Tools domains this applies to:

1. tools.wmflabs.org
2. tools-login.wmflabs.org
3. tools-static.wmflabs.org
4. tools-dev.wmflabs.org
5. tools-trusty.wmflabs.org

Using cnames sounds like a great solution. I'm making two changes to the bug title

• Adding bastions, as that's the same problem
• changing 'domain' to 'record' because I'm trying to train people to be pedantic about using the same distinction that designate/horizon uses.

I have cleaned up some bastion-* that were pointing to things redundantly.

There's only three bastion domains left:

1. bastion.wmflabs.org
2. bastion2.wmflabs.org
3. bastion-restricted.wmflabs.org

These should CNAME to primary.bastion.wmflabs.org, secondary.bastion.wmflabs.org and restricted.bastion.wmflabs.org once those three exist.

It turns out you can't CNAME bastion.wmflabs.org while having A records for subdomains, so we'll leave it as is for now. We'll email about the change from bastion.wmflabs.org to primary.bastion.wmflabs.org along with tools bastion changes if/when they happen.

List of domains leftover on wmflabsdotorg:

huggle-rc.wmflabs.org.
tools-checker.wmflabs.org.
tools-bastion-mtemp.wmflabs.org.
tools-dev.wmflabs.org.
tools-trusty.wmflabs.org.
bastion-restricted.wmflabs.org.
tools-static.wmflabs.org.
beta.wmflabs.org.
telnet.wmflabs.org.
tools-login.wmflabs.org.

We can convert tools-checker to checker.tools.wmflabs.org, and delete mtemp bastion at some point. Rest can probably be CNAME'd.

That was after I deleted a bunch of domains - mwds-proxy (mwds is long over), matterirc (RIP) and tools-docker-registry.wmflabs.org (is docker-registry.tools.wmflabs.org)

Change 282442 had a related patch set uploaded (by Yuvipanda):
tools: s/tools-checker.wmflabs.org/checker.tools.wmflabs.org/

https://gerrit.wikimedia.org/r/282442

Change 282442 merged by Yuvipanda:
tools: s/tools-checker.wmflabs.org/checker.tools.wmflabs.org/

https://gerrit.wikimedia.org/r/282442

The latter is in a special org that requires commandline access on labcontrol1001 to manipulate. This makes it unusable for tools admins.

Actually *.wmflabs.org domains can be administered through horizon by administrators of the 'wmflabsdotorg' project.

@Andrew, @yuvipanda: I suggest that, instead of doing this, we briefly remove the records, create domains for each, recreate the records, and then transfer the domains out of wmflabsdotorg into the appropriate projects. And in future, create domains for people (and transfer the domains to the appropriate projects) instead of putting records directly under wmflabs.org where only small number of administrators can do anything. I'd also prefer to move the proxy system towards making domains and transferring them instead of maintaining records under wmflabs.org.

(With your approval I'll go ahead and do that)

Proposed new domains and owning project:

• huggle-rc.wmflabs.org - huggle
• tools-checker.wmflabs.org - tools
• tools-dev.wmflabs.org - tools
• tools-login.wmflabs.org - tools
• tools-trusty.wmflabs.org - tools
• tools-static.wmflabs.org - tools
• beta.wmflabs.org - deployment-prep
• bastion-restricted.wmflabs.org - bastion
• bastion-eqiad.wmflabs.org - bastion (CNAME to bastion.wmflabs.org)

The Cloud-Services project tag is not intended to have any tasks. Please check the list on https://phabricator.wikimedia.org/project/profile/832/ and replace it with a more specific project tag to this task. Thanks!