May 2013 - infrastructure - Fedora mailing-lists

Anonymized access log from a fedora mirror
by Lukas Zapletal 06 Dec '13

06 Dec '13

Hello, I have two students interested in diploma thesis called Yum plugin for suggesting packages based on usage: http://bit.ly/18hrHbL TL;DR - from anonymized access log, create a database of suggested packages using data mining techniques and provide a Yum plugin that would suggest "Users of vim also installed: ctags, git, ..." I am gonna create a Fedora Feature wiki page shortly describing this in more detail. Our goal is to offer this project for integration into Fedora later on, at least provide Fedora packages for it. To do that, we need good source of data. It would be best to collect access logs from one or two main Fedora mirrors. We would provide short script in Python that would parse access logs and anonymize the data (IP address hash-salted) and filtered only relevant data (RPM files from latest Fedora release or updates repositories). That would be phase one which should give us a sample data. Phase two would be to integrate this script with logrotate and for one Fedora release cycle (Fedora 19) the script would collect relevant anonymized data into a file. Final suggested package database would be created from this file (or maybe files to allow us to move them on the fly out of the stat directory). The big (legal) question is if we are able to provide this anonymized data to public, or if we want to sign NDA with all people involved. I am CCing Tom for this question. I need your help with connecting to relevant people. Any comments are appreciated. Many thanks and I hope this effort will lead to improving user experience with Fedora packaging. -- Later, Lukas "lzap" Zapletal irc: lzap #theforeman

7 15

Plan for tomorrow's Fedora infrastructure meeting (2013-05-30)
by Kevin Fenzi 30 May '13

30 May '13

The infrastructure team will be having it's weekly meeting tomorrow, 2013-05-30 at 19:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Private Cloud status update / discussion #topic Upcoming Tasks/Items https://apps.fedoraproject.org/calendar/list/infrastructure/ #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

areas where we can invest in automation?
by Matthew Miller 30 May '13

30 May '13

I was asked (with my Red Hat hat on) to put together a little report on areas in Fedora which could be improved with an investment in better automation. From what I'm working on myself, I'm aware of the gigantic need in the cloud images production process, and I've been keeping an eye on Tim Flink's autoqa revamp ideas. I expect there are others, because I know from my previous jobs that there's always a balance between building condiment-passing machines and just _passing the salt_. [1] Are there other things which could be made better if only someone came up with the spare time and resources to do the work? 1. http://xkcd.com/974/ -- Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ <mattdm(a)fedoraproject.org>

8 9

Meeting Agenda Item: Introduction David Billsbrough
by David Billsbrough 29 May '13

29 May '13

Hello, IRC handle: kc4zvw I have been using Linux since Redhat 4 and am a contractor that does Linux admin work for a large aerospace company. Can write scripts in Bash, Python and Ruby. Have installed a copy of Fedora 18 on a dedicated machine to learn and work on embedded controller projects. regards, David -- David Billsbrough (KC4ZVW) Chuluota, Florida Grid Loc: EL98kp Web: http://www.kc4zvw.us --- Blog: http://kc4zvw.wordpress.com AMSAT * AVR * FreeBSD * Linux * PICmicro * QRP * Raspi * TAPR

1 0

Fedora 19 Beta Freeze in effect.
by Kevin Fenzi 29 May '13

29 May '13

Greetings. we are now in the infrastructure freeze leading up to the Fedora 19 Beta release. This is a pre-release freeze. You can see a list of hosts that do not freeze by checking out the ansible repo and running the freezelist script: git clone http://infrastructure.fedoraproject.org/infra/ansible.git scripts/freezelist -i inventory/inventory Anything listed as freezes is frozen until 2013-05-28 (or later if Beta slips). Frozen hosts should have no changes made to them without a signoff on the change from at least 2 sysadmin-main or rel-eng members. Thanks, kevin

1 1

Cron the fedora-owner-change?
by Pierre-Yves Chibon 28 May '13

28 May '13

Hi all, Yesterday I announced an idea that I've had of using datagrepper to announce package ownership changes [1]. The feedback seem positive, so I change the script [2] to send the email directly, so basically we can run it via a cron job easily. Do we want to have this script as a cron job in the infrastructure? All it needs to run is argparse and requests. The following question is how often should the cron run, this is opened for discussion. Regards, Pierre [1] http://lists.fedoraproject.org/pipermail/devel/2013-May/182783.html

2 4

Observed Advantages to using Github?
by Tim Flink 28 May '13

28 May '13

As I recall, one of the claimed advantages of using github over fedorahosted is the ease with which people can submit code - the idea being that new contributors are more likely to have a github account than a FAS account. I'm curious whether anyone has observed an uptick in external contributions since the switch over to github, does anyone have any numbers or opinions on that? Tim

2 1

[PATCH] Change fama to go to herlo
by Nick Bebout 26 May '13

26 May '13

From: Nick Bebout <nb(a)lockbox01.phx2.fedoraproject.org> --- configs/system/smtp/aliases.template.erb | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configs/system/smtp/aliases.template.erb b/configs/system/smtp/aliases.template.erb index 156fc33..da64b6a 100644 --- a/configs/system/smtp/aliases.template.erb +++ b/configs/system/smtp/aliases.template.erb @@ -215,7 +215,7 @@ press: chair, kbakis(a)redhat.com, rsuehle, aeusebio(a)redhat.com fedorarewards: famsco(a)lists.fedoraproject.org openvideo: tchung freemedia: tchung,susmit -fama: susmit,jsimon,fab +fama: herlo # Firstname.lastname exceptions (preferrably only for people with a good reason) # History: these are people wishing to keep their firstname.lastname email -- 1.7.2.1

1 0

Freeze break request
by Jason L Tibbitts III 24 May '13

24 May '13

Please forgive me if this isn't the right format for this request; it's been a long time since I've done one of these. I need to push the following change to the review-stats code through puppet: diff --git a/modules/review-stats/files/review-stats.py b/modules/review-stats/files/review-stats.py index 2c59752..e494168 100755 --- a/modules/review-stats/files/review-stats.py +++ b/modules/review-stats/files/review-stats.py @@ -205,7 +205,7 @@ def run_query(bz): bugdata[bug.id]['hidden'] = 1 # Get the status of each "interesting" bug - for i in seq_max_split(alldeps, 500): + for i in seq_max_split(alldeps, 100): for bug in filter(None, bz._proxy.Bug.get_bugs({'ids':i, 'permissive': 1})['bugs']): interesting[bug['id']] = bug RHBugzilla is pretty broken right now, and I'm working on fixing this code upstream in a better way which I will push once we unfreeze, but this is the minimal fix that appears to at least get the script to complete without throwing proxy errors. It takes ages to run but it does eventually finish. - J<

3 5

Freeze break: clean up logs on db01
by Kevin Fenzi 24 May '13

24 May '13

db01 is low on disk space again. This is due to us keeping transaction logs for a long long time. I would like to delete jan and feb transaction logs to free up space for now. After the freeze, we should fix this with a proper tmpwatch setup. +1s? kevin

3 2

Freeze break request: move staging improvements to production for askbot
by Ankur Sinha 23 May '13

23 May '13

Hi, We've tested a couple of things on the askbot staging instance that I think could really improve the performance of askfedora: 1. Use python-django-post_office as email back end[1]: We run a cron job to send out mails periodically using post-office asynchronously. This reduces the delay in comment posting and operations quite a bit. 2. Send periodic reminders to request people to accept the best answer for questions they've asked.[2] This should hopefully reduce the number of "unanswered" questions on the forum, specially questions that have been answered but no answer accepted. The changes are minor ones and could wait for the freeze to finish, but I expect them to improve usability quite a bit. What do you folks think? [1] https://fedorahosted.org/fedora-infrastructure/ticket/3763 [2] https://fedorahosted.org/fedora-infrastructure/ticket/3762 Apart from the puppet changes below, the ask production database will have to be updated to include python-post-office as explained here[3]. [3] https://pypi.python.org/pypi/django-post_office Puppet changes: diff --git a/modules/askbot/manifests/init.pp b/modules/askbot/manifests/init.pp index 98afdb0..0c6e01e 100644 --- a/modules/askbot/manifests/init.pp +++ b/modules/askbot/manifests/init.pp @@ -26,11 +26,8 @@ class askbot { package { "python-psycopg2": ensure => present } - if $puppetEnvironment == 'staging' { - # cron job for reminders: #3762 - package { "django-post_office": - ensure => present - } + package { "django-post_office": + ensure => present } fedmsg::certificate { "askbot": service => "askbot", @@ -76,19 +73,17 @@ class askbot { target => '/usr/lib/python2.6/site-packages/askbot/static/admin/', } - if $puppetEnvironment == 'staging' { - file { "/etc/cron.d/cron-ask-send-reminders": - owner => "root", - group => "root", - mode => 0644, - source => "puppet:///askbot/cron-ask-send-reminders", - } - file { "/etc/cron.d/cron-post-office-send-mail": - owner => "root", - group => "root", - mode => 0644, - source => "puppet:///askbot/cron-post-office-send-mail" - } + file { "/etc/cron.d/cron-ask-send-reminders": + owner => "root", + group => "root", + mode => 0644, + source => "puppet:///askbot/cron-ask-send-reminders", + } + file { "/etc/cron.d/cron-post-office-send-mail": + owner => "root", + group => "root", + mode => 0644, + source => "puppet:///askbot/cron-post-office-send-mail" } exec { 'askbot_collectstatic': diff --git a/modules/askbot/templates/settings.erb b/modules/askbot/templates/settings.erb index f04615a..3dc543a 100644 --- a/modules/askbot/templates/settings.erb +++ b/modules/askbot/templates/settings.erb @@ -37,10 +37,7 @@ EMAIL_SUBJECT_PREFIX = '' EMAIL_HOST='bastion' EMAIL_PORT='25' EMAIL_USE_TLS=False -EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend' -<% if environment == "staging" %> EMAIL_BACKEND = 'post_office.EmailBackend' -<% end %> #incoming mail settings #after filling out these settings - please @@ -187,9 +184,7 @@ INSTALLED_APPS = ( #'followit', # 'avatar', #requires setting of MEDIA_ROOT and MEDIA_URL -<% if environment == "staging" %> 'post_office', -<% end %> ) MEDIA_ROOT='/var/lib/askbot/upfiles/ask' -- Thanks, Warm regards, Ankur: "FranciscoD" Please only print if necessary. Looking to contribute to Fedora? Look here: https://fedoraproject.org/wiki/Fedora_Join_SIG http://fedoraproject.org/wiki/User:Ankursinha http://ankursinha.in/blog

3 4

Plan for tomorrow's Fedora Infrastructure meeting (2013-05-23)
by Kevin Fenzi 23 May '13

23 May '13

The infrastructure team will be having it's weekly meeting tomorrow, 2013-05-23 at 19:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Private Cloud status update / discussion #topic Upcoming Tasks/Items #info 2013-05-14 to 2013-05-28 BETA infrastructure freeze #info 2013-05-28 F19 beta release #info 2013-05-31 end of 1st quarter #info 2013-06-01 nag fi-apprentices #info 2013-06-08 drop inactive apprentices #info 2013-06-18 to 2013-07-02 FINAL infrastructure freeze. #info 2013-07-01 nag fi-apprentices #info 2013-07-02 F19 FINAL release #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

freeze break request: mail alias fix
by Kevin Fenzi 22 May '13

22 May '13

Quick fix for a incorrect alias: diff --git a/configs/system/smtp/aliases.template.erb b/configs/system/smtp/aliases.template.erb index 2440f54..156fc33 100644 --- a/configs/system/smtp/aliases.template.erb +++ b/configs/system/smtp/aliases.template.erb @@ -144,8 +144,8 @@ fudcon-cfp: /dev/null fudcon-paper: fudcon-cfp # flock -flockpress: suehle,spot,rbergero -flockinfo: suehle,spot,rbergero +flockpress: rsuehle,spot,rbergero +flockinfo: rsuehle,spot,rbergero # News #news: nman64,pfrields,sundaram,tchung,kwade +1s? kevin

4 3

Freeze break request: mediawiki security upgrade
by Patrick マルタインアンドレアス Uiterwijk 22 May '13

22 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I would like to request +1's to upgrade mediawiki on our app servers to 1.19.7. This is a security upgrade only, and does NOT need any database schema modifications. There should be no downtime, as the upgrade is just "yum update mediawiki119 && service httpd restart". Regards, Patrick Uiterwijk -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBCgAGBQJRnRZEAAoJEIZXmA2atR5QyxsP/3WKA90S4NJuRufFhGB8zELR dLK3yJ5/xvpDAydxRHs8AyrBPy+0Br9PUBFJRQVf6iDtTwzZx6rJ9+o6yLyMRsj/ pDsboEoVDygVYjx8KJzkFp4lKWEkQD9IZgPUtd1SoLNt766gMBvLWw7Jpff2TleJ pCLTxArqXqcH5AvP7xd6rHIVVcGrkMmKLAdU/8Xzf6xwBMFv1HYuBKv1s3KcF+T2 tKx2w3X5ycAC1u6cCc3LsRsQOfll6arMGtVZ9P6KSikEA0x9Kptq9KKJ16fi8/Hx Ic2UBEI4lkCNq8XHHmpGDZPQ5OBPB5VSokx2Dz3V6D/JijY13z+vNQx0M+X4o4yo 0a0U2BNXnesAvnX8VOPHuZiBqgcPvug0RkY5ZjIJvr4XdoAKFimjY/P3+MfjxB9C HxCIzOfCJm5tE39kn8pYMa/pzLUP6+us8nbbZ+wDS8/+UhwwcZHnEFqOhG+l95PN 875/3IAKszEVBGrC/R4hTABqySUAfeQd75cFhgVekEqfAYPDZALtkZMt4a0NWHVS 8xgQ50fcvu2MHKRQQCmLm6YMnV4UYEoLg95WcoPe0W22nsY+/G1Ag3rDWALQ4EIe QnOiewDAhjdIFZzOm2YHklMgHGqizmnx6HJXdnGJV4sZVB+ZNlcxIntJheCgAZ+L 4EXGIFu5u6olIpZ0gWYS =BwMI -----END PGP SIGNATURE-----

3 4

Why Bodhi have not closed ticket when package was pushed to stable?
by Vít Ondruch 22 May '13

22 May '13

This [1] advisory was pushed into stable. Why Bodhi did not closed the associated ticket in BZ [2]? Thanks Vít [1] https://admin.fedoraproject.org/updates/FEDORA-2013-7282 [2] https://bugzilla.redhat.com/show_bug.cgi?id=947408

3 3

[Freeze break] Rewrite of bz-make-components.py
by Toshio Kuratomi 21 May '13

21 May '13

In infrastructure we have a script called bz-make-components.py that syncs the l10n and docs products (and owners) into bugzilla. This code is what the pkgdb-sync-bugzilla script is based on and performs a very similar function. However, the pkgdb-sync-bugzilla script has seen continuous updates over the years as the needs of syncing our 13K packages into bugzilla have demanded we do things more and more efficiently. The bz-make-components script, in the meantime, has puttered along without breaking so we've largely gotten to ignore it. Unfortunately, the last bugzilla update has changed the xmlrpc api enough that the script is pretty thoroughly broken. Some functions have been replaced (actually pretty easy to update) and the parameters and return values for the xmlrpc functions have changed (a real pain to sift through). After spending a small amount of time attempting to port this old code to the newer API, I decided it would be easier to rewrite it to use the pkgdb-sync-bugzilla routines to talk to bugzilla and only keep the owners.list parsing code from the old bz-make-components script. This is a pretty major rewrite but the code seems to work. Here's the major changes: * The new script uses python-bugzilla. The old one talked to the bugzilla xmlrpc interface directly. * bz-make-components now uses a config file. This means in puppet the script can now be a file instead of a template. It also means the bugzilla passwords won't need to be in the script itself anymore * It's the same format as pkgdb-sync-bugzilla.cfg but I'm adding a new one because: * pkgdb-sync-bugzilla.cfg has extra info. The bz-make-components script doesn't need to map fas accounts to email addresses so it doesn't need the fas username and password that's in there. * The old script sent email to the l10n-members(a)fedoraproject.org email alias. The new script takes the place it sends to from the config file so we need to set a different email address for bz-make-components than pkgdb-sync-bugzilla. * The pkgdb-sync-bugzilla.cfg file is owned by root so the bz-make-components.py cron job would need to change from being run by apache to being run by root (This is, admittedly, not a big concern). Since the old script was simply failing, I'd like a freeze break to fix this in production. The script does run on bapp02 so if something was wrong with the script it could impact other things running there. However, I've tried it out on app01.stg and it doesn't have a noticable impact on other things running there. The patch for all these changes in puppet is attached -- only the manifest is really useful as a diff, the rest is adding the new files and removing the old ones. Could I get two +1's?

3 2

koji police change request
by Dennis Gilmore 21 May '13

21 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 pjones has written a test app to make sure that pesign is running correctly on the builders. there is two builders specially for the purpose of building binaries that need to be signed in order for secure boot to work. i need to make a policy change so that the test app gets built on the right builders. additionally i need to update pesign on them for some bug fixes needed for f19 Beta. can i get some +1's please diff --git a/configs/build/hub.conf.erb b/configs/build/hub.conf.erb index 604dac9..1d695a7 100644 - --- a/configs/build/hub.conf.erb +++ b/configs/build/hub.conf.erb @@ -68,6 +68,8 @@ channel = method createrepo :: use createrepo has req_channel :: req is_child_task :: parent +#we want pesign-test-app to always go to the secure-boot channel even for scratch builds + source */pesign-test-app* && has_perm secure-boot :: use secure-boot method build && bool scratch :: use default #policys to deal with secure boot allowing only people in the secure-boot group to build the packages -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlGbuSsACgkQkSxm47BaWfe+xgCgu3BYqwQmyxwmWHeAFb7zqAGN pgMAoIjf/SIKWQdZ5L/jAe1JQVutITkL =9AAA -----END PGP SIGNATURE-----

3 2

Meeting Agenda Item: Introduction Andrew Harms (aharms)
by Andrew Harms 20 May '13

20 May '13

- Name: Andrew Harms (aharms) - Time Zone / Country: Central (CST), United States - Why you're joining: To learn, improve and prove my sysadmin skills. - How much time you can contribute (usually hours per week): Minimum of five hours per week on weekdays. My weekends change frequently because of my work schedule (currently working overnight shift) but I'd like to contribute extra hours on the weekend as well when I can. - IRC handle: framew0rk - What skills I have to offer and which ones I would like to learn: I can offer junior systems administration skills and a strong desire to succeed and be challenged. I also have a smaller homelab and a few VPS' to use for testing. I'd like to learn more about general Linux administration, scripting (Python/bash) and Puppet. - What you would like to work on and quite possibly which you would like to help resolve: I'd like to be a part of the fi-apprentice group since I'm just (pretty much) starting out. I have practiced sysadmin scenarios in my own test environment. I would like to help resolve ticket #2984 (Add CNames for each applications' db and update configs) if there is still work to be done, or ticket #3736 (add some nagios monitoring for builders). I'd also like to get a sponsor. Let me know! I'm looking forward to this. - Andrew

2 1

[Freeze Break Request] fix fas-bugzilla sync script for new bugzilla server
by Toshio Kuratomi 20 May '13

20 May '13

It was reported today that people were being added to packager but weren't having their bugzilla accounts updated with the correct permissions. Runing the scrip manually on fas01 showed that the script that updates user's permissions in bugzilla works with python-bugzill-0.8 but not with the new bugzilla.redhat.com version. Luckily, the fix for this simply a matter of switching from sending the server a list of groups to add the bugzilla user to into sending it a string.name of a single group. I'd like to apply the following hotfix to stg and production. Could I get two +1's? diff --git a/modules-staging/hotfix/files/fas/export-bugzilla b/modules-staging/hotfix/files/fas/export-bugzilla index 33b23c7..9e6bb27 100755 --- a/modules-staging/hotfix/files/fas/export-bugzilla +++ b/modules-staging/hotfix/files/fas/export-bugzilla @@ -56,7 +56,7 @@ if __name__ == '__main__': if entry.action == 'r': # Remove the user's bugzilla group try: - server.updateperms(entry.email, 'rem', (bzGroup,)) + server.updateperms(entry.email, 'rem', bzGroup) except xmlrpclib.Fault, e: if e.faultCode == 504: # It's okay, not having this user is equivalent to setting @@ -78,7 +78,7 @@ if __name__ == '__main__': else: print 'Error:', e, entry.email, entry.person.human_name raise - server.updateperms(entry.email, 'add', (bzGroup,)) + server.updateperms(entry.email, 'add', bzGroup) else: print 'Unrecognized action code: %s %s %s %s %s' % (entry.action, entry.email, entry.person.human_name, entry.person.username, entry.group.name) diff --git a/modules-staging/hotfix/manifests/init.pp b/modules-staging/hotfix/manifests/init.pp index e229962..58400e0 100644 --- a/modules-staging/hotfix/manifests/init.pp +++ b/modules-staging/hotfix/manifests/init.pp @@ -84,6 +84,10 @@ class hotfix::fas { } class hotfix::fasbugzillasync { + file { '/usr/sbin/export-bugzilla': + source => 'puppet:///hotfix/fas/export-bugzilla', + mode => '0755' + } } class hotfix::pkgdb { -Toshio

3 2

Freeze break request to remove hotfix
by Patrick マルタインアンドレアス Uiterwijk 20 May '13

20 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 There is currently a hotfix for supybot-fedora in puppet for unicode fixes, this has been fixed upstream, and value03.phx2 was updated to the new (patched) upstream version. The hotfix is still in puppet though, preventing some new functionality from working after the last reload of the plugin. The ticket for the original hotfix is: https://fedorahosted.org/fedora-infrastructure/ticket/3341. I would like to request +1's to remove this hotfix from puppet and reload the supybot-fedora plugin on zodbot. Patrick -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBCgAGBQJRmoZQAAoJEIZXmA2atR5QxzcQAJ0IvK8Sw75CC3uAU8xeuNGM 7fPKvCoo8LawO44hS3tK2++4An0sK6j4N7KgLPG3yFGOQDXMVPpkScRhZCudd7qW 51gKutBAhpv4wU89ls201KyaUMdhfPjqavjdmRlfJRL+Mulr/bzTRyn6wCmrZJ5H xuzWs5xayC33rjj4vxqxGcWjUIkYaqnTLoejf3OCCxNtKeNsgYRSG2mkUtSCEKCP r+s342LqRlSEnz9mKdMUXA92TnBMohsKOma6W5saejGAu0JiE4HSD6flo6osPpiM TOHB0URsE4wnuPZ04wnss547nJpS97jQfgPOkEyXAmreVCsem6GqwUO+0XNyRirZ DvnvFaN7czaA/HKDzoCd1t/4lL3mHYte4kPZ5keVVxpWjxZuEtKY+kXKHAQ7z2qD vaYHSQ+ixXuxETA2GjHO3R8hWpfdEE2fFZ1r8D3Kr52S/1qzboqzAzWJUC06nLwk vSA2aVZonk7uVnz0KtEFDA/ipOKUMApUSWHQhBhO6E7fdZ8e0qrnjXtx39D4nuxM IfMTU4jBSA+oqiOrQdmmQJXtYXSqh/CEXhwMtRorNvOQ5HXP9k+qBBGpq9D5/K7w q5e0jNdPjTTjbVjzxFxMcMRckqlllXWtOdgTgQk/ooNg7ciuLFMrM+U1d7PJ7/wF m0j1WJZYQ638mgklP6Vx =4Ybg -----END PGP SIGNATURE-----

3 2

bugzilla is down !!!
by Sérgio Basto 20 May '13

20 May '13

bugzilla is down I'm try enter in https://bugzilla.redhat.com/show_bug.cgi?id=648384 -- Sérgio M. B.

4 5

Fedora Torrent Tracker
by Frank Murphy 20 May '13

20 May '13

Posting here, as uncertain of overall cause. Using Azureus F-18 version. On 3 torrents getting: Error (Requested download is not authorized for use with this tracker.) Fedora-18-x86_64-Live-Desktop (may be mixing _ -) Fedora-19-Alpha-i386-DVD Fedora-17-i386-DVD -- Regards, Frank - I check for new mail app. 20min www.frankly3d.com

2 2

Freeze break: small exclude change for backups
by Kevin Fenzi 17 May '13

17 May '13

Greetings. Backups of lockbox01 are unfortunately backing up .snapshot directories and their contents. This pulls in a ton of stuff and makes backups take forever and contain things we don't want. This one line change should hopefully make it exclude .snapshot dirs. (Apparently it needs a trailing / to search directory names). +1s? kevin -- diff --git a/modules/bacula5/templates/bacula-dir.conf.erb b/modules/bacula5/templates/bacula-dir.co index 9f5b547..d2b8b2d 100644 --- a/modules/bacula5/templates/bacula-dir.conf.erb +++ b/modules/bacula5/templates/bacula-dir.conf.erb @@ -453,7 +453,7 @@ FileSet { File = /dev File = /sys File = /.swap - File = .snapshot + File = .snapshot/ File = /mnt/fedora/app/fi-repo/rhel File = /var/tmp }

3 3

Plan for tomorrow's Fedora Infrastructure meeting (2013-05-16)
by Kevin Fenzi 16 May '13

16 May '13

The infrastructure team will be having it's weekly meeting tomorrow, 2013-05-16 at 19:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Private Cloud status update / discussion #topic Upcoming Tasks/Items #info 2013-05-14 to 2013-05-28 BETA infrastructure freeze #info 2013-05-19 - bugzilla upgrade. #info 2013-05-28 F19 beta release #info 2013-05-31 end of 1st quarter #info 2013-06-01 nag fi-apprentices #info 2013-06-08 drop inactive apprentices #info 2013-06-18 to 2013-07-02 FINAL infrastructure freeze. #info 2013-07-01 nag fi-apprentices #info 2013-07-02 F19 FINAL release #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

Freeze break request for new storage (take two)
by Kevin Fenzi 16 May '13

16 May '13

Here's a better freeze break request that has actual changes. ;) Basically I need to get the new storage mounted on nfs01 and backup03. On nfs01: - add route to netapp network - add directories to mount on - mount new space On backup03: - Add eth1 interface with route to netapp network. - add directory to mount on - mount new space On netapp: - change exports slightly to allow nfs01 access to koji space, and allow backup03's new storage network ip access to the backup space. (We had it with the normal net in there, but it cannot reach the netapp). +1s? kevin -- diff --git a/manifests/nodes/backup03.phx2.fedoraproject.org.pp b/manifests/nodes/backup03.phx2.fedo index 4e1d9ee..2c96d8c 100644 --- a/manifests/nodes/backup03.phx2.fedoraproject.org.pp +++ b/manifests/nodes/backup03.phx2.fedoraproject.org.pp @@ -19,5 +19,27 @@ node backup03 { iptables::firewall { 'ipv4': tcpPorts => [ 9101, 9102, 9103 ] } -} + eth { 'eth1': + ipaddr => '10.5.127.28', + netmask => '255.255.255.0', + } + + route { 'eth1': + content => '10.5.88.0/24 dev eth1' + } + + file { ['/fedora_backups']: + ensure => directory + } + + mount { "/fedora_backups": + device => "vtap-fedora-nfs01.storage.phx2.redhat.com:/vol/fedora_backups", + fstype => "nfs", + ensure => "mounted", + options => "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=3", + atboot => true, + require => File['/fedora_backups'] + } + +} diff --git a/manifests/nodes/nfs01.phx2.fedoraproject.org.pp b/manifests/nodes/nfs01.phx2.fedoraproj index d31ede2..6e1ee4f 100644 --- a/manifests/nodes/nfs01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/nfs01.phx2.fedoraproject.org.pp @@ -8,6 +8,23 @@ node nfs01{ include iscsi-initiator-utils::initiator include rsync::server + route { 'eth0': + content => '10.5.88.0/24 dev eth1' + } + + file { ['/mnt', '/mnt/fedora_koji']: + ensure => directory + } + + mount { "/mnt/fedora_koji": + device => "vtap-fedora-nfs01.storage.phx2.redhat.com:/vol/fedora_koji", + fstype => "nfs", + ensure => "mounted", + options => "rw,hard,bg,intr,noatime,nodev,nosuid,nfsvers=3", + atboot => true, + require => File['/mnt/fedora_koji'] + } + collectd::collectd { 'log02': } iptables::firewall { 'ipv4': diff --git a/files/ntap-fedora-nfs01.storage.phx2.redhat.com/exports b/files/ntap-fedora-nfs01.storage.phx2.redhat.com/exports index 4c52a23..13561ac 100644 --- a/files/ntap-fedora-nfs01.storage.phx2.redhat.com/exports +++ b/files/ntap-fedora-nfs01.storage.phx2.redhat.com/exports @@ -36,8 +36,8 @@ /vol/fedora_app_staging/app -sec=sys,rw=10.5.127.29:10.5.127.30,root=10.5.127.29:10.5.127.30 # INC49937 - new fedora volumes # koji -/vol/fedora_koji -sec=sys,rw=10.5.127.59:10.5.127.60:10.5.127.38:10.5.127.39:10.5.127.53:10.5.127.54:10.5.127.55:10.5.127.67:10.5.127.68:10.5.127.70:10.5.127.41:10.5.127.190:10.5.127.69,root=10.5.127.59:10.5.127.60:10.5.127.38:10.5.127.39:10.5.127.53:10.5.127.54:10.5.127.55:10.5.127.67:10.5.127.68:10.5.127.70:10.5.127.41:10.5.127.190:10.5.127.69,ro=10.5.127.0/24 +/vol/fedora_koji -sec=sys,rw=10.5.127.11:rw=10.5.127.59:10.5.127.60:10.5.127.38:10.5.127.39:10.5.127.53:10.5.127.54:10.5.127.55:10.5.127.67:10.5.127.68:10.5.127.70:10.5.127.41:10.5.127.190:10.5.127.69,root=10.5.127.59:10.5.127.60:10.5.127.38:10.5.127.39:10.5.127.53:10.5.127.54:10.5.127.55:10.5.127.67:10.5.127.68:10.5.127.70:10.5.127.41:10.5.127.190:10.5.127.69,ro=10.5.127.0/24 # general fedora backups -/vol/fedora_backups -sec=sys,rw=10.5.126.161,root=10.5.126.161 +/vol/fedora_backups -sec=sys,rw=10.5.127.28,root=10.5.127.28 # lookaside source cache /vol/fedora_sourcecache -sec=sys,rw=10.5.127.67

4 3

Freeze Break Request: Fedora Tagger Schema
by Ralph Bean 16 May '13

16 May '13

This is a second freeze break request for Fedora Tagger. I haven't actually carried out the first one yet, but Kevin's mention of the broken bodhi sqlitebuildtags url took us down a rabbit hole. This is the traceback that tagger logs when the bodhi masher tries to pull down its sqlitebuildtags: Traceback (most recent call last): File "/usr/lib/python2.6/site-packages/flask/app.py", line 1687, in wsgi_app response = self.full_dispatch_request() File "/usr/lib/python2.6/site-packages/flask/app.py", line 1360, in full_dispatch_request rv = self.handle_user_exception(e) File "/usr/lib/python2.6/site-packages/flask/app.py", line 1358, in full_dispatch_request rv = self.dispatch_request() File "/usr/lib/python2.6/site-packages/flask/app.py", line 1344, in dispatch_request return self.view_functions[rule.endpoint](**req.view_args) File "/usr/lib/python2.6/site-packages/fedoratagger/api/api.py", line 461, in tag_pkg_sqlite return fedoratagger.lib.sqlitebuildtags() File "/usr/lib/python2.6/site-packages/fedoratagger/lib/sqlite_export.py", line 56, in sqlitebuildtags conn.executemany(insert_statement, rows) IntegrityError: columns name, tag are not unique The problem is that the schema upgrade from tagger1 to tagger2 didn't go smoothly in production, and we didn't notice. There is supposed to be a DB constraint that disallows duplicate tags on packages, but it is absent. We can't just apply that new constraint, because there are now two duplicate tags in the DB. We need to: 1) Remove the duplicates 2) Apply the constraint so it doesn't happen again Here's the constraint we need to apply in postgres: ALTER TABLE tag ADD CONSTRAINT unique_package_label UNIQUE (package_id, label); Here's a script to remove the duplicates: #!/usr/bin/env python import os os.environ['FEDORATAGGER_CONFIG'] = '/etc/fedoratagger/fedoratagger.cfg' from sqlalchemy import func, and_ import fedoratagger import fedoratagger.lib.model as m print 'Looking now for package tag dupes.' query = fedoratagger.SESSION.query(m.Tag).all() results = {} for tag in query: results[tag.label] = results.get(tag.label, {}) results[tag.label][tag.package_id] = \ results[tag.label].get(tag.package_id, 0) + 1 dupes = [] for label, packages in results.items(): for package, count in packages.items(): if count > 1: dupes.append((label, package)) print "Found these package+tag dupes:", dupes base_query = fedoratagger.SESSION.query(m.Tag) for label, package_id in dupes: query = base_query.filter(and_( m.Tag.label==label, m.Tag.package_id==package_id )).all() keep, rest = query[0], query[1:] for dupe in rest: fedoratagger.SESSION.delete(dupe) fedoratagger.SESSION.commit()

5 5

Freeze break: add backup storage to backup03
by Kevin Fenzi 16 May '13

16 May '13

Greetings. I'd like to add a interface on our storage network and mount the new backup volume we now have allocated to us on backup03. This is in prep for redoing backups (see previous mail to the list). There's no backups happening right now, so it shouldn't disrupt things, and should be easy to back out of. +1s? kevin

4 3

Freeze Break Request - Fedora Tagger
by Ralph Bean 15 May '13

15 May '13

I'd like to request a freeze break request for Fedora-Tagger to cut a new release and push it to production. I'm in the process of trying it out in staging now. The new release includes fixes to 5 bugs: https://github.com/fedora-infra/fedora-tagger/issues/90 https://github.com/fedora-infra/fedora-tagger/issues/89 https://github.com/fedora-infra/fedora-tagger/issues/84 https://github.com/fedora-infra/fedora-tagger/issues/87 https://github.com/fedora-infra/fedora-tagger/issues/88 They are all frontend/UI/javascript fixes.

3 3

Ask Fedora hackfest?
by Rahul Sundaram 14 May '13

14 May '13

Hi I was thinking of proposing a hackfest on Ask Fedora for Flock (https://fedoraproject.org/wiki/Flock) . Would anyone be interested in participating and if so, do you have any ideas on what you would like to do? Let me know and if there is sufficient interest, I would submit a proposal. Thanks Rahul

1 0

Freeze break request: add rsync for httpd logs
by Kevin Fenzi 14 May '13

14 May '13

So, first freeze break request. ;) I added a number of applications to have log02 pull httpd logs from, but some of them do not have rsync installed, so pulling logs from them is failing. I'd like to have them include rsync::server (which by default only exposes logs to log02 for rsync) and allow that in firewalls. It's not urgent, but it would be nice to start collecting these sooner rather than later. kevin -- diff --git a/manifests/nodes/ask01.phx2.fedoraproject.org.pp b/manifests/nodes/ask01.phx2.fedoraproject.org.pp index 8a24a68..b85905c 100644 --- a/manifests/nodes/ask01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/ask01.phx2.fedoraproject.org.pp @@ -17,7 +17,9 @@ node "ask01.phx2.fedoraproject.org" { } iptables::firewall { 'ipv4': - tcpPorts => [ 80 ] + tcpPorts => [ 80 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } collectd::collectd { 'log02': } diff --git a/manifests/nodes/ask01.stg.phx2.fedoraproject.org.pp b/manifests/nodes/ask01.stg.phx2.fedoraproject.org.pp index e1abad9..661f5ac 100644 --- a/manifests/nodes/ask01.stg.phx2.fedoraproject.org.pp +++ b/manifests/nodes/ask01.stg.phx2.fedoraproject.org.pp @@ -16,7 +16,9 @@ node "ask01.stg.phx2.fedoraproject.org" { } iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 8888 ] + tcpPorts => [ 80, 443, 8888 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } } diff --git a/manifests/nodes/ask02.phx2.fedoraproject.org.pp b/manifests/nodes/ask02.phx2.fedoraproject.org.pp index bf7b259..6df2054 100644 --- a/manifests/nodes/ask02.phx2.fedoraproject.org.pp +++ b/manifests/nodes/ask02.phx2.fedoraproject.org.pp @@ -17,7 +17,9 @@ node "ask02.phx2.fedoraproject.org" { } iptables::firewall { 'ipv4': - tcpPorts => [ 80 ] + tcpPorts => [ 80 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } collectd::collectd { 'log02': } diff --git a/manifests/nodes/blockerbugs01.phx2.fedoraproject.org.pp b/manifests/nodes/blockerbugs01.phx2.fedoraproject.org.pp index 6647b05..61cf44e 100644 --- a/manifests/nodes/blockerbugs01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/blockerbugs01.phx2.fedoraproject.org.pp @@ -12,7 +12,9 @@ node "blockerbugs01.phx2.fedoraproject.org" { include blockerbugs::nobalance iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 8888 ] + tcpPorts => [ 80, 443, 8888 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db01 host { 'db-blockerbugs': diff --git a/manifests/nodes/blockerbugs01.stg.phx2.fedoraproject.org.pp b/manifests/nodes/blockerbugs01.stg.phx2.fedoraproject.org.pp index a034e3d..aa7eb45 100644 --- a/manifests/nodes/blockerbugs01.stg.phx2.fedoraproject.org.pp +++ b/manifests/nodes/blockerbugs01.stg.phx2.fedoraproject.org.pp @@ -9,6 +9,8 @@ node "blockerbugs01.stg.phx2.fedoraproject.org" { include blockerbugs::nobalance iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 8888 ] + tcpPorts => [ 80, 443, 8888 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } } diff --git a/manifests/nodes/blockerbugs02.phx2.fedoraproject.org.pp b/manifests/nodes/blockerbugs02.phx2.fedoraproject.org.pp index 61267e7..e558851 100644 --- a/manifests/nodes/blockerbugs02.phx2.fedoraproject.org.pp +++ b/manifests/nodes/blockerbugs02.phx2.fedoraproject.org.pp @@ -12,7 +12,9 @@ node "blockerbugs02.phx2.fedoraproject.org" { # include blockerbugs::nobalance iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 8888 ] + tcpPorts => [ 80, 443, 8888 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db01 host { 'db-blockerbugs': diff --git a/manifests/nodes/datagrepper01.phx2.fedoraproject.org.pp b/manifests/nodes/datagrepper01.phx2.fedoraproject.org.pp index 8198138..a2616d0 100644 --- a/manifests/nodes/datagrepper01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/datagrepper01.phx2.fedoraproject.org.pp @@ -11,7 +11,9 @@ node "datagrepper01.phx2.fedoraproject.org" { include openvpn::client iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } host { 'db-for-datagrepper': diff --git a/manifests/nodes/datagrepper01.stg.phx2.fedoraproject.org.pp b/manifests/nodes/datagrepper01.stg.phx2.fedoraproject.org.pp index c81a938..78e8f8d 100644 --- a/manifests/nodes/datagrepper01.stg.phx2.fedoraproject.org.pp +++ b/manifests/nodes/datagrepper01.stg.phx2.fedoraproject.org.pp @@ -12,7 +12,9 @@ node "datagrepper01.stg.phx2.fedoraproject.org" { include datagrepper::app iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } host { 'db-for-datagrepper': diff --git a/manifests/nodes/datagrepper02.phx2.fedoraproject.org.pp b/manifests/nodes/datagrepper02.phx2.fedoraproject.org.pp index 4a7c423..84b45ec 100644 --- a/manifests/nodes/datagrepper02.phx2.fedoraproject.org.pp +++ b/manifests/nodes/datagrepper02.phx2.fedoraproject.org.pp @@ -11,7 +11,9 @@ node "datagrepper02.phx2.fedoraproject.org" { include openvpn::client iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } host { 'db-for-datagrepper': diff --git a/manifests/nodes/fedocal01.phx2.fedoraproject.org.pp b/manifests/nodes/fedocal01.phx2.fedoraproject.org.pp index 14168c2..9567cec 100644 --- a/manifests/nodes/fedocal01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/fedocal01.phx2.fedoraproject.org.pp @@ -9,7 +9,9 @@ node "fedocal01.phx2.fedoraproject.org" { include fedocal::nobalance iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db01 diff --git a/manifests/nodes/fedocal01.stg.phx2.fedoraproject.org.pp b/manifests/nodes/fedocal01.stg.phx2.fedoraproject.org.pp index fd13777..3c6adf8 100644 --- a/manifests/nodes/fedocal01.stg.phx2.fedoraproject.org.pp +++ b/manifests/nodes/fedocal01.stg.phx2.fedoraproject.org.pp @@ -10,7 +10,9 @@ node "fedocal01.stg.phx2.fedoraproject.org" { include fedocal::nobalance iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db02.stg diff --git a/manifests/nodes/fedocal02.phx2.fedoraproject.org.pp b/manifests/nodes/fedocal02.phx2.fedoraproject.org.pp index 090207c..d224fd1 100644 --- a/manifests/nodes/fedocal02.phx2.fedoraproject.org.pp +++ b/manifests/nodes/fedocal02.phx2.fedoraproject.org.pp @@ -10,7 +10,9 @@ node "fedocal02.phx2.fedoraproject.org" { #include fedocal::nobalance iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db01 diff --git a/manifests/nodes/openid01.phx2.fedoraproject.org.pp b/manifests/nodes/openid01.phx2.fedoraproject.org.pp index 8db2feb..94daf55 100644 --- a/manifests/nodes/openid01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/openid01.phx2.fedoraproject.org.pp @@ -9,7 +9,9 @@ node "openid01.phx2.fedoraproject.org" { include openvpn::client iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db-fas01 diff --git a/manifests/nodes/openid01.stg.phx2.fedoraproject.org.pp b/manifests/nodes/openid01.stg.phx2.fedoraproject.org.pp index e3527ce..40386d5 100644 --- a/manifests/nodes/openid01.stg.phx2.fedoraproject.org.pp +++ b/manifests/nodes/openid01.stg.phx2.fedoraproject.org.pp @@ -9,7 +9,9 @@ node "openid01.stg.phx2.fedoraproject.org" { include fas-openid iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db-fas01.stg diff --git a/manifests/nodes/openid02.phx2.fedoraproject.org.pp b/manifests/nodes/openid02.phx2.fedoraproject.org.pp index 3e95783..81142df 100644 --- a/manifests/nodes/openid02.phx2.fedoraproject.org.pp +++ b/manifests/nodes/openid02.phx2.fedoraproject.org.pp @@ -9,7 +9,9 @@ node "openid02.phx2.fedoraproject.org" { include openvpn::client iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443 ] + tcpPorts => [ 80, 443 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } # This points to db-fas01 diff --git a/manifests/nodes/packages01.dev.fedoraproject.org.pp b/manifests/nodes/packages01.dev.fedoraproject.org.pp index af87535..bb14b41 100644 --- a/manifests/nodes/packages01.dev.fedoraproject.org.pp +++ b/manifests/nodes/packages01.dev.fedoraproject.org.pp @@ -6,6 +6,8 @@ node "packages01.dev" { include httpd::mod_wsgi iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 6996 ] + tcpPorts => [ 80, 443, 6996 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } } diff --git a/manifests/nodes/packages01.phx2.fedoraproject.org.pp b/manifests/nodes/packages01.phx2.fedoraproject.org.pp index 39d9036..691c5ed 100644 --- a/manifests/nodes/packages01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/packages01.phx2.fedoraproject.org.pp @@ -26,7 +26,9 @@ node "packages01" { } iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 6996 ] + tcpPorts => [ 80, 443, 6996 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } glusterfs::server::config { packages: diff --git a/manifests/nodes/packages01.stg.phx2.fedoraproject.org.pp b/manifests/nodes/packages01.stg.phx2.fedoraproject.org.pp index b0c2b9d..f96a4bd 100644 --- a/manifests/nodes/packages01.stg.phx2.fedoraproject.org.pp +++ b/manifests/nodes/packages01.stg.phx2.fedoraproject.org.pp @@ -25,6 +25,8 @@ node "packages01.stg" { netmask => '255.255.255.0', } iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 6996 ] + tcpPorts => [ 80, 443, 6996 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } } diff --git a/manifests/nodes/packages02.phx2.fedoraproject.org.pp b/manifests/nodes/packages02.phx2.fedoraproject.org.pp index f6a5441..a66358b 100644 --- a/manifests/nodes/packages02.phx2.fedoraproject.org.pp +++ b/manifests/nodes/packages02.phx2.fedoraproject.org.pp @@ -24,7 +24,9 @@ node "packages02" { } iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 6996 ] + tcpPorts => [ 80, 443, 6996 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } glusterfs::server::config { packages: diff --git a/manifests/nodes/paste01.phx2.fedoraproject.org.pp b/manifests/nodes/paste01.phx2.fedoraproject.org.pp index 7708415..30d83e6 100644 --- a/manifests/nodes/paste01.phx2.fedoraproject.org.pp +++ b/manifests/nodes/paste01.phx2.fedoraproject.org.pp @@ -9,7 +9,9 @@ node "paste01.phx2.fedoraproject.org" { collectd::collectd { 'log02': } iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 8888 ] + tcpPorts => [ 80, 443, 8888 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } selboolean { [ diff --git a/manifests/nodes/paste01.stg.fedoraproject.org.pp b/manifests/nodes/paste01.stg.fedoraproject.org.pp index fa05ef1..ad861b5 100644 --- a/manifests/nodes/paste01.stg.fedoraproject.org.pp +++ b/manifests/nodes/paste01.stg.fedoraproject.org.pp @@ -9,7 +9,9 @@ node "paste01.stg.phx2.fedoraproject.org" { include sticky-notes iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 8888 ] + tcpPorts => [ 80, 443, 8888 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } selboolean { [ diff --git a/manifests/nodes/paste02.phx2.fedoraproject.org.pp b/manifests/nodes/paste02.phx2.fedoraproject.org.pp index 091e894..14d694c 100644 --- a/manifests/nodes/paste02.phx2.fedoraproject.org.pp +++ b/manifests/nodes/paste02.phx2.fedoraproject.org.pp @@ -9,7 +9,9 @@ node "paste02.phx2.fedoraproject.org" { collectd::collectd { 'log02': } iptables::firewall { 'ipv4': - tcpPorts => [ 80, 443, 8888 ] + tcpPorts => [ 80, 443, 8888 ], + custom => [ "-A INPUT -p tcp -m tcp -s 10.5.126.29 --dport 873 -j ACCEPT", + ] } selboolean { [ diff --git a/modules/askbot/manifests/init.pp b/modules/askbot/manifests/init.pp index 50bb7d2..98afdb0 100644 --- a/modules/askbot/manifests/init.pp +++ b/modules/askbot/manifests/init.pp @@ -1,5 +1,6 @@ class askbot { include httpd::mod_wsgi + include rsync::server package { "askbot": ensure => installed, diff --git a/modules/blockerbugs/manifests/init.pp b/modules/blockerbugs/manifests/init.pp index c841ab4..2636819 100644 --- a/modules/blockerbugs/manifests/init.pp +++ b/modules/blockerbugs/manifests/init.pp @@ -19,6 +19,7 @@ class blockerbugs::app { include httpd::mod_wsgi include mod_ssl + include rsync::server selboolean { [ "httpd_can_network_connect_db", diff --git a/modules/datagrepper/manifests/init.pp b/modules/datagrepper/manifests/init.pp index afc9b78..bbd10bc 100644 --- a/modules/datagrepper/manifests/init.pp +++ b/modules/datagrepper/manifests/init.pp @@ -19,6 +19,7 @@ class datagrepper::app { include httpd::mod_wsgi include httpd::mod_ssl include fedmsg::config + include rsync::server package { "datagrepper": ensure => present, diff --git a/modules/fas-openid/manifests/init.pp b/modules/fas-openid/manifests/init.pp index 7c48d0d..3409781 100644 --- a/modules/fas-openid/manifests/init.pp +++ b/modules/fas-openid/manifests/init.pp @@ -3,6 +3,7 @@ class fas-openid { include httpd::mod_ssl include httpd::mod_wsgi include hotfix::python-openid + include rsync::server selboolean { [ "httpd_can_network_connect_db", diff --git a/modules/fedocal/manifests/init.pp b/modules/fedocal/manifests/init.pp index 6854c24..31809e5 100644 --- a/modules/fedocal/manifests/init.pp +++ b/modules/fedocal/manifests/init.pp @@ -2,6 +2,7 @@ class fedocal { include selinux-enforcing include httpd::mod_ssl include httpd::mod_wsgi + include rsync::server selboolean { [ "httpd_can_network_connect_db", diff --git a/modules/packages/manifests/init.pp b/modules/packages/manifests/init.pp index ede4331..7b211a7 100644 --- a/modules/packages/manifests/init.pp +++ b/modules/packages/manifests/init.pp @@ -35,6 +35,7 @@ class fedoracommunity::tagger { include httpd::mod_wsgi include httpd::mod_ssl include fedmsg::config + include rsync::server fedmsg::certificate { "fedoratagger": service => "fedoratagger", group => "fedoratagger", diff --git a/modules/sticky-notes/manifests/init.pp b/modules/sticky-notes/manifests/init.pp index ed78bf2..6fd8f71 100644 --- a/modules/sticky-notes/manifests/init.pp +++ b/modules/sticky-notes/manifests/init.pp @@ -1,6 +1,7 @@ class sticky-notes { include httpd::base include httpd::php + include rsync::server package { "sticky-notes": ensure => installed,

3 2

httpd logs
by Kevin Fenzi 13 May '13

13 May '13

So, the recent fas vulnerability made us realize that we were not collecting and saving httpd logs from staging machines. I've since added: app01.stg app02.stg proxy01.stg to have their httpd logs pulled over to log02 and kept. This however got me thinking. Since we are moving to a model where each app has it's own server, should we widen the servers we pull httpd logs from? For example, ask01/02? fedocal? blockerbugs? Or should we figure out a better way to collect and store the httpd logs. Thoughts? kevin

3 7

backups planning
by Kevin Fenzi 13 May '13

13 May '13

Another fun mail to start some discussion. ;) The topic this time is backups. Currently, we do backups two ways: 1. We have a backup server in phx2 with a tape drive running bacula. It backs up machines and spools the backups to tape. It backs up the following: ask01 bastion01 bastion02 collab04 db01 db04 db05 db-fas01 fas01 hosted04 hosted-lists01 lockbox01 log02 nfs01 people03 pkgs01 proxy01 proxy02 releng03 releng04 relepel01 It does a subset of data on those, but for the most part all of them. 2. We have a backup server at ibiblio. It backs up much more selectively. It keeps lvm snapshots of 3 days worth of these backups (so there's the current one, and 2 older ones available): db01 db04 db05 db-fas01 (only database backups from those) pkgs01 (git and lookaside) lockbox01 (git repos and infra rpms) We are finally getting some more storage in phx2, and I thought this might be a good time to look at backups and revamping them. I'm going to get a backups volume added to backup03 in phx2. I'd like to install rdiff-backup there and have it run backups to disk there, and then change the tape backups to just backup the rdiff backup data to tape. I'd like to also rethink what we backup, and restrict rdiff-backup to /etc and /home and /actual-data. If we are restoring an instance we would do a new install, ansible or puppet and then restore data, so it doesn't make much sense to me to backup system binaries, etc. With rdiff-backup we could keep a pretty long history if needed. Some of our instances don't actually have any data on them, thats all in database. Logs should hopefully go to log02, so if we back that up we should have all those. I'm not sure what we could do better on external backups, but open to ideas there. Should we add or remove anything there? Thoughts? Comments? kevin

2 1

RH Bugzilla Upgrade to 4.4-3 on 20th of May
by Róman Joost 09 May '13

09 May '13

Hi, this is a friendly reminder of the upgrade process for https://bugzilla.redhat.com. The outstanding upgrade of Red Hat Bugzilla from 4.2.5-8.4 to 4.4-3 will take place on: Monday, May 20 (APAC) The outages involved will be approximately >4 hours for the disruptive production sensitive cases. PS: A previous mail dating the upgrade of https://bugzilla.redhat.com to happen on Monday, May 13 (APAC) was a mistake on my behalf. I apologize for any inconvenience this may cause. Kind Regards, -- Róman Joost Product Manager, HSS - Infrastructure Engineering & Development (Brisbane) email: rjoost(a)redhat.com | tz: UTC+10 irc: rjoost #bugzilla blog: https://blogs.corp.redhat.com/bugzilla

1 0

Fedora 19 Alpha Freeze in effect.
by Kevin Fenzi 09 May '13

09 May '13

Greetings. we are now in the infrastructure freeze leading up to the Fedora 19 Alpha release. This is a pre-release freeze. Please see: https://fedorahosted.org/fedora-infrastructure/browser/architecture/Environ… Anything in the Pre Release freeze box is frozen until 2013-04-16 (or later if Alpha slips). This means there should be NO puppet changes to any hosts in there (including global ones) without signoff of the change from at least 2 folks in sysadmin-main and/or release-engineering. Thanks, kevin

5 11

Re: MirrorManager GEO IP API
by Vratislav Podzimek 09 May '13

09 May '13

On Thu, 2013-05-02 at 11:07 -0600, Kevin Fenzi wrote: > On Tue, 30 Apr 2013 07:56:31 -0500 > <Matt_Domsch(a)Dell.com> wrote: > > > I think it would work best to use a dedicated Apache module, such as > > http://dev.maxmind.com/geoip/mod_geoip2 rather than add another > > interface into MirrorManager which otherwise duplicates this. Fedora > > Infrastructure could easily roll out such a service then, independent > > of MirrorManager. > > We could look at this. Would you folks be willing to repost the below > on the infrastructure list and we could start a discussion there? > https://admin.fedoraproject.org/mailman/listinfo/infrastructure Absolutely, reposting. I think this list is the right place to discuss such things. And I just wonder -- anybody thinks this could be deployed before the F19 is released? > > I don't see mod_geoip2 packaged yet, just mod_geoip. > > kevin > -- > > > > -- > > Matt Domsch > > Technology Strategist > > Dell | Office of the CTO > > > > > > > > -----Original Message----- > > From: Martin Kolman [mailto:mkolman@redhat.com] > > Sent: Tuesday, April 30, 2013 7:24 AM > > To: mdomsch(a)fedoraproject.org > > Cc: vpodzime(a)redhat.com; dcantrel(a)redhat.com > > Subject: MirrorManager GEO IP API > > > > Hi, > > we've recently added GeoIP support to Anaconda, so that it can > > automatically preset the language and timezone for users that are > > online during the installation. > > > > We are currently using the mirror manager API, as it is part of the > > Fedora infrastructure so users installing fedora are not calling some > > third-party service and leaking their public addresses all over. > > > > Currently, we basically just use the mirror API like this: > > > > https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-19&arch=i386 > > > > And use the first country code. As we don't really need all the other > > data & only care about GeoIP location data without the closest-mirror > > tweaks MirrorManager does, we wanted to ask - would it be possible to > > add some simple API just for GeoIP ? > > > > Basically, just an API, that returns the most probable country code > > for the caller, without the closest mirror tweaks. I think it should > > also result in less strain on the servers than calling the full API. > > > > We are even willing to supply patches adding this functionality. :) > > > > Best wishes > > Martin Kolman > > from the Anaconda team > > > -- Vratislav Podzimek Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic

4 5

Plan for tomorrow's Fedora Infrastructure meeting (2013-05-09)
by Kevin Fenzi 09 May '13

09 May '13

The infrastructure team will be having it's weekly meeting tomorrow, 2013-05-09 at 19:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Private Cloud status update / discussion #topic Upcoming Tasks/Items #info 2013-05-14 to 2013-05-28 BETA infrastructure freeze #info 2013-05-20 - bugzilla upgrade. #info 2013-05-28 F19 beta release #info 2013-05-31 end of 1st quarter #info 2013-06-01 nag fi-apprentices #info 2013-06-08 drop inactive apprentices #info 2013-06-18 to 2013-07-02 FINAL infrastructure freeze. #info 2013-07-01 nag fi-apprentices #info 2013-07-02 F19 FINAL release #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

Meeting Agenda Item: Introduction Kenny Ayers
by Kenny 09 May '13

09 May '13

Hey folks, I signed up to learn how the Fedora project works, and I'm hoping to contribute. *IRC handle*: kenny or kennyayers *Skills to offer*: python programming, RHEL system administration, storage admin, mysql client programming and administration, Atlassian product admin, Jenkins admin and debugging *Skills to learn*: Hoping to improve on items from the previous list as well as learning anything new that comes my way *I'd like to work on*: python development projects, system and storage administration, database programming and admin Thank you, Kenny

2 1

Re: announcing fedocal calendar
by Bruno Wolff III 07 May '13

07 May '13

On Tue, May 07, 2013 at 11:09:45 -0600, Kevin Fenzi <kevin(a)scrye.com> wrote: >Greetings. > >Fedora Infrastructure is happy to announce the fedocal calendar >application for all Fedora related calendar needs. Thank you to all of the people that worked on this.

2 1

Ask Fedora status update
by Rahul Sundaram 06 May '13

06 May '13

Hi (cc'ing Ankur since he has expressed interest in helping with the admin tasks) * Form for local login is still shown in the login page even though this is disabled. This continues to cause confusion among new users and the fix is upstream https://fedorahosted.org/fedora-infrastructure/ticket/3761 We need to pull this in as a hotfix and test it. * FAS openid doesn't seem to be working for some people. I am unsure of the current status * Cron job for sending reminders to accept an answer https://fedorahosted.org/fedora-infrastructure/ticket/3762 We have enabled this feature but it is essentially non-functional without the cron job running * Enabling Ask Fedora to send emails async https://fedorahosted.org/fedora-infrastructure/ticket/3763 Celery was an option but there seems to be some amount of concern with the additional complexity. Upstream is of the opinion that celery isn't that much of an overhead http://askbot.org/en/question/10531/simpler-alternative-to-celery/ I looked out for options and the one that is actively maintained is django post office https://pypi.python.org/pypi/django-post_office It isn't packaged yet but requires no code changes and very simple configuration. If someone has the time, please test this in staging. I will do the packaging once it is confirmed that it serves our purpose. Older pending tasks --------------------------- * Fedora theme Related: * Making optional fields in FAS more obvious https://lists.fedoraproject.org/pipermail/infrastructure/2013-March/012651.… Rahul

5 9

GitLab proposal wiki page
by Mrigesh Pokhrel 05 May '13

05 May '13

Hi, I have made my Proposal wiki page[1] for your reference , do comment and review it and help me in improving it as required. [1] https://fedoraproject.org/wiki/GSOC_2013/Student_Application_rag3nix/Gitlib IRC : rag3nix , rag3 -- Thanks and Regards Mrigesh Pokhrel +91 9807585021

6 13

GSOC Proposal
by Mrigesh Pokhrel 03 May '13

03 May '13

https://fedoraproject.org/wiki/GSOC_2013/Student_Application_rag3nix -- Thanks and Regards Mrigesh Pokhrel +91 9807585021

3 3

Plan for tomorrow's Fedora Infrastructure meeting (2013-05-02)
by Kevin Fenzi 02 May '13

02 May '13

The infrastructure team will be having it's weekly meeting tomorrow, 2013-05-02 at 19:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Private Cloud status update / discussion #topic Upcoming Tasks/Items #info 2013-05-02 nag fi-apprentices #info 2013-05-08 drop inactive apprentices #info 2013-05-14 to 2013-05-28 BETA infrastructure freeze #info 2013-05-28 F19 beta release #info 2013-05-31 end of 1st quarter #info 2013-06-01 nag fi-apprentices #info 2013-06-08 drop inactive apprentices #info 2013-06-18 to 2013-07-02 FINAL infrastructure freeze. #info 2013-07-01 nag fi-apprentices #info 2013-07-02 F19 FINAL release #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

Old login link on fedorahosted trac
by Jamie Nguyen 02 May '13

02 May '13

Just a small issue to point out. When visiting a fedorahosted trac ticket (eg, [1]) as an unauthenticated user, the page says "Error: Forbidden" as expected, and the top bar has "OpenID Login" link. I noticed that the page also prints this message in the body: "You are currently not logged in. You may want to do so now." This message links to: https://fedorahosted.org/emea-swag-tracking/login I think it should instead link to: https://fedorahosted.org/emea-swag-tracking/openidlogin [1] https://fedorahosted.org/emea-swag-tracking/ticket/1 Kind regards, -- Jamie Nguyen

2 1

sslonly and stg
by Kevin Fenzi 01 May '13

01 May '13

Greetings. There's been a long standing issue with sslonly sites and stg. When you go to 'http://site.stg.whatever" you are redirected to 'https://site.whatever' which is anoying. The current sslonly template has: <% if sslonly -%> Redirect 301 / https://<%= name %>/ <% else -%> So it does a redirect to the site 'name' which is always the production one. I'd like to fix this, and changing the above Redirect to: RewriteEngine On RewriteCond %{HTTP_HOST} ^(.+)$ [NC] RewriteRule ^(.*)$ https://%1/$1 [R=301,L] seems to work. I tested it on stg with the qa site. Can anyone see anything that would blow up if I made this change? kevin

3 4

Setting up GitLab for fedorahosted.org
by Axilleas Pipinellis 01 May '13

01 May '13

Greetings from a newly registered member! I've seen the 'GSoC @ Infra' thread but I didn't want to hijack it nor do I know how to reply to a thread through mailman... I will be applying for GSoC this summer and GitLab is my first priority as I have been using it since version 2 and I want to contribute in any way I can. I have been talking with Vit Ondruch about the packaging procedure and I just sent a mail [0] to the ruby-sig list too, regarding this. I have also read last year's discussion [1] and it was made clear by Dan Allen [2] that besides the whole implementation thing, it is as important to find some people that will maintain the project longterm. And I am willing to do this. I don't know if it is possible for more than one person to work on a project during GSoC, but another fellow is interested in this as well [3]. So, now we are two :p This should be very interesting and I am looking forward to hearing from the infra team :) Regards, Axilleas [0] https://lists.fedoraproject.org/pipermail/ruby-sig/2013-March/001270.html [1] https://lists.fedoraproject.org/pipermail/infrastructure/2012-March/011466.… [2] https://groups.google.com/forum/?fromgroups=#!topic/gitlabhq/SQMDi-yyXmU [3] https://lists.fedoraproject.org/pipermail/summer-coding/2013-March/000286.h…

5 10

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure May 2013