--- Class[Profile::Apt].orig
+++ Class[Profile::Apt]
@@
- before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[perccli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']
+ before => ['Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[starship]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[linux-sysctl-defaults]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[perccli]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[bacula-sd]', 'Package[confd]', 'Package[python3-toml]', 'Package[python3-click]', 'Package[python3-box]', 'Package[ruby-concurrent]', 'Package[ruby]', 'Package[libruby]', 'Package[puppet-agent]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]']
Concat_file[/etc/bacula/sd/ssl/cert.pem]
- Parameters differences:
--- Concat_file[/etc/bacula/sd/ssl/cert.pem].orig
+++ Concat_file[/etc/bacula/sd/ssl/cert.pem]
+ ensure_newline => False
+ show_diff => True
+ order => alpha
+ tag => _etc_bacula_sd_ssl_cert.pem
+ force => False
+ format => plain
+ mode => 0644
+ backup => puppet
+ replace => True
- File[/etc/update-motd.d/05-insetup--data-persistence-ferm]
- Parameters differences:
--- File[/etc/update-motd.d/05-insetup--data-persistence-ferm].orig
+++ File[/etc/update-motd.d/05-insetup--data-persistence-ferm]
- owner => root
- ensure => present
- mode => 0555
- group => root
- Content differences:
--- /etc/update-motd.d/05-insetup--data-persistence-ferm.orig
+++ /etc/update-motd.d/05-insetup--data-persistence-ferm
@@ -1,2 +0,0 @@
-#!/bin/sh
-printf "%s\n" "backup2014 is a Host being setup by Data Persistence SREs (insetup::data_persistence_ferm)"
- Concat_fragment[/etc/bacula/sd_puppet_ca_chain]
- Parameters differences:
--- Concat_fragment[/etc/bacula/sd_puppet_ca_chain].orig
+++ Concat_fragment[/etc/bacula/sd_puppet_ca_chain]
+ order => 02
+ tag => _etc_bacula_sd_ssl_cert.pem
+ source => /var/lib/puppet/ssl/certs/ca.pem
+ target => /etc/bacula/sd/ssl/cert.pem
- File[/etc/bacula/sd/ssl/server.key]
- Parameters differences:
--- File[/etc/bacula/sd/ssl/server.key].orig
+++ File[/etc/bacula/sd/ssl/server.key]
+ owner => bacula
+ show_diff => False
+ ensure => present
+ source => /var/lib/puppet/ssl/private_keys/backup2014.codfw.wmnet.pem
+ mode => 0400
+ group => bacula
- Monitoring::Exported_nagios_service[backup2014 disk_space]
- Parameters differences:
--- Monitoring::Exported_nagios_service[backup2014 disk_space].orig
+++ Monitoring::Exported_nagios_service[backup2014 disk_space]
@@
- notifications_enabled => 0
+ notifications_enabled => 1
@@
- servicegroups => insetup_codfw
+ servicegroups => backup_codfw
- File[/var/lib/prometheus/node.d/role_owner.prom]
- Content differences:
--- /var/lib/prometheus/node.d/role_owner.prom.orig
+++ /var/lib/prometheus/node.d/role_owner.prom
@@ -1,3 +1,3 @@
# HELP role_owner The team owner of the server role
# TYPE role_owner gauge
-role_owner{team="data-persistence",role="insetup::data_persistence_ferm",cluster="insetup"} 1.0
+role_owner{team="data-persistence",role="backup::es",cluster="backup"} 1.0
- Class[Cumin::Selector]
- Parameters differences:
--- Class[Cumin::Selector].orig
+++ Class[Cumin::Selector]
@@
- cluster => insetup
+ cluster => backup
- Concat[/etc/bacula/sd/ssl/cert.pem]
- Parameters differences:
--- Concat[/etc/bacula/sd/ssl/cert.pem].orig
+++ Concat[/etc/bacula/sd/ssl/cert.pem]
+ ensure_newline => False
+ show_diff => True
+ warn => False
+ order => alpha
+ force => False
+ format => plain
+ mode => 0644
+ backup => puppet
+ path => /etc/bacula/sd/ssl/cert.pem
+ ensure => present
+ replace => True
- Motd::Message[insetup::data_persistence_ferm]
- Parameters differences:
--- Motd::Message[insetup::data_persistence_ferm].orig
+++ Motd::Message[insetup::data_persistence_ferm]
- message => backup2014 is a Host being setup by Data Persistence SREs (insetup::data_persistence_ferm)
- ensure => present
- priority => 5
- File[/etc/bacula/sd/ssl]
- Parameters differences:
--- File[/etc/bacula/sd/ssl].orig
+++ File[/etc/bacula/sd/ssl]
+ owner => bacula
+ ensure => directory
+ mode => 0555
+ group => bacula
- Systemd::Unit[nrpe2nodexp-bacula_sd.timer]
- Parameters differences:
--- Systemd::Unit[nrpe2nodexp-bacula_sd.timer].orig
+++ Systemd::Unit[nrpe2nodexp-bacula_sd.timer]
+ override => False
+ ensure => absent
+ unit => nrpe2nodexp-bacula_sd.timer
+ override_filename => puppet-override.conf
+ restart => False
+ require => ['Class[Systemd]']
- Monitoring::Service[bacula_sd]
- Parameters differences:
--- Monitoring::Service[bacula_sd].orig
+++ Monitoring::Service[bacula_sd]
+ critical => False
+ check_interval => 1
+ contact_group => admins
+ passive => False
+ notes_url => https://wikitech.wikimedia.org/wiki/Bacula
+ check_command => nrpe_check!check_bacula_sd!10
+ freshness => 36000
+ config_dir => /etc/nagios
+ host => backup2014
+ ensure => present
+ retry_interval => 1
+ migration_task => T357099
+ description => bacula sd process
+ retries => 3
- File[/var/lib/prometheus/node.d/check_bacula_sd.prom]
- Parameters differences:
--- File[/var/lib/prometheus/node.d/check_bacula_sd.prom].orig
+++ File[/var/lib/prometheus/node.d/check_bacula_sd.prom]
+ owner => root
+ ensure => absent
+ group => root
- File[/srv/bacula]
- Parameters differences:
--- File[/srv/bacula].orig
+++ File[/srv/bacula]
+ owner => bacula
+ ensure => directory
+ mode => 0660
+ group => bacula
- Prometheus::Alert::Rule[check_bacula_sd_4d3ab0ef8aa01b04270054b3d1d3c587]
- Parameters differences:
--- Prometheus::Alert::Rule[check_bacula_sd_4d3ab0ef8aa01b04270054b3d1d3c587].orig
+++ Prometheus::Alert::Rule[check_bacula_sd_4d3ab0ef8aa01b04270054b3d1d3c587]
+ site => codfw
+ dashboard => TODO
+ team => observability
+ def_label_whitelst => ['team', 'severity']
+ summary => NRPE CHECK: bacula sd process
+ severity => info
+ instance => ops
+ logs => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_bacula_sd))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
+ runbook => https://wikitech.wikimedia.org/wiki/Bacula
+ ensure => absent
+ expr => (nagios_nrpe_check_result{alert_rule_hash="4d3ab0ef8aa01b04270054b3d1d3c587",check_name="check_bacula_sd", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
+ group => nrpechecks
+ alert_name => nrpe_bacula_sd_process
+ for => 3m
+ description => NRPE CHECK: bacula sd process
- Puppet::Expose_agent_certs[/etc/bacula/sd]
- Parameters differences:
--- Puppet::Expose_agent_certs[/etc/bacula/sd].orig
+++ Puppet::Expose_agent_certs[/etc/bacula/sd]
+ provide_private => True
+ ssldir => /var/lib/puppet/ssl
+ provide_p12 => False
+ require => File[/etc/bacula/sd]
+ provide_pem => True
+ ensure => present
+ user => bacula
+ group => bacula
+ provide_keypair => True
- Motd::Script[insetup::data_persistence_ferm]
- Parameters differences:
--- Motd::Script[insetup::data_persistence_ferm].orig
+++ Motd::Script[insetup::data_persistence_ferm]
- ensure => present
- priority => 5
- File[/srv/bacula/es-readonly]
- Parameters differences:
--- File[/srv/bacula/es-readonly].orig
+++ File[/srv/bacula/es-readonly]
+ owner => bacula
+ ensure => directory
+ group => bacula
+ mode => 0660
+ require => File[/srv/bacula]
- Class[Profile::Backup::Storage::Common]
- Parameters differences:
--- Class[Profile::Backup::Storage::Common].orig
+++ Class[Profile::Backup::Storage::Common]
+ director => backup1014.eqiad.wmnet
- Bacula::Storage::Device[FileStorageEsRoCodfw]
- Parameters differences:
--- Bacula::Storage::Device[FileStorageEsRoCodfw].orig
+++ Bacula::Storage::Device[FileStorageEsRoCodfw]
+ archive_device => /srv/bacula/es-readonly
+ media_type => File
+ max_concur_jobs => 2
+ device_type => File
+ require => File[/srv/bacula/es-readonly]
- File[/etc/bacula/sd-devices.d/FileStorageEsRoCodfw.conf]
- Parameters differences:
--- File[/etc/bacula/sd-devices.d/FileStorageEsRoCodfw.conf].orig
+++ File[/etc/bacula/sd-devices.d/FileStorageEsRoCodfw.conf]
+ owner => bacula
+ ensure => present
+ mode => 0440
+ group => tape
+ notify => Service[bacula-sd]
+ require => File[/etc/bacula/sd-devices.d]
- Content differences:
--- /etc/bacula/sd-devices.d/FileStorageEsRoCodfw.conf.orig
+++ /etc/bacula/sd-devices.d/FileStorageEsRoCodfw.conf
@@ -0,0 +1,14 @@
+# This file has been autogenerated by puppet. Don't edit by hand
+
+Device {
+ Name = FileStorageEsRoCodfw
+ Device Type = File
+ Media Type = File
+ Archive Device = /srv/bacula/es-readonly
+ Maximum Concurrent Jobs = 2
+ LabelMedia = yes;
+ Random Access = Yes;
+ AutomaticMount = yes;
+ RemovableMedia = no;
+ AlwaysOpen = no;
+}
- Systemd::Timer::Job[nrpe2nodexp-bacula_sd]
- Parameters differences:
--- Systemd::Timer::Job[nrpe2nodexp-bacula_sd].orig
+++ Systemd::Timer::Job[nrpe2nodexp-bacula_sd]
+ private_tmp => False
+ fixed_random_delay => True
+ send_mail => False
+ logfile_name => syslog.log
+ ensure => absent
+ splay => 60
+ syslog_identifier => nrpe2nodexp-bacula_sd
+ send_mail_only_on_error => True
+ description => execution of nrpe2nodexp for the check_bacula_sd command.
+ logfile_group => root
+ logfile_perms => all
+ logging_enabled => False
+ syslog_force_stop => True
+ syslog_match_startswith => True
+ success_exit_status => []
+ ignore_errors => True
+ interval => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]
+ logfile_basedir => /var/log
+ command => /usr/local/bin/nrpe2nodexp --alert-rule-hash "4d3ab0ef8aa01b04270054b3d1d3c587" --timeout 10 --check-command "check_bacula_sd"
+ environment => {}
+ user => nagios
+ monitoring_contact_groups => admins
+ group => prometheus-node-exporter
+ send_mail_to => root@backup2014.codfw.wmnet
+ monitoring_notes_url => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+ monitoring_enabled => False
- File[/etc/bacula/bacula-sd.conf]
- Parameters differences:
--- File[/etc/bacula/bacula-sd.conf].orig
+++ File[/etc/bacula/bacula-sd.conf]
+ owner => bacula
+ ensure => present
+ mode => 0400
+ group => tape
+ notify => Service[bacula-sd]
+ require => Package[bacula-sd]
- Content differences:
--- /etc/bacula/bacula-sd.conf.orig
+++ /etc/bacula/bacula-sd.conf
@@ -0,0 +1,40 @@
+# This file has been autogenerated by puppet. Don't edit by hand
+
+# The directors allowed to contect to us
+Director {
+ Name = "backup1014.eqiad.wmnet"
+ Password = "1eedc784c24dbaf5d191a6a47329af0e61259c06"
+ # Have the Control channel encrypted. Used for incoming console connections
+ TLS Enable = yes
+ TLS Require = yes
+ TLS CA Certificate File = "/etc/ssl/certs/wmf-ca-certificates.crt"
+ TLS Verify Peer = no
+ TLS Certificate = "/etc/bacula/sd/ssl/cert.pem"
+ TLS Key = "/etc/bacula/sd/ssl/server.key"
+}
+
+Storage {
+ Name = "backup2014.codfw.wmnet-fd"
+ SDport = 9103
+ WorkingDirectory = "/var/lib/bacula"
+ Pid Directory = "/var/run/bacula"
+ Maximum Concurrent Jobs = 5
+ Plugin Directory = "/usr/lib/bacula"
+ # Do Have the data channel encrypted.
+ TLS Enable = yes
+ TLS Require = yes
+ TLS CA Certificate File = "/etc/ssl/certs/wmf-ca-certificates.crt"
+ TLS Verify Peer = yes
+ TLS Certificate = "/etc/bacula/sd/ssl/cert.pem"
+ TLS Key = "/etc/bacula/sd/ssl/server.key"
+ # Heartbeat inverval = 0 # in secs
+ # SDAddresses = # For director connections
+}
+
+# Send all messages except skipped files back to Director
+Messages {
+ Name = Standard
+ director = "backup1014.eqiad.wmnet" = all, !skipped, !restored
+}
+
+@|"sh -c 'for f in /etc/bacula/sd-devices.d/*.conf ; do echo @${f} ; done'"
- File[/etc/bacula/sd-devices.d/FileStorageEsRwCodfw.conf]
- Parameters differences:
--- File[/etc/bacula/sd-devices.d/FileStorageEsRwCodfw.conf].orig
+++ File[/etc/bacula/sd-devices.d/FileStorageEsRwCodfw.conf]
+ owner => bacula
+ ensure => present
+ mode => 0440
+ group => tape
+ notify => Service[bacula-sd]
+ require => File[/etc/bacula/sd-devices.d]
- Content differences:
--- /etc/bacula/sd-devices.d/FileStorageEsRwCodfw.conf.orig
+++ /etc/bacula/sd-devices.d/FileStorageEsRwCodfw.conf
@@ -0,0 +1,14 @@
+# This file has been autogenerated by puppet. Don't edit by hand
+
+Device {
+ Name = FileStorageEsRwCodfw
+ Device Type = File
+ Media Type = File
+ Archive Device = /srv/bacula/es-readwrite
+ Maximum Concurrent Jobs = 2
+ LabelMedia = yes;
+ Random Access = Yes;
+ AutomaticMount = yes;
+ RemovableMedia = no;
+ AlwaysOpen = no;
+}
- Service[nrpe2nodexp-bacula_sd.timer]
- Parameters differences:
--- Service[nrpe2nodexp-bacula_sd.timer].orig
+++ Service[nrpe2nodexp-bacula_sd.timer]
+ ensure => stopped
+ provider => systemd
+ enable => False
+ before => ['Exec[systemd daemon-reload for nrpe2nodexp-bacula_sd.timer (nrpe2nodexp-bacula_sd.timer)]']
- Systemd::Unit[nrpe2nodexp-bacula_sd.service]
- Parameters differences:
--- Systemd::Unit[nrpe2nodexp-bacula_sd.service].orig
+++ Systemd::Unit[nrpe2nodexp-bacula_sd.service]
+ override => False
+ ensure => absent
+ unit => nrpe2nodexp-bacula_sd.service
+ override_filename => puppet-override.conf
+ restart => False
+ require => ['Class[Systemd]']
- Service[bacula-sd]
- Parameters differences:
--- Service[bacula-sd].orig
+++ Service[bacula-sd]
+ ensure => running
+ require => Package[bacula-sd]
- Monitoring::Exported_nagios_service[backup2014 raid_broadcom_raid]