Akosiaris has submitted this change and it was merged.
Change subject: Allow ytterbium access to CI and gitblit
......................................................................
Allow ytterbium access to CI and gitblit
For git replications purposes
Change-Id: I864c9010d10c0cf057dbcbe372c0520495cd009e
---
M manifests/role/gitblit.pp
M modules/contint/manifests/firewall.pp
2 files changed, 11 insertions(+), 1 deletion(-)
Approvals:
Akosiaris: Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/role/gitblit.pp b/manifests/role/gitblit.pp
index e7a098a..567424c 100644
--- a/manifests/role/gitblit.pp
+++ b/manifests/role/gitblit.pp
@@ -14,7 +14,12 @@
# Firewall GitBlit, it should be accessed from localhost or Varnish
include base::firewall
ferm::rule { 'gitblit_8080':
- rule => 'proto tcp dport 8080 { saddr $INTERNAL ACCEPT; DROP; }'
+ rule => 'proto tcp dport 8080 { saddr $INTERNAL ACCEPT; }'
+ }
+
+ # Add ytterbium to ssh exceptions for git replication
+ ferm::rule { 'ytterbium_ssh_git':
+ rule => 'proto tcp dport ssh { saddr (208.80.154.80
2620:0:861:3:92b1:1cff:fe2a:e60 2620:0:861:3:208:80:154:81) ACCEPT; }'
}
# NRPE for monitoring
include nrpe
diff --git a/modules/contint/manifests/firewall.pp
b/modules/contint/manifests/firewall.pp
index d03d6a2..be66c42 100644
--- a/modules/contint/manifests/firewall.pp
+++ b/modules/contint/manifests/firewall.pp
@@ -27,6 +27,11 @@
rule => 'proto tcp dport 9418 { saddr $INTERNAL ACCEPT; }'
}
+ # Need to grant ytterbium ssh access for git
+ ferm::rule { 'ytterbium_ssh':
+ rule => 'proto tcp dport ssh { saddr (208.80.154.80
2620:0:861:3:92b1:1cff:fe2a:e60 2620:0:861:3:208:80:154:81) ACCEPT; }'
+ }
+
# ALLOWS:
# web access
--
To view, visit https://gerrit.wikimedia.org/r/96527
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I864c9010d10c0cf057dbcbe372c0520495cd009e
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Akosiaris <[email protected]>
Gerrit-Reviewer: Akosiaris <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
