74 commits

Author	SHA1	Message	Date
Patrik Lundin	7352a20143	Start managing mqtt ACL ... Include sample comsos-rules entry for testing out template	2024-10-06 14:26:10 +02:00
Patrik Lundin	2099c4d691	Fix class name	2024-10-04 17:43:31 +02:00
Patrik Lundin	c638772941	Apply mqtt class	2024-10-04 17:41:59 +02:00
Patrik Lundin	152179a5c1	Initial commit for mqtt management	2024-10-04 17:33:49 +02:00
Patrik Lundin	895264bc4f	Trust kano ... Copied from platform-ops	2024-10-04 17:18:09 +02:00
Patrik Lundin	febde032ee	Update to new key standard	2024-10-04 17:16:23 +02:00
Patrik Lundin	571af24060	Make seccomp file readable by runner	2024-10-04 09:22:05 +02:00
Patrik Lundin	05ee26e7c2	Make docker_certs available to runner	2024-10-03 21:04:17 +02:00
Patrik Lundin	48d3b890d0	Use owner/group matching runner compose file	2024-10-03 20:57:28 +02:00
Patrik Lundin	d1d72ad80a	Try to access map correctly	2024-10-03 20:42:39 +02:00
Patrik Lundin	25a18fd58b	Remove extra dot	2024-10-03 20:15:39 +02:00
Patrik Lundin	32e4a99cef	Add initial forgejo runner config	2024-10-03 20:12:59 +02:00
Patrik Lundin	3883bb53b2	Trust jocar key	2024-10-03 15:56:30 +02:00
Patrik Lundin	dc180c10b0	Fix so systemd file is named sunet-cdn-l4lb ... Not sunet-sunet-cdn-l4lb	2024-08-20 12:38:06 +02:00
Patrik Lundin	dd0493f869	Fix volume declarations ... Did not expect to create anonymous volumes, see https://stackoverflow.com/questions/46166304/docker-compose-volumes-without-colon for more details. Now the host directories should be mounted. While here try setting :ro to the paths we are not expecting to modify. The /lib/modules :ro flag is based on 3cbd8258eb/cilium-lb.yaml (L143-L145)	2024-08-20 12:31:42 +02:00
Patrik Lundin	79f2018d1b	Fix path to template	2024-08-20 12:10:29 +02:00
Patrik Lundin	4755886ea9	Move manifest to expected location	2024-08-20 12:06:35 +02:00
Patrik Lundin	f4cd10a970	Add mifr key, imported from platform-ops ... Need to trust commits to puppet-sunet stable branch	2024-08-20 12:00:57 +02:00
Patrik Lundin	9991bef58d	Assign new cdn::l4lb class to machine	2024-08-20 11:27:26 +02:00
Patrik Lundin	6057c62f47	Initial commit of running cilium l4lb via compose	2024-08-20 11:25:15 +02:00
Patrik Lundin	b014b4fdcc	Add sunet::dockerhost2 to cdn-prod-l4lb ... While here fix indentation.	2024-08-15 09:21:02 +02:00
Patrik Lundin	94a65a31e0	Fix problems with outdated sunet puppet modules ... Problem seen: ``` Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Unknown variable: '::osfamily'. (file: /etc/puppet/cosmos-modules/augeas/manifests/params.pp, line: 7, column: 8) on node example-1.sunet.se ``` This way we run modules installed from upstream apt packages instead. Solution to delete keys to use local pacakges from pahol. While here fix pylint issue with not importing platform module at beginning of file.	2024-07-04 14:42:34 +02:00
Patrik Lundin	3d0413b450	Disable ntpd management for now ... The current ntp puppet manifest does not support 24.04, and we need to figure out if the future means timesyncd or chrony.	2024-07-04 13:32:23 +02:00
Patrik Lundin	74fb420946	Add initial cosmos-rules	2024-07-04 08:48:58 +02:00
Patrik Lundin	c417b1e296	Trust pahol key ... Needed for puppet module	2024-07-03 17:27:23 +02:00
Patrik Lundin	4aa5e530f9	Trust jocar key ... Needed for some puppet modules	2024-07-03 17:23:43 +02:00
Patrik Lundin	0b82213811	Add my GPG key	2024-07-03 15:56:09 +02:00
Patrik Lundin	a49e9cfd24	Add init.pp ... Based on geteduroam-ops	2024-07-03 14:48:52 +02:00
Patrik Lundin	dfda322939	Add setup_cosmos_modules	2024-07-01 11:16:15 +02:00
Patrik Holmqvist	4231b4ac1d	Migrate from legacy fact ... This did not work on modern puppet in ubuntu24: Warning: Interpolation failed with '::lsbdistcodename', but compilation continuing; New syntax inspiration from: https://www.puppet.com/docs/puppet/8/hiera_config_yaml_5#configuring_hiera	2024-06-19 14:07:13 +02:00
Johan Wassberg	c72f5ccd86	Allow for hosts without class(s)	2024-04-12 15:32:40 +02:00
Patrik Lundin	4b93d9c426	run-cosmos: support fleetlock unlocking at boot ... This extends run-cosmos with a new argument that calls the unlock function already included in the script as well as using the already existing lock() function to make sure there is no race between the bootup process and cron starting a normal run-cosmos process at the same time. The oexit() function is added to support exiting with a OK exit value the same way eexit() is used to signal something is wrong. This change also adds the systemd unit file that runs run-cosmos with the new fleetlock-unlock argument at boot if fleetlock is configured. While here fix indentation that was mixed between 3 and 4 spaces: it is now 4 spaces everywhere.	2024-01-24 15:36:34 +01:00
Johan Wassberg	cf2e6b6518	File provided by Sunet::Dockerhost	2023-04-04 15:21:15 +02:00
Johan Wassberg	5af8093338	Add support for eyaml in Hiera ... And at the same time remove support for gpg. The modern version of the configuration (v5) has been tested with 20.04 but might work with older dists.	2023-02-16 07:44:37 +01:00
Fredrik Thulin	c400bba97d	remove 'make db' ... The db-file, essentially providing reverse lookup of classes to host names, is only used by some Nagios configuration instances and causes continuing operational headaches in those ops-repos. It should be kept/refactored to only apply to the monitoring hosts in the cases where it is used, but we don't want any new ops-repos to use it hence it should be removed from upstream multiverse.	2023-02-07 14:21:29 +01:00
Fredrik Thulin	12b2412ea7	run cron at boot too, to e.g. get new firewall rules installed	2023-02-06 17:12:01 +01:00
Fredrik Thulin	79606f2a6d	check for /etc/no-automatic-cosmos in the wrapper, and allow arguments to be passed	2023-02-06 16:47:41 +01:00
Johan Wassberg	49ba964897	Wrap cosmos in scriptherder if available ... nunoc-ops and others has been doing this for ages by just modifing the cron file.	2023-02-02 11:45:54 +01:00
Johan Wassberg	bc17ee1354	Don't confuse containers to connect to them self ... When the hostname pointed to loopback the containers tried to connect to them self instead of the host.	2023-01-24 10:01:59 +01:00
Fredrik Thulin	e2e394a9af	generate /etc/puppet/cosmos-modules.conf dynamically	2023-01-19 17:19:42 +01:00
Johan Wassberg	fb4849a0df	Use puppet that comes with OS ... nunoc-ops does like this since 2018 so I think it will fly. Also the package `puppet` seems to been around since at-least Ubuntu 14.04.	2023-01-17 13:53:13 +01:00
Patrik Lundin	3ef4e47ff6	Handle multiple versions of cosmos .deb ... Before this change there was a need to keep addhost and bootstrap-cosmos.sh in sync regarding what version of the cosmos deb to scp over and later run. Now we find the latest version as decided by `sort -V` in both addhost and bootstrap-cosmos.sh. Solution discussed with @fredrikt.	2022-11-15 18:26:36 +01:00
Patrik Lundin	020b8fe34c	Enable "set -e" again ... Good idea to fail when unexpected things go wrong. Additional fixes added to the script to not stop where we can expect a non-zero return code. Requested by @fredrikt who also reviewed the patch before going in, thanks!	2022-10-12 16:47:20 +02:00
Patrik Lundin	c55e5535a2	Add gpg to cosmos bootstrap script ... Without this Debian 11 fails to bootstrap: ``` /etc/cosmos/gpg.d/50gpg: 36: gpg: not found ```	2022-10-10 17:27:15 +02:00
Linus Nordberg	0692cabba3	Remove that '.novalocal' line in /etc/hosts, added by cloud-init ... It messes up `hostname -f` on Debian, even if there's a correct line further down in /etc/hosts.	2022-10-10 17:26:56 +02:00
John Van de Meulebrouck Brendgard	3b80ba32c7	Set manage_etc_hosts to false for cloudimage based hosts ... this is needed so that our changes in /etc/hosts are not overwritten.	2022-10-10 17:26:45 +02:00
Fredrik Thulin	b2272d409f	free-hand updates from eduid-ops	2022-10-10 17:26:18 +02:00
Leif Johansson	19304f2d79	short hostname i /etc/hosts	2022-10-10 17:23:39 +02:00
Leif Johansson	378dfe04fa	try very hard to find git	2022-10-10 17:23:23 +02:00
Leif Johansson	7f0c457a33	try very hard to find git	2022-10-10 17:22:56 +02:00