https://github.com/wikimedia/operations-puppet

sort by:
Revision Author Date Message Commit Date
93ec358 [WIP] Add cassandra role Depends on https://gerrit.wikimedia.org/r/#/c/166888/ Change-Id: I7790c71d89f8bced543f51aae59f1f0ca4ad2860 20 October 2014, 21:15:13 UTC
ec305cf Re-remove deployment::target This reverts commit 7f11bd94b9c362f4243fbc37670973a34d3dff08. Change-Id: I5ee14ba6807553f77f4f67f55d66926cd8e1f778 20 October 2014, 21:06:35 UTC
609a1b9 Merge "Revert "Reduce RAM overprovision ratio."" into production 20 October 2014, 20:26:05 UTC
01a181e Revert "Reduce RAM overprovision ratio." This reverts commit 05d4dc8c1363f8169dbf56c554c008a4ab8fc150. This doesn't work, despite docs to the contrary Change-Id: I3ace0637573abbdef96db8c3a477d59f5bc170fd 20 October 2014, 20:24:56 UTC
0a1f9e0 Merge "Add quickstack to standard-packages; remove from hhvm::packages" into production 20 October 2014, 20:03:06 UTC
89cdf2e Revert "Revert "trebuchet: derive the grain name from the repo name"" This reverts commit 8b602c08df041a369b0408a81f894d6b33cf07a2. Change-Id: Iec445438f18e6e3c14e2d08dcb08a177f7dd6c80 20 October 2014, 20:01:00 UTC
b7f0535 Add quickstack to standard-packages; remove from hhvm::packages Change-Id: I7bf7278313452b290c0f0f7a7a9cc9b22e4e2b58 20 October 2014, 19:57:52 UTC
aa92cd3 hhvm: provision quickstack package Extremely useful for capturing stack traces on HHVM servers. RT: 8671 Change-Id: Id61c79bbe4adcbdd4a1a1b70f7a1291b613a9206 20 October 2014, 19:53:29 UTC
b2a876d Merge "shinken: Make contactgroup name match project name" into production 20 October 2014, 19:49:30 UTC
6311db4 shinken: Make contactgroup name match project name Change-Id: Ib2fa54ca8d4d6064df5cefa2af0fac205f89cd08 20 October 2014, 19:38:15 UTC
942e8fb trebuchet provider: grains.get should be local no need for it to auth to the master and fail if the master is unavailable Change-Id: Ia80b6ada4d0bd0dc7a659d6435dda064329acb32 20 October 2014, 19:33:42 UTC
ee6074c Merge "shinken: Set up separate directory for generated configs" into production 20 October 2014, 19:23:52 UTC
77788f5 shinken: Set up separate directory for generated configs Change-Id: I2d1df956e4819d695b6ddd638bf27383b879e124 20 October 2014, 19:04:22 UTC
7077999 upload: add X-Content-Duration to CORS exposed headers Change-Id: I75ba126e24b978fd2d688da0979ccdc0e6932a7e 20 October 2014, 18:17:42 UTC
fa126ca Merge "Reduce RAM overprovision ratio." into production 20 October 2014, 17:39:43 UTC
b90d73d Merge "Beta: Update cxserver to use Apertium service" into production 20 October 2014, 17:37:17 UTC
b55e966 Merge "create shell user for Joel Sahleen" into production 20 October 2014, 17:36:30 UTC
05d4dc8 Reduce RAM overprovision ratio. This may need to be raised if this change prevents all new instance scheduling... but the old setting was clearly not conservative enough. Change-Id: Ib45f4dfe462fe903a26e90c6ce4ebe5dda9e174c 20 October 2014, 17:35:00 UTC
e4bce06 create shell user for Joel Sahleen this just creates a user account but doesn't add it to any groups yet so it's not the change that actually gives access, but a prerequisite for it for event logging access approved by greg-g RT: #8609 key: https://office.wikimedia.org/w/index.php?title=User:JSahleen_%28WMF%29&oldid=120072 Change-Id: I04413069903df4300a1fb76225d4a37feb6cea35 20 October 2014, 17:34:03 UTC
f0d0470 Brown paper bag fix for Varnish/upload/CORS Change-Id: Ie121af2049c5f3b551598bd05065d7777416a619 20 October 2014, 17:24:32 UTC
9fe840f Handle CORS preflight requests for upload in VCL ogv.js needs to be able to send Range requests to handle video seeking. These come from our project domain names and go to upload, i.e. they are cross-domain, and unfortunately, Range is not whitelisted by browsers as an allowed header. This means that we need to handle CORS preflight requests (OPTIONS) and explicitly respond to browsers that they're allowed to send a cross-domain Range header... This results in another round-trip but seems unavoidable (so far). Swift has some support for CORS, but seems to be per container. This is much easier to handle in Varnish and not too ugly either, so add a few lines that would handle those OPTIONS requests and reply accordingly. Note that we respond with a "*" allowed origin for now as there doesn't seem to be any reason to restrict it to only our origins. Bug: 55631 Change-Id: I6e381d9b4f4692d1eabeb777ee8cdb7fae1de3f2 20 October 2014, 17:12:15 UTC
5a9cc83 Merge "iegreview: Enable rewrite engine in Location context" into production 20 October 2014, 17:08:06 UTC
cbd51d2 Merge "exim: remove ref to tampa" into production 20 October 2014, 16:51:56 UTC
ba6f31a Beta: Update cxserver to use Apertium service Changes: 1. Use apertium-beta.wmflabs.org for mt.apertium service 2. Added registry in config.erb 3. apertium-* packages are no longer needed. Apertium is used as service. Depends on: Ie071199078ce40f9a3f3e25e2e58430330328087 Change-Id: I94597e7e78e97c4b34e3ad40c32a6ca97afeccfa 20 October 2014, 16:47:24 UTC
0e69f13 Simplify apertium module Removing unused parameters Stop overriding the sysvinit script Change-Id: I036b242506711374f695be0014f62053aba8aea5 20 October 2014, 16:17:57 UTC
688f15f shinken: Set up config for default host ping check Change-Id: I7d9fde3cfaa9a9ca9efc91f28cb8d585bacee760 20 October 2014, 16:07:20 UTC
b415804 shinken: Set default contact to guest Change-Id: Icd4e014d189cc8bec2fc9e0a431359bc8eb7adf4 20 October 2014, 15:57:21 UTC
bb9b518 shinken: Puppetize templates.cfg Change-Id: Ieba0286615d61db67abda5135468760f46025075 20 October 2014, 15:53:42 UTC
777d111 Configure Beta Elasticsearch for statsd Follows up I36ff0f43: need to send the data to statsd, not graphite directly. Change-Id: I8e7dd5cff936e28f96cb3497205c6b9566566bc6 20 October 2014, 15:17:06 UTC
c9c52c2 exim: remove ref to tampa Change-Id: Ibf983820f54743596b5821fc1e29c651f97a24a4 20 October 2014, 15:03:12 UTC
2844c7e Add apertium module tests While at it fix 2 bugs with bad dependencies Change-Id: I2d4c6b526cbdda64e35598871dff36a250e8e43c 20 October 2014, 11:15:52 UTC
cbab6c6 iegreview: Enable rewrite engine in Location context Having the RewriteEngine enabled in the global vhost context does not implictily enable the RewriteEngine within a nested context. Bug: 72201 Change-Id: I720f9100c57eba34dabe15c0c1ceaabf0d09d93d 18 October 2014, 17:31:30 UTC
03ca6e9 Beta: Apertium service configuration Apertium APY as a service for Content Translation Beta. Change-Id: Ie071199078ce40f9a3f3e25e2e58430330328087 18 October 2014, 14:21:11 UTC
c4988a0 Merge "iegreview - include app passwords from private" into production 18 October 2014, 00:03:45 UTC
838a919 iegreview - include app passwords from private this is using app user/password for the mysql connection, which have already been added to private repo by springle, but we need to include the class to use them Change-Id: I0f5e0d26a95b9246cf91f3a59b947d125bae8236 18 October 2014, 00:01:00 UTC
a1361eb iegreview: fix hostname for logging server Zirconium is in the wikimedia.org domain rather than eqiad.wmnet so it's resolver configuration does not allow leaving the datacenter specification off of the logging server hostname. Change-Id: I1ee4a2edf7c406d8b98491e64d146de0f2119268 17 October 2014, 23:58:38 UTC
dacf389 iegreview: Provision iegreview application * Apply role:iegreview to zirconium * Add vcl to route iegreview.wikimedia.org requests to zirconium * Configure logstash to store iegreview events received via udp2log Bug: 71597 RT: 8578 Change-Id: I0c1d670e9d77e6598058f95b792f0c6cb6aa24d0 17 October 2014, 23:37:57 UTC
172c1ab Merge "iegreview: Create module and role for deployment" into production 17 October 2014, 23:33:49 UTC
b1e843f Merge "tor-relay - add firewalling" into production 17 October 2014, 23:30:23 UTC
2cb95ba Merge "add IPv6 interface to radium" into production 17 October 2014, 23:25:05 UTC
d98454b Merge "puppetmaster - retab Apache template" into production 17 October 2014, 23:23:30 UTC
f112871 puppetmaster - retab Apache template Change-Id: I94c2f4014a6614290e39eb52ec3af9171144faa0 17 October 2014, 23:18:39 UTC
b1ce21a add IPv6 interface to radium do we want to in this case? yes do we need ip6tables? already included in base:firewall yes Change-Id: I79e0630f2dc11a6117dd622837227f1b7d00c6fc RT: 7925 RT: 7971 17 October 2014, 22:56:29 UTC
7f1f570 add node radium to site.pp add new node radium to site, include admin and standard and base firewall Change-Id: I3f4b8843b02f0272835c98afe81bfb794c59e6f5 RT: 7925 RT: 7971 17 October 2014, 22:54:07 UTC
20bb8ff Merge "add radium to DHCP and netboot" into production 17 October 2014, 22:52:55 UTC
069ad2a Revert "svn - disable SSLv3" This reverts commit 51f85c66e339d3715f7c137d2519c0b3b4218ed4. Change-Id: I2766a20746f9f7a9bc513d2b2fe6865494e34a5f 17 October 2014, 22:32:29 UTC
5d24cca Merge "svn - retab Apache template" into production 17 October 2014, 22:14:42 UTC
aa6e59b Merge "svn - disable SSLv3" into production 17 October 2014, 22:13:40 UTC
81e9606 svn - retab Apache template Change-Id: I09394932886e7de617faecfff95a2f447ee42212 17 October 2014, 22:13:21 UTC
51f85c6 svn - disable SSLv3 svn.wm.org did not specify SSL/TLS protocol versions Change-Id: I9bd78b94ddb7f5efd20160b1458647dba04cd7c5 17 October 2014, 22:12:28 UTC
1bdb741 iegreview: Create module and role for deployment Bug: 71597 RT: 8578 Change-Id: I69d4a2821db0cc3148963f743fcbdca31208cb9f 17 October 2014, 22:05:07 UTC
34b4b4a icinga-admin - disable SSLv3 when doing icinga, don't forget icinga-admin Change-Id: I854f007fee897e814a19c7cdb47e4aab311f4661 17 October 2014, 21:59:43 UTC
b7bc4f2 Merge "icinga - disable SSLv3" into production 17 October 2014, 21:52:48 UTC
6965845 icinga - disable SSLv3 Change-Id: Ia6d4241f38a577c755a56e461fb7d13c97cb97e6 17 October 2014, 21:51:17 UTC
2fc04a4 Merge "stats.wikimedia.org - disable SSLv3" into production 17 October 2014, 21:42:35 UTC
ebed14e stats.wikimedia.org - disable SSLv3 Change-Id: I43bfbcda77649d6be14adabd6c154728e105330c 17 October 2014, 21:41:36 UTC
4eadeaa webserver::php5-mysql: use require_package() Factored out of I69d4a2821. Bryan's iegreview patch needs to php5-mysql package. If it declares it, it will conflict with other classes applied on zirconium, which include webserver::php5-mysql. The iegreview class should not include webserver::php5-mysql itself, though, because that class is deprecated. Change-Id: Ieb3c07bb4a963fa2a32086efbb11e5493435cf39 17 October 2014, 21:23:32 UTC
450338a Merge "webserver - use ssl_ciphersuite in generic_vhost" into production 17 October 2014, 21:15:55 UTC
8e420d4 Merge "puppetmaster - use ssl_ciphersuite" into production 17 October 2014, 21:09:33 UTC
3c063db hhvm: make hhvm-dump-debug only dump core with '--core' Otherwise, only create a backtrace file. Change-Id: I791a287ac15e8dc1ed3d8369cdd572eb42d1f228 17 October 2014, 18:53:20 UTC
c3ca606 hhvm: include .::packages rather than require Change-Id: I8803f7ea842ddb71d54b160b1d7f31b0013c0d38 17 October 2014, 17:58:55 UTC
8f8e27b HHVM: provision debug symbols for libraries used by HHVM Change-Id: I7ccfee56ef8401317979ac2158441e9152b25662 17 October 2014, 17:13:33 UTC
3326274 Merge "Labs: final fix of gridengine class" into production 17 October 2014, 15:21:22 UTC
6be3201 Labs: final fix of gridengine class For this batch of changes; fixes one file source to point at the correct spot. Change-Id: Ia977995ac7ca3c737cca0188d90525a76d48d8d0 17 October 2014, 15:19:14 UTC
fa20928 Disable SSLv3 completely This removes the recently-added "compatnossl" and upgrades "compat" to that standard for all sites. (this includes switching gerrit + bugzilla back from compatnossl). Change-Id: I17d41e7208051cf8501b354a0f254f1669c0059a 17 October 2014, 15:04:06 UTC
f1be7fd Merge "Labs: more tweaks to gridengine puppetization" into production 17 October 2014, 14:57:10 UTC
33745f7 Labs: more tweaks to gridengine puppetization Change-Id: I919a9289653e60df6714a20fe7bbce9003341df6 17 October 2014, 14:54:12 UTC
e305b0e Enable mobile redirect for old Wikisource (http://wikisource.org) Bug: 69765 Change-Id: I0e75d871af87313e2970a8a955d98efbc0551076 17 October 2014, 14:51:49 UTC
41b6725 Labs: more tweaks to the gridengine class sourceselect => all keeps getting confused. Be more verbose, but more explicit. Change-Id: I181357b3fd446038c40330f26c44a2995783d0d7 17 October 2014, 14:44:32 UTC
0ffdfcd Labs: more fixes to gridengine puppetization Change-Id: I7268858ca266f747a2e53155178b7247faf538e9 17 October 2014, 14:21:37 UTC
9d081b1 tor-relay - add firewalling as requested in #7971, let this have strict ferm rules before using it on radium base::firewall added to radium in separate change Change-Id: Ie800d4ef97563dc4bdeefc2d58c5562ae3e3ae2b RT: 7971 17 October 2014, 02:25:36 UTC
3599867 Labs: more gridengine class fixes Change-Id: I7256213b86926167c857132474602bc580f1baa4 17 October 2014, 01:36:45 UTC
bb62d6e Labs: more explicit paths Change-Id: Idc1ecaa8d59c7b3f9d0263177ecf10e4a31feb6a 17 October 2014, 01:31:05 UTC
1c69174 add radium to DHCP and netboot MAC address per racadm getsysinfo netboot - just 'cause similar boxes also use it Change-Id: Ib0a40c42bb306ca07d2d609b5373f7c2c257b726 RT: 7925 RT: 7971 17 October 2014, 01:30:03 UTC
07ca7ae Labs: further fixes to gridengine puppetization Change-Id: Ic1a09db355214f5d62898f67fb35064afb2bc74d 17 October 2014, 01:27:14 UTC
8b7464d Labs: more fixes to gridengine class Change-Id: Ie85f138ba16f0729c0b1ace0ef3d0244a33d7aef 17 October 2014, 01:20:52 UTC
d2eaa8d Labs: typo fix Change-Id: Icb2457dcb0bbd98eec36777853cc4dca4efe57f4 17 October 2014, 01:14:26 UTC
51e65ac Tool Labs: fix c&p fail in hostgroup::collector Change-Id: Ia93c56b94563688c3bfd399bade19ff4d71b571f 17 October 2014, 01:10:38 UTC
8b9df83 Labs: further fixes to toollabs and gridengine This reverts commit d67485f8d4cebe0cab1d9e2f6f585bed6e507e30. Change-Id: I64627e202900b4d7bbf0334bf64261c9f86d73e7 17 October 2014, 01:06:40 UTC
d67485f Labs: minor fixes to toollabs module I wish the puppet compiler worked for labs. Change-Id: Idc9a06bc1d9c1d9974a8029a53eed2fbd2008e3e 17 October 2014, 00:54:19 UTC
9d94fc4 Labs: fix err in toollabs module structure Change-Id: I22f2daab63221422f9fe73475d264f9f0c00bf66 17 October 2014, 00:45:29 UTC
490efb0 Labs: remove $configsource from gridengine::master Change-Id: I880c250e124a401d16d61e9e89fde1d23303654e 17 October 2014, 00:38:16 UTC
cef2892 Labs: decouple exec_host and submit_host While this means having to include the gridengine class directly by the users, this simplifies and allows including both of them cleanly. Change-Id: Iee038ebd25f0f76cb57cb5e57e969cebd8466fca 17 October 2014, 00:23:57 UTC
ed12d67 Labs: puppetize gridengine Much of this will need tweaking and hacking; gridengine is /not/ amenable to simple puppetization because most of its configuration lives in a BDB. Most actualy configuration bits are nooped with 'echo' at this time while testing takes place. Change-Id: I7856b65ebead6aae04777c4851ef3c7771b239f5 17 October 2014, 00:01:04 UTC
cf02c18 Merge "gerrit: Disable SSLv3" into production 16 October 2014, 21:20:52 UTC
9b34632 gerrit: Disable SSLv3 Change-Id: I134fe31d0faca2d86b13af115964942b9f7cd763 16 October 2014, 21:13:09 UTC
31545d3 Merge "ssl_ciphersuite - add new compat mode" into production 16 October 2014, 20:53:42 UTC
3e26b89 Adding edenhill to bastiononly group Change-Id: Icb0bb204923a68b5fb85c3a026d6f503c990001c 16 October 2014, 19:58:59 UTC
e262360 Grant access to Magnus Edenhill on analytics1003 This will allow Magnus to do some kafkatee debugging work RT 8632 Change-Id: Ic6df3c7b408018f694cae0475eb71b89e7728a57 16 October 2014, 19:55:36 UTC
ba532dd Zero: unified everything, no opera for 293-41 * All traffic should now processed as unified * Cache fragmentation begone! Change-Id: I5a95fbda0cfb1c4cf1463538c1a65cc1a6211ee1 16 October 2014, 19:36:58 UTC
5115327 Merge "mailman: add more template translations" into production 16 October 2014, 19:36:47 UTC
8b602c0 Revert "trebuchet: derive the grain name from the repo name" This reverts commit 198d191c3ffa9f8bda02b590c50d99c298ea4b52. Change-Id: I23b27ed86e2a6e876078840e5ee081b18da4c624 16 October 2014, 16:58:13 UTC
198d191 trebuchet: derive the grain name from the repo name It's a bit silly to have to configure a grain name for each Trebuchet-deployed repository, and then have to look up the repository in the configuration to derive the key. It buys you nothing except the ability to have a single grain associated with multiple repositories, which isn't beneficial anyway: if the repositories are part of some role, then they should be declared together in the role class, rather than have their association declared in a giant hash blob in manifests/role/deployment.pp. Change-Id: I38443f3b582c4658f91f0f8d442a590a27aa5b68 16 October 2014, 16:50:44 UTC
02af028 Zero: Updated 410-01 to support Opera https Change-Id: I53ee6e8d81f42b662e2743913df837af1ca34f5a 16 October 2014, 07:49:52 UTC
46f0881 prepare es2001 Change-Id: I0b2d110ad18fce76ecaf20611d97193c59f9dece 16 October 2014, 04:35:41 UTC
1ec85f6 labs: reduce acct archiving retention In our standard packages we install 'acct' which does user and process accounting (see commands 'ac' and 'lastcomm'). The log are held in /var/log/account which, on labs is a 2GB partition that ends up filling quite rapidly on busy instances. On the beta cluster deployment-bastion instance, it takes up to 500MB or a quarter of the /var instance. Reading the SAL I noticed we keep cleaning up manually to reclaim disk space. The files are rotated via a daily cron using the 'savelog' command. It is passed $ACCT_LOGGING which default to 30 days. Reduce it on all labs instance to 7 days. See also https://wikitech.wikimedia.org/wiki/Incident_documentation/20140910-BetaCluster Bug: 69604 Change-Id: Iae6adb6e5783e6ddbcba11779d204aff8e76f9b9 16 October 2014, 00:39:30 UTC
e41db15 Merge "publichtml: tidy" into production 15 October 2014, 20:55:44 UTC
e72a793 Merge "remove scs-c1-pmtpa" into production 15 October 2014, 20:50:51 UTC
6037cf9 remove ishmael SSL cert ishmael is behind misc-web nowadays so it doesn't need a separate cert anymore unless we count it as monitoring tool and we want to revert moving it behind misc-web RT: 8560 RT: 8654 Change-Id: I46c7f3a31b55f1af3d3bd3b093e46e482175b731 15 October 2014, 20:43:58 UTC
78d84a2 Merge "ishmael - remove SSL config remnants" into production 15 October 2014, 20:35:06 UTC
back to top