[PATCH] Remove the old sks.conf file
by Michael Scherer
From: Michael Scherer <misc(a)zarb.org>
It was a left over of the migration to a role
---
files/keyserver/sks.conf | 83 ------------------------------------------------
1 file changed, 83 deletions(-)
delete mode 100644 files/keyserver/sks.conf
diff --git a/files/keyserver/sks.conf b/files/keyserver/sks.conf
deleted file mode 100644
index e91dfd7..0000000
--- a/files/keyserver/sks.conf
+++ /dev/null
@@ -1,83 +0,0 @@
-ServerName keys.fedoraproject.org
-Listen 80.239.156.219:11371
-NameVirtualHost *:443
-
-<ifModule !mod_proxy.c>
- LoadModule proxy_module modules/mod_proxy.so
-</IfModule>
-
-<IfModule !mod_proxy_http.c>
- LoadModule proxy_http_module modules/mod_proxy_http.so
-</IfModule>
-
-<IfModule !mod_proxy_balancer.c>
- LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
-</IfModule>
-
-<IfModule !mod_headers.c>
- LoadModule headers_module modules/mod_headers.so
-</IfModule>
-
-<IfModule !mod_authz_host.c>
- LoadModule authz_host_module modules/mod_authz_host.so
-</IfModule>
-
-<IfModule !mod_log_config.c>
- LoadModule log_config_module modules/mod_log_config.so
-</IfModule>
-
-<IfModule !mod_env.c>
- LoadModule env_module modules/mod_env.so
-</IfModule>
-
-<Directory />
- Options FollowSymLinks
- AllowOverride None
- Order deny,allow
- Deny from all
-</Directory>
-
-<VirtualHost *:80>
- ServerAdmin sysadmin-keys-members(a)fedoraproject.org
- ServerName keys.fedoraproject.org
- ProxyPass / http://127.0.0.1:11371/
- ProxyPassReverse / http://127.0.0.1:11371/
- SetEnv proxy-nokeepalive 1
- ProxyVia Full
-</VirtualHost>
-<VirtualHost *:443>
- ServerAdmin sysadmin-keys-members(a)fedoraproject.org
- ServerName keys.fedoraproject.org
- ServerAlias keys01.fedoraproject.org
-
- SSLEngine on
- SSLCertificateFile /etc/pki/tls/wildcard-2014.fedoraproject.org.cert
- SSLCertificateChainFile /etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert
- SSLCertificateKeyFile /etc/pki/tls/wildcard-2014.fedoraproject.org.key
- ProxyPass / http://localhost:11371/
- ProxyPassReverse / http://localhost:11371/
- SetEnv proxy-nokeepalive 1
- ProxyVia Full
-</VirtualHost>
-<VirtualHost *:443>
- ServerAdmin sysadmin-keys-members(a)fedoraproject.org
- ServerName pool.sks-keyservers.net
- ServerAlias sks-keyservers.net
- ServerAlias *.sks-keyservers.net
-
- SSLEngine on
- SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem
- SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key
- ProxyPass / http://localhost:11371/
- ProxyPassReverse / http://localhost:11371/
- SetEnv proxy-nokeepalive 1
- ProxyVia Full
-</VirtualHost>
-<VirtualHost *:11371>
- ServerAdmin sysadmin-keys-members(a)fedoraproject.org
- ServerName keys.fedoraproject.org
- ProxyPass / http://127.0.0.1:11371/
- ProxyPassReverse / http://127.0.0.1:11371/
- SetEnv proxy-nokeepalive 1
- ProxyVia Full
-</VirtualHost>
--
1.8.3.1
8 years
[PATCH] Move koshei handlers to the role
by Michael Scherer
From: Michael Scherer <misc(a)zarb.org>
---
handlers/restart_services.yml | 12 ------------
roles/koschei/handlers/main.yml | 11 +++++++++++
2 files changed, 11 insertions(+), 12 deletions(-)
create mode 100644 roles/koschei/handlers/main.yml
diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml
index 58396a0..ab74770 100644
--- a/handlers/restart_services.yml
+++ b/handlers/restart_services.yml
@@ -42,18 +42,6 @@
- name: restart jenkins
action: service name=jenkins state=restarted
-- name: restart koschei-polling
- action: service name=koschei-polling state=restarted
-
-- name: restart koschei-resolver
- action: service name=koschei-resolver state=restarted
-
-- name: restart koschei-scheduler
- action: service name=koschei-scheduler state=restarted
-
-- name: restart koschei-watcher
- action: service name=koschei-watcher state=restarted
-
- name: restart libvirtd
action: service name=libvirtd state=restarted
diff --git a/roles/koschei/handlers/main.yml b/roles/koschei/handlers/main.yml
new file mode 100644
index 0000000..5c37b87
--- /dev/null
+++ b/roles/koschei/handlers/main.yml
@@ -0,0 +1,11 @@
+- name: restart koschei-polling
+ action: service name=koschei-polling state=restarted
+
+- name: restart koschei-resolver
+ action: service name=koschei-resolver state=restarted
+
+- name: restart koschei-scheduler
+ action: service name=koschei-scheduler state=restarted
+
+- name: restart koschei-watcher
+ action: service name=koschei-watcher state=restarted
--
1.8.3.1
8 years
[PATCH 1/2] Refactor packages installation for fedmsg-irc, and use package module
by Michael Scherer
From: Michael Scherer <misc(a)zarb.org>
---
roles/fedmsg/irc/tasks/main.yml | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/roles/fedmsg/irc/tasks/main.yml b/roles/fedmsg/irc/tasks/main.yml
index ac23440..618ab1e 100644
--- a/roles/fedmsg/irc/tasks/main.yml
+++ b/roles/fedmsg/irc/tasks/main.yml
@@ -1,15 +1,12 @@
-- name: install fedmsg-irc
- yum: pkg=fedmsg-irc state=present
- tags:
- - packages
- - fedmsg/irc
-
-- name: install python2-fedmsg-meta-fedora-infrastructure
- yum: pkg=python2-fedmsg-meta-fedora-infrastructure state=present
+- name: install package for fedmsg-irc
+ package: pkg={{ item }} state=present
tags:
- packages
- fedmsg/irc
+ with_items:
+ - fedmsg-irc
+ - python2-fedmsg-meta-fedora-infrastructure
- name: ensure that nrpe has rights to monitor us
file: >
--
1.8.3.1
8 years
[PATCH] Refactor (again) the code deploying zodbot/ursabot
by Michael Scherer
From: Michael Scherer <misc(a)zarb.org>
Since there is the same code between staging and production, except
for the bot name, using a variable permit to avoid duplication.
(this time, it work)
---
roles/supybot/tasks/main.yml | 36 ++++++++----------------------------
roles/supybot/vars/main.yml | 3 +++
2 files changed, 11 insertions(+), 28 deletions(-)
create mode 100644 roles/supybot/vars/main.yml
diff --git a/roles/supybot/tasks/main.yml b/roles/supybot/tasks/main.yml
index 59cc5ea..4821c77 100644
--- a/roles/supybot/tasks/main.yml
+++ b/roles/supybot/tasks/main.yml
@@ -10,34 +10,23 @@
- packagedb-cli
tags: supybot
+- set_fact: botname={{ botnames[env] }}
+
- name: creating zodbot log dir
file: path={{ item }} state=directory owner=daemon
with_items:
- - /var/lib/zodbot
- - /var/lib/zodbot/conf
- - /var/lib/zodbot/data
- - /var/lib/zodbot/logs
+ - /var/lib/{{ botname }}
+ - /var/lib/{{ botname }}/conf
+ - /var/lib/{{ botname }}/data
+ - /var/lib/{{ botname }}/logs
- /srv/web
- /srv/web/meetbot
- when: env != "staging"
tags: supybot
- name: create teams directory
file: path=/srv/web/meetbot/teams state=directory owner=apache group=apache mode=0755
tags: supybot
-- name: creating usrabot log dir
- file: path={{ item }} state=directory owner=daemon
- with_items:
- - /var/lib/ursabot
- - /var/lib/ursabot/conf
- - /var/lib/ursabot/data
- - /var/lib/ursabot/logs
- - /srv/web
- - /srv/web/meetbot
- when: env == "staging"
- tags: supybot
-
- name: setup meetings_by_team script
copy: src=meetings_by_team.sh dest=/usr/local/bin/meetings_by_team.sh mode=755
tags: supybot
@@ -70,18 +59,9 @@
- meetbot
- supybot
-- name: setup cron job to start zodbot/ursabot on boot
- cron: name=zodbot special_time=reboot job='cd /srv/web/meetbot; supybot -d /var/lib/zodbot/conf/zodbot.conf' user=daemon
- tags:
- - config
- - meetbot
- - supybot
- when: env != "staging"
-
-- name: setup cron job to start zodbot/ursabot on boot
- cron: name=ursabot special_time=reboot job='cd /srv/web/meetbot; supybot -d /var/lib/ursabot/conf/ursabot.conf' user=daemon
+- name: setup cron job to start {{ botname }}/ursabot on boot
+ cron: name={{ botname }} special_time=reboot job='cd /srv/web/meetbot; supybot -d /var/lib/{{ botname }}/conf/{{ botname }}.conf' user=daemon
tags:
- config
- meetbot
- supybot
- when: env == "staging"
diff --git a/roles/supybot/vars/main.yml b/roles/supybot/vars/main.yml
new file mode 100644
index 0000000..6e3df99
--- /dev/null
+++ b/roles/supybot/vars/main.yml
@@ -0,0 +1,3 @@
+botnames:
+ staging: ursabot
+ production: zodbot
--
1.8.3.1
8 years
PS1 configuration
by Zach Villers
Hello infra,
First apologies for blowing up your inbox with ansible commits.
Second - if you have a chance, please log into these machines before
thursday's meeting and look at your prompt. You should see a red
"[PROD]" before your normal prompt on the production machine and a
regular color "[STG]" on the stage machine. If you dont, would you
kindly let me know what shell you are using and what terminal emulator?
badges-backend01.phx2.fp.o
and
badges-backend01.stg.fp.o
Thanks,
Zach
#aikidouke
8 years
Support levels and RFR adjustments
by Kevin Fenzi
So, I sent an email a while back about this to get people thinking, but
I didn't get too much feedback from my questions, so this time I am
going to actually outline a proposal for people to look at. ;)
Currently users expect pretty much any public service we have is fully
supported. This means things like updating status when it's down,
working anytime something is down to fix it as quickly as we can.
New applications/services currently all pass through the (somewhat
long) RFR process which we setup to make sure we could support the
service moving forward.
This is great and all, but some services just aren't as sustainable, or
don't really fit into our RFR process very well. Also, our RFR process
makes us pretty slow to bring a new service online properly.
In order to have support levels, we need a way to communicate that to
our users easily and the only/best way I can think of to do that easily
is via domain name. If we try and have a table or something it could
get pretty confusing for people. Tying it to domain names would make it
much easier.
So:
fedoraproject.org - Anything with this domain is something that has
passed though our RFR process and we support fully. This means we
update status, we alert on them anytime they have issues, we work on
them anytime they are down, etc.
fedorainfracloud.org - This comes with a lesser level of support,
simply because our cloud doesn't have any kind of HA setup, so
it will be down when doing maint or when there's problems. Services in
this domain may be down when there is scheduled cloud maint. We
monitor, but don't page off hours, we may work on issues only during
business hours, etc. Services here may not have passed through our RFR
process (perhaps we should have a parallel cloud process)
stg.fedoraproject.org - These can be down anytime and we monitor on
them, but may not work on them off hours, etc.
someother domain that sounds fedora related (fedorarelated.org?
fedoralinks.org? ?) - These are things that are fedora related, but not
fully controlled by fedora infrastructure. Things like the fedora
bootstrap site or the porting python3 in fedora site, or possibly cloud
instances that aren't managed by us. These we don't monitor or have
status on, and direct people to contact the managers directly.
Any other types of sites / domains people can think of?
Any general thoughts on the idea?
kevin
8 years
[PATCH] Remove old unused handlers in the current codebase
by Michael Scherer
From: Michael Scherer <misc(a)zarb.org>
---
handlers/restart_services.yml | 18 ------------------
1 file changed, 18 deletions(-)
diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml
index a2e9669..24bfcc7 100644
--- a/handlers/restart_services.yml
+++ b/handlers/restart_services.yml
@@ -2,9 +2,6 @@
# Handlers for restarting services
#
-- name: restart auditd
- action: service name=auditd state=restarted
-
- name: restart apache
command: /usr/local/bin/conditional-restart.sh httpd httpd
@@ -72,12 +69,6 @@
- name: restart named
action: service name=named state=restarted
-- name: restart nfs
- action: service name=nfs state=restarted
-
-- name: restart nfslock
- action: service name=nfslock state=restarted
-
- name: restart ntpd
action: service name=ntpd state=restarted
@@ -105,12 +96,6 @@
- name: restart postfix
action: service name=postfix state=restarted
-- name: restart rpcbind
- action: service name=rpcbind state=restarted
-
-- name: restart rpcidmapd
- action: service name=rpcidmapd state=restarted
-
- name: restart xinetd
action: service name=xinetd state=restarted
@@ -167,9 +152,6 @@
- name: "update ca-trust"
command: /usr/bin/update-ca-trust
-- name: restart openstack-keystone
- service: name=openstack-keystone state=restarted
-
- name: restart stunnel
service: name=stunnel state=restarted
--
1.8.3.1
8 years
[PATCH] Remove handlers that do not correspond to any existing playbook
by Michael Scherer
From: Michael Scherer <misc(a)zarb.org>
---
handlers/restart_services.yml | 21 ---------------------
1 file changed, 21 deletions(-)
diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml
index 75a805b..67f48ef 100644
--- a/handlers/restart_services.yml
+++ b/handlers/restart_services.yml
@@ -2,9 +2,6 @@
# Handlers for restarting services
#
-- name: restart auditd
- action: service name=auditd state=restarted
-
- name: restart apache
command: /usr/local/bin/conditional-restart.sh httpd httpd
@@ -60,21 +57,9 @@
- name: restart libvirtd
action: service name=libvirtd state=restarted
-- name: restart mailman
- action: service name=mailman state=restarted
-
- name: restart named
action: service name=named state=restarted
-- name: restart nfs
- action: service name=nfs state=restarted
-
-- name: restart nfslock
- action: service name=nfslock state=restarted
-
-- name: restart ntpd
- action: service name=ntpd state=restarted
-
- name: restart openvpn (Fedora)
when: ansible_distribution == "Fedora"
action: service name=openvpn@openvpn state=restarted
@@ -99,12 +84,6 @@
- name: restart postfix
action: service name=postfix state=restarted
-- name: restart rpcbind
- action: service name=rpcbind state=restarted
-
-- name: restart rpcidmapd
- action: service name=rpcidmapd state=restarted
-
- name: restart xinetd
action: service name=xinetd state=restarted
--
1.8.3.1
8 years
Meeting Agenda Item: Introduction Suraj Narwade
by Suraj Babulal Narwade
Hello World
IRC handle: snarwade
skills: basics of linux system administration, shell scripting, python programming, openstack administration, jenkins
and I have redhat certifications for system administrator, openstack administrator and engineer
As I am newbie to it, I want to know this things in more detail and contribute my knowledge to opensource world.
Thanks,
Suraj Narwade
8 years