Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/puppet/kandra/templates/teleport_node.yaml.template...

43 lines
1.0 KiB
Plaintext
Raw Normal View History

puppet: Add a teleport node on every host. Teleport nodes[1] are the equivalent to SSH servers. In addition to this config, joining the teleport cluster will require presenting a one-time "join token" from the proxy server[2], which may either be short-lived or static. [1] https://goteleport.com/docs/architecture/nodes/ [2] https://goteleport.com/docs/admin-guide/#adding-nodes-to-the-cluster
2021-06-02 03:43:49 +02:00
# See https://goteleport.com/docs/config-reference/
teleport:
ca_pin: "sha256:df15ba56d56227e288ce183d7eee77a6bef552aaaa5dc25f0f5ea56494ce14c6"
auth_servers:
puppet: Add a teleport application server. This requires switching to a reverse tunnel for the auth connection, with the side effect that the `zulip_ops::teleport::node` manifest can be applied on servers anywhere in the Internet; they do not need to have any publicly-available open ports.
2021-06-02 03:44:37 +02:00
# Use the proxy address, to support running the app_service, which requires
# a reverse tunnel.
- teleport.zulipchat.net:443
puppet: Use IAM join method, when possible.
2024-01-30 20:55:29 +01:00
<% if @is_ec2 -%>
join_params:
method: iam
token_name: iam-token
<% else -%>
join_params:
method: token
token_name: <%= @join_token %>
<% end %>
puppet: Add a teleport node on every host. Teleport nodes[1] are the equivalent to SSH servers. In addition to this config, joining the teleport cluster will require presenting a one-time "join token" from the proxy server[2], which may either be short-lived or static. [1] https://goteleport.com/docs/architecture/nodes/ [2] https://goteleport.com/docs/admin-guide/#adding-nodes-to-the-cluster
2021-06-02 03:43:49 +02:00
ssh_service:
enabled: "yes"
commands:
- name: hostname
puppet: Provide more attributes to teleport on ssh nodes.
2022-01-12 02:16:55 +01:00
command: ["/bin/hostname"]
period: 1h0m0s
- name: uname
command: ["/usr/bin/uptrack-uname", "-r"]
period: 1h0m0s
- name: distro
setup-apt-repos: Don’t install lsb_release. Signed-off-by: Anders Kaseorg <anders@zulip.com>
2022-02-12 22:55:07 +01:00
command:
["/bin/sh", "-c", '. /etc/os-release && printf "%s\n" "$PRETTY_NAME"']
puppet: Provide more attributes to teleport on ssh nodes.
2022-01-12 02:16:55 +01:00
period: 1h0m0s
- name: classes
command:
- /usr/bin/crudini
- --get
- /etc/zulip/zulip.conf
- machine
- puppet_classes
puppet: Add a teleport node on every host. Teleport nodes[1] are the equivalent to SSH servers. In addition to this config, joining the teleport cluster will require presenting a one-time "join token" from the proxy server[2], which may either be short-lived or static. [1] https://goteleport.com/docs/architecture/nodes/ [2] https://goteleport.com/docs/admin-guide/#adding-nodes-to-the-cluster
2021-06-02 03:43:49 +02:00
period: 1h0m0s
proxy_service:
enabled: no
auth_service:
enabled: no