)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"026e5902add5a0f3b6fd2659dfcd4c34c0a07ce9","unresolved":false,"context_lines":[{"line_number":13,"context_line":"This change is a direct port of the implementation previously"},{"line_number":14,"context_line":"deployed to our mailing list server. This sets up apache vhost on"},{"line_number":15,"context_line":"port 443 that proxies to anubis which proxies to another apache"},{"line_number":16,"context_line":"vhost on port 11443 which ultimately proxies to mailman on port"},{"line_number":17,"context_line":"8080."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"In order to simplify the configuration, since we don\u0027t allow remote"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"382c6fec_998f4217","line":16,"updated":"2026-04-01 21:02:25.000000000","message":"Oops, this should have said Gitea too.","commit_id":"5c342105426d4a950b6c0cf272a2486290158ca7"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"3fcd67e80c28896080888f717e39084d13f5da86","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":10,"id":"caaa61bd_ac61ffca","updated":"2026-04-03 15:57:26.000000000","message":"Overall this looks good and seems to be working in my testing against the held node. I did note a couple of things inline one which is probably easy to address (redirect domains) and the other may be more of a wishlist item (figuring out logging).\n\nI tested both web browsing in Firefox and Chrome as well as git clone against the populated opendev/system-config repo. All appears to have worked as expected. I got anubis challenges on first page load with each browser but then navigating around it remembered the previous calculation and I was able to view pages without additional interruption. git clone appears to have just worked the way it always has.","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"}],"playbooks/roles/gitea/tasks/proxy.yaml":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"7609439726ab6d8444a5dc0848e8bd8d9e51c2f2","unresolved":true,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- name: Create config dir for anubis"},{"line_number":38,"context_line":"  file:"},{"line_number":39,"context_line":"    name: /var/lib/anubis"},{"line_number":40,"context_line":"    state: directory"},{"line_number":41,"context_line":"    mode: 0755"},{"line_number":42,"context_line":"    owner: root"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7d0edf63_da38f7de","line":39,"updated":"2026-04-03 16:00:43.000000000","message":"This is a super minor nit and I hesitated to even mention it. But decided it can\u0027t hurt to note it and then decide to leave it as is. We put the gitea data in /var/gitea. This puts anubis at /var/lib/anubis. It might be nice to have anubis live in /var/anubis for some small amount of \"consistency\" in our path selections.\n\nBut as noted this is super minor I don\u0027t feel strongly about it.","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"44dda0308f46245aea6e2ad8f8fd20c3d78aa8eb","unresolved":true,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- name: Create config dir for anubis"},{"line_number":38,"context_line":"  file:"},{"line_number":39,"context_line":"    name: /var/lib/anubis"},{"line_number":40,"context_line":"    state: directory"},{"line_number":41,"context_line":"    mode: 0755"},{"line_number":42,"context_line":"    owner: root"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7e30a7ff_59a15b7d","line":39,"in_reply_to":"7d0edf63_da38f7de","updated":"2026-04-07 11:39:55.000000000","message":"IMO `/var/gitea` is the anomaly and could be changed (if at all), `/var/lib/$service` sounds much more reasonable to me. though one also could argue that a \"config dir\" should go into `/etc` instead?","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"da4a2ee62ba695fc2ef7ab594a5347d63e5c0c93","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- name: Create config dir for anubis"},{"line_number":38,"context_line":"  file:"},{"line_number":39,"context_line":"    name: /var/lib/anubis"},{"line_number":40,"context_line":"    state: directory"},{"line_number":41,"context_line":"    mode: 0755"},{"line_number":42,"context_line":"    owner: root"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"b88ea17a_665e1c27","line":39,"in_reply_to":"7e30a7ff_59a15b7d","updated":"2026-04-08 21:47:27.000000000","message":"I am fine with leaving this as is. I mostly wanted to call it out. Maybe we\u0027ll manage to transition to /var/lib/gitea one day.","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"}],"playbooks/roles/gitea/templates/docker-compose.yaml.j2":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"3fcd67e80c28896080888f717e39084d13f5da86","unresolved":true,"context_lines":[{"line_number":15,"context_line":"      METRICS_BIND: \"[::1]:15000\""},{"line_number":16,"context_line":"      SERVE_ROBOTS_TXT: \"false\""},{"line_number":17,"context_line":"      TARGET: \"http://[::1]:3000\""},{"line_number":18,"context_line":"      REDIRECT_DOMAINS: \"opendev.org\""},{"line_number":19,"context_line":"      POLICY_FNAME: \"/data/cfg/botPolicy.yaml\""},{"line_number":20,"context_line":"    healthcheck:"},{"line_number":21,"context_line":"      test: [\"CMD\", \"anubis\", \"--healthcheck\"]"}],"source_content_type":"text/x-jinja2","patch_set":10,"id":"364ef690_c959554f","line":18,"updated":"2026-04-03 15:57:26.000000000","message":"Can we add `{{ inventory_hostname }}` to the domains list so that we can individual address the Gitea backends?\n\nWhen doing upgrades I like to set up a SOCKS proxy through gitea-lb using an automatic proxy url configuration script that points names like gitea09.opendev.org through gitea14.opendev.org at the SOCKS proxy. Then I can do things like request https://gitea09.opendev.org:3081 in my browser to check on upgrades as they work their way through the cluster.\n\nI tested this setup using gitea99 and got blocked by anubis since gitea99.opendev.org was not in the redirect domains list. There are other ways of accomplishing this, but this way is nice because you can configure it once at the start of a gitea upgrade and then reuse the same socks proxy for each backend. If using direct port forwards and editing /etc/hosts you either need a separate port forward for each backend or you need to recreate connections after checking a backend to check the next.","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"da4a2ee62ba695fc2ef7ab594a5347d63e5c0c93","unresolved":false,"context_lines":[{"line_number":15,"context_line":"      METRICS_BIND: \"[::1]:15000\""},{"line_number":16,"context_line":"      SERVE_ROBOTS_TXT: \"false\""},{"line_number":17,"context_line":"      TARGET: \"http://[::1]:3000\""},{"line_number":18,"context_line":"      REDIRECT_DOMAINS: \"opendev.org\""},{"line_number":19,"context_line":"      POLICY_FNAME: \"/data/cfg/botPolicy.yaml\""},{"line_number":20,"context_line":"    healthcheck:"},{"line_number":21,"context_line":"      test: [\"CMD\", \"anubis\", \"--healthcheck\"]"}],"source_content_type":"text/x-jinja2","patch_set":10,"id":"6d4b8968_273023fb","line":18,"in_reply_to":"364ef690_c959554f","updated":"2026-04-08 21:47:27.000000000","message":"Done","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"}],"playbooks/roles/gitea/templates/gitea.vhost.j2":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"3fcd67e80c28896080888f717e39084d13f5da86","unresolved":true,"context_lines":[{"line_number":57,"context_line":"  Use UserAgentFilter"},{"line_number":58,"context_line":"  # Disable x-forwarded- headers because gitea logging can\u0027t"},{"line_number":59,"context_line":"  # parse them properly"},{"line_number":60,"context_line":"  ProxyAddHeaders Off"},{"line_number":61,"context_line":"  ProxyPass  /.well-known/ !"},{"line_number":62,"context_line":"  ProxyPass  / http://{{ inventory_hostname }}:3000/ retry\u003d0"},{"line_number":63,"context_line":"  ProxyPassReverse / http://{{ inventory_hostname }}:3000/"}],"source_content_type":"text/x-jinja2","patch_set":10,"id":"f2a77e77_31145172","side":"PARENT","line":60,"updated":"2026-04-03 15:57:26.000000000","message":"I compared logs fetching gitea\u0027s own docker-compose.yaml template file from system-config on the anubis test node and in current production. I think the reason for disabling the proxy headers is that we get less useful information when they are enabled.\n\nCurrent production:\n`127.0.0.1:41120 - - [03/Apr/2026:15:39:50 +0000] \"GET /opendev/system-config/src/branch/master/playbooks/roles/gitea/templates/docker-compose.yaml.j2 HTTP/1.1\" 200 45620 \"\" \"My User Agent Here\"`\n\nAnubis Held Node:\n`10.0.18.231:0 - - [03/Apr/2026:15:37:30 +0000] \"GET /opendev/system-config/src/branch/master/playbooks/roles/gitea/templates/docker-compose.yaml.j2 HTTP/1.1\" 200 52705 \"\" \"My User Agent Here\"`\n\nWhen we disable proxy headers we get the IP and port. When we enable them I think we only get the x forwarded for host and then the port is 0. In this case 10.0.18.231 is the gitea-lb node note gitea99 so we are getting info that takes us back to the load balancer but without the port we don\u0027t know which host talked to the load balancer. As you mentioned now that we have anubis and anubis doesn\u0027t log ports we probably can\u0027t trace back to the load balancer using port info anyway. We might want to look into enabling the proxy protocol on haproxy and apache to see if that gives us the detail we want even with Anubis? Anyway I wanted to dig into what the difference is and it does appear there is a difference. But whether or not we get a functional difference without anubis logging extra detail is still a bit fuzzy to me.\n\nNote the anubis held node has a larger file as we added the anubis service to the gitea docker compose file so that response size increase is expected.","commit_id":"3a0139934419d60d49dc0d3c65d5d3a03f750dcb"}],"testinfra/test_gitea.py":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"964d6e98b8e30eb583f76b35092fb24df76da45b","unresolved":true,"context_lines":[{"line_number":27,"context_line":"    gitea_proxy \u003d host.socket(\"tcp://0.0.0.0:3081\")"},{"line_number":28,"context_line":"    assert gitea_proxy.is_listening"},{"line_number":29,"context_line":"    memcached \u003d host.socket(\"tcp://127.0.0.1:11211\")"},{"line_number":30,"context_line":"    assert memcached.is_listening"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"def test_ulimit(host):"},{"line_number":33,"context_line":"    cmd \u003d host.run(\"/usr/local/bin/docker-compose \""}],"source_content_type":"text/x-python","patch_set":10,"id":"c6dbdf33_afd885c2","line":30,"updated":"2026-04-03 16:06:28.000000000","message":"Should we check that anubis is listening here? We check the other services so may be good for completeness.","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"da4a2ee62ba695fc2ef7ab594a5347d63e5c0c93","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    gitea_proxy \u003d host.socket(\"tcp://0.0.0.0:3081\")"},{"line_number":28,"context_line":"    assert gitea_proxy.is_listening"},{"line_number":29,"context_line":"    memcached \u003d host.socket(\"tcp://127.0.0.1:11211\")"},{"line_number":30,"context_line":"    assert memcached.is_listening"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"def test_ulimit(host):"},{"line_number":33,"context_line":"    cmd \u003d host.run(\"/usr/local/bin/docker-compose \""}],"source_content_type":"text/x-python","patch_set":10,"id":"1d0392ce_901ddc41","line":30,"in_reply_to":"c6dbdf33_afd885c2","updated":"2026-04-08 21:47:27.000000000","message":"Done","commit_id":"6c3f9589a888d4e01c4526c10712c86da217e374"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"acb9c38d22a958f7f1acdcf8ba9117a5d4cbedc9","unresolved":true,"context_lines":[{"line_number":28,"context_line":"    assert gitea_proxy.is_listening"},{"line_number":29,"context_line":"    memcached \u003d host.socket(\"tcp://127.0.0.1:11211\")"},{"line_number":30,"context_line":"    assert memcached.is_listening"},{"line_number":31,"context_line":"    anubis \u003d host.socket(\"tcp://0.0.0.0:10000\")"},{"line_number":32,"context_line":"    assert anubis.is_listening"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"def test_ulimit(host):"}],"source_content_type":"text/x-python","patch_set":13,"id":"a40fc925_cfb34a7a","line":31,"updated":"2026-04-09 12:08:32.000000000","message":"```suggestion\n    anubis \u003d host.socket(\"tcp://[::1]:10000\")\n```\nnot sure about the brackets, but it looks like we need to check this on IPv6, not v4","commit_id":"87cd7c970703add61199933cde83142c4a9cfb27"}]}