Compilation results for phab2003.codfw.wmnet: System changes detected

You can retrieve this result from host.json.

Catalog differences

Summary

Total Resources:	3250
Resources added:	537
Resources removed:	8
Resources modified:	546
Change percentage:	33.57%

Resources only in the new catalog

Systemd::Timer[phabricator_stats_job_yearly_metrics]
Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.timer]
Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.timer]
Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.service (phabricator_stats_job_quarterly_wmf_qls.service)]
File[/etc/bacula/ssl/server.p12]
File[/home/urbanecm/.my.cnf]
File[/etc/update-motd.d/06-backups-srv-repos]
File[/etc/logrotate.d/phabricator_stats_job_community_metrics]
Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.timer (phabricator_stats_job_community_metrics.timer)]
Systemd::Service[wmf_auto_restart_envoyproxy]
Ferm::Service[phabmain_http]
Systemd::Service[rsync-phabricator-home-dirs]
User[aphlict]
File[/etc/nftables/input/10_rsyncd_access_srv-dumps.nft]
Firewall::Service[envoy_tls_termination_src_sets]
File[/var/log/rsync-phabricator-repos]
Logrotate::Conf[phabricator_stats_job_tech_news_weekly_stats]
Concat::Fragment[/etc/bacula_puppet_agent_cert]
File[/lib/systemd/system/wmf_auto_restart_envoyproxy.service]
File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.service]
Systemd::Unit[wmf_auto_restart_envoyproxy.timer]
File[/etc/rsyslog.d/40-wmf-auto-restart-envoyproxy.conf]
File[/etc/sysusers.d/vcs.conf]
Exec[systemd daemon-reload for backup-home-dirs.service (backup-home-dirs.service)]
Nftables::Service[phabmain-smtp]
Rsyslog::Conf[wmf_auto_restart_prometheus-apache-exporter]
Ferm::Service[phabmain_smtp]
Firewall::Service[ssh_cluster]
Logrotate::Conf[rsync-phabricator-home-dirs]
File[/etc/rsyslog.d/40-rsync-phabricator-repos.conf]
Systemd::Unit[phabricator_stats_job_yearly_metrics.timer]
File[/home/aklapper/.my.cnf]
Admin::Group[phabricator-bulk-manager]
Systemd::Service[rsync-phabricator-repos]
Systemd::Unit[phabricator_clean_tmp_files.service]
Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.timer (phabricator_stats_job_quarterly_metrics.timer)]
File[/etc/logrotate.d/phabricator_clean_tmp_files]
File[/etc/sysctl.d/70-phabricator-network-tuning.conf]
Exec[renew certificate - discovery2026__phabricator_discovery_wmnet_server]
Profile::Auto_restarts::Service[aphlict]
Rsyslog::Input::File[apache2-error]
Package[mariadb-client]
Rsync::Quickdatacopy[phabricator-home-dirs]
Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.service (phabricator_stats_job_yearly_metrics.service)]
Logrotate::Conf[backup-home-dirs]
File[/lib/systemd/system/phabricator_task_dump.service]
Envoyproxy::Cluster[cluster_local_port_80]
Logrotate::Conf[phabricator_stats_job_yearly_metrics]
Systemd::Syslog[phabricator_clean_tmp_files]
Systemd::Timer[phabricator_stats_job_quarterly_wmf_qls]
Exec[update-gitconfig]
Admin::Groupmembers[phabricator-bulk-manager]
Systemd::Unit[rsync-phabricator-repos.service]
Logrotate::Conf[aphlict]
Concat_fragment[/etc/bacula_puppet_ca_chain]
Phabricator::Logmail[community_metrics]
Phabricator::Libext[/srv/phab/libext/misc]
Systemd::Unit[rsync-phabricator-home-dirs.service]
File[/etc/update-motd.d/05-phabricator]
Rsyslog::Conf[phabricator_stats_job_project_changes]
File[/etc/update-motd.d/06-backups-home]
Exec[systemd daemon-reload for backup-home-dirs.timer (backup-home-dirs.timer)]
File[/etc/phabtools.conf]
File[/etc/phabricator]
Systemd::Timer::Job[wmf_auto_restart_prometheus-apache-exporter]
Exec[systemd daemon-reload for envoyproxy.service (envoyproxy.service)]
File[/var/log/rsync-phabricator-home-dirs]
Git::Systemconfig[setup proxy]
File[/etc/phab_yearly_metrics.conf]
File[/usr/local/bin/community_metrics.sh]
Admin::Group[phabricator-admin]
File[/var/log/aphlict/]
Exec[phabricator-bulk-manager_ensure_members]
Systemd::Timer[wmf_auto_restart_prometheus-apache-exporter]
Exec[/srv/phab/libext/ava/src_static_dir_exists]
File[/var/log/phabricator_stats_job_project_changes]
Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.timer (wmf_auto_restart_prometheus-apache-exporter.timer)]
Systemd::Syslog[wmf_auto_restart_envoyproxy]
File[/srv/phab/phabricator//support/aphlict/server/node_modules]
Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.service (phabricator_stats_job_tech_news_weekly_stats.service)]
Systemd::Timer[rsync-phabricator-home-dirs]
Logrotate::Conf[phabricator_task_dump]
Package[prometheus-apache-exporter]
Logrotate::Conf[rsync-phabricator-repos]
Ferm::Service[ssh_cluster]
File[/etc/sudoers.d/phabricator-bulk-manager]
Package[python3-pymysql]
File[/usr/libexec/phabricator-ssh-hook.sh]
File[/var/run/aphlict/]
Concat[/etc/bacula/ssl/cert.pem]
Concat::Fragment[/etc/bacula_puppet_ca_chain]
Systemd::Unit[rsync-phabricator-repos.timer]
File[/lib/systemd/system/rsync-phabricator-home-dirs.timer]
Exec[systemd daemon-reload for wmf_auto_restart_aphlict.service (wmf_auto_restart_aphlict.service)]
File[/etc/exim4/aliases]
Exec[systemd daemon-reload for rsync-phabricator-home-dirs.timer (rsync-phabricator-home-dirs.timer)]
Systemd::Unit[phabricator_stats_job_quarterly_metrics.service]
File[/etc/exim4/dkim]
Systemd::Timer[phabricator_task_dump]
File[/etc/apache2/sites-enabled/50-phabricator.conf]
User[gjg]
Systemd::Timer[phabricator_stats_job_tech_news_weekly_stats]
Systemd::Service[phabricator_stats_job_yearly_metrics]
Logrotate::Conf[phabricator_stats_job_community_metrics]
File[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]
Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.service (wmf_auto_restart_prometheus-apache-exporter.service)]
Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server]
Exec[update-sysusers-vcs]
Package[apachetop]
Group[phabricator-admin]
Rsyslog::Conf[phabricator_stats_job_quarterly_wmf_qls]
Class[Sslcert::Ca_deselect_dstx3]
File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.timer]
Rsync::Quickdatacopy[phabricator-repos]
File[/usr/local/bin/quarterly_metrics.sh]
File[/etc/nftables/input/10_phabmain_http.nft]
Bacula::Client::Job[srv-repos-Monthly-1st-Wed-productionEqiad]
Service[rsync-phabricator-repos.timer]
File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.timer]
Systemd::Timer[backup-home-dirs]
Mount[/var/spool/exim4/scan]
Admin::Hashgroup[phabricator-admin]
Class[Profile::Tlsproxy::Envoy]
Exec[systemd daemon-reload for phd.service (phd)]
Systemd::Unit[wmf_auto_restart_aphlict.timer]
Httpd::Conf[phabricator]
File[/srv/homes]
Firewall::Service[phabmain_http]
Class[Exim4]
File[/var/log/phabricator_task_dump]
Cfssl::Csr[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]
File[/etc/rsyslog.d/40-backup-home-dirs.conf]
File[/lib/systemd/system/wmf_auto_restart_aphlict.service]
Rsyslog::Conf[input-file-apache2-access]
File[/etc/gitconfig.d/10-setup_proxy.gitconfig]
File[/var/log/phabricator_stats_job_yearly_metrics]
Class[Profile::Tcp_fast_open]
File[/lib/systemd/system/phabricator_stats_job_project_changes.timer]
Class[Phabricator::Config]
Service[phabricator_stats_job_project_changes.timer]
File[/etc/rsyslog.d/40-phabricator-stats-job-yearly-metrics.conf]
File[/etc/phab_epipe.conf]
File[/usr/local/bin/backup-home-dirs]
File[/srv/dumps]
File[/lib/systemd/system/backup-home-dirs.service]
Exec[systemd daemon-reload for phabricator_clean_tmp_files.service (phabricator_clean_tmp_files.service)]
Rsyslog::Conf[rsync-phabricator-home-dirs]
File[/etc/nftables/input/10_bacula-file-daemon-backup1014.eqiad.wmnet.nft]
Nftables::Service[rsyncd_access_srv-dumps]
Systemd::Unit[phabricator_stats_job_quarterly_metrics.timer]
Package[python3-pygments]
Logrotate::Conf[wmf_auto_restart_aphlict]
Systemd::Unit[backup-home-dirs.service]
File[/lib/systemd/system/backup-home-dirs.timer]
Rsyslog::Conf[wmf_auto_restart_aphlict]
Profile::Auto_restarts::Service[envoyproxy]
File[/srv/phab/phabricator/scripts/daemon/]
Service[phabricator_clean_tmp_files.timer]
File[/etc/ssh/userkeys/mbinder]
File[/etc/sysctl.d/70-TCP-Fast-Open.conf]
Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh]
Service[phabricator_stats_job_quarterly_metrics.timer]
File[/lib/systemd/system/phabricator_clean_tmp_files.service]
File[/usr/local/bin/quarterly_wmf_qls.sh]
Phabricator::Logmail[yearly_metrics]
File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.timer]
Rsyslog::Conf[imfile]
Logrotate::Conf[exim4-paniclog]
File[/etc/default/prometheus-apache-exporter]
Admin::Groupmembers[phabricator-admin]
Class[Git::Globalconfig]
Systemd::Timer::Job[phabricator_stats_job_yearly_metrics]
Sysctl::Parameters[phabricator network tuning]
File[/etc/logrotate.d/envoy]
File[/etc/rsync.d]
File[/etc/phab_community_metrics.conf]
Class[Phabricator]
File[/etc/logrotate.d/phabricator_stats_job_quarterly_wmf_qls]
Logrotate::Conf[phabricator_stats_job_quarterly_wmf_qls]
Service[backup-home-dirs.timer]
Rsyslog::Conf[backup-home-dirs]
Systemd::Timer[wmf_auto_restart_envoyproxy]
Systemd::Timer::Job[rsync-phabricator-repos]
Systemd::Unit[phabricator_task_dump.service]
File[/etc/sudoers.d/phabricator-admin]
Systemd::Unit[phabricator_stats_job_project_changes.service]
Ferm::Service[bacula_file_daemon_backup1014_eqiad_wmnet]
File[/etc/phab_tech_news_weekly_stats.conf]
Systemd::Syslog[rsync-phabricator-repos]
Exec[create chained cert /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]
File[/etc/logrotate.d/wmf_auto_restart_envoyproxy]
File[/etc/sudoers.d/vcs]
Logrotate::Conf[phabricator_stats_job_project_changes]
Service[envoyproxy.service]
Rsyslog::Conf[phabricator_stats_job_tech_news_weekly_stats]
Systemd::Unit[wmf_auto_restart_envoyproxy.service]
File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.timer]
Ferm::Service[envoy_tls_termination_src_sets]
User[mbinder]
File[/etc/logrotate.d/phd]
File[/etc/bacula/ssl]
File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-metrics.conf]
Motd::Script[backups-srv-repos]
Systemd::Service[phabricator_stats_job_project_changes]
File[/lib/systemd/system/phabricator_stats_job_community_metrics.service]
Logrotate::Conf[phd]
Envoyproxy::Conf[cluster_local_port_80]
Systemd::Service[wmf_auto_restart_aphlict]
Package[bacula-fd]
Group[aphlict]
File[/usr/local/bin/tech_news_weekly_stats.sh]
File[/etc/nftables/input/10_phabmain-smtp.nft]
File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.service]
Systemd::Unit[aphlict]
Systemd::Service[phabricator_stats_job_tech_news_weekly_stats]
Motd::Script[phabricator]
Exec[systemd daemon-reload for phabricator_task_dump.service (phabricator_task_dump.service)]
Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.service (phabricator_stats_job_quarterly_metrics.service)]
File[/etc/nftables/notrack/10_envoy_tls_termination_src_sets.nft]
Concat_file[/etc/rsyncd.conf]
File[/etc/envoy/listeners.d/00-tls_terminator_443.yaml]
File[/etc/phab_quarterly_metrics.conf]
File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-apache-exporter.conf]
Logrotate::Conf[phabricator_stats_job_quarterly_metrics]
Admin::User[gjg]
Admin::User[urbanecm]
Systemd::Syslog[rsync-phabricator-home-dirs]
File[/usr/local/bin/arc]
File[/usr/local/sbin/envoyproxy-hot-restarter]
Nftables::Service[bacula-file-daemon-backup1014.eqiad.wmnet]
File[/etc/rsyslog.d/40-phabricator-clean-tmp-files.conf]
Systemd::Timer::Job[phabricator_clean_tmp_files]
Ssh::Userkey[gjg]
File[/usr/libexec]
File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.service]
Systemd::Service[wmf_auto_restart_prometheus-apache-exporter]
File[/lib/systemd/system/phabricator_stats_job_community_metrics.timer]
File[/var/log/phd]
Firewall::Service[bacula-file-daemon-backup1014.eqiad.wmnet]
File[/etc/logrotate.d/exim4-paniclog]
File[/home/urbanecm]
Class[Role::Phabricator]
File[/var/log/phabricator_stats_job_quarterly_wmf_qls]
Package[exim4-daemon-heavy]
Systemd::Syslog[phabricator_stats_job_project_changes]
Sysctl::Conffile[TCP Fast Open]
Systemd::Service[aphlict]
Exec[phab-git-safedir]
User[vcs]
File[/home/gjg]
Rsyslog::Conf[phabricator_task_dump]
Concat_fragment[/etc/bacula_puppet_agent_cert]
File[/var/log/wmf_auto_restart_prometheus-apache-exporter]
File[/lib/systemd/system/wmf_auto_restart_envoyproxy.timer]
Systemd::Syslog[phabricator_stats_job_community_metrics]
Exec[systemd daemon-reload for rsync-phabricator-repos.timer (rsync-phabricator-repos.timer)]
Admin::Hashgroup[phabricator-bulk-manager]
Nftables::Service[ssh_cluster]
Service[wmf_auto_restart_prometheus-apache-exporter.timer]
File[/etc/logrotate.d/phabricator_stats_job_yearly_metrics]
Package[exim4-config]
Admin::User[mbinder]
File[/etc/phabricator/config.yaml]
File[/var/log/phd/ssh.log]
Phabricator::Logmail[project_changes]
Concat_file[/etc/bacula/ssl/cert.pem]
Package[python3-phabricator]
File[/srv/repos]
File[/etc/logrotate.d/wmf_auto_restart_prometheus-apache-exporter]
Systemd::Timer::Job[phabricator_stats_job_quarterly_wmf_qls]
File[/var/log/phabricator_stats_job_community_metrics]
Systemd::Unit[wmf_auto_restart_aphlict.service]
Exec[systemd daemon-reload for aphlict.service (aphlict)]
Concat::Fragment[/etc/rsyncd.conf-srv-dumps]
File[/etc/logrotate.d/rsync-phabricator-home-dirs]
Nftables::Service[phabmain_http]
File[/etc/logrotate.d/phabricator_task_dump]
File[/var/log/wmf_auto_restart_envoyproxy]
Class[Profile::Phabricator::Main]
File[/etc/envoy/admin-config.yaml]
Systemd::Timer::Job[phabricator_stats_job_tech_news_weekly_stats]
Class[Phabricator::Aphlict]
Systemd::Timer::Job[phabricator_task_dump]
File[/lib/systemd/system/wmf_auto_restart_aphlict.timer]
Service[phabricator_task_dump.timer]
File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-wmf-qls.conf]
File[/etc/envoy/stats-config.yaml]
File[/srv/dumps/WARNING_NEVER_PUT_PRIVATE_DATA_HERE_THIS_IS_SYNCED_TO_PUBLIC]
Systemd::Service[backup-home-dirs]
File[/usr/local/bin/yearly_metrics.sh]
Exec[systemd daemon-reload for phabricator_task_dump.timer (phabricator_task_dump.timer)]
File[/etc/logrotate.d/phabricator_stats_job_project_changes]
Logrotate::Conf[wmf_auto_restart_prometheus-apache-exporter]
File[/lib/systemd/system/phabricator_task_dump.timer]
Motd::Message[phabricator]
Logrotate::Conf[phabricator_clean_tmp_files]
Sudo::Group[phabricator-admin]
File[/etc/default/rsync]
File[/etc/gitconfig.d/00-header.gitconfig]
Service[rsync-phabricator-home-dirs.timer]
Systemd::Syslog[wmf_auto_restart_aphlict]
Systemd::Unit[phabricator_stats_job_yearly_metrics.service]
Exec[update-safedir-gitconfig]
File[/etc/default/exim4]
File[/etc/systemd/system/envoyproxy.service.d]
Logrotate::Conf[envoy]
Service[phabricator_stats_job_community_metrics.timer]
Systemd::Syslog[backup-home-dirs]
Systemd::Timer[rsync-phabricator-repos]
File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.csr]
Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.timer (phabricator_stats_job_tech_news_weekly_stats.timer)]
Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.timer (phabricator_stats_job_yearly_metrics.timer)]
File[/etc/logrotate.d/phabricator_stats_job_tech_news_weekly_stats]
Admin::Hashuser[mbinder]
File[/var/spool/exim4/db]
Service[prometheus-apache-exporter]
Firewall::Service[rsyncd_access_srv-dumps]
Phabricator::Libext[/srv/phab/libext/translations/src]
Systemd::Syslog[phabricator_task_dump]
File_line[auto_restart_file_presence_prometheus-apache-exporter]
File[/var/spool/exim4]
File_line[deselect_dst_root_ca_x3]
Mount[/var/spool/exim4/db]
File[/etc/rsyslog.d/10-input-file-apache2-error.conf]
File[/usr/local/bin/chk_phuser]
Systemd::Unit[phabricator_stats_job_community_metrics.timer]
File[/etc/bacula/ssl/server.key]
Systemd::Timer[phabricator_stats_job_community_metrics]
File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]
File[/etc/exim4/system_filter]
File[/usr/local/sbin/build-envoy-config]
User[urbanecm]
File[/var/log/wmf_auto_restart_aphlict]
Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.service]
File[/etc/exim4/update-exim4.conf.conf]
Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.timer]
Systemd::Timer::Job[phabricator_stats_job_quarterly_metrics]
Systemd::Timer[wmf_auto_restart_aphlict]
File[/etc/logrotate.d/rsync-phabricator-repos]
Exec[mkdir /var/spool/exim4/scan]
Rsyslog::Conf[envoy]
Backup::Set[srv-repos]
Rsyslog::Conf[phabricator_clean_tmp_files]
Sysctl::Parameters[TCP Fast Open]
Systemd::Timer::Job[wmf_auto_restart_aphlict]
Service[bacula-fd]
Systemd::Timer::Job[wmf_auto_restart_envoyproxy]
Systemd::Syslog[wmf_auto_restart_prometheus-apache-exporter]
File[/etc/bacula/bacula-fd.conf]
Puppet::Expose_agent_certs[/etc/bacula]
Service[rsync]
File[/etc/phab_project_changes.conf]
Class[Profile::Phabricator::Datasync]
Systemd::Service[phabricator_clean_tmp_files]
Rsync::Server::Module[srv-dumps]
File_line[auto_restart_file_presence_aphlict]
File[/usr/local/bin/git-http-backend]
Rsyslog::Conf[phabricator_stats_job_community_metrics]
Phabricator::Logmail[tech_news_weekly_stats]
Firewall::Service[phabmain-smtp]
Bacula::Client::Job[home-Monthly-1st-Wed-productionEqiad]
File[/etc/rsyslog.d/40-envoy.conf]
Systemd::Service[phabricator_task_dump]
Systemd::Timer::Job[phabricator_stats_job_community_metrics]
Ssh::Userkey[urbanecm]
Rsyslog::Conf[wmf_auto_restart_envoyproxy]
Service[phabricator_stats_job_quarterly_wmf_qls.timer]
Systemd::Timer[phabricator_clean_tmp_files]
Systemd::Syslog[envoy]
Systemd::Unit[phabricator_task_dump.timer]
File[/etc/phab_quarterly_wmf_qls.conf]
File[/lib/systemd/system/rsync-phabricator-home-dirs.service]
File[/etc/systemd/system/envoyproxy.service.d/puppet-override.conf]
Exec[create-/etc/bacula-keypair]
Rsyslog::Conf[rsync-phabricator-repos]
Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.service (wmf_auto_restart_envoyproxy.service)]
Systemd::Sysuser[vcs]
Motd::Script[backups-home]
File_line[auto_restart_file_presence_envoyproxy]
Sysctl::Conffile[phabricator network tuning]
Exec[systemd daemon-reload for rsync-phabricator-home-dirs.service (rsync-phabricator-home-dirs.service)]
File[/srv/phab/phabricator/scripts/repository/]
File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.timer]
File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem]
Class[Profile::Envoy]
Package[python3-mysqldb]
Concat[/etc/rsyncd.conf]
File[/lib/systemd/system/rsync-phabricator-repos.timer]
File[/etc/rsyslog.d/40-phabricator-stats-job-project-changes.conf]
Systemd::Mask[phd.service]
Exec[verify-envoy-config]
File[/srv/phab/tools/public_task_dump.py]
Systemd::Timer::Job[phabricator_stats_job_project_changes]
File[/etc/nftables/input/10_envoy_tls_termination_src_sets.nft]
Phabricator::Libext[/srv/phab/libext/ava/src]
Phabricator::Logmail[quarterly_metrics]
File[/etc/rsyslog.d/40-wmf-auto-restart-aphlict.conf]
Rsyslog::Input::File[apache2-access]
Systemd::Unit[rsync-phabricator-home-dirs.timer]
Class[Envoyproxy]
File[/usr/local/sbin/envoyproxy-start]
Class[Profile::Phabricator::Monitoring]
File[/etc/envoy/envoy.yaml]
Group[vcs]
Exec[systemd daemon-reload for phabricator_stats_job_project_changes.timer (phabricator_stats_job_project_changes.timer)]
Class[Profile::Prometheus::Apache_exporter]
Service[aphlict]
Systemd::Syslog[phabricator_stats_job_quarterly_metrics]
Ssh::Userkey[mbinder]
Exec[phabricator-admin_ensure_members]
Exec[apt_update_php]
File[/etc/logrotate.d/backup-home-dirs]
Systemd::Syslog[phabricator_stats_job_tech_news_weekly_stats]
Exec[systemd daemon-reload for phabricator_clean_tmp_files.timer (phabricator_clean_tmp_files.timer)]
File[/var/log/backup-home-dirs]
Systemd::Service[phd]
Class[Phabricator::Mailrelay]
File[/srv/phab/phabricator/scripts/ssh/]
Systemd::Unit[phabricator_clean_tmp_files.timer]
Systemd::Unit[envoyproxy.service]
Class[Phabricator::Vcs]
Systemd::Unit[backup-home-dirs.timer]
Systemd::Unit[phabricator_stats_job_community_metrics.service]
Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.timer (phabricator_stats_job_quarterly_wmf_qls.timer)]
File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.service]
File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.service]
File[/var/log/phabricator_stats_job_quarterly_metrics]
Rsyslog::Conf[phabricator_stats_job_quarterly_metrics]
File[/etc/nftables/input/10_ssh_cluster.nft]
Systemd::Service[phabricator_stats_job_quarterly_wmf_qls]
Systemd::Unit[phabricator_stats_job_project_changes.timer]
File[/etc/logrotate.d/phabricator_stats_job_quarterly_metrics]
File[/srv/phab/phabricator/scripts/mail/]
File[/srv/phab/phabricator/scripts/]
File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem]
Group[phabricator-bulk-manager]
File[/srv/phab/aphlict/config.json]
Systemd::Timer::Job[rsync-phabricator-home-dirs]
Class[Bacula::Client]
Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh on intermediate ca change]
Exec[mask_phd.service]
Prometheus::Apache_exporter[default]
Systemd::Timer[phabricator_stats_job_project_changes]
Sudo::User[www-data]
File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server-key.pem]
Concat::Fragment[/etc/rsyncd.conf-header]
File[/etc/apache2/sites-available/50-phabricator.conf]
Service[wmf_auto_restart_aphlict.timer]
File[/etc/envoy/runtime.yaml]
File[/etc/rsyslog.d/40-phabricator-stats-job-tech-news-weekly-stats.conf]
File[/etc/rsyslog.d/40-phabricator-stats-job-community-metrics.conf]
File[/usr/local/bin/phab_epipe.py]
Exec[systemd daemon-reload for phabricator_stats_job_project_changes.service (phabricator_stats_job_project_changes.service)]
Service[phabricator_stats_job_tech_news_weekly_stats.timer]
Class[Rsync::Server]
Class[Profile::Backup::Host]
Exec[/srv/phab/libext/translations/src_static_dir_exists]
File[/usr/local/bin/project_changes.sh]
Httpd::Site[phabricator]
File[/etc/logrotate.d/wmf_auto_restart_aphlict]
File[/var/log/phabricator_stats_job_tech_news_weekly_stats]
File[/etc/rsyslog.d/40-rsync-phabricator-home-dirs.conf]
Envoyproxy::Tls_terminator[443]
Mailalias[root]
Nftables::Service[envoy_tls_termination_src_sets]
Exec[systemd daemon-reload for wmf_auto_restart_aphlict.timer (wmf_auto_restart_aphlict.timer)]
Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.service]
File[/etc/ssh/userkeys/urbanecm]
File[/lib/systemd/system/phabricator_stats_job_project_changes.service]
Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.service (phabricator_stats_job_community_metrics.service)]
Envoyproxy::Listener[tls_terminator_443]
Sudo::Group[phabricator-bulk-manager]
File[/etc/envoy/listeners.d]
Systemd::Service[phabricator_stats_job_quarterly_metrics]
File[/usr/local/bin/phab_git_safedir.sh]
File[/etc/gitconfig.d]
File[/lib/systemd/system/aphlict.service]
File[/etc/rsyslog.d/10-input-file-apache2-access.conf]
Service[wmf_auto_restart_envoyproxy.timer]
Phabricator::Logmail[quarterly_wmf_qls]
Envoyproxy::Conf[tls_terminator_443]
Rsyslog::Conf[input-file-apache2-error]
Package[envoyproxy]
Concat_fragment[/etc/rsyncd.conf-header]
Profile::Auto_restarts::Service[prometheus-apache-exporter]
Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.service]
File[/lib/systemd/system/phabricator_clean_tmp_files.timer]
File[/etc/sudoers.d/www-data]
Package[s-nail]
File[/etc/logrotate.d/aphlict]
File[/etc/bacula/ssl/server-keypair.pem]
Service[phd]
File[/etc/envoy/ssl]
File[/etc/rsyslog.d/00-imfile.conf]
Prometheus::Blackbox::Check::Tcp[phabricator-smtp]
Service[exim4]
File[/home/gjg/.my.cnf]
Service[phabricator_stats_job_yearly_metrics.timer]
Systemd::Timer[phabricator_stats_job_quarterly_metrics]
Cfssl::Cert[discovery2026__phabricator_discovery_wmnet_server]
File[/etc/exim4/exim4.conf]
Class[Profile::Phabricator::Performance]
Backup::Set[home]
File[/etc/rsyslog.d/40-phabricator-task-dump.conf]
Admin::Hashuser[urbanecm]
Package[subversion]
File[/home/mbinder]
File[/etc/envoy/clusters.d]
Systemd::Unit[phd]
Ferm::Service[rsyncd_access_srv_dumps]
File[/var/spool/exim4/scan]
Systemd::Syslog[phabricator_stats_job_quarterly_wmf_qls]
Rsyslog::Conf[phabricator_stats_job_yearly_metrics]
Class[Phabricator::Phd]
Exec[/srv/phab/libext/misc_static_dir_exists]
Systemd::Syslog[phabricator_stats_job_yearly_metrics]
Sslcert::X509_to_pkcs12[puppet::expose_agent_cert: /etc/bacula]
Systemd::Timer::Job[backup-home-dirs]
Logrotate::Conf[wmf_auto_restart_envoyproxy]
File[/etc/envoy/clusters.d/00-cluster_local_port_80.yaml]
Concat_fragment[/etc/rsyncd.conf-srv-dumps]
Class[Profile::Phabricator::Logmail]
Sudo::User[vcs]
File[/var/log/phabricator_clean_tmp_files]
File[/var/log/envoy]
Exec[systemd daemon-reload for rsync-phabricator-repos.service (rsync-phabricator-repos.service)]
File[/etc/envoy]
Systemd::Service[phabricator_stats_job_community_metrics]
Systemd::Service[envoyproxy.service]
Package[nodejs]
Class[Phabricator::Tools]
File[/etc/ssh/userkeys/gjg]
File[/lib/systemd/system/phd.service]
Class[Passwords::Mysql::Phabricator]
Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.timer (wmf_auto_restart_envoyproxy.timer)]
Admin::Hashuser[gjg]
File[/lib/systemd/system/rsync-phabricator-repos.service]

