Merge pull request 'cleanup interprotocol bridges' (#96) from cfg_matterbridge into production

Reviewed-on: #96
Reviewed-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

pillar/cluster/denc/web-proxy.sls

@@ -127,7 +127,7 @@ nginx:
             - client_max_body_size: 20M
             - modsecurity_rules: |-
                 '
-                SecRuleRemoveById 941160
+                SecRuleRemoveById 941160 949110
                 SecAction "id:900200, phase:1, nolog, pass, t:none, setvar:\'tx.allowed_methods=GET HEAD POST OPTIONS PUT PATCH\'"
                 '
 
@@ -212,6 +212,18 @@ nginx:
             - error_log: /var/log/nginx/libsso_public.error.log
             - access_log: /var/log/nginx/libsso_public.access.log combined
 
+      agola.conf:
+        config:
+          - server:
+            - include:
+              - snippets/listen_ha
+              - snippets/tls_lysergic
+            - server_name: ci.lysergic.dev ci.git.com.de
+            - location /:
+              - proxy_pass: https://ci.lysergic.dev
+              - proxy_ssl_verify: 'on'
+              - include: snippets/proxy
+
 manage_firewall: True
 firewalld:
   zones:

pillar/global/init.sls

@@ -15,6 +15,7 @@ zypper:
   refreshdb_force: False
 
 firewalld:
+  FlushAllOnReload: 'yes'
   zones:
     internal:
       short: Internal

pillar/id/dericom02_rigel_lysergic_dev.sls

@@ -1,4 +1,4 @@
-{%- set mediapath = '/srv/matterbridge/' -%}
+{%- set mediapath = '/var/lib/matterbridge/' -%}
 
 {%- macro discord_common() -%}
             AutoWebhooks: 'true'
@@ -34,12 +34,12 @@ profile:
             Password: ${'secret_matterbridge:general:accounts:xmpp.libertacasa:Password'}
             Muc: muc.liberta.casa
             Nick: viaduct
-            RemoteNickFormat: '[{PROTOCOL}] <{NICK}>'
+            RemoteNickFormat: '[{PROTOCOL}] <{NICK}> '
             Label: x
             Debug: 'false'
           telegram.libertacasa:
             Token: ${'secret_matterbridge:general:accounts:telegram.libertacasa:Token'}
-            RemoteNickFormat: '&lt;{NICK}&gt; '
+            RemoteNickFormat: '[{PROTOCOL}] &lt;{NICK}&gt; '
             MessageFormat: HTMLNick
             Label: tg
             DisableWebPagePreview: 'true'
@@ -47,7 +47,7 @@ profile:
             Server: 192.168.0.110:2220
             Nick: LC
             RemoteNickFormat: '{PROTOCOL}:<{NICK}> '
-            Label: p
+            Label: ssh
           discord.23:
             Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
             Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
@@ -61,7 +61,6 @@ profile:
         gateways:
           libcasa:
             irc.libertacasa: '#libcasa'
-            sshchat.Psyched: sshchat
             xmpp.libertacasa: libcasa
           dev:
             irc.libertacasa: '#dev'
@@ -70,22 +69,18 @@ profile:
             irc.libertacasa: '#lucy'
             xmpp.libertacasa: lucy
             telegram.libertacasa: '-1001795702961'
+            sshchat.Psyched: sshchat
           info:
             irc.libertacasa: '#libcasa.info'
             xmpp.libertacasa: libcasa.info
-            #telegram.libertacasa: '-1001518274267'
           chat:
-            irc.libertacasa: '#chai'
+            irc.libertacasa: '#chat'
             discord.23: chat
             xmpp.libertacasa: chat
-          dota:
+          petals:
-            irc.libertacasa: '#dotes'
+            irc.libertacasa: '#Petals'
-            discord.23: dotes
+            telegram.libertacasa: '-1001971550949'
-            xmpp.libertacasa: dota
+
-          aithunder:
-            irc.libertacasa: '#aithunder'
-          #  discord.aithunder: main-chat
-            xmpp.libertacasa: aithunder
 
       libertacasa-irc:
         general:
@@ -216,20 +211,15 @@ profile:
           nerds:
             irc.libertacasa: '#nerds'
             irc.nerds: '#nerds'
-          chillops:
-            irc.libertacasa: '#chillops'
-            irc.chillnet: '#chillops'
-            irc.stardust: '#chillnet-test'
           music:
             irc.libertacasa: '#music'
             irc.chillnet: '#music'
             irc.stardust: '#music'
-
       chillnet:
         general:
           MediaDownloadSize: 1000000000
           MediaDownloadPath: {{ mediapath }}chillnet
-          MediaServerDownload: https://uploads.chillnet.org
+          MediaServerDownload: https://up.chillnet.org
         accounts:
           irc.chillnet:
             Server: irc.chillnet.org:6697
@@ -250,22 +240,30 @@ profile:
             MessageFormat: HTMLNick
             Label: tg
             DisableWebPagePreview: 'true'
+          discord.23:
+            Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
+            Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
+            {{ discord_common() }}
         gateways:
-          fightclub:
+          staff:
-            irc.chillnet: '#fightclub'
+            irc.chillnet: '#chillstaff'
             telegram.chillnet: '-1001932699309'
+          devs:
+            irc.chillnet: '#chilldevs'
+            telegram.chillnet: '-1001778806358'
+            discord.23: chilldevs
 
