We are going to setup 2 contint machines on physical hardware as a stop gap for T418109 and migrate jenkins to them.
host names: contint1003.wikimedia.org, contint2003.wikimedia.org
In another step a "zuul-legacy" site will be added to the existing contint machines.
https://gerrit.wikimedia.org/r/q/topic:%22contint-split%22
- add jenkins to APT repo for trixie
- create puppet role/profile to install only jenkins without other CI role
- create jenkins.discovery.wmnet
- install envoy on contint1003/2003
- make puppet changes to allow configuring jenkins proxy config to a new host
- upload change to make the actual switch to new jenkins
- setup rsync in puppet to allow syncing /var/lib/jenkins
- pre-sync /var/lib/jenkins
- empty out /var/lib/jenkins/jobs
- edit firewall to allow existing contint manager to connect to port 1443 (envoy) on new machines
- verify connection to cloud VPS works
- verify connecting from the Internet is not allowed by firewall
- patch puppet to enable jenkins service on contint1003 (and not contint2003)
- remove httpd again
- fix firewalling to connect to envoy in front of jenkins from legacy hosts
- startup jenkins manually the first time, use an ssh tunnel to open the web UI from home and go through the setup
- make jenkins service actually start with systemd
- make envoy listen on IPv6 ----
contint1002 (Manager) contint1003 (New)
[ Debian 11 Bullseye ] [ Debian 13 Trixie ]
+---------------------------+ +---------------------------+
| | | |
| [ Zuul Manager ] --------|== jenkins.discovery.wmnet:1443 (HTTPS) ==> [ FIREWALL ] |
| | | | | |
| v | | v |
| [ Envoy (1443) ] | | [ Envoy (1443) ] |
| | | | | |
| v | | v |
| [ Apache (80) ] | | [ Jenkins (8080)] |
| | | | (Java 21) |
| v | +---------------------------+
| [ Jenkins (8080) ] |
| (Java 17) |
+---------------------------+