Compare commits

..

170 Commits

Author SHA1 Message Date
8231c71927 Merge pull request 'cleanup interprotocol bridges' (#96) from cfg_matterbridge into production
Reviewed-on: #96
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2024-09-07 22:07:22 +02:00
00e7832e9d
cleanup interprotocol bridges
Updating sshchat label
Remote nick formatting fixes

Remove some redundant linkages:

Remove commented out tg for #libcasa.info as it is not being utilised
Remove stale dota related bridge
Removed keytomb stuff as it is stale and didn't work anyway.

Reroute bridges:

Rerouting sshchat from #libcasa to #lucy as there isn't much conversation on #libcasa atm. So if it will be getting used, it's likely only to communicate on #lucy.

Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2024-09-01 22:25:18 +05:30
47c7b56e86 Merge pull request 'fix firewalld not updating interfaces during reload' (#95) from fw_flushreload into production
Reviewed-on: #95
2024-06-19 19:45:21 +02:00
f46758fe53
fix firewalld not updating interfaces
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2024-06-19 17:31:23 +05:30
b7ffc08af9 Merge pull request 'enroll derigsm01' (#94) from add_derigsm01 into production
Some checks failed
ci/lysergic/push/pipeline Pipeline failed
Reviewed-on: #94
2024-01-25 18:47:07 +01:00
6d931c54cb
enroll derigsm01
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2024-01-09 02:33:03 +05:30
46f5fd365c Merge pull request 'attempt disc-chilldevirc connect' (#93) from chillcord into production
Reviewed-on: #93
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-10-04 14:03:01 +02:00
931403de64 Merge branch 'production' into chillcord 2023-10-04 13:42:01 +02:00
f26bace747
attempt disc-chilldevirc connect
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-10-04 17:10:16 +05:30
3c1cb027ba Merge pull request 'Remove chillops bridge gateway' (#92) from bridgeupdates into production
Reviewed-on: #92
2023-10-03 15:12:27 +02:00
95edd4bcb4
remove chillops gateway matterb
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-10-03 18:38:43 +05:30
b454b5f5b9 Merge pull request 'link keytomb irclc<->tg' (#90) from matterb-tg-irc-keytomb into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #90
2023-08-20 08:41:24 +02:00
b2aa0317e5
link keytomb irclc<->tg
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-08-20 11:49:09 +05:30
10e380c3c1 Merge pull request 'attempt at fixing the irc-tg link' (#89) from add/matterb-lcirc-tgpetals into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #89
2023-08-19 05:48:17 +02:00
0e3300bb49
attempt at fixing the irc-tg link
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-08-19 09:05:18 +05:30
fd68a06188 Merge pull request 'add petals irccasa<->tg' (#88) from add/matterb-lcirc-tg-petals into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #88
2023-08-18 22:48:48 +02:00
f0a2afc714
add petals irccasa<->tg
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-08-15 01:45:22 +05:30
14109af928 Merge pull request 'fix syntax error in pull 86' (#87) from fix/matterb-chillnet-tgchanaddop into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #87
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-08-10 01:26:19 +02:00
e91ce0f58f
fix syntax error in pull 86
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-08-10 04:52:52 +05:30
e8a5ec5594 Merge pull request 'bridge ircdevchan tgdevchan' (#86) from add/matterbridge-chillnet-tgchan into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #86
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-08-10 01:06:54 +02:00
90abdc179b
bridge ircdevchan tgdevchan
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-08-10 04:08:34 +05:30
4df811c834 Merge pull request 'denc-webcluster: include proxy in agola' (#85) from fix/nginx/sslproxy into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #85
2023-07-31 21:29:10 +02:00
32a0f8d653
denc-webcluster: include proxy in agola
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-31 21:25:28 +02:00
0df71b4331 Merge pull request 'Repair boolean' (#84) from fix/nginx/boolean into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #84
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-07-31 21:15:42 +02:00
13d5e44baa
Repair boolean
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Follow up to b6e9f75352, forgot to quote
the string causing it to still be converted to a boolean.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-31 21:10:35 +02:00
beec7cde28 Merge pull request 'denc-webcluster: exclude 949110' (#83) from fix/bookstack/400 into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #83
2023-07-31 20:49:31 +02:00
fb981646e5
denc-webcluster: exclude 949110
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
ModSecurity rule blocked Bookstack from saving some pages while editing.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-31 20:44:52 +02:00
5d4350aed3 Merge pull request 'Repair boolean' (#82) from ci into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #82
2023-07-21 17:08:41 +02:00
b6e9f75352
Repair boolean
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
```
nginx: [emerg] invalid value "True" in "proxy_ssl_verify" directive, it
must be "on" or "off" in /etc/nginx/vhosts.d/agola.conf:14
```

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-21 17:04:49 +02:00
40b7913d32 Merge pull request 'Add reverse proxy for Agola' (#81) from ci into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #81
2023-07-21 16:37:16 +02:00
24d6de3a5d
Add reverse proxy for Agola
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
New service behind ci.lysergic.dev / ci.git.com.de.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-21 16:27:50 +02:00
8b735d45e2 Merge pull request 'Initialize OpenBSD support' (#80) from OpenBSD into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #80
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-07-16 20:13:41 +02:00
e03e939bf9 Merge pull request 'Optimize minion' (#79) from minion-optimization into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #79
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-07-16 20:12:36 +02:00
4778c43503
Initialize OpenBSD support
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
No states assigned yet.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-16 20:10:26 +02:00
dc3cbea053
Optimize minion
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Cache jobs for later reference, disable unused hardware grains.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-16 20:04:26 +02:00
c7e590843f Merge pull request 'Add http(s) to thetrip public zone' (#78) from thetrip-firewall into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #78
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-07-01 22:25:51 +02:00
29ceb78cde
Add http(s) to thetrip public zone
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Forgotten in fffbaf4698.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-01 22:21:39 +02:00
fffbaf4698 Merge pull request 'Manage firewall on thetrip' (#77) from thetrip-firewall into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #77
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-07-01 22:15:30 +02:00
8519dfec68
Manage firewall on thetrip
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-07-01 22:12:14 +02:00
b73c0805cd Merge pull request 'Manage firewall on derutil01' (#76) from derutil01-fw into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #76
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-06-28 22:17:07 +02:00
080002e642
Manage firewall on derutil01
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Configuration should be imported already.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-06-28 22:10:58 +02:00
1bd2f39312 Merge pull request 'Change redis to redis7' (#75) from salt-redis7 into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #75
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-06-28 22:00:16 +02:00
58c100acc1
Change redis to redis7
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Leap 15.5 renamed the package, "redis" will try to install Redis 6 and
cause a conflict.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-06-28 21:56:54 +02:00
47a364290c Merge pull request 'Remove backslashes in string' (#74) from fix-matterb-mediapath into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #74
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-06-28 19:53:24 +02:00
b36dc960c8 Merge branch 'production' into fix-matterb-mediapath
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
2023-06-28 19:45:43 +02:00
ddf1c03dbb
remove backslash
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-06-28 23:10:34 +05:30
f4f7f93583 Merge pull request 'Update mediapath for matterbridge' (#73) from fix-matterb-mediapath into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #73
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-06-27 20:27:16 +02:00
7145ae4481
update mediapath for matterbridge
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-06-27 23:47:53 +05:30
937b3c99b7 Merge pull request 'Add chillnet matterbridge uploads' (#72) from upload-matterbridge-chillnet into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #72
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-06-24 22:27:51 +02:00
667646a295 Add chillnet matterbridge uploads
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-06-25 01:46:13 +05:30
36c70f4016 Merge pull request 'Rename Chillnet staff channel' (#71) from matter_remap into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #71
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-03 20:51:09 +02:00
97045b5f12 Used /RENAME for #fightclub
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
2023-05-03 19:38:05 +02:00
ffbd2dc4c3 Merge pull request 'Init psyched.dev' (#70) from psyched into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #70
2023-05-02 21:07:25 +02:00
c1fcf5f3b1
Init psyched.dev
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Add pillar IDs for theia/orpheus/selene to disable sshd
management on them (machines use custom configurations
for historic reasons, and we like to preserve history).

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 21:00:45 +02:00
ac0a2b6587 Merge pull request 'Init dencpod01.lysergic.dev' (#68) from dencpod01 into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #68
2023-05-02 20:51:55 +02:00
b6b129c41f
Init dencpod01.lysergic.dev
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Blank machine.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 20:40:09 +02:00
774706211e Merge pull request 'Move backup_mode to minion dict' (#67) from file-backup into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #67
2023-05-02 20:28:34 +02:00
2ce85f172e
Move backup_mode to minion dict
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Is a minion specific option.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 20:25:33 +02:00
ffe1e60baf Merge pull request 'Enable minion file backup' (#66) from file-backup into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #66
2023-05-02 20:19:46 +02:00
c4532b4686
Enable minion file backup
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
https://docs.saltproject.io/en/latest/ref/states/backup_mode.html

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 20:13:24 +02:00
3143bfd96d Merge pull request 'Import moni firewall configuration' (#65) from moni into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #65
2023-05-02 20:06:31 +02:00
d89138e2a7
Import moni firewall configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Some ports not yet covered by a role.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 20:02:21 +02:00
05d86ce689 Merge pull request 'Init phoebe.lysergic.dev' (#64) from phoebe into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #64
2023-05-02 19:52:06 +02:00
55acb1dea4
Init phoebe.lysergic.dev
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Blank machine.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 19:48:22 +02:00
9f176609a5 Merge pull request 'Add manage_sshd conditional' (#63) from sshd-optional into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #63
2023-05-02 19:39:20 +02:00
409016ea75
Disable manage_sshd for philia
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Machine uses a custom sshd configuration for $reasons.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 19:32:36 +02:00
8776b16be1
Add manage_sshd conditional
Allow sshd configuration to be skipped on "special" machines using
an optional "manage_sshd: False" pillar option.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 19:30:33 +02:00
6763d1b64e Merge pull request 'No longer remove libX11' (#62) from libX11 into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #62
2023-05-02 00:16:20 +02:00
d4d7d41ca7
No longer remove libX11
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Multiple packages need it as a dependency, maintaining an exclusion list
is not feasible.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 00:11:45 +02:00
16827d7318 Merge pull request 'Add users conditional for sss' (#61) from skip-users-if-sss into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #61
2023-05-01 23:15:45 +02:00
51e33815df
Add users conditional for sss
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Skip failing local users management on machines using sssd.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-01 22:25:28 +02:00
bfeeb8673e Merge pull request 'Check files in nbroles to grains script' (#60) from nbroles-to-grains-refactor into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #60
2023-05-01 21:48:34 +02:00
de9ac40e3f
Check files in nbroles to grains script
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Script is called in the Lysergic repository as well, where not all files
exist.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-01 21:45:13 +02:00
c951f48b71 Merge pull request 'Repair manage_firewall behavior' (#59) from firewall-optional into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #59
2023-05-01 20:39:02 +02:00
f96e9a4901
Repair manage_firewall behavior
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Fixup to b685f16c91, default value was
outside of conditional - it didn't cause any errors, but did not work as
expected either. :-)

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-01 20:35:27 +02:00
75c91e72cb Merge pull request 'Set env_order + ping_on_rotate' (#58) from saltenv into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #58
2023-05-01 20:27:12 +02:00
2a9a5cf394
Set ping_on_rotate
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Enable option to ensure minions are immediately responsive after key
rotations.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-01 20:24:13 +02:00
1089146801
Set env_order
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Option was removed in d4f39e8e5f, but the
default environment seems to not be set to "production" without
it being present. Adding it back until a better way is found.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-01 20:20:32 +02:00
27d178d852 Merge pull request 'Repair BookStack httpd configuration' (#57) from themis-httpd-fixup into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #57
2023-05-01 00:08:00 +02:00
841317e0f4
Repair BookStack httpd configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
- Replace wrong instances of RewriteCond with RewriteRule
- Remove wrong quotes around rewrite conditions
- Set correct options (seemingly our version of httpd does not set
  FollowSymLinks by default?)

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-01 00:00:31 +02:00
5f1793547b Merge pull request 'Repair PrivateBin config quoting' (#56) from privatebin-quoting into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #56
2023-04-30 20:42:21 +02:00
942b71815e
Repair PrivateBin config quoting
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Ensure strings are quoted correctly.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 20:38:43 +02:00
edd16ff3a7 Merge pull request 'Repair undefined id' (#55) from common-id-var into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #55
2023-04-30 20:14:32 +02:00
1290fd5ec7
Repair undefined id
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Replace with call to grains dict.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 20:11:24 +02:00
f56ed6f64e Merge pull request 'Adjust themis httpd directory options' (#50) from themis-httpd-fixup into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #50
2023-04-30 20:04:42 +02:00
d8263f9b80 Merge pull request 'Exclude libX11 removal for FPM hosts' (#54) from libX11-php into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #54
2023-04-30 19:58:19 +02:00
269b30ce9f
Exclude libX11 removal for FPM hosts
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Needed for some PHP extensions.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 19:48:36 +02:00
21f8818a52 Merge pull request 'Repair BookStack quoting' (#53) from bookstack-quoting into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #53
2023-04-30 19:00:05 +02:00
985b401aaa
Repair BookStack quoting
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Re-order ending quote.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 18:57:03 +02:00
65af33d4fb Merge pull request 'Repair BookStack quoting' (#52) from bookstack-quoting into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #52
2023-04-30 18:53:40 +02:00
4053be45d2
Repair BookStack quoting
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Attempt to repair quoting by correcting the if-condition grouping and by
replacing the quote filter with manual quotes.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 18:50:25 +02:00
8d9af70941 Merge pull request 'BookStack fixups' (#51) from bookstack-fixup into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #51
2023-04-30 18:34:12 +02:00
ef0a931157
Correct BookStack group
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Environment file needs to be readable by the www, not the wwwrun, group
for PHP-FPM to be able to access it.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 18:27:35 +02:00
d8359f002d
Correct SAML realm capitalization
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
The Keycloak realm is named "LibertaCasa", not "libertacasa".

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 18:22:58 +02:00
938be46faf
Quote BookStack values
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Some strings contain spaces or special characters and should be quoted.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 18:20:54 +02:00
0a3d34d962
Adjust themis httpd directory options
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Some directory options are not needed and were listed with syntax
issues. Set to false to prevent "Options" from
being added, which equals "Options +FollowSymLinks".

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 18:16:35 +02:00
600a73a984 Merge pull request 'Add empty role.privatebin pillar' (#49) from privatebin-role into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #49
2023-04-30 16:44:56 +02:00
b0613cf377
Add empty role.privatebin pillar
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
For some reason Salt complains about the file missing, albeit us using
"ignore_missing" in the top file.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 16:41:22 +02:00
b7f34f8b9d Merge pull request 'Add manage_firewall conditional' (#48) from firewall-optional into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #48
2023-04-30 16:11:46 +02:00
b685f16c91
Add manage_firewall conditional
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Allow us to enroll machines in Salt which do not yet have their firewall
configuration imported without having their rules overwritten.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 16:07:21 +02:00
f90197f791 Merge pull request 'Add empty role.bookstack pillar' (#47) from bookstack-pillar into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #47
2023-04-30 14:58:14 +02:00
e8107a3054
Add empty role.bookstack pillar
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
For some reason Salt complains about the file missing (albeit us using
having "ignore_missing" enabled in the pillar top).

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 14:54:43 +02:00
524c82cafa Merge pull request 'Allow saltenv/pillarenv override' (#45) from saltenv into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #45
2023-04-30 14:49:12 +02:00
d4f39e8e5f
Allow saltenv/pillarenv override
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
To ease development, allow saltenv=<branch>/pillarenv=<branch> instead
of enforcing the production branch.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 14:43:59 +02:00
a7cd6609e6 Merge pull request 'Watch httpd service for snippets' (#46) from httpd-service into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #46
2023-04-30 14:43:42 +02:00
d65cb9a43b
Watch httpd service for snippets
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
The reload/restart module calls have been dropped from the formula.
Watch the service.running state instead.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-30 14:39:27 +02:00
b1249e69eb Merge pull request 'Import themis / PrivateBin' (#40) from privatebin into production
Some checks failed
ci/lysergic/push/pipeline Pipeline failed
Reviewed-on: #40
2023-04-30 14:37:12 +02:00
87bb69fa37 Merge pull request 'Split out salt.formulas state' (#44) from profile-formulas into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #44
2023-04-29 19:07:32 +02:00
76d1da11d9
Split out salt.formulas state
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Allow formulas update on Salt master without applying the complete Salt
master profile.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-29 18:55:49 +02:00
f32d814658
id.themis: import backend firewall rules
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Allow HTTPS traffic.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-29 18:39:30 +02:00
a6319da822 Merge pull request 'Add tg lucy channel mapping' (#43) from mattertgbridge into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #43
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-14 17:07:49 +02:00
9d9e61d51d
Add tg lucy channel mapping
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-04-14 18:45:51 +05:30
8420bbdf6f Merge pull request 'Add ChillNet matterbridge' (#42) from chillnet into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #42
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-04-09 21:24:24 +02:00
508c0dc1b2
Add Chillnet to matterbridge
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-04-10 00:25:14 +05:30
6ebd02042f
Refactor matterbridge_media macro
Signed-off-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-04-10 00:18:59 +05:30
4ff7a39f0e
id.themis: import PrivateBin httpd vhost
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-03-12 17:21:32 +01:00
bf3aaa5ff1
id.themis: import PrivateBin configuration
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-03-12 17:01:17 +01:00
96daffc979
Add privatebin profile+role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-03-12 17:01:00 +01:00
84c1cecf61 Merge pull request 'Import themis / BookStack' (#35) from bookstack into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #35
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-03-11 22:11:32 +01:00
c932881cd7
profile.bookstack: quote keys
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Some keys needed quoting to pass the YAML parser.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-03-11 18:10:07 +01:00
a1ce36fd6c
Enable php-formula
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:29 +01:00
c28a4f5a52
role.bookstack: include php-fpm
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:29 +01:00
361e118b31
Add php-fpm role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:29 +01:00
f55e5363a0
Enable memcached-formula
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:28 +01:00
edbf9f3f20
role.bookstack: include memcached
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:28 +01:00
f820978b78
Add memcached role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:28 +01:00
4653655010
profile.apache-httpd: manage snippets
- add apache-httpd profile with snippets configuration
- add TLS snippet to apache-httpd role pillar

