python/psf-chef

Chef configuration and cookbooks for the Python Software Foundation

psf-chef's Issues

nodes which no longer exists on the ganeti cluster

virt-kchn16.psf.osuosl.org and virt-vm43og no longer exists on the ganeti cluster, but are still noted in the opscode management panel.

should we clear these?

preview.python.org - Block IP scans in nginx to avoid Django ALLOWED_HOSTS error emails

Should look something like this in the nginx config:

server {
listen 80;
server_name {{ server_ip }};

location / {
    return 403;
}

}

Redirect for /sf/ doesn't include the query string

preview.python.org - Need cron job to import ICS calendar events

Should be manage.py import_ics_calendars in the virtualenv.

Force ssl on python.org

Issue came through here: python/pythondotorg#76

I tend to agree. Thoughts? I feel like @dstuft mentioned doing this in VCL, but the last couple of days are a bit of a blur.

staging.python.org - Need to use separate branch

Hi,

We need the staging system to pull and use a different branch for production, otherwise it isn't really a "staging" system just a "won't be in production for a few minutes" system :)

Can someone help me get that setup?

packages.python.org cert expired

https://www.ssllabs.com/ssltest/analyze.html?d=packages.python.org&latest

Subject | *.python.org
          Fingerprint SHA256: 32a3b8d6138d2ad362e1b505e4df7eb57a4022a6e659df05c01324b56d8a628e
          Pin SHA256: R3OdAsOX6cLLGc9VLDLaOo1U9AOfvgZ7iVH8gts6P9g=
-- | --
Common names | *.python.org
Alternative names | *.python.org python.org
Serial Number | 1e59fbd6a9f6a09bc72d22f2fb3c617b
Valid from | Thu, 02 Feb 2017 00:00:00 UTC
Valid until | Sun, 02 Feb 2020 23:59:59 UTC (expired 15 hours and 23 minutes ago)   EXPIRED

Sentry or Rollbar for PSF?

Does the PSF have something like that setup? Right now I get flooded with error emails anytime the site goes down. Wondering if that exists for other projects and we just haven't gotten around to setting it up on python.org.

PEP images not getting created, permissions issue

Hi!

Ok so in reference to this Python.org ticket (python/pythondotorg#505) PEP images still aren't displaying.

I believe it's because /srv/redesign.python.org/shared/media is owned root:root and cannot be written to by www-data which is what the cron and app code runs as. I'm honestly surprised an exception isn't raised when this happens, but apparently it isn't. Can we get this fixed asap?

Migration/requirements weirdness

Couple of things:

1. Just pushed a few things live, one of which had a migration. The migration was not run on staging or prod, had to do it manually.

2. Migration worked flawlessly on staging, but on Prod it complained about the peps app not having migrations. Had to comment out peps from INSTALLED_APPS to get the site working again. I'm guessing this is left over .pyc or perhaps pep related ghost migrations in the prod db?

3. Requirements for master (staging) and release (prod) both have Django==1.5.12 however requirements.txt on both boxes has 1.5.11 still. Cron delay issue maybe?

virt-wzmlmm.psf.osuosl.org is unresponsive

responds to pings, but I can't get a shell. hasn't had chef run in 3 months.

jobs.python.org DNS?

Found this earlier this morning: python/pythondotorg#56

There is no node for this in dyn, should there be? If so, where does it go?

Need MEDIA_ROOT

Need MEDIA_ROOT setup for being able to upload images on preview and prod. Needs to be a directory setup outside of the repo (otherwise we'd lose media on each roll out).

And nginx needs to be setup to delivery the contents on the URL /m/.

MEDIA_ROOT will need to be set to that path in pydotorg.settings.staging.py

Should be writeable by the gunicorn process FYI.

Python.org PEP Page generation Process

NOTE: This issue depends on Issue 135 being completed first

We're changing how PEP Pages are generated to not break the existing PEP process around the Mercurial repo. The process is outlined here all that needs to happen is:

1. Install Mercurial
2. Setup a cron job that:
   • Updates the hg repository
   • Runs pep2html.py
   • Runs genpepindex.py
   • Then runs ./manage.py generate_pep_pages using the normal Python 3/Django environment

This assumes that PEP_REPO_PATH has been set in the Django settings to the directory where the hq repository resides.

I would presume that this should be run hourly at most, perhaps just 4 times daily or even just daily.

Let me know if you have any questions!

preview.python.org - Fastly caching /admin/ ???

Didn't dive into it too deeply, but I believe Fastly is caching /admin/ for a few seconds as I'm seeing very odd results that resolve themselves in under a minute. Can someone check on that and disable caching of /admin/*?

virt-byl2f7.psf.osuosl.org is out of inodes

looks like this node has run out of inodes.

ernestd@virt-byl2f7:/tmp$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda3       8.9G  4.7G  3.8G  56% /
udev            489M   12K  489M   1% /dev
tmpfs           200M  260K  199M   1% /run
none            5.0M     0  5.0M   0% /run/lock
none            498M     0  498M   0% /run/shm
/dev/vda1        92M   55M   32M  64% /boot
ernestd@virt-byl2f7:/tmp$ df -i
Filesystem     Inodes  IUsed  IFree IUse% Mounted on
/dev/vda3      588672 588672      0  100% /
udev           125047    448 124599    1% /dev
tmpfs          127376    331 127045    1% /run
none           127376      4 127372    1% /run/lock
none           127376      1 127375    1% /run/shm
/dev/vda1       24096    235  23861    1% /boot

It is setup for the evote role. @coderanger is this something we need to fix immediately, or is the evote thing on hold?

Need cron job to update search index on preview and prod

I'd say once daily at this point:

manage.py rebuild_index --noinput

FYI the --noinput is important as there is a Python 2 vs 3 bug that has been fixed, but not released yet.

use chef environments for pydotorg

This has been weighing heavily on my mind since I did it, so I need to let it out and confess. I didn't use chef's environments on purpose, because it was easier to just use an attribute.

It won't take a whole lot to get it using environments. I'll try to get to that this week at some point. This will also help solve things like #110

Tasks off the top of my head:

• make current_env become node.chef_environment see https://github.com/python/psf-chef/blob/master/cookbooks/pydotorg-redesign/recipes/default.rb#L4
• make sure there are a prod and staging environment
• make sure the nodes are in the right environment
• pin version lines to prod and staging environment

TBD: what versions on what env?

virt-yfae7i.psf.osuosl.org has not had chef run in 7 months

I tried to get a shell, but obviously couldn't get in since my user/key would never have made it to the server via Chef.

@coderanger could you poke around?

preview.python.org - Migrations

Hi Guys,

We're going to need/want migrations to be run when new code is released. It's "manage.py migrate" with the proper settings for the site.

Redirects for peps are "Permanently Moved" instead of "Found"

Staging settings change

Need to adjust Django's cookie domains on staging to be:

CSRF_COOKIE_DOMAIN = 'staging.python.org'
SESSION_COOKIE_DOMAIN = 'staging.python.org'

Otherwise we can't login to staging to poke at changes before releasing. Thanks!

Enable sftp on pycon servers

We're going to need this to support the sites.

preview.python.org - Cron job to import blog feeds

Should be manage.py update_blogs with the right virtualenv path.

Haystack/Elasticsearch config on staging and prod

Hi Everyone,

I think the Haystack and/or ElasticSearch configuration is borked on staging and prod. Ic an't get ANY results to show up on either system and can't rebuild the index on staging get connection errors.

Here is an example configuration for my local config:

HAYSTACK_CONNECTIONS = {
'default': {
'ENGINE': 'haystack.backends.elasticsearch_backend.ElasticsearchSearchEngine',
'URL': 'http://127.0.0.1:9200/',
'INDEX_NAME': 'haystack',
},
}

Can we get this updated asap? Thanks!

Today's mess, need access to fix

Hey,

So I'm guessing that prod got moved to a new box? Perhaps pydotorg-prod.iad1.psf.io or lb0.iad1.psf.io?
I no longer have access to this box (user frank) and can't fix the migration issue.

I was working on virt-q0dzqq.psf.osuosl.org (prod) and virt-l4es2w.psf.osuosl.org (stage) and it took me forever to figure out why the site worked fine directly, but not via Fastly.

So site is broken, fix that worked on old prod was:

1. Comment up 'peps' app in INSTALLED_APPS
2. Run migrations
3. Uncomment 'peps' app.

Need preview.python.org and www.python.org ssh access for Jacob Burch

Hi,

Going to be making a couple more dev sprints on python.org and need Jacob Burch to have ssh access to the systems since he'll be the one doing most of the work. You can find his keys here:

https://api.github.com/users/jacobb/keys

Disable legacy redirects in staging

Got a request from @frankwiles. Opening an issue to track.

11:59 fwiles: [16:48:36] benjaminws: Is it possible to remove redirects that in place on preview but not prod? i.e. as we go to roll out some of the apps we ended up "hiding" yesterday?
11:59 ***: Playback Complete.

Remove redirect

Hi Guys,

Need to remove the /dev/peps/ redirect to legacy.python.org/dev/peps to expose the now working dynamic /dev/peps. This actually rolled out to production a couple of weeks ago, but I forgot about the redirect.

Thanks!