Put in a blocker for an old 'friend'

files/httpd/newvirtualhost.conf.j2

@@ -15,13 +15,12 @@
   #   SSL Protocol support:
   # List the enable protocol levels with which clients will be able to
   # connect.  Disable SSLv2 access by default:
-  SSLProtocol all -SSLv2
+  SSLProtocol {{ ssl_protocols }}
 
   #   SSL Cipher Suite:
   # List the ciphers that the client is permitted to negotiate.
   # See the mod_ssl documentation for a complete list.
-  #SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
+  SSLCipherSuite {{ ssl_ciphers }}
-  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
 
   #   Server Certificate:
   # Point SSLCertificateFile at a PEM encoded certificate.  If

files/lists-dev/apache.conf.j2

@@ -11,7 +11,7 @@
     SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
     #SSLCertificateChainFile /etc/pki/tls/cert.pem
     SSLHonorCipherOrder On
-    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+    SSLCipherSuite {{ ssl_ciphers }}
-    SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+    SSLProtocol {{ ssl_protocols }}
 </VirtualHost>
 

inventory/backups

@@ -11,7 +11,7 @@ batcave01.phx2.fedoraproject.org
 infinote.fedoraproject.org
 pagure01.fedoraproject.org
 people02.fedoraproject.org
-pkgs02.phx2.fedoraproject.org
+#pkgs02.phx2.fedoraproject.org
 log01.phx2.fedoraproject.org
 qadevel.qa.fedoraproject.org:222
 db-qa01.qa.fedoraproject.org

inventory/builders

@@ -35,6 +35,18 @@ buildvm-03.stg.phx2.fedoraproject.org
 buildvm-04.stg.phx2.fedoraproject.org
 buildvm-05.stg.phx2.fedoraproject.org
 
+[buildvm-aarch64]
+buildvm-aarch64-01.arm.fedoraproject.org
+buildvm-aarch64-02.arm.fedoraproject.org
+buildvm-aarch64-03.arm.fedoraproject.org
+buildvm-aarch64-04.arm.fedoraproject.org
+buildvm-aarch64-05.arm.fedoraproject.org
+buildvm-aarch64-06.arm.fedoraproject.org
+buildvm-aarch64-07.arm.fedoraproject.org
+buildvm-aarch64-08.arm.fedoraproject.org
+buildvm-aarch64-09.arm.fedoraproject.org
+buildvm-aarch64-10.arm.fedoraproject.org
+
 [buildvm-ppc64]
 buildvm-ppc64-01.ppc.fedoraproject.org
 buildvm-ppc64-02.ppc.fedoraproject.org
@@ -65,6 +77,16 @@ buildvmhost-12.phx2.fedoraproject.org
 ppc8-01.ppc.fedoraproject.org
 ppc8-02.ppc.fedoraproject.org
 ppc8-03.ppc.fedoraproject.org
+aarch64-c01n1.arm.fedoraproject.org
+aarch64-c02n1.arm.fedoraproject.org
+aarch64-c03n1.arm.fedoraproject.org
+aarch64-c04n1.arm.fedoraproject.org
+aarch64-c05n1.arm.fedoraproject.org
+aarch64-c06n1.arm.fedoraproject.org
+aarch64-c07n1.arm.fedoraproject.org
+aarch64-c08n1.arm.fedoraproject.org
+aarch64-c09n1.arm.fedoraproject.org
+aarch64-c10n1.arm.fedoraproject.org
 
 [buildhw]
 buildhw-01.phx2.fedoraproject.org

inventory/group_vars/buildarm

@@ -21,7 +21,7 @@ csi_relationship: |
 
 # These variables are for koji-containerbuild/osbs
 osbs_fqdn: "osbs.fedoraproject.org"
-docker_registry: "registry.fedoraproject.org"
+docker_registry: "candidate-registry.fedoraproject.org"
 source_registry: "registry.fedoraproject.org"
 koji_root: "koji.fedoraproject.org/koji"
 koji_hub: "koji.fedoraproject.org/kojihub"

inventory/group_vars/buildhw

@@ -23,7 +23,7 @@ csi_relationship: |
 
 # These variables are for koji-containerbuild/osbs
 osbs_fqdn: "osbs.fedoraproject.org"
-docker_registry: "registry.fedoraproject.org"
+docker_registry: "candidate-registry.fedoraproject.org"
 source_registry: "registry.fedoraproject.org"
 koji_root: "koji.fedoraproject.org/koji"
 koji_hub: "koji.fedoraproject.org/kojihub"

inventory/group_vars/buildvm

@@ -35,7 +35,7 @@ csi_relationship: |
 
 # These variables are for koji-containerbuild/osbs
 osbs_fqdn: "osbs.fedoraproject.org"
-docker_registry: "registry.fedoraproject.org"
+docker_registry: "candidate-registry.fedoraproject.org"
 source_registry: "registry.fedoraproject.org"
 koji_root: "koji.fedoraproject.org/koji"
 koji_hub: "koji.fedoraproject.org/kojihub"

inventory/group_vars/buildvm-aarch64

@@ -0,0 +1,40 @@
+---
+# common items for the buildvm-* koji builders
+volgroup: /dev/vg_guests
+lvm_size: 150000
+mem_size: 24576
+max_mem_size: "{{ mem_size }}"
+num_cpus: 4
+ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-24-aarch64
+ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/24/Everything/aarch64/os/
+nm: 255.255.255.0
+gw: 10.5.129.254
+dns: 10.5.126.21
+main_bridge: br1
+
+# for systems that do not match the above - specify the same parameter in
+# the host_vars/$hostname file
+host_group: kojibuilder
+fas_client_groups: sysadmin-releng
+sudoers: "{{ private }}/files/sudo/00releng-sudoers"
+
+koji_hub_nfs: "fedora_koji"
+koji_server_url: "http://koji.fedoraproject.org/kojihub"
+koji_weburl: "http://koji.fedoraproject.org/koji"
+koji_topurl: "http://kojipkgs.fedoraproject.org/"
+
+csi_security_category: High
+csi_primary_contact: Fedora Admins - admin@fedoraproject.org
+csi_purpose: Koji service employs a set of machines to build packages for the Fedora project. This playbook builds vm builders.
+csi_relationship: |
+  * VMs built on top of buildvmhost
+  * Relies on koji-hub, Packages, PkgDB, apache, fedmsg, fas, virthost, and is monitored by nagios
+  * Several services rely on the builders, including koschei, Bodhi, Tagger, SCM, Darkserver.
+  * Produces automated builds of packages for the architecture listed. Builders can be scaled by adding new
+
+# These variables are for koji-containerbuild/osbs
+osbs_fqdn: "osbs.fedoraproject.org"
+docker_registry: "candidate-registry.fedoraproject.org"
+source_registry: "registry.fedoraproject.org"
+koji_root: "koji.fedoraproject.org/koji"
+koji_hub: "koji.fedoraproject.org/kojihub"

inventory/group_vars/buildvm-ppc64

@@ -6,11 +6,12 @@ mem_size: 10240
 max_mem_size: "{{ mem_size }}"
 num_cpus: 4
 ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-24-ppc64
-ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/24/Server/ppc64/os/
+ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/24/Everything/ppc64/os/
 nm: 255.255.255.0
 gw: 10.5.129.254
 dns: 10.5.126.21
 main_bridge: br1
+virt_install_command: "{{ virt_install_command_one_nic }} --graphics none"
 
 # for systems that do not match the above - specify the same parameter in
 # the host_vars/$hostname file
@@ -18,9 +19,17 @@ host_group: kojibuilder
 fas_client_groups: sysadmin-releng,sysadmin-secondary
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 
-virt_install_command: "{{ virt_install_command_one_nic }} --graphics none"
-
 koji_hub_nfs: "fedora_ppc/data"
 koji_server_url: "http://ppc.koji.fedoraproject.org/kojihub"
 koji_weburl: "http://ppc.koji.fedoraproject.org/koji"
 koji_topurl: "http://ppcpkgs.fedoraproject.org/"
+
+csi_security_category: High
+csi_primary_contact: Fedora Admins - admin@fedoraproject.org
+csi_purpose: Koji service employs a set of machines to build packages for the Fedora project. This playbook builds vm builders.
+csi_relationship: |
+  * VMs built on top of buildvmhost
+  * Relies on koji-hub, Packages, PkgDB, apache, fedmsg, fas, virthost, and is monitored by nagios
+  * Several services rely on the builders, including koschei, Bodhi, Tagger, SCM, Darkserver.
+  * Produces automated builds of packages for the architecture listed. Builders can be scaled by adding new
+

inventory/group_vars/buildvm-ppc64le

@@ -6,11 +6,12 @@ mem_size: 10240
 max_mem_size: "{{ mem_size }}"
 num_cpus: 4
 ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-24-ppc64le
-ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/24/Server/ppc64le/os/
+ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/24/Everything/ppc64le/os/
 nm: 255.255.255.0
 gw: 10.5.129.254
 dns: 10.5.126.21
 main_bridge: br1
+virt_install_command: "{{ virt_install_command_one_nic }} --graphics none"
 
 # for systems that do not match the above - specify the same parameter in
 # the host_vars/$hostname file
@@ -18,9 +19,17 @@ host_group: kojibuilder
 fas_client_groups: sysadmin-releng,sysadmin-secondary
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 
-virt_install_command: "{{ virt_install_command_one_nic }} --graphics none"
-
 koji_hub_nfs: "fedora_ppc/data"
 koji_server_url: "http://ppc.koji.fedoraproject.org/kojihub"
 koji_weburl: "http://ppc.koji.fedoraproject.org/koji"
 koji_topurl: "http://ppcpkgs.fedoraproject.org/"
+
+csi_security_category: High
+csi_primary_contact: Fedora Admins - admin@fedoraproject.org
+csi_purpose: Koji service employs a set of machines to build packages for the Fedora project. This playbook builds vm builders.
+csi_relationship: |
+  * VMs built on top of buildvmhost
+  * Relies on koji-hub, Packages, PkgDB, apache, fedmsg, fas, virthost, and is monitored by nagios
+  * Several services rely on the builders, including koschei, Bodhi, Tagger, SCM, Darkserver.
+  * Produces automated builds of packages for the architecture listed. Builders can be scaled by adding new
+

inventory/group_vars/buildvm-s390

@@ -11,7 +11,7 @@ koji_topurl: "http://s390pkgs.fedoraproject.org/"
 
 # These variables are for koji-containerbuild/osbs
 osbs_fqdn: "osbs.fedoraproject.org"
-docker_registry: "registry.fedoraproject.org"
+docker_registry: "candidate-registry.fedoraproject.org"
 source_registry: "registry.fedoraproject.org"
 koji_root: "koji.fedoraproject.org/koji"
 koji_hub: "koji.fedoraproject.org/kojihub"

inventory/group_vars/koji

@@ -45,7 +45,7 @@ nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=4"
 virt_install_command: "{{ virt_install_command_two_nic }}"
 
 osbs_fqdn: "osbs.fedoraproject.org"
-docker_registry: "registry.fedoraproject.org"
+docker_registry: "candidate-registry.fedoraproject.org"
 source_registry: "registry.fedoraproject.org"
 koji_root: "koji.fedoraproject.org/koji"
 koji_hub: "koji.fedoraproject.org/kojihub"

inventory/group_vars/moonshot

@@ -0,0 +1,2 @@
+---
+use_default_epel: false

inventory/group_vars/osbs

@@ -9,8 +9,8 @@ tcp_ports: [ 80, 443, 8443]
 fas_client_groups: sysadmin-releng,fi-apprentice,sysadmin-noc,sysadmin-veteran
 sudoers: "{{ private }}/files/sudo/00releng-sudoers"
 
-docker_cert_dir: "/etc/docker/certs.d/registry.fedoraproject.org"
+docker_cert_dir: "/etc/docker/certs.d/candidate-registry.fedoraproject.org"
-docker_registry: "registry.fedoraproject.org"
+docker_registry: "candidate-registry.fedoraproject.org"
 source_registry: "registry.fedoraproject.org"
 
 osbs_url: "osbs.fedoraproject.org"

inventory/group_vars/pkgs

@@ -36,6 +36,9 @@ clamscan_excludes:
 - pymilter-
 - linkchecker-
 - julia-0.3.7.tar.gz
+- jbossws-cxf-5.1.5.Final.zip
+- wss4j-2.1.5-source-release.zip
+- python-impacket-0.9.14-67fc19e.tar.gz
 
 # These are consumed by a task in roles/fedmsg/base/main.yml
 fedmsg_certs:

inventory/hardware

@@ -71,3 +71,15 @@ ppc8-01.ppc.fedoraproject.org
 ppc8-02.ppc.fedoraproject.org
 ppc8-03.ppc.fedoraproject.org
 ppc8-04.ppc.fedoraproject.org
+
+[moonshot]
+aarch64-c01n1.arm.fedoraproject.org
+aarch64-c02n1.arm.fedoraproject.org
+aarch64-c03n1.arm.fedoraproject.org
+aarch64-c04n1.arm.fedoraproject.org
+aarch64-c05n1.arm.fedoraproject.org
+aarch64-c06n1.arm.fedoraproject.org
+aarch64-c07n1.arm.fedoraproject.org
+aarch64-c08n1.arm.fedoraproject.org
+aarch64-c09n1.arm.fedoraproject.org
+aarch64-c10n1.arm.fedoraproject.org

inventory/host_vars/buildvm-aarch64-01.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c01n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.151

inventory/host_vars/buildvm-aarch64-02.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c02n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.152

inventory/host_vars/buildvm-aarch64-03.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c03n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.153

inventory/host_vars/buildvm-aarch64-04.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c04n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.154

inventory/host_vars/buildvm-aarch64-05.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c05n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.155

inventory/host_vars/buildvm-aarch64-06.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c06n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.156

inventory/host_vars/buildvm-aarch64-07.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c07n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.157

inventory/host_vars/buildvm-aarch64-08.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c08n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.158

inventory/host_vars/buildvm-aarch64-09.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c09n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.159

inventory/host_vars/buildvm-aarch64-10.arm.fedoraproject.org

@@ -0,0 +1,3 @@
+---
+vmhost: aarch64-c10n1.arm.fedoraproject.org
+eth0_ip: 10.5.129.160

inventory/host_vars/buildvm-s390-01.s390.fedoraproject.org

@@ -12,7 +12,7 @@ lvm_size: 150000
 mem_size: 10240
 max_mem_size: "{{ mem_size }}"
 num_cpus: 4
-ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-23
+ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-24
-ks_repo: http://10.5.126.23/pub/fedora/linux/releases/23/Server/x86_64/os/
+ks_repo: http://10.5.126.23/pub/fedora/linux/releases/24/Everything/x86_64/os/
 
 virt_install_command: "{{ virt_install_command_one_nic }}"

inventory/host_vars/compose-ppc64-01.ppc.fedoraproject.org

@@ -1,7 +1,7 @@
 ---
 volgroup: /dev/vg_guests
-ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-23-ppc64
+ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-24-ppc64
-ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/23/Server/ppc64/os/
+ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/24/Everything/ppc64/os/
 virt_install_command: "{{ virt_install_command_one_nic }} --graphics none"
 
 vmhost: ppc8-02.ppc.fedoraproject.org

inventory/host_vars/compose-ppc64le-01.ppc.fedoraproject.org

@@ -1,7 +1,7 @@
 ---
 volgroup: /dev/vg_guests
-ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-23-ppc64le
+ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-24-ppc64le
-ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/23/Server/ppc64le/os/
+ks_repo: http://10.5.126.23/pub/fedora-secondary/releases/24/Everything/ppc64le/os/
 virt_install_command: "{{ virt_install_command_one_nic }} --graphics none"
 
 vmhost: ppc8-03.ppc.fedoraproject.org

inventory/host_vars/compose-s390-01.s390.fedoraproject.org

@@ -2,7 +2,7 @@
 vmhost: virthost-s390.qa.fedoraproject.org
 volgroup: /dev/vg_guests
 ks_url: http://10.5.126.23/repo/rhel/ks/buildvm-fedora-24
-ks_repo: http://10.5.126.23/pub/fedora/linux/releases/24/Server/x86_64/os/
+ks_repo: http://10.5.126.23/pub/fedora/linux/releases/24/Everything/x86_64/os/
 virt_install_command: "{{ virt_install_command_one_nic }}"
 
 eth0_ip: 10.5.129.16

inventory/host_vars/copr-be.cloud.fedoraproject.org

@@ -7,7 +7,7 @@ security_group: web-80-anywhere-persistent,web-443-anywhere-persistent,ssh-anywh
 zone: nova
 hostbase: copr-be-
 public_ip: 209.132.184.48
-root_auth_users:  msuchy asamalik clime
+root_auth_users:  msuchy asamalik clime frostyx
 description: copr dispatcher and repo server
 volumes: [ {volume_id: '63c3a40c-e228-417a-97a2-e2c34730bf3b', device: '/dev/vdc'} ]
 inventory_tenant: persistent

inventory/host_vars/copr-dist-git.fedorainfracloud.org

@@ -6,7 +6,7 @@ security_group: web-80-anywhere-persistent,ssh-anywhere-persistent,default
 zone: nova
 hostbase: copr-dist-git-
 public_ip: 209.132.184.163
-root_auth_users:  msuchy asamalik clime
+root_auth_users:  msuchy asamalik clime frostyx
 description: dist-git for copr service - prod instance
 tcp_ports: [22, 80]
 # volumes:  copr-dist-git, copr-dist-git-log

inventory/host_vars/copr-fe.cloud.fedoraproject.org

@@ -9,7 +9,7 @@ security_group: web-80-anywhere-persistent,web-443-anywhere-persistent,ssh-anywh
 zone: nova
 hostbase: copr-fe-
 public_ip: 209.132.184.54
-root_auth_users:  msuchy asamalik clime
+root_auth_users:  msuchy asamalik clime frostyx
 description: copr frontend server - prod instance
 tcp_ports: [22, 80, 443]
 volumes: [ {volume_id: '8f790db7-8294-4d2b-8bae-7af5961ce0f8', device: '/dev/vdc'} ]

inventory/host_vars/copr-keygen.cloud.fedoraproject.org

@@ -5,7 +5,7 @@ keypair: fedora-admin-20130801
 zone: nova
 hostbase: copr-keygen-
 public_ip: 209.132.184.49
-root_auth_users: msuchy clime
+root_auth_users: msuchy clime frostyx
 description: copr key gen instance
 volumes: [ {volume_id: '761175dc-daaf-48c0-be09-5799990f97a7', device: '/dev/vdc'} ]
 # security_group: default

inventory/host_vars/koschei-backend01.phx2.fedoraproject.org

@@ -3,8 +3,8 @@ nm: 255.255.255.0
 gw: 10.5.125.254
 dns: 10.5.126.21
 
-ks_url: http://10.5.126.23/repo/rhel/ks/kvm-fedora-23
+ks_url: http://10.5.126.23/repo/rhel/ks/kvm-fedora-24
-ks_repo: http://10.5.126.23/pub/fedora/linux/releases/23/Server/x86_64/os/
+ks_repo: http://10.5.126.23/pub/fedora/linux/releases/24/Server/x86_64/os/
 
 volgroup: /dev/xenGuests
 eth0_ip: 10.5.125.49

playbooks/groups/buildvm.yml

@@ -6,7 +6,7 @@
 - include: "/srv/web/infra/ansible/playbooks/include/virt-create.yml myhosts=buildvm:buildvm-stg:buildvm-ppc64:buildvm-ppc64le:buildppcle:buildppc:buildvm-s390"
 
 - name: make koji builder(s)
-  hosts: buildvm:buildvm-stg:buildvm-ppc64:buildvm-ppc64le:buildppcle:buildppc:buildvm-s390
+  hosts: buildvm:buildvm-stg:buildvm-aarch64:buildvm-ppc64:buildvm-ppc64le:buildppcle:buildppc:buildvm-s390
   user: root
   gather_facts: True
 

playbooks/groups/docker-registry.yml

@@ -89,3 +89,10 @@
       when: env == "production",
       delegate_to: compose-x86-01.phx2.fedoraproject.org
     }
+    - {
+      role: push-docker,
+        docker_cert_name: "containerbuild",
+        docker_cert_dir: "/etc/docker/certs.d/candidate-registry.fedoraproject.org",
+      when: env == "production",
+      delegate_to: compose-x86-01.phx2.fedoraproject.org
+    }

playbooks/groups/osbs-master.yml

@@ -80,7 +80,7 @@
     - {
       role: push-docker,
         docker_cert_name: "containerbuild",
-        docker_cert_dir: "/etc/docker/certs.d/registry.fedoraproject.org",
+        docker_cert_dir: "/etc/docker/certs.d/candidate-registry.fedoraproject.org",
       when: env == "production"
     }
 

playbooks/include/proxies-fedora-web.yml

@@ -45,7 +45,6 @@
     website: registry.fedoraproject.org
   - role: fedora-web/candidate-registry
     website: candidate-registry.fedoraproject.org
-    when: env == "staging"
   - role: fedora-web/codecs
     website: codecs.fedoraproject.org
   - role: fedora-web/alt

playbooks/include/proxies-reverseproxy.yml

@@ -505,7 +505,6 @@
     website: candidate-registry.fedoraproject.org
     destname: candidate-registry
     proxyurl: http://localhost:10048
-    when: env == "staging"
 
   - role: httpd/reverseproxy
     website: retrace.fedoraproject.org

playbooks/include/proxies-websites.yml

@@ -503,7 +503,6 @@
     server_aliases: [candidate-registry.stg.fedoraproject.org]
     sslonly: true
     cert_name: "{{wildcard_cert_name}}"
-    when: env == "staging"
 
   - role: httpd/website
     name: retrace.fedoraproject.org

roles/autocloud/backend/files/fedora.txt

@@ -1,5 +1,4 @@
 sudo sh -c 'echo -e "\n10.5.126.23 infrastructure.fedoraproject.org\n10.5.125.44	pkgs.fedoraproject.org	pkgs\n10.5.126.51	download.fedora.redhat.com\n10.5.125.63	koji.fedoraproject.org\n10.5.126.51 mirrors.fedoraproject.org\n10.5.125.36	kojipkgs.fedoraproject.org" >> /etc/hosts'
-cat /etc/hosts
 curl -O http://infrastructure.fedoraproject.org/infra/autocloud/tunirtests.tar.gz
 tar -xzvf tunirtests.tar.gz
 ## sudo python3 -m unittest tunirtests.nongatingtests.TunirNonGatingtests -v
@@ -7,16 +6,21 @@ tar -xzvf tunirtests.tar.gz
 ## sudo python3 -m unittest tunirtests.nongatingtests.TunirNonGatingtestsCpio -v
 ## sudo python3 -m unittest tunirtests.nongatingtests.TunirNonGatingtestDiffutills -v
 ## sudo python3 -m unittest tunirtests.nongatingtests.TunirNonGatingtestaudit -v
+## sudo python3 -m unittest tunirtests.selinux.TestSELinux -v
+## sudo python3 -m unittest tunirtests.sshkeygentest.sshkeygenTest -v
+## sudo python3 -m unittest tunirtests.testumountroot.TestUmountRoot -v
 sudo python3 -m unittest tunirtests.cloudtests.TestBase -v
 sudo python3 -m unittest tunirtests.cloudtests.TestCloudtmp -v
 sudo python3 -m unittest tunirtests.cloudtests.Testtmpmount -v
 sudo python3 -m unittest tunirtests.cloudtests.Testnetname -v
+python3 -m unittest tunirtests.cloudtests.TestJournalWritten -v
 sudo systemctl stop crond.service
 @@ sudo systemctl disable crond.service
 @@ sudo reboot
 SLEEP 30
+## sudo python3 -m unittest tunirtests.testreboot.TestReboot -v
 sudo python3 -m unittest tunirtests.cloudservice.TestServiceManipulation -v
-sudo python3 -m unittest tunirtests.cloudtests.TestJournalWritten -v
+python3 -m unittest tunirtests.cloudtests.TestJournalWrittenAfterReboot -v
 @@ sudo reboot
 SLEEP 30
 sudo python3 -m unittest tunirtests.cloudservice.TestServiceAfter -v

roles/autocloud/backend/tasks/main.yml

@@ -110,6 +110,7 @@
   tags:
   - autocloud
   - autocloud/backend
+  - autocloud/backend/tests
 
 - name: Set up a cronjob to run kill_vagrant every so often..
   copy: src=kill_vagrant.cron dest=/etc/cron.d/kill_vagrant.cron

roles/batcave/files/ssh_known_hosts

@@ -8,6 +8,10 @@ aarch64-07a.arm.fedoraproject.org,aarch64-07a,10.5.78.160 ssh-rsa AAAAB3NzaC1yc2
 aarch64-08a.arm.fedoraproject.org,aarch64-08a,10.5.78.165 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYTTw6hQJjFCxLwgPMlj5NvEi0or0vqS5XETCHxhcztI4UyLXPz8FcqjvOCQI7rEoS5B0p2iLgo6T1D2kEWZLRbUdxJmD1apvkiG+oHQqPU/H2tayfu6625DA097Gi4vyg1nkolp3Ck9/Q3HjuErEkn5KQ/nkyCJc++MXqe5JZp/cNJpHKp0Gu2UsA/0XFignNqDcNXra+MGohyjoeDR1D7pDYEog6vCpRx4Zp18pf5ItmaY/L9XRLcsJnx2oFrjTivTY2SuKLPnoq8N7mCBA7vs4MeFHSJ40teLUr733BvZ3HHh1Y/bAFWHaPe1dYkBG0hNLw7nN/MmggpBLEq05P aarch64-08a.arm.fedoraproject.org
 aarch64-09a.arm.fedoraproject.org,aarch64-09a,10.5.78.170 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA8ouAYaVajcoVgbi5VVO+a5tdm5kGD3l3Y6Mz8WSq104xU7rcX8P7O0LaJpDzZzRENR2UkmjBZcy02P2LDVn4i77x4famkgpR9bnWYBskKhMsmZureLwTSsSIk143U66qEa0RDbffzuuq+zvraZRwXKUwiA10UifYChsvSYZvlL9kMaF3Ge16UPAP13BdoelgJedgt15oKZporSL0gGiWg+yejaWvUkrXfzMLh6zQjuqxtPbf0PgZF1vn0A5H9RQU0Q3B3TeBQWFkpzr107wGioleZhNnn9AiqCmgR7mFgG5eEfXfLYQD6B7rsUWeiYR9FeROLGqVWfA36+mUEupB aarch64-09a.arm.fedoraproject.org
 aarch64-10a.arm.fedoraproject.org,aarch64-10a,10.5.78.175 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdHgx7lpjKo5dmqpWSmGhqRvqZPCtYxPha8jzhXAnPjN/dvgfZPr6W8elpGXsy82fkTpcw23s1bSh65kypyGy3ADs9JejNdn6AhUhaCh5xA8iARDiyJAmehL0e1M7Cn5C/QOiNeS7oTr1RvuMhmsJnK9o3Cb8s5ChSU4yqnLru4wXudfMDgjeEcBwLdg5Fg6UZiElZ9s/wbfXNwoxPBlsRvAnVl9Ut92r3tLwoMMMNxiTpi7IPaYqJKnEV1DVcmKztSPH/W010Zi91PtreyTq3Qj8nUDXzvc1pmdA8NEfr+PKPA6Dkb/moa2YNIrUW1M8iTqZnX3JgRBAKi+gzLnxD aarch64-10a.arm.fedoraproject.org
+aarch64-c01n1.arm.fedoraproject.org,aarch64-c01n1,10.5.129.101 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCc9+CJwzxlJ5+IPr9lMTS3RSaJrH8JPAFst1Vv/ZJwCuPoMXJ5qxIM6CYk6qUIcWwbLx4qsVQSCBVO5Nug0yoomPdnz4ljGzb2mIE5CMMQ3W0uuEx2LyBDmz64nS5JmSMP1vfOFeAdh1LXBtLb5TFLNy7DcjjLZcAf+pixjeG2MV4AviIJlPoQNg9deajbj8PyqS+KromAWabDEVAX3Ij7T2ivho2XEJZbTsZKkLpLbnAaReXDWD1mDQJSKiKdpm+/AbGL7rdDDfA3H4KasyivSu02ZdGue3e7Fy3A9V94+K2o+T+5utqK4TYnAcLoVct/BU0RxnZ5e9qw/VP74sjn aarch64-c01n1.arm.fedoraproject.org
+aarch64-c02n1.arm.fedoraproject.org,aarch64-c02n1,10.5.129.102 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQ+d5p1ms2/PGKelTA+W3AfOXBH7Pag+2oS3V9upeHvLiLu4cwiko9CEPCPff5dGenIxZFAnZHZBVZtdnziTqc59povF+sa0hRWx0sCaZl9CtHIU+7dAHGdrDkfbAPyDEECIvL8P8c8vipgioDDc2vEv8R43yvNC8kE0cxqrbj1eDHORvq2zzjSN9sVNmJFkqcxUjYqjDcZAlAKYi8oqtngseykOJ8kahSzeuIgACthF3271bgPLq5k7sz1Su4fpvrWFIalV0JqXbE9rFFtdtL4n392XWkPgOc30mYKFmqiE7r3VV+26oTn8rE7Y01rnErBMLA6GX4wRwn1KC3WcE7 aarch64-c02n1.arm.fedoraproject.org
+aarch64-c03n1.arm.fedoraproject.org,aarch64-c03n1,10.5.129.103 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCayJ/t5AkFV17hRoKDLZk1yFD9k1tZasDMwWzIklVBrb1Hu3WsPbXVuWd48XLipVX3W5t0JozP9zY0Uqj3aTF0pANrehkW3tanNeAAShxvb9i8f7VyHrYQFFOD4LGt1rR0vD/edLL+SK9uLXgf/0aIgY5cQmO+eOk2gjbjP7b3qAtG9wod12fmUA/C47opyxq34JeTws88DisARVhs9RYGee41B9pE3xIkZ9YhEbzXYJC1ppJ9hyaBlwurO+Y42o2oBVAK76QKvqo4Kcg//pQ5p2zrB/9THWEhpwS5b+dVJrd4XIqBb3hMkqZFGx++ybD6lkroxhwVTGFNI2++X9+D aarch64-c03n1.arm.fedoraproject.org
+aarch64-c04n1.arm.fedoraproject.org,aarch64-c04n1,10.5.129.104 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCkEZ5A6qJtaciiVemtgc63YcN5PWupBjSEZkGywfHE0TPBykqrdBOUSr9jZrZKdn1w6rC4fStXbKTVr139+P8qhPuPamFAURq9U4JEha2y2ZEDvKl6m6+FSa4NZQnGd8WlLCzywAseY0xGPi5wmH16uVt9uyO6kdq/GgctNlOn4qGh2ex6PHplXCVI8zvJcGiEtCFa2ooFGyYou8eUt/ODsn47wW7vMHTH775I+i1DJXELB1pk+yaIujehxu0Jm1RL7WsRZaqeqEmRwJdmWDhTAI236nZ7oUM9rgrA98o5mPywRJ7tWwHy4gi0QiTU4cukhxAMrFCeOpWrXNIVhBqr aarch64-c04n1.arm.fedoraproject.org
 anitya-backend01.fedoraproject.org,anitya-backend01,140.211.169.230,192.168.100.6 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCTqxpo78GMRKV/0RKitRajvGHfZ4hord0xwZHH5hwexVugTWRC1T14oEeyD2vBcO3VY5RaQAg/RWHwHoaAR7WFmS9FQlR0h+wW9NlBuvgI3l8+Gb+FPHGX1XH8ppvAC+3gbPpwBTojErqPVFVIKWX60EP38Aywjm4i5VF+hgGXXG04UTo2cOd9F1NxW+vov8PDVwVwU9DIiLLdlUKb1ckfsMfdnD/Nrr+2He2g+/Qm6VDerl7D8GJsUxST7VizbA8mEBqKHRgksTXK3GyaDYAD0WJHcNpd9/CMyo2iRjSGjPoTyfRDbD3CDVTKumjztC5O+gRxbMEd/KYnVyISjE9d anitya-backend01.fedoraproject.org
 anitya-frontend01.fedoraproject.org,anitya-frontend01,140.211.169.229,192.168.100.5 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCn+G4xh9W4xyv0i05Ob39mr8e4gnIc6Dd+o2hS5pWy3yif+Yyih+DcTNUNRzWWwKExLNMj9psPqa/eCA/xm8b1BRPotYvfHi033nnrBGz4Cdk3fPDOBf0lZcZRsnb6VLg9OteRz4/NcWUzyZ8ROEdT2FhBsKEC6kgt+muZTVldGTIOsIC1jkWv2SrErJws0Sjq8mUue80CLZBr7gsy10URiDbsMXtHCQPeB2UM0bvNLqvSTzq4KIlsOzlGLj/PAmQl/qNQ+z/Zb95X+qkbYoF7u9bmpRERvFvBeZJYR4vsOs3jHWuWkwOA5xgrS9eaLkH7FUJxSk760u7gzBv9KEQh anitya-frontend01.fedoraproject.org
 arm-koji01.qa.fedoraproject.org,arm.koji.fedoraproject.org,arm-koji01,10.5.124.138 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzsfx1T0sWiKS679BX6DiVoFRexrh51/fCdoeHVj8sPm7kNlx/Dzm9qkQhuFwa/61Kv08qKgm8PMftMlEmIfVmCH/yOji9aYxkca6Fk4S7STqBqSD33oMe3IEcRq2nHRNbqAXz0WGmyfn53+H7CF4MTf7damWNTL/QrNKjCxDuup/va98sauNfi+6277JP+USJC82CSh3MgKrTr7BzLVZermk/uQsv7MXnt3ImuD7jcnLqWO3BQuID4aU0JDUyq9oCkmAOnfpVl94UbIT3P3+yj5RkEMdR2TVYJdKUWzKaDFlmsrGdG8ZgHv2Xwkprn2rvq0bf8eTFXpnqrltzQSSZ arm-koji01.qa.fedoraproject.org
@@ -40,6 +44,7 @@ arm02-builder01.arm.fedoraproject.org,arm02-builder01,10.5.78.41 ssh-rsa AAAAB3N
 arm02-builder02.arm.fedoraproject.org,arm02-builder02,10.5.78.42 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9ErLMKF0F+jv0ljTUZ8/RWhCXVU67dSSpzfp1xv+R1DZ2QwFrcu8e6UF3mXpFw7sI9TpHYmGI/eq1gJigodWXPhi0/FBCDrIBVySsl3DpeYTbvwxU3suMMXlRFMB1j+d0nA/3gK8ptjW5Zlk27MQTln03K59TmUJsnSZmxJJ/rn50ecu6o8c0FfB90Un0NaM94IEKgWLhCZrB5g9jsoqnxMf/M9TDqzlMmIddqXXedILbK+GE6UkLeQUkOwuQdwOX08b0iBc+62xu+pQ3D+vC8tQQRfM7jxbwCbYc3jOGhdAlIomDcTNHm6xl5Uy40bOf9JUSIaKYtEQvm/0P4Qn/ arm02-builder02.arm.fedoraproject.org
 arm02-builder03.arm.fedoraproject.org,arm02-builder03,10.5.78.43 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCYjMyCXd3yBpAV+dbAonlfR19o+x75/iMckXFZRR+1PKVvAUVDN0l/eHOiJ+YyK7AIyrXePhyh/YLVpZlu0GKpXAUGHWcUm8EyT9T0zraaZOP5qfc4hUVDH3zfJ3CBn26lcG5cfHSVMby7e6vh4P0717slSg2BKa6NHkZugfJndOo9jHTx5KdsIgVKYygnXwjXvhtxKnyRgf3UYAPudrEankGerbnuz3VHS+QRvq4q04BKt3e+7Vb7PDqr9aHO1btVWuX+VXnOAjEcaNXQu471o1hiwgCtc9HZ2o8MfyjeeCfO1IFMZ30EoVR+mNTf2TbTa3A+PNyDScP+xljo8V83 arm02-builder03.arm.fedoraproject.org
 arm02-builder04.arm.fedoraproject.org,arm02-builder04,10.5.78.44 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDD1z2tgd0VrUhHIV7aIGn1dyy+h/g2DC+F1rO5DNRz1LLPrdeb1mHkC8JfUIo6ZZtpA8E5JhNDLLbn1d+208IV/xEaKSWsC3Y8vFuLdW5CFZ8rqJoUQl6m96S7FEg4a02sIAhRaGgZCOQxACavNNpRfIVLetzkqQuZjN4DkK7x9vm2MQWPTWSmnG5oYlc8359LrWXeywNVkBCOfKJI0Ubkj9dsMXIbWkuI6zbuoiycylvONocxo7Iec99/RhnOE20b2PPng9bkERi1+X2tWkaTpvYFS3AA1YPnkY5TLpqTYxzAnntbTSb8xFH77wZqmoUGaU5pcJj3KMH5DNsam/iV arm02-builder04.arm.fedoraproject.org
+arm02-builder05.arm.fedoraproject.org,arm02-builder05,10.5.78.45 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCw4bomsajwG877MSPtiA7PdC1IjwWtivzob082qffE1y4S5bbZHavRRHH/d9zLKEMdT1UUTpIoU8CCzE0DrswOfb/DUEIloMsCAC0cjXsdQm9w6r3C1ik1CavMEUdrNz0Qw3k1hnFlkSq60QVPPx2EutVIuX+cvzY1IrlTAxtJIrxIa56vKM7tBnsVD1QZCMELKkSuyMWG2/TXb4ga7v6AAAMAu41N/NgLTkqlgxR1kIoCYEVbREj5iNixX6HFE87IgwDDL558psZDcvJLPC8Sf7xjqev78vjl7DOdDGQf9ILqkwvZYLN8bug/p/isDir0G9LqomCAHVdcbk51s3ZZ arm02-builder05.arm.fedoraproject.org
 arm02-builder06.arm.fedoraproject.org,arm02-builder06,10.5.78.46 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeLaeFdrGUo0RmReYynTQErFoWBtrzOZ5EUi/n1LKI513OdxVtVewIgvxleqilF4l3DtPMoZfE/EL8z8wTxvS9tofiDIAaG7A3xrx3jPUg3U+8WhD4geq4WNRhTssYHk7o54jGqS1tARRlSTXUw7HSNp26fWh4h1/IBhQ8/LYQkN6CzHwVRRA0qZ2GhYPtNUu6H3T+89GLHjpekvHmapdwPbfUvfYJVNtCkZISvKC0yP2qh2HSIkx79+DesA7tG3SoSOldLjvqNqtk926lxbAbpi787gFgmuHRo2Bvak3Ne0eYzyDvaH2KdFQHJKtWnS/yPb9ON3a1lBkKmCVhWy1n arm02-builder06.arm.fedoraproject.org
 arm02-builder08.arm.fedoraproject.org,arm02-builder08,10.5.78.48 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4GCfgNkQr99ALfHPJ2+q3UIsv0rtO4gSX0CeqLZqTXi5ycVKSuPcdS70KIEuOuFOr0sdSw+JOkMQTJBHllfxujX+1TRc7a3yx9JUyrpfRxmW3HJ7NcwnaLIwffMvQuiz9R8jx09R4IjFa77gdXf7h7Oc1OHYS58tpfBEZqMxA676Nny66Jvyg/9uHXQ4rGiWmNMTOMObKTsivN7NRWObVNMh3gvMYtM+uLS2+j6H3Y+rmRABjc1qpKQHEXItBdje2X2Hp4k2Y19GH0PCLLpKQ0zyKoWNMnG+jIR7Ai8hfWhGgVeSpL4NRchmcVUhs19KJVDJCIlhy/QI7ovvJwS8z arm02-builder08.arm.fedoraproject.org
 arm02-builder09.arm.fedoraproject.org,arm02-builder09,10.5.78.49 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8ZiSuHB1+9DXZHclxTGYid32IURuq+BW2bq8ES5ixzx0xoZ/Tjf/5AUWnszFAB+LC4cT8y4wS67o7YRSRlE8NXLke3MbW4+qagXhV+HqUr193zbElQSKmI1cRmCDqos4EvZjv+pT0fhjA5xNkzPmJwKGnGvd6OAfJA/0KbBKl3mkpQY/nIW5n9B5eIY9l185A7piVqvEIJhI7Sdgj/4ldc7YRfjZboEH+PPvJHOVHWaI74wJ3eu/sbjx4TmXK0qmQGtBheOVuW7D7K+6iqJoeMalPu3IGXUEA7UKGKaT164v7OxO6Am47LHrgklSsI99Nq2UqKK/BPnwLd9BRC4Ix arm02-builder09.arm.fedoraproject.org
@@ -251,6 +256,8 @@ db03.stg.phx2.fedoraproject.org,db05,db03.stg,10.5.126.113 ssh-rsa AAAAB3NzaC1yc
 dedicatedsolutions01.fedoraproject.org,dedicatedsolutions01,67.219.144.66,2604:1580:fe00:0:dad3:85ff:feb8:d900,192.168.1.139 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRSrVyqS8yOjKXIMLzM1XtWdgLdNmNhVhmAPnxkQflFGqMjX41D17O0XdvrDn8Ot6aH86YBHmUmTWjstnNQzCMgiKNfvmzj1J0F0ce/+9lqm9XUEgUgYWGYVgjzb4v0TSoCK9M+GaHvhalIHOqMRQrMHUFgzZ3kcddCn7AtwpO+vz+L30l/Zvtl59CXu78JMmoK818bWMIKhr49xj3j6JKPXPwQpcRkUpDj65N30z363Xw+2kcfsMpRDPPJGCWPen50Dq7JCdbuGj44XNwQTTObv7bE7jr50k2xu49w9V0T8wCjAHzBB6KwR6YLnXU5M1pBrfwpidqUkvQy09ooHKt dedicatedsolutions01.fedoraproject.org
 developer.fedorainfracloud.org,developer,172.25.32.56 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSY2lm57B32qfEi6eq+DEsY27CcRj/Da+sbnlAO9zSGDUfrkLrvnpIHDIUU0tnmdDnErDC3jQllzBc4QVQFWVaEykMfnvbGooUc1Jlf4KjjF30L89AC3L84uRdghSVoW8CBQML4QJ2uYDP1Sp7hEaAuanNqnZdn6Nrt6Bi30zhl5NnL9ZLYfgWK+FrPE1ufYNO5PO5rHSOMLrU2oFADz5wekSWTCB0vLsjIbjaBxY/Y/Bj8AGU03ojFINmO9w7HtGFMWkfyzbA+4e7tkYjkjRNyUO5qzHVHwFHrtDf+p/1zlmauKVUIe4insDdJnoOEHP4vGLDXi5gfw+RHC6kHAND developer.fedorainfracloud.org
 dhcp01.phx2.fedoraproject.org,dhcp01,10.5.125.43 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFHs0iXw0sYRpBLbDnl4uQtFARF32BlmqvL7Un0zagEz3ArdL89ilY/CH+M+xthLIdhtxbSmV/uzrV2Tbr+Tomm1MpzFHlsYnwHcCnop5QW00Ksps1bTcQB4sw/gGpHabLtOMr7qjdROYnIZPiM3JhK+VevqaPazpk3YjA7J0FJn9ZC/FoLgkwInsYOzOzhS0WUcdJtsqc0RYh584gbCrucAw3fHyO9zVA9+yRv8K5m5hKJdnGHuo1V3fW79fYTRJjsSwXJ1uKkNY/QO+dmAiDFClIifyefNc9e8EHgl/phSRwtuZOZ8LvgzATp72qGveBogateTpVeejzbqxYzsIp dhcp01.phx2.fedoraproject.org
+docker-candidate-registry01.phx2.fedoraproject.org,docker-candidate-registry01,10.5.125.57,192.168.1.93 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2NQXkdQGajeEDf8SHkJwqEeI1pSXMOsuJEzIk+s3kRHKrVdg0VK97o+mNSFoTVh4dx5ydyJI3HrUqDNxtZzmycTeaagPiFM8w3yrY0onqXu6PAMDBkE/k0tfipt/iMNPJxwr7IwwcCbbUw8UVlKDwNbn7QUU7Ar/0nR7W0ituwWi9eNx1/Pipwa9YeFu6BJdTA8Y12kOptaFNhkpWt1g4DIE/Z6HN1iIcpuQ6SH4fb9ESj9aM6/CWpOgp6uQqMCmHmoRT2Uiqcf3bq8EGiAtF45rJ4Z+RL86Zi7MN7Mblct/f8c1dl7rqxVx5BBed4pLn9twXYPckWIUUE1a3FmOV docker-candidate-registry01.phx2.fedoraproject.org
+docker-candidate-registry01.stg.phx2.fedoraproject.org,docker-candidate-registry01.stg.phx2.fedoraproject.org.126.5.10.in-addr.arpa,docker-candidate-registry01.stg,10.5.126.218 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBRdviM6tBOuOY1oSPmOu2c/TgBI+qvFxGIfSU6qy6BW84o7JGXsD7acOj2CfsWUQDOzUGpBvIxUJGoTI0pNrQpVTKnlGkdgfYRlDUE+E1tWl1CbbHwJBerSLW3kbVgc68bWYhFl4IA0JODfeUotXUAkrvXRRWdPyMz+zH4HJ3cjfaqGjy/TWWahnt8v4auIZaK+rKKr44cpiQd+Mp53ttuwYX97Vgin6iibx3jg2CWUxTISBWVsF1Po8goUKhrkhxXDqoQTuWrO3XGx8khcf7dq18e4ej/sQlLC0co+t3Elsh3Fo1SRDklB3/Opy3ofkXvFmQAFr3GQwuklj4b97h docker-candidate-registry01.stg.phx2.fedoraproject.org
 docker-registry01.phx2.fedoraproject.org,docker-registry01,10.5.125.56,192.168.1.48 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6bXm+1v+NeEd2yKuoLeKoFYiL+gpdDlUuncikc8kRCG2DoS1n3mb2RhBOkPRDGQ7B0b7GS69yvSOXG6krTn7OrGBES2tjGf0ish67WWftFhZXW3HOLajRoJOq4BZRn11ycFZ8H5PsTMCA4OAg+R8yluDUEmg+ZpIHnyx7NzbpuNOEaXpbCAHxxOIMVw7p0k6cVlkwXkJW1ELsW3nffW5n6ALanfW0JkkvyYSTT2jGZ9GBE2T78ExnLOluZj/Vnw5o4ntuXOuq5OCpskvS1FciMdSnw6CycXSAzRhh3QjVmdhoIqwQuVumqM+nUZwzyUpKpIJ/ny2arsXljA33AbLX docker-registry01.phx2.fedoraproject.org
 docker-registry01.stg.phx2.fedoraproject.org,docker-registry01.stg,10.5.126.217 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFqdMWUsUaouiAYWD23EJrk98rx53SXbnr31i/Yj5Tt1r8dGs4RDS62tAzDXIV6WnLWS0oooeRZQa62DmaL0pA4h7TvA+BZI3MYPu48li05Sl6jrFeyOZMD7MI/tq9wbL0O5KH9YTKKL/4ApFmVi7CepiezO9kwETMKgXIWWu5sFKJTcGs2t+dx3TvqVcMnkQXapREowXXBSoWhkxhdfBfWpo5rbFNsAvkV5qUcZ6KJrGPVA8KVSXGYC6vWdsMkqTx3o2hC22kqy3kBzPtF4St857gCuqztTj0nxi8fE6xrCT1ALu2X7oHBmTz0XjcyyjcafWsbeGPKHQqAXFruifp docker-registry01.stg.phx2.fedoraproject.org
 docs-dev-builder01.fedorainfracloud.org,docs-dev-builder01,172.25.32.65 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJN8Y/dG/VXhT6Bcilcog0+YKO8szl167x8/GvgJxPE8D8NIy8L0U78ltYnIyzWwqKZuWQ6VG4WgV8P2+gInFa+dpI/Z8W5yAQ96dWWKL+/RD/nTiURYtKc5VTyJuWWS9iKJ3jLsxnCJp5c/wee82GhD7i3wMEnmv00Q+U/qS5EPm/7nQMaJktze5SLI8Oaea3t99n4669kU9sJCS1RDjIVE9IOCeIkMjVxIpv5ncmvQR8lj+G1ij3at31jCy3hNUhkx9ZwGul6gT5ca7sz0DmfLg6FSKqLcuI/hJuw9GIo886ulZjfHBEXHid3y9l/1q6g1TuZbndC0Wt8AWvAqBN docs-dev-builder01.fedorainfracloud.org
@@ -311,7 +318,7 @@ hotness01.phx2.fedoraproject.org,hotness01,10.5.126.5 ssh-rsa AAAAB3NzaC1yc2EAAA
 hotness01.stg.phx2.fedoraproject.org,hotness01.stg,10.5.126.4 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDyDlkZ+CTx1aKX18Wcyflaa+0KjRITUSUeLpCi/I6BoV9xe/QEaVItIr0NzwfvDP0bkfu3l/07eMob75y0Szlaq3azNSRbhyxfvJ+ihxHX4SDsCR1ccO8wY2AW2Jdjskeo5P8DFzmzl1E4677VAN4x3WPf316TPhm/Ej25DjRvxTVxXpUnopBlMJPpYjWFLES0O+Y+6seD5jmZ2xYKDBC8HsMcXpmCSYvW0+7OzL5veZK6jqXOB6UxohHmVfhDxGvvrfkoZewmWJb93r55sglJFeiDPlk6MANJOdPmWBIifvXWsYGD4T1n+c6ACLp7b6POMBLnWYi2tAI7JphCURQ5 hotness01.stg.phx2.fedoraproject.org
 ibiblio02.fedoraproject.org,ibiblio02,152.19.134.169,2610:28:3090:3001:e61f:13ff:feba:d340,192.168.1.65 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcM2FX2yrDh5VGRs4Bs0YUAugncHxCqI54l3FeT3N+UCnF7utY9PwgtK5bgiwcssTFSmql1bszY7rxJ9xkDZ8nZd0IKc+cuY3Mq8jn+tznYyICIL97yb+22+T3pQoA14Q/RMgCu1W0rBva5ukvCsT6+OcTDTywnQKNaoRLhNHGILHuBzNj5earyHBXxcZ22SEMMmTuB0RxI2gHq3JGdNh/swzCM94PCDy8T4WNcrf215wQi+ep9pQF0crLby4hOoWgRz42jY3Cvcyc/0B1sRV3TqpVNrtMztiRNH5lz7G6es8AHbauTCMdyb6GPhcjglEMTzP59sp0+jwA3AVdQE2J ibiblio02.fedoraproject.org
