Dzahn has submitted this change and it was merged.
Change subject: admin: add group 'mw-log-readers'
......................................................................
admin: add group 'mw-log-readers'
Add a group for users who can login on fluorine and read Mediawiki
log files (/a/mw-log). These logs are world-readable so no sudo
rules are needed, just regular shell login.
Many but not all logs here are available in logstash and some users
need the additional logs on fluorine, such as api.log.
There is an existing group to get access to fluorine but that is
the "restricted" group which isn't as restricted as it sounds.
It additionally has sudo ALL as Apache and other things that are all
not needed for the common "I just need to read the logs" use case.
This change only adds the new group and applies it on fluorine,
it does _not_ add a user to that group yet. So it does not have
to be treated like an access request.
Bug:T108696
Change-Id: I125fcbccab6e5e583dabfef6b75513513db08963
---
M hieradata/hosts/fluorine.yaml
M modules/admin/data/data.yaml
2 files changed, 5 insertions(+), 1 deletion(-)
Approvals:
jenkins-bot: Verified
Dzahn: Looks good to me, approved
diff --git a/hieradata/hosts/fluorine.yaml b/hieradata/hosts/fluorine.yaml
index b27cec2..f1ac4e6 100644
--- a/hieradata/hosts/fluorine.yaml
+++ b/hieradata/hosts/fluorine.yaml
@@ -1,3 +1,4 @@
admin::groups:
- deployment
- restricted
+ - mw-log-readers
diff --git a/modules/admin/data/data.yaml b/modules/admin/data/data.yaml
index b3ebefd..f5f02a7 100644
--- a/modules/admin/data/data.yaml
+++ b/modules/admin/data/data.yaml
@@ -360,7 +360,10 @@
members: [bsitzmann, dbrant]
privileges: ['ALL = NOPASSWD: /usr/sbin/service mobileapps *',
'ALL = (mobileapps) NOPASSWD: ALL']
-
+ mw-log-readers:
+ gid: 760
+ description: users who can login on fluorine and read mediawiki logs
+ members: []
users:
rush:
ensure: present
--
To view, visit https://gerrit.wikimedia.org/r/232282
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I125fcbccab6e5e583dabfef6b75513513db08963
Gerrit-PatchSet: 3
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Dzahn <[email protected]>
Gerrit-Reviewer: Alex Monk <[email protected]>
Gerrit-Reviewer: ArielGlenn <[email protected]>
Gerrit-Reviewer: BryanDavis <[email protected]>
Gerrit-Reviewer: Dzahn <[email protected]>
Gerrit-Reviewer: EBernhardson <[email protected]>
Gerrit-Reviewer: Muehlenhoff <[email protected]>
Gerrit-Reviewer: RobH <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
