venv was rebuilt and verified the redis package is present.

redis module added to venv config. Config elements added to template file and appropriate variables added to the role manifest.

Reopening since a pfw rule was masked behind an old host entry that was removed.

PFW changes pushed. Closing.

pfw rule change - {T434038}

Just wanted to verify if this is working after the changes that have been made in other tasks over the previous weeks. We can still adjust as needed.

Verified logins are successful. Closing.

Yubikey added to puppet and puppet runs complete. Email sent with documentation and links to ssh config setup and information.

Verified certificate and login is working.

updated iptables and pfw rulesets. will check with folks tomorrow to see if there are any other pfw changes to pool together with this one.

SSL client certificate created and sent via email. Password sent via sms. Civicrm account re-enabled. with existing donor relations permissions. Welcome message sent.

access approved.

Date: Mon, 3 Aug 2026 14:01:24
From: Sheetal Puri
To: Dallas Wisehaupt
Cc: Doris Morgan, Sandra Hust
Subject: Re: Access request for Doris Morgan

Verified the metabase invite has been accepted. Closing.

SSL client certificate created and sent via email. Password sent via SMS. metabase account created and invitation sent. Welcome email sent.

SSL client cert created and sent via email. Password sent via sms. Civicrm account created and tied to a new contact. Welcome email sent.

SSL client cert created and sent via email. Password sent via sms. Civicrm account created and tied to a new contact. Welcome email sent.

Access approved.

Date: Fri, 31 Jul 2026 15:49:40
From: Sheetal Puri
To: Dallas Wisehaupt
Cc: Runjini Murthy, Caitlin Satchell
Subject: Re: Access request for Caitlin Satchell

ssl client certificate revoked. puppet changes pushed. Contact info removed from collab contact list. Metabase account disabled. Superset account disabled. Civicrm account disabled. Verified no ssh or db access or associated cleanup needed.

Access request sent.

SSH public key added to puppet. User account re-enabled in puppet. mariadb grants added to puppet with access to staging and analytics databases. puppet changes pushed out. Mariadb user config file created on frdev1002 and mariadb connections verified to frdb1006 and frdb1007.

Thanks! I'll update you ssh key entry and start the rest of the account setup. I have submitted a request for a yubikey to be ordered for you. We won't be able to complete setup and testing until the yubikey arrives.

Set information on creating an ssh keypair and asking about the status of their yubikey. Will continue when we have that info.

SSL client certificate created and sent via email. Password sent via SMS. CiviCRM account re-enabled. Metabase invite sent.

Access approval.

Updates complete:

MariaDB [silverpop]> CREATE TABLE IF NOT EXISTS silverpop_export_segment_change
    -> (
    ->   entity_id INT UNSIGNED PRIMARY KEY,
    ->   previous_segment INT(11),
    ->   previous_segment_change_date DATETIME
    -> ) COLLATE 'utf8mb4_unicode_ci';
Query OK, 0 rows affected (0.001 sec)

I can clear up some of the communication as I think there is some combination of things going on.

Some changes codified in puppet after testing:

• Additional path file fundraising.pth added into ml puppet manifest

Audit directories created. IP set created and added to civicrm role. Account username/host/etc added to private repo. Audit template file created with credential data. Verified audit dirs created and config file populated with correct info.

wsgi setup is working and making progress, however, we are unable to set the CONFIG_PATH env in a way that is passing it down to the script. I have the service config file in place, apache config, and some test scripts. I have been attempting SetEnv and even SetEnvIf but neither passes the os.environ down to the script. It's possible that we'll want to modify the default config location in the code to reference out standard location. I'll keep digging.

Revoked ssl client cert and pushed out the change. Deactivated metabase account. No other access present.

@Eileenmcnaughton here is the pubkey to pass on to checkout.com:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFAuAcNlpxCkc0w6DZzM19mRVJaK62VbywEAJaSG3Sa fr-tech@wikimedia.org

I have a wsgi config setup and working with basic test scripts on frproto1001.
You can access the test script using: wget localhost:8080/test
If you access wget localhost:8080 you will be hitting the fraud service script but will see the current python errors in /var/log/syslog

iptables rules updated to have frand2001 and frand2002 present where ever fran2001 is.
ssh keys added for frand hosts where fran2001 has them.
pfw policy updates submitted in T430374

These hosts have been built and are testing now. Closing.

@Jclark-ctr Sorry about that, I have moved to to decommissioning. You are clear to do the work.

@Jclark-ctr Sorry about that, I have moved to to decommissioning. You are clear to do the work.

@Papaul @Jhancock.wm Sorry to pull up something on some old machines, but it looks like these two hosts are not on the network after moving to the new rack. I tried to build them out today and am not seeing the dhcp requests come through to frpm2002. I have verified that both are trying to use the 10G interface and the bios is configured correctly.

ssh access confirmed. closing this task.

community crm hosts are using https so no changes needed.

Re-opening for community crm repos on labs and prod hosts.

Email sent.

Going to close this since we have done a chunk of compactions and other work in the last 3 years. Please re-open if it's still an issue we want to investigate.