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:28 +01:00
d8d848055f
id.themis: add BookStack configuration
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:28 +01:00
e36d40dbc3
id.themis: add BookStack httpd configuration
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:28 +01:00
5e0c0e4bff
Add bookstack profile+role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 13:14:27 +01:00
906dd92d7e
Add web.apache-httpd role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 11:10:05 +01:00
e58c63decc
Enable apache-formula
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-26 11:10:04 +01:00
cc007e6470 Merge pull request 'Import moni Prometheus configuration' (#32) from prometheus-moni into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #32
2023-02-25 16:47:21 +01:00
c8c91269fd Merge pull request 'pipeline.gommit: allow more characters in prefix' (#38) from commit-lint into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #38
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-02-22 20:37:50 +01:00
ddb72f1cb3
Disable commit linting
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Temporary change until imports with existing messages are finished.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-21 19:08:27 +01:00
0730cbb4c2
Manage Prometheus firewall rules
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-21 19:06:04 +01:00
cade9c0aca
Moni: Read Blackbox targets as JSON
Use uniform JSON target files instead of a JSON/YAML mix.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-21 19:06:03 +01:00
8016f86164
p.node_exporter->p.prometheus.node_exporter
Since the last commit introduced a new Prometheus targets profile, it
makes sense to move node_exporter underneath the Prometheus tree as
well.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-21 19:06:01 +01:00
2bafbeedd7
Manage Prometheus targets
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-21 19:05:40 +01:00
979021f5c4
Import Prometheus server configuration
* add new roles:
  - monitoring.prometheus
  - monitoring.prometheus-alertmanager
  - monitoring.prometheus-exporter-blackbox
* add common Prometheus and Prometheus Alertmanager pillar data
* add moni.lysergic.dev specific Prometheus pillar data

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-21 19:05:03 +01:00
cdd09ed524
pipeline.gommit: allow more characters in prefix
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
- For profiles/roles with - or _ in their name
- In the future we should rename all - to _ and adjust the regex to forbid all -

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 20:09:14 +01:00
a705925aa6 Merge pull request 'Commmit lint: allow pipeline + more characters' (#37) from commit-lint into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #37
2023-02-20 19:34:14 +01:00
0c8e3159d3
pipeline.gommit: allow pipeline + more characters
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
- allow pipeline.* prefix
- allow some special characters in summary

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-19 22:18:43 +01:00
6e43bbbe44 Merge pull request 'Enable commit message linting' (#36) from commit-lint into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #36
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-02-19 20:54:59 +01:00
68e41ceab8
Enable commit linting
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-19 20:43:10 +01:00
d082729a66
Add commit linting
- add gommit configuration
- add wrapper script

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-19 20:43:09 +01:00
51da14de69 Merge pull request 'Linting' (#33) from linting into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #33
2023-02-15 23:22:08 +01:00
18d28c3b7f
Address salt-lint errors/warnings
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
- remove trailing whitespaces
- format octal modes correctly

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-15 23:18:54 +01:00
cd93d792ff
Address yamllint errors/warnings
- remove spaces, add headers
- add ignore for line-lengths in .pipeline.yml

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-15 23:15:25 +01:00
36b1fbffb2
Add linting pipeline
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-15 23:15:25 +01:00
6096be0f81 Merge pull request 'Enable prometheus-formula' (#31) from prometheus-formula into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #31
2023-02-15 19:09:12 +01:00
2674d21efc
Enable prometheus-formula
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-15 18:57:18 +01:00
2c2a37ef8b Merge pull request 'denc-webcluster: add ModSecurity adjustments' (#30) from import-denc-webcluster-nginx-modsec into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #30
2023-02-13 01:06:56 +01:00
c75e31c145
denc-webcluster: add ModSecurity adjustments
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
With the rollout of our Salted configuration, ModSecurity came enforced.
This adds necessary rules to PrivateBin and BookStack for correct
operation.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 23:46:22 +01:00
f69cd00888 Merge pull request 'denc-webcluster: nginx listen on HA addresses' (#29) from import-denc-webcluster-nginx-listen-fixup into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #29
2023-02-12 17:43:59 +01:00
37a1ec433a
denc-webcluster: nginx listen on HA addresses
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Accidentally configured to listen only internally.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 17:42:31 +01:00
29435f6fc3 Merge pull request 'AppArmor: reload on drop-in changes' (#28) from reload-apparmor into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #28
2023-02-12 17:37:56 +01:00
75f105a6aa
AppArmor: reload on drop-in changes
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Self-explanatory.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 17:35:09 +01:00
0a00f3ea93 Merge pull request 'Manage AppArmor on web-proxie's' (#27) from import-denc-webcluster-apparmor into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #27
2023-02-12 17:14:41 +01:00
2d5da24ce5
denc-webcluster: nginx AppArmor rules
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Allow access to client trust certificate and to static content.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 16:39:49 +01:00
7e73f6b1a4
web-proxy: include apparmor.local
Some web proxy servers need additional AppArmor drop-ins, for example
for serving static content.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 16:39:48 +01:00
0eca62f4ce
Add AppArmor profile
Simple profile to allow for management of local profile drop-ins using
pillar values.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 16:20:44 +01:00
91089d5d98 Merge pull request 'denc-webcluster: nginx config fixup' (#26) from import-denc-webcluster-iphash into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #26
2023-02-12 15:56:30 +01:00
eac227d120
denc-webcluster: nginx config fixup
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
- remove keys duplicated by include
- repair wrong snippets include directory
- repair wrong ip_hash option syntax

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 15:48:44 +01:00
f9341ad9fe Merge pull request 'ha-node: vrrp is a protocol' (#25) from vrrp-fixup into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #25
2023-02-12 15:25:53 +01:00
d017233a52
ha-node: vrrp is a protocol
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Accidentally added as a service.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 15:22:08 +01:00
5fdbdc7462 Merge pull request 'denc-webcluster: allow http(s) publicly' (#24) from import-denc-webcluster-fw into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #24
2023-02-12 14:44:20 +01:00
533aedd864
denc-webcluster: enable keepalived script security
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Prevent script tampering.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 14:37:45 +01:00
7481741f95
denc-webcluster: allow http(s) publicly
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Public firewall rules were missing from initial import.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-12 14:33:34 +01:00
8c21d250c3 Merge pull request 'Import denc webcluster (nemesis/hubris)' (#12) from import-denc-webcluster into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #12
2023-02-12 14:25:55 +01:00
55 changed files with 860 additions and 67 deletions

23
.gommit.toml Normal file
View File

@ -0,0 +1,23 @@
[config]
exclude-merge-commits=true
check-summary-length=true
summary-length=50
[matchers]
all='^(?:(?:Add|Remove|Update|Enable|Disable) |(?:role|profile|id|pipeline)\.[\w\-_]+: )[\w \.\+\-]+\n(?:(?:\n\- .*)+\n)?(?:\nSigned-off-by: \w+ \w+ <.*@.*>)'
[examples]
summary_variant_one="""
[Add|Remove|Update|Enable|Disable] this and that
"""
summary_variant_two="""
[role.$role|profile.$profile]: this and that
"""
body_message="""
- an optional body line
- another optional body line
Signed-off-by: Max Mandatory <required@example.com>
"""

View File

@ -1,9 +1,32 @@
---
# yamllint disable rule:line-length
skip_clone: true skip_clone: true
pipeline: pipeline:
# commit_lint:
# image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline-gommit:latest
# secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
# when:
# event: [push]
# commands:
# - git clone --single-branch -b $CI_COMMIT_BRANCH $CI_REPO_LINK ../salt-libertacasa-commit-linting
# - cd ../salt-libertacasa-commit-linting
# - bin/lint-commits.pl production
code_lint:
image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline-lint:latest
secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
when:
event: [push]
commands:
- git clone --single-branch -b $CI_COMMIT_BRANCH $CI_REPO_LINK ../salt-libertacasa-linting
- cd ../salt-libertacasa-linting
- find . -type f \( -name '*.yaml' -o -name '*.yml' \) -exec yamllint -f colored -s {} +
- find . -name '*.sls' -exec salt-lint --severity -x 204 {} +
check: check:
image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline:latest image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline:latest
secrets: [ ci_netrc_username, ci_netrc_password, ci_netrc_machine ] secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
when: when:
event: [push] event: [push]
commands: commands:
@ -29,5 +52,5 @@ pipeline:
event: [push] event: [push]
instance: woodpecker-orpheus.intranet.squirrelcube.com instance: woodpecker-orpheus.intranet.squirrelcube.com
commands: commands:
#- rolesyncer # - rolesyncer
- bin/rolesyncer.py - bin/rolesyncer.py

