Muehlenhoff has submitted this change and it was merged.
Change subject: Create a common ferm base class for the database hosts and move
the existing labsdb slave definition over to it
......................................................................
Create a common ferm base class for the database hosts and move the existing
labsdb slave definition over to it
Bug: T104699
Change-Id: I39ca592fe9d6f27f7c672c5d6203e55eaa6bd777
---
M manifests/role/mariadb.pp
1 file changed, 24 insertions(+), 6 deletions(-)
Approvals:
Jcrespo: Looks good to me, but someone else must approve
Muehlenhoff: Verified; Looks good to me, approved
diff --git a/manifests/role/mariadb.pp b/manifests/role/mariadb.pp
index f0d3449..78995ab 100644
--- a/manifests/role/mariadb.pp
+++ b/manifests/role/mariadb.pp
@@ -43,6 +43,29 @@
}
}
+class role::mariadb::ferm {
+
+ # Common ferm class for database access. The actual databases are
listening on 3306
+ # and are initially limited to the internal network. More specialised sub
classes
+ # can grant additional access to other hosts
+
+ ferm::service{ 'mariadb_internal':
+ proto => 'tcp',
+ port => 3306,
+ srange => '$INTERNAL',
+ }
+
+ # tendril monitoring
+ ferm::rule { 'mariabdb_monitoring':
+ rule => "saddr @resolve((neon.wikimedia.org iron.wikimedia.org)) proto
tcp dport (3306) ACCEPT;",
+ }
+
+ # for DBA purposes
+ ferm::rule { 'mariabdb_dba':
+ rule => "saddr @resolve((neon.wikimedia.org iron.wikimedia.org
db1011.eqiad.wmnet)) proto tcp dport (3307) ACCEPT;",
+ }
+}
+
# Annoy people in #wikimedia-operations
class role::mariadb::monitor {
@@ -479,6 +502,7 @@
include role::mariadb::grants
include role::mariadb::monitor
include passwords::misc::scripts
+ include role::mariadb::ferm
class { 'mariadb::packages_wmf':
mariadb10 => true,
@@ -504,12 +528,6 @@
owner => 'mysql',
group => 'mysql',
mode => '0755',
- }
-
- ferm::service{ 'mariadb-labsdb':
- proto => 'tcp',
- port => 3306,
- srange => '$INTERNAL',
}
# Required for TokuDB to start
--
To view, visit https://gerrit.wikimedia.org/r/228228
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I39ca592fe9d6f27f7c672c5d6203e55eaa6bd777
Gerrit-PatchSet: 4
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Muehlenhoff <[email protected]>
Gerrit-Reviewer: Dzahn <[email protected]>
Gerrit-Reviewer: Jcrespo <[email protected]>
Gerrit-Reviewer: Muehlenhoff <[email protected]>
Gerrit-Reviewer: Springle <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
