "https://kojipkgs.fedoraproject.org/"
|
|
|
|
osbs_url: "osbs.stg.fedoraproject.org"
|
|
source_registry: "registry.stg.fedoraproject.org"
|
|
docker_registry: "candidate-registry.stg.fedoraproject.org"
|
|
koji_root: "koji.stg.fedoraproject.org/koji"
|
|
koji_hub: "koji.stg.fedoraproject.org/kojihub"
|
|
|
|
|
|
# Add custom iptable rule to allow stage koji to talk to
|
|
# osbs-dev.fedorainfracloud.org (will move to stage osbs later, this is for the
|
|
# sake of testing).
|
|
custom_rules: [
|
|
'-A OUTPUT -p tcp -m tcp -d 209.132.184.60 --dport 8443 -j ACCEPT'
|
|
]
|