 ibiblio03.fedoraproject.org,ibiblio03,152.19.134.172,2610:28:3090:3001:dead:beef:cafe:fe03,192.168.1.66 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHB6m0iWfNxgwotZjwyRwzRNIH2bRPMKBYIpAoAvLRc2z8/PEI0V3G96lQ+lv7LRl6C1qcZ0Q/kRsnB+fGCGQQvzJMI6Tmw92CyG1zvxhaLs03j2fUXeErrwhIF6qWrr5NvXztvEo7b/KNjVzCWAUADoJ7eUJpWfuitILOfD9wfzmt+9Jw1ccPt+AcTMcAGCX+tklCeoNxwEubhvkPSYzUoLIyV6JcNj/Z28rMkEaM25hWUq6J6HE371l2G0u1oFXKROoVCmg4n39XeUdpEaICEdDAuY/6asbcIzQqG3qD+rbga11KVXgqYZeBvvmrRFLEamiifZ7xKx/KguPaU1wD ibiblio03.fedoraproject.org
-ibiblio04.fedoraproject.org,ibiblio04,152.19.134.136,2610:28:3090:3001:f21f:afff:fedf:fcf5,192.168.1.131 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDD93It2rG2Nfv8o2l+sD3zJiyfiCVmOvwAs7uf/m5lJD2LDkG6dluzAE4cZR5sWHIYBbw1o2rh5a7qGEjOM2KIsZJYMGwnomOJvKwZEyj/fVYjzsfONztZbKMPvft3dy54JY7HGqMI56m8EEl558eWzd5ZpEq6jhOUOTZhZFf6HGuQEQzSiU9XgCIBAgf/NvI8b7kjX5oSqz/DXvWphC1xcUivpfNKdBtf/fYQu2b4nloDzePAo85jnvJ+5Kspu8HPszCaZ8UXHOLez8R4NJMFKjbEG9EKDUnIadjK//xnIQprKvorrjiUgQYjMRdHkHZpO5yPe6kb90hJzu08hllN ibiblio04.fedoraproject.org
+ibiblio04.fedoraproject.org,ibiblio04,152.19.134.136,192.168.1.131 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDD93It2rG2Nfv8o2l+sD3zJiyfiCVmOvwAs7uf/m5lJD2LDkG6dluzAE4cZR5sWHIYBbw1o2rh5a7qGEjOM2KIsZJYMGwnomOJvKwZEyj/fVYjzsfONztZbKMPvft3dy54JY7HGqMI56m8EEl558eWzd5ZpEq6jhOUOTZhZFf6HGuQEQzSiU9XgCIBAgf/NvI8b7kjX5oSqz/DXvWphC1xcUivpfNKdBtf/fYQu2b4nloDzePAo85jnvJ+5Kspu8HPszCaZ8UXHOLez8R4NJMFKjbEG9EKDUnIadjK//xnIQprKvorrjiUgQYjMRdHkHZpO5yPe6kb90hJzu08hllN ibiblio04.fedoraproject.org
 ibiblio05.fedoraproject.org,ibiblio05,152.19.134.137,2610:28:3090:3001:dead:beef:cafe:fe05,192.168.1.147 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA4LoZEEKifKVJj4f/nNyS9vUpzO2RK0ByfGKJOpj9pOq3pUV96BQR6Mb1U4lV8+H+6yCGBjcXoxPBQyb9wMHJ+7OqEnf5ikQrctf80DGX37lYqbJ52NqwhOdvSpfAbXs7BSrpct2v7VNdzoX1H7w1J2/NjE2yUE5Y3KC1IQV2oU/I09VR2H1N2VikIqg01NOWHSZ7LMhU9zIyMwGyxc0hUWE/menlbg7X8DPuO7wT0c1YoUvRIMDv12L9LQQl9twSEuEy+XLVPG22mvURCLcKOG4zjfkyv9DgGF1tLgFMXPvEfA+8Yf0sGWvbGyKZHl63fox6oAvd4Sr7hpbaenhz ibiblio05.fedoraproject.org
 iddev.fedorainfracloud.org,instance-120.cloud.fedoraproject.org,iddev,172.25.32.123 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDOPvCvfz50iy2T9tgwPDWVBTOXg39Kcf2PTzqV4fGJ1F1cgqqvzM6Peg9ckakP7lCHoYCGwY5hqZW4MVyyJq+VoNsqJ+52u4t+nW1GVZO6tDChI+mvAr21xkz/crhdEe0bRQJ4X3bo2mKo14USE76v0xqGJmymR/emrKbn1QzXi8gTUmh/TYUm62CZCvYFL4BAeWvRgtx9ZQUAn2H1hfj8BH7m6dwH1KMFvXjp1cDkZqJ/dLo9M5t0EDZehbqSIwFpLAk5PTEND/YFNHH66mExs+anaXTuxvlv4wz0hjU94oZ6AtVnT1l7pTgIWYTSPM7UILwg79kFutG6dfcDknzj iddev.fedorainfracloud.org
 infinote.fedoraproject.org,infinote,140.211.169.231,192.168.100.10 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCx+bzAH71loRu28DSzkaX6gSwrSpkEOETmLMi98IjHT7h24pTfe3I6QNInqyHDLS6ktDO+z9MxtbtZS2Q0w1mgsqgs2Dq0a+CuiprZmXfW7/DyLgEDk5lt7sTB/xGb0A1lEH1s9CG6W+domlrWIXRoyl4UWymdloAGk39TQMtiEwetMC7eAgo/SNPjs3bp7ntQxVs6kj1/FFLiSmnuai50oVkceoiZgARmwxmnEwy20jNYFfTRZcGm2bQ5zq5z4pSE24p3QQ2X/Wk0f8fG3glMswlKcr+tlM1Kj4EPpm/89YpePjMvcIlV47xYwLq+//7tICRKQ08St+vDyad/VRaR infinote.fedoraproject.org
@@ -336,7 +343,7 @@ koji01.phx2.fedoraproject.org,koji01,10.5.125.61 ssh-rsa AAAAB3NzaC1yc2EAAAADAQA
 koji01.stg.phx2.fedoraproject.org,koji01.stg,10.5.126.87 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC99mE+M1j0yNkQiSg58YUb6L3nJtrEDU5Ep53KL2cC1Rjrk204vd604AuKRarxcOoKfA3EhBYuvd1PVKRiBvzuquWs9C8/AS++JS20xVbQzfkM4s75xWrlLHTR7gZr0lXYR8UkDtmc5vUxTb9dxqnV3Q5fzkZFY0q1U9pmYKAeIjkDme/guEHaEWj16XTBuvt4uQws5hsZ805oTVVnvsCLh+SNfxYwWrUbaBLzLLRcRKgMp++tzjlVv8LBK9JmAB/vBtoK7BiffO1UBYPqixAyWS84uiR5tjK/B+7lIm01no8ck5AECKoOz/lbr8+tRqiBZGtgL30Ko5R3dngS2067 koji01.stg.phx2.fedoraproject.org
 koji02.phx2.fedoraproject.org,koji02,10.5.125.62 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5B/PiWfPisNI8LNWx3qAaU6ceRSHZArgowa2ElI70tvU+gsYWqzeDT6ecdSt87vUYvjBYjlsc4QeijMCFoxMtUlLFQkfyyt+hF9Bcj6AFTa3gQ5Wf+BHSCNbPbpAQV4oRnhxsS4yEqm15yVLCXlswQAeScYcu6kGUZ9cPa79u3RrjRmdz7ZLvSwl+3xB/7yLK/JOFN2Pchce3zYpqYEpNKucAO+LE882FyTyUt8CmXX5iWsN9dRyAQC4oIZa6yB8KwbzEjzmyo6xBkbKa1nX4lbYA+/Tqs1eAPw+kPkb6VqzFvLd4lJQYFzIx/VbXV75DA2uXz4xX0puQoY9YGJ1j koji02.phx2.fedoraproject.org
 kojipkgs01.phx2.fedoraproject.org,kojipkgs01,10.5.125.36 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmnaS7vdikqgHitIRCna922UEPgVJU3w5e2C/7ygVwx2fR8Cu0GQpoHUQ8X8awvUczc8zTrRdMabdd5v4zv0FxaIj0sspE7qsN42/l7L6Kv1SejUc0rHpdfwKec4M5XgrFU+ZM2SxwyWsRabeaJjOdmSzGnwnqfBU/5tY478pFWK6N+nIkBhibBN62XyXq028OUAZUJF5PaU/k+sWy/VYZRKf3fpIINufWNzXmXA02aD29YIqrMGdzkkvcgupne0LJB3XagEnZwcl6VNG4AhSA81AxrLP2JElfT1kwLtLwI0KwbCDHuYvNE3r6TIVBmysvjQn7mnDwvKngkT6igAp3 kojipkgs01.phx2.fedoraproject.org
-koschei-backend01.phx2.fedoraproject.org,koschei-backend01,10.5.125.49 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDmVrFxpr9sNiSpt0V73/dFrN4DmLXTqqznS3VbASsIEHBJqMCiRJewU4mt9B84zk/HDINhIDtCRGkt9tIQ2uT7KxHmMmtYM0opulqmnjT7X+F7PpvOCq7AHh3U+Woi6llUWmgSzQc3Wzd8Zq9i+fabkLVjPGYEcRvLDt6pBbqBwT9Nf2UD2Limg/8X7WVbOsZtc/29xi2Y2aTNN7tu0UQRis2jZ23xoOmyL2GkeG5p964q9lmr8kMK/lmzceupholpBUC7mScYD5btU7q3czu1u0shkfFlzygsnhih7Z2pG0dQMdE/QcjwDoA1hddi6h+JVs/egyqpi+nBByCwyojb koschei-backend01.phx2.fedoraproject.org
+koschei-backend01.phx2.fedoraproject.org,koschei-backend01,10.5.125.49 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCfzSpYkqfikIKIZlOZdBz93WOxooGVdcdwMFjyWtTomRuBnwPvgCcT0FxdtwfOL9syJxrP4Ap2k/WW+ZAjvPxXHFRY9ieMvWTYfb8zqqQhdoQw+sUEFDZrH2llnaxiqmReUBdRCzJ+pxYk8NVodg8M2ZnSMETZK3NnC/rCpShGfQ9ba4u0+1UbSMboD/2X7L/+DPApKxVAZ9a65xTur0WzjsSRBkRPfEntCOyTUvxWtmyXXqrbTDG7xhDrlNGScn58HnsfOnb3B1j/zExgD44IohPgRvCjjBDFh7YoTHF6svQ5luU7mpHRhTy5JnVwZ37M+Ov5NBvKb/WpKmlkcSx/ koschei-backend01.phx2.fedoraproject.org
 koschei-backend01.stg.phx2.fedoraproject.org,koschei-backend01.stg,10.5.126.227 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBCqtlbbPa3NuQwTKhZPPk18lx59MdvYahp/+/9PEh6WW3mJhyQ63xa5CPdqGnvwkFrfVywXlyMgbhaxaDKZFwT+YX1Z0Q3eM7ICVuWgpTm0UByVZ2URGuTIFoeYUFoTwiGGduW9jBd0B9p3aFMNQUEFzjK/L+ujCc4arYeTtgtCegX8IkD7Y0dyxvctn8b3LcDDIu9DQCBI5mQLvcuha9LXW/Sv1kmaKz0cICEVP/3OvjSG9LWgWIY+bz/DObZyZq8PpUsiQkbelLG3UEV8u/xMu5HqaLUZU2clSSjsE/rSfOBEiRCW8mTlZqVMB58jVF+K2sq75skO/6SJ1+2iTr koschei-backend01.stg.phx2.fedoraproject.org
 koschei-web01.phx2.fedoraproject.org,koschei-web01,10.5.126.140,192.168.1.46 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCk7aLIpqeYPTmbRPtktRCJej8ylPt26mE6TPfty2p2sZ31yK1NFhTKXC/RDVWKfPBK/GueMTkqMXZyo/na8P6zzoYcwMw86kgfdeMZzKf5bjaEx6tNx7wwWurK7Rs4NOyZlR0j8E9mYyHKDY3rhoVYu/1GuUMEhEZSsFScZ4ZRXmaxweHCOuy5Cc0l2nqRQJ631S1BBwZgH7AIhD1WDb4q2lmeOhMg6WynckZvPwwJui5z8C92E8oaIAbJ2poU9Rd0kvPscLWdKzP350vOwW1qxUsu7eDncTZ8i6Bs7UE7op3gcyXmCfB6wyDcNB2e8f9U1NQVWTBvFVt+DtBKwBYb koschei-web01.phx2.fedoraproject.org
 koschei-web01.stg.phx2.fedoraproject.org,koschei-web01.stg,10.5.126.228 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCvMsv12bAhu7pjmv3ouHRL7j4bYb/hPv5h8mNb3n8E1jB5EGAvRWf4iNRctusRjvELZQdh9u8ImsT4SlybXRHZ25ydB8oy+GebXKmljQ7f4mBgnHh8T1cXxMeK0JKzQYPw3jMjJYLPqrDiTyLZIYFoTpoi3+///AyenO/Sa/8u2BkSmp5jRBspEPy/F7HpKwUDlxIohLaGapqng+QMDRdgBEqsczH1zaqc/6ZNPm89ZqdmtkdGTUYL2zRXBS3pyyf5Q+y0Gz7nxqI1oY5PxMLvy3DbmDwreA/fH1e7lB/kQxQijT9PLf0LuUamIkn0Zk/pED3FVUHU5yTW4nbYW6P koschei-web01.stg.phx2.fedoraproject.org

