Page MenuHomePhabricator

Remove docroot/wikimediafoundation.org/ folder from mediawiki-config
Open, MediumPublic

Description

After deploying the security.txt file in T337949, we discovered that this folder is not serving any purpose. Therefore, we should remove docroot/wikimediafoundation.org/ folder from operations/mediawiki-config, as it should be managed through the WordPress installation.

Event Timeline

sbassett triaged this task as Medium priority.May 28 2024, 4:57 PM
sbassett moved this task from Backlog to In Progress on the MediaWiki-Configuration board.
sbassett added a project: SecTeam-Processed.
sbassett moved this task from Incoming to In Progress on the Security-Team board.
Reedy subscribed.

Are you sure? I think it just hasn't been renamed...

From hieradata/common/mediawiki.yaml

- name: foundation
  priority: 8
  defaults: {}
  vhosts:
    - name: _foundation
      params:
        ensure: present
        server_name: foundation.wikimedia.org
        server_aliases:
          - wikimediafoundation.org
        canonical_name: "On"
        docroot: "/srv/mediawiki/docroot/wikimediafoundation.org"
        declare_site: false
        additional_rewrites:
          early:
            [
              "# extract.php pages redirected to new pages",
              '    RewriteRule ^/fundraising(\.html)?$ %%{}{ENV:RW_PROTO}://%%{}{SERVER_NAME}/wiki/Fundraising [R=301,L]',
              '    RewriteRule ^/index(\.html)?$ %%{}{ENV:RW_PROTO}://%%{}{SERVER_NAME}/wiki/Home [R=301,L]',
              '    RewriteRule ^/GNU_FDL(\.html)?$ %%{}{ENV:RW_PROTO}://%%{}{SERVER_NAME}/wiki/GNU_Free_Documentation_License [R=301,L]',
              "    # Obsolete PDF redirected to current wiki page",
              '    RewriteRule ^/bylaws\.pdf %%{}{ENV:RW_PROTO}://%%{}{SERVER_NAME}/wiki/Wikimedia_Foundation_bylaws [R,L]',
              "    RewriteRule ^/wiki/Donate$ https://donate.wikimedia.org/ [R=301,L]",
            ]
          late: []

wikimediafoundation.org definitely points to Automattic:

$ whois 192.0.66.2

...

# whois.arin.net

NetRange:       192.0.64.0 - 192.0.127.255
CIDR:           192.0.64.0/18
NetName:        AUTOMATTIC
NetHandle:      NET-192-0-64-0-1
Parent:         NET192 (NET-192-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS2635
Organization:   Automattic, Inc (AUTOM-93)
RegDate:        2012-11-20
Updated:        2024-05-21
Comment:        Geofeed https://as2635.network/geofeed.csv
Ref:            https://rdap.arin.net/registry/ip/192.0.64.0

And none of those rewrite rules in the hieradata yaml appear to work for wikimediafoundation.org. Which make sense, given it's externally-hosted. So I'm not sure what any local wikimediafoundation.org config would actually be doing right now.

The wiki was moved to https://foundation.wikimedia.org as per the server_name, and is still used.

The name of the docroot folder is detached from the host that may be using it to serve anything

Ok, so wikimediafoundation.org and foundation.wikimedia.org are just kind of obnoxiously inter-tangled within our config right now. It'd be nice to remove any references to wikimediafoundation.org within the config and rename that docroot folder, but that almost feels like too much effort, especially if there's a chance it will accidentally break something.

If there’s nothing custom in that docroot folder (I haven’t checked as not at a computer atm), we can just update the config to use the standard one, and then drop it from mw-config later

