Custom Query (196 matches)

(Split out from #48.)

Currently lockername.scripts.mit.edu gives a certificate error on IE 6 and Safari. The problem is that (modulo the recent SNI extension) the HTTPS protocol doesn’t support sending the virtual host name before the server must decide which certificate to present. In #48, Joe installed SNI, which FF 2 and IE 7 understand.

To accomplish the highly desirable #17, we need to support these other browsers; many scripts users will not consider it acceptable that their viewers on IE 6 and Safari get certificate errors. To do this, we can move scripts.mit.edu to a separate IP from *.scripts.mit.edu, so that the server knows which certificate to present based on the IP.

When Apache is truly systemd'ified, we will be able to add the following:

For OpenAFS:

[Unit]
Before=httpd.service
[Install]
WantedBy=httpd.service

For Cron (needs a new patch):

[Unit]
Before=httpd.service
[Install]
WantedBy=httpd.service

Though, honestly, it may make more sense to roll our own Systemd service for afsagent.

This doesn't work right now because Apache is still SysV.

(Imported from ​help.mit.edu #394939.)

geofft:

I have a rough prototype of an auto-CNAME script in /mit/geofft/scripts/cname.sh. People should test it, make sure its logic is right, and laugh at my poor coding standards. I think it handles everything (modulo the special case for "DELETE", which it doesn't explicitly take care of at the moment). It doesn't actually do anything yet, just print the actions that it would take.

I'll make it do something (i.e., e-mail jweiss and dump the vhost into SVN) once I'm confident its existing logic is right. Oh, and recommendations for a decent regex or other pattern-matching check for scripts URLs? (Escaping the string and calling wget is certainly an option.)

Oh, and someone who doesn't "add consult" by default (especially someone with tcsh) should make sure the script can still reach qy.

geofft:

Yeah, so more people should test this so we can put it into production. Seriously, it takes like 2 minutes to try some valid data and make sure it produces correct output, and then try invalid data and make sure it errors. And maybe 5 more minutes to read through my source and find holes in it. (Although most holes don't matter, since the script executes as the user.)

andersk:

I fixed some bugs:

/mit/andersk/Public/scripts/geofft-cname.sh