Commit graph

921 commits

Author SHA1 Message Date
Kevin Fenzi
82d725ccb8 dnf-automatic: apply a tag to easily run this role by itself
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-08-26 14:18:22 -07:00
Kevin Fenzi
5a3851a187 krb5.conf template: also include from normal include dir
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-08-13 13:42:07 -07:00
James Antill
dc56eb16c8 Fix % to \% for cron CMD format.
Signed-off-by: James Antill <james@and.org>
2024-07-19 19:11:36 +00:00
James Antill
602723ed45 Compress fedora_stats *.log files automatically with xz.
Signed-off-by: James Antill <james@and.org>
2024-07-17 19:17:40 +00:00
Stephen Smoogen
432a3a497b Go through and remove entries for EL6 and EL7
Using `git grep el6` and `git grep el7` and variants like EL-7 or
el-7, I found various entries and files which were no longer needed
with the current ansible. I updated text or tests to later versions of
RHEL as needed.

found entries for the fedora ami's for the original cloud and removed
those entries also.

Signed-off-by: Stephen Smoogen <ssmoogen@redhat.com>
2024-07-03 22:20:30 +00:00
Michal Konecny
61330941e4 [base/postfix] Set the missing required configuration value
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-27 14:55:31 +02:00
Michal Konecny
40c0408acd [base/postfix] Redirect back to mx1.redhat.com relay
The firewall rules are now updated.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-20 13:20:42 +02:00
Michal Konecny
c775045ede [base/postfix] Change the relay to something that is still in RDU 2
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-18 17:06:39 +02:00
Michal Konecny
2ff451ae80 [base/postfix] Use smtp.corp.redhat.com instead mxX.redhat.com servers
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-18 16:53:12 +02:00
Michal Konecny
649ede2f89 [base/postfix] Change the Red Hat relay to mx1.redhat.com
The relay changed the IP it points to, let's try this and see if that helps.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-18 16:17:15 +02:00
Michal Konecny
c3a169c08e [postfix] Move destinations to staging mailman configuration
Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-10 14:26:38 +02:00
Michal Konecny
438979a996 [postfix] Add mailman staging lists
I followed the instruction from
https://pagure.io/fedora-infrastructure/issue/8455#comment-913675, but this is
my first time I actually doing anything in postfix configuration, so I'm not
sure if everything I did is correct.

The SMTP port on the machine seems to be open according to group_vars for the
mailman_stg.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-06-10 14:25:30 +02:00
Kevin Fenzi
77cee07ef0 base / iptables: fix format for releng and builder machines
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-05-06 17:26:08 -07:00
Adam Williamson
8b9778777b iptables: correct invalid syntax in nat table
This `[0:]` syntax doesn't seem to be correct. iptables 1.8.10
errors out on encountering it, saying:

invalid policy counters for chain 'PREROUTING'

this seems to be because the check was tightened between 1.8.9
and 1.8.10 to apply even when iptables is not actively restoring
the counters:
https://git.netfilter.org/iptables/commit/?id=4a2b2008fdf4df980433f99a6d8f2003f2005296

I think these are all meant to be 0:0, so let's make them that
and stop iptables choking.

Signed-off-by: Adam Williamson <awilliam@redhat.com>
2024-04-24 13:00:51 -07:00
Andrew Heath
74e536d639 Update Rsyslog.conf file
Update Rsyslog config file to use the Splunk LB for rsyslog rather than
one single host.
2024-04-03 22:00:38 +00:00
Kevin Fenzi
4a6cb460ca buildvm_s390x in boston: retire
We have moved over to the rdu mainframe, drop all the bos kvm hosts.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-02-27 08:33:41 -08:00
Kevin Fenzi
334219e706 buildvm-s390x: move rest of old zvm builders to rdu and kvm
We want to move (well, really re-install) all these over on the new lpar
in rdu. This will have much higher stats and be in general faster by
both network and cpu. Hopefully all these will replace all the old
boston ones.

We may need to break these up some more into smaller vm's if the number
isn't able to keep up ok. We can adjust after things are all working.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-02-21 09:51:24 -08:00
Kevin Fenzi
1c4408ebe5 buildvm-s390x-14: move to rdu and setup as new varnish cache
Lets move this vm over to rdu, and set it up as a new varnish cache.
This way we can test 01 doing builds before moving others.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-02-20 17:38:34 -08:00
6f949fe3eb
rsyslog: comment out splunk receiver to unblock rsyslog
Splunk receiver seems unresponsive since Feb 12 and result in rsyslog on
log01 to stop logging.
I disabled it for now so we don't loose more logs.
2024-02-15 19:11:29 +01:00
David Kirwan
7d63531b82
zabbix: ensure zabbix can communicate with releng machines
Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>
2024-02-09 13:04:46 +00:00
Kevin Fenzi
dd12a25400 logrotate: this has to replace the rsyslog file, not add rsyslog-logroate
Missed this in review, but if we do this it causes logrotate to error
out because there's a rsyslog and a rsyslog-logrotate files with the
same log files mentioned. So, we need to just replace the stock rsyslog
file and not use the ryslog-logrotate one. ;)

