1476406 - /etc/mercurial/mirror on hgssh1.dmz.mdc1 is wrong

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Gregory Szorc [:gps]]

The /etc/mercurial/mirror file on hgssh1.dmz.mdc1 is wrong. Or at least it isn't an RSA private key registered with the [e-mail] LDAP user. The file definitely varies from what is on hgssh4.dmz.scl3.mozilla.com and I expect the files to be the same.

The file is put in place by Puppet. So this smells like a Puppet misconfiguration issue.

fubar: could you please look into this? This is blocking our ability to perform an Ansible deploy in MDC1.

Comment 1

[Kendall Libby [:fubar] (he/him)]

This is not managed by puppet, though I think it had been at one point.

ansible/roles/hg-ssh/tasks/main.yml:

- name: replication SSH key is present
  command: /usr/bin/ssh-keygen -b 4096 -f /etc/mercurial/mirror -t rsa -N '' creates=/etc/mercurial/mirror

Comment 2

[Gregory Szorc [:gps]]

Hmmm.

Well, the SSH key has to be registered in LDAP. So I guess we manually placed it there on hgssh in scl3. Or it was already there.

The Ansible code for creating it probably exists to support the container-based testing environment.

I guess the solution here is to manually replace /etc/mercurial/mirror on mdc1 and we'll be on our way.

That being said, a better solution is to have Puppet populate this file. Because it is a secret that needs to persist across new servers.

Comment 3

[Gregory Szorc [:gps]]

I manually updated the file on hgssh1 and hgssh3. I'll leave open in case fubar wants to add this file to Puppet. If not, then it can be resolved. But we have to be cognizant to manually update this file when we provision new hgssh servers.

Comment 4

[Kendall Libby [:fubar] (he/him)]

Added to puppet.