Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
56,377 Commits 28 Branches 143 Tags 615 MiB
Commit Graph

1641 Commits

Author SHA1 Message Date
Alex Vandiver 3d63a87384 kandra: Puppet github.com keys to both root and zulip users. 
We update to add the ecdsa-sha2-nistp256 key as well.
 2024-02-07 10:42:12 -08:00
Alex Vandiver b1f899512a pack-local-script: Match mode of file outside of packing. 2024-02-07 10:42:12 -08:00
Alex Vandiver 927660a7b6 kandra: Remove munin. 2024-02-06 21:34:56 -08:00
Alex Vandiver 96d237d57e kandra: Pull in known_hosts to the nagios user. 
This prevents failures when new hosts are initially added to the
configuration.
 2024-02-07 00:02:40 -05:00
Alex Vandiver 2cbd9c2a47 kandra: Update default chrony configuration for 22.04. 2024-02-07 00:02:32 -05:00
Alex Vandiver b23d90ed62 puppet: Rename puppet/zulip_ops to puppet/kandra. 
This makes for easier tab-completion, and also is a bit more explicit
about the expected consumer.
 2024-02-06 17:56:27 -08:00
Alex Vandiver ccc106dca3 puppet: Add redis host to ~redistunnel/.ssh/known_hosts. 2024-02-06 11:34:09 -08:00
Alex Vandiver aaf3eb514d puppet: Allow controlling known_hosts. 
Note that this uses `ssh-keyscan` to write in the currently-observed
host fingerprint; if DNS or network is untrusted during initial puppet
apply, this can allow attackers to write their own host key, obviating
the utility of known_hosts.

We do not view this as a likely attack mechanism, since in our
deployment the network and DNS is almost certainly trusted, and if
not, the timing attack to catch only initial configuration is likely
impossible.
 2024-02-06 11:34:09 -08:00
Alex Vandiver fe1fd30a58 puppet: Create redistunnel group. 
This was left off of 1fe5e7c7da.
 2024-02-05 12:15:15 -08:00
Alex Vandiver dc950235e5 puppet: Raise net.core.somaxconn on redis. 2024-02-02 17:54:02 -08:00
Alex Vandiver ec59b4fd78 puppet: Enact redis' kernel config suggestions. 2024-02-02 17:54:02 -08:00
Alex Vandiver 069f262e7b puppet: Inline all sysctl settings, and always check for containers. 2024-02-02 17:54:02 -08:00
Alex Vandiver fd69f5f8e2 puppet: Call systemd reload after adding or changing a teleport service. 2024-02-02 17:54:02 -08:00
Alex Vandiver 1ac6e24eaa puppet: Rename exec resource of systemd_daemon_reload. 
This makes it easier to put as a "notify" resource.
 2024-02-02 17:54:02 -08:00
Alex Vandiver 4947753bfd puppet: Remove unused systemd_daemon_reload. 
572443edc6 removed the callsite that triggered the exec in
`zulip::systemd_daemon_reload`, making its inclusion and ordering via
`require` moot.

Remove the call.
 2024-02-02 17:54:02 -08:00
Alex Vandiver 6e9b25d993 puppet: Add key to allow prod to write ccache on zmirrorp. 2024-02-02 17:24:12 -08:00
Alex Vandiver 96b65cbeab install-ssh-authorized-keys: Merge multiple authorized_keys secrets. 2024-02-02 17:24:12 -08:00
Alex Vandiver 1567275959 install-ssh-authorized-keys: Use --check rather than another argument. 2024-02-02 17:24:12 -08:00
Alex Vandiver afa24923e5 install-ssh-authorized-keys: Enable -o pipefail to catch AWS errors. 2024-02-02 17:24:12 -08:00
Alex Vandiver a0347e76cb install-ssh-keys: Enable -o pipefail to catch AWS errors. 2024-02-02 17:24:12 -08:00
Alex Vandiver f8a9edc382 install-ssh-*: Pass -a to rsync to preserve rights, owners, and times. 2024-02-02 17:24:12 -08:00
Alex Vandiver 0bd1e2b434 puppet: Rename and limit production key distribution. 2024-02-02 17:24:12 -08:00
Alex Vandiver d910ea27fe puppet: Allow profiles to override zulip_ops::profile::base. 2024-02-02 17:24:12 -08:00
Tim Abbott a0e7f1296f puppet: Increase minimum memory for multiprocess queue workers. 
This should give some more room for systems that are still below 4GB
of RAM to use the lower-memory multithreaded mode, which is less
likely to have OOM kills (a very bad experience).

There should be little cost, as few systems are likely allocated with
memory in this range.
 2024-02-02 13:45:25 -08:00
Tim Abbott 43c0c77610 puppet: Update rules for number of uwsgi processes. 
The defaults for how many uwsgi processes to run no longer depend on
the queue processor mode, but instead the total memory on the system.
 2024-02-02 13:45:25 -08:00
Alex Vandiver 0e6f013e03 puppet: Drop mosh package -- teleport is now the supported login. 2024-01-31 16:41:04 -08:00
Alex Vandiver 16117e6139 puppet: Drop now-unnecessary common-session change. 2024-01-31 16:41:04 -08:00
Alex Vandiver 9810200d78 puppet: Stop writing custom sshd_config. 
The only relevant changes are `PasswordAuthentication no` (which
is now the default) and `MaxStartups 40:50:60` (which is now
unneccesary due to autossh tunnels.
 2024-01-31 16:41:04 -08:00
Alex Vandiver 1fe5e7c7da puppet: Use a dedicated user for redis tunneling. 2024-01-31 16:41:04 -08:00
Alex Vandiver 795621771f puppet: Pull authorized_keys from AWS secretsmanager. 2024-01-31 16:41:04 -08:00
Alex Vandiver ff00c01538 bootstrap-aws-installer: Pull all keys from secretsmanager. 2024-01-31 16:41:04 -08:00
Alex Vandiver 65d2e855a0 puppet: Switch removal of MOTD directories for .hushlogin. 
Rather than have to keep resolving apt conflicts with the lack of
`/etc/update-motd.d`, have each user disable the motds with a
`.hushlogin` file.
 2024-01-31 16:41:04 -08:00
Alex Vandiver 1bddf41731 puppet: Factor out creation of basic user dotfiles. 2024-01-31 16:41:04 -08:00
Alex Vandiver 69ef808d7b puppet: Use IAM Roles Anywhere to get AWS credentials outside EC2. 2024-01-31 16:41:04 -08:00
Alex Vandiver 16305761ac puppet: Use IAM join method, when possible. 2024-01-31 16:41:04 -08:00
Alex Vandiver dbb60dbeb9 puppet: Factor out $is_ec2, clarify comments. 2024-01-31 16:41:04 -08:00
Alex Vandiver 6902d5db47 install-aws-cli: Also install and keep up to date using Puppet. 
We previously only did this install on the developer machine and on
initial boot.  Also run it from puppet to make sure we keep the binary
up-to-date.
 2024-01-31 16:41:04 -08:00
Alex Vandiver e49fc8873b install-aws-cli: Check version before no-op'ing. 
We previously just ensured that _a_ version was installed.  Since we
were only using this at initial boot, that was all that was required.
 2024-01-31 16:41:04 -08:00
Alex Vandiver bd87f53c86 install-aws-server: Build a tool to smuggle scripts inline in the bootdata. 2024-01-31 16:41:04 -08:00
Alex Vandiver 1a84a20ca0 install-aws-cli: Add a shebang so it is callable directly. 2024-01-31 16:41:04 -08:00
Alex Vandiver 38bf1c5d22 install-aws-cli: Move into puppet files. 2024-01-31 16:41:04 -08:00
Alex Vandiver 7eeec09425 puppet: Include epmd on the list of do-not-auto-restart services. 
This brings it into parity with the list of unattended-upgrade
packages.
 2024-01-31 16:41:04 -08:00
Alex Vandiver d02354be6c puppet: statuspage-pusher uses zulip.conf for page_id. 
This was changed midway through the implementation, from reading it
from `zulip-secrets.conf`, and a couple locations still reference the
secrets path.
 2024-01-25 15:37:03 -08:00
Alex Vandiver cd565058cd puppet: Add vector pipelines for other Akamai SQS queues. 2024-01-25 15:36:40 -08:00
Alex Vandiver 39046afbaf nagios: Remove locks alert. 
Using locks is not itself a bad sign; there is no need to alert on it,
as there is no value which can be chosen as being "too many."
 2024-01-25 13:14:08 -08:00
Alex Vandiver 147fe19c1f puppet: Fix grafana tarball path. 
Grafana 10.2.1 and up package their tarball with a `grafana-v10.2.1`
and not `grafana-10.2.1` as previously.
 2024-01-25 13:03:05 -08:00
Tim Abbott 004563b380 puppet: Fix bugs in sysctl configuration. 2024-01-23 09:32:15 -08:00
Alex Vandiver 3bf047beb8 iptables: Skip conntrack for DNS queries. 
Under heavy request load, it is possible for the conntrack kernel
table to fill up (by default, 256k connections).  This leads to DNS
requests failing because they cannot make a new conntrack entry.

Allow all port-53 UDP traffic in and out without connection tracking.
This means that unbound port-53 traffic is no longer filtered out by
the on-host firewall -- but it is already filtered out at the border
firewall, so this does not change the external network posture.
`systemd-resolve` also only binds to 127.0.0.53 on the loopback
interface, so there is no server to attack on inbound port 53.
 2024-01-10 09:07:00 -08:00
Alex Vandiver d18de3e0a4 puppet: Add a knob to adjust conntrack max size. 2024-01-10 09:07:00 -08:00
Alex Vandiver 588aec96f9 puppet: Factor out a sysctl operator. 2024-01-10 09:07:00 -08:00