[12:34:38] please unblock me [12:34:42] u [12:34:42] n [12:34:43] b [12:34:44] l [12:34:44] o [12:34:45] c [12:34:46] k [12:34:47] m [12:34:48] e [12:34:51] p [12:34:51] l [12:34:52] e [12:34:53] a [12:34:54] s [12:34:54] e [12:35:39] u [12:35:40] n [12:35:41] b [12:35:41] l [12:35:42] o [12:35:43] c [12:35:43] k [12:35:48] m [12:35:49] e [12:35:49] u [12:35:50] n [12:35:51] b [12:35:51] l [12:35:52] o [12:35:54] c [12:35:54] k [12:35:55] m [12:35:56] e [12:35:57] u [12:35:57] n [12:35:58] b [12:35:59] l [12:35:59] o [12:36:00] c [12:36:01] k [12:36:01] m [12:36:02] e [12:36:04] p [12:36:05] l [12:36:06] e [12:36:06] a [12:36:07] s [12:36:08] e [12:36:09] u [12:36:10] n [12:36:11] b [12:36:12] l [12:36:13] o [12:36:15] c [12:36:16] k [12:36:17] m [12:36:17] e [12:36:18] p [12:36:19] l [12:36:20] e [12:36:21] a [12:36:22] s [12:36:24] e [17:00:15] Ryan_Lane: hi :) [17:00:19] howdy [17:00:25] I have a giant change to push in. heh [17:00:32] it's not 100% complete [17:00:38] so, virt1005, 1007 & 1008 are ready [17:00:43] I reformatted 1005 [17:00:48] cool [17:00:57] then I had a look at 1007 & 1008 and they looked recently provisioned and untouched [17:01:06] so I just purged gluster, dist-upgraded them and rebooted them [17:01:16] so, I cheated :) [17:01:18] heh [17:04:12] I had to rework all the ldap puppet stuff for the openstack stuff too [17:05:07] ? [17:05:18] it's was all spaghetti coded in [19:04:16] New patchset: Ryan Lane; "Adding new class names for ldap passwords" [labs/private] (master) - https://gerrit.wikimedia.org/r/19515 [19:04:32] Change merged: Ryan Lane; [labs/private] (master) - https://gerrit.wikimedia.org/r/19515 [19:08:41] Ryan_Lane: hi [19:09:07] (how) can I access the ldap in labs? [19:09:17] ldaplist, ldapseach, etc [19:09:50] does it have the info of the dev team [19:10:10] i.e. if some one gets access to labs [19:10:24] will i see them in the ldap [19:10:29] yes [19:10:33] ok great [19:10:34] ldaplist -l passwd [19:10:52] my password ? [19:11:05] ssh [19:11:12] eh? [19:11:26] do I need to put in my ssh password ? [19:12:06] for that to work or an ldap specific password [19:12:19] you don't have an ssh password [19:12:23] you have a wiki password [19:12:34] ok I get it [19:12:39] and for ldapsearch to work, you'll need to put in your full dn and password [19:12:50] you can use ldaplist without a password, though [19:13:10] you can find your dn for ldapsearch by using ldaplist byw [19:13:12] btw [19:13:15] ldaplist -l passwd oren [19:13:42] ldapsearch -x -D '' -W '' [19:14:52] now if I want to hack gerrit [19:14:59] is it puputised ? [19:15:10] or should I set it up [19:15:24] (I am guessing it is not) [19:16:29] it kind of it [19:16:31] *is [19:16:35] ^demon: ^^ [19:16:42] nice [19:16:54] is bastion1 having issues or someone's doing network maint? [19:17:06] Ryan you're in SF right? [19:17:07] i just got like 20+ secs of lag on the shell [19:17:13] Damianz_: yep [19:17:23] I can't ssh to ee-prototype.pmtpa.wmflabs today [19:17:26] Is it just after 12 or is my timezone sensing totally off? [19:17:29] Permission denied (publickey) [19:17:33] am I allowed to add.remove people to the ldap ? [19:17:40] (on bastion1) itself, not even my own instance [19:17:42] of course not [19:17:45] Ryan_Lane: ^ [19:18:04] OrenBochman: no, of course not [19:18:14] can you give me permission [19:18:21] no [19:18:24] Damianz: The local time here is 12:18pm yes [19:18:29] I will only add and remove one person - as a unit test [19:18:37] OrenBochman: Setup opendj locally [19:18:43] RoanKattouw: Cheers :) [19:18:56] jeremyb: Mind coming over to #wikimedia and banning a troll? [19:19:04] He just pinged you there, too :) [19:19:40] It's weird dealing with people like 8hours behind you =/ [19:19:54] Damianz: It seems like it already is installed [19:19:55] jeremyb: nm DeltaQuad has got it [19:20:39] I'm not sure how broken the gerrit puppet stuff is or if opendj is puppetized but for a local/testing/development env ideally you should install everything via puppet on 1 box. [19:20:43] should I set up my own ldap, git and garret then ... ? [19:20:57] ^demon is the best person to talk to, I believe he has a project and is sorta fixing the puppet stuff. [19:21:12] OrenBochman: if you are going to do ldap testing, you'll definitely need to set up ldap [19:21:29] you should talk to ^demon about seting up gerrit [19:21:37] I actualy want to integrate our ldap with gerrit [19:21:45] Ryan_Lane: Benny is not able to ssh to ee-prototype either [19:21:54] kaldari: yes, I'm looking at it [19:21:58] thanks :) [19:22:00] and I've chatted abit with ^demon - he says go on! [19:22:04] OrenBochman: our gerrit *is* integrated with ldap [19:22:17] since when ? [19:22:31] Since the beginning of time? [19:22:37] ok [19:22:50] do you want to fix the code so that ssh keys are pulled from ldap or something? [19:22:57] yes [19:22:59] or so that ldap groups can be added as reviewers? [19:23:04] both [19:23:15] but mostly # 2 [19:23:21] that stuff isn't working yet, but gerrit is configured with ldap [19:24:42] crap [19:24:55] my private repo change seems to have broken something [19:24:59] annoying [19:25:06] I got git and garret on my local machine but no ldap [19:25:36] ok Ryan_Lane: I'll let u know if I need more help [19:25:50] <^demon> Sorry, was on the phone. [19:25:58] re [19:26:08] <^demon> So yeah, gerrit is like half-puppetized for labs. I did a lot of the work, but I need Ryan to review & finish it. [19:26:21] New patchset: Ryan Lane; "Fix proxyagent password in labs" [labs/private] (master) - https://gerrit.wikimedia.org/r/19518 [19:26:26] ^demon: does it run on tomcat ? [19:26:34] Change merged: Ryan Lane; [labs/private] (master) - https://gerrit.wikimedia.org/r/19518 [19:26:40] or another application server ? [19:26:51] kaldari: thanks for reporting that, seems I had just broken something [19:26:56] <^demon> No, it just runs on its internal jetty-based thing. [19:26:58] <^demon> Which is proxied out via apache. [19:27:09] jetty is even better for quick dev [19:27:11] <^demon> You *can* run it on tomcat, but we don't. [19:27:22] also we puptised solar on jetty [19:27:30] I tried the tomcat route at first [19:27:34] so you guys might want to look at that [19:27:38] it's way easier to run via jetty [19:27:41] it is more complex [19:27:45] I agree [19:27:45] <^demon> Ryan_Lane: Glad you didn't. Would've made it harder for me to help you :) [19:27:50] gerrit is already puppetized [19:27:55] <^demon> For prod. [19:27:58] exactly [19:27:59] <^demon> Labs is fubar'd [19:28:04] it's poorly puppetized [19:28:19] <^demon> Yeah. Which is why I've been bugging you to finish that manifest :) [19:28:25] cant we re use it ? [19:28:32] <^demon> Yeah, it just needed a lot of work. [19:28:43] can use puppetmaster::self :) [19:28:44] heh [19:28:54] <^demon> That's what I've done. But some stuff I'm not sure about still. [19:28:57] <^demon> Like LDAP config. [19:28:59] kaldari: fixed [19:29:10] <^demon> And how to pull the database password when in labs. [19:29:11] yay [19:29:12] I just made a huge ldap change [19:29:24] ^demon: private repo for that [19:29:31] ok [19:29:59] ^demon: which lab are you using for the gerrit work ? [19:30:11] RoanKattouw: sorry, had some local computer issues after the other (bastion1?) issue [19:30:24] <^demon> OrenBochman: gerrit project. gerrit-puppet-overhaul instance. [19:30:28] <^demon> Let me add you if I haven't already. [19:30:35] thanks [19:31:11] RoanKattouw: speaking of troll, scroll up to 12:34:22 UTC in here ;) [19:31:43] is that the currently used gerrit - or a development instance ? [19:31:49] jeremyb: I wasn't in this channel at 4am sorry :) [19:32:10] <^demon> OrenBochman: That instance is the one we're testing the puppet rewrite on. [19:32:26] RoanKattouw: 4am? oh, you're not CEST huh [19:32:32] <^demon> "gerrit" is the instance that's running the live gerrit-dev.wmflabs.org [19:32:33] RoanKattouw: so that's 5:30am ? [19:32:43] <^demon> And "gerrit-build" is a new instance with maven on it I set up for building gerrit. [19:33:20] Oh, right, DSG [19:33:22] *DST [19:33:26] It's UTC-7 here in summer, not UTC-8 [19:33:38] jeremyb: I was in CEST until February, I live in PDT now [19:34:17] I will probably want to build wars in my local maven based dev environment and test in gerrit project. gerrit-puppet-overhaul instance. [19:34:48] <^demon> Step 1 is getting the puppet fixes done. [19:34:52] <^demon> I'll poke at that a bit now. [19:35:00] great [19:35:15] <^demon> Step 2 is getting a build environment where we can maven package and then build the debian package from that. [19:35:24] I got to go soon but I may have some time to look at ldap + gerrit code tommorow [19:35:46] RoanKattouw: right, i know *someone* moved, i just can never remember who. I'm open to mnemonics ;) [19:35:55] are you working on gerrit's code or your own version [19:36:01] Oh lots of people moved recently [19:36:13] i.e. local git or thier;s [19:36:28] There's like 4 or 5 European people here in the office that moved here in 2012 [19:36:40] Or more [19:36:49] and how many reverse moves? [19:36:53] <^demon> OrenBochman: Everything we're doing is using vanilla upstream. Anything I've fixed I've pushed there. [19:37:09] None that I know of this year [19:37:14] is that a branch or an explression [19:37:25] RoanKattouw: try march last year? ;) [19:37:31] ;-) [19:37:46] * RoanKattouw forgets who reverse-moved in March 2011 [19:37:58] RoanKattouw: oh, *that* troll... he's become a regular. i think maybe he's just a spammer and not even a troll. (maybe he has no idea what wikimedia is?). anyway, i have a strong feeling that it's a completely manual process. he also always /msg's to ask why i banned after i ban [19:38:03] RoanKattouw: apergos! [19:38:09] Oh right [19:38:35] btw is fixing ldap issues the top issue for gerrit ? [19:38:58] or is there something more urgent which I should look into ?> [19:39:09] not really. it's only a problem for the operations group mostly [19:39:17] since the other groups are internal gerrit groups [19:39:24] OrenBochman: ^demon would know best [19:39:46] I am asking him [19:40:02] <^demon> I haven't looked at it at all. [19:40:05] since he now has to assign people repos himself [19:40:13] <^demon> The keys issue is a PITA though. [19:40:26] yeah. it is [19:40:28] PITA == ? [19:40:31] Ryan_Lane: what problem? not being able to add ops as a reviewer? [19:40:42] <^demon> OrenBochman: Pain In The Ass. [19:40:49] I agree [19:41:02] it slows other stuff down [19:41:25] I'll have some time this week to look at it [19:42:57] * jeremyb will bbl [19:42:59] <^demon> Ryan_Lane: https://gerrit.wikimedia.org/r/#/c/16971/ <3 [19:44:10] jeremyb: yes [19:44:22] because gerrit expands groups into reviewers [19:44:25] which is dumb [19:44:38] gerrit should understand the concept of a group as a reviewer [19:44:41] "expands"? [19:44:53] does that mean it adds each member individaully? [19:44:53] when you add a group, it adds the members [19:45:36] ... [19:48:37] well IMHO it doesn't need to be perfect, (or at least we don't have to wait for it to be) i'm happy to go with my original proposal. create a dummy account for "the wind" and let people ask the wind for review if they don't want to ask a specific person (or if they've already asked and waited for a specific person and now want to open it up to more reviewers) [19:49:18] then people looking for stuff to review can just go to the dashboard for that dummy user (after e.g. going through the dashboard for themself) [19:49:45] <^demon> Dashboards are private in 2.5 [19:49:50] ugh [19:50:02] we don't have a choice to make them public [19:50:03] ? [19:50:23] that seems like the kind of thing people could grow to rely on [19:50:25] <^demon> Not that I know of. They were never really intended to be public. [19:50:44] <^demon> Which is why they're based on totally opaque UIDs. [19:51:23] well they are presumably the same IDs that are used for those people in other places [19:51:58] <^demon> No, they just use the index user id, like 1, 2, 3. [19:52:20] right... [19:52:50] <^demon> For searching and such, you should use e-mail addresses or user names. [19:52:57] yeah [19:57:04] RoanKattouw: hah, now i know why you asked me in particular about the troll [19:58:43] I didn't notice you were opped [19:58:50] I just picked a name I knew off the access list [19:59:03] okey, nvm then [20:11:51] Ryan_Lane: can you confirm if i'm a member of the 'bastion' project. i can't log into the bastion host [20:12:48] what's your username? [20:13:00] you aren't in bastion [20:13:26] tfinc [20:13:47] you are now [20:14:07] your shell account name is tomasz [20:14:14] wiki name is tfinc [20:14:14] heh [20:14:29] is that because my old svn account was 'tomasz' ? [20:14:33] yes [20:15:27] works for me. thanks for the clear docs on labs for this. i hopped on here asking about this after reading "Accessing public and private instances" :D [20:15:35] documentation FTW [20:19:12] heh [20:19:18] yeah. nice to have docs :)