diff --git a/inventory/group_vars/buildvm b/inventory/group_vars/buildvm index d9ac906017..a1ff3b5880 100644 --- a/inventory/group_vars/buildvm +++ b/inventory/group_vars/buildvm @@ -19,4 +19,4 @@ virt_install_command: /usr/sbin/virt-install -n ${inventory_hostname} -r ${mem_s # for systems that do not match the above - specify the same parameter in # the host_vars/$hostname file -sshd_config: ssh/sshd_config.kojibuilder +host_group: kojibuilder diff --git a/inventory/group_vars/releng b/inventory/group_vars/releng index a92d6f5046..fcb291689d 100644 --- a/inventory/group_vars/releng +++ b/inventory/group_vars/releng @@ -19,3 +19,4 @@ virt_install_command: /usr/sbin/virt-install -n ${inventory_hostname} -r ${mem_s # for systems that do not match the above - specify the same parameter in # the host_vars/$hostname file +host_group: releng diff --git a/playbooks/groups/buildvm.yml b/playbooks/groups/buildvm.yml index 7c956cb219..4345bf7467 100644 --- a/playbooks/groups/buildvm.yml +++ b/playbooks/groups/buildvm.yml @@ -18,6 +18,7 @@ tasks: - include: $tasks/virt_instance_create.yml + - include: $tasks/hosts.yml - include: $tasks/koji/base_builder.yml - include: $tasks/koji/builder_kernel_config.yml diff --git a/playbooks/groups/releng.yml b/playbooks/groups/releng.yml index 193dd683a9..743f920c64 100644 --- a/playbooks/groups/releng.yml +++ b/playbooks/groups/releng.yml @@ -32,10 +32,12 @@ - ${vars}/${ansible_distribution}.yml roles: + - /srv/web/infra/ansible/roles/base - /srv/web/infra/ansible/roles/nagios_client tasks: - include: $tasks/koji/releng_config.yml + - include: $tasks/hosts.yml - include: $tasks/motd.yml handlers: diff --git a/roles/base/files/postfix/main.cf.releng02 b/roles/base/files/postfix/main.cf.kojibuilder similarity index 99% rename from roles/base/files/postfix/main.cf.releng02 rename to roles/base/files/postfix/main.cf.kojibuilder index df11bedf8e..f3c260f736 100644 --- a/roles/base/files/postfix/main.cf.releng02 +++ b/roles/base/files/postfix/main.cf.kojibuilder @@ -111,7 +111,7 @@ myorigin = fedoraproject.org #inet_interfaces = all #inet_interfaces = $myhostname #inet_interfaces = $myhostname, localhost -inet_interfaces = 127.0.0.1 +inet_interfaces = all # The proxy_interfaces parameter specifies the network interface # addresses that this mail system receives mail on by way of a diff --git a/roles/base/files/postfix/main.cf.releng01 b/roles/base/files/postfix/main.cf.releng similarity index 100% rename from roles/base/files/postfix/main.cf.releng01 rename to roles/base/files/postfix/main.cf.releng diff --git a/roles/base/files/ssh/sshd_config.buildvm b/roles/base/files/ssh/sshd_config.buildvm deleted file mode 100644 index da5f79fcdc..0000000000 --- a/roles/base/files/ssh/sshd_config.buildvm +++ /dev/null @@ -1,138 +0,0 @@ -# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $ - -# This is the sshd server system-wide configuration file. See -# sshd_config(5) for more information. - -# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin - -# The strategy used for options in the default sshd_config shipped with -# OpenSSH is to specify options with their default value where -# possible, but leave them commented. Uncommented options change a -# default value. - -#Port 22 -#AddressFamily any -#ListenAddress 0.0.0.0 -#ListenAddress :: - -# Disable legacy (protocol version 1) support in the server for new -# installations. In future the default will change to require explicit -# activation of protocol 1 -Protocol 2 - -# HostKey for protocol version 1 -#HostKey /etc/ssh/ssh_host_key -# HostKeys for protocol version 2 -#HostKey /etc/ssh/ssh_host_rsa_key -#HostKey /etc/ssh/ssh_host_dsa_key - -# Lifetime and size of ephemeral version 1 server