Add manage_postfix conditional

Allow local MTA management to be disabled for hosts which need a custom configuration. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-05-02 21:11:57 +02:00
11 changed files with 41 additions and 64 deletions
--- a/pillar/cluster/denc/web-proxy.sls
+++ b/pillar/cluster/denc/web-proxy.sls
@ -127,7 +127,7 @@ nginx:
            - client_max_body_size: 20M
            - modsecurity_rules: |-
                '
-                SecRuleRemoveById 941160 949110
+                SecRuleRemoveById 941160
                SecAction "id:900200, phase:1, nolog, pass, t:none, setvar:\'tx.allowed_methods=GET HEAD POST OPTIONS PUT PATCH\'"
                '

@ -212,18 +212,6 @@ nginx:
            - error_log: /var/log/nginx/libsso_public.error.log
            - access_log: /var/log/nginx/libsso_public.access.log combined

-      agola.conf:
-        config:
-          - server:
-            - include:
-              - snippets/listen_ha
-              - snippets/tls_lysergic
-            - server_name: ci.lysergic.dev ci.git.com.de
-            - location /:
-              - proxy_pass: https://ci.lysergic.dev
-              - proxy_ssl_verify: 'on'
-              - include: snippets/proxy
-
 manage_firewall: True
 firewalld:
  zones:
--- a/pillar/global/init.sls
+++ b/pillar/global/init.sls
@ -15,7 +15,6 @@ zypper:
  refreshdb_force: False

 firewalld:
-  FlushAllOnReload: 'yes'
  zones:
    internal:
      short: Internal
--- a/pillar/id/dericom02_rigel_lysergic_dev.sls
+++ b/pillar/id/dericom02_rigel_lysergic_dev.sls
@ -1,4 +1,4 @@
-{%- set mediapath = '/var/lib/matterbridge/' -%}
+{%- set mediapath = '/srv/matterbridge/' -%}

 {%- macro discord_common() -%}
            AutoWebhooks: 'true'
@ -34,12 +34,12 @@ profile:
            Password: ${'secret_matterbridge:general:accounts:xmpp.libertacasa:Password'}
            Muc: muc.liberta.casa
            Nick: viaduct
-            RemoteNickFormat: '[{PROTOCOL}] <{NICK}> '
+            RemoteNickFormat: '[{PROTOCOL}] <{NICK}>'
            Label: x
            Debug: 'false'
          telegram.libertacasa:
            Token: ${'secret_matterbridge:general:accounts:telegram.libertacasa:Token'}
-            RemoteNickFormat: '[{PROTOCOL}] &lt;{NICK}&gt; '
+            RemoteNickFormat: '&lt;{NICK}&gt; '
            MessageFormat: HTMLNick
            Label: tg
            DisableWebPagePreview: 'true'
@ -47,7 +47,7 @@ profile:
            Server: 192.168.0.110:2220
            Nick: LC
            RemoteNickFormat: '{PROTOCOL}:<{NICK}> '
-            Label: ssh
+            Label: p
          discord.23:
            Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
            Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
@ -61,6 +61,7 @@ profile:
        gateways:
          libcasa:
            irc.libertacasa: '#libcasa'
+            sshchat.Psyched: sshchat
            xmpp.libertacasa: libcasa
          dev:
            irc.libertacasa: '#dev'
@ -69,18 +70,22 @@ profile:
            irc.libertacasa: '#lucy'
            xmpp.libertacasa: lucy
            telegram.libertacasa: '-1001795702961'
-            sshchat.Psyched: sshchat
          info:
            irc.libertacasa: '#libcasa.info'
            xmpp.libertacasa: libcasa.info
+            #telegram.libertacasa: '-1001518274267'
          chat:
-            irc.libertacasa: '#chat'
+            irc.libertacasa: '#chai'
            discord.23: chat
            xmpp.libertacasa: chat
-          petals:
-            irc.libertacasa: '#Petals'
-            telegram.libertacasa: '-1001971550949'
-
+          dota:
+            irc.libertacasa: '#dotes'
+            discord.23: dotes
+            xmpp.libertacasa: dota
+          aithunder:
+            irc.libertacasa: '#aithunder'
+          #  discord.aithunder: main-chat
+            xmpp.libertacasa: aithunder

      libertacasa-irc:
        general:
@ -211,15 +216,20 @@ profile:
          nerds:
            irc.libertacasa: '#nerds'
            irc.nerds: '#nerds'
+          chillops:
+            irc.libertacasa: '#chillops'
+            irc.chillnet: '#chillops'
+            irc.stardust: '#chillnet-test'
          music:
            irc.libertacasa: '#music'
            irc.chillnet: '#music'
            irc.stardust: '#music'
+
      chillnet:
        general:
          MediaDownloadSize: 1000000000
          MediaDownloadPath: {{ mediapath }}chillnet
-          MediaServerDownload: https://up.chillnet.org
+          MediaServerDownload: https://uploads.chillnet.org
        accounts:
          irc.chillnet:
            Server: irc.chillnet.org:6697
@ -240,30 +250,22 @@ profile:
            MessageFormat: HTMLNick
            Label: tg
            DisableWebPagePreview: 'true'
-          discord.23:
-            Token: ${'secret_matterbridge:general:accounts:discord.23:Token'}
-            Server: ${'secret_matterbridge:general:accounts:discord.23:Server'}
-            {{ discord_common() }}
        gateways:
-          staff:
-            irc.chillnet: '#chillstaff'
+          fightclub:
+            irc.chillnet: '#fightclub'
            telegram.chillnet: '-1001932699309'
-          devs:
-            irc.chillnet: '#chilldevs'
-            telegram.chillnet: '-1001778806358'
-            discord.23: chilldevs

  lighttpd:
    vhosts:
      matterbridge-general:
-        host: 'libertacasa-general.matterbridge.dericom02.rigel.lysergic.dev'
+        host: 'libertacasa-general\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
        root: {{ mediapath }}libertacasa-general
      matterbridge-irc:
-        host: 'libertacasa-irc.matterbridge.dericom02.rigel.lysergic.dev'
+        host: 'libertacasa-irc\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
        root: {{ mediapath }}libertacasa-irc
      matterbridge-chillnet:
-        host: 'chillnet.matterbridge.dericom02.rigel.lysergic.dev'
-        root: {{ mediapath }}chillnet
+        host: 'chillnet\.matterbridge\.dericom02\.rigel\.lysergic\.dev'
+        root: {{ mediapath }}chill

 manage_firewall: True
 firewalld:
--- a/pillar/id/derigsm01_rigel_lysergic_dev.sls
+++ b/pillar/id/derigsm01_rigel_lysergic_dev.sls
@ -1 +0,0 @@
-manage_firewall: True
--- a/pillar/id/deriweb01_rigel_lysergic_dev.sls
+++ b/pillar/id/deriweb01_rigel_lysergic_dev.sls
@ -44,11 +44,11 @@
                - proxy_set_header: Host $http_host
                - resolver: '{{ resolver }} ipv4=off valid=24h'
 {%- endmacro -%}
-{%- macro matterbridge_media(domain, name, tls='load') -%}
+{%- macro matterbridge_media(domain, name) -%}
          - server:
            - include:
              - snippets/listen
-              - snippets/tls_{{ tls }}
+              - snippets/tls_load
              - snippets/tls
            - server_name: {{ domain }}
            - location /:
@ -71,7 +71,6 @@ nginx:
    {{ nginx_crtkeypair('meet', 'meet.com.de') | indent }}
    {{ nginx_crtkeypair('takahe', 'social.liberta.casa') | indent }}
    {{ nginx_crtkeypair('pub_sectigo', 'pub') | indent }}
-    {{ nginx_crtkeypair('up.chillnet.org', 'up.chillnet.org') | indent }}

    {#- locations shared between clearnet and Tor LibertaCasa servers #}
    libertacasa:
@ -317,10 +316,9 @@ nginx:

      matterbridge.conf:
        config:
-          {{ matterbridge_media('load.casa', 'libertacasa-general') }}
-          {{ matterbridge_media('irc.load.casa', 'libertacasa-irc') }}
-          {{ matterbridge_media('up.chillnet.org', 'chillnet', 'up.chillnet.org') }}
-
+          {{  matterbridge_media('load.casa', 'libertacasa-general') }}
+          {{  matterbridge_media('irc.load.casa', 'libertacasa-irc') }}
+          {{  matterbridge_media('uploads.chillnet.org', 'chillnet') }}
      meet.conf:
        config:
          - server:
--- a/pillar/id/derutil01_rigel_lysergic_dev.sls
+++ b/pillar/id/derutil01_rigel_lysergic_dev.sls
@ -1 +0,0 @@
-manage_firewall: True
--- a/pillar/id/thetrip_lysergic_dev.sls
+++ b/pillar/id/thetrip_lysergic_dev.sls
@ -1,7 +0,0 @@
-manage_firewall: True
-firewalld:
-  zones:
-    public:
-      services:
-        - http
-        - https
--- a/pillar/role/salt/minion.sls
+++ b/pillar/role/salt/minion.sls
@ -4,6 +4,4 @@ salt:
  minion:
    master_type: str
    backup_mode: minion
-    cache_jobs: True
-    enable_gpu_grains: False
  saltenv: production
--- a/salt/common/openbsd.sls
+++ b/salt/common/openbsd.sls
@ -1 +0,0 @@
-# Nothing yet
--- a/salt/common/suse.sls
+++ b/salt/common/suse.sls
@ -12,7 +12,9 @@ include:
  - users
  {%- endif %}
  - .ssh
+  {%- if salt['pillar.get']('manage_postfix', True) %}
  - postfix.config
+  {%- endif %}

 {#- to-do: move this to some formula or macro -#}
 {%- set osfullname = grains['osfullname'] -%}
--- a/salt/profile/salt/master.sls
+++ b/salt/profile/salt/master.sls
@ -41,7 +41,7 @@ salt_master_extra_packages:
      - python3-ldap
      - python3-pynetbox
      - python3-redis
-      - redis7
+      - redis
      - salt-bash-completion
      - salt-fish-completion
      - salt-keydiff
@ -68,7 +68,7 @@ salt_master_extra_packages:
    - group: redis
    - mode: '0640'
    - require:
-      - pkg: redis7
+      - pkg: redis

 /var/lib/redis/salt:
  file.directory:
@ -76,19 +76,19 @@ salt_master_extra_packages:
    - group: redis
    - mode: '0750'
    - require:
-      - pkg: redis7
+      - pkg: redis

 salt_redis_service_enable:
  service.enabled:
    - name: {{ redis_service }}
    - require:
-      - pkg: redis7
+      - pkg: redis

 salt_redis_service_start:
  service.running:
    - name: {{ redis_service }}
    - require:
-      - pkg: redis7
+      - pkg: redis
    - watch:
      - file: {{ redis_config }}

@ -96,7 +96,7 @@ salt_redis_membership:
  group.present:
    - name: redis
    - require:
-      - pkg: redis7
+      - pkg: redis
    - addusers:
      - {{ master_pillar['user'] }}
 {%- if pillar['secret_salt'] is defined %}