Tim Starling has submitted this change and it was merged.
Change subject: Require a password for Redis
......................................................................
Require a password for Redis
Ibc0f4908 must be deployed first.
Change-Id: I05e966060aacac8fa98499faf235b5b2ad3c16d3
---
M manifests/role/redisdb.pp
M manifests/site.pp
M modules/redis/manifests/init.pp
M modules/redis/templates/redis.conf.erb
4 files changed, 16 insertions(+), 5 deletions(-)
Approvals:
Tim Starling: Verified; Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/role/redisdb.pp b/manifests/role/redisdb.pp
index 5c27ab8..ae0ea23 100644
--- a/manifests/role/redisdb.pp
+++ b/manifests/role/redisdb.pp
@@ -13,12 +13,14 @@
system_role { "db::redis": description => "Redis server" }
- include standard
+ include standard,
+ passwords::redis
class { "::redis":
maxmemory => $maxmemory,
persist => "aof",
redis_replication => $redis_replication,
+ password => $passwords::redis::main_password,
}
include redis::ganglia
diff --git a/manifests/site.pp b/manifests/site.pp
index f7a48c9..1cddc40 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -1633,7 +1633,8 @@
'mc15' => 'mc1015',
'mc16' => 'mc1016',
}
- include role::memcached
+ include role::memcached,
+ passwords::redis
file { "/a":
ensure => directory;
@@ -1642,6 +1643,7 @@
class { "redis":
maxmemory => "500Mb",
redis_replication => $redis_replication,
+ password => $passwords::redis::main_password,
}
include redis::ganglia
}
@@ -1681,7 +1683,8 @@
'mc1016' => 'mc16',
}
- include role::memcached
+ include role::memcached,
+ passwords::redis
file { "/a":
ensure => directory;
@@ -1690,6 +1693,7 @@
class { "redis":
maxmemory => "500Mb",
redis_replication => $redis_replication,
+ password => $passwords::redis::main_password,
}
include redis::ganglia
}
diff --git a/modules/redis/manifests/init.pp b/modules/redis/manifests/init.pp
index ddf51a2..6e446e3 100644
--- a/modules/redis/manifests/init.pp
+++ b/modules/redis/manifests/init.pp
@@ -12,6 +12,7 @@
$package_version = "2:2.6.3-wmf1",
$servicename = "redis-server",
$monitor = true,
+ $password = false,
) {
case $::operatingsystem {
debian, ubuntu: {
diff --git a/modules/redis/templates/redis.conf.erb
b/modules/redis/templates/redis.conf.erb
index 95d44b4..e31de08 100644
--- a/modules/redis/templates/redis.conf.erb
+++ b/modules/redis/templates/redis.conf.erb
@@ -159,7 +159,9 @@
# starting the replication synchronization process, otherwise the master will
# refuse the slave request.
#
-# masterauth <master-password>
+<% if @password %>
+ masterauth <%= @password %>
+<% end %>
# When a slave lost the connection with the master, or when the replication
# is still in progress, the slave can act in two different ways:
@@ -236,7 +238,9 @@
# 150k passwords per second against a good box. This means that you should
# use a very strong password otherwise it will be very easy to break.
#
-# requirepass foobared
+<% if @password %>
+ requirepass <%= @password %>
+<% end %>
# Command renaming.
#
--
To view, visit https://gerrit.wikimedia.org/r/61740
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I05e966060aacac8fa98499faf235b5b2ad3c16d3
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Tim Starling <[email protected]>
Gerrit-Reviewer: Tim Starling <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
