@yuvipanda I don't really know how I would investigate the issue. The issue was fixed by explicitly opening the port so this wasn't much of a priority for me. I take a quick look in about 3-4 hours to see if I can find anything.

@Aklapper I discussed it with the few people actively working with OpenStack atm. It isn't that big (yet). Its fine if this isn't created, its not really needed right now.

@chasemp Its in the Phabricator project. Phab-02 was an old model that I was going off of while writing https://gerrit.wikimedia.org/r/#/c/222987/. Phab-pup-test has that role enabled and is the most current with the Differential/Diffusion (just realized I've been using the wrong name) setup.

Do they need to be locked down? We can just change the group privs to something phd is a member of.

Unhandled exceptions are not expected behavior.

The feature being described would be an upstream request not a Wikimedia specific feature.

It should also be mentioned that the grey dot next to a disabled user could have the same problem.

In modules/phabricator/manifests/init.pp, line 177:

mode    => '0754',

@chasemp, Is there a specific reason this is set?

Running /usr/libexec/phabricator-ssh-hook.sh as vcs-user gives:

/usr/libexec/phabricator-ssh-hook.sh: 17: exec: /srv/phab/phabricator/bin/ssh-auth: Permission denied

phabricator/scripts or more specifically phabricator/scripts/ssh should be owned by phd (Bug: T105575)

Script log:

negative24@phab-pup-test:~$ sudo cat /home/vcs-user/script.log
Script is running
Arguments: vcs-user
VCS user matched
Running /srv/phab/phabricator/bin/ssh-auth vcs-user

So the script is being run by SSH and is executing the ssh-auth command which returns:

command="'/srv/phab/phabricator/bin/ssh-exec' '--phabricator-ssh-user' 'Negative24' '--phabricator-ssh-key' '3'",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlACYKvy3x6uE6eeWHY22bQtFoTNYlJnl/erzUi3FGdegCHnOJfVqir8IM4M2aGR8Qc0UozGDiai16cSpI+GTo++g702wO6Pn7TNZGbk0NRBm7ucauJIkH1UlzE8Q8+SH8RINFhRFQtBPGmHn09xDQ50kmNXCnHtSEY/0D+WKEkb7nDPz5O9dzR5DZJ2w26NYXBAQg+oPkcSRHNEDH3JE6ywhHKoLBnHMjLPz1lcyg6hIaRfJNAASV32IbDwSzBGFcCVHgAWN6JPplQ5Vq3t34j8J8IuGbsIqDbTJ+C6z8OCkPOaW58AZpEi3P+dAFM1qXv0yfvnXVhOtA8m9bkgZt

The public key that is returned matches my public key:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlACYKvy3x6uE6eeWHY22bQtFoTNYlJnl/erzUi3FGdegCHnOJfVqir8IM4M2aGR8Qc0UozGDiai16cSpI+GTo++g702wO6Pn7TNZGbk0NRBm7ucauJIkH1UlzE8Q8+SH8RINFhRFQtBPGmHn09xDQ50kmNXCnHtSEY/0D+WKEkb7nDPz5O9dzR5DZJ2w26NYXBAQg+oPkcSRHNEDH3JE6ywhHKoLBnHMjLPz1lcyg6hIaRfJNAASV32IbDwSzBGFcCVHgAWN6JPplQ5Vq3t34j8J8IuGbsIqDbTJ+C6z8OCkPOaW58AZpEi3P+dAFM1qXv0yfvnXVhOtA8m9bkgZt jamison.lofthouse@gmail.com

but SSH keeps on showing key not found.

Ln 53 is the last line from initial start.
Ln 160 shows that it did run the command.
Ln 163 is where the check failed.

Accidentally pasted my public key, which happened to be on the clipboard when my log wasn't copied.

Possibly related:

I have to say the notification system is the most confusing and weird exception-y thing in Phabricator.

T104515 seems to have changed it back to black. (that is, the header)

Seems to be very similar to https://secure.phabricator.com/T8524 as well.

@mmodell Un-watching is still different from unsubscribing. @Mattflaschen said he unsubscribed (which I can see) but @mmodell said un-watch. I just need a bit of clarification. It is possible to un-watch and unsubscribe from a project while still being in it and it sounds like doing that should mute all notifications which would mean that this would be a bug.

Name: OpenStack
Description: This project tracks the development and deployment of the OpenStack software that manages the instance framework in Cloud-Services.
Type: Component

The Phabricator's res dir contains generated files based on either the phabricator.base-uri or security.alternate-file-domain.

