{%- from 'macros.jinja' import redis %}

include:
{%- if salt['grains.get']('include_secrets', True) %}
  - secrets.role.pagure
{%- endif %}
  - role.common.nginx

firewalld:
  enabled: true
  zones:
    internal:
      interfaces:
        - os-code
      services:
        - http
        - https

sshd_config:
  matches:
    git_user:
      type:
        User: git
      options:
        AuthorizedKeysCommand: /usr/lib/pagure/keyhelper.py "%u" "%h" "%t" "%f"
        AuthorizedKeysCommandUser: git
    proxy:
      type:
        Address:
          - 2a07:de40:b27e:1204::11  # atlas1
          - 2a07:de40:b27e:1204::12  # atlas2
      options:
        AllowUsers:
          - git

profile:
  pagure:
    database_user: pagure
    database_host: postgresql.infra.opensuse.org

{%- set listenhttps6='[::]:80' %}

nginx:
  servers:
    managed:
      code.opensuse.org.conf:
        config:
          - server:
              - server_name: code.opensuse.org
              - listen: '{{ listenhttps6 }}'
              - location @pagure:
                  - client_max_body_size: 0
                  - proxy_set_header: Host $http_host
                  - proxy_set_header: X-Real-IP $remote_addr
                  - proxy_set_header: X-Forwarded-For $proxy_add_x_forwarded_for
                  - proxy_set_header: X-Forwarded-Proto $scheme
                  - proxy_pass: http://unix:/srv/gitolite/.pagure_web.sock
              - location /:
                  - try_files: $uri @pagure
              - location /releases:
                  - alias: /srv/www/pagure-releases/
                  - autoindex: 'on'
        enabled: True
      releases.opensuse.org.conf:
        config:
          - server:
              - server_name: releases.opensuse.org
              - listen: '{{ listenhttps6 }}'
              - location /:
                  - alias: /srv/www/pagure-releases/
                  - autoindex: 'on'
        enabled: True
      ev.opensuse.org.conf:
        config:
          - server:
              - server_name: ev.opensuse.org
              - listen: '{{ listenhttps6 }}'
              - location @pagure_ev:
                  - proxy_set_header: Host $http_host
                  - proxy_set_header: X-Real-IP $remote_addr
                  - proxy_set_header: X-Forwarded-For $proxy_add_x_forwarded_for
                  - proxy_set_header: X-Forwarded-Proto $scheme
                  - proxy_pass: http://localhost:8080
              - location /:
                  - try_files: $uri @pagure_ev
        enabled: True
      pages.opensuse.org.conf:
        config:
          - server:
              - server_name: pages.opensuse.org
              - listen: '{{ listenhttps6 }}'
              - location @pagure_docs:
                  - proxy_set_header: Host $http_host
                  - proxy_set_header: X-Real-IP $remote_addr
                  - proxy_set_header: X-Forwarded-For $proxy_add_x_forwarded_for
                  - proxy_set_header: X-Forwarded-Proto $scheme
                  - proxy_pass: http://unix:/srv/gitolite/.pagure_docs_web.sock
              - location /:
                  - try_files: $uri @pagure_docs
        enabled: True

{{ redis('pagure') }}

groups:
  redis:
    members:
      - git

zypper:
  repositories:
    openSUSE:infrastructure:pagure:
      baseurl: http://download-prg.infra.opensuse.org/repositories/openSUSE:/infrastructure:/pagure/$releasever/
      priority: 100
      refresh: True