You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
Kevin Fenzi e1818e7a8c
virthost: rkhunter is available for epel9 for a while now
7 hours ago
callback_plugins logview: migrate optparse to argparse, add additional date filtering capabilities, and some pep8 fixes 2 years ago
files debuginfod: tweak caching, stop retaining f32 data 3 weeks ago
filter_plugins playbooks / staging: adjust playbooks for staging to configure fedmsg if needed 2 years ago
handlers copr: restart systemd-oomd after changing its config 2 months ago
inventory debuginfod01.stg: increase memory to 16gb 11 hours ago
library Spring cleaning time. :) 3 years ago
playbooks virthost: rkhunter is available for epel9 for a while now 7 hours ago
roles crypto-policies: Set ns01.iad2/ns02.iad2 to use DEFAULT:SHA1 crypto-policy 1 day ago
scripts ansible-core is now using python3.9 3 months ago
tasks copr: disable zram0 swap 2 months ago
vars F37 is GO 3 months ago
.ansible-lint [Zuul] Add configuration file for ansible-lint 9 months ago
.gitignore [release-monitoring] Add librariesio consumer 3 years ago
.yamllint.yaml CI: Run yamllint on added or modified YAML files 3 years ago
.zuul.yaml [Zuul] Use ansible lint instead ansible review 9 months ago
CONVENTIONS conventions: you guessed it, another whitespace change 3 years ago
README Convert README to a symlink to 3 years ago Added section about PR workflow. 2 years ago
main.yml main: remove os-cluster from main 2 months ago

Fedora Infrastructure

Welcome! This is the Fedora Infrastructure Ansible Pagure project.

Pull requests and forks can be made against this repository hosted

This repository is also mirrored for production runs to
but this is the working repository where changes are made.

If you would like to help out with Fedora Infrastructure, see:

Ansible repository/structure

files - files and templates for use in playbooks/tasks
      - subdirs for specific tasks/dirs highly recommended

inventory - where the inventory and additional vars is stored
          - All files in this directory in ini format
          - added together for total inventory
          - per group variables set here in a file per group
          - per host variables set here in a file per host

library - library of custom local ansible modules

playbooks - collections of plays we want to run on systems

  groups: groups of hosts configured from one playbook.

  hosts: playbooks for single hosts.

  manual: playbooks that are only run manually by an admin as needed.

tasks - snippets of tasks that should be included in plays

roles - specific roles to be use in playbooks.
        Each role has it's own files/templates/vars

filter_plugins - Jinja filters

main.yml - This is the main playbook, consisting of all
             current group and host playbooks. Note that the
             daily cron doesn't run this, it runs even over
             playbooks that are not yet included in main.
             This playbook is usefull for making changes over
             multiple groups/hosts usually with -t (tag).


The public path on batcave01 (our control host) for everything is /srv/web/infra/ansible

The private path on batcave01 (our control host) (which is sysadmin-main accessible only)
is /srv/private/ansible

In general to run any ansible playbook you will want to run:

sudo -i ansible-playbook /path/to/playbook.yml

(On batcave01, our control host)

Scheduled check-diff

Every night a cron job runs over all playbooks under playbooks/{groups}{hosts}
with ansible --check --diff. A report from this is sent to sysadmin-logs.
In the ideal state this report would be empty.


All playbooks should be idempotent. Ie, if run once they should bring the
machine(s) to the desired state, and if run again N times after that they should
make 0 changes (because the machine(s) are in the desired state).
Please make sure your playbooks are idempotent.

Can be run anytime

When a playbook or change is checked into ansible you should assume
that it could be run at ANY TIME. Always make sure the checked in state
is the desired state. Always test changes when they land so they don't
surprise you later.

Contributing and Licensing

Contributions to this repository are subject to the Fedora Project
Contributor Agreement. If no license is specified, the MIT license is used, otherwise
the contribution is under the specified acceptable Fedora License.
for more information.

Contributing Pull Requests

If found a way to improve this repository or fix an issue found in our
infrastructure tracker (see
open a pull-request.

You either should have capability to run the playbooks after they have been reviewed,
and merged or find the person responsible and work with them to make sure the changes
will be aplied afterwards.

We are currently working on a simple to use list of Point Of Contanct people for the applications
here, untill it is done, you can, look at people that recently edited the ansible files,
or if you belong to sysadmin group, view the /etc/ansible_utils/rbac.yaml located on batcave01,
where you can see the groups of people that have capabilities to run the relevant playbooks.

For example, to upgrade Release Monitoring, you need to run playbook openshift-apps/release-monitoring.yaml.
People in sysadmin-releasemonitoring have that capability, and you cand find the members in

If the application in question is not on the critical path it should be sufficient,
if person responsible for the application reviews the PR.

If the files in question are on the critical path, that are necessary for functioning packager workflow,
at least two different people should review the PR.

If there is any risk at all, that the application of the changes would induce downtime,
work closely with other to ensure that the downtime is properly scheduled:

Applications on critical path: pagure, mirrormanager, toddlers, bodhi, noggin, mdapi, rpmautospec,
pagure-dist-git, monitor-gating, mirror_from_pagure, fedora-messaging, dist-git, PDC/FPDC, FMN, sigul
robosignatory, tag2distrepo, ci-resultsdb-listener, stylo, mirrorlist
resultsdb, Nagios, koschei, wiki / mediawiki, wiki / moin, waiverdb,
greenwave, ODCS, Mailman3 / HK, mailman 2, OSBS, pungi, koji, MBS,
IPA, rabbitmq, geoip,ipsilon

We are rewiewing PR's during the morning EU standup (,
so feel free to jump in and discuss.