Page MenuHomePhabricator
Create Task
Maniphest T132463

HTTPS redirects for datasets.wikimedia.org
Closed, ResolvedPublic
Actions

Description

Enabling this is trivial, the question is: is there any reason we *can't* enable this? Who's responsible for this service and might know of exceptions like mixed-content, or HTTPS-incapable tools which rely on it, etc? [note this a generic message being tacked into the description of several similar tickets]

Details

SubjectRepoBranchLines +/-
datasets: rewrite http to httpsoperations/puppetproduction+6 -0
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 Resolved• emaT108827 Investigate TCP Fast Open for tlsproxy
 DeclinedNoneT107236 Switch port 80 to nginx on primary clusters
 ResolvedBBlackT104681 HTTPS Plans (tracking / high-level info)
 ResolvedBBlackT102824 Clean up DNS/redirects for TLS
 ResolvedArielGlennT107575 download.wiki[mp]edia.org are using an invalid certificate
 ResolvedChmarkineT110511 sitemap.wikimedia.org uses invalid SSL certificate
 ResolvedBBlackT104244 Preload HSTS
 ResolvedBBlackT102814 Decom old multiple-subdomain wikis in wikipedia.org
 ResolvedBBlackT104942 TLS and *.wap/*.mobile multi-level subdomains of wikipedia.org
 ResolvedBBlackT102815 Decom www.$lang hostnames/redirects
 ResolvedBBlackT102826 Fix/decom multiple-subdomain wikis in wikimedia.org
 ResolvedBBlackT102827 Decide what to do with *.donate.wikimedia.org subdomain + TLS
 Resolved• CCogdill_WMFT130414 delete links.email.donate.wikimedia.org (and all other email.donate.*?) from DNS
 DeclinedBBlackT111967 Preload HSTS for select hostnames within wikimedia.org
 DuplicateBBlackT111998 investigate/remove hostname login.m.wikimedia.org
 ResolvedBBlackT40516 Enable HSTS on Wikimedia sites
 ResolvedBBlackT103919 let all services on misc-web enforce http->https redirects
 ResolvedBBlackT132463 HTTPS redirects for datasets.wikimedia.org
 ResolvedBBlackT132452 HSTS preload for wmfusercontent.org
 ResolvedBBlackT132685 Preload STS for wikimedia.org
 ResolvedBBlackT34796 status.wikimedia.org has no (valid) HTTPS
 ResolvedBBlackT132450 enable https for (ubuntu|apt|mirrors).wikimedia.org
 ResolvedBBlackT132812 Sort out letsencrypt puppetization for simple public hosts

Event Timeline

BBlack created this task.Apr 12 2016, 3:43 PM
Dzahn added a project: Datasets-General-or-Unknown.Apr 12 2016, 6:00 PM
Dzahn edited subscribers, added: ArielGlenn; removed: • JohnLewis.
ArielGlenn added a comment.Apr 12 2016, 9:05 PM

dumps.wm.o already redirects and so does downloads.wm.o. What's left?

BBlack added a comment.EditedApr 12 2016, 9:18 PM

This isn't for dumps or downloads, this is for http://datasets.wikimedia.org

ArielGlenn added a comment.Apr 12 2016, 9:36 PM

How does that not redirect already? I thought/hoped that the 'default' parameter in the nginx conf on datasets would take care of that. https://gerrit.wikimedia.org/r/#/c/278861/6/modules/dumps/templates/nginx.dumps.conf.erb Anyways, yes please redirect it all!

gerritbot subscribed.Apr 12 2016, 9:37 PM

Change 283084 had a related patch set uploaded (by Dzahn):
datasets: rewrite http to https

https://gerrit.wikimedia.org/r/283084

gerritbot added a project: Patch-For-Review.Apr 12 2016, 9:37 PM
Dzahn added a comment.Apr 12 2016, 9:38 PM
In T132463#2201127, @ArielGlenn wrote:

How does that not redirect already? I thought/hoped that the 'default' parameter in the nginx conf on datasets would take care of that.

Nope, all the services that do this have a rule in the backend based on RewriteCond %{HTTP:X-Forwarded-Proto} !https

https://gerrit.wikimedia.org/r/#/c/283084/1/modules/statistics/files/datasets.wikimedia.org

Dzahn added a comment.Apr 12 2016, 9:39 PM

Somewhat counterintuitively the config for this is not in module dataset but instead in modules/statistics/files/ and it's not nginx but Apache?

ArielGlenn added a subscriber: Ottomata.Apr 12 2016, 9:45 PM

That just can't be true. And yet it is. 2d1fa5938f22c94324435c75acc4f496c1cacaa3 @Ottomata set it up. Someone has to ask him about this, I have zero idea.

Dzahn added a comment.EditedApr 12 2016, 9:47 PM

Hah, and that says **"# NOTE: This class has nothing to do with the # datasets site hosted at 'datasets.wikimedia.org'." ** ? ?

gerritbot added a comment.Apr 12 2016, 10:06 PM

Change 283084 abandoned by Dzahn:
datasets: rewrite http to https

Reason:
can be done in varnish

https://gerrit.wikimedia.org/r/283084

Ottomata added subscribers: mforns, Halfak, Milimetric.Apr 13 2016, 2:55 PM

datasets.wikimedia.or is hosted on stat1001, not a dataset100x host.

I think HTTPS only is fine, but maybe @Milimetric or @mforns or @Halfak might have more to say.

Halfak added a comment.Apr 13 2016, 3:17 PM

+1 for HTTPS only being OK.

gerritbot added a comment.Apr 13 2016, 3:42 PM

Change 283207 had a related patch set uploaded (by BBlack):
datasets.wm.o HTTPS redirect T132463

https://gerrit.wikimedia.org/r/283207

gerritbot added a comment.Apr 13 2016, 3:43 PM

Change 283207 merged by BBlack:
datasets.wm.o HTTPS redirect T132463

https://gerrit.wikimedia.org/r/283207

BBlack closed this task as Resolved.Apr 13 2016, 3:43 PM
BBlack claimed this task.
mforns added a comment.Apr 14 2016, 11:10 AM

@Ottomata
We might want to change this to https then: https://github.com/wikimedia/analytics-dashiki/blob/master/src/app/config.js#L39

Milimetric added a comment.Apr 14 2016, 2:22 PM

done https://gerrit.wikimedia.org/r/#/c/283446/

mforns mentioned this in T131206: Notification dashboards miscount time-to-read.Apr 14 2016, 7:19 PM
ArielGlenn moved this task from Backlog to Done on the Datasets-General-or-Unknown board.Apr 25 2016, 3:24 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL