1120384 - Create public fqdn of webqa-ci.mozilla.com to proxy traffic to http://webqa-ci1.qa.scl3.mozilla.com:8080/

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Description

[Dave Hunt [:davehunt] [he/him] ⌚BST]

See bug 1112555 for details and bug 1118241 for results of security review.

Comment 1

[:Atoll]

Hi, MOC.

I have no idea where to assign this request - they're asking for public (8080/tcp) access to a non-DMZ host that isn't managed by WebOps.

Could you help us triage this service request?

Comment 2

[:Atoll]

Per IRC, this is a NetOps DC ACL Request, so moving it to that component.

:ulfr, you did sec-review for bug 1118241, can you chime in here?

Comment 3

[Julien Vehent]

Dave: we typically don't open non-standard ports like this. This request would be easier to process if we went with the standard webops setup, which includes:

1. pick a public fqdn for the service, and not an internal machine hostname. For example: ci.qa.mozilla.com

2. obtain a certificate for the public fqdn

3. set a vhost on the external load balancer to terminate HTTPS with the certificate and proxy web traffic to http://webqa-ci1.qa.scl3.mozilla.com:8080/

Would this work for you? If so, let's transfer this bug over to webops.

Comment 4

[Dave Hunt [:davehunt] [he/him] ⌚BST]

(In reply to Julien Vehent [:ulfr] (use needinfo) from comment #3)
> Dave: we typically don't open non-standard ports like this. This request
> would be easier to process if we went with the standard webops setup, which
> includes:
> 
> 1. pick a public fqdn for the service, and not an internal machine hostname.
> For example: ci.qa.mozilla.com
> 
> 2. obtain a certificate for the public fqdn
> 
> 3. set a vhost on the external load balancer to terminate HTTPS with the
> certificate and proxy web traffic to
> http://webqa-ci1.qa.scl3.mozilla.com:8080/
> 
> Would this work for you? If so, let's transfer this bug over to webops.

Yes, this would all work for me. I would suggest webqa-ci.mozilla.com as the FQDN, what do you think Stephen?

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to Dave Hunt (:davehunt) from comment #4)
 
> Yes, this would all work for me. I would suggest webqa-ci.mozilla.com as the
> FQDN, what do you think Stephen?

Ship it -- yes, please! :-)

Comment 6

[Dave Hunt [:davehunt] [he/him] ⌚BST]

See comment 3 for details.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

I *think* this now depends on bug 1121453 -- clear the field if that's not the case, please :-)

Comment 8

[Dave Hunt [:davehunt] [he/him] ⌚BST]

I'd say bug 1121453 is a nice to have (and I see no reason that we won't have it) but it doesn't block moving forward on this bug. I think we just need to find an owner for this bug now that can set up what we need.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

:gozer -- is this something you could pick up for us?  Thanks!

Comment 10

[C. Liang [:cyliang]]

webqa-ci.mozilla.com should be set up and working.  HTTP traffic should be automatically re-directed to HTTPS.  Requests are logged at the ZLB.  Please verify that things are working as expected.  =)

I've also created a service entry in Inventory which lists the technical owner of the service (AKA "who should be poked if the underlying server is having issues") as Stephen Donner with a business owner (AKA "which director does this belong to") as Clint Talbert.

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to C. Liang [:cyliang] from comment #10)
> webqa-ci.mozilla.com should be set up and working.  HTTP traffic should be
> automatically re-directed to HTTPS.  Requests are logged at the ZLB.  Please
> verify that things are working as expected.  =)
> 
> I've also created a service entry in Inventory which lists the technical
> owner of the service (AKA "who should be poked if the underlying server is
> having issues") as Stephen Donner with a business owner (AKA "which director
> does this belong to") as Clint Talbert.

Thanks so, so much - to both you and Stephanie, for prioritizing this for us and making it happen!  <3

I've logged in, and will let Dave Hunt work with me, soon, on any further issues/needs; thanks!

Comment 12

[Dave Hunt [:davehunt] [he/him] ⌚BST]

This is *awesome* thank you so much! :)