https://github.com/wikimedia/operations-puppet

sort by:
Revision Author Date Message Commit Date
efdaa51 statsdlb: replace txstatsd with statsite Start with three instances, should be easy to add more if needed. Bug: T90111 Change-Id: Ibf9b820b2dd221b6a61064bb7b4e48ae8609feca 25 March 2015, 11:22:58 UTC
05dc378 statsite: new module statsite provides a txstatsd replacement, the module allows for multiple instances to be provisioned with statsite::instance and controlled using the '*ctl pattern'. Bug: T90111 Change-Id: I265f5307f73f69c242832d148e14595bfccfdba9 25 March 2015, 11:10:37 UTC
fd8555d update cassandra submodule Change-Id: I15964f034a5c727827f5e3d6bbef2f5422b3c86b 25 March 2015, 09:12:35 UTC
c94aa1a Disable TCP slow-start restart on caches TCP SSR resets the congestion window of connections that have gone idle, which means it has a tendency to reset the congestion window of HTTP keepalive and SPDY connections, which are characterized by short bursts of activity separated by long idle times. References: * https://www.belshe.com/2011/12/03/spdy-configuration-tcp_slow_start_after_idle/ * http://chimera.labs.oreilly.com/books/1230000000545/ch02.html#SLOW_START Change-Id: I368d74cae73e010a503cd3144663651e07229cf2 25 March 2015, 01:34:26 UTC
bc82a57 improved error capture for OCSP updater This should get subprocess errors from openssl logged to the cron email output on failure for now Change-Id: Ia87cf39ab6754cc0dbdbff3ba59a26ad77d580e5 24 March 2015, 22:19:50 UTC
8410139 Merge "explicit service pathname for update-ocsp-all" into production 24 March 2015, 21:43:03 UTC
c86c3fa explicit service pathname for update-ocsp-all Change-Id: If867df61d06922ab89a033b81d4fb78607a6fe57 24 March 2015, 21:42:26 UTC
47881c0 setting francium install params + raid10 partman recipe setting the francium install paramters and attempting to write a raid10-gpt partman instruciton set Bug:T93113 Change-Id: If1fd0a006b4a599a31bc04374c4cf94337efbc58 24 March 2015, 21:28:28 UTC
4f0b6a1 update-ocsp-all: fix varname, kill normal output Change-Id: I2fa7c8639603d8da0b816990aeadfdd9f4da6a74 24 March 2015, 19:02:57 UTC
0dbf450 bugfix for cp1008 test (puppet scoping?) Change-Id: I3076f8f6133e788c6b6976270e3a09640333b345 24 March 2015, 18:56:24 UTC
3ea37a3 OCSP bugfix for 8aa4e450 wrong variable name! Change-Id: I82d6e6e687765f5beadbc71e671766cf790e181f 24 March 2015, 18:52:35 UTC
71b121b autoinstall: switch public1-esams to Debian public1-esams is special, as instead of using our own mirror in eqiad, we want to use a more local to the site (NL) mirror. Since all reinstalls will likely happen with jessie from now onwards, switch the Ubuntu mirror to a Debian one. This *will* break a reinstall of eeden. Change-Id: I65a3d9aacb2844ad67bae565543a23333769aa87 24 March 2015, 18:50:35 UTC
47e02df test OCSP Stapling on cp1008 Task: T86666 Change-Id: I299a2730dd4f8fa306ac27270dd2253c9e5377e8 24 March 2015, 18:42:46 UTC
c1afe02 Merge "correct einsteinium node name" into production 24 March 2015, 18:38:46 UTC
8aa4e45 protoproxy/sslcert/cache: nginx ssl_stapling_file support Bug: T86666 Change-Id: If19dc78a8743cdcfff18b702a6c4502eeedcf393 24 March 2015, 18:38:19 UTC
b649214 add generic nrpe script check-fresh-files-in-dir.py Change-Id: I28bef50f3c3e284573dc060c517ae6ac9e2f7731 24 March 2015, 18:36:26 UTC
670a42a correct einsteinium node name typo, eisteinium != einsteinium This should let the Titan test host get its puppet role. Change-Id: I3e4b4769fdc69c0f3aea94e89c6680e04e5e3cf9 24 March 2015, 18:33:08 UTC
2eb7fc2 autoinstall: properly set up misc esams hosts Add partitioning for hooft/nescio/maerlant. While at it, rename "esams.cfg" to "public1-esams.cfg", as this is what we're calling the LAN now that we also have a private one. Change-Id: I667a95ec7e5d79ebd25d2440bbb1a50a5dec14bc 24 March 2015, 18:29:10 UTC
ac024ed Merge "make twentyafterfour a phabricator-admin" into production 24 March 2015, 18:29:06 UTC
1cd9b84 Configure Labs Phabricators with default local repo store Production is configured to use /srv/phab/repos but Labs isn't. Because this isn't configured, the Labs instances default to /var/repo which isn't created by Puppet. This configures Labs to use the same configuration as production. Bug: T93615 Change-Id: I085f2e771b835a17be7f74e39b968e511f5d80aa 24 March 2015, 18:02:56 UTC
5b535a7 phab phd user owns repo management scripts Change-Id: Iaf78a1d38a9f52ec567d316455f251afd02bf2fe 24 March 2015, 17:42:15 UTC
c001d39 ipsec: drop the custom $site detection We already have $::site set globally (and implemented in a better way), set by realm.pp. Drop the explicit $site detection from this role and rely on $::site. Change-Id: Iaa9291ae3eb2e802e6c11dbb4776d4df87913141 24 March 2015, 17:19:48 UTC
8a1d7e6 Fix wikimedia.org typo under palladium's hiera Change-Id: Iab02a349bae64c6431c7a85a36d562d04061c1dd 24 March 2015, 17:19:48 UTC
df20122 puppetmaster: Keep reports only for 16 hours Nobody seems to be looking at them, and they are filling up disk on palladium Change-Id: Ia76ef5294dd07f9ac43c7e983ebdb63c8e12c93d 24 March 2015, 16:16:29 UTC
973cd26 Re-add maerlant @ esams, format as jessie Change-Id: I1e376737fa89dd0bc915ba5cb6c50c88b1856e94 24 March 2015, 16:11:08 UTC
b2a1922 scap: remove temporarily mw2148 from the list of scap proxies Change-Id: I06f4f05bd140f2b356ec163af0231e95f9f2cf6d 24 March 2015, 15:24:03 UTC
90df7ab Merge "Update cassandra submodule" into production 24 March 2015, 15:00:24 UTC
c104dd8 exim4.conf.SMTP_IMAP_MM.erb local mail can cause loops The affected hosts seem to be: * iodine (otrs) * phabricator (iridium) * requestracker (magnesium) Reproduce: echo test | mail -s "loopme" rush Eventually this errors out: ** root@iodine.wikimedia.org: \ Too many "Received" headers - \ suspected mail loop Change-Id: I077a3a160dff9ebb91915ca3fe3a43ab9e0b8c66 24 March 2015, 14:58:10 UTC
e1c7809 Update cassandra submodule To have the the Iaa3bbf07b6053e139dc9483f849f6d4acba1418b change included Change-Id: I6497c32cc8f14f77c38cda39893edce0631ec6d7 24 March 2015, 13:59:50 UTC
35e9587 lvs: add loadbalancers for appservers, api and rendering Bug: T92377 Change-Id: I4e76e44ed80304ed7c236678859e0e9158b4afcb 24 March 2015, 13:50:54 UTC
10fe946 Merge "scap: add codfw proxies" into production 24 March 2015, 13:44:35 UTC
2860ba4 scap: add codfw proxies For now, we keep all the scap proxies together. Change-Id: Ic96b8a2e4a57c8fe00a6e71b3bbe18632601ff7c 24 March 2015, 13:43:33 UTC
95d7210 Firewall for Holmium Change-Id: I938807648720b48d1b0742dd7cb76ed58ff5a12d 24 March 2015, 13:36:43 UTC
24036fc Merge "Add .codfw.wmnet to tin's domain search" into production 24 March 2015, 12:56:47 UTC
6b10264 Merge "Labs: upgrade codfw labstores to Jessie" into production 24 March 2015, 12:40:06 UTC
cc3c46e Labs: upgrade codfw labstores to Jessie (This is probably the last real opportunity to do so without outage or interruptions). Bug: T93740 Change-Id: I4a47e6184fbb62b16ca8498aa3247ae49a1c2775 24 March 2015, 12:32:42 UTC
16016c1 Add .codfw.wmnet to tin's domain search scap needs that Change-Id: Ieebdab7826ce622fb628287f9c8e90fe7d3c260a 24 March 2015, 10:51:52 UTC
4da464c dsh: add more codfw servers Change-Id: I1aa654a58f1717b4a44b09d22ae55ae3c52df9b5 24 March 2015, 10:40:30 UTC
9bdcc4d Merge "servermon - Enable HSTS max-age=7 days" into production 24 March 2015, 10:11:28 UTC
6b04789 mediawiki: add dsh entries for codfw Change-Id: Iebb705e5b5ecd825a2ec654facbf89aa04ab6cca 24 March 2015, 09:31:23 UTC
ecd6edb tools: Specify full path for uwsgi mountpoint Change-Id: Ibd5f8981a6e6c41d5107f2aeecf6f01802cd0927 24 March 2015, 06:14:07 UTC
9a49e0f Merge "increased compaction concurrency and throughput" into production 23 March 2015, 23:40:59 UTC
3939120 Update the cassandra submodule Change-Id: I78cbf51d8bca49f90553603c2f203a3c77bb4fe2 23 March 2015, 23:37:08 UTC
332ed17 include firewall on uranium Change-Id: I13802a1774f7894af0d7ec34e48676017573cfcb 23 March 2015, 23:33:53 UTC
98a7c41 increased compaction concurrency and throughput More experimentation has shown that both the number of concurrent compactors, and the throughput limit are still overly conservative. Bug: T93140 Change-Id: Id5547f90718bc968dbd0381be7680a791e191291 23 March 2015, 23:24:34 UTC
112293f Merge "puppet-lint.rc - do not disable indentation checks" into production 23 March 2015, 22:11:41 UTC
9ac8d27 Move misc. utilities to utils/; remove typos Clean up the top level of the repository tree by moving various support scripts to utils/ and deleting 'typos', which doesn't catch anything plausible. Change-Id: Icbcbb9832d49f322dc935f4ace5a9c5510dfab4c 23 March 2015, 21:58:58 UTC
5000d94 puppet-lint.rc - do not disable indentation checks the comment that claims "Anyone has a different indentation preference" is not accurate. we have actually agreed on four-space soft tabs: https://wikitech.wikimedia.org/wiki/Puppet_coding#Spacing.2C_Indentation.2C_.26_Whitespace Bug:T93645 Change-Id: Ifc2dc02bdd02aff0055bb91bcc2c48e4830fb6cb 23 March 2015, 21:54:09 UTC
0f6a9be Merge "puppet-lint: fix all 2sp_soft_tabs errors" into production 23 March 2015, 21:53:46 UTC
fa7a05c puppet-lint: fix all 2sp_soft_tabs errors These are the (only) errors that keep us from re-enabling 2sp_soft_tabs lint check. This should allow us to enable that rule in Ifc2dc02bdd02aff0055bb9 . Change-Id: Iac0f24d8eeb3d45da4ba1924cc75e4aca5c452b2 23 March 2015, 21:49:32 UTC
b8c1e19 repool cp4009 T92476 Change-Id: I59026af5814fccb013ae7ac657e3780767211356 23 March 2015, 21:48:30 UTC
bd2b2f7 servermon - Enable HSTS max-age=7 days https://servermon.wikimedia.org is HTTPS only. Bug: T40516 Change-Id: I9e2d7a00d76991805ddc456c1a3d6a4874615ca2 23 March 2015, 21:44:56 UTC
a291f80 Merge "puppet-lint: fix all 2sp_soft_tabs errors" into production 23 March 2015, 21:32:28 UTC
43270f7 Merge "Enable ensure_not_symlink_target puppet-lint check" into production 23 March 2015, 21:11:54 UTC
cb2b229 Merge "Fix the fixed ip range for labs" into production 23 March 2015, 21:02:25 UTC
08de5ae Fix the fixed ip range for labs Change-Id: I4732283217632633986ab5039fe169f3942153f4 23 March 2015, 21:00:14 UTC
575b76b puppet-lint: fix all 2sp_soft_tabs errors These are the (only) errors that keep us from re-enabling 2sp_soft_tabs lint check. This should make jenkins like Ifc2dc02bdd02aff0055bb9 again. Change-Id: I9c5d93fd6b5f22f6b17d3f45c1019adaa71e7975 23 March 2015, 20:47:40 UTC
99ac831 Merge "Allow the labs dns server to recurse when hit from a labs instance." into production 23 March 2015, 20:46:09 UTC
763dd5d Allow the labs dns server to recurse when hit from a labs instance. Change-Id: I8abc9e757ab8f44de97edd60d4431d88fdfb87a2 23 March 2015, 20:42:17 UTC
d8b4e0b toollabs: Add mosh to bastions Change-Id: Ibebff69b4e0001ed6ad2d3593f5c47225006e0ce 23 March 2015, 20:13:59 UTC
82ec26e Enable ensure_not_symlink_target puppet-lint check It is not causing a stacktrace anymore: $ rm .puppet-lint.rc $ puppet-lint --only-checks 'ensure_not_symlink_target' . $ puppet-lint --version puppet-lint 1.1.0 Bug: T93645 Change-Id: Icb9840d0269a98767f105f94e2149fa3ba58d7c9 23 March 2015, 20:00:28 UTC
be8f157 Log X-Cache header as new field in webrequest logs via varnishkafka Bug: T91749 Change-Id: Ia25fbaacf8b373ddc63b00fe3391797eb692f0a3 23 March 2015, 19:59:16 UTC
4408a23 add roles for staging redis ( *-rdb\d\d? ) Change-Id: I345eadad8baf02cddb9c39bc27a7cd28e255c1b6 23 March 2015, 19:27:09 UTC
4475a53 Merge "check_graphite: accept additional date specification" into production 23 March 2015, 19:15:59 UTC
78def2b Merge "have base::firewall on codfw poolcounters" into production 23 March 2015, 19:08:07 UTC
ebf197d Merge "add ferm service for poolcounterd" into production 23 March 2015, 19:00:21 UTC
c02effd puppetmaster: Use cleaner syntax for shelling out Change-Id: I8dd218fe4cdd6d9c78ec17ec39b0ae4c89d1048f 23 March 2015, 18:51:46 UTC
02895d3 check_graphite: accept additional date specification I got bitten by this using from="1hour" and check_graphite goes UNKNOWN in icinga. Make it more tolerant of other date suffixes, this also makes the help text work as described ('day' was not accepted). Change-Id: Ib801f087c55fec5d3b9e3eead6d6101076d68c7d 23 March 2015, 18:35:31 UTC
dfaa234 Merge "wikistats: lint" into production 23 March 2015, 18:25:42 UTC
372d45f wikistats: lint Bug: T91908 Change-Id: I6c453fcbefad930f2a0e0455469c51a6d0a58f70 23 March 2015, 17:39:13 UTC
668f61d tools: Add CORS header to tools-static Bug: T93466 Change-Id: I698406f4c9c3ee37a244f444d6ca6dd31a3bb718 23 March 2015, 16:46:29 UTC
5c60924 Merge "scholarships: use HTTPS by default" into production 23 March 2015, 16:15:45 UTC
cf1f2d0 Merge "Rename and move quota settings." into production 23 March 2015, 16:12:51 UTC
71f934b Rename and move quota settings. No documentation for this! Change-Id: Id78b6f34207d64c28bd078607297c09000e460aa 23 March 2015, 16:09:33 UTC
ae541f7 scholarships: use HTTPS by default using the same standard clause for behind-misc hosts and add headers class to the manifest. Change-Id: I3d6de17bb7c614fa4f9210f498005c0a21f23bcb 23 March 2015, 16:09:06 UTC
61d666b phab set daemon management scripts as phd user Right now dropping to PHD user fails as these are root owned. refs T93477 Change-Id: I625ee8d4fe0f771184fff02e0f98c356032e2fdb 23 March 2015, 16:07:00 UTC
fa5301e Tools: Make "admin" and "administrator" system aliases Today, users were registered with the shell user names "admin" and "administrators". While not standardized per se like "abuse", "postmaster" or "webmaster" and thus covered by /etc/aliases, these bear a high risk of misleading third parties for example in mail correspondence. This change adds them as system aliases to /etc/aliases. Change-Id: I6380a4d3e5c49c1d05930e7990aef29362f49254 23 March 2015, 15:09:18 UTC
a9c18a6 Tools: Don't let user names mask system aliases Today, several users were registered with shell user names like "hostmaster", "postmaster" and "webmaster". While investigating how to block those in the mail system, I noticed that "webmaster" is forwarded to the user, but "Webmaster" is forwarded to the project administrators. This is due to the resolution order in the configuration: If a user name with an exact match exists, this wins over an homonymous system alias in /etc/aliases where case is ignored. This change prioritizes system aliases so that they are looked up first and cannot be masked by user names. Change-Id: I65619c341c3965618d0c1fd203a6e22ac9183fdb 23 March 2015, 12:36:45 UTC
0092361 swift: increase rsync server max_connections there are more machines in the fleet now, when changing weights it is likely that max_connections is being hit Bug: T1268 Change-Id: Icd1defe5fe6619e1c002422502ff6dafdc62d27e 23 March 2015, 10:10:51 UTC
0198a67 Replicate centralauth tables in dbstores No reason not to... but often very much needed. Obviously this is the smallest part of this, the tables need to be created/ populated in advance. Change-Id: I15ea04584e645a12663382be879cb9a41a7809f6 23 March 2015, 05:30:15 UTC
8f0d4d7 Grant access to the databases from codfw appserver networks Bug: T93211 Change-Id: I68777ee5a61bf190d2bbc5b6371f07be3428878b 23 March 2015, 04:56:25 UTC
054793d Merge "Attempt to raise quotas so that we can have more than 500 records." into production 22 March 2015, 17:03:19 UTC
d118f0b Attempt to raise quotas so that we can have more than 500 records. Change-Id: Ic5ca5570e5e7b5e0a48d98d548fa8adaf649d848 22 March 2015, 16:59:33 UTC
d72a449 add ferm service for poolcounterd tcp 0 0 0.0.0.0:7531 .. 19590/poolcounterd eqiad poolservers don't include base::firewall yet (so noop there), but i would like to on new codfw servers. (Iea291978649db8dddc729). Bug:T93261 Change-Id: Iae2bca2f24823701e61e2aad9d63b2c06c0c6d55 21 March 2015, 00:22:04 UTC
94ba37e have base::firewall on codfw poolcounters Bug:T93261 Change-Id: Iea291978649db8dddc72929381757bf552ec5643 21 March 2015, 00:16:17 UTC
aa0b83f add subra/suhail to site.pp as codfw poolcounters Just copying roles used by potassium and helium in eqiad. Bug:T93261 Change-Id: Iedc0ef51e3d3669577eea85db0d018be0f6449e2 21 March 2015, 00:06:41 UTC
63e32b4 Merge "gdash: mod_rewrite, mod_headers for proto redirect" into production 20 March 2015, 23:03:16 UTC
5a1c8ff gdash: mod_rewrite, mod_headers for proto redirect Apache for gdash now needs both modules for I29515ddd327179631 to work. Change-Id: Ic7511eaaf6ac6564d58ea56603081219561b9924 20 March 2015, 22:48:49 UTC
d0ae87a Merge "gdash: add protocol redirect to https" into production 20 March 2015, 22:41:46 UTC
c662f78 gdash: add protocol redirect to https gdash is behind misc-web. The snippet is used in several places for this purpose, for example dbtree and others. Change-Id: I29515ddd327179631eefc2323569ecd6e701e069 20 March 2015, 22:40:17 UTC
94a04f8 remove ori weekend commit check I've been behaving myself. Change-Id: I3ac89a8484d1981b69e10183cbd07918d67bb7a4 20 March 2015, 21:03:28 UTC
3b88a71 Merge "phabricator: delete legalpad.yaml" into production 20 March 2015, 21:02:02 UTC
d5fe388 misc: remove tungsten unused by misc-web Change-Id: I3645e0ce6a57b0efdffacf3b51ee144386d5427b 20 March 2015, 20:56:47 UTC
61fafff Merge "add a .bash_profile for myself" into production 20 March 2015, 20:49:55 UTC
2162f49 Merge "misc: remove radon.eqiad.wmnet from cache.pp" into production 20 March 2015, 20:49:18 UTC
ca64834 Update cassandra submodule Follow-up to https://gerrit.wikimedia.org/r/#/c/198297/ Change-Id: I61523ab3af9223a8e12518ce93e8bc24236a8f1a 20 March 2015, 20:49:02 UTC
2b61001 misc: remove radon.eqiad.wmnet from cache.pp radon is no longer used as a backend so this is unnecessary. Change-Id: Icece438a9fc370a4e8cfd94c31a297b2e1eaf70d 20 March 2015, 20:45:51 UTC
99d4d7e add a .bash_profile for myself run puppet as "sudo puppet" and steal Ori's fancy colors Change-Id: I580e4fa9512659cdbfc754abc256cbe44546f138 20 March 2015, 20:44:48 UTC
3463edf Merge "netboot: use lvm partman recipe for subra/suhail" into production 20 March 2015, 20:27:54 UTC
06881ce netboot: use lvm partman recipe for subra/suhail Because the others i tried here fail and i found in git log that this was once used by "tola" which was suhail in his last life. Change-Id: I2ccd7a62c2aaf7048dd108cac8eeb3e9c760d6a6 20 March 2015, 20:16:58 UTC
back to top