The plan is to reimage an unpooled payments server (either 1004 or a codfw hosts) and use that to live-test with internal test traffic, to validate payments-wiki with PHP 7.0 etc.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Jgreen | T185013 EPIC: migrate fundraising off of Debian Jessie | |||
| Resolved | Jgreen | T202290 test and deploy payments on Debian Stretch/PHP7.0 | |||
| Resolved | • Cmjohnson | T202439 check cabling/config for payments1004 DRAC interface | |||
| Restricted Task | |||||
| Resolved | Ejegg | T184460 Upgrade PaymentsWiki to Mediawiki 1.31 (new LTS) | |||
| Resolved | None | T218661 Adjust codfw payments servers to log to frlog1001 as well as bellatrix for live mw upgrade test | |||
| Resolved | Jgreen | T218667 upgrade payments2001 & 2002 to stretch | |||
| Resolved | Jgreen | T218669 Reconfigure mariadb for codfw payments cluster |
Event Timeline
Comment Actions
We've decided to use payments1004 for testing, noting that it also hosts scripts for some manual batch payment processing stuff, and we're ok with testing those on PHP 7.0 at the same time.
Comment Actions
@Ejegg after adding missing php-mbstring I was able to to make a $3 credit card donation through the rebuilt payments1004, so it's ready for more testing.
Comment Actions
Possibly-significant version changes from Jessie to Stretch:
mariadb 10.0.37 -> 10.1.37
memcached 1.4.21 -> 1.4.33
php5-memcache 3.0.8 -> 3.0.9
php5-memcached 2.2.0 -> 3.0.1
Comment Actions
Looks like the php-memcache upgrades shouldn't matter. Our filters are using memcache via Mediawiki's BagOStuff interface, which has its own PHP class to talk directly to the daemon without using either of the PHP libs.
Comment Actions
OK, I'm seeing the loading errors in Chrome now. It's more images inlined into CSS by ResourceLoader as data: urls. This time, it's from core MediaWiki.
So we can either pile some patches on top of Mediawiki Core to unminify them, or allow data: urls in image-src. I'm firmly in favor of allowing data: in image-src. It seems an especially improbable attack vector for a locked-down wiki like payments, and in any case is no less secure than the current zero-CSP situation.
Comment Actions
I've started a planning checklist/document here https://collab.wikimedia.org/wiki/2019-03-payments-service-upgrade
Comment Actions
We've worked out all the identified upgrade-related issues with the test cluster, and are ready to upgrade the main cluster.