Differential D2293

Provide a PaaS front-end role
AbandonedPublic
Actions

Authored by dereckson on Jun 3 2020, 17:43.

Tags

None

Referenced Files

	F25090399: D2293.id5778.diff
	Sun, Mar 29, 11:28

	Unknown Object (File)
	Thu, Mar 26, 18:35

	Unknown Object (File)
	Thu, Mar 26, 18:22

	Unknown Object (File)
	Thu, Mar 26, 10:43

	Unknown Object (File)
	Thu, Mar 26, 04:47

	Unknown Object (File)
	Wed, Mar 25, 18:53

	Unknown Object (File)
	Tue, Mar 24, 15:12

	Unknown Object (File)
	Tue, Mar 24, 15:11

Subscribers

None

Details

Reviewers

Maniphest Tasks

T1616: Build a bastion - load balancers - private instances network topology

Summary

Currently, each Docker engine software receives a nginx front-end.

This change consolidates them in a specific role, to allow to move
the Docker engines into the private part.

Test Plan

Browse each vhost and ensure it serves a 200, not a 502/504.

Diff Detail

Repository

rOPS Nasqueron Operations

Lint

Lint Passed

Unit

No Test Coverage

Branch

paas-docker-frontend

Build Status

Buildable 3566
Build 3815: arc lint + arc unit

Event Timeline

dereckson requested review of this revision.Jun 3 2020, 17:43

dereckson created this revision.

Harbormaster completed remote builds in B3565: Diff 5777.Jun 3 2020, 17:43

Hmmm, no autosave on this Atom

Harbormaster completed remote builds in B3566: Diff 5778.Jun 3 2020, 17:45

Date. No need for dirs variable.

Harbormaster completed remote builds in B3567: Diff 5779.Jun 3 2020, 18:46

dereckson mentioned this in T1616: Build a bastion - load balancers - private instances network topology.Apr 15 2022, 19:21

dereckson added inline comments.May 27 2022, 09:06

roles/paas-frontend/nginx/config.sls
64
76

The issue with this idea is we've to load balance more than HTTP:

various XMPP ports for OpenFire
SSH port 5022 for DevCentral

Not currently in scope as:

most services switch to localhost or 172.27.27.5 to listen to services
we first need a correct load balancer solution, with keepalive
we also need to load balance non-HTTP ports (XMPP ports for openfire, 5022 for devcentral)
to rebase this change against webserver-core won't be efficient

Plan is instead to first create a general load balancer role, then move paas-docker nginx on it

Revision Contents
Changeset List

Path

Size

roles/

paas-docker/

nginx/

files/

includes/

selinux/

vhosts/

auth-grove.conf

base/

phabricator.conf

wwwroot-502/

	paas-frontend/
	paas-docker/


	nginx/

10 lines

nginx/

4 lines

files/

includes/

24 lines

20 lines

48 lines

28 lines

58 lines

selinux/

30 lines

vhosts/

2 lines

2 lines

auth-grove.conf

2 lines

base/

27 lines

58 lines

2 lines

2 lines

2 lines

68 lines

phabricator.conf

8 lines

2 lines

2 lines

2 lines

2 lines

26 lines

13 lines

49 lines

25 lines

wwwroot-502/

29 lines

Diff 5778

roles/paas-docker/nginx/config.sls

Loading...

roles/paas-docker/nginx/files/includes/geo_nasqueron

Loading...

roles/paas-docker/nginx/files/includes/letsencrypt

Loading...

roles/paas-docker/nginx/files/includes/proxy_params

Loading...

roles/paas-docker/nginx/files/includes/tls

Loading...

roles/paas-docker/nginx/files/nginx.conf

Loading...

roles/paas-docker/nginx/files/selinux/nginx.te

Loading...

roles/paas-docker/nginx/files/vhosts/_default.conf

Loading...

roles/paas-docker/nginx/files/vhosts/acme_dns.conf

Loading...

roles/paas-docker/nginx/files/vhosts/auth-grove.conf

Loading...

roles/paas-docker/nginx/files/vhosts/base/fallback.conf

Loading...

roles/paas-docker/nginx/files/vhosts/base/server.conf

Loading...

roles/paas-docker/nginx/files/vhosts/cachet.conf

Loading...

roles/paas-docker/nginx/files/vhosts/etherpad.conf

Loading...

roles/paas-docker/nginx/files/vhosts/jenkins.conf

Loading...

roles/paas-docker/nginx/files/vhosts/openfire.conf

Loading...

roles/paas-docker/nginx/files/vhosts/phabricator.conf

Loading...

roles/paas-docker/nginx/files/vhosts/pixelfed.conf

Loading...

roles/paas-docker/nginx/files/vhosts/registry.conf

Loading...

roles/paas-docker/nginx/files/vhosts/sentry.conf

Loading...

roles/paas-docker/nginx/files/vhosts/tommy.conf

Loading...

roles/paas-docker/nginx/firewall.sls

Loading...

roles/paas-docker/nginx/init.sls

Loading...

roles/paas-docker/nginx/selinux.sls

Loading...

roles/paas-docker/nginx/software.sls

Loading...

roles/paas-docker/wwwroot-502/init.sls

Loading...

roles/paas-frontend/init.sls

Loading...

roles/paas-frontend/nginx/config.sls

Loading...

roles/paas-frontend/nginx/files/includes/geo_nasqueron

Loading...

roles/paas-frontend/nginx/files/includes/letsencrypt

Loading...

roles/paas-frontend/nginx/files/includes/proxy_params

Loading...

roles/paas-frontend/nginx/files/includes/tls

Loading...

roles/paas-frontend/nginx/files/nginx.conf

Loading...

roles/paas-frontend/nginx/files/selinux/nginx.te

Loading...

roles/paas-frontend/nginx/files/vhosts/_default.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/acme_dns.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/auth-grove.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/base/fallback.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/base/server.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/cachet.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/etherpad.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/jenkins.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/openfire.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/phabricator.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/pixelfed.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/registry.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/sentry.conf

Loading...

roles/paas-frontend/nginx/files/vhosts/tommy.conf

Loading...

roles/paas-frontend/nginx/firewall.sls

Loading...

roles/paas-frontend/nginx/init.sls

Loading...

roles/paas-frontend/nginx/selinux.sls

Loading...

roles/paas-frontend/nginx/software.sls

Loading...

roles/paas-frontend/wwwroot-502/init.sls

Loading...