April 2014 - infrastructure - Fedora mailing-lists

Plan for tomorrow's Fedora Infrastructure meeting (2014-05-01)
by Kevin Fenzi 01 May '14

01 May '14

The infrastructure team will be having it's weekly meeting tomorrow, 2014-05-01 at 18:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic nagios/alerts recap Here we go over the last weeks alerts and see if we can find ways to make it so they don't happen again. #topic Upcoming Tasks/Items https://apps.fedoraproject.org/calendar/list/infrastructure/ #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

2 2

Vacation Thu,Fri *2
by Miroslav Suchý 30 Apr '14

30 Apr '14

I will be on vacation on 1st, 2nd and 8th, 9th May. Just FYI. -- Miroslav Suchy, RHCE, RHCDS Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys

1 0

[PATCH 1/2] split memcached into a separate roles from mailman
by Michael Scherer 29 Apr '14

29 Apr '14

From: Michael Scherer <misc(a)zarb.org> --- roles/mailman/files/memcached.sysconfig | 5 ----- roles/mailman/handlers/main.yml | 3 +-- roles/mailman/meta/main.yml | 4 ++++ roles/mailman/tasks/main.yml | 10 ---------- roles/memcached/files/memcached.sysconfig | 5 +++++ roles/memcached/handlers/main.yml | 3 +++ roles/memcached/tasks/main.yml | 15 +++++++++++++++ 7 files changed, 28 insertions(+), 17 deletions(-) delete mode 100644 roles/mailman/files/memcached.sysconfig create mode 100644 roles/mailman/meta/main.yml create mode 100644 roles/memcached/files/memcached.sysconfig create mode 100644 roles/memcached/handlers/main.yml create mode 100644 roles/memcached/tasks/main.yml diff --git a/roles/mailman/files/memcached.sysconfig b/roles/mailman/files/memcached.sysconfig deleted file mode 100644 index 6a53e3e..0000000 --- a/roles/mailman/files/memcached.sysconfig +++ /dev/null @@ -1,5 +0,0 @@ -PORT="11211" -USER="memcached" -MAXCONN="1024" -CACHESIZE="256" -OPTIONS="" diff --git a/roles/mailman/handlers/main.yml b/roles/mailman/handlers/main.yml index ee96b7a..0761d2f 100644 --- a/roles/mailman/handlers/main.yml +++ b/roles/mailman/handlers/main.yml @@ -8,5 +8,4 @@ - name: reload apache action: service name=httpd state=reloaded -- name: restart memcached - action: service name=memcached state=restarted + diff --git a/roles/mailman/meta/main.yml b/roles/mailman/meta/main.yml new file mode 100644 index 0000000..ccebbea --- /dev/null +++ b/roles/mailman/meta/main.yml @@ -0,0 +1,4 @@ +--- +dependencies: +- { role: memcached } + diff --git a/roles/mailman/tasks/main.yml b/roles/mailman/tasks/main.yml index 686f3db..a4b338e 100644 --- a/roles/mailman/tasks/main.yml +++ b/roles/mailman/tasks/main.yml @@ -45,7 +45,6 @@ - hyperkitty - hyperkitty-selinux - postorius - - memcached - python-pylibmc - yum-plugin-post-transaction-actions - mailman3-fedmsg-plugin @@ -235,12 +234,3 @@ - name: create the postfix aliases command: su mailman -s /bin/sh -c "mailman3 aliases" creates=/var/lib/mailman3/data/postfix_lmtp.db - -# Memcached -- name: set the memcached sysconfig file - copy: src=memcached.sysconfig dest=/etc/sysconfig/memcached - notify: - - restart memcached - -- name: start memcached - service: state=started enabled=yes name=memcached diff --git a/roles/memcached/files/memcached.sysconfig b/roles/memcached/files/memcached.sysconfig new file mode 100644 index 0000000..6a53e3e --- /dev/null +++ b/roles/memcached/files/memcached.sysconfig @@ -0,0 +1,5 @@ +PORT="11211" +USER="memcached" +MAXCONN="1024" +CACHESIZE="256" +OPTIONS="" diff --git a/roles/memcached/handlers/main.yml b/roles/memcached/handlers/main.yml new file mode 100644 index 0000000..5af2e59 --- /dev/null +++ b/roles/memcached/handlers/main.yml @@ -0,0 +1,3 @@ +--- +- name: restart memcached + action: service name=memcached state=restarted diff --git a/roles/memcached/tasks/main.yml b/roles/memcached/tasks/main.yml new file mode 100644 index 0000000..cd591bc --- /dev/null +++ b/roles/memcached/tasks/main.yml @@ -0,0 +1,15 @@ +--- +- name: install needed packages + yum: pkg={{ item }} state=installed + with_items: + - memcached + tags: + - packages + +- name: set the memcached sysconfig file + copy: src=memcached.sysconfig dest=/etc/sysconfig/memcached + notify: + - restart memcached + +- name: start memcached + service: state=started enabled=yes name=memcached -- 1.9.0

3 7

Ideas for getting involved in FI-Apprentice projects
by Amitakhya Phukan 29 Apr '14

29 Apr '14

Hi group, Over a period of time, I have been thinking of how to get more involved in FI-Apprentice and with FI. It seems that my skills fall short even on the easy tickets. :) Maybe I am the only person who doesn't know these technologies. I have no idea of Puppet/Ansible or anything that is so much discussed around. I had a very brief discussion with Kevin some time ago and I had this idea that perhaps we could have a few servers where in we can "learn" a few of the technologies that are bring used by Fedora and then feel more comfortable to contribute. At that time, I brought out the topic of maybe we can rent a few servers from Digital Ocean/GoDaddy etc. Turns out they are quite heavy on my budget. :) Is it possible for Fedora to let a few servers dedicated for training ? Moreover, is there some one like me who would like to join me learn so that the contributions to FA/FI-Apprentice group could be more satisfactory ? Please guide and sincere apologies to any and all who think this mail fall in "junk". It is never my intention to disturb you. Best regards, Amitakhya Phukan

7 8

kernel test web interface request for public facing host.
by Justin Forbes 29 Apr '14

29 Apr '14

As part of the kernel test project, a web interface has been developed to display results. At this point, the only thing reporting to it is the internal autotest systems, but we would like to get this site somewhere public. Once we have a public address for the site, we can have community users testing and submitting results as well. Once community users are submitting test results, the front end can start generating fedmsg messages and badge integration can be done. The application is very lightweight, and should not require too many resources. We do however need a web server for the front end which is capable of sitting on the fedmsg bus as well, and a mysql database on the back end. I expect load to be very light, and we can remove log files for releases as they are no longer supported to keep this from growing infinitely. The logs are stored on the front end, but the average log size is under 3k at this point. The application requires python and mysql-connector-python, but doesn't require any additional framework. The code for the front end is available in git at: https://github.com/jmflinuxtx/kerneltest-harness/tree/master/frontend A quick rundown of the design: Data is submitted via an http post. The submit_test.py script takes those logs, and looks for the relevant information. If the information is found, is entered into the mysql database and the log is stored, renamed to the testid that the database returns. The front end will consists of a number of static web pages which are regenerated whenever the autotest systems submit new results. This was done to keep the load down, there is no need to do dynamic generation of the landing page which people will see most often. The main page lists the most current tested kernel for each supported release, the test results, and a link to the logs. It has links to each supported release which is a static page listing every kernel tested for that release so far. If a kernel version is clicked on, a dynamic page is generated showing all test results for that kernel version. Thanks, Justin

2 1

Meeting Agenda Item: Introduction John Troan
by jtroan＠jt-sw.com 29 Apr '14

29 Apr '14

Hello To All..... I am John Troan, with an IRC handle of ootbro. Bonus points to anyone who can decode this one. :-D I've earned a paycheck over the last twenty years in Lotus Domino/Notes, working my way up to being a senior architect / sys admin / developer. I've also been using Linux at home since the days of going to Best Buy, etc., for the original shrink-wrapped versions of Red Hat -- and still have my RH (not RHEL) version 4.x book from back then. With the decline of Domino, I've decided to shift to the word of Penguin Power (Linux) and picked up an RHCSA last year. I have no specific Fedora work in mind yet**, but would like to gain more Linux experience in a larger-scale environment than I have at home. (Home is where my own domain runs on a small slew of VMs in my mini data center.) **In looking at the list of FIGs, sysadmin-main is where I think my interest best fits -- but I know I need to pick another group first. I'm a programmer by degree and experience, but haven't yet picked up python or enough shell scripting to churn out code. Both are on my list of things to learn. If there's any FIG that needs a warm body, please contact me directly. (If there's more than one, we'll start a bidding process for my time. :) ) While it'll take a little time to build up the specific tech skills, recent experiences have shown that a lot of my past job and programming experiences will transfer well. If there's a general need, I've also got some capacity to build a couple of VMs for testing and might be able to tweak the home network config a little to allow access from the outside. Thanks and I'll be in my first fedora-admin IRC meeting on Thursday...... ======================================================================= John M. Troan <jtroan(a)jt-sw.com> Maintainer: Football Site @ JT-SW.com http://www.jt-sw.com/football Chief of Computer Operations U.S.S. Kitty Hawk / NCC-1659 =======================================================================

1 0

source FOO in Ansible?
by Miroslav Suchý 28 Apr '14

28 Apr '14

Lets have file FOO with: export OS_USERNAME=admin export OS_PASSWORD=ADMIN_PASS can I somehow do in Ansible: source FOO and for all next actions, those variables will be defined? Writing: - shell: source FOO && bar looks kind a ugly to me.... -- Miroslav Suchy, RHCE, RHCDS Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys

2 1

Re: Pkgdb2 making it to stg (pre-prod)
by Honza Horak 28 Apr '14

28 Apr '14

Hi, I'm not sure if this is related to the new pkgdb2 effort, but may be. The problem I had the last days was that the old pkgdb seemed broken for me and at least one other guy I asked. Today I found the reason -- it seems that URL https://admin.fedoraproject.org/pkgdb/ works just fine, but URL https://admin.fedoraproject.org/pkgdb (without slash in the end) does not and I get a message: "Not Found The requested URL /pkgdb was not found on this server." What is more, the staging version of pkgdb2 has the same problem -- URL https://admin.stg.fedoraproject.org/pkgdb returns the same error message. I guess redirection or something is a question of a minute, but in case it is necessary to submit a report for infrastructure, just let me know. Regards, Honza On 04/22/2014 09:23 PM, Pierre-Yves Chibon wrote: > Dear all, > > A while ago I introduced you the dev instance of pkgdb2. Since then, I have been > working some more on it. > I recently updated pgkdb-cli to work with the new API [1] as well as writing > a python module for those that want to script against said API [2]. > > On March 10th, pkgdb2 made it to staging [3], our pre-production environment, > and on March 11th, I have updated its database to have a recent version of the > pkgdb1 database, just converted for pkgdb2. > > This means that soon (I'm thinking early May), pkgdb2 will go live in > production. If you have any tools that are relying on pkgdb, now would be a good > time to start looking at the pkgdb2 API [4] and see if it does what you want to > do. I will accept *minor* changes/enhancements to the current API, but only > while it is only in staging. So if you want something changed in the API, now > is a good time to ask. > > [1] https://github.com/fedora-infra/packagedb-cli/ > [2] https://github.com/fedora-infra/packagedb-cli/blob/master/pkgdb2client.py > [3] https://admin.stg.fedoraproject.org/pkgdb/ > [4] https://admin.stg.fedoraproject.org/pkgdb/api/ > > Bug reports and RFE are of course welcome at either place: > https://github.com/fedora-infra/pkgdb2 > or > https://fedorahosted.org/pkgdb2/ > > Thanks for your attention and have a nice day! > Pierre >

2 1

New Mirror in VietNam
by An Phuoc 27 Apr '14

27 Apr '14

Hey 123HOST has been setup a new mirror server for Fedora in Vietnam. Info: HTTP: http://mirrors.123host.vn/epel/ Country : Vietnam City: Ho Chi Minh Sponsoring Organization : 123HOST URL of Sponsoring Organization: http://123host.vn Bandwidth cap: 100mbit Update Frequency: every day Please add this server to public mirror list of Fedora

2 1

Meeting Agenda Item: Introduction Dan Rimal
by Dan Římal 27 Apr '14

27 Apr '14

Hello, My name is Dan Rimal, i'm working and living in Prague, Czech republic. My irc handle is danrimal. Currently i'm working in small outsourcing company as a team leader of system administrator department. I am interested in virtualization, high availability and load balancing, because i'm working with this techniques in my job, like openvz, kvm, RHCS, ocfs2, nginx as cache and load balacer, db replication and so on. Networking like bgp, ospf routing and switching is another interest of mine (i am main admin of our autonomous system AS35236). I have two main goals to contribute fedora. I want to get another point of view to similar problems which i meet in my job and i want to improve my poor english by using it on regular basis. So, it was litte introduction of myself. Regards, Dan

1 0

Re: Looking for admin to increase attachment size limit of fudcon-planning trac
by Zamir Sun 26 Apr '14

26 Apr '14

copy this to infrastructure list On 2014/4/24 21:17, Alick Zhao wrote: > Hi all, > > I wonder who is currently an admin of fudcon-planning trac. Please help > to increase the attachment size limit to allow good quality receipt > files. Similar things has been done at fedora-apac trac ticket. > > Ref: https://fedorahosted.org/fedora-infrastructure/ticket/3683 > > Regards, > -- Zamir SUN zsun(a)fedoraproject.org zsun in #fedora-zh #openshift on freenode.net

3 4

Meeting Agenda Item: Introduction Gabriel Diaz'
by Gabriel Diaz 25 Apr '14

25 Apr '14

Hello community! My name is Gabriel Diaz, and I am very interested in start contributing with my knowledge. I'm from Colombia so mi Time Zone is GTM-5. My basic skills and experiences are quite simple. I learned to program a few year ago and i have liked it since then, I know different languages like C++, Python, Java, Haskell, and I know different paradigms like OOP or structured. I'd like to improve my programming skills, learning from the great developers than this community has. I have made different projects in those languages, most of all for my university assignments, but nothing too big. I'm joining because since I knew about free software I love it, and get really interested in developing free software. I'm able to contribute about 6 hours per week, it depends on my workload. I checked the outstanding issues but didn't feel comfortable picking one to help with, I think is better first get more involved. -- Gabriel Diaz.

1 0

Openstack ansible manifest
by Miroslav Suchý 25 Apr '14

25 Apr '14

Following yesterday meeting: This is may work-in-progress of openstack ansible manifest: https://github.com/xsuchy/openstack-ansible-install I decided to skip all this undercloud etc. and just follow what main wiki suggest: http://docs.openstack.org/trunk/install-guide/install/yum/content/index.html Far from being finished, but comments and collaborators are welcome. -- Miroslav Suchy, RHCE, RHCDS Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys

1 0

[PATCH] migrate keyserver to be a role
by Michael Scherer 24 Apr '14

24 Apr '14

From: Michael Scherer <misc(a)zarb.org> --- files/keyserver/css.css | 132 ---------------------- files/keyserver/index.html | 91 ---------------- files/keyserver/membership | 48 -------- files/keyserver/sks.conf | 83 -------------- files/keyserver/sksconf | 13 --- files/keyserver/ssl.conf | 224 -------------------------------------- handlers/restart_services.yml | 6 - playbooks/groups/keyserver.yml | 2 +- roles/keyserver/files/css.css | 132 ++++++++++++++++++++++ roles/keyserver/files/index.html | 91 ++++++++++++++++ roles/keyserver/files/membership | 48 ++++++++ roles/keyserver/files/sks.conf | 83 ++++++++++++++ roles/keyserver/files/sksconf | 13 +++ roles/keyserver/files/ssl.conf | 224 ++++++++++++++++++++++++++++++++++++++ roles/keyserver/handlers/main.yml | 6 + roles/keyserver/tasks/main.yml | 100 +++++++++++++++++ tasks/keyserver.yml | 100 ----------------- 17 files changed, 698 insertions(+), 698 deletions(-) delete mode 100644 files/keyserver/css.css delete mode 100644 files/keyserver/index.html delete mode 100644 files/keyserver/membership delete mode 100644 files/keyserver/sks.conf delete mode 100644 files/keyserver/sksconf delete mode 100644 files/keyserver/ssl.conf create mode 100644 roles/keyserver/files/css.css create mode 100644 roles/keyserver/files/index.html create mode 100644 roles/keyserver/files/membership create mode 100644 roles/keyserver/files/sks.conf create mode 100644 roles/keyserver/files/sksconf create mode 100644 roles/keyserver/files/ssl.conf create mode 100644 roles/keyserver/handlers/main.yml create mode 100644 roles/keyserver/tasks/main.yml delete mode 100644 tasks/keyserver.yml diff --git a/files/keyserver/css.css b/files/keyserver/css.css deleted file mode 100644 index 99443a0..0000000 --- a/files/keyserver/css.css +++ /dev/null @@ -1,132 +0,0 @@ - * { font-family: helvetica, sans-serif; } - - h1, - p { - margin: 0; /* Let's zero those margins */ - } - -h2 { color: #3c6eb4; margin: 0;} - - #container { - /* border: 1px solid #555; /* Nice transition from white background */ - width: 600px; /* Should be narrow enough for small screens */ - margin: 0 auto; /* Centering */ - font-size: 1.1em; /* Font big enough not to need to squint */ - line-height: 1.3em; - - } - - #title { - /* background-color:#e2e5e2; */ - padding: 10px; - } - - #title h1, #title h2 { - margin-top: 0.3em; - } - - #info { - /* background-color:#e2e5e2; */ - padding: 5px 10px; - } - - #main { - /* background : #FAFBEA; */ - padding: 0 10px 10px 10px; - } - - #main header { - padding-top: 1em; - } - - #main p { - margin: 0.5em 0; - } - - #keytext { - width: 100%; - height: 150px; - border: 1px solid #555; - background : #fff; - max-width: 100%; - display: block; - } - - ul { - width: 100%; - list-style-type: none; - padding-left: 0; - } - - li { - width: 99%; - } - - li label { - width: 57%; - display: inline-block; - } - - button { - border-radius: 3px; - -moz-border-radius: 3px; - background: -webkit-gradient(linear, left top, left bottom, from(#fff), to(#ddd)); - background: -moz-linear-gradient(top, #fff, #ddd); - border: 1px solid #bbb; - } - - #info p {line-height: 1.1em; margin-bottom: 0.3em;} - - - -#bodyform { - margin-top: 20px; - color: #555; - font-weight: normal; - font-size: 16px; - -} - -#headcontent { - width: 700px; - margin: auto; - display: table; - -} - -#lefttop { - float: left; - text-align: left; -} - -#righttop { - float:right; - text-align: right; -} - -hr { - background: #3c6eb4; - height: 8px; - border: 0px; -} - -footer { - background: #3c6eb4; - margin: auto; - color: #fff; - -} - -footer p { width: 500px; margin: auto; text-align: center;} - -a {text-decoration: none; color: #B8C9FF; font-weight: bold;} - -fieldset { - border: 2px solid #4462C4; -} - -legend { - color: #3c6eb4; -} - - diff --git a/files/keyserver/index.html b/files/keyserver/index.html deleted file mode 100644 index 12b7be5..0000000 --- a/files/keyserver/index.html +++ /dev/null @@ -1,91 +0,0 @@ -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> -<head> - <link rel="stylesheet" type="text/css" media="all" href="css.css" /> - <title>Fedora Project GPG Key Server</title> -</head> - - <body> - -<div id=bodyform> - <div id=headcontent> - <div id=lefttop> - <a href="https://fedoraproject.org"> - <img src='https://fedoraproject.org/static/images/fedora-logo.png'> - </a> - </div> - <div id=righttop> - <h1>SKS OpenPGP Key server</h1> - <h2>keys.fedoraproject.org</h2> - </div> - </div> - <hr></hr> - - <div id="container"> - - <div id="main" role="main"> - <header> - <h2>Extract a key</h2> - </header> - <p>You can find a key by typing in some words that appear in the - userid (name, email, etc.) of the key you're looking for, or - by typing in the keyid in hex format ("0x…")</p> - <form id="lookup" action="/pks/lookup" method="get"> - <fieldset checked="true"> <legend>Search for a public key</legend> - <ul> - <li> <label for="search">String</label> <input id="search" - name="search" placeholder="0xDEADBEEF" required="" autofocus="" - type="text"> </li> - <li> <label for="fingerprint">Show PGP Fingerprints</label> - <input id="fingerprint" name="fingerprint" type="checkbox"> - </li> - <li> <label for="hash">Show SKS full-key hashes</label> <input - id="hash" name="hash" type="checkbox"> </li> - <li> <label for="matching">Get regular index of matching - keys</label> <input id="matching" name="op" value="index" - type="radio"> </li> - <li> <label for="verbose">Get verbose index of matching - keys</label> <input id="verbose" name="op" value="vindex" - checked="checked" type="radio"> </li> - <li> <label for="asciiarmored">Retrieve ascii-armored - keys</label> <input id="asciiarmored" name="op" value="get" - type="radio"> </li> - <li> <label for="fullkey">Retrieve keys by full-key hash</label> - <input id="fullkey" name="op" value="hget" type="radio"> - </li> - </ul> - <button type="reset">Reset</button> <button type="submit">Search - - - - - - - for a key</button> </fieldset> - </form> - <header> - <h2>Submit a key</h2> - </header> - <p>You can submit a key by simply pasting in the ASCII-armored - version of your key and clicking on submit.</p> - <form id="add" action="/pks/add" method="post"> - <fieldset> <textarea id="keytext" name="keytext" rows="5" cols="30"></textarea> - <button type="reset">Reset</button> <button checked="true" - type="submit">Submit this key</button></fieldset> - </form> - </div> -  - </div> -  - <footer id="info"> - <p><a href="https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home">SKS</a> is - a new <a href="http://www.openpgp.org/">OpenPGP</a> - keyserver. The main innovation of SKS is that it includes a - highly-efficient reconciliation algorithm for keeping the - keyservers synchronized.</p> - <p style="text-align: center;"><a href="/pks/lookup?op=stats">SKS statistics</a></p> - </footer> -</div> - </body> - -</html> diff --git a/files/keyserver/membership b/files/keyserver/membership deleted file mode 100644 index 42d57b3..0000000 --- a/files/keyserver/membership +++ /dev/null @@ -1,48 +0,0 @@ -a.sks.srv.scientia.net 11370 # root(a)sks.srv.scientia.net -key.adeti.org 11370 # Marco RODRIGUES <marco(a)adeti.org> 0x7CE697FC -key.ip6.li 11370 # Christian Felsing <hostmaster(a)ip6.li> 0x5386E2A0 -keys2.kfwebs.net 11370 # 0x0B7F8B60E3EDFAE3 -keys.andreas-puls.de 11370 # Andreas Puls <appu(a)gmx.net> 0xDAC73FA6 -#keys.christensenplace.us 11370 # Eric Christensen <eric(a)christensenplace.us> 0x024BB3D1 -keyserver.advmapper.com 11370 # Tyler Schwend <tylerschwend(a)gmail.com> 0xDB4B79F8 -keyserver.cns.vt.edu 11370 # Phil Benchoff <benchoff(a)vt.edu> <keymaster(a)cns.vt.edu> -#keyserver.computer42.org 11370 # H.-Dirk Schmitt <dirk(a)computer42.org> 0x6A017B17 -keyserver.dacr.hu 11370 # David Horvath <dacr(a)dacr.hu> 0x00CBC81A -keyserver.gingerbear.net 11370 # John P. Clizbe <John(a)Gingerbear.net> 0xD6569825 -keyserver.kim-minh.com 11370 # Kim Minh Kaplan<kaplan+sks(a)kim-minh.com> 0xAF1E829C -keyserver.kjsl.org 11370 # Javier Henderson <javier(a)kjsl.org> 0x9BF88EE5 -keyserver.nausch.org 11370 # Michael Nausch <michael(a)nausch.org> 0x2384C849 -#key-server.nl 11370 # Wijnand Modderman-Lenstra <maze(a)key-server.nl> 0x294DF221 -keyserver.saol.no-ip.com 11370 # Peter <peter(a)saol.no-ip.com> 0x39E97290 -keyserver.secretresearchfacility.com 11370 # Stephan Seitz <s.seitz(a)secretresearchfacility.com> 0xAB83B1C3 -keyserver.serviz.fr 11370 # robert <sks(at)serviz(pt)fr> 0xEF333C7E -keyserver.sincer.us 11370 # Petru Ghita <petrutz(a)venaver.info> 0x7CF29D04 -keyserver.skoopsmedia.net 11370 # unknown -#keyservers.org 11370 # Rob Hansen <rjh(a)sixdemonbag.org> -keyserver.stack.nl 11370 # Johan van Selst <johans(a)stack.nl> 0xD3AE8D3A -keyserver.ut.mephi.ru 11370 # Dmitry Yu Okunev <dyokunev(a)ut.mephi.ru> 0x8E30679C, pks team <pks(a)ut.mephi.ru> -keyserver.vi-di.fr 11370 # Frank Villaro-Dixon <keyserver(a)vi-di.fr>016106A6AF223DBE -keys.exosphere.de 11370 # Christoph Gebhardt <chris(a)exosphere.de> 0xE1C2E92C -keys.jhcloos.com 11370 # James Cloos <cloos(a)jhcloos.com> 0xED7DAEA6 -keys.niif.hu 11370 # Gabor Kiss <kissg(a)ssg.ki.iif.hu> -keys.thoma.cc 11370 # Maximilian Thoma <keys(a)thoma.cc> 0xB480AC4B -#keys.wuschelpuschel.org 11370 # 0x017D1C3D Peter Kornherr <peter(a)wuschelpuschel.org> -#openpgp1.claruscomms.net 11370 # unknown -pgp.circl.lu 11370 # CIRCL - info(a)circl.lu - 0x22BD4CD5 -#pgp.codelabs.ru 11370 # Eygene Ryabinkin <rea(a)codelabs.ru> 0x8152ECFB -pgp.jjim.de 11370 # Joel Garske <admin(a)pgp.jjim.de> 0xA921EB20 -pgpkeys.mallos.nl 11370 # Arnold Schekkerman <arnold(a)mallos.nl> 0xB66BBBAA -#pgp.megagod.net 11370 # Kullawat Chaowanawatee (0xC19EAE3A) -pgp.rediris.es 11370 # Francisco.monserrat <francisco.monserrat(a)rediris.es> 0xD3A42C61 -#pki.colliertech.org 11370 # C.J. Adams-Collier <cjac(a)uw.edu> 0x8E562765BA27A83C -ranger.ky9k.org 11370 # Brian D Heaton <pgp-keymaster(a)ky9k.org> 0x9A016118 -sks.alpha-labs.net 11370 # Christian Reiss <email(a)christian-reiss.de> 0x44e29126abcd43c5 -sks.disunitedstates.com 11370 # David Benfell <benfell(a)disunitedstates.com> 0x1236602B -sks.ecks.ca 11370 # Eric Benoit <eric(a)ecks.ca> 0x69E65D2C -sks.es.net 11370 # keymaster(a)es.net -sks.fidocon.de 11370 # unknown -sks.karotte.org 11370 # Sebastian Wiesinger <sebastian(a)karotte.org> 0x93A0B9CE -sks.keyservers.net 11370 # John P. Clizbe <John(a)Gingerbear.net> 0xD6569825 -sks-peer.spodhuis.org 11370 # Phil Pennock <keyserver(a)spodhuis.org> 0x3903637F -sks.pkqs.net 11370 # Stephan Beyer <s-beyer(a)gmx.net> 0xFCC5040F -zimmermann.mayfirst.org 11370 # Daniel Kahn Gillmor <dkg(a)fifthhorseman.net> 0xCCD2ED94D21739E9 diff --git a/files/keyserver/sks.conf b/files/keyserver/sks.conf deleted file mode 100644 index 2b87b46..0000000 --- a/files/keyserver/sks.conf +++ /dev/null @@ -1,83 +0,0 @@ -ServerName keys.fedoraproject.org -Listen 80.239.156.219:11371 -NameVirtualHost *:443 - -<ifModule !mod_proxy.c> - LoadModule proxy_module modules/mod_proxy.so -</IfModule> - -<IfModule !mod_proxy_http.c> - LoadModule proxy_http_module modules/mod_proxy_http.so -</IfModule> - -<IfModule !mod_proxy_balancer.c> - LoadModule proxy_balancer_module modules/mod_proxy_balancer.so -</IfModule> - -<IfModule !mod_headers.c> - LoadModule headers_module modules/mod_headers.so -</IfModule> - -<IfModule !mod_authz_host.c> - LoadModule authz_host_module modules/mod_authz_host.so -</IfModule> - -<IfModule !mod_log_config.c> - LoadModule log_config_module modules/mod_log_config.so -</IfModule> - -<IfModule !mod_env.c> - LoadModule env_module modules/mod_env.so -</IfModule> - -<Directory /> - Options FollowSymLinks - AllowOverride None - Order deny,allow - Deny from all -</Directory> - -<VirtualHost *:80> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName keys.fedoraproject.org - ProxyPass / http://127.0.0.1:11371/ - ProxyPassReverse / http://127.0.0.1:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> -<VirtualHost *:443> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName keys.fedoraproject.org - ServerAlias keys01.fedoraproject.org - - SSLEngine on - SSLCertificateFile /etc/pki/tls/wildcard-2013.fedoraproject.org.cert - SSLCertificateChainFile /etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert - SSLCertificateKeyFile /etc/pki/tls/wildcard-2013.fedoraproject.org.key - ProxyPass / http://localhost:11371/ - ProxyPassReverse / http://localhost:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> -<VirtualHost *:443> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName pool.sks-keyservers.net - ServerAlias sks-keyservers.net - ServerAlias *.sks-keyservers.net - - SSLEngine on - SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem - SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key - ProxyPass / http://localhost:11371/ - ProxyPassReverse / http://localhost:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> -<VirtualHost *:11371> - ServerAdmin sysadmin-keys-members(a)fedoraproject.org - ServerName keys.fedoraproject.org - ProxyPass / http://127.0.0.1:11371/ - ProxyPassReverse / http://127.0.0.1:11371/ - SetEnv proxy-nokeepalive 1 - ProxyVia Full -</VirtualHost> diff --git a/files/keyserver/sksconf b/files/keyserver/sksconf deleted file mode 100644 index ae15003..0000000 --- a/files/keyserver/sksconf +++ /dev/null @@ -1,13 +0,0 @@ -basedir: /srv/sks -#debuglevel: 10 -#debug: -hostname: keys.fedoraproject.org -hkp_address: 127.0.0.1 -hkp_port: 11371 -recon_port: 11370 -#gossip_interval: 1440 -stat_hour: 00 -initial_stat: -membership_reload_interval: 1 -disable_mailsync: -server_contact: 0x167B4A54236BBEAA37DCCD92ED14D5E7110810E9 diff --git a/files/keyserver/ssl.conf b/files/keyserver/ssl.conf deleted file mode 100644 index c1ed750..0000000 --- a/files/keyserver/ssl.conf +++ /dev/null @@ -1,224 +0,0 @@ -# -# This is the Apache server configuration file providing SSL support. -# It contains the configuration directives to instruct the server how to -# serve pages over an https connection. For detailing information about these -# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html> -# -# Do NOT simply read the instructions in here without understanding -# what they do. They're here only as hints or reminders. If you are unsure -# consult the online docs. You have been warned. -# - -LoadModule ssl_module modules/mod_ssl.so - -# -# When we also provide SSL we have to listen to the -# the HTTPS port in addition. -# -Listen 443 - -## -## SSL Global Context -## -## All SSL configuration in this context applies both to -## the main server and all SSL-enabled virtual hosts. -## - -# Pass Phrase Dialog: -# Configure the pass phrase gathering process. -# The filtering dialog program (`builtin' is a internal -# terminal dialog) has to provide the pass phrase on stdout. -SSLPassPhraseDialog builtin - -# Inter-Process Session Cache: -# Configure the SSL Session Cache: First the mechanism -# to use and second the expiring timeout (in seconds). -SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000) -SSLSessionCacheTimeout 300 - -# Semaphore: -# Configure the path to the mutual exclusion semaphore the -# SSL engine uses internally for inter-process synchronization. -SSLMutex default - -# Pseudo Random Number Generator (PRNG): -# Configure one or more sources to seed the PRNG of the -# SSL library. The seed data should be of good random quality. -# WARNING! On some platforms /dev/random blocks if not enough entropy -# is available. This means you then cannot use the /dev/random device -# because it would lead to very long connection times (as long as -# it requires to make more entropy available). But usually those -# platforms additionally provide a /dev/urandom device which doesn't -# block. So, if available, use this one instead. Read the mod_ssl User -# Manual for more details. -SSLRandomSeed startup file:/dev/urandom 256 -SSLRandomSeed connect builtin -#SSLRandomSeed startup file:/dev/random 512 -#SSLRandomSeed connect file:/dev/random 512 -#SSLRandomSeed connect file:/dev/urandom 512 - -# -# Use "SSLCryptoDevice" to enable any supported hardware -# accelerators. Use "openssl engine -v" to list supported -# engine names. NOTE: If you enable an accelerator and the -# server does not start, consult the error logs and ensure -# your accelerator is functioning properly. -# -SSLCryptoDevice builtin -#SSLCryptoDevice ubsec - -## -## SSL Virtual Host Context -## - -<VirtualHost _default_:443> - -# General setup for the virtual host, inherited from global configuration -#DocumentRoot "/var/www/html" - # ProxyPass / http://localhost:11371/ - # ProxyPassReverse / http://localhost:11371/ -#ServerName www.example.com:443 - -# Use separate log files for the SSL virtual host; note that LogLevel -# is not inherited from httpd.conf. -ErrorLog logs/ssl_error_log -TransferLog logs/ssl_access_log -LogLevel warn - -# SSL Engine Switch: -# Enable/Disable SSL for this virtual host. -SSLEngine on - -# SSL Protocol support: -# List the enable protocol levels with which clients will be able to -# connect. Disable SSLv2 access by default: -SSLProtocol all -SSLv2 - -# SSL Cipher Suite: -# List the ciphers that the client is permitted to negotiate. -# See the mod_ssl documentation for a complete list. -SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW - -# Server Certificate: -# Point SSLCertificateFile at a PEM encoded certificate. If -# the certificate is encrypted, then you will be prompted for a -# pass phrase. Note that a kill -HUP will prompt again. A new -# certificate can be generated using the genkey(1) command. -SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem - -# Server Private Key: -# If the key is not combined with the certificate, use this -# directive to point at the key file. Keep in mind that if -# you've both a RSA and a DSA private key you can configure -# both in parallel (to also allow the use of DSA ciphers, etc.) -SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key - -# Server Certificate Chain: -# Point SSLCertificateChainFile at a file containing the -# concatenation of PEM encoded CA certificates which form the -# certificate chain for the server certificate. Alternatively -# the referenced file can be the same as SSLCertificateFile -# when the CA certificates are directly appended to the server -# certificate for convinience. -#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt - -# Certificate Authority (CA): -# Set the CA certificate verification path where to find CA -# certificates for client authentication or alternatively one -# huge file containing all of them (file must be PEM encoded) -#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt - -# Client Authentication (Type): -# Client certificate verification type and depth. Types are -# none, optional, require and optional_no_ca. Depth is a -# number which specifies how deeply to verify the certificate -# issuer chain before deciding the certificate is not valid. -#SSLVerifyClient require -#SSLVerifyDepth 10 - -# Access Control: -# With SSLRequire you can do per-directory access control based -# on arbitrary complex boolean expressions containing server -# variable checks and other lookup directives. The syntax is a -# mixture between C and Perl. See the mod_ssl documentation -# for more details. -#<Location /> -#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ -# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ -# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ -# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ -# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ -# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ -#</Location> - -# SSL Engine Options: -# Set various options for the SSL engine. -# o FakeBasicAuth: -# Translate the client X.509 into a Basic Authorisation. This means that -# the standard Auth/DBMAuth methods can be used for access control. The -# user name is the `one line' version of the client's X.509 certificate. -# Note that no password is obtained from the user. Every entry in the user -# file needs this password: `xxj31ZMTZzkVA'. -# o ExportCertData: -# This exports two additional environment variables: SSL_CLIENT_CERT and -# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the -# server (always existing) and the client (only existing when client -# authentication is used). This can be used to import the certificates -# into CGI scripts. -# o StdEnvVars: -# This exports the standard SSL/TLS related `SSL_*' environment variables. -# Per default this exportation is switched off for performance reasons, -# because the extraction step is an expensive operation and is usually -# useless for serving static content. So one usually enables the -# exportation for CGI and SSI requests only. -# o StrictRequire: -# This denies access when "SSLRequireSSL" or "SSLRequire" applied even -# under a "Satisfy any" situation, i.e. when it applies access is denied -# and no other module can change it. -# o OptRenegotiate: -# This enables optimized SSL connection renegotiation handling when SSL -# directives are used in per-directory context. -#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire -<Files ~ "\.(cgi|shtml|phtml|php3?)$"> - SSLOptions +StdEnvVars -</Files> -<Directory "/var/www/cgi-bin"> - SSLOptions +StdEnvVars -</Directory> - -# SSL Protocol Adjustments: -# The safe and default but still SSL/TLS standard compliant shutdown -# approach is that mod_ssl sends the close notify alert but doesn't wait for -# the close notify alert from client. When you need a different shutdown -# approach you can use one of the following variables: -# o ssl-unclean-shutdown: -# This forces an unclean shutdown when the connection is closed, i.e. no -# SSL close notify alert is send or allowed to received. This violates -# the SSL/TLS standard but is needed for some brain-dead browsers. Use -# this when you receive I/O errors because of the standard approach where -# mod_ssl sends the close notify alert. -# o ssl-accurate-shutdown: -# This forces an accurate shutdown when the connection is closed, i.e. a -# SSL close notify alert is send and mod_ssl waits for the close notify -# alert of the client. This is 100% SSL/TLS standard compliant, but in -# practice often causes hanging connections with brain-dead browsers. Use -# this only for browsers where you know that their SSL implementation -# works correctly. -# Notice: Most problems of broken clients are also related to the HTTP -# keep-alive facility, so you usually additionally want to disable -# keep-alive for those clients, too. Use variable "nokeepalive" for this. -# Similarly, one has to force some clients to use HTTP/1.0 to workaround -# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and -# "force-response-1.0" for this. -SetEnvIf User-Agent ".*MSIE.*" \ - nokeepalive ssl-unclean-shutdown \ - downgrade-1.0 force-response-1.0 - -# Per-Server Logging: -# The home of a custom SSL log file. Use this when you want a -# compact non-error SSL logfile on a virtual host basis. -CustomLog logs/ssl_request_log \ - "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" - -</VirtualHost> - diff --git a/handlers/restart_services.yml b/handlers/restart_services.yml index 10fa661..90cfb67 100644 --- a/handlers/restart_services.yml +++ b/handlers/restart_services.yml @@ -80,12 +80,6 @@ - name: restart rsyslog action: service name=rsyslog state=restarted -- name: restart sks-db - action: service name=sks-db state=restarted - -- name: restart sks-recon - action: service name=sks-recon state=restarted - - name: restart sshd action: service name=sshd state=restarted diff --git a/playbooks/groups/keyserver.yml b/playbooks/groups/keyserver.yml index ef2fb9c..4bc06fc 100644 --- a/playbooks/groups/keyserver.yml +++ b/playbooks/groups/keyserver.yml @@ -38,6 +38,7 @@ - nagios_client - fas_client - fedmsg/base + - keyserver tasks: - include: "{{ tasks }}/hosts.yml" @@ -47,7 +48,6 @@ - include: "{{ tasks }}/motd.yml" - include: "{{ tasks }}/sudo.yml" - include: "{{ tasks }}/apache.yml" - - include: "{{ tasks }}/keyserver.yml" handlers: - include: "{{ handlers }}/restart_services.yml" diff --git a/roles/keyserver/files/css.css b/roles/keyserver/files/css.css new file mode 100644 index 0000000..99443a0 --- /dev/null +++ b/roles/keyserver/files/css.css @@ -0,0 +1,132 @@ + * { font-family: helvetica, sans-serif; } + + h1, + p { + margin: 0; /* Let's zero those margins */ + } + +h2 { color: #3c6eb4; margin: 0;} + + #container { + /* border: 1px solid #555; /* Nice transition from white background */ + width: 600px; /* Should be narrow enough for small screens */ + margin: 0 auto; /* Centering */ + font-size: 1.1em; /* Font big enough not to need to squint */ + line-height: 1.3em; + + } + + #title { + /* background-color:#e2e5e2; */ + padding: 10px; + } + + #title h1, #title h2 { + margin-top: 0.3em; + } + + #info { + /* background-color:#e2e5e2; */ + padding: 5px 10px; + } + + #main { + /* background : #FAFBEA; */ + padding: 0 10px 10px 10px; + } + + #main header { + padding-top: 1em; + } + + #main p { + margin: 0.5em 0; + } + + #keytext { + width: 100%; + height: 150px; + border: 1px solid #555; + background : #fff; + max-width: 100%; + display: block; + } + + ul { + width: 100%; + list-style-type: none; + padding-left: 0; + } + + li { + width: 99%; + } + + li label { + width: 57%; + display: inline-block; + } + + button { + border-radius: 3px; + -moz-border-radius: 3px; + background: -webkit-gradient(linear, left top, left bottom, from(#fff), to(#ddd)); + background: -moz-linear-gradient(top, #fff, #ddd); + border: 1px solid #bbb; + } + + #info p {line-height: 1.1em; margin-bottom: 0.3em;} + + + +#bodyform { + margin-top: 20px; + color: #555; + font-weight: normal; + font-size: 16px; + +} + +#headcontent { + width: 700px; + margin: auto; + display: table; + +} + +#lefttop { + float: left; + text-align: left; +} + +#righttop { + float:right; + text-align: right; +} + +hr { + background: #3c6eb4; + height: 8px; + border: 0px; +} + +footer { + background: #3c6eb4; + margin: auto; + color: #fff; + +} + +footer p { width: 500px; margin: auto; text-align: center;} + +a {text-decoration: none; color: #B8C9FF; font-weight: bold;} + +fieldset { + border: 2px solid #4462C4; +} + +legend { + color: #3c6eb4; +} + + diff --git a/roles/keyserver/files/index.html b/roles/keyserver/files/index.html new file mode 100644 index 0000000..12b7be5 --- /dev/null +++ b/roles/keyserver/files/index.html @@ -0,0 +1,91 @@ +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> +<head> + <link rel="stylesheet" type="text/css" media="all" href="css.css" /> + <title>Fedora Project GPG Key Server</title> +</head> + + <body> + +<div id=bodyform> + <div id=headcontent> + <div id=lefttop> + <a href="https://fedoraproject.org"> + <img src='https://fedoraproject.org/static/images/fedora-logo.png'> + </a> + </div> + <div id=righttop> + <h1>SKS OpenPGP Key server</h1> + <h2>keys.fedoraproject.org</h2> + </div> + </div> + <hr></hr> + + <div id="container"> + + <div id="main" role="main"> + <header> + <h2>Extract a key</h2> + </header> + <p>You can find a key by typing in some words that appear in the + userid (name, email, etc.) of the key you're looking for, or + by typing in the keyid in hex format ("0x…")</p> + <form id="lookup" action="/pks/lookup" method="get"> + <fieldset checked="true"> <legend>Search for a public key</legend> + <ul> + <li> <label for="search">String</label> <input id="search" + name="search" placeholder="0xDEADBEEF" required="" autofocus="" + type="text"> </li> + <li> <label for="fingerprint">Show PGP Fingerprints</label> + <input id="fingerprint" name="fingerprint" type="checkbox"> + </li> + <li> <label for="hash">Show SKS full-key hashes</label> <input + id="hash" name="hash" type="checkbox"> </li> + <li> <label for="matching">Get regular index of matching + keys</label> <input id="matching" name="op" value="index" + type="radio"> </li> + <li> <label for="verbose">Get verbose index of matching + keys</label> <input id="verbose" name="op" value="vindex" + checked="checked" type="radio"> </li> + <li> <label for="asciiarmored">Retrieve ascii-armored + keys</label> <input id="asciiarmored" name="op" value="get" + type="radio"> </li> + <li> <label for="fullkey">Retrieve keys by full-key hash</label> + <input id="fullkey" name="op" value="hget" type="radio"> + </li> + </ul> + <button type="reset">Reset</button> <button type="submit">Search + + + + + + + for a key</button> </fieldset> + </form> + <header> + <h2>Submit a key</h2> + </header> + <p>You can submit a key by simply pasting in the ASCII-armored + version of your key and clicking on submit.</p> + <form id="add" action="/pks/add" method="post"> + <fieldset> <textarea id="keytext" name="keytext" rows="5" cols="30"></textarea> + <button type="reset">Reset</button> <button checked="true" + type="submit">Submit this key</button></fieldset> + </form> + </div> +  + </div> +  + <footer id="info"> + <p><a href="https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home">SKS</a> is + a new <a href="http://www.openpgp.org/">OpenPGP</a> + keyserver. The main innovation of SKS is that it includes a + highly-efficient reconciliation algorithm for keeping the + keyservers synchronized.</p> + <p style="text-align: center;"><a href="/pks/lookup?op=stats">SKS statistics</a></p> + </footer> +</div> + </body> + +</html> diff --git a/roles/keyserver/files/membership b/roles/keyserver/files/membership new file mode 100644 index 0000000..42d57b3 --- /dev/null +++ b/roles/keyserver/files/membership @@ -0,0 +1,48 @@ +a.sks.srv.scientia.net 11370 # root(a)sks.srv.scientia.net +key.adeti.org 11370 # Marco RODRIGUES <marco(a)adeti.org> 0x7CE697FC +key.ip6.li 11370 # Christian Felsing <hostmaster(a)ip6.li> 0x5386E2A0 +keys2.kfwebs.net 11370 # 0x0B7F8B60E3EDFAE3 +keys.andreas-puls.de 11370 # Andreas Puls <appu(a)gmx.net> 0xDAC73FA6 +#keys.christensenplace.us 11370 # Eric Christensen <eric(a)christensenplace.us> 0x024BB3D1 +keyserver.advmapper.com 11370 # Tyler Schwend <tylerschwend(a)gmail.com> 0xDB4B79F8 +keyserver.cns.vt.edu 11370 # Phil Benchoff <benchoff(a)vt.edu> <keymaster(a)cns.vt.edu> +#keyserver.computer42.org 11370 # H.-Dirk Schmitt <dirk(a)computer42.org> 0x6A017B17 +keyserver.dacr.hu 11370 # David Horvath <dacr(a)dacr.hu> 0x00CBC81A +keyserver.gingerbear.net 11370 # John P. Clizbe <John(a)Gingerbear.net> 0xD6569825 +keyserver.kim-minh.com 11370 # Kim Minh Kaplan<kaplan+sks(a)kim-minh.com> 0xAF1E829C +keyserver.kjsl.org 11370 # Javier Henderson <javier(a)kjsl.org> 0x9BF88EE5 +keyserver.nausch.org 11370 # Michael Nausch <michael(a)nausch.org> 0x2384C849 +#key-server.nl 11370 # Wijnand Modderman-Lenstra <maze(a)key-server.nl> 0x294DF221 +keyserver.saol.no-ip.com 11370 # Peter <peter(a)saol.no-ip.com> 0x39E97290 +keyserver.secretresearchfacility.com 11370 # Stephan Seitz <s.seitz(a)secretresearchfacility.com> 0xAB83B1C3 +keyserver.serviz.fr 11370 # robert <sks(at)serviz(pt)fr> 0xEF333C7E +keyserver.sincer.us 11370 # Petru Ghita <petrutz(a)venaver.info> 0x7CF29D04 +keyserver.skoopsmedia.net 11370 # unknown +#keyservers.org 11370 # Rob Hansen <rjh(a)sixdemonbag.org> +keyserver.stack.nl 11370 # Johan van Selst <johans(a)stack.nl> 0xD3AE8D3A +keyserver.ut.mephi.ru 11370 # Dmitry Yu Okunev <dyokunev(a)ut.mephi.ru> 0x8E30679C, pks team <pks(a)ut.mephi.ru> +keyserver.vi-di.fr 11370 # Frank Villaro-Dixon <keyserver(a)vi-di.fr>016106A6AF223DBE +keys.exosphere.de 11370 # Christoph Gebhardt <chris(a)exosphere.de> 0xE1C2E92C +keys.jhcloos.com 11370 # James Cloos <cloos(a)jhcloos.com> 0xED7DAEA6 +keys.niif.hu 11370 # Gabor Kiss <kissg(a)ssg.ki.iif.hu> +keys.thoma.cc 11370 # Maximilian Thoma <keys(a)thoma.cc> 0xB480AC4B +#keys.wuschelpuschel.org 11370 # 0x017D1C3D Peter Kornherr <peter(a)wuschelpuschel.org> +#openpgp1.claruscomms.net 11370 # unknown +pgp.circl.lu 11370 # CIRCL - info(a)circl.lu - 0x22BD4CD5 +#pgp.codelabs.ru 11370 # Eygene Ryabinkin <rea(a)codelabs.ru> 0x8152ECFB +pgp.jjim.de 11370 # Joel Garske <admin(a)pgp.jjim.de> 0xA921EB20 +pgpkeys.mallos.nl 11370 # Arnold Schekkerman <arnold(a)mallos.nl> 0xB66BBBAA +#pgp.megagod.net 11370 # Kullawat Chaowanawatee (0xC19EAE3A) +pgp.rediris.es 11370 # Francisco.monserrat <francisco.monserrat(a)rediris.es> 0xD3A42C61 +#pki.colliertech.org 11370 # C.J. Adams-Collier <cjac(a)uw.edu> 0x8E562765BA27A83C +ranger.ky9k.org 11370 # Brian D Heaton <pgp-keymaster(a)ky9k.org> 0x9A016118 +sks.alpha-labs.net 11370 # Christian Reiss <email(a)christian-reiss.de> 0x44e29126abcd43c5 +sks.disunitedstates.com 11370 # David Benfell <benfell(a)disunitedstates.com> 0x1236602B +sks.ecks.ca 11370 # Eric Benoit <eric(a)ecks.ca> 0x69E65D2C +sks.es.net 11370 # keymaster(a)es.net +sks.fidocon.de 11370 # unknown +sks.karotte.org 11370 # Sebastian Wiesinger <sebastian(a)karotte.org> 0x93A0B9CE +sks.keyservers.net 11370 # John P. Clizbe <John(a)Gingerbear.net> 0xD6569825 +sks-peer.spodhuis.org 11370 # Phil Pennock <keyserver(a)spodhuis.org> 0x3903637F +sks.pkqs.net 11370 # Stephan Beyer <s-beyer(a)gmx.net> 0xFCC5040F +zimmermann.mayfirst.org 11370 # Daniel Kahn Gillmor <dkg(a)fifthhorseman.net> 0xCCD2ED94D21739E9 diff --git a/roles/keyserver/files/sks.conf b/roles/keyserver/files/sks.conf new file mode 100644 index 0000000..2b87b46 --- /dev/null +++ b/roles/keyserver/files/sks.conf @@ -0,0 +1,83 @@ +ServerName keys.fedoraproject.org +Listen 80.239.156.219:11371 +NameVirtualHost *:443 + +<ifModule !mod_proxy.c> + LoadModule proxy_module modules/mod_proxy.so +</IfModule> + +<IfModule !mod_proxy_http.c> + LoadModule proxy_http_module modules/mod_proxy_http.so +</IfModule> + +<IfModule !mod_proxy_balancer.c> + LoadModule proxy_balancer_module modules/mod_proxy_balancer.so +</IfModule> + +<IfModule !mod_headers.c> + LoadModule headers_module modules/mod_headers.so +</IfModule> + +<IfModule !mod_authz_host.c> + LoadModule authz_host_module modules/mod_authz_host.so +</IfModule> + +<IfModule !mod_log_config.c> + LoadModule log_config_module modules/mod_log_config.so +</IfModule> + +<IfModule !mod_env.c> + LoadModule env_module modules/mod_env.so +</IfModule> + +<Directory /> + Options FollowSymLinks + AllowOverride None + Order deny,allow + Deny from all +</Directory> + +<VirtualHost *:80> + ServerAdmin sysadmin-keys-members(a)fedoraproject.org + ServerName keys.fedoraproject.org + ProxyPass / http://127.0.0.1:11371/ + ProxyPassReverse / http://127.0.0.1:11371/ + SetEnv proxy-nokeepalive 1 + ProxyVia Full +</VirtualHost> +<VirtualHost *:443> + ServerAdmin sysadmin-keys-members(a)fedoraproject.org + ServerName keys.fedoraproject.org + ServerAlias keys01.fedoraproject.org + + SSLEngine on + SSLCertificateFile /etc/pki/tls/wildcard-2013.fedoraproject.org.cert + SSLCertificateChainFile /etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert + SSLCertificateKeyFile /etc/pki/tls/wildcard-2013.fedoraproject.org.key + ProxyPass / http://localhost:11371/ + ProxyPassReverse / http://localhost:11371/ + SetEnv proxy-nokeepalive 1 + ProxyVia Full +</VirtualHost> +<VirtualHost *:443> + ServerAdmin sysadmin-keys-members(a)fedoraproject.org + ServerName pool.sks-keyservers.net + ServerAlias sks-keyservers.net + ServerAlias *.sks-keyservers.net + + SSLEngine on + SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem + SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key + ProxyPass / http://localhost:11371/ + ProxyPassReverse / http://localhost:11371/ + SetEnv proxy-nokeepalive 1 + ProxyVia Full +</VirtualHost> +<VirtualHost *:11371> + ServerAdmin sysadmin-keys-members(a)fedoraproject.org + ServerName keys.fedoraproject.org + ProxyPass / http://127.0.0.1:11371/ + ProxyPassReverse / http://127.0.0.1:11371/ + SetEnv proxy-nokeepalive 1 + ProxyVia Full +</VirtualHost> diff --git a/roles/keyserver/files/sksconf b/roles/keyserver/files/sksconf new file mode 100644 index 0000000..ae15003 --- /dev/null +++ b/roles/keyserver/files/sksconf @@ -0,0 +1,13 @@ +basedir: /srv/sks +#debuglevel: 10 +#debug: +hostname: keys.fedoraproject.org +hkp_address: 127.0.0.1 +hkp_port: 11371 +recon_port: 11370 +#gossip_interval: 1440 +stat_hour: 00 +initial_stat: +membership_reload_interval: 1 +disable_mailsync: +server_contact: 0x167B4A54236BBEAA37DCCD92ED14D5E7110810E9 diff --git a/roles/keyserver/files/ssl.conf b/roles/keyserver/files/ssl.conf new file mode 100644 index 0000000..c1ed750 --- /dev/null +++ b/roles/keyserver/files/ssl.conf @@ -0,0 +1,224 @@ +# +# This is the Apache server configuration file providing SSL support. +# It contains the configuration directives to instruct the server how to +# serve pages over an https connection. For detailing information about these +# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html> +# +# Do NOT simply read the instructions in here without understanding +# what they do. They're here only as hints or reminders. If you are unsure +# consult the online docs. You have been warned. +# + +LoadModule ssl_module modules/mod_ssl.so + +# +# When we also provide SSL we have to listen to the +# the HTTPS port in addition. +# +Listen 443 + +## +## SSL Global Context +## +## All SSL configuration in this context applies both to +## the main server and all SSL-enabled virtual hosts. +## + +# Pass Phrase Dialog: +# Configure the pass phrase gathering process. +# The filtering dialog program (`builtin' is a internal +# terminal dialog) has to provide the pass phrase on stdout. +SSLPassPhraseDialog builtin + +# Inter-Process Session Cache: +# Configure the SSL Session Cache: First the mechanism +# to use and second the expiring timeout (in seconds). +SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000) +SSLSessionCacheTimeout 300 + +# Semaphore: +# Configure the path to the mutual exclusion semaphore the +# SSL engine uses internally for inter-process synchronization. +SSLMutex default + +# Pseudo Random Number Generator (PRNG): +# Configure one or more sources to seed the PRNG of the +# SSL library. The seed data should be of good random quality. +# WARNING! On some platforms /dev/random blocks if not enough entropy +# is available. This means you then cannot use the /dev/random device +# because it would lead to very long connection times (as long as +# it requires to make more entropy available). But usually those +# platforms additionally provide a /dev/urandom device which doesn't +# block. So, if available, use this one instead. Read the mod_ssl User +# Manual for more details. +SSLRandomSeed startup file:/dev/urandom 256 +SSLRandomSeed connect builtin +#SSLRandomSeed startup file:/dev/random 512 +#SSLRandomSeed connect file:/dev/random 512 +#SSLRandomSeed connect file:/dev/urandom 512 + +# +# Use "SSLCryptoDevice" to enable any supported hardware +# accelerators. Use "openssl engine -v" to list supported +# engine names. NOTE: If you enable an accelerator and the +# server does not start, consult the error logs and ensure +# your accelerator is functioning properly. +# +SSLCryptoDevice builtin +#SSLCryptoDevice ubsec + +## +## SSL Virtual Host Context +## + +<VirtualHost _default_:443> + +# General setup for the virtual host, inherited from global configuration +#DocumentRoot "/var/www/html" + # ProxyPass / http://localhost:11371/ + # ProxyPassReverse / http://localhost:11371/ +#ServerName www.example.com:443 + +# Use separate log files for the SSL virtual host; note that LogLevel +# is not inherited from httpd.conf. +ErrorLog logs/ssl_error_log +TransferLog logs/ssl_access_log +LogLevel warn + +# SSL Engine Switch: +# Enable/Disable SSL for this virtual host. +SSLEngine on + +# SSL Protocol support: +# List the enable protocol levels with which clients will be able to +# connect. Disable SSLv2 access by default: +SSLProtocol all -SSLv2 + +# SSL Cipher Suite: +# List the ciphers that the client is permitted to negotiate. +# See the mod_ssl documentation for a complete list. +SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW + +# Server Certificate: +# Point SSLCertificateFile at a PEM encoded certificate. If +# the certificate is encrypted, then you will be prompted for a +# pass phrase. Note that a kill -HUP will prompt again. A new +# certificate can be generated using the genkey(1) command. +SSLCertificateFile /etc/pki/tls/keys_fedoraproject_org.crt.pem + +# Server Private Key: +# If the key is not combined with the certificate, use this +# directive to point at the key file. Keep in mind that if +# you've both a RSA and a DSA private key you can configure +# both in parallel (to also allow the use of DSA ciphers, etc.) +SSLCertificateKeyFile /etc/pki/tls/keys_fedoraproject_org.key + +# Server Certificate Chain: +# Point SSLCertificateChainFile at a file containing the +# concatenation of PEM encoded CA certificates which form the +# certificate chain for the server certificate. Alternatively +# the referenced file can be the same as SSLCertificateFile +# when the CA certificates are directly appended to the server +# certificate for convinience. +#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt + +# Certificate Authority (CA): +# Set the CA certificate verification path where to find CA +# certificates for client authentication or alternatively one +# huge file containing all of them (file must be PEM encoded) +#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt + +# Client Authentication (Type): +# Client certificate verification type and depth. Types are +# none, optional, require and optional_no_ca. Depth is a +# number which specifies how deeply to verify the certificate +# issuer chain before deciding the certificate is not valid. +#SSLVerifyClient require +#SSLVerifyDepth 10 + +# Access Control: +# With SSLRequire you can do per-directory access control based +# on arbitrary complex boolean expressions containing server +# variable checks and other lookup directives. The syntax is a +# mixture between C and Perl. See the mod_ssl documentation +# for more details. +#<Location /> +#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ +# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ +# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ +# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ +# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ +# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ +#</Location> + +# SSL Engine Options: +# Set various options for the SSL engine. +# o FakeBasicAuth: +# Translate the client X.509 into a Basic Authorisation. This means that +# the standard Auth/DBMAuth methods can be used for access control. The +# user name is the `one line' version of the client's X.509 certificate. +# Note that no password is obtained from the user. Every entry in the user +# file needs this password: `xxj31ZMTZzkVA'. +# o ExportCertData: +# This exports two additional environment variables: SSL_CLIENT_CERT and +# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the +# server (always existing) and the client (only existing when client +# authentication is used). This can be used to import the certificates +# into CGI scripts. +# o StdEnvVars: +# This exports the standard SSL/TLS related `SSL_*' environment variables. +# Per default this exportation is switched off for performance reasons, +# because the extraction step is an expensive operation and is usually +# useless for serving static content. So one usually enables the +# exportation for CGI and SSI requests only. +# o StrictRequire: +# This denies access when "SSLRequireSSL" or "SSLRequire" applied even +# under a "Satisfy any" situation, i.e. when it applies access is denied +# and no other module can change it. +# o OptRenegotiate: +# This enables optimized SSL connection renegotiation handling when SSL +# directives are used in per-directory context. +#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire +<Files ~ "\.(cgi|shtml|phtml|php3?)$"> + SSLOptions +StdEnvVars +</Files> +<Directory "/var/www/cgi-bin"> + SSLOptions +StdEnvVars +</Directory> + +# SSL Protocol Adjustments: +# The safe and default but still SSL/TLS standard compliant shutdown +# approach is that mod_ssl sends the close notify alert but doesn't wait for +# the close notify alert from client. When you need a different shutdown +# approach you can use one of the following variables: +# o ssl-unclean-shutdown: +# This forces an unclean shutdown when the connection is closed, i.e. no +# SSL close notify alert is send or allowed to received. This violates +# the SSL/TLS standard but is needed for some brain-dead browsers. Use +# this when you receive I/O errors because of the standard approach where +# mod_ssl sends the close notify alert. +# o ssl-accurate-shutdown: +# This forces an accurate shutdown when the connection is closed, i.e. a +# SSL close notify alert is send and mod_ssl waits for the close notify +# alert of the client. This is 100% SSL/TLS standard compliant, but in +# practice often causes hanging connections with brain-dead browsers. Use +# this only for browsers where you know that their SSL implementation +# works correctly. +# Notice: Most problems of broken clients are also related to the HTTP +# keep-alive facility, so you usually additionally want to disable +# keep-alive for those clients, too. Use variable "nokeepalive" for this. +# Similarly, one has to force some clients to use HTTP/1.0 to workaround +# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and +# "force-response-1.0" for this. +SetEnvIf User-Agent ".*MSIE.*" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + +# Per-Server Logging: +# The home of a custom SSL log file. Use this when you want a +# compact non-error SSL logfile on a virtual host basis. +CustomLog logs/ssl_request_log \ + "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" + +</VirtualHost> + diff --git a/roles/keyserver/handlers/main.yml b/roles/keyserver/handlers/main.yml new file mode 100644 index 0000000..eee9214 --- /dev/null +++ b/roles/keyserver/handlers/main.yml @@ -0,0 +1,6 @@ +- name: restart sks-db + action: service name=sks-db state=restarted + +- name: restart sks-recon + action: service name=sks-recon state=restarted + diff --git a/roles/keyserver/tasks/main.yml b/roles/keyserver/tasks/main.yml new file mode 100644 index 0000000..af7c672 --- /dev/null +++ b/roles/keyserver/tasks/main.yml @@ -0,0 +1,100 @@ +--- +- name: install sks + yum: name=sks state=installed + tags: + - packages + +- name: install mod_ssl + yum: name=mod_ssl state=installed + tags: + - packages + +- name: /srv/sks + file: > + path=/srv/sks + state=directory + owner=sks group=sks mode=0755 + +- name: /srv/sks/membership + copy: src="membership" dest=/srv/sks/membership owner=sks group=sks mode=0644 + tags: + - config + +- name: /srv/sks/sksconf + copy: src="sksconf" dest=/srv/sks/sksconf owner=sks group=sks mode=0644 + tags: + - config + +- name: /srv/sks/web + file: > + path=/srv/sks/web + state=directory + owner=sks group=sks mode=0755 + +- name: /srv/sks/web/index.html + copy: src="index.html" dest=/srv/sks/web/index.html owner=sks group=sks mode=0644 + tags: + - config + with_items: +- name: /srv/sks/web/css.css + copy: src="css.css" dest=/srv/sks/web/css.css owner=sks group=sks mode=0644 + tags: + - config + +- name: /etc/httpd/conf.d/sks.conf + copy: src="sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644 + tags: + - config + +- name: /etc/httpd/conf.d/ssl.conf + copy: src="ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644 + tags: + - config + +- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.cert + copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.cert" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.cert owner=root group=root mode=0600 + tags: + - config + +- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.key + copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.key" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.key owner=root group=root mode=0600 + tags: + - config + +- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert + copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.intermediate.cert" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert owner=root group=root mode=0600 + tags: + - config + +- name: /etc/pki/tls/keys_fedoraproject_org.crt.pem + copy: src="{{ puppet_private }}/keys_fedoraproject_org.crt.pem" dest=/etc/pki/tls/keys_fedoraproject_org.crt.pem owner=root group=root mode=0600 + tags: + - config + +- name: /etc/pki/tls/keys_fedoraproject_org.key + copy: src="{{ puppet_private }}/keys_fedoraproject_org.key" dest=/etc/pki/tls/keys_fedoraproject_org.key owner=root group=root mode=0600 + tags: + - config + +- cron: name="regenerate stats hourly" + hour="*" + minute="5" + job="killall -SIGUSR2 sks-db" + state=present + +- name: Set sks-db to run on boot + service: name=sks-db enabled=yes + ignore_errors: true + notify: + - restart sks-db + tags: + - service + +- name: Set sks-recon to run on boot + service: name=sks-recon enabled=yes + ignore_errors: true + notify: + - restart sks-recon + tags: + - service + diff --git a/tasks/keyserver.yml b/tasks/keyserver.yml deleted file mode 100644 index 9cf3e2c..0000000 --- a/tasks/keyserver.yml +++ /dev/null @@ -1,100 +0,0 @@ ---- -- name: install sks - yum: name=sks state=installed - tags: - - packages - -- name: install mod_ssl - yum: name=mod_ssl state=installed - tags: - - packages - -- name: /srv/sks - file: > - path=/srv/sks - state=directory - owner=sks group=sks mode=0755 - -- name: /srv/sks/membership - copy: src="{{ files }}/keyserver/membership" dest=/srv/sks/membership owner=sks group=sks mode=0644 - tags: - - config - -- name: /srv/sks/sksconf - copy: src="{{ files }}/keyserver/sksconf" dest=/srv/sks/sksconf owner=sks group=sks mode=0644 - tags: - - config - -- name: /srv/sks/web - file: > - path=/srv/sks/web - state=directory - owner=sks group=sks mode=0755 - -- name: /srv/sks/web/index.html - copy: src="{{ files }}/keyserver/index.html" dest=/srv/sks/web/index.html owner=sks group=sks mode=0644 - tags: - - config - -- name: /srv/sks/web/css.css - copy: src="{{ files }}/keyserver/css.css" dest=/srv/sks/web/css.css owner=sks group=sks mode=0644 - tags: - - config - -- name: /etc/httpd/conf.d/sks.conf - copy: src="{{ files }}/keyserver/sks.conf" dest=/etc/httpd/conf.d/sks.conf owner=root group=root mode=0644 - tags: - - config - -- name: /etc/httpd/conf.d/ssl.conf - copy: src="{{ files }}/keyserver/ssl.conf" dest=/etc/httpd/conf.d/ssl.conf owner=root group=root mode=0644 - tags: - - config - -- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.cert - copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.cert" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.cert owner=root group=root mode=0600 - tags: - - config - -- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.key - copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.key" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.key owner=root group=root mode=0600 - tags: - - config - -- name: /etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert - copy: src="{{ puppet_private }}/httpd/wildcard-2013.fedoraproject.org.intermediate.cert" dest=/etc/pki/tls/wildcard-2013.fedoraproject.org.intermediate.cert owner=root group=root mode=0600 - tags: - - config - -- name: /etc/pki/tls/keys_fedoraproject_org.crt.pem - copy: src="{{ puppet_private }}/keys_fedoraproject_org.crt.pem" dest=/etc/pki/tls/keys_fedoraproject_org.crt.pem owner=root group=root mode=0600 - tags: - - config - -- name: /etc/pki/tls/keys_fedoraproject_org.key - copy: src="{{ puppet_private }}/keys_fedoraproject_org.key" dest=/etc/pki/tls/keys_fedoraproject_org.key owner=root group=root mode=0600 - tags: - - config - -- cron: name="regenerate stats hourly" - hour="*" - minute="5" - job="killall -SIGUSR2 sks-db" - state=present - -- name: Set sks-db to run on boot - service: name=sks-db enabled=yes - ignore_errors: true - notify: - - restart sks-db - tags: - - service - -- name: Set sks-recon to run on boot - service: name=sks-recon enabled=yes - ignore_errors: true - notify: - - restart sks-recon - tags: - - service - -- 1.9.0

2 1

Plan for tomorrow's Fedora Infrastructure meeting (2014-04-24)
by Kevin Fenzi 24 Apr '14

24 Apr '14

The infrastructure team will be having it's weekly meeting tomorrow, 2014-04-24 at 18:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Upcoming Tasks/Items https://apps.fedoraproject.org/calendar/list/infrastructure/ #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

New fedmsg certs
by Miroslav Suchý 24 Apr '14

24 Apr '14

Today I was notified that #fedora-fedmsg say: [09:43] <fedmsg-bot> copr.build.end (invalid signature!) -- ... I had to re-run playbook because that it seem that fedmsg got new certs and revoked old. I still see at least: [09:56] <fedmsg-bot> buildsys.build.state.change (invalid signature!) -- karsten's libccp4-6.3.1-4.fc20 failed to build (ppc) http://ppc.koji.fedoraproject.org/koji/buildinfo?buildID=186452 [09:43] <fedmsg-bot> fedbadges.badge.award (invalid signature!) -- albertone has been awarded the "Paranoid Panda" badge https://badges.fedoraproject.org/user/albertone [09:44] <fedmsg-bot> fedbadges.person.rank.advance (invalid signature!) -- albertone moved to position 6003 on the badges leaderboard [09:46] <fedmsg-bot> bodhi.update.request.testing (invalid signature!) -- jgrulich submitted kde-plasma-networkmanagement-0.9.0.11-1.fc19 to testing https://admin.fedoraproject.org/updates/kde-plasma-networkmanagement-0.9.0.… [10:00] <fedmsg-bot> fedocal.meeting.reminder (invalid signature!) -- Friendly reminder! The "ROS/RPM IRC workshop" meeting from the "ambassadors" calendar starts in 11 hours https://apps.fedoraproject.org/calendar/meeting/365/ So at least those (and maybe others) need to redeploy fedmsg certs. -- Miroslav Suchy, RHCE, RHCDS Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys

4 3

Meeting Agenda Item: Introduction Kenneth McDowell
by Kenneth 23 Apr '14

23 Apr '14

Hello, My name is Kenny. I have been eyeing contributing to something open source for a long time. I have found after reading the wiki on how to contribute, I believe I would be able to best contribute to the Infrastructure group. I am currently in the US (UTC -5). I have been working on RHEL based servers in an enterprise environment since 2006, and I received my RHCE in 2010. Up until a few years ago I was on the Operations side doing break-fix work. I now work on the implementation side standing up servers and applications. My philosophy is this, if there is a problem was there a scriptable resolution? If so, script it. Have I been tasked with doing something that can be automated? If so, automate it. I have morphed into more of a DevOps type person in the past year or so. I am hoping I can help in maintaining any of the servers that support the Fedora team. In addition to system administration I do a lot of programming, both for work and hobbies. I tend to spend a lot of my time in Java and PHP. I have scripting experience with Bash and Perl to cover the basics. Python is definitely a weak link of mine, however I have not hesitated taking it up. Being a self-starter I have already done some basic things with it to get the general syntax and style down. So I basically want to be a behind the scenes nut and bolt guy. Making sure machines stay up or come back up when they have an issue. Helping making things smoother once settled in would be a top priority as well. My available time would be a roller coaster, but a minimum of 4-5 hours a week would not be an issue. I have been idle in IRC for at least 3-4 hours, and have only seen a SWAP alert come through. It just depends on the work schedule. For example tomorrow I will try to attend the weekly meeting, but I have a meeting at work that may run over not allowing me to make it. The best troubleshooting is proactive thinking! - Kenny --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

1 0

Meeting Agenda Item: Introduction - Bill Wood
by Bill Wood 22 Apr '14

22 Apr '14

Hello, everyone! I'm Bill Wood. Fedora has been a huge part of my life since the Core 1 release (and I've been using RHL since version 5.2 up until Fedora started up) and I want to devote my time while I'm not employed to helping out the project. My IRC handle is bwood09. You can already find me in the #fedora-admin channel; I've been lurking for a while. I've got roughly ten years of Linux administrative (user-end, not servers) experience, and five years in actual Windows and Linux systems administrator work (this is where the servers cam in). I've gotten to the point where I can usually design and implement an entire system in a day. I'm able to work with just about any program after a day or so of looking it over, and I can code in C++, Java, Python, BASH, and more. I'm also proficient in web technologies; I've recently learned HTML5 and CSS3. I do have my own mini-datacenter in my home office, and I've got it working a lot like AWS where I can provision/delete VMs in a very short amount of time. I am also a perfectionist. I'd like to learn more about what makes Fedora great. I've always had a great amount of respect for this project, and I want to help make it even better. I can help with a lot of the tickets I've seen on the infrastructure list (I'd love to help fix #1180), and I look forward to helping you guys for years to come.

1 0

Meeting Agenda Item: Introduction Claudio Penasio Jr.
by Claudio Penasio Junior 22 Apr '14

22 Apr '14

Hi all, I've would like to introduce myself, my name is Claudio Penasio Junior, and my personal page on Fedora is: https://fedoraproject.org/wiki/User:Penasio When i participated on Fedora meetings i use Freenode on xchat with following informations: IRC Nick: penasio Account System Name: penasio Since 2000 my activity areas was: I was Linux instructor and Linux Consultant between 2000 and 2003, this year I got my RHCE. After that I've worked as a Sysadmin with RedHat Linux and Debian GNU Linux until the end of 2010. After 2010 my main Activity is IT Support Manager with some Sysadmin jobs in IT Infrastructure. My main skills like Sisadmin is on Bind DNS, Apache httpd, LDAP Authentication, SAMBA, Mysql (MariaDB), Postgresql, SVN and Mantis BT end Shell Script and related Sysadmins activities. I know a little bit of C Language, Python and PHP. I would like to learn more about the newest Linux Clusters technologies and keep my Linux and Sysadmin knowledge alive in my mind. My main difficult will be at 18 UTC every Tuesday (3 pm São Paulo, Brasil), I'm on the office at this time, but i will try. So, that's all... I hope can help in Infrastructure Team -- Claudio Penasio Jr.

1 0

Meeting Agenda Item: Introduction Henderb Rodriguez
by Henderbj . 19 Apr '14

19 Apr '14

Hello, admins and members of Fedora Infraestructure Team. My name is Henderb Rodriguez, Electronics Engineer, 36 years old, from Venezuela. I like to join this team in order to collaborate on development, documentation, and translation to Spanish (my native language) of the great Fedora OS and webpages/wikis related to it. I have experience working on projects involving SQL programming, application GUI, web development, even some drivers since more than 15 years. Among my skills (obtained from paid jobs) are: C development. SQL development (Sybase). Object Oriented Programming (QNX AppBuilder). GUI to DB applications (at SIDOR, iron processing company) Shell script programming (I was teacher of a course about "HP-UX Basic Shell Scripting"). Datacenter Helpdesk Level 2 Unix/Linux Support (this was applied to "Movistar de Venezuela" through Huawei Technologies). Virtualization (primarily with Virtualbox) OS installation, configuration and administration (Windows, Linux, Unix). DNS management. Firewall configuration. I have worked on servers from various vendors and families, like HP Proliant and BladeSystem, Sun SPARC and Blade, and MSC-S Ericsson servers, running several Unix flavors, like HP-UX, Sun Solaris, RHEL, etc. I would like to learn new programming languages, new technologies on security, networking, and web development, improve on english technical writing and translation to spanish. This is the first time i try to get into an open source project and community, and i want to work with the community that creates the wonderfull Fedora OS, that i am using on my home workstations since Fedora 18. I have one multiseat workstation with two seats (for wife and kids), and another workstation for my personal use, they both using Fedora 20. I saw several tickets with easyfix mark, as the Ticket #3536 - "Add place for raw HTML content for fedorahosted project", that i could have work on it, but of course you maybe could suggest me another that could better fit with my experience. I think i can easy invest 6-10 hours/week to contribute to team assignments. I am trying now to make a name as freelancer on odesk on my spare time too. With best regards, Henderb Rodriguez Freenode IRC handle: henderbj

1 0

Plan for tomorrow's Fedora Infrastructure meeting (2014-04-17)
by Kevin Fenzi 17 Apr '14

17 Apr '14

The infrastructure team will be having it's weekly meeting tomorrow, 2014-04-17 at 18:00 UTC in #fedora-meeting on the freenode network. Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Upcoming Tasks/Items https://apps.fedoraproject.org/calendar/list/infrastructure/ * flock talks * fad(s) #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

Disabling unused languages in Ask Fedora
by Rahul Sundaram 13 Apr '14

13 Apr '14

Hi I was happy to support I18N in Ask Fedora but its been a while and some languages are just not used at all with zero postings in them. If this continues, I think it might be better to disable them again. Thoughts? Rahul

3 6

Vacation: Smoogen 2012-04-12 -> 2012-04-20
by Stephen John Smoogen 10 Apr '14

10 Apr '14

I will be taking a vacation next week and will be away from my desk/email/etc for most of the time. In case of emergency, please contact Kevin Fenzi or others in sysadmin-main and they should be able to either contact me or deal with the issue. Thanks :) -- Stephen J Smoogen.

1 0

Plan for tomorrow's Fedora Infrastructure meeting (2014-04-10)
by Stephen John Smoogen 10 Apr '14

10 Apr '14

The infrastructure team will be having it's weekly meeting tomorrow, 2014-04-10 at 18:00 UTC in #fedora-meeting on the freenode network. (We are moving back one hour due to the daylight saving time changes. Hope that works for everyone). Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Upcoming Tasks/Items https://apps.fedoraproject.org/calendar/list/infrastructure/ * flock talks * fad(s) #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks -- Stephen J Smoogen.

1 0

April status update for Fedora Infrastructure Apprentices
by Kevin Fenzi 09 Apr '14

09 Apr '14

Greetings. You are getting this email because you are in the 'fi-apprentice' group in the fedora account system (or are reading this on the infrastructure list). Feel free to reply just directly to me, or cc the infrastructure list for everyone to see and comment on. https://fedoraproject.org/wiki/Infrastructure_Apprentice At the first of every month(or so), I am going to be sending out an email like this one. I would like feedback on how things are going for you. I'd like to ask for everyone to send me a quick reply with the following data or anything related you can think of that might help us make the apprentice program more useful. 0. Whats your fedora account system login? 1. Have you logged in and used your fi-apprentice membership to look at our machines/setup in the last month? Do you plan to? 2. Has it helped you decide any area you wish to focus on or contribute to more? 3. Have you looked at or been able to work on any of the fi-apprentice 'easyfix' tickets? https://fedorahosted.org/fedora-infrastructure/report/14 4. Do you still wish to be a member of the group? If not (for whatever reason) could you provide any hints to help others down the road? 5. Is there any help or communication or ideas you have that would help you do any of the above? 6. What do you find to be the hardest part of getting involved? Finding things to work on? Getting attention from others to help you? Finding tickets in your interest area? 7. Have you been able to make any weekly irc meetings? Do you find them helpful or interesting? 8. Do you have any pets? Any other general feedback is also quite welcome, including improvements to this email, the wiki page, etc. Any folks I do not hear from in the next week will be removed from the group. (Note that it's easy to be readded when you have time or whatever and it's nothing at all personal, we just want to keep the group up to date with active folks). Thanks, and looking forward to your feedback! kevin

10 12

Meeting Agenda Item : Introduction Cydrobolt
by Chaoyi Zha 08 Apr '14

08 Apr '14

Hello, My name is Cydrobolt, and I would like to join the Fedora Infrastructure group. My real name is Chaoyi. My FAS account is "cydrobolt", which is also my IRC handle. I am familiar with PHP, JS, HTML, and Python. So far, most of my projects have been written in PHP, but I am trying to branch out a little and gain some more experience in Python. I would like to work on maintaining Fedora's websites and web services. I live in the United States, in the EST time zone. I would like to join mainly because I would like to gain more experience in Python, but also because I would like to help Fedora grow. The amount of time I will be able to contribute will vary - some weeks, I will be able to contribute 10 or 15 hours, while on other weeks, I might only be able to contribute 3 or 4. Regards, Cydrobolt

1 0

Plan for tomorrow's Fedora Infrastructure meeting (2014-04-03)
by Kevin Fenzi 03 Apr '14

03 Apr '14

The infrastructure team will be having it's weekly meeting tomorrow, 2014-04-03 at 18:00 UTC in #fedora-meeting on the freenode network. (We are moving back one hour due to the daylight saving time changes. Hope that works for everyone). Suggested topics: #topic New folks introductions and Apprentice tasks. If any new folks want to give a quick one line bio or any apprentices would like to ask general questions, they can do so in this part of the meeting. Don't be shy! #topic Applications status / discussion Check in on status of our applications: pkgdb, fas, bodhi, koji, community, voting, tagger, packager, dpsearch, etc. If there's new releases, bugs we need to work around or things to note. #topic Sysadmin status / discussion Here we talk about sysadmin related happenings from the previous week, or things that are upcoming. #topic Upcoming Tasks/Items https://apps.fedoraproject.org/calendar/list/infrastructure/ * flock talks * fad(s) #topic Open Floor Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure April 2014