)]}'
{"ansible/group_vars/all.yml":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"e01e68326f3e887d13cf3c082b7ca803e0524298","unresolved":false,"context_lines":[{"line_number":391,"context_line":"ovn_nb_connection: \"{% for host in groups[\u0027ovn-nb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":392,"context_line":"ovn_sb_connection: \"{% for host in groups[\u0027ovn-sb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":393,"context_line":""},{"line_number":394,"context_line":"outward_rabbitmq_port: \"5674\""},{"line_number":395,"context_line":"outward_rabbitmq_management_port: \"15674\""},{"line_number":396,"context_line":"outward_rabbitmq_cluster_port: \"25674\""},{"line_number":397,"context_line":"outward_rabbitmq_epmd_port: \"4371\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"9f560f44_79c7ff12","line":394,"range":{"start_line":394,"start_character":24,"end_line":394,"end_character":28},"updated":"2020-09-17 08:35:46.000000000","message":"what about this one?","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"9fdc6a2a8c88ea69b704bcc140d65abf37295801","unresolved":false,"context_lines":[{"line_number":391,"context_line":"ovn_nb_connection: \"{% for host in groups[\u0027ovn-nb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":392,"context_line":"ovn_sb_connection: \"{% for host in groups[\u0027ovn-sb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":393,"context_line":""},{"line_number":394,"context_line":"outward_rabbitmq_port: \"5674\""},{"line_number":395,"context_line":"outward_rabbitmq_management_port: \"15674\""},{"line_number":396,"context_line":"outward_rabbitmq_cluster_port: \"25674\""},{"line_number":397,"context_line":"outward_rabbitmq_epmd_port: \"4371\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"9f560f44_6b00c4ac","line":394,"range":{"start_line":394,"start_character":24,"end_line":394,"end_character":28},"in_reply_to":"9f560f44_4bb86010","updated":"2020-09-17 09:40:00.000000000","message":"Ok, I put myself in a non-standard config then. :-)\noutward RMQ does not cause insomnia for me either so let\u0027s forget about this part of the discussion.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"6dc7f2abf76ac12320374edfc0a7b71fa7e4f014","unresolved":false,"context_lines":[{"line_number":391,"context_line":"ovn_nb_connection: \"{% for host in groups[\u0027ovn-nb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":392,"context_line":"ovn_sb_connection: \"{% for host in groups[\u0027ovn-sb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":393,"context_line":""},{"line_number":394,"context_line":"outward_rabbitmq_port: \"5674\""},{"line_number":395,"context_line":"outward_rabbitmq_management_port: \"15674\""},{"line_number":396,"context_line":"outward_rabbitmq_cluster_port: \"25674\""},{"line_number":397,"context_line":"outward_rabbitmq_epmd_port: \"4371\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"9f560f44_f4c79664","line":394,"range":{"start_line":394,"start_character":24,"end_line":394,"end_character":28},"in_reply_to":"9f560f44_79c7ff12","updated":"2020-09-17 09:21:54.000000000","message":"it\u0027s a non-standard port, not sure we need to change it for TLS.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"35577e4d2f4fecd745932296239e3552b6fb86b3","unresolved":false,"context_lines":[{"line_number":391,"context_line":"ovn_nb_connection: \"{% for host in groups[\u0027ovn-nb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":392,"context_line":"ovn_sb_connection: \"{% for host in groups[\u0027ovn-sb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":393,"context_line":""},{"line_number":394,"context_line":"outward_rabbitmq_port: \"5674\""},{"line_number":395,"context_line":"outward_rabbitmq_management_port: \"15674\""},{"line_number":396,"context_line":"outward_rabbitmq_cluster_port: \"25674\""},{"line_number":397,"context_line":"outward_rabbitmq_epmd_port: \"4371\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"9f560f44_4bb86010","line":394,"range":{"start_line":394,"start_character":24,"end_line":394,"end_character":28},"in_reply_to":"9f560f44_cb09102c","updated":"2020-09-17 09:37:24.000000000","message":"We can do what we like, but for the standard RMQ we may as well stick to standard ports:\n\n5672, 5671: used by AMQP 0-9-1 and 1.0 clients without and with TLS\n\nhttps://www.rabbitmq.com/networking.html\n\noutward RMQ is used by ~0% of kolla deployments so I am not losing much sleep over it.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"b1b3d267c52666389f5ca54ac5a704505a366dcb","unresolved":false,"context_lines":[{"line_number":391,"context_line":"ovn_nb_connection: \"{% for host in groups[\u0027ovn-nb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_nb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":392,"context_line":"ovn_sb_connection: \"{% for host in groups[\u0027ovn-sb-db\u0027] %}tcp:{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}:{{ ovn_sb_db_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":393,"context_line":""},{"line_number":394,"context_line":"outward_rabbitmq_port: \"5674\""},{"line_number":395,"context_line":"outward_rabbitmq_management_port: \"15674\""},{"line_number":396,"context_line":"outward_rabbitmq_cluster_port: \"25674\""},{"line_number":397,"context_line":"outward_rabbitmq_epmd_port: \"4371\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"9f560f44_cb09102c","line":394,"range":{"start_line":394,"start_character":24,"end_line":394,"end_character":28},"in_reply_to":"9f560f44_f4c79664","updated":"2020-09-17 09:33:33.000000000","message":"well, we never need - we can use the default one for tls as well; maybe not change it at all? (users still can)","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"}],"ansible/roles/rabbitmq/handlers/main.yml":[{"author":{"_account_id":27336,"name":"XiaojueGuan","email":"xiaojueguan@gmail.com","username":"XiaojueGuan"},"change_message_id":"e5375ca1b4e595342abed8239f81b1b72b9ac9cc","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    - kolla_action !\u003d \"config\""},{"line_number":17,"context_line":"    - inventory_hostname \u003d\u003d groups[service.group]|first"},{"line_number":18,"context_line":"  notify:"},{"line_number":19,"context_line":"    - Waiting for rabbitmq to start on first node"},{"line_number":20,"context_line":"  listen: Restart rabbitmq container"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"- name: Waiting for rabbitmq to start on first node"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ff570b3c_ebcfa054","line":19,"range":{"start_line":19,"start_character":5,"end_line":19,"end_character":49},"updated":"2020-05-28 00:16:45.000000000","message":"this notify seems won\u0027t work any more","commit_id":"cead74b2a7a6784d0a178705fba65168f54e83cf"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d51657a23f73d8b3a13c00ddae145ab7eb396028","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    - kolla_action !\u003d \"config\""},{"line_number":17,"context_line":"    - inventory_hostname \u003d\u003d groups[service.group]|first"},{"line_number":18,"context_line":"  notify:"},{"line_number":19,"context_line":"    - Waiting for rabbitmq to start on first node"},{"line_number":20,"context_line":"  listen: Restart rabbitmq container"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"- name: Waiting for rabbitmq to start on first node"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ff570b3c_07cac018","line":19,"range":{"start_line":19,"start_character":5,"end_line":19,"end_character":49},"in_reply_to":"ff570b3c_ebcfa054","updated":"2020-05-28 10:07:00.000000000","message":"Are you saying that it doesn\u0027t work, or you think it won\u0027t work?","commit_id":"cead74b2a7a6784d0a178705fba65168f54e83cf"}],"ansible/roles/rabbitmq/templates/rabbitmq.conf.j2":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"7c7a8a69ec6c61a910c80d0d74738aa915a6ccbb","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"}],"source_content_type":"text/x-jinja2","patch_set":6,"id":"bf51134e_376ef22e","line":25,"range":{"start_line":23,"start_character":0,"end_line":25,"end_character":11},"updated":"2020-06-21 14:35:07.000000000","message":"it seems always required w/ verify_peer","commit_id":"cead74b2a7a6784d0a178705fba65168f54e83cf"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"0688b69192595a2845b894718e56d915065dd44d","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"}],"source_content_type":"text/x-jinja2","patch_set":6,"id":"bf51134e_773a43c4","line":25,"range":{"start_line":23,"start_character":0,"end_line":25,"end_character":11},"in_reply_to":"bf51134e_376ef22e","updated":"2020-07-23 13:57:14.000000000","message":"Only if the client sends a certificate. If it does not then I don\u0027t think we need it.","commit_id":"cead74b2a7a6784d0a178705fba65168f54e83cf"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"e01e68326f3e887d13cf3c082b7ca803e0524298","unresolved":false,"context_lines":[{"line_number":18,"context_line":"cluster_formation.classic_config.nodes.{{ loop.index0 }} \u003d rabbit@{{ hostvars[host][\u0027ansible_hostname\u0027] }}"},{"line_number":19,"context_line":"{% endfor %}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_59c31b39","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":25},"updated":"2020-09-17 08:35:46.000000000","message":"rabbitmq_enable_listener_tls ?","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"cde80bac35b8dda17d4e409719d75a5fc597eed0","unresolved":false,"context_lines":[{"line_number":18,"context_line":"cluster_formation.classic_config.nodes.{{ loop.index0 }} \u003d rabbit@{{ hostvars[host][\u0027ansible_hostname\u0027] }}"},{"line_number":19,"context_line":"{% endfor %}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_2bcecc5a","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":25},"in_reply_to":"9f560f44_0bf148df","updated":"2020-09-17 09:51:31.000000000","message":"Yeah, the problem is they are all in \u0027server\u0027 scope so to speak...","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"a893ed016756031d025993679b6b44c6715eca06","unresolved":false,"context_lines":[{"line_number":18,"context_line":"cluster_formation.classic_config.nodes.{{ loop.index0 }} \u003d rabbit@{{ hostvars[host][\u0027ansible_hostname\u0027] }}"},{"line_number":19,"context_line":"{% endfor %}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_d77ecf68","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":25},"in_reply_to":"9f560f44_215d4d48","updated":"2020-09-17 12:15:41.000000000","message":"OK, makes sense.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"3afe733674510ba58a38bcd8edef17dec44bd0e1","unresolved":false,"context_lines":[{"line_number":18,"context_line":"cluster_formation.classic_config.nodes.{{ loop.index0 }} \u003d rabbit@{{ hostvars[host][\u0027ansible_hostname\u0027] }}"},{"line_number":19,"context_line":"{% endfor %}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_215d4d48","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":25},"in_reply_to":"9f560f44_2bcecc5a","updated":"2020-09-17 11:04:20.000000000","message":"Not scoping them follows the same logic as rabbitmq_port vs. rabbitmq_management_port. Everything is secondary to AMQP.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"1cd77be6154f8728cf3b9e4b28cf594b14796c3e","unresolved":false,"context_lines":[{"line_number":18,"context_line":"cluster_formation.classic_config.nodes.{{ loop.index0 }} \u003d rabbit@{{ hostvars[host][\u0027ansible_hostname\u0027] }}"},{"line_number":19,"context_line":"{% endfor %}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_0bf148df","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":25},"in_reply_to":"9f560f44_4b5ce018","updated":"2020-09-17 09:44:36.000000000","message":"I think my plan was to make the client-server connection unscoped, since that is what most people likely think of when they think of RMQ traffic. If we add support for others, we could scope them.\n\nIf you want to add scope, rabbitmq_enable_server_tls might be better?","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"6dc7f2abf76ac12320374edfc0a7b71fa7e4f014","unresolved":false,"context_lines":[{"line_number":18,"context_line":"cluster_formation.classic_config.nodes.{{ loop.index0 }} \u003d rabbit@{{ hostvars[host][\u0027ansible_hostname\u0027] }}"},{"line_number":19,"context_line":"{% endfor %}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_f4c31638","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":25},"in_reply_to":"9f560f44_59c31b39","updated":"2020-09-17 09:21:54.000000000","message":"You mean to change the name of the variable? It\u0027s not just the listener, it\u0027s all TLS.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"b1b3d267c52666389f5ca54ac5a704505a366dcb","unresolved":false,"context_lines":[{"line_number":18,"context_line":"cluster_formation.classic_config.nodes.{{ loop.index0 }} \u003d rabbit@{{ hostvars[host][\u0027ansible_hostname\u0027] }}"},{"line_number":19,"context_line":"{% endfor %}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_4b5ce018","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":25},"in_reply_to":"9f560f44_f4c31638","updated":"2020-09-17 09:33:33.000000000","message":"Well, it\u0027s not all tls because inter-node, CLI and management are not covered with this. Only client (so amqp-0-9-1) connections. I found \u0027listener\u0027 to be less confusing here than \u0027client\u0027 (as it could grammatically imply we are configuring a client). We could also use \u0027amqp\u0027 - \u0027rabbitmq_enable_amqp_tls\u0027 - sounds legit!","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"e01e68326f3e887d13cf3c082b7ca803e0524298","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_19c9a359","line":25,"range":{"start_line":23,"start_character":0,"end_line":25,"end_character":11},"updated":"2020-09-17 08:35:46.000000000","message":"not needed because clients do not send certs (nothing to verify here)","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"6dc7f2abf76ac12320374edfc0a7b71fa7e4f014","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_4897c646","line":25,"range":{"start_line":23,"start_character":0,"end_line":25,"end_character":11},"in_reply_to":"9f560f44_19c9a359","updated":"2020-09-17 09:21:54.000000000","message":"I believe I found it to be necessary.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"b1b3d267c52666389f5ca54ac5a704505a366dcb","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_8b28b885","line":25,"range":{"start_line":23,"start_character":0,"end_line":25,"end_character":11},"in_reply_to":"9f560f44_4897c646","updated":"2020-09-17 09:33:33.000000000","message":"Hmm, odd. I\u0027m saying this based off some hand-crafted config I have.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"cde80bac35b8dda17d4e409719d75a5fc597eed0","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_4bd34002","line":25,"range":{"start_line":23,"start_character":0,"end_line":25,"end_character":11},"in_reply_to":"9f560f44_4be980e1","updated":"2020-09-17 09:51:31.000000000","message":"It\u0027s required for verify_peer you set right now.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"1cd77be6154f8728cf3b9e4b28cf594b14796c3e","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"{% if rabbitmq_enable_tls | bool %}"},{"line_number":22,"context_line":"# https://www.rabbitmq.com/ssl.html"},{"line_number":23,"context_line":"{% if rabbitmq_cacert %}"},{"line_number":24,"context_line":"ssl_options.cacertfile \u003d {{ rabbitmq_cacert }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_4be980e1","line":25,"range":{"start_line":23,"start_character":0,"end_line":25,"end_character":11},"in_reply_to":"9f560f44_8b28b885","updated":"2020-09-17 09:44:36.000000000","message":"I might be wrong. It shouldn\u0027t hurt though.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"e01e68326f3e887d13cf3c082b7ca803e0524298","unresolved":false,"context_lines":[{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"},{"line_number":29,"context_line":"# Don\u0027t require client certificates."},{"line_number":30,"context_line":"ssl_options.fail_if_no_peer_cert \u003d false"},{"line_number":31,"context_line":"{% for key, value in rabbitmq_tls_options.items() %}"},{"line_number":32,"context_line":"ssl_options.{{ key }} \u003d {{ value }}"},{"line_number":33,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_d9af2b7b","line":30,"range":{"start_line":28,"start_character":0,"end_line":30,"end_character":40},"updated":"2020-09-17 08:35:46.000000000","message":"we shouldn\u0027t set these really","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"1cd77be6154f8728cf3b9e4b28cf594b14796c3e","unresolved":false,"context_lines":[{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"},{"line_number":29,"context_line":"# Don\u0027t require client certificates."},{"line_number":30,"context_line":"ssl_options.fail_if_no_peer_cert \u003d false"},{"line_number":31,"context_line":"{% for key, value in rabbitmq_tls_options.items() %}"},{"line_number":32,"context_line":"ssl_options.{{ key }} \u003d {{ value }}"},{"line_number":33,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_cbb630fa","line":30,"range":{"start_line":28,"start_character":0,"end_line":30,"end_character":40},"in_reply_to":"9f560f44_0b34a8de","updated":"2020-09-17 09:44:36.000000000","message":"ok","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"b1b3d267c52666389f5ca54ac5a704505a366dcb","unresolved":false,"context_lines":[{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"},{"line_number":29,"context_line":"# Don\u0027t require client certificates."},{"line_number":30,"context_line":"ssl_options.fail_if_no_peer_cert \u003d false"},{"line_number":31,"context_line":"{% for key, value in rabbitmq_tls_options.items() %}"},{"line_number":32,"context_line":"ssl_options.{{ key }} \u003d {{ value }}"},{"line_number":33,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_0b34a8de","line":30,"range":{"start_line":28,"start_character":0,"end_line":30,"end_character":40},"in_reply_to":"9f560f44_88b8bec7","updated":"2020-09-17 09:33:33.000000000","message":"But our clients don\u0027t. :-) It\u0027s at least confusing - let the value below be used for such extras.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"6dc7f2abf76ac12320374edfc0a7b71fa7e4f014","unresolved":false,"context_lines":[{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"ssl_options.certfile \u003d /etc/rabbitmq/certs/{{ project_name }}-cert.pem"},{"line_number":27,"context_line":"ssl_options.keyfile \u003d /etc/rabbitmq/certs/{{ project_name }}-key.pem"},{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"},{"line_number":29,"context_line":"# Don\u0027t require client certificates."},{"line_number":30,"context_line":"ssl_options.fail_if_no_peer_cert \u003d false"},{"line_number":31,"context_line":"{% for key, value in rabbitmq_tls_options.items() %}"},{"line_number":32,"context_line":"ssl_options.{{ key }} \u003d {{ value }}"},{"line_number":33,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_88b8bec7","line":30,"range":{"start_line":28,"start_character":0,"end_line":30,"end_character":40},"in_reply_to":"9f560f44_d9af2b7b","updated":"2020-09-17 09:21:54.000000000","message":"It means that we don\u0027t require client certs, but if a client does send a cert then we will verify it.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"e01e68326f3e887d13cf3c082b7ca803e0524298","unresolved":false,"context_lines":[{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"},{"line_number":29,"context_line":"# Don\u0027t require client certificates."},{"line_number":30,"context_line":"ssl_options.fail_if_no_peer_cert \u003d false"},{"line_number":31,"context_line":"{% for key, value in rabbitmq_tls_options.items() %}"},{"line_number":32,"context_line":"ssl_options.{{ key }} \u003d {{ value }}"},{"line_number":33,"context_line":"{% endfor %}"},{"line_number":34,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_f9c82f4e","line":31,"range":{"start_line":31,"start_character":21,"end_line":31,"end_character":41},"updated":"2020-09-17 08:35:46.000000000","message":"rabbitmq_listener_tls_options","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"b1b3d267c52666389f5ca54ac5a704505a366dcb","unresolved":false,"context_lines":[{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"},{"line_number":29,"context_line":"# Don\u0027t require client certificates."},{"line_number":30,"context_line":"ssl_options.fail_if_no_peer_cert \u003d false"},{"line_number":31,"context_line":"{% for key, value in rabbitmq_tls_options.items() %}"},{"line_number":32,"context_line":"ssl_options.{{ key }} \u003d {{ value }}"},{"line_number":33,"context_line":"{% endfor %}"},{"line_number":34,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_4b2ea08c","line":31,"range":{"start_line":31,"start_character":21,"end_line":31,"end_character":41},"in_reply_to":"9f560f44_a88ca22e","updated":"2020-09-17 09:33:33.000000000","message":"See the answer at the top. This would become \u0027rabbitmq_amqp_tls_options\u0027 - better than \u0027rabbitmq_client_tls_options\u0027 obviously.","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"6dc7f2abf76ac12320374edfc0a7b71fa7e4f014","unresolved":false,"context_lines":[{"line_number":28,"context_line":"ssl_options.verify \u003d verify_peer"},{"line_number":29,"context_line":"# Don\u0027t require client certificates."},{"line_number":30,"context_line":"ssl_options.fail_if_no_peer_cert \u003d false"},{"line_number":31,"context_line":"{% for key, value in rabbitmq_tls_options.items() %}"},{"line_number":32,"context_line":"ssl_options.{{ key }} \u003d {{ value }}"},{"line_number":33,"context_line":"{% endfor %}"},{"line_number":34,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"9f560f44_a88ca22e","line":31,"range":{"start_line":31,"start_character":21,"end_line":31,"end_character":41},"in_reply_to":"9f560f44_f9c82f4e","updated":"2020-09-17 09:21:54.000000000","message":"why listener?","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"}],"doc/source/reference/message-queues/rabbitmq.rst":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"96447c7aa52f474869bed202412735228de37d83","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"* client-server traffic, typically between OpenStack services using the"},{"line_number":19,"context_line":"  :oslo.messaging-doc:`oslo.messaging \u003c/\u003e` library and RabbitMQ"},{"line_number":20,"context_line":"* RabbitMQ Management API"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff570b3c_2f100b57","line":20,"updated":"2020-05-20 07:42:11.000000000","message":"and UI","commit_id":"3d95bc7caa925634c03cab704431f64f37996426"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"96447c7aa52f474869bed202412735228de37d83","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* RabbitMQ cluster traffic between RabbitMQ server nodes"},{"line_number":25,"context_line":"* RabbitMQ CLI communication with RabbitMQ server nodes"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Client-server"},{"line_number":28,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff570b3c_fa5533fb","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":55},"updated":"2020-05-20 07:42:11.000000000","message":"kinda kills the spirit :D So no management commands from CLI are sent over TLS? Or just ignore certs? I thought switching rmq to tls would disallow plain tcp? (except for cluster traffic)","commit_id":"3d95bc7caa925634c03cab704431f64f37996426"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"92370c79dda50c929a505bbea64282d09b0e7de9","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* RabbitMQ cluster traffic between RabbitMQ server nodes"},{"line_number":25,"context_line":"* RabbitMQ CLI communication with RabbitMQ server nodes"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Client-server"},{"line_number":28,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff570b3c_3c0b0f8e","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":55},"in_reply_to":"ff570b3c_9cb05bdf","updated":"2020-05-21 08:17:39.000000000","message":"Ah, yeah. They called it \u0027clustering-ssl\u0027 in url and \u0027TLS for Inter-node (Clustering) Traffic\u0027 in the toc so I did not notice they write about CLI there lol. Hence why I thought only the clustering traffic was special (which would be finer than also insecure CLI but meh).\n\n\nPS: Deprecate rmq.","commit_id":"3d95bc7caa925634c03cab704431f64f37996426"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"9923ac67434e1359638ed078c0c65e353172049d","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* RabbitMQ cluster traffic between RabbitMQ server nodes"},{"line_number":25,"context_line":"* RabbitMQ CLI communication with RabbitMQ server nodes"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Client-server"},{"line_number":28,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff570b3c_9cb05bdf","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":55},"in_reply_to":"ff570b3c_fa5533fb","updated":"2020-05-21 08:12:26.000000000","message":"The main RMQ TLS guide just covers client AMQP traffic: https://www.rabbitmq.com/ssl.html. Clustering and CLI communication uses native erlang, so is configured differently, see https://www.rabbitmq.com/clustering-ssl.html. It\u0027s not impossible to do, just different so requires a bit more time to be spent on it. I figured the main priority would be AMQP, since that extends out to compute nodes.","commit_id":"3d95bc7caa925634c03cab704431f64f37996426"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"96447c7aa52f474869bed202412735228de37d83","unresolved":false,"context_lines":[{"line_number":75,"context_line":"command, which will generate self-signed certificates for RabbitMQ if"},{"line_number":76,"context_line":"``rabbitmq_enable_tls`` is ``true``."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Management API"},{"line_number":79,"context_line":"--------------"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The management API is accessed via HAProxy, exposed only on the internal VIP."}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff570b3c_6f068322","line":78,"updated":"2020-05-20 07:42:11.000000000","message":"and UI","commit_id":"3d95bc7caa925634c03cab704431f64f37996426"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"96447c7aa52f474869bed202412735228de37d83","unresolved":false,"context_lines":[{"line_number":78,"context_line":"Management API"},{"line_number":79,"context_line":"--------------"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The management API is accessed via HAProxy, exposed only on the internal VIP."},{"line_number":82,"context_line":"As such, traffic to this API is encrypted when ``kolla_enable_tls_internal`` is"},{"line_number":83,"context_line":"``true``. See :ref:`tls-configuration`."},{"line_number":84,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff570b3c_ba01fb07","line":81,"updated":"2020-05-20 07:42:11.000000000","message":"and UI","commit_id":"3d95bc7caa925634c03cab704431f64f37996426"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"96447c7aa52f474869bed202412735228de37d83","unresolved":false,"context_lines":[{"line_number":79,"context_line":"--------------"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The management API is accessed via HAProxy, exposed only on the internal VIP."},{"line_number":82,"context_line":"As such, traffic to this API is encrypted when ``kolla_enable_tls_internal`` is"},{"line_number":83,"context_line":"``true``. See :ref:`tls-configuration`."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Passing arguments to RabbitMQ server\u0027s Erlang VM"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff570b3c_fa07f316","line":82,"updated":"2020-05-20 07:42:11.000000000","message":"and UI","commit_id":"3d95bc7caa925634c03cab704431f64f37996426"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"f0620106576968121152a611ab95e37c61b0940c","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"* client-server traffic, typically between OpenStack services using the"},{"line_number":19,"context_line":"  :oslo.messaging-doc:`oslo.messaging \u003c/\u003e` library and RabbitMQ"},{"line_number":20,"context_line":"* RabbitMQ Management API and UI"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"bf51134e_b7ea020c","line":20,"updated":"2020-06-21 10:34:06.000000000","message":"hmm, does it in fact? https://www.rabbitmq.com/management.html#single-listener-https","commit_id":"cead74b2a7a6784d0a178705fba65168f54e83cf"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"0688b69192595a2845b894718e56d915065dd44d","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"* client-server traffic, typically between OpenStack services using the"},{"line_number":19,"context_line":"  :oslo.messaging-doc:`oslo.messaging \u003c/\u003e` library and RabbitMQ"},{"line_number":20,"context_line":"* RabbitMQ Management API and UI"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"bf51134e_f777739e","line":20,"in_reply_to":"bf51134e_b7ea020c","updated":"2020-07-23 13:57:14.000000000","message":"Well, via the load balancer yes. Not end-to-end.","commit_id":"cead74b2a7a6784d0a178705fba65168f54e83cf"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"e01e68326f3e887d13cf3c082b7ca803e0524298","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"* client-server traffic, typically between OpenStack services using the"},{"line_number":19,"context_line":"  :oslo.messaging-doc:`oslo.messaging \u003c/\u003e` library and RabbitMQ"},{"line_number":20,"context_line":"* RabbitMQ Management API and UI"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9f560f44_7979bff9","line":20,"range":{"start_line":20,"start_character":2,"end_line":20,"end_character":32},"updated":"2020-09-17 08:35:46.000000000","message":"only frontend (haproxy), not backend (rmq management plugin)","commit_id":"f66f6455826f43e4e2bb612839171d669f4330d2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"29576bfc9de75651d2f67076eb52a4fd860c4d49","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Encryption of the following channels is not currently supported:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* RabbitMQ cluster traffic between RabbitMQ server nodes"},{"line_number":25,"context_line":"* RabbitMQ CLI communication with RabbitMQ server nodes"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Client-server"},{"line_number":28,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"9f560f44_882b9ee8","line":25,"updated":"2020-09-17 09:16:12.000000000","message":"then add the other one here","commit_id":"e441285cd9777af620894511b19e2a214005a9d7"}]}