Migrate all the infra to the tails.net namespace

Assumptions

  • We'll eventually migrate all Tails infra to use tails.net
  • We'll eventually get rid of tails.boum.org (modulo redirections, to avoid link rot)
  • We'll not migrate everything at once, so steps should be incremental

Migration steps

Postponed

These items need to be coordinated in the context of the the merge with TPA. See more info on: sysadmin-private.git:meetings/2024-09-23.md

Node migration steps
  1. Add a DNS entry for the host in the tails.net zone
  2. Replace all entries in Puppet: 
    set HOSTNAME skink
git grep -l $HOSTNAME.tails.boum.org | xargs -l sed -i -e "s/$HOSTNAME.tails.boum.org/$HOSTNAME.tails.net/"
for i in yaml eyaml;
  find hieradata/node/ \
    -regex "hieradata/node/$HOSTNAME.tails.boum.org.$i" \
    -exec git mv '{}' "hieradata/node/$HOSTNAME.tails.net.$i" \; ;
end
  3. Commit and push the changes: 
    git commit -a -m "Move $HOSTNAME to the tails.net domain" -m "refs sysadmin#17987"
git push
  4. Change the machine hostname: 
    set HOSTNAME (hostname)
sudo sed -i -e "s/$HOSTNAME.tails.boum.org/$HOSTNAME.tails.net/" /etc/hosts /etc/puppet/puppet.conf
sudo find /var/lib/puppet/ssl -type f -delete
  5. In the Puppet Master node: 
    set HOSTNAME skink
sudo puppetserver ca clean --certname $HOSTNAME.tails.boum.org
sudo puppet node deactivate $HOSTNAME.tails.boum.org
  6. In the node: 
    sudo puppet agent -t --waitforcert 5
  7. In the Puppet Master: 
    sudo puppetserver ca list
# Check the fingerprint!
sudo puppetserver ca sign --certname $HOSTNAME.tails.net
  8. Wait for the Puppet run to finish to make sure the node exports any exported .resources it declares
  9. In lizard, run Puppet for the VPN entrypoints and the monitoring node: 
    for i in iguana ecours lizard; ssh $i.tails.boum.org sudo systemctl restart puppet-run; end
  10. Force the node's icinga2 to use the new hostname and delete the old certificate: 
    sudo systemctl restart icinga2
sudo rm /var/lib/icinga2/certs/(hostname).tails.boum.org.{crt,key}
  11. Sign the node's Icinga2 certificate in ecours: 
    # List the pending certificates and get the fingerprint...
sudo icinga2 ca list
# ...then sign
sudo icinga2 ca sign $FINGERPRINT
  12. Move the entries in sysadmin-private.git:systems to the new hostname
  13. Reboot the node and make sure Puppet works: 
    sudo shutdown -r now
# Do the Dropbear dance
sudo puppet agent -t

Tracked separately

Edited by Zen Fu