39
bin/lint-commits.pl Executable file
View File

@ -0,0 +1,39 @@
#!/usr/bin/perl
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
use v5.26;
my ($branch_main) = @ARGV;
if(!$branch_main){
$branch_main = "master"
}
`git ls-remote origin $branch_main` =~ /([a-f0-9]{40})/;
my $refHead = `git rev-parse HEAD`;
my $refTail = $1;
chomp($refHead);
chomp($refTail);
if ($refHead eq $refTail) {
exit 0;
}
system "gommit check range $refTail $refHead";
if ($? > 0) {
exit 1;
}

View File

@ -1,4 +1,14 @@
#!/usr/bin/env sh #!/usr/bin/env sh
# This rewrites top-files to fetch roles from grains instead of our custom roles API. Useful for testing outside of the LibertaCasa infrastructure, but not recommended for production. # This rewrites top-files to fetch roles from grains instead of our custom roles API. Useful for testing outside of the LibertaCasa infrastructure, but not recommended for production.
sed -i "s/salt\['http.query'\].*/grains\['roles'\] -%}/" */top.sls potential_files=(*/top.sls salt/common/suse.sls)
for file in ${potential_files[@]}
do
if [ -f "$file" ]
then
files+="$file "
fi
done
sed -i "s/salt\['http.query'\].*/grains\['roles'\] -%}/" ${files[@]}

View File

@ -15,6 +15,7 @@ keepalived:
smtp_server: {{ mailer }} smtp_server: {{ mailer }}
smtp_connect_timeout: 30 smtp_connect_timeout: 30
router_id: SSO_FO router_id: SSO_FO
enable_script_security: true
vrrp_script: vrrp_script:
check_nginx_port: check_nginx_port:
script: '"/usr/bin/curl -kfsSm2 https://[::1]:443"' script: '"/usr/bin/curl -kfsSm2 https://[::1]:443"'
@ -89,18 +90,15 @@ nginx:
{{ nginx_crtkeypair('lysergic', 'lysergic.dev') | indent }} {{ nginx_crtkeypair('lysergic', 'lysergic.dev') | indent }}
- include: snippets/tls - include: snippets/tls
tls_syscidsso: tls_syscidsso:
- ssl_trusted_certificate: {{ trustcrt }}
- ssl_client_certificate: {{ trustcrt }} - ssl_client_certificate: {{ trustcrt }}
- ssl_certificate: /etc/ssl/syscid/sso.syscid.com.crt - ssl_certificate: /etc/ssl/syscid/sso.syscid.com.crt
- ssl_certificate_key: /etc/ssl/syscid/sso.syscid.com.key - ssl_certificate_key: /etc/ssl/syscid/sso.syscid.com.key
- ssl_ocsp: 'on' - ssl_ocsp: 'on'
- ssl_ocsp_responder: {{ stapler }} - ssl_ocsp_responder: {{ stapler }}
- ssl_stapling: 'on'
- ssl_stapling_responder: {{ stapler }} - ssl_stapling_responder: {{ stapler }}
- ssl_stapling_verify: 'on'
- ssl_verify_client: 'on' - ssl_verify_client: 'on'
- resolver: {{ resolver }} ipv6=off - resolver: {{ resolver }} ipv6=off
- include: snippets.d/tls - include: snippets/tls
servers: servers:
managed: managed:
@ -110,7 +108,7 @@ nginx:
- proxy_cache_path: /var/cache/nginx/sso_public keys_zone=cache_sso_public:10m - proxy_cache_path: /var/cache/nginx/sso_public keys_zone=cache_sso_public:10m
- proxy_cache_path: /var/cache/nginx/sso_private keys_zone=cache_sso_private:10m - proxy_cache_path: /var/cache/nginx/sso_private keys_zone=cache_sso_private:10m
- upstream jboss: - upstream jboss:
- ip: hash - ip_hash: ''
- server: - server:
- theia.backend.syscid.com:8443 - theia.backend.syscid.com:8443
- orpheus.backend.syscid.com:8443 - orpheus.backend.syscid.com:8443
@ -120,13 +118,18 @@ nginx:
config: config:
- server: - server:
- include: - include:
- snippets/listen - snippets/listen_ha
- snippets/tls_libertacasa - snippets/tls_libertacasa
- server_name: libertacasa.info libcasa.info - server_name: libertacasa.info libcasa.info
- location /: - location /:
- proxy_pass: https://bookstack.themis.backend.syscid.com - proxy_pass: https://bookstack.themis.backend.syscid.com
- proxy_http_version: 1.1 - proxy_http_version: 1.1
- client_max_body_size: 20M - client_max_body_size: 20M
- modsecurity_rules: |-
'
SecRuleRemoveById 941160 949110
SecAction "id:900200, phase:1, nolog, pass, t:none, setvar:\'tx.allowed_methods=GET HEAD POST OPTIONS PUT PATCH\'"
'
http.conf: http.conf:
config: config:
@ -142,19 +145,23 @@ nginx:
config: config:
- server: - server:
- include: - include:
- snippets/listen - snippets/listen_ha
- snippets/tls_lysergic - snippets/tls_lysergic
- server_name: pasta.lysergic.dev - server_name: pasta.lysergic.dev
- location /: - location /:
- proxy_pass: https://privatebin.themis.backend.syscid.com - proxy_pass: https://privatebin.themis.backend.syscid.com
- proxy_http_version: 1.1 - proxy_http_version: 1.1
- client_max_body_size: 50M - client_max_body_size: 50M
- modsecurity_rules: |-
'
SecRequestBodyNoFilesLimit 50000000
'
sso_private.conf: sso_private.conf:
config: config:
- server: - server:
- include: - include:
- snippets/listen - snippets/listen_ha
- snippets/tls_syscidsso - snippets/tls_syscidsso
- server_name: sso.syscid.com - server_name: sso.syscid.com
- root: /srv/www/sso.syscid.com - root: /srv/www/sso.syscid.com
@ -174,14 +181,14 @@ nginx:
config: config:
- server: - server:
- include: - include:
- snippets/listen - snippets/listen_ha
- snippets/tls_libsso - snippets/tls_libsso
- server_name: sso.casa www.sso.casa - server_name: sso.casa www.sso.casa
- location /: - location /:
- root: /srv/www/sso.casa - root: /srv/www/sso.casa
- server: - server:
- include: - include:
- snippets/listen - snippets/listen_ha
- snippets/tls_libsso - snippets/tls_libsso
- server_name: libsso.net www.libsso.net - server_name: libsso.net www.libsso.net
- location /: - location /:
@ -204,3 +211,30 @@ nginx:
- proxy_busy_buffers_size: 512k - proxy_busy_buffers_size: 512k
- error_log: /var/log/nginx/libsso_public.error.log - error_log: /var/log/nginx/libsso_public.error.log
- access_log: /var/log/nginx/libsso_public.access.log combined - access_log: /var/log/nginx/libsso_public.access.log combined
agola.conf:
config:
- server:
- include:
- snippets/listen_ha
- snippets/tls_lysergic
- server_name: ci.lysergic.dev ci.git.com.de
- location /:
- proxy_pass: https://ci.lysergic.dev
- proxy_ssl_verify: 'on'
- include: snippets/proxy
manage_firewall: True
firewalld:
zones:
public:
services:
- http
- https
profile:
apparmor:
local:
usr.sbin.nginx:
- '{{ trustcrt }} r,'
- '/srv/www/{libsso.net,sso.casa,sso.syscid.com}/{index.html,stuff/tacit-css-1.5.2.min.css} r,'

View File

@ -1,8 +1,13 @@
---
- apache
- firewalld - firewalld
- keepalived - keepalived
- memcached
- nginx - nginx
- openssh - openssh
- php
- postfix - postfix
- prometheus
- salt - salt
- tor - tor
- users - users

View File

@ -15,6 +15,7 @@ zypper:
refreshdb_force: False refreshdb_force: False
firewalld: firewalld:
FlushAllOnReload: 'yes'
zones: zones:
internal: internal:
short: Internal short: Internal

View File

@ -0,0 +1 @@
manage_firewall: True

View File

@ -1,4 +1,4 @@
{%- set mediapath = '/srv/matterbridge/' -%} {%- set mediapath = '/var/lib/matterbridge/' -%}
{%- macro discord_common() -%} {%- macro discord_common() -%}
AutoWebhooks: 'true' AutoWebhooks: 'true'
@ -34,12 +34,12 @@ profile:
Password: ${'secret_matterbridge:general:accounts:xmpp.libertacasa:Password'} Password: ${'secret_matterbridge:general:accounts:xmpp.libertacasa:Password'}
Muc: muc.liberta.casa Muc: muc.liberta.casa
Nick: viaduct Nick: viaduct
RemoteNickFormat: '[{PROTOCOL}] <{NICK}>' RemoteNickFormat: '[{PROTOCOL}] <{NICK}> '
Label: x Label: x
Debug: 'false' Debug: 'false'
telegram.libertacasa: telegram.libertacasa:
Token: ${'secret_matterbridge:general:accounts:telegram.libertacasa:Token'} Token: ${'secret_matterbridge:general:accounts:telegram.libertacasa:Token'}
RemoteNickFormat: '&lt;{NICK}&gt; ' RemoteNickFormat: '[{PROTOCOL}] &lt;{NICK}&gt; '
MessageFormat: HTMLNick MessageFormat: HTMLNick
Label: tg Label: tg
DisableWebPagePreview: 'true' DisableWebPagePreview: 'true'
@ -47,7 +47,7 @@ profile:
Server: 192.168.0.110:2220 Server: 192.168.0.110:2220
Nick: LC Nick: LC
RemoteNickFormat: '{PROTOCOL}:<{NICK}> ' RemoteNickFormat: '{PROTOCOL}:<{NICK}> '
Label: p Label: ssh
discord.23: discord.23:
Token: ${'secret_matterbridge:general:accounts:discord.23:Token'} Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
Server: ${'secret_matterbridge:general:accounts:discord.23:Server'} Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
@ -61,7 +61,6 @@ profile:
gateways: gateways:
libcasa: libcasa:
irc.libertacasa: '#libcasa' irc.libertacasa: '#libcasa'
sshchat.Psyched: sshchat
xmpp.libertacasa: libcasa xmpp.libertacasa: libcasa
dev: dev:
irc.libertacasa: '#dev' irc.libertacasa: '#dev'
@ -69,22 +68,19 @@ profile:
lucy: lucy:
irc.libertacasa: '#lucy' irc.libertacasa: '#lucy'
xmpp.libertacasa: lucy xmpp.libertacasa: lucy
telegram.libertacasa: '-1001795702961'
sshchat.Psyched: sshchat
info: info:
irc.libertacasa: '#libcasa.info' irc.libertacasa: '#libcasa.info'
xmpp.libertacasa: libcasa.info xmpp.libertacasa: libcasa.info
#telegram.libertacasa: '-1001518274267'
chat: chat:
irc.libertacasa: '#chai' irc.libertacasa: '#chat'
discord.23: chat discord.23: chat
xmpp.libertacasa: chat xmpp.libertacasa: chat
dota: petals:
irc.libertacasa: '#dotes' irc.libertacasa: '#Petals'
discord.23: dotes telegram.libertacasa: '-1001971550949'
xmpp.libertacasa: dota
aithunder:
irc.libertacasa: '#aithunder'
# discord.aithunder: main-chat
xmpp.libertacasa: aithunder
libertacasa-irc: libertacasa-irc:
general: general:
@ -215,24 +211,61 @@ profile:
nerds: nerds:
irc.libertacasa: '#nerds' irc.libertacasa: '#nerds'
irc.nerds: '#nerds' irc.nerds: '#nerds'
chillops:
irc.libertacasa: '#chillops'
irc.chillnet: '#chillops'
irc.stardust: '#chillnet-test'
music: music:
irc.libertacasa: '#music' irc.libertacasa: '#music'
irc.chillnet: '#music' irc.chillnet: '#music'
irc.stardust: '#music' irc.stardust: '#music'
chillnet:
general:
MediaDownloadSize: 1000000000
MediaDownloadPath: {{ mediapath }}chillnet
MediaServerDownload: https://up.chillnet.org
accounts:
irc.chillnet:
Server: irc.chillnet.org:6697
UseTLS: 'true'
UseSASL: 'true'
Nick: viaduct
NickServNick: viaduct
NickServPassword: ${'secret_matterbridge:chillnet:accounts:irc.chillnet:NickServPassword'}
ColorNicks: 'true'
Charset: utf8
MessageSplit: 'true'
MessageQueue: 60
UseRelayMsg: 'true'
RemoteNickFormat: '{NICK}/{LABEL}'
telegram.chillnet:
Token: ${'secret_matterbridge:chillnet:accounts:telegram.chillnet:Token'}
RemoteNickFormat: '&lt;{NICK}&gt; '
MessageFormat: HTMLNick
Label: tg
DisableWebPagePreview: 'true'
discord.23:
Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
{{ discord_common() }}
gateways:
staff:
irc.chillnet: '#chillstaff'
telegram.chillnet: '-1001932699309'
devs:
irc.chillnet: '#chilldevs'
telegram.chillnet: '-1001778806358'
discord.23: chilldevs
lighttpd: lighttpd:
vhosts: vhosts:
matterbridge-general: matterbridge-general:
host: 'libertacasa-general\.matterbridge\.dericom02\.rigel\.lysergic\.dev' host: 'libertacasa-general.matterbridge.dericom02.rigel.lysergic.dev'
root: {{ mediapath }}libertacasa-general root: {{ mediapath }}libertacasa-general
matterbridge-irc: matterbridge-irc:
host: 'libertacasa-irc\.matterbridge\.dericom02\.rigel\.lysergic\.dev' host: 'libertacasa-irc.matterbridge.dericom02.rigel.lysergic.dev'
root: {{ mediapath }}libertacasa-irc root: {{ mediapath }}libertacasa-irc
matterbridge-chillnet:
host: 'chillnet.matterbridge.dericom02.rigel.lysergic.dev'
root: {{ mediapath }}chillnet
manage_firewall: True
firewalld: firewalld:
zones: zones:
web: web:

View File

@ -0,0 +1 @@
manage_firewall: True

View File

@ -12,3 +12,5 @@ tor:
hostname: cr36xbvmgjwnfw4sly4kuc6c3ozhesjre3y5pggq5xdkkmbrq6dz4fad.onion hostname: cr36xbvmgjwnfw4sly4kuc6c3ozhesjre3y5pggq5xdkkmbrq6dz4fad.onion
hs_ed25519_public_key: PT0gZWQyNTUxOXYxLXB1YmxpYzogdHlwZTAgPT0AAAAUd+uGrDJs0tuSXjiqC8LbsnJJMSbx15jQ7calMDGHhw== hs_ed25519_public_key: PT0gZWQyNTUxOXYxLXB1YmxpYzogdHlwZTAgPT0AAAAUd+uGrDJs0tuSXjiqC8LbsnJJMSbx15jQ7calMDGHhw==
hs_ed25519_secret_key: ${'secret_tor:hidden_services:irc:key'} hs_ed25519_secret_key: ${'secret_tor:hidden_services:irc:key'}
manage_firewall: True

View File

@ -44,15 +44,15 @@
- proxy_set_header: Host $http_host - proxy_set_header: Host $http_host
- resolver: '{{ resolver }} ipv4=off valid=24h' - resolver: '{{ resolver }} ipv4=off valid=24h'
{%- endmacro -%} {%- endmacro -%}
{%- macro matterbridge_media(name) -%} {%- macro matterbridge_media(domain, name, tls='load') -%}
- server: - server:
- include: - include:
- snippets/listen - snippets/listen
- snippets/tls_load - snippets/tls_{{ tls }}
- snippets/tls - snippets/tls
- server_name: {% if name == 'general' %}load.casa{%- else %}{{ name ~ '.load.casa' }}{%- endif %} - server_name: {{ domain }}
- location /: - location /:
- proxy_pass: http://libertacasa-{{ name }}.matterbridge.dericom02.rigel.lysergic.dev - proxy_pass: http://{{ name }}.matterbridge.dericom02.rigel.lysergic.dev
{%- endmacro -%} {%- endmacro -%}
nginx: nginx:
@ -71,6 +71,7 @@ nginx:
{{ nginx_crtkeypair('meet', 'meet.com.de') | indent }} {{ nginx_crtkeypair('meet', 'meet.com.de') | indent }}
{{ nginx_crtkeypair('takahe', 'social.liberta.casa') | indent }} {{ nginx_crtkeypair('takahe', 'social.liberta.casa') | indent }}
{{ nginx_crtkeypair('pub_sectigo', 'pub') | indent }} {{ nginx_crtkeypair('pub_sectigo', 'pub') | indent }}
{{ nginx_crtkeypair('up.chillnet.org', 'up.chillnet.org') | indent }}
{#- locations shared between clearnet and Tor LibertaCasa servers #} {#- locations shared between clearnet and Tor LibertaCasa servers #}
libertacasa: libertacasa:
@ -316,8 +317,9 @@ nginx:
matterbridge.conf: matterbridge.conf:
config: config:
{{ matterbridge_media('general') }} {{ matterbridge_media('load.casa', 'libertacasa-general') }}
{{ matterbridge_media('irc') }} {{ matterbridge_media('irc.load.casa', 'libertacasa-irc') }}
{{ matterbridge_media('up.chillnet.org', 'chillnet', 'up.chillnet.org') }}
meet.conf: meet.conf:
config: config:
@ -441,3 +443,4 @@ nginx:
- sub_filter_types: application/xml - sub_filter_types: application/xml
- sub_filter: takahe.rigel.lysergic.dev:8000 exhausted.life - sub_filter: takahe.rigel.lysergic.dev:8000 exhausted.life
manage_firewall: True

View File

@ -0,0 +1 @@
manage_firewall: True

View File

@ -0,0 +1,123 @@
prometheus:
pkg:
component:
prometheus:
config:
alerting:
alertmanagers:
- static_configs:
- targets:
- localhost:9093
rule_files:
- /etc/prometheus/alerts/lysergic/*.yml
scrape_configs:
- job_name: 'prometheus'
static_configs:
- targets: ['localhost:9090']
- job_name: 'node_exporters_lysergic'
scrape_timeout: 1m
scrape_interval: 5m
file_sd_configs:
- files:
- '/etc/prometheus/targets/node-lysergic.json'
- job_name: 'blackbox-2xx'
metrics_path: /probe
params:
module: [http_2xx]
file_sd_configs:
- files: ['/etc/prometheus/targets/blackbox-2xx*.json']
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- target_label: __address__
replacement: 127.0.0.1:9115
- job_name: 'blackbox-3xx'
metrics_path: /probe
params:
module: [http_3xx]
file_sd_configs:
- files: ['/etc/prometheus/targets/blackbox-3xx*.json']
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- target_label: __address__
replacement: 127.0.0.1:9115
- job_name: 'certificate_exporter'
static_configs:
- targets: ['therapon.rigel.lysergic.dev:9793']
alertmanager:
config:
route:
group_by: ['alertname']
group_wait: 10s
group_interval: 10s
repeat_interval: 1h
receiver: 'smtp-local'
routes:
- receiver: 'lysergic'
# continue: false
match:
project: LYSERGIC
- receiver: 'chillnet'
match:
project: CHILLNET
receivers:
- name: 'smtp-local'
email_configs:
- to: 'system@lysergic.dev'
from: 'alertmanager@moni.lysergic.dev'
require_tls: false
# !!! TO-DO
smarthost: 'zz0.email:465'
send_resolved: yes
- name: 'irc-libertacasa'
webhook_configs:
- url: 'http://127.0.0.1:2410/universe'
send_resolved: yes
- name: 'lysergic'
webhook_configs:
- url: 'http://127.0.0.1:2410/universe'
send_resolved: yes
- url: http://127.0.0.2:8081/prometheus/webhook
send_resolved: yes
email_configs:
- to: 'system@lysergic.dev'
from: 'alertmanager@moni.lysergic.dev'
require_tls: false
smarthost: 'zz0.email:465'
send_resolved: yes
- name: 'chillnet'
email_configs:
- to: 'team@chillnet.org'
from: 'alertmanager@moni.lysergic.dev'
require_tls: false
smarthost: 'zz0.email:465'
send_resolved: yes
manage_firewall: True
firewalld:
zones:
internal:
services:
- https
ports:
- comment: DNS Slave
port: 5353
protocol: tcp
- port: 5353
protocol: udp

View File

@ -0,0 +1 @@
manage_sshd: False

View File

@ -0,0 +1 @@
manage_sshd: False

View File

@ -0,0 +1 @@
manage_firewall: True

View File

@ -0,0 +1 @@
manage_sshd: False

View File

@ -0,0 +1 @@
manage_sshd: False

View File

@ -0,0 +1,150 @@
{%- set common = {'address': '[fd29:8e45:f292:ff80::1]', 'port': 443, 'domain': '.themis.backend.syscid.com', 'snippetsdir': '/etc/apache2/snippets.d/'} -%}
{%- macro httpdformulaexcess() -%}
LogLevel: False
ErrorLog: False
LogFormat: False
CustomLog: False
ServerAdmin: False
ServerAlias: False
{%- endmacro -%}
{%- macro httpdcommon(app) -%}
Include {{ common['snippetsdir'] }}ssl_themis.conf
<FilesMatch '\.php$'>
SetHandler 'proxy:unix:/run/php-fpm/{{ app }}.sock|fcgi://{{ app }}'
</FilesMatch>
{%- endmacro -%}
apache:
sites:
BookStack:
interface: '{{ common['address'] }}'
port: {{ common['port'] }}
ServerName: bookstack{{ common['domain'] }}
DocumentRoot: /srv/www/BookStack/
DirectoryIndex: index.php
Directory:
/srv/www/BookStack/:
Options: FollowSymLinks
AllowOverride: None
Require: all granted
Formula_Append: |
RewriteEngine On
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [L,R=301]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
{{ httpdformulaexcess() }}
Formula_Append: |
{{ httpdcommon('BookStack') }}
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
SetOutputFilter DEFLATE
PrivateBin:
interface: '{{ common['address'] }}'
port: {{ common['port'] }}
ServerName: privatebin{{ common['domain'] }}
DocumentRoot: /srv/www/PrivateBin/public
DirectoryIndex: index.php
Directory:
/srv/www/PrivateBin/:
Options: false
AllowOverride: None
Require: all granted
{{ httpdformulaexcess() }}
Formula_Append: |
{{ httpdcommon('PrivateBin') }}
profile:
bookstack:
app_url: https://libertacasa.info
db_host: ${'secret_bookstack:db_host'}
db_database: ${'secret_bookstack:db_database'}
db_username: ${'secret_bookstack:db_username'}
db_password: ${'secret_bookstack:db_password'}
mail_driver: smtp
mail_from_name: LibertaCasa Documentation
mail_from: mail@libertacasa.info
mail_host: zz0.email
mail_port: 465
mail_username: mail@libertacasa.info
mail_password: ${'secret_bookstack:mail_password'}
mail_encryption: ssl
app_theme: lysergic
cache_driver: memcached
session_driver: memcached
memcached_servers: /run/memcached/memcached.sock
session_secure_cookie: true
session_cookie_name: libertacasa_megayummycookie
app_debug: false
session_lifetime: 240
auth_method: saml2
auth_auto_initiate: true
saml2_name: LibertaCasa SSO
saml2_email_attribute: email
saml2_external_id_attribute: uid
saml2_display_name_attributes: fullname
saml2_idp_entityid: https://libsso.net/realms/LibertaCasa
saml2_idp_sso: https://libsso.net/realms/LibertaCasa/protocol/saml
saml2_idp_slo: https://libsso.net/realms/LibertaCasa/protocol/saml
saml2_idp_x509: ${'secret_bookstack:saml2_idp_x509'}
saml2_autoload_metadata: false
saml2_sp_x509: ${'secret_bookstack:saml2_sp_x509'}
saml2_sp_x509_key: ${'secret_bookstack:saml2_sp_x509_key'}
saml2_user_to_groups: true
saml2_group_attribute: groups
saml2_remove_from_groups: true
queue_connection: database
privatebin:
main:
name: Bin
fileupload: true
syntaxhighlightingtheme: sons-of-obsidian
sizelimit: 310485760
notice: 'Note: Kittens will die if you abuse this service.'
languageselection: true
urlshortener: ${'secret_privatebin:main:urlshortener'}
qrcode: true
expire:
default: 1week
expire_options:
5min: 300
10min: 600
1hour: 3600
1day: 86400
1week: 604800
1month: 2592000
1year: 31536000
never: 0
formatter_options:
plaintext: Plain Text
syntaxhighlighting: Source Code
markdown: Markdown
traffic:
limit: 10
header: X_FORWARDED_FOR
dir: /var/lib/PrivateBin/limits
purge:
limit: 300
batchsize: 10
dir: /var/lib/PrivateBin/limits
model:
class: Database
model_options:
dsn: ${'secret_privatebin:model_options:dsn'}
tbl: privatebin_
usr: ${'secret_privatebin:model_options:usr'}
pwd: ${'secret_privatebin:model_options:pwd'}
opt[12]: true
manage_firewall: True
firewalld:
zones:
backend:
services:
- https

View File

@ -0,0 +1,7 @@
manage_firewall: True
firewalld:
zones:
public:
services:
- http
- https

View File

@ -0,0 +1 @@
# empty

View File

@ -1,7 +1,7 @@
firewalld: firewalld:
zones: zones:
internal: internal:
services: protocols:
- vrrp - vrrp
backend: backend:
protocols: protocols:

View File

@ -0,0 +1,2 @@
memcached:
listen_address: /run/memcached/memcached.sock

View File

@ -0,0 +1,11 @@
prometheus:
wanted:
component:
- alertmanager
pkg:
component:
alertmanager:
config:
global:
resolve_timeout: 5m

View File

@ -0,0 +1,50 @@
prometheus:
wanted:
component:
- blackbox_exporter
pkg:
component:
blackbox_exporter:
config:
modules:
http_2xx:
prober: http
timeout: 15s
http_post_2xx:
prober: http
http:
method: POST
http_3xx:
prober: http
timeout: 5s
http:
method: HEAD
no_follow_redirects: true
valid_status_codes: [301, 302]
tcp_connect:
prober: tcp
ssh_banner:
prober: tcp
tcp:
query_response:
- expect: "^SSH-2.0-"
irc_banner:
prober: tcp
tcp:
query_response:
- send: "NICK prober"
- send: "USER prober prober prober :prober"
- expect: "PING :([^ ]+)"
send: "PONG ${1}"
- expect: "^:[^ ]+ 001"
icmp:
prober: icmp
firewalld:
zones:
internal:
ports:
- comment: 'Prometheus Blackbox Exporter'
port: 9115
protocol: tcp

View File

@ -0,0 +1,17 @@
prometheus:
wanted:
component:
- prometheus
pkg:
component:
prometheus:
config:
global:
scrape_interval: 15s
evaluation_interval: 1m
firewalld:
zones:
internal:
services:
- prometheus

1
pillar/role/php-fpm.sls Normal file
View File

@ -0,0 +1 @@
# empty

View File

@ -0,0 +1 @@
# empty

View File

@ -21,7 +21,7 @@ salt:
- roots - roots
- git - git
file_roots: file_roots:
production: __env__:
{%- for formula in formulas %} {%- for formula in formulas %}
- /srv/formulas/{{ formula }}-formula - /srv/formulas/{{ formula }}-formula
{%- endfor %} {%- endfor %}
@ -30,6 +30,7 @@ salt:
- https://git.com.de/LibertaCasa/salt.git: - https://git.com.de/LibertaCasa/salt.git:
- user: ${'secret_salt:master:gitfs_remotes:LibertaCasa:user'} - user: ${'secret_salt:master:gitfs_remotes:LibertaCasa:user'}
- password: ${'secret_salt:master:gitfs_remotes:LibertaCasa:password'} - password: ${'secret_salt:master:gitfs_remotes:LibertaCasa:password'}
- fallback: production
ext_pillar: ext_pillar:
- netbox: - netbox:
api_url: ${'secret_salt:master:ext_pillar:netbox:api_url'} api_url: ${'secret_salt:master:ext_pillar:netbox:api_url'}
@ -59,6 +60,7 @@ salt:
timeout: 20 timeout: 20
gather_job_timeout: 20 gather_job_timeout: 20
keep_jobs: 30 keep_jobs: 30
ping_on_rotate: True
user: ${'secret_salt:master:user'} user: ${'secret_salt:master:user'}
syndic_user: ${'secret_salt:master:syndic_user'} syndic_user: ${'secret_salt:master:syndic_user'}
cache.redis.unix_socket_path: ${'secret_salt:master:cache.redis.unix_socket_path'} cache.redis.unix_socket_path: ${'secret_salt:master:cache.redis.unix_socket_path'}

View File

@ -3,4 +3,7 @@ salt:
minion_remove_config: True minion_remove_config: True
minion: minion:
master_type: str master_type: str
backup_mode: minion
cache_jobs: True
enable_gpu_grains: False
saltenv: production saltenv: production

View File

@ -0,0 +1,13 @@
{%- set host = grains['host'] -%}
{%- set fqdn = grains['fqdn'] -%}
apache:
global:
ServerAdmin: system@lysergic.dev
profile:
apache-httpd:
snippets:
ssl_{{ host }}:
- 'SSLCertificateFile "/etc/ssl/{{ host }}/{{ fqdn }}.crt"'
- 'SSLCertificateKeyFile "/etc/ssl/{{ host }}/{{ fqdn }}.key"'

1
salt/common/openbsd.sls Normal file
View File

@ -0,0 +1 @@
# Nothing yet

View File

@ -1,5 +1,6 @@
include: include:
- openssh.banner - openssh.banner
{%- if salt['pillar.get']('manage_sshd', True) %}
- openssh.config - openssh.config
/etc/ssh/user_ca: /etc/ssh/user_ca:
@ -10,3 +11,4 @@ include:
{%- endfor -%} {%- endfor -%}
- require: - require:
- pkg: openssh - pkg: openssh
{%- endif %}

View File

@ -1,9 +1,16 @@
include: include:
{#- drop pillar check after all firewall configurations have been imported #}
{%- if salt['pillar.get']('manage_firewall', False) %}
- firewalld - firewalld
{%- endif %}
- profile.seccheck - profile.seccheck
- profile.zypp - profile.zypp
- profile.node_exporter - profile.prometheus.node_exporter
{%- if salt['cmd.run']("awk '/^passwd/{ print $2; exit }' /etc/nsswitch.conf") == 'sss' %}
{%- do salt.log.warning('Not configuring local users due to sss') %}
{%- else %}
- users - users
{%- endif %}
- .ssh - .ssh
- postfix.config - postfix.config
@ -62,7 +69,6 @@ common_packages_remove:
{#- we only use AutoYaST for the OS deployment #} {#- we only use AutoYaST for the OS deployment #}
- autoyast2 - autoyast2
- autoyast2-installation - autoyast2-installation
- libX11-data
- yast2-add-on - yast2-add-on
- yast2-services-manager - yast2-services-manager
- yast2-slp - yast2-slp

View File

@ -0,0 +1,28 @@
{%- set snippetsdir = '/etc/apache2/snippets.d' -%}
{%- set mypillar = salt['pillar.get']('profile:apache-httpd', {}) -%}
{{ snippetsdir }}:
file.directory:
- makedirs: True
{%- if 'snippets' in mypillar %}
{%- for snippet, config in mypillar['snippets'].items() %}
{{ snippetsdir }}/{{ snippet }}.conf:
file.managed:
- contents:
{%- for line in config %}
- {{ line }}
{%- endfor %}
- require:
- file: {{ snippetsdir }}
{#- formula dependencies #}
- watch_in:
- service: apache-service-running
{%- endfor %}
{%- endif %}
include:
- apache.config

View File

@ -0,0 +1,22 @@
{%- set aapillar = salt['pillar.get']('profile:apparmor') %}
{%- if 'local' in aapillar %}
{%- for profile, lines in aapillar['local'].items() %}
/etc/apparmor.d/local/{{ profile }}:
file.managed:
- contents: {{ lines }}
- watch_in:
- module: apparmor_reload
{%- endfor %}
{%- if aapillar['local'] | length %}
apparmor_reload:
module.run:
- name: service.reload
- m_name: apparmor
- onchanges:
{%- for profile in aapillar['local'] %}
- file: /etc/apparmor.d/local/{{ profile }}
{%- endfor %}
{%- endif %}
{%- endif %}

View File

@ -0,0 +1,74 @@
{%- set mypillar = salt['pillar.get']('profile:bookstack', {}) -%}
{%- set configfile = '/etc/sysconfig/BookStack' -%}
bookstack_packages:
pkg.installed:
- names:
- BookStack-config-php-fpm-apache
bookstack_permissions:
file.managed:
- mode: '0640'
- user: root
- group: www
- names:
- {{ configfile }}
{%- if mypillar | length %}
{{ configfile }}:
file.keyvalue:
- separator: '='
- show_changes: False
- require:
- pkg: bookstack_packages
- key_values:
{%- macro condconf(option) %}
{%- if option in mypillar -%}
{%- if ( mypillar[option] is string and mypillar[option].startswith('$') ) or mypillar[option] is number %}
{%- set value = mypillar[option] %}
{%- else %}
{%- set value = "\"'" ~ mypillar[option] ~ "'\"" %}
{%- endif %}
{{ option | upper }}: {{ value }}
{%- endif -%}
{%- endmacro %}
{{ condconf('app_url') }}
{{ condconf('db_host') }}
{{ condconf('db_database') }}
{{ condconf('db_username') }}
{{ condconf('db_password') }}
{{ condconf('mail_driver') }}
{{ condconf('mail_from_name') }}
{{ condconf('mail_from') }}
{{ condconf('mail_host') }}
{{ condconf('mail_port') }}
{{ condconf('mail_username') }}
{{ condconf('mail_password') }}
{{ condconf('mail_encryption') }}
{{ condconf('app_theme') }}
{{ condconf('cache_driver') }}
{{ condconf('session_driver') }}
{{ condconf('memcached_servers') }}
{{ condconf('session_secure_cookie') }}
{{ condconf('session_cookie_name') }}
{{ condconf('app_debug') }}
{{ condconf('session_lifetime') }}
{{ condconf('auth_method') }}
{{ condconf('auth_auto_initiate') }}
{{ condconf('saml2_name') }}
{{ condconf('saml2_email_attribute') }}
{{ condconf('saml2_external_id_attribute') }}
{{ condconf('saml2_display_name_attributes') }}
{{ condconf('saml2_idp_entityid') }}
{{ condconf('saml2_idp_sso') }}
{{ condconf('saml2_idp_slo') }}
{{ condconf('saml2_idp_x509') }}
{{ condconf('saml2_autoload_metadata') }}
{{ condconf('saml2_sp_x509') }}
{{ condconf('saml2_user_to_groups') }}
{{ condconf('saml2_group_attribute') }}
{{ condconf('saml2_remove_from_groups') }}
{{ condconf('saml2_dump_user_details') }}
{{ condconf('queue_connection') }}
{{ condconf('app_views_books') }}
{%- endif %}

