LibertaCasa/salt
LibertaCasa/salt
9
1
Fork 0
Code Issues 5 Pull Requests Releases Activity
333 Commits 10 Branches 0 Tags 849 KiB
8231c71927
Commit Graph

166 Commits

Author SHA1 Message Date
Georg Pfuetzenreuter
361e118b31
Add php-fpm role 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 13:14:29 +01:00
Georg Pfuetzenreuter
f55e5363a0
Enable memcached-formula 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 13:14:28 +01:00
Georg Pfuetzenreuter
f820978b78
Add memcached role 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 13:14:28 +01:00
Georg Pfuetzenreuter
4653655010
profile.apache-httpd: manage snippets 
- add apache-httpd profile with snippets configuration
- add TLS snippet to apache-httpd role pillar

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 13:14:28 +01:00
Georg Pfuetzenreuter
d8d848055f
id.themis: add BookStack configuration 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 13:14:28 +01:00
Georg Pfuetzenreuter
e36d40dbc3
id.themis: add BookStack httpd configuration 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 13:14:28 +01:00
Georg Pfuetzenreuter
906dd92d7e
Add web.apache-httpd role 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 11:10:05 +01:00
Georg Pfuetzenreuter
e58c63decc
Enable apache-formula 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-26 11:10:04 +01:00
Georg Pfuetzenreuter
0730cbb4c2
Manage Prometheus firewall rules 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-21 19:06:04 +01:00
Georg Pfuetzenreuter
cade9c0aca
Moni: Read Blackbox targets as JSON 
Use uniform JSON target files instead of a JSON/YAML mix.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-21 19:06:03 +01:00
Georg Pfuetzenreuter
979021f5c4
Import Prometheus server configuration 
* add new roles:
  - monitoring.prometheus
  - monitoring.prometheus-alertmanager
  - monitoring.prometheus-exporter-blackbox
* add common Prometheus and Prometheus Alertmanager pillar data
* add moni.lysergic.dev specific Prometheus pillar data

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-21 19:05:03 +01:00
Georg Pfuetzenreuter
18d28c3b7f
Address salt-lint errors/warnings
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
- remove trailing whitespaces
- format octal modes correctly

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-15 23:18:54 +01:00
Georg Pfuetzenreuter
cd93d792ff
Address yamllint errors/warnings 
- remove spaces, add headers
- add ignore for line-lengths in .pipeline.yml

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-15 23:15:25 +01:00
Georg Pfuetzenreuter
2674d21efc
Enable prometheus-formula
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-15 18:57:18 +01:00
Georg Pfuetzenreuter
c75e31c145
denc-webcluster: add ModSecurity adjustments
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
With the rollout of our Salted configuration, ModSecurity came enforced.
This adds necessary rules to PrivateBin and BookStack for correct
operation.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 23:46:22 +01:00
Georg Pfuetzenreuter
37a1ec433a
denc-webcluster: nginx listen on HA addresses
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Accidentally configured to listen only internally.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 17:42:31 +01:00
Georg Pfuetzenreuter
2d5da24ce5
denc-webcluster: nginx AppArmor rules
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Allow access to client trust certificate and to static content.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 16:39:49 +01:00
Georg Pfuetzenreuter
eac227d120
denc-webcluster: nginx config fixup
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
- remove keys duplicated by include
- repair wrong snippets include directory
- repair wrong ip_hash option syntax

