Commit graph

959 commits

Author SHA1 Message Date
James Antill
50d04f6e95 Remove nftables cron and disable service, when using iptables (for backout).
Signed-off-by: James Antill <james@and.org>
2025-04-11 00:33:11 +00:00
Kevin Fenzi
b9eb773848 ipsilon: change crypto policy back to default
Since https://pagure.io/fedora-infrastructure/issue/12321
is fixed on the bugzilla side, we should be able to move back
to using DEFAULT.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-03-19 20:39:56 +00:00
Kevin Fenzi
17c8094c2f log01 / rsyslog / splunk: adjust ip again as the previous one was not desired
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-03-12 14:20:27 -07:00
Andrew Heath
d616fa6c6c Update Splunk syslog address
Update Splunk syslog address per Red Hat's Monitoring and Loging team.
The old address will be decomed in about a week per their
communications.
2025-03-11 18:30:47 +00:00
James Antill
69911c5d72 Enable IPv6 nftables.
Signed-off-by: James Antill <james@and.org>
2025-03-04 14:31:54 -05:00
James Antill
e83b42b572 Remove iptables cron and stop/disable services, when using nftables.
Signed-off-by: James Antill <james@and.org>
2025-03-04 14:14:37 -05:00
James Antill
ca18224faa Change osbuildapi set table to the ip filter table.
Signed-off-by: James Antill <james@and.org>
2025-03-03 17:08:20 -05:00
James Antill
224d98cbb0 Remove typo from kojibuilder nftables template.
Signed-off-by: James Antill <james@and.org>
2025-03-03 16:52:02 -05:00
James Antill
4fac049b6a Actually install the nftable template file.
Signed-off-by: James Antill <james@and.org>
2025-03-03 21:20:30 +00:00
James Antill
31d65aa439 Actually move to nftables for any host with nftables: true (nothing atm).
Signed-off-by: James Antill <jantill@redhat.com>
2025-03-03 21:20:30 +00:00
Michal Konecny
6428f8f772 Sunset github2fedmsg and fedmsg
This commit is removing all the fedmsg related stuff from ansible
repository.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2025-02-13 10:08:51 +00:00
Kevin Fenzi
de84b616f6 riscv-koji: setup correct krb5.conf for the hub
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-02-11 11:07:53 -08:00
Michal Konecny
2ec055db6f Use first uppercase letter for all handlers
This will unify all the handlers to use first uppercase letter for
ansible-lint to stop complaining.

I went through all `notify:` occurrences and fixed them by running
```
set TEXT "text_to_replace"; set REPLACEMENT "replacement_text"; git grep
-rlz "$TEXT" . | xargs -0 sed -i "s/$TEXT/$REPLACEMENT/g"
```

Then I went through all the changes and removed the ones that wasn't
expected to be changed.

Fixes https://pagure.io/fedora-infrastructure/issue/12391

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2025-02-10 20:31:49 +00:00
Michal Konecny
7b58dfdce8 Remove fedmsg and github2fedmsg from staging
The messaging bridges openshift project and github2fedmsg VM were
already removed in staging. This is to clean the ansible playbooks.

I will create a separate one for production after this one is merged.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2025-02-04 09:13:40 +01:00
Kevin Fenzi
77fe8423e0 base: drop system_identification
We don't need or want this anymore since CSI is gone/dead.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-01-28 10:49:57 -08:00
iamyaash
b3d6a90b9a motd generic template added
migrated notes from infra/hosts

motd changes; excluding CSI infos

removed csi_* vars from group_vars; converted csi_purpose & csi_relationship into notes

fixed merge conflicts

minor changes; var

updating YAMLs & playbooks

udpated YAMLs & playbooks again

updated correctly; buildhw.yml

fixing merge conflicts

dest added in motd.yml
2025-01-28 01:10:14 +00:00
Kevin Fenzi
759ee55f18 bastion: fix delivering non contributors emails locally
Should fix:
https://pagure.io/fedora-infrastructure/issue/12361

Basically postfix default is:
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
so if the user is a local user or an alias, it's valid.
However, sssd and ipa show all users (even ones with no
access to that host). This means we were accepting and delivering
(locally) emails for anyuser@fedoraproject.org.

Setting this to just $alias_maps will just treat aliases as valid
and ignore all the local users. This should be fine as we use
aliases to send even to root or other system users.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-01-17 15:31:21 -08:00
Kevin Fenzi
e196958322 base: fix another handler case
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-01-16 14:52:49 -08:00
Kevin Fenzi
1e77199920 base: fix more handler renaming issues
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2025-01-16 14:44:00 -08:00
James Antill
80aa4bbbc2 Initial version of iptables to nftables conversion. 2025-01-16 11:28:24 -05:00
47c68f478d ansiblelint fixes - fqcn[action-core] - template to ansible.builtin.template
Replaces references to template: with ansible.builtin.template

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:30:29 +10:00
3c41882bb0 ansiblelint fixes - fqcn[action-core] - shell to ansible.builtin.shell
Replaces references to shell: with ansible.builtin.shell

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:29:10 +10:00
25391e95b7 ansiblelint fixes - fqcn[action-core] - package to ansible.builtin.package
Replaces many references to  package: with ansible.builtin.package

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:28:00 +10:00
462176464b ansiblelint fixes-- fqcn[action-core] - command to ansible.builtin.command
Replaces many references to  command: with ansible.builtin.command

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 11:26:47 +10:00
6a3816dfdc ansiblelint fixes-- fqcn[action-core] - copy to ansible.builtin.copy
Replaces many references to 'copy' with ansible.builtin.copy

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 10:43:31 +10:00
62952df107 ansiblelint fixes-- fqcn[action-core] - file to ansible.builtin.file
Replaces many references to  file: with ansible.builtin.file

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-15 10:41:52 +10:00
691adee6ee Fix name[casing] ansible-lint issues
fix 1900 failures of the following case issue:

`name[casing]: All names should start with an uppercase letter.`

Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:20:07 +10:00
Kevin Fenzi
6743920113 crypto-policies: fix copypasta for ipsilon servers
Looks like this conditional was copied and I failed to update the name.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-12-15 10:28:34 -08:00
Kevin Fenzi
c11d415d86 crypto-policies / ipsilon: set policy to FEDORA40 on ipsilon servers
We need this policy to get bugzilla SAML2 auth working (for now)
See https://pagure.io/fedora-infrastructure/issue/12321

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-12-13 10:29:42 -08:00
Pavel Raiskup
501b5ce8de copr: skip the base's rootpw settings 2024-11-29 18:51:16 +01:00
89f6f1fc32 Fix majority of remaining yamllint warnings and errors
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2024-11-28 17:31:45 +10:00
Kevin Fenzi
43fa9928d6 dns: adjust crypto policy to be idempotent
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-10-13 10:30:51 -07:00
Kevin Fenzi
a018c15c33 dns: all nameservers are rhel9 now
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-10-13 09:44:13 -07:00
Kevin Fenzi
6356a6be83 bastion / iptables: fix network
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-09-25 07:34:08 -07:00
Kevin Fenzi
79f3af4e58 bastion: allow s390x builders/virthost smtp access
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-09-25 07:29:02 -07:00
Kevin Fenzi
f72ff64029 bastion / iptables: Add internal RH mxes and drop global allow
We want to allow internal mx'es to send us email still.
We want to drop the global allow for port 25 now that we hopefully have
all the legit senders listed.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-09-24 10:55:20 -07:00
Kevin Fenzi
06a28bf516 bastion: iptables: fix copypasta
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-09-24 10:48:32 -07:00
Kevin Fenzi
42cae5591f bastion: adjust smtp firewall rules for mimecast
Setup things so we accept smtp connections from all the places we
currently do, but also from mimecast as incoming emails may come via
that. We don't want to globally allow everyone to inject emails here.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-09-24 10:36:47 -07:00
Kevin Fenzi
82d725ccb8 dnf-automatic: apply a tag to easily run this role by itself
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-08-26 14:18:22 -07:00
Kevin Fenzi
5a3851a187 krb5.conf template: also include from normal include dir
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-08-13 13:42:07 -07:00
James Antill
dc56eb16c8 Fix % to \% for cron CMD format.
Signed-off-by: James Antill <james@and.org>
2024-07-19 19:11:36 +00:00
James Antill
602723ed45 Compress fedora_stats *.log files automatically with xz.
Signed-off-by: James Antill <james@and.org>
2024-07-17 19:17:40 +00:00
Stephen Smoogen
432a3a497b Go through and remove entries for EL6 and EL7
Using `git grep el6` and `git grep el7` and variants like EL-7 or
el-7, I found various entries and files which were no longer needed
with the current ansible. I updated text or tests to later versions of
RHEL as needed.

found entries for the fedora ami's for the original cloud and removed
those entries also.

Signed-off-by: Stephen Smoogen <ssmoogen@redhat.com>
2024-07-03 22:20:30 +00:00
Michal Konecny
61330941e4 [base/postfix] Set the missing required configuration value
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-27 14:55:31 +02:00
Michal Konecny
40c0408acd [base/postfix] Redirect back to mx1.redhat.com relay
The firewall rules are now updated.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-20 13:20:42 +02:00
Michal Konecny
c775045ede [base/postfix] Change the relay to something that is still in RDU 2
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-18 17:06:39 +02:00
Michal Konecny
2ff451ae80 [base/postfix] Use smtp.corp.redhat.com instead mxX.redhat.com servers
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-18 16:53:12 +02:00
Michal Konecny
649ede2f89 [base/postfix] Change the Red Hat relay to mx1.redhat.com
The relay changed the IP it points to, let's try this and see if that helps.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-18 16:17:15 +02:00
Michal Konecny
c3a169c08e [postfix] Move destinations to staging mailman configuration
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-10 14:26:38 +02:00
Michal Konecny
438979a996 [postfix] Add mailman staging lists
I followed the instruction from
https://pagure.io/fedora-infrastructure/issue/8455#comment-913675, but this is
my first time I actually doing anything in postfix configuration, so I'm not
sure if everything I did is correct.

The SMTP port on the machine seems to be open according to group_vars for the
mailman_stg.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-10 14:25:30 +02:00