Skip to content
Snippets Groups Projects
New look: Off

rebuild corsicum into collector-02.torproject.org

    • Closed Issue created by anarcat @anarcat

    we need to migrate out of the old Sunet cluster into the new Safespring cluster, corsicum needs to be retired and rebuilt into collector-02.

    see also #40684 (closed).

    Edited

    Designs

    Child items ...

    • Activity

    • anarcat added Metrics Next labels

      added Metrics Next labels

    • anarcat assigned to @hiro

      assigned to @hiro

    • anarcat marked this issue as related to #40684 (closed)

      marked this issue as related to #40684 (closed)

    • anarcat mentioned in issue #40684 (closed)

      mentioned in issue #40684 (closed)

    • Georg Koppen
      Georg Koppen @gk ·

      /cc @gk

      • Hiro
        Hiro @hiro ·
        Reporter

        I was thinking is there a plan to move colchicifolium? Can corsicum in that case become collector-02?

        If that's not the case. Could we call this VM collector-backup-01 instead? Otherwise it would be kind of confusing.

      • anarcat
        anarcat @anarcat ·
        Author Owner

        I was thinking is there a plan to move colchicifolium?

        i don't remember there being a plan for colchicifolium specifically... there's this disk full ticket:

        #40535 (closed)

        Can corsicum in that case become collector-02?

        If that's not the case. Could we call this VM collector-backup-01 instead? Otherwise it would be kind of confusing.

        Ah. Oops. Well, I will just retire collector-01 then and recreate collector-02... sorry for the confusion, i'll let you know when it's done.

        ...

        On 2023-05-09 09:21:27, Hiro wrote:

      • Please register or sign in to reply
    • Hiro
      Hiro @hiro ·
      Reporter

      As far as collector (colchicifolium) is concerned, the downloading from corsicum happens over http. There is a configuration option that says:

      RelaySyncOrigins = https://collector2.torproject.org

      So as long as we keep that cname up we are good.

    • Hiro
      Hiro @hiro ·
      Reporter

      Regarding corsicum. I think the safest bet is copying over what we have in /srv/collector.torproject.org/

      Everything else should be handled by puppet. Do let me know when you are doing the migration and I will be looking over at the service and see if everything works correctly.

    • Hiro removed Next label

      removed Next label

    • Hiro added Doing label

      added Doing label

    • anarcat changed title from rebuild corsicum into collector-01.torproject.org to rebuild corsicum into collector-02.torproject.org

      changed title from rebuild corsicum into collector-01.torproject.org to rebuild corsicum into collector-02.torproject.org

    • anarcat changed the description

      changed the description

    • anarcat
      anarcat @anarcat ·
      Author Owner

      collector-01 retirement:

      571 host=collector-01,ou=hosts,dc=torproject,dc=org
host: collector-01
hostname: collector-01.torproject.org
objectClass: top
objectClass: debianServer
l: Sweden
distribution: Debian
access: restricted
admin: torproject-admin@torproject.org
architecture: amd64
physicalHost: safespring.com
allowedGroups: collector
description: collector host backend
purpose: [[*collector.torproject.org]]
rebootPolicy: justdoit
ipHostNumber: 89.47.184.197
ipHostNumber: 2001:6b0:5a:4020::114
sshRSAHostKey: ssh-dss AAAAB3NzaC1kc3MAAACBALf+F7jx9S5hS6yVFE0Zc/n3RHX4sUhFpvSj6dwLdxva/g+GdgYzUmrm6e6rLXgmwharNvI7tUpBrwKsYZ4fVdkGH91J+Y8tFHLJOisv34IzrcOY5uV9Eh5K7ujPfMFWxSOnIpxOkLEj1MWlipqOKGcjVErcT1JSyA5Nxgl9IN3dAAAAFQCdIPlVxsA6ODrWwjxw6a3tyK7v1QAAAIBrC/ImI3K/scXNG4SCv/pKmEFz6sjVzmSECpZ1v+idSAiKKbYoMFxvCPIgY4FVseBAqNuHi9fOwU3kde95qMD7Ap0Ztt/gi8uqRF96j9kqwFoGNe4J4omT6DF3y5q2ZncQGw/Im+lkf884JKHDcyUwl/fzeUEKIv3iZL90QaDBAQAAAIAp0Sr0id8MPR+Bs4G20cynlC6+h7BsIyzgQBT4WYfi1tg2gpGtTfOhUFS5RENdzbQYHcThNWjciaeTfPbYeS2m7SQcRVNjxvPL7zdDQrl3lwEXeEGa+slB7jFShUapBalIIv7IBVO+3uJPHfoGaOyELSWmtpEFrrURZjsaiS2JLw== root@collector-01
sshRSAHostKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYNX/gCGnhGyAndUowh7UsB+Jm7JDjINctUkfXPxR0T root@collector-01
sshRSAHostKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDKJC2uHxJYPdUDP+yprMvkpLbiotBislSYWPWJSX7MVT3K5xa953M++vtPs5BXEHcrviqf7jRPN9RXBey3gUVlL4CUAs+HHZ9Ip370te3xTqrF8f7q8VRmFuqUwKI2/frlG8HBYwM+RDRqVEJpl3AIVJ7L9gTJn/st2WfXLMHsavCkbBNxPU05NcYCZxrtI+77rB+M5VWRCdn6VuwfdvMLJt3lIPflRKkMYFe3YgzYH53PhNj/0UwQM8W0S1NcHPy0GCSDy1TJWkP9JNGABZ9vHJlL06BicUMx2OrxneREL+BJulJQBGslIiSsf24bHRPCZFZOva7A1I/jee9zb5/RnPjgm0HKKca0jgy2dvGgA3wdjHpyFw8zR3qi1vJYEMH2sCTYpNfwgNA0zthpQLeykpY7ZvOJnVvVYwA2eej2vBW0fxUAwtuHmgp5IZ2WN7KKl91+fweGNkUWMKeo+SFZcZ1xvswGRT13vY3oSbu1HnN/Veu6B5teYc7VUcMFWs0= root@collector-01

      fabric:

      anarcat@angela:tsa-misc[SIGINT]$ ./retire -v -H collector-01.torproje
ct.org retire-all
starting tasks at 2023-05-09 16:59:58.367378+00:00
not wiping instance collector-01.torproject.org data: no parent host
scheduling collector-01.torproject.org backup disks removal on host bungei.torproject.org and director bacula-director-01.torproject.org
checking for path "/srv/backups/bacula/collector-01.torproject.org/" on bungei.torproject.org
scheduling rm -rf "/srv/backups/bacula/collector-01.torproject.org/" to run on bungei.torproject.org in 30 days
warning: commands will be executed using /bin/sh
job 100 at Thu Jun  8 17:00:00 2023
checking for path "/srv/backups/pg/collector-01/" on bungei.torproject.org
path /srv/backups/pg/collector-01/ not found: [Errno 2] No such file
scheduling echo delete client=collector-01.torproject.org-fd yes | bconsole to run on bacula-director-01.torproject.org in 30 days
warning: commands will be executed using /bin/sh
job 52 at Thu Jun  8 17:00:00 2023
Notice: Revoked certificate with serial 177
Notice: Removing file Puppet::SSL::Certificate collector-01.torproject.org at '/var/lib/puppet/ssl/ca/signed/collector-01.torproject.org.pem'
collector-01.torproject.org
Submitted 'deactivate node' for collector-01.torproject.org with UUID f91b3279-460c-49aa-9bfd-20febe67bb32
completed tasks, elasped: 0:00:13.621413 (user 1.5 system 0.02 chlduser 0.03 chldsystem 0.0 RSS 56.7 MB)
anarcat@angela:tsa-misc$
    • anarcat
      anarcat @anarcat ·
      Author Owner

      collector-02 rebuilt.

    • anarcat
      anarcat @anarcat ·
      Author Owner

      i installed apache2 and reran puppet on collector-02 as nagios was complaining about apache missing... i also had to enable the ssl module to get puppet happy after.

      Edited by anarcat
    • anarcat
      anarcat @anarcat ·
      Author Owner

      @hiro any progress on this? do you need help?

    • Hiro
      Hiro @hiro ·
      Reporter

      Ok this is done. You can retire corsicum.

    • Hiro closed

      closed

    • anarcat
      anarcat @anarcat ·
      Author Owner

      thanks, i'll reopen this to keep track of the retirement if you don't mind.

    • anarcat reopened

      reopened

    • anarcat assigned to @anarcat and unassigned @hiro

      assigned to @anarcat and unassigned @hiro

    • anarcat
      anarcat @anarcat ·
      Author Owner

      corsicum retirement, retire fabric script:

      anarcat@angela:tsa-misc$ ./retire -v -H corsicum.torproject.org retire-all 
starting tasks at 2023-05-23 16:11:58.796622+00:00
not wiping instance corsicum.torproject.org data: no parent host
scheduling corsicum.torproject.org backup disks removal on host bungei.torproject.org and director bacula-director-01.torproject.org
checking for path "/srv/backups/bacula/corsicum.torproject.org/" on bungei.torproject.org
scheduling rm -rf "/srv/backups/bacula/corsicum.torproject.org/" to run on bungei.torproject.org in 30 days
warning: commands will be executed using /bin/sh
job 102 at Thu Jun 22 16:12:00 2023
checking for path "/srv/backups/pg/corsicum/" on bungei.torproject.org
path /srv/backups/pg/corsicum/ not found: [Errno 2] No such file
scheduling echo delete client=corsicum.torproject.org-fd yes | bconsole to run on bacula-director-01.torproject.org in 30 days
warning: commands will be executed using /bin/sh
job 54 at Thu Jun 22 16:12:00 2023
Notice: Revoked certificate with serial 21
Notice: Removing file Puppet::SSL::Certificate corsicum.torproject.org at '/var/lib/puppet/ssl/ca/signed/corsicum.torproject.org.pem'
corsicum.torproject.org
Submitted 'deactivate node' for corsicum.torproject.org with UUID b896da74-eecc-4466-87a0-326cd0969e48
completed tasks, elasped: 0:00:13.536709 (user 1.52 system 0.03 chlduser 0.03 chldsystem 0.0 RSS 56.4 MB)

      LDAP blob removed:

      338 host=corsicum,ou=hosts,dc=torproject,dc=org
host: corsicum
hostname: corsicum.torproject.org
objectClass: top
objectClass: debianServer
distribution: Debian
access: restricted
admin: torproject-admin@torproject.org
architecture: amd64
physicalHost: cloud.ipnett.se
l: Sweden
ipHostNumber: 2001:6b0:5a:5000::7
ipHostNumber: 89.45.235.23
sshRSAHostKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEsQUqtay/jXzVWngYpLbfraZviel+qb4vHgl7u2Ne6Ur396TDbKy045dAJZiKLG4Ukb7Spgb+2zYG+8gDbq4ji/IcJRLxgMcKOhDtapSJZDP87ZyMnuPneLpxZ0ppchwPLz748mNBksjA6fvdBqC0wh2VTHIdesvt4SBMZEH3COEYJpltkV0DGIyoXOE0eNvCi4B8NH4OQq9oIUufdFSsFhqEbjEtmPYVnAIRWQf/rsYO43Z7Ljueq23Hwrrvsj0znOeRajLeNL51myEUi9Mi0F5mCyKFNjGWuEvRWxnxepEom3av/MxImley9gG6cGtUfKT3xcSvpt86uWbF6ZWX root@corsicum
sshRSAHostKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFhKZhfN0Uno4PpeWa3la4ZUbzO95LRXKlv1PG8sKeJn root@corsicum
allowedGroups: collector
description: collector host backend
purpose: [[*collector.torproject.org]]
rebootPolicy: justdoit
    • anarcat
      anarcat @anarcat ·
      Author Owner

      checklist:

      1. announcement
      2. nagios
      3. retire the host in fabric
      4. remove from LDAP with ldapvi
      5. power-grep
      6. remove from tor-passwords
      7. remove from DNSwl
      8. remove from docs
      9. remove from racks
      10. remove from reverse DNS
      Edited by anarcat
    • anarcat mentioned in issue #41174 (closed)

      mentioned in issue #41174 (closed)

    • anarcat
      anarcat @anarcat ·
      Author Owner

      VM deleted from Sunet, i still need to cleanup the reverse zone, but i'll followup on that in #40684 (closed), closing.

    • anarcat closed

      closed

    Please register or sign in to reply