Last modified: 2014-08-04 11:34:07 UTC
At the moment, Labs instances that want to be able to connect to "dewiki.labsdb" and end up at the DB replica server hosting the German Wikipedia, have to copy /etc/hosts from a Tools instance and set up iptables according to /data/project/.system/iptables.conf. I tried to puppetize this in Gerrit change #107010, but it turned out that using ferm (base::firewall) for iptables has severe side effects (like locking myself out from my test instance :-)). There is however an alternative that is rather easy to set up and maintain: Move the aliases to DNS, and the NAT rules to the DB servers itself. This way we only have to test (and worry) about three hosts and not dozens. This would include: - allocating seven IP addresses, - routing them to the LabsDB servers, - setting up a DNS zone labsdb with the aliases pointing at the IP addresses, - setting up firewall and NAT on the LabsDB servers. Thus, new instances in Tools and other Labs projects would have instant access (minus credentials) to the replica servers. Existing instances would not be affected.
