964486 - Set up alternate IP/DNS for ftp

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: WebOps: Product Delivery, task)

Description

[Chris AtLee [:catlee]]

Can we please set up a new DNS name and IP address for ftp.m.o?

We need to divert some traffic out of our VPN tunnel to the public internet. We'd like to move SSL traffic to/from ftp outside the VPN, but that requires us to have a different IP to adjust the routing tables.

I'm not picky about the name, 'ftp-ssl' or something would WFM.

Comment 1

[Peter Radcliffe [:pir]]

On a tangentially related note, is there any caching in AWS for downloads from ftp.mozilla.org?

Comment 2

[Chris AtLee [:catlee]]

(In reply to Peter Radcliffe [:pir] from comment #1)
> On a tangentially related note, is there any caching in AWS for downloads
> from ftp.mozilla.org?

no :(

Comment 3

[Chris Turra [:cturra]]

(In reply to Peter Radcliffe [:pir] from comment #1)
> On a tangentially related note, is there any caching in AWS for downloads
> from ftp.mozilla.org?

we've been actively mirroring data to amazon s3, but we're not actively serving any of that content.

Comment 4

[Chris Turra [:cturra]]

dropping important so it doesn't page on call.

Comment 5

[Chris Turra [:cturra]]

grabbing this bug.

Comment 6

[Chris Turra [:cturra]]

i've got this all sorted (special thnx to :adam too). there is now a dedicated ssl-only vip for the ftp cluster. you can find it at: ftp-ssl.mozilla.org

in addition to this configuration, i went ahead and updated the ftp.mo ssl certificate to include a subject alternative name for ftp-ssl so we didnt have to deal with SNI or other host header shenanigans.

 $ dig +short ftp-ssl.mozilla.org
 ftp-ssl-zlb.vips.scl3.mozilla.com.
 63.245.215.129

 $ curl -I https://ftp-ssl.mozilla.org/pub/mozilla.org/firefox/releases/26.0/
 HTTP/1.1 200 OK
 Server: Apache
 X-Backend-Server: ftp2.dmz.scl3.mozilla.com
 Cache-Control: max-age=300
 Content-Type: text/html;charset=UTF-8
 Date: Tue, 28 Jan 2014 22:07:17 GMT 
 Expires: Tue, 28 Jan 2014 22:12:17 GMT
 Transfer-Encoding: chunked
 Access-Control-Allow-Origin: *
 Connection: Keep-Alive
 X-Cache-Info: caching