From Jenkins, hostnames are used, not static IPs, both on CD and CI.

We met on Jitsi this evening to test D3591. We decided to switch from trying to write the socket file to create a directory with correct permissions, so opendkim itself can create files on it.

FreeBSD service for OpenDKIM has several issues:

https://agora.nasqueron.org/Nasqueron_infrastructure_reference -> https://agora.nasqueron.org/Operations_grimoire
https://agora.nasqueron.org/Nasqueron_infrastructure_reference/Mail -> https://agora.nasqueron.org/Operations_grimoire/Mail

Per previous comment, I'd advice to downgrade to 3006 LTS for paas-docker servers too.

I've also discovered we can't deploy secrets to Salt 3007+ anymore from a Salt 3006 server:

Permission set to editor.

Needed to create a new Docker Hub image for rDVMA.

Secrets have been migrated from dot notation to slash notation.

Apparently some Jenkins agents have static ip. But that ip can be taken by dynamic assignment of previously launched containers.

All secrets are now stored in Vault and provisioned through Salt, with policies restricting access to secrets by node.

And with the Zemke-Rhyne decom, we're done.

User account deployed.

Request approved

L3 has been signed. M

Ok, we've an agreement so :)

It seems nice to me.

Rule H27 works perfectly well.

The rOPS repository is pretty sensible, as code pushed there will be executed by Salt under extended root privileges.

Nasqueron Operations tasks are discussed on IRC Libera #nasqueron-ops, could be interesting to join that one.

Migrated secrets

[ Grabbing this on my radar again, as it's in my account. ]

Already exists as hs-shellcheck — http://www.freshports.org/devel/hs-ShellCheck

nasqueron-devcentral transferred