infrastructure April 2016

infrastructure@lists.fedoraproject.org

33 participants
75 discussions

[PATCH] Remove the old sks.conf file
by Michael Scherer 09 Apr '16

09 Apr '16

From: Michael Scherer <misc(a)zarb.org> It was a left over of the migration to a role --- files/keyserver/sks.conf | 83 ------------------------------------------------ 1 file changed, 83 deletions(-) delete mode 100644 files/keyserver/sks.conf diff --git a/files/keyserver/sks.conf b/files/keyserver/sks.conf deleted file mode 100644 index e91dfd7..0000000 --- a/files/keyserver/sks.conf +++ /dev/null @@ -1,83 +0,0 @@ -ServerName keys.fedoraproject.org -Listen 80.239.156.219:11371 -NameVirtualHost *:443 - -<ifModule !mod_proxy.c> - LoadModule proxy_module modules/mod_proxy.so -</IfModule> - -<IfModule !mod_proxy_http.c> - LoadModule proxy_http_module modules/mod_proxy_http.so -</IfModule> - -<IfModule !mod_proxy_balancer.c> - LoadModule proxy_balancer_module modules/mod_proxy_balancer.so -</IfModule> - -<IfModule !mod_headers.c> - LoadModule headers_module modules/mod_headers.so -</IfModule> - -<IfModule !mod_authz_host.c> - LoadModule authz_host_module modules/mod_authz_host.so -</IfModule> - -<IfModule !mod_log_config.c> - LoadModule log_config_module modules/mod_log_config.so -</IfModule> - -<IfModule !mod_env.c> - LoadModule env_module modules/mod_env.so -</IfModule> - -<Directory /> - Options FollowSymLinks - AllowOverride None - Order deny,allow - Deny from all -</Directory> - -<VirtualHost *:80> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName keys.fedoraproject.org - ProxyPass / http://127.0.0.1:11371/ - ProxyPassReverse / http://127.0.0.1:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> -<VirtualHost *:443> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName keys.fedoraproject.org - ServerAlias keys01.fedoraproject.org - - SSLEngine on - SSLCertificateFile /etc/pki/tls/wildcard-2014.fedoraproject.org.cert - SSLCertificateChainFile /etc/pki/tls/wildcard-2014.fedoraproject.org.intermediate.cert - SSLCertificateKeyFile /etc/pki/tls/wildcard-2014.fedoraproject.org.key - ProxyPass / http://localhost:11371/ - ProxyPassReverse / http://localhost:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> -<VirtualHost *:443> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName pool.sks-keyservers.net - ServerAlias sks-keyservers.net - ServerAlias *.sks-keyservers.net - - SSLEngine on - SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem - SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key - ProxyPass / http://localhost:11371/ - ProxyPassReverse / http://localhost:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> -<VirtualHost *:11371> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName keys.fedoraproject.org - ProxyPass / http://127.0.0.1:11371/ - ProxyPassReverse / http://127.0.0.1:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> -- 1.8.3.1

1 0

[PATCH] Move koshei handlers to the role
by Michael Scherer 09 Apr '16

09 Apr '16

From: Michael Scherer <misc(a)zarb.org> --- handlers/restart_services.yml | 12 ------------ roles/koschei/handlers/main.yml | 11 +++++++++++ 2 files changed, 11 insertions(+), 12 deletions(-) create mode 100644 roles/koschei/handlers/main.yml diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml index 58396a0..ab74770 100644 --- a/handlers/restart_services.yml +++ b/handlers/restart_services.yml @@ -42,18 +42,6 @@ - name: restart jenkins action: service name=jenkins state=restarted -- name: restart koschei-polling - action: service name=koschei-polling state=restarted - -- name: restart koschei-resolver - action: service name=koschei-resolver state=restarted - -- name: restart koschei-scheduler - action: service name=koschei-scheduler state=restarted - -- name: restart koschei-watcher - action: service name=koschei-watcher state=restarted - - name: restart libvirtd action: service name=libvirtd state=restarted diff --git a/roles/koschei/handlers/main.yml b/roles/koschei/handlers/main.yml new file mode 100644 index 0000000..5c37b87 --- /dev/null +++ b/roles/koschei/handlers/main.yml @@ -0,0 +1,11 @@ +- name: restart koschei-polling + action: service name=koschei-polling state=restarted + +- name: restart koschei-resolver + action: service name=koschei-resolver state=restarted + +- name: restart koschei-scheduler + action: service name=koschei-scheduler state=restarted + +- name: restart koschei-watcher + action: service name=koschei-watcher state=restarted -- 1.8.3.1

2 1

[PATCH 1/2] Refactor packages installation for fedmsg-irc, and use package module
by Michael Scherer 09 Apr '16

09 Apr '16

From: Michael Scherer <misc(a)zarb.org> --- roles/fedmsg/irc/tasks/main.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/roles/fedmsg/irc/tasks/main.yml b/roles/fedmsg/irc/tasks/main.yml index ac23440..618ab1e 100644 --- a/roles/fedmsg/irc/tasks/main.yml +++ b/roles/fedmsg/irc/tasks/main.yml @@ -1,15 +1,12 @@ -- name: install fedmsg-irc - yum: pkg=fedmsg-irc state=present - tags: - - packages - - fedmsg/irc - -- name: install python2-fedmsg-meta-fedora-infrastructure - yum: pkg=python2-fedmsg-meta-fedora-infrastructure state=present +- name: install package for fedmsg-irc + package: pkg={{ item }} state=present tags: - packages - fedmsg/irc + with_items: + - fedmsg-irc + - python2-fedmsg-meta-fedora-infrastructure - name: ensure that nrpe has rights to monitor us file: > -- 1.8.3.1

2 2

[PATCH] Refactor (again) the code deploying zodbot/ursabot
by Michael Scherer 09 Apr '16

09 Apr '16

From: Michael Scherer <misc(a)zarb.org> Since there is the same code between staging and production, except for the bot name, using a variable permit to avoid duplication. (this time, it work) --- roles/supybot/tasks/main.yml | 36 ++++++++---------------------------- roles/supybot/vars/main.yml | 3 +++ 2 files changed, 11 insertions(+), 28 deletions(-) create mode 100644 roles/supybot/vars/main.yml diff --git a/roles/supybot/tasks/main.yml b/roles/supybot/tasks/main.yml index 59cc5ea..4821c77 100644 --- a/roles/supybot/tasks/main.yml +++ b/roles/supybot/tasks/main.yml @@ -10,34 +10,23 @@ - packagedb-cli tags: supybot +- set_fact: botname={{ botnames[env] }} + - name: creating zodbot log dir file: path={{ item }} state=directory owner=daemon with_items: - - /var/lib/zodbot - - /var/lib/zodbot/conf - - /var/lib/zodbot/data - - /var/lib/zodbot/logs + - /var/lib/{{ botname }} + - /var/lib/{{ botname }}/conf + - /var/lib/{{ botname }}/data + - /var/lib/{{ botname }}/logs - /srv/web - /srv/web/meetbot - when: env != "staging" tags: supybot - name: create teams directory file: path=/srv/web/meetbot/teams state=directory owner=apache group=apache mode=0755 tags: supybot -- name: creating usrabot log dir - file: path={{ item }} state=directory owner=daemon - with_items: - - /var/lib/ursabot - - /var/lib/ursabot/conf - - /var/lib/ursabot/data - - /var/lib/ursabot/logs - - /srv/web - - /srv/web/meetbot - when: env == "staging" - tags: supybot - - name: setup meetings_by_team script copy: src=meetings_by_team.sh dest=/usr/local/bin/meetings_by_team.sh mode=755 tags: supybot @@ -70,18 +59,9 @@ - meetbot - supybot -- name: setup cron job to start zodbot/ursabot on boot - cron: name=zodbot special_time=reboot job='cd /srv/web/meetbot; supybot -d /var/lib/zodbot/conf/zodbot.conf' user=daemon - tags: - - config - - meetbot - - supybot - when: env != "staging" - -- name: setup cron job to start zodbot/ursabot on boot - cron: name=ursabot special_time=reboot job='cd /srv/web/meetbot; supybot -d /var/lib/ursabot/conf/ursabot.conf' user=daemon +- name: setup cron job to start {{ botname }}/ursabot on boot + cron: name={{ botname }} special_time=reboot job='cd /srv/web/meetbot; supybot -d /var/lib/{{ botname }}/conf/{{ botname }}.conf' user=daemon tags: - config - meetbot - supybot - when: env == "staging" diff --git a/roles/supybot/vars/main.yml b/roles/supybot/vars/main.yml new file mode 100644 index 0000000..6e3df99 --- /dev/null +++ b/roles/supybot/vars/main.yml @@ -0,0 +1,3 @@ +botnames: + staging: ursabot + production: zodbot -- 1.8.3.1

2 1

PS1 configuration
by Zach Villers 07 Apr '16

07 Apr '16

Hello infra, First apologies for blowing up your inbox with ansible commits. Second - if you have a chance, please log into these machines before thursday's meeting and look at your prompt. You should see a red "[PROD]" before your normal prompt on the production machine and a regular color "[STG]" on the stage machine. If you dont, would you kindly let me know what shell you are using and what terminal emulator? badges-backend01.phx2.fp.o and badges-backend01.stg.fp.o Thanks, Zach #aikidouke

3 2

Support levels and RFR adjustments
by Kevin Fenzi 07 Apr '16

07 Apr '16

So, I sent an email a while back about this to get people thinking, but I didn't get too much feedback from my questions, so this time I am going to actually outline a proposal for people to look at. ;) Currently users expect pretty much any public service we have is fully supported. This means things like updating status when it's down, working anytime something is down to fix it as quickly as we can. New applications/services currently all pass through the (somewhat long) RFR process which we setup to make sure we could support the service moving forward. This is great and all, but some services just aren't as sustainable, or don't really fit into our RFR process very well. Also, our RFR process makes us pretty slow to bring a new service online properly. In order to have support levels, we need a way to communicate that to our users easily and the only/best way I can think of to do that easily is via domain name. If we try and have a table or something it could get pretty confusing for people. Tying it to domain names would make it much easier. So: fedoraproject.org - Anything with this domain is something that has passed though our RFR process and we support fully. This means we update status, we alert on them anytime they have issues, we work on them anytime they are down, etc. fedorainfracloud.org - This comes with a lesser level of support, simply because our cloud doesn't have any kind of HA setup, so it will be down when doing maint or when there's problems. Services in this domain may be down when there is scheduled cloud maint. We monitor, but don't page off hours, we may work on issues only during business hours, etc. Services here may not have passed through our RFR process (perhaps we should have a parallel cloud process) stg.fedoraproject.org - These can be down anytime and we monitor on them, but may not work on them off hours, etc. someother domain that sounds fedora related (fedorarelated.org? fedoralinks.org? ?) - These are things that are fedora related, but not fully controlled by fedora infrastructure. Things like the fedora bootstrap site or the porting python3 in fedora site, or possibly cloud instances that aren't managed by us. These we don't monitor or have status on, and direct people to contact the managers directly. Any other types of sites / domains people can think of? Any general thoughts on the idea? kevin

7 13

[PATCH] Remove old unused handlers in the current codebase
by Michael Scherer 07 Apr '16

07 Apr '16

From: Michael Scherer <misc(a)zarb.org> --- handlers/restart_services.yml | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml index a2e9669..24bfcc7 100644 --- a/handlers/restart_services.yml +++ b/handlers/restart_services.yml @@ -2,9 +2,6 @@ # Handlers for restarting services # -- name: restart auditd - action: service name=auditd state=restarted - - name: restart apache command: /usr/local/bin/conditional-restart.sh httpd httpd @@ -72,12 +69,6 @@ - name: restart named action: service name=named state=restarted -- name: restart nfs - action: service name=nfs state=restarted - -- name: restart nfslock - action: service name=nfslock state=restarted - - name: restart ntpd action: service name=ntpd state=restarted @@ -105,12 +96,6 @@ - name: restart postfix action: service name=postfix state=restarted -- name: restart rpcbind - action: service name=rpcbind state=restarted - -- name: restart rpcidmapd - action: service name=rpcidmapd state=restarted - - name: restart xinetd action: service name=xinetd state=restarted @@ -167,9 +152,6 @@ - name: "update ca-trust" command: /usr/bin/update-ca-trust -- name: restart openstack-keystone - service: name=openstack-keystone state=restarted - - name: restart stunnel service: name=stunnel state=restarted -- 1.8.3.1

