With Salt, sudo files content are now managed from rOPS.

Next: configure DNS records

Will need to be revisited when we switch to acme.sh.

Patched it live.

Bruteforce attack scenario possible, so we're only interested by usernames defined in users.sls, not by "root" (can't login by SSH) or generic accounts like "docker" (doesn't exist):

Same issue for rhyne-wyse.log. Configuration was copied from acme.sh one.

Credentials have been hashed directly in Vault, so we don't need to manipulate cleartext password with Salt.
Salt updated the tomcat-users.xml accordingly.

The full /etc/nginx directories on both docker-002 and dwellers use httpd_config_t for every file.

Alternatively, we made a lot of progress on this in T2124.

So, there is a new reason to do the upgrade.

First step is to create a script to renew all needed certificates: