Page MenuHomePhabricator
Create Task
Maniphest T421751

Allow SFTP outbound requests from civi1002/civi2002 to deployment.eqiad.wmnet
Closed, ResolvedPublic
Actions

Description

Overview:

As part of the Donor ID project. We need to be able to push an exported file from civi1002/civi2002 via SFTP over to deployment.eqiad.wmnet.

Details

@CDanis sent over the following:

deploy1003.eqiad.wmnet has address 10.64.16.93
deploy1003.eqiad.wmnet has IPv6 address 2620:0:861:102:10:64:16:93
deploy2003.codfw.wmnet has address 10.192.57.6
deploy2003.codfw.wmnet has IPv6 address 2620:0:860:12c:10:192:57:6
deploy2002.codfw.wmnet has address 10.192.32.7
deploy2002.codfw.wmnet has IPv6 address 2620:0:860:103:10:192:32:7
The active one is whatever deployment.eqiad.wmnet resolves to, currently deploy1003, but it changes twice a year

Ideal delivery date

ASAP - we have a test run tomorrow 😅

Details

Other Assignee
Dwisehaupt
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
deployment_server: fundraising-data-uploader roleCDanisoperations/puppetproduction+48 -2
Customize query in gerrit

Related Objects
Search...

Event Timeline

jgleeson created this task.Mar 30 2026, 5:29 PM
jgleeson renamed this task from Allow SFTP outbound requests from civi1002 to deployment.eqiad.wmnet to Allow SFTP outbound requests from civi2001 to deployment.eqiad.wmnet.
jgleeson updated the task description. (Show Details)
jgleeson added a parent task: T416948: CiviCRM should export a CSV that can be used in a MediaWiki maintenance script.Mar 30 2026, 5:42 PM
jgleeson added a project: Fundraising Sprint - Floor is Lava.Mar 30 2026, 7:41 PM
jgleeson moved this task from Backlog to Doing on the Fundraising Sprint - Floor is Lava board.
SBurnett-WMF subscribed.Mar 30 2026, 7:46 PM

Dallas will take a run at it

Dwisehaupt triaged this task as High priority.Mar 30 2026, 7:47 PM
Dwisehaupt added a project: fundraising-tech-ops.
AKanji-WMF moved this task from Triage to Current Sprint on the Fundraising-Backlog board.Mar 30 2026, 7:47 PM
Dwisehaupt moved this task from Current Sprint to FR-Ops on the Fundraising-Backlog board.Mar 30 2026, 7:48 PM
Dwisehaupt claimed this task.Mar 30 2026, 8:38 PM
Dwisehaupt added a project: ServiceOps.
Dwisehaupt moved this task from Triage to In Progress on the fundraising-tech-ops board.
Dwisehaupt added subscribers: cmooney, Jgreen, Dwisehaupt.

iptables rules are up and working on the fr-tech side. @cmooney helped to verify that the packets are making it through to the deployment server. However, it looks like there is an iptables rule needed on the deployment server to allow for these connections.

Service Ops: It looks like we need iptables rules added to the deployment server role to allow the 2 civicrm hosts to be able to contact it. The names/IPs are:

  • civicrm-eqiad.wikimedia.org - 208.80.155.17
  • civicrm-codfw.wikimedia.org - 208.80.152.232
Dwisehaupt renamed this task from Allow SFTP outbound requests from civi2001 to deployment.eqiad.wmnet to Allow SFTP outbound requests from civi1002/civi2002 to deployment.eqiad.wmnet.Mar 30 2026, 8:44 PM
Dwisehaupt updated the task description. (Show Details)
CDanis added a comment.Mar 30 2026, 8:56 PM

Apologies, I'll write a host firewall patch tomorrow morning.

gerritbot added a comment.Mar 31 2026, 3:51 PM

Change #1255036 had a related patch set uploaded (by CDanis; author: CDanis):

[operations/puppet@production] deployment_server: fundraising-data-uploader role

https://gerrit.wikimedia.org/r/1255036

gerritbot added a project: Patch-For-Review.Mar 31 2026, 3:51 PM
gerritbot added a comment.Mar 31 2026, 3:55 PM

Change #1255036 merged by CDanis:

[operations/puppet@production] deployment_server: fundraising-data-uploader role

https://gerrit.wikimedia.org/r/1255036

JMeybohm removed a project: ServiceOps.Mar 31 2026, 4:05 PM
JMeybohm subscribed.

Removing the ServiceOps tag, since this is being handled already. Feel free to add us back if you need additional hands.

Maintenance_bot removed a project: Patch-For-Review.Mar 31 2026, 4:32 PM
Dwisehaupt added a comment.Mar 31 2026, 8:47 PM

Outbound requests are successful from the transport side. Leaving to @jgleeson to close as needed.

jgleeson added a comment.Apr 1 2026, 1:48 PM

Working great! thanks all

jgleeson moved this task from Doing to Done on the Fundraising Sprint - Floor is Lava board.Apr 1 2026, 1:49 PM
CDanis closed this task as Resolved.Apr 1 2026, 6:54 PM
Dwisehaupt moved this task from In Progress to Done on the fundraising-tech-ops board.Apr 2 2026, 11:33 PM
Damilare mentioned this in T420783: Fundraising Sprint F - 2026 - Priorities.Apr 8 2026, 12:46 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits