927520 - Remove unnecessary Zeus VIPs after SSL consolidation to SAN certificate

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Description

[Jason Crowe [:jd]]

Changing from SNI to SAN on the generic VIP in phx1 allows us to remove the VIPs which were added to work around SNI. The new SAN cert has been installed on all of these VIPs and all of these domains are configured correctly on the generic-ssl VIP. All that needs to be done here is to change the DNS for each of these domains. This of course will require CAB and scheduling. This bug is for tracking.

These will just need the CNAME changed to 'generic.zlb.phx.mozilla.net'
or the A set to 63.245.217.86

The list of domains (by VIP) is:
blog.mozilla.org & blog.mozilla.com
basket.mozilla.org & basket.mozilla.com
wiki.mozilla.org

Comment 1

[Jake Maul [:jakem]]

all moved back in DNS
basket and blogmo vhosts are disabled in ZLB


Still TODO:

wiki.mozilla.org vhost is still enabled (waiting on propagation)
getfirebug.com vhost is still enabled (waiting on propagation)
all vhosts still exist (waiting to verify nothing is broken)
all TIGs and IP reservations in DNS still exist (waiting to verify nothing is broken)

Should be easy to resolve completely tomorrow.

Comment 2

[Jake Maul [:jakem]]

undid changes to getfirebug.com, that one is *not* on the generic SAN. Fail.

wiki.mozilla.org vhost is still getting traffic somehow. Need to check ZLB logs to figure out what's up.

Comment 3

[Jake Maul [:jakem]]

Vservers, DNS records, and TIGS deleted for for blog, basket, and wikimo.

All done here, I think.


FYI, traffic to wikimo in comment 2 was an external bot scraping the site. Not concerned about it.