{"push_id":3095989428,"size":25,"distinct_size":24,"ref":"refs/heads/master","head":"8a964e7b6c019fd71300ee2823d9f2f48bb89da2","before":"6cd228d731a2c12e2512f4cde5cc2e537144ad6e","commits":[{"sha":"326f8a8dd25727962cd2ad6b720f237186806bc1","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1452: change tcp flags order\n\nThis should prevent messages like:\n\nNotice: /Stage[main]/Nebula::Profile::Networking::Firewall::Http/Firewall[200 HTTP: HAProxy chardonnay.umdl.umich.edu]/tcp_flags: tcp_flags changed 'FIN,SYN,RST,ACK SYN' to 'SYN,RST,ACK,FIN SYN'\n\nwhen applying the manifest","distinct":false,"url":"https://api.github.com/repos/mlibrary/nebula/commits/326f8a8dd25727962cd2ad6b720f237186806bc1"},{"sha":"5d8f584af5e2a20834b8cdc85fb247a37a0a1a71","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1620: purge unmanaged firewall resources\n\nThis ensures that any firewall resources not added by the firewall\nmodule are removed -- that is, we expect any changes to the firewall to\nbe managed by puppet.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/5d8f584af5e2a20834b8cdc85fb247a37a0a1a71"},{"sha":"8df4b8f170579212cbcc732170db7c9032e727a6","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"make puppet lint match rake task\n\nwithout this, running puppet lint manually to fix issues reported by\nrake lint causes errors in puppet:// urls - puppet-lint adds an\nerrorneous 'modules' path element","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/8df4b8f170579212cbcc732170db7c9032e727a6"},{"sha":"63e1d0d006dbbfcf85612419676c805d2535cd09","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1425: tweak packages to match debian 9\n\nlibio-compress-perl is included with libperl5.24\npear-horde-channel -> pear-channels","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/63e1d0d006dbbfcf85612419676c805d2535cd09"},{"sha":"e008d193cb0d8fa5193f0c0d889c11ae6289a304","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1429: Apache config, first pass\n\nMost of what's remaining is deprecated vhosts, individual IPs that\nshould be coming from hiera, or unclear how to achieve without using\ncustom snippets. The next step is just giving it a try on a host.\n\nThis a first pass at modules including shibboleth as well as SSL\ncertificates and a first pass at logging.\n\nThis runs apache as nobody/nogroup. The Debian default is www-data, but\nour long standing practice (inherited from RHEL) has been to run as\nnobody. Changing this would require changing ownership/permissions in\nmany places.\n\nCompared to the original configuration, this adds explicit logging\ndirectives for all vhosts, because otherwise puppet configures apache to\nlog to unfortunate places like \"/var/log/apache2/hathitrust canonical\nname redirection_error.log\"","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/e008d193cb0d8fa5193f0c0d889c11ae6289a304"},{"sha":"a14053bbad8e19129a74bc140b9973caecc5b599","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1433,AEIM-1435: install netpbm, kakadu","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/a14053bbad8e19129a74bc140b9973caecc5b599"},{"sha":"00617722acc3e468bdd94c89e3757ddf2473a454","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1429; AEIM-1625: shibboleth configuration\n\nfor now, just puts static config files in place\nstill to do: set permissions so shibd can read SSL keys\n\nThe time-out for startup is set by dropping in a configuration file that\nis picked up by the systemd service. The value is hardcoded at this\ntime; should it be expected to change, it should be extracted.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/00617722acc3e468bdd94c89e3757ddf2473a454"},{"sha":"480e8d4c6a525893a63d63d6c2da4bd2e6a0a8c9","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1626: configure private network interface on htvms","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/480e8d4c6a525893a63d63d6c2da4bd2e6a0a8c9"},{"sha":"01af388b31537aacd8d1c767a7d4baa024acad0d","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1622: mount for ht repository & applications\n\nTo prevent a race condition when applying, this makes the /etc/bind\ndirectory if necessary before adding files","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/01af388b31537aacd8d1c767a7d4baa024acad0d"},{"sha":"bd91ddad3ee816c3fe999c0a335c547ff50f55e9","author":{"name":"Noah Botimer","email":"b1072af485e238284c6033f3227a87c845946bdb@umich.edu"},"message":"AEIM-1430 - Install PEAR modules with puppet/php\n\nThis attempts to install all of the PEAR modules through the\n'puppet/php' module, which appears to be the most mature and maintained\non the forge. The usage does not install FPM, dev headers, or composer,\nbut each is simple to add. I chose to remove the Debian packages for the\nselect few PEAR modules and list them all as extensions on the PHP\nresource.\n\nThis explicitly lists 'beta' for the extensions that aren't 'stable',\nsince they won't install otherwise, but doesn't pin to a specific\nversion.\n\nThis also installs a locally-packaged version of smarty, since we need\nversion 2 and it is no longer available via PEAR.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/bd91ddad3ee816c3fe999c0a335c547ff50f55e9"},{"sha":"f0f764c636a88ea7218a5011ffb4267d2779c6e8","author":{"name":"Noah Botimer","email":"b1072af485e238284c6033f3227a87c845946bdb@umich.edu"},"message":"AEIM-1428 - Add CPAN modules to HTVM\n\nThis is not a beautiful implementation, but it should do the trick.\nThere is a reasonable check in the unless that just loads the module.\nThe defined type sits at the nebula level, which may not be right for\nthe long term.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/f0f764c636a88ea7218a5011ffb4267d2779c6e8"},{"sha":"0549efa2a91c1678919f6bf030b26583b1326a9c","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1632: add mysql hosts entry\n\nAs mentioned elsewhere, a static IP from hiera is easiest for now, but\nit will probably make sense to generate this dynamically in the future\nbased on the host with the HathiTrust mysql role, when that exists.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/0549efa2a91c1678919f6bf030b26583b1326a9c"},{"sha":"f053a017d5ff764c733b1802bbd0528b3aac5e71","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1429: add symlink from /l/local/bin to /usr/bin\n\nThere are some hard-coded paths to /l/local/bin, but in the new world\neverything that was in /l/local/bin should be installed as a deb and end\nup in /usr/bin like anything else on the system","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/f053a017d5ff764c733b1802bbd0528b3aac5e71"},{"sha":"5314b8af41c5cce13af39197defcfd7fb70d85f7","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1431: HathiTrust imgsrv\n\nAdds systemd service and startup script for imgsrv.  Parameterizes some\nthings that were hardcoded in the startup script (sdrroot, sdrview,\nsdrdataroot), but removes the parameterization on application.\n\nWe could have created a defined type that passed through the application\nname as a parameter, but at least for now that likely doesn't make sense\ngiven that we are unlikely to deploy additional Plack-based\napplications. We can always revisit that later if need be.\n\nThis also changes from binding to a unix socket to a TCP socket for\nimgsrv. The Unix socket configuration didn't work with\nmod_proxy_fastcgi. It uses a Directory and Files snippet to use the\nproxy handler for imgsrv - this way $PATH_INFO gets set correctly - and\nadds tests to ensure this stanza and some other directories are\nproperly configured.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/5314b8af41c5cce13af39197defcfd7fb70d85f7"},{"sha":"6990647b17b5e0c5cd83222c1ec2b54c073d3d05","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1429: Refactor apache profile to separate class per vhost\n\n- Added common parameters to each vhost\n\n- Removed 'hathitrust.org' literals from vhosts\n\n- Add defaults or values in lensoftruth for non-common parameters for\nvhosts","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/6990647b17b5e0c5cd83222c1ec2b54c073d3d05"},{"sha":"829d1d88ca110d2708c5dca0e588878951c6b94f","author":{"name":"Noah Botimer","email":"b1072af485e238284c6033f3227a87c845946bdb@umich.edu"},"message":"AEIM-1429 - Splat SSL params\n\n- Splat SSL params to simplify invocation of the profiles with common\ndata\n- Add tests for the various vhosts/redirects\n- Move catalog redirect to redirect.pp","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/829d1d88ca110d2708c5dca0e588878951c6b94f"},{"sha":"fd596fc97417351a2881f1940ff21e652e8e83d8","author":{"name":"Noah Botimer","email":"b1072af485e238284c6033f3227a87c845946bdb@umich.edu"},"message":"AEIM-1629 - Remove redirects for obsolete hostnames","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/fd596fc97417351a2881f1940ff21e652e8e83d8"},{"sha":"7279f7f8c671f87608b1f126d1682be3239809c1","author":{"name":"Noah Botimer","email":"b1072af485e238284c6033f3227a87c845946bdb@umich.edu"},"message":"AEIM-1429 - Verify bare domain redirects\n\nThis tests that we add redirects for bare, alternate domains like\nhathitrust.com.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/7279f7f8c671f87608b1f126d1682be3239809c1"},{"sha":"5e3caecbdd5657519996b63af46b2369c7e50644","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1431: remove socket-based fcgi rewrite rule","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/5e3caecbdd5657519996b63af46b2369c7e50644"},{"sha":"d11c8641427d1f3527986a4c27b9a71b40c78d75","author":{"name":"Aaron Elkiss","email":"718f4320e0499f2ede773da33bfee614137fc1db@umich.edu"},"message":"AEIM-1645: deploy ip-detection & badrobots\n\nThis uses the apache::custom_config defined type, which is provided to\nmanage apache conf.d things, so we don't need to use file resources\ndirectly. As a bonus it will verify the config before it restarts\napache.","distinct":true,"url":"https://api.github.com/repos/mlibrary/nebula/commits/d11c8641427d1f3527986a4c27b9a71b40c78d75"}]}
{"actor":{"display_login":"aelkiss"}}