dbbf94a411
Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-*` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-*` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com>
78 lines
2 KiB
Text
78 lines
2 KiB
Text
---
|
|
# Define resources for this group of hosts here.
|
|
lvm_size: 20000
|
|
mem_size: 4096
|
|
num_cpus: 1
|
|
|
|
# Definining these vars has a number of effects
|
|
# 1) mod_wsgi is configured to use the vars for its own setup
|
|
# 2) iptables opens enough ports for all threads for fedmsg
|
|
# 3) roles/fedmsg/base/ declares enough fedmsg endpoints for all threads
|
|
wsgi_fedmsg_service: github2fedmsg
|
|
wsgi_procs: 2
|
|
wsgi_threads: 2
|
|
|
|
tcp_ports: [ 80 ]
|
|
|
|
# Neeed for rsync from log01 for logs.
|
|
custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.5.126.13 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT' ]
|
|
|
|
ipa_host_group: github2fedmsg
|
|
ipa_host_group_desc: Bridge select GitHub repo events into bus messages
|
|
ipa_client_shell_groups:
|
|
- sysadmin-noc
|
|
- sysadmin-veteran
|
|
ipa_client_sudo_groups:
|
|
- sysadmin-noc
|
|
- sysadmin-veteran
|
|
|
|
# for fedora-messaging
|
|
username: "github2fedmsg{{ env_suffix }}"
|
|
deployment_type: stg
|
|
|
|
# These are consumed by a task in roles/fedmsg/base/main.yml
|
|
fedmsg_certs:
|
|
- service: shell
|
|
owner: root
|
|
group: sysadmin
|
|
can_send:
|
|
- logger.log
|
|
- service: github2fedmsg
|
|
owner: root
|
|
group: apache
|
|
can_send:
|
|
- github.commit_comment
|
|
- github.create
|
|
- github.delete
|
|
- github.fork
|
|
- github.gollum
|
|
- github.issue.assigned
|
|
- github.issue.closed
|
|
- github.issue.comment
|
|
- github.issue.edited
|
|
- github.issue.labeled
|
|
- github.issue.milestone
|
|
- github.issue.opened
|
|
- github.issue.reopened
|
|
- github.issue.unassigned
|
|
- github.issue.unlabeled
|
|
- github.label
|
|
- github.member
|
|
- github.page_build
|
|
- github.pull_request.assigned
|
|
- github.pull_request.closed
|
|
- github.pull_request.edited
|
|
- github.pull_request.labeled
|
|
- github.pull_request.opened
|
|
- github.pull_request_review
|
|
- github.pull_request_review_comment
|
|
- github.pull_request.review_requested
|
|
- github.pull_request.synchronize
|
|
- github.pull_request.unlabeled
|
|
- github.push
|
|
- github.release
|
|
- github.repository_vulnerability_alert
|
|
- github.star
|
|
- github.status
|
|
- github.team_add
|
|
- github.webhook
|