BryanDavis has uploaded a new change for review.
https://gerrit.wikimedia.org/r/108722
Change subject: kibana: Allow /status from all
......................................................................
kibana: Allow /status from all
The prior CIDR allow stanzas were potentially confusing in that they
really did not restrict access to internal clients since requests
proxied by the frontend Varnish caches appear to be internal to the
Apache layer.
Change-Id: I14a2a72eb898be92b2439f1a169de77734740ca7
---
M templates/kibana/apache.conf.erb
1 file changed, 4 insertions(+), 3 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/22/108722/1
diff --git a/templates/kibana/apache.conf.erb b/templates/kibana/apache.conf.erb
index eef2c2b..e843747 100644
--- a/templates/kibana/apache.conf.erb
+++ b/templates/kibana/apache.conf.erb
@@ -87,9 +87,10 @@
# Disallow caching of status checks
Header set Cache-Control "private, must-revalidate, max-age=0"
Header set Expires "Thu, 01 Jan 1970 00:00:00 GMT"
- # Allow internal hosts to access this URI without authenticating
- Allow from 10.0.0.0/8
- Allow from 2620:0:860::/46
+ # Allow access this URI without authenticating
+ # Due to varnish frontend, all reqests are seen by Apache as being internal
+ # so using IP ranges is not any more restrictive than "all".
+ Allow from all
Satisfy Any
</Location>
--
To view, visit https://gerrit.wikimedia.org/r/108722
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I14a2a72eb898be92b2439f1a169de77734740ca7
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: BryanDavis <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
