Page MenuHomePhabricator

move releases.wm.org to bromine (was: request VM for releases.wm.org)
Closed, ResolvedPublic

Description

requesting a VM to replace physical server caesium.eqiad.wmnet

it currently hosts nothing except releases.wikimedia.org ..all it needs is an Apache

i would like to keep it a separate VM though and not put it on other existing VMs. one reason being different admin groups who have access


Labs Project Tested: caesium.eqiad.wmnet
Site/Location: eqiad (both?)
Number of systems: 1
Service: releases.wikimedia.org
Networking Requirements: internal (misc-web backend)
Processor Requirements: 1
Memory: 1GB
Disks: 20GB
Other Requirements: jessie

Event Timeline

Dzahn updated the task description. (Show Details)
Dzahn raised the priority of this task from to Needs Triage.
Dzahn claimed this task.
Dzahn added a project: Operations.
Dzahn added a project: vm-requests.
Dzahn set Security to None.
Dzahn updated the task description. (Show Details)Jan 21 2016, 1:27 AM
Dzahn removed Dzahn as the assignee of this task.
Dzahn added a subscriber: mark.

@mark should we have a second one of this in codfw as well? so we can switch over DCs and still have releases.wm.org up ?

@Dzahn, since we will be doing this anyway, doing it twice for codfw as well, doesn't seem to be that much extra trouble so I say we do it. Correct me if I am wrong though.

I am a bit hazy though on the

i would like to keep it a separate VM though and not put it on other existing VMs. one reason being different admin groups who have access

care to elaborate ?

Dzahn added a comment.EditedJan 22 2016, 10:11 PM

@akosiaris I just wanted to avoid putting multiple "misc" sites/apps on the same server with the official releases. It would mean if one of them has an (security) issue the others might be affected too and the release packages seemed quite critical. And because releasers are a different set of shell users that need access but not necessarily to all the other sites.

Do you think it should go on an existing VM? Then i'd say at least bromine (it's for static sites) i guess that's fine, let's not use krypton though.

re: setting up another machine in codfw: ok, yep, i'd suggest we set up equivalents of bromine and krypton in codfw and apply the same roles.. it wouldn't take that much effort and we could still have all those misc. services too when we switch over

@akosiaris I just wanted to avoid putting multiple "misc" sites/apps on the same server with the official releases. It would mean if one of them has an (security) issue the others might be affected too and the release packages seemed quite critical. And because releasers are a different set of shell users that need access but not necessarily to all the other sites.

Do you think it should go on an existing VM? Then i'd say at least bromine (it's for static sites) i guess that's fine, let's not use krypton though.

Yes, I am thinking that releases does not at this point in time warrant a separate VM, let's reuse bromine. I agree though with you krypton is not suitable.

re: setting up another machine in codfw: ok, yep, i'd suggest we set up equivalents of bromine and krypton in codfw and apply the same roles.. it wouldn't take that much effort and we could still have all those misc. services too when we switch over

I agree.

Change 266531 had a related patch set uploaded (by Dzahn):
releases: add role on bromine

https://gerrit.wikimedia.org/r/266531

Change 266531 merged by Dzahn:
releases: add role on bromine

https://gerrit.wikimedia.org/r/266531

had to adjust roles a bit so they dont conflict when applied on the same server, but now it's fine

https://gerrit.wikimedia.org/r/#/c/266546/
https://gerrit.wikimedia.org/r/#/c/266581/

Dzahn renamed this task from request VM for releases.wm.org to move releases.wm.org to bromine (was: request VM for releases.wm.org).Jan 26 2016, 10:12 PM

@akosiaris It does mean that all shell users who are in "releasers-mediawiki" or "releasers-mobile" now get access to a machine with other misc. static services that they did not have before. I do not see this as a problem, but i wanted to mention it anyways to clarify.

Change 266608 had a related patch set uploaded (by Dzahn):
releases: setup rsyncd to copy release files

https://gerrit.wikimedia.org/r/266608

Change 266608 merged by Dzahn:
releases: setup rsyncd to copy release files

https://gerrit.wikimedia.org/r/266608

Change 266613 had a related patch set uploaded (by Dzahn):
releases: add ferm rule to allow rsync to bromine

https://gerrit.wikimedia.org/r/266613

Change 266613 merged by Dzahn:
releases: add ferm rule to allow rsync to bromine

https://gerrit.wikimedia.org/r/266613

setup rsync, copying the release files over to bromine now ... running in screen ..

Change 266616 had a related patch set uploaded (by Dzahn):
releases: also rsync /home dirs with user tools

https://gerrit.wikimedia.org/r/266616

Change 266616 merged by Dzahn:
releases: also rsync /home dirs with user tools

https://gerrit.wikimedia.org/r/266616

@csteipp @demon This is the ticket re: moving the releases server. The purpose is to replace another Ubuntu system (caesium). The role for releases.wm.org is applied on bromine.eqiad.wmnet now, which is Debian jessie. (but it's also still on the existing server)

I have applied the puppet stuff so the Apache config etc has been created, had to make some minimal puppet fixes, now It has the releases.wm.org vhost. I used rsync to copy the entire /srv/org/wikimedia and also your /home dirs , so you have "releasetools" and all the tarballs etc like before.

I have _not_ switched the varnish config yet to give you some time to confirm it looks ok and nothing is missing.

So currently the status is: caesium is exactly like before but please feel free to login on bromine.eqiad.wmnet and confirm it works for you and looks like we could switch over and decom caesium some time soon.

Hi, if you have been subscribed to this ticket it's because you are a member in one of the "releasers-" admin groups and have shell access. This is fyi that the service releases.wikimedia.org is soon going to move from caesium.eqiad.wmnet over to bromine.eqiad.wmnet. You should already be able to login on the new server now but we have not made the switch yet. Please let me know if you see any issues with access or the new server. The change is that it used to be Ubuntu precise and is going to be Debian jessie. I have copied all release files from /srv/org and your /home's with rsync today and will run it one more time before we switch over the varnish config that actually changes which server is the backend of releases.wm.org.

@akosiaris It does mean that all shell users who are in "releasers-mediawiki" or "releasers-mobile" now get access to a machine with other misc. static services that they did not have before. I do not see this as a problem, but i wanted to mention it anyways to clarify.

I don't either see a problem either in this specific situation. Thanks for clarifying it!

@Dzahn, thanks for the heads up and quick summary. bromine works fine for me.

Change 267148 had a related patch set uploaded (by Dzahn):
releases: make Apache config work with 2.4

https://gerrit.wikimedia.org/r/267148

Change 267148 merged by Dzahn:
releases: make Apache config work with 2.4

https://gerrit.wikimedia.org/r/267148

Change 267151 had a related patch set uploaded (by Dzahn):
varnish/misc-web: switch releases to bromine backend

https://gerrit.wikimedia.org/r/267151

Change 267151 merged by Dzahn:
varnish/misc-web: switch releases to bromine backend

https://gerrit.wikimedia.org/r/267151

Change 267175 had a related patch set uploaded (by Dzahn):
releases: beautify directory index page

https://gerrit.wikimedia.org/r/267175

the backend for this service has been switched over to bromine now.

in addition to subscriptions on this ticket i will send a mail to all "releasers" to let them know

Dzahn closed this task as Resolved.

Change 267385 had a related patch set uploaded (by Dzahn):
releases: switch reprepro upload server to bromine

https://gerrit.wikimedia.org/r/267385

Change 267385 merged by Dzahn:
releases: switch reprepro upload server to bromine

https://gerrit.wikimedia.org/r/267385

Change 267377 had a related patch set uploaded (by Dzahn):
admin: replace caesium with bromine in enforce-users-groups.sh

https://gerrit.wikimedia.org/r/267377

Change 267377 merged by Dzahn:
admin: replace caesium with bromine in enforce-users-groups.sh

https://gerrit.wikimedia.org/r/267377