FBR: Setup proxying and VPN for certgetter01
by Patrick Uiterwijk
Hi,
Could I get +1s for these patches:
From 596ccf8bc44bad969a2ee9395c2c0ae7ee994a43 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk(a)redhat.com>
Date: Sat, 9 Sep 2017 22:25:08 +0000
Subject: [PATCH 1/3] Allow setting up a vhost for certgetter
Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com>
---
roles/httpd/website/defaults/main.yml | 1 +
roles/httpd/website/templates/website.conf | 4 ++++
2 files changed, 5 insertions(+)
diff --git a/roles/httpd/website/defaults/main.yml
b/roles/httpd/website/defaults/main.yml
index 99aa8b0..8ad299d 100644
--- a/roles/httpd/website/defaults/main.yml
+++ b/roles/httpd/website/defaults/main.yml
@@ -4,6 +4,7 @@
server_aliases: []
server_admin: webmaster(a)fedoraproject.org
+certbot: false
ssl: true
sslonly: false
SSLCertificateChainFile: wildcard-2017.fedoraproject.org.intermediate.cert
diff --git a/roles/httpd/website/templates/website.conf
b/roles/httpd/website/templates/website.conf
index 6547452..8eed648 100644
--- a/roles/httpd/website/templates/website.conf
+++ b/roles/httpd/website/templates/website.conf
@@ -10,6 +10,10 @@
SetOutputFilter DEFLATE
{% endif %}
+{% if certbot %}
+ ProxyPass "/.well-known/acme-challenge"
"http://certgetter01/.well-known/acme-challenge"
+{% endif %}
+
{% if sslonly %}
RewriteEngine On
RewriteCond %{HTTPS} off
--
1.8.3.1
From 403f97fc772c4a1d9fc55aab981e6bf0293c19b1 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk(a)redhat.com>
Date: Sat, 9 Sep 2017 22:26:40 +0000
Subject: [PATCH 2/3] Enable certbot for secondary kojis
Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com>
---
playbooks/include/proxies-websites.yml | 3 +++
1 file changed, 3 insertions(+)
diff --git a/playbooks/include/proxies-websites.yml
b/playbooks/include/proxies-websites.yml
index 9735c89..6362509 100644
--- a/playbooks/include/proxies-websites.yml
+++ b/playbooks/include/proxies-websites.yml
@@ -499,6 +499,7 @@
- role: httpd/website
name: ppc.koji.fedoraproject.org
sslonly: true
+ certbot: true
server_aliases:
- ppcpkgs.fedoraproject.org
cert_name: secondary.koji.fedoraproject.org.letsencrypt
@@ -507,6 +508,7 @@
- role: httpd/website
name: s390.koji.fedoraproject.org
sslonly: true
+ certbot: true
server_aliases:
- s390pkgs.fedoraproject.org
cert_name: secondary.koji.fedoraproject.org.letsencrypt
@@ -515,6 +517,7 @@
- role: httpd/website
name: arm.koji.fedoraproject.org
sslonly: true
+ certbot: true
server_aliases:
- armpkgs.fedoraproject.org
cert_name: secondary.koji.fedoraproject.org.letsencrypt
--
1.8.3.1
From 49a05d85c2af5d3288e095c837ff7013d77f5756 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk(a)redhat.com>
Date: Sat, 9 Sep 2017 23:02:21 +0000
Subject: [PATCH 3/3] Add certgetter01 ccd file
Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com>
---
roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org | 2 ++
1 file changed, 2 insertions(+)
create mode 100644
roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org
diff --git a/roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org
b/roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org
new file mode 100644
index 0000000..6b4c087
--- /dev/null
+++ b/roles/openvpn/server/files/ccd/certgetter01.phx2.fedoraproject.org
@@ -0,0 +1,2 @@
+# ifconfig-push actualIP PtPIP
+ifconfig-push 192.168.1.177 192.168.0.177
--
1.8.3.1
6 years, 6 months
Freeze break: weed out audit messages entirely from epylog reports
by Kevin Fenzi
Greetings.
For some reason f26 builders are spewing a lot more audit messages than
other machines. This currently makes the epylog reports pretty usless
since they are so big.
At least for now I would like to just weed all of them out:
diff --git a/roles/epylog/files/merged/weed_local.cf
b/roles/epylog/files/merged/weed_local.cf
index 0fbaeb7..e0f996d 100644
--- a/roles/epylog/files/merged/weed_local.cf
+++ b/roles/epylog/files/merged/weed_local.cf
@@ -8,7 +8,7 @@ ansible.*: Invoked.*
ansible.*: message repeated.*
ansible-accelerate:.*
ansible-async_wrapper:.*
-auditd.*: Audit daemon rotating log files
+auditd.*
autocloud_job.*
avahi-daemon.*
btseed.*
this also of course needs a run of logserver playbook after applying this.
+1s?
kevin
6 years, 6 months
Freeze break: enable highlighting on pkgs for cgit
by Kevin Fenzi
Here's a simple FBR to enable highlighting on cgit on pkgs:
Author: Kevin Fenzi <kevin(a)scrye.com>
Date: Tue Sep 12 01:50:43 2017 +0000
add highlighting for cgit on pkgs. ticket 6333
diff --git a/roles/distgit/files/cgitrc b/roles/distgit/files/cgitrc
index a84fe2d..fb1c5db 100644
--- a/roles/distgit/files/cgitrc
+++ b/roles/distgit/files/cgitrc
@@ -60,7 +60,7 @@ mimetype.png=image/png
mimetype.svg=image/svg+xml
# Enable syntax highlighting (requires the highlight package)
-#source-filter=/usr/libexec/cgit/filters/syntax-highlighting.sh
+source-filter=/usr/libexec/cgit/filters/syntax-highlighting.sh
#email-filter=lua:/usr/libexec/cgit/filters/email-libravatar-korg.lua
+1s?
kevin
6 years, 6 months
FBR - ostree commit signing fixups for f27/rawhide
by Dusty Mabe
A few fixes for ostree commit signing for f27/rawhide.
[PATCH 1/3] robosig: add in commit signing for f27
[PATCH 2/3] robosig: sign ostree rawhide with f28 key
[PATCH 3/3] robosig: add in ostree signing for rawhide ppc64le
6 years, 6 months
[FBR] Add oldschool mapping for CommOps team badge to FAS group
by Justin W. Flory
Hello all,
I have another patch to add to the award-oldschool-badges cronjob for
the Badges role. It's a one-line change, patch file is attached.
I'm not sure if this minor or a change needs to be voted on or not – if
not, feel free to merge this in.
Thanks!
--
Cheers,
Justin W. Flory
jflory7(a)gmail.com
6 years, 6 months
[patch] Another oldschool badges cron mapping
by Justin W. Flory
Hey folks,
I have another quick and simple patch attached for the ansible.git repo.
This one adds a mapping for the DotNet SIG's FAS group to their new
badge that was just pushed up.
Let me know if anything else is needed. Thanks!
--
Cheers,
Justin W. Flory
jflory7(a)gmail.com
6 years, 6 months
Bodhi + Modules (not quite an FBR, just yet)
by Ralph Bean
This came up in the FESCo meeting today.
https://github.com/fedora-infra/bodhi/issues/1795
In my last discussions with Randy, we were planning on merging,
releasing, and deploying the modular bodhi masher work after Beta
freeze thawed - but FESCo would rather see proof of it before freeze
is up. This is reasonable. We would've liked to have it before Beta,
but contiguous PTO schedules + Flock made that not possible.
Anyways, here we are. I volunteered to take on trying to rebase the
modular masher patches from https://github.com/fedora-infra/bodhi/pull/1697
and cutting a hotfix release of Bodhi.. and to exercise it very
carefully in staging. I want to try upgrading it and downgrading it,
and making sure it won't interrupt the mainline mash if anything is
wrong with it.
I don't think I need an FBR for staging - this is more of a
pre-emptive request. If all goes well with that staging
upgrade/downgrade, is the infra group OK with upgrading also in prod
before the freeze is up?
It's not a super small change. What sort of checks would help raise
confidence? What should I watch out for? Can you help add items to
my TODO list in #1795? (Feel free to edit the ticket there and just
add them.)
Yours-
-Ralph
p.s., for the ultimate prod upgrade, I'll send a separate email asking
for approval after I've crossed off items on the list.
p.p.s., for the ultimate prod upgrade, I'll do it at night US+EU TZ
which is when I expect usage will be slightly less.
6 years, 6 months
What can Fedora Infra do for Factory 2.0? - September
by Pierre-Yves Chibon
Good Morning Everyone,
Yesterday, Ralph and I held our monthly meeting: WCFIDFF2.0 (cf $subject). This
is a meeting I started to schedule with Ralph earlier this summer. The idea is
to help prioritize things on the Fedora Infra side as well as keeping each other
informed on what is being worked on and may come in the future and how we can
help each other.
I wanted to send a recap of these discussions but missed the opportunity last
month, so here it is this time.
On the F2.0 front:
- Top priority is getting bodhi ready and shaped for modules.
This relates to the recent FESCo decision and is being tracked upstream at:
https://github.com/fedora-infra/bodhi/issues/1795
Ralph is going to work on this and is likely going to require help from Randy.
- The ODCS hosts have been created but are missing shared storage (nfs/gluster)
between the frontend and backend hosts.
This is not a top priority but it would be appreciated if someone knowing how to
do it, has some spare cycles to look into it. Otherwise it will be processed
later.
Tracked: https://pagure.io/fedora-infrastructure/issue/6182
- Security audit for ODCS and freshmaker (to prioritize in this order) are still
pending but I know Patrick has them on his radar.
This is also not a top priority since bodhi for modules takes the precedence but
it will get higher on the priority list once bodhi is figured out.
- The follow up from pagure deployment on dist-git is getting lower, there is
only one item left: migrating the watch statuses from pkgdb to pagure.
This has been queued to be fixed.
https://pagure.io/fedora-infrastructure/issue/6315
Hoping this is useful,
Pierre
6 years, 6 months
Freeze break: fix docs 404
by Kevin Fenzi
Greetings.
When I set this up the other week at flock I didn't realize that giving
the full url here would simply redirect to it.
We instead need the path to it so it will properly return a 404 to the
caller.
diff --git a/roles/fedora-docs/proxy/files/fedora-docs.conf
b/roles/fedora-docs/proxy/files/fedora-docs.conf
index 508ad1d..ebce645 100644
--- a/roles/fedora-docs/proxy/files/fedora-docs.conf
+++ b/roles/fedora-docs/proxy/files/fedora-docs.conf
@@ -1,5 +1,5 @@
DocumentRoot /srv/web/docs.fedoraproject.org/
-ErrorDocument 404 https://docs.fedoraproject.org/_images/404.html
+ErrorDocument 404 /_images/404.html
AddType application/epub+zip .epub
AddType image/svg+xml .svg
I tested this in stg and it works now as expected.
In addition to applying this of course I need to run the proxy playbooks.
+1s?
kevin
6 years, 6 months