568678 - Grant talos machines access to http://build.mozilla.org/talos w/o LDAP auth

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Chris AtLee [:catlee]]

The talos machines need to be able to get to http://build.mozilla.org/talos without LDAP authentication.

Comment 1

[Nick Thomas [:nthomas] (UTC+12)]

So we probably just need
        <Directory /var/www/html/build/talos>
                Order allow,deny
                Allow from 10.250.48.0/22
                Satisfy any
        </Directory>
right after the block for stackwalk in 
 dm-wwwbuild01.m.o:/etc/httpd/conf/domains/build.mozilla.org.conf

Comment 2

[Dave Miller [:justdave]]

Done.

Comment 3

[Chris AtLee [:catlee]]

I think something changed last night.  I'm getting a 401 error now from the talos machines.

Ideally hitting this url wouldn't require being redirected to https://build.m.o/talos (as is happening now), and would also be cached by the squid proxy at Castro.

Comment 4

[Dave Miller [:justdave]]

It redirects everything (with a couple exceptions) to https.  /talos isn't one of those exceptions.

Comment 5

[Justin Dow [:jabba]]

I added Allow from 10.250.48.0/22 back into the block referenced in Comment 1 and also added:
Alias /talos /var/www/html/build/talos

and

	RewriteRule !^/talos - [C]

to the :80 vhost.

Catlee confirmed over IRC that it is now working properly.

Comment 6

[Chris AtLee [:catlee]]

Can we restrict access to /talos to just build/test machines?  There's a <Directory> section in the :443 vhost that should probably be moved or copied int he the :80 vhost.

Comment 7

[Justin Dow [:jabba]]

Added:

        <Directory /var/www/html/build/talos>
                Order allow,deny
                Allow from 63.245.220.220
                Allow from 10.250.48.0/22
                Satisfy any
        </Directory>

        <Location /talos>
                Options -Indexes
        </Location>

to the :80 virtual host.