--- Nftables::Service[rsyncd_access_srv-org-wikimedia-releases-releases2003.codfw.wmnet].orig
+++ Nftables::Service[rsyncd_access_srv-org-wikimedia-releases-releases2003.codfw.wmnet]
+ port => [873, 1873]
+ desc =>
+ unrestricted_access => False
+ proto => tcp
+ prio => 10
+ src_ips => ['10.192.16.72', '2620:0:860:102:10:192:16:72']
+ ensure => present
+ notrack => False
File[/var/log/rsync-srv-patches-releases-primary]
- Parameters differences:
--- File[/var/log/rsync-srv-patches-releases-primary].orig
+++ File[/var/log/rsync-srv-patches-releases-primary]
@@
- ensure => absent
+ ensure => directory
- Class[Profile::Releases::Mediawiki::Security]
- Parameters differences:
--- Class[Profile::Releases::Mediawiki::Security].orig
+++ Class[Profile::Releases::Mediawiki::Security]
@@
- primary_server => releases2003.codfw.wmnet
+ primary_server => releases1003.eqiad.wmnet
@@
- secondary_servers => ['releases1003.eqiad.wmnet']
+ secondary_servers => ['releases2003.codfw.wmnet']
- File[/etc/rsyslog.d/40-wmf-auto-restart-rsync.conf]
- Parameters differences:
--- File[/etc/rsyslog.d/40-wmf-auto-restart-rsync.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-rsync.conf]
@@
- ensure => absent
+ ensure => present
- Class[Rsync::Server]
- Parameters differences:
--- Class[Rsync::Server].orig
+++ Class[Rsync::Server]
+ use_chroot => yes
+ address => 0.0.0.0
+ rsyncd_conf => {}
+ rsync_opts => []
+ timeout => 300
+ ensure_service => running
- File[/etc/rsync.d]
- Parameters differences:
--- File[/etc/rsync.d].orig
+++ File[/etc/rsync.d]
+ group => root
+ force => True
+ recurse => True
+ ensure => absent
+ purge => True
+ owner => root
- Class[Rsync::Server::Stunnel]
- Parameters differences:
--- Class[Rsync::Server::Stunnel].orig
+++ Class[Rsync::Server::Stunnel]
+ ensure => present
+ ensure_service => running
- File[/usr/local/sbin/sync-srv-patches-releases-primary-ssl-wrapper]
- Parameters differences:
--- File[/usr/local/sbin/sync-srv-patches-releases-primary-ssl-wrapper].orig
+++ File[/usr/local/sbin/sync-srv-patches-releases-primary-ssl-wrapper]
+ mode => 0755
+ ensure => present
+ group => root
+ owner => root
- Content differences:
--- /usr/local/sbin/sync-srv-patches-releases-primary-ssl-wrapper.orig
+++ /usr/local/sbin/sync-srv-patches-releases-primary-ssl-wrapper
@@ -0,0 +1,29 @@
+#!/bin/sh
+# This file is managed by Puppet
+#
+# This script is expected to be used as the --rsh argument to rsync.
+# It will wrap rsync's communication in stunnel, and validate the
+# server's cert vs the Puppet CA.
+
+set -eu
+
+cleanup() {
+ [ -f "$CONFIG" ] && rm -f "$CONFIG"
+}
+trap cleanup EXIT
+
+CONFIG=$(mktemp -t sync-ssl-wrapper.stunnel.conf.XXXXXXXX)
+
+RSYNC_SSL_PORT=${RSYNC_SSL_PORT:-1873}
+
+cat > "$CONFIG" <<EOF
+foreground = yes
+client = yes
+connect = $1:$RSYNC_SSL_PORT
+CAfile = /var/lib/puppet/ssl/certs/ca.pem
+cert = /var/lib/puppet/ssl/certs/releases1003.eqiad.wmnet.pem
+key = /var/lib/puppet/ssl/private_keys/releases1003.eqiad.wmnet.pem
+verifyChain = yes
+EOF
+
+/usr/bin/stunnel4 "$CONFIG"
- File[/etc/logrotate.d/rsync-srv-patches-releases-primary]
- Parameters differences:
--- File[/etc/logrotate.d/rsync-srv-patches-releases-primary].orig
+++ File[/etc/logrotate.d/rsync-srv-patches-releases-primary]
@@
- ensure => absent
+ ensure => present
- File[/etc/logrotate.d/rsync-srv-patches-releases1003_eqiad_wmnet]
- Parameters differences:
--- File[/etc/logrotate.d/rsync-srv-patches-releases1003_eqiad_wmnet].orig
+++ File[/etc/logrotate.d/rsync-srv-patches-releases1003_eqiad_wmnet]
@@
- ensure => present
+ ensure => absent
- File[/etc/rsyslog.d/40-rsync-srv-patches-releases-primary.conf]
- Parameters differences:
--- File[/etc/rsyslog.d/40-rsync-srv-patches-releases-primary.conf].orig
+++ File[/etc/rsyslog.d/40-rsync-srv-patches-releases-primary.conf]
@@
- ensure => absent
+ ensure => present
- File[/usr/local/sbin/sync-srv-mediawiki-private-releases1003.eqiad.wmnet]
- Parameters differences:
--- File[/usr/local/sbin/sync-srv-mediawiki-private-releases1003.eqiad.wmnet].orig
+++ File[/usr/local/sbin/sync-srv-mediawiki-private-releases1003.eqiad.wmnet]
@@
- ensure => present
+ ensure => absent
- File[/usr/local/sbin/sync-srv-org-wikimedia-releases-releases1003.eqiad.wmnet]
- Content differences:
--- /usr/local/sbin/sync-srv-org-wikimedia-releases-releases1003.eqiad.wmnet.orig
+++ /usr/local/sbin/sync-srv-org-wikimedia-releases-releases1003.eqiad.wmnet
@@ -1,2 +1,2 @@
#!/bin/sh
-/usr/bin/rsync --rsh /usr/local/sbin/sync-srv-org-wikimedia-releases-releases1003.eqiad.wmnet-ssl-wrapper --delete -a rsync://releases2003.codfw.wmnet/srv-org-wikimedia-releases-releases1003.eqiad.wmnet /srv/org/wikimedia/releases/
+/usr/bin/rsync --rsh /usr/local/sbin/sync-srv-org-wikimedia-releases-releases1003.eqiad.wmnet-ssl-wrapper --delete -a rsync://releases1003.eqiad.wmnet/srv-org-wikimedia-releases-releases1003.eqiad.wmnet /srv/org/wikimedia/releases/
- Rsyslog::Conf[rsync-srv-patches-releases-primary]
- Parameters differences:
--- Rsyslog::Conf[rsync-srv-patches-releases-primary].orig
+++ Rsyslog::Conf[rsync-srv-patches-releases-primary]
@@
- ensure => absent
+ ensure => present
- File[/usr/local/sbin/sync-srv-patches-releases-primary]
- Parameters differences:
--- File[/usr/local/sbin/sync-srv-patches-releases-primary].orig
+++ File[/usr/local/sbin/sync-srv-patches-releases-primary]
+ mode => 0755
+ ensure => present
+ group => root
+ owner => root
- Content differences:
--- /usr/local/sbin/sync-srv-patches-releases-primary.orig
+++ /usr/local/sbin/sync-srv-patches-releases-primary
@@ -0,0 +1,2 @@
+#!/bin/sh
+/usr/bin/rsync --rsh /usr/local/sbin/sync-srv-patches-releases-primary-ssl-wrapper --delete -a --chown=jenkins:705 rsync://deploy1003.eqiad.wmnet/srv-patches-releases-primary /srv/patches/
- Exec[systemd daemon-reload for rsync-srv-patches-releases1003.eqiad.wmnet.timer (rsync-srv-patches-releases1003.eqiad.wmnet.timer)]
- Parameters differences:
--- Exec[systemd daemon-reload for rsync-srv-patches-releases1003.eqiad.wmnet.timer (rsync-srv-patches-releases1003.eqiad.wmnet.timer)].orig
+++ Exec[systemd daemon-reload for rsync-srv-patches-releases1003.eqiad.wmnet.timer (rsync-srv-patches-releases1003.eqiad.wmnet.timer)]
- before => ['Service[rsync-srv-patches-releases1003.eqiad.wmnet.timer]']
- Systemd::Syslog[rsync-srv-patches-releases1003_eqiad_wmnet]
- Parameters differences:
--- Systemd::Syslog[rsync-srv-patches-releases1003_eqiad_wmnet].orig
+++ Systemd::Syslog[rsync-srv-patches-releases1003_eqiad_wmnet]
@@
- ensure => present
+ ensure => absent
- Rsync::Server::Module[var-lib-jenkins-releases1003.eqiad.wmnet]
- Parameters differences:
--- Rsync::Server::Module[var-lib-jenkins-releases1003.eqiad.wmnet].orig
+++ Rsync::Server::Module[var-lib-jenkins-releases1003.eqiad.wmnet]
+ max_connections => 0
+ auto_firewall => True
+ qos_low => False
+ write_only => no
+ lock_file => /var/run/rsyncd.lock
+ read_only => yes
+ uid => 0
+ chroot => True
+ list => yes
+ hosts_allow => ['releases1003.eqiad.wmnet']
+ gid => 0
+ ensure => present
+ path => /var/lib/jenkins
- Concat_file[/etc/rsyncd.conf]
- Parameters differences:
--- Concat_file[/etc/rsyncd.conf].orig
+++ Concat_file[/etc/rsyncd.conf]
+ group => root
+ format => plain
+ tag => _etc_rsyncd.conf
+ mode => 0444
+ show_diff => True
+ backup => puppet
+ order => alpha
+ replace => True
+ force => False
+ ensure_newline => False
+ owner => root
- File[/usr/local/sbin/sync-srv-patches-releases1003.eqiad.wmnet]
- Parameters differences:
--- File[/usr/local/sbin/sync-srv-patches-releases1003.eqiad.wmnet].orig
+++ File[/usr/local/sbin/sync-srv-patches-releases1003.eqiad.wmnet]
@@
- ensure => present
+ ensure => absent
- Content differences:
--- /usr/local/sbin/sync-srv-patches-releases1003.eqiad.wmnet.orig
+++ /usr/local/sbin/sync-srv-patches-releases1003.eqiad.wmnet
@@ -1,2 +1,2 @@
#!/bin/sh
-/usr/bin/rsync --rsh /usr/local/sbin/sync-srv-patches-releases1003.eqiad.wmnet-ssl-wrapper --delete -a --chown=jenkins:705 rsync://deploy1003.eqiad.wmnet/srv-patches-releases1003.eqiad.wmnet /srv/patches/
+/usr/bin/rsync --rsh /usr/local/sbin/sync-srv-patches-releases1003.eqiad.wmnet-ssl-wrapper --delete -a rsync://deploy1003.eqiad.wmnet/srv-patches-releases1003.eqiad.wmnet /srv/patches/
- Logrotate::Conf[wmf_auto_restart_rsync]
- Parameters differences:
--- Logrotate::Conf[wmf_auto_restart_rsync].orig
+++ Logrotate::Conf[wmf_auto_restart_rsync]
@@
- ensure => absent
+ ensure => present
- Rsync::Server::Module[srv-org-wikimedia-releases-releases1003.eqiad.wmnet]
- Parameters differences:
--- Rsync::Server::Module[srv-org-wikimedia-releases-releases1003.eqiad.wmnet].orig
+++ Rsync::Server::Module[srv-org-wikimedia-releases-releases1003.eqiad.wmnet]
+ max_connections => 0
+ auto_firewall => True
+ qos_low => False
+ write_only => no
+ lock_file => /var/run/rsyncd.lock
+ read_only => yes
+ uid => 0
+ chroot => True
+ list => yes
+ hosts_allow => ['releases1003.eqiad.wmnet']
+ gid => 0
+ ensure => present
+ path => /srv/org/wikimedia/releases
- Service[rsync-srv-patches-releases-primary.timer]
- Parameters differences:
--- Service[rsync-srv-patches-releases-primary.timer].orig
+++ Service[rsync-srv-patches-releases-primary.timer]
- before => ['Exec[systemd daemon-reload for rsync-srv-patches-releases-primary.timer (rsync-srv-patches-releases-primary.timer)]']
@@
- ensure => stopped
+ ensure => running
@@
- enable => False
+ enable => True
- Systemd::Unit[rsync-srv-patches-releases-primary.service]
- Parameters differences:
--- Systemd::Unit[rsync-srv-patches-releases-primary.service].orig
+++ Systemd::Unit[rsync-srv-patches-releases-primary.service]
@@
- ensure => absent
+ ensure => present
- File[/etc/ferm/conf.d/10_rsyncd_access_var_lib_jenkins_releases1003_eqiad_wmnet]
- Parameters differences:
--- File[/etc/ferm/conf.d/10_rsyncd_access_var_lib_jenkins_releases1003_eqiad_wmnet].orig
+++ File[/etc/ferm/conf.d/10_rsyncd_access_var_lib_jenkins_releases1003_eqiad_wmnet]
+ notify => Service[ferm]
+ tag => ferm
+ group => root
+ require => File[/etc/ferm/conf.d]
+ mode => 0400
+ ensure => present
+ owner => root
- Content differences:
--- /etc/ferm/conf.d/10_rsyncd_access_var_lib_jenkins_releases1003_eqiad_wmnet.orig
+++ /etc/ferm/conf.d/10_rsyncd_access_var_lib_jenkins_releases1003_eqiad_wmnet
@@ -0,0 +1,6 @@
+# Autogenerated by puppet. DO NOT EDIT BY HAND!
+#
+#
+&R_SERVICE(tcp, (873 1873), (10.64.48.34 2620:0:861:107:10:64:48:34));
+
+
- Rsync::Quickdatacopy[srv-mediawiki-private-releases2003.codfw.wmnet]
- Parameters differences:
--- Rsync::Quickdatacopy[srv-mediawiki-private-releases2003.codfw.wmnet].orig
+++ Rsync::Quickdatacopy[srv-mediawiki-private-releases2003.codfw.wmnet]
@@
- ensure => absent
+ ensure => present
- Rsync::Quickdatacopy[srv-mediawiki-private-primary]
- Parameters differences:
--- Rsync::Quickdatacopy[srv-mediawiki-private-primary].orig
+++ Rsync::Quickdatacopy[srv-mediawiki-private-primary]
@@
- dest_host => releases2003.codfw.wmnet
+ dest_host => releases1003.eqiad.wmnet
- Systemd::Unit[rsync-srv-patches-releases1003.eqiad.wmnet.service]
- Parameters differences:
--- Systemd::Unit[rsync-srv-patches-releases1003.eqiad.wmnet.service].orig
+++ Systemd::Unit[rsync-srv-patches-releases1003.eqiad.wmnet.service]
@@
- ensure => present
+ ensure => absent
- Systemd::Timer[rsync-srv-patches-releases-primary]
- Parameters differences:
--- Systemd::Timer[rsync-srv-patches-releases-primary].orig
+++ Systemd::Timer[rsync-srv-patches-releases-primary]
@@
- ensure => absent
+ ensure => present
- Systemd::Service[rsync-srv-patches-releases1003.eqiad.wmnet]
- Parameters differences:
--- Systemd::Service[rsync-srv-patches-releases1003.eqiad.wmnet].orig
+++ Systemd::Service[rsync-srv-patches-releases1003.eqiad.wmnet]
@@
- ensure => present
+ ensure => absent
- File[/etc/logrotate.d/wmf_auto_restart_rsync]
- Parameters differences:
--- File[/etc/logrotate.d/wmf_auto_restart_rsync].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_rsync]
@@
- ensure => absent
+ ensure => present
- Rsync::Quickdatacopy[srv-patches-releases-primary]
- Parameters differences:
--- Rsync::Quickdatacopy[srv-patches-releases-primary].orig
+++ Rsync::Quickdatacopy[srv-patches-releases-primary]
@@
- dest_host => releases2003.codfw.wmnet
+ dest_host => releases1003.eqiad.wmnet
- Ferm::Service[rsyncd_access_srv_org_wikimedia_releases_releases1003_eqiad_wmnet]
- Parameters differences:
--- Ferm::Service[rsyncd_access_srv_org_wikimedia_releases_releases1003_eqiad_wmnet].orig
+++ Ferm::Service[rsyncd_access_srv_org_wikimedia_releases_releases1003_eqiad_wmnet]
+ port => [873, 1873]
+ srange => ['releases1003.eqiad.wmnet']
+ desc =>
+ unrestricted_access => False
+ proto => tcp
+ prio => 10
+ ensure => present
+ notrack => False
- Rsyslog::Conf[rsync-srv-patches-releases1003_eqiad_wmnet]
- Parameters differences:
--- Rsyslog::Conf[rsync-srv-patches-releases1003_eqiad_wmnet].orig
+++ Rsyslog::Conf[rsync-srv-patches-releases1003_eqiad_wmnet]
@@
- ensure => present
+ ensure => absent
- Nftables::Service[rsyncd_access_var-lib-jenkins-releases1003.eqiad.wmnet]
- Parameters differences:
--- Nftables::Service[rsyncd_access_var-lib-jenkins-releases1003.eqiad.wmnet].orig
+++ Nftables::Service[rsyncd_access_var-lib-jenkins-releases1003.eqiad.wmnet]
+ port => [873, 1873]
+ desc =>
+ unrestricted_access => False
+ proto => tcp
+ prio => 10
+ src_ips => ['10.64.48.34', '2620:0:861:107:10:64:48:34']
+ ensure => present
+ notrack => False
- Concat_fragment[/etc/rsyncd.conf-header]
- Parameters differences:
--- Concat_fragment[/etc/rsyncd.conf-header].orig
+++ Concat_fragment[/etc/rsyncd.conf-header]
+ tag => _etc_rsyncd.conf
+ order => 01
+ target => /etc/rsyncd.conf
- Content differences:
--- /etc/rsyncd.conf-header.orig
+++ /etc/rsyncd.conf-header
@@ -0,0 +1,11 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+
+uid = nobody
+gid = nogroup
+use chroot = yes
+
+log format = %t %a %m %f %b
+syslog facility = local3
+timeout = 300
+address = 0.0.0.0
- File[/etc/default/rsync]
- Parameters differences:
--- File[/etc/default/rsync].orig
+++ File[/etc/default/rsync]
+ mode => 0444
+ ensure => present
+ group => root
+ owner => root
- Content differences:
--- /etc/default/rsync.orig
+++ /etc/default/rsync
@@ -0,0 +1,46 @@
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///rsync/rsync.default.erb
+#####################################################################
+
+# defaults file for rsync daemon mode
+
+# start rsync in daemon mode from init.d script?
+# only allowed values are "true", "false", and "inetd"
+# Use "inetd" if you want to start the rsyncd from inetd,
+# all this does is prevent the init.d script from printing a message
+# about not starting rsyncd (you still need to modify inetd's config yourself).
+RSYNC_ENABLE=true
+
+# which file should be used as the configuration file for rsync.
+# This file is used instead of the default /etc/rsyncd.conf
+# Warning: This option has no effect if the daemon is accessed
+# using a remote shell. When using a different file for
+# rsync you might want to symlink /etc/rsyncd.conf to
+# that file.
+RSYNC_CONFIG_FILE=/etc/rsyncd.conf
+
+# what extra options to give rsync --daemon?
+# that excludes the --daemon; that's always done in the init.d script
+# Possibilities are:
+# --address=123.45.67.89 (bind to a specific IP address)
+# --port=8730 (bind to specified port; default 873)
+RSYNC_OPTS=''
+
+# run rsyncd at a nice level?
+# the rsync daemon can impact performance due to much I/O and CPU usage,
+# so you may want to run it at a nicer priority than the default priority.
+# Allowed values are 0 - 19 inclusive; 10 is a reasonable value.
+RSYNC_NICE=''
+
+# run rsyncd with ionice?
+# "ionice" does for IO load what "nice" does for CPU load.
+# As rsync is often used for backups which aren't all that time-critical,
+# reducing the rsync IO priority will benefit the rest of the system.
+# See the manpage for ionice for allowed options.
+# -c3 is recommended, this will run rsync IO at "idle" priority. Uncomment
+# the next line to activate this.
+# RSYNC_IONICE='-c3'
+
+# Don't forget to create an appropriate config file,
+# else the daemon will not start.
- Concat[/etc/rsyncd.conf]
- Parameters differences:
--- Concat[/etc/rsyncd.conf].orig
+++ Concat[/etc/rsyncd.conf]
+ group => root
+ format => plain
+ mode => 0444
+ warn => False
+ show_diff => True
+ backup => puppet
+ order => alpha
+ replace => True
+ owner => root
+ force => False
+ ensure_newline => False
+ ensure => present
+ path => /etc/rsyncd.conf
- File_line[auto_restart_file_presence_rsync]
- Parameters differences:
--- File_line[auto_restart_file_presence_rsync].orig
+++ File_line[auto_restart_file_presence_rsync]
@@
- ensure => absent
+ ensure => present
- Service[stunnel4]
- Parameters differences: