dMerge branch 'master' of /git/ansible

inventory/group_vars/openqa

@@ -34,7 +34,7 @@ deployment_type: prod
 freezes: false
 
 # http and NFS
-tcp_ports: [ 80, 2049 ]
+tcp_ports: [80, 2049]
 
 # These people get told when something goes wrong.
 fedmsg_error_recipients:

inventory/group_vars/openqa-stg

@@ -28,8 +28,6 @@ openqa_dbuser: openqastg
 openqa_dbpassword: "{{ stg_openqa_dbpassword }}"
 openqa_assetsize: 300
 
-openqa_workers: 3
-
 openqa_key: "{{ stg_openqa_apikey }}"
 openqa_secret: "{{ stg_openqa_apisecret }}"
 

inventory/group_vars/openqa-stg-workers

@@ -1,14 +1,13 @@
+gw: 10.5.124.254
 openqa_workers: 4
 openqa_hostname: openqa-stg01.qa.fedoraproject.org
-gw: 10.5.124.254
+openqa_key: "{{ stg_openqa_apikey }}"
+openqa_secret: "{{ stg_openqa_apisecret }}"
 
 # for iptables rules...maybe other stuff in future? both staging
 # and prod workers are in this group
 host_group: openqa-workers
 
-openqa_key: "{{ stg_openqa_apikey }}"
-openqa_secret: "{{ stg_openqa_apisecret }}"
-
 # firewall rules to allow openQA openvswitch guests to communicate
 custom_rules: [
     '-A FORWARD -i br0 -j ACCEPT',

inventory/group_vars/openqa-workers

@@ -1,9 +1,25 @@
+gw: 10.5.124.254
 openqa_workers: 4
 openqa_hostname: openqa01.qa.fedoraproject.org
-gw: 10.5.124.254
-
 openqa_key: "{{ prod_openqa_apikey }}"
 openqa_secret: "{{ prod_openqa_apisecret }}"
 
+# for iptables rules...maybe other stuff in future? both staging
+# and prod workers are in this group
+host_group: openqa-workers
+
+# firewall rules to allow openQA openvswitch guests to communicate
+custom_rules: [
+    '-A FORWARD -i br0 -j ACCEPT',
+    '-A FORWARD -m state -i eth0 -o br0 --state RELATED,ESTABLISHED -j ACCEPT',
+    '-A INPUT -i br0 -j ACCEPT'
+]
+
+# we do stuff with ifcfg that base doesn't understand. terrible, terrible
+# stuff. seriously - it doesn't handle the openvswitch config well. so
+# let's tell it to just configure eth0 for us and leave everything else
+# alone.
+ansible_ifcfg_whitelist: ['eth0']
+
 deployment_type: prod
 freezes: false

playbooks/groups/arm-packager.yml

@@ -34,7 +34,7 @@
     - packages
 
   - name: allow packagers to use mock
-    lineinfile: dest=/etc/pam.d/mock line="{{ item }} sufficient pam_succeed_if.so user ingroup packager use_uid quiet"
+    lineinfile: dest=/etc/pam.d/mock line="{{ item }} sufficient pam_succeed_if.so user ingroup packager use_uid quiet" insertbefore=BOF
     with_items:
     - account
     - auth