Hi all,
Could I get +1s for the below patch?
Thanks, Patrick
From 46dc8281edb9b874075525b1756ed0cfa0f91575 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk patrick@puiterwijk.org Date: Wed, 6 Mar 2019 21:11:12 +0100 Subject: [PATCH] Add rabbitmq proxying to the proxies
Signed-off-by: Patrick Uiterwijk patrick@puiterwijk.org --- inventory/group_vars/proxies | 5 +++++ inventory/group_vars/proxies-stg | 5 +++++ roles/haproxy/templates/haproxy.cfg | 28 ++++++++++++++++++++++++++++ 3 files changed, 38 insertions(+)
diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 4b97c2ae3..8901de118 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -17,6 +17,11 @@ tcp_ports: [ # This is for TCP krb5 1088,
+ # This is for RabbitMQ public access + 5671, + # This is for RabbitMQ internal-public access + 15671, + # This is for the haproxy HTML stats page # TODO -- there's no need for this to be wide open to the world. With this # in place, you can visit https://apps.fedoraproject.org:8080 and get the diff --git a/inventory/group_vars/proxies-stg b/inventory/group_vars/proxies-stg index 7aeb745e7..f5590beff 100644 --- a/inventory/group_vars/proxies-stg +++ b/inventory/group_vars/proxies-stg @@ -17,6 +17,11 @@ tcp_ports: [ # This is for TCP krb5 1088,
+ # This is for RabbitMQ public access + 5671, + # This is for RabbitMQ internal-public access + 15671, + # This is for the haproxy HTML stats page # TODO -- there's no need for this to be wide open to the world. With this # in place, you can visit https://apps.fedoraproject.org:8080 and get the diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg index 29bb567b7..0b4835fcd 100644 --- a/roles/haproxy/templates/haproxy.cfg +++ b/roles/haproxy/templates/haproxy.cfg @@ -565,6 +565,34 @@ backend copr-backend option httpchk GET /api_3/ {% endif %}
+{% if datacenter == "phx2" %} +# These ports are for proxying rabbitmq (AMQP) protocol through. +# At this moment, internal- and public-rabbitmq both point to the exact same set of +# brokers on the backend, but the internal- is intended for applications we directly control. +# This allows us to move to a separate cluster for public access if that became necessary +# on just the infra side, with no need to ask users to change anything. +frontend internal-rabbitmq + mode tcp + bind 0.0.0.0:15671 + default_backend rabbitmq + +frontend public-rabbitmq + mode tcp + bind 0.0.0.0:5671 + default_backend rabbitmq + +backend rabbitmq + mode tcp + option tcplog + balance roundrobin + maxconn 16384 + server rabbitmq01 rabbitmq01:5671 weight 1 maxconn 16384 +{% if env == "production %} + server rabbitmq02 rabbitmq02:5671 weight 1 maxconn 16384 + server rabbitmq03 rabbitmq03:5671 weight 1 maxconn 16384 +{% endif %} +{% endif %} + # Apache doesn't handle the initial connection here like the other proxy # entries. This proxy also doesn't use the http mode like the others. # stunnel should be sitting on port 9939 (public) and redirecting
On 3/6/19 12:25 PM, Patrick Uiterwijk wrote:
Hi all,
Could I get +1s for the below patch?
+1, but do we need also:
* some rabbitmq config to add a vhost that doesn't require a user/cert for ro access?
and
* RHIT ticket to open those ports on proxy01/10?
kevin --
Thanks, Patrick
From 46dc8281edb9b874075525b1756ed0cfa0f91575 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk patrick@puiterwijk.org Date: Wed, 6 Mar 2019 21:11:12 +0100 Subject: [PATCH] Add rabbitmq proxying to the proxies
Signed-off-by: Patrick Uiterwijk patrick@puiterwijk.org
inventory/group_vars/proxies | 5 +++++ inventory/group_vars/proxies-stg | 5 +++++ roles/haproxy/templates/haproxy.cfg | 28 ++++++++++++++++++++++++++++ 3 files changed, 38 insertions(+)
diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 4b97c2ae3..8901de118 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -17,6 +17,11 @@ tcp_ports: [ # This is for TCP krb5 1088,
- # This is for RabbitMQ public access
- 5671,
- # This is for RabbitMQ internal-public access
- 15671,
- # This is for the haproxy HTML stats page # TODO -- there's no need for this to be wide open to the world. With this # in place, you can visit https://apps.fedoraproject.org:8080 and get the
diff --git a/inventory/group_vars/proxies-stg b/inventory/group_vars/proxies-stg index 7aeb745e7..f5590beff 100644 --- a/inventory/group_vars/proxies-stg +++ b/inventory/group_vars/proxies-stg @@ -17,6 +17,11 @@ tcp_ports: [ # This is for TCP krb5 1088,
- # This is for RabbitMQ public access
- 5671,
- # This is for RabbitMQ internal-public access
- 15671,
- # This is for the haproxy HTML stats page # TODO -- there's no need for this to be wide open to the world. With this # in place, you can visit https://apps.fedoraproject.org:8080 and get the
diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg index 29bb567b7..0b4835fcd 100644 --- a/roles/haproxy/templates/haproxy.cfg +++ b/roles/haproxy/templates/haproxy.cfg @@ -565,6 +565,34 @@ backend copr-backend option httpchk GET /api_3/ {% endif %}
+{% if datacenter == "phx2" %} +# These ports are for proxying rabbitmq (AMQP) protocol through. +# At this moment, internal- and public-rabbitmq both point to the exact same set of +# brokers on the backend, but the internal- is intended for applications we directly control. +# This allows us to move to a separate cluster for public access if that became necessary +# on just the infra side, with no need to ask users to change anything. +frontend internal-rabbitmq
- mode tcp
- bind 0.0.0.0:15671
- default_backend rabbitmq
+frontend public-rabbitmq
- mode tcp
- bind 0.0.0.0:5671
- default_backend rabbitmq
+backend rabbitmq
- mode tcp
- option tcplog
- balance roundrobin
- maxconn 16384
- server rabbitmq01 rabbitmq01:5671 weight 1 maxconn 16384
+{% if env == "production %}
- server rabbitmq02 rabbitmq02:5671 weight 1 maxconn 16384
- server rabbitmq03 rabbitmq03:5671 weight 1 maxconn 16384
+{% endif %} +{% endif %}
# Apache doesn't handle the initial connection here like the other proxy # entries. This proxy also doesn't use the http mode like the others. # stunnel should be sitting on port 9939 (public) and redirecting
On Wed, 6 Mar 2019 at 15:30, Kevin Fenzi kevin@scrye.com wrote:
On 3/6/19 12:25 PM, Patrick Uiterwijk wrote:
Hi all,
Could I get +1s for the below patch?
+1, but do we need also:
+!
- some rabbitmq config to add a vhost that doesn't require a user/cert
for ro access?
and
- RHIT ticket to open those ports on proxy01/10?
Yes. Only a couple of ports are open on proxy01/10
kevin
Thanks, Patrick
From 46dc8281edb9b874075525b1756ed0cfa0f91575 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk patrick@puiterwijk.org Date: Wed, 6 Mar 2019 21:11:12 +0100 Subject: [PATCH] Add rabbitmq proxying to the proxies
Signed-off-by: Patrick Uiterwijk patrick@puiterwijk.org
inventory/group_vars/proxies | 5 +++++ inventory/group_vars/proxies-stg | 5 +++++ roles/haproxy/templates/haproxy.cfg | 28 ++++++++++++++++++++++++++++ 3 files changed, 38 insertions(+)
diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 4b97c2ae3..8901de118 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -17,6 +17,11 @@ tcp_ports: [ # This is for TCP krb5 1088,
- # This is for RabbitMQ public access
- 5671,
- # This is for RabbitMQ internal-public access
- 15671,
- # This is for the haproxy HTML stats page # TODO -- there's no need for this to be wide open to the world. With this # in place, you can visit https://apps.fedoraproject.org:8080 and get the
diff --git a/inventory/group_vars/proxies-stg b/inventory/group_vars/proxies-stg index 7aeb745e7..f5590beff 100644 --- a/inventory/group_vars/proxies-stg +++ b/inventory/group_vars/proxies-stg @@ -17,6 +17,11 @@ tcp_ports: [ # This is for TCP krb5 1088,
- # This is for RabbitMQ public access
- 5671,
- # This is for RabbitMQ internal-public access
- 15671,
- # This is for the haproxy HTML stats page # TODO -- there's no need for this to be wide open to the world. With this # in place, you can visit https://apps.fedoraproject.org:8080 and get the
diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg index 29bb567b7..0b4835fcd 100644 --- a/roles/haproxy/templates/haproxy.cfg +++ b/roles/haproxy/templates/haproxy.cfg @@ -565,6 +565,34 @@ backend copr-backend option httpchk GET /api_3/ {% endif %}
+{% if datacenter == "phx2" %} +# These ports are for proxying rabbitmq (AMQP) protocol through. +# At this moment, internal- and public-rabbitmq both point to the exact same set of +# brokers on the backend, but the internal- is intended for applications we directly control. +# This allows us to move to a separate cluster for public access if that became necessary +# on just the infra side, with no need to ask users to change anything. +frontend internal-rabbitmq
- mode tcp
- bind 0.0.0.0:15671
- default_backend rabbitmq
+frontend public-rabbitmq
- mode tcp
- bind 0.0.0.0:5671
- default_backend rabbitmq
+backend rabbitmq
- mode tcp
- option tcplog
- balance roundrobin
- maxconn 16384
- server rabbitmq01 rabbitmq01:5671 weight 1 maxconn 16384
+{% if env == "production %}
- server rabbitmq02 rabbitmq02:5671 weight 1 maxconn 16384
- server rabbitmq03 rabbitmq03:5671 weight 1 maxconn 16384
+{% endif %} +{% endif %}
# Apache doesn't handle the initial connection here like the other proxy # entries. This proxy also doesn't use the http mode like the others. # stunnel should be sitting on port 9939 (public) and redirecting
infrastructure mailing list -- infrastructure@lists.fedoraproject.org To unsubscribe send an email to infrastructure-leave@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedorapro...
On 3/6/19 3:29 PM, Kevin Fenzi wrote:
On 3/6/19 12:25 PM, Patrick Uiterwijk wrote:
Hi all,
Could I get +1s for the below patch?
+1, but do we need also:
- some rabbitmq config to add a vhost that doesn't require a user/cert
for ro access?
I'm pretty familiar with how this needs to get set up so in the next couple days I should be able to write a patch for this bit of things.
- Jeremy
infrastructure@lists.fedoraproject.org
-
Jeremy Cline -
Kevin Fenzi -
Patrick Uiterwijk -
Stephen John Smoogen