Currently the image build process polls mediawiki/core and operations/mediawiki-config repositories. It would be nice if it could also poll /srv/mediawiki-staging/private and /srv/patches on the active deployment host (which it already has access to).
Marking as low priority since T297673: Build MediaWiki images for kubernetes on the deployment servers might make this obsolete.
As a first step I updated the Jenkins trigger to monitor /srv/patches on the releases server and verified that an image build occurs when it is updated. This directory is rsync'd from the deploy server every 10 minutes. We can reduce the interval to make it more responsive to patch updates if desired.
Change 749566 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):
[operations/puppet@production] profile::releases::mediawiki::private: Enable timer and alter target directory
Change 751481 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):
[operations/puppet@production] Define git::daemon class and use it in profile::mediawiki::deployment::server
Change 749566 abandoned by Ahmon Dancy:
[operations/puppet@production] profile::releases::mediawiki::private: Enable timer and alter target directory
Reason:
Going with a different approach
Change 751481 merged by Dzahn:
[operations/puppet@production] Define git::daemon class and use it in profile::mediawiki::deployment::server
Change 751805 had a related patch set uploaded (by Dzahn; author: Majavah):
[operations/puppet@production] P:mediawiki::deployment: fix ferm syntax
Change 751805 merged by Dzahn:
[operations/puppet@production] P:mediawiki::deployment: fix ferm syntax
deployed Ahmon's change, first only on codfw, which was good because there was a little fix needed in the ferm rules (see above, thanks Majvah)
after this things looked fine. then also deployed to deploy1002. Now there is the new git-daemon running on both of them:
● git-daemon.service - Git daemon Loaded: loaded (/lib/systemd/system/git-daemon.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2022-01-05 20:58:43 UTC; 8min ago Main PID: 21309 (git-daemon)
netstat -tulepn | grep git tcp 0 0 0.0.0.0:9418 0.0.0.0:* LISTEN 499 7933471 21309/git-daemon tcp6 0 0 :::9418 :::* LISTEN 499 7933472 21309/git-daemon
and firewall rules allow only releases servers to connect:
root@deploy2002:/# iptables -L | grep git ACCEPT tcp -- releases1002.eqiad.wmnet anywhere tcp dpt:git ACCEPT tcp -- releases2002.codfw.wmnet anywhere tcp dpt:git
This is for both deploy1002 and deploy2002 now.
Thanks @Dzahn. That allowed me to configure releases-jenkins to poll git://deployment.eqiad.wmnet/srv/patches and git://deployment.eqiad.wmnet/srv/mediawiki-staging/private and respond to new commits in a timely manner. I verified that it works by making test commits on the deploy server.