System configuration for OpenStack Infrastructure
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

site.pp 46KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126
  1. #
  2. # Top-level variables
  3. #
  4. # There must not be any whitespace between this comment and the variables or
  5. # in between any two variables in order for them to be correctly parsed and
  6. # passed around in test.sh
  7. #
  8. $elasticsearch_nodes = [
  9. 'elasticsearch02.openstack.org',
  10. 'elasticsearch03.openstack.org',
  11. 'elasticsearch04.openstack.org',
  12. 'elasticsearch05.openstack.org',
  13. 'elasticsearch06.openstack.org',
  14. 'elasticsearch07.openstack.org',
  15. ]
  16. $elasticsearch_clients = [
  17. 'logstash.openstack.org',
  18. 'logstash-worker01.openstack.org',
  19. 'logstash-worker02.openstack.org',
  20. 'logstash-worker03.openstack.org',
  21. 'logstash-worker04.openstack.org',
  22. 'logstash-worker05.openstack.org',
  23. 'logstash-worker06.openstack.org',
  24. 'logstash-worker07.openstack.org',
  25. 'logstash-worker08.openstack.org',
  26. 'logstash-worker09.openstack.org',
  27. 'logstash-worker10.openstack.org',
  28. 'logstash-worker11.openstack.org',
  29. 'logstash-worker12.openstack.org',
  30. 'logstash-worker13.openstack.org',
  31. 'logstash-worker14.openstack.org',
  32. 'logstash-worker15.openstack.org',
  33. 'logstash-worker16.openstack.org',
  34. 'logstash-worker17.openstack.org',
  35. 'logstash-worker18.openstack.org',
  36. 'logstash-worker19.openstack.org',
  37. 'logstash-worker20.openstack.org',
  38. 'subunit-worker01.openstack.org',
  39. ]
  40. #
  41. # Default: should at least behave like an openstack server
  42. #
  43. node default {
  44. class { 'openstack_project::server':
  45. sysadmins => hiera('sysadmins', []),
  46. }
  47. }
  48. #
  49. # Long lived servers:
  50. #
  51. # Node-OS: precise
  52. # Node-OS: trusty
  53. node 'review.openstack.org' {
  54. class { 'openstack_project::server':
  55. iptables_public_tcp_ports => [80, 443, 29418],
  56. sysadmins => hiera('sysadmins', []),
  57. }
  58. class { 'openstack_project::review':
  59. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  60. github_oauth_token => hiera('gerrit_github_token'),
  61. github_project_username => hiera('github_project_username', 'username'),
  62. github_project_password => hiera('github_project_password'),
  63. mysql_host => hiera('gerrit_mysql_host', 'localhost'),
  64. mysql_password => hiera('gerrit_mysql_password'),
  65. email_private_key => hiera('gerrit_email_private_key'),
  66. token_private_key => hiera('gerrit_rest_token_private_key'),
  67. gerritbot_password => hiera('gerrit_gerritbot_password'),
  68. gerritbot_ssh_rsa_key_contents => hiera('gerritbot_ssh_rsa_key_contents'),
  69. gerritbot_ssh_rsa_pubkey_contents => hiera('gerritbot_ssh_rsa_pubkey_contents'),
  70. ssl_cert_file_contents => hiera('gerrit_ssl_cert_file_contents'),
  71. ssl_key_file_contents => hiera('gerrit_ssl_key_file_contents'),
  72. ssl_chain_file_contents => hiera('gerrit_ssl_chain_file_contents'),
  73. ssh_dsa_key_contents => hiera('gerrit_ssh_dsa_key_contents'),
  74. ssh_dsa_pubkey_contents => hiera('gerrit_ssh_dsa_pubkey_contents'),
  75. ssh_rsa_key_contents => hiera('gerrit_ssh_rsa_key_contents'),
  76. ssh_rsa_pubkey_contents => hiera('gerrit_ssh_rsa_pubkey_contents'),
  77. ssh_project_rsa_key_contents => hiera('gerrit_project_ssh_rsa_key_contents'),
  78. ssh_project_rsa_pubkey_contents => hiera('gerrit_project_ssh_rsa_pubkey_contents'),
  79. ssh_welcome_rsa_key_contents => hiera('welcome_message_gerrit_ssh_private_key'),
  80. ssh_welcome_rsa_pubkey_contents => hiera('welcome_message_gerrit_ssh_public_key'),
  81. ssh_replication_rsa_key_contents => hiera('gerrit_replication_ssh_rsa_key_contents'),
  82. ssh_replication_rsa_pubkey_contents => hiera('gerrit_replication_ssh_rsa_pubkey_contents'),
  83. lp_sync_consumer_key => hiera('gerrit_lp_consumer_key'),
  84. lp_sync_token => hiera('gerrit_lp_access_token'),
  85. lp_sync_secret => hiera('gerrit_lp_access_secret'),
  86. contactstore_appsec => hiera('gerrit_contactstore_appsec'),
  87. contactstore_pubkey => hiera('gerrit_contactstore_pubkey'),
  88. swift_username => hiera('swift_store_user', 'username'),
  89. swift_password => hiera('swift_store_key'),
  90. }
  91. }
  92. # Node-OS: trusty
  93. node 'review-dev.openstack.org' {
  94. class { 'openstack_project::server':
  95. iptables_public_tcp_ports => [80, 443, 29418],
  96. sysadmins => hiera('sysadmins', []),
  97. afs => true,
  98. }
  99. class { 'openstack_project::review_dev':
  100. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  101. github_oauth_token => hiera('gerrit_dev_github_token'),
  102. github_project_username => hiera('github_dev_project_username', 'username'),
  103. github_project_password => hiera('github_dev_project_password'),
  104. mysql_host => hiera('gerrit_dev_mysql_host', 'localhost'),
  105. mysql_password => hiera('gerrit_dev_mysql_password'),
  106. email_private_key => hiera('gerrit_dev_email_private_key'),
  107. contactstore_appsec => hiera('gerrit_dev_contactstore_appsec'),
  108. contactstore_pubkey => hiera('gerrit_dev_contactstore_pubkey'),
  109. ssh_dsa_key_contents => hiera('gerrit_dev_ssh_dsa_key_contents'),
  110. ssh_dsa_pubkey_contents => hiera('gerrit_dev_ssh_dsa_pubkey_contents'),
  111. ssh_rsa_key_contents => hiera('gerrit_dev_ssh_rsa_key_contents'),
  112. ssh_rsa_pubkey_contents => hiera('gerrit_dev_ssh_rsa_pubkey_contents'),
  113. ssh_project_rsa_key_contents => hiera('gerrit_dev_project_ssh_rsa_key_contents'),
  114. ssh_project_rsa_pubkey_contents => hiera('gerrit_dev_project_ssh_rsa_pubkey_contents'),
  115. ssh_replication_rsa_key_contents => hiera('gerrit_dev_replication_ssh_rsa_key_contents'),