roles/batcave/tasks/main.yml

@@ -252,7 +252,7 @@
   - httpd
 
 - name: install web server config for batcave (main config)
-  copy: src=infrastructure.fedoraproject.org.conf dest=/etc/httpd/conf.d/infrastructure.fedoraproject.org.conf mode=0644
+  template: src=infrastructure.fedoraproject.org.conf.j2 dest=/etc/httpd/conf.d/infrastructure.fedoraproject.org.conf mode=0644
   tags:
   - batcave
   - config

roles/batcave/templates/infrastructure.fedoraproject.org.conf.j2

@@ -121,8 +121,8 @@ ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
   # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
   # If you change the protocols or cipher suites, you should probably update
   # modules/squid/files/squid.conf-el6 too, to keep it in sync.
-  SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+  SSLProtocol {{ ssl_protocols }}
-  SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+  SSLCipherSuite {{ ssl_ciphers }}
 
 # robots location
 Alias /robots.txt /srv/web/robots.txt.lockbox01

roles/bodhi2/base/files/bowlofeggs-bodhi-epel-7.repo

@@ -0,0 +1,8 @@
+[bowlofeggs-bodhi]
+name=Copr repo for bodhi owned by bowlofeggs
+baseurl=https://copr-be.cloud.fedoraproject.org/results/bowlofeggs/bodhi/epel-7-$basearch/
+skip_if_unavailable=True
+gpgcheck=1
+gpgkey=https://copr-be.cloud.fedoraproject.org/results/bowlofeggs/bodhi/pubkey.gpg
+enabled=1
+enabled_metadata=1

roles/bodhi2/base/files/lmacken-bodhi2-epel-7.repo

@@ -1,7 +0,0 @@
-[lmacken-bodhi2]
-name=Copr repo for bodhi2 owned by lmacken
-baseurl=https://copr-be.cloud.fedoraproject.org/results/lmacken/bodhi2/epel-7-$basearch/
-skip_if_unavailable=True
-gpgcheck=1
-gpgkey=https://copr-be.cloud.fedoraproject.org/results/lmacken/bodhi2/pubkey.gpg
-enabled=1

roles/bodhi2/base/tasks/main.yml

@@ -4,8 +4,8 @@
 
 - name: setup the bodhi2 copr repo
   copy: >
-    src="lmacken-bodhi2-epel-7.repo"
+    src="bowlofeggs-bodhi-epel-7.repo"
-    dest="/etc/yum.repos.d/lmacken-bodhi2-epel-7.repo"
+    dest="/etc/yum.repos.d/bowlofeggs-bodhi-epel-7.repo"
     owner=root
     group=root
     mode=0644

roles/copr/backend/files/provision/files/mock/fedora-23-ppc64le.cfg

@@ -28,17 +28,15 @@ mdpolicy=group:primary
 [fedora]
 name=fedora
 metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
-#baseurl=https://dl.fedoraproject.org/pub/fedora-secondary/releases/23/Everything/ppc64le/
 failovermethod=priority
-gpgkey=file:///etc/pki/mock/RPM-GPG-KEY-fedora-23-secondary
+gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-23-secondary
 gpgcheck=1
 
 [updates]
 name=updates
 metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
-#baseurl=https://dl.fedoraproject.org/pub/fedora-secondary/updates/23/Everything/ppc64le/
 failovermethod=priority
-gpgkey=file:///etc/pki/mock/RPM-GPG-KEY-fedora-23-secondary
+gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-23-secondary
 gpgcheck=1
 
 [updates-testing]

roles/copr/backend/files/provision/files/mock/fedora-24-ppc64le.cfg

@@ -29,14 +29,14 @@ mdpolicy=group:primary
 name=fedora
 metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
 failovermethod=priority
-gpgkey=file:///etc/pki/mock/RPM-GPG-KEY-fedora-24-secondary
+gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-24-secondary
 gpgcheck=1
 
 [updates]
 name=updates
 metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
 failovermethod=priority
-gpgkey=file:///etc/pki/mock/RPM-GPG-KEY-fedora-24-secondary
+gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-24-secondary
 gpgcheck=1
 
 [updates-testing]

roles/copr/backend/files/provision/files/mock/fedora-25-ppc64le.cfg

@@ -0,0 +1,71 @@
+config_opts['root'] = 'fedora-25-ppc64le'
+config_opts['target_arch'] = 'ppc64le'
+config_opts['legal_host_arches'] = ('ppc64le',)
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils fedora-release findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['dist'] = 'fc25'  # only useful for --resultdir variable subst
+config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
+config_opts['releasever'] = '25'
+config_opts['package_manager'] = 'dnf'
+
+config_opts['yum.conf'] = """
+[main]
+keepcache=1
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+install_weak_deps=0
+metadata_expire=0
+mdpolicy=group:primary
+
+# repos
+
+[fedora]
+name=fedora
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
+failovermethod=priority
+gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-25-secondary
+gpgcheck=1
+
+[updates]
+name=updates
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
+failovermethod=priority
+gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-25-secondary
+gpgcheck=1
+
+[updates-testing]
+name=updates-testing
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[local]
+name=local
+baseurl=http://ppcpkgs.fedoraproject.org/repos/f25-build/latest/ppc64le/
+cost=2000
+enabled=0
+
+[fedora-debuginfo]
+name=fedora-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-debug-$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[updates-debuginfo]
+name=updates-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-debug-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[updates-testing-debuginfo]
+name=updates-testing-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-debug-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+"""

roles/copr/backend/files/provision/provision_builder_tasks_ppc64le.yml

@@ -55,6 +55,7 @@
     - site-defaults.cfg
     - fedora-23-ppc64le.cfg
     - fedora-24-ppc64le.cfg
+    - fedora-25-ppc64le.cfg
     - fedora-rawhide-ppc64le.cfg
 
 # ansible doesn't support simultaneously usage of async and with_* options
@@ -62,7 +63,7 @@
 - name: prepare cache
   when: prepare_base_image is defined
   async: 14400
-  shell: "for i in fedora-23-ppc64le fedora-24-ppc64le fedora-rawhide-ppc64le; do mock --init -r $i; done"
+  shell: "for i in fedora-23-ppc64le fedora-24-ppc64le fedora-25-ppc64le fedora-rawhide-ppc64le; do mock --init -r $i; done"
 
 - name: mockbuilder user
   user: name=mockbuilder groups=mock

roles/copr/frontend/tasks/main.yml

@@ -44,7 +44,7 @@
   - config
 
 - name: install copr-frontend ssl vhost for production
-  copy: src="httpd/coprs_ssl.conf" dest="/etc/httpd/conf.d/copr_ssl.conf"
+  template: src="httpd/coprs_ssl.conf.j2" dest="/etc/httpd/conf.d/copr_ssl.conf"
   when: not devel
   tags:
   - config

roles/copr/frontend/templates/httpd/coprs_ssl.conf.j2

@@ -1,8 +1,8 @@
 <VirtualHost *:443>
     SSLEngine on
-    SSLProtocol all -SSLv2 -SSLv3
+    SSLProtocol {{ ssl_protocols }}
     # Use secure TLSv1.1 and TLSv1.2 ciphers
-    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
+    SSLCipherSuite {{ ssl_ciphers }}
     SSLHonorCipherOrder on
     Header always add Strict-Transport-Security "max-age=15768000; preload"
 
@@ -44,9 +44,9 @@
 
 <VirtualHost *:443>
     SSLEngine on
-    SSLProtocol all -SSLv2 -SSLv3
+    SSLProtocol {{ ssl_protocols }}
     # Use secure TLSv1.1 and TLSv1.2 ciphers
-    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
+    SSLCipherSuite {{ ssl_ciphers }}
     SSLHonorCipherOrder on
     Header always add Strict-Transport-Security "max-age=15768000; preload"
 

roles/distgit/tasks/main.yml

@@ -274,7 +274,7 @@
 # -- Lookaside Cache -------------------------------------
 # This is the annex to Dist Git, where we host source tarballs.
 - name: install the Lookaside Cache httpd configs
-  copy: src={{item}} dest=/etc/httpd/conf.d/pkgs.fedoraproject.org/{{item}}
+  template: src={{item}} dest=/etc/httpd/conf.d/pkgs.fedoraproject.org/{{item}}
   with_items:
   - lookaside.conf
   - lookaside-upload.conf

roles/distgit/templates/lookaside-upload.conf

@@ -28,7 +28,8 @@ SSLCryptoDevice builtin
     SSLCACertificateFile  conf/cacert.pem
     SSLCARevocationFile  /etc/pki/tls/crl.pem
 
-    SSLCipherSuite RSA:!EXPORT:!DH:!LOW:!NULL:+MEDIUM:+HIGH
+    SSLProtocol {{ ssl_protocols }}
+    SSLCipherSuite {{ ssl_ciphers }}
 
 # Must be 'optional' everywhere in order to have POST operations work to upload.cgi
     SSLVerifyClient optional

roles/download/tasks/main.yml

@@ -68,7 +68,10 @@
   copy: src="{{private}}/files/httpd/wildcard-2014.fedoraproject.org.intermediate.cert" dest=/etc/pki/tls/certs/wildcard-2014.fedoraproject.org.intermediate.cert owner=root group=root mode=0644
 
 - name: Configure httpd dl main conf
-  copy: src=httpd/dl.fedoraproject.org.conf dest=/etc/httpd/conf.d/dl.fedoraproject.org.conf
+  template: src=httpd/dl.fedoraproject.org.conf dest=/etc/httpd/conf.d/dl.fedoraproject.org.conf
+  tags:
+  - httpd
+  - config
   notify:
   - reload httpd
 

roles/download/templates/httpd/dl.fedoraproject.org.conf

@@ -24,8 +24,8 @@
   # If you change the protocols or cipher suites, you should probably update
   # modules/squid/files/squid.conf-el6 too, to keep it in sync.
 
-   SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+   SSLProtocol {{ ssl_protocols }}
-   SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+   SSLCipherSuite {{ ssl_ciphers }}
 
   Include "conf.d/dl.fedoraproject.org/*.conf"
 </VirtualHost>

roles/epylog/files/merged/weed_local.cf

@@ -11,6 +11,7 @@ ansible-async_wrapper:.*
 auditd.*: Audit daemon rotating log files
 avahi-daemon.*
 btseed.*
+chronyd.*
 collectd.*: Filter subsystem.*
 collectd.*: Value too old.*
 collectd.*: processes plugin: Failed to read from.*
@@ -168,6 +169,7 @@ openvpn.*: NOTE: the current --script-security setting may allow this configurat
 openvpn.*: WARNING: No server certificate verification method has been enabled.*
 pam_unix\(.*\): account .* has password changed in future
 pagure-stream-server.py:.*
+polkitd.*
 postfix/anvil.*: statistics.*
 postfix/bounce.*sender non-delivery notification.*
 postfix/error.*:.*delivery temporarily suspended.*Connection timed out.*
@@ -301,16 +303,8 @@ sshd.*: error\: buffer_get_bignum2_ret\: invalid bignum
 sshd.*: error\: key_from_blob\: can\'t read rsa key
 sshd.*: error\: key_read\: key_from_blob
 sshd.*: Close session\: user root from 10.5.126.23 port.*
-stunnel:.*connected remote.*
+stunnel:.*
-stunnel:.*SSL_read.*
+su: pam_unix\(su-l:session\): session .* for user.*
-stunnel:.*Connection reset.*
-stunnel:.*connect_blocking.*
-stunnel:.*Connection closed.*
-stunnel:.*Service \[websockets\] accepted connection from.*
-stunnel:.*Service \[eventsource\] accepted connection from.*
-stunnel: .*SSL_accept\: Peer suddenly disconnected
-su: pam_unix\(su-l:session\): session .* for user dbbackup.*
-su: pam_unix\(su-l:session\): session .* for user postgres.*
 runuser: pam_unix\(runuser-l:session\).* session opened for user postgres by.*
 runuser: pam_unix\(runuser-l:session\).* session closed for user postgres
 systemd-logind.*
@@ -323,6 +317,8 @@ systemd: pam_unix\(systemd-user:session\): session.*
 systemd.*: Start.* Cleanup of Temporary Directories.*
 systemd-machine-id-setup.*: Initializing machine ID.*                            
 systemd.*: Created slice user-.*.slice.
+systemd: Created slice User Slice of.*
+systemd: Listening on D-Bus User Message Bus Socket.
 systemd.*: Removed slice user-.*slice.
 systemd.*: Received SIGRTMIN\+24 from PID.*
 systemd.*: Failed to mark scope session-.*.scope as abandoned : Stale file handle

roles/git/make_checkout_seed/files/make-git-checkout-seed.sh

@@ -47,7 +47,7 @@ for repo in $ORIGIN_DIR/*.git ; do
       rm -f $working_tree/$bname.spec
       rm -f $SPEC_DIR/$bname.spec
     elif [ -e $working_tree/$bname.spec ]; then
-      cp $working_tree/$bname.spec $SPEC_DIR/
+      cp -p $working_tree/$bname.spec $SPEC_DIR/
     fi
   else
     pushd $SEED_DIR &>/dev/null
@@ -58,7 +58,7 @@ for repo in $ORIGIN_DIR/*.git ; do
       rm -f $working_tree/$bname.spec
       rm -f $SPEC_DIR/$bname.spec
     elif [ -e $working_tree/$bname.spec ]; then
-      cp $working_tree/$bname.spec $SPEC_DIR/
+      cp -p $working_tree/$bname.spec $SPEC_DIR/
     fi
   fi
 done

roles/graphite/grafana/templates/grafana.conf

@@ -19,8 +19,8 @@
   SSLCertificateKeyFile /etc/letsencrypt/live/grafana.cloud.fedoraproject.org/privkey.pem
   SSLCertificateChainFile /etc/letsencrypt/live/grafana.cloud.fedoraproject.org/fullchain.pem
   SSLHonorCipherOrder On
-  SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!ADH:!EXP:!LOW:!MD5:!SSLV2:!NULL
+  SSLCipherSuite {{ ssl_ciphers }}
-  SSLProtocol ALL -SSLv2
+  SSLProtocol {{ ssl_protocols }}
 
   ProxyPass / http://localhost:3000/
   ProxyPassReverse / http://localhost:3000/

roles/graphite/graphite/templates/graphite-web.conf

@@ -37,8 +37,8 @@
   SSLCertificateKeyFile /etc/letsencrypt/live/graphite.cloud.fedoraproject.org/privkey.pem
   SSLCertificateChainFile /etc/letsencrypt/live/graphite.cloud.fedoraproject.org/fullchain.pem
   SSLHonorCipherOrder On
-  SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!ADH:!EXP:!LOW:!MD5:!SSLV2:!NULL
+  SSLCipherSuite {{ ssl_ciphers }}
-  SSLProtocol ALL -SSLv2
+  SSLProtocol {{ ssl_protocols }}
 
   ProxyPass / http://graphite.cloud.fedoraproject.org/
   ProxyPassReverse / http://graphite.cloud.fedoraproject.org/

roles/haproxy/templates/haproxy.cfg

@@ -336,13 +336,11 @@ listen  ipa 0.0.0.0:10053
     option  httpchk GET /
 
 {% endif %}
-{% if env == "staging" %}
 
 listen docker-candidate-registry 0.0.0.0:10054
     balance hdr(appserver)
     server docker-candidate-registry01 docker-candidate-registry01:5000 check inter 10s rise 1 fall 2
 
-{% endif %}
 
 # Apache doesn't handle the initial connection here like the other proxy
 # entries.  This proxy also doesn't use the http mode like the others.

roles/httpd/templates/website.conf.j2

@@ -42,8 +42,8 @@
   # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
   # If you change the protocols or cipher suites, you should probably update
   # modules/squid/files/squid.conf-el6 too, to keep it in sync.
-  SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+  SSLProtocol {{ ssl_protocols }}
-  SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+  SSLCipherSuite {{ ssl_ciphers }}
 
   Include "conf.d/{{ name }}/*.conf"
 </VirtualHost>

roles/httpd/website/templates/website.conf

@@ -42,8 +42,8 @@
   # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
   # If you change the protocols or cipher suites, you should probably update
   # modules/squid/files/squid.conf-el6 too, to keep it in sync.
-  SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+  SSLProtocol {{ ssl_protocols }}
-  SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+  SSLCipherSuite {{ ssl_ciphers }}
 
 {% if sslonly %}
   Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"

roles/infinote/tasks/main.yml

@@ -21,7 +21,7 @@
   - config
 
 - name: Setup basic apache config
-  copy: src=infinote.fedoraproject.org.conf dest=/etc/httpd/conf.d/infinote.fedoraproject.org.conf
+  template: src=infinote.fedoraproject.org.conf dest=/etc/httpd/conf.d/infinote.fedoraproject.org.conf
   tags:
   - infinote
   - config

roles/infinote/templates/infinote.fedoraproject.org.conf

@@ -82,8 +82,8 @@ ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
   # https://fedorahosted.org/fedora-infrastructure/ticket/4101#comment:14
   # If you change the protocols or cipher suites, you should probably update
   # modules/squid/files/squid.conf-el6 too, to keep it in sync.
-  SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+  SSLProtocol {{ ssl_protocols }}
-  SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+  SSLCipherSuite {{ ssl_ciphers }}
 
 # robots location
 Alias /robots.txt /srv/web/robots.txt.lockbox01

roles/keyserver/tasks/main.yml

@@ -43,12 +43,12 @@
   - config
 
 - name: /etc/httpd/conf.d/sks.conf
-  copy: src="sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644
+  template: src="sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644
   tags:
   - config
 
 - name: /etc/httpd/conf.d/ssl.conf
-  copy: src="ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
+  template: src="ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
   tags:
   - config
 

roles/keyserver/templates/sks.conf

@@ -56,8 +56,8 @@ NameVirtualHost *:443
         SSLCertificateFile /etc/pki/tls/wildcard-2014.fedoraproject.org.cert
 	SSLCertificateChainFile /etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert
         SSLCertificateKeyFile /etc/pki/tls/wildcard-2014.fedoraproject.org.key
-        SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+        SSLProtocol {{ ssl_protocols }}
-	SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+	SSLCipherSuite {{ ssl_ciphers }}
 
 	ProxyPass / http://localhost:11371/
 	ProxyPassReverse / http://localhost:11371/
@@ -73,8 +73,8 @@ NameVirtualHost *:443
         SSLEngine on
         SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem
         SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key
-	SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+	SSLProtocol {{ ssl_protocols }}
-	SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+	SSLCipherSuite {{ ssl_ciphers }}
 
         ProxyPass / http://localhost:11371/
         ProxyPassReverse / http://localhost:11371/

roles/keyserver/templates/ssl.conf

@@ -92,12 +92,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 # List the ciphers that the client is permitted to negotiate.
 # See the mod_ssl documentation for a complete list.
-SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Server Certificate:
 # Point SSLCertificateFile at a PEM encoded certificate.  If

roles/koji_hub/tasks/main.yml

@@ -297,7 +297,7 @@
   when: env == "staging"
 
 - name: koji staging ssl config
-  copy: src=koji-ssl.conf.stg dest=/etc/httpd/conf.d/ssl.conf
+  template: src=koji-ssl.conf.stg dest=/etc/httpd/conf.d/ssl.conf
   tags:
   - config
   - koji_hub
@@ -305,7 +305,7 @@
   when: env == "staging"
 
 - name: koji ssl config
-  copy: src=koji-ssl.conf dest=/etc/httpd/conf.d/ssl.conf
+  template: src=koji-ssl.conf dest=/etc/httpd/conf.d/ssl.conf
   tags:
   - config
   - koji_hub

roles/koji_hub/templates/koji-ssl.conf

@@ -72,12 +72,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_ssl documentation for a complete list.
-SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Speed-optimized SSL Cipher configuration:
 #   If speed is your main concern (on busy HTTPS servers e.g.),

roles/koji_hub/templates/koji-ssl.conf.arm

@@ -72,12 +72,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_ssl documentation for a complete list.
-SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Speed-optimized SSL Cipher configuration:
 #   If speed is your main concern (on busy HTTPS servers e.g.),

roles/koji_hub/templates/koji-ssl.conf.ppc

@@ -72,12 +72,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_ssl documentation for a complete list.
-SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Speed-optimized SSL Cipher configuration:
 #   If speed is your main concern (on busy HTTPS servers e.g.),

roles/koji_hub/templates/koji-ssl.conf.s390

@@ -72,12 +72,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_ssl documentation for a complete list.
-SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Speed-optimized SSL Cipher configuration:
 #   If speed is your main concern (on busy HTTPS servers e.g.),

roles/koji_hub/templates/koji-ssl.conf.stg

@@ -72,12 +72,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_ssl documentation for a complete list.
-SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Speed-optimized SSL Cipher configuration:
 #   If speed is your main concern (on busy HTTPS servers e.g.),
@@ -89,8 +89,7 @@ SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
 #   have perfect forward secrecy - if the server's key is
 #   compromised, captures of past or future traffic must be
 #   considered compromised, too.
-#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
+SSLHonorCipherOrder on 
-#SSLHonorCipherOrder on 
 
 #   Server Certificate:
 # Point SSLCertificateFile at a PEM encoded certificate.  If

roles/koschei/frontend/templates/config-frontend.cfg.j2

@@ -95,28 +95,6 @@ config = {
     ],
     "bugreport": {
         "url": "https://{{ koschei_bugzilla }}/enter_bug.cgi?{query}",
-        {% if env != 'staging' %}
-        "template": {
-            "product": "Fedora",
-            "component": "{name}",
-            "version": "rawhide",
-            "short_desc": "{name}: FTBFS in rawhide",
-            "bug_file_loc": "{{ koschei_topurl }}/package/{name}",
-            "comment": """
-            Description of problem:
-            Package {name} fails to build from source in rawhide.
-
-            Version-Release number of selected component (if applicable):
-            {version}-{release}
-
-            Steps to Reproduce:
-            koji build --scratch f26 {name}-{version}-{release}.{arch}.rpm
-
-            Additional info:
-            This package is tracked by Koschei. See:
-            {{ koschei_topurl }}/package/{name}"""
-        },
-        {% endif %}
     },
 }
 

roles/openqa/server/tasks/main.yml

@@ -221,11 +221,6 @@
   changed_when: "admin.rc == 0"
   failed_when: "(admin.rc > 0) and (admin.stderr is not defined or admin.stderr.find('already exists') == -1)"
 
-- name: Patch repo URLs in templates
-  shell: "cp /var/lib/openqa/share/tests/fedora/templates /tmp && sed -i -e 's,dl.fedoraproject,dl.phx2.fedoraproject,g' /tmp/templates"
-  when: "gittests|changed and deployment_type is defined"
-  changed_when: "1 != 1"
-
 - name: Dump existing config for checking changes
   shell: "/usr/share/openqa/script/dump_templates --json > /tmp/tmpl-old.json"
   when: "gittests|changed"
@@ -235,14 +230,9 @@
 # a correct 'changed' for this step is too difficult. Instead we have
 # the prior and following steps; when the templates actually changed,
 # the *following* step will register as changed.
-- name: Load patched tests
-  shell: "/tmp/templates --clean"
-  when: "gittests|changed and deployment_type is defined"
-  changed_when: "1 != 1"
-
 - name: Load tests
   shell: "/var/lib/openqa/share/tests/fedora/templates --clean"
-  when: "gittests|changed and deployment_type is not defined"
+  when: "gittests|changed"
   changed_when: "1 != 1"
 
 - name: Check if the tests changed in previous step

roles/openvpn/client/files/client.conf

@@ -17,6 +17,8 @@ persist-key
 #up /etc/openvpn/fix-routes.sh
 #up-restart
 
+cipher AES-256-CBC
+auth SHA512
 ca ca.crt
 cert client.crt
 key client.key

roles/openvpn/client/tasks/main.yml

@@ -36,10 +36,10 @@
   tags:
   - install
   - openvpn
-  notify:
+#  notify:
-  - restart openvpn (Fedora)
+#  - restart openvpn (Fedora)
-  - restart openvpn (RHEL7)
+#  - restart openvpn (RHEL7)
-  - restart openvpn (RHEL6)
+#  - restart openvpn (RHEL6)
 
 - name: enable openvpn service for rhel 6
   service: name=openvpn state=running enabled=true

roles/openvpn/server/files/server.conf

@@ -12,6 +12,8 @@ ca ca.crt
 cert server.crt
 key server.key
 
+cipher AES-256-CBC
+auth SHA512
 dh dh2048.pem
 crl-verify crl.pem
 

roles/pagure/frontend/tasks/main.yml

@@ -288,6 +288,7 @@
   - redis
   - pagure_ev
   - pagure_webhook
+  - pagure_ci
   - fedmsg-relay
   ignore_errors: true
   tags:

roles/pagure/frontend/templates/pagure.cfg

@@ -204,3 +204,5 @@ SSH_KEYS = {
 # was running since before version 1.3 and if you care about backward
 # compatibility in your URLs.
 OLD_VIEW_COMMIT_ENABLED = True
+
+PAGURE_CI_SERVICES=['jenkins']

roles/people/tasks/main.yml

@@ -20,11 +20,15 @@
   - packages
   - people
 
+- name: install main httpd config
+  template: src=people.conf dest=/etc/httpd/conf.d/people.conf
+  tags:
+  - people
+
 - name: install httpd config
   copy: src={{item}} dest=/etc/httpd/conf.d/{{item}}
   with_items:
   - cgit.conf
-  - people.conf
   - ssl.conf
   - userdir.conf
   tags:

roles/people/templates/people.conf

@@ -31,8 +31,8 @@ NameVirtualHost *:80
   SSLCertificateKeyFile /etc/pki/tls/private/wildcard-2014.fedorapeople.org.key
   SSLCertificateChainFile /etc/pki/tls/certs/wildcard-2014.fedorapeople.org.intermediate.cert
   SSLHonorCipherOrder On
-  SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+  SSLCipherSuite {{ ssl_ciphers }}
-  SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+  SSLProtocol {{ ssl_protocols }}
 
   Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
 

roles/phabricator/tasks/main.yml

@@ -196,6 +196,8 @@
 
 - name: copy phabricator httpd config
   template: src=phabricator.conf.j2 dest=/etc/httpd/conf.d/phabricator.conf owner=root group=root mode=0644
+  tags:
+  - httpd
   notify:
   - reload httpd
 

roles/phabricator/templates/phabricator.conf.j2

@@ -16,13 +16,12 @@
   #   SSL Protocol support:
   # List the enable protocol levels with which clients will be able to
   # connect.  Disable SSLv2 access by default:
-  SSLProtocol all -SSLv2
+  SSLProtocol {{ ssl_protocols }}
 
   #   SSL Cipher Suite:
   # List the ciphers that the client is permitted to negotiate.
   # See the mod_ssl documentation for a complete list.
-  #SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
+  SSLCipherSuite {{ ssl_ciphers }}
-  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
 
   #   Server Certificate:
   # Point SSLCertificateFile at a PEM encoded certificate.  If

roles/planet/tasks/main.yml

@@ -30,7 +30,7 @@
     - planet_server
 
 - name: copy the planet http config file
-  copy: src=planet.conf dest=/etc/httpd/conf.d/planet.conf
+  template: src=planet.conf dest=/etc/httpd/conf.d/planet.conf
   tags:
     - planet_server
 

roles/planet/templates/planet.conf

@@ -65,8 +65,8 @@
     SSLCertificateKeyFile /etc/pki/tls/private/planet.fedoraproject.org.key
     SSLCertificateChainFile /etc/pki/tls/certs/wildcard-2014.fedorapeople.org.intermediate.cert
     SSLHonorCipherOrder On
-    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
+    SSLProtocol {{ ssl_protocols }}
-    SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+    SSLCipherSuite {{ ssl_ciphers }}
 
     DocumentRoot "/srv/planet/site/"
 

roles/releng/tasks/main.yml

@@ -181,7 +181,7 @@
   when: "'releng-secondary' in group_names"
 
 - name: symlink /srv/pungi
-  file: src=/mnt/fedora_koji/compose dest=/srv/pungi  state=link
+  file: src=/mnt/fedora_koji/koji/compose dest=/srv/pungi  state=link
   when: "'releng-secondary' not in group_names"
 
 - name: add pkgs for nightly compose

roles/supybot/files/archive.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+cd /srv/web/meetbot/teams
+for team in *; do
+    pushd $team >/dev/null 2>&1
+    tar -cphf /srv/web/meetbot/archives/$team.tgz *.log.txt
+    popd >/dev/null 2>&1
+done

roles/supybot/tasks/main.yml

@@ -28,6 +28,10 @@
   file: path=/srv/web/meetbot/teams state=directory owner=apache group=apache mode=0755
   tags: supybot
 
+- name: create archives directory
+  file: path=/srv/web/meetbot/archives state=directory owner=apache group=apache mode=0755
+  tags: supybot
+
 - name: setup meetings_by_team script
   copy: src=meetings_by_team.sh dest=/usr/local/bin/meetings_by_team.sh mode=755
   tags: supybot
@@ -36,6 +40,14 @@
   cron: name=meetings-by-team hour="23" minute="0" user=apache job="/usr/local/bin/meetings_by_team.sh"
   tags: supybot
 
+- name: setup archive script
+  copy: src=archive.sh dest=/usr/local/bin/archive.sh mode=755
+  tags: supybot
+
+- name: teams cron job
+  cron: name=archive hour="23" minute="30" user=apache job="/usr/local/bin/archive.sh >& /dev/null"
+  tags: supybot
+
 - name: setup meetbot.conf apache config
   copy: src=meetbot.conf dest=/etc/httpd/conf.d/meetbot.conf mode=644
   tags: supybot

roles/taskotron/imagefactory-client/tasks/main.yml

@@ -20,7 +20,7 @@
     repo: https://bitbucket.org/fedoraqa/base_images
     dest: '/var/lib/fedoraqa/base_images'
     update: yes
-    version: '{{imagefactory_tools_branch}}'
+    version: 'master'
   register: git_result
   changed_when: "git_result.after|default('after') != git_result.before|default('before')"
 

roles/taskotron/imagefactory/tasks/main.yml

@@ -26,7 +26,7 @@
     repo: https://bitbucket.org/fedoraqa/base_images
     dest: '/var/lib/fedoraqa/base_images'
     update: yes
-    version: '{{imagefactory_tools_branch}}'
+    version: 'master'
   register: git_result
   changed_when: "git_result.after|default('after') != git_result.before|default('before')"
 

roles/taskotron/imagefactory/templates/config_server.ini.j2

@@ -7,3 +7,4 @@ mail_to=jskladan@redhat.com tflink@redhat.com
 mail_subject=Images that failed to build for Taskotron in ImageFactory on {{deployment_type}}
 smtp_server=bastion.phx2.fedoraproject.org
 
+deployment_type={{deployment_type}}

roles/taskotron/ssl-taskotron/tasks/main.yml

@@ -20,12 +20,16 @@
 - name: generate rhel httpd ssl config
   template: src=ssl.conf.rhel.j2 dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
   when: is_rhel is defined
+  tags:
+  - httpd
   notify:
   - reload httpd
 
 - name: generate fedora httpd ssl config
   template: src=ssl.conf.j2 dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644
   when: is_fedora is defined
+  tags:
+  - httpd
   notify:
   - reload httpd
 

roles/taskotron/ssl-taskotron/templates/ssl.conf.j2

@@ -76,12 +76,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_ssl documentation for a complete list.
-SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Speed-optimized SSL Cipher configuration:
 #   If speed is your main concern (on busy HTTPS servers e.g.),

roles/taskotron/ssl-taskotron/templates/ssl.conf.rhel.j2

@@ -92,12 +92,12 @@ SSLEngine on
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
-SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
+SSLProtocol {{ ssl_protocols }}
 
 #   SSL Cipher Suite:
 # List the ciphers that the client is permitted to negotiate.
 # See the mod_ssl documentation for a complete list.
-SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
+SSLCipherSuite {{ ssl_ciphers }}
 
 #   Server Certificate:
 # Point SSLCertificateFile at a PEM encoded certificate.  If