move all the *.planet.wikimedia.org virtual hosts behind misc-web as a subtask of T60048
related gerrit changes:
varnish: https://gerrit.wikimedia.org/r/#/c/181419/ (regex lgtm)
DNS https://gerrit.wikimedia.org/r/#/c/181985/ (yep)
install *planet. wildcard SSL cert on misc-web https://gerrit.wikimedia.org/r/181415 (ok with Faidon per comments on parent ticket?)
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| delete *.planet.wikimedia.org SSL cert | operations/puppet | production | +0 -39 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Declined | • JohnLewis | T90676 remove public IP from zirconium | |||
| Resolved | Dzahn | T60048 Put all zirconium vhosts behind misc varnish cluster | |||
| Resolved | Dzahn | T85789 move planet behind misc-web |
Change 181984 had a related patch set uploaded (by Dzahn):
planets: remove SSL stanza
< mutante> paravoid: are you against installing the planet SSL cert on misc-web? https://gerrit.wikimedia.org/r/#/c/181415/ you said once " Planet needs its own certificate anyway (second-level wildcard), so there is not much incentive here." but that would install it
the cert got installed on cp1043/cp1044 after merging the above. then merged John's change to add it to varnish config.
hacked my /etc/hosts to test it before switching DNS. current issue: i still get the *.wikimedia.org cert and it doesn't seem to match the server name and provide *.planet cert even though a new nginx site has been created by puppet with:
server_name planet.wikimedia.org *.planet.wikimedia.org;
just had to restart nginx on cp1043/cp1044 manually, then it worked.
merged:
https://gerrit.wikimedia.org/r/#/c/181415/
https://gerrit.wikimedia.org/r/#/c/181984/
https://gerrit.wikimedia.org/r/#/c/181985/
works for me. tested with curl. resolving.
Change 195306 had a related patch set uploaded (by Dzahn):
delete *.planet.wikimedia.org SSL cert