2 1

[PATCH] Remove handlers that do not correspond to any existing playbook
by Michael Scherer 07 Apr '16

07 Apr '16

From: Michael Scherer <misc(a)zarb.org> --- handlers/restart_services.yml | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml index 75a805b..67f48ef 100644 --- a/handlers/restart_services.yml +++ b/handlers/restart_services.yml @@ -2,9 +2,6 @@ # Handlers for restarting services # -- name: restart auditd - action: service name=auditd state=restarted - - name: restart apache command: /usr/local/bin/conditional-restart.sh httpd httpd @@ -60,21 +57,9 @@ - name: restart libvirtd action: service name=libvirtd state=restarted -- name: restart mailman - action: service name=mailman state=restarted - - name: restart named action: service name=named state=restarted -- name: restart nfs - action: service name=nfs state=restarted - -- name: restart nfslock - action: service name=nfslock state=restarted - -- name: restart ntpd - action: service name=ntpd state=restarted - - name: restart openvpn (Fedora) when: ansible_distribution == "Fedora" action: service name=openvpn@openvpn state=restarted @@ -99,12 +84,6 @@ - name: restart postfix action: service name=postfix state=restarted -- name: restart rpcbind - action: service name=rpcbind state=restarted - -- name: restart rpcidmapd - action: service name=rpcidmapd state=restarted - - name: restart xinetd action: service name=xinetd state=restarted -- 1.8.3.1

1 0

Can not download repomd.xml for rawhide-source repo.
by Jun Aruga 07 Apr '16

07 Apr '16

Hi, Fedora Infra team Can I ask you a question about fedora-rawhide repo? Case [1][2]: got an error for "dnf repoquery". but [3] it works. Does Fedora infra team need to modify server settings to fix this error? - Case [1] $ sudo vi /etc/yum.repos.d/fedora-rawhide.repo ... [rawhide-source] baseurl=http://download.fedoraproject.org/pub/fedora/linux/development/rawh… ... $ dnf repoquery --enablerepo=rawhide-source --arch src --whatrequires 'rubygem(acts_as_list)' Error: Failed to synchronize cache for repo 'rawhide-source' from 'http://download.fedoraproject.org/pub/fedora/linux/development/rawhide/sour…': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried When I clicked http://download.fedoraproject.org/pub/fedora/linux/development/rawhide/sour… by my Firefox, its URL was redirected to http://mirrors.nic.cz/fedora/linux/development/rawhide/source/SRPMS/ and the URL was not found (404). (cz domain is because I was in Czech Republic). - Case [2] $ sudo vi /etc/yum.repos.d/fedora-rawhide.repo ... [rawhide-source] metalink=https://mirrors.fedoraproject.org/metalink?repo=rawhide-source&arc… ... $ dnf repoquery --enablerepo=rawhide-source --arch src --whatrequires 'rubygem(acts_as_list)' Error: Failed to synchronize cache for repo 'rawhide-source' from 'https://mirrors.fedoraproject.org/metalink?repo=rawhide-source&arch=x86_64': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried I clicked https://mirrors.fedoraproject.org/metalink?repo=rawhide-source&arch=x86_64, and downloaded "metalink" text file by my Firefox. Though several link sites were "not found 404" for the repomd.xml. I could find one available link site, that is the link of [3]. - Case [3] $ sudo vi /etc/yum.repos.d/fedora-rawhide.repo ... [rawhide-source] baseurl=http://ftp.uninett.no/linux/fedora/development/rawhide/source/SRPMS/ ... $ dnf repoquery --enablerepo=rawhide-source --arch src --whatrequires 'rubygem(acts_as_list)' Fedora - Rawhide - Source 3.6 MB/s | 6.1 MB 00:01 Last metadata expiration check: 0:00:00 ago on Tue Mar 29 12:10:32 2016 => OK Best regards, Jun Aruga

3 5

Meeting Agenda Item: Introduction Suraj Narwade
by Suraj Babulal Narwade 07 Apr '16

07 Apr '16

Hello World IRC handle: snarwade skills: basics of linux system administration, shell scripting, python programming, openstack administration, jenkins and I have redhat certifications for system administrator, openstack administrator and engineer As I am newbie to it, I want to know this things in more detail and contribute my knowledge to opensource world. Thanks, Suraj Narwade

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure April 2016