First part done,

Should use port 587 for submission. Port 25 (smptd) should be server-to-server only.

Jan 6 19:04:10 hervil postfix/smtpd[73868]: connect from docker-002.nasqueron.org[51.255.124.9]
Jan 6 19:04:12 hervil postfix/smtpd[73868]: warning: docker-002.nasqueron.org[51.255.124.9]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=devcentral
Jan 6 19:04:12 hervil postfix/smtpd[73868]: lost connection after RSET from docker-002.nasqueron.org[51.255.124.9]
Jan 6 19:04:12 hervil postfix/smtpd[73868]: disconnect from docker-002.nasqueron.org[51.255.124.9] ehlo=1 auth=0/1 rset=1 commands=2/3

From Jenkins, hostnames are used, not static IPs, both on CD and CI.

We met on Jitsi this evening to test D3591. We decided to switch from trying to write the socket file to create a directory with correct permissions, so opendkim itself can create files on it.

FreeBSD service for OpenDKIM has several issues:

https://agora.nasqueron.org/Nasqueron_infrastructure_reference -> https://agora.nasqueron.org/Operations_grimoire
https://agora.nasqueron.org/Nasqueron_infrastructure_reference/Mail -> https://agora.nasqueron.org/Operations_grimoire/Mail

Per previous comment, I'd advice to downgrade to 3006 LTS for paas-docker servers too.

I've also discovered we can't deploy secrets to Salt 3007+ anymore from a Salt 3006 server:

Permission set to editor.

Needed to create a new Docker Hub image for rDVMA.

Secrets have been migrated from dot notation to slash notation.

Apparently some Jenkins agents have static ip. But that ip can be taken by dynamic assignment of previously launched containers.

All secrets are now stored in Vault and provisioned through Salt, with policies restricting access to secrets by node.

And with the Zemke-Rhyne decom, we're done.

User account deployed.

Request approved

L3 has been signed. M

Ok, we've an agreement so :)

It seems nice to me.

Rule H27 works perfectly well.

The rOPS repository is pretty sensible, as code pushed there will be executed by Salt under extended root privileges.

Nasqueron Operations tasks are discussed on IRC Libera #nasqueron-ops, could be interesting to join that one.

Migrated secrets

[ Grabbing this on my radar again, as it's in my account. ]