root@louvre:~# sudo udevadm test-builtin net_id /sys/class/net/eth2
calling: test-builtin
=== trie on-disk ===
tool version:          232
file size:         8441068 bytes
header size             80 bytes
strings            1846908 bytes
nodes              6594080 bytes
Load module index
Found container virtualization none
timestamp of '/etc/systemd/network' changed
timestamp of '/lib/systemd/network' changed
Parsed configuration file /lib/systemd/network/99-default.link
Created link configuration context.
ID_NET_NAME_MAC=enxecf4bbdd4222
ID_OUI_FROM_DATABASE=Dell Inc.
ID_NET_NAME_ONBOARD=eno3
ID_NET_LABEL_ONBOARD=enNIC3
ID_NET_NAME_PATH=enp1s0f2
Unload module index
Unloaded link configuration context.
root@louvre:~# sudo udevadm test-builtin net_id /sys/class/net/eth3
calling: test-builtin
=== trie on-disk ===
tool version:          232
file size:         8441068 bytes
header size             80 bytes
strings            1846908 bytes
nodes              6594080 bytes
Load module index
Found container virtualization none
timestamp of '/etc/systemd/network' changed
timestamp of '/lib/systemd/network' changed
Parsed configuration file /lib/systemd/network/99-default.link
Created link configuration context.
ID_NET_NAME_MAC=enxecf4bbdd4223
ID_OUI_FROM_DATABASE=Dell Inc.
ID_NET_NAME_ONBOARD=eno4
ID_NET_LABEL_ONBOARD=enNIC4
ID_NET_NAME_PATH=enp1s0f3
Unload module index
Unloaded link configuration context.

Jul 10 2019, 3:58 PM · System administration

olasd added a comment to T1894: De-containerify uffizi.

I'm not 100% certain about the config of the array management interfaces as the system is going to move to predictable interface names that I'm not quite sure how to predict...

Jul 10 2019, 3:56 PM · System administration

olasd updated the task description for T1894: De-containerify uffizi.

Jul 10 2019, 3:54 PM · System administration

olasd updated the task description for T1894: De-containerify uffizi.

Jul 10 2019, 3:09 PM · System administration

olasd updated the task description for T1894: De-containerify uffizi.

Jul 10 2019, 2:57 PM · System administration

olasd accepted D1713: Increase rate-limit for swh_api_origin_visit_latest..

Jul 10 2019, 2:45 PM

olasd added a comment to T1895: De-baremetalify louvre.

In T1895#35134, @douardda wrote:

For backup centralization, it can stay there for now I guess.

Jul 10 2019, 2:12 PM · System administration

Jul 9 2019

olasd committed rSPSITE0385e58a7ea6: Revert "Bump icinga2 to 2.1.1" (authored by olasd).

Revert "Bump icinga2 to 2.1.1"

Jul 9 2019, 7:37 PM

olasd added a reverting change for rSPSITEed401102a1ab: Bump icinga2 to 2.1.1: rSPSITE0385e58a7ea6: Revert "Bump icinga2 to 2.1.1".

Jul 9 2019, 7:37 PM

olasd committed rSPSITEed401102a1ab: Bump icinga2 to 2.1.1 (authored by olasd).

Bump icinga2 to 2.1.1

Jul 9 2019, 7:30 PM

olasd committed rSPSITEdf46526953aa: Bump apt to 7.0.1 (authored by olasd).

Bump apt to 7.0.1

Jul 9 2019, 7:16 PM

olasd committed rSPSITE327bf8bb5de8: Make louvre.internal.softwareheritage.org a new node (authored by olasd).

Make louvre.internal.softwareheritage.org a new node

Jul 9 2019, 7:04 PM

olasd added a comment to T1895: De-baremetalify louvre.

In T1895#35132, @olasd wrote:

I've setup a new virtual machine (aptly called "louvre") and I've given it the following setup:

bare buster install, two network interfaces (private one with a temp ip address, public one unplugged)

openvpn installed and config copied over from the original louvre (/etc/openvpn)

regenerated larger dh parameters so it would start

strongswan installed and config copied over from louvre (/etc/ipsec.secrets and /etc/ipsec.conf)

network config copied over from louvre and trimmed down

Looks like both services start up properly (and hiccup because the public ip address isn't really working yet).
To actually switch network related stuff over:

give current-louvre a new internal ip address

stop openvpn and strongswan on current-louvre

remove current-louvre's 100.1 and public ip addresses

clean up current-louvre's firewall config

add a new default route to 100.1 on current-louvre

reboot new-louvre with its new network setup

This should only be a minute or two downtime.

Jul 9 2019, 7:03 PM · System administration

olasd added a comment to T1895: De-baremetalify louvre.

I've setup a new virtual machine (aptly called "louvre") and I've given it the following setup:

bare buster install, two network interfaces (private one with a temp ip address, public one unplugged)
openvpn installed and config copied over from the original louvre (/etc/openvpn)
- regenerated larger dh parameters so it would start
strongswan installed and config copied over from louvre (/etc/ipsec.secrets and /etc/ipsec.conf)
network config copied over from louvre and trimmed down

Jul 9 2019, 6:29 PM · System administration

olasd added a comment to T1876: staging infra: Configure DNS zones.

So, internal-staging.softwareheritage.org feels like a really long base domain name, but I don't have a snappy alternative suggestion that gives me warm fuzzies.

Jul 9 2019, 5:34 PM · System administration

Jul 8 2019

olasd added a comment to T979: Migrate TLS certificates away from the *.softwareheritage.org wildcards.

I've now started work on refactoring the way we do Apache Virtual hosts in puppet, but it's still somewhat of a mess with the number of settings that still vary across hosts.

Jul 8 2019, 7:02 PM · System administration

olasd updated the task description for T979: Migrate TLS certificates away from the *.softwareheritage.org wildcards.

Jul 8 2019, 7:00 PM · System administration

olasd added a comment to T1895: De-baremetalify louvre.

I've moved the clustershell setup to pergamon, by installing the clustershell command then copying the following files over:

Jul 8 2019, 5:58 PM · System administration

olasd changed the status of T1895: De-baremetalify louvre from Open to Work in Progress.

I've done the first step of this, which is separating louvre from the rest of the proxmox cluster, following the instructions on https://pve.proxmox.com/wiki/Cluster_Manager#_remove_a_cluster_node.

Jul 8 2019, 5:45 PM · System administration

olasd changed the status of T1895: De-baremetalify louvre, a subtask of T1894: De-containerify uffizi, from Open to Work in Progress.

Jul 8 2019, 5:45 PM · System administration

olasd updated the task description for T1894: De-containerify uffizi.

Jul 8 2019, 3:47 PM · System administration

olasd updated the task description for T1894: De-containerify uffizi.

Jul 8 2019, 2:55 PM · System administration

olasd updated the task description for T1894: De-containerify uffizi.

Jul 8 2019, 2:51 PM · System administration

olasd triaged T1895: De-baremetalify louvre as High priority.

Jul 8 2019, 2:44 PM · System administration

olasd triaged T1894: De-containerify uffizi as High priority.

Jul 8 2019, 2:13 PM · System administration

olasd triaged T1893: Prepare the addition of the new storage array on 2019-07-12 as High priority.

Jul 8 2019, 2:11 PM · System administration

olasd updated the task description for T1891: Make 'type' an attribute of origin visits, not origins.

Jul 8 2019, 2:07 PM

Jul 5 2019

olasd committed rSPSITE5ba3bc25130e: letsencrypt_gandi_paas: only push each cert once (authored by olasd).

letsencrypt_gandi_paas: only push each cert once

Jul 5 2019, 9:17 AM

olasd committed rSPSITE5bee98485726: Push more TLS certificates on Gandi infrastructure (authored by olasd).

Push more TLS certificates on Gandi infrastructure

Jul 5 2019, 9:14 AM

Jul 4 2019

olasd added a comment to T979: Migrate TLS certificates away from the *.softwareheritage.org wildcards.

In T979#34731, @olasd wrote:

After swapping in some memories from the Gandi simple hosting stuff, it's possible to upload certificates to Gandi using the legacy XML-RPC API. There's no explicit linking of certificates between the certificates API and the PaaS API, and ISTR that the PaaS stuff just picks up certificates automatically once uploaded.

Jul 4 2019, 5:53 PM · System administration

olasd updated the task description for T979: Migrate TLS certificates away from the *.softwareheritage.org wildcards.

Jul 4 2019, 5:52 PM · System administration

olasd committed rSPSITE40c5992608c5: letsencrypt: support extra options in deploy hooks (authored by olasd).

letsencrypt: support extra options in deploy hooks

Jul 4 2019, 5:26 PM

olasd committed rSPSITEd42413f88cfd: letsencrypt_gandi_paas: Use the proper signature for the rpc command (authored by olasd).

letsencrypt_gandi_paas: Use the proper signature for the rpc command

Jul 4 2019, 5:17 PM

olasd committed rSPSITEc03b2381a437: Add a Let's Encrypt hook to push certificates to Gandi's XML-RPC (authored by olasd).

Add a Let's Encrypt hook to push certificates to Gandi's XML-RPC

Jul 4 2019, 5:07 PM

olasd committed rSPSITE1acc70a5e20e: letsencrypt: Dynamically load deploy hooks (authored by olasd).

letsencrypt: Dynamically load deploy hooks

Jul 4 2019, 5:07 PM

olasd committed rSPPRIVC52250f2ef77c: Add censored production gandi xmlrpc key (authored by olasd).

Add censored production gandi xmlrpc key

Jul 4 2019, 5:00 PM

olasd committed rSPSITE1415e8c0eec7: Drop most mentions of "latest" packages (authored by olasd).

Drop most mentions of "latest" packages

Jul 4 2019, 4:09 PM

olasd added a comment to T979: Migrate TLS certificates away from the *.softwareheritage.org wildcards.

After swapping in some memories from the Gandi simple hosting stuff, it's possible to upload certificates to Gandi using the legacy XML-RPC API. There's no explicit linking of certificates between the certificates API and the PaaS API, and ISTR that the PaaS stuff just picks up certificates automatically once uploaded.

Jul 4 2019, 9:14 AM · System administration