Page MenuHomeDevCentral

D4144.id10870.diff
No OneTemporary

D4144.id10870.diff

diff --git a/GIDs b/GIDs
deleted file mode 100644
--- a/GIDs
+++ /dev/null
@@ -1,19 +0,0 @@
-827 chaton-dev
-828 deployment
-829 nasqueron-irc
-835 opensearch
-836 opendkim
-842 nasqueron-dev-docker
-904 grafana
-1001 netbox
-3001 ops
-#3002 is intentionally left unassigned
-3003 deployment
-3004 mediawiki
-3005 nasquenautes
-6000 mailbox
-9001 salt
-9002 deploy
-9003 web
-9018 rhyne-wyse
-9019 anubis
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -100,15 +100,14 @@
As any program, modules should be tested. See section E.
-### D. UNIX resources assignments
+### D. UNIX resource assignments
-This repository is the source of truth for service accounts, groups and ports:
+This repository is the source of truth for service accounts, groups, and ports:
-* UIDs document unique usernames and the UIDs for system accounts
-* GIDs document the same information for the groups
-* PORTS contain the list of reserved application ports
+* `pillar/core/ids.sls` maps unique usernames and groups with their UIDs/GIDs
+* `PORTS` contains the list of reserved application ports
-When a service needs any of those resources, they are assigned in those files.
+When a service needs one of these resources, assign it in the corresponding file.
### E. Tests
diff --git a/UIDs b/UIDs
deleted file mode 100644
--- a/UIDs
+++ /dev/null
@@ -1,21 +0,0 @@
-830 odderon
-831 builder
-832 chaton LEGACY
-833 viperserv
-834 tc2
-835 opensearch
-836 opendkim
-904 grafana # Source FreeBSD port
-1001 netbox
-3004 mediawiki
-6000 mailbox
-8000 web-admin
-9001 salt
-9002 deploy
-9018 rhyne-wyse
-9019 anubis
-8900 zr LEGACY
-
-# Web app
-12000 web-org-nasqueron-mail
-12001 web-org-nasqueron-mail-admin
diff --git a/_tests/pillar/core/test_ids.py b/_tests/pillar/core/test_ids.py
new file mode 100755
--- /dev/null
+++ b/_tests/pillar/core/test_ids.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+
+import unittest
+import yaml
+
+PILLAR_FILE = "../pillar/core/ids.sls"
+
+
+class TestIds(unittest.TestCase):
+ def setUp(self):
+ with open(PILLAR_FILE, "r") as fd:
+ self.pillar = yaml.safe_load(fd)
+
+ def test_ids_are_integers(self):
+ errors = []
+
+ for section in ("uids", "gids"):
+ for name, identifier in self.pillar[section].items():
+ if not isinstance(identifier, int):
+ errors.append(f"{section}:{name} isn't an integer")
+
+ self.assertEqual([], errors)
+
+ def test_ids_are_unique_in_each_section(self):
+ errors = []
+
+ for section in ("uids", "gids"):
+ ids = list(self.pillar[section].values())
+ duplicates = {identifier for identifier in ids if ids.count(identifier) > 1}
+ if duplicates:
+ errors.append(f"{section} has duplicate IDs: {duplicates}")
+
+ self.assertEqual([], errors)
+
+
+if __name__ == "__main__":
+ unittest.main()
diff --git a/pillar/core/groups.sls b/pillar/core/groups.sls
--- a/pillar/core/groups.sls
+++ b/pillar/core/groups.sls
@@ -16,12 +16,12 @@
# These mapping are defined in the forests.sls pillar file.
#
# Sort the groups by GIDs.
+# GIDs are now centralized in pillar/core/ids.sls
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
shellgroups:
shell:
- gid: 200
title: Eglide shell users
description: >
Provide an account to use on the Eglide shell hosting project servers.
@@ -70,20 +70,17 @@
- yousra
chaton-dev:
- gid: 827
description: Manage Bonjour chaton service
members:
- hlp
nasqueron-irc:
- gid: 829
description: Manage IRC bots used for Nasqueron projects
members:
- dereckson
- sandlayth
nasqueron-dev-docker:
- gid: 842
description: Docker development
members:
- aceppaluni
@@ -97,7 +94,6 @@
- sandrine
ops:
- gid: 3001
title: Nasqueron Operations
description: >
Maintain the servers infrastructure. As such, members of this
@@ -110,7 +106,6 @@
- yousra
deployment:
- gid: 3003
title: Nasqueron Deployment
description: >
Build software to be installed on the servers.
@@ -119,7 +114,6 @@
- dereckson
nasquenautes:
- gid: 3005
title: Nasqueron servers users
description: >
Provide an account on Nasqueron development servers.
diff --git a/pillar/core/ids.sls b/pillar/core/ids.sls
new file mode 100644
--- /dev/null
+++ b/pillar/core/ids.sls
@@ -0,0 +1,63 @@
+# -------------------------------------------------------------
+# Salt — Reserved UNIX identifiers
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+# -------------------------------------------------------------
+# Service accounts and groups
+#
+# This repository is the source of truth for stable UIDs and GIDs
+# assigned to service accounts and service groups.
+#
+# Sort identifiers by numeric value.
+#
+# User accounts for actual humans are assigned in the user.sls file
+# in the 2000-2999 range. Old ops use 5000-5099.
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+uids:
+ odderon: 830
+ builder: 831
+ chaton: 832 # LEGACY
+ viperserv: 833
+ tc2: 834
+ opensearch: 835
+ opendkim: 836
+ grafana: 904 # from FreeBSD ports
+ netbox: 1001
+ mediawiki: 3004
+ mailbox: 6000
+ web-admin: 8000
+ zr: 8900 # LEGACY
+ salt: 9001
+ deploy: 9002
+ rhyne-wyse: 9018
+ anubis: 9019
+
+ # PaaS Alkane :: Mail server
+ web-org-nasqueron-mail: 12000
+ web-org-nasqueron-mail-admin: 12001
+
+gids:
+ shell: 200
+ chaton-dev: 827
+ deployment-legacy: 828 # Previous deployment assignment
+ nasqueron-irc: 829
+ opensearch: 835
+ opendkim: 836
+ nasqueron-dev-docker: 842
+ grafana: 904 # from FreeBSD ports
+ netbox: 1001
+ ops: 3001
+ # 3002 is intentionally left unassigned
+ deployment: 3003
+ mediawiki: 3004
+ nasquenautes: 3005
+ mailbox: 6000
+ salt: 9001
+ deploy: 9002
+ web: 9003
+ rhyne-wyse: 9018
+ anubis: 9019
diff --git a/pillar/paas/alkane/hervil/main.sls b/pillar/paas/alkane/hervil/main.sls
--- a/pillar/paas/alkane/hervil/main.sls
+++ b/pillar/paas/alkane/hervil/main.sls
@@ -31,7 +31,6 @@
domain: nasqueron.org
subdomain: admin.mail
user: web-org-nasqueron-mail-admin
- uid: 12001
php-fpm: prod
env:
APPLICATION_ENV: production
@@ -40,5 +39,4 @@
domain: nasqueron.org
subdomain: mail
user: web-org-nasqueron-mail
- uid: 12000
php-fpm: prod
diff --git a/pillar/top.sls b/pillar/top.sls
--- a/pillar/top.sls
+++ b/pillar/top.sls
@@ -7,6 +7,7 @@
base:
'*':
+ - core.ids
- core.users
- core.groups
- core.network
diff --git a/pillar/viperserv/bots.sls b/pillar/viperserv/bots.sls
--- a/pillar/viperserv/bots.sls
+++ b/pillar/viperserv/bots.sls
@@ -5,11 +5,9 @@
viperserv_accounts:
viperserv:
fullname: ViperServ
- uid: 833
tc2:
fullname: Tau Ceti Central
- uid: 834
viperserv_bots:
Daeghrefn:
diff --git a/roles/builder/account/init.sls b/roles/builder/account/init.sls
--- a/roles/builder/account/init.sls
+++ b/roles/builder/account/init.sls
@@ -7,6 +7,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Service account
@@ -16,8 +18,8 @@
user.present:
- name: builder
- fullname: Software builder account for configure and make
- - uid: 831
- - gid: deployment
+ - uid: {{ uids["builder"] }}
+ - gid: {{ gids["deployment"] }}
- home: /var/run/builder
# -------------------------------------------------------------
diff --git a/roles/core/deploy/init.sls b/roles/core/deploy/init.sls
--- a/roles/core/deploy/init.sls
+++ b/roles/core/deploy/init.sls
@@ -6,14 +6,16 @@
# -------------------------------------------------------------
{% if salt["node.has_deployment"]() %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# Deployment account
deploy_account:
user.present:
- name: deploy
- fullname: Deployment and management of the Salt staging area
- - uid: 9002
- - gid: 3003
+ - uid: {{ uids["deploy"] }}
+ - gid: {{ gids["deployment"] }}
- home: /var/run/deploy
{% endif %}
diff --git a/roles/core/users/init.sls b/roles/core/users/init.sls
--- a/roles/core/users/init.sls
+++ b/roles/core/users/init.sls
@@ -108,7 +108,7 @@
group_{{ groupname }}:
group.present:
- name: {{ groupname }}
- - gid: {{ group["gid"] }}
+ - gid: {{ pillar["gids"][groupname] }}
- members: {{ group["members"] }}
{% endfor %}
diff --git a/roles/grafana/grafana/init.sls b/roles/grafana/grafana/init.sls
--- a/roles/grafana/grafana/init.sls
+++ b/roles/grafana/grafana/init.sls
@@ -6,6 +6,7 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Software
@@ -26,7 +27,7 @@
domain: grafana.nasqueron.org
socket:
dir: /var/run/web/grafana
- gid: 9003 # web
+ gid: {{ gids["web"] }}
# -------------------------------------------------------------
# Socket
diff --git a/roles/mailserver/dkim/account.sls b/roles/mailserver/dkim/account.sls
--- a/roles/mailserver/dkim/account.sls
+++ b/roles/mailserver/dkim/account.sls
@@ -5,14 +5,17 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
# -------------------------------------------------------------
# OpenDKIM user account
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
opendkim:
group.present:
- - gid: 836
+ - gid: {{ gids["opendkim"] }}
user.present:
- - uid: 836
- - gid: 836
+ - uid: {{ uids["opendkim"] }}
+ - gid: {{ gids["opendkim"] }}
- home: /var/run/milteropendkim
diff --git a/roles/mailserver/vimbadmin/config.sls b/roles/mailserver/vimbadmin/config.sls
--- a/roles/mailserver/vimbadmin/config.sls
+++ b/roles/mailserver/vimbadmin/config.sls
@@ -8,31 +8,33 @@
{% set db = pillar["vimbadmin_config"]["db"] %}
{% set securityCredentials = pillar["vimbadmin_config"]["security"] %}
{% from "map.jinja" import dirs, packages_prefixes with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
mailbox:
group.present:
- - gid: 6000
+ - gid: {{ gids["mailbox"] }}
- system: True
mailbox_mail_user:
user.present:
- name: mailbox
- - uid: 6000
- - gid: 6000
+ - uid: {{ uids["mailbox"] }}
+ - gid: {{ gids["mailbox"] }}
- system: True
- home: /var/run/web/mailbox_mail_user
/var/mail/_archive:
file.directory:
- - user: 6000
- - group: 6000
+ - user: {{ uids["mailbox"] }}
+ - group: {{ gids["mailbox"] }}
- mode: 700
- makedirs: True
/var/mail/_virtual:
file.directory:
- - user: 6000
- - group: 6000
+ - user: {{ uids["mailbox"] }}
+ - group: {{ gids["mailbox"] }}
- mode: 700
- makedirs: True
@@ -84,8 +86,8 @@
mailbox:
archive: "/var/mail/_archive"
dir: "/var/mail/_virtual"
- GID: 6000
- UID: 6000
+ GID: {{ gids["mailbox"] }}
+ UID: {{ uids["mailbox"] }}
security:
salt: {{ salt["credentials.read_secret"](securityCredentials)["salt"] | yaml_dquote }}
osRememberMeSalt: {{ salt["credentials.read_secret"](securityCredentials)["osRememberMeSalt"] | yaml_dquote }}
diff --git a/roles/netbox/netbox/software.sls b/roles/netbox/netbox/software.sls
--- a/roles/netbox/netbox/software.sls
+++ b/roles/netbox/netbox/software.sls
@@ -5,6 +5,9 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
# -------------------------------------------------------------
# NetBox
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
@@ -29,13 +32,13 @@
netbox_group:
group.present:
- name: netbox
- - gid: 1001
+ - gid: {{ gids["netbox"] }}
netbox_user:
user.present:
- name: netbox
- - uid: 1001
- - gid: 1001
+ - uid: {{ uids["netbox"] }}
+ - gid: {{ gids["netbox"] }}
# -------------------------------------------------------------
# Python environment
diff --git a/roles/opensearch/opensearch/software.sls b/roles/opensearch/opensearch/software.sls
--- a/roles/opensearch/opensearch/software.sls
+++ b/roles/opensearch/opensearch/software.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import shells with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# User account
@@ -14,14 +16,14 @@
opensearch_group:
group.present:
- name: opensearch
- - gid: 835
+ - gid: {{ gids["opensearch"] }}
opensearch_user:
user.present:
- name: opensearch
- fullname: OpenSearch
- - uid: 835
- - gid: opensearch
+ - uid: {{ uids["opensearch"] }}
+ - gid: {{ gids["opensearch"] }}
- home: /opt/opensearch
- shell: {{ shells["bash"] }}
diff --git a/roles/paas-docker/anubis/account.sls b/roles/paas-docker/anubis/account.sls
--- a/roles/paas-docker/anubis/account.sls
+++ b/roles/paas-docker/anubis/account.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
{% set has_selinux = salt['grains.get']('selinux:enabled', False) %}
@@ -16,12 +18,12 @@
anubis_group:
group.present:
- name: anubis
- - gid: 9019
+ - gid: {{ gids["anubis"] }}
anubis_user:
user.present:
- name: anubis
- - uid: 9019
+ - uid: {{ uids["anubis"] }}
- shell: /sbin/nologin
- groups:
- anubis
diff --git a/roles/reports/rhyne-wyse/account.sls b/roles/reports/rhyne-wyse/account.sls
--- a/roles/reports/rhyne-wyse/account.sls
+++ b/roles/reports/rhyne-wyse/account.sls
@@ -5,15 +5,18 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
rhyne_wyse_group:
group.present:
- name: rhyne-wyse
- - gid: 9018
+ - gid: {{ gids["rhyne-wyse"] }}
rhyne_wyse_user:
user.present:
- name: rhyne-wyse
- - uid: 9018
+ - uid: {{ uids["rhyne-wyse"] }}
- shell: /bin/sh
- groups:
- nasquenautes
diff --git a/roles/saas-mediawiki/account/init.sls b/roles/saas-mediawiki/account/init.sls
--- a/roles/saas-mediawiki/account/init.sls
+++ b/roles/saas-mediawiki/account/init.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% set fqdn = pillar["mediawiki_saas"]["main_fqdn"] %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Service account
@@ -14,15 +16,15 @@
mediawiki_group:
group.present:
- name: mediawiki
- - gid: 3004
+ - gid: {{ gids["mediawiki"] }}
- system: True
mediawiki_account:
user.present:
- name: mediawiki
- fullname: MediaWiki SaaS
- - uid: 3004
- - gid: 3004
+ - uid: {{ uids["mediawiki"] }}
+ - gid: {{ gids["mediawiki"] }}
- system: True
- home: /var/run/web/{{ fqdn }}
diff --git a/roles/salt-primary/account/init.sls b/roles/salt-primary/account/init.sls
--- a/roles/salt-primary/account/init.sls
+++ b/roles/salt-primary/account/init.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Accounts
@@ -15,12 +17,12 @@
salt_account:
group.present:
- name: salt
- - gid: 9001
+ - gid: {{ gids["salt"] }}
user.present:
- name: salt
- fullname: SaltStack primary server account
- - uid: 9001
- - gid: 9001
+ - uid: {{ uids["salt"] }}
+ - gid: {{ gids["salt"] }}
- home: /var/run/salt
salt_account_ownership:
diff --git a/roles/shellserver/odderon/account.sls b/roles/shellserver/odderon/account.sls
--- a/roles/shellserver/odderon/account.sls
+++ b/roles/shellserver/odderon/account.sls
@@ -7,6 +7,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Service account
@@ -16,8 +18,8 @@
user.present:
- name: odderon
- fullname: Odderon
- - uid: 830
- - gid: 829
+ - uid: {{ uids["odderon"] }}
+ - gid: {{ gids["nasqueron-irc"] }}
- home: /opt/odderon
# -------------------------------------------------------------
diff --git a/roles/viperserv/account/init.sls b/roles/viperserv/account/init.sls
--- a/roles/viperserv/account/init.sls
+++ b/roles/viperserv/account/init.sls
@@ -7,24 +7,26 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
# -------------------------------------------------------------
# Service accounts
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
{% for username, user in pillar["viperserv_accounts"].items() %}
+{% set uid = uids[username] %}
viperserv_account_{{ username }}:
user.present:
- name: {{ username }}
- fullname: {{ user["fullname"] }}
- - uid: {{ user["uid"] }}
+ - uid: {{ uid }}
- gid: nasqueron-irc
- - home: {{ dirs.share }}/{{ username }}
+ - home: {{ dirs.share }}/{{ usercname }}
/var/run/{{ username }}:
file.directory:
- - user: {{ user["uid"] }}
+ - user: {{ uid }}
- group: nasqueron-irc
- dir_mode: 711
diff --git a/roles/webserver-alkane/account/init.sls b/roles/webserver-alkane/account/init.sls
--- a/roles/webserver-alkane/account/init.sls
+++ b/roles/webserver-alkane/account/init.sls
@@ -5,6 +5,9 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
# -------------------------------------------------------------
# User groups for domains served
#
@@ -16,7 +19,7 @@
#
# Back-ends runs under their own separate account.
#
-# The 9003 group matches "web" group, see webserver-core/nginx
+# The web group is shared with webserver-core/nginx.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
{% for domains_group in pillar["web_domains"] %}
@@ -24,7 +27,7 @@
webserver_user_{{ domain }}:
user.present:
- name: {{ domain }}
- - gid: 9003
+ - gid: {{ gids["web"] }}
- createhome: False
- fullname: Websites account for {{ domain }}
{% endfor %}
@@ -38,15 +41,16 @@
{% for fqdn, site in pillar["web_php_sites"].items() %}
{% if "skipCreateUser" not in site or not site["skipCreateUser"] %}
+{% set uid = site.get("uid", uids.get(site["user"])) %}
webserver_user_{{ site["user"] }}:
user.present:
- name: {{ site["user" ] }}
- fullname: {{ fqdn }}
-{% if "uid" in site %}
- - uid: {{ site["uid"] }}
+{% if uid is not none %}
+ - uid: {{ uid }}
{% endif %}
- - gid: 9003
+ - gid: {{ gids["web"] }}
- system: True
- home: /var/run/web/{{ fqdn }}
diff --git a/roles/webserver-core/nginx/config.sls b/roles/webserver-core/nginx/config.sls
--- a/roles/webserver-core/nginx/config.sls
+++ b/roles/webserver-core/nginx/config.sls
@@ -7,6 +7,8 @@
{% from "map.jinja" import dirs with context %}
{% from "roles/webserver-core/map.jinja" import options with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
{% set has_selinux = salt["grains.get"]("selinux:enabled", False) %}
@@ -28,14 +30,14 @@
webserver_core_group:
group.present:
- name: web
- - gid: 9003
+ - gid: {{ gids["web"] }}
- system: True
webserver_core_user:
user.present:
- name: web-admin
- - uid: 8000
- - gid: 9003
+ - uid: {{ uids["web-admin"] }}
+ - gid: {{ gids["web"] }}
# -------------------------------------------------------------
# Base configuration

File Metadata

Mime Type
text/plain
Expires
Thu, Aug 6, 10:54 (16 h, 13 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3973986
Default Alt Text
D4144.id10870.diff (20 KB)

Event Timeline