Writing things down makes me feel very important
Revisions and Commits
|Restricted Differential Revision||Restricted Diffusion Commit|
|D15696||rP66366137ffa9 Don't apply `security.require-https` to intracluster requests|
|D15695||rP99be132ea21e Allow public users to make intracluster API requests|
This sort of works now. The 002 node is live, just not reachable yet. Some weird stuff I hit:
- I wasn't fiddling with security.require-https properly, so the service was redirecting and dropping headers/parameters. If the X-Phabricator-Cluster header is present, we could fail with a useful message instead of redirecting.
- sudo permission for SSH for proxying on web/ssh nodes, kind of hard to auto-detect this.
Every service on secure is now supported by a redundant version in a separate AWS availability zone. Failover wouldn't be completely clean/automatic, but we could lose either node with zero data loss, and would have a very short path to promoting the remaining node as a full master.
(Technically, Drydock only has only one sbuild node and one saux node, so this isn't entirely true if you want to split hairs, but those services are nonessential in this configuration.)