   lighttpd:
     vhosts:
       matterbridge-general:
-        host: 'libertacasa-general\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
+        host: 'libertacasa-general.matterbridge.dericom02.rigel.lysergic.dev'
         root: {{ mediapath }}libertacasa-general
       matterbridge-irc:
-        host: 'libertacasa-irc\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
+        host: 'libertacasa-irc.matterbridge.dericom02.rigel.lysergic.dev'
         root: {{ mediapath }}libertacasa-irc
       matterbridge-chillnet:
-        host: 'chillnet\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
+        host: 'chillnet.matterbridge.dericom02.rigel.lysergic.dev'
-        root: {{ mediapath }}chill
+        root: {{ mediapath }}chillnet
 
 manage_firewall: True
 firewalld:

pillar/id/derigsm01_rigel_lysergic_dev.sls

@@ -0,0 +1 @@
+manage_firewall: True

pillar/id/deriweb01_rigel_lysergic_dev.sls

@@ -44,11 +44,11 @@
                 - proxy_set_header: Host $http_host
                 - resolver: '{{ resolver }} ipv4=off valid=24h'
 {%- endmacro -%}
-{%- macro matterbridge_media(domain, name) -%}
+{%- macro matterbridge_media(domain, name, tls='load') -%}
           - server:
             - include:
               - snippets/listen
-              - snippets/tls_load
+              - snippets/tls_{{ tls }}
               - snippets/tls
             - server_name: {{ domain }}
             - location /:
@@ -71,6 +71,7 @@ nginx:
     {{ nginx_crtkeypair('meet', 'meet.com.de') | indent }}
     {{ nginx_crtkeypair('takahe', 'social.liberta.casa') | indent }}
     {{ nginx_crtkeypair('pub_sectigo', 'pub') | indent }}
+    {{ nginx_crtkeypair('up.chillnet.org', 'up.chillnet.org') | indent }}
 
     {#- locations shared between clearnet and Tor LibertaCasa servers #}
     libertacasa:
@@ -316,9 +317,10 @@ nginx:
 
       matterbridge.conf:
         config:
-          {{  matterbridge_media('load.casa', 'libertacasa-general') }}
+          {{ matterbridge_media('load.casa', 'libertacasa-general') }}
-          {{  matterbridge_media('irc.load.casa', 'libertacasa-irc') }}
+          {{ matterbridge_media('irc.load.casa', 'libertacasa-irc') }}
-          {{  matterbridge_media('uploads.chillnet.org', 'chillnet') }}
+          {{ matterbridge_media('up.chillnet.org', 'chillnet', 'up.chillnet.org') }}
+
       meet.conf:
         config:
           - server:

pillar/id/derutil01_rigel_lysergic_dev.sls

@@ -0,0 +1 @@
+manage_firewall: True

pillar/id/orpheus_psyched_dev.sls

@@ -0,0 +1 @@
+manage_sshd: False

pillar/id/selene_psyched_dev.sls

@@ -0,0 +1 @@
+manage_sshd: False

pillar/id/theia_psyched_dev.sls

@@ -0,0 +1 @@
+manage_sshd: False

pillar/id/thetrip_lysergic_dev.sls

@@ -0,0 +1,7 @@
+manage_firewall: True
+firewalld:
+  zones:
+    public:
+      services:
+        - http
+        - https

pillar/role/salt/minion.sls

@@ -4,4 +4,6 @@ salt:
   minion:
     master_type: str
     backup_mode: minion
+    cache_jobs: True
+    enable_gpu_grains: False
   saltenv: production

salt/common/openbsd.sls

@@ -0,0 +1 @@
+# Nothing yet

salt/profile/salt/master.sls

@@ -41,7 +41,7 @@ salt_master_extra_packages:
       - python3-ldap
       - python3-pynetbox
       - python3-redis
-      - redis
+      - redis7
       - salt-bash-completion
       - salt-fish-completion
       - salt-keydiff
@@ -68,7 +68,7 @@ salt_master_extra_packages:
     - group: redis
     - mode: '0640'
     - require:
-      - pkg: redis
+      - pkg: redis7
 
 /var/lib/redis/salt:
   file.directory:
@@ -76,19 +76,19 @@ salt_master_extra_packages:
     - group: redis
     - mode: '0750'
     - require:
-      - pkg: redis
+      - pkg: redis7
 
 salt_redis_service_enable:
   service.enabled:
     - name: {{ redis_service }}
     - require:
-      - pkg: redis
+      - pkg: redis7
 
 salt_redis_service_start:
   service.running:
     - name: {{ redis_service }}
     - require:
-      - pkg: redis
+      - pkg: redis7
     - watch:
       - file: {{ redis_config }}
 
@@ -96,7 +96,7 @@ salt_redis_membership:
   group.present:
     - name: redis
     - require:
-      - pkg: redis
+      - pkg: redis7
     - addusers:
       - {{ master_pillar['user'] }}
 {%- if pillar['secret_salt'] is defined %}