key -#KeyRegenerationInterval 1h -#ServerKeyBits 1024 - -# Logging -# obsoletes QuietMode and FascistLogging -#SyslogFacility AUTH -SyslogFacility AUTHPRIV -LogLevel VERBOSE - -# Authentication: - -#LoginGraceTime 2m -#PermitRootLogin yes -StrictModes no -#MaxAuthTries 6 -#MaxSessions 10 - -#RSAAuthentication yes -#PubkeyAuthentication yes -#AuthorizedKeysFile .ssh/authorized_keys -#AuthorizedKeysCommand none -#AuthorizedKeysCommandRunAs nobody - -# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts -#RhostsRSAAuthentication no -# similar for protocol version 2 -#HostbasedAuthentication no -# Change to yes if you don't trust ~/.ssh/known_hosts for -# RhostsRSAAuthentication and HostbasedAuthentication -#IgnoreUserKnownHosts no -# Don't read the user's ~/.rhosts and ~/.shosts files -#IgnoreRhosts yes - -# To disable tunneled clear text passwords, change to no here! -#PasswordAuthentication yes -#PermitEmptyPasswords no -PasswordAuthentication yes - -# Change to no to disable s/key passwords -#ChallengeResponseAuthentication yes -ChallengeResponseAuthentication no - -# Kerberos options -#KerberosAuthentication no -#KerberosOrLocalPasswd yes -#KerberosTicketCleanup yes -#KerberosGetAFSToken no -#KerberosUseKuserok yes - -# GSSAPI options -#GSSAPIAuthentication no -GSSAPIAuthentication yes -#GSSAPICleanupCredentials yes -GSSAPICleanupCredentials yes -#GSSAPIStrictAcceptorCheck yes -#GSSAPIKeyExchange no - -# Set this to 'yes' to enable PAM authentication, account processing, -# and session processing. If this is enabled, PAM authentication will -# be allowed through the ChallengeResponseAuthentication and -# PasswordAuthentication. Depending on your PAM configuration, -# PAM authentication via ChallengeResponseAuthentication may bypass -# the setting of "PermitRootLogin without-password". -# If you just want the PAM account and session checks to run without -# PAM authentication, then enable this but set PasswordAuthentication -# and ChallengeResponseAuthentication to 'no'. -#UsePAM no -UsePAM yes - -# Accept locale-related environment variables -AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES -AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT -AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE -AcceptEnv XMODIFIERS - -#AllowAgentForwarding yes -#AllowTcpForwarding yes -#GatewayPorts no -#X11Forwarding no -X11Forwarding yes -#X11DisplayOffset 10 -#X11UseLocalhost yes -#PrintMotd yes -#PrintLastLog yes -#TCPKeepAlive yes -#UseLogin no -#UsePrivilegeSeparation yes -#PermitUserEnvironment no -#Compression delayed -#ClientAliveInterval 0 -#ClientAliveCountMax 3 -#ShowPatchLevel no -#UseDNS yes -#PidFile /var/run/sshd.pid -#MaxStartups 10 -#PermitTunnel no -#ChrootDirectory none - -# no default banner path -#Banner none - -# override default of no subsystems -Subsystem sftp /usr/libexec/openssh/sftp-server - -# Example of overriding settings on a per-user basis -#Match User anoncvs -# X11Forwarding no -# AllowTcpForwarding no -# ForceCommand cvs server diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index 818331b903..8db0b70f80 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -126,6 +126,11 @@ - postfix - config +- name: enable postfix to start + service: name=postfix state=running enabled=true + tags: + - service + # # This task installs some common scripts to /usr/local/bin # scripts are under roles/base/files/common-scripts diff --git a/files/iptables/kojibuilder b/roles/base/templates/iptables/iptables.kojibuilder similarity index 100% rename from files/iptables/kojibuilder rename to roles/base/templates/iptables/iptables.kojibuilder diff --git a/files/iptables/releng b/roles/base/templates/iptables/iptables.releng similarity index 100% rename from files/iptables/releng rename to roles/base/templates/iptables/iptables.releng diff --git a/tasks/hosts.yml b/tasks/hosts.yml index 5f94c083db..be600bc091 100644 --- a/tasks/hosts.yml +++ b/tasks/hosts.yml @@ -12,7 +12,7 @@ - name: setup /etc/hosts for some clients action: copy src=$item dest=/etc/hosts with_first_found: - - files: $files/hosts/${ansible_fqdn}-hosts $files/hosts/${ansible_hostname}-hosts $files/hosts/${ansible_domain}-hosts + - files: $files/hosts/{{ ansible_fqdn }}-hosts $files/hosts/{{ ansible_hostname }}-hosts $files/hosts/{{ ansible_domain }}-hosts $files/hosts/{{ host_group }}-hosts skip: true tags: - config diff --git a/tasks/koji/base_builder.yml b/tasks/koji/base_builder.yml index c3f5b66ed7..c8b535202e 100644 --- a/tasks/koji/base_builder.yml +++ b/tasks/koji/base_builder.yml @@ -1,10 +1,3 @@ -- name: enforce certain packages previously assumed from kickstarts - action: yum name=$item state=installed - with_items: - - postfix - - joe - - perl - - name: set root passwd action: user name=root password=$builder_rootpw state=present @@ -32,32 +25,6 @@ - name: mockbuilder ssh key action: copy src=$files/kojibuilder/ftbfs_auth_keys dest=/home/mockbuilder/.ssh/authorized_keys mode=644 owner=mockbuilder group=mockbuilder -- name: iptables - action: template src=$files/iptables/kojibuilder dest=/etc/sysconfig/iptables mode=600 - notify: - - restart iptables - -- name: sshd_config - action: copy src=$files/ssh/sshd_config.kojibuilder dest=/etc/ssh/sshd_config mode=600 - notify: - - restart sshd - -- name: /etc/resolv.conf - action: copy src=$files/resolv.conf/kojibuilder dest=/etc/resolv.conf - -- name: add to hosts - action: copy src=$files/hosts/kojibuilder-hosts dest=/etc/hosts - -- name: rsyslog.conf - action: copy src=$files/rsyslog/rsyslog.conf.kojibuilder dest=/etc/rsyslog.conf mode=644 - notify: - - restart rsyslog - -- name: /etc/postfix/main.cf - action: copy src=$files/postfix/main.cf.norelay dest=/etc/postfix/main.cf - notify: - - restart postfix - - name: make a bunch of dirs action: file state=directory path=$item with_items: diff --git a/tasks/koji/releng_config.yml b/tasks/koji/releng_config.yml index 24be2b4adf..f458a6d595 100644 --- a/tasks/koji/releng_config.yml +++ b/tasks/koji/releng_config.yml @@ -36,7 +36,6 @@ - name: add masher ssh priv key action: copy src=$private/files/mash/masher.id_rsa dest=/home/masher/.ssh/id_rsa mode=600 owner=masher group=masher - # rawhide group - name: rawhide group action: group name=rawhide gid=265 @@ -44,46 +43,6 @@ - name: add rawhide user action: user name=rawhide uid=265 group=rawhide home=/tmp comment="rawhide compose account" - -- name: iptables - action: template src=$files/iptables/releng dest=/etc/sysconfig/iptables mode=600 - notify: - - restart iptables - tags: - - configs - -- name: sshd_config - action: copy src=$files/ssh/sshd_config.releng dest=/etc/ssh/sshd_config mode=600 - notify: - - restart sshd - tags: - - sshd_config - - configs - -- name: /etc/resolv.conf - action: copy src=$files/resolv.conf/phx2 dest=/etc/resolv.conf - tags: - - configs - -- name: /etc/hosts - action: copy src=$files/hosts/releng-hosts dest=/etc/hosts - tags: - - configs - - -- name: rsyslog.conf - action: copy src=$files/rsyslog/rsyslog.conf.releng dest=/etc/rsyslog.conf mode=644 - tags: - - configs - -- name: /etc/postfix/main.cf - action: copy src=$files/postfix/main.cf.releng01 dest=/etc/postfix/main.cf - tags: - - configs - -- name: ensure postfix is started - action: service name=postfix state=started enabled=true - - name: make a bunch of dirs action: file state=directory path=$item with_items: @@ -249,4 +208,3 @@ tags: - fedmsg only_if: "'${inventory_hostname}'.startswith('releng02')" -