Merge pull request #14979 from rocky-linux/develop

Develop

ansible/playbooks/adhoc-ipadnsrecord.yml

@@ -42,3 +42,16 @@
         state: "{{ ipa_presence }}"
       tags:
         - dns
+
+    # We try to do this just in case because if a certificate is being issued
+    # that wants a CNAME, the host has to "manage" said host. However, if the
+    # host doesn't exist, we'll ignore it.
+    - name: "Creating host object for CNAME"
+      freeipa.ansible_freeipa.ipahost:
+        ipaadmin_principal: "{{ ipa_admin|default('admin') }}"
+        ipaadmin_password: "{{ ipaadmin_password }}"
+        name: "{{ ipa_name }}.{{ ipa_zone }}"
+        force: true
+        managedby:
+          - "{{ ipa_name_value[:-1] }}"
+      ignore_errors: true

ansible/playbooks/handlers/main.yml

@@ -37,3 +37,11 @@
   service:
     name: noggin
     state: restarted
+
+- name: rehash_postfix_sasl
+  command: "postmap /etc/postfix/sasl_passwd"
+
+- name: restart_postfix
+  service:
+    name: postfix
+    state: restarted

ansible/playbooks/init-rocky-builder-postfix.yml

@@ -0,0 +1,36 @@
+---
+# Configures postfix on buildsystems
+- name: Configure Buildsys Relay
+  hosts: "buildsys"
+  become: true
+  vars_files:
+    - vars/buildsys.yml
+
+  handers:
+    - import_tasks: handlers/main.yml
+
+  pre_tasks:
+    - name: Check if ansible cannot be run here
+      stat:
+        path: /etc/no-ansible
+      register: no_ansible
+
+    - name: Verify if we can run ansible
+      assert:
+        that:
+          - "not no_ansible.stat.exists"
+        success_msg: "We are not able to run on this node"
+        fail_msg: "/etc/no-ansible exists - skipping run on this node"
+
+  tasks:
+    - name: Deploy Postfix Relay
+      import_tasks: tasks/postfix_relay.yml
+
+  post_tasks:
+    - name: Touching run file that ansible has ran here
+      file:
+        path: /var/log/ansible.run
+        state: touch
+        mode: '0644'
+        owner: root
+        group: root

ansible/playbooks/tasks/gitlab-reconfigure.yml

@@ -50,6 +50,10 @@
     group: root
     state: link
 
+- name: Symlink the hash
+  command: "openssl rehash /etc/gitlab/trusted-certs"
+  changed_when: "1 != 1"
+
 - name: Turn on necessary SELinux booleans
   ansible.posix.seboolean:
     name: "{{ item }}"

ansible/playbooks/tasks/postfix_relay.yml

@@ -0,0 +1,37 @@
+---
+# Configure relay
+- name: Ensure postfix is installed
+  yum:
+    name:
+      - postfix
+      - cyrus-sasl-plain
+    state: present
+
+- name: Add password map
+  template:
+    src: etc/postfix/sasl_passwd.j2
+    dest: /etc/postfix/sasl_passwd
+    owner: root
+    group: root
+    mode: '0600'
+  notify: rehash_postfix_sasl
+
+- name: Add relay information to postfix
+  blockinfile:
+    path: /etc/postfix/main.cf
+    marker: "## ANSIBLE MANAGED ##"
+    block: |
+      smtp_tls_note_starttls_offer = yes
+      relayhost = [{{ smtp_relayhost }}]:587
+      smtp_use_tls = yes
+      smtp_sasl_auth_enable = yes
+      smtp_sasl_security_options =
+      smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
+      smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
+  notify: restart_postfix
+
+- name: Ensure postfix is running and enabled
+  service:
+    name: postfix
+    state: running
+    enabled: true

ansible/playbooks/templates/etc/gitlab/rocky_gitlab.rb

@@ -132,3 +132,7 @@ gitlab_rails['db_port'] = '{{ gitlab_external_db_port }}'
 gitlab_rails['db_username'] = '{{ gitlab_external_db_user }}'
 gitlab_rails['db_password'] = '{{ gitlab_external_db_password }}'
 {% endif %}
+
+{% if gitlab_trusted_proxies %}
+gitlab_rails['trusted_proxies'] = '{{ gitlab_trusted_proxies | map("to_json") | join(", ") }}'
+{% endif %}

ansible/playbooks/templates/etc/postfix/sasl_passwd.j2

@@ -0,0 +1 @@
+[{{ smtp_relayhost }}]:587 {{ smtp_user_name }}:{{ smtp_user_pass }}

ansible/playbooks/vars/gitlab.yml

@@ -29,7 +29,7 @@ gitlab_ldap_bind_dn: "{{ rocky_ldap_bind_dn }}"
 gitlab_ldap_password: "{{ rocky_ldap_bind_pw }}"
 gitlab_ldap_base: "{{ rocky_ldap_user_basedn }}"
 gitlab_ldap_group_dn: "{{ rocky_ldap_group_basedn }}"
-gitlab_ldap_admin_group: "cn=gitadm,cn=groups,cn=accounts,dc=rockylinux,dc=org"
+gitlab_ldap_admin_group: "gitadm"
 gitlab_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=gitusers,cn=groups,cn=accounts,dc=rockylinux,dc=org))"
 
 gitlab_time_zone: "UTC"
@@ -67,3 +67,6 @@ gitlab_external_db: true
 gitlab_external_db_host: db.rockylinux.org
 gitlab_external_db_user: gitlab
 gitlab_external_db_password: "{{ gitlab_db_pass }}"
+
+gitlab_trusted_proxies:
+  - 10.100.20.20/32