  116. ssh_replication_rsa_pubkey_contents => hiera('gerrit_dev_replication_ssh_rsa_pubkey_contents'),
  117. lp_sync_consumer_key => hiera('gerrit_dev_lp_consumer_key'),
  118. lp_sync_token => hiera('gerrit_dev_lp_access_token'),
  119. lp_sync_secret => hiera('gerrit_dev_lp_access_secret'),
  120. }
  121. }
  122. # Node-OS: trusty
  123. node 'grafana.openstack.org' {
  124. class { 'openstack_project::server':
  125. iptables_public_tcp_ports => [80],
  126. sysadmins => hiera('sysadmins', []),
  127. }
  128. class { 'openstack_project::grafana':
  129. admin_password => hiera('grafana_admin_password'),
  130. admin_user => hiera('grafana_admin_user', 'username'),
  131. mysql_host => hiera('grafana_mysql_host', 'localhost'),
  132. mysql_name => hiera('grafana_mysql_name'),
  133. mysql_password => hiera('grafana_mysql_password'),
  134. mysql_user => hiera('grafana_mysql_user', 'username'),
  135. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  136. secret_key => hiera('grafana_secret_key'),
  137. }
  138. }
  139. # Node-OS: trusty
  140. node 'health.openstack.org' {
  141. class { 'openstack_project::server':
  142. iptables_public_tcp_ports => [80, 443],
  143. sysadmins => hiera('sysadmins', []),
  144. }
  145. class { 'openstack_project::openstack_health_api':
  146. subunit2sql_db_host => hiera('subunit2sql_db_host', 'localhost'),
  147. }
  148. }
  149. # Node-OS: trusty
  150. node 'stackalytics.openstack.org' {
  151. class { 'openstack_project::server':
  152. iptables_public_tcp_ports => [80],
  153. sysadmins => hiera('sysadmins', []),
  154. }
  155. class { 'openstack_project::stackalytics':
  156. gerrit_ssh_user => hiera('stackalytics_gerrit_ssh_user'),
  157. stackalytics_ssh_private_key => hiera('stackalytics_ssh_private_key_contents'),
  158. }
  159. }
  160. # Node-OS: precise
  161. node 'jenkins.openstack.org' {
  162. $group = "jenkins"
  163. $zmq_event_receivers = ['logstash.openstack.org',
  164. 'nodepool.openstack.org']
  165. $iptables_rule = regsubst ($zmq_event_receivers,
  166. '^(.*)$', '-m state --state NEW -m tcp -p tcp --dport 8888 -s \1 -j ACCEPT')
  167. class { 'openstack_project::server':
  168. iptables_public_tcp_ports => [80, 443],
  169. iptables_rules6 => $iptables_rule,
  170. iptables_rules4 => $iptables_rule,
  171. sysadmins => hiera('sysadmins', []),
  172. puppetmaster_server => 'puppetmaster.openstack.org',
  173. }
  174. class { 'openstack_project::jenkins':
  175. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  176. jenkins_password => hiera('jenkins_jobs_password'),
  177. jenkins_ssh_private_key => hiera('jenkins_ssh_private_key_contents'),
  178. ssl_cert_file => '/etc/ssl/certs/ssl-cert-snakeoil.pem',
  179. ssl_key_file => '/etc/ssl/private/ssl-cert-snakeoil.key',
  180. ssl_chain_file => '',
  181. }
  182. }
  183. # Node-OS: precise
  184. node /^jenkins\d+\.openstack\.org$/ {
  185. $group = "jenkins"
  186. $zmq_event_receivers = ['logstash.openstack.org',
  187. 'nodepool.openstack.org']
  188. $iptables_rule = regsubst ($zmq_event_receivers,
  189. '^(.*)$', '-m state --state NEW -m tcp -p tcp --dport 8888 -s \1 -j ACCEPT')
  190. class { 'openstack_project::server':
  191. iptables_public_tcp_ports => [80, 443],
  192. iptables_rules6 => $iptables_rule,
  193. iptables_rules4 => $iptables_rule,
  194. sysadmins => hiera('sysadmins', []),
  195. puppetmaster_server => 'puppetmaster.openstack.org',
  196. }
  197. class { 'openstack_project::jenkins':
  198. jenkins_password => hiera('jenkins_jobs_password'),
  199. jenkins_ssh_private_key => hiera('jenkins_ssh_private_key_contents'),
  200. ssl_cert_file => '/etc/ssl/certs/ssl-cert-snakeoil.pem',
  201. ssl_key_file => '/etc/ssl/private/ssl-cert-snakeoil.key',
  202. ssl_chain_file => '',
  203. }
  204. }
  205. # Node-OS: precise
  206. node 'jenkins-dev.openstack.org' {
  207. class { 'openstack_project::server':
  208. iptables_public_tcp_ports => [80, 443],
  209. sysadmins => hiera('sysadmins', []),
  210. puppetmaster_server => 'puppetmaster.openstack.org',
  211. }
  212. class { 'openstack_project::jenkins_dev':
  213. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  214. jenkins_ssh_private_key => hiera('jenkins_dev_ssh_private_key_contents'),
  215. mysql_password => hiera('nodepool_dev_mysql_password'),
  216. mysql_root_password => hiera('nodepool_dev_mysql_root_password'),
  217. nodepool_ssh_private_key => hiera('jenkins_dev_ssh_private_key_contents'),
  218. jenkins_api_user => hiera('jenkins_dev_api_user', 'username'),
  219. jenkins_api_key => hiera('jenkins_dev_api_key'),
  220. jenkins_credentials_id => hiera('jenkins_dev_credentials_id'),
  221. hpcloud_username => hiera('nodepool_hpcloud_username', 'username'),
  222. hpcloud_password => hiera('nodepool_hpcloud_password'),
  223. hpcloud_project => hiera('nodepool_hpcloud_project'),
  224. }
  225. }
  226. # Node-OS: precise
  227. node 'cacti.openstack.org' {
  228. include openstack_project::ssl_cert_check
  229. class { 'openstack_project::cacti':
  230. sysadmins => hiera('sysadmins', []),
  231. }
  232. }
  233. # Node-OS: trusty
  234. node 'puppetmaster.openstack.org' {
  235. class { 'openstack_project::server':
  236. iptables_public_tcp_ports => [8140],
  237. sysadmins => hiera('sysadmins', []),
  238. pin_puppet => '3.6.',
  239. }
  240. class { 'openstack_project::puppetmaster':
  241. root_rsa_key => hiera('puppetmaster_root_rsa_key'),
  242. jenkins_api_user => hiera('jenkins_api_user', 'username'),
  243. jenkins_api_key => hiera('jenkins_api_key'),
  244. puppetmaster_clouds => hiera('puppetmaster_clouds'),
  245. }
  246. }
  247. # Node-OS: precise
  248. node 'puppetdb.openstack.org' {
  249. class { 'openstack_project::puppetdb':
