proxy1.stg and xen6
by Mike McGrath
I'm doing some work on proxy1.stg specifically with it's aliased IP
10.8.34.98 on xen6. Please don't touch them until I give the ok
(troubleshooting network issues with a dedicated box)
-Mike
14 years, 8 months
[PATCH] Try an autodisablePuppet fix.
by Ricky Zhou
---
manifests/nodes/backup1.fedora.phx.redhat.com.pp | 2 +-
.../nodes/proxy1.stg.fedora.phx.redhat.com.pp | 1 +
.../nodes/sign-bridge1.fedora.phx.redhat.com.pp | 2 +-
.../nodes/sign-vault1.fedora.phx.redhat.com.pp | 2 +-
modules/puppet/manifests/init.pp | 10 ++++++++--
5 files changed, 12 insertions(+), 5 deletions(-)
diff --git a/manifests/nodes/backup1.fedora.phx.redhat.com.pp b/manifests/nodes/backup1.fedora.phx.redhat.com.pp
index 7f1a1d9..0dbf6bc 100644
--- a/manifests/nodes/backup1.fedora.phx.redhat.com.pp
+++ b/manifests/nodes/backup1.fedora.phx.redhat.com.pp
@@ -1,5 +1,5 @@
node backup1{
- $autodisablePuppet = 1
+ $autodisablePuppet = true
include phx
# include global
include openvpn::client
diff --git a/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp b/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp
index f9a1289..2c303fe 100644
--- a/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp
+++ b/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp
@@ -1,4 +1,5 @@
node 'proxy1.stg.fedora.phx.redhat.com' {
+ $autodisablePuppet = true
$puppetEnvironment='staging'
include phx
include proxy
diff --git a/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp b/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp
index d710016..4147862 100644
--- a/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp
+++ b/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp
@@ -1,5 +1,5 @@
node "sign-bridge1.fedora.phx.redhat.com" {
- $autodisablePuppet = 1
+ $autodisablePuppet = true
$fas_groups = [ 'sysadmin-main', 'sysadmin-releng' ]
include phx
include fas::client
diff --git a/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp b/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp
index 1b5641d..a1e0ab0 100644
--- a/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp
+++ b/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp
@@ -1,5 +1,5 @@
node "sign-vault1" {
- $autodisablePuppet = 1
+ $autodisablePuppet = true
$fas_groups = [ 'sysadmin-main', 'sysadmin-releng' ]
include phx
include fas::client
diff --git a/modules/puppet/manifests/init.pp b/modules/puppet/manifests/init.pp
index 54ca3e3..686de0a 100644
--- a/modules/puppet/manifests/init.pp
+++ b/modules/puppet/manifests/init.pp
@@ -18,8 +18,14 @@ class puppet::client {
}
service { "puppet":
- ensure => running,
- enable => true,
+ ensure => $autodisablePuppet ? {
+ true => undef,
+ default => running,
+ },
+ enable => $autodisablePuppet ? {
+ true => false,
+ default => true,
+ },
require => Package["puppet"],
}
--
1.5.5.6
14 years, 8 months
[Change Request] Set replace => false on some db files which I missed.
by Ricky Zhou
I missed a few files in my earlier change request.
---
modules/sigul/manifests/init.pp | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/modules/sigul/manifests/init.pp b/modules/sigul/manifests/init.pp
index 20a88bd..f613182 100644
--- a/modules/sigul/manifests/init.pp
+++ b/modules/sigul/manifests/init.pp
@@ -88,6 +88,7 @@ class sigul::server inherits sigul {
group => "sigul",
mode => 0600,
source => "puppet:///config/secure/sigul_server_cert8.db",
+ replace => false,
require => Package["sigul"],
}
@@ -96,6 +97,7 @@ class sigul::server inherits sigul {
group => "sigul",
mode => 0600,
source => "puppet:///config/secure/sigul_server_key3.db",
+ replace => false,
require => Package["sigul"],
}
@@ -104,6 +106,7 @@ class sigul::server inherits sigul {
group => "sigul",
mode => 0600,
source => "puppet:///config/secure/sigul_server_secmod.db",
+ replace => false,
require => Package["sigul"],
}
--
1.5.5.6
14 years, 8 months
Recent change freeze exception - MXs for our domains
by Ricky Zhou
Hey, we had a @fedoraproject.org mail outage today because Red Hat's MXs
changed IPs. Previously, we had our MXs set to
mx[123].fedoraproject.org, which pointed to the IPs of the MXes. With
the last change, we switched to setting the MXs directly to
mx[12].redhat.com, which should always point ot the right place.
Additionally, the change also reenables tummy, telia, and ibiblio, which
we took out for the mass reboot.
Stephen and Mike +1ed these changes on IRC while we were working on it.
Thanks,
Ricky
14 years, 8 months
[PATCH] Adding mod_limitipconn
by Mike McGrath
This will allow us for greater control against abusive clients.
Starting on secondary1 for now which seems to be the biggest problem.
---
manifests/servergroups/secondary.pp | 1 +
modules/mod_limitipconn/README | 10 ++++++++++
modules/mod_limitipconn/files/limitipconn.conf | 18 ++++++++++++++++++
modules/mod_limitipconn/manifests/init.pp | 12 ++++++++++++
4 files changed, 41 insertions(+), 0 deletions(-)
create mode 100644 modules/mod_limitipconn/README
create mode 100644 modules/mod_limitipconn/files/limitipconn.conf
create mode 100644 modules/mod_limitipconn/manifests/init.pp
diff --git a/manifests/servergroups/secondary.pp b/manifests/servergroups/secondary.pp
index b53cff9..d5d96e5 100644
--- a/manifests/servergroups/secondary.pp
+++ b/manifests/servergroups/secondary.pp
@@ -3,6 +3,7 @@ class secondaryMirror {
include mirrorsize-secondary
include httpd::proxy
+ include mod_limitipconn::mod_limitipconn
httpd::certificate { "wildcard.fedoraproject.org": }
diff --git a/modules/mod_limitipconn/README b/modules/mod_limitipconn/README
new file mode 100644
index 0000000..70a5550
--- /dev/null
+++ b/modules/mod_limitipconn/README
@@ -0,0 +1,10 @@
+=====================
+mod_limitipconn
+=====================
+
+-----------
+Usage
+-----------
+
+Apache module which allows web server administrators to limit the number of
+simultaneous downloads permitted from a single IP address.
diff --git a/modules/mod_limitipconn/files/limitipconn.conf b/modules/mod_limitipconn/files/limitipconn.conf
new file mode 100644
index 0000000..fb33733
--- /dev/null
+++ b/modules/mod_limitipconn/files/limitipconn.conf
@@ -0,0 +1,18 @@
+# This module will not function unless mod_status is loaded and the
+# "ExtendedStatus On" directive is set. So load only if mod_status is too.
+<IfModule mod_status.c>
+
+ # This is always needed
+ ExtendedStatus On
+
+ # mod_limitipconn configuration
+ LoadModule limitipconn_module modules/mod_limitipconn.so
+
+ # A global default configuration doesn't make much sense. See the README
+ # from the mod_limitipconn package for configuration examples.
+
+ MaxConnPerIP 3
+ OnlyIPLimit application/octet-stream
+
+</IfModule>
+
diff --git a/modules/mod_limitipconn/manifests/init.pp b/modules/mod_limitipconn/manifests/init.pp
new file mode 100644
index 0000000..b643d9a
--- /dev/null
+++ b/modules/mod_limitipconn/manifests/init.pp
@@ -0,0 +1,12 @@
+
+class mod_limitipconn::mod_limitipconn {
+ package { mod_limitipconn:
+ ensure => present
+ }
+
+ file { '/etc/httpd/conf.d/limitipconn.conf':
+ source => 'puppet:///mod_limitipconn/limitipconn.conf',
+ require => Package['httpd'],
+ notify => Service['httpd']
+ }
+}
--
1.6.2.5
14 years, 8 months
[Change Request] Don't replace sigul db files.
by Ricky Zhou
---
modules/sigul/manifests/init.pp | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/modules/sigul/manifests/init.pp b/modules/sigul/manifests/init.pp
index d2b6dc9..20a88bd 100644
--- a/modules/sigul/manifests/init.pp
+++ b/modules/sigul/manifests/init.pp
@@ -41,6 +41,7 @@ class sigul::bridge inherits sigul {
group => "sigul",
mode => 0600,
source => "puppet:///config/secure/sigul_bridge_cert8.db",
+ replace => false,
require => Package["sigul"],
}
@@ -49,6 +50,7 @@ class sigul::bridge inherits sigul {
group => "sigul",
mode => 0600,
source => "puppet:///config/secure/sigul_bridge_key3.db",
+ replace => false,
require => Package["sigul"],
}
@@ -57,6 +59,7 @@ class sigul::bridge inherits sigul {
group => "sigul",
mode => 0600,
source => "puppet:///config/secure/sigul_bridge_secmod.db",
+ replace => false,
require => Package["sigul"],
}
--
1.5.5.6
14 years, 8 months