I updated some confusing documentation here. I ended up getting confused the same way.

In T104515#1426380, @Paladox wrote:

We should upgrade to the latest source code of redesign-branch every week.

@Andrew, well I do have an instance (phab-pup) which I'm writing puppet configs for phab-02 which has its puppet disabled. Eventually phab-02 should be fully puppetized in phab-pup.

I have a feeling I'm going to be getting these emails quite often...

Could be both. I haven't found the underlying issue yet.

Phab-01's log is empty
Phab-02's last entry was made on 25-Jun-2015 19:47:18 UTC. I don't know what happened then (probably a puppet run).
Phab-03's log is also empty but this was caused by me since the log was getting to be too big so I cleared everything and this made me discover the bug in the first place.

Currently investigating. Will post details soon.

@mmodell Phab-03 wasn't that hard to setup. I'll recreate it tomorrow (couldn't yesterday because I was SSHing through a tablet). Debugging isn't worth it on that machine. I'll poke around in phab-01 to see whats going on there.

Like I said I didn't know how to use it when I posted that. Now I do.

So this molly-guard package, is it going to be installed everywhere as in Labs and prod? A few emails and docs should be written because I, and I guarantee a few others, won't know how to use it and people will not be happy if they can't reboot their instances.

@mmodell I'm a little curious to what you did to phab-03. It wasn't fully updated with the origin/redesign-2015 branch and so Spaces wasn't installed which caused a few database errors but nothing really happened. I updated to the latest commit in the redesign branch and the phd services are still failing to connect to the database.

Phab-03 was ready for Spaces testing (I say was because T103918 seems to have left it in a peculiar state).

Phab-02 and phab-pup are recovered and NFS has been disabled on both.

@Quiddity No that makes sense. Its a little reminder that its still there.
I'm still not seeing how the sidebar showing up momentarily is a FOUC, though. It looks styled and fine in both states.

Mostly unused because its mostly automatic (testing suites). But yes it doesn't use NFS.

I'm not at all qualified to say this but I bet a bit of smoothing around
the edges would do nicely.

@He7d3r I can't reproduce. Can you see if the issue is still present?

There is a Phabricator application called Dashboard (https://phabricator.wikimedia.org/dashboard/). I'm assuming if you are a new user your home dashboard was automatically set to the default one. You need to create your own dashboard (or pick an existing one) and "install" it to make it show up on the home page. Refer to the documentation on MW.org for doing that.

Just letting everyone know that this is a new feature.

Phab-02 and phab-pup are the only ones I didn't get to work and they're the only ones not using the main puppetmaster (phab-02 is disabled and phab-pup is a self puppetmaster). It doesn't really matter since I was the only one using them anyways. I'll fix them when Labs recovers.

@mmodell Since most of Wikimedia's custom code has been made into an extension, could we get the small amount of code that is being merged in also into an extension? This would make deployments simpler and easier to track. Perhaps just a misc extension if code is too small to be made into a full extension.

Is this still being blocked by upstream?

In T102180#1358510, @Qgil wrote:

There is, but it doesn't seem to be working.

https://phabricator.wikimedia.org/settings/panel/emailpreferences/

Project membership changes.

I have set it to Ignore, but still get notifications via email.

(mmm I think this is a duplicate, but it's late and I want to zzzzzz)

In T823#1355913, @Qgil wrote:

After the last Wikimedia Phabricator update, https://phabricator.wikimedia.org/spaces/ exists. According to upstream it is "useless" as of today.

I got Phab-03 up with Phabricator at upstream's HEAD if it is any use to anyone else. Spaces seems to be working quite well there. I'll just be testing on it for a few weeks (at least) and then'll probably delete it unless someone needs it.

An alternative (read: the way I do it) is I set

Host bastion1.wmflabs.org
    User negative24

My ssh config

In T99345#1290249, @wctaiwan wrote:

(Tangentially, the images take up the whole screen on my display. We should probably reduce the size even if we're going to keep them.)

I believe it is working now. Just had to set load-libraries and events.listeners. @mmodell probably happened with the 2015-05-06 migration.

In T273#1264927, @mmodell wrote:

this is updated but I'm not sure how to flush cache - browsers cache the favicon pretty aggressively.

What about the 'security.allow-outbound-http' option that is now obsolete (and will/can be removed with https://gerrit.wikimedia.org/r/#/c/208848/)? Do we need to set the alternative (security.outbound-blacklist) before the deployment?