From https://phabricator.wikimedia.org/T86951#983620

In T86951#983620, @yuvipanda wrote:

After some more digging...

https://gerrit.wikimedia.org/r/#/c/185428/ removed the ferm rule from parsoid, because prod parsoid hosts don't have base::firewall included, and we thought we hada removed all vestiges of base::firewall from beta with T86143. However, it turns out that base::firewall is included by contint::firewall::labs which is included by role::ci::slave::labs::common, on parsoid as well as other *oid hosts on betalabs. So that commit actually broke them all, which is sad. To unify prod and beta again, we'll have to either: add base::firewall to parsoid hosts or remove them from beta. I'll discuss this inside ops and remember to keep track.

I've fixed this now by just adding a common ferm rule to all parsoid hosts opening up port 8000. I'm also adding monitoring now to all *oid hosts to make sure they are still accessible (T87063)