infrastructure October 2018

infrastructure@lists.fedoraproject.org

29 participants
54 discussions

[After the fact Freeze Break Request]: restarting loopabull
by Pierre-Yves Chibon 15 Oct '18

15 Oct '18

Good Morning Everyone, After being asked why the CI messages aren't being shown to src.fp.o, I looked at loopabull to find out it wasn't running, the workers were but not the main app. So I'd like, 2 +1 after the fact for having restarted it. In the same idea: 2 +1 to enable it in ansible using the following patch: """ From 865436dbdb8f5d1387af1e630c1b9adc01a44ed5 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon <pingou(a)pingoured.fr> Date: Mon, 15 Oct 2018 16:12:23 +0200 Subject: [PATCH] Ensure the loopabull server is running and enabled Signed-off-by: Pierre-Yves Chibon <pingou(a)pingoured.fr> --- roles/loopabull/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/loopabull/tasks/main.yml b/roles/loopabull/tasks/main.yml index 2edf16190..9ddd42289 100644 --- a/roles/loopabull/tasks/main.yml +++ b/roles/loopabull/tasks/main.yml @@ -61,6 +61,7 @@ state: started enabled: yes with_items: + - loopabull - loopabull@1 - loopabull@2 - loopabull@3 -- 2.14.4 """ Thanks, Pierre

3 2

FAS & openid application development
by Radka Janekova 15 Oct '18

15 Oct '18

Hi, please excuse me if this information is somewhere and I failed to find it... I'm looking for a way to add an application / get an id, to be used in a web application used to authenticate the user with Fedora account. I did not see any mention of it in the auth/openid wiki page, I'm assuming that it would be to create a ticket with infrastructure? Who would be the right person to talk to about this topic? Willing to spare a bit of time to provide some guidance? (Czech would be welcome as it is a local high school intern working on the project, and I'm not entirely confident in his English :P) Project details to give you a better picture what am I talking about - A website where the user will log-in with their Fedora account, then have some options to choose from, these would be generated based on their scope/groups ... Thank you, Radka ------------------------------ *Radka Janeková* .NET Engineer, Red Hat *radka.janek(a)redhat.com <radka.janek(a)redhat.com>* IRC: radka | Freenode: Rhea

4 5

[Freeze Break Request: ] Upgrade pagure.io to pagure 5.1.2
by Pierre-Yves Chibon 15 Oct '18

15 Oct '18

Good Morning Everyone, Today people started to indicate some issues with merging, accessing or delete branches in some projects. All what these persons had in common, they had access to the project via a group. It turns out, in 5.1 the logic to determine if a person is a committer to a project has been changed and our test suite seems to be incomplete here as people having commit via a group are not considered committers. I've spent sometime getting this fixed in a way that remains compatible with the reason it was changed in the first place and added more tests for this. Seeing that the changelog since the 5.1.1 release isn't large: * 7dbcb0e5 Add test checking that group with ticket access aren't committer * 8bba7704 Add test to ensure committers in a group with commit access are recognized * 695f8cad Ensure there is a session in flask.g and patch it correctly * 2a1d4db8 Fix detecting if the user is a committer via a group * a3c93a3d Also provide PATH and content encoding for clone.py * 557a7ab3 Use the manually updated updated_on field rather than last_updated * 6764e6aa Make the sshkey migration more flexible * 6387abb7 Fix underline length in the doc - fixes warning in sphinx * 20456fac Add some documentation about MIRROR_SSHKEYS_FOLDER * 3e055021 If a value is None, insert empty strings into the arguments (This is including the commits fixing the issue, PR pending at: https://pagure.io/pagure/pull-request/3890) I am considering just doing a 5.1.2 bug fix release and I would like to request permission to push this to pagure.io. Thoughts? Thanks, Pierre

4 6

FBR: Stop building F28 AH image artifacts during bodhi run
by Sinny Kumari 14 Oct '18

14 Oct '18

Hi, Next Fedora Atomic Host TwoWeek release will be based on F29 stream and same will be followed in future releases. So, building F28 AH artifacts during bodhi run is not needed. Additionally, use testing refs to build image artifacts for updates-testing compose and updates refs to build updates compose during bodhi run. Can I get +1 for the patch (available in email attachment.)? Thanks, Sinny

5 9

Automating bodhi daily pushes
by Mohan Boddu 12 Oct '18

12 Oct '18

Please review this change: diff --git a/roles/bodhi2/backend/files/bodhi-automated-pushes.cron b/roles/bodhi2/backend/files/bodhi-au new file mode 100644 index 0000000..7e12cfd --- /dev/null +++ b/roles/bodhi2/backend/files/bodhi-automated-pushes.cron @@ -0,0 +1 @@ +59 23 * * * apache /usr/local/bin/bodhi-automated-pushes.py diff --git a/roles/bodhi2/backend/files/bodhi-automated-pushes.py b/roles/bodhi2/backend/files/bodhi-auto new file mode 100644 index 0000000..aacc81c --- /dev/null +++ b/roles/bodhi2/backend/files/bodhi-automated-pushes.py @@ -0,0 +1,12 @@ +import requests +import json +import subprocess +import logging + +req = requests.get('https://bodhi.fedoraproject.org/composes/') +bodhi_composes = req.json() + +if len(bodhi_composes['composes']) == 0: + bodhi_push_cmd = ["bodhi-push", "--username", "releng"] + push = subprocess.Popen(bodhi_push_cmd, stdout=PIPE, stderr=PIPE, stdin=PIPE) + push.stdin.write('y') diff --git a/roles/bodhi2/backend/tasks/main.yml b/roles/bodhi2/backend/tasks/main.yml index f76d944..054cef1 100644 --- a/roles/bodhi2/backend/tasks/main.yml +++ b/roles/bodhi2/backend/tasks/main.yml @@ -264,6 +264,14 @@ - bodhi - cron +- name: put bodhi-automated-pushes.py in place + copy: src=bodhi-automated-pushes.py dest=/usr/local/bin/bodhi-automated-pushes.py mode=0755 + when: inventory_hostname.startswith('bodhi-backend01') and env == "production" + tags: + - config + - bodhi + - cron + - name: put update-fullfiletimelist in place copy: src="{{ files }}/scripts/update-fullfiletimelist" dest=/usr/local/bin/update-fullfiletimelist mo when: inventory_hostname.startswith('bodhi-backend01') and env == "production" @@ -288,6 +296,14 @@ - bodhi - cron +- name: Set the bodhi-automated-pushes cron job + copy: src=bodhi-automated-pushes.cron dest=/etc/cron.d/bodhi-automated-pushes + when: inventory_hostname.startswith('bodhi-backend01') and env == "production" + tags: + - config + - bodhi + - cron + - name: directory sizes update cron job. cron: name="directory-sizes-update" minute="30" hour="19" user="ftpsync" job="/usr/bin/find /pub/alt/ /pub/archive/ /pub/fedora-secondary/ /pub/fedora/ /pub/epel/ -type During freezes the cron job is disabled and we will push the updates manually.

3 4

[Freeze Break Request: ] Switch anitya backups to use --exclude-table-data rather than excluding entire tables
by kevin＠scrye.com 12 Oct '18

12 Oct '18

From: Kevin Fenzi <kevin(a)scrye.com> This allows people to use the db dump without having to manually create the missing tables. Signed-off-by: Kevin Fenzi <kevin(a)scrye.com> --- roles/postgresql_server/files/backup-database.anitya | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/postgresql_server/files/backup-database.anitya b/roles/postgresql_server/files/backup-database.anitya index c28f31b..a2e05a8 100644 --- a/roles/postgresql_server/files/backup-database.anitya +++ b/roles/postgresql_server/files/backup-database.anitya @@ -10,7 +10,7 @@ DB=anitya # Make it use a limited number of threads because pxz will use all the # cpus which causes pg_dump to starve which causes... -/usr/bin/pg_dump -T users -T tokens -T 'social*' -T sessions -C $DB | /usr/bin/pxz -T4 > /backups/$DB-public-$(date +%F).dump.xz +/usr/bin/pg_dump --exclude-table-data users --exclude-table-data tokens --exclude-table-data 'social*' --exclude-table-data sessions -C $DB | /usr/bin/pxz -T4 > /backups/$DB-public-$(date +%F).dump.xz # Also, delete the backup from a few days ago. rm -f /backups/$DB-public-$(date --date="1 days ago" +%F).dump.xz -- 1.8.3.1

5 4

FBR: Allow anonymous HTTPS pulling via in-Pagure systems
by Patrick マルタインアンドレアス Uiterwijk 12 Oct '18

