Make Cloud Services shared HTTP proxies enforce TLS
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Andrew
	Mar 30 2016, 7:36 PM

Description

*.toolforge.org (urlproxy) T102367
*.wmflabs.org (domainproxy) T120486
*.wmcloud.org (domainproxy) T120486
maps proxies T273648
tools-static T273651

Related Objects
Search...

Status	Assigned	Task
Resolved	• bd808	T131288 Make Cloud Services shared HTTP proxies enforce TLS
Resolved	Andrew	T131290 Abolish use of labs proxies in domains other than .wmflabs.org
Resolved	• AlexMonk-WMF	T131270 Only allow labs proxies to be *.wmflabs.org
Resolved	• bd808	T102367 Migrate tools.wmflabs.org to https only (and set HSTS)
Resolved	Magnus	T102457 Make Magnus tools on tools.wmflabs.org work in HTTPS
Resolved	Milimetric	T44259 Make domas' pageviews data available in semi-publicly queryable database format
Resolved	Milimetric	T107056 Puppetize a server with a role that sets up Cassandra on Analytics machines [13 pts] {slug}
Resolved	Ottomata	T111053 Request three servers for Pageview API
Resolved	• mobrovac	T114742 restbase is not listening on port 7231 on aqs*
Resolved	• bd808	T128409 Detect tools.wmflabs.org tools which are HTTP-only
Declined	None	T163019 Allow tool's maintainers to force HTTPS for their tool
Resolved	• bd808	T120486 Set "https_upgrade" configuration flag for domainproxy to enforce HTTPS upgrade for GET\|HEAD requests
Resolved	• bd808	T273648 Force HTTPS and set HSTS header to 366 days for profile::wmcs::proxy::static proxies
Resolved	• bd808	T273651 Force HTTPS and set HSTS header to 366 days for profile::toolforge::static proxies

Event Timeline

Andrew created this task.Mar 30 2016, 7:36 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 30 2016, 7:36 PM

Andrew created subtask T131290: Abolish use of labs proxies in domains other than .wmflabs.org.Mar 30 2016, 7:38 PM

Andrew added a subtask: T131270: Only allow labs proxies to be *.wmflabs.org.

Andrew closed subtask T131270: Only allow labs proxies to be *.wmflabs.org as Resolved.Mar 30 2016, 9:13 PM

• chasemp triaged this task as Medium priority.Apr 4 2016, 1:52 PM

See also T120486

• bd808 added subtasks: T102367: Migrate tools.wmflabs.org to https only (and set HSTS), T120486: Set "https_upgrade" configuration flag for domainproxy to enforce HTTPS upgrade for GET|HEAD requests.Oct 15 2017, 8:04 PM

Liuxinyu970226 subscribed.Dec 30 2017, 2:18 AM

• bd808 mentioned this in T180854: Create discourse-mediawiki.wmflabs.org (pilot instance).Jan 6 2018, 11:22 PM

• GTirloni edited projects, added cloud-services-team (Kanban); removed Cloud-Services.Mar 24 2019, 10:31 AM

• bd808 moved this task from Unsorted to Web proxy on the Cloud-VPS board.Nov 10 2019, 11:36 PM

was this resolved by https://gerrit.wikimedia.org/r/c/operations/puppet/+/482142 or is there more to be done?

We'd need to set https_upgrade to true either by changing the default or setting the key when we create the dynamicproxy class.

Andrew closed subtask T131290: Abolish use of labs proxies in domains other than .wmflabs.org as Resolved.May 17 2020, 10:00 PM

• bd808 closed subtask T102367: Migrate tools.wmflabs.org to https only (and set HSTS) as Resolved.Jul 17 2020, 4:56 PM

+1 to this. Discussed in IRC but having this handled by default would be hugely hugely appreciated as I definitely do not trust myself to get it right!

• bd808 renamed this task from Make labs proxies https only to Make Cloud Services shared HTTP proxies enforce TLS.Aug 17 2020, 9:51 PM

• bd808 updated the task description. (Show Details)

Nintendofan885 subscribed.Aug 17 2020, 9:54 PM

• bd808 added a subtask: T273648: Force HTTPS and set HSTS header to 366 days for profile::wmcs::proxy::static proxies.Feb 2 2021, 5:17 PM

• bd808 added a subtask: T273651: Force HTTPS and set HSTS header to 366 days for profile::toolforge::static proxies.

• bd808 closed subtask T120486: Set "https_upgrade" configuration flag for domainproxy to enforce HTTPS upgrade for GET|HEAD requests as Resolved.Feb 2 2021, 6:02 PM

• bd808 closed subtask T273648: Force HTTPS and set HSTS header to 366 days for profile::wmcs::proxy::static proxies as Resolved.Feb 2 2021, 6:05 PM

• bd808 updated the task description. (Show Details)

• bd808 claimed this task.Feb 2 2021, 6:08 PM

• bd808 moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.

Restricted Application added a project: User-bd808. · View Herald TranscriptFeb 2 2021, 6:08 PM

• bd808 closed this task as Resolved.May 3 2021, 5:08 PM

• bd808 closed subtask T273651: Force HTTPS and set HSTS header to 366 days for profile::toolforge::static proxies as Resolved.

• bd808 updated the task description. (Show Details)

Make Cloud Services shared HTTP proxies enforce TLSClosed, ResolvedPublicActions

Description

Related ObjectsSearch...

Event Timeline

Make Cloud Services shared HTTP proxies enforce TLS
Closed, ResolvedPublic
Actions

Related Objects
Search...