leap_platform.git - [leap

Age	Commit message (Collapse)	Author
2017-01-17	Remove spec_helper	Tulio Casagrande

2017-01-17	Update how exec is run	Tulio Casagrande

2017-01-17	Add apache auto-restart extension file	Tulio Casagrande

2017-01-16	git subrepo clone --force https://leap.se/git/puppet_systemd ↵	varac
	puppet/modules/systemd subrepo: subdir: "puppet/modules/systemd" merged: "f3c4059" upstream: origin: "https://leap.se/git/puppet_systemd" branch: "master" commit: "f3c4059" git-subrepo: version: "0.3.0" origin: "https://github.com/ingydotnet/git-subrepo.git" commit: "841aa43"
2017-01-16	Revert "Add systemd::enable define"	varac
	This commit was moved to the systemd puppet repo. This reverts commit f5db49cf6b3ca0a5830b849c0aac074e371b95d9.
2016-12-31	Couchdb service should not require on soledad	varac
	- Resolves: #8693
2016-12-21	Merge branch 'bugfix/sans-soledad' into 'master'	Varac
	bugfix: couchdb nodes should not require soledad. closes #8693 See merge request !60
2016-12-20	[Vagrant] Install leap_cli gem dependencies	varac

2016-12-20	bugfix: couchdb nodes should not require soledad. closes #8693	elijah

2016-12-08	Lint site_config::files	varac

2016-10-24	Set X-XSS-Protection HTTP response header to '1'.	Micah Anderson
	This HTTP response header enables the Cross-site scripting (XSS) filter built into some modern web browsers. This header is usually enabled by default anyway, so the role of this header is to re-enable the filter if it was disabled maliciously, or by accident.
2016-10-24	Set X-Content-Type-Options nosniff.	Micah Anderson
	Setting this header will prevent the browser from interpreting files as something else than declared by the content type in the HTTP headers. This will prevent the browser from MIME-sniffing a response away from the declared content-type. When this is not set, older versions of Internet Explorer and Chrome perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type.
2016-10-20	Merge branch 'twisted_backports' into develop	varac

2016-10-18	Setup couch for soledad before starting soledad	varac
	When the soledad couch user is not present, soledad-server refuses to start, so we need to ensure that couch is setup correctly before starting soledad-server. see https://leap.se/code/issues/8535
2016-10-18	Lint site_couchdb::setup	varac

2016-10-18	[feat] Use twisted 16.2 from jessie-backports	varac
	New soledad packages now depend on Twisted 16.2.0 (see https://leap.se/code/issues/8412), so we need to pin twisted to get installed from jessie-backports. - Resolves: #8418
2016-10-18	lint site_mx class	varac

2016-09-13	[bugfix] static sites: only enable hidden service by default if one domain ↵	elijah
	is configured The problem is that we have a single onion address per server, so if more than one domain is configured we need to make sure they don't both try to use the same onion address.
2016-09-08	Merge branch 'clamd_dependencies' into develop	varac

2016-09-08	Merge branch 'ensure_clamav_running' into develop	varac

2016-09-08	start clamav after definitions are downloaded	Christoph Kluenter
	freshclam might not be able to start clamav via the socket because the socket might not be there. This systemd unit watches for the definitions and then starts clamav. Resolves: #8431
2016-09-08	Add systemd::enable define	varac

2016-09-07	Fix dependencies for clamd service	varac
	Sometimes, after a deploy from scratch `leap test` fails because clamd could not get started (even when the deploy log says so). This fixes the dependencies of all resources needed in order to let clamd start reliable. Resolves: #8431
2016-09-06	[feat] Add check_mk config values, dont set them	varac
	When setting values like ignored_services = [...] this will override other `ignored_services` that might get parsed before. Instead, we use `+=` so multiple files can add sth to this config value.
2016-09-05	[style] lint ::site_static class	varac

2016-09-01	added support for Let's Encrypt	elijah

2016-09-01	moved infrastructure tests run by `leap run` to tests/server-tests	elijah

2016-08-31	Merge remote-tracking branch 'varac/remove_soledad_procs_check' into develop	Micah Anderson

2016-08-31	[bug] Remove Nagios soledad procs check	varac
	leap_cli already checks for running procs - Resolves: #8380
2016-08-31	[style] lint soledad::server	varac

2016-08-31	Document site_check_mk::agent::soledad	varac

2016-08-30	lint site_webapp/manifests/init.pp	varac

2016-08-30	[feat] Use twisted 16.2 from jessie-backports	varac
	New soledad packages now depend on Twisted 16.2.0 (see https://leap.se/code/issues/8412), so we need to pin twisted to get installed from jessie-backports. - Resolves: #8418
2016-08-23	syslog: remove duplicate messages (#8405).	Micah
	Change-Id: I90f8d160d2293288066847bcc199f480d06d877d
2016-08-20	Fix rsyslog auth.log entries (#8381).	Micah
	The auth.log rsyslog entry was accidentally removed in #7863. Change-Id: I4ebffeafedbca5df902041ddd2bcb80d3f68b230
2016-08-20	ignore noisy 401 errors from soledad log.	Micah
	Change-Id: Ia1764cb28e263353856523c11f351a39774bf3b4
2016-08-08	Stricter VPN egress firewall (#8289)	Micah
	Change-Id: Ie09a6a34dfa8fe3d72568d2de0b208e7d947412f
2016-08-08	Disallow intra-client connectivity (#8272).	Micah
	If you connect to the VPN with a client, you can make direct network connections to the other connected clients. This allows communication to the eip gateways, but disallows any other connections. Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93
2016-08-05	Disallow intra-client connectivity (#8272).	Micah
	If you connect to the VPN with a client, you can make direct network connections to the other connected clients. This allows communication to the eip gateways, but disallows any other connections. Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93
2016-08-04	Remove site-apache symlink.	Micah
	There is no need to keep this symlink around any longer, it was there for older puppet. Change-Id: Ie7a380821d478e5ad69df39f03009d773afb73f3
2016-08-02	Set TCP_NODELAY option for couchdb (#8264)	Micah
	Mochiweb in couchdb by default sets the TCP socket option SO_NODELAY to false. This means that small data sent to the TCP socket, like the reply to a document write request (or reading a very small document), will not be sent immediately to the network - TCP will buffer it for a while hoping that it will be asked to send more data through the same socket and then send all the data at once for increased performance. Setting this increases the couchdb speed significantly. Change-Id: Ib493ef061ff62c9bdee501e44ce2b55990fe14b7
2016-07-21	fix site_static's call to passenger	elijah

2016-07-21	fix couchdb's backupninja	elijah

2016-07-21	git subrepo clone https://leap.se/git/puppet_openvpn puppet/modules/openvpn	elijah
	subrepo: subdir: "puppet/modules/openvpn" merged: "ba7ec7a" upstream: origin: "https://leap.se/git/puppet_openvpn" branch: "master" commit: "ba7ec7a" git-subrepo: version: "0.3.0" origin: "https://github.com/ingydotnet/git-subrepo" commit: "cb2995b"
2016-07-21	remove openvpn submodule	elijah

2016-07-19	Only use the 'main' repository for apt (#8253)	Micah
	Change-Id: If39222dc9ec68d1786c70c4b82b740e0a06773c4
2016-07-19	Block ip-based helo at MTA (#8139).	Micah
	Numeric helo is a very strong indicator of spam. When this is blocked, a very significant amount of spam stops. Change-Id: Ieb340190faf37638950d1aa60b52268659e0b7f6
2016-07-19	Block MTAs that claim they are 'localhost'.	Micah
	Nobody should be claiming that they are localhost when they are connecting over smtpd Change-Id: Ifb7df855b4e12021c58b89b2053e31fb10806096
2016-07-13	Newest passenger module dont manage munin by default	varac

2016-07-13	Notify Exec[shorewall_check] not Service[shorew..]	varac
	Latest shorewall module does `shorewall check` (executed by `Exec[shorewall_check]`) so every related resource change must notify this Exec instead of `Service[shorewall]` as before.