View File

@ -46,7 +46,7 @@ matterbridge_{{ instance }}_mediadir:
- user: matterbridge - user: matterbridge
{#- to-do: implement some shared group #} {#- to-do: implement some shared group #}
- group: lighttpd - group: lighttpd
- mode: 750 - mode: '0750'
- makedirs: True - makedirs: True
{%- endif %} {%- endif %}

View File

@ -5,6 +5,6 @@ include:
file.managed: file.managed:
- user: keepalived_script - user: keepalived_script
- group: wheel - group: wheel
- mode: 750 - mode: '0750'
- template: jinja - template: jinja
- source: salt://{{ slspath }}/files/failover.sh.j2 - source: salt://{{ slspath }}/files/failover.sh.j2

View File

@ -0,0 +1,55 @@
{%- set mypillar = salt['pillar.get']('profile:privatebin', {}) -%}
{%- set confdir = '/etc/PrivateBin' -%}
{%- set configfile = confdir ~ '/conf.php' -%}
privatebin_packages:
pkg.installed:
- names:
- PrivateBin-config-httpd
privatebin_clean:
file.directory:
- name: {{ confdir }}
- clean: True
- onchanges:
- pkg: privatebin_packages
- require:
- pkg: privatebin_packages
{%- if mypillar | length %}
{{ configfile }}:
ini.options_present:
- separator: '='
- strict: True
- sections:
{%- macro conf(section, options) %}
{%- for option in options.keys() -%}
{%- if ( mypillar[section][option] is string and mypillar[section][option].startswith('$') ) or mypillar[section][option] is number %}
{%- set value = mypillar[section][option] -%}
{%- else %}
{%- set value = "\"'" ~ mypillar[section][option] ~ "'\"" -%}
{%- endif %}
{{ option }}: {{ value }}
{%- endfor -%}
{%- endmacro %}
{%- for section, options in mypillar.items() %}
{{ section }}:
{{ conf(section, options) }}
{%- endfor %}
- require:
- pkg: privatebin_packages
- watch:
- file: privatebin_clean
- watch_in:
- file: privatebin_permissions
{%- endif %}
privatebin_permissions:
file.managed:
- mode: '0640'
- user: wwwrun
- group: privatebin
- names:
- {{ configfile }}
- require:
- pkg: privatebin_packages

View File

@ -0,0 +1,18 @@
{%- set mypillar = salt['pillar.get']('profile:prometheus:targets') %}
{%- set targetsdir = '/etc/prometheus/targets' %}
{%- if mypillar | length %}
{{ targetsdir }}:
file.directory:
- group: prometheus
{%- for group, nodes in mypillar.items() %}
{{ targetsdir }}/{{ group }}.json:
file.serialize:
- dataset: {{ nodes }}
- serializer: json
{%- endfor %}
{%- else %}
{%- do salt.log.debug('profile.prometheus: no targets defined') %}
{%- endif %}

View File

@ -0,0 +1,6 @@
salt_master_formulas:
git.latest:
- name: https://git.com.de/LibertaCasa/salt-formulas.git
- target: /srv/formulas
- branch: production
- submodules: True

View File

@ -7,6 +7,7 @@
include: include:
- salt.master - salt.master
- .formulas
salt_master_extension_modules_dirs: salt_master_extension_modules_dirs:
file.directory: file.directory:
@ -17,7 +18,7 @@ salt_master_extension_modules_dirs:
{%- endfor %} {%- endfor %}
- user: root - user: root
- group: salt - group: salt
- mode: 0755 - mode: '0755'
salt_master_extension_modules_bins: salt_master_extension_modules_bins:
file.managed: file.managed:
@ -30,24 +31,17 @@ salt_master_extension_modules_bins:
{%- endfor %} {%- endfor %}
- user: root - user: root
- group: salt - group: salt
- mode: 0640 - mode: '0640'
- require: - require:
- file: salt_master_extension_modules_dirs - file: salt_master_extension_modules_dirs
salt_master_formulas:
git.latest:
- name: https://git.com.de/LibertaCasa/salt-formulas.git
- target: /srv/formulas
- branch: production
- submodules: True
salt_master_extra_packages: salt_master_extra_packages:
pkg.installed: pkg.installed:
- names: - names:
- python3-ldap - python3-ldap
- python3-pynetbox - python3-pynetbox
- python3-redis - python3-redis
- redis - redis7
- salt-bash-completion - salt-bash-completion
- salt-fish-completion - salt-fish-completion
- salt-keydiff - salt-keydiff
@ -72,29 +66,29 @@ salt_master_extra_packages:
- requirepass {{ master_pillar['cache.redis.password'] }} - requirepass {{ master_pillar['cache.redis.password'] }}
- user: root - user: root
- group: redis - group: redis
- mode: 0640 - mode: '0640'
- require: - require:
- pkg: redis - pkg: redis7
/var/lib/redis/salt: /var/lib/redis/salt:
file.directory: file.directory:
- user: redis - user: redis
- group: redis - group: redis
- mode: 0750 - mode: '0750'
- require: - require:
- pkg: redis - pkg: redis7
salt_redis_service_enable: salt_redis_service_enable:
service.enabled: service.enabled:
- name: {{ redis_service }} - name: {{ redis_service }}
- require: - require:
- pkg: redis - pkg: redis7
salt_redis_service_start: salt_redis_service_start:
service.running: service.running:
- name: {{ redis_service }} - name: {{ redis_service }}
- require: - require:
- pkg: redis - pkg: redis7
- watch: - watch:
- file: {{ redis_config }} - file: {{ redis_config }}
@ -102,7 +96,7 @@ salt_redis_membership:
group.present: group.present:
- name: redis - name: redis
- require: - require:
- pkg: redis - pkg: redis7
- addusers: - addusers:
- {{ master_pillar['user'] }} - {{ master_pillar['user'] }}
{%- if pillar['secret_salt'] is defined %} {%- if pillar['secret_salt'] is defined %}

View File

@ -1,5 +1,7 @@
{%- set netbox_pillar = salt['pillar.get']('netbox') -%} {%- set netbox_pillar = salt['pillar.get']('netbox') -%}
{%- if 'custom_fields' in netbox_pillar and netbox_pillar['custom_fields']['salt_roles'] is not none and 'salt.syndic' in netbox_pillar['custom_fields']['salt_roles'] -%} {%- if 'custom_fields' in netbox_pillar
and netbox_pillar['custom_fields']['salt_roles'] is not none
and 'salt.syndic' in netbox_pillar['custom_fields']['salt_roles'] -%}
{%- set master = salt['pillar.get']('salt:master:syndic_master') -%} {%- set master = salt['pillar.get']('salt:master:syndic_master') -%}
{%- elif 'config_context' in netbox_pillar -%} {%- elif 'config_context' in netbox_pillar -%}
{%- set master = netbox_pillar['config_context']['salt_master'] -%} {%- set master = netbox_pillar['config_context']['salt_master'] -%}

5
salt/role/bookstack.sls Normal file
View File

@ -0,0 +1,5 @@
include:
- role.web.apache-httpd
- role.memcached
- profile.bookstack
- php.fpm

2
salt/role/memcached.sls Normal file
View File

@ -0,0 +1,2 @@
include:
- memcached.config

View File

@ -0,0 +1,2 @@
include:
- prometheus.config

View File

@ -0,0 +1,2 @@
include:
- prometheus.config

View File

@ -0,0 +1,3 @@
include:
- prometheus.config
- profile.prometheus.targets

2
salt/role/php-fpm.sls Normal file
View File

@ -0,0 +1,2 @@
include:
- php.fpm

4
salt/role/privatebin.sls Normal file
View File

@ -0,0 +1,4 @@
include:
- role.web.apache-httpd
- profile.privatebin
- php.fpm

View File

@ -1,5 +1,6 @@
include: include:
- nginx.pkg - nginx.pkg
- profile.apparmor.local
- nginx.config - nginx.config
- nginx.snippets - nginx.snippets
- nginx.servers - nginx.servers

View File

@ -0,0 +1,2 @@
include:
- profile.apache-httpd