Bug ID: 61897
           Summary: Move LabsDB aliases and NAT to DNS and LabsDB servers
           Product: Wikimedia Labs
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: Unprioritized
         Component: Infrastructure
       Web browser: ---
   Mobile Platform: ---

At the moment, Labs instances that want to be able to connect to
"dewiki.labsdb" and end up at the DB replica server hosting the German
Wikipedia, have to copy /etc/hosts from a Tools instance and set up iptables
according to /data/project/.system/iptables.conf.

I tried to puppetize this in Gerrit change #107010, but it turned out that
using ferm (base::firewall) for iptables has severe side effects (like locking
myself out from my test instance :-)).

There is however an alternative that is rather easy to set up and maintain:
Move the aliases to DNS, and the NAT rules to the DB servers itself.  This way
we only have to test (and worry) about three hosts and not dozens.

This would include:

- allocating seven IP addresses,
- routing them to the LabsDB servers,
- setting up a DNS zone labsdb with the aliases pointing at the IP addresses,
- setting up firewall and NAT on the LabsDB servers.

Thus, new instances in Tools and other Labs projects would have instant access
(minus credentials) to the replica servers.  Existing instances would not be

You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
Wikibugs-l mailing list

Reply via email to