Dzahn has submitted this change and it was merged. (
https://gerrit.wikimedia.org/r/386793 )
Change subject: gerrit: sshd listen on specific IP, v4 and v6
......................................................................
gerrit: sshd listen on specific IP, v4 and v6
The Gerrit SSHd should only listen on the specific
IPs of gerrit.wimedia.org, IPv4 and IPv6, but not on *.
It should not also listen on cobalt.wikimedia.org.
We tried before to use the DNS name itself with listenAddress
which Gerrit does support, but apparently in that case it decides
to look up the name and use the A record for it, not the AAAA record
or both, breaking IPv6.
So instead we need to listen both explicitly and to have these
variables accesible in the template we need to add the existing
ipv4 and ipv6 parameters from Hiera/profile class also to gerrit
and gerrit::jetty and pass them through.
Change-Id: I2ce69f02258954db2b5a189bb36b659379190d62
---
M modules/gerrit/manifests/init.pp
M modules/gerrit/manifests/jetty.pp
M modules/gerrit/templates/gerrit.config.erb
M modules/profile/manifests/gerrit/server.pp
4 files changed, 10 insertions(+), 1 deletion(-)
Approvals:
Paladox: Looks good to me, but someone else must approve
jenkins-bot: Verified
Dzahn: Looks good to me, approved
diff --git a/modules/gerrit/manifests/init.pp b/modules/gerrit/manifests/init.pp
index 61f64c8..7d1fd4f 100644
--- a/modules/gerrit/manifests/init.pp
+++ b/modules/gerrit/manifests/init.pp
@@ -2,12 +2,16 @@
class gerrit(
$config,
$host,
+ $ipv4,
+ $ipv6,
$slave_hosts = [],
$slave = false,
) {
class { '::gerrit::jetty':
host => $host,
+ ipv4 => $ipv4,
+ ipv6 => $ipv6,
slave => $slave,
config => $config,
}
diff --git a/modules/gerrit/manifests/jetty.pp
b/modules/gerrit/manifests/jetty.pp
index 10cea92..40ec81a 100644
--- a/modules/gerrit/manifests/jetty.pp
+++ b/modules/gerrit/manifests/jetty.pp
@@ -2,6 +2,8 @@
# https://projects.eclipse.org/projects/rt.jetty/developer
class gerrit::jetty(
$host,
+ $ipv4,
+ $ipv6,
$db_host = 'localhost',
$replication = '',
$url = "https://${::gerrit::host}/r";,
diff --git a/modules/gerrit/templates/gerrit.config.erb
b/modules/gerrit/templates/gerrit.config.erb
index bd85289..2c02ca8 100644
--- a/modules/gerrit/templates/gerrit.config.erb
+++ b/modules/gerrit/templates/gerrit.config.erb
@@ -172,7 +172,8 @@
<%- if @slave %>
listenAddress = off
<%- else -%>
- listenAddress = *:29418
+ listenAddress = <%= @host %>:29418
+ listenAddress = [<%= @ipv6 %>]:29418
<%- end -%>
threads = 8
diff --git a/modules/profile/manifests/gerrit/server.pp
b/modules/profile/manifests/gerrit/server.pp
index 1c64147..2f06f8b 100644
--- a/modules/profile/manifests/gerrit/server.pp
+++ b/modules/profile/manifests/gerrit/server.pp
@@ -68,6 +68,8 @@
class { '::gerrit':
host => $host,
+ ipv4 => $ipv4,
+ ipv6 => $ipv6,
slave => $slave,
slave_hosts => $slave_hosts,
config => $config,
--
To view, visit https://gerrit.wikimedia.org/r/386793
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I2ce69f02258954db2b5a189bb36b659379190d62
Gerrit-PatchSet: 4
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Dzahn <dz...@wikimedia.org>
Gerrit-Reviewer: Chad <ch...@wikimedia.org>
Gerrit-Reviewer: Dzahn <dz...@wikimedia.org>
Gerrit-Reviewer: Hashar <has...@free.fr>
Gerrit-Reviewer: Paladox <thomasmulhall...@yahoo.com>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
