Migrate all the infra to the tails.net namespace

Assumptions

• We'll eventually migrate all Tails infra to use tails.net
• We'll eventually get rid of tails.boum.org (modulo redirections, to avoid link rot)
• We'll not migrate everything at once, so steps should be incremental

Migration steps

• Migrate Puppet config to use voxpupuli/nginx
• Website -- #17985
• Translation platform
  • puppet-weblate!15+
  • puppet-code!11+
  • jenkins-tools!2+
  • tails!1699+
  • Staging website
  • Inform tails-l10n@
• Machine FQDNs
  • chameleon
  • dragon
  • ecours
  • iguana
  • lizard
  • gecko
  • stone
  • skink
  • teels
• Gitolite
• LimeSurvey
• Rsync (needs coordination with mirror admins)
  • Create rsync.tails.net
  • Update the documentation on the website:
  • Request the change to mirror operators and kindly ask them to report back
  • Check the state on Oct 31st and notify them once again
• Start serving several addresses under the tails.net domain:
  • Tor Browser archive: https://torbrowser-archive.tails.boum.org
  • ISO links: https://iso-history.tails.boum.org and https://nightly.tails.boum.org
  • APT snapshots: https://time-based.snapshots.deb.tails.boum.org and https://tagged.snapshots.deb.tails.boum.org
  • Redmine archives
  • Redmine redirects (see thread)

Postponed

These items need to be coordinated in the context of the the merge with TPA. See more info on: sysadmin-private.git:meetings/2024-09-23.md

• GitLab (service provider needs to add support to the tails.net domain)
• Jenkins:
  • Documentation on tails/tails>
  • Jenkins configuration
  • tails/jenkins-jobs>
  • gitlab-jenkins integration
• Mailman (lists at autistici)
• APT repository: https://deb.tails.boum.org
• Icinga2 / Icingaweb2

Node migration steps

1. Add a DNS entry for the host in the tails.net zone
2. Replace all entries in Puppet:

   set HOSTNAME skink
   git grep -l $HOSTNAME.tails.boum.org | xargs -l sed -i -e "s/$HOSTNAME.tails.boum.org/$HOSTNAME.tails.net/"
   for i in yaml eyaml;
     find hieradata/node/ \
       -regex "hieradata/node/$HOSTNAME.tails.boum.org.$i" \
       -exec git mv '{}' "hieradata/node/$HOSTNAME.tails.net.$i" \; ;
   end

3. Commit and push the changes:

   git commit -a -m "Move $HOSTNAME to the tails.net domain" -m "refs sysadmin#17987"
   git push

4. Change the machine hostname:

   set HOSTNAME (hostname)
   sudo sed -i -e "s/$HOSTNAME.tails.boum.org/$HOSTNAME.tails.net/" /etc/hosts /etc/puppet/puppet.conf
   sudo find /var/lib/puppet/ssl -type f -delete

5. In the Puppet Master node:

   set HOSTNAME skink
   sudo puppetserver ca clean --certname $HOSTNAME.tails.boum.org
   sudo puppet node deactivate $HOSTNAME.tails.boum.org

6. In the node:

   sudo puppet agent -t --waitforcert 5

7. In the Puppet Master:

   sudo puppetserver ca list
   # Check the fingerprint!
   sudo puppetserver ca sign --certname $HOSTNAME.tails.net

8. Wait for the Puppet run to finish to make sure the node exports any exported .resources it declares
9. In lizard, run Puppet for the VPN entrypoints and the monitoring node:

   for i in iguana ecours lizard; ssh $i.tails.boum.org sudo systemctl restart puppet-run; end

10. Force the node's icinga2 to use the new hostname and delete the old certificate:

    sudo systemctl restart icinga2
    sudo rm /var/lib/icinga2/certs/(hostname).tails.boum.org.{crt,key}

11. Sign the node's Icinga2 certificate in ecours:

    # List the pending certificates and get the fingerprint...
    sudo icinga2 ca list
    # ...then sign
    sudo icinga2 ca sign $FINGERPRINT

12. Move the entries in sysadmin-private.git:systems to the new hostname
13. Reboot the node and make sure Puppet works:

    sudo shutdown -r now
    # Do the Dropbear dance
    sudo puppet agent -t

Tracked separately

• #18026+
• #18024+
• #18095+