This ip had hit release-monitoring.org like 5,000,000 times in the
course of a few hours and swamped it's web pod.
Lets block it for now and see if anyone complains.
If this is you: please add some rate limiting.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
Some folks were getting posts failing against forge.
See https://forge.fedoraproject.org/forge/forge/issues/401
So, lets just explicitly allow POSTs through anubis as
this should be fine for normal people and should not be something
that scrapers normally do.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
The /pub/alt/virtio-win directory had in it some 11 year old things.
One was a readme noting that it moved 11 years ago and nothing was
still here. The others were links to .
The scrapers, being as dumb as posts followed all those links over and
over again to the tune of millions per day.
I removed the links, but of course they were still trying, so
lets be a bit more aggressive and just 403 them all.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
selinux was preventing anubis from reading its policy file.
So, set the right context here so it is happy.
Note that we cannot use :Z in the podman call, because it runs as the
anubis user which cannot chcon those files on the host.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
Right now, podman on el9 isn't reading the policy correctly.
This is because the env for the unit isn't getting picked up
by podman, so instead pass --env-file to read it from a file.
Also, we want to setup a private key for the download servers
so they all have the same challenge creation (so if you hit 01
you want your challenge to be good on 02, etc).
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
These hosts are rhel10 now and removing nftables takes out the entire
libvirt stack as it doesn't support iptables anymore.
This results in base removing libvirt and the hypervisor role
re-installing it every playbook run. It also means the network doesn't
work on guests at all.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
The x86 ones are now in rdu3 and reinstalled with rhel10.
All the power9 ones are in rdu3 and reinstalled.
So, we should just enable nbde on all of them.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
releng moved things from pagure.io/releng to
forge.fedoraproject.org/releng/tooling
Adjust this cron to do likewise.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
