Query: All Stories

Configure client authentication

Switch to specialized Sentry PostgreSQL and wal2json Docker image

	Include stories about projects I am a member of.

An image for this diff is available in our registry: docker pull registry.nasqueron.org/postgres-sentry:D2867.

$ docker logs sentry_db
[…]
CREATE DATABASE

To create the payload, we can use a dictionary: [dict create code "$::errorCode" info "$::errorInfo" stack [info errorstack]].

Drop pg_hba.conf provisionning: /var/lib/postgresql/data must be empty to allow PostgreSQL initializing it.

Use preferred exec form for CMD

Provide PostgreSQL and wal2json Docker image

PostgreSQL for Sentry requires a custom extension, wal2json.

Decreased priority as a workaround exists and is applied.

Parse .sls as YAML for nano syntax highlighting

We also need pillar/core/network Drake content

Configure network and health check for Redis

Deploy memcached container for Sentry

docker inspect <container> allows to check the health check log, and the interval, 30000000000 matches correctly 30s

Switch to Alpine, so we've busybox nc for the healthcheck

Use 172.18.3.0/24 as Docker network for Sentry containers

Complector

$ salt docker-002 state.apply roles/paas-docker/docker/networks
docker-002:
----------
[…]
          ID: docker_network_sentry
    Function: docker_network.present
        Name: sentry
      Result: True
     Comment: Network 'sentry' created
     Started: 22:49:11.811458
    Duration: 89.937 ms
     Changes:
              ----------
              created:
                  True
[…]

Update Exim MTA container configuration

$ ssh -t docker-002 deploy-container exim
local:
----------
          ID: /srv/exim/sentry_smtp
    Function: file.directory
      Result: True
     Comment: The directory /srv/exim/sentry_smtp is in the correct state
     Started: 22:09:41.165494
    Duration: 5.888 ms
     Changes:
----------
          ID: /srv/exim/sentry_smtp/spool
    Function: file.directory
      Result: True
     Comment:
     Started: 22:09:41.171564
    Duration: 1.671 ms
     Changes:
              ----------
              /srv/exim/sentry_smtp/spool:
                  ----------
                  directory:
                      new
----------
          ID: /srv/exim/sentry_smtp/log
    Function: file.directory
      Result: True
     Comment:
     Started: 22:09:41.173356
    Duration: 1.553 ms
     Changes:
              ----------
              /srv/exim/sentry_smtp/log:
                  ----------
                  directory:
                      new
----------
          ID: /srv/exim/sentry_smtp/mailname
    Function: file.managed
      Result: True
     Comment: File /srv/exim/sentry_smtp/mailname is in the correct state
     Started: 22:09:41.175029
    Duration: 29.635 ms
     Changes:
----------
          ID: selinux_context_sentry_smtp_exim_data
    Function: selinux.fcontext_policy_present
        Name: /srv/exim/sentry_smtp
      Result: True
     Comment: SELinux policy for "/srv/exim/sentry_smtp" already present with specified filetype "all files" and sel_type "container_file_t".
     Started: 22:09:41.207344
    Duration: 397.715 ms
     Changes:
----------
          ID: selinux_context_sentry_smtp_exim_data_applied
    Function: selinux.fcontext_policy_applied
        Name: /srv/exim/sentry_smtp
      Result: True
     Comment: SElinux policies are already applied for filespec "/srv/exim/sentry_smtp"
     Started: 22:09:41.605608
    Duration: 13.955 ms
     Changes:
----------
          ID: sentry_smtp
    Function: docker_container.running
      Result: True
     Comment: Replaced container 'sentry_smtp'
     Started: 22:09:41.674233
    Duration: 3848.801 ms
     Changes:
              ----------
              container:
                  ----------
                  Config:
                      ----------
                      Volumes:
                          ----------
                          new:
                              ----------
                              /etc/mailname:
                                  ----------
                              /var/log/exim4:
                                  ----------
                              /var/spool/exim4:
                                  ----------
                          old:
                              ----------
                              /var/log/exim4:
                                  ----------
                              /var/spool/exim4:
                                  ----------
                  HostConfig:
                      ----------
                      Binds:
                          ----------
                          new:
                              - /srv/exim/sentry_smtp/mailname:/etc/mailname:ro
                              - /srv/exim/sentry_smtp/spool:/var/spool/exim4
                              - /srv/exim/sentry_smtp/log:/var/log/exim4
                          old:
                              None
              container_id:
                  ----------
                  added:
                      b060c7cda35cef48e3ab804150832e10f973aa5f71a4261e37e7bdfb331159f4
                  removed:
                      - 3baa77c17efa641675a342682b6ed636b605fd888706fc23376b09fb93e27064

Document the repository as legacy

Documentation says Zemke-Rhyme Phabricator account should be used.

All secrets are now stored in Vault and provisioned through Salt, with policies restricting access to secrets by node.

The point is currently moot as we don't have an operations SIG large enough to allow key shares.

Current status: ZR has been decom, we now deploy credentials through from Vault.

All Stories
Use Results
Edit Query
Hide Query

Mar 9 2023

Mar 8 2023

Mar 7 2023

All StoriesUse ResultsEdit QueryHide Query

Mar 9 2023

Mar 8 2023

Mar 7 2023

All Stories
Use Results
Edit Query
Hide Query