  250. sysadmins => hiera('sysadmins', []),
  251. }
  252. }
  253. # Node-OS: precise
  254. node 'graphite.openstack.org' {
  255. $statsd_hosts = ['git.openstack.org',
  256. 'logstash.openstack.org',
  257. 'nodepool.openstack.org',
  258. 'zuul.openstack.org']
  259. # Turn a list of hostnames into a list of iptables rules
  260. $rules = regsubst ($statsd_hosts, '^(.*)$', '-m udp -p udp -s \1 --dport 8125 -j ACCEPT')
  261. class { 'openstack_project::server':
  262. iptables_public_tcp_ports => [80, 443],
  263. iptables_rules6 => $rules,
  264. iptables_rules4 => $rules,
  265. sysadmins => hiera('sysadmins', [])
  266. }
  267. class { '::graphite':
  268. graphite_admin_user => hiera('graphite_admin_user', 'username'),
  269. graphite_admin_email => hiera('graphite_admin_email', 'email@example.com'),
  270. graphite_admin_password => hiera('graphite_admin_password'),
  271. }
  272. }
  273. # Node-OS: precise
  274. node 'groups.openstack.org' {
  275. class { 'openstack_project::server':
  276. iptables_public_tcp_ports => [22, 80, 443],
  277. sysadmins => hiera('sysadmins', []),
  278. }
  279. class { 'openstack_project::groups':
  280. site_admin_password => hiera('groups_site_admin_password'),
  281. site_mysql_host => hiera('groups_site_mysql_host', 'localhost'),
  282. site_mysql_password => hiera('groups_site_mysql_password'),
  283. conf_cron_key => hiera('groups_conf_cron_key'),
  284. site_ssl_cert_file_contents => hiera('groups_site_ssl_cert_file_contents', undef),
  285. site_ssl_key_file_contents => hiera('groups_site_ssl_key_file_contents', undef),
  286. site_ssl_chain_file_contents => hiera('groups_site_ssl_chain_file_contents', undef),
  287. }
  288. }
  289. # Node-OS: precise
  290. node 'groups-dev.openstack.org' {
  291. class { 'openstack_project::server':
  292. iptables_public_tcp_ports => [22, 80, 443],
  293. sysadmins => hiera('sysadmins', []),
  294. }
  295. class { 'openstack_project::groups_dev':
  296. site_admin_password => hiera('groups_dev_site_admin_password'),
  297. site_mysql_host => hiera('groups_dev_site_mysql_host', 'localhost'),
  298. site_mysql_password => hiera('groups_dev_site_mysql_password'),
  299. conf_cron_key => hiera('groups_dev_conf_cron_key'),
  300. site_ssl_cert_file_contents => hiera('groups_dev_site_ssl_cert_file_contents', undef),
  301. site_ssl_key_file_contents => hiera('groups_dev_site_ssl_key_file_contents', undef),
  302. site_ssl_cert_file => '/etc/ssl/certs/groups-dev.openstack.org.pem',
  303. site_ssl_key_file => '/etc/ssl/private/groups-dev.openstack.org.key',
  304. }
  305. }
  306. # Node-OS: precise
  307. node 'lists.openstack.org' {
  308. class { 'openstack_project::lists':
  309. listadmins => hiera('listadmins', []),
  310. listpassword => hiera('listpassword'),
  311. }
  312. }
  313. # Node-OS: precise
  314. node 'paste.openstack.org' {
  315. class { 'openstack_project::server':
  316. iptables_public_tcp_ports => [80],
  317. sysadmins => hiera('sysadmins', []),
  318. }
  319. class { 'openstack_project::paste':
  320. db_password => hiera('paste_db_password'),
  321. mysql_root_password => hiera('paste_mysql_root_password'),
  322. }
  323. }
  324. # Node-OS: precise
  325. node 'planet.openstack.org' {
  326. class { 'openstack_project::planet':
  327. sysadmins => hiera('sysadmins', []),
  328. }
  329. }
  330. # Node-OS: precise
  331. node 'eavesdrop.openstack.org' {
  332. class { 'openstack_project::server':
  333. iptables_public_tcp_ports => [80],
  334. sysadmins => hiera('sysadmins', []),
  335. }
  336. class { 'openstack_project::eavesdrop':
  337. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  338. nickpass => hiera('openstack_meetbot_password'),
  339. statusbot_nick => hiera('statusbot_nick', 'username'),
  340. statusbot_password => hiera('statusbot_nick_password'),
  341. statusbot_server => 'chat.freenode.net',
  342. statusbot_channels => 'edeploy, fuel-dev, heat, kolla, murano, openstack, openstack-101, openstack-ansible, openstack-anvil, openstack-bacon, openstack-barbican, openstack-blazar, openstack-board, openstack-ceilometer, openstack-chef, openstack-cinder, openstack-cloudkeep, openstack-community, openstack-containers, openstack-defcore, openstack-dev, openstack-dns, openstack-doc, openstack-entropy, openstack-foundation, openstack-gantt, openstack-gate, openstack-glance, openstack-heat-translator, openstack-horizon, openstack-hyper-v, openstack-i18n, openstack-infra, openstack-infra-incident, openstack-ironic, openstack-keystone, openstack-manila, openstack-meeting, openstack-meeting-3, openstack-meeting-4, openstack-meeting-alt, openstack-meniscus, openstack-merges, openstack-metering, openstack-monasca, openstack-neutron, openstack-neutron-ovn, openstack-nova, openstack-opw, openstack-oslo, openstack-qa, openstack-raksha, openstack-rally, openstack-rating, openstack-release, openstack-sahara, openstack-sdks, openstack-sprint, openstack-stable, openstack-state-management, openstack-swauth, openstack-swift, openstack-trove, openstack-zaqar, packstack-dev, puppet-openstack, refstack, senlin, storyboard, syscompass, tripleo',
  343. statusbot_auth_nicks => 'jeblair, ttx, fungi, mordred, clarkb, sdague, SergeyLukjanov, jhesketh, lifeless, pleia2',
  344. statusbot_wiki_user => hiera('statusbot_wiki_username', 'username'),
  345. statusbot_wiki_password => hiera('statusbot_wiki_password'),
  346. statusbot_wiki_url => 'https://wiki.openstack.org/w/api.php',
  347. # https://wiki.openstack.org/wiki/Infrastructure_Status
  348. statusbot_wiki_pageid => '1781',
  349. # https://wiki.openstack.org/wiki/Successes
  350. statusbot_wiki_successpageid => '7717',
  351. statusbot_irclogs_url => 'http://eavesdrop.openstack.org/irclogs/%(chan)s/%(chan)s.%(date)s.log.html',
  352. accessbot_nick => hiera('accessbot_nick', 'username'),
  353. accessbot_password => hiera('accessbot_nick_password'),
  354. }
  355. }
  356. # Node-OS: trusty
  357. node 'etherpad.openstack.org' {
  358. class { 'openstack_project::server':
  359. iptables_public_tcp_ports => [22, 80, 443],
  360. sysadmins => hiera('sysadmins', []),
  361. }
  362. class { 'openstack_project::etherpad':
  363. ssl_cert_file_contents => hiera('etherpad_ssl_cert_file_contents'),
  364. ssl_key_file_contents => hiera('etherpad_ssl_key_file_contents'),
  365. ssl_chain_file_contents => hiera('etherpad_ssl_chain_file_contents'),
  366. mysql_host => hiera('etherpad_db_host', 'localhost'),
  367. mysql_user => hiera('etherpad_db_user', 'username'),
  368. mysql_password => hiera('etherpad_db_password'),
  369. }
  370. }
  371. # Node-OS: trusty
  372. node 'etherpad-dev.openstack.org' {
  373. class { 'openstack_project::server':
  374. iptables_public_tcp_ports => [22, 80, 443],
  375. sysadmins => hiera('sysadmins', []),
  376. }
  377. class { 'openstack_project::etherpad_dev':
  378. mysql_host => hiera('etherpad-dev_db_host', 'localhost'),
  379. mysql_user => hiera('etherpad-dev_db_user', 'username'),
  380. mysql_password => hiera('etherpad-dev_db_password'),
  381. }
  382. }
  383. # Node-OS: precise
  384. node 'wiki.openstack.org' {
  385. class { 'openstack_project::wiki':
  386. mysql_root_password => hiera('wiki_db_password'),
  387. sysadmins => hiera('sysadmins', []),
  388. ssl_cert_file_contents => hiera('wiki_ssl_cert_file_contents'),
  389. ssl_key_file_contents => hiera('wiki_ssl_key_file_contents'),
  390. ssl_chain_file_contents => hiera('wiki_ssl_chain_file_contents'),
  391. }
  392. }
  393. # Node-OS: precise
  394. node 'logstash.openstack.org' {
  395. $iptables_es_rule = regsubst($elasticsearch_nodes,
  396. '^(.*)$', '-m state --state NEW -m tcp -p tcp --dport 9200:9400 -s \1 -j ACCEPT')
  397. $iptables_gm_rule = regsubst($elasticsearch_clients,
  398. '^(.*)$', '-m state --state NEW -m tcp -p tcp --dport 4730 -s \1 -j ACCEPT')
  399. $logstash_iptables_rule = flatten([$iptables_es_rule, $iptables_gm_rule])
  400. class { 'openstack_project::server':
  401. iptables_public_tcp_ports => [22, 80, 3306],
  402. iptables_rules6 => $logstash_iptables_rule,
  403. iptables_rules4 => $logstash_iptables_rule,
  404. sysadmins => hiera('sysadmins', []),
  405. }
  406. class { 'openstack_project::logstash':
  407. discover_nodes => [
  408. 'elasticsearch02.openstack.org:9200',
  409. 'elasticsearch03.openstack.org:9200',
  410. 'elasticsearch04.openstack.org:9200',
  411. 'elasticsearch05.openstack.org:9200',
  412. 'elasticsearch06.openstack.org:9200',
  413. 'elasticsearch07.openstack.org:9200',
  414. ],
  415. subunit2sql_db_host => hiera('subunit2sql_db_host', ''),
  416. subunit2sql_db_pass => hiera('subunit2sql_db_password', ''),
  417. }
  418. }
  419. # Node-OS: precise
  420. node /^logstash-worker\d+\.openstack\.org$/ {
  421. $logstash_worker_iptables_rule = regsubst(flatten([$elasticsearch_nodes, $elasticsearch_clients]),
  422. '^(.*)$', '-m state --state NEW -m tcp -p tcp --dport 9200:9400 -s \1 -j ACCEPT')
  423. $group = 'logstash-worker'
  424. class { 'openstack_project::server':
  425. iptables_public_tcp_ports => [22],
  426. iptables_rules6 => $logstash_worker_iptables_rule,
  427. iptables_rules4 => $logstash_worker_iptables_rule,
  428. sysadmins => hiera('sysadmins', []),
  429. }
  430. class { 'openstack_project::logstash_worker':
  431. discover_node => 'elasticsearch02.openstack.org',
  432. }
  433. }
  434. # Node-OS: trusty
  435. node /^subunit-worker\d+\.openstack\.org$/ {
  436. $group = "subunit-worker"
  437. class { 'openstack_project::server':
  438. iptables_public_tcp_ports => [22],
  439. sysadmins => hiera('sysadmins', []),
  440. }
  441. class { 'openstack_project::subunit_worker':
  442. subunit2sql_db_host => hiera('subunit2sql_db_host', ''),
  443. subunit2sql_db_pass => hiera('subunit2sql_db_password', ''),
  444. }
  445. }
  446. # Node-OS: precise
  447. node /^elasticsearch0[1-7]\.openstack\.org$/ {
  448. $group = "elasticsearch"
  449. $iptables_nodes_rule = regsubst ($elasticsearch_nodes,
  450. '^(.*)$', '-m state --state NEW -m tcp -p tcp --dport 9200:9400 -s \1 -j ACCEPT')
  451. $iptables_clients_rule = regsubst ($elasticsearch_clients,
  452. '^(.*)$', '-m state --state NEW -m tcp -p tcp --dport 9200:9400 -s \1 -j ACCEPT')
  453. $iptables_rule = flatten([$iptables_nodes_rule, $iptables_clients_rule])
  454. class { 'openstack_project::server':
  455. iptables_public_tcp_ports => [22],
  456. iptables_rules6 => $iptables_rule,
  457. iptables_rules4 => $iptables_rule,
  458. sysadmins => hiera('sysadmins', []),
  459. }
  460. class { 'openstack_project::elasticsearch_node':
  461. discover_nodes => $elasticsearch_nodes,
  462. }
  463. }
  464. # CentOS machines to load balance git access.
  465. # Node-OS: centos7
  466. node /^git(-fe\d+)?\.openstack\.org$/ {
  467. $group = "git-loadbalancer"
  468. class { 'openstack_project::git':
  469. sysadmins => hiera('sysadmins', []),
  470. balancer_member_names => [
  471. 'git01.openstack.org',
  472. 'git02.openstack.org',
  473. 'git03.openstack.org',
  474. 'git04.openstack.org',
  475. 'git05.openstack.org',
  476. 'git06.openstack.org',
  477. 'git07.openstack.org',
  478. 'git08.openstack.org',
  479. ],
  480. balancer_member_ips => [
  481. '104.130.243.237',
  482. '104.130.243.109',
  483. '67.192.247.197',
  484. '67.192.247.180',
  485. '23.253.69.135',
  486. '104.239.132.223',
  487. '23.253.94.84',
  488. '104.239.146.131',
  489. ],
  490. }
  491. }
  492. # CentOS machines to run cgit and git daemon. Will be
  493. # load balanced by git.openstack.org.
  494. # Node-OS: centos7
  495. node /^git\d+\.openstack\.org$/ {
  496. $group = "git-server"
  497. include openstack_project
  498. class { 'openstack_project::server':
  499. iptables_public_tcp_ports => [4443, 8080, 29418],
  500. sysadmins => hiera('sysadmins', []),
  501. }
  502. class { 'openstack_project::git_backend':
  503. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  504. vhost_name => 'git.openstack.org',
  505. git_gerrit_ssh_key => hiera('gerrit_replication_ssh_rsa_pubkey_contents'),
  506. ssl_cert_file_contents => hiera('git_ssl_cert_file_contents'),
  507. ssl_key_file_contents => hiera('git_ssl_key_file_contents'),
  508. ssl_chain_file_contents => hiera('git_ssl_chain_file_contents'),
  509. behind_proxy => true,
  510. selinux_mode => 'enforcing'
  511. }
  512. }
  513. # Machines in each region to run PyPI mirrors.
  514. # Node-OS: precise
  515. node /^pypi\..*\.openstack\.org$/ {
  516. $group = "pypi"
  517. class { 'openstack_project::pypi':
  518. sysadmins => hiera('sysadmins', []),
  519. }
  520. }
  521. # A machine to run ODSREG in preparation for summits.
  522. # Node-OS: trusty
  523. node 'design-summit-prep.openstack.org' {
  524. class { 'openstack_project::summit':
  525. sysadmins => hiera('sysadmins', []),
  526. }
  527. }
  528. # Node-OS: trusty
  529. node 'refstack.openstack.org' {
  530. class { 'openstack_project::server':
  531. iptables_public_tcp_ports => [80, 443],
  532. sysadmins => hiera('sysadmins', []),
  533. }
  534. class { 'refstack':
  535. mysql_host => hiera('refstack_mysql_host', 'localhost'),
  536. mysql_database => hiera('refstack_mysql_db_name', 'refstack'),
  537. mysql_user => hiera('refstack_mysql_user', 'refstack'),
  538. mysql_user_password => hiera('refstack_mysql_password'),
  539. ssl_cert_content => hiera('refstack_ssl_cert_file_contents'),
  540. ssl_key_content => hiera('refstack_ssl_key_file_contents'),
  541. ssl_ca_content => hiera('refstack_ssl_chain_file_contents'),
  542. protocol => 'https',
  543. }
  544. }
  545. # A machine to run Storyboard
  546. # Node-OS: precise
  547. node 'storyboard.openstack.org' {
  548. class { 'openstack_project::storyboard':
  549. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  550. sysadmins => hiera('sysadmins', []),
  551. mysql_host => hiera('storyboard_db_host', 'localhost'),
  552. mysql_user => hiera('storyboard_db_user', 'username'),
  553. mysql_password => hiera('storyboard_db_password'),
  554. rabbitmq_user => hiera('storyboard_rabbit_user', 'username'),
  555. rabbitmq_password => hiera('storyboard_rabbit_password'),
  556. ssl_cert_file_contents => hiera('storyboard_ssl_cert_file_contents'),
  557. ssl_key_file_contents => hiera('storyboard_ssl_key_file_contents'),
  558. ssl_chain_file_contents => hiera('storyboard_ssl_chain_file_contents'),
  559. hostname => $::fqdn,
  560. valid_oauth_clients => [
  561. $::fqdn,
  562. 'docs-draft.openstack.org',
  563. ],
  564. cors_allowed_origins => [
  565. "https://${::fqdn}",
  566. 'http://docs-draft.openstack.org',
  567. ],
  568. }
  569. }
  570. # A machine to serve static content.
  571. # Node-OS: precise
  572. node 'static.openstack.org' {
  573. class { 'openstack_project::server':
  574. iptables_public_tcp_ports => [22, 80, 443],
  575. sysadmins => hiera('sysadmins', []),
  576. }
  577. class { 'openstack_project::static':
  578. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  579. swift_authurl => 'https://identity.api.rackspacecloud.com/v2.0/',
  580. swift_user => 'infra-files-ro',
  581. swift_key => hiera('infra_files_ro_password'),
  582. swift_tenant_name => hiera('infra_files_tenant_name', 'tenantname'),
  583. swift_region_name => 'DFW',
  584. swift_default_container => 'infra-files',
  585. ssl_cert_file_contents => hiera('static_ssl_cert_file_contents'),
  586. ssl_key_file_contents => hiera('static_ssl_key_file_contents'),
  587. ssl_chain_file_contents => hiera('static_ssl_chain_file_contents'),
  588. }
  589. }
  590. # A machine to serve various project status updates.
  591. # Node-OS: precise
  592. node 'status.openstack.org' {
  593. class { 'openstack_project::server':
  594. iptables_public_tcp_ports => [22, 80, 443],
  595. sysadmins => hiera('sysadmins', []),
  596. }
  597. class { 'openstack_project::status':
  598. gerrit_host => 'review.openstack.org',
  599. gerrit_ssh_host_key => hiera('gerrit_ssh_rsa_pubkey_contents'),
  600. reviewday_ssh_public_key => hiera('reviewday_rsa_pubkey_contents'),
  601. reviewday_ssh_private_key => hiera('reviewday_rsa_key_contents'),
  602. recheck_ssh_public_key => hiera('elastic-recheck_gerrit_ssh_public_key'),
  603. recheck_ssh_private_key => hiera('elastic-recheck_gerrit_ssh_private_key'),
  604. recheck_bot_nick => 'openstackrecheck',
  605. recheck_bot_passwd => hiera('elastic-recheck_ircbot_password'),
  606. }
  607. }
  608. # Node-OS: trusty
  609. node 'nodepool.openstack.org' {
  610. $bluebox_username = hiera('nodepool_bluebox_username', 'username')
  611. $bluebox_password = hiera('nodepool_bluebox_password')
  612. $bluebox_project = hiera('nodepool_bluebox_project', 'project')
  613. $rackspace_username = hiera('nodepool_rackspace_username', 'username')
  614. $rackspace_password = hiera('nodepool_rackspace_password')
  615. $rackspace_project = hiera('nodepool_rackspace_project', 'project')
  616. $hpcloud_username = hiera('nodepool_hpcloud_username', 'username')
  617. $hpcloud_password = hiera('nodepool_hpcloud_password')
  618. $hpcloud_project = hiera('nodepool_hpcloud_project', 'project')
  619. $internap_username = hiera('nodepool_internap_username', 'username')
  620. $internap_password = hiera('nodepool_internap_password')
  621. $internap_project = hiera('nodepool_internap_project', 'project')
  622. $ovh_username = hiera('nodepool_ovh_username', 'username')
  623. $ovh_password = hiera('nodepool_ovh_password')
  624. $ovh_project = hiera('nodepool_ovh_project', 'project')
  625. $tripleo_username = hiera('nodepool_tripleo_username', 'username')
  626. $tripleo_password = hiera('nodepool_tripleo_password')
  627. $tripleo_project = hiera('nodepool_tripleo_project', 'project')
  628. $clouds_yaml = template("openstack_project/nodepool/clouds.yaml.erb")
  629. class { 'openstack_project::server':
  630. sysadmins => hiera('sysadmins', []),
  631. iptables_public_tcp_ports => [80],
  632. }
  633. class { '::openstackci::nodepool':
  634. vhost_name => 'nodepool.openstack.org',
  635. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  636. mysql_password => hiera('nodepool_mysql_password'),
  637. mysql_root_password => hiera('nodepool_mysql_root_password'),
  638. nodepool_ssh_private_key => hiera('jenkins_ssh_private_key_contents'),
  639. oscc_file_contents => $clouds_yaml,
  640. image_log_document_root => '/var/log/nodepool/image',
  641. statsd_host => 'graphite.openstack.org',
  642. logging_conf_template => 'openstack_project/nodepool/nodepool.logging.conf.erb',
  643. jenkins_masters => [
  644. {
  645. name => 'jenkins01',
  646. url => 'https://jenkins01.openstack.org/',
  647. user => hiera('jenkins_api_user', 'username'),
  648. apikey => hiera('jenkins_api_key'),
  649. credentials => hiera('jenkins_credentials_id'),
  650. },
  651. {
  652. name => 'jenkins02',
  653. url => 'https://jenkins02.openstack.org/',
  654. user => hiera('jenkins_api_user', 'username'),
  655. apikey => hiera('jenkins_api_key'),
  656. credentials => hiera('jenkins_credentials_id'),
  657. },
  658. {
  659. name => 'jenkins03',
  660. url => 'https://jenkins03.openstack.org/',
  661. user => hiera('jenkins_api_user', 'username'),
  662. apikey => hiera('jenkins_api_key'),
  663. credentials => hiera('jenkins_credentials_id'),
  664. },
  665. {
  666. name => 'jenkins04',
  667. url => 'https://jenkins04.openstack.org/',
  668. user => hiera('jenkins_api_user', 'username'),
  669. apikey => hiera('jenkins_api_key'),
  670. credentials => hiera('jenkins_credentials_id'),
  671. },
  672. {
  673. name => 'jenkins05',
  674. url => 'https://jenkins05.openstack.org/',
  675. user => hiera('jenkins_api_user', 'username'),
  676. apikey => hiera('jenkins_api_key'),
  677. credentials => hiera('jenkins_credentials_id'),
  678. },
  679. {
  680. name => 'jenkins06',
  681. url => 'https://jenkins06.openstack.org/',
  682. user => hiera('jenkins_api_user', 'username'),
  683. apikey => hiera('jenkins_api_key'),
  684. credentials => hiera('jenkins_credentials_id'),
  685. },
  686. {
  687. name => 'jenkins07',
  688. url => 'https://jenkins07.openstack.org/',
  689. user => hiera('jenkins_api_user', 'username'),
  690. apikey => hiera('jenkins_api_key'),
  691. credentials => hiera('jenkins_credentials_id'),
  692. },
  693. ],
  694. }
  695. }
  696. # Node-OS: precise
  697. # Node-OS: trusty
  698. node 'zuul.openstack.org' {
  699. class { 'openstack_project::zuul_prod':
  700. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  701. gerrit_server => 'review.openstack.org',
  702. gerrit_user => 'jenkins',
  703. gerrit_ssh_host_key => hiera('gerrit_ssh_rsa_pubkey_contents'),
  704. zuul_ssh_private_key => hiera('zuul_ssh_private_key_contents'),
  705. url_pattern => 'http://logs.openstack.org/{build.parameters[LOG_PATH]}',
  706. swift_authurl => 'https://identity.api.rackspacecloud.com/v2.0/',
  707. swift_user => 'infra-files-rw',
  708. swift_key => hiera('infra_files_rw_password'),
  709. swift_tenant_name => hiera('infra_files_tenant_name', 'tenantname'),
  710. swift_region_name => 'DFW',
  711. swift_default_container => 'infra-files',
  712. swift_default_logserver_prefix => 'http://logs.openstack.org/',
  713. swift_default_expiry => 14400,
  714. proxy_ssl_cert_file_contents => hiera('zuul_ssl_cert_file_contents'),
  715. proxy_ssl_key_file_contents => hiera('zuul_ssl_key_file_contents'),
  716. proxy_ssl_chain_file_contents => hiera('zuul_ssl_chain_file_contents'),
  717. zuul_url => 'http://zuul.openstack.org/p',
  718. sysadmins => hiera('sysadmins', []),
  719. statsd_host => 'graphite.openstack.org',
  720. gearman_workers => [
  721. 'nodepool.openstack.org',
  722. 'jenkins.openstack.org',
  723. 'jenkins01.openstack.org',
  724. 'jenkins02.openstack.org',
  725. 'jenkins03.openstack.org',
  726. 'jenkins04.openstack.org',
  727. 'jenkins05.openstack.org',
  728. 'jenkins06.openstack.org',
  729. 'jenkins07.openstack.org',
  730. 'jenkins-dev.openstack.org',
  731. 'zm01.openstack.org',
  732. 'zm02.openstack.org',
  733. 'zm03.openstack.org',
  734. 'zm04.openstack.org',
  735. 'zm05.openstack.org',
  736. 'zm06.openstack.org',
  737. 'zm07.openstack.org',
  738. 'zm08.openstack.org',
  739. ],
  740. }
  741. }
  742. # Node-OS: precise
  743. # Node-OS: trusty
  744. node /^zm\d+\.openstack\.org$/ {
  745. $group = "zuul-merger"
  746. class { 'openstack_project::zuul_merger':
  747. gearman_server => 'zuul.openstack.org',
  748. gerrit_server => 'review.openstack.org',
  749. gerrit_user => 'jenkins',
  750. gerrit_ssh_host_key => hiera('gerrit_ssh_rsa_pubkey_contents'),
  751. zuul_ssh_private_key => hiera('zuul_ssh_private_key_contents'),
  752. sysadmins => hiera('sysadmins', []),
  753. }
  754. }
  755. # Node-OS: precise
  756. # Node-OS: trusty
  757. node 'zuul-dev.openstack.org' {
  758. class { 'openstack_project::zuul_dev':
  759. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  760. gerrit_server => 'review-dev.openstack.org',
  761. gerrit_user => 'jenkins',
  762. gerrit_ssh_host_key => hiera('gerrit_dev_ssh_rsa_pubkey_contents'),
  763. zuul_ssh_private_key => hiera('zuul_dev_ssh_private_key_contents'),
  764. url_pattern => 'http://logs.openstack.org/{build.parameters[LOG_PATH]}',
  765. zuul_url => 'http://zuul-dev.openstack.org/p',
  766. sysadmins => hiera('sysadmins', []),
  767. statsd_host => 'graphite.openstack.org',
  768. gearman_workers => [
  769. 'jenkins.openstack.org',
  770. 'jenkins01.openstack.org',
  771. 'jenkins02.openstack.org',
  772. 'jenkins03.openstack.org',
  773. 'jenkins04.openstack.org',
  774. 'jenkins05.openstack.org',
  775. 'jenkins06.openstack.org',
  776. 'jenkins07.openstack.org',
  777. 'jenkins-dev.openstack.org',
  778. ],
  779. }
  780. }
  781. # Node-OS: trusty
  782. node 'pbx.openstack.org' {
  783. class { 'openstack_project::server':
  784. sysadmins => hiera('sysadmins', []),
  785. # SIP signaling is either TCP or UDP port 5060.
