infrastructure/ansible
1
0
Fork 0
Code Pull requests 7 Activity Actions

osbs: use no-cdn registry

Browse source 
Signed-off-by: Clement Verna <cverna@tutanota.com>
This commit is contained in:
Clement Verna 2020-07-09 10:28:46 +02:00
parent 9c4ce2545b
commit 98187ea922
2 changed files with 6 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

14
files/osbs/fix-docker-iptables.production
View file

@ -29,15 +29,11 @@ iptables -A FILTER_FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FILTER_FORWARD --src 10.1.0.0/16 --dst 10.1.0.0/16 -j ACCEPT
# Now insert access to allowed boxes
# docker-registry aws cdn
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.34 --dport 80 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.23 --dport 80 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.73 --dport 80 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.88 --dport 80 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.34 --dport 443 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.23 --dport 443 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.73 --dport 443 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 54.230.74.88 --dport 443 -j ACCEPT
# docker-registry no cdn
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.3.169.119 --dport 80 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.3.169.127 --dport 80 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.3.169.119 --dport 443 -j ACCEPT
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.3.169.127 --dport 443 -j ACCEPT
# Candidate registry
iptables -A FILTER_FORWARD -p tcp -m tcp -d 10.3.169.102 --dport 80 -j ACCEPT

2
inventory/group_vars/osbs_masters
View file

@ -10,7 +10,7 @@ fas_client_groups: sysadmin-releng,fi-apprentice,sysadmin-noc,sysadmin-veteran,s
sudoers: "{{ private }}/files/sudo/osbs-sudoers"
docker_cert_dir: "/etc/docker/certs.d/candidate-registry.fedoraproject.org"
source_registry: "registry.fedoraproject.org"
source_registry: "registry-no-cdn.fedoraproject.org"
docker_registry: "candidate-registry.fedoraproject.org"
osbs_url: "osbs.fedoraproject.org"