From de0882bd7ed919099c7713ce93d19953887741ce Mon Sep 17 00:00:00 2001 From: RobHooper Date: Thu, 30 Jul 2026 10:50:53 +0100 Subject: [PATCH 01/10] refactor: remove ubuntu 20.04 --- salt/apache/init.sls | 15 -------------- salt/core/firewall/files/firewall_reset.sh | 4 ++-- salt/core/sshd/files/customization.conf | 5 +++++ salt/core/sshd/init.sls | 24 ---------------------- salt/core/systemd/ntp.sls | 5 ----- 5 files changed, 7 insertions(+), 46 deletions(-) diff --git a/salt/apache/init.sls b/salt/apache/init.sls index f084344c..456e5ba5 100644 --- a/salt/apache/init.sls +++ b/salt/apache/init.sls @@ -8,25 +8,10 @@ {{ unset_firewall('PUBLIC_HTTPS') }} {% endif %} -# ondrej/apache2 is still needed on Ubuntu 20.04 for MDContactEmail. -# https://github.com/icing/mod_md/issues/203 apache2: - {% if grains.osmajorrelease in ('18', '20') %} - pkgrepo.managed: - - ppa: ondrej/apache2 - {% endif %} pkg.installed: - pkgs: - apache2 - {% if grains.osmajorrelease in ('18', '20') %} - # Avoid "AH01882: Init: this version of mod_ssl was compiled against a newer library (OpenSSL 1.1.1g 21 Apr 2020, - # version currently loaded is OpenSSL 1.1.1 11 Sep 2018) - may result in undefined or erroneous behavior" - # https://github.com/open-contracting/deploy/issues/66#issuecomment-742898193 - - libssl1.1 - - openssl - - require: - - pkgrepo: apache2 - {% endif %} service.running: - name: apache2 - enable: True diff --git a/salt/core/firewall/files/firewall_reset.sh b/salt/core/firewall/files/firewall_reset.sh index ca1cfb04..d0fa6821 100644 --- a/salt/core/firewall/files/firewall_reset.sh +++ b/salt/core/firewall/files/firewall_reset.sh @@ -34,11 +34,11 @@ fi echo_verbose "Get iptables location" case "${ID}_${VERSION_ID}" in -ubuntu_22.04 | ubuntu_20.04 | ubuntu_18.04 | debian_10 | debian_9 | debian_8) +ubuntu_26.04 | ubuntu_24.04 | ubuntu_22.04 | debian_13 | debian_12 ) IPTABLESSAVLOC=/etc/iptables/rules.v4 IP6TABLESSAVLOC=/etc/iptables/rules.v6 ;; -centos_7 | redhat-derivative_) +redhat-derivative_) IPTABLESSAVLOC=/etc/sysconfig/iptables IP6TABLESSAVLOC=/etc/sysconfig/ip6tables ;; diff --git a/salt/core/sshd/files/customization.conf b/salt/core/sshd/files/customization.conf index 526b487f..01529421 100644 --- a/salt/core/sshd/files/customization.conf +++ b/salt/core/sshd/files/customization.conf @@ -1,3 +1,8 @@ +# We set both PermitRootLogin and PasswordAuthentication for two reasons: +# +# - PermitRootLogin adds a layer of security in case PasswordAuthentication is toggled on. +# - While PermitRootLogin is set to "no" or "without-password", we can monitor it with our intrusion detection software. + PasswordAuthentication no PermitRootLogin without-password X11Forwarding no diff --git a/salt/core/sshd/init.sls b/salt/core/sshd/init.sls index face34a3..3df1ccfc 100644 --- a/salt/core/sshd/init.sls +++ b/salt/core/sshd/init.sls @@ -1,34 +1,10 @@ # We'll only be using SSH key authentication. -{% if grains['osrelease'] >= '20.04' %} /etc/ssh/sshd_config.d/customization.conf: file.managed: - source: salt://core/sshd/files/customization.conf - watch_in: - service: ssh_service -{% else %} -# We set both PermitRootLogin and PasswordAuthentication for two reasons: -# -# - PermitRootLogin adds a layer of security in case PasswordAuthentication is toggled on. -# - While PermitRootLogin is set to "no" or "without-password", we can monitor it with our intrusion detection software. -harden ssh configuration: - file.keyvalue: - - name: /etc/ssh/sshd_config - - key_values: - # Disable password authentication. - PasswordAuthentication: 'no' - # Force root logins with SSH keys. - PermitRootLogin: without-password - # Disable X11 forwarding. - X11Forwarding: 'no' - - separator: ' ' - - uncomment: '# ' - - key_ignore_case: True - - append_if_not_found: True - - watch_in: - - service: ssh_service -{% endif %} - # Restart the SSH service if the config changes. ssh_service: service.running: diff --git a/salt/core/systemd/ntp.sls b/salt/core/systemd/ntp.sls index 8b4ab9c7..00c968f3 100644 --- a/salt/core/systemd/ntp.sls +++ b/salt/core/systemd/ntp.sls @@ -1,17 +1,12 @@ # Configure an SNTP service. systemd-timesyncd: - {% if grains['osrelease'] >= '20.04' %} - # timesyncd is built into systemd on older Ubuntu releases. pkg.installed: - name: systemd-timesyncd - {% endif %} service.running: - name: systemd-timesyncd - enable: True - {% if grains['osrelease'] >= '20.04' %} - require: - pkg: systemd-timesyncd - {% endif %} /etc/systemd/timesyncd.conf.d/customization.conf: file.managed: From 3ea5d03f0abdd67f38358e12fb1bf73c8797c818 Mon Sep 17 00:00:00 2001 From: RobHooper Date: Mon, 3 Aug 2026 15:36:48 +0100 Subject: [PATCH 02/10] feat: Update default MySQL version --- salt/mysql/init.sls | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/mysql/init.sls b/salt/mysql/init.sls index 9af6de97..d58511e8 100644 --- a/salt/mysql/init.sls +++ b/salt/mysql/init.sls @@ -1,4 +1,4 @@ -{% set mysql_version = pillar.mysql.version|default('8.0')|quote %} +{% set mysql_version = pillar.mysql.version|default('8.4')|quote %} # https://docs.saltproject.io/en/latest/ref/states/all/salt.states.mysql_database.html mysql dependencies: From 750d09b651842feee060e668ed996305fa0a744d Mon Sep 17 00:00:00 2001 From: RobHooper Date: Mon, 3 Aug 2026 15:43:17 +0100 Subject: [PATCH 03/10] feat: Update default PHP version --- salt/php-fpm/init.sls | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/php-fpm/init.sls b/salt/php-fpm/init.sls index 8acfe17f..c685ae31 100644 --- a/salt/php-fpm/init.sls +++ b/salt/php-fpm/init.sls @@ -1,4 +1,4 @@ -{% set php_version = pillar.php.version|default('8.1')|quote %} +{% set php_version = pillar.php.version|default('8.5')|quote %} include: - apache.modules.proxy_fcgi From 002aaa0da2630f5dc8bbc246a84aa63a9978dfa5 Mon Sep 17 00:00:00 2001 From: RobHooper Date: Mon, 3 Aug 2026 15:47:08 +0100 Subject: [PATCH 04/10] refactor: remove legacy apt repo configuration --- salt/docker/init.sls | 4 ---- salt/postgres/init.sls | 4 ---- 2 files changed, 8 deletions(-) diff --git a/salt/docker/init.sls b/salt/docker/init.sls index f67bc075..7e9cb9bb 100644 --- a/salt/docker/init.sls +++ b/salt/docker/init.sls @@ -4,12 +4,8 @@ docker: pkgrepo.managed: - humanname: Docker Official Repository - {% if grains.osmajorrelease|string in ('18', '20') %} - - name: deb [arch={{ grains.osarch }}] https://download.docker.com/{{ grains.kernel|lower }}/{{ grains.os|lower }} {{ grains.oscodename }} stable - {% else %} - name: deb [arch={{ grains.osarch }} signed-by=/usr/share/keyrings/docker-keyring.gpg] https://download.docker.com/{{ grains.kernel|lower }}/{{ grains.os|lower }} {{ grains.oscodename }} stable - aptkey: False - {% endif %} - dist: {{ grains.oscodename }} - file: /etc/apt/sources.list.d/docker.list - key_url: https://download.docker.com/{{ grains.kernel|lower }}/{{ grains.os|lower }}/gpg diff --git a/salt/postgres/init.sls b/salt/postgres/init.sls index 28274cec..4b92e130 100644 --- a/salt/postgres/init.sls +++ b/salt/postgres/init.sls @@ -79,12 +79,8 @@ pgbadger: postgresql: pkgrepo.managed: - humanname: PostgreSQL Official Repository - {% if grains.osmajorrelease|string in ('18', '20') %} - - name: deb https://apt.postgresql.org/pub/repos/apt {{ grains.oscodename }}-pgdg main - {% else %} - name: deb [signed-by=/usr/share/keyrings/postgresql-keyring.gpg] https://apt.postgresql.org/pub/repos/apt {{ grains.oscodename }}-pgdg main - aptkey: False - {% endif %} - dist: {{ grains.oscodename }}-pgdg - file: /etc/apt/sources.list.d/psql.list - key_url: https://www.postgresql.org/media/keys/ACCC4CF8.asc From 36ee7b82b9671e07a258eddf55bdcf5747bee344 Mon Sep 17 00:00:00 2001 From: RobHooper Date: Tue, 4 Aug 2026 10:43:00 +0100 Subject: [PATCH 05/10] chore: fix linting --- salt/core/firewall/files/firewall_reset.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/core/firewall/files/firewall_reset.sh b/salt/core/firewall/files/firewall_reset.sh index d0fa6821..a3e56bdc 100644 --- a/salt/core/firewall/files/firewall_reset.sh +++ b/salt/core/firewall/files/firewall_reset.sh @@ -34,7 +34,7 @@ fi echo_verbose "Get iptables location" case "${ID}_${VERSION_ID}" in -ubuntu_26.04 | ubuntu_24.04 | ubuntu_22.04 | debian_13 | debian_12 ) +ubuntu_26.04 | ubuntu_24.04 | ubuntu_22.04 | debian_13 | debian_12) IPTABLESSAVLOC=/etc/iptables/rules.v4 IP6TABLESSAVLOC=/etc/iptables/rules.v6 ;; From 044886dcd5df605eb4039f663035c03882e80df8 Mon Sep 17 00:00:00 2001 From: RobHooper Date: Tue, 4 Aug 2026 14:06:08 +0100 Subject: [PATCH 06/10] docs: New Linode interface --- docs/deploy/create_server.rst | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/deploy/create_server.rst b/docs/deploy/create_server.rst index e97d26cf..dfe3ad2a 100644 --- a/docs/deploy/create_server.rst +++ b/docs/deploy/create_server.rst @@ -34,6 +34,10 @@ Create the server via the :ref:`host`'s interface. #. Set *Linode Label* to the server's FQDN (e.g. ``ocp99.open-contracting.org``) #. Set *Add Tags* to either *Production* or *Development* #. Set *Root Password* to a `strong password `__, and save it to OCP's `LastPass `__ account + #. Set *Public Interface Firewall* to *No firewall*, unless the server uses Docker. + + #. If using Docker, select *Create Firewall* and :ref:`configure an external firewall starting at step 3`. + #. Check *Backups* #. Click *Create Linode* and wait a