Nasqueron Agora - Recent changes [en]

User:Dereckson/Devserver

Dereckson — Mon, 13 Apr 2026 12:44:02 GMT

Log is available per D4057

← Older revision		Revision as of 12:44, 13 April 2026
(One intermediate revision by the same user not shown)
Line 58:		Line 58:

	== Zed ==		== Zed ==
			=== Useful paths ===
			{\| class="wikitable"
			\|+ Paths for Zed development
			\|-
			! File path !! Managed by !! Notes
			\|-
			\| /usr/local/etc/nginx/vhosts/dereckson.be/zed51.conf \|\| Salt :: webserver-alkane
			\|-
			\| /var/51-wwwroot/zed/ \|\| Salt :: wwwroot-51 (still to do) \|\| Git repo: git@github.com:dereckson/zed.git
			\|-
			\| /var/dataroot/zed/content/ \|\| Manually \|\| Git repo: git@github.com:hypership/content.git
			\|}

	=== Logs ===		=== Logs ===
	tail -n 100 -f /var/log/www/dereckson.be/zed51-php.log		* nginx: <code>tail -n 100 -f /var/log/www/dereckson.be/zed51-error.log</code>
			* PHP: <code>tail -n 100 -f /var/log/www/dereckson.be/zed51-php.log</code>

	=== Staging ===		=== Staging ===

Module:ProjectBox

Dereckson — Thu, 09 Apr 2026 17:52:40 GMT

← Older revision		Revision as of 17:52, 9 April 2026
(One intermediate revision by the same user not shown)
Line 1:		Line 1:
			-- Module:ProjectInfobox
			-- Renders a structured infobox for a project page.
			-- Usage: {{#invoke:ProjectInfobox\|render}}

	local p = {}		local p = {}

	local function ~~renderRow~~(~~label,~~ value)		-- Split a comma-separated string into a trimmed list.
	~~if not~~ value ~~or value ==~~ "" ~~then~~		local function splitList(value)
	~~return ""~~		local items = {}
			for item in value:gmatch("[^,]+") do
			table.insert(items, mw.text.trim(item))
	end		end
	return ~~string~~.~~format~~(		return items
	~~'<tr><~~th~~>%s</th><~~td~~>%s</td></tr>'~~,		end
	~~label~~, ~~value~~
	)		-- Wrap a value in a table cell pair (label / value).
			local function row(label, value)
			return mw.html.create("tr")
			:tag("th"):addClass("project-infobox__label"):wikitext(label):done()
			:tag("td"):addClass("project-infobox__value"):wikitext(value):done()
			end

			-- Render participants as a comma-separated inline list.
			local function participantCell(raw)
			local names = splitList(raw)
			local linked = {}
			for _, name in ipairs(names) do
			table.insert(linked, "[[User:" .. name .. "\|" .. name .. "]]")
			end
			return table.concat(linked, ", ")
	end		end

Line 14:		Line 34:
	local args = frame:getParent().args		local args = frame:getParent().args

	local ~~html~~ = {}		local group = mw.text.trim(args.group or "")
	~~table~~.~~insert~~(~~html, '{\| class~~="~~infobox project-infobox~~"')		local project = mw.text.trim(args.project or "")
			local participants = mw.text.trim(args.participants or "")
			local status = mw.text.trim(args.status or "")
			local description = mw.text.trim(args.description or "")

	-- ~~Title~~ (project ~~name~~)		local root = mw.html.create("table"):addClass("project-infobox")
	if ~~args.project~~ then		local tbody = root:tag("tbody")
	~~table.insert~~(~~html~~, ~~string.format('! colspan~~="2" ~~class=~~"~~infobox-title~~" ~~\| %s'~~, ~~args.~~project))
			-- Header row: project name as caption
			root:tag("caption")
			:addClass("project-infobox__title")
			:wikitext(project ~= "" and project or "Project")

			if group ~= "" then
			tbody:node(row("Group", group))
			end

			if project ~= "" then
			tbody:node(row("Project", project))
	end		end

	~~table.insert~~(~~html~~, ~~'\|-'~~)		if status ~= "" then
			tbody:node(row("Status", status))
			end

	~~-- Rows~~		if participants ~= "" then
	~~table.insert(html, renderRow(~~"~~Group~~"~~, args.group))~~		tbody:node(row("Participants", participantCell(participants)))
	~~table.insert~~(~~html, renderRow~~("Participants", ~~args.~~participants))		end

	~~table.insert~~(~~html~~, ~~'\|}'~~)		if description ~= "" then
			tbody:tag("tr")
			:tag("td")
			:attr("colspan", "2")
			:addClass("project-infobox__description")
			:wikitext(description)
			end

	return ~~table.concat~~(~~html, '\n'~~)		return tostring(root)
	end		end

	return p		return p

Module:ProjectBox

Dereckson — Thu, 09 Apr 2026 17:38:42 GMT

Created page with "local p = {} local function renderRow(label, value) if not value or value == "" then return "" end return string.format( '<tr><th>%s</th><td>%s</td></tr>', label, value ) end function p.render(frame) local args = frame:getParent().args local html = {} table.insert(html, '{| class="infobox project-infobox"') -- Title (project name) if args.project then table.insert(html, string.format('! colspan="2" c..."

New page

local p = {}

local function renderRow(label, value)
if not value or value == "" then
return ""
end
return string.format(
'<tr><th>%s</th><td>%s</td></tr>',
label, value
)
end

function p.render(frame)
local args = frame:getParent().args

local html = {}
table.insert(html, '{| class="infobox project-infobox"')

-- Title (project name)
if args.project then
table.insert(html, string.format('! colspan="2" class="infobox-title" | %s', args.project))
end

table.insert(html, '|-')

-- Rows
table.insert(html, renderRow("Group", args.group))
table.insert(html, renderRow("Participants", args.participants))

table.insert(html, '|}')

return table.concat(html, '\n')
end

return p

User:Dereckson/Sandbox

Dereckson — Thu, 09 Apr 2026 17:37:22 GMT

← Older revision		Revision as of 17:37, 9 April 2026
Line 1:		Line 1:
	{{#invoke:~~ProjectInfobox~~\|render		{{#invoke:ProjectBox\|render
	\| project = Some project		\| project = Some project
	\| group = Nasqueron Operations SIG		\| group = Nasqueron Operations SIG
	\| participants = Dereckson ⬪ ptdradmin		\| participants = Dereckson ⬪ ptdradmin
	}}		}}

User:Dereckson/Sandbox

Dereckson — Thu, 09 Apr 2026 17:37:10 GMT

Created page with "{{#invoke:ProjectInfobox|render | project = Some project | group = Nasqueron Operations SIG | participants = Dereckson ⬪ ptdradmin }}"

New page

{{#invoke:ProjectInfobox|render
| project = Some project
| group = Nasqueron Operations SIG
| participants = Dereckson ⬪ ptdradmin
}}

Operations grimoire/Anubis

Dereckson — Thu, 09 Apr 2026 17:30:58 GMT

← Older revision		Revision as of 17:30, 9 April 2026
(One intermediate revision by the same user not shown)
Line 8:		Line 8:
	Anubis is used by a lot of similar software forges from open-source projects: [https://anubis.techaro.lol/docs/user/known-instances Anubis known instances], but it's unclear if someone already succeed to configure it for Phabricator.		Anubis is used by a lot of similar software forges from open-source projects: [https://anubis.techaro.lol/docs/user/known-instances Anubis known instances], but it's unclear if someone already succeed to configure it for Phabricator.

	It's our current field of investigation by ~~Doba~~ Gui and Dereckson.		It's our current field of investigation by Gui and Dereckson.

	At Wikimedia, Andrew Kostka (WMDE) has some experience deploying it, apparently for Wikibase products.		At Wikimedia, Andrew Kostka (WMDE) has some experience deploying it, apparently for Wikibase products.

	== Implementation (by ~~Doba~~ Gui) ==		== Implementation (by Gui) ==
	=== Isolation via UNIX Sockets ===		=== Isolation via UNIX Sockets ===
	To avoid ~~port conflicts (especially the default metrics port 9000)~~, ~~every~~ instance is configured to use UNIX sockets for both traffic and metrics:		To avoid to maintain a table of TCP ports, each instance is configured to use UNIX sockets for both traffic and metrics:
	* '''Main socket:''' `/run/anubis/{{ instance }}.sock`		* '''Main socket:''' <code><nowiki>/run/anubis/{{ instance }}.sock</nowiki></code>
	* '''Metrics socket:''' `/run/anubis/{{ instance }}-metrics.sock`		* '''Metrics socket:''' <code><nowiki>/run/anubis/{{ instance }}-metrics.sock</nowiki></code>

	=== Dynamic Configuration ===		=== Dynamic Configuration ===
Line 32:		Line 32:

