2021-07-26 10:39:47 +02:00
|
|
|
= Fedora Bastion Hosts
|
|
|
|
|
|
2021-08-17 14:45:42 +02:00
|
|
|
== Contact Information
|
|
|
|
|
|
|
|
|
|
Owner::
|
|
|
|
|
sysadmin-main
|
|
|
|
|
Contact::
|
|
|
|
|
admin@fedoraproject.org
|
|
|
|
|
Location::
|
2025-07-04 11:55:02 +02:00
|
|
|
rdu3
|
2021-08-17 14:45:42 +02:00
|
|
|
Servers::
|
|
|
|
|
bastion01, bastion02
|
|
|
|
|
Purpose::
|
|
|
|
|
background and description of bastion hosts and their unique issues.
|
|
|
|
|
|
2021-07-26 10:39:47 +02:00
|
|
|
== Description
|
|
|
|
|
|
2025-07-04 11:55:02 +02:00
|
|
|
There are 2 primary bastion hosts in the _rdu3_ datacenter. One will be
|
2021-07-26 10:39:47 +02:00
|
|
|
active at any given time and the second will be a hot spare, ready to
|
|
|
|
|
take over. Switching between bastion hosts is currently a manual process
|
|
|
|
|
that requires changes in ansible.
|
|
|
|
|
|
|
|
|
|
All of the bastion hosts have an external IP that is mapped into them.
|
|
|
|
|
The reverse dns for these IPs is controlled by RHIT, so any changes must
|
|
|
|
|
be carefully coordinated.
|
|
|
|
|
|
|
|
|
|
The active bastion host performs the following functions:
|
|
|
|
|
|
|
|
|
|
* Outgoing smtp from fedora servers. This includes email aliases,
|
|
|
|
|
mailing list posts, build and commit notices, mailing list posts, etc.
|
2021-08-17 14:45:42 +02:00
|
|
|
|
2025-07-04 11:55:02 +02:00
|
|
|
* Incoming smtp from servers in _rdu3_ or on the fedora vpn. Incoming mail
|
2021-07-26 10:39:47 +02:00
|
|
|
directly from the outside is NOT accepted or forwarded.
|
2021-08-17 14:45:42 +02:00
|
|
|
|
2025-07-04 11:55:02 +02:00
|
|
|
* ssh access to all _rdu3/vpn_ connected servers.
|
2021-08-17 14:45:42 +02:00
|
|
|
|
2021-07-26 10:39:47 +02:00
|
|
|
* openvpn hub. This is the hub that all vpn clients connect to and talk
|
|
|
|
|
to each other via. Taking down or stopping this service will be a major
|
|
|
|
|
outage of services as all proxy and app servers use the vpn to talk to
|
|
|
|
|
each other.
|
|
|
|
|
|
|
|
|
|
When rebuilding these machines, care must be taken to match up the dns
|
|
|
|
|
names externally, and to preserve the ssh host keys.
|
