Submitting this before it becomes to painful to change later: we should use abstract service names rather than hostnames for new services.
In particular the new ci should have a CNAME like "ci" or "jenkins" rather than http://thyssen.internal.softwareheritage.org:8080/ .
To be coordinated with @douardda as he is actively working on the Jenkins setup.
| rSPSITE puppet-swh-site | |||
| rSPSITE01d52f0aa983 Add reverse proxy configuration for jenkins | |||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Migrated | gitlab-migration | T1024 Proper continuous integration setup | ||
| Migrated | gitlab-migration | T1233 use CNAME for upcoming jenkins CI |
JFTR, setting up a reverse proxy with https in front of this service was always the plan before this went further than the prototype stage :)
The only blocker is choosing which of our public-facing hosts should play the role of the reverse proxy. I'll be going with tate, which hosts phabricator and the wikis.
should the public facing (rev proxy) be a "web server" like nginx (or apache) or a varnish? (I like varnish, far from being an expert though. At Logilab, I usually put a varnish (or nginx) alone on a small VM.)
Varnish is indeed nice but that host (tate) already has an apache so I'll be configuring a vhost in that.