#musicbrainz-devel

/

      • ruaok
        what does that do?

        • 2015-04-24 11418, 2015

      • kepstin-laptop
        (you might be able to use a service module to enable it instead of running that manually)

        • 2015-04-24 11438, 2015

      • kepstin-laptop
        the service didn't get the symlinks in /etc/rc*.d installed, that installs them.

        • 2015-04-24 11457, 2015

      • ruaok
        ah

        • 2015-04-24 11422, 2015

      • ruaok
        pushed.

        • 2015-04-24 11419, 2015

      • kepstin-laptop
        ok, that looks good. it's happily moving the ips back and forth, and survives reboots. I'm just gonna try the dual poweroff scenario then i'll be satisfied

        • 2015-04-24 11433, 2015

      • ruaok
        :-D

        • 2015-04-24 11418, 2015

      • ruaok
        packemaker links installed.

        • 2015-04-24 11420, 2015

      • ruaok
        looking good.

        • 2015-04-24 11428, 2015

      • bagoluls joined the channel

        • 2015-04-24 11450, 2015

      • ruaok
        and also, the traffic shaper is getting installed. might be worth testing that too.

        • 2015-04-24 11456, 2015

      • kepstin-laptop
        ok, everything came back up fine

        • 2015-04-24 11414, 2015

      • kepstin-laptop
        I've tested the script separately before

        • 2015-04-24 11427, 2015

      • ruaok
        ok. :)

        • 2015-04-24 11429, 2015

      • ruaok
        \ø/

        • 2015-04-24 11433, 2015

      • ruaok
        thanks so much.

        • 2015-04-24 11448, 2015

      • ruaok
        I just need to test dnscache on ernie and then I think I am done.

        • 2015-04-24 11458, 2015

      • kepstin-laptop
        ok, this corosync+pacemaker config is looking good now.

        • 2015-04-24 11418, 2015

      • ruaok
        :(

        • 2015-04-24 11438, 2015

      • kepstin-laptop
        ruaok, yep, that means out of date openssl or nginx version.

        • 2015-04-24 11439, 2015

      • ruaok
        we need to update our wildcard cert.

        • 2015-04-24 11414, 2015

      • ruaok
        let me do an apt-get upgrade again

        • 2015-04-24 11429, 2015

      • kepstin-laptop
        globalsign run their own ssl checker, but i find they try to upsell you on their own services, and the diagnostics aren't as good as the ssllabs one

        • 2015-04-24 11447, 2015

      • Gentlecat
        ruaok: maybe get a cert for meb.org while you are at it

        • 2015-04-24 11412, 2015

      • ruaok
        I'll do that next week when I deploy meb

        • 2015-04-24 11427, 2015

      • ruaok
        I wonder if we can make meb SSL only.

        • 2015-04-24 11404, 2015

      • ruaok
        upgraded packages. didn't see anything pertaining to ssl being updated.

        • 2015-04-24 11412, 2015

      • ruaok
        doing a reboot test now.

        • 2015-04-24 11416, 2015

      • Gentlecat
        definitely need to do that for user account parts

        • 2015-04-24 11435, 2015

      • Gentlecat
        alastairp: got a question about your comment https://github.com/metabrainz/acousticbrainz-serv…

        • 2015-04-24 11442, 2015

      • ruaok
        I'm considering doing it for ALL urls, save for hte replication fetch

        • 2015-04-24 11453, 2015

      • kepstin-laptop
        ruaok, this is 'www.musicbrainz.org' you're testing?

        • 2015-04-24 11403, 2015

      • ruaok
        no gtest.musicbrainz.org

        • 2015-04-24 11415, 2015

      • yeeeargh
        tsl only with a+ would be great

        • 2015-04-24 11418, 2015

      • ruaok
        which is running the * cert with sha1.

        • 2015-04-24 11425, 2015

      • ruaok
        but at least the software ought to be up to date.

        • 2015-04-24 11427, 2015

      • yeeeargh
        *tls

        • 2015-04-24 11432, 2015

      • Gentlecat
        I was thinking only about editing, but it seems sensible to do that on the server since we'll need that data for viewing datasets

        • 2015-04-24 11402, 2015

      • ruaok
        how do I fix this, yeeeargh & kepstin-laptop ?

        • 2015-04-24 11404, 2015

      • Gentlecat
        did you mean caching on the server for a certain amount of time?

        • 2015-04-24 11418, 2015

      • kepstin-laptop
        ruaok, just a moment, the ssllabs test isn't connecting, and I want to see its diagnostics.

        • 2015-04-24 11429, 2015

      • ruaok
        hang on, I just broke something.

        • 2015-04-24 11434, 2015

      • ruaok
        nginx didn't come up cleanly.

        • 2015-04-24 11452, 2015

      • ruaok
        the vhost is gone.

        • 2015-04-24 11429, 2015

      • ruaok
        the virtual ip survived reboot, so that is good. :)

        • 2015-04-24 11441, 2015

      • ruaok
        gotta clean up a little mess real quick. hang on.

        • 2015-04-24 11445, 2015

      • Gentlecat
        alastairp: I'll post that on github

        • 2015-04-24 11450, 2015

      • kepstin-laptop
        what ubuntu version is the nginx that's terminating ssl running?

        • 2015-04-24 11409, 2015

      • kepstin-laptop
        should be able to do tls1.2 in 12.04 and newer

        • 2015-04-24 11423, 2015

      • ruaok
        sUbuntu 14.04.2 LTS

        • 2015-04-24 11430, 2015

      • ruaok
        or did you mean the nginx version?

        • 2015-04-24 11441, 2015

      • kepstin-laptop
        need to make sure it has "ssl_protocols TLSv1.2 TLSv1.1 TLSv1;" in the config

        • 2015-04-24 11458, 2015

      • ruaok
        1.4.6-1ubuntu3.2

        • 2015-04-24 11413, 2015

      • kepstin-laptop
        ok, should have no problem, those package versions are plenty new enough

        • 2015-04-24 11436, 2015

      • ruaok
        ok, I see that.

        • 2015-04-24 11448, 2015

      • ruaok
        trouble is that might conflict with the production version.

        • 2015-04-24 11453, 2015

      • ruaok
        er, fuckit for now.

        • 2015-04-24 11427, 2015

      • Enverex joined the channel

        • 2015-04-24 11453, 2015

      • kepstin-laptop
        but yeah, there's nothing listening on port 443 on 72.29.167.152 right now.

        • 2015-04-24 11414, 2015

      • Enverex
        Silly question whilst the server continues to fall over - what's the general turnaround time on edits these days?

        • 2015-04-24 11406, 2015

      • kepstin-laptop
        Enverex, seems like more of a user question, but https://musicbrainz.org/doc/Introduction_to_Voting should cover it.

        • 2015-04-24 11451, 2015

      • ruaok
        hmmm. something didn't work right on boot.

        • 2015-04-24 11459, 2015

      • ruaok
        but it worked after a chef deploy.

        • 2015-04-24 11403, 2015

      • ruaok
        I need to get to the bottom of that.

        • 2015-04-24 11444, 2015

      • kepstin-laptop
        do you have nginx binding to specific ip addresses in the config?

        • 2015-04-24 11411, 2015

      • ruaok
        yes, the one virtual ip I have.

        • 2015-04-24 11412, 2015

      • kepstin-laptop
        if you are, it will fail to start if the ip isn't available.

        • 2015-04-24 11414, 2015

      • ruaok
        and a pile I don't have.

        • 2015-04-24 11431, 2015

      • ruaok
        problem is it started, but it failed out the vhost.

        • 2015-04-24 11436, 2015

      • ruaok
        I need to look at the logs.

        • 2015-04-24 11442, 2015

      • ruaok
        but I am re-running the ssllabs one

        • 2015-04-24 11414, 2015

      • kepstin-laptop
        yeah, gets an A now, main warning is the sha1 cert

        • 2015-04-24 11418, 2015

      • ruaok
        A!!!

        • 2015-04-24 11433, 2015

      • ruaok
        it will get better with the main cert since we switched to sha2 a while back.

