LibertaCasa/salt - salt - GitCom: Git with a cup of Com

Author	SHA1	Message	Date
Georg Pfuetzenreuter	c75e31c145	denc-webcluster: add ModSecurity adjustments All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details With the rollout of our Salted configuration, ModSecurity came enforced. This adds necessary rules to PrivateBin and BookStack for correct operation. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 23:46:22 +01:00
Georg Pfuetzenreuter	37a1ec433a	denc-webcluster: nginx listen on HA addresses All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Accidentally configured to listen only internally. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 17:42:31 +01:00
Georg Pfuetzenreuter	2d5da24ce5	denc-webcluster: nginx AppArmor rules All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Allow access to client trust certificate and to static content. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 16:39:49 +01:00
Georg Pfuetzenreuter	eac227d120	denc-webcluster: nginx config fixup All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details - remove keys duplicated by include - repair wrong snippets include directory - repair wrong ip_hash option syntax Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 15:48:44 +01:00
Georg Pfuetzenreuter	d017233a52	ha-node: vrrp is a protocol All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Accidentally added as a service. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 15:22:08 +01:00
Georg Pfuetzenreuter	533aedd864	denc-webcluster: enable keepalived script security All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Prevent script tampering. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 14:37:45 +01:00
Georg Pfuetzenreuter	7481741f95	denc-webcluster: allow http(s) publicly All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Public firewall rules were missing from initial import. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 14:33:34 +01:00
Georg Pfuetzenreuter	c5ce94d7b5	Manage backend firewall zone All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Configure backend firewall zones if applicable. Allow all UDP for cluster traffic. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 06:04:16 +01:00
Georg Pfuetzenreuter	bef66c1f8a	ha-node: allow vrrp in firewall Needed for keepalived operation. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 05:54:20 +01:00
Georg Pfuetzenreuter	303b06ae8c	nemesis/hubris: import keepalived configuration Add shared configuration to cluster.denc.web-proxy. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 05:21:43 +01:00
Georg Pfuetzenreuter	a0a21a17db	nemesis/hubris: include denc.web-proxy Add shared nginx configuration to nemesis/hubris HA pair nodes. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 05:21:42 +01:00
Georg Pfuetzenreuter	eed4945a9f	nemesis/hubris: import nginx configuration Add shared configuration to cluster.denc.web-proxy. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 05:21:39 +01:00
Georg Pfuetzenreuter	1f8d8b642c	dericom02: manage web firewall zone All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Import locally configured web zone into Salt. This zone allows the web proxy to reach http for serving Matterbridge media. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 03:49:40 +01:00
Georg Pfuetzenreuter	16c8cd3dd5	dericom02: disable matterbridge XMPP debug All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details It's very noisy - one can enable it on demand if needed. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 02:53:04 +01:00
Georg Pfuetzenreuter	1302e06486	Disable "aithunder" Discord bridge All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Discord room does not exist. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 02:25:55 +01:00
Georg Pfuetzenreuter	12c47a346b	dericom02: quote matterbridge booleans All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details TOML configuration format needs lowercase boolean values. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 02:13:03 +01:00
Georg Pfuetzenreuter	1aacd3f340	dericom02: manage matterbridge media All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details - move base media directory to variable - add lighttpd vhosts to pillar Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-12 00:51:59 +01:00
Georg Pfuetzenreuter	77c50cf53f	matterbridge: add role pillar All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Empty for now, adding for future reference and because we enforce role pillars to exist. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-09 22:56:28 +01:00
Pratyush Desai	03a4aec0f3	Merge pull request 'Import Matterbridge configuration' (#10 ) from import-dericom02 into production All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Reviewed-on: #10	2023-02-09 21:02:02 +01:00
Georg Pfuetzenreuter	2d06de94ca	Enable keepalived-formula Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-08 20:30:52 +01:00
Georg Pfuetzenreuter	07d325d777	dericom02: import Matterbridge configuration All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-07 22:29:02 +01:00
Georg Pfuetzenreuter	f678de8560	derimisc01: import Tor configuration All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-07 18:35:40 +01:00
Georg Pfuetzenreuter	a3ec351b70	Add onion-router role Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-07 18:21:32 +01:00
Georg Pfuetzenreuter	687473b919	Enable tor-formula All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-06 23:00:47 +01:00
Georg Pfuetzenreuter	70ca4fabc8	Set webirc backend to https All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Ergo rightfully does not accept plain text websocket connections. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-06 14:20:19 +01:00
Georg Pfuetzenreuter	82cad3b099	Include libertacasa for liberta.casa All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Fallout from `77fa39e59c` - libertacasa nginx snippet needs to be included in liberta.casa server for main website to operate on the clearnet. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-06 14:10:14 +01:00
Georg Pfuetzenreuter	df3eeede1d	Repair liberta.casa TLS include All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Accidentally mixed up the libertacasa with the libertacasa2 nginx TLS snippet. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-06 14:01:23 +01:00
Georg Pfuetzenreuter	92f01888af	web-proxy: include mime.types All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Always include mime.types on web-proxies. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 20:10:57 +01:00
Georg Pfuetzenreuter	e369c53a4c	web-proxy: common includes All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Always include files in conf.d and vhosts.d on web-proxies. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 20:09:05 +01:00
Georg Pfuetzenreuter	12ce134559	web-proxy: common nginx.conf All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Import default nginx.conf contents from our custom packaged file into Salt. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 19:59:04 +01:00
Georg Pfuetzenreuter	e3e4caaabe	web-proxy: IPv6 listener brackets All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Add logic to wrap IPv6 listening addresses in brackets, to prevent nginx from failing to start. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 19:19:27 +01:00
Georg Pfuetzenreuter	5e02090bc6	web-proxy: add firewall configuration All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Allow internal http and https to pass on web proxies. To-do: logic for web proxies directly attached to the internet. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 14:29:25 +01:00
Georg Pfuetzenreuter	1b619358a8	deriweb01: import nginx configuration All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Transfer local/manual nginx configuration structure into pillar. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 11:56:27 +01:00
Georg Pfuetzenreuter	98ea861c13	web-proxy: add common TLS configuration All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Add TLS configuration snippet shared between all web-proxies. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 10:05:20 +01:00
Georg Pfuetzenreuter	4581bd4a6a	Add nginx crtkeypair macro For use in nginx pillars. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 10:04:09 +01:00
Georg Pfuetzenreuter	3f2b8d2ee7	Add cluster pillar Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-05 09:36:23 +01:00
Georg Pfuetzenreuter	2e4d350c7f	Add web-proxy role - web-proxy role to configure nginx - pillar with common nginx configuration Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-04 11:47:09 +01:00
Georg Pfuetzenreuter	bb252c1d47	Set default saltenv All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-02-01 23:23:43 +01:00
Georg Pfuetzenreuter	ba6522ce5b	Refactor map/macro sourcing All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details - move pillar macros and map to base directory - move listener logic from macro to map - update includes respectively Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-30 05:43:53 +01:00
Georg Pfuetzenreuter	096bb24769	Enable nginx-formula Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-30 03:23:48 +01:00
Georg Pfuetzenreuter	83f698e18c	Manage Salt roleproxy All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Add role, profile and pillar for roleproxy. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-30 00:39:33 +01:00
Georg Pfuetzenreuter	d2bc7b0785	Set firewalld short zone names All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details To match the SUSE defaults deployed by our AutoYaST configuration. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 17:50:37 +01:00
Georg Pfuetzenreuter	84c1d63776	Allow IPv6-only interfaces + fixup All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details - interfaces with no IPv4 address would cause a render failure - repair if-clause needed for interfaces with only IPv4 addresses Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 17:38:29 +01:00
Georg Pfuetzenreuter	824baf386b	Firewall interface mapping logic All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Detect which interfaces belong to which zones, and configure firewalld accordingly. Backend zone is currently only prepared and yet to be tested and enabled. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 17:27:58 +01:00
Georg Pfuetzenreuter	c8aa6c6157	Mine interfaces Needed for firewall interface-zone mapping logic. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 16:37:07 +01:00
Georg Pfuetzenreuter	7600e631d3	salt.master: extra quotes around API listener All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details State would print the colons unquoted into the file, causing the YAML to not parse. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 16:11:01 +01:00
Georg Pfuetzenreuter	45b53f8392	salt.master: add firewalld rules All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 15:50:11 +01:00
Georg Pfuetzenreuter	e395f7f0a3	Manage common firewalld rules Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 15:49:48 +01:00
Georg Pfuetzenreuter	4ece021122	Enable firewalld-formula All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details ... and sort list entries alphabetically. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 15:12:52 +01:00
Georg Pfuetzenreuter	880f6796c5	salt.master: enable API IPv6 listener All checks were successful ci/lysergic/push/pipeline Pipeline was successful Details No individual listeners can be configured, hence global dual stack listener it is. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>	2023-01-29 14:59:35 +01:00

1 2 3

102 Commits