dbbf94a411
Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-*` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-*` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com>
57 lines
1.3 KiB
Text
57 lines
1.3 KiB
Text
---
|
|
# Define resources for this group of hosts here.
|
|
lvm_size: 30000
|
|
mem_size: 8192
|
|
max_mem_size: 8192
|
|
num_cpus: 4
|
|
|
|
deployment_type: prod
|
|
|
|
virt_install_command: "{{ virt_install_command_two_nic }}"
|
|
|
|
tcp_ports: [ 80 ]
|
|
fas_client_groups: sysadmin-noc,fi-apprentice,sysadmin-web,sysadmin-veteran
|
|
|
|
ipa_host_group: wiki
|
|
ipa_host_group_desc: Fedora Wiki
|
|
ipa_client_shell_groups:
|
|
- fi-apprentice
|
|
- sysadmin-noc
|
|
- sysadmin-veteran
|
|
- sysadmin-web
|
|
ipa_client_sudo_groups:
|
|
- sysadmin-noc
|
|
- sysadmin-veteran
|
|
- sysadmin-web
|
|
|
|
# mediawiki variables
|
|
wikiname: "fp"
|
|
wikipath: "wiki"
|
|
wpath: "w"
|
|
wikiver: "mediawiki"
|
|
|
|
# These are consumed by a task in roles/fedmsg/base/main.yml
|
|
fedmsg_certs:
|
|
- service: shell
|
|
owner: root
|
|
group: sysadmin
|
|
can_send:
|
|
- logger.log
|
|
- service: mediawiki
|
|
owner: root
|
|
group: apache
|
|
can_send:
|
|
- wiki.article.edit
|
|
- wiki.upload.complete
|
|
|
|
nfs_mount_opts: "rw,hard,bg,intr,noatime,nodev,nosuid,sec=sys,nfsvers=3"
|
|
|
|
csi_security_category: Moderate
|
|
csi_primary_contact: "#fedora-admin"
|
|
csi_purpose: Provides our wiki
|
|
csi_relationship: |
|
|
- There are multiple servers that this service requires. All proxy servers and Wiki 1 and 2.
|
|
- Wiki requires the proxy servers in order for traffic to pass to them
|
|
- If the Apache processes stop on wiki01 and wiki02 the wiki will not display
|
|
- The wiki also requires fas for log in purposes
|
|
|