https://github.com/wikimedia/operations-puppet

sort by:
Revision Author Date Message Commit Date
1b9cebf Add 'udplog' to $nova_dnsmasq_aliases Corresponding change in production: I33d3e4a58. Change-Id: I2a25eec4fa9744e1127efd46186f9d92d4cfd045 13 August 2014, 14:38:20 UTC
ca46a83 Stop forwarding udp2log's EventLogging data to universities Change-Id: I628545762d0c33a184571137c6b55bbd5636de24 13 August 2014, 13:30:37 UTC
fcf5123 puppetmaster: fix typo in scripts.pp Change-Id: Icdf8c04ba4daeedf9a612d4ee4397ec435f4b2d5 Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org> 13 August 2014, 10:27:42 UTC
9115a16 puppetmaster: make reimaging servers easier. Change-Id: Id898cce1f634f4ae2015173f15e95ab94d60fc43 Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org> 13 August 2014, 10:13:50 UTC
49ea85f osm planet import/sync, make sure we use hstore hstore is a key/value store in postgresql that is used by openstreetmap as a tagging scheme. Pass the -k parameter to osm2pgsql to use it Change-Id: I037057ea6e475dbac5f3ff424b72464f94e3f413 13 August 2014, 06:57:49 UTC
6751a5a tendril: add access for ldap groups ops and nda As the wmf is organisation specific and others also need access, the restriction should be replaced with the groups ops and nda. The group nda was newly created for cases like this. This still retains access for the wmf group because we don't know who from that group needs access. Change-Id: I1e8ccb91ee9985e0a6cf3076f31655bf1e823a0e 13 August 2014, 01:42:26 UTC
79b1c6e Remove mw1053 from mediawiki-installation dsh Scap etc. doesn't work there atm... Change-Id: Ica160668160dd2950b63378ccac454d6a2f1054c 12 August 2014, 23:28:17 UTC
2cad95b Fix kafka & udp2log filtering of ZERO The \d{3}-\d{2} syntax is incompatible with future plans for this field, and might break in some cases going forward. Expanding it to 'zero=\d' Change-Id: I121bb6c15767bbbade7f8cb10745ef75e3592bc2 12 August 2014, 20:10:37 UTC
f464c90 varnish/zero.inc.vcl.erb - retab Change-Id: If814c4307349ff412dd2268c6e8833702f9b24e4 12 August 2014, 19:50:13 UTC
caf701d New admin group for eventlogging troubleshooting. RT 7769 (nuria) & 8034 (qchris) And Nuria has had access to vanadium for the same things. This rolls it into one nice setup. Change-Id: Iecbea59a8f294167a8d2ca385609e1d4b2f0f46c 12 August 2014, 17:02:38 UTC
10cb6ca remove aluminium from sites.pp and dhcp config Change-Id: I9fe8a306ff9360acc89a98eca88826ddd784e5f7 12 August 2014, 16:39:22 UTC
0704a1e salt-minion service should fail to start if master rejects key salt-minion bails if the Salt master rejects the minion's key, but by this point the Upstart job has emitted the start/running signal, so Puppet thinks the service is up, and it executes things that require it, like various Trebuchet operations. These usually hang. So, perform a salt-call test.ping before starting salt-minion. Change-Id: I78da7fec86b7991f7c1119fa59dde0471a4471cb 12 August 2014, 15:56:38 UTC
76a2c38 Sanitarium sysv script + basic monitoring. Change-Id: I67c91975317ba02ec51912a6afbd8ffa3aa13f12 12 August 2014, 14:57:45 UTC
75bcddf MariaDB 10 in the Sanitarium (pre-labsdb) Change-Id: I26b03bbded727f5a5e4e901af808a0617577bfe5 12 August 2014, 13:51:36 UTC
b996e51 Merge "Small lint-fix for hhvm.pp" into production 12 August 2014, 12:40:35 UTC
eb75ea1 Make permanent some labsdb TokuDB settings applied with SET GLOBAL. Change-Id: Ib4e70b91cc871bdf5f3e6dd00a575451363181f6 12 August 2014, 11:50:42 UTC
a9eb347 Small lint-fix for hhvm.pp Change-Id: I3130327a5210d708b5ff41409424f9c9647e9900 12 August 2014, 11:42:10 UTC
18a3983 Enable mathoid deployment::target on beta This was needed anyway Change-Id: Idd36f111ee2fb47a0c602b6839cba716f5bd47b3 12 August 2014, 11:04:40 UTC
c839164 osm: Enable ganglia diskstat plugin Evaluate its usage in the osm databases Change-Id: I2e7a028047ea116068cf64341e049d1afee15a0a 12 August 2014, 08:13:42 UTC
6433773 Merge "enable gelf logging from hadoop workers" into production 11 August 2014, 21:41:50 UTC
37be54a Merge "rm old puppet_disabled check,replaced by new chk" into production 11 August 2014, 21:39:32 UTC
5e9fad6 rm old puppet_disabled check,replaced by new chk the new "puppet run" check should also detect those disabled puppet agents, so keeping the old one would just cause duplicate alarms and longer/slower Icinga config Change-Id: I46d8e23ea0a96395252dc9323cb24c49f70614cf 11 August 2014, 21:37:53 UTC
5529265 enable gelf logging from hadoop workers Change-Id: Ifd06469ccc5fbb5a603ef59f8c7458cf3e24049a 11 August 2014, 21:35:57 UTC
8df79cd Merge "Hadoop role: depend on JARs for GELF, pass param" into production 11 August 2014, 21:32:21 UTC
7d8c357 Hadoop role: depend on JARs for GELF, pass param * rework of https://gerrit.wikimedia.org/r/#/c/140677/ * logstash-gelf.jar is now packaged as liblogstash-gelf-java Change-Id: I129ee2c00d174c4c190321040afc52c65da38581 11 August 2014, 21:26:59 UTC
f73da31 Merge "remove deprecated config related to fundraising/aluminium" into production 11 August 2014, 21:19:00 UTC
3f6b6e3 remove deprecated config related to fundraising/aluminium Change-Id: Iade7f550838fa59ae27fefe0c9b1998798d26bd5 11 August 2014, 21:15:41 UTC
bc986f0 Zero: updated 436-01 436-04 - both unified, both support https Change-Id: I636d965f975cca539354d61d6c4494566f302bf3 11 August 2014, 21:13:00 UTC
835da31 Zero: 436-06 added to unified and added https Change-Id: I0ef959f459262fdca6c54110ebcef82414f4a738 11 August 2014, 21:07:31 UTC
e053aa3 Tools: Install libgd-gd2-perl Bug: 67199 Change-Id: I7c5c3f1a709541126cd1ce711d36b5df891df292 11 August 2014, 21:03:49 UTC
a4cf953 Tools: Sort package lists alphabetically Change-Id: I80ba3286448913880c23468e653458b48422a146 11 August 2014, 20:56:32 UTC
7ed6935 Tools: Install php5-imagick Bug: 69078 Change-Id: I2805392b149c8e23a5cd5ebe4c41a351e19d06ff 11 August 2014, 20:52:01 UTC
fe78c3a Tools: Remove lint This leaves a few spots where puppet-lint complains about lines with more than 80 characters, but changing those just for the sake of it would be cumbersome and needs to be addressed by a proper refactoring. Change-Id: Iac4fa7cedcb17a01fe99099c0305dc24c2c5017e 11 August 2014, 20:25:48 UTC
47da96e Logstash filter changes to support messages from Hadoop * Refactor of https://gerrit.wikimedia.org/r/#/c/140623 * Incorporated feedback from BDavis to eliminate leading underscores and conform with Monolog notions of "type" and "channel" * Only affects messages where type="Hadoop" Change-Id: I78e6e2a3a8bafbda76c7f6dec55a69233037f2b6 11 August 2014, 19:40:55 UTC
