Merge branch 'openvpn_handler' of /git/ansible into openvpn_handler

Add nagios to trusted openid roots
2026-03-21 20:41:35 +08:00 · 2014-08-02 15:00:10 +00:00 · 2014-08-02 15:00:06 +00:00
3252 changed files with 15898 additions and 166013 deletions
--- a/233
+++ b/233
@@ -15,26 +15,11 @@ library - library of custom local ansible modules

 playbooks - collections of plays we want to run on systems

-  groups: groups of hosts configured from one playbook.
-  
-  hosts: playbooks for single hosts. 
-
-  manual: playbooks that are only run manually by an admin as needed.
-
 tasks - snippets of tasks that should be included in plays

 roles - specific roles to be use in playbooks. 
        Each role has it's own files/templates/vars

-filter_plugins - Jinja filters
-
-master.yml - This is the master playbook, consisting of all 
-             current group and host playbooks. Note that the 
-             daily cron doesn't run this, it runs even over
-             playbooks that are not yet included in master. 
-             This playbook is usefull for making changes over 
-             multiple groups/hosts usually with -t (tag). 
-
 == Paths ==

 public path for everything is:
@@ -49,22 +34,212 @@ In general to run any ansible playbook you will want to run:

 sudo -i ansible-playbook /path/to/playbook.yml

-== Scheduled check-diff ==
+== Cloud information ==

-Every night a cron job runs over all playbooks under playbooks/{groups}{hosts}
-with the ansible --check --diff options. A report from this is sent to 
-sysadmin-logs. In the ideal state this report would be empty. 
+cloud instances:
+to startup a new cloud instance and configure for basic server use run (as
+root):

-== Idempotency ==
+el6:
+sudo -i ansible-playbook /srv/web/infra/ansible/playbooks/el6_temp_instance.yml

-All playbooks should be idempotent. Ie, if run once they should bring the 
-machine(s) to the desired state, and if run again N times after that they should
-make 0 changes (because the machine(s) are in the desired state). 
-Please make sure your playbooks are idempotent. 
+f19:
+sudo -i ansible-playbook /srv/web/infra/ansible/playbooks/f19_temp_instance.yml

-== Can be run anytime ==

-When a playbook or change is checked into ansible you should assume 
-that it could be run at ANY TIME. Always make sure the checked in state
-is the desired state. Always test changes when they land so they don't 
-surprise you later. 
+The -i is important - ansible's tools need access to root's sshagent as well
+as the cloud credentials to run the above playbooks successfully.
+
+This will setup a new instance, provision it and email sysadmin-main that
+the instance was created, it's instance id (for terminating it, attaching
+volumes, etc) and it's ip address.
+
+You will then be able to login, as root.
+
+You can add various extra vars to the above commands to change the instance
+you've just spun up.
+
+variables to define:
+instance_type=c1.medium
+security_group=default
+root_auth_users='username1 username2 @groupname'
+hostbase=basename for hostname - will have instance id appended to it
+
+
+define these with:
+
+--extra-vars="varname=value varname1=value varname2=value"
+
+Name        Memory_MB  Disk   VCPUs
+m1.tiny     512        0      1    
+m1.small    2048       20     1    
+m1.medium   4096       40     2    
+m1.large    8192       80     4    
+m1.xlarge   16384      160    8    
+m1.builder  5120       50     3    
+
+Setting up a new persistent cloud host:
+1. select an ip:
+   source /srv/private/ansible/files/openstack/persistent-admin/ec2rc.sh
+   euca-describe-addresses
+  - pick an ip from the list that is not assigned anywhere
+  - add it into dns - normally in the cloud.fedoraproject.org but it doesn't
+    have to be
+
+2. If needed create a persistent storage disk for the instance:
+   source /srv/private/ansible/files/openstack/persistent-admin/ec2rc.sh
+   euca-create-volume -z nova -s <size in gigabytes>
+
+
+3. set up the host/ip in ansible host inventory
+   - add to ansible/inventory/inventory under [persistent-cloud]
+     - either the ip itself or the hostname you want to refer to it as
+
+4. setup the host_vars
+   - create file named by the hostname or ip you used in the inventory
+   - for adding persistent volumes add an entry like this into the host_vars file
+
+   volumes: ['-d /dev/vdb vol-BCA33FCD', '-d /dev/vdc vol-DC833F48']
+
+   for each volume you want to attach to the instance.
+
+   The device names matter - they start at /dev/vdb and increment. However,
+   they are not reliable IN the instance. You should find the device, partition
+   it, format it and label the formatted device then mount the device by label
+   or  by UUID. Do not count on the device name being the same each time.
+
+
+Contents should look like this (remove all the comments)
+
+---
+# 2cpus, 3GB of ram 20GB of ephemeral space
+instance_type: m1.large 
+# image id
+image: emi-B8793915 
+keypair: fedora-admin
+# what security group to add the host to
+security_group: webserver 
+zone: fedoracloud 
+# instance id will be appended
+hostbase: hostname_base- 
+# ip should be in the 209.132.184.XXX range
+public_ip: $ip_you_selected
+# users/groups who should have root ssh access
+root_auth_users:  skvidal bkabrda 
+description: some description so someone else can know what this is
+
+The available images can be found by running::
+   source /srv/private/ansible/files/openstack/persistent-admin/ec2rc.sh
+   euca-describe-images | grep ami
+
+4. setup a host playbook ansible/playbooks/hosts/$YOUR_HOSTNAME_HERE.yml
+   Note: the name of this file doesn't really matter but it should normally
+         be the hostname of the host you're setting up. 
+
+- name: check/create instance
+  hosts: $YOUR_HOSTNAME/IP HERE
+  user: root
+  gather_facts: False
+
+  vars_files:
+   - /srv/web/infra/ansible/vars/global.yml
+   - "{{ private }}/vars.yml"
+
+  tasks:
+  - include: "{{ tasks }}/persistent_cloud.yml"
+
+- name: provision instance
+  hosts: $YOUR_HOSTNAME/IP HERE
+  user: root
+  gather_facts: True
+
+  vars_files:
+   - /srv/web/infra/ansible/vars/global.yml
+   - "{{ private }}/vars.yml"
+   - /srv/web/infra/ansible/vars//{{ ansible_distribution }}.yml
+
+  tasks:
+  - include: "{{ tasks }}/cloud_setup_basic.yml
+  # fill in other actions/includes/etc here
+
+  handlers:
+  - include: "{{ handlers }}/restart_services.yml
+
+
+5. add/commit the above to the git repo and push your changes
+
+
+6. set it up:
+   sudo -i ansible-playbook /srv/web/infra/ansible/playbooks/hosts/$YOUR_HOSTNAME_HERE.yml
+
+7. login, etc
+
+You should be able to run that playbook over and over again safely, it will
+only setup/create a new instance if the ip is not up/responding.
+
+SECURITY GROUPS
+- to edit security groups you must either have your own cloud account or
+  be a member of sysadmin-main
+
+This gives you the credential to change things in the persistent tenant
+- source /srv/private/ansible/files/openstack/persistent-admin/ec2rc.sh
+
+
+This lists all security groups in that tenant:
+- euca-describe-groups | grep GROUP
+
+the output will look like this:
+euca-describe-groups  | grep GROU
+GROUP	d4e664a10e2c4210839150be09c46e5e	default	default
+GROUP	d4e664a10e2c4210839150be09c46e5e	jenkins	jenkins instance group
+GROUP	d4e664a10e2c4210839150be09c46e5e	logstash	logstash security group
+GROUP	d4e664a10e2c4210839150be09c46e5e	smtpserver	list server group. needs web and smtp
+GROUP	d4e664a10e2c4210839150be09c46e5e	webserver	webserver security group
+GROUP	d4e664a10e2c4210839150be09c46e5e	wideopen	wideopen
+
+
+This lets you list the rules in a specific group:
+- euca-describe-group groupname
+
+the output will look like this:
+
+euca-describe-group wideopen
+GROUP	d4e664a10e2c4210839150be09c46e5e	wideopen	wideopen
+PERMISSION	d4e664a10e2c4210839150be09c46e5e	wideopen ALLOWS	tcp	1	65535	FROM	CIDR	0.0.0.0/0
+PERMISSION	d4e664a10e2c4210839150be09c46e5e	wideopen ALLOWS	icmp	-1	-1	FROM	CIDR	0.0.0.0/0
+
+
+To create a new group:
+euca-create-group -d "group description here" groupname
+
+To add a rule to a group:
+euca-authorize -P tcp -p 22 groupname
+euca-authorize -P icmp -t -1:-1 groupname
+
+To delete a rule from a group:
+euca-revoke -P tcp -p 22 groupname
+
+Notes:
+- Be careful removing or adding rules to existing groups b/c you could be
+impacting other instances using that security group.
+
+- You will almost always want to allow 22/tcp (sshd) and icmp -1 -1 (ping
+and traceroute and friends). 
+
+
+
+
+TERMINATING INSTANCES
+
+For transient:
+1. source /srv/private/ansible/files/openstack/transient-admin/ec2rc.sh
+
+  - OR -
+
+For persistent:
+1. source /srv/private/ansible/files/openstack/persistent-admin/ec2rc.sh
+
+2. euca-describe-instances | grep <ip of your instance>
+
+3. euca-terminate-instances <the id, something like i-00000295>
+
--- a/README.cloud
+++ b/README.cloud
@@ -1,181 +0,0 @@
-== Cloud information ==
-
-The dashboard for the production cloud instance is: 
-https://fedorainfracloud.org/dashboard/
-
-You can download credentials via the dashboard (under security and access)
-
-=== Transient instances ===
-
-Transient instances are short term use instances for Fedora 
-contributors. They can be terminated at any time and shouldn't be
-relied on for any production use.  If you have an application 
-or longer term item that should always be around
-please create a persistent playbook instead. (see below)
-
-to startup a new transient cloud instance and configure for basic 
-server use run (as root):
-
-sudo -i ansible-playbook /srv/web/infra/ansible/playbooks/transient_cloud_instance.yml -e 'name=somename'
-
-The -i is important - ansible's tools need access to root's sshagent as well
-as the cloud credentials to run the above playbooks successfully.
-
-This will setup a new instance, provision it and email sysadmin-main that
-the instance was created and it's ip address.
-
-You will then be able to login, as root if you are in the sysadmin-main group.
-(If you are making the instance for another user, see below)
-
-You MUST pass a name to it, ie: -e 'name=somethingdescriptive'
-You can optionally override defaults by passing any of the following: 
-image=imagename (default is centos70_x86_64)
-instance_type=some instance type (default is m1.small)
-root_auth_users='user1 user2 user3 @group1' (default always includes sysadmin-main group)
-
-Note: if you run this playbook with the same name= multiple times
-openstack is smart enough to just return the current ip of that instance
-and go on. This way you can re-run if you want to reconfigure it without
-reprovisioning it.
-
-
-Sizes options
-------------
-
-Name        Memory_MB  Disk   VCPUs
-m1.tiny     512        0      1
-m1.small    2048       20     1
-m1.medium   4096       40     2
-m1.large    8192       80     4
-m1.xlarge   16384      160    8
-m1.builder  5120       50     3
-
-
-=== Persistent cloud instances ===
-
-Persistent cloud instances are ones that we want to always have up and 
-configured. These are things like dev instances for various applications, 
-proof of concept servers for evaluating something, etc. They will be 
-reprovisioned after a reboot/maint window for the cloud. 
-
-Setting up a new persistent cloud host:
-
-1) Select an available floating IP
-
-    source /srv/private/ansible/files/openstack/novarc
-    nova floating-ip-list
-
-Note that an "available floating IP" is one that has only a "-" in the Fixed IP
-column of the above `nova` command. Ignore the fact that the "Server Id" column 
-is completely blank for all instances. If there are no ip's with -, use: 
-
-    nova floating-ip-create
-
-and retry the list. 
-
-2) Add that IP addr to dns (typically as foo.fedorainfracloud.org)
-
-3) Create persistent storage disk for the instance (if necessary.. you might not
-   need this).
-
-    nova volume-create --display-name SOME_NAME SIZE_IN_GB
-
-4) Add to ansible inventory in the persistent-cloud group.
-   You should use the FQDN for this and not the IP.  Names are good.
-
-5) setup the host_vars file.  It should looks something like this::
-
-        instance_type: m1.medium
-        image: 
-        keypair: fedora-admin-20130801
-        security_group: default  # NOTE: security_group MUST contain default.
-        zone: nova
-        tcp_ports: [22, 80, 443]
-
-        inventory_tenant: persistent
-        inventory_instance_name: taiga
-        hostbase: taiga
-        public_ip: 209.132.184.50
-        root_auth_users:  ralph maxamillion
-        description: taiga frontend server
-
-        volumes:
-          - volume_id: VOLUME_UUID_GOES_HERE
-            device: /dev/vdc
-
-        cloud_networks:
-          # persistent-net
-          - net-id: "67b77354-39a4-43de-b007-bb813ac5c35f"
-
-6) setup the host playbook
-
-7) run the playbook:
-   sudo -i ansible-playbook /srv/web/infra/ansible/playbooks/hosts/$YOUR_HOSTNAME_HERE.yml
-
-You should be able to run that playbook over and over again safely, it will
-only setup/create a new instance if the ip is not up/responding.
-
-=== SECURITY GROUPS ===
-
-FIXME: needs work for new cloud. 
-
- to edit security groups you must either have your own cloud account or
-  be a member of sysadmin-main
-
-This gives you the credential to change things in the persistent tenant
- source /srv/private/ansible/files/openstack/persistent-admin/ec2rc.sh
-
-This lists all security groups in that tenant:
- euca-describe-groups | grep GROUP
-
-the output will look like this:
-euca-describe-groups  | grep GROU
-GROUP	d4e664a10e2c4210839150be09c46e5e	default	default
-GROUP	d4e664a10e2c4210839150be09c46e5e	jenkins	jenkins instance group
-GROUP	d4e664a10e2c4210839150be09c46e5e	logstash	logstash security group
-GROUP	d4e664a10e2c4210839150be09c46e5e	smtpserver	list server group. needs web and smtp
-GROUP	d4e664a10e2c4210839150be09c46e5e	webserver	webserver security group
-GROUP	d4e664a10e2c4210839150be09c46e5e	wideopen	wideopen
-
-
-This lets you list the rules in a specific group:
- euca-describe-group groupname
-
-the output will look like this:
-
-euca-describe-group wideopen
-GROUP	d4e664a10e2c4210839150be09c46e5e	wideopen	wideopen
-PERMISSION	d4e664a10e2c4210839150be09c46e5e	wideopen ALLOWS	tcp	1	65535	FROM	CIDR	0.0.0.0/0
-PERMISSION	d4e664a10e2c4210839150be09c46e5e	wideopen ALLOWS	icmp	-1	-1	FROM	CIDR	0.0.0.0/0
-
-
-To create a new group:
-euca-create-group -d "group description here" groupname
-
-To add a rule to a group:
-euca-authorize -P tcp -p 22 groupname
-euca-authorize -P icmp -t -1:-1 groupname
-
-To delete a rule from a group:
-euca-revoke -P tcp -p 22 groupname
-
-Notes:
- Be careful removing or adding rules to existing groups b/c you could be
-impacting other instances using that security group.
-
- You will almost always want to allow 22/tcp (sshd) and icmp -1 -1 (ping
-and traceroute and friends).
-
-=== TERMINATING INSTANCES === 
-
-For transient:
-1. source /srv/private/ansible/files/openstack/transient-admin/keystonerc.sh
-
-  - OR -
-
-For persistent:
-1. source /srv/private/ansible/files/openstack/novarc
-
-2. nova list | grep <ip of your instance or name of your instance>
-
-3. nova delete <name of instance or ID of instance>
--- a/callback_plugins/logdetail.py
+++ b/callback_plugins/logdetail.py
@@ -138,13 +138,7 @@ class LogMech(object):
        elif self.play_info.get('check', False):    
            category = 'CHECK:' + category

-        # Sometimes this is None.. othertimes it's fine.  Othertimes it has
-        # trailing whitespace that kills logview.  Strip that, when possible.
-        if name:
-            name = name.strip()
-
-        sanitize_host = host.replace(' ', '_').replace('>', '-')
-        fd = open(self.logpath_play + '/' + sanitize_host + '.log', 'a')
+        fd = open(self.logpath_play + '/' + host + '.log', 'a')
        now = time.strftime(TIME_FORMAT, time.localtime())
        fd.write(MSG_FORMAT % dict(now=now, name=name, count=count, category=category, data=json.dumps(data)))
        fd.close()
--- a/files/2fa/pam_url.conf.cloud
+++ b/files/2fa/pam_url.conf.cloud
@@ -1,21 +0,0 @@
-pam_url:
-{
-	settings:
-	{
-		url = "https://fas-all.phx2.fedoraproject.org:8443/";	# URI to fetch
-		returncode = "OK";				# The remote script/cgi should return a 200 http code and this string as its only results
-		userfield = "user";				# userfield name to send
-		passwdfield = "token";				# passwdfield name to send
-		extradata = "&do=login";			# extradata to send
-		prompt = "Password+Token: ";			# password prompt
-	};
-
-	ssl:
-	{
-		verify_peer = true;				# Should we verify SSL ?
-		verify_host = true;				# Should we verify the CN in the SSL cert?
-		client_cert = "/etc/pki/tls/private/totpcgi.pem"; # file to use as client-side certificate
-		client_key  = "/etc/pki/tls/private/totpcgi.pem"; # file to use as client-side key (can be same file as above if a single cert)
-                ca_cert     = "/etc/pki/tls/private/totpcgi-ca.cert";
-	};
-};
--- a/files/2fa/pam_url.conf.fed-cloud09.cloud.fedoraproject.org
+++ b/files/2fa/pam_url.conf.fed-cloud09.cloud.fedoraproject.org
@@ -1,21 +0,0 @@
-pam_url:
-{
-	settings:
-	{
-		url = "https://fas-all.phx2.fedoraproject.org:8443/";	# URI to fetch
-		returncode = "OK";				# The remote script/cgi should return a 200 http code and this string as its only results
-		userfield = "user";				# userfield name to send
-		passwdfield = "token";				# passwdfield name to send
-		extradata = "&do=login";			# extradata to send
-		prompt = "Password+Token: ";			# password prompt
-	};
-
-	ssl:
-	{
-		verify_peer = true;				# Should we verify SSL ?
-		verify_host = true;				# Should we verify the CN in the SSL cert?
-		client_cert = "/etc/pki/tls/private/totpcgi.pem"; # file to use as client-side certificate
-		client_key  = "/etc/pki/tls/private/totpcgi.pem"; # file to use as client-side key (can be same file as above if a single cert)
-                ca_cert     = "/etc/pki/tls/private/totpcgi-ca.cert";
-	};
-};
--- a/files/artboard/artboard.conf
+++ b/files/artboard/artboard.conf
@@ -3,14 +3,7 @@

    AllowOverride All

-    <IfModule mod_authz_core.c>
-        # Apache 2.4
-        Require all granted
-    </IfModule>
-    <IfModule !mod_authz_core.c>
-        # Apache 2.2
-        Order deny,allow
-        Allow from all
-    </IfModule>
+    Order allow,deny
+    Allow from all

 </Directory>
--- a/files/common/epel7.repo
+++ b/files/common/epel7.repo
@@ -1,7 +1,7 @@
 [epel]
 name=Extras Packages for Enterprise Linux $releasever - $basearch
 baseurl=http://infrastructure.fedoraproject.org/pub/epel/7/$basearch/
-enabled=1
+enabled=0
 gpgcheck=1
 gpgkey=http://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7

