Dzahn has submitted this change and it was merged. ( https://gerrit.wikimedia.org/r/354074 )
Change subject: gerrit-ssh: don't listen on all interfaces, disable on slaves ...................................................................... gerrit-ssh: don't listen on all interfaces, disable on slaves Gerrit servers have a server and a service IP, and we also do pass the service IP to the manifests but then we let the Gerrit SSHd listen on all interfaces anyways, not just on the service IP. Change that and listen only on the server name (which it can, tested in labs by Paladox). Docs say that setting listenAddress to "off" means disabling sshd and that the port can be omitted to use the default of 29418. https://gerrit-review.googlesource.com/Documentation/config-gerrit.html Change-Id: Idbc1654033fb075ededd0dd5fcd7d460f288735b --- M modules/gerrit/manifests/init.pp M modules/gerrit/manifests/jetty.pp M modules/gerrit/templates/gerrit.config.erb 3 files changed, 8 insertions(+), 1 deletion(-) Approvals: Paladox: Looks good to me, but someone else must approve Alexandros Kosiaris: Looks good to me, but someone else must approve jenkins-bot: Verified Dzahn: Looks good to me, approved diff --git a/modules/gerrit/manifests/init.pp b/modules/gerrit/manifests/init.pp index 6f88341..61f64c8 100644 --- a/modules/gerrit/manifests/init.pp +++ b/modules/gerrit/manifests/init.pp @@ -7,6 +7,7 @@ ) { class { '::gerrit::jetty': + host => $host, slave => $slave, config => $config, } diff --git a/modules/gerrit/manifests/jetty.pp b/modules/gerrit/manifests/jetty.pp index f4439fe..10cea92 100644 --- a/modules/gerrit/manifests/jetty.pp +++ b/modules/gerrit/manifests/jetty.pp @@ -1,6 +1,7 @@ # sets up jetty for gerrit # https://projects.eclipse.org/projects/rt.jetty/developer class gerrit::jetty( + $host, $db_host = 'localhost', $replication = '', $url = "https://${::gerrit::host}/r";, diff --git a/modules/gerrit/templates/gerrit.config.erb b/modules/gerrit/templates/gerrit.config.erb index ed76f00..b25dbf3 100644 --- a/modules/gerrit/templates/gerrit.config.erb +++ b/modules/gerrit/templates/gerrit.config.erb @@ -169,7 +169,12 @@ connectTimeout = 1 min smtpServer = <%= @mail_smarthost[0] %> [sshd] - listenAddress = *:29418 + <%- if @slave %> + listenAddress = off + <%- else -%> + listenAddress = <%= @host %>:29418 + <%- end -%> + threads = 8 batchThreads = 2 idleTimeout = 864000 -- To view, visit https://gerrit.wikimedia.org/r/354074 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: Idbc1654033fb075ededd0dd5fcd7d460f288735b Gerrit-PatchSet: 14 Gerrit-Project: operations/puppet Gerrit-Branch: production Gerrit-Owner: Dzahn <[email protected]> Gerrit-Reviewer: Alexandros Kosiaris <[email protected]> Gerrit-Reviewer: Chad <[email protected]> Gerrit-Reviewer: Dzahn <[email protected]> Gerrit-Reviewer: Giuseppe Lavagetto <[email protected]> Gerrit-Reviewer: Paladox <[email protected]> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
