@Dzahn, since we will be doing this anyway, doing it twice for codfw as well, doesn't seem to be that much extra trouble so I say we do it. Correct me if I am wrong though.

I am a bit hazy though on the

i would like to keep it a separate VM though and not put it on other existing VMs. one reason being different admin groups who have access

care to elaborate ?

@akosiaris I just wanted to avoid putting multiple "misc" sites/apps on the same server with the official releases. It would mean if one of them has an (security) issue the others might be affected too and the release packages seemed quite critical. And because releasers are a different set of shell users that need access but not necessarily to all the other sites.

Do you think it should go on an existing VM? Then i'd say at least bromine (it's for static sites) i guess that's fine, let's not use krypton though.

re: setting up another machine in codfw: ok, yep, i'd suggest we set up equivalents of bromine and krypton in codfw and apply the same roles.. it wouldn't take that much effort and we could still have all those misc. services too when we switch over

In T124261#1957401, @Dzahn wrote:

@akosiaris I just wanted to avoid putting multiple "misc" sites/apps on the same server with the official releases. It would mean if one of them has an (security) issue the others might be affected too and the release packages seemed quite critical. And because releasers are a different set of shell users that need access but not necessarily to all the other sites.

Do you think it should go on an existing VM? Then i'd say at least bromine (it's for static sites) i guess that's fine, let's not use krypton though.

Yes, I am thinking that releases does not at this point in time warrant a separate VM, let's reuse bromine. I agree though with you krypton is not suitable.

re: setting up another machine in codfw: ok, yep, i'd suggest we set up equivalents of bromine and krypton in codfw and apply the same roles.. it wouldn't take that much effort and we could still have all those misc. services too when we switch over

I agree.

Change 266531 had a related patch set uploaded (by Dzahn):
releases: add role on bromine

https://gerrit.wikimedia.org/r/266531

Change 266531 merged by Dzahn:
releases: add role on bromine

https://gerrit.wikimedia.org/r/266531

had to adjust roles a bit so they dont conflict when applied on the same server, but now it's fine

https://gerrit.wikimedia.org/r/#/c/266546/
https://gerrit.wikimedia.org/r/#/c/266581/

@akosiaris It does mean that all shell users who are in "releasers-mediawiki" or "releasers-mobile" now get access to a machine with other misc. static services that they did not have before. I do not see this as a problem, but i wanted to mention it anyways to clarify.

Change 266608 had a related patch set uploaded (by Dzahn):
releases: setup rsyncd to copy release files

https://gerrit.wikimedia.org/r/266608

Change 266608 merged by Dzahn:
releases: setup rsyncd to copy release files

https://gerrit.wikimedia.org/r/266608

Change 266613 had a related patch set uploaded (by Dzahn):
releases: add ferm rule to allow rsync to bromine

https://gerrit.wikimedia.org/r/266613

Change 266613 merged by Dzahn:
releases: add ferm rule to allow rsync to bromine

https://gerrit.wikimedia.org/r/266613

setup rsync, copying the release files over to bromine now ... running in screen ..

Change 266616 had a related patch set uploaded (by Dzahn):
releases: also rsync /home dirs with user tools

https://gerrit.wikimedia.org/r/266616

Change 266616 merged by Dzahn:
releases: also rsync /home dirs with user tools

https://gerrit.wikimedia.org/r/266616

@csteipp @demon This is the ticket re: moving the releases server. The purpose is to replace another Ubuntu system (caesium). The role for releases.wm.org is applied on bromine.eqiad.wmnet now, which is Debian jessie. (but it's also still on the existing server)

I have applied the puppet stuff so the Apache config etc has been created, had to make some minimal puppet fixes, now It has the releases.wm.org vhost. I used rsync to copy the entire /srv/org/wikimedia and also your /home dirs , so you have "releasetools" and all the tarballs etc like before.

I have _not_ switched the varnish config yet to give you some time to confirm it looks ok and nothing is missing.

So currently the status is: caesium is exactly like before but please feel free to login on bromine.eqiad.wmnet and confirm it works for you and looks like we could switch over and decom caesium some time soon.

Hi, if you have been subscribed to this ticket it's because you are a member in one of the "releasers-" admin groups and have shell access. This is fyi that the service releases.wikimedia.org is soon going to move from caesium.eqiad.wmnet over to bromine.eqiad.wmnet. You should already be able to login on the new server now but we have not made the switch yet. Please let me know if you see any issues with access or the new server. The change is that it used to be Ubuntu precise and is going to be Debian jessie. I have copied all release files from /srv/org and your /home's with rsync today and will run it one more time before we switch over the varnish config that actually changes which server is the backend of releases.wm.org.

In T124261#1967740, @Dzahn wrote:

@akosiaris It does mean that all shell users who are in "releasers-mediawiki" or "releasers-mobile" now get access to a machine with other misc. static services that they did not have before. I do not see this as a problem, but i wanted to mention it anyways to clarify.

I don't either see a problem either in this specific situation. Thanks for clarifying it!

@Dzahn, thanks for the heads up and quick summary. bromine works fine for me.

Change 267148 had a related patch set uploaded (by Dzahn):
releases: make Apache config work with 2.4

https://gerrit.wikimedia.org/r/267148

Change 267148 merged by Dzahn:
releases: make Apache config work with 2.4

https://gerrit.wikimedia.org/r/267148

Change 267151 had a related patch set uploaded (by Dzahn):
varnish/misc-web: switch releases to bromine backend

https://gerrit.wikimedia.org/r/267151

Change 267151 merged by Dzahn:
varnish/misc-web: switch releases to bromine backend

https://gerrit.wikimedia.org/r/267151

Change 267175 had a related patch set uploaded (by Dzahn):
releases: beautify directory index page

https://gerrit.wikimedia.org/r/267175

the backend for this service has been switched over to bromine now.

in addition to subscriptions on this ticket i will send a mail to all "releasers" to let them know

Change 267385 had a related patch set uploaded (by Dzahn):
releases: switch reprepro upload server to bromine

https://gerrit.wikimedia.org/r/267385

Change 267385 merged by Dzahn:
releases: switch reprepro upload server to bromine

https://gerrit.wikimedia.org/r/267385

Change 267377 had a related patch set uploaded (by Dzahn):
admin: replace caesium with bromine in enforce-users-groups.sh

https://gerrit.wikimedia.org/r/267377

Change 267377 merged by Dzahn:
admin: replace caesium with bromine in enforce-users-groups.sh

https://gerrit.wikimedia.org/r/267377