mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-05-12 10:56:20 +08:00
dbbf94a411
Almost global anyway, i.e. inside the VPN. The ipa/client-based shell access and sudo rules are only effective for staging right now, the respective playbook bits are masked out for prod. - Assign Ansible host groups to IPA host groups, the latter don't care about 'stg' in the name and use dashes rather than underscores. - Distill shell access groups from fas_client_groups in group and host vars. - Let all `sysadmin-*` groups in the previous list run anything via sudo in the host group (except bastion & batcave). - Remove `fas_client_groups` from staging host and group vars. - Remove sudoers from staging host and group vars if only `sysadmin-*` groups have shell access. - Set up `ipa_client_shell_groups` on bastion to be a super set of the same on batcave. Newly created IPA host groups: - autosign - badges - basset - bastion - batcave - blockerbugs - bodhi - bugzilla2fedmsg - busgateway - datagrepper - dbserver - dns - fedimg - github2fedmsg - ipa - kernel-qa - kerneltest - kojibuilder - kojihub - kojipkgs - logging - mailman - memcached - mirrormanager - nagios - notifs - oci-registry - odcs - openqa - openqa-workers - osbs - packages - pdc-web - pkgs - proxies - rabbitmq - releng-compose - resultsdb - secondary - sign-bridge - sundries - value - wiki Signed-off-by: Nils Philippsen <nils@redhat.com>
28 lines
598 B
Plaintext
28 lines
598 B
Plaintext
---
|
|
# Define resources for this group of hosts here.
|
|
lvm_size: 30000
|
|
mem_size: 6144
|
|
num_cpus: 2
|
|
|
|
tcp_ports: [ 80, 88, 389, 443, 464, 636 ]
|
|
|
|
custom_rules: [
|
|
'-A INPUT -p udp -m udp -s 10.5.0.0/16 --dport 53 -j ACCEPT'
|
|
]
|
|
|
|
fas_client_groups: sysadmin-main,sysadmin-accounts
|
|
|
|
ipa_host_group: ipa
|
|
ipa_host_group_desc: IPA service
|
|
ipa_client_shell_groups:
|
|
- sysadmin-accounts
|
|
ipa_client_sudo_groups:
|
|
- sysadmin-accounts
|
|
|
|
nrpe_procs_warn: 300
|
|
nrpe_procs_crit: 500
|
|
|
|
ipa_initial: false
|
|
ipa_dm_password: "{{ ipa_prod_dm_password }}"
|
|
ipa_ldap_socket: ldapi://%2fvar%2frun%2fslapd-FEDORAPROJECT-ORG.socket
|