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 15:48:44 +01:00
Georg Pfuetzenreuter
d017233a52
ha-node: vrrp is a protocol
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Accidentally added as a service.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 15:22:08 +01:00
Georg Pfuetzenreuter
533aedd864
denc-webcluster: enable keepalived script security
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Prevent script tampering.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 14:37:45 +01:00
Georg Pfuetzenreuter
7481741f95
denc-webcluster: allow http(s) publicly
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Public firewall rules were missing from initial import.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 14:33:34 +01:00
Georg Pfuetzenreuter
c5ce94d7b5
Manage backend firewall zone
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Configure backend firewall zones if applicable. Allow all UDP for
cluster traffic.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 06:04:16 +01:00
Georg Pfuetzenreuter
bef66c1f8a
ha-node: allow vrrp in firewall 
Needed for keepalived operation.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 05:54:20 +01:00
Georg Pfuetzenreuter
303b06ae8c
nemesis/hubris: import keepalived configuration 
Add shared configuration to cluster.denc.web-proxy.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 05:21:43 +01:00
Georg Pfuetzenreuter
a0a21a17db
nemesis/hubris: include denc.web-proxy 
Add shared nginx configuration to nemesis/hubris HA pair nodes.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 05:21:42 +01:00
Georg Pfuetzenreuter
eed4945a9f
nemesis/hubris: import nginx configuration 
Add shared configuration to cluster.denc.web-proxy.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 05:21:39 +01:00
Georg Pfuetzenreuter
1f8d8b642c
dericom02: manage web firewall zone
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Import locally configured web zone into Salt. This zone allows the web
proxy to reach http for serving Matterbridge media.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 03:49:40 +01:00
Georg Pfuetzenreuter
16c8cd3dd5
dericom02: disable matterbridge XMPP debug
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
It's very noisy - one can enable it on demand if needed.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 02:53:04 +01:00
Georg Pfuetzenreuter
1302e06486
Disable "aithunder" Discord bridge
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Discord room does not exist.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 02:25:55 +01:00
Georg Pfuetzenreuter
12c47a346b
dericom02: quote matterbridge booleans
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
TOML configuration format needs lowercase boolean values.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 02:13:03 +01:00
Georg Pfuetzenreuter
1aacd3f340
dericom02: manage matterbridge media
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
- move base media directory to variable
- add lighttpd vhosts to pillar

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-12 00:51:59 +01:00
Georg Pfuetzenreuter
77c50cf53f
matterbridge: add role pillar
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Empty for now, adding for future reference and because we enforce role
pillars to exist.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-09 22:56:28 +01:00
Pratyush Desai
03a4aec0f3 Merge pull request 'Import Matterbridge configuration' (#10) from import-dericom02 into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Reviewed-on: #10
 2023-02-09 21:02:02 +01:00
Georg Pfuetzenreuter
2d06de94ca
Enable keepalived-formula 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-08 20:30:52 +01:00
Georg Pfuetzenreuter
07d325d777
dericom02: import Matterbridge configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-07 22:29:02 +01:00
Georg Pfuetzenreuter
f678de8560
derimisc01: import Tor configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-07 18:35:40 +01:00
Georg Pfuetzenreuter
a3ec351b70
Add onion-router role 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-07 18:21:32 +01:00
Georg Pfuetzenreuter
687473b919
Enable tor-formula
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-06 23:00:47 +01:00
Georg Pfuetzenreuter
70ca4fabc8
Set webirc backend to https
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Ergo rightfully does not accept plain text websocket connections.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-06 14:20:19 +01:00
Georg Pfuetzenreuter
82cad3b099
Include libertacasa for liberta.casa
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Fallout from 77fa39e59c - libertacasa
nginx snippet needs to be included in liberta.casa server for main
website to operate on the clearnet.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-06 14:10:14 +01:00
Georg Pfuetzenreuter
df3eeede1d
Repair liberta.casa TLS include
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Accidentally mixed up the libertacasa with the libertacasa2 nginx
TLS snippet.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-06 14:01:23 +01:00
Georg Pfuetzenreuter
92f01888af
web-proxy: include mime.types
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Always include mime.types on web-proxies.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 20:10:57 +01:00
Georg Pfuetzenreuter
e369c53a4c
web-proxy: common includes
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Always include files in conf.d and vhosts.d on web-proxies.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 20:09:05 +01:00
Georg Pfuetzenreuter
12ce134559
web-proxy: common nginx.conf
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Import default nginx.conf contents from our custom packaged file into
Salt.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 19:59:04 +01:00
Georg Pfuetzenreuter
e3e4caaabe
web-proxy: IPv6 listener brackets
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Add logic to wrap IPv6 listening addresses in brackets, to prevent nginx
from failing to start.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 19:19:27 +01:00
Georg Pfuetzenreuter
5e02090bc6
web-proxy: add firewall configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Allow internal http and https to pass on web proxies.
To-do: logic for web proxies directly attached to the internet.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 14:29:25 +01:00
Georg Pfuetzenreuter
1b619358a8
deriweb01: import nginx configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Transfer local/manual nginx configuration structure into pillar.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 11:56:27 +01:00
Georg Pfuetzenreuter
98ea861c13
web-proxy: add common TLS configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Add TLS configuration snippet shared between all web-proxies.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 10:05:20 +01:00
Georg Pfuetzenreuter
4581bd4a6a
Add nginx crtkeypair macro 
For use in nginx pillars.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 10:04:09 +01:00
Georg Pfuetzenreuter
3f2b8d2ee7
Add cluster pillar 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-05 09:36:23 +01:00
Georg Pfuetzenreuter
2e4d350c7f
Add web-proxy role 
- web-proxy role to configure nginx
- pillar with common nginx configuration

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-04 11:47:09 +01:00
Georg Pfuetzenreuter
bb252c1d47
Set default saltenv
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-02-01 23:23:43 +01:00
Georg Pfuetzenreuter
ba6522ce5b
Refactor map/macro sourcing
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
- move pillar macros and map to base directory
- move listener logic from macro to map
- update includes respectively

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-30 05:43:53 +01:00
Georg Pfuetzenreuter
096bb24769
Enable nginx-formula 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-30 03:23:48 +01:00
Georg Pfuetzenreuter
83f698e18c
Manage Salt roleproxy
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Add role, profile and pillar for roleproxy.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-30 00:39:33 +01:00
Georg Pfuetzenreuter
d2bc7b0785
Set firewalld short zone names
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
To match the SUSE defaults deployed by our AutoYaST configuration.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 17:50:37 +01:00
Georg Pfuetzenreuter
84c1d63776
Allow IPv6-only interfaces + fixup
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
- interfaces with no IPv4 address would cause a render failure
- repair if-clause needed for interfaces with only IPv4 addresses

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 17:38:29 +01:00
Georg Pfuetzenreuter
824baf386b
Firewall interface mapping logic
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Detect which interfaces belong to which zones, and configure firewalld
accordingly.
Backend zone is currently only prepared and yet to be tested and
enabled.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 17:27:58 +01:00
Georg Pfuetzenreuter
c8aa6c6157
Mine interfaces 
Needed for firewall interface-zone mapping logic.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 16:37:07 +01:00
Georg Pfuetzenreuter
7600e631d3
salt.master: extra quotes around API listener
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
State would print the colons unquoted into the file, causing the YAML to
not parse.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 16:11:01 +01:00
Georg Pfuetzenreuter
45b53f8392
salt.master: add firewalld rules
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 15:50:11 +01:00
Georg Pfuetzenreuter
e395f7f0a3
Manage common firewalld rules 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 15:49:48 +01:00
Georg Pfuetzenreuter
4ece021122
Enable firewalld-formula
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
... and sort list entries alphabetically.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 15:12:52 +01:00
Georg Pfuetzenreuter
880f6796c5
salt.master: enable API IPv6 listener
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
No individual listeners can be configured, hence global dual stack
listener it is.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 14:59:35 +01:00
Georg Pfuetzenreuter
7b808efdb5
Enable SSH banner
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-29 14:15:40 +01:00
Georg Pfuetzenreuter
bd7fe25eb0
Listeners macro: skip on empty mine
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Don't fail if mine does not contain information about the queried
minion.
In the future it would be nice to add another conditional to allow such
minions to fall-back to the locally executed network module for
masterless setups.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-28 02:14:37 +01:00
Georg Pfuetzenreuter
bd166cbb42
salt.master: set rootgroup 
Needed for formula to not nuke Syndic key permissions. Little bit ugly.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-28 02:14:36 +01:00
Georg Pfuetzenreuter
08f23700c9
Listeners macro: use mined addresses
Some checks failed
ci/lysergic/push/pipeline Pipeline failed
Details 
The network module run on the Salt master, but the macro should fetch
minion addresses.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-28 01:32:23 +01:00
Georg Pfuetzenreuter
0ea6f8c62d
Mine IPv6 addresses
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-28 01:13:21 +01:00
Georg Pfuetzenreuter
975fa89abc
Mine IP addresses
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Add Salt mine configuration to collect minion IP addresses.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-28 01:06:44 +01:00
Georg Pfuetzenreuter
e8b905cd0b
salt.master: increase LDAP scope
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Likely needed as it does not support searching a more fine grained base
DN.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-28 00:19:42 +01:00
Georg Pfuetzenreuter
a831a25701
salt.master: switch to CherryPy
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Tornado does not support all the features.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-28 00:17:39 +01:00
Georg Pfuetzenreuter
570522176a
salt.master: add LDAP configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-27 20:01:01 +01:00
Georg Pfuetzenreuter
85bfe2cac4
salt.master: add Salt API configuration 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-27 19:25:21 +01:00
Georg Pfuetzenreuter
950b308546
Relay via static zz0.email host
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Split horizon for the complete .email zone is not feasible for all
sites, and TLS certificate currently does not cover any of the internal
hostnames.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-27 12:45:01 +01:00
Georg Pfuetzenreuter
698234c040
Manage common SSH server
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-26 23:05:21 +01:00
Georg Pfuetzenreuter
f949c0aba0
mta.postfix->global.mta pillar; remove mta profile
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
This is more a MTA configuration for system email on all hosts instead of
a dedicated email server role.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-26 20:54:09 +01:00
Georg Pfuetzenreuter
56a1e11ef6
Move common to global pillar 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-26 20:54:09 +01:00
Georg Pfuetzenreuter
d627582075
Read formulas from central file 
- add formulas.yaml file containing list of all enabled formulas
- read formulas from said file in role.salt.master and prepare_minion.py
- add symlink for easier tracking of the file

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-26 20:54:09 +01:00
Georg Pfuetzenreuter
68939f8054
Postfix: configure alias_database
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Not needed, but the formula writes a hash:/ entry default, which might
cause confusion in the future, since our alias_maps is using lmdb:/.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-25 21:39:35 +01:00
Georg Pfuetzenreuter
9fd56e7640
Allow local system mail in Postfix 
- correct mydestination to allow lysergic.dev to be sent through the
  relay
- correct relayhost to use SMTPS port

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-25 21:29:16 +01:00
Georg Pfuetzenreuter
4bf9ac9413
Include Postfix pillar via role
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-24 23:16:56 +01:00
Georg Pfuetzenreuter
7b9f184c6b
Revert "Split to OS specific common pillar" 
This reverts commit 4863396938.
 2023-01-24 23:03:20 +01:00
Georg Pfuetzenreuter
4c6b221dad
Include role.salt.common in master
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Needed to allow individual apply's of salt.master without breaking
common configuration options.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-24 21:46:18 +01:00
Georg Pfuetzenreuter
70036d224f
Manage aliases
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-24 21:18:08 +01:00
Georg Pfuetzenreuter
5f9a74c612
Enable postfix-formula 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-24 21:18:08 +01:00
Georg Pfuetzenreuter
6c7aaa08e1
Manage common Postfix 
Add configuration for global client MTA's.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

Enable Postfix management

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-24 21:17:55 +01:00
Georg Pfuetzenreuter
4863396938
Split to OS specific common pillar 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-24 18:03:15 +01:00
Georg Pfuetzenreuter
0457625204
Enforce ID and roles in top
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Adapt to current private pillar top:
- match ID grain for inclusion of ID files
- move roles under conditional

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 22:39:14 +01:00
Georg Pfuetzenreuter
48c9e05de1
Enable users-formula
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 21:37:45 +01:00
Georg Pfuetzenreuter
a3583e25a5
Wrap zypper pillar in OS check
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Zypper pillar data is not needed on non-SUSE systems.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 21:33:27 +01:00
Georg Pfuetzenreuter
e8f19191eb
Disable refreshdb_force
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Speed up state.apply's.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 21:02:44 +01:00
Georg Pfuetzenreuter
cce6cce594
Use central machine-roles endpoint
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 16:55:55 +01:00
Georg Pfuetzenreuter
0efd688151
Use http.query instead of nbroles module
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
This is an attempt to remove the need for the custom nbroles module. If
it works out, the localhost reference should be replaced with a global
roles API endpoint.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 16:32:57 +01:00
Georg Pfuetzenreuter
5ab1c4f854
salt.master: manage formulas
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 14:49:30 +01:00
Georg Pfuetzenreuter
f7bb83bd75
salt.master: move file_roots to production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 14:40:21 +01:00
Georg Pfuetzenreuter
d593cbeae5
salt.master: move gpg_keydir to master
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Details 
'gpg_keydir' is a master specific setting, it does not work under the
top level 'salt' key.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 14:34:42 +01:00
Georg Pfuetzenreuter
928809b267
salt.master: manage extension modules 
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 14:34:42 +01:00
Georg Pfuetzenreuter
bcac69683b
Update salt.master role pillar 
- add missing settings needed for use in production
- correct existing settings with new advancements

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 13:49:36 +01:00
Georg Pfuetzenreuter
5d60fe6a34
Set Salt log level to info 
Globally setting log level for easier initial setup. Later on we should
consider removing it again, or moving it to the salt:master pillar.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
 2023-01-22 13:49:35 +01:00