~/git/operations/mediawiki-config/docroot$ ls -al
total 48
drwxrwxr-x 12 reedy reedy 4096 Sep 26  2023 .
drwxrwxr-x 19 reedy reedy 4096 May 23 14:31 ..
drwxrwxr-x  2 reedy reedy 4096 Jul 17  2018 default
drwxrwxr-x  3 reedy reedy 4096 Sep 26  2023 donate
lrwxrwxrwx  1 reedy reedy   13 Aug  9  2018 mediawiki -> mediawiki.org
drwxrwxr-x  6 reedy reedy 4096 May 17 17:34 mediawiki.org
drwxrwxr-x  5 reedy reedy 4096 May 23 13:41 noc
drwxrwxr-x  2 reedy reedy 4096 Jul 17  2018 secure
drwxrwxr-x  4 reedy reedy 4096 May 17 17:34 standard-docroot
drwxrwxr-x  3 reedy reedy 4096 Feb 11  2022 thankyou
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wikibooks.org -> standard-docroot
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wikidata.org -> standard-docroot
lrwxrwxrwx  1 reedy reedy   16 Sep 26  2023 wikifunctions.org -> standard-docroot
drwxrwxr-x  3 reedy reedy 4096 Feb 11  2022 wikimediafoundation.org
lrwxrwxrwx  1 reedy reedy   16 May  1  2019 wikimedia.org -> standard-docroot
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wikinews.org -> standard-docroot
drwxrwxr-x  4 reedy reedy 4096 Dec  9  2022 wikipedia.org
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wikiquote.org -> standard-docroot
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wikisource.org -> standard-docroot
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wikiversity.org -> standard-docroot
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wikivoyage.org -> standard-docroot
lrwxrwxrwx  1 reedy reedy   16 Jan 12  2017 wiktionary.org -> standard-docroot
drwxrwxr-x  4 reedy reedy 4096 Feb 11  2022 wwwportal
~/git/operations/mediawiki-config/docroot$ ls -al wikimediafoundation.org/
total 12
drwxrwxr-x  3 reedy reedy 4096 Feb 11  2022 .
drwxrwxr-x 12 reedy reedy 4096 Sep 26  2023 ..
lrwxrwxrwx  1 reedy reedy   25 Oct 17  2020 503.html -> ../../errorpages/503.html
lrwxrwxrwx  1 reedy reedy   12 Feb 11  2022 images -> ../../images
lrwxrwxrwx  1 reedy reedy   12 Feb 11  2022 static -> ../../static
lrwxrwxrwx  1 reedy reedy    7 Feb 11  2022 w -> ../../w
drwxrwxr-x  3 reedy reedy 4096 May 17 17:34 .well-known
~/git/operations/mediawiki-config/docroot$ ls -al standard-docroot/
total 16
drwxrwxr-x  4 reedy reedy 4096 May 17 17:34 .
drwxrwxr-x 12 reedy reedy 4096 Sep 26  2023 ..
lrwxrwxrwx  1 reedy reedy   25 Jan 12  2017 503.html -> ../../errorpages/503.html
drwxrwxr-x  2 reedy reedy 4096 Sep 26  2023 api
lrwxrwxrwx  1 reedy reedy   12 Feb 11  2022 images -> ../../images
lrwxrwxrwx  1 reedy reedy   12 Feb 11  2022 static -> ../../static
lrwxrwxrwx  1 reedy reedy    7 Feb 11  2022 w -> ../../w
drwxrwxr-x  2 reedy reedy 4096 May 17 17:34 .well-known
reedy@ubuntu64-web-esxi:~/git/operations/mediawiki-config/docroot$ ls -al standard-docroot/api/
total 12
drwxrwxr-x 2 reedy reedy 4096 Sep 26  2023 .
drwxrwxr-x 4 reedy reedy 4096 May 17 17:34 ..
-rw-rw-r-- 1 reedy reedy  944 Sep 26  2023 index.html

Change #1036744 had a related patch set uploaded (by Reedy; author: Reedy):

[operations/puppet@production] hieradata/mediawiki.yaml: Move foundation.wm.o to wm.o docroot folder

https://gerrit.wikimedia.org/r/1036744

/docroot/wikimediafoundation.org/.well-known contains a matrix/server file.

If this is believed to no longer be needed, I recommend first explicitly deleting this in its own commit, with a commit message that explains why.

I had a quick look, but I can't obviously see if the file needs to stay forever. I'm guessing it does, as it is a form of config for the domain for matrix...

{
    "m.server": "wikimediafoundation.ems.host:443"
}

Tagging Infrastructure-Foundations to get a definitive opinion on the matrix/server file mentioned above. I'm not sure why that would still be necessary when wikimediafoundation.org is a WP site fully-hosted at VIP/Automattic these days, but admittedly I don't have the ops knowledge to know for sure.

Codesearch: docroot/wikimediafoundation.org shows where it is used. It is used in the Apache configuration, next to other wikis and their docroots. This is the same Apache config that this task's associated patch is changing (instead of removing).

This means the above file is served from https://foundation.wikimedia.org/.well-known/matrix/server, which is a MediaWiki site that maps 1:1 to the wikimediafoundation.org docroot directory. wikimediafoundation.org from our perspective was indeed publicly renamed to foundation.wikimedia.org, but its internal wiki ID and docroot directory have not (yet) been renamed. I believe this task is about updating that.

Git says the file was added in https://gerrit.wikimedia.org/r/631530 for T261531, where the message and task indicate that its intended address was foundation.wikimedia.org from the start, and presumably powering the current WMF Slack-Element bridge.