        • 2015-04-24 11434, 2015

      • kepstin-laptop
        you're also including the root cert in the cert chain, which you shouldn't be

        • 2015-04-24 11441, 2015

      • kepstin-laptop
        should only be the servers's cert and the intermediate

        • 2015-04-24 11456, 2015

      • kepstin-laptop
        (that'll make the ssl setup a bit faster, 1 less cert to transmit)

        • 2015-04-24 11408, 2015

      • ruaok
        gateway-chef/cookbooks/ssl/files/default/wildcard.musicbrainz.crt

        • 2015-04-24 11413, 2015

      • ruaok
        what there needs to be nuked?

        • 2015-04-24 11415, 2015

      • kepstin-laptop
        delete the third block

        • 2015-04-24 11421, 2015

      • kepstin-laptop
        keep the first 2

        • 2015-04-24 11426, 2015

      • Enverex
        kepstin-laptop: Yep, my bad.

        • 2015-04-24 11441, 2015

      • Leo_Verto
        wee, no downgrading to B anymore :D

        • 2015-04-24 11450, 2015

      • kepstin-laptop
        ssllabs is giving some "weak' notices on some ciphers, that's because it's using 1024bit diffie-hellman. That's fine for now, but might be worth looking at to change to 2048 bit later.

        • 2015-04-24 11409, 2015

      • ruaok
        yeah. and the main cert is sha2.

        • 2015-04-24 11423, 2015

      • ruaok
        ok, giving another whirl

        • 2015-04-24 11448, 2015

      • ruaok
        the anchor bit is gone. :)

        • 2015-04-24 11421, 2015

      • ruaok
        looking better.

        • 2015-04-24 11430, 2015

      • ruaok
        ok, need to take a bit of a break.

        • 2015-04-24 11443, 2015

      • ruaok
        I'll re-do the reboot test and do my final dnscache check.

        • 2015-04-24 11452, 2015

      • ruaok
        after that, I'll try to migrate to the new gateway.

        • 2015-04-24 11455, 2015

      • ruaok
        bbiab

        • 2015-04-24 11456, 2015

      • kepstin-laptop
        ok. don't forget to remove me from the repo when you're done :)

        • 2015-04-24 11406, 2015

      • ruaok
        will do.

        • 2015-04-24 11455, 2015

      • ruaok
        kepstin-laptop: did everything come back up on boot for you?

        • 2015-04-24 11408, 2015

      • ruaok
        my nginx comes up, but the vhost isn't working.

        • 2015-04-24 11425, 2015

      • ruaok
        nothing interesting in the logs.

        • 2015-04-24 11443, 2015

      • kepstin-laptop
        hmm, let me look at the nginx config you have

        • 2015-04-24 11444, 2015

      • ruaok
        but as soon as I do another chef deploy, it starts working.

        • 2015-04-24 11454, 2015

      • kepstin-laptop
        i was mostly concentrating on the ip stuff, didn't really look at nginx

        • 2015-04-24 11423, 2015

      • kepstin-laptop
        can i see the nginx config being used somewhere?

        • 2015-04-24 11436, 2015

      • ruaok
        sure one sec

        • 2015-04-24 11404, 2015

      • ruaok
        well, if you still have those instances...

        • 2015-04-24 11410, 2015

      • ruaok
        /usr/local/nginx

        • 2015-04-24 11418, 2015

      • ruaok
        if not, I can add you to the team on github.

        • 2015-04-24 11422, 2015

      • kepstin-laptop
        I didn't do the full setup on them

        • 2015-04-24 11430, 2015

      • ruaok
        ah

        • 2015-04-24 11436, 2015

      • kepstin-laptop
        missing some of the bits to get your chef config going

        • 2015-04-24 11437, 2015

      • rvedotrc pops in again.

        • 2015-04-24 11439, 2015

      • kepstin-laptop
        i think

        • 2015-04-24 11425, 2015

      • ruaok
        rvedotrc: wb. how does tinydns bind to a specific IP? or does it?