  786. # RTP media (audio/video) uses a range of UDP ports.
  787. iptables_public_tcp_ports => [5060],
  788. iptables_public_udp_ports => [5060],
  789. iptables_rules4 => ['-m udp -p udp --dport 10000:20000 -j ACCEPT'],
  790. iptables_rules6 => ['-m udp -p udp --dport 10000:20000 -j ACCEPT'],
  791. }
  792. class { 'openstack_project::pbx':
  793. sip_providers => [
  794. {
  795. provider => 'voipms',
  796. hostname => 'dallas.voip.ms',
  797. username => hiera('voipms_username', 'username'),
  798. password => hiera('voipms_password'),
  799. outgoing => false,
  800. },
  801. ],
  802. }
  803. }
  804. # Node-OS: precise
  805. # A backup machine. Don't run cron or puppet agent on it.
  806. node /^ci-backup-.*\.openstack\.org$/ {
  807. $group = "ci-backup"
  808. include openstack_project::backup_server
  809. }
  810. # Node-OS: precise
  811. # Node-OS: trusty
  812. node 'proposal.slave.openstack.org' {
  813. include openstack_project
  814. class { 'openstack_project::proposal_slave':
  815. jenkins_ssh_public_key => $openstack_project::jenkins_ssh_key,
  816. proposal_ssh_public_key => hiera('proposal_ssh_public_key_contents'),
  817. proposal_ssh_private_key => hiera('proposal_ssh_private_key_contents'),
  818. zanata_server_url => 'https://translate.openstack.org/',
  819. zanata_server_user => hiera('proposal_zanata_user'),
  820. zanata_server_api_key => hiera('proposal_zanata_api_key'),
  821. }
  822. }
  823. # Node-OS: trusty
  824. node 'release.slave.openstack.org' {
  825. include openstack_project
  826. class { 'openstack_project::release_slave':
  827. pypi_username => 'openstackci',
  828. pypi_password => hiera('pypi_password'),
  829. jenkins_ssh_public_key => $openstack_project::jenkins_ssh_key,
  830. jenkinsci_username => hiera('jenkins_ci_org_user', 'username'),
  831. jenkinsci_password => hiera('jenkins_ci_org_password'),
  832. mavencentral_username => hiera('mavencentral_org_user', 'username'),
  833. mavencentral_password => hiera('mavencentral_org_password'),
  834. puppet_forge_username => hiera('puppet_forge_username', 'username'),
  835. puppet_forge_password => hiera('puppet_forge_password'),
  836. npm_username => 'openstackci',
  837. npm_userpassword => hiera('npm_user_password'),
  838. npm_userurl => 'https://openstack.org',
  839. }
  840. }
  841. # Node-OS: precise
  842. # Node-OS: trusty
  843. node 'openstackid.org' {
  844. class { 'openstack_project::openstackid_prod':
  845. sysadmins => hiera('sysadmins', []),
  846. site_admin_password => hiera('openstackid_site_admin_password'),
  847. id_mysql_host => hiera('openstackid_id_mysql_host', 'localhost'),
  848. id_mysql_password => hiera('openstackid_id_mysql_password'),
  849. id_mysql_user => hiera('openstackid_id_mysql_user', 'username'),
  850. id_db_name => hiera('openstackid_id_db_name'),
  851. ss_mysql_host => hiera('openstackid_ss_mysql_host', 'localhost'),
  852. ss_mysql_password => hiera('openstackid_ss_mysql_password'),
  853. ss_mysql_user => hiera('openstackid_ss_mysql_user', 'username'),
  854. ss_db_name => hiera('openstackid_ss_db_name', 'username'),
  855. redis_password => hiera('openstackid_redis_password'),
  856. ssl_cert_file_contents => hiera('openstackid_ssl_cert_file_contents'),
  857. ssl_key_file_contents => hiera('openstackid_ssl_key_file_contents'),
  858. ssl_chain_file_contents => hiera('openstackid_ssl_chain_file_contents'),
  859. }
  860. }
  861. # Node-OS: precise
  862. # Node-OS: trusty
  863. node 'openstackid-dev.openstack.org' {
  864. class { 'openstack_project::openstackid_dev':
  865. sysadmins => hiera('sysadmins', []),
  866. site_admin_password => hiera('openstackid_dev_site_admin_password'),
  867. id_mysql_host => hiera('openstackid_dev_id_mysql_host', 'localhost'),
  868. id_mysql_password => hiera('openstackid_dev_id_mysql_password'),
  869. id_mysql_user => hiera('openstackid_dev_id_mysql_user', 'username'),
  870. ss_mysql_host => hiera('openstackid_dev_ss_mysql_host', 'localhost'),
  871. ss_mysql_password => hiera('openstackid_dev_ss_mysql_password'),
  872. ss_mysql_user => hiera('openstackid_dev_ss_mysql_user', 'username'),
  873. ss_db_name => hiera('openstackid_dev_ss_db_name', 'username'),
  874. redis_password => hiera('openstackid_dev_redis_password'),
  875. ssl_cert_file_contents => hiera('openstackid_dev_ssl_cert_file_contents'),
  876. ssl_key_file_contents => hiera('openstackid_dev_ssl_key_file_contents'),
  877. ssl_chain_file_contents => hiera('openstackid_dev_ssl_chain_file_contents'),
  878. }
  879. }
  880. # Node-OS: precise
  881. # Node-OS: trusty
  882. # This is not meant to be an actual node that connects to the master.
  883. # This is a dummy node definition to trigger a test of the code path used by
  884. # nodepool's prepare_node scripts in the apply tests
  885. # NOTE(pabelanger): These are the settings we currently use for bare-* nodes.
  886. # It includes thick_slave.pp.
  887. node 'single-use-slave-bare' {
  888. class { 'openstack_project::single_use_slave':
  889. # Test non-default values from prepare_node_bare.sh
  890. sudo => true,
  891. thin => false,
  892. }
  893. }
  894. # Node-OS: centos7
  895. # Node-OS: fedora21
  896. # Node-OS: precise
  897. # Node-OS: trusty
  898. # This is not meant to be an actual node that connects to the master.
  899. # This is a dummy node definition to trigger a test of the code path used by
  900. # nodepool's prepare_node scripts in the apply tests
  901. # NOTE(pabelanger): These are the current settings we use for devstack-* nodes.
  902. node 'single-use-slave-devstack' {
  903. class { 'openstack_project::single_use_slave':
  904. sudo => true,
  905. thin => true,
  906. }
  907. }
  908. # Node-OS: trusty
  909. node 'kdc01.openstack.org' {
  910. class { 'openstack_project::kdc':
  911. sysadmins => hiera('sysadmins', []),
  912. }
  913. }
  914. # Node-OS: trusty
  915. node 'kdc02.openstack.org' {
  916. class { 'openstack_project::kdc':
  917. sysadmins => hiera('sysadmins', []),
  918. slave => true,
  919. }
  920. }
  921. # Node-OS: trusty
  922. node /^afsdb.*\.openstack\.org$/ {
  923. $group = "afsdb"
  924. class { 'openstack_project::template':
  925. iptables_public_udp_ports => [7000,7002,7003,7004,7005,7006,7007],
  926. sysadmins => hiera('sysadmins', []),
  927. afs => true,
  928. manage_exim => true,
  929. }
  930. include openstack_project::afsdb
  931. }
  932. # Node-OS: trusty
  933. node /^afs.*\..*\.openstack\.org$/ {
  934. $group = "afs"
  935. class { 'openstack_project::template':
  936. iptables_public_udp_ports => [7000,7002,7003,7004,7005,7006,7007],
  937. sysadmins => hiera('sysadmins', []),
  938. afs => true,
  939. manage_exim => true,
  940. }
  941. include openstack_project::afsfs
  942. }
  943. # Node-OS: trusty
  944. node 'ask.openstack.org' {
  945. class { 'openstack_project::server':
  946. iptables_public_tcp_ports => [22, 80, 443],
  947. sysadmins => hiera('sysadmins', []),
  948. }
  949. class { 'openstack_project::ask':
  950. db_user => hiera('ask_db_user', 'ask'),
  951. db_password => hiera('ask_db_password'),
  952. redis_password => hiera('ask_redis_password'),
  953. site_ssl_cert_file_contents => hiera('ask_site_ssl_cert_file_contents', undef),
  954. site_ssl_key_file_contents => hiera('ask_site_ssl_key_file_contents', undef),
  955. site_ssl_chain_file_contents => hiera('ask_site_ssl_chain_file_contents', undef),
  956. }
  957. }
  958. # Node-OS: trusty
  959. node 'ask-staging.openstack.org' {
  960. class { 'openstack_project::server':
  961. iptables_public_tcp_ports => [22, 80, 443],
  962. sysadmins => hiera('sysadmins', []),
  963. }
  964. class { 'openstack_project::ask_staging':
  965. db_password => hiera('ask_staging_db_password'),
  966. redis_password => hiera('ask_staging_redis_password'),
  967. }
  968. }
  969. # Node-OS: trusty
  970. node 'translate.openstack.org' {
  971. class { 'openstack_project::server':
  972. iptables_public_tcp_ports => [80, 443],
  973. sysadmins => hiera('sysadmins', []),
  974. }
  975. class { 'openstack_project::translate':
  976. admin_users => 'aeng,camunoz,cboylan,daisyycguo,infra,jaegerandi,lyz,mordred,stevenk',
  977. openid_url => 'https://openstackid.org',
  978. listeners => ['ajp'],
  979. from_address => 'noreply@openstack.org',
  980. mysql_host => hiera('translate_mysql_host', 'localhost'),
  981. mysql_password => hiera('translate_mysql_password'),
  982. zanata_server_user => hiera('proposal_zanata_user'),
  983. zanata_server_api_key => hiera('proposal_zanata_api_key'),
  984. zanata_wildfly_version => '9.0.1',
  985. zanata_url => 'https://sourceforge.net/projects/zanata/files/webapp/zanata-war-3.7.3.war',
  986. zanata_checksum => '59f1ac35cce46ba4e46b06a239cd7ab4e10b5528',
  987. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  988. ssl_cert_file_contents => hiera('translate_ssl_cert_file_contents'),
  989. ssl_key_file_contents => hiera('translate_ssl_key_file_contents'),
  990. ssl_chain_file_contents => hiera('translate_ssl_chain_file_contents'),
  991. }
  992. }
  993. # Node-OS: trusty
  994. node 'translate-dev.openstack.org' {
  995. class { 'openstack_project::translate_dev':
  996. sysadmins => hiera('sysadmins', []),
  997. admin_users => 'aeng,camunoz,cboylan,daisyycguo,infra,jaegerandi,lyz,mordred,stevenk',
  998. openid_url => 'https://openstackid.org',
  999. listeners => ['ajp'],
  1000. from_address => 'noreply@openstack.org',
  1001. mysql_host => hiera('translate_dev_mysql_host', 'localhost'),
  1002. mysql_password => hiera('translate_dev_mysql_password'),
  1003. zanata_server_user => hiera('proposal_zanata_user'),
  1004. zanata_server_api_key => hiera('proposal_zanata_api_key'),
  1005. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  1006. }
  1007. }
  1008. # Node-OS: trusty
  1009. node 'apps.openstack.org' {
  1010. class { 'openstack_project::server':
  1011. iptables_public_tcp_ports => [80, 443],
  1012. sysadmins => hiera('sysadmins', []),
  1013. }
  1014. class { '::apps_site':
  1015. ssl_cert_file => '/etc/ssl/certs/apps.openstack.org.pem',
  1016. ssl_cert_file_contents => hiera('apps_ssl_cert_file_contents'),
  1017. ssl_key_file => '/etc/ssl/private/apps.openstack.org.key',
  1018. ssl_key_file_contents => hiera('apps_ssl_key_file_contents'),
  1019. ssl_chain_file => '/etc/ssl/certs/apps.openstack.org_intermediate.pem',
  1020. ssl_chain_file_contents => hiera('apps_ssl_chain_file_contents'),
  1021. }
  1022. }
  1023. # Node-OS: trusty
  1024. node 'odsreg.openstack.org' {
  1025. class { 'openstack_project::server':
  1026. iptables_public_tcp_ports => [80],
  1027. sysadmins => hiera('sysadmins', []),
  1028. }
  1029. realize (
  1030. User::Virtual::Localuser['ttx'],
  1031. )
  1032. class { '::odsreg':
  1033. }
  1034. }
  1035. # Node-OS: trusty
  1036. node 'codesearch.openstack.org' {
  1037. class { 'openstack_project::server':
  1038. iptables_public_tcp_ports => [80],
  1039. sysadmins => hiera('sysadmins', []),
  1040. }
  1041. class { 'openstack_project::codesearch':
  1042. project_config_repo => 'https://git.openstack.org/openstack-infra/project-config',
  1043. }
  1044. }
  1045. # vim:sw=2:ts=2:expandtab:textwidth=79