257af3a apache: set a default 5-second GracefulShutdownTimeout The GracefulShutdownTimeout specifies the maximum time servers should continue to run after receiving a graceful-stop signal and waiting for client connections to close. The default, as I discovered is 0 -- which means wait indefinitely! I strongly suspect that the reason we don't set this is that it was added in Apache 2.2, whereas our Apache configs predate that. Change-Id: I4d8fd75025e588fcb3cc486c2c473a3c19748c4e 11 August 2014, 18:59:04 UTC
ac3759d Merge "Tools: Add some i386 compat packages to exec nodes" into production 11 August 2014, 14:46:14 UTC
41bae0d Tools: Add some i386 compat packages to exec nodes Required for running Android build tools. Change-Id: Id26e52db81b2f700483100cca972d80b83397b1e 10 August 2014, 18:33:13 UTC
03a1cf3 Merge "Tools: Use apt::repository instead of file resources" into production 10 August 2014, 12:40:14 UTC
2a3c482 Merge "zuul: typo in role::zuul::merger description" into production 10 August 2014, 12:24:10 UTC
3d3b897 Merge "contint: analytics packages are not on Trusty yet" into production 10 August 2014, 12:22:53 UTC
d398ad9 Merge "OTRS - use apache::site instead of file resource" into production 10 August 2014, 12:10:46 UTC
b1c1d91 Merge "noc.wm - use apache::site and move to templates" into production 10 August 2014, 11:32:16 UTC
a2f0ef6 Merge "planet - use ssl_ciphersuite" into production 10 August 2014, 11:06:49 UTC
848813e Merge "gerrit apache template - qualify vars" into production 10 August 2014, 11:02:44 UTC
239b04b Merge "role/parsoid - minor lint fixes" into production 10 August 2014, 10:58:07 UTC
38b373c Merge "sudo.pp - minor linting fixes" into production 10 August 2014, 10:54:31 UTC
94b6171 Merge "gerrit - retab apache template" into production 10 August 2014, 10:51:25 UTC
ab1076b role/parsoid - minor lint fixes Change-Id: Id2541ffea57249cb488329bd7e7a37fb307f600e 09 August 2014, 20:21:38 UTC
2b603b3 sudo.pp - minor linting fixes the extra whitespace causes lint errors such as 'two-space soft tabs not used' 'trailing whitespace found' and ensure should always be first Change-Id: I6221817f6ca2f153b9b15f3ebf46cf07eea5e290 09 August 2014, 20:09:52 UTC
9ceb6e4 planet - use ssl_ciphersuite Change-Id: I9d4b01fdd82a0a97beb899c3e5c6dbd26d8d384f 09 August 2014, 20:05:17 UTC
7261081 gerrit apache template - qualify vars Change-Id: I88cf67379e3b66719e86d555eaba9d58f91ebbdc 09 August 2014, 19:50:54 UTC
5594692 gerrit - retab apache template Change-Id: I7740bcb7fd2577a6b167bb0ed97ba50d063f9c75 09 August 2014, 19:48:25 UTC
07a7fa8 noc.wm - use apache::site and move to templates noc.wm.org - use apache::site and move the config to templates have proper symlinks from sites-enabled again Change-Id: I0f73a15be45c8232c8bb80b10a6c78b2b11191d0 09 August 2014, 19:36:13 UTC
9c28326 OTRS - use apache::site instead of file resource use apache::site and move the Apache config from ./files/apache to ./templates/apache have proper symlinks from sites-enabled again Change-Id: Ide19b654762fcc396358d3316609b73f1361b9ed 09 August 2014, 19:32:32 UTC
de7e2c6 contint: analytics packages are not on Trusty yet We have some packages installed to let us compile some Analytics libraries. The jobs need to be rewritten to clone the dependencies instead of using the packages from apt. Since that is breaking puppet on Trusty instance, don't install them there. The Jenkins jobs will be rewritten eventually. Change-Id: I47bbac3b477e5047c2642976163e448d9588711b 09 August 2014, 18:47:15 UTC
f11a981 zuul: typo in role::zuul::merger description merVer -> merGer Change-Id: I4644866a7193a24af6546095b56bee019c40df7e 09 August 2014, 18:38:48 UTC
852a8e1 Merge "diamond: Enable stats collection for quarry" into production 09 August 2014, 17:04:39 UTC
ad76eb7 Merge "kibana: add access for ldap groups ops and nda" into production 09 August 2014, 17:02:51 UTC
f9617ca kibana: add access for ldap groups ops and nda this is logstash As the wmf is organisation specific and others also need access, the restriction should be replaced with the groups ops and nda. The group nda was newly created for cases like this. This still retains access for the wmf group because we don't know who from that group needs access. RT: 7724 Change-Id: I0a41ba0dbbfcb3a7e887d9e4d843350ae23bb134 09 August 2014, 17:02:04 UTC
f0cd2c3 Merge "allow LDAP groups 'ops' and 'nda' login on icinga" into production 09 August 2014, 16:59:11 UTC
27de4ae allow LDAP groups 'ops' and 'nda' login on icinga RT: 7724 Change-Id: I17216d44088715c45060904b1127a0a17a29658b 09 August 2014, 16:57:43 UTC
d82345a diamond: Enable stats collection for quarry Change-Id: I22b509feee79c87c789141af83f303fc8045d6d1 09 August 2014, 16:56:14 UTC
7addf7f add (and use) shell_exports() and apache::vars * Add useful shell_exports() from MediaWiki-Vagrant; renders a Puppet hash into shell exports * Not confined to Apache module or a template because it will be useful in other places. * Add apache::env for declaring Apache envvars. * Use in MediaWiki module Change-Id: I84183eb61df3921d9e2f2034648e7d61351f1a5d 09 August 2014, 16:31:52 UTC
f9420ee Quarry: Add sqlalchemy as an explicit dependency Change-Id: Ice5a2981ebe76e3e3fca573f8b1d13f8f23abfa8 09 August 2014, 15:41:29 UTC
ed53966 Merge "graphite: add access for ldap groups ops and nda" into production 09 August 2014, 15:37:10 UTC
fe46ea3 Merge "Allow ldap "nda" users to access ishmael" into production 09 August 2014, 15:17:38 UTC
ac0e6be beta: puppet rebase script Script to rebase local checkout of operations/puppet.git on origin/production branch. The script tries to preserve local changes in the form of cherry-picks, local-only commits and dirty working copy files. Also adds a cron job to run the script once an hour. Messages from the update are logged to /var/log/git-sync-upstream.log and managed with logrotate. If this proves to be mostly stable in beta it might be nice to offer it as an optional class for any labs hosts using role::puppet::self. Bug: 66683 Change-Id: I8072780a48e27d3d4271a82660417d711b8e2082 09 August 2014, 14:01:20 UTC
60c01d2 beta: Fix IP mapping for stream.wmflabs.org At the moment, DNS requests from within Labs for stream.wmflabs.org get resolved to deployment-eventlogging02, while they should resolve to deployment-stream, the instance bound to the external IP. Change-Id: I586df59274946fb1dfef7edaf488b0cb798ae4ca 09 August 2014, 12:34:33 UTC
290a657 Merge "apache::def: port to env-{enabled,disabled}" into production 09 August 2014, 11:25:36 UTC
a5e0131 replicate information_schema_p from sanitarium to labsdb Change-Id: I514c676208f86d82f242c8d619570415eef1ff88 09 August 2014, 06:48:17 UTC
c21ee30 switch rcstream to source hash LVS scheduling Change-Id: I9b83a4c570d3a22e9e2cab959044746324db104e 09 August 2014, 06:40:55 UTC
a91f8bc HHVM: simplify logging options * native_stack_trace is true by default; so remove. * error_reporting_level is set to HPHP_ALL by default. Additional fixes: * Remove unneeded dir (/usr/share/pear) from include path. * Make runtime dirs run before the service Change-Id: I05dd12a8cc141eba05448c8d6226462048d04cf9 09 August 2014, 04:15:15 UTC
26bbb68 apache::def: port to env-{enabled,disabled} Change-Id: I4316c0cbb47f2ddd1b6e82fbd68b36e9700fa1cf 09 August 2014, 02:36:01 UTC
4f699a8 Remove mw1130 from mediawiki-installation dsh as it's offline Change-Id: I3b10749afb4ef63b4f21e3cc887428745c02e827 08 August 2014, 22:41:05 UTC
bd0681b Distribute via.inc.vcl to Varnishes (fixup for commit 36296853) Change-Id: I3eafe8b401a27450a08de79fc9d06a78062a9f47 08 August 2014, 22:01:34 UTC
3629685 Log when Internet.org in X-Analytics with proxy tag Change-Id: Iefd0f9042b138e4dacb9fe810f352e60160a64bc 08 August 2014, 21:45:36 UTC
000cdef sync-common-file is no more, use sync-file /usr/local/bin/updateinterwikicache: line 11: /usr/local/bin/sync-common-file: No such file or directory Change-Id: Ie6d7c509e9e17465d870580cc6f5c15118cd1809 08 August 2014, 21:37:42 UTC
c5615b1 RCStream: use recommended Nginx config for WebSockets Use the configuration recommended by <https://github.com/miguelgrinberg/Flask-SocketIO/blob/9ed9b070cccd98be88ce3b3de0f684e4601924db/docs/index.rst>. Change-Id: Ie4056af6ad45f902f3a4365bca3cc5dbea46a0f4 08 August 2014, 18:01:50 UTC
0865888 allow public option setting in phab Change-Id: I85136e3e263ed89b9eb4fdc59c813b00f7c58cbf 08 August 2014, 17:41:18 UTC
9138a98 graphite: add access for ldap groups ops and nda As the wmf is organisation specific and others also need accessi, the restriction should be replaced with the groups ops and nda. The group nda was newly created for cases like this. This still retains access for the wmf group because we don't know who from that group needs access. RT: 8102 Change-Id: Ie621a1f2732fcad872b8b84396b02cc1d4563de5 08 August 2014, 17:23:52 UTC
10a3060 Allow ldap "nda" users to access ishmael also users in the "ops" group (for consistency) Untested Change-Id: I9853b77a8f2b38f3aedc6c2c82a279f7510ed255 08 August 2014, 16:44:53 UTC
8482c73 wmflib: add apply_format() Applies a format string to each element of an array. For things like: apply_format('/etc/apache2/%s-enabled', ['sites', 'mods', 'conf']) Also useful for formatting arrays of numbers or IPs. Unlike map(), doesn't require the future parser, and won't kill performance. :) Tested on vagrant. Change-Id: I2323319baefb3274cc42eb40a14b3ad57586b042 08 August 2014, 14:04:18 UTC
2346a71 mediawiki: fix pidfile location in apache2.conf Change-Id: I135999d7d339e8a235e2861ca1af52f09be11c3a 08 August 2014, 11:44:52 UTC
71e36e2 mediawiki::hhvm: require 'apache' user Change-Id: I8445291405df5bf2f2c5467003d13d10ad86bb5b 08 August 2014, 10:47:05 UTC
fbfcc97 Partially revert 9393f239ff, moving dist-check in-line Change-Id: Id89c8b675b3d6892f3779a696972c70bf504aa7c 08 August 2014, 10:37:03 UTC
bba59db decom tantalum, former OCG QA box Change-Id: I3b2beadeb988da61aed855a291d90f05a42152e1 RT: 7947 08 August 2014, 10:10:05 UTC
7811287 osm.planet sync up Use osm::planet_sync to create a cron entry to keep OSM dbs in sync with planet.osm. Add rspec for the osm::planet_sync define Change-Id: I5507cd6364b10048b596d9d4772d22fc65ef7373 08 August 2014, 09:54:51 UTC
7debc10 HAT: fix class inclusion Change-Id: I9619ae89884076a0ea5cc7af759aeb38c458aedc Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org> 08 August 2014, 09:51:36 UTC
2da7c47 mediawiki: move testwiki to HAT This patch will make mw1017 (the testwiki host) reinstall with trusty, which will automagically make the mediawiki module use HHVM instead of mod_php. Change-Id: Idaf3afd1f230a7a3547a74a68709b1a3cfaa7430 Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org> 08 August 2014, 08:22:30 UTC
208b170 mediawiki: basic HHVM monitoring With this change, we will add to trusty appservers: - monitoring of the hhvm process on all HHVM appservers - access to the admin console for hhvm locally Change-Id: Ibbb11d37b7963a9aa0b6cf2bd379123bbc6e9a45 Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org> 08 August 2014, 08:15:42 UTC
3dc4b22 hhvm::admin: bring back $ensure ..accidentally dropped by bad merge. Shame on me, etc. Change-Id: I0f801c38ac16b6e1a9184b6da25215787b670098 08 August 2014, 08:15:04 UTC
fd3ce6d hhvm: add process monitoring This will add direct nagios checks. For deeper inspection you will need to use the hhvm::status module. Change-Id: I8f1ae3675a9ced80ba914fa6bbd1d65aebefdafe Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org> 08 August 2014, 08:09:09 UTC
4ef1ba7 hhvm::status -> hhvm::admin + small lint fixes * Validate port param. * Don't set priority on site (default of 50 is fine). * Rename status -> admin. Change-Id: I8e91d31246cc9e119d152db0ec540715119bd3a0 08 August 2014, 07:46:05 UTC
85d82e2 hhvm: fix status Unluckily enough, HHVM admin interface speaks FastCGI but... it doesn't understand it, so we should ask apache the exact same url we will then proxy to the HHVM admin interface (meh!). So, converting this to a virtualhost that will listen on a specified port; this is ugly but it will at least succeed (note that I could remove the guards on proxying since we're using a different port). See https://github.com/facebook/hhvm/issues/3379 Change-Id: Ibf0b86b52e26fc68012969fe9797b370227cec15 Signed-off-by: Giuseppe Lavagetto <glavagetto@wikimedia.org> 08 August 2014, 07:39:08 UTC
952ad52 Remove mysql_multi_instance from labsdb1003, for upgrade. Change-Id: I1709d0cf4d153ee11c8e88712dc6195ebcb81ea5 08 August 2014, 06:22:03 UTC
f1a9418 Disable access for mwalker, who is leaving WMF. Change-Id: If91bb36488c951ffc238b824b23469656800a869 08 August 2014, 03:26:11 UTC
6362aa7 Merge "restrict access to puppet logs to root users" into production 08 August 2014, 15:59:33 UTC
6137689 restrict access to puppet logs to root users RT: 8022 RT: 4058 Change-Id: I274b4f830f8860c6e37d0b31d424a7549144fabe 08 August 2014, 15:40:56 UTC
d320f2f bugzilla - consistently use SSLCompression Off use it everywhere, not just in one virtual host consistency Change-Id: Iff5e1e725095f5ce0780111d055e9b7c678dc9da 08 August 2014, 15:24:06 UTC
bb5441b bugzilla - retab Apache template Change-Id: I5d978ac0f647915eab6ca6224d45d455ebd653f5 08 August 2014, 15:19:08 UTC
back to top