@@ -15,6 +15,6 @@ gpgkey=http://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
 [epel-beta]
 name=Extras Packages for Enterprise Linux beta $releasever - $basearch
 baseurl=http://infrastructure.fedoraproject.org/pub/epel/beta/7/$basearch/
-enabled=0
+enabled=1
 gpgcheck=1
 gpgkey=http://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
--- a/files/common/fedora-updates-testing.repo-secondary
+++ b/files/common/fedora-updates-testing.repo-secondary
@@ -1,26 +1,26 @@
 [updates-testing]
 name=Fedora $releasever - $basearch - Test Updates
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/$basearch/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/$basearch/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
 enabled=0
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch

 [updates-testing-debuginfo]
 name=Fedora $releasever - $basearch - Test Updates Debug
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/$basearch/debug/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/$basearch/debug/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-debug-f$releasever&arch=$basearch
 enabled=0
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch

 [updates-testing-source]
 name=Fedora $releasever - Test Updates Source
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/SRPMS/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/SRPMS/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-source-f$releasever&arch=$basearch
 enabled=0
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
--- a/files/common/fedora-updates.repo-secondary
+++ b/files/common/fedora-updates.repo-secondary
@@ -1,26 +1,26 @@
 [updates]
 name=Fedora $releasever - $basearch - Updates
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/updates/$releasever/$basearch/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/updates/$releasever/$basearch/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
 enabled=1
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch

 [updates-debuginfo]
 name=Fedora $releasever - $basearch - Updates - Debug
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/updates/$releasever/$basearch/debug/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/updates/$releasever/$basearch/debug/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-debug-f$releasever&arch=$basearch
 enabled=0
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch

 [updates-source]
 name=Fedora $releasever - Updates Source
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/updates/$releasever/SRPMS/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/updates/$releasever/SRPMS/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-source-f$releasever&arch=$basearch
 enabled=0
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
--- a/files/common/fedora.repo-secondary
+++ b/files/common/fedora.repo-secondary
@@ -1,29 +1,29 @@
 [fedora]
 name=Fedora $releasever - $basearch
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/$basearch/os/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/$basearch/os/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
 enabled=1
 metadata_expire=7d
 gpgcheck=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch

 [fedora-debuginfo]
 name=Fedora $releasever - $basearch - Debug
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/$basearch/debug/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/$basearch/debug/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-debug-$releasever&arch=$basearch
 enabled=0
 metadata_expire=7d
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch

 [fedora-source]
 name=Fedora $releasever - Source
 failovermethod=priority
-baseurl=http://infrastructure.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/source/SRPMS/
+baseurl=http://infrastructure.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/source/SRPMS/
 #metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-source-$releasever&arch=$basearch
 enabled=0
 metadata_expire=7d
 gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
--- a/files/common/step-tickers
+++ b/files/common/step-tickers
@@ -1,7 +1,10 @@
-208.75.88.4
-216.93.242.12
-107.170.242.27
-108.166.189.70
-199.223.248.98
+# [clock.redhat.com]
+66.187.233.4 
+# [time.nist.gov]
+192.43.244.18
+# [otc1.psu.edu]
+128.118.25.5
+# [clock.isc.org]
+204.152.184.72
 # [loopback]
 127.127.1.0
--- a/roles/copr/backend/files/DigiCertCA.crt
+++ b/roles/copr/backend/files/DigiCertCA.crt
--- a/roles/copr/backend/files/boto
+++ b/roles/copr/backend/files/boto
--- a/files/copr/copr-be.conf
+++ b/files/copr/copr-be.conf
@@ -0,0 +1,60 @@
+[backend]
+
+# URL where are results visible
+# default is http://copr
+results_baseurl=http://copr-be.cloud.fedoraproject.org/results
+
+# ??? What is this
+# default is http://coprs/rest/api
+#frontend_url=http://copr-fe.cloud.fedoraproject.org/backend
+frontend_url=http://172.16.5.31/backend
+
+# must have same value as BACKEND_PASSWORD from have frontend in /etc/copr/copr.conf
+# default is PASSWORDHERE but you really should change it. really.
+frontend_auth={{ copr_backend_password }}
+
+# path to ansible playbook which spawns builder
+# see /usr/share/copr*/playbooks/ for examples
+# default is /etc/copr/builder_playbook.yml
+spawn_playbook=/home/copr/provision/builderpb.yml
+
+# path to ansible playbook which terminate builder
+# default is /etc/copr/terminate_playbook.yml 
+terminate_playbook=/home/copr/provision/terminatepb.yml
+
+terminate_vars=vm_name
+
+# directory where jobs are stored
+# no defaults
+jobsdir=/var/lib/copr/jobs
+
+# directory where results are stored
+# should be accessible from web using 'results_baseurl' URL
+# no default
+destdir=/var/lib/copr/public_html/results
+
+# default is 10
+sleeptime=30
+
+# default is 8
+num_workers=8
+
+# path to log file
+# default is /var/log/copr/backend.log
+logfile=/var/log/copr/backend.log
+
+# default is /var/log/copr/workers/
+worker_logdir=/var/log/copr/workers/
+
+# exit on worker failure
+# default is false
+#exit_on_worker=false
+
+# publish fedmsg notifications from workers if true
+# default is false
+#fedmsg_enabled=false
+fedmsg_enabled=true
+
+[builder]
+# default is 1800
+timeout=3600
--- a/files/copr/copr-be.conf-dev
+++ b/files/copr/copr-be.conf-dev
@@ -0,0 +1,57 @@
+[backend]
+
+# URL where are results visible
+# default is http://copr
+results_baseurl=http://copr-be-dev.cloud.fedoraproject.org/results
+
+# ??? What is this
+# default is http://coprs/rest/api
+frontend_url=http://copr-fe-dev.cloud.fedoraproject.org/backend
+
+# must have same value as BACKEND_PASSWORD from have frontend in /etc/copr/copr.conf
+# default is PASSWORDHERE but you really should change it. really.
+frontend_auth=PASSWORDHERE
+
+# path to ansible playbook which spawns builder
+# see /usr/share/copr*/playbooks/ for examples
+# default is /etc/copr/builder_playbook.yml
+spawn_playbook=/home/copr/provision/builderpb.yml
+
+# path to ansible playbook which terminate builder
+# default is /etc/copr/terminate_playbook.yml 
+terminate_playbook=/home/copr/provision/terminatepb.yml
+
+# directory where jobs are stored
+# no defaults
+jobsdir=/var/lib/copr/jobs
+
+# directory where results are stored
+# should be accessible from web using 'results_baseurl' URL
+# no default
+destdir=/var/lib/copr/public_html/results
+
+# default is 10
+sleeptime=30
+
+# default is 8
+num_workers=5
+
+# path to log file
+# default is /var/log/copr/backend.log
+logfile=/var/log/copr/backend.log
+
+# default is /var/log/copr/workers/
+worker_logdir=/var/log/copr/workers/
+
+# exit on worker failure
+# default is false
+#exit_on_worker=false
+
+# publish fedmsg notifications from workers if true
+# default is false
+#fedmsg_enabled=false
+
+
+[builder]
+# default is 1800
+timeout=3600
--- a/roles/copr/backend/files/copr_bashrc
+++ b/roles/copr/backend/files/copr_bashrc
--- a/roles/copr/backend/files/delete-forgotten-instances.cron
+++ b/roles/copr/backend/files/delete-forgotten-instances.cron
--- a/roles/copr/backend/files/delete-forgotten-instances.pl
+++ b/roles/copr/backend/files/delete-forgotten-instances.pl
--- a/files/copr/fe/README
+++ b/files/copr/fe/README
@@ -0,0 +1 @@
+in this dir is where we put all the configs for the copr frontend
--- a/files/copr/fe/copr.conf
+++ b/files/copr/fe/copr.conf
@@ -0,0 +1,33 @@
+# Directory and files where is stored Copr database files
+DATA_DIR = '/var/lib/copr/data'
+DATABASE = '/var/lib/copr/data/copr.db'
+OPENID_STORE = '/var/lib/copr/data/openid_store'
+WHOOSHEE_DIR = '/var/lib/copr/data/whooshee'
+
+SECRET_KEY = '{{ copr_secret_key }}'
+BACKEND_PASSWORD = '{{ copr_backend_password  }}'
+
+# restrict access to a set of users
+#USE_ALLOWED_USERS = False
+#ALLOWED_USERS = ['bonnie', 'clyde']
+
+SQLALCHEMY_DATABASE_URI = '{{ copr_database_uri }}'
+
+# Token length, defaults to 30 (max 255)
+#API_TOKEN_LENGTH = 30
+
+# Expiration of API token in days
+#API_TOKEN_EXPIRATION = 180
+
+# logging options
+#SEND_LOGS_TO = ['root@localhost']
+#LOGGING_LEVEL = logging.ERROR
+
+DEBUG = False
+SQLALCHEMY_ECHO = False
+
+CSRF_ENABLED = True
+WTF_CSRF_ENABLED = True
+
+# send emails when user's perms change in project?
+SEND_EMAILS = True
--- a/roles/copr/frontend/files/httpd/coprs.conf
+++ b/roles/copr/frontend/files/httpd/coprs.conf
@@ -15,7 +15,32 @@ WSGISocketPrefix /var/run/wsgi

    <Directory /usr/share/copr>
        WSGIApplicationGroup %{GLOBAL}
-    Require all granted
+	Require all granted
+    </Directory>
+</VirtualHost>
+
+<VirtualHost *:443>
+    SSLEngine on
+    SSLProtocol all -SSLv2
+    #optimeize on speed
+    SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
+    SSLHonorCipherOrder on
+
+    SSLCertificateFile /etc/pki/tls/ca.crt
+    SSLCertificateKeyFile /etc/pki/tls/private/ca.key
+    ServerName copr-fe.cloud.fedoraproject.org:443
+
+    WSGIPassAuthorization On
+    #WSGIDaemonProcess 127.0.0.1 user=copr-fe group=copr-fe threads=5
+    WSGIScriptAlias / /usr/share/copr/coprs_frontend/application
+    WSGIProcessGroup 127.0.0.1
+
+    #ErrorLog logs/error_coprs
+    #CustomLog logs/access_coprs common
+
+    <Directory /usr/share/copr>
+        WSGIApplicationGroup %{GLOBAL}
+        Require all granted
    </Directory>
 </VirtualHost>

--- a/roles/copr/frontend/files/httpd/welcome.conf
+++ b/roles/copr/frontend/files/httpd/welcome.conf
--- a/roles/copr/frontend/files/pg/pg_hba.conf
+++ b/roles/copr/frontend/files/pg/pg_hba.conf
--- a/files/copr/fe/yum/copr.repo
+++ b/files/copr/fe/yum/copr.repo
@@ -0,0 +1,10 @@
+[Copr]
+name=Copr
+failovermethod=priority
+#baseurl=http://copr-be.cloud.fedoraproject.org/results/msuchy/copr/fedora-19-x86_64/
+# 172.16.5.4 is copr-be.cloud.fedoraproject.org
+# see https://fedorahosted.org/fedora-infrastructure/ticket/4025
+baseurl=http://172.16.5.4/results/msuchy/copr/fedora-20-x86_64/
+enabled=1
+gpgcheck=0
+
--- a/roles/copr/base/files/forward
+++ b/roles/copr/base/files/forward
--- a/roles/copr/base/files/forward_dev
+++ b/roles/copr/base/files/forward_dev
@@ -1,3 +1,2 @@
 msuchy+coprmachine@redhat.com
 asamalik@redhat.com
-vgologuz@redhat.com
--- a/files/copr/hosts
+++ b/files/copr/hosts
@@ -0,0 +1,7 @@
+127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
+::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
+172.16.5.31  copr-fe.cloud.fedoraproject.org
+172.16.5.31  copr.fedoraproject.org
+172.16.5.4 copr-be.cloud.fedoraproject.org
+172.16.5.5 copr-be-dev.cloud.fedoraproject.org
+172.16.5.15 copr-fe-dev.cloud.fedoraproject.org
--- a/roles/copr/backend/templates/keystonerc
+++ b/roles/copr/backend/templates/keystonerc
--- a/roles/copr/backend/files/lighttpd/dirlisting.conf
+++ b/roles/copr/backend/files/lighttpd/dirlisting.conf
--- a/roles/copr/backend/files/lighttpd/lighttpd.conf
+++ b/roles/copr/backend/files/lighttpd/lighttpd.conf
@@ -75,11 +75,7 @@ var.socket_dir  = home_dir + "/sockets"
 #######################################################################
 ##
 ## Load the modules.
-#include "modules.conf"
-server.modules = (
-  "mod_access",
-  "mod_setenv",
-)
+include "modules.conf"

 ##
 #######################################################################
@@ -210,7 +206,7 @@ server.network-backend = "linux-sendfile"
 ##
 ## With SELinux enabled, this is denied by default and needs to be allowed
 ## by running the following once : setsebool -P httpd_setrlimit on
-server.max-fds = 2048
+#server.max-fds = 2048

 ##
 ## Stat() call caching.
@@ -455,13 +451,5 @@ $SERVER["socket"] == ":443" {
  ssl.pemfile = "/etc/lighttpd/copr-be.fedoraproject.org.pem"
  ssl.ca-file = "/etc/lighttpd/DigiCertCA.crt"
  ssl.disable-client-renegotiation = "enable"
-  ssl.use-sslv2 = "disable"
-  ssl.use-sslv3 = "disable"
  ssl.cipher-list             = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
 }
-
-include "conf.d/compress.conf"
-$HTTP["url"] =~ "\.log\.gz$" {
-    setenv.add-response-header  = ( "Content-Encoding" => "gzip")
-    mimetype.assign = ("" => "text/plain" )
-}
--- a/roles/copr/backend/files/lighttpd/mime.conf
+++ b/roles/copr/backend/files/lighttpd/mime.conf
--- a/roles/copr/backend/files/provision/ansible.cfg
+++ b/roles/copr/backend/files/provision/ansible.cfg
--- a/roles/copr/backend/files/provision/builderpb.yml
+++ b/roles/copr/backend/files/provision/builderpb.yml
@@ -1,18 +1,18 @@
+#jinja2:variable_start_string:'[%' , variable_end_string:'%]'
 ---
 - name: check/create instance
  hosts: localhost
  user: copr
  gather_facts: False

-  vars_files:
-  - nova_cloud_vars.yml
-
  vars:
  - security_group: builder
+  - OS_AUTH_URL: http://172.23.0.2:5000/v2.0
+  - OS_TENANT_NAME: copr
+  - OS_USERNAME: msuchy
+  - OS_PASSWORD: [% copr_nova_password %]
+  # rhel 6.4 2013-02-21 x86_64 - ami
  - image_id: cba0c766-84ac-4048-b0f5-6d4000af62f8
-  - OS_USERNAME_OLD: msuchy
-  - OS_AUTH_URL_OLD: http://172.23.0.2:5000/v2.0
-  # todo: remove after transition to new cloud

  tasks:
  - name: generate builder name
@@ -20,7 +20,7 @@
    register: vm_name

  - name: spin it up
-    local_action: nova_compute auth_url={{OS_AUTH_URL_OLD}} flavor_id=6 image_id={{ image_id }} key_name=buildsys login_password={{OS_PASSWORD_OLD}} login_tenant_name={{OS_TENANT_NAME}} login_username={{OS_USERNAME_OLD}} security_groups={{security_group}} wait=yes name="{{vm_name.stdout}}"
+    local_action: nova_compute auth_url={{OS_AUTH_URL}} flavor_id=6 image_id={{ image_id }} key_name=buildsys login_password={{OS_PASSWORD}} login_tenant_name={{OS_TENANT_NAME}} login_username={{OS_USERNAME}} security_groups={{security_group}} wait=yes name="{{vm_name.stdout}}"
    register: nova

  # should be able to use nova.private_ip, but it does not work with Fedora Cloud.
@@ -36,7 +36,7 @@

 - hosts: builder_temp_group
  user: root
-  gather_facts: True
+  gather_facts: False
  vars:
   - files: files/
  
@@ -55,6 +55,7 @@
  - name: add repos
    action: copy src={{ files }}/{{ item }} dest=/etc/yum.repos.d/{{ item }}
    with_items:
+    - builder.repo
    - epel6.repo

  - name: install additional pkgs
@@ -70,9 +71,8 @@
    with_items:
    - rpm
    - glib2
-    - ca-certificates

-  #- yum: name=mock  enablerepo=epel-testing state=latest
+  - yum: name=mock  enablerepo=epel-testing state=latest

  - name: mockbuilder user   
    action: user name=mockbuilder groups=mock
@@ -84,12 +84,13 @@
    action: authorized_key user=mockbuilder key='{{ lookup('file', '/home/copr/provision/files/buildsys.pub') }}'

  - name: put updated mock configs into /etc/mock
-    action: template src={{ files }}/mock/{{ item }} dest=/etc/mock
+    action: copy src={{ files }}/mock/{{ item }} dest=/etc/mock
    with_items:
    - site-defaults.cfg
+    - epel-5-x86_64.cfg
+    - epel-5-i386.cfg
+    - fedora-20-x86_64.cfg
+    - fedora-20-i386.cfg
+    - epel-7-x86_64.cfg

-  - lineinfile: dest=/etc/mock/fedora-rawhide-x86_64.cfg line="config_opts['package_manager'] = 'dnf'" state=absent
-  - lineinfile: dest=/etc/mock/fedora-rawhide-i386.cfg line="config_opts['package_manager'] = 'dnf'" state=absent
-
-  - lineinfile: dest=/etc/security/limits.conf line="* soft nofile 10240" insertafter=EOF
-  - lineinfile: dest=/etc/security/limits.conf line="* hard nofile 10240" insertafter=EOF
+  - lineinfile: dest=/root/.bashrc line="ulimit -n 10240" insertafter=EOF
--- a/files/copr/provision/files/builder.repo
+++ b/files/copr/provision/files/builder.repo
@@ -0,0 +1,23 @@
+[builder-infrastructure]
+name=Builder Packages from Fedora Infrastructure $releasever - $basearch
+baseurl=http://infrastructure.fedoraproject.org/repo/builder-rpms/$releasever/$basearch/
+enabled=1
+gpgcheck=1
+gpgkey=http://infrastructure.fedoraproject.org/repo/RPM-GPG-KEY-INFRASTRUCTURE
+
+[msuchy-Mock]
+name=Copr repo for Mock owned by msuchy
+description=Mock for RHEL6 with patch from https://bugzilla.redhat.com/show_bug.cgi?id=1028438 and https://bugzilla.redhat.com/show_bug.cgi?id=1034805
+baseurl=http://172.16.5.4/results/msuchy/Mock/epel-6-$basearch/
+skip_if_unavailable=True
+gpgcheck=0
+enabled=1
+
+[msuchy-scl-utils]
+name=Copr repo for scl-utils owned by msuchy
+description=scl-utils with patch from https://bugzilla.redhat.com/show_bug.cgi?id=985233
+baseurl=http://172.16.5.4/results/msuchy/scl-utils/epel-6-$basearch/
+skip_if_unavailable=True
+gpgcheck=0
+enabled=1
+
--- a/roles/copr/backend/files/provision/files/buildsys.pub
+++ b/roles/copr/backend/files/provision/files/buildsys.pub
--- a/files/copr/provision/files/epel6.repo
+++ b/files/copr/provision/files/epel6.repo
@@ -0,0 +1,13 @@
+[epel]
+name=Extras Packages for Enterprise Linux $releasever - $basearch
+baseurl=http://infrastructure.fedoraproject.org/pub/epel/6/$basearch/
+enabled=1
+gpgcheck=1
+gpgkey=http://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-6
+
+[epel-testing]
+name=Extras Packages for Enterprise Linux $releasever - $basearch
+baseurl=http://infrastructure.fedoraproject.org/pub/epel/testing/6/$basearch/
+enabled=0
+gpgcheck=1
+gpgkey=http://infrastructure.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-6
--- a/files/copr/provision/files/mock/epel-5-i386.cfg
+++ b/files/copr/provision/files/mock/epel-5-i386.cfg
@@ -0,0 +1,60 @@
+config_opts['root'] = 'epel-5-i386'
+config_opts['target_arch'] = 'i386'
+config_opts['legal_host_arches'] = ('i386', 'i586', 'i686', 'x86_64')
+config_opts['chroot_setup_cmd'] = 'install buildsys-build'
+config_opts['dist'] = 'el5'  # only useful for --resultdir variable subst
+if not config_opts.has_key('macros'):  config_opts['macros'] = {}
+config_opts['macros']['%__arch_install_post'] = '%{nil}'
+config_opts['macros']['%rhel'] = '5'
+config_opts['macros']['%dist'] = '.el5'
+config_opts['macros']['%el5'] = '1'
+config_opts['releasever'] = '5'
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+logfile=/var/log/yum.log
+reposdir=/dev/null
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[core]
+name=base
+mirrorlist=http://mirrorlist.centos.org/?release=5&arch=i386&repo=os
+
+[update]
+name=updates
+mirrorlist=http://mirrorlist.centos.org/?release=5&arch=i386&repo=updates
+
+[groups]
+name=groups
+baseurl=http://buildsys.fedoraproject.org/buildgroups/rhel5/i386/
+
+[extras]
+name=epel
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=i386
+
+[testing]
+name=epel-testing
+enabled=0
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=testing-epel5&arch=i386
+
+[local]
+name=local
+baseurl=http://kojipkgs.fedoraproject.org/repos/dist-5E-epel-build/latest/i386/
+cost=2000
+enabled=0
+
+[epel-debug]
+name=epel-debug
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-debug-5&arch=i386
+failovermethod=priority
+enabled=0
+"""
--- a/files/copr/provision/files/mock/epel-5-x86_64.cfg
+++ b/files/copr/provision/files/mock/epel-5-x86_64.cfg
@@ -0,0 +1,60 @@
+config_opts['root'] = 'epel-5-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['chroot_setup_cmd'] = 'install buildsys-build'
+config_opts['dist'] = 'el5'  # only useful for --resultdir variable subst
+if not config_opts.has_key('macros'):  config_opts['macros'] = {}
+config_opts['macros']['%__arch_install_post'] = '%{nil}'
+config_opts['macros']['%rhel'] = '5'
+config_opts['macros']['%dist'] = '.el5'
+config_opts['macros']['%el5'] = '1'
+config_opts['releasever'] = '5'
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+logfile=/var/log/yum.log
+reposdir=/dev/null
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[core]
+name=base
+mirrorlist=http://mirrorlist.centos.org/?release=5&arch=x86_64&repo=os
+
+[update]
+name=updates
+mirrorlist=http://mirrorlist.centos.org/?release=5&arch=x86_64&repo=updates
+
+[groups]
+name=groups
+baseurl=http://buildsys.fedoraproject.org/buildgroups/rhel5/x86_64/
+
+[extras]
+name=epel
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=x86_64
+
+[testing]
+name=epel-testing
+enabled=0
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=testing-epel5&arch=x86_64
+
+[local]
+name=local
+baseurl=http://kojipkgs.fedoraproject.org/repos/dist-5E-epel-build/latest/x86_64/
+cost=2000
+enabled=0
+
+[epel-debug]
+name=epel-debug
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-debug-5&arch=x86_64
+failovermethod=priority
+enabled=0
+"""
--- a/files/copr/provision/files/mock/epel-7-x86_64.cfg
+++ b/files/copr/provision/files/mock/epel-7-x86_64.cfg
@@ -0,0 +1,45 @@
+config_opts['chroothome'] = '/builddir'
+config_opts['basedir'] = '/var/lib/mock'
+config_opts['root'] = 'epel-7-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-release-server redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['dist'] = 'el7'  # only useful for --resultdir variable subst
+config_opts['macros'] = {}
+config_opts['macros']['%dist'] = '.el7'
+config_opts['macros']['%rhel'] = '7'
+config_opts['macros']['%el7'] = '1'
+config_opts['macros']['%_topdir'] = '/builddir/build'
+config_opts['macros']['%_rpmfilename'] = '%%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm'
+config_opts['releasever'] = '7'
+
+config_opts['plugin_conf']['root_cache_enable'] = False
+config_opts['plugin_conf']['yum_cache_enable'] = False
+config_opts['plugin_conf']['ccache_enable'] = False
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+logfile=/var/log/yum.log
+reposdir=/dev/null
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[beta]
+name=beta
+baseurl=http://kojipkgs.fedoraproject.org/rhel/beta/7/x86_64/os/
+
+[epel]
+name=Extra Packages for Enterprise Linux 7 - $basearch
+#baseurl=http://download.fedoraproject.org/pub/epel/7/$basearch
+mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch
+failovermethod=priority
+enabled=1
+"""
--- a/files/copr/provision/files/mock/fedora-20-i386.cfg
+++ b/files/copr/provision/files/mock/fedora-20-i386.cfg
@@ -0,0 +1,62 @@
+config_opts['root'] = 'fedora-20-i386'
+config_opts['target_arch'] = 'i686'
+config_opts['legal_host_arches'] = ('i386', 'i586', 'i686', 'x86_64')
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc20'  # only useful for --resultdir variable subst
+config_opts['releasever'] = '20'
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-20&arch=i386
+failovermethod=priority
+
+[updates]
+name=updates
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f20&arch=i386
+failovermethod=priority
+
+[updates-testing]
+name=updates-testing
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-testing-f20&arch=i386
+failovermethod=priority
+enabled=0
+
+[local]
+name=local
+baseurl=http://kojipkgs.fedoraproject.org/repos/f20-build/latest/i386/
+cost=2000
+enabled=0
+
+[fedora-debuginfo]
+name=fedora-debuginfo
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-debug-20&arch=i386
+failovermethod=priority
+enabled=0
+
+[updates-debuginfo]
+name=updates-debuginfo
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-debug-f20&arch=i386
+failovermethod=priority
+enabled=0
+
+[updates-testing-debuginfo]
+name=updates-testing-debuginfo
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-testing-debug-f20&arch=i386
+failovermethod=priority
+enabled=0
+"""
--- a/files/copr/provision/files/mock/fedora-20-x86_64.cfg
+++ b/files/copr/provision/files/mock/fedora-20-x86_64.cfg
@@ -0,0 +1,62 @@
+config_opts['root'] = 'fedora-20-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc20'  # only useful for --resultdir variable subst
+config_opts['releasever'] = '20'
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-20&arch=x86_64
+failovermethod=priority
+
+[updates]
+name=updates
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f20&arch=x86_64
+failovermethod=priority
+
+[updates-testing]
+name=updates-testing
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-testing-f20&arch=x86_64
+failovermethod=priority
+enabled=0
+
+[local]
+name=local
+baseurl=http://kojipkgs.fedoraproject.org/repos/f20-build/latest/x86_64/
+cost=2000
+enabled=0
+
+[fedora-debuginfo]
+name=fedora-debuginfo
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-debug-20&arch=x86_64
+failovermethod=priority
+enabled=0
+
+[updates-debuginfo]
+name=updates-debuginfo
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-debug-f20&arch=x86_64
+failovermethod=priority
+enabled=0
+
+[updates-testing-debuginfo]
+name=updates-testing-debuginfo
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-testing-debug-f20&arch=x86_64
+failovermethod=priority
+enabled=0
+"""
--- a/files/copr/provision/files/mock/fedora-21-i386.cfg
+++ b/files/copr/provision/files/mock/fedora-21-i386.cfg
@@ -0,0 +1,63 @@
+config_opts['root'] = 'fedora-21-i386'
+config_opts['target_arch'] = 'i686'
+config_opts['legal_host_arches'] = ('i386', 'i586', 'i686', 'x86_64')
+config_opts['chroot_setup_cmd'] = 'install @buildsys-build'
+config_opts['dist'] = 'fc21'  # only useful for --resultdir variable subst
+config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
+config_opts['releasever'] = '21'
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[fedora]
+name=fedora
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
+failovermethod=priority
+
+[updates]
+name=updates
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
+failovermethod=priority
+
+[updates-testing]
+name=updates-testing
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[local]
+name=local
+baseurl=http://kojipkgs.fedoraproject.org/repos/f21-build/latest/i386/
+cost=2000
+enabled=0
+
+[fedora-debuginfo]
+name=fedora-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-debug-$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[updates-debuginfo]
+name=updates-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-debug-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[updates-testing-debuginfo]
+name=updates-testing-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-debug-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+"""
--- a/files/copr/provision/files/mock/fedora-21-x86_64.cfg
+++ b/files/copr/provision/files/mock/fedora-21-x86_64.cfg
@@ -0,0 +1,63 @@
+config_opts['root'] = 'fedora-21-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['chroot_setup_cmd'] = 'install @buildsys-build'
+config_opts['dist'] = 'fc21'  # only useful for --resultdir variable subst
+config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
+config_opts['releasever'] = '21'
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[fedora]
+name=fedora
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
+failovermethod=priority
+
+[updates]
+name=updates
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
+failovermethod=priority
+
+[updates-testing]
+name=updates-testing
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[local]
+name=local
+baseurl=http://kojipkgs.fedoraproject.org/repos/f21-build/latest/x86_64/
+cost=2000
+enabled=0
+
+[fedora-debuginfo]
+name=fedora-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-debug-$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[updates-debuginfo]
+name=updates-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-debug-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+
+[updates-testing-debuginfo]
+name=updates-testing-debuginfo
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-debug-f$releasever&arch=$basearch
+failovermethod=priority
+enabled=0
+"""
--- a/files/copr/provision/files/mock/site-defaults.cfg
+++ b/files/copr/provision/files/mock/site-defaults.cfg
@@ -0,0 +1,152 @@
+# mock defaults
+# vim:tw=0:ts=4:sw=4:et:
+#
+# This config file is for site-specific default values that apply across all
+# configurations. Options specified in this config file can be overridden in
+# the individual mock config files.
+#
+# The site-defaults.cfg delivered by default has NO options set. Only set
+# options here if you want to override the defaults.
+#
+# Entries in this file follow the same format as other mock config files.
+# config_opts['foo'] = bar
+
+#############################################################################
+#
+# Things that we recommend you set in site-defaults.cfg:
+#
+# config_opts['basedir'] = '/var/lib/mock/'
+# config_opts['cache_topdir'] = '/var/cache/mock'
+#  Note: the path pointed to by basedir and cache_topdir must be owned
+#        by group 'mock' and must have mode: g+rws
+# config_opts['rpmbuild_timeout'] = 0
+# config_opts['use_host_resolv'] = True
+
+# You can configure log format to pull from logging.ini formats of these names:
+# config_opts['build_log_fmt_name'] = "unadorned"
+# config_opts['root_log_fmt_name']  = "detailed"
+# config_opts['state_log_fmt_name'] = "state"
+#
+# mock will normally set up a minimal chroot /dev.
+# If you want to use a pre-configured /dev, disable this and use the bind-mount
+# plugin to mount your special /dev
+# config_opts['internal_dev_setup'] = True
+#
+# internal_setarch defaults to 'True' if the python 'ctypes' package is
+# available. It is in the python std lib on >= python 2.5. On older versions,
+# it is available as an addon. On systems w/o ctypes, it will default to 'False'
+# config_opts['internal_setarch'] = False
+#
+# the cleanup_on_* options allow you to automatically clean and remove the
+# mock build directory, but only take effect if --resultdir is used.
+# config_opts provides fine-grained control. cmdline only has big hammer
+#
+# config_opts['cleanup_on_success'] = 1
+# config_opts['cleanup_on_failure'] = 1
+
+# if you want mock to automatically run createrepo on the rpms in your
+# resultdir.
+# config_opts['createrepo_on_rpms'] = False
+# config_opts['createrepo_command'] = '/usr/bin/createrepo -d -q -x *.src.rpm'
+
+#############################################################################
+#
+# plugin related. Below are the defaults. Change to suit your site
+# policy. site-defaults.cfg is a good place to do this.
+#
+# NOTE: Some of the caching options can theoretically affect build
+#  reproducability. Change with care.
+#
+config_opts['plugin_conf']['package_state_enable'] = True
+# config_opts['plugin_conf']['ccache_enable'] = True
+# config_opts['plugin_conf']['ccache_opts']['max_cache_size'] = '4G'
+# config_opts['plugin_conf']['ccache_opts']['compress'] = None
+# config_opts['plugin_conf']['ccache_opts']['dir'] = "%(cache_topdir)s/%(root)s/ccache/"
+# config_opts['plugin_conf']['yum_cache_enable'] = True
+# config_opts['plugin_conf']['yum_cache_opts']['max_age_days'] = 30
+# config_opts['plugin_conf']['yum_cache_opts']['dir'] = "%(cache_topdir)s/%(root)s/yum_cache/"
+# config_opts['plugin_conf']['root_cache_enable'] = True
+# config_opts['plugin_conf']['root_cache_opts']['max_age_days'] = 15
+# config_opts['plugin_conf']['root_cache_opts']['dir'] = "%(cache_topdir)s/%(root)s/root_cache/"
+# config_opts['plugin_conf']['root_cache_opts']['compress_program'] = "pigz"
+# config_opts['plugin_conf']['root_cache_opts']['extension'] = ".gz"
+# config_opts['plugin_conf']['root_cache_opts']['exclude_dirs'] = ["./proc", "./sys", "./dev", 
+#                                                                  "./tmp/ccache", "./var/cache/yum" ]
+#
+# bind mount plugin is enabled by default but has no configured directories to
+# mount
+# config_opts['plugin_conf']['bind_mount_enable'] = True
+# config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/host/path', '/bind/mount/path/in/chroot/' ))
+#
+# config_opts['plugin_conf']['tmpfs_enable'] = False
+# config_opts['plugin_conf']['tmpfs_opts']['required_ram_mb'] = 1024
+# config_opts['plugin_conf']['tmpfs_opts']['max_fs_size'] = '512m'
+
+#############################################################################
+#
+# environment for chroot
+#
+# config_opts['environment']['TERM'] = 'vt100'
+# config_opts['environment']['SHELL'] = '/bin/bash'
+# config_opts['environment']['HOME'] = '/builddir'
+# config_opts['environment']['HOSTNAME'] = 'mock'
+# config_opts['environment']['PATH'] = '/usr/bin:/bin:/usr/sbin:/sbin'
+# config_opts['environment']['PROMPT_COMMAND'] = 'echo -n "<mock-chroot>"'
+# config_opts['environment']['LANG'] = os.environ.setdefault('LANG', 'en_US.UTF-8')
+# config_opts['environment']['TZ'] = os.environ.setdefault('TZ', 'EST5EDT')
+
+#############################################################################
+#
+# Things that you can change, but we dont recommend it:
+# config_opts['chroothome'] = '/builddir'
+# config_opts['clean'] = True
+
+#############################################################################
+#
+# Things that must be adjusted if SCM integration is used:
+#
+# config_opts['scm'] = True
+# config_opts['scm_opts']['method'] = 'git'
+# config_opts['scm_opts']['cvs_get'] = 'cvs -d /srv/cvs co SCM_BRN SCM_PKG'
+# config_opts['scm_opts']['git_get'] = 'git clone SCM_BRN git://localhost/SCM_PKG.git SCM_PKG'
+# config_opts['scm_opts']['svn_get'] = 'svn co file:///srv/svn/SCM_PKG/SCM_BRN SCM_PKG'
+# config_opts['scm_opts']['spec'] = 'SCM_PKG.spec'
+# config_opts['scm_opts']['ext_src_dir'] = '/dev/null'
+# config_opts['scm_opts']['write_tar'] = True
+# config_opts['scm_opts']['git_timestamps'] = True
+
+# These options are also recognized but usually defined in cmd line
+# with --scm-option package=<pkg> --scm-option branch=<branch>
+# config_opts['scm_opts']['package'] = 'mypkg'
+# config_opts['scm_opts']['branch'] = 'master'
+
+#############################################################################
+#
+# Things that are best suited for individual chroot config files:
+#
+# MUST SET (in individual chroot cfg file):
+# config_opts['root'] = 'name-of-yum-build-dir'
+# config_opts['target_arch'] = 'i386'
+# config_opts['yum.conf'] = ''
+# config_opts['yum_common_opts'] = []
+#
+# CAN SET, defaults usually work ok:
+# config_opts['chroot_setup_cmd'] = 'install buildsys-build'
+# config_opts['log_config_file'] = 'logging.ini'
+# config_opts['more_buildreqs']['srpm_name-version-release'] = 'dependencies'
+# config_opts['macros']['%Add_your_macro_name_here'] = "add macro value here"
+# config_opts['files']['path/name/no/leading/slash'] = "put file contents here."
+# config_opts['chrootuid'] = os.getuid()
+
+# If you change chrootgid, you must also change "mock" to the correct group
+# name in this line of the mock PAM config:
+#   auth  sufficient pam_succeed_if.so user ingroup mock use_uid quiet
+# config_opts['chrootgid'] = grp.getgrnam("mock")[2]
+
+# config_opts['useradd'] = '/usr/sbin/useradd -m -u %(uid)s -g %(gid)s -d %(home)s -n %(user)s' # Fedora/RedHat
+#
+# Security related
+# config_opts['no_root_shells'] = False
+#
+# Proxy settings (https_proxy, ftp_proxy, and no_proxy can also be set)
+# config_opts['http_proxy'] = 'http://localhost:3128'
--- a/roles/copr/backend/files/provision/inventory
+++ b/roles/copr/backend/files/provision/inventory
--- a/files/copr/provision/terminatepb.yml
+++ b/files/copr/provision/terminatepb.yml
@@ -0,0 +1,18 @@
+#jinja2:variable_start_string:'[%' , variable_end_string:'%]'
+---
+- name: terminate instance
+  hosts: all
+  user: root
+  gather_facts: False
+
+  vars:
+  - OS_AUTH_URL: http://172.23.0.2:5000/v2.0
+  - OS_TENANT_NAME: copr
+  - OS_USERNAME: msuchy
+  - OS_PASSWORD: [% copr_nova_password %]
+
+  tasks:
+  - name: terminate it
+    local_action: nova_compute auth_url={{OS_AUTH_URL}} login_password={{OS_PASSWORD}} login_tenant_name={{OS_TENANT_NAME}} login_username={{OS_USERNAME}} name="{{copr_task.vm_name}}" state=absent
+
+
--- a/roles/copr/backend/files/ssh_config
+++ b/roles/copr/backend/files/ssh_config
--- a/files/download/sync-up-downloads.sh
+++ b/files/download/sync-up-downloads.sh
@@ -8,7 +8,7 @@
 RSYNC='/usr/bin/rsync'
 RS_OPT="-avSHP  --numeric-ids"
 RS_DEADLY="--delete --delete-excluded --delete-delay --delay-updates"
-ALT_EXCLUDES="--exclude deltaisos/archive --exclude 22_Alpha* --exclude 22_Beta*"
+ALT_EXCLUDES="--exclude deltaisos/archive"
 EPL_EXCLUDES=""
 FED_EXCLUDES=""

