Improve filesystem sandboxing for some services

[chef.git] / .kitchen.yml

diff --git a/.kitchen.yml b/.kitchen.yml
index 133d124eea8396df116445f4467ca86f5aa1fbb0..a86bd7f543f8df057034b607fe5a34567af98dc4 100644 (file)
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -1,7 +1,9 @@
 ---
 driver:
   name: dokken
 ---
 driver:
   name: dokken

-  chef_version: 15
+  chef_version: 17
+  volumes:
+    - /var/lib/docker

   env:
     - container=dokken
 
   env:
     - container=dokken
 


@@ -18,9 +20,16 @@ verifier:
   sudo: false
 
 platforms:
   sudo: false
 
 platforms:

-  - name: ubuntu-18.04
+  - name: ubuntu-20.04

     driver:
     driver:

-      image: dokken/ubuntu-18.04
+      image: dokken/ubuntu-20.04
+      privileged: true
+      pid_one_command: /bin/systemd
+      intermediate_instructions:
+        - RUN /usr/bin/apt-get update -y
+  - name: ubuntu-22.04
+    driver:
+      image: dokken/ubuntu-22.04

       privileged: true
       pid_one_command: /bin/systemd
       intermediate_instructions:
       privileged: true
       pid_one_command: /bin/systemd
       intermediate_instructions:


@@ -57,6 +66,9 @@ suites:
   - name: clamav
     run_list:
       - recipe[clamav::default]
   - name: clamav
     run_list:
       - recipe[clamav::default]

+  - name: community
+    run_list:
+      - recipe[community::default]

   - name: db-backup
     run_list:
       - recipe[db::backup]
   - name: db-backup
     run_list:
       - recipe[db::backup]


@@ -93,6 +105,9 @@ suites:
   - name: dmca
     run_list:
       - recipe[dmca::default]
   - name: dmca
     run_list:
       - recipe[dmca::default]

+  - name: dns
+    run_list:
+      - recipe[dns::default]

   - name: docker
     run_list:
       - recipe[docker::default]
   - name: docker
     run_list:
       - recipe[docker::default]


@@ -156,10 +171,6 @@ suites:
   - name: letsencrypt
     run_list:
       - recipe[letsencrypt::default]
   - name: letsencrypt
     run_list:
       - recipe[letsencrypt::default]

-    attributes:
-      apt:
-        sources:
-          - openstreetmap

   - name: logstash
     run_list:
       - recipe[logstash::default]
   - name: logstash
     run_list:
       - recipe[logstash::default]


@@ -169,17 +180,23 @@ suites:
     attributes:
       logstash:
         forwarder:
     attributes:
       logstash:
         forwarder:

-          filebeat.prospectors:
-            - input_type: log
+          filebeat.inputs:
+            - type: filestream
+              id: apache

               paths:
                 - /var/log/apache2/access.log
               paths:
                 - /var/log/apache2/access.log

-              type: apache
+              fields:
+                type: apache
+              fields_under_root: true

   - name: mail
     run_list:
       - role[mail]
   - name: mailman
     run_list:
       - recipe[mailman::default]
   - name: mail
     run_list:
       - role[mail]
   - name: mailman
     run_list:
       - recipe[mailman::default]

+  - name: matomo
+    run_list:
+      - recipe[matomo::default]

   - name: memcached
     run_list:
       - recipe[memcached::default]
   - name: memcached
     run_list:
       - recipe[memcached::default]


@@ -222,6 +239,9 @@ suites:
   - name: otrs
     run_list:
       - recipe[otrs::default]
   - name: otrs
     run_list:
       - recipe[otrs::default]

+  - name: overpass
+    run_list:
+      - recipe[overpass::default]

   - name: passenger
     run_list:
       - recipe[passenger::default]
   - name: passenger
     run_list:
       - recipe[passenger::default]


@@ -234,9 +254,6 @@ suites:
   - name: php-fpm
     run_list:
       - recipe[php::fpm]
   - name: php-fpm
     run_list:
       - recipe[php::fpm]

-  - name: piwik
-    run_list:
-      - recipe[piwik::default]

   - name: planet
     run_list:
       - recipe[planet::default]
   - name: planet
     run_list:
       - recipe[planet::default]


@@ -265,6 +282,24 @@ suites:
       postgresql:
         versions:
           - 10
       postgresql:
         versions:
           - 10

+  - name: prometheus
+    run_list:
+      - recipe[prometheus::default]
+    attributes:
+      networking:
+        interfaces:
+          test:
+            interface: eth0
+            role: internal
+            address: 172.18.0.2
+            prefix: 16
+            gateway: 172.18.0.1
+  - name: prometheus-server
+    run_list:
+      - recipe[prometheus::server]
+    attributes:
+      prometheus:
+        promscale: true

   - name: python
     run_list:
       - recipe[python::default]
   - name: python
     run_list:
       - recipe[python::default]


@@ -280,15 +315,21 @@ suites:
   - name: spamassassin
     run_list:
       - recipe[spamassassin::default]
   - name: spamassassin
     run_list:
       - recipe[spamassassin::default]

-  - name: squid
-    run_list:
-      - recipe[squid::default]

   - name: ssl
     run_list:
       - recipe[ssl::default]
   - name: stateofthemap
     run_list:
       - recipe[stateofthemap::default]
   - name: ssl
     run_list:
       - recipe[ssl::default]
   - name: stateofthemap
     run_list:
       - recipe[stateofthemap::default]

+  - name: stateofthemap-static
+    run_list:
+      - recipe[stateofthemap::static]
+  - name: stateofthemap-jekyll
+    run_list:
+      - recipe[stateofthemap::jekyll]
+  - name: stateofthemap-wordpress
+    run_list:
+      - recipe[stateofthemap::wordpress]

   - name: subversion
     run_list:
       - recipe[subversion::default]
   - name: subversion
     run_list:
       - recipe[subversion::default]


@@ -314,21 +355,18 @@ suites:
   - name: tile
     run_list:
       - recipe[tile::default]
   - name: tile
     run_list:
       - recipe[tile::default]

-  - name: tilecache
-    run_list:
-      - recipe[tilecache::default]

   - name: tilelog
     run_list:
       - recipe[tilelog::default]
   - name: tilelog
     run_list:
       - recipe[tilelog::default]

+  - name: timescaledb
+    run_list:
+      - recipe[timescaledb::default]

   - name: tools
     run_list:
       - recipe[tools::default]
   - name: trac
     run_list:
       - recipe[trac::default]
   - name: tools
     run_list:
       - recipe[tools::default]
   - name: trac
     run_list:
       - recipe[trac::default]

-  - name: web-backend
-    run_list:
-      - recipe[web::backend]

   - name: web-cgimap
     run_list:
       - recipe[web::cgimap]
   - name: web-cgimap
     run_list:
       - recipe[web::cgimap]