	== Current work ==		== Current work ==
	* ~~Doba~~ deployed an experimental run manually on Dwellers to figure how we can build and configure Anubis		* Gui deployed an experimental run manually on Dwellers to figure how we can build and configure Anubis
	* Work to deploy Anubis with Salt: [https://devcentral.nasqueron.org/D3908 D3908]		* Work to deploy Anubis with Salt: [https://devcentral.nasqueron.org/D3908 D3908]

IPsec

Duranzed — Thu, 09 Apr 2026 10:00:57 GMT

@@ Line 194: / Line 194: @@
 * Any known issues with multicast over GRE ?
 * How will IPsec impact CARP ?
 === Official documentation ===

Operations grimoire/Configuration files

Dereckson — Sun, 05 Apr 2026 21:07:45 GMT

Draft

Show changes

Operations grimoire/Services

Dereckson — Sun, 05 Apr 2026 20:50:48 GMT

FreeBSD rc: Basic instructions

← Older revision		Revision as of 20:50, 5 April 2026
Line 36:		Line 36:

	== FreeBSD rc ==		== FreeBSD rc ==
			=== Structure of a rc configuration file ===
			Each service is configured in /etc/rc.conf.d/<service> file or by all the files in /etc/rc.conf.d/<service>/ directory.

			Those files follow [https://man.freebsd.org/cgi/man.cgi?rc.conf rc.conf syntax] and use:
			* <service>_enable="YES" to indicate auto start of the service
			* various <service>_<key>=<value> per service documentation

			To know all the available options for a service the best is to read the documentation at the top of every service, located in
			/usr/local/etc/rc.d for applications and /etc/rc.d for the base system.

	=== Template for operations repository ===		=== Template for operations repository ===
	If you need to add a rc service, we've a template for the file: follow [https://devcentral.nasqueron.org/D3571 D3571 instructions]		If you need to add a rc service, we've a template for the file: follow [https://devcentral.nasqueron.org/D3571 D3571 instructions]

	[[Category:Operations grimoire\|Services]]		[[Category:Operations grimoire\|Services]]

Operations grimoire

Dereckson — Sun, 05 Apr 2026 20:41:45 GMT

Appendices

← Older revision		Revision as of 20:41, 5 April 2026
Line 139:		Line 139:
	* [[/Changelog]]		* [[/Changelog]]
	* [[/Contacts]]		* [[/Contacts]]
			* [[/Configuration files]]
	* [[/Contribute]]		* [[/Contribute]]
	* [[/Decom]]		* [[/Decom]]

Code conventions

Dereckson — Fri, 03 Apr 2026 22:35:38 GMT

Salt: Double quotes

← Older revision		Revision as of 22:35, 3 April 2026
Line 72:		Line 72:
	== Salt ==		== Salt ==
	=== Style ===		=== Style ===
	Whitespaces:		;Whitespaces
	* Indent with two spaces		* Indent with two spaces
	* YAML lists use indented bullets		* YAML lists use indented bullets
Line 82:		Line 82:
	- otherkey: value		- otherkey: value
	</syntaxhighlight>		</syntaxhighlight>

			;Quotes
			* Use double quotes in Python, Salt and Jinja expressions

	=== Tips ===		=== Tips ===

WindRiver

Dereckson — Fri, 03 Apr 2026 17:19:51 GMT

← Older revision		Revision as of 17:19, 3 April 2026
Line 31:		Line 31:
	\| 6902 \|\| dereckson \|\| irssi proxy		\| 6902 \|\| dereckson \|\| irssi proxy
	\|}		\|}

			== Troubleshoot ==

			=== To check after reboot ===

			* Network
			** IPv4 - ICANN
			** IPv6 - main + viperserv alias
			** IPv6 - can we reach something with IPv6
			** IPv4 - Drake: tunnel + route + ping any server
			* Services
			** Alkane HTTP server
			** API exec HTTP server
			** Bitlbee
			** Eggdrops: Dæghrefn + Wearg
			** Grafana
			** MariaDB
			** NetBox
			** nginx
			** Node exporter for Prometheus
			** oidentd
			** php-fpm
			** PostgreSQL
			** Prometheus
			** Redis
			** Salt minion
			** SSH server
			* Vault connectivity

Operations grimoire/Deploy with Terraform

Yousra — Sun, 29 Mar 2026 18:27:37 GMT

CARP OVH secrets usage

← Older revision		Revision as of 18:27, 29 March 2026
(4 intermediate revisions by the same user not shown)
Line 68:		Line 68:
	'''ops/secrets/network/router/vault'''		'''ops/secrets/network/router/vault'''

	Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.		Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

			The Vault Secrets may need to be rotated, so we need a simple way to propagate
	~~When rotating the secrets OVH :~~		updated credentials to routers. This is enabled by the mechanism
			introduced in D4026.
	* Terraform must be applied again to update the secrets in Vault

	~~Failing~~ to do so ~~may cause CARP failover~~ to ~~break due~~ to ~~invalid OVH credentials or expired Vault authentication~~.

