Setup a convenience group to describe what qa-network boxes can send fedmsg messages to the prod bus.

inventory/inventory

@@ -695,6 +695,18 @@ wiki01.stg.phx2.fedoraproject.org
 wiki01.phx2.fedoraproject.org
 wiki02.phx2.fedoraproject.org
 
+
+# This is a convenience group listing the hosts that live on the QA network that
+# are allowed to send inbound fedmsg messages to our production fedmsg bus.
+# See also:
+# - inventory/group_vars/proxies for the iptables custom_rules list
+# - roles/fedmsg/base/templates/relay.py.j2
+[fedmsg-qa-network]
+retrace01.qa.fedoraproject.org
+retrace02.qa.fedoraproject.org
+s390-koji01.qa.fedoraproject.org
+
+
 # assorted categories of fedmsg services, for convenience
 [fedmsg-hubs:children]
 badges-backend

roles/fedmsg/base/templates/relay.py.j2

@@ -33,10 +33,10 @@ config = dict(
         # not getting messages in from proxies across the vpn.  So, only use
         # proxy01 for now.
         "tcp://209.132.181.16:9941",
-        {% elif 'retrace' in group_names %}
+        {% elif 'fedmsg-qa-network' in group_names %}
 
-        # We want the retrace boxes to talk to the *internal* IP of proxy01,
-        # because otherwise the RHIT firewall blocks them.
+        # We want the retrace (and other) boxes to talk to the *internal* IP of
+        # proxy01, because otherwise the RHIT firewall blocks them.
         "tcp://proxy01.phx2.fedoraproject.org:9941",
 
         {% else %}