Page MenuHomePhabricator
Create Task
Maniphest T131288

Make Cloud Services shared HTTP proxies enforce TLS
Closed, ResolvedPublic
Actions

Description

Related Objects
Search...

Event Timeline

Andrew created this task.Mar 30 2016, 7:36 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 30 2016, 7:36 PM
Andrew created subtask T131290: Abolish use of labs proxies in domains other than .wmflabs.org.Mar 30 2016, 7:38 PM
Andrew added a subtask: T131270: Only allow labs proxies to be *.wmflabs.org.
Andrew closed subtask T131270: Only allow labs proxies to be *.wmflabs.org as Resolved.Mar 30 2016, 9:13 PM
• chasemp triaged this task as Medium priority.Apr 4 2016, 1:52 PM
• AlexMonk-WMF merged a task: T144790: wmflabs.org should enforce HTTPS.Sep 8 2016, 10:21 PM
• AlexMonk-WMF added a subscriber: abian.
• AlexMonk-WMF subscribed.

See also T120486

bd808 added subtasks: T102367: Migrate tools.wmflabs.org to https only (and set HSTS), T120486: Set "https_upgrade" configuration flag for domainproxy to enforce HTTPS upgrade for GET|HEAD requests.Oct 15 2017, 8:04 PM
Liuxinyu970226 subscribed.Dec 30 2017, 2:18 AM
bd808 mentioned this in T180854: Create discourse-mediawiki.wmflabs.org (pilot instance).Jan 6 2018, 11:22 PM
• GTirloni edited projects, added cloud-services-team (Kanban); removed Cloud-Services.Mar 24 2019, 10:31 AM
bd808 moved this task from Backlog to Dynamicproxy on the Cloud-VPS board.Nov 10 2019, 11:36 PM
Dzahn subscribed.Nov 21 2019, 11:27 PM

was this resolved by https://gerrit.wikimedia.org/r/c/operations/puppet/+/482142 or is there more to be done?

Krenair subscribed.Nov 21 2019, 11:33 PM

We'd need to set https_upgrade to true either by changing the default or setting the key when we create the dynamicproxy class.

Andrew closed subtask T131290: Abolish use of labs proxies in domains other than .wmflabs.org as Resolved.May 17 2020, 10:00 PM
bd808 closed subtask T102367: Migrate tools.wmflabs.org to https only (and set HSTS) as Resolved.Jul 17 2020, 4:56 PM
Isaac subscribed.Jul 20 2020, 7:39 PM

+1 to this. Discussed in IRC but having this handled by default would be hugely hugely appreciated as I definitely do not trust myself to get it right!

bd808 renamed this task from Make labs proxies https only to Make Cloud Services shared HTTP proxies enforce TLS.Aug 17 2020, 9:51 PM
bd808 updated the task description. (Show Details)
Nintendofan885 subscribed.Aug 17 2020, 9:54 PM
bd808 added a subtask: T273648: Force HTTPS and set HSTS header to 366 days for profile::wmcs::proxy::static proxies.Feb 2 2021, 5:17 PM
bd808 added a subtask: T273651: Force HTTPS and set HSTS header to 366 days for profile::toolforge::static proxies.
bd808 closed subtask T120486: Set "https_upgrade" configuration flag for domainproxy to enforce HTTPS upgrade for GET|HEAD requests as Resolved.Feb 2 2021, 6:02 PM
bd808 closed subtask T273648: Force HTTPS and set HSTS header to 366 days for profile::wmcs::proxy::static proxies as Resolved.Feb 2 2021, 6:05 PM
bd808 updated the task description. (Show Details)
bd808 claimed this task.Feb 2 2021, 6:08 PM
bd808 moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.
Restricted Application added a project: User-bd808. · View Herald TranscriptFeb 2 2021, 6:08 PM
bd808 closed this task as Resolved.May 3 2021, 5:08 PM
bd808 closed subtask T273651: Force HTTPS and set HSTS header to 366 days for profile::toolforge::static proxies as Resolved.
bd808 updated the task description. (Show Details)
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL