DuckCorp Projects: Issueshttps://projects.duckcorp.org/https://projects.duckcorp.org/favicon.ico?16699090422022-04-07T00:05:40ZDuckCorp Projects
Redmine DuckCorp Infrastructure - External #768 (Resolved): Perte du xco Oxymium/Nerim à PA3 le 14/04https://projects.duckcorp.org/issues/7682022-04-07T00:05:40ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>On Toushirou, the current link provided by Acontios will end in one week (2022-04-14).</p>
<p>According to the checks made by Acontios about the used bandwith, the Nerim link can be used instead of the current one.</p>
<p>A L2TP tunnel will be required in order to keep/use our current IP.</p>
The requirements:
<ol>
<li>✅ If any issue occurs during the migration, a physical access will be required
<ul>
<li>Pilou asked Chojin about it (Pilou will be available 2022-04-11 or 2022-04-13).</li>
</ul>
</li>
<li>✅ Duck: contact Acontios to provide the L2TP setup</li>
</ol>
The required tasks in order to update the configuration:
<ol>
<li>✅ ensure we are able to connect through the Nerim link</li>
<li>✅ remove any reference to the hivane network interface<br /><pre># rgrep -l eth-wan-hivane /etc/
/etc/network/interfaces.d/hivane-link
/etc/network/multihoming
/etc/default/grub
/etc/systemd/network/10_eth-wan-hivane.link
/etc/mp-admin/firewalling
/etc/sysctl.d/90-disable-accept_ra.conf</pre><br />Notes that the following services aren't listening on nerim IP:
<ul>
<li><code>slapd</code> (TCP ports 389 and 636)</li>
<li><code>apache2</code> (TCP ports 80 and 443)</li>
<li><code>proftpd</code> (TCP port 21)</li>
</ul>
</li>
<li>✅ stop the multihoming setup</li>
<li>✅ run the L2TP service</li>
<li>✅ start the multihoming setup</li>
</ol>
<p>✅ <code>poulet</code>: I have checked that SSH is listening on the IP provided by Nerim (<code>213.215.11.165</code>)</p> Bip - Enhancement #715 (New): Backlog one channel onlyhttps://projects.duckcorp.org/issues/7152020-12-17T09:34:26ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>The backlog command only allows to backlog all the channels from one network.</p>
<p>It would be nice to fetch backlog from one channel only.</p>
<p>From: Debian bug <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668420" class="external">#668420</a>.</p> DuckCorp Infrastructure - Review #712 (Resolved): Fix 'ipaddr' Jinja filter usage and avoid a forkhttps://projects.duckcorp.org/issues/7122020-08-28T10:34:19ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p><a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/duckcorp-infra.git;a=log;h=refs/heads/fix_ipaddr_usage" class="external"><code>fix_ipaddr_usage</code></a> branch from <code>duckcorp-infra</code> repository.</p>
<p>Use <code>address</code> parameter with hosts and <code>network</code> parameter with ranges.</p>
<p><code>ipaddr</code> Jinja filter behavior is quiet unexpected but a fork of this filter isn't required.</p>
<p>Tested with the following play and command:</p>
<pre><code>- hosts: all<br /> tasks:<br /> - debug:<br /> msg: "{{ item ~ ' : ' ~ (item|ipaddr('address') or item|ipaddr('network')) ~ '/' ~ item|ipaddr('netmask') }}" <br /> loop: '{{ firewalling.whitelist }}'</code></pre>
<pre><code>$ ansible-playbook -c local -l Elwing test.yaml</code></pre>
<p>The playbook output is the same with these ipaddr versions:</p>
<p>- the one committed<br />- <a href="https://github.com/ansible/ansible/blob/stable-2.9/lib/ansible/plugins/filter/ipaddr.py" class="external">ansible/ansible: branch stable-2.9</a><br />- <a href="https://github.com/ansible-collections/ansible.netcommon/blob/1.1.2/plugins/filter/ipaddr.py" title="<redpre#5></code> tag" class="external">ansible-collections/ansible.netcommon</a></p>
<p>Relates: <a class="issue tracker-1 status-3 priority-6 priority-high2 closed" title="Bug: restrict LDAP service accounts (Resolved)" href="https://projects.duckcorp.org/issues/646">#646</a></p> DuckCorp Infrastructure - Review #711 (Resolved): Allow to connect to services hosted on Orthos w...https://projects.duckcorp.org/issues/7112020-08-25T15:42:24ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p><a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/duckcorp-infra.git;a=log;h=refs/heads/allow_input_connections_from_hypervisor" class="external"><code>allow_input_connections_from_hypervisor</code></a> branch from <code>duckcorp-infra</code> repository.</p>
<p>Allow input connections from the hypervisor</p>
<p>While being at Conde, without this patch, I am not able to reach <code>sup.duckcorp.org</code>. Indeed the following packet is dropped:</p>
<p>On the hypervisor:</p>
<pre><code>IP 192.168.100.1.33874 > 192.168.100.2.443: Flags [S]</code></pre>
<p>where:</p>
<pre>
192.168.100.1: IP of the hypervisor on the bridge used with libvirt
192.168.100.2: Orthos
</pre>
<p>This patch has been applied already.</p> DuckCorp Infrastructure - Review #707 (Resolved): ansible-role-zabbix: ignore debian bugs #909750https://projects.duckcorp.org/issues/7072020-07-09T00:45:21ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/ansible-role-zabbix" class="external"><code>ansible-role-zabbix/ignore_debian_bugs_#909750</code></a></p>
<p>Ignore debian bugs #909750, workaround this issue:</p>
<pre>
Reading package lists...
Building dependency tree...
Reading state information...
The following additional packages will be installed:
fontconfig-config fonts-dejavu-core libfontconfig1 libgd3 libjbig0
libjpeg62-turbo libtiff5 libwebp6 libxpm4 php php-bcmath php-gd
php-ldap php-mbstring php-pgsql php-xml php7.3 php7.3-bcmath php7.3-gd
php7.3-ldap php7.3-mbstring php7.3-pgsql php7.3-xml
Suggested packages:
libgd-tools
The following NEW packages will be installed:
fontconfig-config fonts-dejavu-core libfontconfig1 libgd3 libjbig0
libjpeg62-turbo libtiff5 libwebp6 libxpm4 php php-bcmath php-gd
php-ldap php-mbstring php-pgsql php-xml php7.3 php7.3-bcmath php7.3-gd
php7.3-ldap php7.3-mbstring php7.3-pgsql php7.3-xml zabbix-frontend-php
0 upgraded, 24 newly installed, 0 to remove and 40 not upgraded.
[...]
serious bugs of libfontconfig1 (-> 2.13.1-2) <Forwarded>
b1 - #909750 - applications tries to write to /usr/* directories via
libfontconfig1
Summary:
libfontconfig1(1 bug)
libfontconfig1 pinned by adding Pin preferences in
/etc/apt/preferences.d/apt-listbugs. Restart APT session to enable
**********************************************************************
****** Exiting with an error in order to stop the installation. ******
**********************************************************************
</pre> DuckCorp Infrastructure - Review #706 (Resolved): ansible-role-httpd_php_fpm: dont_check_potentia...https://projects.duckcorp.org/issues/7062020-07-08T19:59:48ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/ansible-role-httpd_php_fpm" class="external"><code>ansible-role-httpd_php_fpm/dont_check_potentially_non_existent_path</code></a></p>
<p>Don't check existence of potentially nonexistent paths.</p>
<p>Some paths might be created later, for example: <code>/etc/zabbix/zabbix.conf.php</code>. This file can not be rendered before since owner is created in the following task.<br />Nonexistent path mentioned in <code>open_basedir</code> php configuration seems to be without any consequence.</p> DuckCorp Infrastructure - Review #705 (Rejected): ansible-role-httpd_php_fpm: create Unix group u...https://projects.duckcorp.org/issues/7052020-07-08T19:49:29ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/ansible-role-httpd_php_fpm" class="external"><code>ansible-role-httpd_php_fpm/create_unix_group_for_pool_workers</code></a></p>
<p>Create Unix group used for pool workers.</p>
<p>Fix this error:</p>
<pre>
TASK [zabbix : Generate Zabbix UI configuration]
task path: duckcorp-infra/ansible/roles/zabbix/tasks/webui.yml:30
fatal: [Orthos]: FAILED! => {
"changed": false,
"owner": "root",
"group": "root",
"mode": "0644",
"msg": "chgrp failed: failed to look up group php_sup.duckcorp.org",
"path": "/etc/zabbix/zabbix.conf.php",
"state": "file",
}
</pre> DuckCorp Infrastructure - Review #704 (Resolved): duckcorp-infra: move supervision serverhttps://projects.duckcorp.org/issues/7042020-07-08T03:04:18ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/duckcorp-infra.git" class="external"><code>duckcorp-infra/move_sup_server</code></a></p>
<p>Supervision server: use Orthos instead of Nicecity</p>
<p>Tested with check mode enabled only using the following command:<br /><pre>
ansible-playbook --check -vv --diff playbooks/dc.yml -l Orthos -e_pg_version=11 -ehttpd_version=2.4.38 -ephp_minor_version=7.3
</pre></p> DuckCorp Infrastructure - Review #703 (Resolved): dc-web: improve check mode supporthttps://projects.duckcorp.org/issues/7032020-07-08T02:52:52ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/duckcorp-infra.git" class="external"><code>duckcorp-infra/dc-web_check_mode</code></a></p>
Improve check mode support:
<ul>
<li>don't fail when <code>rsync</code> binary isn't installed</li>
<li>allow apache2_module to fail when check mode is enabled and apache2ctl isn't installed yet</li>
</ul> DuckCorp Infrastructure - Review #702 (Resolved): ansible-role-httpd_php_fpm: improve check mode ...https://projects.duckcorp.org/issues/7022020-07-07T09:36:07ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/ansible-role-httpd_php_fpm" class="external"><code>ansible-role-httpd_php_fpm/improve_check_mode_handling</code></a></p>
Improve check mode support:
<ul>
<li>check mode: handle <code>apache2_module</code> failure</li>
<li>don't check paths existence when check mode is enabled</li>
<li>Check mode: don't fail when <code>php</code> binary isn't installed</li>
</ul>
One unrelated change included:
<ul>
<li>Ensure <code>php_minor_version</code> var isn't empty</li>
</ul> DuckCorp Infrastructure - Review #701 (Resolved): ansible-role-zabbix: improve check mode supporthttps://projects.duckcorp.org/issues/7012020-07-01T16:44:58ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/ansible-role-zabbix" class="external"><code>ansible-role-zabbix/check_mode_support</code></a>.</p>
Improve check mode support:
<ul>
<li>when <code>psycopg/PostgreSQL</code> isn't installed yet</li>
<li>always execute <code>timedatectl</code> command</li>
</ul> DuckCorp Infrastructure - Review #700 (Resolved): ansible-role-zabbix: Use 'timedatectl show'https://projects.duckcorp.org/issues/7002020-07-01T16:39:30ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Repository/branch: <a href="https://vcs-git-viewer.duckcorp.org/?p=duckcorp/ansible-role-zabbix" class="external"><code>ansible-role-zabbix/timedatectl_show_is_available</code></a>.</p>
<p><code>timedatectl show</code> <a href="https://manpages.debian.org/buster/systemd/timedatectl.1.en.html" class="external">is now documented</a> and works well with Buster: use it.</p> DuckCorp Infrastructure - Review #687 (Resolved): encrypt ansible vault password (locally)https://projects.duckcorp.org/issues/6872020-03-10T15:53:45ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<ol>
<li><code>duckcorp/admin:encrypt_vault_password</code> branch: encrypt Ansible Vault password</li>
<li><code>duckcorp/duckcorp-infra:decrypt_vault_password</code> branch: decrypt Ansible Vault password when needed</li>
</ol> DuckCorp Infrastructure - Review #686 (Resolved): enable fstrimhttps://projects.duckcorp.org/issues/6862020-02-19T07:58:07ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<p>Enable fstrim when at least one SSD is installed</p> DuckCorp Infrastructure - Review #685 (Resolved): opendnssec isn't used anymorehttps://projects.duckcorp.org/issues/6852020-02-19T07:56:27ZPierre-Louis Bonicolipierre-louis.bonicoli@ir5.eu
<ul>
<li>purge opendnssec Debian package</li>
<li>update srv_dns_update_zone</li>
</ul>