Page Menu
Home
DevCentral
Search
Configure Global Search
Log In
Files
F41758015
D4144.id10870.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Award Token
Flag For Later
Size
20 KB
Referenced Files
None
Subscribers
None
D4144.id10870.diff
View Options
diff --git a/GIDs b/GIDs
deleted file mode 100644
--- a/GIDs
+++ /dev/null
@@ -1,19 +0,0 @@
-827 chaton-dev
-828 deployment
-829 nasqueron-irc
-835 opensearch
-836 opendkim
-842 nasqueron-dev-docker
-904 grafana
-1001 netbox
-3001 ops
-#3002 is intentionally left unassigned
-3003 deployment
-3004 mediawiki
-3005 nasquenautes
-6000 mailbox
-9001 salt
-9002 deploy
-9003 web
-9018 rhyne-wyse
-9019 anubis
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -100,15 +100,14 @@
As any program, modules should be tested. See section E.
-### D. UNIX resources assignments
+### D. UNIX resource assignments
-This repository is the source of truth for service accounts, groups and ports:
+This repository is the source of truth for service accounts, groups, and ports:
-* UIDs document unique usernames and the UIDs for system accounts
-* GIDs document the same information for the groups
-* PORTS contain the list of reserved application ports
+* `pillar/core/ids.sls` maps unique usernames and groups with their UIDs/GIDs
+* `PORTS` contains the list of reserved application ports
-When a service needs any of those resources, they are assigned in those files.
+When a service needs one of these resources, assign it in the corresponding file.
### E. Tests
diff --git a/UIDs b/UIDs
deleted file mode 100644
--- a/UIDs
+++ /dev/null
@@ -1,21 +0,0 @@
-830 odderon
-831 builder
-832 chaton LEGACY
-833 viperserv
-834 tc2
-835 opensearch
-836 opendkim
-904 grafana # Source FreeBSD port
-1001 netbox
-3004 mediawiki
-6000 mailbox
-8000 web-admin
-9001 salt
-9002 deploy
-9018 rhyne-wyse
-9019 anubis
-8900 zr LEGACY
-
-# Web app
-12000 web-org-nasqueron-mail
-12001 web-org-nasqueron-mail-admin
diff --git a/_tests/pillar/core/test_ids.py b/_tests/pillar/core/test_ids.py
new file mode 100755
--- /dev/null
+++ b/_tests/pillar/core/test_ids.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+
+import unittest
+import yaml
+
+PILLAR_FILE = "../pillar/core/ids.sls"
+
+
+class TestIds(unittest.TestCase):
+ def setUp(self):
+ with open(PILLAR_FILE, "r") as fd:
+ self.pillar = yaml.safe_load(fd)
+
+ def test_ids_are_integers(self):
+ errors = []
+
+ for section in ("uids", "gids"):
+ for name, identifier in self.pillar[section].items():
+ if not isinstance(identifier, int):
+ errors.append(f"{section}:{name} isn't an integer")
+
+ self.assertEqual([], errors)
+
+ def test_ids_are_unique_in_each_section(self):
+ errors = []
+
+ for section in ("uids", "gids"):
+ ids = list(self.pillar[section].values())
+ duplicates = {identifier for identifier in ids if ids.count(identifier) > 1}
+ if duplicates:
+ errors.append(f"{section} has duplicate IDs: {duplicates}")
+
+ self.assertEqual([], errors)
+
+
+if __name__ == "__main__":
+ unittest.main()
diff --git a/pillar/core/groups.sls b/pillar/core/groups.sls
--- a/pillar/core/groups.sls
+++ b/pillar/core/groups.sls
@@ -16,12 +16,12 @@
# These mapping are defined in the forests.sls pillar file.
#
# Sort the groups by GIDs.
+# GIDs are now centralized in pillar/core/ids.sls
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
shellgroups:
shell:
- gid: 200
title: Eglide shell users
description: >
Provide an account to use on the Eglide shell hosting project servers.
@@ -70,20 +70,17 @@
- yousra
chaton-dev:
- gid: 827
description: Manage Bonjour chaton service
members:
- hlp
nasqueron-irc:
- gid: 829
description: Manage IRC bots used for Nasqueron projects
members:
- dereckson
- sandlayth
nasqueron-dev-docker:
- gid: 842
description: Docker development
members:
- aceppaluni
@@ -97,7 +94,6 @@
- sandrine
ops:
- gid: 3001
title: Nasqueron Operations
description: >
Maintain the servers infrastructure. As such, members of this
@@ -110,7 +106,6 @@
- yousra
deployment:
- gid: 3003
title: Nasqueron Deployment
description: >
Build software to be installed on the servers.
@@ -119,7 +114,6 @@
- dereckson
nasquenautes:
- gid: 3005
title: Nasqueron servers users
description: >
Provide an account on Nasqueron development servers.
diff --git a/pillar/core/ids.sls b/pillar/core/ids.sls
new file mode 100644
--- /dev/null
+++ b/pillar/core/ids.sls
@@ -0,0 +1,63 @@
+# -------------------------------------------------------------
+# Salt — Reserved UNIX identifiers
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+# -------------------------------------------------------------
+# Service accounts and groups
+#
+# This repository is the source of truth for stable UIDs and GIDs
+# assigned to service accounts and service groups.
+#
+# Sort identifiers by numeric value.
+#
+# User accounts for actual humans are assigned in the user.sls file
+# in the 2000-2999 range. Old ops use 5000-5099.
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+uids:
+ odderon: 830
+ builder: 831
+ chaton: 832 # LEGACY
+ viperserv: 833
+ tc2: 834
+ opensearch: 835
+ opendkim: 836
+ grafana: 904 # from FreeBSD ports
+ netbox: 1001
+ mediawiki: 3004
+ mailbox: 6000
+ web-admin: 8000
+ zr: 8900 # LEGACY
+ salt: 9001
+ deploy: 9002
+ rhyne-wyse: 9018
+ anubis: 9019
+
+ # PaaS Alkane :: Mail server
+ web-org-nasqueron-mail: 12000
+ web-org-nasqueron-mail-admin: 12001
+
+gids:
+ shell: 200
+ chaton-dev: 827
+ deployment-legacy: 828 # Previous deployment assignment
+ nasqueron-irc: 829
+ opensearch: 835
+ opendkim: 836
+ nasqueron-dev-docker: 842
+ grafana: 904 # from FreeBSD ports
+ netbox: 1001
+ ops: 3001
+ # 3002 is intentionally left unassigned
+ deployment: 3003
+ mediawiki: 3004
+ nasquenautes: 3005
+ mailbox: 6000
+ salt: 9001
+ deploy: 9002
+ web: 9003
+ rhyne-wyse: 9018
+ anubis: 9019
diff --git a/pillar/paas/alkane/hervil/main.sls b/pillar/paas/alkane/hervil/main.sls
--- a/pillar/paas/alkane/hervil/main.sls
+++ b/pillar/paas/alkane/hervil/main.sls
@@ -31,7 +31,6 @@
domain: nasqueron.org
subdomain: admin.mail
user: web-org-nasqueron-mail-admin
- uid: 12001
php-fpm: prod
env:
APPLICATION_ENV: production
@@ -40,5 +39,4 @@
domain: nasqueron.org
subdomain: mail
user: web-org-nasqueron-mail
- uid: 12000
php-fpm: prod
diff --git a/pillar/top.sls b/pillar/top.sls
--- a/pillar/top.sls
+++ b/pillar/top.sls
@@ -7,6 +7,7 @@
base:
'*':
+ - core.ids
- core.users
- core.groups
- core.network
diff --git a/pillar/viperserv/bots.sls b/pillar/viperserv/bots.sls
--- a/pillar/viperserv/bots.sls
+++ b/pillar/viperserv/bots.sls
@@ -5,11 +5,9 @@
viperserv_accounts:
viperserv:
fullname: ViperServ
- uid: 833
tc2:
fullname: Tau Ceti Central
- uid: 834
viperserv_bots:
Daeghrefn:
diff --git a/roles/builder/account/init.sls b/roles/builder/account/init.sls
--- a/roles/builder/account/init.sls
+++ b/roles/builder/account/init.sls
@@ -7,6 +7,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Service account
@@ -16,8 +18,8 @@
user.present:
- name: builder
- fullname: Software builder account for configure and make
- - uid: 831
- - gid: deployment
+ - uid: {{ uids["builder"] }}
+ - gid: {{ gids["deployment"] }}
