9
0
Fork 1
Commit graph

100 commits

Author SHA1 Message Date
27199f9f7a
First skeleton for soc::intelmq 2024-11-13 16:25:14 +01:00
e080e53707
Correct proxy url. 2024-11-04 09:47:34 +01:00
e6294af8e3
Typo 2024-10-31 14:15:01 +01:00
24ad811a54
Typo 2024-10-31 14:12:43 +01:00
2f0343cfa5
fixes. 2024-10-31 14:05:47 +01:00
48201c92cb
Set up SSO. 2024-10-31 13:51:26 +01:00
69ee730ec2
Set up acme-d. 2024-10-31 13:37:55 +01:00
617b07bfa5
Fixed typio. 2024-10-31 13:23:12 +01:00
5684d1b892
Preparing vul dashbaord and sso. 2024-10-31 13:09:38 +01:00
42ac3c8c42
Fix rendering of satosa docker-compose.yml 2024-10-31 09:46:23 +01:00
db85b4fecc
More name fixing. 2024-10-31 09:01:17 +01:00
a3c77a05c4
Fix class name, duh. 2024-10-31 08:59:12 +01:00
c527adb91e
Fix logic and spelling. 2024-10-31 08:58:04 +01:00
ddc22ad91c
Switch to soc::satosa 2024-10-31 08:52:40 +01:00
959acc2337
Fixing cert locations, this might bomb. 2024-10-30 13:58:19 +01:00
5b2bef346d
Testing how to get facts. 2024-10-30 13:52:27 +01:00
7171dd5a8a
Testing how to get facts. 2024-10-30 13:46:11 +01:00
035581e5b7
more fixes. 2024-10-30 13:41:25 +01:00
806735fefa
Fixing with satosa. 2024-10-30 13:39:04 +01:00
01880222a4
commit commit. 2024-10-30 13:25:26 +01:00
6cb41f4c3f
Switch to Deb12 .. 2024-10-30 13:12:03 +01:00
1ef208a0a5
Nope, stdlib on 24.04 no good. 2024-10-30 12:34:17 +01:00
e48bff537a
Seems like stdlib is required. 2024-10-30 10:50:59 +01:00
e619ba1683
Set up TLS certificate, fixes. 2024-10-29 14:14:48 +01:00
69d3be88fb
Set up TLS certificate 2024-10-29 14:12:41 +01:00
4b11e53200
Added a lot of SSO stuff and base for SSO proxy. 2024-10-29 10:59:13 +01:00
0af1dbe562
Fixes for certbot, no certbot script just yet. 2024-10-28 15:55:35 +01:00
1dc0a879db
I love YAML. Fix syntax. 2024-10-28 15:39:53 +01:00
03694c1384
fixing with modules 2024-10-28 15:35:05 +01:00
25bb16852c
Spellcheck class ... 2024-10-28 15:23:49 +01:00
c2df36a32e
Fix path .. 2024-10-28 15:21:56 +01:00
1a62e46d64
Let's see if anything works ... or just bombs 2024-10-28 15:19:24 +01:00
3e383c6d68
Created stub for sso groups 2024-10-28 14:00:55 +01:00
493cb1c1bd
Removed .empty file 2024-10-28 13:36:25 +01:00
f24f201d46
First sekelton for shib-proxy. 2024-10-28 13:32:11 +01:00
f4d620ba4d
Added Valerio's ssh key. 2024-10-28 11:00:11 +01:00
72488b8586
Add soc class, will it work? 2024-10-28 10:34:42 +01:00
69e4bf28cc
Disable fail2ban. 2024-10-25 16:04:10 +02:00
2d6151ced5
Test if I must trust jocar ... 2024-10-25 16:02:19 +02:00
417e257ac8
Fix fix. 2024-10-25 15:06:58 +02:00
4e072df30f
Fixing with modules. 2024-10-25 15:04:04 +02:00
46d8160c07
First try just to deloy ssh keys. 2024-10-25 13:03:34 +02:00
c2d60bd424 initial trust 2024-10-21 14:49:48 +02:00
aa88795ee0
sunet-fleetlock: also handle ReadTimeout
Turns out this was not caught by ConnectionError.
2024-07-03 14:13:22 +02:00
01768129f0
fleetlock: configurable lock/unlock timeout
While we already support setting a healthcheck timeout it probably
makes sense to be able to control how long we wait for a
fleetlock_lock() or fleetlock_unlock() call. This becomes important if
only running cosmos once a night or something like that. In that case we
you probably want to give a physical machine more than than 1 minute to
complete a reboot etc.

This can now be controlled by setting fleetlock_lock_timeout and
fleetlock_unlock_timeout in /etc/run-cosmos-fleetlock-conf. Keep in mind
that while it can make sense to increase the time for taking a lock,
releasing a lock should always be fast (either you have it and release
it, or you dont have it and it is a no-op) so setting a long unlock
timeout should probably never be done.

Since we also potentially wait the unlock timeout at boot (if the
fleetlock server is broken etc) that is another reason to keep it
short. The default 1m is probably OK for most uses.
2024-07-03 13:27:52 +02:00
4231b4ac1d
Migrate from legacy fact
This did not work on modern puppet in ubuntu24:
Warning: Interpolation failed with '::lsbdistcodename', but compilation continuing;
New syntax inspiration from:
https://www.puppet.com/docs/puppet/8/hiera_config_yaml_5#configuring_hiera
2024-06-19 14:07:13 +02:00
e315282bc5
Use more strict exception checking
This is probably wide enough and we do not need weird extra handling of
our own execption etc.

Thanks to @mickenordin for keeping me honest :).
2024-06-17 12:40:12 +02:00
4b8b8887f6
sunet-fleetlock: handle connection errors
In order to handle upgrades of the fleetlock server when running only
one server we need to handle connection errors like connection refused
or timed out errors gracefully.

Because there are several different ways the connection can fail and it
is hard to keep track of them all, just catch everything. We then also
need special handling of our own timeout execption so we are not
accidentally stuck retrying forever.

Also fix so we actually use the request_timeout arg for individual HTTP
requests instead of the global timeout.

While here run isort to keep imports tidy.
2024-06-17 12:07:22 +02:00
c72f5ccd86
Allow for hosts without class(s) 2024-04-12 15:32:40 +02:00
df5558befb
Fix another indentation mismatch 2024-01-24 15:36:52 +01:00