open-contracting · RobHooper · Jul 30, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
diff --git a/docs/deploy/create_server.rst b/docs/deploy/create_server.rst
@@ -34,6 +34,10 @@ Create the server via the :ref:`host<hosting>`'s interface.
          #. Set *Linode Label* to the server's FQDN (e.g. ``ocp99.open-contracting.org``)
          #. Set *Add Tags* to either *Production* or *Development*
          #. Set *Root Password* to a `strong password <https://www.lastpass.com/features/password-generator>`__, and save it to OCP's `LastPass <https://www.lastpass.com>`__ account
+         #. Set *Public Interface Firewall* to *No firewall*, unless the server uses Docker.
+
+            #.  If using Docker, select *Create Firewall* and :ref:`configure an external firewall starting at step 3<docker-firewall>`.
+
          #. Check *Backups*
          #. Click *Create Linode* and wait a few minutes for the server to power on
 
@@ -58,11 +62,11 @@ Create the server via the :ref:`host<hosting>`'s interface.
 
             #. Rename the "Swap Image" disk to "### MB Swap Image"
 
-         #. On the *Configurations* tab:
+         #. On the *Network* tab:
 
-            #. Click *Edit* for the "My Ubuntu ##.04 LTS Disk Profile" (or similar) configuration
-            #. Uncheck *Auto-configure networking* (skip if configuring a non-OCP server)
-            #. Click *Save Changes*
+            #. Click *Interface Settings*
+            #. Uncheck *Enable Network Helper* (skip if configuring a non-OCP server)
+            #. Click *Save*
 
          #. Click *Power On*
          #. Copy *SSH Access* to your clipboard
@@ -79,8 +83,6 @@ Create the server via the :ref:`host<hosting>`'s interface.
 
             Linode can take a day to close the ticket. In the meantime, proceed with the instructions below. Once the ticket is closed, assign a specific address within the /64 block in the :doc:`network configuration<../develop/update/network>`.
 
-      #. If using Docker, :ref:`configure an external firewall<docker-firewall>`.
-
    .. tab-item:: Hetzner Cloud
       :sync: hetzner-cloud
 

diff --git a/pillar/common.sls b/pillar/common.sls
@@ -23,7 +23,11 @@ ssh:
     - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDG8dhMVvgH/tt9+VoyokyUg/iKVcZKMku8pYN6o8RoT8XKoyP/iyrUIl5HxolqIt+PJTpomYkA40eJ/0mN4/kRhr+tctZ+tUdo8/G8H42FG3McklL6XlwOdXRGIYC+NynF8YGws57J8YkM2oL9linkUZYpGpVkNew2aEg916HWWfGZktwuQa7knIwIhFr9FlvxxaZhdcQ7VJjnJOP0fLLr5WCVaiWDGjQ5cHJURcTBL+j+eTRpKFvk9BMKCAQyLkSEluT0QeESDMtR7sRHA54to1LDXRX0ky9cAQ6mxXWgpSpmHCuPVYpzOfoSd7b8aczDLUGBxq9EWOTS3UMUWJBX Yohanna (OCP)
 
 # The default locale is en_GB rather than en_US for accidental, historical reasons.
+{% if grains.osmajorrelease|int >= 26 %}
+locale: en_US
+{% else %}
 locale: en_GB
+{% endif %}
 
 ntp:
   - 0.uk.pool.ntp.org

diff --git a/salt/apache/init.sls b/salt/apache/init.sls
@@ -8,25 +8,10 @@
   {{ unset_firewall('PUBLIC_HTTPS') }}
 {% endif %}
 
-# ondrej/apache2 is still needed on Ubuntu 20.04 for MDContactEmail.
-# https://github.com/icing/mod_md/issues/203
 apache2:
-  {% if grains.osmajorrelease in ('18', '20') %}
-  pkgrepo.managed:
-    - ppa: ondrej/apache2
-  {% endif %}
   pkg.installed:
     - pkgs:
       - apache2
-    {% if grains.osmajorrelease in ('18', '20') %}
-      # Avoid "AH01882: Init: this version of mod_ssl was compiled against a newer library (OpenSSL 1.1.1g 21 Apr 2020,
-      # version currently loaded is OpenSSL 1.1.1 11 Sep 2018) - may result in undefined or erroneous behavior"
-      # https://github.com/open-contracting/deploy/issues/66#issuecomment-742898193
-      - libssl1.1
-      - openssl
-    - require:
-      - pkgrepo: apache2
-    {% endif %}
   service.running:
     - name: apache2
     - enable: True

diff --git a/salt/core/apt/init.sls b/salt/core/apt/init.sls
@@ -12,7 +12,6 @@ needrestart:
   pkg.removed:
     - name: needrestart
 
-# https://www.phusionpassenger.com/library/install/apache/install/oss/bionic/
 # gnupg depends on dirmngr. gnupg2 is a dummy package for gnupg.
 secure ppa:
   pkg.installed:

diff --git a/salt/core/firewall/files/firewall.sh b/salt/core/firewall/files/firewall.sh
@@ -61,11 +61,11 @@ fi
 
 echo_verbose "Get iptables location"
 case "${ID}_${VERSION_ID}" in
-ubuntu_24.04 | ubuntu_22.04 | ubuntu_20.04 | ubuntu_18.04 | debian_10 | debian_9 | debian_8)
+ubuntu_26.04 | ubuntu_24.04 | ubuntu_22.04 | debian_13 | debian_12)
     IPTABLESSAVLOC=/etc/iptables/rules.v4
     IP6TABLESSAVLOC=/etc/iptables/rules.v6
     ;;
-centos_7 | redhat-derivative_)
+redhat-derivative_)
     IPTABLESSAVLOC=/etc/sysconfig/iptables
     IP6TABLESSAVLOC=/etc/sysconfig/ip6tables
     ;;

diff --git a/salt/core/firewall/files/firewall_reset.sh b/salt/core/firewall/files/firewall_reset.sh
@@ -34,11 +34,11 @@ fi
 
 echo_verbose "Get iptables location"
 case "${ID}_${VERSION_ID}" in
-ubuntu_22.04 | ubuntu_20.04 | ubuntu_18.04 | debian_10 | debian_9 | debian_8)
+ubuntu_26.04 | ubuntu_24.04 | ubuntu_22.04 | debian_13 | debian_12)
     IPTABLESSAVLOC=/etc/iptables/rules.v4
     IP6TABLESSAVLOC=/etc/iptables/rules.v6
     ;;
-centos_7 | redhat-derivative_)
+redhat-derivative_)
     IPTABLESSAVLOC=/etc/sysconfig/iptables
     IP6TABLESSAVLOC=/etc/sysconfig/ip6tables
     ;;

diff --git a/salt/core/ntp/files/ntp-pools.sources b/salt/core/ntp/files/ntp-pools.sources
@@ -0,0 +1,3 @@
+{% for source in pillar.ntp %}
+pool {{ source }}  iburst maxsources 4
+{% endfor %}
diff --git a/salt/core/systemd/files/timesyncd.conf → salt/core/ntp/files/timesyncd.conf b/salt/core/systemd/files/timesyncd.conf → salt/core/ntp/files/timesyncd.conf
diff --git a/salt/core/systemd/ntp.sls → salt/core/ntp/init.sls b/salt/core/systemd/ntp.sls → salt/core/ntp/init.sls
@@ -1,21 +1,40 @@
 # Configure an SNTP service.
+{% if grains.osmajorrelease|int >= 26 %}
+chrony:
+  service.running:
+    - name: chrony
+
+chrony-reload:
+  cmd.wait:
+    - name: chronyc reload sources
+
+/etc/chrony/sources.d/ntp-pools.sources:
+  file.managed:
+    - source: salt://core/ntp/files/ntp-pools.sources
+    - template: jinja
+    - watch_in:
+      - cmd: chrony-reload
+
+/etc/chrony/sources.d/ubuntu-ntp-pools.sources:
+  file.comment:
+    - regex: "^pool "
+    - backup: False
+    - watch_in:
+      - cmd: chrony-reload
+
+{% else %}
 systemd-timesyncd:
-  {% if grains['osrelease'] >= '20.04' %}
-  # timesyncd is built into systemd on older Ubuntu releases.
   pkg.installed:
     - name: systemd-timesyncd
-  {% endif %}
   service.running:
     - name: systemd-timesyncd
     - enable: True
-    {% if grains['osrelease'] >= '20.04' %}
     - require:
       - pkg: systemd-timesyncd
-    {% endif %}
 
 /etc/systemd/timesyncd.conf.d/customization.conf:
   file.managed:
-    - source: salt://core/systemd/files/timesyncd.conf
+    - source: salt://core/ntp/files/timesyncd.conf
     - template: jinja
     - makedirs: True
     - watch_in:
@@ -27,6 +46,7 @@ systemd-timesyncd:
     - backup: False
     - watch_in:
       - service: systemd-timesyncd
+{% endif %}
 
 set timezone to utc:
   timezone.system:

diff --git a/salt/core/sshd/files/customization.conf b/salt/core/sshd/files/customization.conf
@@ -1,3 +1,8 @@
+# We set both PermitRootLogin and PasswordAuthentication for two reasons:
+#
+# - PermitRootLogin adds a layer of security in case PasswordAuthentication is toggled on.
+# - While PermitRootLogin is set to "no" or "without-password", we can monitor it with our intrusion detection software.
+
 PasswordAuthentication no
 PermitRootLogin without-password
 X11Forwarding no
diff --git a/salt/core/sshd/init.sls b/salt/core/sshd/init.sls
@@ -1,34 +1,10 @@
 # We'll only be using SSH key authentication.
-{% if grains['osrelease'] >= '20.04' %}
 /etc/ssh/sshd_config.d/customization.conf:
   file.managed:
     - source: salt://core/sshd/files/customization.conf
     - watch_in:
       - service: ssh_service
 
-{% else %}
-# We set both PermitRootLogin and PasswordAuthentication for two reasons:
-#
-# - PermitRootLogin adds a layer of security in case PasswordAuthentication is toggled on.
-# - While PermitRootLogin is set to "no" or "without-password", we can monitor it with our intrusion detection software.
-harden ssh configuration:
-  file.keyvalue:
-    - name: /etc/ssh/sshd_config
-    - key_values:
-        # Disable password authentication.
-        PasswordAuthentication: 'no'
-        # Force root logins with SSH keys.
-        PermitRootLogin: without-password
-        # Disable X11 forwarding.
-        X11Forwarding: 'no'
-    - separator: ' '
-    - uncomment: '# '
-    - key_ignore_case: True
-    - append_if_not_found: True
-    - watch_in:
-      - service: ssh_service
-{% endif %}
-
 # Restart the SSH service if the config changes.
 ssh_service:
   service.running:

diff --git a/salt/docker/init.sls b/salt/docker/init.sls
@@ -4,12 +4,8 @@
 docker:
   pkgrepo.managed:
     - humanname: Docker Official Repository
-    {% if grains.osmajorrelease|string in ('18', '20') %}
-    - name: deb [arch={{ grains.osarch }}] https://download.docker.com/{{ grains.kernel|lower }}/{{ grains.os|lower }} {{ grains.oscodename }} stable
-    {% else %}
     - name: deb [arch={{ grains.osarch }} signed-by=/usr/share/keyrings/docker-keyring.gpg] https://download.docker.com/{{ grains.kernel|lower }}/{{ grains.os|lower }} {{ grains.oscodename }} stable
     - aptkey: False
-    {% endif %}
     - dist: {{ grains.oscodename }}
     - file: /etc/apt/sources.list.d/docker.list
     - key_url: https://download.docker.com/{{ grains.kernel|lower }}/{{ grains.os|lower }}/gpg

diff --git a/salt/mysql/init.sls b/salt/mysql/init.sls
@@ -1,4 +1,4 @@
-{% set mysql_version = pillar.mysql.version|default('8.0')|quote %}
+{% set mysql_version = pillar.mysql.version|default('8.4')|quote %}
 
 # https://docs.saltproject.io/en/latest/ref/states/all/salt.states.mysql_database.html
 mysql dependencies:

diff --git a/salt/php-fpm/init.sls b/salt/php-fpm/init.sls
@@ -1,4 +1,4 @@
-{% set php_version = pillar.php.version|default('8.1')|quote %}
+{% set php_version = pillar.php.version|default('8.5')|quote %}
 
 include:
   - apache.modules.proxy_fcgi

diff --git a/salt/postgres/init.sls b/salt/postgres/init.sls
@@ -79,12 +79,8 @@ pgbadger:
 postgresql:
   pkgrepo.managed:
     - humanname: PostgreSQL Official Repository
-    {% if grains.osmajorrelease|string in ('18', '20') %}
-    - name: deb https://apt.postgresql.org/pub/repos/apt {{ grains.oscodename }}-pgdg main
-    {% else %}
     - name: deb [signed-by=/usr/share/keyrings/postgresql-keyring.gpg] https://apt.postgresql.org/pub/repos/apt {{ grains.oscodename }}-pgdg main
     - aptkey: False
-    {% endif %}
     - dist: {{ grains.oscodename }}-pgdg
     - file: /etc/apt/sources.list.d/psql.list
     - key_url: https://www.postgresql.org/media/keys/ACCC4CF8.asc

diff --git a/salt/top.sls b/salt/top.sls
@@ -13,13 +13,13 @@ base:
     - core.mail
     - core.motd
     - core.network
+    - core.ntp
     - core.reboot
     - core.rsyslog
     - core.sshd
     - core.swap
     - core.sysctl
     - core.systemd.logind
-    - core.systemd.ntp
 
   'cms':
     - cms