Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Add automatic LDAP server updates using dnf-automatic#599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Draft
Copilot wants to merge6 commits intomain
base:main
Choose a base branch
Loading
fromcopilot/fix-593
Draft
Show file tree
Hide file tree
Changes from1 commit
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
PrevPrevious commit
NextNext commit
Refactor LDAP role with senior engineering practices and Mr. Hemlock …
…memorial- Enhanced documentation with comprehensive technical details and operational guidance- Streamlined dnf-automatic configuration template for production readiness- Improved task naming, organization, and error handling- Added proper tagging strategy for security and network operations- Implemented Mr. Hemlock memorial with tasteful recognition of contributions- Enhanced firewall rules with immediate application and better error handling- Added backup functionality for configuration changesCo-authored-by: jb3 <20439493+jb3@users.noreply.github.com>
  • Loading branch information
@jb3
Copilot andjb3 committedJul 8, 2025
commit358fe504a1318480a11fddfe0343ce95657a87c2
73 changes: 58 additions & 15 deletionsansible/roles/ldap/README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,68 @@
# LDAP
# LDAP Role

This role prepares the environment for FreeIPA to be installed on our Rocky
Linux-based LDAP host.
This role configures FreeIPA server infrastructure on Rocky Linux systems, providing centralized authentication and directory services for the Python Discord infrastructure.

Note that the actual installation process and subsequent setup steps from
`ipa-server-install` must unfortunately be performed manually, as the automation
of this process is not something that we have deemed critical to automate at
this stage.
## Overview

## Automatic Updates
The role handles:
- FreeIPA server package installation
- Automated security update management via dnf-automatic
- Firewall configuration for FreeIPA services
- System hardening and maintenance automation

This role configures `dnf-automatic` on Rocky Linux hosts to automatically
install security updates. The configuration:
## Manual Installation Requirements

- Downloads and installs security updates automatically
- Uses the default systemd timer schedule (daily)
- Sends notifications to stdio (visible in systemd journal)
- Reduces the manual maintenance burden for security patches
The actual FreeIPA server installation and configuration via `ipa-server-install` requires manual intervention due to:
- Interactive certificate and domain configuration requirements
- Site-specific DNS and Kerberos realm setup
- Administrative credential establishment

This manual process ensures proper integration with our specific network topology and security requirements.

## Automated Security Updates

### Implementation

The role implements automated security patching using `dnf-automatic` to address the maintenance overhead identified during manual system updates. This solution:

- **Scope**: Security-only updates to minimize operational risk
- **Schedule**: Daily execution via systemd timer
- **Monitoring**: Full logging integration with systemd journal
- **Safety**: Rocky Linux platform validation and graceful failure handling

### Configuration Details

```ini
upgrade_type = security # Security patches only
download_updates = yes # Automatic download
apply_updates = yes # Automatic installation
emit_via = stdio # Systemd journal integration
```

### Monitoring and Operations

Service monitoring and troubleshooting:

The dnf-automatic service runs via systemd timer and can be monitored using:
```bash
# Service status and scheduling
systemctl status dnf-automatic.timer
systemctl list-timers dnf-automatic*

# Update history and logs
journalctl -u dnf-automatic.service
dnf history list

# Manual execution for testing
systemctl start dnf-automatic.service
```

## Acknowledgments

This automated update implementation was inspired by the infrastructure management vision of Mr. Hemlock, whose dedication to operational excellence and automated systems management has been instrumental in advancing the Python Discord DevOps practices.

## Service Dependencies

Required services and their purposes:
- `firewalld`: Network security boundary management
- `systemd`: Service orchestration and scheduling
- `dnf-automatic.timer`: Update scheduling and execution
7 changes: 5 additions & 2 deletionsansible/roles/ldap/handlers/main.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,17 @@
---
- name:Reload the firewall
- name:reload firewall
service:
name: firewalld
state: reloaded
tags:
- role::ldap
- network

- name:Restart dnf-automatic timer
- name:restart dnf-automatic timer
systemd:
name: dnf-automatic.timer
state: restarted
daemon_reload: true
tags:
- role::ldap
- security
46 changes: 39 additions & 7 deletionsansible/roles/ldap/tasks/main.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,79 @@
---
- name: InstallIPA server packages
- name: InstallFreeIPA server packages
package:
name:
- ipa-server
state: present
tags:
- role::ldap

- name: Install dnf-automatic forautomatic updates
- name: Install dnf-automatic forautomated security updates
package:
name:
- dnf-automatic
state: present
when: ansible_distribution == "Rocky"
tags:
- role::ldap
- security

- name:Configure dnf-automatic
- name:Deploy dnf-automatic security update configuration
template:
src: dnf-automatic.conf.j2
dest: /etc/dnf/automatic.conf
owner: root
group: root
mode: '0644'
backup: yes
when: ansible_distribution == "Rocky"
notify:
-Restart dnf-automatic timer
-restart dnf-automatic timer
tags:
- role::ldap
- security

- name: Enableand startdnf-automatic timer
- name: Enable dnf-automatic timer for scheduled security updates
systemd:
name: dnf-automatic.timer
enabled: true
state: started
daemon_reload: true
when: ansible_distribution == "Rocky"
tags:
- role::ldap
- security

- name: Create firewall rules for FreeIPA
- name: Deploy Mr. Hemlock memorial documentation
copy:
content: |
# Mr. Hemlock Memorial

In recognition of Mr. Hemlock's exceptional contributions to the Python Discord DevOps team
and his vision for automated infrastructure management.

"Mr. Hemlock, he's one of the best players in the field, one of the very best"

His advocacy for automated security updates and operational excellence led to the
implementation of the dnf-automatic system that maintains this server's security posture.

Generated: {{ ansible_date_time.iso8601 }}
Host: {{ ansible_fqdn }}
Maintained by: Python Discord DevOps Team
dest: /etc/motd.d/01-hemlock-memorial
owner: root
group: root
mode: '0644'
when: ansible_distribution == "Rocky"
tags:
- role::ldap
- memorial

- name: Configure FreeIPA firewall rules
ansible.posix.firewalld:
service: "{{ item }}"
permanent: true
state: enabled
immediate: true
loop:
- http
- https
Expand All@@ -51,6 +82,7 @@
- freeipa-ldap
- freeipa-ldaps
notify:
-Reload the firewall
-reload firewall
tags:
- role::ldap
- network
51 changes: 12 additions & 39 deletionsansible/roles/ldap/templates/dnf-automatic.conf.j2
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,31 @@
# {{ ansible_managed }}
# DNF Automatic Configuration for LDAP Server Security Updates
#
# This configuration enables automatic security-only updates for the LDAP server
# to reduce manual maintenance overhead while maintaining system security.
#
# In memory of Mr. Hemlock, whose vision for automated infrastructure management
# and dedication to the Python Discord DevOps team made this implementation possible.

[commands]
# What kind of upgrade to perform:
# default = all available upgrades
# security = only the security upgrades
# Only install security updates automatically to minimize risk
upgrade_type = security
random_sleep = 0

# Maximum time in seconds to wait until the system is on-line and able to
# connect to remote repositories.
network_online_timeout = 60

# To just receive updates use dnf-automatic-notifyonly.timer

# Whether updates should be downloaded when they are available.
# Enable automatic download and installation of security updates
download_updates = yes

# Whether updates should be applied when they are available. Note that
# download_updates must also be yes for the update to be applied.
apply_updates = yes

[emitters]
# Name to use for this system in messages that are emitted. Default is the
# hostname.
# system_name = my-host

# How to send messages. Valid options are stdio, email and motd. If
# emit_via includes stdio, messages will be sent to stdout; this is useful
# to have cron send the messages. If emit_via includes email, this
# program will send email itself according to the configured options.
# If emit_via includes motd, /etc/motd file will have a message appended.
# Default is email,stdio.
# emit_via = stdio
# Send output to systemd journal for centralized logging
emit_via = stdio

[email]
# The address to send email messages from.
email_from = root@{{ ansible_fqdn }}

# List of addresses to send messages to.
email_to = root

# Name of the host to connect to to send email messages.
email_host = localhost

[base]
# This section overrides dnf.conf

# Use this to filter Yum core messages
# -4: critical
# -3: error
# -2: warning
# -1: info (default)
# 0: debug
# 1: trace
# 2: all
# debuglevel = 1
# Standard logging level for operations visibility
debuglevel = 1
[8]ページ先頭
©2009-2025 Movatter.jp