After moving gerrit behind the cdn (T411895) it seems like pushing (git-review) over https is blocked by generic requestctl actions. git-review fails with:
Please set a user-agent and respect our robot policy
Turnilo/Superset also list some requestctl actions which are triggered on Gerrit: https://w.wiki/Hp7S
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| gerrit.wm.o: allow library-default UAs | CDanis | operations/puppet | production | +6 -2 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | Dzahn | T411895 gerrit behind CDN | |||
| Resolved | Jelto | T417156 Pushing to gerrit over http is blocked by generic rate limiting |
I was able to reproduce the error:
Problems encountered installing commit-msg hook
The following command failed with exit code 103
"GET https://gerrit.wikimedia.org/tools/hooks/commit-msg"
-----------------------
Please set a user-agent and respect our robot policy https://w.wiki/4wJS. See also https://phabricator.wikimedia.org/T400119.So even the GET requests fails, probably using the python-requests useragent (see code).
I was not able to find a corresponding requestctl action but a haproxy config in puppet: https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/refs/heads/production/modules/profile/templates/cache/haproxy/tls_terminator.cfg.erb#422.
I think we either need a proper user agent in git-review or add some exception like `!is_gerrit" in the haproxy config.
Change #1238751 had a related patch set uploaded (by CDanis; author: CDanis):
[operations/puppet@production] gerrit: allow library-default UAs
Change #1238751 merged by CDanis:
[operations/puppet@production] gerrit.wm.o: allow library-default UAs
This should be fixed now -- I did some quick checks but further confirmation appreciated :)
Confirmed working!
I went to https://gerrit.wikimedia.org/r/settings/#HTTPCredentials and generated a new password
Re-cloned operations/puppet via https with commit hook (https://gerrit.wikimedia.org/r/admin/repos/operations/puppet,general) which asks you for the password
Then pushed this test commit: https://gerrit.wikimedia.org/r/c/operations/puppet/+/1238796
for the record; if someone wants to test or generally push via https if ssh ever has a problem
What I actually had to do to switch the remote for git-review to https:
reclone repo; then edit .gitreview exactly like this, with the /r and the scheme but NOT the port in there:
[gerrit] host=gerrit.wikimedia.org/r project=operations/puppet.git scheme=https defaultbranch=production
git update-index --skip-worktree .gitreview to ignore the local change to .gitreview in the repo.
git-review -s to re-do the setup
git remote -v then shows the format like gerrit https://user@gerrit.wikimedia.org/r/operations/puppet.git (push) and when you push get asked for the passphrase that you generate above.