Maniphest T307510

Update tls proxy config for Bullseye
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	bking
	May 3 2022, 9:05 PM

Tags

Referenced Files

None

Subscribers

Description

The version of nginx that ships with Bullseye does not support the $ssl_ecdhe_curve directive.

As the Swift team did, we need to update our puppet code to disable this directive on Bullseye hosts.

Details

	Subject	Repo	Branch	Lines +/-
	tlsproxy: manage ssl_ecdhe_curve internally	operations/puppet	production	+23 -52
	elastic: enable/disable ssl_ecdhe_curve based on OS version	operations/puppet	production	+49 -31

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		None	T248925 Make MediaWiki release tarball compatible with PHP 8.0
		Resolved		Jdforrester-WMF	T300463 Make PHP 8.0 voting on MW master
		Resolved		None	T283275 Make MW master tests pass on PHP 8.0
		Resolved		Reedy	T268861 CirrusSearch uses Elastica's Match class
		Resolved		Reedy	T268863 Translate uses Elastica's Match class
		Resolved		matthiasmullie	T268866 WikibaseMediaInfo uses Elastica's Match class
		Invalid		None	T268864 WikibaseCirrusSearch uses Elastica's Match class
		Resolved		Reedy	T268865 WikibaseLexemeCirrusSearch uses Elastica's Match class
		Resolved		EBernhardson	T271777 Bump rufin/elastica (and related libraries) to versions that support PHP 8.0
		Resolved		Gehel	T263142 [EPIC] Upgrade Elasticsearch to version 7.10
		Stalled		None	T302086 Set scap minimum python version to 3.7
		Resolved		None	T247045 Migrate all of production metal and VMs to Buster or later
		Declined		None	T244736 Migrate Elasticsearch to Debian Buster
		Resolved		None	T306068 Cloud VPS "deployment-prep" project Stretch deprecation
		Resolved		taavi	T278641 Migrate deployment-prep away from Debian Stretch to Buster/Bullseye
		Open		None	T291916 Tracking task for Bullseye migrations in production
		Resolved		bking	T289135 Upgrade Cirrus Elasticsearch clusters to Debian Bullseye
		Resolved		bking	T299797 Deploy new bullseye elastic cluster nodes on deployment-prep
		Resolved		bking	T307510 Update tls proxy config for Bullseye

Event Timeline

bking created this task.May 3 2022, 9:05 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 3 2022, 9:05 PM

bking added a parent task: T299797: Deploy new bullseye elastic cluster nodes on deployment-prep.May 3 2022, 9:05 PM

Change 788815 had a related patch set uploaded (by Bking; author: Bking):

[operations/puppet@production] elastic: enable/disable ssl_ecdhe_curve based on OS version

https://gerrit.wikimedia.org/r/788815

gerritbot added a project: Patch-For-Review.May 3 2022, 10:20 PM

Change 789559 had a related patch set uploaded (by Gehel; author: Gehel):

[operations/puppet@production] tlsproxy: manage ssl_ecdhe_curve internally

https://gerrit.wikimedia.org/r/789559

Change 788815 merged by Bking:

[operations/puppet@production] elastic: enable/disable ssl_ecdhe_curve based on OS version

https://gerrit.wikimedia.org/r/788815

Gehel closed this task as Resolved.Jul 20 2022, 3:06 PM

Change 789559 abandoned by Gehel:

[operations/puppet@production] tlsproxy: manage ssl_ecdhe_curve internally

Reason:

we don't support stretch anymore

https://gerrit.wikimedia.org/r/789559

Maintenance_bot removed a project: Patch-For-Review.Feb 23 2024, 4:30 PM