We're done here :)

Vault is live and Salt deployments were successful to cloudhugger dwellers windriver ysul (and Complector itself).

Per T644.

Migrated secrets

Perhaps replace references here too: https://code.nasqueron.org/?q=equatower&i=nope&literal=nope&files=&excludeFiles=&repos=

All tasks seem done, as we've docker-001 running for more than one year without any issue.

Alternative could be to use https://docs.saltproject.io/en/latest/ref/engines/all/salt.engines.ircbot.html#module-salt.engines.ircbot

If all we want are tunnels, Tinc could be overkill, as GRE tunnels work well at D2594 + D2595.

As said in IRC:
14:47:59 < Dereckson> (j'ai un doute pour ep_ether-o-meter après relecture du package.json, je me demande si ce n'est simplement à ce moment là que npm audit s'est réveillé)
14:49:44 < Dereckson> Je soupçonne que npm install <plugin> prend les dépendances de dev d'Etherpad aussi, alors que https://github.com/ether/etherpad-lite/blob/develop/src/bin/installDeps.sh utilise npm ci --no-optional

There is a concurrent approach through tinc deployed on devserver WindRiver:

[ Grabbing this on my radar again, as it's in my account. ]

Spambots actually target Phabricator, so we're fine with the current process.

Certificates have been migrated, and a salt-call --local state.apply have been successfully ran after the migration.

Regression introduced in rOPSbf659c5728cbfeab65c1fba8772f2037278000b5:

Let's rewire tunnels against router-001.nasqueron.org / 51.255.124.8 / 172.27.27.1

Phabricator config explicitly contained a reference to Equatower, it's now aphlict.nasqueron.org

Machine migration done with this workflow:

All the quoted containers are priority candidates to be moved to Kubernetes cluster.

OpenSSH now mitigates this.

We do'nt use sshguard anymore, as login by password is disabled, keys are required.