few minutes for the server to power on @@ -58,11 +62,11 @@ Create the server via the :ref:`host`'s interface. #. Rename the "Swap Image" disk to "### MB Swap Image" - #. On the *Configurations* tab: + #. On the *Network* tab: - #. Click *Edit* for the "My Ubuntu ##.04 LTS Disk Profile" (or similar) configuration - #. Uncheck *Auto-configure networking* (skip if configuring a non-OCP server) - #. Click *Save Changes* + #. Click *Interface Settings* + #. Uncheck *Enable Network Helper* (skip if configuring a non-OCP server) + #. Click *Save* #. Click *Power On* #. Copy *SSH Access* to your clipboard @@ -79,8 +83,6 @@ Create the server via the :ref:`host`'s interface. Linode can take a day to close the ticket. In the meantime, proceed with the instructions below. Once the ticket is closed, assign a specific address within the /64 block in the :doc:`network configuration<../develop/update/network>`. - #. If using Docker, :ref:`configure an external firewall`. - .. tab-item:: Hetzner Cloud :sync: hetzner-cloud From 79c2b97914216a4ad8e0bcb46ea59ba28771cfe9 Mon Sep 17 00:00:00 2001 From: RobHooper Date: Tue, 4 Aug 2026 16:35:11 +0100 Subject: [PATCH 07/10] feat: update locale on new servers --- pillar/common.sls | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pillar/common.sls b/pillar/common.sls index 4f138a2a..4713950a 100644 --- a/pillar/common.sls +++ b/pillar/common.sls @@ -23,7 +23,11 @@ ssh: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDG8dhMVvgH/tt9+VoyokyUg/iKVcZKMku8pYN6o8RoT8XKoyP/iyrUIl5HxolqIt+PJTpomYkA40eJ/0mN4/kRhr+tctZ+tUdo8/G8H42FG3McklL6XlwOdXRGIYC+NynF8YGws57J8YkM2oL9linkUZYpGpVkNew2aEg916HWWfGZktwuQa7knIwIhFr9FlvxxaZhdcQ7VJjnJOP0fLLr5WCVaiWDGjQ5cHJURcTBL+j+eTRpKFvk9BMKCAQyLkSEluT0QeESDMtR7sRHA54to1LDXRX0ky9cAQ6mxXWgpSpmHCuPVYpzOfoSd7b8aczDLUGBxq9EWOTS3UMUWJBX Yohanna (OCP) # The default locale is en_GB rather than en_US for accidental, historical reasons. +{% if grains.osmajorrelease|int >= 26 %} +locale: en_US +{% else %} locale: en_GB +{% endif %} ntp: - 0.uk.pool.ntp.org From 9f39f95a6b1803eabc76f01cad798589a98569ce Mon Sep 17 00:00:00 2001 From: RobHooper Date: Tue, 4 Aug 2026 16:36:45 +0100 Subject: [PATCH 08/10] refactor(firewall.sh): remove ubuntu 20.04 --- salt/core/firewall/files/firewall.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/core/firewall/files/firewall.sh b/salt/core/firewall/files/firewall.sh index 0ba2db5a..0fb836de 100644 --- a/salt/core/firewall/files/firewall.sh +++ b/salt/core/firewall/files/firewall.sh @@ -61,11 +61,11 @@ fi echo_verbose "Get iptables location" case "${ID}_${VERSION_ID}" in -ubuntu_24.04 | ubuntu_22.04 | ubuntu_20.04 | ubuntu_18.04 | debian_10 | debian_9 | debian_8) +ubuntu_26.04 | ubuntu_24.04 | ubuntu_22.04 | debian_13 | debian_12) IPTABLESSAVLOC=/etc/iptables/rules.v4 IP6TABLESSAVLOC=/etc/iptables/rules.v6 ;; -centos_7 | redhat-derivative_) +redhat-derivative_) IPTABLESSAVLOC=/etc/sysconfig/iptables IP6TABLESSAVLOC=/etc/sysconfig/ip6tables ;; From 7942ba1ed7de848f07ec61fed17273db0d38dad1 Mon Sep 17 00:00:00 2001 From: RobHooper Date: Tue, 4 Aug 2026 16:39:44 +0100 Subject: [PATCH 09/10] feat: add chrony support for Ubuntu 26+ --- salt/core/ntp/files/ntp-pools.sources | 3 +++ .../{systemd => ntp}/files/timesyncd.conf | 0 salt/core/{systemd/ntp.sls => ntp/init.sls} | 27 ++++++++++++++++++- salt/top.sls | 2 +- 4 files changed, 30 insertions(+), 2 deletions(-) create mode 100644 salt/core/ntp/files/ntp-pools.sources rename salt/core/{systemd => ntp}/files/timesyncd.conf (100%) rename salt/core/{systemd/ntp.sls => ntp/init.sls} (50%) diff --git a/salt/core/ntp/files/ntp-pools.sources b/salt/core/ntp/files/ntp-pools.sources new file mode 100644 index 00000000..661d6b40 --- /dev/null +++ b/salt/core/ntp/files/ntp-pools.sources @@ -0,0 +1,3 @@ +{% for source in pillar.ntp %} +pool {{ source }} iburst maxsources 4 +{% endfor %} diff --git a/salt/core/systemd/files/timesyncd.conf b/salt/core/ntp/files/timesyncd.conf similarity index 100% rename from salt/core/systemd/files/timesyncd.conf rename to salt/core/ntp/files/timesyncd.conf diff --git a/salt/core/systemd/ntp.sls b/salt/core/ntp/init.sls similarity index 50% rename from salt/core/systemd/ntp.sls rename to salt/core/ntp/init.sls index 00c968f3..969cdd83 100644 --- a/salt/core/systemd/ntp.sls +++ b/salt/core/ntp/init.sls @@ -1,4 +1,28 @@ # Configure an SNTP service. +{% if grains.osmajorrelease|int >= 26 %} +chrony: + service.running: + - name: chrony + +chrony-reload: + cmd.wait: + - name: chronyc reload sources + +/etc/chrony/sources.d/ntp-pools.sources: + file.managed: + - source: salt://core/ntp/files/ntp-pools.sources + - template: jinja + - watch_in: + - cmd: chrony-reload + +/etc/chrony/sources.d/ubuntu-ntp-pools.sources: + file.comment: + - regex: "^pool " + - backup: False + - watch_in: + - cmd: chrony-reload + +{% else %} systemd-timesyncd: pkg.installed: - name: systemd-timesyncd @@ -10,7 +34,7 @@ systemd-timesyncd: /etc/systemd/timesyncd.conf.d/customization.conf: file.managed: - - source: salt://core/systemd/files/timesyncd.conf + - source: salt://core/ntp/files/timesyncd.conf - template: jinja - makedirs: True - watch_in: @@ -22,6 +46,7 @@ systemd-timesyncd: - backup: False - watch_in: - service: systemd-timesyncd +{% endif %} set timezone to utc: timezone.system: diff --git a/salt/top.sls b/salt/top.sls index bcd1f424..a9a1b57a 100644 --- a/salt/top.sls +++ b/salt/top.sls @@ -13,13 +13,13 @@ base: - core.mail - core.motd - core.network + - core.ntp - core.reboot - core.rsyslog - core.sshd - core.swap - core.sysctl - core.systemd.logind - - core.systemd.ntp 'cms': - cms From 764fae617dd930a75003dcb05f3e50e0318179a5 Mon Sep 17 00:00:00 2001 From: RobHooper Date: Tue, 4 Aug 2026 17:14:20 +0100 Subject: [PATCH 10/10] chore: remove legacy comment --- salt/core/apt/init.sls | 1 - 1 file changed, 1 deletion(-) diff --git a/salt/core/apt/init.sls b/salt/core/apt/init.sls index fd45dd15..dd736290 100644 --- a/salt/core/apt/init.sls +++ b/salt/core/apt/init.sls @@ -12,7 +12,6 @@ needrestart: pkg.removed: - name: needrestart -# https://www.phusionpassenger.com/library/install/apache/install/oss/bionic/ # gnupg depends on dirmngr. gnupg2 is a dummy package for gnupg. secure ppa: pkg.installed: