infrastructure September 2017

infrastructure@lists.fedoraproject.org

41 participants
67 discussions

FBR: Setup proxying and VPN for certgetter01
by Patrick Uiterwijk 14 Sep '17

14 Sep '17

Hi, Could I get +1s for these patches: From 596ccf8bc44bad969a2ee9395c2c0ae7ee994a43 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk <puiterwijk(a)redhat.com> Date: Sat, 9 Sep 2017 22:25:08 +0000 Subject: [PATCH 1/3] Allow setting up a vhost for certgetter Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com> --- roles/httpd/website/defaults/main.yml | 1 + roles/httpd/website/templates/website.conf | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/roles/httpd/website/defaults/main.yml b/roles/httpd/website/defaults/main.yml index 99aa8b0..8ad299d 100644 --- a/roles/httpd/website/defaults/main.yml +++ b/roles/httpd/website/defaults/main.yml @@ -4,6 +4,7 @@ server_aliases: [] server_admin: webmaster(a)fedoraproject.org +certbot: false ssl: true sslonly: false SSLCertificateChainFile: wildcard-2017.fedoraproject.org.intermediate.cert diff --git a/roles/httpd/website/templates/website.conf b/roles/httpd/website/templates/website.conf index 6547452..8eed648 100644 --- a/roles/httpd/website/templates/website.conf +++ b/roles/httpd/website/templates/website.conf @@ -10,6 +10,10 @@ SetOutputFilter DEFLATE {% endif %} +{% if certbot %} + ProxyPass "/.well-known/acme-challenge" "http://certgetter01/.well-known/acme-challenge" +{% endif %} + {% if sslonly %} RewriteEngine On RewriteCond %{HTTPS} off -- 1.8.3.1 From 403f97fc772c4a1d9fc55aab981e6bf0293c19b1 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk <puiterwijk(a)redhat.com> Date: Sat, 9 Sep 2017 22:26:40 +0000 Subject: [PATCH 2/3] Enable certbot for secondary kojis Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com> --- playbooks/include/proxies-websites.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml index 9735c89..6362509 100644 --- a/playbooks/include/proxies-websites.yml +++ b/playbooks/include/proxies-websites.yml @@ -499,6 +499,7 @@ - role: httpd/website name: ppc.koji.fedoraproject.org sslonly: true + certbot: true server_aliases: - ppcpkgs.fedoraproject.org cert_name: secondary.koji.fedoraproject.org.letsencrypt @@ -507,6 +508,7 @@ - role: httpd/website name: s390.koji.fedoraproject.org sslonly: true + certbot: true server_aliases: - s390pkgs.fedoraproject.org cert_name: secondary.koji.fedoraproject.org.letsencrypt @@ -515,6 +517,7 @@ - role: httpd/website name: arm.koji.fedoraproject.org sslonly: true + certbot: true server_aliases: - armpkgs.fedoraproject.org cert_name: secondary.koji.fedoraproject.org.letsencrypt -- 1.8.3.1 From 49a05d85c2af5d3288e095c837ff7013d77f5756 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk <puiterwijk(a)redhat.com> Date: Sat, 9 Sep 2017 23:02:21 +0000 Subject: [PATCH 3/3] Add certgetter01 ccd file Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com> --- roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org diff --git a/roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org b/roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org new file mode 100644 index 0000000..6b4c087 --- /dev/null +++ b/roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org @@ -0,0 +1,2 @@ +# ifconfig-push actualIP PtPIP +ifconfig-push 192.168.1.177 192.168.0.177 -- 1.8.3.1

4 5

Freeze break: weed out audit messages entirely from epylog reports
by Kevin Fenzi 14 Sep '17

14 Sep '17

Greetings. For some reason f26 builders are spewing a lot more audit messages than other machines. This currently makes the epylog reports pretty usless since they are so big. At least for now I would like to just weed all of them out: diff --git a/roles/epylog/files/merged/weed_local.cf b/roles/epylog/files/merged/weed_local.cf index 0fbaeb7..e0f996d 100644 --- a/roles/epylog/files/merged/weed_local.cf +++ b/roles/epylog/files/merged/weed_local.cf @@ -8,7 +8,7 @@ ansible.*: Invoked.* ansible.*: message repeated.* ansible-accelerate:.* ansible-async_wrapper:.* -auditd.*: Audit daemon rotating log files +auditd.* autocloud_job.* avahi-daemon.* btseed.* this also of course needs a run of logserver playbook after applying this. +1s? kevin

4 4

Freeze break: enable highlighting on pkgs for cgit
by Kevin Fenzi 14 Sep '17

14 Sep '17

Here's a simple FBR to enable highlighting on cgit on pkgs: Author: Kevin Fenzi <kevin(a)scrye.com> Date: Tue Sep 12 01:50:43 2017 +0000 add highlighting for cgit on pkgs. ticket 6333 diff --git a/roles/distgit/files/cgitrc b/roles/distgit/files/cgitrc index a84fe2d..fb1c5db 100644 --- a/roles/distgit/files/cgitrc +++ b/roles/distgit/files/cgitrc @@ -60,7 +60,7 @@ mimetype.png=image/png mimetype.svg=image/svg+xml # Enable syntax highlighting (requires the highlight package) -#source-filter=/usr/libexec/cgit/filters/syntax-highlighting.sh +source-filter=/usr/libexec/cgit/filters/syntax-highlighting.sh #email-filter=lua:/usr/libexec/cgit/filters/email-libravatar-korg.lua +1s? kevin

3 2

FBR - ostree commit signing fixups for f27/rawhide
by Dusty Mabe 13 Sep '17

13 Sep '17

A few fixes for ostree commit signing for f27/rawhide. [PATCH 1/3] robosig: add in commit signing for f27 [PATCH 2/3] robosig: sign ostree rawhide with f28 key [PATCH 3/3] robosig: add in ostree signing for rawhide ppc64le

4 7

[FBR] Add oldschool mapping for CommOps team badge to FAS group
by Justin W. Flory 13 Sep '17

13 Sep '17

Hello all, I have another patch to add to the award-oldschool-badges cronjob for the Badges role. It's a one-line change, patch file is attached. I'm not sure if this minor or a change needs to be voted on or not – if not, feel free to merge this in. Thanks! -- Cheers, Justin W. Flory jflory7(a)gmail.com

2 1

[patch] Another oldschool badges cron mapping
by Justin W. Flory 13 Sep '17

13 Sep '17

Hey folks, I have another quick and simple patch attached for the ansible.git repo. This one adds a mapping for the DotNet SIG's FAS group to their new badge that was just pushed up. Let me know if anything else is needed. Thanks! -- Cheers, Justin W. Flory jflory7(a)gmail.com

3 3

[After-the-fact FBR] fixing deleting forks in pagure.io
by Pierre-Yves Chibon 13 Sep '17

13 Sep '17

Good Morning Everyone, I just applied this one liner change to pagure.io: https://pagure.io/pagure/pull-request/2585#request_diff to fix showing the delete button on forks. I had fixed this in src.fp.o before freeze but forgot to fix pagure.io and got a report about it yesterday: https://pagure.io/pagure/issue/2600 Can I get +1s after the fact? Thanks, Pierre

3 2

Bodhi + Modules (not quite an FBR, just yet)
by Ralph Bean 13 Sep '17

13 Sep '17

This came up in the FESCo meeting today. https://github.com/fedora-infra/bodhi/issues/1795 In my last discussions with Randy, we were planning on merging, releasing, and deploying the modular bodhi masher work after Beta freeze thawed - but FESCo would rather see proof of it before freeze is up. This is reasonable. We would've liked to have it before Beta, but contiguous PTO schedules + Flock made that not possible. Anyways, here we are. I volunteered to take on trying to rebase the modular masher patches from https://github.com/fedora-infra/bodhi/pull/1697 and cutting a hotfix release of Bodhi.. and to exercise it very carefully in staging. I want to try upgrading it and downgrading it, and making sure it won't interrupt the mainline mash if anything is wrong with it. I don't think I need an FBR for staging - this is more of a pre-emptive request. If all goes well with that staging upgrade/downgrade, is the infra group OK with upgrading also in prod before the freeze is up? It's not a super small change. What sort of checks would help raise confidence? What should I watch out for? Can you help add items to my TODO list in #1795? (Feel free to edit the ticket there and just add them.) Yours- -Ralph p.s., for the ultimate prod upgrade, I'll send a separate email asking for approval after I've crossed off items on the list. p.p.s., for the ultimate prod upgrade, I'll do it at night US+EU TZ which is when I expect usage will be slightly less.

1 1

What can Fedora Infra do for Factory 2.0? - September
by Pierre-Yves Chibon 12 Sep '17

12 Sep '17

Good Morning Everyone, Yesterday, Ralph and I held our monthly meeting: WCFIDFF2.0 (cf $subject). This is a meeting I started to schedule with Ralph earlier this summer. The idea is to help prioritize things on the Fedora Infra side as well as keeping each other informed on what is being worked on and may come in the future and how we can help each other. I wanted to send a recap of these discussions but missed the opportunity last month, so here it is this time. On the F2.0 front: - Top priority is getting bodhi ready and shaped for modules. This relates to the recent FESCo decision and is being tracked upstream at: https://github.com/fedora-infra/bodhi/issues/1795 Ralph is going to work on this and is likely going to require help from Randy. - The ODCS hosts have been created but are missing shared storage (nfs/gluster) between the frontend and backend hosts. This is not a top priority but it would be appreciated if someone knowing how to do it, has some spare cycles to look into it. Otherwise it will be processed later. Tracked: https://pagure.io/fedora-infrastructure/issue/6182 - Security audit for ODCS and freshmaker (to prioritize in this order) are still pending but I know Patrick has them on his radar. This is also not a top priority since bodhi for modules takes the precedence but it will get higher on the priority list once bodhi is figured out. - The follow up from pagure deployment on dist-git is getting lower, there is only one item left: migrating the watch statuses from pkgdb to pagure. This has been queued to be fixed. https://pagure.io/fedora-infrastructure/issue/6315 Hoping this is useful, Pierre

2 1

Freeze break: fix docs 404
by Kevin Fenzi 12 Sep '17

12 Sep '17

Greetings. When I set this up the other week at flock I didn't realize that giving the full url here would simply redirect to it. We instead need the path to it so it will properly return a 404 to the caller. diff --git a/roles/fedora-docs/proxy/files/fedora-docs.conf b/roles/fedora-docs/proxy/files/fedora-docs.conf index 508ad1d..ebce645 100644 --- a/roles/fedora-docs/proxy/files/fedora-docs.conf +++ b/roles/fedora-docs/proxy/files/fedora-docs.conf @@ -1,5 +1,5 @@ DocumentRoot /srv/web/docs.fedoraproject.org/ -ErrorDocument 404 https://docs.fedoraproject.org/_images/404.html +ErrorDocument 404 /_images/404.html AddType application/epub+zip .epub AddType image/svg+xml .svg I tested this in stg and it works now as expected. In addition to applying this of course I need to run the proxy playbooks. +1s? kevin

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure September 2017