= Fedora Bastion Hosts

== Contact Information

Owner::
  sysadmin-main
Contact::
  admin@fedoraproject.org
Location::
  rdu3
Servers::
  bastion01, bastion02
Purpose::
  background and description of bastion hosts and their unique issues.

== Description

There are 2 primary bastion hosts in the _rdu3_ datacenter. One will be
active at any given time and the second will be a hot spare, ready to
take over. Switching between bastion hosts is currently a manual process
that requires changes in ansible.

All of the bastion hosts have an external IP that is mapped into them.
The reverse dns for these IPs is controlled by RHIT, so any changes must
be carefully coordinated.

The active bastion host performs the following functions:

* Outgoing smtp from fedora servers. This includes email aliases,
mailing list posts, build and commit notices, mailing list posts, etc.

* Incoming smtp from servers in _rdu3_ or on the fedora vpn. Incoming mail
directly from the outside is NOT accepted or forwarded.

* ssh access to all _rdu3/vpn_ connected servers.

* openvpn hub. This is the hub that all vpn clients connect to and talk
to each other via. Taking down or stopping this service will be a major
outage of services as all proxy and app servers use the vpn to talk to
each other.

When rebuilding these machines, care must be taken to match up the dns
names externally, and to preserve the ssh host keys.