- home: /var/run/builder
# -------------------------------------------------------------
diff --git a/roles/core/deploy/init.sls b/roles/core/deploy/init.sls
--- a/roles/core/deploy/init.sls
+++ b/roles/core/deploy/init.sls
@@ -6,14 +6,16 @@
# -------------------------------------------------------------
{% if salt["node.has_deployment"]() %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# Deployment account
deploy_account:
user.present:
- name: deploy
- fullname: Deployment and management of the Salt staging area
- - uid: 9002
- - gid: 3003
+ - uid: {{ uids["deploy"] }}
+ - gid: {{ gids["deployment"] }}
- home: /var/run/deploy
{% endif %}
diff --git a/roles/core/users/init.sls b/roles/core/users/init.sls
--- a/roles/core/users/init.sls
+++ b/roles/core/users/init.sls
@@ -108,7 +108,7 @@
group_{{ groupname }}:
group.present:
- name: {{ groupname }}
- - gid: {{ group["gid"] }}
+ - gid: {{ pillar["gids"][groupname] }}
- members: {{ group["members"] }}
{% endfor %}
diff --git a/roles/grafana/grafana/init.sls b/roles/grafana/grafana/init.sls
--- a/roles/grafana/grafana/init.sls
+++ b/roles/grafana/grafana/init.sls
@@ -6,6 +6,7 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Software
@@ -26,7 +27,7 @@
domain: grafana.nasqueron.org
socket:
dir: /var/run/web/grafana
- gid: 9003 # web
+ gid: {{ gids["web"] }}
# -------------------------------------------------------------
# Socket
diff --git a/roles/mailserver/dkim/account.sls b/roles/mailserver/dkim/account.sls
--- a/roles/mailserver/dkim/account.sls
+++ b/roles/mailserver/dkim/account.sls
@@ -5,14 +5,17 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
# -------------------------------------------------------------
# OpenDKIM user account
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
opendkim:
group.present:
- - gid: 836
+ - gid: {{ gids["opendkim"] }}
user.present:
- - uid: 836
- - gid: 836
+ - uid: {{ uids["opendkim"] }}
+ - gid: {{ gids["opendkim"] }}
- home: /var/run/milteropendkim
diff --git a/roles/mailserver/vimbadmin/config.sls b/roles/mailserver/vimbadmin/config.sls
--- a/roles/mailserver/vimbadmin/config.sls
+++ b/roles/mailserver/vimbadmin/config.sls
@@ -8,31 +8,33 @@
{% set db = pillar["vimbadmin_config"]["db"] %}
{% set securityCredentials = pillar["vimbadmin_config"]["security"] %}
{% from "map.jinja" import dirs, packages_prefixes with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
mailbox:
group.present:
- - gid: 6000
+ - gid: {{ gids["mailbox"] }}
- system: True
mailbox_mail_user:
user.present:
- name: mailbox
- - uid: 6000
- - gid: 6000
+ - uid: {{ uids["mailbox"] }}
+ - gid: {{ gids["mailbox"] }}
- system: True
- home: /var/run/web/mailbox_mail_user
/var/mail/_archive:
file.directory:
- - user: 6000
- - group: 6000
+ - user: {{ uids["mailbox"] }}
+ - group: {{ gids["mailbox"] }}
- mode: 700
- makedirs: True
/var/mail/_virtual:
file.directory:
- - user: 6000
- - group: 6000
+ - user: {{ uids["mailbox"] }}
+ - group: {{ gids["mailbox"] }}
- mode: 700
- makedirs: True
@@ -84,8 +86,8 @@
mailbox:
archive: "/var/mail/_archive"
dir: "/var/mail/_virtual"
- GID: 6000
- UID: 6000
+ GID: {{ gids["mailbox"] }}
+ UID: {{ uids["mailbox"] }}
security:
salt: {{ salt["credentials.read_secret"](securityCredentials)["salt"] | yaml_dquote }}
osRememberMeSalt: {{ salt["credentials.read_secret"](securityCredentials)["osRememberMeSalt"] | yaml_dquote }}
diff --git a/roles/netbox/netbox/software.sls b/roles/netbox/netbox/software.sls
--- a/roles/netbox/netbox/software.sls
+++ b/roles/netbox/netbox/software.sls
@@ -5,6 +5,9 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
# -------------------------------------------------------------
# NetBox
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
@@ -29,13 +32,13 @@
netbox_group:
group.present:
- name: netbox
- - gid: 1001
+ - gid: {{ gids["netbox"] }}
netbox_user:
user.present:
- name: netbox
- - uid: 1001
- - gid: 1001
+ - uid: {{ uids["netbox"] }}
+ - gid: {{ gids["netbox"] }}
# -------------------------------------------------------------
# Python environment
diff --git a/roles/opensearch/opensearch/software.sls b/roles/opensearch/opensearch/software.sls
--- a/roles/opensearch/opensearch/software.sls
+++ b/roles/opensearch/opensearch/software.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import shells with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# User account
@@ -14,14 +16,14 @@
opensearch_group:
group.present:
- name: opensearch
- - gid: 835
+ - gid: {{ gids["opensearch"] }}
opensearch_user:
user.present:
- name: opensearch
- fullname: OpenSearch
- - uid: 835
- - gid: opensearch
+ - uid: {{ uids["opensearch"] }}
+ - gid: {{ gids["opensearch"] }}
- home: /opt/opensearch
- shell: {{ shells["bash"] }}
diff --git a/roles/paas-docker/anubis/account.sls b/roles/paas-docker/anubis/account.sls
--- a/roles/paas-docker/anubis/account.sls
+++ b/roles/paas-docker/anubis/account.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
{% set has_selinux = salt['grains.get']('selinux:enabled', False) %}
@@ -16,12 +18,12 @@
anubis_group:
group.present:
- name: anubis
- - gid: 9019
+ - gid: {{ gids["anubis"] }}
anubis_user:
user.present:
- name: anubis
- - uid: 9019
+ - uid: {{ uids["anubis"] }}
- shell: /sbin/nologin
- groups:
- anubis
diff --git a/roles/reports/rhyne-wyse/account.sls b/roles/reports/rhyne-wyse/account.sls
--- a/roles/reports/rhyne-wyse/account.sls
+++ b/roles/reports/rhyne-wyse/account.sls
@@ -5,15 +5,18 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
rhyne_wyse_group:
group.present:
- name: rhyne-wyse
- - gid: 9018
+ - gid: {{ gids["rhyne-wyse"] }}
rhyne_wyse_user:
user.present:
- name: rhyne-wyse
- - uid: 9018
+ - uid: {{ uids["rhyne-wyse"] }}
- shell: /bin/sh
- groups:
- nasquenautes
diff --git a/roles/saas-mediawiki/account/init.sls b/roles/saas-mediawiki/account/init.sls
--- a/roles/saas-mediawiki/account/init.sls
+++ b/roles/saas-mediawiki/account/init.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% set fqdn = pillar["mediawiki_saas"]["main_fqdn"] %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Service account
@@ -14,15 +16,15 @@
mediawiki_group:
group.present:
- name: mediawiki
- - gid: 3004
+ - gid: {{ gids["mediawiki"] }}
- system: True
mediawiki_account:
user.present:
- name: mediawiki
- fullname: MediaWiki SaaS
- - uid: 3004
- - gid: 3004
+ - uid: {{ uids["mediawiki"] }}
+ - gid: {{ gids["mediawiki"] }}
- system: True
- home: /var/run/web/{{ fqdn }}
diff --git a/roles/salt-primary/account/init.sls b/roles/salt-primary/account/init.sls
--- a/roles/salt-primary/account/init.sls
+++ b/roles/salt-primary/account/init.sls
@@ -6,6 +6,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Accounts
@@ -15,12 +17,12 @@
salt_account:
group.present:
- name: salt
- - gid: 9001
+ - gid: {{ gids["salt"] }}
user.present:
- name: salt
- fullname: SaltStack primary server account
- - uid: 9001
- - gid: 9001
+ - uid: {{ uids["salt"] }}
+ - gid: {{ gids["salt"] }}
- home: /var/run/salt
salt_account_ownership:
diff --git a/roles/shellserver/odderon/account.sls b/roles/shellserver/odderon/account.sls
--- a/roles/shellserver/odderon/account.sls
+++ b/roles/shellserver/odderon/account.sls
@@ -7,6 +7,8 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
# -------------------------------------------------------------
# Service account
@@ -16,8 +18,8 @@
user.present:
- name: odderon
- fullname: Odderon
- - uid: 830
- - gid: 829
+ - uid: {{ uids["odderon"] }}
+ - gid: {{ gids["nasqueron-irc"] }}
- home: /opt/odderon
# -------------------------------------------------------------
diff --git a/roles/viperserv/account/init.sls b/roles/viperserv/account/init.sls
--- a/roles/viperserv/account/init.sls
+++ b/roles/viperserv/account/init.sls
@@ -7,24 +7,26 @@
# -------------------------------------------------------------
{% from "map.jinja" import dirs with context %}
+{% set uids = pillar["uids"] %}
# -------------------------------------------------------------
# Service accounts
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
{% for username, user in pillar["viperserv_accounts"].items() %}
+{% set uid = uids[username] %}
viperserv_account_{{ username }}:
user.present:
- name: {{ username }}
- fullname: {{ user["fullname"] }}
- - uid: {{ user["uid"] }}
+ - uid: {{ uid }}
- gid: nasqueron-irc
- - home: {{ dirs.share }}/{{ username }}
+ - home: {{ dirs.share }}/{{ usercname }}
/var/run/{{ username }}:
file.directory:
- - user: {{ user["uid"] }}
+ - user: {{ uid }}
- group: nasqueron-irc
- dir_mode: 711
diff --git a/roles/webserver-alkane/account/init.sls b/roles/webserver-alkane/account/init.sls
--- a/roles/webserver-alkane/account/init.sls
+++ b/roles/webserver-alkane/account/init.sls
@@ -5,6 +5,9 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
+
# -------------------------------------------------------------
# User groups for domains served
#
@@ -16,7 +19,7 @@
#
# Back-ends runs under their own separate account.
#
-# The 9003 group matches "web" group, see webserver-core/nginx
+# The web group is shared with webserver-core/nginx.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
{% for domains_group in pillar["web_domains"] %}
@@ -24,7 +27,7 @@
webserver_user_{{ domain }}:
user.present:
- name: {{ domain }}
- - gid: 9003
+ - gid: {{ gids["web"] }}
- createhome: False
- fullname: Websites account for {{ domain }}
{% endfor %}
@@ -38,15 +41,16 @@
{% for fqdn, site in pillar["web_php_sites"].items() %}
{% if "skipCreateUser" not in site or not site["skipCreateUser"] %}
+{% set uid = site.get("uid", uids.get(site["user"])) %}
webserver_user_{{ site["user"] }}:
user.present:
- name: {{ site["user" ] }}
- fullname: {{ fqdn }}
-{% if "uid" in site %}
- - uid: {{ site["uid"] }}
+{% if uid is not none %}
+ - uid: {{ uid }}
{% endif %}
- - gid: 9003
+ - gid: {{ gids["web"] }}
- system: True
- home: /var/run/web/{{ fqdn }}
diff --git a/roles/webserver-core/nginx/config.sls b/roles/webserver-core/nginx/config.sls
--- a/roles/webserver-core/nginx/config.sls
+++ b/roles/webserver-core/nginx/config.sls
@@ -7,6 +7,8 @@
{% from "map.jinja" import dirs with context %}
{% from "roles/webserver-core/map.jinja" import options with context %}
+{% set uids = pillar["uids"] %}
+{% set gids = pillar["gids"] %}
{% set has_selinux = salt["grains.get"]("selinux:enabled", False) %}
@@ -28,14 +30,14 @@
webserver_core_group:
group.present:
- name: web
- - gid: 9003
+ - gid: {{ gids["web"] }}
- system: True
webserver_core_user:
user.present:
- name: web-admin
- - uid: 8000
- - gid: 9003
+ - uid: {{ uids["web-admin"] }}
+ - gid: {{ gids["web"] }}
# -------------------------------------------------------------
# Base configuration
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Thu, Aug 6, 10:54 (16 h, 13 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3973986
Default Alt Text
D4144.id10870.diff (20 KB)
Attached To
Mode
D4144: Promote UIDs and GIDs into pillar
Attached
Detach File
Event Timeline
Log In to Comment