infrastructure August 2009

infrastructure@lists.fedoraproject.org

52 participants
70 discussions

Meeting today
by Mike McGrath 20 Aug '09

20 Aug '09

Just a reminder there's a meeting today and we'll be discussing the alpha release just less then a week away! https://fedorahosted.org/fedora-infrastructure/report/9 -Mike

1 0

proxy1.stg and xen6
by Mike McGrath 20 Aug '09

20 Aug '09

I'm doing some work on proxy1.stg specifically with it's aliased IP 10.8.34.98 on xen6. Please don't touch them until I give the ok (troubleshooting network issues with a dedicated box) -Mike

1 0

[PATCH] Try an autodisablePuppet fix.
by Ricky Zhou 19 Aug '09

19 Aug '09

--- manifests/nodes/backup1.fedora.phx.redhat.com.pp | 2 +- .../nodes/proxy1.stg.fedora.phx.redhat.com.pp | 1 + .../nodes/sign-bridge1.fedora.phx.redhat.com.pp | 2 +- .../nodes/sign-vault1.fedora.phx.redhat.com.pp | 2 +- modules/puppet/manifests/init.pp | 10 ++++++++-- 5 files changed, 12 insertions(+), 5 deletions(-) diff --git a/manifests/nodes/backup1.fedora.phx.redhat.com.pp b/manifests/nodes/backup1.fedora.phx.redhat.com.pp index 7f1a1d9..0dbf6bc 100644 --- a/manifests/nodes/backup1.fedora.phx.redhat.com.pp +++ b/manifests/nodes/backup1.fedora.phx.redhat.com.pp @@ -1,5 +1,5 @@ node backup1{ - $autodisablePuppet = 1 + $autodisablePuppet = true include phx # include global include openvpn::client diff --git a/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp b/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp index f9a1289..2c303fe 100644 --- a/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp +++ b/manifests/nodes/proxy1.stg.fedora.phx.redhat.com.pp @@ -1,4 +1,5 @@ node 'proxy1.stg.fedora.phx.redhat.com' { + $autodisablePuppet = true $puppetEnvironment='staging' include phx include proxy diff --git a/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp b/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp index d710016..4147862 100644 --- a/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp +++ b/manifests/nodes/sign-bridge1.fedora.phx.redhat.com.pp @@ -1,5 +1,5 @@ node "sign-bridge1.fedora.phx.redhat.com" { - $autodisablePuppet = 1 + $autodisablePuppet = true $fas_groups = [ 'sysadmin-main', 'sysadmin-releng' ] include phx include fas::client diff --git a/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp b/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp index 1b5641d..a1e0ab0 100644 --- a/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp +++ b/manifests/nodes/sign-vault1.fedora.phx.redhat.com.pp @@ -1,5 +1,5 @@ node "sign-vault1" { - $autodisablePuppet = 1 + $autodisablePuppet = true $fas_groups = [ 'sysadmin-main', 'sysadmin-releng' ] include phx include fas::client diff --git a/modules/puppet/manifests/init.pp b/modules/puppet/manifests/init.pp index 54ca3e3..686de0a 100644 --- a/modules/puppet/manifests/init.pp +++ b/modules/puppet/manifests/init.pp @@ -18,8 +18,14 @@ class puppet::client { } service { "puppet": - ensure => running, - enable => true, + ensure => $autodisablePuppet ? { + true => undef, + default => running, + }, + enable => $autodisablePuppet ? { + true => false, + default => true, + }, require => Package["puppet"], } -- 1.5.5.6

1 1

[Change Request] Update xz on the builders
by Toshio Kuratomi 19 Aug '09

19 Aug '09

A data corruption bug was found in the current xz package for certain files. The xz package was updated to a snapshot in Fedora and EPEL. We'd like to update the builders with the new xz to make sure we aren't producing packages with corrupted payloads. The corruption bug report is here: https://bugzilla.redhat.com/show_bug.cgi?id=517806 which includes confirmation that it fixes the bug and jnovy's recommendation to update the buildsystem. The EPEL-5 update is here: https://admin.fedoraproject.org/updates/xz-4.999.8-0.10.beta.20090817git.el5 Can I get two +1's for this? -Toshio

4 5

Seeking comments on my proposal
by Steven M. Parrish 19 Aug '09

19 Aug '09

Got the outline of my proposal here https://fedoraproject.org/wiki/SugarZilla I welcome any comments Steven -- ===================================================== Steven M. Parrish ------------------------------------------------------------------------------------------------- gpg fingerprint: 4B6C 8357 059E B7ED 8095 0FD6 1F4B EDA0 A9A6 13C0 http://tuxbrewr.fedorapeople.org/ irc.freenode.net: SMParrish @ #fedora-kde, #fedora-devel, #fedora-olpc, #sugar

3 5

[Change Request] Set replace => false on some db files which I missed.
by Ricky Zhou 19 Aug '09

19 Aug '09

I missed a few files in my earlier change request. --- modules/sigul/manifests/init.pp | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules/sigul/manifests/init.pp b/modules/sigul/manifests/init.pp index 20a88bd..f613182 100644 --- a/modules/sigul/manifests/init.pp +++ b/modules/sigul/manifests/init.pp @@ -88,6 +88,7 @@ class sigul::server inherits sigul { group => "sigul", mode => 0600, source => "puppet:///config/secure/sigul_server_cert8.db", + replace => false, require => Package["sigul"], } @@ -96,6 +97,7 @@ class sigul::server inherits sigul { group => "sigul", mode => 0600, source => "puppet:///config/secure/sigul_server_key3.db", + replace => false, require => Package["sigul"], } @@ -104,6 +106,7 @@ class sigul::server inherits sigul { group => "sigul", mode => 0600, source => "puppet:///config/secure/sigul_server_secmod.db", + replace => false, require => Package["sigul"], } -- 1.5.5.6

3 2

[Change Request]
by Dennis Gilmore 19 Aug '09

19 Aug '09

id like to make the following changes impact will be minimal /buildgroups is the only active service on buildsys.pfp.o where plague used to run. its only needed for mock building using epel targets so the increaded load will be insignificant. the change will be trasnparent to end users. the content is in place on /mnt/koji so its available to either hub. as well as kojipkgs i think it makes more sense to have buildsys be a cname to koji.fp.o rather than kojipkgs.fp.o diff --git a/configs/web/applications/kojiweb.conf.erb b/configs/web/applications/kojiweb.conf.erb index f6b35d4..cf4a868 100644 --- a/configs/web/applications/kojiweb.conf.erb +++ b/configs/web/applications/kojiweb.conf.erb @@ -88,4 +88,11 @@ Alias /static-repos "/mnt/koji/static-repos/" Options Indexes FollowSymLinks </Directory> +Alias /buildgroups "/mnt/koji/buildgroups/" + +<Directory "/mnt/koji/buildgroups/"> + Options Indexes FollowSymLinks +</Directory> + + RewriteRule ^/packages(.+) http://kojipkgs.fedoraproject.org/packages$1 [R=301,L] diff --git a/modules/bind/files/master/fedoraproject.org b/modules/bind/files/master/fedoraproject.org index 4b30336..93bc55b 100644 --- a/modules/bind/files/master/fedoraproject.org +++ b/modules/bind/files/master/fedoraproject.org @@ -1,6 +1,6 @@ $TTL 3600 @ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( - 2009081201 ; Serial + 2009081901 ; Serial 8H ; refresh 2H ; retry 4W ; expire @@ -74,7 +74,7 @@ bodhi IN CNAME admin bu1 IN A 128.197.185.45 bugz IN CNAME wildcard bugz.stg IN CNAME admin.stg.fedoraproject.org. -buildsys IN CNAME serverbeach1.fedoraproject.org. +buildsys IN CNAME koji.fedoraproject.org. bzr IN CNAME git certmaster IN CNAME puppet capp1 IN A 172.17.255.29

4 4

Recent change freeze exception - MXs for our domains
by Ricky Zhou 19 Aug '09

19 Aug '09

Hey, we had a @fedoraproject.org mail outage today because Red Hat's MXs changed IPs. Previously, we had our MXs set to mx[123].fedoraproject.org, which pointed to the IPs of the MXes. With the last change, we switched to setting the MXs directly to mx[12].redhat.com, which should always point ot the right place. Additionally, the change also reenables tummy, telia, and ibiblio, which we took out for the mass reboot. Stephen and Mike +1ed these changes on IRC while we were working on it. Thanks, Ricky

1 0

[PATCH] Adding mod_limitipconn
by Mike McGrath 19 Aug '09

19 Aug '09

This will allow us for greater control against abusive clients. Starting on secondary1 for now which seems to be the biggest problem. --- manifests/servergroups/secondary.pp | 1 + modules/mod_limitipconn/README | 10 ++++++++++ modules/mod_limitipconn/files/limitipconn.conf | 18 ++++++++++++++++++ modules/mod_limitipconn/manifests/init.pp | 12 ++++++++++++ 4 files changed, 41 insertions(+), 0 deletions(-) create mode 100644 modules/mod_limitipconn/README create mode 100644 modules/mod_limitipconn/files/limitipconn.conf create mode 100644 modules/mod_limitipconn/manifests/init.pp diff --git a/manifests/servergroups/secondary.pp b/manifests/servergroups/secondary.pp index b53cff9..d5d96e5 100644 --- a/manifests/servergroups/secondary.pp +++ b/manifests/servergroups/secondary.pp @@ -3,6 +3,7 @@ class secondaryMirror { include mirrorsize-secondary include httpd::proxy + include mod_limitipconn::mod_limitipconn httpd::certificate { "wildcard.fedoraproject.org": } diff --git a/modules/mod_limitipconn/README b/modules/mod_limitipconn/README new file mode 100644 index 0000000..70a5550 --- /dev/null +++ b/modules/mod_limitipconn/README @@ -0,0 +1,10 @@ +===================== +mod_limitipconn +===================== + +----------- +Usage +----------- + +Apache module which allows web server administrators to limit the number of +simultaneous downloads permitted from a single IP address. diff --git a/modules/mod_limitipconn/files/limitipconn.conf b/modules/mod_limitipconn/files/limitipconn.conf new file mode 100644 index 0000000..fb33733 --- /dev/null +++ b/modules/mod_limitipconn/files/limitipconn.conf @@ -0,0 +1,18 @@ +# This module will not function unless mod_status is loaded and the +# "ExtendedStatus On" directive is set. So load only if mod_status is too. +<IfModule mod_status.c> + + # This is always needed + ExtendedStatus On + + # mod_limitipconn configuration + LoadModule limitipconn_module modules/mod_limitipconn.so + + # A global default configuration doesn't make much sense. See the README + # from the mod_limitipconn package for configuration examples. + + MaxConnPerIP 3 + OnlyIPLimit application/octet-stream + +</IfModule> + diff --git a/modules/mod_limitipconn/manifests/init.pp b/modules/mod_limitipconn/manifests/init.pp new file mode 100644 index 0000000..b643d9a --- /dev/null +++ b/modules/mod_limitipconn/manifests/init.pp @@ -0,0 +1,12 @@ + +class mod_limitipconn::mod_limitipconn { + package { mod_limitipconn: + ensure => present + } + + file { '/etc/httpd/conf.d/limitipconn.conf': + source => 'puppet:///mod_limitipconn/limitipconn.conf', + require => Package['httpd'], + notify => Service['httpd'] + } +} -- 1.6.2.5

3 3

[Change Request] Don't replace sigul db files.
by Ricky Zhou 19 Aug '09

19 Aug '09

--- modules/sigul/manifests/init.pp | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules/sigul/manifests/init.pp b/modules/sigul/manifests/init.pp index d2b6dc9..20a88bd 100644 --- a/modules/sigul/manifests/init.pp +++ b/modules/sigul/manifests/init.pp @@ -41,6 +41,7 @@ class sigul::bridge inherits sigul { group => "sigul", mode => 0600, source => "puppet:///config/secure/sigul_bridge_cert8.db", + replace => false, require => Package["sigul"], } @@ -49,6 +50,7 @@ class sigul::bridge inherits sigul { group => "sigul", mode => 0600, source => "puppet:///config/secure/sigul_bridge_key3.db", + replace => false, require => Package["sigul"], } @@ -57,6 +59,7 @@ class sigul::bridge inherits sigul { group => "sigul", mode => 0600, source => "puppet:///config/secure/sigul_bridge_secmod.db", + replace => false, require => Package["sigul"], } -- 1.5.5.6

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure August 2009