T125320: Create project for AuthManager testing

Setup new host at am-01.authmanager.eqiad.wmflabs:

• Enabled role role::labs::mediawiki_vagrant and forced puppet run with sudo puppet agent --test --verbose
• Setup MediaWiki-Vagrant hiera config for a wiki farm by creating /srv/mediawiki-vagrant/puppet/hieradata/local.yaml:

---
role::mediawiki::hostname: authmanager.wmflabs.org
mediawiki::multiwiki::base_domain: "-authmanager.wmflabs.org"

• Enabled MediaWiki-Vagrant roles:
  • apex
  • buggy
  • centralauth
  • cite
  • cologneblue
  • eventlogging
  • fss
  • gadgets2
  • geshi
  • inputbox
  • interwiki
  • jsonconfig
  • math
  • mobilefrontend
  • oauth
  • parserfunctions
  • poem
  • poolcounter
  • psr3
  • scribunto
  • sitematrix
  • templatedata
  • thumb_on_404
  • titleblacklist
  • visualeditor
  • wikidiff2
  • wikimediamessages
• Started VM: vagrant up
• Waited forever for that to complete....
• Tested that wiki worked locally via curl -L localhost:8080
• Added web proxies pointing to am-01.authmanager.eqiad.wmflabs:8080 using wikitech UI:
  • authmanager.wmflabs.org
  • centralauthtest-authmanager.wmflabs.org
  • gadgets-authmanager.wmflabs.org
  • gadgetsclient-authmanager.wmflabs.org
  • login-authmanager.wmflabs.org
  • mobile-authmanager.wmflabs.org
• Logged in to https://authmanager.wmflabs.org using default MediaWiki-Vagrant credentials and then changed the Admin password

Not sure if we want to have everything on the same box, but other useful test roles are confimedit, https, oathauth, oauthauthentication.

And we should probably have an LdapAuthentication role. The wikitech role sets it up but comes with a million other things.

In T124832#2065748, @Tgr wrote:

Not sure if we want to have everything on the same box, but other useful test roles are confimedit, https, oathauth, oauthauthentication.

In T124832#2065751, @Tgr wrote:

And we should probably have an LdapAuthentication role. The wikitech role sets it up but comes with a million other things.

I enabled confirmedit. I don't think that https will really add anything in the Labs environment. We could add some custom config to ensure that https is enforced, but TLS termination is already provided by the Labs proxy.

I think we will have to setup other servers for the alternate authplugin implementations or at least change the roles to provision separate wikis.

My next big question for this stack is going to be how we will track and manage the various cherry-picks that we want to apply. Does anyone have a better idea than local feature branches that we rebase on master?