Page MenuHomePhabricator

Terminate Thumbor with SSL
Closed, InvalidPublic

Description

In order to allow having Mediawiki talk directly to Thumbor for thumb.php, Thumbor needs to be available behind a secure connection. In the public thumbnail scenario that SSL termination is done at the Swift level, which is bypassed by thumb.php.

Related Objects

Event Timeline

@fgiunchedi I'd like to add private wiki support for Thumbor as a Q3 goal. Will you have the bandwidth to handle this task next quarter?

@Gilles if the scope is just securing thumbor with https then certainly. Do you envision any other help from ops besides e.g. build/deploy ?

I don't expect any other work, no. This task really is only about adding SSL termination to Thumbor, so that Mediawiki can talk to it directly securely, since in the private wiki/thumb.php scenario we're not going through the Swift proxy.

fgiunchedi removed a project: User-fgiunchedi.

Thumbor ownership has moved to service operations, unassigning

TLS on haproxy it is then:)

We're trying to standardize TLS termination on envoy, and I think we should concentrate on moving thumbor to kubernetes next.

@Joe we will be moving towards this direction

Removing task assignee due to inactivity, as this open task has been assigned for more than two years. See the email sent to the task assignee on February 06th 2022 (and T295729).

Please assign this task to yourself again if you still realistically [plan to] work on this task - it would be welcome.

If this task has been resolved in the meantime, or should not be worked on ("declined"), please update its task status via "Add Action… 🡒 Change Status".

Also see https://www.mediawiki.org/wiki/Bug_management/Assignee_cleanup for tips how to best manage your individual work in Phabricator.

TheDJ subscribed.

I'm speculating here that this will be automatically fixed by the thumbor migration, which I assume already will do ssl termination ?

Closing this ticket as we will get it automatically as part of the Kubernetes migration.