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2024-01-17 08:47:07 -08:00
Michal Konecny
b502cbbc19 [base] Fix proxy playbook
https://pagure.io/fedora-infra/ansible/pull-request/1718 introduced failure when
running proxies ansible playbook, this commit should fix that.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2024-01-16 10:42:27 +01:00
Andrew Heath
f97666a75d Add logrotate for proxy systems
Added rsyslog logrotate cong for proxy systems and a task land the
configs as well as fix some yamllint errors.
2024-01-15 09:55:20 +00:00
Kevin Fenzi
5fd49a0b20 smtp-mm: reject unauth pipelining.
This should reject broken pipelining attempts.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-12-24 10:15:27 -08:00
David Kirwan
beb09a8835
zabbix: debugging iptables config
- add zabbix agent to RabbitMQ hosts

Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>
2023-12-04 07:01:22 +00:00
Michal Konecny
df9d9a0d51 [IPA] Use ipa_server variable where posible
Don't use hardcoded ipa01, use ipa_server variable instead that is set in group_vars.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
2023-11-29 17:29:15 +01:00
David Kirwan
369ae4f66e
zabbix: Add zabbix01 production to iptable rules
Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>
2023-11-28 08:54:13 +00:00
Kevin Fenzi
e8a7d63a5e base: run update with force to make sure its setup right
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-11-27 13:30:56 -08:00
Kevin Fenzi
4cd2c924c3 smtp-auth: actually install the master.cf file too
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-11-15 17:51:16 -08:00
Kevin Fenzi
ddd0913262 smtp-auth: rename this to explicit hostname
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-11-15 17:48:24 -08:00
Michael Scherer
bdd76ae138 Add master.cf with submission enabled
Copied from base master.cf, fix #11623
2023-11-16 01:38:59 +00:00
Andrew Heath
7260701e59 Remove unessary settings for Spunk Setup 2023-11-08 23:28:57 +00:00
Kevin Fenzi
11d2a789ba log01: bump queue size for splunk backlog
I'm pushing this during freeze as it's required to avoid an outage of
our logs. For some reason we hit a large backlog and log01 rsyslog
stopped logging. Bumping this up seems to have fixed it.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-09-15 10:39:06 -07:00
Andrew Heath
02046fdc0c Enable Splunk log fowarding 2023-08-21 17:36:17 -04:00
Kevin Fenzi
590819397c blocklist: drop output for now until I can sort out why its outputting anything
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 18:18:51 -07:00
Kevin Fenzi
3200014f8f base / blocklist: use bool filter
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 16:15:44 -07:00
Kevin Fenzi
a57c71a170 base: tag blocklist
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 15:36:15 -07:00
Kevin Fenzi
623c0f45bd base / iptables: rework how this blocklist works
Just rip out the parts here as they are no longer needed.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 12:41:54 -07:00
Kevin Fenzi
e524963387 iptables: fix conditional
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 12:23:08 -07:00
Kevin Fenzi
5936815f75 iptables / staging: more adjusting
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 12:18:21 -07:00
Kevin Fenzi
363af73e57 iptables / staging: fix the actual used template
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 12:11:22 -07:00
Kevin Fenzi
6ada4829fa base / iptables: simplify conditional even more to perhaps actually work
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 12:05:59 -07:00
Kevin Fenzi
fcd3e67484 base / iptables: simplify conditional to perhaps actually work
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-08-15 12:02:49 -07:00
Kevin Fenzi
4527510448 log01: compress job: try escaping the %s for cron
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-07-17 16:31:12 -07:00
Kevin Fenzi
b7cecd3deb gateway: do not try and specify a local_recipient_maps
This map wasn't there, causing bastion02 to basically reject emails.
So, instead just comment it out because we aren't using it anyhow.
We are luckly bastion01's postfix hasn't been restarted and breaking it
there.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-07-17 11:19:28 -07:00
David Kirwan
a9a14a4023 zabbix: modify db tasks zabbix_server role
error handling
Update iptables to allow access to server/agent

Signed-off-by: David Kirwan <dkirwan@redhat.com>
2023-06-30 12:00:33 +01:00
Stephen Smoogen
19b500a5fd Remove chunking error messages in gateway systems
RHEL turned off chunking in postfix for various reasons. This causes a
lot of logs from spam and other servers. Turning off logging this as
it is not supported.

Signed-off-by: Stephen Smoogen <ssmoogen@redhat.com>
2023-06-29 20:09:57 +00:00
Kevin Fenzi
0fb53e0fba base: only compress logs on log01, not everything
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-06-27 08:31:31 -07:00
Kevin Fenzi
e06db2465a base / iptables: fix last conditional
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-06-26 13:27:06 -07:00
Kevin Fenzi
f1eaa5d773 base / iptables: simplify logic
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
2023-06-26 13:23:38 -07:00