	== Table of Terraform states ==		== Table of Terraform states ==

Protocol CARP

Yousra — Sun, 29 Mar 2026 15:00:53 GMT

ESXI and CARP

← Older revision		Revision as of 15:00, 29 March 2026
Line 391:		Line 391:


	~~== ESXI and CARP ==~~

	Linked to {{T\|2227}}		Linked to {{T\|2227}}

Operations grimoire/Deploy with Terraform

Yousra — Sun, 29 Mar 2026 14:34:51 GMT

CARP OVH secrets usage

@@ Line 55: / Line 55: @@
 Don't forget to always apply this full procedure.
 </div>
 == Table of Terraform states ==

How to communicate

Dereckson — Tue, 24 Mar 2026 17:13:32 GMT

← Older revision		Revision as of 17:13, 24 March 2026
Line 67:		Line 67:

	[[Category:Contributor guide]]		[[Category:Contributor guide]]
	[[Category:Reference ~~guide~~]]		[[Category:Reference]]

Operations grimoire/Deploy with Terraform

Dereckson — Sun, 22 Mar 2026 23:51:29 GMT

Propagate secrets (DRP)

← Older revision		Revision as of 23:51, 22 March 2026
Line 50:		Line 50:
	# Missing for router		# Missing for router
	</syntaxhighlight>		</syntaxhighlight>

			<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

			Don't forget to always apply this full procedure.
			</div>

	== Table of Terraform states ==		== Table of Terraform states ==

MediaWiki:Common.css

Dereckson — Sun, 22 Mar 2026 23:50:38 GMT

@@ Line 31: / Line 31: @@
 .inline-code, .inline-code div,  .inline-code pre {
 	display: inline-table;
+}

Operations grimoire/Deploy with Terraform

Dereckson — Sun, 22 Mar 2026 23:18:13 GMT

Propagate secrets (DRP): # Missing for router

← Older revision		Revision as of 23:18, 22 March 2026
Line 48:		Line 48:
	$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config		$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
	$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config		$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
			# Missing for router
	</syntaxhighlight>		</syntaxhighlight>

Protocol CARP

Yousra — Sun, 22 Mar 2026 20:24:31 GMT

← Older revision		Revision as of 20:24, 22 March 2026
Line 390:		Line 390:
	https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security/securing-vsphere-networking/securing-vsphere-standard-switches.html		https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security/securing-vsphere-networking/securing-vsphere-standard-switches.html


			== ESXI and CARP ==

	Linked to {{T\|2227}}		Linked to {{T\|2227}}

Operations grimoire/Vault

Dereckson — Sun, 22 Mar 2026 18:59:45 GMT

Get an admin-level token

← Older revision		Revision as of 18:59, 22 March 2026
(One intermediate revision by the same user not shown)
Line 134:		Line 134:
	ssh complector		ssh complector
	cd /opt/salt/nasqueron-operations		cd /opt/salt/nasqueron-operations
	sudo ./utils/vault/issue-admin-token.py		sudo ./utils/vault/issue-admin-token.py

	If Vault certificate has expired, add the `--insecure` argument.		If Vault certificate has expired, add the `--insecure` argument.

			You can also create a $HOME/bin/vault-login helper script:

			<syntaxhighlight language="sh">
			#!/bin/sh

			touch $HOME/.vault-token
			chmod 600 $HOME/.vault-token
			ssh complector sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py \| tr -d '\n' > $HOME/.vault-token
			</syntaxhighlight>

	== Troubleshoot ==		== Troubleshoot ==

Wearg

Dereckson — Sat, 21 Mar 2026 09:48:02 GMT

MariaDB server connectivity

← Older revision		Revision as of 09:48, 21 March 2026
(One intermediate revision by the same user not shown)
Line 1:		Line 1:
	Wearg is an eggdrop and a notifications ~~clients~~.		Wearg is an eggdrop and a notifications client.

			== Features ==

	Services → [[Operations grimoire/Notifications center\|Notifications center]] → [[Operations grimoire/~~Broker~~\|broker]] → Wearg		Wearg handles two important workflows for the Nasqueron Operations SIG:

			* Publish notifications on IRC channels: Services --HTTPS--> [[Operations grimoire/Notifications center\|Notifications center]] --AMQP--> [[Operations grimoire/RabbitMQ\|broker]] --AMQP--> Wearg --IRC--> Channel publication
			* Allow to log to servers log: Channel publication --HTTPS--> Nasqueron API --IO--> servers log

	== Troubleshoot ==		== Troubleshoot ==
Line 17:		Line 21:
	# Ask next message in the queue .tcl mq get wearg-notifications		# Ask next message in the queue .tcl mq get wearg-notifications
	# If stuck at the previous operation, close the connection through the broker interface: http://white-rabbit.nasqueron.org:15672/#/connections (username is daeghrefn, source IP is 212.83.187.132). This method is pretty effective		# If stuck at the previous operation, close the connection through the broker interface: http://white-rabbit.nasqueron.org:15672/#/connections (username is daeghrefn, source IP is 212.83.187.132). This method is pretty effective

			=== Can't publish to servers log ===
			==== MariaDB server connectivity ====

			If the MariaDB connection is broken, <code>.+log [server] message works</code>, but not directly <code>[server] message</code>.

			* Short-term solution: <code>.tcl sqlrehash</code> in the Wearg partyline
			* Long-term solution: automate reconnect with {{T\|2282}}

Code conventions

Dereckson — Fri, 20 Mar 2026 01:47:16 GMT

Makefile

@@ Line 116: / Line 116: @@
 ;Templates
 * New command: [https://devcentral.nasqueron.org/source/snippets/browse/main/shell/script.sh shell/script.sh]
 == Makefile ==

Clean up

Dereckson — Fri, 20 Mar 2026 01:38:43 GMT

Tab to spaces

← Older revision		Revision as of 01:38, 20 March 2026
Line 21:		Line 21:
	=== Tab to spaces ===		=== Tab to spaces ===
	Git has a filter to be able to normalize with expand. See [https://eev.ee/blog/2016/06/04/converting-a-git-repo-from-tabs-to-spaces/ here].		Git has a filter to be able to normalize with expand. See [https://eev.ee/blog/2016/06/04/converting-a-git-repo-from-tabs-to-spaces/ here].

			As expand doesn't have a inline capability, you need to create a temporary file:

			tmp_file=$(mktemp -t spaces)
			expand -t 4 "$source_file" > "$tmp_file"
			mv "$tmp_file" "$source_file"

	=== Trailing spaces ===		=== Trailing spaces ===

WindRiver

Dereckson — Thu, 19 Mar 2026 22:23:05 GMT

@@ Line 2: / Line 2: @@
 It supersedes [[Ysul]].
 == Basic information ==
@@ Line 15: / Line 17: @@
 * '''Policy:''' Access for any Nasqueron project and for infrastructure operations task.
 * '''Started:''' 2019-11-21

User:Dereckson/Devserver

Dereckson — Thu, 19 Mar 2026 22:02:12 GMT

← Older revision		Revision as of 22:02, 19 March 2026
Line 85:		Line 85:

	Note: Zed currently not defined in wwwroot-51 in rOPS, should be done for /var/51-wwwroot/zed		Note: Zed currently not defined in wwwroot-51 in rOPS, should be done for /var/51-wwwroot/zed

			== IRC ==

			=== Troubleshoot ===
			==== Error loading module proxy/irc ====
			When trying to load proxy module, I got:

			22:00:09 -!- Irssi: Error loading module proxy/irc: /home/dereckson/.irssi/modules/libirc_proxy.so: Undefined symbol "g_input_add"

			Proxy is now compiled by default, personal module needs to be deleted.

Protocol CARP

Yousra — Wed, 18 Mar 2026 08:16:16 GMT

Peer

← Older revision		Revision as of 08:16, 18 March 2026
(2 intermediate revisions by the same user not shown)
Line 187:		Line 187:
	All hosts begin in BACKUP state.		All hosts begin in BACKUP state.

	2. Each host starts a timer		2. Each host starts a timer, a counter

	* The delay depends on the CARP priority.		* The delay depends on the CARP priority.
Line 264:		Line 264:

	In addition to that, using CARP in unicast mode can be appropriate in a two-router topology, as communication only needs to occur between 2 specific peers.		In addition to that, using CARP in unicast mode can be appropriate in a two-router topology, as communication only needs to occur between 2 specific peers.

			Above all IPsec (security added in a classic tunnel) protects unicast traffic, it does not protect (or protects very poorly) multicast traffic. So if we want CARP to be used with IPsec, peer is an excellent choice.

	Router-002 :		Router-002 :