Page MenuHomeDevCentral

Configure Notifications center
ClosedPublic

Authored by dereckson on Oct 2 2020, 00:27.
Referenced Files
F2744782: D2354.id5929.diff
Thu, Mar 28, 19:37
F2743182: D2354.id7006.diff
Thu, Mar 28, 08:38
Unknown Object (File)
Wed, Mar 27, 21:24
Unknown Object (File)
Wed, Mar 27, 15:48
Unknown Object (File)
Wed, Mar 27, 14:20
Unknown Object (File)
Wed, Mar 27, 12:50
Unknown Object (File)
Sun, Mar 24, 14:28
Unknown Object (File)
Sat, Mar 23, 15:08
Subscribers
None

Details

Summary

Currently, the notifications center configuration is stored into
an ad hoc repository, operations-data-notifications (rOPSDATAN).

Configuration files are JSON, which can be more compactly expressed
and maintained in YAML, then dumped on the server as JSON.

As we need to provision those files and set SELinux context for them,
they can be hosted directly on rOPS too.

Secrets for credentials.json are stored in Vault.

Test Plan

Deploy container and config on docker-001.

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
notifications-config
Build Status
Buildable 4365
Build 4632: arc lint + arc unit

Event Timeline

dereckson created this revision.

Confused two files for a change. This one will be the config change so.

dereckson retitled this revision from Move notifications container to production Docker engine to Configure Notifications center.Oct 2 2020, 00:48
dereckson edited the summary of this revision. (Show Details)
dereckson edited the test plan for this revision. (Show Details)

Fix uid, gid and path: this is Notifications center, not RabbitMQ.

dereckson added inline comments.
pillar/notifications/config.sls
57

orgz

Next: switch to Vault credentials

Next: migrate secrets to Vault

#!/bin/sh
vault kv put ops/secrets/nasqueron.notifications.credentials_github_nasqueron password=$(ssh ysul /usr/home/zr/bin/getcredentials 153 token)
vault kv put ops/secrets/nasqueron.notifications.credentials_github_wolfplex password=$(ssh ysul /usr/home/zr/bin/getcredentials 156 token)
vault kv put ops/secrets/nasqueron.notifications.credentials_github_keruald password=$(ssh ysul /usr/home/zr/bin/getcredentials 157 token)
vault kv put ops/secrets/nasqueron.notifications.credentials_github_trustspace password=$(ssh ysul /usr/home/zr/bin/getcredentials 158 token)
vault kv put ops/secrets/nasqueron.notifications.credentials_github_eglide password=$(ssh ysul /usr/home/zr/bin/getcredentials 159 token)
vault kv put ops/secrets/nasqueron.notifications.credentials_phabricator_nasqueron password=$(ssh ysul /usr/home/zr/bin/getcredentials 154 token)
pillar/notifications/config.sls
42

Not sure api_token has ever been used, code uses secret field in PhabricatorAPI class.

This revision is now accepted and ready to land.Jan 30 2023, 19:10

Rebased. Removed created field from new file.

This revision was automatically updated to reflect the committed changes.
pillar/notifications/config.sls
19

Pillar doesn't have access to credentials module.

Furthermore, access is granted to those keys for docker-001, not the Salt master.

Perhaps we need a Jinja filter to call credentials.get_password (get_token is an alias for get_password, so no need to implement that)?