Wiki account created. Password should have been sent by e-mail.

Next: add the account in nasqueron-dev-docker group to get access to Dwellers to test nginx change

As we don't currently have a SSO (but see T1771 for plans), a series of access is to create too as separate accounts.

Request devserver access -> SSH public key to document here

Sign L3 Nasqueron Operations SIG — adherence to the core principles document

Assigning to @philectro for acceptance and to sign L3 document.

Have worked fine all summer.

Applied to Hervil, was missing there.

First part done,

Should use port 587 for submission. Port 25 (smptd) should be server-to-server only.

Jan 6 19:04:10 hervil postfix/smtpd[73868]: connect from docker-002.nasqueron.org[51.255.124.9]
Jan 6 19:04:12 hervil postfix/smtpd[73868]: warning: docker-002.nasqueron.org[51.255.124.9]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=devcentral
Jan 6 19:04:12 hervil postfix/smtpd[73868]: lost connection after RSET from docker-002.nasqueron.org[51.255.124.9]
Jan 6 19:04:12 hervil postfix/smtpd[73868]: disconnect from docker-002.nasqueron.org[51.255.124.9] ehlo=1 auth=0/1 rset=1 commands=2/3

From Jenkins, hostnames are used, not static IPs, both on CD and CI.

We met on Jitsi this evening to test D3591. We decided to switch from trying to write the socket file to create a directory with correct permissions, so opendkim itself can create files on it.

FreeBSD service for OpenDKIM has several issues:

https://agora.nasqueron.org/Nasqueron_infrastructure_reference -> https://agora.nasqueron.org/Operations_grimoire
https://agora.nasqueron.org/Nasqueron_infrastructure_reference/Mail -> https://agora.nasqueron.org/Operations_grimoire/Mail

Per previous comment, I'd advice to downgrade to 3006 LTS for paas-docker servers too.

I've also discovered we can't deploy secrets to Salt 3007+ anymore from a Salt 3006 server:

Permission set to editor.

Needed to create a new Docker Hub image for rDVMA.

Secrets have been migrated from dot notation to slash notation.

Apparently some Jenkins agents have static ip. But that ip can be taken by dynamic assignment of previously launched containers.

All secrets are now stored in Vault and provisioned through Salt, with policies restricting access to secrets by node.

And with the Zemke-Rhyne decom, we're done.

User account deployed.

Request approved

L3 has been signed. M

Ok, we've an agreement so :)