--- a/files/fedora-cloud/fed-cloud09.pem
+++ b/files/fedora-cloud/fed-cloud09.pem
@@ -1,23 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIID2DCCAsACCQCxRWmzwjSj6TANBgkqhkiG9w0BAQUFADCBrTELMAkGA1UEBhMC
-VVMxCzAJBgNVBAgMAk5NMRAwDgYDVQQHDAdSYWxlaWdoMRAwDgYDVQQKDAdSZWQg
-SGF0MRcwFQYDVQQLDA5GZWRvcmEgUHJvamVjdDEsMCoGA1UEAwwjZmVkLWNsb3Vk
-MDkuY2xvdWQuZmVkb3JhcHJvamVjdC5vcmcxJjAkBgkqhkiG9w0BCQEWF2FkbWlu
-QGZlZG9yYXByb2plY3Qub3JnMB4XDTE0MDkxODEwMjMxMloXDTE1MDkxODEwMjMx
-Mlowga0xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOTTEQMA4GA1UEBwwHUmFsZWln
-aDEQMA4GA1UECgwHUmVkIEhhdDEXMBUGA1UECwwORmVkb3JhIFByb2plY3QxLDAq
-BgNVBAMMI2ZlZC1jbG91ZDA5LmNsb3VkLmZlZG9yYXByb2plY3Qub3JnMSYwJAYJ
-KoZIhvcNAQkBFhdhZG1pbkBmZWRvcmFwcm9qZWN0Lm9yZzCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBALFOYDRhow6sEyCvm4jNlIAxs9vYDF07q3sEHzVj
-zXy0NNlUgZPRCijWFyHRDwy383f7ZtRlqVCGXxm4l8ltQUU+jmXcnIY1xY2A1TPv
-nWv+f1dGSv+SfWGAjqgwyajr6wyPAOnpwui2v03/xalAx6Xl7padfdlAEsNjAvNb
-5uZkW7DLlDu3jSIroDSKsJUQW9kc1elT90W0mNgw3MpFA5zdj0QRxi2JpBth6PeT
-CewN4r7QZ5cP4EzfHMLKT21kJzm+j5jlaQEak4yKWDEeLh4+RxgTnmss4zYKTUit
-7H+j9KaxqVsneB8Sg7EtVnXafYLrSlr9fwOV5DWklLzvjBMCAwEAATANBgkqhkiG
-9w0BAQUFAAOCAQEAHToeNGFaGlybHICw1ncLCmdu6vikPPn/UShfS25U54Q9eIMn
-zqlhbbEyzuF4wKjV35W0BORWKJ+hQ2vpfk21jUMVOsdl7IMEXtIWotfO17ufWM28
-zhwcPAlrs/Pr5dF7ihbOGKAHhEYVopSH8OTFayAQKWWKGv52lZsgwfrnDDu0TjIo
-zmhCEmOWZf+CeEWT/AP7BJ6g4Apz9grUmaRvaQGft5y5sGC8tsV0im/C9WaMfVhF
-wemG2KcOuKJDXtvd7DHNBoHcDrB1cN1i0uKhj0nxXsXpeag9Xh4BmkgHMU8rnegK
-q7hOy15qVU/lOBZUtfx69aYHPpOGJ7Jc1xFIiQ==
-----END CERTIFICATE-----
--- a/files/fedora-cloud/fed09-ssh-key.pub
+++ b/files/fedora-cloud/fed09-ssh-key.pub
@@ -1,2 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCv8WqXOuL78Rd7ZvDqoi84M7uRV3uueXTXtvlPdyNQBzIBmxh+spw9IhtoR+FlzgQQ1MN4B7YVLTGki6QDxWDM5jgTVfzxTh/HTg7kJ31HbM1/jDuBK7HMfay2BGx/HCqS2oxIBgIBwIMQAU93jBZUxNyYWvO+5TiU35IHEkYOtHyGYtTtuGCopYRQoAAOIVIIzzDbPvopojCBF5cMYglR/G02YgWM7hMpQ9IqEttLctLmpg6ckcp/sDTHV/8CbXbrSN6pOYxn1YutOgC9MHNmxC1joMH18qkwvSnzXaeVNh4PBWnm1f3KVTSZXKuewPThc3fk2sozgM9BH6KmZoKl
-
--- a/files/fedora-cloud/fed_cloud09_nova_public_key
+++ b/files/fedora-cloud/fed_cloud09_nova_public_key
@@ -1 +0,0 @@
-{{fed_cloud09_nova_public_key}}
--- a/files/fedora-cloud/fedora-admin-20130801.pub
+++ b/files/fedora-cloud/fedora-admin-20130801.pub
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1sBKROSJ3rzI0IlBkM926Dvpiw3a4wYSys0ZeKRohWZg369ilZkUkRhsy0g4JU85lt6rxf5JLwURF+fWBEohauF1Uvklc25LdZpRS3IBQPaXvWeM8lygQQomFc0Df6iUbCYFWnEWMjKd7FGYX3DgOZLnG8tV2vX7jFjqitsh5LRAbmghUBRarw/ix4CFx7+VIeKCBkAybviQIW828N1IqJC6/e7v6/QStpblYpCFPqMflXhQ/KS2D043Yy/uUjmOjMWwOMFS6Qk+py1C0mDU0TUptFYwDP5o9IK/c5HaccmOl2IyUPB1/RCtTfOn6wXPRTMUU+5w+TcPH6MPvvuiSQ== root@lockbox01.phx2.fedoraproject.org
--- a/files/fedora-cloud/haproxy.cfg
+++ b/files/fedora-cloud/haproxy.cfg
@@ -1,135 +0,0 @@
-#---------------------------------------------------------------------
-# Example configuration for a possible web application.  See the
-# full configuration options online.
-#
-#   http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
-#
-#---------------------------------------------------------------------
-
-#---------------------------------------------------------------------
-# Global settings
-#---------------------------------------------------------------------
-global
-    # to have these messages end up in /var/log/haproxy.log you will
-    # need to:
-    #
-    # 1) configure syslog to accept network log events.  This is done
-    #    by adding the '-r' option to the SYSLOGD_OPTIONS in
-    #    /etc/sysconfig/syslog
-    #
-    # 2) configure local2 events to go to the /var/log/haproxy.log
-    #   file. A line like the following can be added to
-    #   /etc/sysconfig/syslog
-    #
-    #    local2.*                       /var/log/haproxy.log
-    #
-    log         127.0.0.1 local2
-
-    chroot      /var/lib/haproxy
-    pidfile     /var/run/haproxy.pid
-    maxconn     4000
-    user        haproxy
-    group       haproxy
-    daemon
-
-    # turn on stats unix socket
-    stats socket /var/lib/haproxy/stats
-
-    tune.ssl.default-dh-param 1024
-    ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
-
-
-#---------------------------------------------------------------------
-# common defaults that all the 'listen' and 'backend' sections will
-# use if not designated in their block
-#---------------------------------------------------------------------
-defaults
-    mode                    http
-    log                     global
-    option                  httplog
-    option                  dontlognull
-    option http-server-close
-    option forwardfor       except 127.0.0.0/8
-    option                  redispatch
-    retries                 3
-    timeout http-request    10s
-    timeout queue           1m
-    timeout connect         10s
-    timeout client          1m
-    timeout server          1m
-    timeout http-keep-alive 10s
-    timeout check           10s
-    maxconn                 3000
-
-#frontend keystone_public *:5000
-#  default_backend keystone_public
-#frontend keystone_admin *:35357
-#  default_backend keystone_admin
-frontend neutron
-  bind 0.0.0.0:9696 ssl no-sslv3 no-tlsv10 crt /etc/haproxy/fedorainfracloud.org.combined
-  default_backend neutron
-  # HSTS (15768000 seconds = 6 months)
-  rspadd  Strict-Transport-Security:\ max-age=15768000
-
-frontend cinder
-  bind 0.0.0.0:8776 ssl no-sslv3 no-tlsv10 crt /etc/haproxy/fedorainfracloud.org.combined
-  default_backend cinder
-  # HSTS (15768000 seconds = 6 months)
-  rspadd  Strict-Transport-Security:\ max-age=15768000
-
-frontend swift
-  bind 0.0.0.0:8080 ssl no-sslv3 no-tlsv10 crt /etc/haproxy/fedorainfracloud.org.combined
-  default_backend swift
-  # HSTS (15768000 seconds = 6 months)
-  rspadd  Strict-Transport-Security:\ max-age=15768000
-
-frontend nova
-  bind 0.0.0.0:8774 ssl no-sslv3 no-tlsv10 crt /etc/haproxy/fedorainfracloud.org.combined
-  default_backend nova
-  # HSTS (15768000 seconds = 6 months)
-  rspadd  Strict-Transport-Security:\ max-age=15768000
-
-frontend ceilometer
-  bind 0.0.0.0:8777 ssl no-sslv3 no-tlsv10 crt /etc/haproxy/fedorainfracloud.org.combined
-  default_backend ceilometer
-  # HSTS (15768000 seconds = 6 months)
-  rspadd  Strict-Transport-Security:\ max-age=15768000
-
-frontend ec2
-  bind 0.0.0.0:8773 ssl no-sslv3 no-tlsv10 crt /etc/haproxy/fedorainfracloud.org.combined
-  default_backend ec2
-  # HSTS (15768000 seconds = 6 months)
-  rspadd  Strict-Transport-Security:\ max-age=15768000
-
-frontend glance
-  bind 0.0.0.0:9292 ssl no-sslv3 no-tlsv10 crt /etc/haproxy/fedorainfracloud.org.combined
-  default_backend glance
-  # HSTS (15768000 seconds = 6 months)
-  rspadd  Strict-Transport-Security:\ max-age=15768000
-
-backend neutron
-  server neutron 127.0.0.1:8696 check
-
-backend cinder
-  server cinder 127.0.0.1:6776 check
-
-backend swift
-  server swift 127.0.0.1:7080 check
-
-backend nova
-  server nova 127.0.0.1:6774 check
-
-backend ceilometer
-  server ceilometer 127.0.0.1:6777 check
-
-backend ec2
-  server ec2 127.0.0.1:6773 check
-
-backend glance
-  server glance 127.0.0.1:7292 check
-
-backend keystone_public
-  server keystone_public 127.0.0.1:5000 check
-
-backend keystone_admin
-  server keystone_admin 127.0.0.1:35357 check
--- a/files/fedora-cloud/hosts
+++ b/files/fedora-cloud/hosts
@@ -1,24 +0,0 @@
-127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4                                     
-::1         localhost localhost.localdomain localhost6 localhost6.localdomain6 
-
-# http://docs.openstack.org/icehouse/install-guide/install/yum/content/basics-neutron-networking-controller-node.html
-# controller
-{{ controller_public_ip }}       controller
-
-# network
-{{ network_public_ip }}       network
-
-# compute1
-{{ compute1_private_ip }}        fed-cloud10.cloud.fedoraproject.org
-{{ compute2_private_ip }}        fed-cloud11.cloud.fedoraproject.org
-{{ compute3_private_ip }}        fed-cloud12.cloud.fedoraproject.org
-{{ compute4_private_ip }}        fed-cloud13.cloud.fedoraproject.org
-{{ compute5_private_ip }}        fed-cloud14.cloud.fedoraproject.org
-{{ compute6_private_ip }}        fed-cloud15.cloud.fedoraproject.org
-#
-# This is needed for 2fa to work correctly.
-#
-209.132.181.6 infrastructure infrastructure.fedoraproject.org
-209.132.181.32 fas-all.phx2.fedoraproject.org
-
-{{ controller_private_ip }}      fed-cloud09.cloud.fedoraproject.org fedorainfracloud.org
--- a/files/fedora-cloud/ifcfg-br-ex
+++ b/files/fedora-cloud/ifcfg-br-ex
@@ -1,9 +0,0 @@
-DEVICE=br-ex
-DEVICETYPE=ovs
-TYPE=OVSBridge
-BOOTPROTO=static
-IPADDR={{ network_public_ip }}
-NETMASK={{ public_netmask }}  # your netmask
-GATEWAY={{ public_gateway_ip }}  # your gateway
-DNS1={{ public_dns }}     # your nameserver
-ONBOOT=yes
--- a/files/fedora-cloud/ifcfg-eth0
+++ b/files/fedora-cloud/ifcfg-eth0
@@ -1,8 +0,0 @@
-DEVICE="eth0"
-NAME="eth0"
-ONBOOT=yes
-BOOTPROTO=none
-HWADDR="f0:1f:af:e3:5f:0c"
-DEVICETYPE=ovs
-TYPE=OVSPort
-OVS_BRIDGE=br-ex
--- a/files/fedora-cloud/keystonerc_msuchy
+++ b/files/fedora-cloud/keystonerc_msuchy
@@ -1,5 +0,0 @@
-export OS_USERNAME=msuchy
-export OS_TENANT_NAME=copr
-export OS_PASSWORD=TBD
-export OS_AUTH_URL=http://209.132.184.9:5000/v2.0/
-export PS1='[\u@\h \W(keystone_msuchy)]\$ '
--- a/files/fedora-cloud/my.cnf
+++ b/files/fedora-cloud/my.cnf
@@ -1,4 +0,0 @@
-[client]
-host=localhost
-user=root
-password={{ DBPASSWORD }}
--- a/files/fedora-cloud/nova-ssh-config
+++ b/files/fedora-cloud/nova-ssh-config
@@ -1 +0,0 @@
-StrictHostKeyChecking no
--- a/files/fedora-cloud/openstack-nova-novncproxy
+++ b/files/fedora-cloud/openstack-nova-novncproxy
@@ -1,2 +0,0 @@
-# You may specify other parameters to the nova-novncproxy here
-OPTIONS="--novncproxy_host 209.132.184.9 --ssl_only"
--- a/files/fedora-cloud/packstack-controller-answers.txt
+++ b/files/fedora-cloud/packstack-controller-answers.txt
@@ -1,512 +0,0 @@
-[general]
-
-# Path to a Public key to install on servers. If a usable key has not
-# been installed on the remote servers the user will be prompted for a
-# password and this key will be installed so the password will not be
-# required again
-CONFIG_SSH_KEY=/root/.ssh/id_rsa.pub
-
-# Set to 'y' if you would like Packstack to install MySQL
-CONFIG_MARIADB_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack Image
-# Service (Glance)
-CONFIG_GLANCE_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack Block
-# Storage (Cinder)
-CONFIG_CINDER_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack Compute
-# (Nova)
-CONFIG_NOVA_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack
-# Networking (Neutron)
-CONFIG_NEUTRON_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack
-# Dashboard (Horizon)
-CONFIG_HORIZON_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack Object
-# Storage (Swift)
-CONFIG_SWIFT_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack
-# Metering (Ceilometer)
-CONFIG_CEILOMETER_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install OpenStack
-# Orchestration (Heat)
-CONFIG_HEAT_INSTALL=n
-
-# Set to 'y' if you would like Packstack to install the OpenStack
-# Client packages. An admin "rc" file will also be installed
-CONFIG_CLIENT_INSTALL=y
-
-# Comma separated list of NTP servers. Leave plain if Packstack
-# should not install ntpd on instances.
-CONFIG_NTP_SERVERS=
-
-# Set to 'y' if you would like Packstack to install Nagios to monitor
-# OpenStack hosts
-CONFIG_NAGIOS_INSTALL=n
-
-# Comma separated list of servers to be excluded from installation in
-# case you are running Packstack the second time with the same answer
-# file and don't want Packstack to touch these servers. Leave plain if
-# you don't need to exclude any server.
-EXCLUDE_SERVERS=
-
-# Set to 'y' if you want to run OpenStack services in debug mode.
-# Otherwise set to 'n'.
-CONFIG_DEBUG_MODE=n
-
-# Set to 'y' if you want to use VMware vCenter as hypervisor and
-# storageOtherwise set to 'n'.
-CONFIG_VMWARE_BACKEND=n
-
-# The IP address of the server on which to install MySQL
-CONFIG_MARIADB_HOST={{ controller_public_ip }}
-
-# Username for the MySQL admin user
-CONFIG_MARIADB_USER=root
-
-# Password for the MySQL admin user
-CONFIG_MARIADB_PW={{ DBPASSWORD }}
-
-# Set the server for the AMQP service
-CONFIG_AMQP_BACKEND=rabbitmq
-
-# The IP address of the server on which to install the AMQP service
-CONFIG_AMQP_HOST={{ controller_public_ip }}
-
-# Enable SSL for the AMQP service
-CONFIG_AMQP_ENABLE_SSL=n
-
-# Enable Authentication for the AMQP service
-CONFIG_AMQP_ENABLE_AUTH=y
-
-# The password for the NSS certificate database of the AMQP service
-CONFIG_AMQP_NSS_CERTDB_PW={{ CONFIG_AMQP_NSS_CERTDB_PW }}
-
-# The port in which the AMQP service listens to SSL connections
-CONFIG_AMQP_SSL_PORT=5671
-
-# The filename of the certificate that the AMQP service is going to
-# use
-CONFIG_AMQP_SSL_CERT_FILE=/etc/pki/tls/certs/fedorainfracloud.org.pem
-
-# The filename of the private key that the AMQP service is going to
-# use
-CONFIG_AMQP_SSL_KEY_FILE=/etc/pki/tls/private/fedorainfracloud.org.key
-
-# Auto Generates self signed SSL certificate and key
-CONFIG_AMQP_SSL_SELF_SIGNED=n
-
-# User for amqp authentication
-CONFIG_AMQP_AUTH_USER=amqp_user
-
-# Password for user authentication
-CONFIG_AMQP_AUTH_PASSWORD={{ CONFIG_AMQP_AUTH_PASSWORD }}
-
-# The password to use for the Keystone to access DB
-CONFIG_KEYSTONE_DB_PW={{ KEYSTONE_DBPASS }}
-
-# The token to use for the Keystone service api
-CONFIG_KEYSTONE_ADMIN_TOKEN={{ ADMIN_TOKEN }}
-
-# The password to use for the Keystone admin user
-CONFIG_KEYSTONE_ADMIN_PW={{ ADMIN_PASS }}
-
-# The password to use for the Keystone demo user
-CONFIG_KEYSTONE_DEMO_PW={{ DEMO_PASS }}
-
-# Kestone token format. Use either UUID or PKI
-CONFIG_KEYSTONE_TOKEN_FORMAT=PKI
-
-# The password to use for the Glance to access DB
-CONFIG_GLANCE_DB_PW={{ GLANCE_DBPASS }}
-
-# The password to use for the Glance to authenticate with Keystone
-CONFIG_GLANCE_KS_PW={{ GLANCE_PASS }}
-
-# The password to use for the Cinder to access DB
-CONFIG_CINDER_DB_PW={{ CINDER_DBPASS }}
-
-# The password to use for the Cinder to authenticate with Keystone
-CONFIG_CINDER_KS_PW={{ CINDER_PASS }}
-
-# The Cinder backend to use, valid options are: lvm, gluster, nfs,
-# vmdk
-CONFIG_CINDER_BACKEND=lvm
-
-# Create Cinder's volumes group. This should only be done for testing
-# on a proof-of-concept installation of Cinder.  This will create a
-# file-backed volume group and is not suitable for production usage.
-CONFIG_CINDER_VOLUMES_CREATE=n
-
-# Cinder's volumes group size. Note that actual volume size will be
-# extended with 3% more space for VG metadata.
-CONFIG_CINDER_VOLUMES_SIZE=5G
-
-# A single or comma separated list of gluster volume shares to mount,
-# eg: ip-address:/vol-name, domain:/vol-name
-CONFIG_CINDER_GLUSTER_MOUNTS=
-
-# A single or comma seprated list of NFS exports to mount, eg: ip-
-# address:/export-name
-CONFIG_CINDER_NFS_MOUNTS=
-
-# The IP address of the VMware vCenter datastore
-CONFIG_VCENTER_HOST=
-
-# The username to authenticate to VMware vCenter datastore
-CONFIG_VCENTER_USER=
-
-# The password to authenticate to VMware vCenter datastore
-CONFIG_VCENTER_PASSWORD=
-
-# A comma separated list of IP addresses on which to install the Nova
-# Compute services
-CONFIG_COMPUTE_HOSTS={{ controller_public_ip }}
-
-# The IP address of the server on which to install the Nova Conductor
-# service
-CONFIG_NOVA_CONDUCTOR_HOST={{ controller_public_ip }}
-
-# The password to use for the Nova to access DB
-CONFIG_NOVA_DB_PW={{ NOVA_DBPASS }}
-
-# The password to use for the Nova to authenticate with Keystone
-CONFIG_NOVA_KS_PW={{ NOVA_PASS }}
-
-# The overcommitment ratio for virtual to physical CPUs. Set to 1.0
-# to disable CPU overcommitment
-CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO=16.0
-
-# The overcommitment ratio for virtual to physical RAM. Set to 1.0 to
-# disable RAM overcommitment
-CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO=1.5
-
-# Private interface for Flat DHCP on the Nova compute servers
-CONFIG_NOVA_COMPUTE_PRIVIF=lo
-
-# The list of IP addresses of the server on which to install the Nova
-# Nova network manager
-CONFIG_NOVA_NETWORK_MANAGER=nova.network.manager.FlatDHCPManager
-
-# Public interface on the Nova network server
-CONFIG_NOVA_NETWORK_PUBIF=eth0
-
-# Private interface for network manager on the Nova network server
-CONFIG_NOVA_NETWORK_PRIVIF=eth1
-
-# IP Range for network manager
-CONFIG_NOVA_NETWORK_FIXEDRANGE={{ internal_interface_cidr }}
-
-# IP Range for Floating IP's
-CONFIG_NOVA_NETWORK_FLOATRANGE={{ public_interface_cidr }}
-
-# Name of the default floating pool to which the specified floating
-# ranges are added to
-CONFIG_NOVA_NETWORK_DEFAULTFLOATINGPOOL=external
-
-# Automatically assign a floating IP to new instances
-CONFIG_NOVA_NETWORK_AUTOASSIGNFLOATINGIP=n
-
-# First VLAN for private networks
-CONFIG_NOVA_NETWORK_VLAN_START=100
-
-# Number of networks to support
-CONFIG_NOVA_NETWORK_NUMBER=1
-
-# Number of addresses in each private subnet
-CONFIG_NOVA_NETWORK_SIZE=255
-
-# The IP address of the VMware vCenter server
-CONFIG_VCENTER_HOST=
-
-# The username to authenticate to VMware vCenter server
-CONFIG_VCENTER_USER=
-
-# The password to authenticate to VMware vCenter server
-CONFIG_VCENTER_PASSWORD=
-
-# The name of the vCenter cluster
-CONFIG_VCENTER_CLUSTER_NAME=
-
-# The password to use for Neutron to authenticate with Keystone
-CONFIG_NEUTRON_KS_PW={{ NEUTRON_PASS }}
-
-# The password to use for Neutron to access DB
-CONFIG_NEUTRON_DB_PW={{ NEUTRON_DBPASS }}
-
-# A comma separated list of IP addresses on which to install Neutron
-CONFIG_NETWORK_HOSTS={{ controller_public_ip }}
-
-# The name of the bridge that the Neutron L3 agent will use for
-# external traffic, or 'provider' if using provider networks
-CONFIG_NEUTRON_L3_EXT_BRIDGE=provider
-
-
-# The name of the L2 plugin to be used with Neutron
-CONFIG_NEUTRON_L2_PLUGIN=ml2
-
-# A comma separated list of IP addresses on which to install Neutron
-# metadata agent
-CONFIG_NEUTRON_METADATA_PW={{ NEUTRON_PASS }}
-
-# Set to 'y' if you would like Packstack to install Neutron LBaaS
-CONFIG_LBAAS_INSTALL=y
-
-# Set to 'y' if you would like Packstack to install Neutron L3
-# Metering agent
-CONFIG_NEUTRON_METERING_AGENT_INSTALL=y
-
-# Whether to configure neutron Firewall as a Service
-CONFIG_NEUTRON_FWAAS=y
-
-# A comma separated list of network type driver entrypoints to be
-# loaded from the neutron.ml2.type_drivers namespace.
-CONFIG_NEUTRON_ML2_TYPE_DRIVERS=local,flat,gre
-
-# A comma separated ordered list of network_types to allocate as
-# tenant networks. The value 'local' is only useful for single-box
-# testing but provides no connectivity between hosts.
-CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES=gre
-
-# A comma separated ordered list of networking mechanism driver
-# entrypoints to be loaded from the neutron.ml2.mechanism_drivers
-# namespace.
-CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS=openvswitch
-
-# A comma separated  list of physical_network names with which flat
-# networks can be created. Use * to allow flat networks with arbitrary
-# physical_network names.
-CONFIG_NEUTRON_ML2_FLAT_NETWORKS=*
-
-# A comma separated list of <physical_network>:<vlan_min>:<vlan_max>
-# or <physical_network> specifying physical_network names usable for
-# VLAN provider and tenant networks, as well as ranges of VLAN tags on
-# each available for allocation to tenant networks.
-CONFIG_NEUTRON_ML2_VLAN_RANGES=
-
-# A comma separated list of <tun_min>:<tun_max> tuples enumerating
-# ranges of GRE tunnel IDs that are available for tenant network
-# allocation. Should be an array with tun_max +1 - tun_min > 1000000
-CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES=1:1000
-
-# Multicast group for VXLAN. If unset, disables VXLAN enable sending
-# allocate broadcast traffic to this multicast group. When left
-# unconfigured, will disable multicast VXLAN mode. Should be an
-# Multicast IP (v4 or v6) address.
-CONFIG_NEUTRON_ML2_VXLAN_GROUP=
-
-# A comma separated list of <vni_min>:<vni_max> tuples enumerating
-# ranges of VXLAN VNI IDs that are available for tenant network
-# allocation. Min value is 0 and Max value is 16777215.
-CONFIG_NEUTRON_ML2_VNI_RANGES=
-
-# The name of the L2 agent to be used with Neutron
-CONFIG_NEUTRON_L2_AGENT=openvswitch
-
-# The type of network to allocate for tenant networks (eg. vlan,
-# local)
-CONFIG_NEUTRON_LB_TENANT_NETWORK_TYPE=gre
-
-# A comma separated list of VLAN ranges for the Neutron linuxbridge
-# plugin (eg. physnet1:1:4094,physnet2,physnet3:3000:3999)
-CONFIG_NEUTRON_LB_VLAN_RANGES=
-
-# A comma separated list of interface mappings for the Neutron
-# linuxbridge plugin (eg. physnet1:br-eth1,physnet2:br-eth2,physnet3
-# :br-eth3)
-CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS=
-
-# Type of network to allocate for tenant networks (eg. vlan, local,
-# gre, vxlan)
-CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE=gre
-
-# A comma separated list of VLAN ranges for the Neutron openvswitch
-# plugin (eg. physnet1:1:4094,physnet2,physnet3:3000:3999)
-CONFIG_NEUTRON_OVS_VLAN_RANGES=floatnet
-
-# A comma separated list of bridge mappings for the Neutron
-# openvswitch plugin (eg. physnet1:br-eth1,physnet2:br-eth2,physnet3
-# :br-eth3)
-CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS=floatnet:br-ex
-
-# A comma separated list of colon-separated OVS bridge:interface
-# pairs. The interface will be added to the associated bridge.
-CONFIG_NEUTRON_OVS_BRIDGE_IFACES=
-
-# A comma separated list of tunnel ranges for the Neutron openvswitch
-# plugin (eg. 1:1000)
-CONFIG_NEUTRON_OVS_TUNNEL_RANGES=1:1000
-
-# The interface for the OVS tunnel. Packstack will override the IP
-# address used for tunnels on this hypervisor to the IP found on the
-# specified interface. (eg. eth1)
-CONFIG_NEUTRON_OVS_TUNNEL_IF=eth1
-
-# VXLAN UDP port
-CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT=4789
-
-# To set up Horizon communication over https set this to "y"
-CONFIG_HORIZON_SSL=y
-
-# PEM encoded certificate to be used for ssl on the https server,
-# leave blank if one should be generated, this certificate should not
-# require a passphrase
-CONFIG_SSL_CERT=/etc/pki/tls/certs/fedorainfracloud.org.pem
-
-# PEM encoded CA certificates from which the certificate chain of the
-# # server certificate can be assembled.
-CONFIG_SSL_CACHAIN=/etc/pki/tls/certs/fedorainfracloud.org.digicert.pem
-
-# Keyfile corresponding to the certificate if one was entered
-CONFIG_SSL_KEY=/etc/pki/tls/private/fedorainfracloud.key
-
-# The password to use for the Swift to authenticate with Keystone
-CONFIG_SWIFT_KS_PW={{ SWIFT_PASS }}
-
-# A comma separated list of IP addresses on which to install the
-# Swift Storage services, each entry should take the format
-# <ipaddress>[/dev], for example 127.0.0.1/vdb will install /dev/vdb
-# on 127.0.0.1 as a swift storage device(packstack does not create the
-# filesystem, you must do this first), if /dev is omitted Packstack
-# will create a loopback device for a test setup
-CONFIG_SWIFT_STORAGES={{ swift_storages }}
-
-# Number of swift storage zones, this number MUST be no bigger than
-# the number of storage devices configured
-CONFIG_SWIFT_STORAGE_ZONES=1
-
-# Number of swift storage replicas, this number MUST be no bigger
-# than the number of storage zones configured
-CONFIG_SWIFT_STORAGE_REPLICAS=1
-
-# FileSystem type for storage nodes
-CONFIG_SWIFT_STORAGE_FSTYPE=ext4
-
-# Shared secret for Swift
-CONFIG_SWIFT_HASH={{ SWIFT_HASH }}
-
-# Size of the swift loopback file storage device
-CONFIG_SWIFT_STORAGE_SIZE=2G
-
-# Whether to provision for demo usage and testing. Note that
-# provisioning is only supported for all-in-one installations.
-CONFIG_PROVISION_DEMO=n
-
-# Whether to configure tempest for testing. Note that provisioning is
-# only supported for all-in-one installations.
-CONFIG_PROVISION_TEMPEST=n
-
-# The CIDR network address for the floating IP subnet
-CONFIG_PROVISION_DEMO_FLOATRANGE=
-
-# The uri of the tempest git repository to use
-CONFIG_PROVISION_TEMPEST_REPO_URI=https://github.com/openstack/tempest.git
-
-# The revision of the tempest git repository to use
-CONFIG_PROVISION_TEMPEST_REPO_REVISION=master
-
-# Whether to configure the ovs external bridge in an all-in-one
-# deployment
-CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE=n
-
-# The password used by Heat user to authenticate against MySQL
-CONFIG_HEAT_DB_PW={{ HEAT_DBPASS }}
-
-# The encryption key to use for authentication info in database
-CONFIG_HEAT_AUTH_ENC_KEY={{ HEAT_AUTH_ENC_KEY }}
-
-# The password to use for the Heat to authenticate with Keystone
-CONFIG_HEAT_KS_PW={{ HEAT_PASS }}
-
-# Set to 'y' if you would like Packstack to install Heat CloudWatch
-# API
-CONFIG_HEAT_CLOUDWATCH_INSTALL=n
-
-# Set to 'y' if you would like Packstack to install Heat
-# CloudFormation API
-CONFIG_HEAT_CFN_INSTALL=n
-
-# The IP address of the server on which to install Heat CloudWatch
-# API service
-CONFIG_HEAT_CLOUDWATCH_HOST={{ controller_public_ip }}
-
-# The IP address of the server on which to install Heat
-# CloudFormation API service
-CONFIG_HEAT_CFN_HOST={{ controller_public_ip }}
-
-# The IP address of the management node
-CONFIG_CONTROLLER_HOST={{ controller_public_ip }}
-
-# Secret key for signing metering messages.
-CONFIG_CEILOMETER_SECRET={{ CEILOMETER_SECRET }}
-
-# The password to use for Ceilometer to authenticate with Keystone
-CONFIG_CEILOMETER_KS_PW={{ CEILOMETER_PASS }}
-
-# The IP address of the server on which to install mongodb
-CONFIG_MONGODB_HOST=127.0.0.1
-
-# The password of the nagiosadmin user on the Nagios server
-CONFIG_NAGIOS_PW=
-
-# To subscribe each server to EPEL enter "y"
-CONFIG_USE_EPEL=y
-
-# A comma separated list of URLs to any additional yum repositories
-# to install
-CONFIG_REPO=
-
-# To subscribe each server with Red Hat subscription manager, include
-# this with CONFIG_RH_PW
-CONFIG_RH_USER=
-
-# To subscribe each server with Red Hat subscription manager, include
-# this with CONFIG_RH_USER
-CONFIG_RH_PW=
-
-# To subscribe each server to Red Hat Enterprise Linux 6 Server Beta
-# channel (only needed for Preview versions of RHOS) enter "y"
-CONFIG_RH_BETA_REPO=n
-
-# To subscribe each server with RHN Satellite,fill Satellite's URL
-# here. Note that either satellite's username/password or activation
-# key has to be provided
-CONFIG_SATELLITE_URL=
-
-# Username to access RHN Satellite
-CONFIG_SATELLITE_USER=
-
-# Password to access RHN Satellite
-CONFIG_SATELLITE_PW=
-
-# Activation key for subscription to RHN Satellite
-CONFIG_SATELLITE_AKEY=
-
-# Specify a path or URL to a SSL CA certificate to use
-CONFIG_SATELLITE_CACERT=
-
-# If required specify the profile name that should be used as an
-# identifier for the system in RHN Satellite
-CONFIG_SATELLITE_PROFILE=
-
-# Comma separated list of flags passed to rhnreg_ks. Valid flags are:
-# novirtinfo, norhnsd, nopackages
-CONFIG_SATELLITE_FLAGS=
-
-# Specify a HTTP proxy to use with RHN Satellite
-CONFIG_SATELLITE_PROXY=
-
-# Specify a username to use with an authenticated HTTP proxy
-CONFIG_SATELLITE_PROXY_USER=
-
-# Specify a password to use with an authenticated HTTP proxy.
-CONFIG_SATELLITE_PROXY_PW=
--- a/files/fedora-cloud/uninstall.sh
+++ b/files/fedora-cloud/uninstall.sh
@@ -1,32 +0,0 @@
-# Warning! Dangerous step! Destroys VMs
-# if you do know what you are doing feel free to remove the line below to proceed
-exit 1
-# also if you really insist to remove VM, uncomment that vgremove near bottom
-
-for x in $(virsh list --all | grep instance- | awk '{print $2}') ; do
-    virsh destroy $x ;
-    virsh undefine $x ;
-done ;
-
-# Warning! Dangerous step! Removes lots of packages, including many
-# which may be unrelated to RDO.
-yum remove -y nrpe "*openstack*" \
-"*nova*" "*keystone*" "*glance*" "*cinder*" "*swift*" \
-mysql mysql-server httpd "*memcache*" ;
-
-ps -ef | grep -i repli | grep swift | awk '{print $2}' | xargs kill ;
-
-# Warning! Dangerous step! Deletes local application data
-rm -rf /etc/nagios /etc/yum.repos.d/packstack_* /root/.my.cnf \
-/var/lib/mysql/* /var/lib/glance /var/lib/nova /etc/nova /etc/swift \
-/srv/node/device*/* /var/lib/cinder/ /etc/rsync.d/frag* \
-/var/cache/swift /var/log/keystone ;
-
-umount /srv/node/device* ;
-killall -9 dnsmasq tgtd httpd ;
-#vgremove -f cinder-volumes ;
-losetup -a | sed -e 's/:.*//g' | xargs losetup -d ;
-find /etc/pki/tls -name "ssl_ps*" | xargs rm -rf ;
-for x in $(df | grep "/lib/" | sed -e 's/.* //g') ; do
-    umount $x ;
-done
--- a/files/gnome/backup.sh
+++ b/files/gnome/backup.sh
@@ -12,6 +12,8 @@ MACHINES='signal.gnome.org
          chooser.gnome.org
          git.gnome.org
          webapps.gnome.org
+          socket.gnome.org
+          bugzilla-web.gnome.org
          progress.gnome.org
          clipboard.gnome.org
          cloud-ssh.gnome.org
@@ -27,10 +29,7 @@ MACHINES='signal.gnome.org
          puppet.gnome.org
          accelerator.gnome.org
          range.gnome.org
-          pentagon.gimp.org
-          account.gnome.org
-          bugzilla-new.gnome.org
-          socket.gnome.org'
+          pentagon.gimp.org'

 BACKUP_DIR='/fedora_backups/gnome/'
 LOGS_DIR='/fedora_backups/gnome/logs'
@@ -38,5 +37,4 @@ LOGS_DIR='/fedora_backups/gnome/logs'
 for MACHINE in $MACHINES; do
      rsync -avz -e 'ssh -F /usr/local/etc/gnome_ssh_config' --bwlimit=2000 $MACHINE:/etc/rsyncd/backup.exclude $BACKUP_DIR/excludes/$MACHINE.exclude
      rdiff-backup --remote-schema 'ssh -F /usr/local/etc/gnome_ssh_config %s rdiff-backup --server' --print-statistics --exclude-device-files --exclude /selinux --exclude /sys --exclude /proc --exclude-globbing-filelist $BACKUP_DIR/excludes/$MACHINE.exclude $MACHINE::/ $BACKUP_DIR/$MACHINE/ | mail -s "Daily backup: $MACHINE" backups@gnome.org
-      rdiff-backup --remove-older-than 6M --force $BACKUP_DIR/$MACHINE/
 done
--- a/files/hotfix/httpd/httpd.sysconfig.el7
+++ b/files/hotfix/httpd/httpd.sysconfig.el7
@@ -1,2 +0,0 @@
-export OPENSSL_NO_DEFAULT_ZLIB=1
-export PYTHONHASHSEED=random
--- a/files/hotfix/mirrorlist/mirrorlist_server.py
+++ b/files/hotfix/mirrorlist/mirrorlist_server.py
--- a/files/httpd/headers.conf.j2
+++ b/files/httpd/headers.conf.j2
@@ -1,3 +1,5 @@
 Header set AppTime "%D"
 PassEnv HOSTNAME
 Header set AppServer "{{ inventory_hostname }}"
+
+
--- a/files/httpd/newvirtualhost.conf.j2
+++ b/files/httpd/newvirtualhost.conf.j2
@@ -1,75 +0,0 @@
-<VirtualHost *:443>
-  # Change this to the domain which points to your host.
-  ServerName {{ item.name }}
-
-  # Use separate log files for the SSL virtual host; note that LogLevel
-  # is not inherited from httpd.conf.
-  ErrorLog logs/{{ item.name }}_error_log
-  TransferLog logs/{{ item.name }}_access_log
-  LogLevel warn
-
-  #   SSL Engine Switch:
-  #   Enable/Disable SSL for this virtual host.
-  SSLEngine on
-
-  #   SSL Protocol support:
-  # List the enable protocol levels with which clients will be able to
-  # connect.  Disable SSLv2 access by default:
-  SSLProtocol all -SSLv2
-
-  #   SSL Cipher Suite:
-  # List the ciphers that the client is permitted to negotiate.
-  # See the mod_ssl documentation for a complete list.
-  #SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
-  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
-
-  #   Server Certificate:
-  # Point SSLCertificateFile at a PEM encoded certificate.  If
-  # the certificate is encrypted, then you will be prompted for a
-  # pass phrase.  Note that a kill -HUP will prompt again.  A new
-  # certificate can be generated using the genkey(1) command.
-  SSLCertificateFile /etc/pki/tls/certs/{{ sslcertfile }}
-
-  #   Server Private Key:
-  #   If the key is not combined with the certificate, use this
-  #   directive to point at the key file.  Keep in mind that if
-  #   you've both a RSA and a DSA private key you can configure
-  #   both in parallel (to also allow the use of DSA ciphers, etc.)
-  SSLCertificateKeyFile /etc/pki/tls/private/{{ sslkeyfile }}
-
-  #   Server Certificate Chain:
-  #   Point SSLCertificateChainFile at a file containing the
-  #   concatenation of PEM encoded CA certificates which form the
-  #   certificate chain for the server certificate. Alternatively
-  #   the referenced file can be the same as SSLCertificateFile
-  #   when the CA certificates are directly appended to the server
-  #   certificate for convinience.
-  #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
-  {% if sslintermediatecertfile != '' %}
-  SSLCertificateChainFile /etc/pki/tls/certs/{{ sslintermediatecertfile }}
-  {% endif %}
-
-  #   Certificate Authority (CA):
-  #   Set the CA certificate verification path where to find CA
-  #   certificates for client authentication or alternatively one
-  #   huge file containing all of them (file must be PEM encoded)
-  #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
-
-  DocumentRoot {{ item.document_root }}
-
-  Options Indexes FollowSymLinks
-
-</VirtualHost>
-
-
-<VirtualHost *:80>
-  # Change this to the domain which points to your host.
-  ServerName {{ item.name }}
-  {% if sslonly %}
-    RewriteEngine On
-    RewriteCond %{HTTPS} off
-    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [NE]
-  {% else %}
-    Options Indexes FollowSymLinks
-  {% endif %}
-</VirtualHost>
--- a/files/iptables/iptables
+++ b/files/iptables/iptables
@@ -17,6 +17,12 @@
 # allow ssh - always
 -A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT

+# for fireball mode - allow port 5099 from lockbox and it's ips
+-A INPUT -p tcp -m tcp --dport 5099 -s 192.168.1.58 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.126.23 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.127.51 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 209.132.181.6 -j ACCEPT
+
 # for nrpe - allow it from nocs
 -A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
 # FIXME - this is the global nat-ip and we need the noc01-specific ip
--- a/files/iptables/iptables.staging
+++ b/files/iptables/iptables.staging
@@ -7,7 +7,7 @@
 # Redirect staging attempts to talk to the external proxy to an internal ip.
 # This is primarily for openid in staging which needs to get around proxy
 # redirects.
-A OUTPUT -d 209.132.181.5 -j DNAT --to-destination 10.5.126.88
+-A OUTPUT -d 209.132.181.14 -j DNAT --to-destination 10.5.126.89

 COMMIT

@@ -29,6 +29,12 @@ COMMIT
 # allow ssh - always
 -A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT

+# for fireball mode - allow port 5099 from lockbox and it's ips
+-A INPUT -p tcp -m tcp --dport 5099 -s 192.168.1.58 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.126.23 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.127.51 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 209.132.181.6 -j ACCEPT
+
 # for nrpe - allow it from nocs
 -A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
 # FIXME - this is the global nat-ip and we need the noc01-specific ip
--- a/files/jenkins/gitconfig
+++ b/files/jenkins/gitconfig
@@ -0,0 +1,4 @@
+[user]
+        email = sysadmin@fedoraproject.org
+        name = ${dist_tag} node - Fedora cloud
+
--- a/files/jenkins/jenkins-admin-keys
+++ b/files/jenkins/jenkins-admin-keys
@@ -0,0 +1,38 @@
+#ausil
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAD9QDskl41P2f4wqBuDBRD3VJ7MfKD6gMetMEaOy2b/CzfxN1vzeoxEvUxefi4+uh5b5ht5+BhQVhvBV7sTxxYftEH+B7IRmWigqcS1Ndnw+ML6zCbSTCJOqDvTLxmkZic0NUBIBP907ztMCoZjaOW9SSCrdA9Vp87V3x/KEQaeSNntmnFqtnpQI/N0NlmqxB78p97W/QDpLuftqJ33sM0uyvxXSusThLSFBHjisezsWox49nEKY8HW+Kwkmw+k7EF4tsDWymPB+S0gMsMlTxzjutNASVDmn6H+lgkzns+5Xxii4/mZWrcjqfLuH7vCI2mWykZJ6ek0LiQea9tNN+KZomqX6NbTUK3riaDPrZPNexa4I83Fp+DYNmYgnGMInqn+cZ5PoUJ3u3LaqZGBQeuuONTw0yQ8Pkkn5xibpPO6qblHKcet0pfmWQ5ab+5BDrsyLcPXolMci5h45GNWebr7UMuXT6+q+EolnYgbgDzzGJ4xPohF04OW8CwflK64KEnYcqlGs+DF4TNgGFlhKiyCWfXSjizmQusxn17ayi6+yrkiGeqfz72qyZ1pSKlwA8XRYC2VkAAquJP6zAtAKjCUdmRTSyYgCpoIAlMwBO07BiPLLov6lKdphZYY1DI7pTXA98fhVU04PDqJJYR1GKkttmCsjbRWnxjkPl/Zka1+ei3k9DNidT6j4hFj+uTj8SS70qZUtKLNpc5IcedHaGEK0vcXJm9lIEKBIEnN0PCLZCa4kQZnfdsbuep1fbXNf4WYPXea29aRKJc4hiqsdrccTp4KueHgWt1Jj6CZDZcFgX+NlUVWwk6djgjRzHUryExtsjCcgGMPRJWdUnVcpgkQ1qJhEXng3W+nFFboArWfwU8u1pXEdeE1Z+m+ows3nJHdEgQevyy/cUx6BPNPZkBh10MWskSV8Z+vb02vJB+QikRMwQs3Ywf6RMaZFrBkWD4FfUaU24f4wgtPQN7j5xxJ2rWLJ/s9ZOWSl9yrytC6ZUQwmayLmiPUdm4u/7ZZmaly39K1YWqFDl3eUrRAZwf1L/NAqFu/qcQQ3Xf20K0nI55nVbZ8ODyx6BtfwoioblnTEcehK0uud5Vamc5mfpErFY0agEecsc0sMZO+ky9pf/gCUdM7je7kMDI2hdx61fOa8Wypb5u9WNBWKRKx8xT1XUKhb2uFumm3sR1iNm1Qhj92mo/NO2aETOA1lsYSL0XK571Yy0iFK3X1nOqp/gCsEGLI8OPQk6XuFqv8hmfiIXNKV8IwuDStw7eIvuQIgT7bmMkj+1Ca25foSmg3w5FqJux1gO9t5F018LeQZ6LVlYHZaQnaN+eTU7KfoCozhWw1H9pprDz Dennis Gilmore
+
+#codeblock
+ssh-rsa AAAAB3NzaC1yc2EAAAABIwAACAEAstHxky7hl1inyHBy+q/9M+Aen2HSfy8IoW+sAO6HSuHEUT7qWB8AlSNjHhahjXx7sy/BUkUed+NB/177rjlThokZDJ0yoM9KKymp26ETGaamBSkWBxZatTj96BWfD0P2K9jc/9vxtgKBq3VK9UaOt6VtJ9q6mKY3DdWLZn+K6iGQAKMCAgd8cCMgD6epBB5/litz7WhYv+aYTyjZGUGbBojQUiWgXDv9lR7p0w+VP7pnZEeb3//k4pZhsPrKFwwRVRLxBvWgVKNvA6nMXmsdikHCLLj8YAevhEY1xAba+iCKOpTqT7Bu+1Fnb9St8u5iDod21gRmN7MGGWYsO+Iu2MNAW9sw2nsA/sdNR0HEEgBqJLhERjGv399fWKyiZaF90n59lg8Pb6EzE6wHRs6rSB+9uKApBzPk99BEHLvC6mhn6RjrOC+TWSTcmXojAwQYCadqIdgWUaBsxaugKEXBFcmRuDWtpDfsqmM1kjeGU6MiaMlqPW0KjsMaVVChLO5ZvB/T7qW4wr5ZjLri475MuHocCMP0ECSUk7I3YW2h8RU6FEFmTpuULFRQo01iPreY5XJ7l0+xy2eggAWo+X2h3nGjXhCPOelBg+LYe0WOmPgB5oc1m5HZtFTcFzYbhAE+xQKlbwNeYT8HmNmEMhPjVoNyOOV7NAap+ueS2u/7li5D59O5Iy8aa5n/WiuYfkqH4pG796nFyLr5L/LVudzyaYFb/Gk8C1j/NAWYw53D/9aOA277HHe5t0/daJhbo98u0asF5mvPld3swPuPqkEZzgUfmNgH5CkvcQcMzaOvj6qr6xNmQfgsHroCShb46kplQ2uSf1pMAqsjN7jGhk6l+Bu6hKHnJKhZJVLiuAZtgYvkCB1ahaO3wRVozA1VKCAlqHOqoCq4YLIobUL95H08Kwcz7vIRIadX1TkOoLb2EwPkE/xrhDp4BySh+j6YNklSBkiRHvJMBNnRIj8NTRjYyj2o1Om7kJ770lEdryg2og8QBaFWCmFkwzg1QVrBOuu0dN7kt2l7VI7Ib4lavKSVTrqUdxdSbthUlu/b4Qif+pbyEtUFgykRsHVs+5Ofg7FZpsgCJ8rLFjzeVF/hAYX7t3XaIPLu+DL8kzamb/CRy1b7+iAw9nJbd7ED2SGyU6+c2coMPG23y6+YxgEmNG/rkCLCypkEEDOZe4DuMerZQ/RxMo06+glC6HC/3VN2dHlVLtEEV33B04/6Z0plAhqtjG7PVs08f8a5msV/VYn5ifa4z0oIXX1r5CIg3Ejp1JguLhBHpWa7YbS2Mwu6GAbD+hQfCYrsUkFonoOLu5czpITLo7ceJFTQmAt7OxZEoZBfmtYfzADQsQVYQb6J4QwvM3iKJOn30dgtYnJOVlDZEn+0fivedxoBAt9jHJ8lVp2ov/dOFnimi5V+2QIMB0fKTkChsk10zsDZ/KUk6zfijjEju0WfjRHCd357KswNv3aXHazfRIw77S2UOenD+xmUDZ6WgnxservUSDNDz7NldLf/gdPOMO4uSwKZixzsoCNioeLEmQv4gomNK7DyZBLMHLlWlbliqP+QWuIJO1rfoH2vaxzzA7l5tJW1gfnxm87RrrwIf9v5kpdJM6gQZxqmBCRsKQd5VkrEJ/xaFfkv080pWNV0drWTZW8fAAgfUNYB260Hyk3rHsjQlVtQxGJ1aAcgjMi3eGKQMwptbUMYHqct75czX6xp6zgXPiC/glX6AtuiZQ5bOI07imil20ien/ks/dnel8L+dmYDasL9m0B2jZ3lbl3eR1Dy7UhqGyERx//vYQapEBuwFcqQ9UdIWCGGG2Pte1I39BSehUUGSCOOD38a/GCu0l7OWZKdwq80MK/Ixgz4neiZQZ7MD2wPy6vk6Num18PZPN7OynMrI2UG5MViQ0GAhRgxwbUCvc7uKnGRqZo9q2mCabCxLbv+hJ4bppxpHHJxMDDXilTKMfZb0YRbvjBUi7LFKLN3MBMK2U1jHE+PjBgweqF8Jtuw04CQMxK3unajZOVkYAIq8IdMbw0oBVP4++eGB9z0x1eH+IsqL6IgknbbyoMgQqW9/8atm8HW2QYCX47oPd4FHs8rgJZk3bz8MwN3tp8WCRtYnJuwkWGWSq77ans0Ycl/tUfSSwUjnSvMsJnuSbxvdX0XbP5eRWikk0pJz5lM9sjYFOPHrQ44/U254yBa0N6UhyNTQnMGzRvY+fADE49b10hXZwCCrxpY9KvGr1XNJMnMcUke+4p9RS5LUwcZ8A6v7oWtZaZwnuBzvKk+HAn2gevD7Stjto+TnRCx1qcbx8iOhAEC6nvbLl+U313TmawrO/usrI5w3EFKP/4BnlKJDtNBeklJ0MpU3R1fmisqfegjuBW2bbaxq8Uo6m7uqPsYuAl7E6rOyZHLbtA8szvbQ46MSqAHezqxHJajWn2oZXMtbddgO5vlkxbRp3SSVKaPOeIj3XOGl78Owp4gFNRE0RY2EuUvrwUhXZR4wx1VHYjS6o9HAwOx3dH+pf1OiblUEanLQ9HLuOBkLhP8wn1M2slsSw+A1gyuI0ayjRujYFXdw6Mqp6XKTdU8vNue2c3d0I+TMifBypP0oJtxXmEoPp/VsU9yLKA2FF7Xvv/Xq1gtZcuZWAbSwMok/ENY1xeIFyjV+0yBidmax3jaf9yus/XEpyeBS3iIz63ymU10Kb2vrWjubg/sa2yd+q0y96dLdDRbnbwGwMmg6mXvTlVXf8c= ricky@padlock01.home.elrod.me
+
+#jstanley
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDi5bNJQBrvT/YuvfLO0y6smZW5N+946uISkzmDi9myffLgHAZP4nBGeH/4GcB5ns9HJ19xVtbIwqOz4QwIqKh4gKU7DgaqND2Iu0bUUFL1KXPLGyAIW+9N3yHB+nKkH31alDnF4dpKkvO63DRkqh4ptxwEQbZDCFqn+vXuMnG4cPmDEweR3QZUt5m0Vc7HXzbehZxjUZ3xRWvT/pu+khBhJcRFkLlA60Fnqv7Q+MQP1C0Cpf3hiX1LcXUogXkNooAqx1YYRd8VqvI8e9yQW+a99x8FftnmXKlGCxP33ng6+U6Y2H7u3cRDrlRTbWqkry4SuUYo+6MtvZVgL0fw6PsZ jstanley@hawtness.rmrf.net
+
+#kevin
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJH1lA7WHRCbaFtvzbw0HxHYJstZjuXhax1+eL+SUJ5fFRGosEc4fLrSCP0gSFDfXmNzuspoBgcQTqnNO8FdIUwkJLDEu0vTQls1aT9YUXb+RVwKB7ULA3b1dqFkmOgLEjTJL9AplK4OJ9Su0kq6QBV4mXCxMsgEML/gn6r8muZmu2L/LdzUnxKKggyq7O5q1K/eW5Yy21fpvbHt2UPQX1f6gt4ty7E9Nnuhi7SHCI7fNIa+kHyIesfTm/SzeK/PY9rDwZKjuyS8o22GJXGEScJomK1cjMESH/J+t8Hffaj88BjGHNczvcnXAjq6y73VJQ9DiGLD4zmFquQMxDu0Tf kevin@jelerak.scrye.com
+
+#lmacken
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDefONrBaBJlCxKtDwkYWVhf96lMhRQfwVJyBoBd4Pk6TqKMlAu2eST1xRZlV4cJSxAWgZpOaFgqJ5EGd6mq8PvVk+mKXdtX7CAoWm4f3c6otUFsFDCTw3gVvYSlEk23XBHuACsbAVNL4HmP+9C7PxQBePukbMBFD2smsyQkPcX7lZw+lDJW5lOTz3dHAA92bcopDycxRDI99gGkawzjlmxpm2C9nhRabKS6mpGw3N64d8hwHkkFbtHY7rS0/0Cka0geYYYv0NVki1IIctkhZE9LndcWbVcVe1pIlR0RyW2sorfgCgoa5fRZZhukUCtspdv981h/0b87RpRVUJKuRd1 lmacken@tomservo
+
+#mdomsch
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCsmLoA/97DrE7roCHOY7NdB5TV/g7oxAsk74HgHcFRYAbn/rkoa7r9ZsgR7qzwd6Z+5Z77qFqvl1Bs3XtJf+1vJ3kwdcNFdKTw1DgTdE/rNPI7QzUgXKKKv/WCiU6UDBX4HHWq8Yuq4tkr/yepS8sLzMz2e0pHU4uWFQuvr5ttP9ABGohhDnPr0IcaT5vm+uBTJItJBrhqGws2fnVxhWEm8Y96AZb2vFZVwiMdcKKqfVZby3/wTuEtaDbv0krQNtLJcjaOTWLHWnxJEvLWSdFgkuIDvoNKR7ZV2lsmh5UD/smStgf8TkORR59r63dp2kWAn0/Jl59ARsdXDXGCiduF3GamxglTUA+kYbkN/PBQbl6o+nNKy4Q5TI53WNmhpdsbEJWCjzT+V1ju5JejFEHIhnWyBoBUWB2NKxWaSlToI2B9E0iJ0HK68IlA7bO4X7SD8q5cZBVTKMByFxt9uQXFeZeG7QRCPIsg6bXsirnFn5028iz+RfVFe3Mavp18v1hObvH6SDTczQauuAhTwYOtphaPZj+iHbaKvKndvlOWdGoyrNxgcx+t4loyEEcEWD0Astdp0bZD39nag94PD7hnoENOC0oE6mbtyUuSCGrU6ogee8qxYAt0AP3Rq1LLaRWXqe/1rM5A9oaDNwNkWA/JWbJbZQf0vvWTZmTib3rfew== mdomsch@fedoraproject.org
+
+#mmcgrath
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7U0WbKLL/D6iR03/vdDZJ8Lkj1jjAkindSvC4PkXVgi6qJo1YBZnIgsmoQopYcra2yzHFt58crygIh79P/rpQowWY99W+Sk4kB9UNuiAiX/LRi+1YdxwCKcRNTVOwuji6MGZoscACERmIjPY6P1oFPERoXhUkOuzPcrDK/0z/Bp9dpNRVZE/0zN6dvHA9QODLGvcFtgnX73SbZfoIbaVP/37IvOZvjGI1jxC5DwCmY+ihM13GpELP6BM8iihlnl1pjk1vtqPxD9g9Llr14Sc6cZJKl1WCulqhde4SEMOjpMJ8J8cGYBSsdh49hB36pdKQuTTnuCXpEt5Tl8PUKCrr mmcgrath@desktop.mmcgrath.net
+
+#notting
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3eVd6Ccegp1r1mhm7tPnlGUcw0zsAbR2p9hrFZ7RKxdIponuVV9ix4lgwpNEVDs0j4vxAApeLpJrsV8R8+YLUZO3Mzi+2s8nM8LXrKHtJT9wKKqoU3O/lC79drbWk3EMgETyP61Zpjkub0hwG2MjviPee63zCuRbxzxyalzk+AtwkRSxYaS2Ha0uKxGDiq1c/Iu6HRgm8HrtW+Pr6QbSSoHLhGUpR0HkgoC6852xXGhrRMkzXXbD9L6vaK9F39YmzD7Z8yey+xDTFW529avkEIWDeqBpbae+HjKqEQaBx71/rcmXhqKYrEagzUGpS8Bwskp3JMksd/v9tMuUhGQ2XaooCeKzvM0KnVUk/Q031ZtjNYxLpy/rEqbyt18+8wYOvVoGgnRZ/yJ/UVwYbGJrttYrrQmaJv7b357bkgDJobkIki+zGzi1xkvb85JWEt0mfh38H2vCnpwQtSAIyF/hmrS+1xsD/oAoc83IUhsVYcDhLbBEVKMX2IsJLMAPwCE6GexRYyVE5vEN4PMV9A8VmGuIC3IzkPEbStdtlbP4ttNKtfwS+MrY+ceAABDixls6xpedgT1he44R+7C1p+w4uj4TnYReLVce6+KgfJ6mz8CTXVULLWM4l2H3PylEUyoHGRDpVanGAvm7h2D0HgxErWIkjZkL79GFhzQc1xjzixQ== notting@nostromo.devel.redhat.com
+
+#ricky
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDAeAohiRJ2v/RO7R9GS93TF92Gc9ixK6HM7wlbMdlZ4yYAbeoEX8VpeNaSTfo/Nw3zazr9VpmpHg+H70K8ljQsPgRwcgpetRVpF55M5FYjqM5oM+N94HV3nSGcnWbSIho1R31DaDH2ptxVqgh2m5DG7Bc45w9Bd4wjfdQ8nBrGv93tuH7X/cee4g6GvexLm5nXhAngdEmiyxw5MHuJAvj+54l4wMXRWpeF6XlI2iamW42nLSfRMCFkGNiXvBm8zkfkeH2L7I2cNKXXoP/cPCd3G/teIsI9FDqYpZ6CS0zMkWhlTuh7rlCjc9+nJsLdDLgwhb75skiUOOfimGvCCxWeHuCsSL+KpCu4AgI9UAVgO6xblDlmbQXxlGopep29U/s00W/0qv3Zp8Ks4Za0xHdoIwHiaLM0OYymFaNDd3ZqFG0FN23ZjcGqUmFGhGfUQRDt72+e9HtXlBJ0mUaCX9+e4wFGTVciG1/5CKsLHCaLRf+knsWXrv2zcv9BoZ9SCAK32zCZw05wjcmr7jYDCTLmtC6kEBNaOeE9Qqi2oomo4ji8ybg+Qq+1BwOtJKExvmZaooBZud0qd24HmCU0/0ysw732jGcqexzxsCR0VArd+7LKexOD7KwMW0VUss6fdOWac9gwCLx9FaKYh8mVvcQjKhKGI3aO2sXRUWSbBJw8w== ricky@alpha.rzhou.org
+
+#smooge
+ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEAxnzCHH11nDM1m7yvqo6Uanq5vcZjBcs/mr3LccxwJ59ENzSXwUgEQy/P8vby9VKMwsskoaqZcvJdOSZBFhNV970NTPb69OIXPQAl/xhaLwiJOn606fB+/S8WepeuntS0qLiebbEiA9vIQLteZ+bWl1s/didD/sFo3/wItoTGA4GuShUu1AyWJx5Ue7Y34rwGR+kIvDoy2GHUcunn2PjGt4r3v2vpiR8GuK0JRupJAGYbYCiMBDRMkR0cgEyHW6+QQNqMlA6nRJjp94PcUMKaZK6Tc+6h5v8kLLtzuZ6ZupwMMC4X8sh85YcxqoW9DynrvO28pzaMNBHm7qr9LeY9PIhXscSa35GAcGZ7UwPK4aJAAuIzCf8BzazyvUM3Ye7GPCXHxUwY0kdXk+MHMVKFzZDChNp/ovgdhxNrw9Xzcs4yw7XYambN9Bk567cI6/tWcPuYLYD4ZJQP0qSXVzVgFEPss1lDcgd0k4if+pINyxM8eVFZVAqU+BMeDC+6W8HUUPgv6LiyTWs+xTXTuORwBTSF1pOqWB4LjqsCGIiMAc6n/xdALBGUN7qsuKDU6Q7bwPppaxypi4KCvuJsqW+8sDtMUaZ34I5Zo1q7cu03wqnOljUGoAY6IDn3J66F2KlPPyb/q3PDV3WbY/jnH16L29/xUA73nFUW1p+WXutwmSU= ssmoogen@ponyo.int.smoogespace.com
+
+#spot
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFZ3AD/I0OfU84IrK573amZptucuBrDxHoue/c+PUsD3MGIA6QXRceq3ZkLuz25OAAu53hFxzCE4d6eVS299rVR8Cd+tVU8aqBdTHzdqv52Vs8zRfXMW69sV7fhwRLaQDcRTwY90Wmz2MbZmN996XmJDNtUIWI2mML+PBYEdO0PyiB2ttb7mmA3SwtC/rwEMJL2YHh+bTzlJ9W4BgFcFwizMXU3mk5uGp2/q3nKzEvgTROM8yWvqdM34cRYpjFKyOlpo6k3SPt76hgDUEIsAu6Ul1S0FHTCRMIihcxZOSN4frMtXVjX0NhW9mKcn1IRBpzd0Yon/gPB8OJ31ojIIop spot@pterodactyl
+
+#toshio
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDfgKJEBuHFlFc8/IHDeIpdprNnAFQHkicXAFfAzIJSkhUaOJFjsulmgPZn2TJJpYqFAxYUjhWJOdrOwx7AHSg6gWu4TT4a0sTay+Z0eqZOShf5UL/M587DxJk1JZU8g812yDKZMc7Sv7K6zdteONnCvno1kALSg0F2MVMJXFjE/tSontkIRH6IuG19R19NGEj1h56uGwdfe78xjOmv5wk6RZBjaOKqiPSQKNqCKbY9Kyz6yrem2M5uxRK45u3wSPJdmopo8l/nwf0p6ydrUSL5C/aXGh7LPqh31eTBDQUbWHw9LQMk1SibMGQPwJt59lLMlzc5OQZAJEbadsDAgl6VVA6MZkBQROiK9E087kvPesMoGWE0KBgvTqzpBZj0uHATP9i097dv80gjupMyaePsnQOxk0wRho9nRkxRo18Drt3QPVND4YGHzahMe/YR2N83MkbnGoP8K+GsFhLMAp3NKh6yUofFxTgRiB6H8ULKf3CV+hlk0Z9RJR3CpgMTKILYHPlaleJqoP6sXg6tJxI0rUE+0jUKvaTj+N2gX0MjKfUINk5mTbjD2mdVrPtKOBvos2luNhY5nTDpJuAHQqnFHPlPw8l3lXC2VBWOjqfTeeS+qD7ArKe6F7IO5ZNxJ2mTUuodhaPySta1MS37DWoz6UqeJu+wKIsHok90+EU4aAvUABh3RXSQA1E3IaxkooMhhrdIQO6K4L0M+CZ7lP35sW5pnwsN4sFlPec9Xn5e15LTlb9yFlx7Nm4DE2SX1s9QyMRE7z0LNO0X7wiihojuyQM6OQwc+ZaaDw5HerBisX/3LcC9osVLQQg1pt91YcCczUQ08qfUJV6aOD962K+EGzVFQGGauJDzgEH9BHQg7QwCWr0f3mu8/TNBzys2c0YsywDUc3AT1KP6TEJcR/dy6WbhJD3qyO/BLfCzRrHUOIaz+WbwmfTX8tGEQnVV5sEkZ39PWA1hRQ83b3MNV8cRJl+h/FnTk62yM4ZqGu73+x8JiEG3HAJp9/xYfNSwg8++PojJBXe+yM6DrTh5fTnBhxatLEKB658p8jTqJtF4+YD9D8+L39xEns6GQ7FphNqTC6IcpXyqq+zNuzF7vs/T+5n7978dUs3sK6YpBX4BlDxK6MsRF1WYqajEVeBJEMwdX2rfGkN9B5GfWdmdrzBjZQ6yyvlx5Dg++qgxpMiVOXSnw5v7H03PrT1we9wKre/2SQ1A2Oq/UDt/7tR2cMLoaPDNBpFT1W44LJB7o9iDT9YHUG3dC7R8JoeJ5YjyFmxbUQ5xg1oHnrBaPrGCuEYdQWhuDmp9Px2yRu8Agxzr9rNCZ/W8nWJVmvwvlXoldrum2rAECx0wiWqBhQ/+eX65 badger@unaka.lan
+
+#pingou
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2xAeq5uO72kY4mSFgFl9ZSveiAqe4tUv8hemrxwZH+w24RFOGrW1nOV+hjQhRpYVNwvqJkrd9N7VY/HXkd9df2AgQyYoiVfeMPTA7lB0/e/S1Bd6XGdWudvqRU1O6Rug0j3RQOuz7WDJgnanBVcBl8+X7EaPGpv9aILgh6CJDOVAO2GgaFdzI7CHtR99CMqNG7BsQF8C9Y8ALK+8HOPRE0R1wzgaAw85HTo0gyIWcrZqr4HI/QDuLjUQ6AZSgzE7dTiwZuFnUjLBnL0YP1bxJglt9IFx6r6jvdp/yMD+Bn/91WvmBL/AD+GIQ/ZydoeLo+JQW22ibiX/SzdAE4Cd3 FedoraProject
--- a/files/jenkins/master/config.xml
+++ b/files/jenkins/master/config.xml
@@ -0,0 +1,119 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<hudson>
+  <disabledAdministrativeMonitors/>
+  <version>1.486</version>
+  <numExecutors>0</numExecutors>
+  <mode>NORMAL</mode>
+  <useSecurity>true</useSecurity>
+  <authorizationStrategy
+  class="hudson.security.ProjectMatrixAuthorizationStrategy">
+    <permission>hudson.model.Hudson.Administer:sysadmin-jenkins</permission>
+    <permission>hudson.model.Hudson.ConfigureUpdateCenter:sysadmin-jenkins</permission>
+    <permission>hudson.model.Hudson.Read:sysadmin-jenkins</permission>
+    <permission>hudson.model.Hudson.Read:anonymous</permission>
+    <permission>hudson.model.Hudson.RunScripts:sysadmin-jenkins</permission>
+    <permission>hudson.model.Item.Read:anonymous</permission>
+  </authorizationStrategy>
+  <securityRealm class="hudson.plugins.openid.OpenIdSsoSecurityRealm"
+  plugin="openid@1.5">
+    <endpoint>http://id.fedoraproject.org/</endpoint>
+  </securityRealm>
+  <projectNamingStrategy
+class="jenkins.model.ProjectNamingStrategy$DefaultProjectNamingStrategy"/>
+  <workspaceDir>${ITEM_ROOTDIR}/workspace</workspaceDir>
+  <buildsDir>${ITEM_ROOTDIR}/builds</buildsDir>
+  <markupFormatter class="hudson.markup.RawHtmlMarkupFormatter">
+    <disableSyntaxHighlighting>false</disableSyntaxHighlighting>
+  </markupFormatter>
+  <jdks/>
+  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
+  <myViewsTabBar class="hudson.views.DefaultMyViewsTabBar"/>
+  <clouds/>
+  <slaves>
+    <slave>
+      <name>Fedora19</name>
+      <description></description>
+      <remoteFS>/mnt/jenkins/</remoteFS>
+      <numExecutors>2</numExecutors>
+      <mode>NORMAL</mode>
+      <retentionStrategy class="hudson.slaves.RetentionStrategy$Always"/>
+      <launcher class="hudson.plugins.sshslaves.SSHLauncher"
+      plugin="ssh-slaves@0.21">
+        <host>172.16.5.12</host>
+        <port>22</port>
+        <credentialsId>d844d352-af1d-466b-9fc9-cbb19348103a</credentialsId>
+      </launcher>
+      <label></label>
+      <nodeProperties/>
+    </slave>
+    <slave>
+      <name>EL6</name>
+      <description></description>
+      <remoteFS>/mnt/jenkins/</remoteFS>
+      <numExecutors>2</numExecutors>
+      <mode>NORMAL</mode>
+      <retentionStrategy class="hudson.slaves.RetentionStrategy$Always"/>
+      <launcher class="hudson.plugins.sshslaves.SSHLauncher"
+      plugin="ssh-slaves@0.21">
+        <host>172.16.5.10</host>
+        <port>22</port>
+        <credentialsId>950d5dd7-acb2-402a-8670-21f152d04928</credentialsId>
+      </launcher>
+      <label></label>
+      <nodeProperties/>
+    </slave>
+    <slave>
+       <name>Fedora20</name>
+       <description></description>
+       <remoteFS>/mnt/jenkins/</remoteFS>
+       <numExecutors>2</numExecutors>
+       <mode>NORMAL</mode>
+       <retentionStrategy class="hudson.slaves.RetentionStrategy$Always"/>
+       <launcher class="hudson.plugins.sshslaves.SSHLauncher"
+       plugin="ssh-slaves@0.21">
+         <host>172.16.5.23</host>
+         <port>22</port>
+         <credentialsId>950d5dd7-acb2-402a-8670-21f152d04928</credentialsId>
+       </launcher>
+       <label></label>
+       <nodeProperties/>
+     </slave>
+     <slave>
+        <name>EL7-beta</name>
+        <description></description>
+        <remoteFS>/mnt/jenkins/</remoteFS>
+        <numExecutors>2</numExecutors>
+        <mode>NORMAL</mode>
+        <retentionStrategy class="hudson.slaves.RetentionStrategy$Always"/>
+        <launcher class="hudson.plugins.sshslaves.SSHLauncher"
+        plugin="ssh-slaves@0.21">
+          <host>172.16.5.14</host>
+          <port>22</port>
+          <credentialsId>950d5dd7-acb2-402a-8670-21f152d04928</credentialsId>
+        </launcher>
+        <label></label>
+        <nodeProperties/>
+      </slave>
+  </slaves>
+  <quietPeriod>5</quietPeriod>
+  <scmCheckoutRetryCount>0</scmCheckoutRetryCount>
+  <views>
+    <hudson.model.AllView>
+      <owner class="hudson" reference="../../.."/>
+      <name>All</name>
+      <filterExecutors>false</filterExecutors>
+      <filterQueue>false</filterQueue>
+      <properties class="hudson.model.View$PropertyList"/>
+    </hudson.model.AllView>
+  </views>
+  <primaryView>All</primaryView>
+  <slaveAgentPort>0</slaveAgentPort>
+  <label></label>
+  <crumbIssuer class="hudson.security.csrf.DefaultCrumbIssuer">
+    <excludeClientIPFromCrumb>false</excludeClientIPFromCrumb>
+    <PROXY__HEADER>X-Forwarded-For</PROXY__HEADER>
+  </crumbIssuer>
+  <nodeProperties/>
+  <globalNodeProperties/>
+</hudson>
+
--- a/files/jenkins/master/hudson.plugins.git.GitSCM.xml
+++ b/files/jenkins/master/hudson.plugins.git.GitSCM.xml
@@ -0,0 +1,8 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<hudson.plugins.git.GitSCM_-DescriptorImpl plugin="git@1.1.25">
+  <helpRedirect/>
+  <generation>1</generation>
+  <globalConfigName>jenkins @ fedora infr</globalConfigName>
+  <globalConfigEmail>infrastructure@fedoraproject.org</globalConfigEmail>
+  <createAccountBasedOnEmail>false</createAccountBasedOnEmail>
+</hudson.plugins.git.GitSCM_-DescriptorImpl>
--- a/files/jenkins/master/hudson.plugins.warnings.WarningsPublisher.xml
+++ b/files/jenkins/master/hudson.plugins.warnings.WarningsPublisher.xml
@@ -0,0 +1,22 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!-- plugin requested by user rholy (ticket #4175) -->
+<hudson.plugins.warnings.WarningsDescriptor plugin="warnings@4.39">
+  <groovyParsers>
+    <hudson.plugins.warnings.GroovyParser>
+      <name>pyflakes</name>
+      <regexp>^(.*):([0-9]*):(.*)$</regexp>
+      <script>import hudson.plugins.warnings.parser.Warning
+import hudson.plugins.analysis.util.model.Priority
+
+String fileName = matcher.group(1)
+String category = &quot;PyFlakes Error&quot;
+String lineNumber = matcher.group(2)
+String message = matcher.group(3)
+
+return new Warning(fileName, Integer.parseInt(lineNumber), category, &quot;PyFlakes Parser&quot;, message, Priority.NORMAL);</script>
+      <example></example>
+      <linkName>https://pypi.python.org/pypi/pyflakes</linkName>
+      <trendName>pyflakes errors</trendName>
+    </hudson.plugins.warnings.GroovyParser>
+  </groovyParsers>
+</hudson.plugins.warnings.WarningsDescriptor>
--- a/roles/jenkins/master/files/hudson.tasks.Mailer.xml
+++ b/roles/jenkins/master/files/hudson.tasks.Mailer.xml
@@ -1,8 +1,8 @@
 <?xml version='1.0' encoding='UTF-8'?>
-<hudson.tasks.Mailer_-DescriptorImpl plugin="mailer@1.15">
+<hudson.tasks.Mailer_-DescriptorImpl>
  <helpRedirect/>
  <defaultSuffix>@fedoraproject.org</defaultSuffix>
-  <hudsonUrl>http://jenkins.fedorainfracloud.org/</hudsonUrl>
+  <hudsonUrl>http://jenkins.cloud.fedoraproject.org/</hudsonUrl>
  <adminAddress>jenkins@fedoraproject.org</adminAddress>
  <smtpHost>localhost</smtpHost>
  <useSsl>false</useSsl>
--- a/files/jenkins/master/hudson.triggers.SCMTrigger.xml
+++ b/files/jenkins/master/hudson.triggers.SCMTrigger.xml
@@ -0,0 +1,6 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<hudson.triggers.SCMTrigger_-DescriptorImpl>
+  <helpRedirect/>
+  <synchronousPolling>false</synchronousPolling>
+  <maximumThreads>0</maximumThreads>
+</hudson.triggers.SCMTrigger_-DescriptorImpl>
--- a/files/jenkins/master/jenkins-apache.conf
+++ b/files/jenkins/master/jenkins-apache.conf
@@ -0,0 +1,9 @@
+ProxyPass         /  http://localhost:8080/
+ProxyPassReverse  /  http://localhost:8080/
+ProxyRequests     Off
+
+# Local reverse proxy authorization override
+<Proxy http://localhost:8080/*>
+  Order deny,allow
+  Allow from all
+</Proxy>
--- a/files/jenkins/master/jenkins-ci.org.key
+++ b/files/jenkins/master/jenkins-ci.org.key
@@ -0,0 +1,112 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.9 (GNU/Linux)
+
+mQGiBEmFQG0RBACXScOxb6BTV6rQE/tcJopAEWsdvmE0jNIRWjDDzB7HovX6Anrq
+n7+Vq4spAReSFbBVaYiiOx2cGDymj2dyx2i9NAI/9/cQXJOU+RPdDzHVlO1Edksp
+5rKn0cGPWY5sLxRf8s/tO5oyKgwCVgTaB5a8gBHaoGms3nNC4YYf+lqlpwCgjbti
+3u1iMIx6Rs+dG0+xw1oi5FUD/2tLJMx7vCUQHhPRupeYFPoD8vWpcbGb5nHfHi4U
+8/x4qZspAIwvXtGw0UBHildGpqe9onp22Syadn/7JgMWhHoFw5Ke/rTMlxREL7pa
+TiXuagD2G84tjJ66oJP1FigslJzrnG61y85V7THL61OFqDg6IOP4onbsdqHby4VD
+zZj9A/9uQxIn5250AGLNpARStAcNPJNJbHOQuv0iF3vnG8uO7/oscB0TYb8/juxr
+hs9GdSN0U0BxENR+8KWy5lttpqLMKlKRknQYy34UstQiyFgAQ9Epncu9uIbVDgWt
+y7utnqXN033EyYkcWx5EhLAgHkC7wSzeSWABV3JSXN7CeeOif7QiS29oc3VrZSBL
+YXdhZ3VjaGkgPGtrQGtvaHN1a2Uub3JnPohjBBMRAgAjAhsDBgsJCAcDAgQVAggD
+BBYCAwECHgECF4AFAko/7vYCGQEACgkQm30y8tUFguabhgCgi54IQR4rpJZ/uUHe
+ZB879zUWTQwAniQDBO+Zly7Fsvm0Mcvqvl02UzxCtC1Lb2hzdWtlIEthd2FndWNo
+aSA8a29oc3VrZS5rYXdhZ3VjaGlAc3VuLmNvbT6IYAQTEQIAIAUCSj/qbQIbAwYL
+CQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEJt9MvLVBYLm38gAoIGR2+TQeJaCeEa8
+CQhZYzDoiJkQAJ0cpmD+0VA+leOAr5LEccNVd70Z/dHNy83JARAAAQEAAAAAAAAA
+AAAAAAD/2P/gABBKRklGAAEBAQBgAGAAAP/hAGBFeGlmAABJSSoACAAAAAQAMQEC
+ABkAAAA+AAAAEFEBAAEAAAABQ5AAEVEEAAEAAAASCwAAElEEAAEAAAASCwAAAAAA
+AE1hY3JvbWVkaWEgRmlyZXdvcmtzIDQuMAAA/9sAQwAIBgYHBgUIBwcHCQkICgwU
+DQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy
+/9sAQwEJCQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy
+MjIyMjIyMjIyMjIyMjIyMjIyMjIy/8AAEQgArgCWAwEiAAIRAQMRAf/EAB8AAAEF
+AQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQEC
+AwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkq
+NDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqS
+k5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk
+5ebn6Onq8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkK
+C//EALURAAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGx
+wQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFla
+Y2RlZmdoaWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2
+t7i5usLDxMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwDAQAC
+EQMRAD8A9wEj/wB9vzpfMf8Avt+dRinCpGSeY398/nS72/vH86YKBQBJvb+8fzpd
+7f3j+dMFLQA/e394/nS7j6n86ZSimA7cfU07cfU1HnFOFADtx9aXJ9TTKUUxD8n1
+pc+9Mp1AC5ozSUtAC0maKKADNFJ2ooAoCnCmilzWZQ6lFJSimAopaQUtAC54rOvN
+dsLCTZPPGrdwXAry/wCKHxXfRppND0Mq16Bie5PIi9lHdv5V8/X+rXt/O8tzcyyy
+MclnYkk0avYdl1PqPxT8VtH8NwqwzdXEuSkaHoB61wjftCXhlzHosBjHZpSCa8PW
+O7uhuAkcDueaaYbhOqMMe1L5lcvWx9U+FPjJ4f8AEU0dpdhtLvXOFWdgY3PoH6fg
+cV6MrZGa+EklIOJOPqK9i+G3xem0TytI8QSSXGnHCQXJO57f2Pqn6indrclq+x9G
+5pwNVoLiO4hSaGRZIpFDKynIYHuKmBqyB+aWmg0uaAFopKKAFoozRQBQFLSUorMo
+UUtJSigB1ZHijWovD/hu+1KZlUQxErnu3YfnWsK8k+Pt60PhaxtAxAnuOQO4UE0P
+YaWp8/Xd1LeTz3Mzl5pnLuxPJJNa+i+HDclZZ1yp5C1Q0axa+1BEx8i8mvS7S3WG
+NQo6elcWLxDprljuelgsOp+/IgtdCiVFVYx07CnXHhyNgflA/Ct+1BwOKmkVq8xS
+m9bnr2S0sec6n4UVo2KKNw6Vx9xby2U3lSAj617NcR5J4zmua1/Q4r+1JVQJU5Ui
+uzD4qUXyz2OHFYWM1zR3Ol+CHj0xXX/CKajMTHKd1g7H7r94/oeo9wR3r3tWr4ht
+pZtNv4bmElZ7eVZUIOPmU5/pX2dpOpR6tpFnqMQxHdQpMoz03DOK9ePY8OaszUDU
+oFNSg0yUOopKWgAoo6mikBRpwptLWZY4UoptLTELXin7QbD7PoiFv45Gx+Ar2uv
+FP2g7dfsejXOfm8x48evGf6UmNbnm3hCBls57sJuYnYg9TXSyW2uIgNpJbs5GWDj
+gewrP8EJu0XIHKyNV2+j1txM0MzIQV8oIQN3POSenHTg15VSV6z2+Z7dGNqKt26G
+hpeo6rC3lajZxKOgdG6/hW5NcoIC4HOOhrmbJb1IokuZWkfbmUsQQGz2xW5OAbAE
+Y3d/es5TtJo6oRbjcx7uXVryXbblIIv723JqN9PuUdLhJ2aQf6xW6OP6VBqS6jcQ
+sLS4aOQHCqH2qVx64znP8verWn2d/DKrPOzxbFBWQ5O7HJyOxParv7t7oxcfeasz
+z3xBaC01uZV4RxvAr6X+F0rv8NdCMj7iICAfQBjgV87+NYzHr6jHHlA/rX0H8LFa
+P4baLu3DMTHDDtvOPwr1sM7xR4mK0m/U7lTUyniqyGp1NbtHOmSUuaaDS1JQuaKS
+ikBTpaQUVmUOpabS0xC15f8AF7wxc+IEsJI3VI4Nyrkfxtjn6YH616hWL4ptDd6B
+cBTh0+cH0xUVL8j5dzSk0prm2PD/AAnYvp+ltazDbNHM6yD3BrpEiWToOKzPLktr
+mRiSwlO7J9atQ3bFsCvGnJSlzM+gpLlXKJcpDAegGT+ZqYgPYAgVnz3DpKW8pJW6
+AM2MUranci38vy4gBz/9alGF3dG0ppKzZYs0ilB4BwauOixggVlW9w8sivsWJuhC
+nOanmun83bimtNCZPS5g6/osOta3Zq8giRImMjeoyMAe5Oa940SxTStFsbCM/JbQ
+JGv0AryTTLRLzXIwwDOWVAvfGecCvZx19q9fAttPyPBzCyatuyyhqZTxVdDU612M
+4ESg04GowacDUFjqKQc0UDKlLSUtZFC0UUCmAtMmiSeF4pBlHBVh7U6imI878Y+G
+rbTbGC7tFf5WKyFmz1rimZoy2wZJGQBXter2C6lpc9qw++vy/XtXiMoe3upLeTiS
+Nipry8XSUJJpaHq4Os5JpvUoC4uJr1rYIkJC7vMuGCgj2rZ/4Ry/aHzvtdltO4Ei
+TPTH+NUrhFlUB1yQODVB8RjyRboR6hiAfqM4rCLTPR6aSt8rktzJc2l7HZgRXLOu
+4SQPkKPU1fUtu3SHJUc/WqlvGIULKo3kdhgCr+lwfb9ZtLItxLIAx9upp25pKKMq
+klFN3PTfDenR2mjWbtEvnsm8sVG4buevXpit1aiUAcAYHapVr6GMVGKij5iUnKTk
+ydKnU1ClSikwRIKcD60wU4GpLQ7PpRSUUhlaikpc1kWLRSUUxC5ozSZozTA5Txn8
+QtF8DxRDUDLPeTDdFaQAFyucbiTwo+vXsK8huNZHiVJddtbY2/mysfJL7iAD0JwM
+1h/F+X7V8RtUKybzEUj5PTCjj8KseD2S304WbzxPJ9/CsDjcM4/DvXLjF+6TXc7M
+F/EafY1YNThkVcttccMpqY3trtx8ufeoJbK3acrLECPcUsmj2EUYfyw27kcmvOjY
+9NuS6kc+pxp8seWc8Koq7pWox+HLiHWdQSR0gO90jALYxjAzjnmsxbnTbCXMssMK
+r6nk/h1rH17xLY3lpJa25dw4wWxgfrW9KnOU04owqziotSZ7r4S8daT4xFwunpcR
+S24DPHOoBweMjBOa6pDXzn8JNej0nxdFbSKqwX6/ZtzHG1s5U59yMfjX0SpwcGvc
+Wp4MlZltDUoNV42qYGpYIlFOzUYNOBqSx4opBzRSArUtNqrqWqWOj2D32pXcVrap
+96WVsDPoO5PsOayNC5TXkWKJpZHVI0GWd2AVR7k9K8Z8R/HTazweHNPBHQXd4Ovu
+sY/9mP4V5Trvi7XPETltW1S4uVzkRM2I1+iDCj8qtRYWPfvEXxh8L6GJIrWZ9Vu1
+48u1/wBWD7yHj8s15Jr/AMYfFGtyOlvdDS7c5xFZnace7n5j+n0rz1n3Hmmk4zzV
+KKFcdNPI7s0jM7sxZmY5LE9ST61CsrI25SQR3BwacWzwRUZX0qiblgaheq25bucH
+18w086tqDrta9uCvp5hqng56UDmp5I9iueXcmDsxyzEn1JqROvNQKD7VKCqDJOas
+kuRuMgjp711+n/FHxVpyIsWqNPHEAojukWQEe5PP61wvnEj0B4ApykZJJ7UDPfvD
+Hxp0+/dLfXbYWMp4E8RLxH6jqv616laXtve26XFrPFPC/KyRsGU/iK+MBICcDitn
+QPFWseHbvztMv5YM/eTOUb6qeDRcXKj7CV8ing1434V+NtpezR2niC3W0Y8fa4cm
+PP8AtL1H1Ga9atrqG6gSe3mjmhcZSSNgysPYikTZouCiow4xRRYLmRr+tW/h7Qrv
+Vbkbo7dCwQHBdugUfU4r5Y8TeKtV8Tak15qlwztk+XEDiOFf7qL2H6nvXr3x01n7
+Po2n6SjfNcymaQf7K8D9T+leBzPuT3H8qiC0NHoNeYnvURc4phPNITmrJuLu5pSa
+Z3pRyKYhM80oOaaetAoAkzwKTd6Cm5pBQA8EnqTijOSeOKaT2oHSgY7cTTg1Rilp
+AS7/AGpc4UA96iHJApXbk0wJ0kOeDXTeGPGer+GbtZNOunWMnLwscxv9V/ya5T7q
+D1NOEhQYHU9/Siw0z7A8KeJ7XxToceo2ymNs7JoicmNx1HuOcg0V5j8A9RQnWNKl
+lVARHcruOOfut/7LRTViJaPQ5b42agbrx29uGytrAiAehPJ/nXmrNu2H14NdD481
+A6j401S6zkPMQPoOP6VzQOcj0OaiGxctxpNA5obqfrQKokSlWkzQDzQAMOaSnN1F
+JQAtFFFAAKKKO9AC0UlGaBj0HemjlvrTkOEY03vQIe7YJP4CkTBfn6mkbkA/Wkzg
+YHU9aYGtpl7Pau8kEzxMwwShwcUVUtWIU4oqbXLTFv3M0jSkksWJP481SU/Pk1Ym
+b7/1FViMY96diWKwy5+tITTm+7mo6BC0DrR2oHWgB7dBTac3SmUALS0lKOtACUua
+KKACm0vSk70ASLxF9TSYzznrQf8AVqKTPH40wHHHQfjTM55pTwp9+KQdKALEL7Is
+poph4Cr6Cigdz//2YhgBBMRAgAgBQJKP/cgAhsDBgsJCAcDAgQVAggDBBYCAwEC
+HgECF4AACgkQm30y8tUFgua3awCdFQlChLgn/n4tb4jLe1RgxOxHxosAn2Cn2oNh
+sZ91wUb4d5JuH88TCupsuQINBEmFQG0QCADqAXWgiis4yi96os3QZmK5809ojjTT
+nlICgbztrT55cMVTDBc9SneyRQlC0cS+M1z4Do6lj81sNJdJiBPqTYYA1+exTFvs
+5zCxPInDP3hvqXxHTP142XN1hdzt53R7smn8O0wyO+RCBUb44e9NkusvBd5UP3Je
+449hnpXJ4WO3cVMFm4ghxs7ERlpAi5NTEsVVdM8dqHbZJtk8gbzdAHH0ybiAXmWy
+LFGZDuuKiFAkqm/Wled7id6N+cPx107dwBclwPxzfEYKEqJ1YDDHoDlyfx4012y1
+53e5sGyah/IPBYrrLMfG+Wmiwr5nCX0tmwOcyukuE94hbzJCX2wBdbWLAAMGCACz
+l3cuM4lGt/wr5liM4gotXpZAopY+EnbLIBuOHFXXR7HnyAgST1jH/AUbafvPjyDh
+EkFDyUP14XtHNIAqsN1UpuyYbM90bMPAWXJxrazMsSF+Tv5yIxHiy4cc1pjoqHA2
+kwqIGHmTxYzOPOS19ZWQAtevoTE6pCARphY0dzpscCWaXGs/ZqNAhjL96WLYV1Oo
+Ut+9mTnOcs6Vuxaxp2wN2S5DK1S9gdIxWEc8wMUPiQe8CYk0OySdORIblMs3bGqD
+FoM5HcBAZP1YlXitPH2nIRv0DtOQGMQOCkqUWmQuQAUgKV+YO86lO4S7EhTET/GP
+sQb6P7efm/Cs8wbq/wyIiEkEGBECAAkFAkmFQG0CGwwACgkQm30y8tUFgua2mACe
+JNBW4snDC4OzjKU6QT386/GA9ssAn3vLzSwn8N1xv5MihWGr5kVzvaE2
+=cjdq
+-----END PGP PUBLIC KEY BLOCK-----
--- a/files/jenkins/master/jenkins.repo
+++ b/files/jenkins/master/jenkins.repo
@@ -0,0 +1,5 @@
+[jenkins]
+name=Jenkins
+baseurl=http://pkg.jenkins-ci.org/redhat
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-jenkins-ci.org
--- a/files/jenkins/master/plugins/bazaar.hpi
+++ b/files/jenkins/master/plugins/bazaar.hpi
--- a/files/jenkins/master/plugins/chucknorris.hpi
+++ b/files/jenkins/master/plugins/chucknorris.hpi
--- a/files/jenkins/master/plugins/cobertura.hpi
+++ b/files/jenkins/master/plugins/cobertura.hpi
--- a/files/jenkins/master/plugins/cvs.hpi
+++ b/files/jenkins/master/plugins/cvs.hpi
--- a/files/jenkins/master/plugins/external-monitor-job.hpi
+++ b/files/jenkins/master/plugins/external-monitor-job.hpi
--- a/files/jenkins/master/plugins/git-client.hpi
+++ b/files/jenkins/master/plugins/git-client.hpi
--- a/files/jenkins/master/plugins/git.hpi
+++ b/files/jenkins/master/plugins/git.hpi
--- a/files/jenkins/master/plugins/instant-messaging.hpi
+++ b/files/jenkins/master/plugins/instant-messaging.hpi
--- a/files/jenkins/master/plugins/ldap.hpi
+++ b/files/jenkins/master/plugins/ldap.hpi
--- a/files/jenkins/master/plugins/maven-plugin.hpi
+++ b/files/jenkins/master/plugins/maven-plugin.hpi
--- a/files/jenkins/master/plugins/mercurial.hpi
+++ b/files/jenkins/master/plugins/mercurial.hpi
--- a/files/jenkins/master/plugins/openid.hpi
+++ b/files/jenkins/master/plugins/openid.hpi
--- a/files/jenkins/master/plugins/python.hpi
+++ b/files/jenkins/master/plugins/python.hpi
--- a/files/jenkins/master/plugins/scm-api.hpi
+++ b/files/jenkins/master/plugins/scm-api.hpi
--- a/files/jenkins/master/plugins/ssh-agent.hpi
+++ b/files/jenkins/master/plugins/ssh-agent.hpi
--- a/files/jenkins/master/plugins/subversion.hpi
+++ b/files/jenkins/master/plugins/subversion.hpi
--- a/files/jenkins/master/plugins/translation.hpi
+++ b/files/jenkins/master/plugins/translation.hpi
--- a/files/jenkins/master/plugins/violations.hpi
+++ b/files/jenkins/master/plugins/violations.hpi
--- a/files/jenkins/master/plugins/xunit.hpi
+++ b/files/jenkins/master/plugins/xunit.hpi
--- a/files/jenkins/slaves/sbt.repo
+++ b/files/jenkins/slaves/sbt.repo
@@ -0,0 +1,6 @@
+[sbt-fedorapeople]
+name=SBT Fedorapeople Repo
+baseurl=http://repos.fedorapeople.org/repos/codeblock/sbt/fedora-18/RPMS/
+enabled=1
+skip_if_unavailable=1
+gpgcheck=0
--- a/roles/base/files/ssh/sshd_config.23
+++ b/roles/base/files/ssh/sshd_config.23
@@ -1,26 +1,22 @@
-#	$OpenBSD: sshd_config,v 1.89 2013/02/06 00:20:42 dtucker Exp $
+#	$OpenBSD: sshd_config,v 1.84 2011/05/23 03:30:07 djm Exp $

 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.

-# This sshd was compiled with PATH=/usr/local/bin:/usr/bin
+# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

 # The strategy used for options in the default sshd_config shipped with
 # OpenSSH is to specify options with their default value where
 # possible, but leave them commented.  Uncommented options override the
 # default value.

-# If you want to change the port on a SELinux system, you have to tell
-# SELinux about this change.
-# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
-#
 #Port 22
 #AddressFamily any
 #ListenAddress 0.0.0.0
 #ListenAddress ::

 # The default requires explicit activation of protocol 1
-Protocol 2
+#Protocol 2

 # HostKey for protocol version 1
 #HostKey /etc/ssh/ssh_host_key
@@ -42,10 +38,8 @@ SyslogFacility AUTHPRIV
 # Authentication:

 #LoginGraceTime 2m
-PermitRootLogin without-password
-StrictModes yes
-PasswordAuthentication no
-
+#PermitRootLogin yes
+#StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10

@@ -56,10 +50,8 @@ PasswordAuthentication no
 # but this is overridden so installations will only check .ssh/authorized_keys
 AuthorizedKeysFile	.ssh/authorized_keys

-#AuthorizedPrincipalsFile none
-
 #AuthorizedKeysCommand none
-#AuthorizedKeysCommandUser nobody
+#AuthorizedKeysCommandRunAs nobody

 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
 #RhostsRSAAuthentication no
@@ -71,6 +63,13 @@ AuthorizedKeysFile	.ssh/authorized_keys
 # Don't read the user's ~/.rhosts and ~/.shosts files
 #IgnoreRhosts yes

+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication no
+PasswordAuthentication yes
+#PermitEmptyPasswords no
+AllowUsers jenkins_slave root
+
+
 # Change to no to disable s/key passwords
 #ChallengeResponseAuthentication yes
 ChallengeResponseAuthentication no
@@ -115,7 +114,7 @@ X11Forwarding yes
 #PrintLastLog yes
 #TCPKeepAlive yes
 #UseLogin no
-UsePrivilegeSeparation sandbox		# Default for new installations.
+#UsePrivilegeSeparation yes
 #PermitUserEnvironment no
 #Compression delayed
 #ClientAliveInterval 0
@@ -123,10 +122,9 @@ UsePrivilegeSeparation sandbox		# Default for new installations.
 #ShowPatchLevel no
 #UseDNS yes
 #PidFile /var/run/sshd.pid
-#MaxStartups 10:30:100
+#MaxStartups 10
 #PermitTunnel no
 #ChrootDirectory none
-#VersionAddendum none

 # no default banner path
 #Banner none
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Patrick Uiterwijk	e35e850ad3	Merge branch 'openvpn_handler' of /git/ansible into openvpn_handler	2014-08-02 15:00:10 +00:00
Patrick Uiterwijk	2c5755dbc4	Add nagios to trusted openid roots	2014-08-02 15:00:06 +00:00
				`@@ -0,0 +1 @@`
				`in this dir is where we put all the configs for the copr frontend`
				`@@ -1,2 +0,0 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCv8WqXOuL78Rd7ZvDqoi84M7uRV3uueXTXtvlPdyNQBzIBmxh+spw9IhtoR+FlzgQQ1MN4B7YVLTGki6QDxWDM5jgTVfzxTh/HTg7kJ31HbM1/jDuBK7HMfay2BGx/HCqS2oxIBgIBwIMQAU93jBZUxNyYWvO+5TiU35IHEkYOtHyGYtTtuGCopYRQoAAOIVIIzzDbPvopojCBF5cMYglR/G02YgWM7hMpQ9IqEttLctLmpg6ckcp/sDTHV/8CbXbrSN6pOYxn1YutOgC9MHNmxC1joMH18qkwvSnzXaeVNh4PBWnm1f3KVTSZXKuewPThc3fk2sozgM9BH6KmZoKl`
				`@@ -1 +0,0 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA1sBKROSJ3rzI0IlBkM926Dvpiw3a4wYSys0ZeKRohWZg369ilZkUkRhsy0g4JU85lt6rxf5JLwURF+fWBEohauF1Uvklc25LdZpRS3IBQPaXvWeM8lygQQomFc0Df6iUbCYFWnEWMjKd7FGYX3DgOZLnG8tV2vX7jFjqitsh5LRAbmghUBRarw/ix4CFx7+VIeKCBkAybviQIW828N1IqJC6/e7v6/QStpblYpCFPqMflXhQ/KS2D043Yy/uUjmOjMWwOMFS6Qk+py1C0mDU0TUptFYwDP5o9IK/c5HaccmOl2IyUPB1/RCtTfOn6wXPRTMUU+5w+TcPH6MPvvuiSQ== root@lockbox01.phx2.fedoraproject.org`