12 Oct '18

Hi all, This should be my last FBR for now, as with this I tested everything in staging, and I believe it works there (SSH pull/push and HTTPS pull, we don't have HTTPS push for pagure.io (yet)). This basically sets the username for anonymous access to something that would never be a valid user for FAS. Patrick commit b89814426a0565219684336952a823178b973619 (HEAD -> master) Author: Patrick Uiterwijk <patrick(a)puiterwijk.org> Date: Fri Oct 12 11:51:57 2018 +0200 Enable anon user for prod Pagure Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org> diff --git a/roles/pagure/frontend/templates/gitolite.rc b/roles/pagure/frontend/templates/gitolite.rc index 41c0b3f1f..77eb32b3e 100644 --- a/roles/pagure/frontend/templates/gitolite.rc +++ b/roles/pagure/frontend/templates/gitolite.rc @@ -15,9 +15,8 @@ %RC = ( # ------------------------------------------------------------------ -{% if env == "pagure-staging" %} HTTP_ANON_USER => 'ANONYMOUS_', -{% endif %} + # default umask gives you perms of '0700'; see the rc file docs for # how/why you might change this UMASK => 0077,

3 2

Anitya 0.13.2 (stg.release-monitoring.org) deployed on staging
by Michal Konečný 12 Oct '18

12 Oct '18

Hi everybody, I want to announce that the Anitya 0.13.2 was finally deployed on staging (https://stg.release-monitoring.org/) Feel free to test it. Anitya 0.13.2 will be deployed on production next week if no breaking issue will be found. You can see changelog here https://github.com/release-monitoring/anitya/releases/tag/0.13.2 Known issues that were found in 0.13.1 should be fixed now: - documentation links are broken (fixed) - many project are now incorrectly setup (There is migration script as part of this update) - admins lost their rights (For admin access you need to give existing admin your user ID now - this could be found on Settings page. This is private information, so use secure channel when sending it to admin) Regards, mkonecny

1 0

FBR: Switch to in-Pagure https cloning and enable keyhelper/aclchecker for prod
by Patrick マルタインアンドレアス Uiterwijk 11 Oct '18

11 Oct '18

Hi all, Can I get +1s for these last two patches, which should make Pagure.io fully repoSpanner compatible? It switches the prod sshd to the new sshd_config with keyhelper, and the other patch disables the scriptalias, which means it hits the code in Pagure that multiplexes this to gitolite (for us) or repoSpanner (future). Patrick commit 93bdfdf91339df06dda9b61bc9bda7d27e6cc4e7 (HEAD -> master) Author: Patrick Uiterwijk <patrick(a)puiterwijk.org> Date: Thu Oct 11 21:08:48 2018 +0200 Switch over prod pagure.io to keyhelper/aclchecker Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org> diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure index afa936a6f..a172bf8b9 100644 --- a/inventory/group_vars/pagure +++ b/inventory/group_vars/pagure @@ -17,6 +17,8 @@ stunnel_service: "eventsource" stunnel_source_port: 8088 stunnel_destination_port: 8080 +sshd_config: ssh/sshd_config.pagure + # These are consumed by a task in roles/fedmsg/base/main.yml fedmsg_certs: - service: shell commit 2b45182edde6b7896500088da7d430e5435c49b8 Author: Patrick Uiterwijk <patrick(a)puiterwijk.org> Date: Thu Oct 11 21:08:09 2018 +0200 Remove ScriptAlias to use in-Pagure https clone Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org> diff --git a/roles/pagure/frontend/templates/0_pagure.conf b/roles/pagure/frontend/templates/0_pagure.conf index cd1004845..50c2d6e9b 100644 --- a/roles/pagure/frontend/templates/0_pagure.conf +++ b/roles/pagure/frontend/templates/0_pagure.conf @@ -80,15 +80,6 @@ WSGIDaemonProcess paguredocs user=git group=git maximum-requests=1000 display-na SetEnv GIT_PROJECT_ROOT /srv/git/repositories - AliasMatch ^/(.*/objects/[0-9a-f]{2}/[0-9a-f]{38})$ /srv/git/repositories/$1 - AliasMatch ^/(.*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$ /srv/git/repositories/$1 - ScriptAliasMatch \ - "(?x)^/(.*/(HEAD | \ - info/refs | \ - objects/info/[^/]+ | \ - git-(upload|receive)-pack))$" \ - /usr/libexec/git-core/git-http-backend/$1 - <Location /> WSGIProcessGroup pagure <IfModule mod_authz_core.c>

3 2

Meeting Agenda Item: Introduction Juan Pablo Máscolo
by Juan Pablo 11 Oct '18

11 Oct '18

Hi, looking forward to collaborate on fedora infra. Im currently at UTC-3 can be found on IRC as Kal3ssiN / jungle_juice fas: kalessin Im ok with bash scripting, some experience with python, mostly a foss/sysadmin/networking background guy. =)

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure October 2018