Commit Graph

77 Commits

Author SHA1 Message Date
85bfe2cac4
salt.master: add Salt API configuration
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-27 19:25:21 +01:00
950b308546
Relay via static zz0.email host
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Split horizon for the complete .email zone is not feasible for all
sites, and TLS certificate currently does not cover any of the internal
hostnames.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-27 12:45:01 +01:00
b7ec9e683f Merge pull request 'Manage common SSH server' (#6) from ssh into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #6
2023-01-27 11:48:51 +01:00
698234c040
Manage common SSH server
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-26 23:05:21 +01:00
f949c0aba0
mta.postfix->global.mta pillar; remove mta profile
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
This is more a MTA configuration for system email on all hosts instead of
a dedicated email server role.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-26 20:54:09 +01:00
56a1e11ef6
Move common to global pillar
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-26 20:54:09 +01:00
d627582075
Read formulas from central file
- add formulas.yaml file containing list of all enabled formulas
- read formulas from said file in role.salt.master and prepare_minion.py
- add symlink for easier tracking of the file

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-26 20:54:09 +01:00
68939f8054
Postfix: configure alias_database
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Not needed, but the formula writes a hash:/ entry default, which might
cause confusion in the future, since our alias_maps is using lmdb:/.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-25 21:39:35 +01:00
286bd5d20b
Repository: remove comment, add priority
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
LibertaCasa RPM repsitory:
- comment was not added by Salt, it attempted to re-add it every time
- set lower priority

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-25 21:31:40 +01:00
9fd56e7640
Allow local system mail in Postfix
- correct mydestination to allow lysergic.dev to be sent through the
  relay
- correct relayhost to use SMTPS port

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-25 21:29:16 +01:00
7305d70822 Merge pull request 'Revert OS pillar split' (#4) from revert-ospillarsplit into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #4
2023-01-24 23:29:11 +01:00
4bf9ac9413
Include Postfix pillar via role
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-24 23:16:56 +01:00
7b9f184c6b
Revert "Split to OS specific common pillar"
This reverts commit 4863396938.
2023-01-24 23:03:20 +01:00
342affc1b8 Merge pull request 'Include role.salt.common in master' (#3) from master-include-common into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #3
2023-01-24 21:59:04 +01:00
4c6b221dad
Include role.salt.common in master
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Needed to allow individual apply's of salt.master without breaking
common configuration options.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-24 21:46:18 +01:00
d83eb08f48 Merge pull request 'Manage global Postfix'es + make common pillar OS based' (#2) from postfix into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #2
2023-01-24 21:26:04 +01:00
70036d224f
Manage aliases
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-24 21:18:08 +01:00
5f9a74c612
Enable postfix-formula
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-24 21:18:08 +01:00
6c7aaa08e1
Manage common Postfix
Add configuration for global client MTA's.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

Enable Postfix management

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-24 21:17:55 +01:00
4863396938
Split to OS specific common pillar
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-24 18:03:15 +01:00
2698d18625
Include users in pipeline
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 22:59:29 +01:00
dc3c0dd6a9
Include users in common.suse
Some checks failed
ci/lysergic/push/pipeline Pipeline failed
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 22:56:39 +01:00
0457625204
Enforce ID and roles in top
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Adapt to current private pillar top:
- match ID grain for inclusion of ID files
- move roles under conditional

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 22:39:14 +01:00
48c9e05de1
Enable users-formula
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 21:37:45 +01:00
a3583e25a5
Wrap zypper pillar in OS check
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Zypper pillar data is not needed on non-SUSE systems.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 21:33:27 +01:00
0c2ea3ef95
Add common_packages to common.suse
Add ID and initialize with fish and system-group wheel packages.
More packages to be added later on.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 21:32:45 +01:00
e8f19191eb
Disable refreshdb_force
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Speed up state.apply's.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 21:02:44 +01:00
3226b4113c
Remove release from RPM key check
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Release tag can be different from machine to machine. Checking for the
version tag should be good enough.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 20:55:56 +01:00
5bda75100a
Manage LC repository + ca-certificates
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
manage
- home:crameleon:LibertaCasa repository
- ca-certificates-syscid
in common SUSE state.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 20:44:39 +01:00
2e08c3cf36
Connect syndic minions to syndic master
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Syndics are generally the masters assigned to their region.
We want the minions on syndics to connect to their upstream master
("master of masters") instead of to themselves.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 19:28:28 +01:00
a5754ea0cb
Add admins to redis group on masters
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Avoid permissions errors if Salt attempts to write to Redis during
non-root state.apply calls.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 18:38:36 +01:00
cce6cce594
Use central machine-roles endpoint
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 16:55:55 +01:00
0efd688151
Use http.query instead of nbroles module
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
This is an attempt to remove the need for the custom nbroles module. If
it works out, the localhost reference should be replaced with a global
roles API endpoint.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 16:32:57 +01:00
06a36e62ae
salt.master: configure publisher_acl
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 15:41:23 +01:00
4f633d8d4e
Update symlink to nbroles.py
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Fallout from b112ee3131.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 14:52:44 +01:00
5ab1c4f854
salt.master: manage formulas
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 14:49:30 +01:00
b112ee3131
Move extmods to salt/
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Allow for extension modules to be delivered using the Salt file server.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 14:46:25 +01:00
f7bb83bd75
salt.master: move file_roots to production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 14:40:21 +01:00
d593cbeae5
salt.master: move gpg_keydir to master
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
'gpg_keydir' is a master specific setting, it does not work under the
top level 'salt' key.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 14:34:42 +01:00
928809b267
salt.master: manage extension modules
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 14:34:42 +01:00
689eb5c676
Configure Redis for Salt master
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Add Redis configuration to salt.master profile for caching on Salt masters.
To-Do: move configuration to a formula based approach.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 13:56:21 +01:00
bcac69683b
Update salt.master role pillar
- add missing settings needed for use in production
- correct existing settings with new advancements

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 13:49:36 +01:00
5d60fe6a34
Set Salt log level to info
Globally setting log level for easier initial setup. Later on we should
consider removing it again, or moving it to the salt:master pillar.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 13:49:35 +01:00
ad4c6af852
Add salt.syndic role + pillar
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 13:49:35 +01:00
8743190e5b
roles.py: exclude salt.common
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Role is targetted globally.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 02:46:27 +01:00
874e3c190d
Sync roles in pipeline
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Call rolesyncer on new commits to production.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-22 01:52:20 +01:00
ed427955c3
Add rolesyncer script
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-21 21:45:25 +01:00
03da60604e
roles.py: remove exclusions
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
These were only relevant during testing. Leaving the empty list in case
exclusions need to be added in the future.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-21 20:13:47 +01:00
0d9230d6bb
Init pipeline config
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-21 20:05:09 +01:00
e5e9685113
Add empty salt.common SLS
Roles under salt/ are enforced to be existent - adding "empty" file to
match pillar/role/salt/.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-01-21 19:54:17 +01:00