        • 2015-04-24 11459, 2015

      • rvedotrc
        iirc, /etc/tinydns/env/IP

        • 2015-04-24 11410, 2015

      • rvedotrc
        something like that.

        • 2015-04-24 11413, 2015

      • ruaok
        kepstin-laptop: I invited you to be part of the metabrainz team.

        • 2015-04-24 11422, 2015

      • kepstin-laptop
        oh, on github

        • 2015-04-24 11424, 2015

      • ruaok
        accept that and then look at the nginx repo

        • 2015-04-24 11434, 2015

      • ruaok
        yeah. that one doesn't live on bb.

        • 2015-04-24 11426, 2015

      • ruaok
        rvedotrc: the IP file shows only localhost. but on carl it listens on .250

        • 2015-04-24 11430, 2015

      • ruaok
        how does that work?

        • 2015-04-24 11446, 2015

      • rvedotrc looks

        • 2015-04-24 11421, 2015

      • rvedotrc
        dnscache is on .250, tinydns is on 12.0.0.1

        • 2015-04-24 11426, 2015

      • rvedotrc
        different services.

        • 2015-04-24 11446, 2015

      • rvedotrc
        which one are you asking about?

        • 2015-04-24 11408, 2015

      • rvedotrc
        grep ^ /etc/dnscache/env/* /etc/tinydns/env/*

        • 2015-04-24 11425, 2015

      • ruaok
        ah. I didn't know much about either of those.

        • 2015-04-24 11431, 2015

      • ruaok
        but it makes sense now.

        • 2015-04-24 11437, 2015

      • rvedotrc
        cool :-)

        • 2015-04-24 11440, 2015

      • ruaok
        I'll have to tweak the configs in order to test that.

        • 2015-04-24 11429, 2015

      • bagoluls
        hey guys, how does one build the search indexes?

        • 2015-04-24 11425, 2015

      • bagoluls
        nevermind, found it :)

        • 2015-04-24 11449, 2015

      • ruaok
        looks like tinydns isn't working. it used to be. :(

        • 2015-04-24 11407, 2015

      • rvedotrc
        Anything I can help with?

        • 2015-04-24 11420, 2015

      • johtso_ joined the channel

        • 2015-04-24 11428, 2015

      • ruaok
        are you averse to logging into the new gateway?

        • 2015-04-24 11440, 2015

      • ruaok
        if not, ernie.musicbrainz.org

        • 2015-04-24 11441, 2015

      • kepstin-laptop
        interesting; nginx's behaviour differs in how it binds to ips depending on whether or not a config is present that binds to * on the port in question.

        • 2015-04-24 11449, 2015

      • rvedotrc
        Why not. Username rachel? :-)

        • 2015-04-24 11405, 2015

      • ruaok
        rvedotrc: if you send us a PR for that, I can change that.

        • 2015-04-24 11411, 2015

      • ruaok
        alas, still djce.

        • 2015-04-24 11414, 2015

      • rvedotrc
        PR to what codebase?

        • 2015-04-24 11433, 2015

      • kepstin-laptop
        is there anything in the config that has "listen 80" or "listen *:80" (or :443), or do all listens specify an ip address?

        • 2015-04-24 11433, 2015

      • ruaok
        syswiki

        • 2015-04-24 11433, 2015

      • rvedotrc
        also, hostname?

        • 2015-04-24 11440, 2015

      • ruaok
        ernie

        • 2015-04-24 11443, 2015

      • rvedotrc
        k

        • 2015-04-24 11422, 2015

      • ruaok
        feel free to make changes, but let me know what you change so I can get that into the chef config.

        • 2015-04-24 11432, 2015

      • ruaok
        I added an internal ip .150 for testing purposes.

        • 2015-04-24 11448, 2015

      • ruaok
        and changed dnscache/env/IP to be .150

        • 2015-04-24 11456, 2015

      • kepstin-laptop
        it looks like if there is a listener on * for some port, nginx only listens on *, and does not bind separately to the ips.

        • 2015-04-24 11409, 2015

      • kepstin-laptop
        if there is no listener to *, it *only* binds to the separate ips.