Resources only in the old catalog

File[/var/lib/scap/scap]
Class[Passwords::Mysql::Phorge_testdb]
Motd::Message[phabricator::migration]
Class[Role::Phabricator::Migration]
File[/etc/update-motd.d/05-phabricator--migration]
Motd::Script[phabricator::migration]
File[/var/lib/scap/scap/bin]
Class[Profile::Phabricator::Migration]

Resources modified

Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.timer (phabricator_stats_job_community_metrics.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.timer (phabricator_stats_job_community_metrics.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.timer (phabricator_stats_job_community_metrics.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Concat::Fragment[/etc/bacula_puppet_agent_cert]

Parameters differences:

--- Concat::Fragment[/etc/bacula_puppet_agent_cert].orig
+++ Concat::Fragment[/etc/bacula_puppet_agent_cert]

+    source => /var/lib/puppet/ssl/certs/phab2003.codfw.wmnet.pem
+    target => /etc/bacula/ssl/cert.pem
+    order  => 01

Firewall::Service[ssh_cluster]

Parameters differences:

--- Firewall::Service[ssh_cluster].orig
+++ Firewall::Service[ssh_cluster]

+    ensure              => present
+    port                => 22
+    proto               => tcp
+    prio                => 10
+    srange              => ['phab1004.eqiad.wmnet', 'phab2002.codfw.wmnet']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

File[/etc/logrotate.d/phabricator_clean_tmp_files]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_clean_tmp_files].orig
+++ File[/etc/logrotate.d/phabricator_clean_tmp_files]

+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_clean_tmp_files.orig
+++ /etc/logrotate.d/phabricator_clean_tmp_files
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_clean_tmp_files
+
+/var/log/phabricator_clean_tmp_files/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Systemd::Syslog[phabricator_clean_tmp_files]

Parameters differences:

--- Systemd::Syslog[phabricator_clean_tmp_files].orig
+++ Systemd::Syslog[phabricator_clean_tmp_files]

+    readable_by            => all
+    ensure                 => present
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Admin::Groupmembers[phabricator-bulk-manager]

Parameters differences:

--- Admin::Groupmembers[phabricator-bulk-manager].orig
+++ Admin::Groupmembers[phabricator-bulk-manager]

+    before         => Exec[enforce-users-groups-cleanup]
+    default_member => root

Systemd::Unit[rsync-phabricator-repos.service]

Parameters differences:

--- Systemd::Unit[rsync-phabricator-repos.service].orig
+++ Systemd::Unit[rsync-phabricator-repos.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => rsync-phabricator-repos.service
+    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for backup-home-dirs.timer (backup-home-dirs.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for backup-home-dirs.timer (backup-home-dirs.timer)].orig
+++ Exec[systemd daemon-reload for backup-home-dirs.timer (backup-home-dirs.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_prometheus-apache-exporter].orig
+++ Systemd::Timer::Job[wmf_auto_restart_prometheus-apache-exporter]

+    monitoring_contact_groups => admins
+    ensure                    => present
+    private_tmp               => False
+    description               => Auto restart job: prometheus-apache-exporter
+    command                   => /usr/local/sbin/wmf-auto-restart -s prometheus-apache-exporter
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 13:4:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    require                   => File[/usr/local/sbin/wmf-auto-restart]
+    logfile_basedir           => /var/log

Exec[phabricator-bulk-manager_ensure_members]

Parameters differences:

--- Exec[phabricator-bulk-manager_ensure_members].orig
+++ Exec[phabricator-bulk-manager_ensure_members]

+    logoutput => True
+    command   => /usr/bin/gpasswd phabricator-bulk-manager -M mbinder
+    path      => /usr/bin:/bin
+    require   => ['User[mbinder]']
+    unless    => getent group phabricator-bulk-manager | xargs test -z || getent group phabricator-bulk-manager | cut -d ':' -f 4 | grep -E ^mbinder$

Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.timer (wmf_auto_restart_prometheus-apache-exporter.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.timer (wmf_auto_restart_prometheus-apache-exporter.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.timer (wmf_auto_restart_prometheus-apache-exporter.timer)]

+    before      => ['Service[wmf_auto_restart_prometheus-apache-exporter.timer]']
+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/usr/libexec/phabricator-ssh-hook.sh]

Parameters differences:

--- File[/usr/libexec/phabricator-ssh-hook.sh].orig
+++ File[/usr/libexec/phabricator-ssh-hook.sh]

+    mode    => 0755
+    require => File[/usr/libexec]
+    owner   => root
+    group   => root

Content differences:

--- /usr/libexec/phabricator-ssh-hook.sh.orig
+++ /usr/libexec/phabricator-ssh-hook.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# This is the name users should connect with
+VCSUSER=vcs
+ROOT="/srv/phab/phabricator"
+
+if [ "$1" != "$VCSUSER" ];
+then
+  exit 1
+fi
+
+exec "$ROOT/bin/ssh-auth" $@

Concat[/etc/bacula/ssl/cert.pem]

Parameters differences:

--- Concat[/etc/bacula/ssl/cert.pem].orig
+++ Concat[/etc/bacula/ssl/cert.pem]

+    warn           => False
+    ensure         => present
+    show_diff      => True
+    replace        => True
+    ensure_newline => False
+    force          => False
+    format         => plain
+    mode           => 0644
+    path           => /etc/bacula/ssl/cert.pem
+    order          => alpha
+    backup         => puppet

File[/lib/systemd/system/rsync-phabricator-home-dirs.timer]

Parameters differences:

--- File[/lib/systemd/system/rsync-phabricator-home-dirs.timer].orig
+++ File[/lib/systemd/system/rsync-phabricator-home-dirs.timer]

+    notify => Exec[systemd daemon-reload for rsync-phabricator-home-dirs.timer (rsync-phabricator-home-dirs.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/rsync-phabricator-home-dirs.timer.orig
+++ /lib/systemd/system/rsync-phabricator-home-dirs.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of rsync-phabricator-home-dirs.service
+
+[Timer]
+Unit=rsync-phabricator-home-dirs.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-*-* *:00/10:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.service (wmf_auto_restart_prometheus-apache-exporter.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.service (wmf_auto_restart_prometheus-apache-exporter.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.service (wmf_auto_restart_prometheus-apache-exporter.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Rsyslog::Conf[phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- Rsyslog::Conf[phabricator_stats_job_quarterly_wmf_qls].orig
+++ Rsyslog::Conf[phabricator_stats_job_quarterly_wmf_qls]

+    mode     => 0444
+    require  => File[/var/log/phabricator_stats_job_quarterly_wmf_qls]
+    priority => 40
+    ensure   => absent

File[/etc/rsyslog.d/40-phabricator-stats-job-yearly-metrics.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-stats-job-yearly-metrics.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-stats-job-yearly-metrics.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-stats-job-yearly-metrics.conf.orig
+++ /etc/rsyslog.d/40-phabricator-stats-job-yearly-metrics.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_stats_job_yearly_metrics" then {
+    action(
+        type="omfile" file="/var/log/phabricator_stats_job_yearly_metrics/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Nftables::Service[rsyncd_access_srv-dumps]

Parameters differences:

--- Nftables::Service[rsyncd_access_srv-dumps].orig
+++ Nftables::Service[rsyncd_access_srv-dumps]

+    ensure              => present
+    port                => [873, 1873]
+    proto               => tcp
+    prio                => 10
+    notrack             => False
+    src_ips             => ['10.192.27.6', '10.64.16.101', '208.80.154.142', '208.80.154.71', '2620:0:860:114:10:192:27:6', '2620:0:861:102:10:64:16:101', '2620:0:861:2:208:80:154:142', '2620:0:861:3:208:80:154:71']
+    unrestricted_access => False
+    desc                =>

File[/usr/local/bin/quarterly_wmf_qls.sh]

Parameters differences:

--- File[/usr/local/bin/quarterly_wmf_qls.sh].orig
+++ File[/usr/local/bin/quarterly_wmf_qls.sh]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /usr/local/bin/quarterly_wmf_qls.sh.orig
+++ /usr/local/bin/quarterly_wmf_qls.sh
@@ -0,0 +1,162 @@
+#!/bin/bash
+# Quarterly statistics of Phabricator for internal WMF QLS
+# per T362804 - aklapper 20240425
+# SPDX-License-Identifier: Apache-2.0
+# ! this file is managed by puppet !
+# ./modules/phabricator/files/quarterly_wmf_qls.sh
+source /etc/phab_quarterly_wmf_qls.conf
+
+lastquarterint=$(expr $(expr $(date -d '-1 month' +%m) - 1) / 3 + 1)
+
+if (( $lastquarterint % 4 == 1 ))
+then lastquarterintfy=3
+elif (( $lastquarterint % 4 == 2 ))
+then lastquarterintfy=4
+elif (( $lastquarterint % 4 == 3 ))
+then lastquarterintfy=1
+elif (( $lastquarterint % 4 == 0 ))
+then lastquarterintfy=2
+fi
+
+lastquarterstr=$(date +"Q$lastquarterint/%Y (Q$lastquarterintfy in FY)")
+
+#echo "result_tasks"
+result_tasks=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -t -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+SELECT DISTINCT t.phid AS phid, autr.userName AS author, t.status AS status, ownr.userName AS owner, FROM_UNIXTIME(t.closedEpoch, '%Y-%m-%d') AS closedDate, clsr.userName AS closer, t.priority AS priority, t.subtype AS subtype, CONCAT("https://phabricator.wikimedia.org/T", t.id) AS url, t.title AS taskTitle, FROM_UNIXTIME(t.dateCreated, '%Y-%m-%d') AS createdDate, ROUND((t.closedEpoch - t.dateCreated) / 86400) AS daysBetween
+    FROM phabricator_maniphest.maniphest_task t
+    INNER JOIN phabricator_user.user autr ON autr.phid = t.authorPHID
+    INNER JOIN phabricator_user.user ownr ON ownr.phid = t.ownerPHID
+    INNER JOIN phabricator_user.user clsr ON clsr.phid = t.closerPHID
+    WHERE t.status = "resolved"
+    AND FROM_UNIXTIME(t.closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 3 MONTH,'%Y%m')
+    AND autr.phid NOT IN
+        (SELECT ua.userPHID
+         FROM phabricator_user.user u
+         INNER JOIN phabricator_user.user_externalaccount ua
+         ON ua.userPHID = u.phid
+         WHERE ua.accountType = "mediawiki"
+         AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF')
+         OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+    AND autr.phid NOT IN
+        (SELECT ue.userPHID
+         FROM phabricator_user.user u
+         INNER JOIN phabricator_user.user_email ue
+         ON ue.userPHID = u.phid
+         WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com'))
+    AND (ownr.phid IN
+            (SELECT ua.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_externalaccount ua ON ua.userPHID = u.phid WHERE ua.accountType = "mediawiki" AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF') OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+         OR ownr.phid IN
+            (SELECT ue.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_email ue ON ue.userPHID = u.phid WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com')));
+END
+)
+
+#echo "result_projects"
+result_projects=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -t -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+SELECT t.id AS taskId, t.phid AS phid, p.name AS projectTag
+    FROM phabricator_maniphest.maniphest_task t
+    INNER JOIN phabricator_maniphest.edge e ON t.phid = e.src
+    INNER JOIN phabricator_project.project p ON e.dst = p.phid
+    WHERE e.type = 41
+    AND t.phid IN
+        (SELECT DISTINCT t.phid
+         FROM phabricator_maniphest.maniphest_task t
+         INNER JOIN phabricator_user.user autr ON autr.phid = t.authorPHID
+         INNER JOIN phabricator_user.user ownr ON ownr.phid = t.ownerPHID
+         WHERE t.status = "resolved"
+         AND FROM_UNIXTIME(t.closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 3 MONTH,'%Y%m')
+         AND autr.phid NOT IN
+             (SELECT ua.userPHID
+              FROM phabricator_user.user u
+              INNER JOIN phabricator_user.user_externalaccount ua
+              ON ua.userPHID = u.phid
+              WHERE ua.accountType = "mediawiki"
+              AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF')
+              OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+         AND autr.phid NOT IN
+             (SELECT ue.userPHID
+              FROM phabricator_user.user u
+              INNER JOIN phabricator_user.user_email ue
+              ON ue.userPHID = u.phid
+              WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com'))
+         AND (ownr.phid IN
+                 (SELECT ua.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_externalaccount ua ON ua.userPHID = u.phid WHERE ua.accountType = "mediawiki" AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF') OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+              OR ownr.phid IN
+                 (SELECT ue.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_email ue ON ue.userPHID = u.phid WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com')))) 
+    ORDER BY t.id;
+END
+)
+
+#echo "result_subscribers"
+result_subscribers=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -t -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+SELECT t.id AS taskId, t.phid AS phid, u.userName AS subscriber
+    FROM phabricator_maniphest.maniphest_task t
+    INNER JOIN phabricator_maniphest.edge e ON t.phid = e.src
+    INNER JOIN phabricator_user.user u ON e.dst = u.phid
+    WHERE e.type = 21 
+    AND t.phid IN
+        (SELECT DISTINCT t.phid
+         FROM phabricator_maniphest.maniphest_task t
+         INNER JOIN phabricator_user.user autr ON autr.phid = t.authorPHID
+         INNER JOIN phabricator_user.user ownr ON ownr.phid = t.ownerPHID
+         WHERE t.status = "resolved"
+         AND FROM_UNIXTIME(t.closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 3 MONTH,'%Y%m')
+         AND autr.phid NOT IN
+             (SELECT ua.userPHID
+              FROM phabricator_user.user u
+              INNER JOIN phabricator_user.user_externalaccount ua
+              ON ua.userPHID = u.phid
+              WHERE ua.accountType = "mediawiki"
+              AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF')
+              OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+         AND autr.phid NOT IN
+             (SELECT ue.userPHID
+              FROM phabricator_user.user u
+              INNER JOIN phabricator_user.user_email ue
+              ON ue.userPHID = u.phid
+              WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com'))
+         AND (ownr.phid IN
+                 (SELECT ua.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_externalaccount ua ON ua.userPHID = u.phid WHERE ua.accountType = "mediawiki" AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF') OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+              OR ownr.phid IN
+                 (SELECT ue.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_email ue ON ue.userPHID = u.phid WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com')))) 
+    AND u.isDisabled != 1 
+    ORDER BY t.id;
+END
+)
+
+# the actual email
+cat <<EOF | /usr/bin/mail -r "${sndr_address}" -s "Phabricator data for WMF QLS - ${lastquarterstr}" ${rcpt_address}
+This is the automatic quarterly Phabricator mail for WMF QLS.
+
+It is supposed to list Phabricator tasks reported by folks who are
+not with WMF, WMDE, or contractors, and resolved in the last quarter
+by folks who are with WMF, WMDE, or contractors.
+
+WARNING: Results and numbers of tasks below are incorrect as staff
+and contractors can use non-staff accounts and non-staff / personal
+email addresses for their staff activity. There is no way to
+reliably identify staff or contractors due to lack of WMF policies.
+
+
+=== TASKS ===
+
+Meaning of priority values:
+100=Unbreak Now!, 90=Needs Triage, 80=High, 50=Medium, 25=Low, 10=Lowest.
+
+${result_tasks}
+
+
+=== PROJECT TAGS ===
+
+${result_projects}
+
+
+=== NON-DISABLED SUBSCRIBERS ===
+
+${result_subscribers}
+
+
+Yours sincerely,
+Fab Rick Aytor
+(via $(basename $0) on $(hostname) at $(date); see T362804, T370947)
+EOF
+

Phabricator::Logmail[yearly_metrics]

Parameters differences:

--- Phabricator::Logmail[yearly_metrics].orig
+++ Phabricator::Logmail[yearly_metrics]

+    ensure           => absent
+    rcpt_address     => ['aklapper@wikimedia.org', 'releng@lists.wikimedia.org']
+    monthday         => 1
+    month            => 1
+    mysql_slave      => m3-slave.codfw.wmnet
+    mysql_slave_port => 3323
+    minute           => 0
+    basedir          => /usr/local/bin
+    sndr_address     => aklapper@wikimedia.org
+    mysql_db_name    => phabricator_maniphest
+    require          => Package[phabricator/deployment]
+    hour             => 0

File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.timer]

+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.timer (wmf_auto_restart_prometheus-apache-exporter.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of wmf_auto_restart_prometheus-apache-exporter.service
+
+[Timer]
+Unit=wmf_auto_restart_prometheus-apache-exporter.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 13:4:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Admin::Groupmembers[phabricator-admin]

Parameters differences:

--- Admin::Groupmembers[phabricator-admin].orig
+++ Admin::Groupmembers[phabricator-admin]

+    before         => Exec[enforce-users-groups-cleanup]
+    default_member => root

File[/etc/sudoers.d/phabricator-admin]

Parameters differences:

--- File[/etc/sudoers.d/phabricator-admin].orig
+++ File[/etc/sudoers.d/phabricator-admin]

+    mode         => 0440
+    owner        => root
+    ensure       => present
+    validate_cmd => /usr/sbin/visudo -cqf %
+    group        => root

Content differences:

--- /etc/sudoers.d/phabricator-admin.orig
+++ /etc/sudoers.d/phabricator-admin
@@ -0,0 +1,11 @@
+# This file is managed by Puppet!
+
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/cache purge --caches user
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/herald
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/remove
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/repository
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/phd
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/policy
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/worker
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/bulk make-silent --id *
+%phabricator-admin ALL = NOPASSWD: /srv/phab/phabricator/bin/auth strip --all-types --user *

File[/etc/logrotate.d/wmf_auto_restart_envoyproxy]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_envoyproxy].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_envoyproxy]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_envoyproxy.orig
+++ /etc/logrotate.d/wmf_auto_restart_envoyproxy
@@ -0,0 +1,12 @@
+# logrotate(8) config for wmf_auto_restart_envoyproxy
+
+/var/log/wmf_auto_restart_envoyproxy/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

File[/etc/sudoers.d/vcs]

Parameters differences:

--- File[/etc/sudoers.d/vcs].orig
+++ File[/etc/sudoers.d/vcs]

+    mode         => 0440
+    owner        => root
+    ensure       => present
+    validate_cmd => /usr/sbin/visudo -cqf %
+    group        => root

Content differences:

--- /etc/sudoers.d/vcs.orig
+++ /etc/sudoers.d/vcs
@@ -0,0 +1,3 @@
+# This file is managed by Puppet!
+
+vcs ALL=(phd) SETENV: NOPASSWD: /usr/bin/git-upload-pack, /usr/bin/git-receive-pack, /usr/bin/svnserve

Envoyproxy::Conf[cluster_local_port_80]

Parameters differences:

--- Envoyproxy::Conf[cluster_local_port_80].orig
+++ Envoyproxy::Conf[cluster_local_port_80]

+    priority  => 0
+    conf_type => cluster

Group[aphlict]

Parameters differences:

--- Group[aphlict].orig
+++ Group[aphlict]

+    system => True
+    ensure => present

Motd::Script[phabricator]

Parameters differences:

--- Motd::Script[phabricator].orig
+++ Motd::Script[phabricator]

+    priority => 5
+    ensure   => present

Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.service (phabricator_stats_job_quarterly_metrics.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.service (phabricator_stats_job_quarterly_metrics.service)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.service (phabricator_stats_job_quarterly_metrics.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Concat_file[/etc/rsyncd.conf]

Parameters differences:

--- Concat_file[/etc/rsyncd.conf].orig
+++ Concat_file[/etc/rsyncd.conf]

+    show_diff      => True
+    replace        => True
+    ensure_newline => False
+    force          => False
+    format         => plain
+    mode           => 0444
+    tag            => _etc_rsyncd.conf
+    owner          => root
+    order          => alpha
+    backup         => puppet
+    group          => root

Systemd::Syslog[rsync-phabricator-home-dirs]

Parameters differences:

--- Systemd::Syslog[rsync-phabricator-home-dirs].orig
+++ Systemd::Syslog[rsync-phabricator-home-dirs]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

File[/usr/libexec]

Parameters differences:

--- File[/usr/libexec].orig
+++ File[/usr/libexec]

+    mode   => 0755
+    owner  => root
+    ensure => directory
+    group  => root

File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.service].orig
+++ File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.service]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.service (phabricator_stats_job_quarterly_metrics.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_quarterly_metrics.service.orig
+++ /lib/systemd/system/phabricator_stats_job_quarterly_metrics.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator statistics mail - quarterly_metrics
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/quarterly_metrics.sh

Systemd::Service[wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_prometheus-apache-exporter].orig
+++ Systemd::Service[wmf_auto_restart_prometheus-apache-exporter]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => present
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.service]
+    monitoring_contact_group => admins

Package[exim4-daemon-heavy]

Parameters differences:

--- Package[exim4-daemon-heavy].orig
+++ Package[exim4-daemon-heavy]

+    provider => apt
+    ensure   => installed

File[/var/log/phd/ssh.log]

Parameters differences:

--- File[/var/log/phd/ssh.log].orig
+++ File[/var/log/phd/ssh.log]

+    mode    => 0640
+    owner   => vcs
+    ensure  => present
+    require => File[/var/log/phd]
+    group   => root

File[/etc/logrotate.d/rsync-phabricator-home-dirs]

Parameters differences:

--- File[/etc/logrotate.d/rsync-phabricator-home-dirs].orig
+++ File[/etc/logrotate.d/rsync-phabricator-home-dirs]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/rsync-phabricator-home-dirs.orig
+++ /etc/logrotate.d/rsync-phabricator-home-dirs
@@ -0,0 +1,12 @@
+# logrotate(8) config for rsync-phabricator-home-dirs
+
+/var/log/rsync-phabricator-home-dirs/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

File[/usr/local/bin/yearly_metrics.sh]

Parameters differences:

--- File[/usr/local/bin/yearly_metrics.sh].orig
+++ File[/usr/local/bin/yearly_metrics.sh]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /usr/local/bin/yearly_metrics.sh.orig
+++ /usr/local/bin/yearly_metrics.sh
@@ -0,0 +1,130 @@
+#!/bin/bash
+# Basic yearly statistics of Phabricator used for
+# early January email to wikitech-l mailing list
+# per T337388 - aklapper 20230523
+# SPDX-License-Identifier: Apache-2.0
+# ! this file is managed by puppet !
+# ./modules/phabricator/files/yearly_metrics.sh
+
+source /etc/phab_yearly_metrics.conf
+
+#echo "result_tasks_created"
+result_tasks_created=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(dateCreated) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 12 MONTH,'%Y%m');
+END
+)
+
+#echo "result_tasks_closed"
+result_tasks_closed=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(closedEpoch) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 12 MONTH,'%Y%m');
+END
+)
+
+#echo "result_active_users"
+result_active_users=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(DISTINCT (authorPHID)) FROM phabricator_maniphest.maniphest_transaction WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 12 MONTH,'%Y%m');
+END
+)
+
+#echo "result_tasks_authors"
+result_tasks_authors=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(DISTINCT (authorPHID)) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 12 MONTH,'%Y%m');
+END
+)
+
+#echo "result_tasks_closers"
+result_tasks_closers=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(DISTINCT (closerPHID)) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 12 MONTH,'%Y%m');
+END
+)
+
+#echo "result_tasks_authors_top20"
+result_tasks_authors_top20=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+SELECT usr.username AS user, COUNT(usr.username) AS created
+    FROM phabricator_user.user usr JOIN phabricator_maniphest.maniphest_task tsk
+    WHERE tsk.authorPHID = usr.phid
+    AND FROM_UNIXTIME(tsk.closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 12 MONTH,'%Y%m')
+    GROUP BY usr.username ORDER BY created DESC LIMIT 20;
+END
+)
+
+#echo "result_tasks_closers_top20"
+result_tasks_closers_top20=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+SELECT usr.username AS user, COUNT(usr.username) AS closed
+    FROM phabricator_user.user usr JOIN phabricator_maniphest.maniphest_task tsk 
+    WHERE tsk.closerPHID = usr.phid
+    AND FROM_UNIXTIME(tsk.closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 12 MONTH,'%Y%m')
+    GROUP BY usr.username ORDER BY closed DESC LIMIT 20;
+END
+)
+
+taskscreated=$(echo $result_tasks_created | sed 's/[^0-9]*//g')
+tasksclosed=$(echo $result_tasks_closed | sed 's/[^0-9]*//g')
+activeusers=$(echo $result_active_users | sed 's/[^0-9]*//g')
+tasksauthors=$(echo $result_tasks_authors | cut -d " " -f3)
+tasksclosers=$(echo $result_tasks_closers | cut -d " " -f3)
+
+year=$(date --date='1 year ago' +%Y)
+
+# the actual email
+cat <<EOF | /usr/bin/mail -r "${sndr_address}" -s "DRAFT: Some Phabricator and Gerrit ${year} statistics" -a "Auto-Submitted: auto-generated" ${rcpt_address}
+
+THIS IS AN EMAIL TEMPLATE. THIS REQUIRES ADDITIONAL
+MANUAL WORK FOR GERRIT BEFORE SENDING TO WIKITECH-L.
+
+Hi everyone,
+
+Sharing some Phabricator and Gerrit statistics from the past Gregorian calendar year ${year}. 
+Big thanks to all Wikimedia technical contributors!
+
+=== Phabricator ${year} ===
+
+* ${taskscreated} tasks got created.
+* ${tasksclosed} tasks got closed.
+* ${activeusers} accounts were active in Phabricator.
+* ${tasksauthors} accounts created tasks.
+* ${tasksclosers} accounts closed tasks.
+* The 20 accounts who created the most tasks:
+${result_tasks_authors_top20}
+* The 20 accounts who closed the most tasks:
+${result_tasks_closers_top20}
+
+=== Gerrit ${year} ===
+
+* TODO changesets got created. [1]
+* TODO code reviews took place. [2]
+* TODO accounts created patches. [3]
+* The 20 accounts who submitted the most changesets: [4]
+TODO
+* The 20 accounts who reviewed the most patchsets: [5]
+TODO
+
+If you find a bug in these numbers, please see
+https://www.mediawiki.org/wiki/Community_metrics
+
+Cheers!
+
+[1] See "Gerrit ð¡ Changesets" on "Gerrit ð¡ Overview" on 
+https://development-metrics.wmcloud.org/ after setting the time
+[2] See "Total Changesets and Approvals ð¡ Approvals" on "Gerrit ð¡
+Approvals" on https://development-metrics.wmcloud.org/ after setting
+the time span
+[3] See "Gerrit ð¡ Changeset Submitters" on "Gerrit ð¡ Overview" on
+https://development-metrics.wmcloud.org/ after setting the time span
+[4] See "Submitters" on "Gerrit ð¡ Overview" on
+https://development-metrics.wmcloud.org/ after setting the time span
+[5] See "Approvals by Reviewer" on "Gerrit ð¡ Approvals" on
+https://development-metrics.wmcloud.org/ after setting the time span
+
+(via $(basename $0) on $(hostname) at $(date))
+EOF

File[/etc/logrotate.d/phabricator_stats_job_project_changes]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_stats_job_project_changes].orig
+++ File[/etc/logrotate.d/phabricator_stats_job_project_changes]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_stats_job_project_changes.orig
+++ /etc/logrotate.d/phabricator_stats_job_project_changes
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_stats_job_project_changes
+
+/var/log/phabricator_stats_job_project_changes/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Logrotate::Conf[wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_prometheus-apache-exporter].orig
+++ Logrotate::Conf[wmf_auto_restart_prometheus-apache-exporter]

+    ensure => present

Logrotate::Conf[phabricator_clean_tmp_files]

Parameters differences:

--- Logrotate::Conf[phabricator_clean_tmp_files].orig
+++ Logrotate::Conf[phabricator_clean_tmp_files]

+    ensure => present

File[/etc/gitconfig.d/00-header.gitconfig]

Parameters differences:

--- File[/etc/gitconfig.d/00-header.gitconfig].orig
+++ File[/etc/gitconfig.d/00-header.gitconfig]

+    notify => Exec[update-gitconfig]
+    mode   => 0444
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/gitconfig.d/00-header.gitconfig.orig
+++ /etc/gitconfig.d/00-header.gitconfig
@@ -0,0 +1,2 @@
+# vim: set ts=4 sw=4 et:
+# This file is managed by Puppet

File[/etc/logrotate.d/phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_stats_job_tech_news_weekly_stats].orig
+++ File[/etc/logrotate.d/phabricator_stats_job_tech_news_weekly_stats]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_stats_job_tech_news_weekly_stats.orig
+++ /etc/logrotate.d/phabricator_stats_job_tech_news_weekly_stats
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_stats_job_tech_news_weekly_stats
+
+/var/log/phabricator_stats_job_tech_news_weekly_stats/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Firewall::Service[rsyncd_access_srv-dumps]

Parameters differences:

--- Firewall::Service[rsyncd_access_srv-dumps].orig
+++ Firewall::Service[rsyncd_access_srv-dumps]

+    ensure              => present
+    port                => [873, 1873]
+    proto               => tcp
+    prio                => 10
+    srange              => ['phab1004.eqiad.wmnet', 'phab2002.codfw.wmnet', 'clouddumps1001.wikimedia.org', 'clouddumps1002.wikimedia.org']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

File[/usr/local/bin/chk_phuser]

Parameters differences:

--- File[/usr/local/bin/chk_phuser].orig
+++ File[/usr/local/bin/chk_phuser]

+    mode   => 0550
+    source => puppet:///modules/phabricator/chk_phuser.sh
+    owner  => root
+    group  => root

Systemd::Timer::Job[phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- Systemd::Timer::Job[phabricator_stats_job_quarterly_metrics].orig
+++ Systemd::Timer::Job[phabricator_stats_job_quarterly_metrics]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => phabricator statistics mail - quarterly_metrics
+    command                   => /usr/local/bin/quarterly_metrics.sh
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-01,04,07,10-1 0:0:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

Phabricator::Logmail[tech_news_weekly_stats]

Parameters differences:

--- Phabricator::Logmail[tech_news_weekly_stats].orig
+++ Phabricator::Logmail[tech_news_weekly_stats]

+    ensure           => absent
+    weekday          => Thursday
+    rcpt_address     => ['nwilson@wikimedia.org', 'jjonsson@wikimedia.org', 'bevellin@wikimedia.org', 'uzoma@wikimedia.org', 'stei@wikimedia.org']
+    mysql_slave_port => 3323
+    mysql_slave      => m3-slave.codfw.wmnet
+    minute           => 0
+    basedir          => /usr/local/bin
+    sndr_address     => aklapper@wikimedia.org
+    mysql_db_name    => phabricator_maniphest
+    require          => Package[phabricator/deployment]
+    hour             => 12

Class[Admin]

Parameters differences:

--- Class[Admin].orig
+++ Class[Admin]

@@
-    groups => ['phabricator-roots']
+    groups => ['phabricator-admin', 'phabricator-roots', 'phabricator-bulk-manager']

Firewall::Service[phabmain-smtp]

Parameters differences:

--- Firewall::Service[phabmain-smtp].orig
+++ Firewall::Service[phabmain-smtp]

+    ensure              => absent
+    port                => 25
+    proto               => tcp
+    prio                => 10
+    srange              => ['mx-in1001.wikimedia.org', 'mx-in2001.wikimedia.org']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Systemd::Timer[phabricator_clean_tmp_files]

Parameters differences:

--- Systemd::Timer[phabricator_clean_tmp_files].orig
+++ Systemd::Timer[phabricator_clean_tmp_files]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* 07:00:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => present
+    unit_name          => phabricator_clean_tmp_files.service
+    splay              => 0

Systemd::Unit[phabricator_task_dump.timer]

Parameters differences:

--- Systemd::Unit[phabricator_task_dump.timer].orig
+++ Systemd::Unit[phabricator_task_dump.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_task_dump.timer
+    require           => ['Class[Systemd]']

Systemd::Sysuser[vcs]

Parameters differences:

--- Systemd::Sysuser[vcs].orig
+++ Systemd::Sysuser[vcs]

+    id                => 497:497
+    ensure            => present
+    shell             => /bin/sh
+    username          => vcs
+    usertype          => user
+    description       => Phabricator vcs user
+    home_dir          => /var/lib/vcs
+    allow_login       => True
+    additional_groups => ['vcs', 'phd']

File[/etc/rsyslog.d/40-phabricator-stats-job-project-changes.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-stats-job-project-changes.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-stats-job-project-changes.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-stats-job-project-changes.conf.orig
+++ /etc/rsyslog.d/40-phabricator-stats-job-project-changes.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_stats_job_project_changes" then {
+    action(
+        type="omfile" file="/var/log/phabricator_stats_job_project_changes/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

File[/etc/nftables/input/10_envoy_tls_termination_src_sets.nft]

Parameters differences:

--- File[/etc/nftables/input/10_envoy_tls_termination_src_sets.nft].orig
+++ File[/etc/nftables/input/10_envoy_tls_termination_src_sets.nft]

+    notify  => ['Service[nftables]']
+    mode    => 0444
+    tag     => nft
+    owner   => root
+    ensure  => present
+    require => ['Nftables::Set[CACHES]']
+    group   => root

Content differences:

--- /etc/nftables/input/10_envoy_tls_termination_src_sets.nft.orig
+++ /etc/nftables/input/10_envoy_tls_termination_src_sets.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr @CACHES_ipv4 tcp dport { 443 } accept
+ip6 saddr @CACHES_ipv6 tcp dport { 443 } accept

Systemd::Syslog[phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- Systemd::Syslog[phabricator_stats_job_quarterly_metrics].orig
+++ Systemd::Syslog[phabricator_stats_job_quarterly_metrics]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

File[/etc/logrotate.d/backup-home-dirs]

Parameters differences:

--- File[/etc/logrotate.d/backup-home-dirs].orig
+++ File[/etc/logrotate.d/backup-home-dirs]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/backup-home-dirs.orig
+++ /etc/logrotate.d/backup-home-dirs
@@ -0,0 +1,12 @@
+# logrotate(8) config for backup-home-dirs
+
+/var/log/backup-home-dirs/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Sudo::User[www-data]

Parameters differences:

--- Sudo::User[www-data].orig
+++ Sudo::User[www-data]

+    privileges => ['ALL=(phd) SETENV: NOPASSWD: /usr/local/bin/git-http-backend, /usr/bin/git']
+    require    => ['File[/usr/local/bin/git-http-backend]', 'Class[Sudo]']
+    user       => www-data
+    ensure     => present

File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server-key.pem]

Parameters differences:

--- File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server-key.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server-key.pem]

+    mode      => 0440
+    owner     => envoy
+    ensure    => file
+    show_diff => False
+    backup    => False
+    group     => envoy

File[/etc/rsyslog.d/40-phabricator-stats-job-community-metrics.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-stats-job-community-metrics.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-stats-job-community-metrics.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-stats-job-community-metrics.conf.orig
+++ /etc/rsyslog.d/40-phabricator-stats-job-community-metrics.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_stats_job_community_metrics" then {
+    action(
+        type="omfile" file="/var/log/phabricator_stats_job_community_metrics/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

File[/usr/local/bin/phab_epipe.py]

Parameters differences:

--- File[/usr/local/bin/phab_epipe.py].orig
+++ File[/usr/local/bin/phab_epipe.py]

+    mode   => 0555
+    source => puppet:///modules/phabricator/phab_epipe.py
+    owner  => mail
+    ensure => file
+    group  => mail

Exec[systemd daemon-reload for phabricator_stats_job_project_changes.service (phabricator_stats_job_project_changes.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_project_changes.service (phabricator_stats_job_project_changes.service)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_project_changes.service (phabricator_stats_job_project_changes.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Exec[/srv/phab/libext/translations/src_static_dir_exists]

Parameters differences:

--- Exec[/srv/phab/libext/translations/src_static_dir_exists].orig
+++ Exec[/srv/phab/libext/translations/src_static_dir_exists]

+    creates => /srv/phab/phabricator/webroot/rsrc//srv/phab/libext/translations/src
+    require => File[/srv/phab]
+    command => /bin/ln -s /srv/phab/libext//srv/phab/libext/translations/src/rsrc/webroot-static /srv/phab/phabricator/webroot/rsrc//srv/phab/libext/translations/src
+    onlyif  => /usr/bin/test -e /srv/phab/libext//srv/phab/libext/translations/src/rsrc/webroot-static

Nftables::Service[envoy_tls_termination_src_sets]

Parameters differences:

--- Nftables::Service[envoy_tls_termination_src_sets].orig
+++ Nftables::Service[envoy_tls_termination_src_sets]

+    ensure              => present
+    port                => 443
+    proto               => tcp
+    src_sets            => ['CACHES']
+    prio                => 10
+    notrack             => True
+    unrestricted_access => False
+    desc                =>

Sudo::Group[phabricator-bulk-manager]

Parameters differences:

--- Sudo::Group[phabricator-bulk-manager].orig
+++ Sudo::Group[phabricator-bulk-manager]

+    privileges => ['ALL = NOPASSWD: /srv/phab/phabricator/bin/bulk make-silent --id *']
+    require    => ['Class[Sudo]']
+    group      => phabricator-bulk-manager
+    ensure     => present

Rsyslog::Conf[input-file-apache2-error]

Parameters differences:

--- Rsyslog::Conf[input-file-apache2-error].orig
+++ Rsyslog::Conf[input-file-apache2-error]

+    mode     => 0444
+    require  => Rsyslog::Conf[imfile]
+    priority => 10
+    ensure   => present

File[/etc/sudoers.d/www-data]

Parameters differences:

--- File[/etc/sudoers.d/www-data].orig
+++ File[/etc/sudoers.d/www-data]

+    mode         => 0440
+    owner        => root
+    ensure       => present
+    validate_cmd => /usr/sbin/visudo -cqf %
+    group        => root

Content differences:

--- /etc/sudoers.d/www-data.orig
+++ /etc/sudoers.d/www-data
@@ -0,0 +1,3 @@
+# This file is managed by Puppet!
+
+www-data ALL=(phd) SETENV: NOPASSWD: /usr/local/bin/git-http-backend, /usr/bin/git

Package[s-nail]

Parameters differences:

--- Package[s-nail].orig
+++ Package[s-nail]

+    provider => apt
+    ensure   => present

Concat_fragment[main contacts]

Content differences:

--- main contacts.orig
+++ main contacts
@@ -1,3 +1,3 @@
 ---
-role::phabricator::migration:
+role::phabricator:
 - Collaboration Services

Service[phabricator_stats_job_yearly_metrics.timer]

Parameters differences:

--- Service[phabricator_stats_job_yearly_metrics.timer].orig
+++ Service[phabricator_stats_job_yearly_metrics.timer]

+    before   => ['Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.timer (phabricator_stats_job_yearly_metrics.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

File[/etc/exim4/exim4.conf]

Parameters differences:

--- File[/etc/exim4/exim4.conf].orig
+++ File[/etc/exim4/exim4.conf]

+    notify  => Service[exim4]
+    mode    => 0440
+    owner   => root
+    ensure  => present
+    require => Package[exim4-config]
+    group   => Debian-exim

Content differences:

--- /etc/exim4/exim4.conf.orig
+++ /etc/exim4/exim4.conf
@@ -0,0 +1,197 @@
+# This file is managed by puppet
+
+##########
+# Macros #
+##########
+
+CONFDIR=/etc/exim4
+
+###############################
+# Main configuration settings #
+###############################
+
+domainlist system_domains = @
+domainlist local_domains = +system_domains : +phab_domains
+
+# Standard lists
+domainlist phab_domains = phabricator.wikimedia.org
+
+hostlist wikimedia_nets = <; 208.80.152.0/22 ; 2620:0:860::/46 ; 198.35.26.0/23 ; 185.71.138.0/24 ; 2001:67c:930::/48 ; 2a02:ec80::/32 ; 2001:df2:e500::/48 ; 103.102.166.0/24 ; 185.15.58.0/24 ; 185.15.59.0/24 ; 195.200.68.0/24 ; 10.0.0.0/8 ; 127.0.0.0/8 ; ::1/128
+hostlist relay_from_hosts = <; @[] ; 127.0.0.1 ; ::1 ;
+
+# Administration
+log_selector = +address_rewrite +all_parents +delivery_size +deliver_time +incoming_interface +incoming_port +smtp_confirmation +smtp_protocol_error +smtp_syntax_error +tls_cipher +tls_peerdn
+message_logs = false
+
+# Policy control
+acl_smtp_connect = acl_check_connect
+acl_smtp_rcpt = acl_check_rcpt
+acl_smtp_data = acl_check_data
+
+# Allow Phab, RT, OTRS to use any sender address
+untrusted_set_sender = *
+local_from_check = false
+
+system_filter = CONFDIR/system_filter
+
+# Resource control
+check_spool_space = 50M
+smtp_reserve_hosts = <; 127.0.0.1 ; ::1 ; +wikimedia_nets
+smtp_accept_queue_per_connection = 500
+
+deliver_queue_load_max = 800.0
+queue_only_load = 100.0
+remote_max_parallel = 500
+
+smtp_connect_backlog = 128
+smtp_receive_timeout = 1m
+smtp_accept_max = 4000
+smtp_accept_max_per_host = ${if match_ip{$sender_host_address}{+wikimedia_nets}{50}{5}}
+smtp_accept_reserve = 100
+
+# Lookups
+host_lookup = *
+rfc1413_hosts =
+
+# Other
+never_users = root : daemon : bin
+ignore_bounce_errors_after = 0h
+
+add_environment = <; PATH=/bin:/usr/bin
+keep_environment =
+
+###############################
+# Access Control Lists (ACLs) #
+###############################
+
+begin acl
+
+acl_check_rcpt:
+
+	# Accept if the source is local SMTP (a pipe)
+	accept hosts = :
+
+	# Deny if the local part contains @, %, /, | or !, or starts with a dot
+	deny local_parts = ^.*[@%!/|] : ^\\.
+
+	# Accept relaying from networks we control. Note: no address verification
+	# is done at this point, which is good for mail submission, but may render
+	# recipient callout verification by affected hosts useless.
+	accept domains = ! +local_domains
+		hosts = +relay_from_hosts
+		control = submission/sender_retain
+
+	# Require recipient domain to be local, or a domain we relay for
+	require message = Relay not permitted
+		domains = +local_domains : +relay_domains
+
+	# Accept mail for postmaster without further policy checking,
+	# for compliance with the RFCs
+	accept local_parts = postmaster : abuse
+
+	# Verify the recipient address for local domains, or require the
+	# recipient domain to exist for remote domains
+	require verify = recipient
+
+	accept
+
+acl_check_connect:
+	# We only accept mail from our own mail relays
+	require message = This server does not accept external mail
+		hosts = <; 127.0.0.0/8 ; ::1 ; +wikimedia_nets
+
+	accept
+
+acl_check_data:
+	accept
+
+###########
+# Routers #
+###########
+
+begin routers
+
+# Use the system aliasfile /etc/aliases for system domains
+system_aliases:
+	driver = redirect
+	domains = +system_domains
+	data = ${lookup{$local_part}lsearch{/etc/aliases}}
+	pipe_transport = address_pipe
+	allow_fail
+	allow_defer
+	forbid_file
+
+# Mail destined for Phabricator
+
+eat:
+	driver = redirect
+	domains = +phab_domains
+	local_parts = no-reply
+	data = :blackhole:
+
+phabricator_bound:
+	driver = redirect
+	domains = +phab_domains
+	redirect_router = phab
+	data = general$local_part_suffix@$domain
+	no_verify
+
+phab:
+	driver = accept
+	domains = +phab_domains
+	transport = phab_pipe
+
+# Send all mail not destined for the local machine via a set of
+# mail relays ("smart hosts")
+smart_route:
+	driver = manualroute
+	transport = remote_smtp
+	# Local mail is undeliverable and remote mail is forwarded
+	route_list = !+local_domains  mx-out1001.wikimedia.org:mx-out2001.wikimedia.org
+
+##############
+# Transports #
+##############
+
+begin transports
+
+# Generic remote SMTP transport
+
+remote_smtp:
+	driver = smtp
+	hosts_avoid_tls = <; 0.0.0.0/0 ; 0::0/0
+
+# Generic pipe local delivery transport (for use by alias/forward files)
+
+address_pipe:
+	driver = pipe
+	return_output
+
+# phabricator transport
+phab_pipe:
+	driver = pipe
+	batch_max = 5
+	command = /usr/local/bin/phab_epipe.py
+	environment = $address_data
+	user = mail
+	group = mail
+	return_fail_output
+
+###############
+# Retry rules #
+###############
+
+begin retry
+
+*	*	F,2h,15m; G,16h,1h,1.5; F,4d,6h
+
+#################
+# Rewrite rules #
+#################
+
+begin rewrite
+
+# T118176 - rewrite 'to/envelope-to' for mail to maint-announce
+# this can be used to make phabricator accept maint-announce mails but needs
+# to stay disabled until a phab application is setup to handle it
+# maint-announce@wikimedia.org	maint-announce@phabricator.wikimedia.org	tT

File[/home/mbinder]

Parameters differences:

--- File[/home/mbinder].orig
+++ File[/home/mbinder]

+    mode    => 0644
+    source  => puppet:///modules/admin/home/skel
+    recurse => remote
+    owner   => mbinder
+    ensure  => directory
+    force   => True
+    group   => 500

File[/etc/envoy/clusters.d]

Parameters differences:

--- File[/etc/envoy/clusters.d].orig
+++ File[/etc/envoy/clusters.d]

+    mode    => 0755
+    recurse => True
+    owner   => root
+    ensure  => directory
+    purge   => True
+    group   => root

Sudo::User[vcs]

Parameters differences:

--- Sudo::User[vcs].orig
+++ Sudo::User[vcs]

+    privileges => ['ALL=(phd) SETENV: NOPASSWD: /usr/bin/git-upload-pack, /usr/bin/git-receive-pack, /usr/bin/svnserve']
+    require    => ['User[vcs]', 'Class[Sudo]']
+    user       => vcs
+    ensure     => present

File[/var/log/phabricator_clean_tmp_files]

Parameters differences:

--- File[/var/log/phabricator_clean_tmp_files].orig
+++ File[/var/log/phabricator_clean_tmp_files]

+    mode   => 0755
+    owner  => root
+    ensure => directory
+    force  => True
+    backup => False
+    group  => root

Exec[systemd daemon-reload for rsync-phabricator-repos.service (rsync-phabricator-repos.service)]

Parameters differences:

--- Exec[systemd daemon-reload for rsync-phabricator-repos.service (rsync-phabricator-repos.service)].orig
+++ Exec[systemd daemon-reload for rsync-phabricator-repos.service (rsync-phabricator-repos.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Package[nodejs]

Parameters differences:

--- Package[nodejs].orig
+++ Package[nodejs]

+    before   => ['File[/srv/phab/aphlict/config.json]']
+    provider => apt
+    ensure   => installed

Ferm::Service[phabmain_smtp]

Parameters differences:

--- Ferm::Service[phabmain_smtp].orig
+++ Ferm::Service[phabmain_smtp]

+    ensure              => absent
+    port                => 25
+    proto               => tcp
+    prio                => 10
+    srange              => ['mx-in1001.wikimedia.org', 'mx-in2001.wikimedia.org']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Rsyslog::Input::File[apache2-error]

Parameters differences:

--- Rsyslog::Input::File[apache2-error].orig
+++ Rsyslog::Input::File[apache2-error]

+    ensure             => present
+    syslog_tag_prefix  => input-file
+    addmetadata        => off
+    addceetag          => off
+    reopen_on_truncate => on
+    path               => /var/log/apache2/*error*.log
+    syslog_tag         => apache2-error
+    priority           => 10

Systemd::Timer[phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- Systemd::Timer[phabricator_stats_job_quarterly_wmf_qls].orig
+++ Systemd::Timer[phabricator_stats_job_quarterly_wmf_qls]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-01,04,07,10-1 0:0:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => phabricator_stats_job_quarterly_wmf_qls.service
+    splay              => 0

File[/etc/phabtools.conf]

Parameters differences:

--- File[/etc/phabtools.conf].orig
+++ File[/etc/phabtools.conf]

+    mode    => 0660
+    require => Package[phabricator/deployment]
+    owner   => root
+    group   => root

Content differences:

--- /etc/phabtools.conf.orig
+++ /etc/phabtools.conf
@@ -0,0 +1,63 @@
+[general]
+dbhost = m3-slave.codfw.wmnet
+dbport = 3323
+dbslave = m3-slave.codfw.wmnet
+slaveport = 3323
+file_upload_timeout = 360
+
+[phmanifest]
+user = manifest_user
+passwd = manifest_pass
+
+[phuser]
+user = app_user
+passwd = app_pass
+
+[fabmigrate]
+db = fab_migration
+user = fabmigrate
+passwd = ''
+multi = 10
+limit = 30
+
+[phab]
+host = https://phabricator.wikimedia.org/api/
+certificate = phabtools_cert
+username = phabtools_user
+
+[oldfab]
+cert = asdf
+host = ''
+user = ''
+
+[bz]
+url = https://bugzilla.wikimedia.org/xmlrpc.cgi
+Bugzilla_login =
+Bugzilla_password =
+
+[bzmigrate]
+db = bugzilla_migration
+user = bz_user
+passwd = bz_pass
+fetch_multi = 50
+create_multi = 13
+update_limit = 400
+update_multi = 1
+populate_multi = 1
+security = true
+update_lookback = 86500
+
+[rtmigrate]
+db = rt_migration
+user = rt_user
+passwd = rt_pass
+fetch_multi = 30
+create_multi = 10
+update_limit = 400
+update_multi = 10
+update_lookback = 86500
+
+[rt]
+url = https://rt.wikimedia.org/REST/1.0/
+login =
+passwd =

Admin::Group[phabricator-admin]

Parameters differences:

--- Admin::Group[phabricator-admin].orig
+++ Admin::Group[phabricator-admin]

+    privileges => ['ALL = NOPASSWD: /srv/phab/phabricator/bin/cache purge --caches user', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/herald', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/remove', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/repository', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/phd', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/policy', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/worker', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/bulk make-silent --id *', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/auth strip --all-types --user *']
+    ensure     => present
+    gid        => 746

File[/var/log/phabricator_stats_job_project_changes]

Parameters differences:

--- File[/var/log/phabricator_stats_job_project_changes].orig
+++ File[/var/log/phabricator_stats_job_project_changes]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Concat::Fragment[/etc/bacula_puppet_ca_chain]

Parameters differences:

--- Concat::Fragment[/etc/bacula_puppet_ca_chain].orig
+++ Concat::Fragment[/etc/bacula_puppet_ca_chain]

+    source => /var/lib/puppet/ssl/certs/ca.pem
+    target => /etc/bacula/ssl/cert.pem
+    order  => 02

User[gjg]

Parameters differences:

--- User[gjg].orig
+++ User[gjg]

+    comment    => Greg Grossmeier
+    managehome => False
+    ensure     => present
+    shell      => /bin/bash
+    groups     => []
+    allowdupe  => False
+    gid        => 500
+    home       => /home/gjg
+    uid        => 2890

File[/usr/local/bin/quarterly_metrics.sh]

Parameters differences:

--- File[/usr/local/bin/quarterly_metrics.sh].orig
+++ File[/usr/local/bin/quarterly_metrics.sh]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /usr/local/bin/quarterly_metrics.sh.orig
+++ /usr/local/bin/quarterly_metrics.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+# Basic quarterly statistics of Phabricator used for
+# https://www.mediawiki.org/wiki/Technical_Community_Newsletter
+# per T337387 - aklapper 20230523
+# SPDX-License-Identifier: Apache-2.0
+# ! this file is managed by puppet !
+# ./modules/phabricator/files/quarterly_metrics.sh
+
+source /etc/phab_quarterly_metrics.conf
+
+#echo "result_tasks_created"
+result_tasks_created=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(dateCreated) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 3 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_tasks_closed"
+result_tasks_closed=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(closedEpoch) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 3 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_task_authors"
+result_tasks_authors=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(DISTINCT (authorPHID)) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 3 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_tasks_closers"
+result_tasks_closers=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+
+SELECT COUNT(DISTINCT (closerPHID)) FROM phabricator_maniphest.maniphest_task WHERE
+    FROM_UNIXTIME(closedEpoch,'%Y%m')>=DATE_FORMAT(NOW() - INTERVAL 3 MONTH,'%Y%m');
+
+END
+)
+
+taskscreated=$(echo $result_tasks_created | sed 's/[^0-9]*//g')
+tasksclosed=$(echo $result_tasks_closed | sed 's/[^0-9]*//g')
+tasksauthors=$(echo $result_tasks_authors | sed 's/[^0-9]*//g')
+tasksclosers=$(echo $result_tasks_closers | sed 's/[^0-9]*//g')
+
+month="$(date -d '-1 month' +%m)"
+if [[ $month == 12 ]]; then
+  year="$(date --date='-1 year' +'%Y')"
+else
+  year="$(date +'%Y')"
+fi
+lastquarter=$(date +"Q$(expr $(expr $month - 1) / 3 + 1)/$year")
+
+# the actual email
+cat <<EOF | /usr/bin/mail -r "${sndr_address}" -s "Phabricator quarterly statistics - ${lastquarter}" -a "Auto-Submitted: auto-generated" ${rcpt_address}
+
+This is the automatic quarterly Phabricator statistics mail used
+for https://www.mediawiki.org/wiki/Technical_Community_Newsletter
+
+=== Phabricator and Gerrit ===
+
+* [[mw:Phabricator|Phabricator]]: Number of tasks created in ${lastquarter}: ${taskscreated}
+* Phabricator: Number of tasks closed in ${lastquarter}: ${tasksclosed}
+* Phabricator: Number of different people who created tasks in ${lastquarter}: ${tasksauthors}
+* Phabricator: Number of different people who closed tasks in ${lastquarter}: ${tasksclosers}
+* [[mw:Gerrit|Gerrit]]: [https://development-metrics.wmcloud.org/goto/xxxTODOxxx X people wrote patches] ([https://development-metrics.wmcloud.org/goto/xxxTODOxxx X of them being volunteers]) in ${lastquarter}.
+
+
+Instructions / steps how to get Gerrit statistics for that last line:
+
+* Go to https://development-metrics.wmcloud.org/
+* Select "Gerrit" in the top bar, then select the "Overview" subpage
+* Adjust the time frame to cover the last calendar quarter:
+** Select the time filter in the upper right corner
+** Under "Time Range" select "Absolute"
+** Set the exact start date and end date of the last calendar quarter
+* Use the number of "Change Submitters" in the box called "Gerrit" as
+  that is the number of all and any Gerrit contributors
+* Select "Independent" in the "Organizations" pie chart to filter on
+  affiliation ("Independent" organization = volunteer contributors)
+* Use the number of "Change Submitters" in the box called "Gerrit" as
+  that is the number of volunteer Gerrit contributors
+* To create a short URL link to what you see on
+  https://development-metrics.wmcloud.org/:
+** Log in via the button in the bottom left corner
+*** If you do not have an account yet, see
+    https://www.mediawiki.org/wiki/Community_metrics#Contact
+** Select "Share" in the top bar
+** Select "Permalink"
+** Enable "Short URL"
+** Select "Copy link"
+For general info how to use development-metrics.wmcloud.org, see
+https://www.mediawiki.org/wiki/Community_metrics
+
+
+Yours sincerely,
+Fab Rick Aytor
+
+(via $(basename $0) on $(hostname) at $(date))
+EOF

Bacula::Client::Job[srv-repos-Monthly-1st-Wed-productionEqiad]

Parameters differences:

--- Bacula::Client::Job[srv-repos-Monthly-1st-Wed-productionEqiad].orig
+++ Bacula::Client::Job[srv-repos-Monthly-1st-Wed-productionEqiad]

+    require     => Class[Bacula::Client]
+    jobdefaults => Monthly-1st-Wed-productionEqiad
+    fileset     => srv-repos

File[/var/log/phabricator_task_dump]

Parameters differences:

--- File[/var/log/phabricator_task_dump].orig
+++ File[/var/log/phabricator_task_dump]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

File[/lib/systemd/system/wmf_auto_restart_aphlict.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_aphlict.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_aphlict.service]

+    notify => Exec[systemd daemon-reload for wmf_auto_restart_aphlict.service (wmf_auto_restart_aphlict.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/wmf_auto_restart_aphlict.service.orig
+++ /lib/systemd/system/wmf_auto_restart_aphlict.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Auto restart job: aphlict
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/wmf-auto-restart -s aphlict

Class[Profile::Base::Production]

Parameters differences:

--- Class[Profile::Base::Production].orig
+++ Class[Profile::Base::Production]

@@
-    role_description => Temp role to allow migrating Phabricator data to a new server
+    role_description => Phabricator (main) server

Service[phabricator_clean_tmp_files.timer]

Parameters differences:

--- Service[phabricator_clean_tmp_files.timer].orig
+++ Service[phabricator_clean_tmp_files.timer]

+    provider => systemd
+    enable   => True
+    ensure   => running

File[/srv/phab]

Parameters differences:

--- File[/srv/phab].orig
+++ File[/srv/phab]

+    require => Package[phabricator/deployment]

File[/lib/systemd/system/phabricator_clean_tmp_files.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_clean_tmp_files.service].orig
+++ File[/lib/systemd/system/phabricator_clean_tmp_files.service]

+    notify => Exec[systemd daemon-reload for phabricator_clean_tmp_files.service (phabricator_clean_tmp_files.service)]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_clean_tmp_files.service.orig
+++ /lib/systemd/system/phabricator_clean_tmp_files.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator cleanup temp files
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/bin/find /tmp -ignore_readdir_race -user www-data -mtime +14 -delete

File[/var/lib/scap/scap/bin]

Parameters differences:

--- File[/var/lib/scap/scap/bin].orig
+++ File[/var/lib/scap/scap/bin]

-    require => Class[Scap::User]
-    owner   => scap
-    ensure  => directory
-    group   => root

Systemd::Service[phabricator_stats_job_project_changes]

Parameters differences:

--- Systemd::Service[phabricator_stats_job_project_changes].orig
+++ Systemd::Service[phabricator_stats_job_project_changes]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_stats_job_project_changes.service]
+    monitoring_contact_group => admins

File[/usr/local/bin/arc]

Parameters differences:

--- File[/usr/local/bin/arc].orig
+++ File[/usr/local/bin/arc]

+    mode    => 0755
+    owner   => root
+    ensure  => link
+    target  => /srv/phab/arcanist/bin/arc
+    require => ['Package[phabricator/deployment]']
+    group   => root

File[/var/log/phd]

Parameters differences:

--- File[/var/log/phd].orig
+++ File[/var/log/phd]

+    owner  => phd
+    ensure => directory
+    group  => phd

Firewall::Service[bacula-file-daemon-backup1014.eqiad.wmnet]

Parameters differences:

--- Firewall::Service[bacula-file-daemon-backup1014.eqiad.wmnet].orig
+++ Firewall::Service[bacula-file-daemon-backup1014.eqiad.wmnet]

+    ensure              => present
+    port                => 9102
+    proto               => tcp
+    prio                => 10
+    srange              => ['backup1014.eqiad.wmnet']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Systemd::Syslog[phabricator_stats_job_project_changes]

Parameters differences:

--- Systemd::Syslog[phabricator_stats_job_project_changes].orig
+++ Systemd::Syslog[phabricator_stats_job_project_changes]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

User[vcs]

Parameters differences:

--- User[vcs].orig
+++ User[vcs]

+    ensure   => present
+    shell    => /bin/sh
+    groups   => ['vcs', 'phd']
+    password => *
+    gid      => 497
+    home     => /var/lib/vcs
+    uid      => 497
+    system   => True

Package[python3-phabricator]

Parameters differences:

--- Package[python3-phabricator].orig
+++ Package[python3-phabricator]

+    provider => apt
+    ensure   => present

File[/srv/repos]

Parameters differences:

--- File[/srv/repos].orig
+++ File[/srv/repos]

+    mode   => 0755
+    owner  => phd
+    ensure => directory
+    group  => www-data

Systemd::Timer::Job[phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- Systemd::Timer::Job[phabricator_stats_job_quarterly_wmf_qls].orig
+++ Systemd::Timer::Job[phabricator_stats_job_quarterly_wmf_qls]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => phabricator statistics mail - quarterly_wmf_qls
+    command                   => /usr/local/bin/quarterly_wmf_qls.sh
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-01,04,07,10-1 0:0:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

Concat::Fragment[/etc/rsyncd.conf-srv-dumps]

Parameters differences:

--- Concat::Fragment[/etc/rsyncd.conf-srv-dumps].orig
+++ Concat::Fragment[/etc/rsyncd.conf-srv-dumps]

+    order  => 10
+    target => /etc/rsyncd.conf

File[/etc/logrotate.d/phabricator_task_dump]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_task_dump].orig
+++ File[/etc/logrotate.d/phabricator_task_dump]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_task_dump.orig
+++ /etc/logrotate.d/phabricator_task_dump
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_task_dump
+
+/var/log/phabricator_task_dump/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

File[/var/log/wmf_auto_restart_envoyproxy]

Parameters differences:

--- File[/var/log/wmf_auto_restart_envoyproxy].orig
+++ File[/var/log/wmf_auto_restart_envoyproxy]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Class[Phabricator::Aphlict]

Parameters differences:

--- Class[Phabricator::Aphlict].orig
+++ Class[Phabricator::Aphlict]

+    admin_port    => 22281
+    user          => aphlict
+    ensure        => absent
+    client_listen => 0.0.0.0
+    client_port   => 22280
+    basedir       => /srv/phab
+    require       => Class[Phabricator]
+    enable_ssl    => False
+    group         => aphlict
+    admin_listen  => 127.0.0.1

File[/lib/systemd/system/phabricator_task_dump.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_task_dump.timer].orig
+++ File[/lib/systemd/system/phabricator_task_dump.timer]

+    notify => Exec[systemd daemon-reload for phabricator_task_dump.timer (phabricator_task_dump.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_task_dump.timer.orig
+++ /lib/systemd/system/phabricator_task_dump.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_task_dump.service
+
+[Timer]
+Unit=phabricator_task_dump.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Monday *-*-* 02:00:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Service[prometheus-apache-exporter]

Parameters differences:

--- Service[prometheus-apache-exporter].orig
+++ Service[prometheus-apache-exporter]

+    require => Package[prometheus-apache-exporter]
+    ensure  => running

Phabricator::Libext[/srv/phab/libext/translations/src]

Parameters differences:

--- Phabricator::Libext[/srv/phab/libext/translations/src].orig
+++ Phabricator::Libext[/srv/phab/libext/translations/src]

+    require => ['Package[phabricator/deployment]']
+    libname => /srv/phab/libext/translations/src
+    rootdir => /srv/phab

Motd::Message[phabricator::migration]

Parameters differences:

--- Motd::Message[phabricator::migration].orig
+++ Motd::Message[phabricator::migration]

-    priority => 5
-    ensure   => present
-    message  => phab2003 is a Temp role to allow migrating Phabricator data to a new server (phabricator::migration)

File_line[deselect_dst_root_ca_x3]

Parameters differences:

--- File_line[deselect_dst_root_ca_x3].orig
+++ File_line[deselect_dst_root_ca_x3]

+    notify             => Exec[update-ca-certificates]
+    match              => ^!?mozilla/DST_Root_CA_X3\.crt$
+    path               => /etc/ca-certificates.conf
+    append_on_no_match => False
+    require            => Package[ca-certificates]
+    line               => !mozilla/DST_Root_CA_X3.crt

Sysctl::Parameters[TCP Fast Open]

Parameters differences:

--- Sysctl::Parameters[TCP Fast Open].orig
+++ Sysctl::Parameters[TCP Fast Open]

+    values             => {'net.ipv4.tcp_fastopen': 3}
+    priority           => 70
+    no_priority_prefix => False
+    ensure             => present

File_line[auto_restart_file_presence_envoyproxy]

Parameters differences:

--- File_line[auto_restart_file_presence_envoyproxy].orig
+++ File_line[auto_restart_file_presence_envoyproxy]

+    require => File[/etc/debdeploy-client/autorestarts.conf]
+    line    => envoyproxy
+    ensure  => absent
+    path    => /etc/debdeploy-client/autorestarts.conf

Sysctl::Conffile[phabricator network tuning]

Parameters differences:

--- Sysctl::Conffile[phabricator network tuning].orig
+++ Sysctl::Conffile[phabricator network tuning]

+    priority           => 70
+    no_priority_prefix => False
+    ensure             => present

Exec[verify-envoy-config]

Parameters differences:

--- Exec[verify-envoy-config].orig
+++ Exec[verify-envoy-config]

+    notify      => Systemd::Service[envoyproxy.service]
+    refreshonly => True
+    command     => /usr/local/sbin/build-envoy-config -c '/etc/envoy'
+    user        => root
+    require     => Package[envoyproxy]

Rsyslog::Input::File[apache2-access]

Parameters differences:

--- Rsyslog::Input::File[apache2-access].orig
+++ Rsyslog::Input::File[apache2-access]

+    ensure             => present
+    syslog_tag_prefix  => input-file
+    addmetadata        => off
+    addceetag          => off
+    reopen_on_truncate => on
+    path               => /var/log/apache2/*access*.log
+    syslog_tag         => apache2-access
+    priority           => 10

Group[vcs]

Parameters differences:

--- Group[vcs].orig
+++ Group[vcs]

+    ensure => present
+    system => True
+    gid    => 497

Service[aphlict]

Parameters differences:

--- Service[aphlict].orig
+++ Service[aphlict]

+    hasrestart => False
+    before     => ['Exec[systemd daemon-reload for aphlict.service (aphlict)]']
+    enable     => False
+    ensure     => stopped

Systemd::Service[phd]

Parameters differences:

--- Systemd::Service[phd].orig
+++ Systemd::Service[phd]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => present
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => service
+    service_params           => {'ensure': 'stopped', 'enable': False, 'hasrestart': True}
+    require                  => Class[Phabricator::Phd]
+    monitoring_contact_group => admins

Class[Phabricator::Mailrelay]

Parameters differences:

--- Class[Phabricator::Mailrelay].orig
+++ Class[Phabricator::Mailrelay]

+    default                 => {'maint': False}
+    phab_bot                => {'root_dir': '/srv/phab/phabricator/'}
+    direct_comments_allowed => {}
+    address_routing         => {}

Systemd::Unit[phabricator_stats_job_project_changes.timer]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_project_changes.timer].orig
+++ Systemd::Unit[phabricator_stats_job_project_changes.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_project_changes.timer
+    require           => ['Class[Systemd]']

File[/srv/phab/aphlict/config.json]

Parameters differences:

--- File[/srv/phab/aphlict/config.json].orig
+++ File[/srv/phab/aphlict/config.json]

+    notify => ['Service[aphlict]']
+    mode   => 0644
+    owner  => aphlict
+    ensure => absent
+    group  => aphlict

Content differences:

--- /srv/phab/aphlict/config.json.orig
+++ /srv/phab/aphlict/config.json
@@ -0,0 +1,21 @@
+{
+  "servers": [
+    {
+      "type": "client",
+      "port": 22280,
+      "listen": "0.0.0.0"
+
+    },
+    {
+      "type": "admin",
+      "port": 22281,
+      "listen": "127.0.0.1"
+    }
+  ],
+  "logs": [
+    {
+      "path": "/var/log/aphlict/aphlict.log"
+    }
+  ],
+  "pidfile": "/var/run/aphlict/aphlict.pid"
+}

File[/var/log/phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- File[/var/log/phabricator_stats_job_tech_news_weekly_stats].orig
+++ File[/var/log/phabricator_stats_job_tech_news_weekly_stats]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Mailalias[root]

Parameters differences:

--- Mailalias[root].orig
+++ Mailalias[root]

+    recipient => root@wikimedia.org

Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.service]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.service].orig
+++ Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_quarterly_wmf_qls.service
+    require           => ['Class[Systemd]']

Systemd::Service[phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- Systemd::Service[phabricator_stats_job_quarterly_metrics].orig
+++ Systemd::Service[phabricator_stats_job_quarterly_metrics]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_stats_job_quarterly_metrics.service]
+    monitoring_contact_group => admins

File[/usr/local/bin/phab_git_safedir.sh]

Parameters differences:

--- File[/usr/local/bin/phab_git_safedir.sh].orig
+++ File[/usr/local/bin/phab_git_safedir.sh]

+    mode   => 0550
+    source => puppet:///modules/phabricator/phab_git_safedir.sh
+    owner  => root
+    group  => root

File[/etc/gitconfig.d]

Parameters differences:

--- File[/etc/gitconfig.d].orig
+++ File[/etc/gitconfig.d]

+    mode    => 0555
+    recurse => True
+    owner   => root
+    ensure  => directory
+    purge   => True
+    group   => root

Systemd::Timer[phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- Systemd::Timer[phabricator_stats_job_quarterly_metrics].orig
+++ Systemd::Timer[phabricator_stats_job_quarterly_metrics]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-01,04,07,10-1 0:0:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => phabricator_stats_job_quarterly_metrics.service
+    splay              => 0

Admin::Hashuser[urbanecm]

Parameters differences:

--- Admin::Hashuser[urbanecm].orig
+++ Admin::Hashuser[urbanecm]

+    ensure_ssh_key => True

Logrotate::Conf[wmf_auto_restart_envoyproxy]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_envoyproxy].orig
+++ Logrotate::Conf[wmf_auto_restart_envoyproxy]

+    ensure => absent

Class[Profile::Phabricator::Logmail]

Parameters differences:

--- Class[Profile::Phabricator::Logmail].orig
+++ Class[Profile::Phabricator::Logmail]

+    deploy_target    => phabricator/deployment
+    mysql_slave_port => 3323
+    mysql_slave      => m3-slave.codfw.wmnet
+    logmail          => False
+    sndr_address     => aklapper@wikimedia.org

Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.timer (wmf_auto_restart_envoyproxy.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.timer (wmf_auto_restart_envoyproxy.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.timer (wmf_auto_restart_envoyproxy.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/rsync-phabricator-repos.service]

Parameters differences:

--- File[/lib/systemd/system/rsync-phabricator-repos.service].orig
+++ File[/lib/systemd/system/rsync-phabricator-repos.service]

+    notify => Exec[systemd daemon-reload for rsync-phabricator-repos.service (rsync-phabricator-repos.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/rsync-phabricator-repos.service.orig
+++ /lib/systemd/system/rsync-phabricator-repos.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Transfer data periodically between hosts
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/sync-phabricator-repos
+SuccessExitStatus=24

Systemd::Timer[phabricator_stats_job_yearly_metrics]

Parameters differences:

--- Systemd::Timer[phabricator_stats_job_yearly_metrics].orig
+++ Systemd::Timer[phabricator_stats_job_yearly_metrics]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-1-1 0:0:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => phabricator_stats_job_yearly_metrics.service
+    splay              => 0

File[/home/urbanecm/.my.cnf]

Parameters differences:

--- File[/home/urbanecm/.my.cnf].orig
+++ File[/home/urbanecm/.my.cnf]

+    mode  => 0440
+    owner => urbanecm
+    group => root

Content differences:

--- /home/urbanecm/.my.cnf.orig
+++ /home/urbanecm/.my.cnf
@@ -0,0 +1,6 @@
+[client]
+user=metrics_user
+password=metrics_pass
+database=phabricator_maniphest
+host=m3-slave.codfw.wmnet
+port=3323

File[/etc/update-motd.d/06-backups-srv-repos]

Parameters differences:

--- File[/etc/update-motd.d/06-backups-srv-repos].orig
+++ File[/etc/update-motd.d/06-backups-srv-repos]

+    mode   => 0555
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/update-motd.d/06-backups-srv-repos.orig
+++ /etc/update-motd.d/06-backups-srv-repos
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "Backed up on this host: srv-repos"

Systemd::Service[rsync-phabricator-home-dirs]

Parameters differences:

--- Systemd::Service[rsync-phabricator-home-dirs].orig
+++ Systemd::Service[rsync-phabricator-home-dirs]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[rsync-phabricator-home-dirs.service]
+    monitoring_contact_group => admins

Exec[systemd daemon-reload for backup-home-dirs.service (backup-home-dirs.service)]

Parameters differences:

--- Exec[systemd daemon-reload for backup-home-dirs.service (backup-home-dirs.service)].orig
+++ Exec[systemd daemon-reload for backup-home-dirs.service (backup-home-dirs.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/home/aklapper/.my.cnf]

Parameters differences:

--- File[/home/aklapper/.my.cnf].orig
+++ File[/home/aklapper/.my.cnf]

+    mode  => 0440
+    owner => aklapper
+    group => root

Content differences:

--- /home/aklapper/.my.cnf.orig
+++ /home/aklapper/.my.cnf
@@ -0,0 +1,6 @@
+[client]
+user=metrics_user
+password=metrics_pass
+database=phabricator_maniphest
+host=m3-slave.codfw.wmnet
+port=3323

Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.service (phabricator_stats_job_yearly_metrics.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.service (phabricator_stats_job_yearly_metrics.service)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.service (phabricator_stats_job_yearly_metrics.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Class[Adduser]

Parameters differences:

--- Class[Adduser].orig
+++ Class[Adduser]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[php8.2-common]', 'Package[php8.2-opcache]', 'Package[php8.2-cli]', 'Package[php8.2-fpm]', 'Package[apache2]', 'Package[links]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[git-lfs]', 'Package[rsync]', 'Package[python3-venv]', 'Package[phabricator/deployment]', 'Package[php8.2-curl]', 'Package[php8.2-gd]', 'Package[php8.2-gmp]', 'Package[php8.2-intl]', 'Package[php8.2-mbstring]', 'Package[php8.2-ldap]', 'Package[php-apcu]', 'Package[php-mailparse]', 'Package[php8.2-xml]', 'Package[php8.2-mysql]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[bacula-fd]', 'Package[python3-pygments]', 'Package[python3-phabricator]', 'Package[apachetop]', 'Package[subversion]', 'Package[s-nail]', 'Package[php8.2-common]', 'Package[php8.2-opcache]', 'Package[php8.2-cli]', 'Package[php8.2-fpm]', 'Package[nodejs]', 'Package[python3-mysqldb]', 'Package[python3-pymysql]', 'Package[exim4-config]', 'Package[exim4-daemon-heavy]', 'Package[apache2]', 'Package[links]', 'Package[envoyproxy]', 'Package[rsync]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[git-lfs]', 'Package[python3-venv]', 'Package[phabricator/deployment]', 'Package[php8.2-curl]', 'Package[php8.2-gd]', 'Package[php8.2-gmp]', 'Package[php8.2-intl]', 'Package[php8.2-mbstring]', 'Package[php8.2-ldap]', 'Package[php-apcu]', 'Package[php-mailparse]', 'Package[php8.2-xml]', 'Package[php8.2-mysql]', 'Package[mariadb-client]', 'Package[prometheus-apache-exporter]']

File[/var/lib/scap/scap]

Parameters differences:

--- File[/var/lib/scap/scap].orig
+++ File[/var/lib/scap/scap]

-    require => Class[Scap::User]
-    owner   => scap
-    ensure  => directory
-    group   => root

Class[Profile::Resolving]

Parameters differences:

--- Class[Profile::Resolving].orig
+++ Class[Profile::Resolving]

@@
-    domain_search => ['codfw.wmnet']
+    domain_search => ['eqiad.wmnet', 'codfw.wmnet']

Logrotate::Conf[aphlict]

Parameters differences:

--- Logrotate::Conf[aphlict].orig
+++ Logrotate::Conf[aphlict]

+    source  => puppet:///modules/phabricator/logrotate_aphlict
+    ensure  => absent
+    require => File[/var/log/aphlict/]

File[/etc/update-motd.d/06-backups-home]

Parameters differences:

--- File[/etc/update-motd.d/06-backups-home].orig
+++ File[/etc/update-motd.d/06-backups-home]

+    mode   => 0555
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/update-motd.d/06-backups-home.orig
+++ /etc/update-motd.d/06-backups-home
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "Backed up on this host: home"

Logrotate::Conf[rsync-phabricator-repos]

Parameters differences:

--- Logrotate::Conf[rsync-phabricator-repos].orig
+++ Logrotate::Conf[rsync-phabricator-repos]

+    ensure => absent

Systemd::Unit[rsync-phabricator-repos.timer]

Parameters differences:

--- Systemd::Unit[rsync-phabricator-repos.timer].orig
+++ Systemd::Unit[rsync-phabricator-repos.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => rsync-phabricator-repos.timer
+    require           => ['Class[Systemd]']

Systemd::Timer[phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- Systemd::Timer[phabricator_stats_job_tech_news_weekly_stats].orig
+++ Systemd::Timer[phabricator_stats_job_tech_news_weekly_stats]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Thursday *-*-* 12:0:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => phabricator_stats_job_tech_news_weekly_stats.service
+    splay              => 0

Logrotate::Conf[phabricator_stats_job_community_metrics]

Parameters differences:

--- Logrotate::Conf[phabricator_stats_job_community_metrics].orig
+++ Logrotate::Conf[phabricator_stats_job_community_metrics]

+    ensure => absent

Exec[update-sysusers-vcs]

Parameters differences:

--- Exec[update-sysusers-vcs].orig
+++ Exec[update-sysusers-vcs]

+    command  => /bin/systemd-sysusers /etc/sysusers.d/vcs.conf
+    user     => root
+    path     => /usr/bin:/usr/sbin:/bin
+    onlyif   => test -n "$(systemd-sysusers --dry-run /etc/sysusers.d/vcs.conf 2>&1)"
+    provider => shell

Httpd::Conf[phabricator]

Parameters differences:

--- Httpd::Conf[phabricator].orig
+++ Httpd::Conf[phabricator]

+    priority  => 50
+    conf_type => sites
+    ensure    => present

File[/srv/homes]

Parameters differences:

--- File[/srv/homes].orig
+++ File[/srv/homes]

+    owner  => root
+    ensure => directory
+    group  => root

Class[Exim4]

Parameters differences:

--- Class[Exim4].orig
+++ Class[Exim4]

+    config_dir  => /etc/exim4
+    queuerunner => combined
+    variant     => heavy
+    config      => # This file is managed by puppet

##########
# Macros #
##########

CONFDIR=/etc/exim4

###############################
# Main configuration settings #
###############################

domainlist system_domains = @
domainlist local_domains = +system_domains : +phab_domains

# Standard lists
domainlist phab_domains = phabricator.wikimedia.org

hostlist wikimedia_nets = <; 208.80.152.0/22 ; 2620:0:860::/46 ; 198.35.26.0/23 ; 185.71.138.0/24 ; 2001:67c:930::/48 ; 2a02:ec80::/32 ; 2001:df2:e500::/48 ; 103.102.166.0/24 ; 185.15.58.0/24 ; 185.15.59.0/24 ; 195.200.68.0/24 ; 10.0.0.0/8 ; 127.0.0.0/8 ; ::1/128
hostlist relay_from_hosts = <; @[] ; 127.0.0.1 ; ::1 ;

# Administration
log_selector = +address_rewrite +all_parents +delivery_size +deliver_time +incoming_interface +incoming_port +smtp_confirmation +smtp_protocol_error +smtp_syntax_error +tls_cipher +tls_peerdn
message_logs = false

# Policy control
acl_smtp_connect = acl_check_connect
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data

# Allow Phab, RT, OTRS to use any sender address
untrusted_set_sender = *
local_from_check = false

system_filter = CONFDIR/system_filter

# Resource control
check_spool_space = 50M
smtp_reserve_hosts = <; 127.0.0.1 ; ::1 ; +wikimedia_nets
smtp_accept_queue_per_connection = 500

deliver_queue_load_max = 800.0
queue_only_load = 100.0
remote_max_parallel = 500

smtp_connect_backlog = 128
smtp_receive_timeout = 1m
smtp_accept_max = 4000
smtp_accept_max_per_host = ${if match_ip{$sender_host_address}{+wikimedia_nets}{50}{5}}
smtp_accept_reserve = 100

# Lookups
host_lookup = *
rfc1413_hosts =

# Other
never_users = root : daemon : bin
ignore_bounce_errors_after = 0h

add_environment = <; PATH=/bin:/usr/bin
keep_environment =

###############################
# Access Control Lists (ACLs) #
###############################

begin acl

acl_check_rcpt:

	# Accept if the source is local SMTP (a pipe)
	accept hosts = :

	# Deny if the local part contains @, %, /, | or !, or starts with a dot
	deny local_parts = ^.*[@%!/|] : ^\\.

	# Accept relaying from networks we control. Note: no address verification
	# is done at this point, which is good for mail submission, but may render
	# recipient callout verification by affected hosts useless.
	accept domains = ! +local_domains
		hosts = +relay_from_hosts
		control = submission/sender_retain

	# Require recipient domain to be local, or a domain we relay for
	require message = Relay not permitted
		domains = +local_domains : +relay_domains

	# Accept mail for postmaster without further policy checking,
	# for compliance with the RFCs
	accept local_parts = postmaster : abuse

	# Verify the recipient address for local domains, or require the
	# recipient domain to exist for remote domains
	require verify = recipient

	accept

acl_check_connect:
	# We only accept mail from our own mail relays
	require message = This server does not accept external mail
		hosts = <; 127.0.0.0/8 ; ::1 ; +wikimedia_nets

	accept

acl_check_data:
	accept

###########
# Routers #
###########

begin routers

# Use the system aliasfile /etc/aliases for system domains
system_aliases:
	driver = redirect
	domains = +system_domains
	data = ${lookup{$local_part}lsearch{/etc/aliases}}
	pipe_transport = address_pipe
	allow_fail
	allow_defer
	forbid_file

# Mail destined for Phabricator

eat:
	driver = redirect
	domains = +phab_domains
	local_parts = no-reply
	data = :blackhole:

phabricator_bound:
	driver = redirect
	domains = +phab_domains
	redirect_router = phab
	data = general$local_part_suffix@$domain
	no_verify

phab:
	driver = accept
	domains = +phab_domains
	transport = phab_pipe

# Send all mail not destined for the local machine via a set of
# mail relays ("smart hosts")
smart_route:
	driver = manualroute
	transport = remote_smtp
	# Local mail is undeliverable and remote mail is forwarded
	route_list = !+local_domains  mx-out1001.wikimedia.org:mx-out2001.wikimedia.org

##############
# Transports #
##############

begin transports

# Generic remote SMTP transport

remote_smtp:
	driver = smtp
	hosts_avoid_tls = <; 0.0.0.0/0 ; 0::0/0

# Generic pipe local delivery transport (for use by alias/forward files)

address_pipe:
	driver = pipe
	return_output

# phabricator transport
phab_pipe:
	driver = pipe
	batch_max = 5
	command = /usr/local/bin/phab_epipe.py
	environment = $address_data
	user = mail
	group = mail
	return_fail_output

###############
# Retry rules #
###############

begin retry

*	*	F,2h,15m; G,16h,1h,1.5; F,4d,6h

#################
# Rewrite rules #
#################

begin rewrite

# T118176 - rewrite 'to/envelope-to' for mail to maint-announce
# this can be used to make phabricator accept maint-announce mails but needs
# to stay disabled until a phab application is setup to handle it
# maint-announce@wikimedia.org	maint-announce@phabricator.wikimedia.org	tT

+    filter      => # Exim filter

if first_delivery then
	if $acl_m0 is not "trusted relay" then
		# Remove any SpamAssassin headers and add local ones
		headers remove X-Spam-Score:X-Spam-Report:X-Spam-Checker-Version:X-Spam-Status:X-Spam-Level:X-Spam-Flag
	endif
	if $acl_m0 is not "" and $acl_m0 is not "trusted relay" then
		headers add "X-Spam-Score: $acl_m0"
		headers add "X-Spam-Report: $acl_m1"
	endif
endif

# reject these excessive bounces temporarily
if $header_from: matches "MAILER-DAEMON@fickja.de" and $header_to: matches "abuse@wikipedia.org" then
	fail text "Message rejected due to excessive volume. If you believe this is an error please contact postmaster@wikimedia.org"
endif
if $header_from: matches "keineantwortadresse@web.de" and $header_to: matches "abuse@wikipedia.org" then
	fail text "Message rejected due to excessive volume. If you believe this is an error please contact postmaster@wikimedia.org"
endif
# quietly drop this spam T298038
if $header_from: matches @unn-212-102-49-71\\.cdn77\\.com and $header_to: matches abuse@wikimediafoundation\\.org then
	seen finish
endif

File[/etc/gitconfig.d/10-setup_proxy.gitconfig]

Parameters differences:

--- File[/etc/gitconfig.d/10-setup_proxy.gitconfig].orig
+++ File[/etc/gitconfig.d/10-setup_proxy.gitconfig]

+    notify => Exec[update-gitconfig]
+    mode   => 0444
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/gitconfig.d/10-setup_proxy.gitconfig.orig
+++ /etc/gitconfig.d/10-setup_proxy.gitconfig
@@ -0,0 +1,11 @@
+# git::systemconfig for 'setup proxy'
+[http "https://gerrit.googlesource.com"]
+proxy = http://url-downloader.codfw.wikimedia.org:8080
+[http "https://gerrit.wikimedia.org"]
+proxy = 
+[http "https://github.com"]
+proxy = http://url-downloader.codfw.wikimedia.org:8080
+[http "https://gitlab.com"]
+proxy = http://url-downloader.codfw.wikimedia.org:8080
+[http "https://phabricator.wikimedia.org"]
+proxy =

Service[phabricator_stats_job_project_changes.timer]

Parameters differences:

--- Service[phabricator_stats_job_project_changes.timer].orig
+++ Service[phabricator_stats_job_project_changes.timer]

+    before   => ['Exec[systemd daemon-reload for phabricator_stats_job_project_changes.timer (phabricator_stats_job_project_changes.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

File[/etc/nftables/input/10_bacula-file-daemon-backup1014.eqiad.wmnet.nft]

Parameters differences:

--- File[/etc/nftables/input/10_bacula-file-daemon-backup1014.eqiad.wmnet.nft].orig
+++ File[/etc/nftables/input/10_bacula-file-daemon-backup1014.eqiad.wmnet.nft]

+    notify => ['Service[nftables]']
+    mode   => 0444
+    tag    => nft
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/nftables/input/10_bacula-file-daemon-backup1014.eqiad.wmnet.nft.orig
+++ /etc/nftables/input/10_bacula-file-daemon-backup1014.eqiad.wmnet.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr { 10.64.183.10 } tcp dport { 9102 } accept
+ip6 saddr { 2620:0:861:13d:10:64:183:10 } tcp dport { 9102 } accept

Systemd::Unit[backup-home-dirs.service]

Parameters differences:

--- Systemd::Unit[backup-home-dirs.service].orig
+++ Systemd::Unit[backup-home-dirs.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => backup-home-dirs.service
+    require           => ['Class[Systemd]']

Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh]

Parameters differences:

--- Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh].orig
+++ Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    refreshonly => True
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/phab2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server

+    subscribe   => File[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]

Service[phabricator_stats_job_quarterly_metrics.timer]

Parameters differences:

--- Service[phabricator_stats_job_quarterly_metrics.timer].orig
+++ Service[phabricator_stats_job_quarterly_metrics.timer]

+    before   => ['Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.timer (phabricator_stats_job_quarterly_metrics.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

File[/etc/default/prometheus-apache-exporter]

Parameters differences:

--- File[/etc/default/prometheus-apache-exporter].orig
+++ File[/etc/default/prometheus-apache-exporter]

+    notify => Service[prometheus-apache-exporter]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/default/prometheus-apache-exporter.orig
+++ /etc/default/prometheus-apache-exporter
@@ -0,0 +1 @@
+ARGS="--scrape_uri http://127.0.0.1/server-status/?auto"

File[/etc/logrotate.d/envoy]

Parameters differences:

--- File[/etc/logrotate.d/envoy].orig
+++ File[/etc/logrotate.d/envoy]

+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/logrotate.d/envoy.orig
+++ /etc/logrotate.d/envoy
@@ -0,0 +1,12 @@
+# logrotate(8) config for envoy
+
+/var/log/envoy/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Logrotate::Conf[phabricator_stats_job_project_changes]

Parameters differences:

--- Logrotate::Conf[phabricator_stats_job_project_changes].orig
+++ Logrotate::Conf[phabricator_stats_job_project_changes]

+    ensure => absent

Ferm::Service[envoy_tls_termination_src_sets]

Parameters differences:

--- Ferm::Service[envoy_tls_termination_src_sets].orig
+++ Ferm::Service[envoy_tls_termination_src_sets]

+    ensure              => present
+    port                => 443
+    proto               => tcp
+    src_sets            => ['CACHES']
+    prio                => 10
+    notrack             => True
+    unrestricted_access => False
+    desc                =>

File[/usr/local/sbin/envoyproxy-hot-restarter]

Parameters differences:

--- File[/usr/local/sbin/envoyproxy-hot-restarter].orig
+++ File[/usr/local/sbin/envoyproxy-hot-restarter]

+    mode   => 0555
+    source => puppet:///modules/envoyproxy/hot_restarter/hot-restarter.py
+    owner  => root
+    ensure => present
+    group  => root

File[/etc/logrotate.d/exim4-paniclog]

Parameters differences:

--- File[/etc/logrotate.d/exim4-paniclog].orig
+++ File[/etc/logrotate.d/exim4-paniclog]

+    mode   => 0444
+    source => puppet:///modules/exim4/logrotate/exim4-paniclog
+    owner  => root
+    ensure => present
+    group  => root

File[/etc/php/8.2/mods-available/apcu.ini]

Content differences:

--- /etc/php/8.2/mods-available/apcu.ini.orig
+++ /etc/php/8.2/mods-available/apcu.ini
@@ -2,5 +2,6 @@
 ;
 ; configuration for the apcu PHP extension
 ; priority=20
+apc.shm_size = 4096M
 extension = apcu.so

Sysctl::Conffile[TCP Fast Open]

Parameters differences:

--- Sysctl::Conffile[TCP Fast Open].orig
+++ Sysctl::Conffile[TCP Fast Open]

+    priority           => 70
+    no_priority_prefix => False
+    ensure             => present

Service[wmf_auto_restart_prometheus-apache-exporter.timer]

Parameters differences:

--- Service[wmf_auto_restart_prometheus-apache-exporter.timer].orig
+++ Service[wmf_auto_restart_prometheus-apache-exporter.timer]

+    provider => systemd
+    enable   => True
+    ensure   => running

File[/etc/logrotate.d/phabricator_stats_job_yearly_metrics]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_stats_job_yearly_metrics].orig
+++ File[/etc/logrotate.d/phabricator_stats_job_yearly_metrics]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_stats_job_yearly_metrics.orig
+++ /etc/logrotate.d/phabricator_stats_job_yearly_metrics
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_stats_job_yearly_metrics
+
+/var/log/phabricator_stats_job_yearly_metrics/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Phabricator::Logmail[project_changes]

Parameters differences:

--- Phabricator::Logmail[project_changes].orig
+++ Phabricator::Logmail[project_changes]

+    ensure           => absent
+    weekday          => Monday
+    rcpt_address     => ['phabricator-reports@lists.wikimedia.org']
+    mysql_slave_port => 3323
+    mysql_slave      => m3-slave.codfw.wmnet
+    minute           => 0
+    basedir          => /usr/local/bin
+    sndr_address     => aklapper@wikimedia.org
+    mysql_db_name    => phabricator_project
+    require          => Package[phabricator/deployment]
+    hour             => 0

File[/etc/logrotate.d/wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_prometheus-apache-exporter].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_prometheus-apache-exporter]

+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_prometheus-apache-exporter.orig
+++ /etc/logrotate.d/wmf_auto_restart_prometheus-apache-exporter
@@ -0,0 +1,12 @@
+# logrotate(8) config for wmf_auto_restart_prometheus-apache-exporter
+
+/var/log/wmf_auto_restart_prometheus-apache-exporter/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Systemd::Unit[wmf_auto_restart_aphlict.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_aphlict.service].orig
+++ Systemd::Unit[wmf_auto_restart_aphlict.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => wmf_auto_restart_aphlict.service
+    require           => ['Class[Systemd]']

File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-wmf-qls.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-wmf-qls.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-wmf-qls.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-stats-job-quarterly-wmf-qls.conf.orig
+++ /etc/rsyslog.d/40-phabricator-stats-job-quarterly-wmf-qls.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_stats_job_quarterly_wmf_qls" then {
+    action(
+        type="omfile" file="/var/log/phabricator_stats_job_quarterly_wmf_qls/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

File[/srv/dumps/WARNING_NEVER_PUT_PRIVATE_DATA_HERE_THIS_IS_SYNCED_TO_PUBLIC]

Parameters differences:

--- File[/srv/dumps/WARNING_NEVER_PUT_PRIVATE_DATA_HERE_THIS_IS_SYNCED_TO_PUBLIC].orig
+++ File[/srv/dumps/WARNING_NEVER_PUT_PRIVATE_DATA_HERE_THIS_IS_SYNCED_TO_PUBLIC]

+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Motd::Message[phabricator]

Parameters differences:

--- Motd::Message[phabricator].orig
+++ Motd::Message[phabricator]

+    priority => 5
+    ensure   => present
+    message  => phab2003 is a Phabricator (main) server (phabricator)

Sudo::Group[phabricator-admin]

Parameters differences:

--- Sudo::Group[phabricator-admin].orig
+++ Sudo::Group[phabricator-admin]

+    privileges => ['ALL = NOPASSWD: /srv/phab/phabricator/bin/cache purge --caches user', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/herald', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/remove', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/repository', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/phd', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/policy', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/worker', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/bulk make-silent --id *', 'ALL = NOPASSWD: /srv/phab/phabricator/bin/auth strip --all-types --user *']
+    require    => ['Class[Sudo]']
+    group      => phabricator-admin
+    ensure     => present

Service[rsync-phabricator-home-dirs.timer]

Parameters differences:

--- Service[rsync-phabricator-home-dirs.timer].orig
+++ Service[rsync-phabricator-home-dirs.timer]

+    before   => ['Exec[systemd daemon-reload for rsync-phabricator-home-dirs.timer (rsync-phabricator-home-dirs.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

Logrotate::Conf[envoy]

Parameters differences:

--- Logrotate::Conf[envoy].orig
+++ Logrotate::Conf[envoy]

+    ensure => present

Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.timer (phabricator_stats_job_tech_news_weekly_stats.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.timer (phabricator_stats_job_tech_news_weekly_stats.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.timer (phabricator_stats_job_tech_news_weekly_stats.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/etc/exim4/system_filter]

Parameters differences:

--- File[/etc/exim4/system_filter].orig
+++ File[/etc/exim4/system_filter]

+    mode    => 0444
+    owner   => root
+    ensure  => present
+    require => Package[exim4-config]
+    group   => Debian-exim

Content differences:

--- /etc/exim4/system_filter.orig
+++ /etc/exim4/system_filter
@@ -0,0 +1,24 @@
+# Exim filter
+
+if first_delivery then
+	if $acl_m0 is not "trusted relay" then
+		# Remove any SpamAssassin headers and add local ones
+		headers remove X-Spam-Score:X-Spam-Report:X-Spam-Checker-Version:X-Spam-Status:X-Spam-Level:X-Spam-Flag
+	endif
+	if $acl_m0 is not "" and $acl_m0 is not "trusted relay" then
+		headers add "X-Spam-Score: $acl_m0"
+		headers add "X-Spam-Report: $acl_m1"
+	endif
+endif
+
+# reject these excessive bounces temporarily
+if $header_from: matches "MAILER-DAEMON@fickja.de" and $header_to: matches "abuse@wikipedia.org" then
+	fail text "Message rejected due to excessive volume. If you believe this is an error please contact postmaster@wikimedia.org"
+endif
+if $header_from: matches "keineantwortadresse@web.de" and $header_to: matches "abuse@wikipedia.org" then
+	fail text "Message rejected due to excessive volume. If you believe this is an error please contact postmaster@wikimedia.org"
+endif
+# quietly drop this spam T298038
+if $header_from: matches @unn-212-102-49-71\\.cdn77\\.com and $header_to: matches abuse@wikimediafoundation\\.org then
+	seen finish
+endif

File[/var/log/wmf_auto_restart_aphlict]

Parameters differences:

--- File[/var/log/wmf_auto_restart_aphlict].orig
+++ File[/var/log/wmf_auto_restart_aphlict]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Service[bacula-fd]

Parameters differences:

--- Service[bacula-fd].orig
+++ Service[bacula-fd]

+    require => Package[bacula-fd]
+    ensure  => running

Service[rsync]

Parameters differences:

--- Service[rsync].orig
+++ Service[rsync]

+    subscribe => ['Concat[/etc/rsyncd.conf]', 'File[/etc/default/rsync]']
+    require   => Package[rsync]
+    enable    => True
+    ensure    => running

Rsyslog::Conf[phabricator_stats_job_community_metrics]

Parameters differences:

--- Rsyslog::Conf[phabricator_stats_job_community_metrics].orig
+++ Rsyslog::Conf[phabricator_stats_job_community_metrics]

+    mode     => 0444
+    require  => File[/var/log/phabricator_stats_job_community_metrics]
+    priority => 40
+    ensure   => absent

Systemd::Timer::Job[phabricator_stats_job_community_metrics]

Parameters differences:

--- Systemd::Timer::Job[phabricator_stats_job_community_metrics].orig
+++ Systemd::Timer::Job[phabricator_stats_job_community_metrics]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => phabricator statistics mail - community_metrics
+    command                   => /usr/local/bin/community_metrics.sh
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-1 0:0:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

Ssh::Userkey[urbanecm]

Parameters differences:

--- Ssh::Userkey[urbanecm].orig
+++ Ssh::Userkey[urbanecm]

+    user   => urbanecm
+    ensure => present

Motd::Script[phabricator::migration]

Parameters differences:

--- Motd::Script[phabricator::migration].orig
+++ Motd::Script[phabricator::migration]

-    priority => 5
-    ensure   => present

File[/lib/systemd/system/rsync-phabricator-home-dirs.service]

Parameters differences:

--- File[/lib/systemd/system/rsync-phabricator-home-dirs.service].orig
+++ File[/lib/systemd/system/rsync-phabricator-home-dirs.service]

+    notify => Exec[systemd daemon-reload for rsync-phabricator-home-dirs.service (rsync-phabricator-home-dirs.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/rsync-phabricator-home-dirs.service.orig
+++ /lib/systemd/system/rsync-phabricator-home-dirs.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Transfer data periodically between hosts
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/sync-phabricator-home-dirs

Exec[create-/etc/bacula-keypair]

Parameters differences:

--- Exec[create-/etc/bacula-keypair].orig
+++ Exec[create-/etc/bacula-keypair]

+    before  => File[/etc/bacula/ssl/server-keypair.pem]
+    require => File[/etc/bacula/ssl]
+    command => /bin/cat                          /var/lib/puppet/ssl/private_keys/phab2003.codfw.wmnet.pem                          /var/lib/puppet/ssl/certs/phab2003.codfw.wmnet.pem                         > /etc/bacula/ssl/server-keypair.pem
+    creates => /etc/bacula/ssl/server-keypair.pem

File[/var/lib/prometheus/node.d/role_owner.prom]

Content differences:

--- /var/lib/prometheus/node.d/role_owner.prom.orig
+++ /var/lib/prometheus/node.d/role_owner.prom
@@ -1,3 +1,3 @@
 # HELP role_owner The team owner of the server role
 # TYPE role_owner gauge
-role_owner{team="collaboration-services",role="phabricator::migration",cluster="misc"} 1.0
+role_owner{team="collaboration-services",role="phabricator",cluster="misc"} 1.0

Package[python3-mysqldb]

Parameters differences:

--- Package[python3-mysqldb].orig
+++ Package[python3-mysqldb]

+    provider => apt
+    ensure   => present

Systemd::Mask[phd.service]

Parameters differences:

--- Systemd::Mask[phd.service].orig
+++ Systemd::Mask[phd.service]

+    unit => phd.service

Phabricator::Libext[/srv/phab/libext/ava/src]

Parameters differences:

--- Phabricator::Libext[/srv/phab/libext/ava/src].orig
+++ Phabricator::Libext[/srv/phab/libext/ava/src]

+    require => ['Package[phabricator/deployment]']
+    libname => /srv/phab/libext/ava/src
+    rootdir => /srv/phab

File[/etc/rsyslog.d/40-wmf-auto-restart-aphlict.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-aphlict.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-aphlict.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-aphlict.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-aphlict.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "wmf_auto_restart_aphlict" then {
+    action(
+        type="omfile" file="/var/log/wmf_auto_restart_aphlict/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Class[Profile::Phabricator::Monitoring]

Parameters differences:

--- Class[Profile::Phabricator::Monitoring].orig
+++ Class[Profile::Phabricator::Monitoring]

+    active_server => phab1004.eqiad.wmnet

Exec[systemd daemon-reload for phabricator_stats_job_project_changes.timer (phabricator_stats_job_project_changes.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_project_changes.timer (phabricator_stats_job_project_changes.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_project_changes.timer (phabricator_stats_job_project_changes.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Exec[apt_update_php]

Parameters differences:

--- Exec[apt_update_php].orig
+++ Exec[apt_update_php]

+    refreshonly => True
+    logoutput   => True
+    command     => /usr/bin/apt-get update

Systemd::Unit[phabricator_clean_tmp_files.timer]

Parameters differences:

--- Systemd::Unit[phabricator_clean_tmp_files.timer].orig
+++ Systemd::Unit[phabricator_clean_tmp_files.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => present
+    unit              => phabricator_clean_tmp_files.timer
+    require           => ['Class[Systemd]']

Group[phabricator-bulk-manager]

Parameters differences:

--- Group[phabricator-bulk-manager].orig
+++ Group[phabricator-bulk-manager]

+    ensure    => present
+    allowdupe => False
+    gid       => 819

Class[Bacula::Client]

Parameters differences:

--- Class[Bacula::Client].orig
+++ Class[Bacula::Client]

+    client_version   => 9
+    director         => backup1014.eqiad.wmnet
+    directorpassword => ZmIW52TA72psk8uust0B6ujGHYzzJbW6
+    fdport           => 9102
+    job_retention    => 90 days
+    file_retention   => 90 days
+    catalog          => production

File[/etc/apache2/sites-available/50-phabricator.conf]

Parameters differences:

--- File[/etc/apache2/sites-available/50-phabricator.conf].orig
+++ File[/etc/apache2/sites-available/50-phabricator.conf]

+    notify => Service[apache2]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/apache2/sites-available/50-phabricator.conf.orig
+++ /etc/apache2/sites-available/50-phabricator.conf
@@ -0,0 +1,84 @@
+# Apache configuration for Phabricator (https://phabricator.wikimedia.org)
+
+# This file is managed by Puppet.
+
+<VirtualHost *:80>
+  ServerName phabricator.wikimedia.org
+  ServerAlias phab.wmfusercontent.org
+  ServerAlias bugzilla.wikimedia.org
+  ServerAlias bugs.wikimedia.org
+
+  DocumentRoot /srv/phab/phabricator/webroot
+
+  SetEnv PHABRICATOR_ENV www
+
+    <IfModule mod_remoteip.c>
+    RemoteIPHeader X-Client-IP
+    RemoteIPInternalProxy 10.192.27.12 127.0.0.1 2620:0:860:114:10:192:27:12 :1 fe80::425b:7fff:fef3:a3c4
+  </IfModule>
+  
+  RewriteEngine on
+
+  # Allow longer URLs for phatality / form prefill
+  LimitRequestLine 16384
+
+  # Read robots.txt from disk for the alternative domain
+  RewriteCond "%{HTTP_HOST}" "phab\.wmfusercontent\.org"
+  RewriteRule ^/robots.txt$ /srv/phab/robots.txt [L]
+
+  # Read robots.txt from disk for the alternative domain
+  RewriteCond "%{HTTP_HOST}" "bugzilla\.wikimedia\.org"
+  RewriteRule ^/robots.txt$ /srv/phab/robots.txt [L]
+
+  # Read robots.txt from disk for the alternative domain
+  RewriteCond "%{HTTP_HOST}" "bugs\.wikimedia\.org"
+  RewriteRule ^/robots.txt$ /srv/phab/robots.txt [L]
+
+
+
+  <Files "robots.txt">
+    Require all granted
+  </Files>
+
+
+  <Directory "/srv/phab/phabricator/webroot">
+    Options Indexes FollowSymLinks MultiViews
+    Require all granted
+  </Directory>
+
+  # needed to allow http basic auth (using https auth)
+  SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
+
+  # php-fpm
+  <FilesMatch \.php$>
+      SetHandler "proxy:unix:/run/php/fpm-www.sock|fcgi://localhost/"
+  </FilesMatch>
+
+  LogLevel warn
+  ErrorLog /var/log/apache2/phabricator_error.log
+  CustomLog /var/log/apache2/phabricator_access.log cee_ecs_accesslog_170
+  ServerSignature Off
+
+
+  RewriteCond %{HTTP:X-Forwarded-Proto} !https
+  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
+
+  # Redirect server alias home to the main server name
+  RewriteCond "%{HTTP_HOST}" "phab\.wmfusercontent\.org"
+  RewriteRule ^/$ "https://phabricator.wikimedia.org" [R,L]
+  # Redirect server alias home to the main server name
+  RewriteCond "%{HTTP_HOST}" "bugzilla\.wikimedia\.org"
+  RewriteRule ^/$ "https://phabricator.wikimedia.org" [R,L]
+  # Redirect server alias home to the main server name
+  RewriteCond "%{HTTP_HOST}" "bugs\.wikimedia\.org"
+  RewriteRule ^/$ "https://phabricator.wikimedia.org" [R,L]
+
+
+
+  RewriteRule ^/rsrc/(.*)     -                       [L,QSA]
+  RewriteRule ^/favicon.ico   -                       [L,QSA]
+  RewriteRule ^/project/sprint/board/(.*) /project/board/$1 [L,QSA,R=301]
+  RewriteRule ^/maniphest/task/create/? /maniphest/task/edit/form/1/ [L,QSA,NE,R=301]
+  RewriteRule ^(.*)$          /index.php?__path__=$1  [B,L,QSA,UnsafeAllow3F]
+
+</VirtualHost>

File[/etc/rsyslog.d/40-phabricator-stats-job-tech-news-weekly-stats.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-stats-job-tech-news-weekly-stats.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-stats-job-tech-news-weekly-stats.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-stats-job-tech-news-weekly-stats.conf.orig
+++ /etc/rsyslog.d/40-phabricator-stats-job-tech-news-weekly-stats.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_stats_job_tech_news_weekly_stats" then {
+    action(
+        type="omfile" file="/var/log/phabricator_stats_job_tech_news_weekly_stats/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.service (phabricator_stats_job_community_metrics.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.service (phabricator_stats_job_community_metrics.service)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.service (phabricator_stats_job_community_metrics.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/etc/envoy/listeners.d]

Parameters differences:

--- File[/etc/envoy/listeners.d].orig
+++ File[/etc/envoy/listeners.d]

+    mode    => 0755
+    recurse => True
+    owner   => root
+    ensure  => directory
+    purge   => True
+    group   => root

File[/lib/systemd/system/aphlict.service]

Parameters differences:

--- File[/lib/systemd/system/aphlict.service].orig
+++ File[/lib/systemd/system/aphlict.service]

+    notify => Exec[systemd daemon-reload for aphlict.service (aphlict)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/aphlict.service.orig
+++ /lib/systemd/system/aphlict.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Aphlict - Phabricator notification service
+After=network.target auditd.service
+
+[Service]
+Type=forking
+User=aphlict
+Group=aphlict
+PIDFile=/var/run/aphlict/aphlict.pid
+Environment="PHABRICATOR_ENV=aphlict"
+ExecStartPre=-/bin/mkdir -p /var/run/aphlict/
+ExecStartPre=/bin/chown -R aphlict:aphlict /var/run/aphlict/
+ExecStart=/srv/phab/phabricator/bin/aphlict start --config /srv/phab/aphlict/config.json
+ExecStop=/srv/phab/phabricator/bin/aphlict stop --config /srv/phab/aphlict/config.json
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+Alias=aphlict.service

Service[wmf_auto_restart_envoyproxy.timer]

Parameters differences:

--- Service[wmf_auto_restart_envoyproxy.timer].orig
+++ Service[wmf_auto_restart_envoyproxy.timer]

+    before   => ['Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.timer (wmf_auto_restart_envoyproxy.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

File[/lib/systemd/system/phabricator_clean_tmp_files.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_clean_tmp_files.timer].orig
+++ File[/lib/systemd/system/phabricator_clean_tmp_files.timer]

+    notify => Exec[systemd daemon-reload for phabricator_clean_tmp_files.timer (phabricator_clean_tmp_files.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_clean_tmp_files.timer.orig
+++ /lib/systemd/system/phabricator_clean_tmp_files.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_clean_tmp_files.service
+
+[Timer]
+Unit=phabricator_clean_tmp_files.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-*-* 07:00:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

File[/etc/envoy/ssl]

Parameters differences:

--- File[/etc/envoy/ssl].orig
+++ File[/etc/envoy/ssl]

+    mode    => 0740
+    recurse => True
+    owner   => envoy
+    ensure  => directory
+    group   => envoy

File[/etc/rsyslog.d/00-imfile.conf]

Parameters differences:

--- File[/etc/rsyslog.d/00-imfile.conf].orig
+++ File[/etc/rsyslog.d/00-imfile.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/rsyslog.d/00-imfile.conf.orig
+++ /etc/rsyslog.d/00-imfile.conf
@@ -0,0 +1 @@
+module(load="imfile")

File[/etc/rsyslog.d/40-phabricator-task-dump.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-task-dump.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-task-dump.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-task-dump.conf.orig
+++ /etc/rsyslog.d/40-phabricator-task-dump.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_task_dump" then {
+    action(
+        type="omfile" file="/var/log/phabricator_task_dump/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Ferm::Service[rsyncd_access_srv_dumps]

Parameters differences:

--- Ferm::Service[rsyncd_access_srv_dumps].orig
+++ Ferm::Service[rsyncd_access_srv_dumps]

+    ensure              => present
+    port                => [873, 1873]
+    proto               => tcp
+    prio                => 10
+    srange              => ['phab1004.eqiad.wmnet', 'phab2002.codfw.wmnet', 'clouddumps1001.wikimedia.org', 'clouddumps1002.wikimedia.org']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Exec[/srv/phab/libext/misc_static_dir_exists]

Parameters differences:

--- Exec[/srv/phab/libext/misc_static_dir_exists].orig
+++ Exec[/srv/phab/libext/misc_static_dir_exists]

+    creates => /srv/phab/phabricator/webroot/rsrc//srv/phab/libext/misc
+    require => File[/srv/phab]
+    command => /bin/ln -s /srv/phab/libext//srv/phab/libext/misc/rsrc/webroot-static /srv/phab/phabricator/webroot/rsrc//srv/phab/libext/misc
+    onlyif  => /usr/bin/test -e /srv/phab/libext//srv/phab/libext/misc/rsrc/webroot-static

Concat_fragment[/etc/rsyncd.conf-srv-dumps]

Parameters differences:

--- Concat_fragment[/etc/rsyncd.conf-srv-dumps].orig
+++ Concat_fragment[/etc/rsyncd.conf-srv-dumps]

+    order  => 10
+    tag    => _etc_rsyncd.conf
+    target => /etc/rsyncd.conf

Content differences:

--- /etc/rsyncd.conf-srv-dumps.orig
+++ /etc/rsyncd.conf-srv-dumps
@@ -0,0 +1,20 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+
+[ srv-dumps ]
+path            = /srv/dumps
+read only       = yes
+write only      = no
+list            = yes
+uid             = 0
+gid             = 0
+use chroot      = yes
+
+
+max connections = 0
+
+
+
+
+hosts allow = phab1004.eqiad.wmnet phab2002.codfw.wmnet clouddumps1001.wikimedia.org clouddumps1002.wikimedia.org localhost
+

Systemd::Service[phabricator_stats_job_community_metrics]

Parameters differences:

--- Systemd::Service[phabricator_stats_job_community_metrics].orig
+++ Systemd::Service[phabricator_stats_job_community_metrics]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_stats_job_community_metrics.service]
+    monitoring_contact_group => admins

Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.timer]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.timer].orig
+++ Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_tech_news_weekly_stats.timer
+    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.service (phabricator_stats_job_quarterly_wmf_qls.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.service (phabricator_stats_job_quarterly_wmf_qls.service)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.service (phabricator_stats_job_quarterly_wmf_qls.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/etc/logrotate.d/phabricator_stats_job_community_metrics]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_stats_job_community_metrics].orig
+++ File[/etc/logrotate.d/phabricator_stats_job_community_metrics]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_stats_job_community_metrics.orig
+++ /etc/logrotate.d/phabricator_stats_job_community_metrics
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_stats_job_community_metrics
+
+/var/log/phabricator_stats_job_community_metrics/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

File[/var/log/rsync-phabricator-repos]

Parameters differences:

--- File[/var/log/rsync-phabricator-repos].orig
+++ File[/var/log/rsync-phabricator-repos]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

File[/lib/systemd/system/wmf_auto_restart_envoyproxy.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_envoyproxy.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_envoyproxy.service]

+    notify => Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.service (wmf_auto_restart_envoyproxy.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/wmf_auto_restart_envoyproxy.service.orig
+++ /lib/systemd/system/wmf_auto_restart_envoyproxy.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Auto restart job: envoyproxy
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/wmf-auto-restart -s envoyproxy

File[/etc/phabricator]

Parameters differences:

--- File[/etc/phabricator].orig
+++ File[/etc/phabricator]

+    mode   => 0750
+    owner  => root
+    ensure => directory
+    group  => phab-deploy

File[/srv/phab/phabricator//support/aphlict/server/node_modules]

Parameters differences:

--- File[/srv/phab/phabricator//support/aphlict/server/node_modules].orig
+++ File[/srv/phab/phabricator//support/aphlict/server/node_modules]

+    notify => ['Service[aphlict]']
+    owner  => root
+    ensure => link
+    target => /srv/phab/aphlict/node_modules
+    group  => root

Logrotate::Conf[phabricator_task_dump]

Parameters differences:

--- Logrotate::Conf[phabricator_task_dump].orig
+++ Logrotate::Conf[phabricator_task_dump]

+    ensure => absent

File[/etc/sudoers.d/phabricator-bulk-manager]

Parameters differences:

--- File[/etc/sudoers.d/phabricator-bulk-manager].orig
+++ File[/etc/sudoers.d/phabricator-bulk-manager]

+    mode         => 0440
+    owner        => root
+    ensure       => present
+    validate_cmd => /usr/sbin/visudo -cqf %
+    group        => root

Content differences:

--- /etc/sudoers.d/phabricator-bulk-manager.orig
+++ /etc/sudoers.d/phabricator-bulk-manager
@@ -0,0 +1,3 @@
+# This file is managed by Puppet!
+
+%phabricator-bulk-manager ALL = NOPASSWD: /srv/phab/phabricator/bin/bulk make-silent --id *

File[/etc/exim4/aliases]

Parameters differences:

--- File[/etc/exim4/aliases].orig
+++ File[/etc/exim4/aliases]

+    mode    => 0755
+    owner   => root
+    ensure  => directory
+    require => Package[exim4-config]
+    group   => Debian-exim

Systemd::Service[phabricator_stats_job_yearly_metrics]

Parameters differences:

--- Systemd::Service[phabricator_stats_job_yearly_metrics].orig
+++ Systemd::Service[phabricator_stats_job_yearly_metrics]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_stats_job_yearly_metrics.service]
+    monitoring_contact_group => admins

Systemd::Timer[backup-home-dirs]

Parameters differences:

--- Systemd::Timer[backup-home-dirs].orig
+++ Systemd::Timer[backup-home-dirs]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* 0:10:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => backup-home-dirs.service
+    splay              => 0

Class[Profile::Tlsproxy::Envoy]

Parameters differences:

--- Class[Profile::Tlsproxy::Envoy].orig
+++ Class[Profile::Tlsproxy::Envoy]

+    error_page                => False
+    services                  => [{'server_names': ['*'], 'port': 80}]
+    sni_support               => no
+    header_key_format         => none
+    firewall_global           => False
+    request_headers_to_add    => {}
+    global_cert_name          => phabricator.discovery.wmnet
+    upstream_addr             => phab2003.codfw.wmnet
+    upstream_tls              => False
+    tls_port                  => 443
+    use_remote_address        => False
+    websockets                => True
+    ssl_provider              => cfssl
+    firewall_src_sets         => ['CACHES']
+    listen_ipv6               => True
+    upstream_response_timeout => 65.0
+    fast_open_queue           => 150
+    cfssl_label               => discovery2026
+    retries                   => True
+    rate_limit_enabled        => False
+    local_otel_reporting_pct  => 0.0
+    require                   => ['Class[Profile::Envoy]']
+    cfssl_options             => {'hosts': ['phabricator.wikimedia.org', 'phab.wmfusercontent.org', 'bugs.wikimedia.org', 'bugzilla.wikimedia.org']}
+    access_log                => False

Systemd::Unit[wmf_auto_restart_aphlict.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_aphlict.timer].orig
+++ Systemd::Unit[wmf_auto_restart_aphlict.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => wmf_auto_restart_aphlict.timer
+    require           => ['Class[Systemd]']

Rsyslog::Conf[input-file-apache2-access]

Parameters differences:

--- Rsyslog::Conf[input-file-apache2-access].orig
+++ Rsyslog::Conf[input-file-apache2-access]

+    mode     => 0444
+    require  => Rsyslog::Conf[imfile]
+    priority => 10
+    ensure   => present

Package[python3-pygments]

Parameters differences:

--- Package[python3-pygments].orig
+++ Package[python3-pygments]

+    provider => apt
+    ensure   => present

Profile::Auto_restarts::Service[envoyproxy]

Parameters differences:

--- Profile::Auto_restarts::Service[envoyproxy].orig
+++ Profile::Auto_restarts::Service[envoyproxy]

+    ensure => absent

Rsyslog::Conf[imfile]

Parameters differences:

--- Rsyslog::Conf[imfile].orig
+++ Rsyslog::Conf[imfile]

+    mode     => 0444
+    priority => 0
+    ensure   => present

Sysctl::Parameters[phabricator network tuning]

Parameters differences:

--- Sysctl::Parameters[phabricator network tuning].orig
+++ Sysctl::Parameters[phabricator network tuning]

+    values             => {'net.ipv4.ip_local_port_range': [4001, 65534], 'net.ipv4.tcp_tw_reuse': 1}
+    priority           => 70
+    no_priority_prefix => False
+    ensure             => present

Logrotate::Conf[phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- Logrotate::Conf[phabricator_stats_job_quarterly_wmf_qls].orig
+++ Logrotate::Conf[phabricator_stats_job_quarterly_wmf_qls]

+    ensure => absent

Exec[create chained cert /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]

Parameters differences:

--- Exec[create chained cert /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem].orig
+++ Exec[create chained cert /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]

+    require   => Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh on intermediate ca change]
+    unless    => /usr/bin/test "$(/bin/cat /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem | sha512sum)" == "$(/bin/cat /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem | sha512sum)"

+    command   => /bin/cat /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem > /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem
+    subscribe => ['Exec[renew certificate - discovery2026__phabricator_discovery_wmnet_server]', 'File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]', 'File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem]']

Systemd::Unit[wmf_auto_restart_envoyproxy.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_envoyproxy.service].orig
+++ Systemd::Unit[wmf_auto_restart_envoyproxy.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => wmf_auto_restart_envoyproxy.service
+    require           => ['Class[Systemd]']

Systemd::Unit[aphlict]

Parameters differences:

--- Systemd::Unit[aphlict].orig
+++ Systemd::Unit[aphlict]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => aphlict
+    require           => ['Class[Systemd]']

File[/etc/envoy/listeners.d/00-tls_terminator_443.yaml]

Parameters differences:

--- File[/etc/envoy/listeners.d/00-tls_terminator_443.yaml].orig
+++ File[/etc/envoy/listeners.d/00-tls_terminator_443.yaml]

+    notify => Exec[verify-envoy-config]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/envoy/listeners.d/00-tls_terminator_443.yaml.orig
+++ /etc/envoy/listeners.d/00-tls_terminator_443.yaml
@@ -0,0 +1,55 @@
+address:
+    socket_address:
+        port_value: 443
+        address: '::'
+        ipv4_compat: true
+listener_filters:
+- name: "envoy.filters.listener.tls_inspector"
+  typed_config:
+    "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+tcp_fast_open_queue_length: 150
+filter_chains:
+# Non-SNI support
+- transport_socket:
+    name: envoy.transport_sockets.tls
+    typed_config:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+      common_tls_context:
+        tls_certificates:
+        - certificate_chain: { filename: "/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem" }
+          private_key: { filename: "/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server-key.pem" }
+  filters:
+  - name: envoy.http_connection_manager
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+      upgrade_configs:
+      - upgrade_type: "websocket"
+      stat_prefix: ingress_http
+      route_config:
+        virtual_hosts:
+        - name: non_sni_port_80
+          domains: ["*"]
+          routes:
+          - match: { prefix: "/" }
+            route:
+              cluster: local_port_80
+              timeout: 65.0s
+              retry_policy:
+                num_retries: 1
+                retry_on: "5xx"
+      http_filters:
+      - name: envoy.filters.http.router
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+      http_protocol_options:
+        accept_http_10: true
+      server_header_transformation: APPEND_IF_ABSENT
+      internal_address_config:
+        unix_sockets: true
+        cidr_ranges:
+        - address_prefix: 10.0.0.0
+          prefix_len: 8
+        - address_prefix: 127.0.0.1
+          prefix_len: 32
+        - address_prefix: ::1
+          prefix_len: 128

Logrotate::Conf[phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- Logrotate::Conf[phabricator_stats_job_quarterly_metrics].orig
+++ Logrotate::Conf[phabricator_stats_job_quarterly_metrics]

+    ensure => absent

File[/etc/rsyslog.d/40-phabricator-clean-tmp-files.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-clean-tmp-files.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-clean-tmp-files.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-clean-tmp-files.conf.orig
+++ /etc/rsyslog.d/40-phabricator-clean-tmp-files.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_clean_tmp_files" then {
+    action(
+        type="omfile" file="/var/log/phabricator_clean_tmp_files/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

File[/var/log/wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- File[/var/log/wmf_auto_restart_prometheus-apache-exporter].orig
+++ File[/var/log/wmf_auto_restart_prometheus-apache-exporter]

+    mode   => 0755
+    owner  => root
+    ensure => directory
+    force  => True
+    backup => False
+    group  => root

File[/lib/systemd/system/wmf_auto_restart_envoyproxy.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_envoyproxy.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_envoyproxy.timer]

+    notify => Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.timer (wmf_auto_restart_envoyproxy.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/wmf_auto_restart_envoyproxy.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_envoyproxy.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of wmf_auto_restart_envoyproxy.service
+
+[Timer]
+Unit=wmf_auto_restart_envoyproxy.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 19:9:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

File[/lib/systemd/system/wmf_auto_restart_aphlict.timer]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_aphlict.timer].orig
+++ File[/lib/systemd/system/wmf_auto_restart_aphlict.timer]

+    notify => Exec[systemd daemon-reload for wmf_auto_restart_aphlict.timer (wmf_auto_restart_aphlict.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/wmf_auto_restart_aphlict.timer.orig
+++ /lib/systemd/system/wmf_auto_restart_aphlict.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of wmf_auto_restart_aphlict.service
+
+[Timer]
+Unit=wmf_auto_restart_aphlict.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 11:39:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Systemd::Service[backup-home-dirs]

Parameters differences:

--- Systemd::Service[backup-home-dirs].orig
+++ Systemd::Service[backup-home-dirs]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[backup-home-dirs.service]
+    monitoring_contact_group => admins

Systemd::Syslog[wmf_auto_restart_aphlict]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_aphlict].orig
+++ Systemd::Syslog[wmf_auto_restart_aphlict]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

File[/etc/systemd/system/envoyproxy.service.d]

Parameters differences:

--- File[/etc/systemd/system/envoyproxy.service.d].orig
+++ File[/etc/systemd/system/envoyproxy.service.d]

+    mode   => 0555
+    owner  => root
+    ensure => directory
+    group  => root

Systemd::Syslog[backup-home-dirs]

Parameters differences:

--- Systemd::Syslog[backup-home-dirs].orig
+++ Systemd::Syslog[backup-home-dirs]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Systemd::Syslog[phabricator_task_dump]

Parameters differences:

--- Systemd::Syslog[phabricator_task_dump].orig
+++ Systemd::Syslog[phabricator_task_dump]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

File_line[auto_restart_file_presence_prometheus-apache-exporter]

Parameters differences:

--- File_line[auto_restart_file_presence_prometheus-apache-exporter].orig
+++ File_line[auto_restart_file_presence_prometheus-apache-exporter]

+    require => File[/etc/debdeploy-client/autorestarts.conf]
+    line    => prometheus-apache-exporter
+    ensure  => present
+    path    => /etc/debdeploy-client/autorestarts.conf

Systemd::Unit[phabricator_stats_job_community_metrics.timer]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_community_metrics.timer].orig
+++ Systemd::Unit[phabricator_stats_job_community_metrics.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_community_metrics.timer
+    require           => ['Class[Systemd]']

File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]

Parameters differences:

--- File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]

+    mode   => 0440
+    source => puppet:///modules/profile/pki/intermediates/discovery2026-cert.pem
+    owner  => envoy
+    ensure => file
+    group  => envoy

File[/etc/exim4/update-exim4.conf.conf]

Parameters differences:

--- File[/etc/exim4/update-exim4.conf.conf].orig
+++ File[/etc/exim4/update-exim4.conf.conf]

+    mode    => 0444
+    require => Package[exim4-config]
+    owner   => root
+    group   => root

Content differences:

--- /etc/exim4/update-exim4.conf.conf.orig
+++ /etc/exim4/update-exim4.conf.conf
@@ -0,0 +1 @@
+dc_eximconfig_configtype=none

Rsyslog::Conf[phabricator_clean_tmp_files]

Parameters differences:

--- Rsyslog::Conf[phabricator_clean_tmp_files].orig
+++ Rsyslog::Conf[phabricator_clean_tmp_files]

+    mode     => 0444
+    require  => File[/var/log/phabricator_clean_tmp_files]
+    priority => 40
+    ensure   => present

Systemd::Timer::Job[wmf_auto_restart_aphlict]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_aphlict].orig
+++ Systemd::Timer::Job[wmf_auto_restart_aphlict]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => Auto restart job: aphlict
+    command                   => /usr/local/sbin/wmf-auto-restart -s aphlict
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 11:39:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    require                   => File[/usr/local/sbin/wmf-auto-restart]
+    logfile_basedir           => /var/log

File[/etc/bacula/bacula-fd.conf]

Parameters differences:

--- File[/etc/bacula/bacula-fd.conf].orig
+++ File[/etc/bacula/bacula-fd.conf]

+    notify  => Service[bacula-fd]
+    mode    => 0400
+    owner   => root
+    ensure  => present
+    require => ['Package[bacula-fd]']
+    group   => root

Content differences:

--- /etc/bacula/bacula-fd.conf.orig
+++ /etc/bacula/bacula-fd.conf
@@ -0,0 +1,47 @@
+# This file has been autogenerated by puppet. Don't edit by hand
+
+# The directors allowed to connect to us
+Director {
+    Name = "backup1014.eqiad.wmnet"
+    Password = "ZmIW52TA72psk8uust0B6ujGHYzzJbW6"
+    # Have the Control channel encrypted
+    TLS Enable = yes
+    TLS Require = yes
+    TLS CA Certificate File = "/etc/ssl/certs/wmf-ca-certificates.crt"
+    TLS Verify Peer = yes
+    TLS Certificate = "/etc/bacula/ssl/cert.pem"
+    TLS Key = "/etc/bacula/ssl/server.key"
+}
+
+#
+# "Global" File daemon configuration specifications
+#
+FileDaemon {
+    Name = "phab2003.codfw.wmnet-fd"
+    FDport = 9102
+    WorkingDirectory = /var/lib/bacula
+    Pid Directory = /var/run/bacula
+    Maximum Concurrent Jobs = 1
+    Plugin Directory = "/usr/lib/bacula"
+    # Have all data stored encrypted
+    PKI Encryption = Yes
+    PKI Signatures = Yes
+    PKI Keypair = "/etc/bacula/ssl/server-keypair.pem"
+    PKI Master Key = "/var/lib/puppet/ssl/certs/ca.pem"
+    # Do enable Data channel encryption.
+    TLS Enable = yes
+    TLS Require = yes
+    TLS Certificate = "/etc/bacula/ssl/cert.pem"
+    TLS Key = "/etc/bacula/ssl/server.key"
+    TLS CA Certificate File = "/etc/ssl/certs/wmf-ca-certificates.crt"
+    # Heartbeat inverval = 0 # in secs
+    # FDAddresses = # For director connections
+    # FDSourceAddress = # For connecting to SD
+    # Maximum Bandwidth Per Job =
+}
+
+# Send all messages except skipped files back to Director
+Messages {
+    Name = Standard
+    director = "backup1014.eqiad.wmnet" = all, !skipped, !restored
+}

File[/etc/phab_project_changes.conf]

Parameters differences:

--- File[/etc/phab_project_changes.conf].orig
+++ File[/etc/phab_project_changes.conf]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/phab_project_changes.conf.orig
+++ /etc/phab_project_changes.conf
@@ -0,0 +1,8 @@
+declare rcpt_address='phabricator-reports@lists.wikimedia.org'
+declare sndr_address='aklapper@wikimedia.org'
+
+declare sql_host='m3-slave.codfw.wmnet'
+declare sql_port='3323'
+declare sql_user='metrics_user'
+declare sql_name='phabricator_project'
+declare sql_pass='metrics_pass'

Phabricator::Logmail[quarterly_metrics]

Parameters differences:

--- Phabricator::Logmail[quarterly_metrics].orig
+++ Phabricator::Logmail[quarterly_metrics]

+    ensure           => absent
+    rcpt_address     => ['lgoto@wikimedia.org', 'aklapper@wikimedia.org']
+    monthday         => 1
+    month            => 01,04,07,10
+    mysql_slave      => m3-slave.codfw.wmnet
+    mysql_slave_port => 3323
+    minute           => 0
+    basedir          => /usr/local/bin
+    sndr_address     => aklapper@wikimedia.org
+    mysql_db_name    => phabricator_maniphest
+    require          => Package[phabricator/deployment]
+    hour             => 0

File[/usr/local/sbin/envoyproxy-start]

Parameters differences:

--- File[/usr/local/sbin/envoyproxy-start].orig
+++ File[/usr/local/sbin/envoyproxy-start]

+    mode   => 0555
+    source => puppet:///modules/envoyproxy/hot_restarter/start-envoy.sh
+    owner  => root
+    ensure => present
+    group  => root

Systemd::Syslog[phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- Systemd::Syslog[phabricator_stats_job_tech_news_weekly_stats].orig
+++ Systemd::Syslog[phabricator_stats_job_tech_news_weekly_stats]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Exec[systemd daemon-reload for phabricator_clean_tmp_files.timer (phabricator_clean_tmp_files.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_clean_tmp_files.timer (phabricator_clean_tmp_files.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_clean_tmp_files.timer (phabricator_clean_tmp_files.timer)]

+    before      => ['Service[phabricator_clean_tmp_files.timer]']
+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/srv/phab/phabricator/scripts/ssh/]

Parameters differences:

--- File[/srv/phab/phabricator/scripts/ssh/].orig
+++ File[/srv/phab/phabricator/scripts/ssh/]

+    recurse => True
+    owner   => vcs
+    path    => /srv/phab/phabricator/scripts/ssh
+    group   => root

Systemd::Unit[backup-home-dirs.timer]

Parameters differences:

--- Systemd::Unit[backup-home-dirs.timer].orig
+++ Systemd::Unit[backup-home-dirs.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => backup-home-dirs.timer
+    require           => ['Class[Systemd]']

Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.timer (phabricator_stats_job_quarterly_wmf_qls.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.timer (phabricator_stats_job_quarterly_wmf_qls.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.timer (phabricator_stats_job_quarterly_wmf_qls.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Systemd::Timer::Job[rsync-phabricator-home-dirs]

Parameters differences:

--- Systemd::Timer::Job[rsync-phabricator-home-dirs].orig
+++ Systemd::Timer::Job[rsync-phabricator-home-dirs]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => Transfer data periodically between hosts
+    command                   => /usr/local/sbin/sync-phabricator-home-dirs
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh on intermediate ca change]

Parameters differences:

--- Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh on intermediate ca change].orig
+++ Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server refresh on intermediate ca change]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    refreshonly => True
+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/phab2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server

+    require     => Cfssl::Csr[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]
+    subscribe   => File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]

Class[Rsync::Server]

Parameters differences:

--- Class[Rsync::Server].orig
+++ Class[Rsync::Server]

+    rsyncd_conf    => {}
+    ensure_service => running
+    address        => 0.0.0.0
+    rsync_opts     => []
+    timeout        => 300
+    use_chroot     => yes

File[/etc/rsyslog.d/40-rsync-phabricator-home-dirs.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-rsync-phabricator-home-dirs.conf].orig
+++ File[/etc/rsyslog.d/40-rsync-phabricator-home-dirs.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-rsync-phabricator-home-dirs.conf.orig
+++ /etc/rsyslog.d/40-rsync-phabricator-home-dirs.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "rsync-phabricator-home-dirs" then {
+    action(
+        type="omfile" file="/var/log/rsync-phabricator-home-dirs/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Envoyproxy::Conf[tls_terminator_443]

Parameters differences:

--- Envoyproxy::Conf[tls_terminator_443].orig
+++ Envoyproxy::Conf[tls_terminator_443]

+    priority  => 0
+    conf_type => listener

Package[envoyproxy]

Parameters differences:

--- Package[envoyproxy].orig
+++ Package[envoyproxy]

+    provider => apt
+    ensure   => present

File[/etc/bacula/ssl/server-keypair.pem]

Parameters differences:

--- File[/etc/bacula/ssl/server-keypair.pem].orig
+++ File[/etc/bacula/ssl/server-keypair.pem]

+    mode   => 0400
+    owner  => bacula
+    ensure => present
+    group  => bacula

Rsyslog::Conf[phabricator_stats_job_yearly_metrics]

Parameters differences:

--- Rsyslog::Conf[phabricator_stats_job_yearly_metrics].orig
+++ Rsyslog::Conf[phabricator_stats_job_yearly_metrics]

+    mode     => 0444
+    require  => File[/var/log/phabricator_stats_job_yearly_metrics]
+    priority => 40
+    ensure   => absent

Class[Phabricator::Tools]

Parameters differences:

--- Class[Phabricator::Tools].orig
+++ Class[Phabricator::Tools]

+    gerritbot_token => gerritbot_token
+    phabtools_cert  => phabtools_cert
+    dbslave_port    => 3323
+    phabtools_user  => phabtools_user
+    directory       => /srv/phab/tools
+    app_user        => app_user
+    dbmaster_port   => 3323
+    manifest_user   => manifest_user
+    dbmaster_host   => m3-slave.codfw.wmnet
+    bz_pass         => bz_pass
+    dbslave_host    => m3-slave.codfw.wmnet
+    manifest_pass   => manifest_pass
+    app_pass        => app_pass
+    rt_user         => rt_user
+    deploy_target   => phabricator/deployment
+    dump            => False
+    rt_pass         => rt_pass
+    bz_user         => bz_user
+    require         => Package[phabricator/deployment]

Admin::Hashuser[gjg]

Parameters differences:

--- Admin::Hashuser[gjg].orig
+++ Admin::Hashuser[gjg]

+    ensure_ssh_key => True

Class[Profile::Apt]

Parameters differences:

--- Class[Profile::Apt].orig
+++ Class[Profile::Apt]

@@
-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[php8.2-common]', 'Package[php8.2-opcache]', 'Package[php8.2-cli]', 'Package[php8.2-fpm]', 'Package[apache2]', 'Package[links]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[git-lfs]', 'Package[rsync]', 'Package[python3-venv]', 'Package[php8.2-curl]', 'Package[php8.2-gd]', 'Package[php8.2-gmp]', 'Package[php8.2-intl]', 'Package[php8.2-mbstring]', 'Package[php8.2-ldap]', 'Package[php-apcu]', 'Package[php-mailparse]', 'Package[php8.2-xml]', 'Package[php8.2-mysql]']
+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[nftables]', 'Package[conntrack]', 'Package[bacula-fd]', 'Package[python3-pygments]', 'Package[python3-phabricator]', 'Package[apachetop]', 'Package[subversion]', 'Package[s-nail]', 'Package[php8.2-common]', 'Package[php8.2-opcache]', 'Package[php8.2-cli]', 'Package[php8.2-fpm]', 'Package[nodejs]', 'Package[python3-mysqldb]', 'Package[python3-pymysql]', 'Package[exim4-config]', 'Package[exim4-daemon-heavy]', 'Package[apache2]', 'Package[links]', 'Package[envoyproxy]', 'Package[rsync]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[git-lfs]', 'Package[python3-venv]', 'Package[php8.2-curl]', 'Package[php8.2-gd]', 'Package[php8.2-gmp]', 'Package[php8.2-intl]', 'Package[php8.2-mbstring]', 'Package[php8.2-ldap]', 'Package[php-apcu]', 'Package[php-mailparse]', 'Package[php8.2-xml]', 'Package[php8.2-mysql]', 'Package[mariadb-client]', 'Package[prometheus-apache-exporter]']

Systemd::Unit[wmf_auto_restart_envoyproxy.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_envoyproxy.timer].orig
+++ Systemd::Unit[wmf_auto_restart_envoyproxy.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => wmf_auto_restart_envoyproxy.timer
+    require           => ['Class[Systemd]']

File[/etc/sysusers.d/vcs.conf]

Parameters differences:

--- File[/etc/sysusers.d/vcs.conf].orig
+++ File[/etc/sysusers.d/vcs.conf]

+    mode    => 0444
+    owner   => root
+    ensure  => file
+    require => File[/etc/sysusers.d]
+    group   => root

Content differences:

--- /etc/sysusers.d/vcs.conf.orig
+++ /etc/sysusers.d/vcs.conf
@@ -0,0 +1 @@
+u	vcs	497:497	"Phabricator vcs user"	/var/lib/vcs	/bin/sh

File[/etc/rsyslog.d/40-rsync-phabricator-repos.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-rsync-phabricator-repos.conf].orig
+++ File[/etc/rsyslog.d/40-rsync-phabricator-repos.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-rsync-phabricator-repos.conf.orig
+++ /etc/rsyslog.d/40-rsync-phabricator-repos.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "rsync-phabricator-repos" then {
+    action(
+        type="omfile" file="/var/log/rsync-phabricator-repos/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.timer (phabricator_stats_job_quarterly_metrics.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.timer (phabricator_stats_job_quarterly_metrics.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.timer (phabricator_stats_job_quarterly_metrics.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Logrotate::Conf[phabricator_stats_job_yearly_metrics]

Parameters differences:

--- Logrotate::Conf[phabricator_stats_job_yearly_metrics].orig
+++ Logrotate::Conf[phabricator_stats_job_yearly_metrics]

+    ensure => absent

Phabricator::Libext[/srv/phab/libext/misc]

Parameters differences:

--- Phabricator::Libext[/srv/phab/libext/misc].orig
+++ Phabricator::Libext[/srv/phab/libext/misc]

+    require => ['Package[phabricator/deployment]']
+    libname => /srv/phab/libext/misc
+    rootdir => /srv/phab

Rsyslog::Conf[phabricator_stats_job_project_changes]

Parameters differences:

--- Rsyslog::Conf[phabricator_stats_job_project_changes].orig
+++ Rsyslog::Conf[phabricator_stats_job_project_changes]

+    mode     => 0444
+    require  => File[/var/log/phabricator_stats_job_project_changes]
+    priority => 40
+    ensure   => absent

File[/var/log/rsync-phabricator-home-dirs]

Parameters differences:

--- File[/var/log/rsync-phabricator-home-dirs].orig
+++ File[/var/log/rsync-phabricator-home-dirs]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.service (phabricator_stats_job_tech_news_weekly_stats.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.service (phabricator_stats_job_tech_news_weekly_stats.service)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.service (phabricator_stats_job_tech_news_weekly_stats.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Ferm::Service[ssh_cluster]

Parameters differences:

--- Ferm::Service[ssh_cluster].orig
+++ Ferm::Service[ssh_cluster]

+    ensure              => present
+    port                => 22
+    proto               => tcp
+    prio                => 10
+    srange              => ['phab1004.eqiad.wmnet', 'phab2002.codfw.wmnet']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Systemd::Timer[phabricator_task_dump]

Parameters differences:

--- Systemd::Timer[phabricator_task_dump].orig
+++ Systemd::Timer[phabricator_task_dump]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Monday *-*-* 02:00:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => phabricator_task_dump.service
+    splay              => 0

File[/etc/apache2/sites-enabled/50-phabricator.conf]

Parameters differences:

--- File[/etc/apache2/sites-enabled/50-phabricator.conf].orig
+++ File[/etc/apache2/sites-enabled/50-phabricator.conf]

+    notify => Service[apache2]
+    owner  => root
+    ensure => link
+    target => /etc/apache2/sites-available/50-phabricator.conf
+    group  => root

Group[phabricator-admin]

Parameters differences:

--- Group[phabricator-admin].orig
+++ Group[phabricator-admin]

+    ensure    => present
+    allowdupe => False
+    gid       => 746

Cfssl::Csr[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]

Parameters differences:

--- Cfssl::Csr[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr].orig
+++ Cfssl::Csr[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]

+    names       => []
+    hosts       => ['phabricator.wikimedia.org', 'phab.wmfusercontent.org', 'bugs.wikimedia.org', 'bugzilla.wikimedia.org']
+    key         => {'algo': 'ecdsa', 'size': 256}
+    ensure      => present
+    common_name => phabricator.discovery.wmnet

File[/var/log/phabricator_stats_job_yearly_metrics]

Parameters differences:

--- File[/var/log/phabricator_stats_job_yearly_metrics].orig
+++ File[/var/log/phabricator_stats_job_yearly_metrics]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

File[/lib/systemd/system/phabricator_stats_job_project_changes.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_project_changes.timer].orig
+++ File[/lib/systemd/system/phabricator_stats_job_project_changes.timer]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_project_changes.timer (phabricator_stats_job_project_changes.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_project_changes.timer.orig
+++ /lib/systemd/system/phabricator_stats_job_project_changes.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_stats_job_project_changes.service
+
+[Timer]
+Unit=phabricator_stats_job_project_changes.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Monday *-*-* 0:0:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Class[Resolvconf]

Parameters differences:

--- Class[Resolvconf].orig
+++ Class[Resolvconf]

@@
-    domain_search => ['codfw.wmnet']
+    domain_search => ['eqiad.wmnet', 'codfw.wmnet']

Php::Extension[apcu]

Parameters differences:

--- Php::Extension[apcu].orig
+++ Php::Extension[apcu]

+    config => {'extension': 'apcu.so', 'apc.shm_size': '4096M'}

File[/srv/phab/phabricator/scripts/daemon/]

Parameters differences:

--- File[/srv/phab/phabricator/scripts/daemon/].orig
+++ File[/srv/phab/phabricator/scripts/daemon/]

+    recurse => True
+    owner   => phd
+    path    => /srv/phab/phabricator/scripts/daemon
+    group   => root

File[/etc/ssh/userkeys/mbinder]

Parameters differences:

--- File[/etc/ssh/userkeys/mbinder].orig
+++ File[/etc/ssh/userkeys/mbinder]

+    mode      => 0444
+    owner     => root
+    ensure    => file
+    show_diff => False
+    force     => True
+    group     => root

Content differences:

--- /etc/ssh/userkeys/mbinder.orig
+++ /etc/ssh/userkeys/mbinder
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLrpbK99cmNng3y8t1qYOvTKksI4TZKtQSTsF9RZ1pC maxbinder@Maxs-MacBook-Air.local

File[/etc/sysctl.d/70-TCP-Fast-Open.conf]

Parameters differences:

--- File[/etc/sysctl.d/70-TCP-Fast-Open.conf].orig
+++ File[/etc/sysctl.d/70-TCP-Fast-Open.conf]

+    notify => Exec[update_sysctl]
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/sysctl.d/70-TCP-Fast-Open.conf.orig
+++ /etc/sysctl.d/70-TCP-Fast-Open.conf
@@ -0,0 +1,2 @@
+# sysctl parameters managed by Puppet.
+net.ipv4.tcp_fastopen = 3

Class[Profile::Phabricator::Migration]

Parameters differences:

--- Class[Profile::Phabricator::Migration].orig
+++ Class[Profile::Phabricator::Migration]

-    dst_hosts    => ['phab2002.codfw.wmnet']
-    storage_user => phadmin
-    deploy_user  => phab-deploy
-    phabdir      => /srv/phab
-    src_host     => phab1004.eqiad.wmnet

File[/etc/rsync.d]

Parameters differences:

--- File[/etc/rsync.d].orig
+++ File[/etc/rsync.d]

+    recurse => True
+    owner   => root
+    ensure  => absent
+    force   => True
+    purge   => True
+    group   => root

File[/etc/update-motd.d/05-phabricator--migration]

Parameters differences:

--- File[/etc/update-motd.d/05-phabricator--migration].orig
+++ File[/etc/update-motd.d/05-phabricator--migration]

-    mode   => 0555
-    owner  => root
-    ensure => present
-    group  => root

Content differences:

--- /etc/update-motd.d/05-phabricator--migration.orig
+++ /etc/update-motd.d/05-phabricator--migration
@@ -1,2 +0,0 @@
-#!/bin/sh
-printf "%s\n" "phab2003 is a Temp role to allow migrating Phabricator data to a new server (phabricator::migration)"

Class[Phabricator]

Parameters differences:

--- Class[Phabricator].orig
+++ Class[Phabricator]

+    settings           => {'darkconsole.enabled': False, 'differential.allow-self-accept': True, 'phabricator.base-uri': 'https://phabricator.wikimedia.org', 'security.alternate-file-domain': 'https://phab.wmfusercontent.org', 'mysql.host': 'm3-slave.codfw.wmnet', 'mysql.port': '3323', 'cluster.mailers': [{'key': 'wikimedia-smtp', 'type': 'smtp', 'options': {'host': 'localhost', 'port': 25}}], 'metamta.default-address': 'no-reply@phabricator.wikimedia.org', 'metamta.reply-handler-domain': 'phabricator.wikimedia.org', 'repository.default-local-path': '/srv/repos', 'phd.taskmasters': 4, 'events.listeners': [], 'diffusion.allow-http-auth': True, 'diffusion.ssh-host': 'git-ssh.wikimedia.org'}
+    phabdir            => /srv/phab
+    timezone           => UTC
+    serveraliases      => ['phab.wmfusercontent.org', 'bugzilla.wikimedia.org', 'bugs.wikimedia.org']
+    phd_service_enable => False
+    libraries          => ['/srv/phab/libext/misc', '/srv/phab/libext/ava/src', '/srv/phab/libext/translations/src']
+    config_deploy_vars => {'phabricator': {'www': {'database_username': 'app_user', 'database_password': 'app_pass'}, 'mail': {'database_username': 'app_user', 'database_password': 'app_pass'}, 'phd': {'database_username': 'phd_user', 'database_password': 'phd_pass'}, 'vcs': {'database_username': 'phd_user', 'database_password': 'phd_pass'}, 'redirects': {'database_username': 'phd_user', 'database_password': 'phd_pass', 'database_host': 'm3-slave.codfw.wmnet', 'field_index': '4rRUkCdImLQU'}, 'local': {'base_uri': 'https://phabricator.wikimedia.org', 'alternate_file_domain': 'https://phab.wmfusercontent.org', 'mail_default_address': 'no-reply@phabricator.wikimedia.org', 'mail_reply_handler_domain': 'phabricator.wikimedia.org', 'phd_taskmasters': 4, 'ssh_host': 'git-ssh.wikimedia.org', 'notification_servers': [{'type': 'client', 'host': 'phabricator.wikimedia.org', 'port': 443, 'protocol': 'https'}, {'type': 'admin', 'host': 'aphlict.discovery.wmnet', 'port': 22281, 'protocol': 'http'}], 'cluster_mailers': [{'key': 'wikimedia-smtp', 'type': 'smtp', 'options': {'host': 'localhost', 'port': 25}}], 'database_host': 'm3-slave.codfw.wmnet', 'database_port': '3323', 'gitlab_api_key': ''}}}
+    confdir            => /srv/phab/phabricator/conf
+    enable_vcs         => True
+    mysql_admin_pass   => admin_pass
+    deploy_target      => phabricator/deployment
+    deploy_user        => phab-deploy
+    trusted_proxies    => ['10.192.27.12', '127.0.0.1', '2620:0:860:114:10:192:27:12', ':1', 'fe80::425b:7fff:fef3:a3c4']
+    serveradmin        => 
+    manage_scap_user   => True
+    opcache_validate   => 0
+    mysql_admin_user   => admin_user
+    phd_service_ensure => stopped

Systemd::Unit[phabricator_task_dump.service]

Parameters differences:

--- Systemd::Unit[phabricator_task_dump.service].orig
+++ Systemd::Unit[phabricator_task_dump.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_task_dump.service
+    require           => ['Class[Systemd]']

Ferm::Service[bacula_file_daemon_backup1014_eqiad_wmnet]

Parameters differences:

--- Ferm::Service[bacula_file_daemon_backup1014_eqiad_wmnet].orig
+++ Ferm::Service[bacula_file_daemon_backup1014_eqiad_wmnet]

+    ensure              => present
+    port                => 9102
+    proto               => tcp
+    prio                => 10
+    srange              => ['backup1014.eqiad.wmnet']
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Rsyslog::Conf[phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- Rsyslog::Conf[phabricator_stats_job_tech_news_weekly_stats].orig
+++ Rsyslog::Conf[phabricator_stats_job_tech_news_weekly_stats]

+    mode     => 0444
+    require  => File[/var/log/phabricator_stats_job_tech_news_weekly_stats]
+    priority => 40
+    ensure   => absent

File[/etc/logrotate.d/phd]

Parameters differences:

--- File[/etc/logrotate.d/phd].orig
+++ File[/etc/logrotate.d/phd]

+    mode   => 0444
+    source => puppet:///modules/phabricator/logrotate_phd
+    owner  => root
+    ensure => present
+    group  => root

File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-metrics.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-metrics.conf].orig
+++ File[/etc/rsyslog.d/40-phabricator-stats-job-quarterly-metrics.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-phabricator-stats-job-quarterly-metrics.conf.orig
+++ /etc/rsyslog.d/40-phabricator-stats-job-quarterly-metrics.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "phabricator_stats_job_quarterly_metrics" then {
+    action(
+        type="omfile" file="/var/log/phabricator_stats_job_quarterly_metrics/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Package[bacula-fd]

Parameters differences:

--- Package[bacula-fd].orig
+++ Package[bacula-fd]

+    provider => apt
+    ensure   => installed

File[/etc/nftables/input/10_phabmain-smtp.nft]

Parameters differences:

--- File[/etc/nftables/input/10_phabmain-smtp.nft].orig
+++ File[/etc/nftables/input/10_phabmain-smtp.nft]

+    notify => ['Service[nftables]']
+    mode   => 0444
+    tag    => nft
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/nftables/input/10_phabmain-smtp.nft.orig
+++ /etc/nftables/input/10_phabmain-smtp.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr { 208.80.153.75, 208.80.155.102 } tcp dport { 25 } accept
+ip6 saddr { 2620:0:860:3:208:80:153:75, 2620:0:861:4:208:80:155:102 } tcp dport { 25 } accept

Exec[systemd daemon-reload for phabricator_task_dump.service (phabricator_task_dump.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_task_dump.service (phabricator_task_dump.service)].orig
+++ Exec[systemd daemon-reload for phabricator_task_dump.service (phabricator_task_dump.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Concat::Fragment[main contacts]

Ssh::Userkey[gjg]

Parameters differences:

--- Ssh::Userkey[gjg].orig
+++ Ssh::Userkey[gjg]

+    user   => gjg
+    ensure => present

File[/var/log/phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- File[/var/log/phabricator_stats_job_quarterly_wmf_qls].orig
+++ File[/var/log/phabricator_stats_job_quarterly_wmf_qls]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Exec[phab-git-safedir]

Parameters differences:

--- Exec[phab-git-safedir].orig
+++ Exec[phab-git-safedir]

+    notify  => Exec[update-safedir-gitconfig]
+    unless  => /usr/bin/grep -q deployment-cache /etc/gitconfig
+    command => /usr/local/bin/phab_git_safedir.sh

Exec[systemd daemon-reload for rsync-phabricator-repos.timer (rsync-phabricator-repos.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for rsync-phabricator-repos.timer (rsync-phabricator-repos.timer)].orig
+++ Exec[systemd daemon-reload for rsync-phabricator-repos.timer (rsync-phabricator-repos.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/etc/phabricator/config.yaml]

Parameters differences:

--- File[/etc/phabricator/config.yaml].orig
+++ File[/etc/phabricator/config.yaml]

+    mode   => 0640
+    owner  => root
+    ensure => present
+    group  => phab-deploy

Content differences:

--- /etc/phabricator/config.yaml.orig
+++ /etc/phabricator/config.yaml
@@ -0,0 +1,44 @@
+---
+phabricator:
+  www:
+    database_username: app_user
+    database_password: app_pass
+  mail:
+    database_username: app_user
+    database_password: app_pass
+  phd:
+    database_username: phd_user
+    database_password: phd_pass
+  vcs:
+    database_username: phd_user
+    database_password: phd_pass
+  redirects:
+    database_username: phd_user
+    database_password: phd_pass
+    database_host: m3-slave.codfw.wmnet
+    field_index: 4rRUkCdImLQU
+  local:
+    base_uri: https://phabricator.wikimedia.org
+    alternate_file_domain: https://phab.wmfusercontent.org
+    mail_default_address: no-reply@phabricator.wikimedia.org
+    mail_reply_handler_domain: phabricator.wikimedia.org
+    phd_taskmasters: 4
+    ssh_host: git-ssh.wikimedia.org
+    notification_servers:
+    - type: client
+      host: phabricator.wikimedia.org
+      port: 443
+      protocol: https
+    - type: admin
+      host: aphlict.discovery.wmnet
+      port: 22281
+      protocol: http
+    cluster_mailers:
+    - key: wikimedia-smtp
+      type: smtp
+      options:
+        host: localhost
+        port: 25
+    database_host: m3-slave.codfw.wmnet
+    database_port: '3323'
+    gitlab_api_key: ''

Systemd::Timer::Job[phabricator_task_dump]

Parameters differences:

--- Systemd::Timer::Job[phabricator_task_dump].orig
+++ Systemd::Timer::Job[phabricator_task_dump]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => phabricator public task dump
+    command                   => /usr/bin/python3 /srv/phab/tools/public_task_dump.py
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Monday *-*-* 02:00:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    require                   => Package[phabricator/deployment]
+    logfile_basedir           => /var/log

Service[phabricator_task_dump.timer]

Parameters differences:

--- Service[phabricator_task_dump.timer].orig
+++ Service[phabricator_task_dump.timer]

+    before   => ['Exec[systemd daemon-reload for phabricator_task_dump.timer (phabricator_task_dump.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

Systemd::Unit[phabricator_stats_job_yearly_metrics.service]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_yearly_metrics.service].orig
+++ Systemd::Unit[phabricator_stats_job_yearly_metrics.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_yearly_metrics.service
+    require           => ['Class[Systemd]']

File[/etc/default/exim4]

Parameters differences:

--- File[/etc/default/exim4].orig
+++ File[/etc/default/exim4]

+    mode    => 0444
+    owner   => root
+    ensure  => present
+    require => Package[exim4-config]
+    group   => root

Content differences:

--- /etc/default/exim4.orig
+++ /etc/default/exim4
@@ -0,0 +1,24 @@
+# /etc/default/exim4
+# THIS FILE IS MANAGED BY PUPPET
+
+EX4DEF_VERSION=''
+
+# 'combined' -	 one daemon running queue and listening on SMTP port
+# 'no'       -	 no daemon running the queue
+# 'separate' -	 two separate daemons
+# 'ppp'      -   only run queue with /etc/ppp/ip-up.d/exim4.
+# 'nodaemon' - no daemon is started at all.
+# 'queueonly' - only a queue running daemon is started, no SMTP listener.
+# setting this to 'no' will also disable queueruns from /etc/ppp/ip-up.d/exim4
+QUEUERUNNER='combined'
+# how often should we run the queue
+QUEUEINTERVAL='1m'
+# options common to quez-runner and listening daemon
+COMMONOPTIONS=''
+# more options for the daemon/process running the queue (applies to the one
+# started in /etc/ppp/ip-up.d/exim4, too.
+QUEUERUNNEROPTIONS=''
+# special flags given to exim directly after the -q. See exim(8)
+QFLAGS=''
+# options for daemon listening on port 25
+SMTPLISTENEROPTIONS=''

File[/etc/bacula/ssl/server.key]

Parameters differences:

--- File[/etc/bacula/ssl/server.key].orig
+++ File[/etc/bacula/ssl/server.key]

+    mode      => 0400
+    source    => /var/lib/puppet/ssl/private_keys/phab2003.codfw.wmnet.pem
+    owner     => bacula
+    ensure    => present
+    show_diff => False
+    group     => bacula

Systemd::Timer[phabricator_stats_job_community_metrics]

Parameters differences:

--- Systemd::Timer[phabricator_stats_job_community_metrics].orig
+++ Systemd::Timer[phabricator_stats_job_community_metrics]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-1 0:0:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => phabricator_stats_job_community_metrics.service
+    splay              => 0

Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.service]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.service].orig
+++ Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => present
+    unit              => wmf_auto_restart_prometheus-apache-exporter.service
+    require           => ['Class[Systemd]']

Systemd::Timer::Job[wmf_auto_restart_envoyproxy]

Parameters differences:

--- Systemd::Timer::Job[wmf_auto_restart_envoyproxy].orig
+++ Systemd::Timer::Job[wmf_auto_restart_envoyproxy]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => Auto restart job: envoyproxy
+    command                   => /usr/local/sbin/wmf-auto-restart -s envoyproxy
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 19:9:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    require                   => File[/usr/local/sbin/wmf-auto-restart]
+    logfile_basedir           => /var/log

Puppet::Expose_agent_certs[/etc/bacula]

Parameters differences:

--- Puppet::Expose_agent_certs[/etc/bacula].orig
+++ Puppet::Expose_agent_certs[/etc/bacula]

+    notify          => Service[bacula-fd]
+    provide_keypair => True
+    user            => bacula
+    ensure          => present
+    provide_private => True
+    provide_pem     => True
+    provide_p12     => False
+    ssldir          => /var/lib/puppet/ssl
+    require         => Package[bacula-fd]
+    group           => bacula

Bacula::Client::Job[home-Monthly-1st-Wed-productionEqiad]

Parameters differences:

--- Bacula::Client::Job[home-Monthly-1st-Wed-productionEqiad].orig
+++ Bacula::Client::Job[home-Monthly-1st-Wed-productionEqiad]

+    require     => Class[Bacula::Client]
+    jobdefaults => Monthly-1st-Wed-productionEqiad
+    fileset     => home

Systemd::Syslog[envoy]

Parameters differences:

--- Systemd::Syslog[envoy].orig
+++ Systemd::Syslog[envoy]

+    readable_by            => group
+    ensure                 => present
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => envoy
+    require                => Package[envoyproxy]
+    group                  => envoy
+    base_dir               => /var/log

File[/etc/systemd/system/envoyproxy.service.d/puppet-override.conf]

Parameters differences:

--- File[/etc/systemd/system/envoyproxy.service.d/puppet-override.conf].orig
+++ File[/etc/systemd/system/envoyproxy.service.d/puppet-override.conf]

+    notify => Exec[systemd daemon-reload for envoyproxy.service (envoyproxy.service)]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/systemd/system/envoyproxy.service.d/puppet-override.conf.orig
+++ /etc/systemd/system/envoyproxy.service.d/puppet-override.conf
@@ -0,0 +1,26 @@
+[Service]
+# TODO: support hot restarts, see for instance https://www.envoyproxy.io/docs/envoy/latest/operations/hot_restarter
+# Ensure envoy can handle enough file descriptors
+LimitNOFILE=65536
+# Allow envoy to bind on a privileged port
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+ExecStart=
+# We use the hot-restarter script to start envoy. Please note that "restart"
+# in systemd terms is stop + start, so it will not hot-restart envoy.
+# We will have to use "reload" to obtain the desired result -
+# and have puppet run 'systemctl reload envoyproxy.service' instead.
+Environment="ENVOY_CONFIG=/etc/envoy/envoy.yaml"
+Environment="SERVICE_ZONE=codfw"
+Environment="SERVICE_CLUSTER=misc"
+Environment="SERVICE_NODE=phab2003.codfw.wmnet"
+ExecStart=/usr/local/sbin/envoyproxy-hot-restarter /usr/local/sbin/envoyproxy-start 
+ExecReload=
+ExecReload=/bin/kill -s HUP $MAINPID
+
+# Security settings
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ReadWritePaths=/var/log/envoy/

Rsyslog::Conf[rsync-phabricator-repos]

Parameters differences:

--- Rsyslog::Conf[rsync-phabricator-repos].orig
+++ Rsyslog::Conf[rsync-phabricator-repos]

+    mode     => 0444
+    require  => File[/var/log/rsync-phabricator-repos]
+    priority => 40
+    ensure   => absent

Exec[systemd daemon-reload for rsync-phabricator-home-dirs.service (rsync-phabricator-home-dirs.service)]

Parameters differences:

--- Exec[systemd daemon-reload for rsync-phabricator-home-dirs.service (rsync-phabricator-home-dirs.service)].orig
+++ Exec[systemd daemon-reload for rsync-phabricator-home-dirs.service (rsync-phabricator-home-dirs.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/srv/phab/tools/public_task_dump.py]

Parameters differences:

--- File[/srv/phab/tools/public_task_dump.py].orig
+++ File[/srv/phab/tools/public_task_dump.py]

+    mode    => 0555
+    require => Package[phabricator/deployment]
+    owner   => root
+    group   => root

Systemd::Timer::Job[phabricator_stats_job_project_changes]

Parameters differences:

--- Systemd::Timer::Job[phabricator_stats_job_project_changes].orig
+++ Systemd::Timer::Job[phabricator_stats_job_project_changes]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => phabricator statistics mail - project_changes
+    command                   => /usr/local/bin/project_changes.sh
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Monday *-*-* 0:0:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

Systemd::Unit[phabricator_stats_job_community_metrics.service]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_community_metrics.service].orig
+++ Systemd::Unit[phabricator_stats_job_community_metrics.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_community_metrics.service
+    require           => ['Class[Systemd]']

File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.service].orig
+++ File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.service]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.service (phabricator_stats_job_quarterly_wmf_qls.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.service.orig
+++ /lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator statistics mail - quarterly_wmf_qls
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/quarterly_wmf_qls.sh

Rsyslog::Conf[phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- Rsyslog::Conf[phabricator_stats_job_quarterly_metrics].orig
+++ Rsyslog::Conf[phabricator_stats_job_quarterly_metrics]

+    mode     => 0444
+    require  => File[/var/log/phabricator_stats_job_quarterly_metrics]
+    priority => 40
+    ensure   => absent

Systemd::Service[phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- Systemd::Service[phabricator_stats_job_quarterly_wmf_qls].orig
+++ Systemd::Service[phabricator_stats_job_quarterly_wmf_qls]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.service]
+    monitoring_contact_group => admins

File[/etc/logrotate.d/phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_stats_job_quarterly_metrics].orig
+++ File[/etc/logrotate.d/phabricator_stats_job_quarterly_metrics]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_stats_job_quarterly_metrics.orig
+++ /etc/logrotate.d/phabricator_stats_job_quarterly_metrics
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_stats_job_quarterly_metrics
+
+/var/log/phabricator_stats_job_quarterly_metrics/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

File[/srv/phab/phabricator/scripts/]

Parameters differences:

--- File[/srv/phab/phabricator/scripts/].orig
+++ File[/srv/phab/phabricator/scripts/]

+    mode    => 0754
+    recurse => True
+    owner   => phab-deploy
+    path    => /srv/phab/phabricator/scripts
+    require => ['Package[phabricator/deployment]']
+    group   => phab-deploy

Exec[mask_phd.service]

Parameters differences:

--- Exec[mask_phd.service].orig
+++ Exec[mask_phd.service]

+    creates => /etc/systemd/system/phd.service
+    command => /bin/systemctl mask phd.service

Systemd::Timer[phabricator_stats_job_project_changes]

Parameters differences:

--- Systemd::Timer[phabricator_stats_job_project_changes].orig
+++ Systemd::Timer[phabricator_stats_job_project_changes]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Monday *-*-* 0:0:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => phabricator_stats_job_project_changes.service
+    splay              => 0

Concat::Fragment[/etc/rsyncd.conf-header]

Parameters differences:

--- Concat::Fragment[/etc/rsyncd.conf-header].orig
+++ Concat::Fragment[/etc/rsyncd.conf-header]

+    order  => 01
+    target => /etc/rsyncd.conf

Service[wmf_auto_restart_aphlict.timer]

Parameters differences:

--- Service[wmf_auto_restart_aphlict.timer].orig
+++ Service[wmf_auto_restart_aphlict.timer]

+    before   => ['Exec[systemd daemon-reload for wmf_auto_restart_aphlict.timer (wmf_auto_restart_aphlict.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

Exec[systemd daemon-reload for wmf_auto_restart_aphlict.timer (wmf_auto_restart_aphlict.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_aphlict.timer (wmf_auto_restart_aphlict.timer)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_aphlict.timer (wmf_auto_restart_aphlict.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Envoyproxy::Listener[tls_terminator_443]

Parameters differences:

--- Envoyproxy::Listener[tls_terminator_443].orig
+++ Envoyproxy::Listener[tls_terminator_443]

+    priority => 0

Phabricator::Logmail[quarterly_wmf_qls]

Parameters differences:

--- Phabricator::Logmail[quarterly_wmf_qls].orig
+++ Phabricator::Logmail[quarterly_wmf_qls]

+    ensure           => absent
+    rcpt_address     => ['aramirez@wikimedia.org', 'cbogen@wikimedia.org', 'mcollins@wikimedia.org', 'aklapper@wikimedia.org']
+    monthday         => 1
+    month            => 01,04,07,10
+    mysql_slave      => m3-slave.codfw.wmnet
+    mysql_slave_port => 3323
+    minute           => 0
+    basedir          => /usr/local/bin
+    sndr_address     => aklapper@wikimedia.org
+    mysql_db_name    => phabricator_maniphest
+    require          => Package[phabricator/deployment]
+    hour             => 0

Profile::Auto_restarts::Service[prometheus-apache-exporter]

Parameters differences:

--- Profile::Auto_restarts::Service[prometheus-apache-exporter].orig
+++ Profile::Auto_restarts::Service[prometheus-apache-exporter]

+    ensure => present

Service[phd]

Parameters differences:

--- Service[phd].orig
+++ Service[phd]

+    hasrestart => True
+    enable     => False
+    ensure     => stopped

File[/home/gjg/.my.cnf]

Parameters differences:

--- File[/home/gjg/.my.cnf].orig
+++ File[/home/gjg/.my.cnf]

+    mode  => 0440
+    owner => gjg
+    group => root

Content differences:

--- /home/gjg/.my.cnf.orig
+++ /home/gjg/.my.cnf
@@ -0,0 +1,6 @@
+[client]
+user=metrics_user
+password=metrics_pass
+database=phabricator_maniphest
+host=m3-slave.codfw.wmnet
+port=3323

File[/var/spool/exim4/scan]

Parameters differences:

--- File[/var/spool/exim4/scan].orig
+++ File[/var/spool/exim4/scan]

+    mode    => 1777
+    owner   => Debian-exim
+    ensure  => directory
+    before  => Service[exim4]
+    require => ['Mount[/var/spool/exim4/scan]', 'Mount[/var/spool/exim4/db]']
+    group   => Debian-exim

Systemd::Syslog[phabricator_stats_job_yearly_metrics]

Parameters differences:

--- Systemd::Syslog[phabricator_stats_job_yearly_metrics].orig
+++ Systemd::Syslog[phabricator_stats_job_yearly_metrics]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Systemd::Timer::Job[backup-home-dirs]

Parameters differences:

--- Systemd::Timer::Job[backup-home-dirs].orig
+++ Systemd::Timer::Job[backup-home-dirs]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => create tarballs from /home dirs into /srv/homes
+    command                   => /usr/local/bin/backup-home-dirs
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* 0:10:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    require                   => File[/usr/local/bin/backup-home-dirs]
+    logfile_basedir           => /var/log

File[/var/log/envoy]

Parameters differences:

--- File[/var/log/envoy].orig
+++ File[/var/log/envoy]

+    mode   => 0755
+    owner  => envoy
+    ensure => directory
+    force  => True
+    backup => False
+    group  => envoy

Ferm::Service[phabmain_http]

Parameters differences:

--- Ferm::Service[phabmain_http].orig
+++ Ferm::Service[phabmain_http]

+    ensure              => present
+    port                => 80
+    proto               => tcp
+    src_sets            => ['DEPLOYMENT_HOSTS']
+    prio                => 10
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

User[aphlict]

Parameters differences:

--- User[aphlict].orig
+++ User[aphlict]

+    shell   => /bin/false
+    gid     => aphlict
+    system  => True
+    before  => ['Service[aphlict]']
+    require => Group[aphlict]
+    home    => /var/run/aphlict

Logrotate::Conf[phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- Logrotate::Conf[phabricator_stats_job_tech_news_weekly_stats].orig
+++ Logrotate::Conf[phabricator_stats_job_tech_news_weekly_stats]

+    ensure => absent

File[/etc/rsyslog.d/40-wmf-auto-restart-envoyproxy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-envoyproxy.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-envoyproxy.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-envoyproxy.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-envoyproxy.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "wmf_auto_restart_envoyproxy" then {
+    action(
+        type="omfile" file="/var/log/wmf_auto_restart_envoyproxy/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Logrotate::Conf[rsync-phabricator-home-dirs]

Parameters differences:

--- Logrotate::Conf[rsync-phabricator-home-dirs].orig
+++ Logrotate::Conf[rsync-phabricator-home-dirs]

+    ensure => absent

Systemd::Unit[phabricator_stats_job_yearly_metrics.timer]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_yearly_metrics.timer].orig
+++ Systemd::Unit[phabricator_stats_job_yearly_metrics.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_yearly_metrics.timer
+    require           => ['Class[Systemd]']

Admin::Group[phabricator-bulk-manager]

Parameters differences:

--- Admin::Group[phabricator-bulk-manager].orig
+++ Admin::Group[phabricator-bulk-manager]

+    privileges => ['ALL = NOPASSWD: /srv/phab/phabricator/bin/bulk make-silent --id *']
+    ensure     => present
+    gid        => 819

Class[Profile::Admin]

Parameters differences:

--- Class[Profile::Admin].orig
+++ Class[Profile::Admin]

@@
-    groups => ['phabricator-roots']
+    groups => ['phabricator-admin', 'phabricator-roots', 'phabricator-bulk-manager']

Exec[renew certificate - discovery2026__phabricator_discovery_wmnet_server]

Parameters differences:

--- Exec[renew certificate - discovery2026__phabricator_discovery_wmnet_server].orig
+++ Exec[renew certificate - discovery2026__phabricator_discovery_wmnet_server]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server]
+    unless      => /usr/bin/openssl x509 -in /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem -checkend 952200
+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/phab2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server

Envoyproxy::Cluster[cluster_local_port_80]

Parameters differences:

--- Envoyproxy::Cluster[cluster_local_port_80].orig
+++ Envoyproxy::Cluster[cluster_local_port_80]

+    priority => 0

File[/var/log/aphlict/]

Parameters differences:

--- File[/var/log/aphlict/].orig
+++ File[/var/log/aphlict/]

+    owner  => aphlict
+    ensure => directory
+    path   => /var/log/aphlict
+    before => ['Service[aphlict]']
+    group  => aphlict

Exec[/srv/phab/libext/ava/src_static_dir_exists]

Parameters differences:

--- Exec[/srv/phab/libext/ava/src_static_dir_exists].orig
+++ Exec[/srv/phab/libext/ava/src_static_dir_exists]

+    creates => /srv/phab/phabricator/webroot/rsrc//srv/phab/libext/ava/src
+    require => File[/srv/phab]
+    command => /bin/ln -s /srv/phab/libext//srv/phab/libext/ava/src/rsrc/webroot-static /srv/phab/phabricator/webroot/rsrc//srv/phab/libext/ava/src
+    onlyif  => /usr/bin/test -e /srv/phab/libext//srv/phab/libext/ava/src/rsrc/webroot-static

File[/var/run/aphlict/]

Parameters differences:

--- File[/var/run/aphlict/].orig
+++ File[/var/run/aphlict/]

+    owner  => aphlict
+    ensure => directory
+    path   => /var/run/aphlict
+    before => ['File[/var/log/aphlict/]']
+    group  => aphlict

Package[apachetop]

Parameters differences:

--- Package[apachetop].orig
+++ Package[apachetop]

+    provider => apt
+    ensure   => present

File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.timer].orig
+++ File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.timer]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.timer (phabricator_stats_job_yearly_metrics.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_yearly_metrics.timer.orig
+++ /lib/systemd/system/phabricator_stats_job_yearly_metrics.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_stats_job_yearly_metrics.service
+
+[Timer]
+Unit=phabricator_stats_job_yearly_metrics.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-1-1 0:0:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

File[/etc/nftables/input/10_phabmain_http.nft]

Parameters differences:

--- File[/etc/nftables/input/10_phabmain_http.nft].orig
+++ File[/etc/nftables/input/10_phabmain_http.nft]

+    notify  => ['Service[nftables]']
+    mode    => 0444
+    tag     => nft
+    owner   => root
+    ensure  => present
+    require => ['Nftables::Set[DEPLOYMENT_HOSTS]']
+    group   => root

Content differences:

--- /etc/nftables/input/10_phabmain_http.nft.orig
+++ /etc/nftables/input/10_phabmain_http.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr @DEPLOYMENT_HOSTS_ipv4 tcp dport { 80 } accept
+ip6 saddr @DEPLOYMENT_HOSTS_ipv6 tcp dport { 80 } accept

File[/etc/rsyslog.d/40-backup-home-dirs.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-backup-home-dirs.conf].orig
+++ File[/etc/rsyslog.d/40-backup-home-dirs.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-backup-home-dirs.conf.orig
+++ /etc/rsyslog.d/40-backup-home-dirs.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "backup-home-dirs" then {
+    action(
+        type="omfile" file="/var/log/backup-home-dirs/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

File[/etc/phab_epipe.conf]

Parameters differences:

--- File[/etc/phab_epipe.conf].orig
+++ File[/etc/phab_epipe.conf]

+    owner  => mail
+    ensure => file
+    group  => root

Content differences:

--- /etc/phab_epipe.conf.orig
+++ /etc/phab_epipe.conf
@@ -0,0 +1,8 @@
+# This file is managed by Puppet.
+
+[default]
+
+maint = false
+
+[phab_bot]
+root_dir = /srv/phab/phabricator/

File[/usr/local/bin/backup-home-dirs]

Parameters differences:

--- File[/usr/local/bin/backup-home-dirs].orig
+++ File[/usr/local/bin/backup-home-dirs]

+    mode   => 0555
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /usr/local/bin/backup-home-dirs.orig
+++ /usr/local/bin/backup-home-dirs
@@ -0,0 +1,3 @@
+#!/bin/bash
+for user in $(ls /home); do
+tar czfv /srv/homes/${user}-$(hostname -s).tar.gz /home/${user}; done

Rsyslog::Conf[rsync-phabricator-home-dirs]

Parameters differences:

--- Rsyslog::Conf[rsync-phabricator-home-dirs].orig
+++ Rsyslog::Conf[rsync-phabricator-home-dirs]

+    mode     => 0444
+    require  => File[/var/log/rsync-phabricator-home-dirs]
+    priority => 40
+    ensure   => absent

Logrotate::Conf[wmf_auto_restart_aphlict]

Parameters differences:

--- Logrotate::Conf[wmf_auto_restart_aphlict].orig
+++ Logrotate::Conf[wmf_auto_restart_aphlict]

+    ensure => absent

Logrotate::Conf[exim4-paniclog]

Parameters differences:

--- Logrotate::Conf[exim4-paniclog].orig
+++ Logrotate::Conf[exim4-paniclog]

+    source => puppet:///modules/exim4/logrotate/exim4-paniclog
+    ensure => present

Systemd::Timer::Job[phabricator_stats_job_yearly_metrics]

Parameters differences:

--- Systemd::Timer::Job[phabricator_stats_job_yearly_metrics].orig
+++ Systemd::Timer::Job[phabricator_stats_job_yearly_metrics]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => phabricator statistics mail - yearly_metrics
+    command                   => /usr/local/bin/yearly_metrics.sh
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-1-1 0:0:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

File[/etc/phab_community_metrics.conf]

Parameters differences:

--- File[/etc/phab_community_metrics.conf].orig
+++ File[/etc/phab_community_metrics.conf]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/phab_community_metrics.conf.orig
+++ /etc/phab_community_metrics.conf
@@ -0,0 +1,8 @@
+declare rcpt_address='wikitech-l@lists.wikimedia.org'
+declare sndr_address='aklapper@wikimedia.org'
+
+declare sql_host='m3-slave.codfw.wmnet'
+declare sql_port='3323'
+declare sql_user='metrics_user'
+declare sql_name='phabricator_maniphest'
+declare sql_pass='metrics_pass'

File[/etc/logrotate.d/phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- File[/etc/logrotate.d/phabricator_stats_job_quarterly_wmf_qls].orig
+++ File[/etc/logrotate.d/phabricator_stats_job_quarterly_wmf_qls]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/phabricator_stats_job_quarterly_wmf_qls.orig
+++ /etc/logrotate.d/phabricator_stats_job_quarterly_wmf_qls
@@ -0,0 +1,12 @@
+# logrotate(8) config for phabricator_stats_job_quarterly_wmf_qls
+
+/var/log/phabricator_stats_job_quarterly_wmf_qls/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

Rsyslog::Conf[backup-home-dirs]

Parameters differences:

--- Rsyslog::Conf[backup-home-dirs].orig
+++ Rsyslog::Conf[backup-home-dirs]

+    mode     => 0444
+    require  => File[/var/log/backup-home-dirs]
+    priority => 40
+    ensure   => absent

Systemd::Unit[phabricator_stats_job_project_changes.service]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_project_changes.service].orig
+++ Systemd::Unit[phabricator_stats_job_project_changes.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_project_changes.service
+    require           => ['Class[Systemd]']

File[/etc/phab_tech_news_weekly_stats.conf]

Parameters differences:

--- File[/etc/phab_tech_news_weekly_stats.conf].orig
+++ File[/etc/phab_tech_news_weekly_stats.conf]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/phab_tech_news_weekly_stats.conf.orig
+++ /etc/phab_tech_news_weekly_stats.conf
@@ -0,0 +1,7 @@
+declare rcpt_address='nwilson@wikimedia.org,jjonsson@wikimedia.org,bevellin@wikimedia.org,uzoma@wikimedia.org,stei@wikimedia.org'
+declare sndr_address='aklapper@wikimedia.org'
+declare sql_host='m3-slave.codfw.wmnet'
+declare sql_port='3323'
+declare sql_user='metrics_user'
+declare sql_name='phabricator_maniphest'
+declare sql_pass='metrics_pass'

File[/etc/bacula/ssl]

Parameters differences:

--- File[/etc/bacula/ssl].orig
+++ File[/etc/bacula/ssl]

+    mode   => 0555
+    owner  => bacula
+    ensure => directory
+    group  => bacula

Systemd::Service[wmf_auto_restart_aphlict]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_aphlict].orig
+++ Systemd::Service[wmf_auto_restart_aphlict]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[wmf_auto_restart_aphlict.service]
+    monitoring_contact_group => admins

File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.service]

Parameters differences:

--- File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.service].orig
+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.service]

+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-apache-exporter.service (wmf_auto_restart_prometheus-apache-exporter.service)]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.service.orig
+++ /lib/systemd/system/wmf_auto_restart_prometheus-apache-exporter.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Auto restart job: prometheus-apache-exporter
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/wmf-auto-restart -s prometheus-apache-exporter

File[/etc/phab_quarterly_metrics.conf]

Parameters differences:

--- File[/etc/phab_quarterly_metrics.conf].orig
+++ File[/etc/phab_quarterly_metrics.conf]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/phab_quarterly_metrics.conf.orig
+++ /etc/phab_quarterly_metrics.conf
@@ -0,0 +1,8 @@
+declare rcpt_address='lgoto@wikimedia.org,aklapper@wikimedia.org'
+declare sndr_address='aklapper@wikimedia.org'
+
+declare sql_host='m3-slave.codfw.wmnet'
+declare sql_port='3323'
+declare sql_user='metrics_user'
+declare sql_name='phabricator_maniphest'
+declare sql_pass='metrics_pass'

File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-apache-exporter.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-apache-exporter.conf].orig
+++ File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-apache-exporter.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-wmf-auto-restart-prometheus-apache-exporter.conf.orig
+++ /etc/rsyslog.d/40-wmf-auto-restart-prometheus-apache-exporter.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "wmf_auto_restart_prometheus-apache-exporter" then {
+    action(
+        type="omfile" file="/var/log/wmf_auto_restart_prometheus-apache-exporter/syslog.log"
+        fileOwner="root" fileGroup="root"
+        fileCreateMode="0644"
+    )
+    & stop
+}

Admin::User[gjg]

Parameters differences:

--- Admin::User[gjg].orig
+++ Admin::User[gjg]

+    comment  => Greg Grossmeier
+    ensure   => present
+    shell    => /bin/bash
+    ssh_keys => ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPul+urK7qgLY7UucRRj9SljZFB/DWpMKZ1KMragNGbc greg@carbon12']
+    groups   => []
+    home_dir => /home/gjg
+    gid      => 500
+    uid      => 2890

Systemd::Service[aphlict]

Parameters differences:

--- Systemd::Service[aphlict].orig
+++ Systemd::Service[aphlict]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => service
+    service_params           => {'hasrestart': False}
+    require                  => User[aphlict]
+    monitoring_contact_group => admins

Nftables::Service[ssh_cluster]

Parameters differences:

--- Nftables::Service[ssh_cluster].orig
+++ Nftables::Service[ssh_cluster]

+    ensure              => present
+    port                => 22
+    proto               => tcp
+    prio                => 10
+    notrack             => False
+    src_ips             => ['10.192.27.6', '10.64.16.101', '2620:0:860:114:10:192:27:6', '2620:0:861:102:10:64:16:101']
+    unrestricted_access => False
+    desc                =>

Exec[systemd daemon-reload for aphlict.service (aphlict)]

Parameters differences:

--- Exec[systemd daemon-reload for aphlict.service (aphlict)].orig
+++ Exec[systemd daemon-reload for aphlict.service (aphlict)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Nftables::Service[phabmain_http]

Parameters differences:

--- Nftables::Service[phabmain_http].orig
+++ Nftables::Service[phabmain_http]

+    ensure              => present
+    port                => 80
+    proto               => tcp
+    src_sets            => ['DEPLOYMENT_HOSTS']
+    prio                => 10
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Systemd::Timer::Job[phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- Systemd::Timer::Job[phabricator_stats_job_tech_news_weekly_stats].orig
+++ Systemd::Timer::Job[phabricator_stats_job_tech_news_weekly_stats]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => phabricator statistics mail - tech_news_weekly_stats
+    command                   => /usr/local/bin/tech_news_weekly_stats.sh
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': 'Thursday *-*-* 12:0:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

Exec[systemd daemon-reload for phabricator_task_dump.timer (phabricator_task_dump.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_task_dump.timer (phabricator_task_dump.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_task_dump.timer (phabricator_task_dump.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/etc/default/rsync]

Parameters differences:

--- File[/etc/default/rsync].orig
+++ File[/etc/default/rsync]

+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/default/rsync.orig
+++ /etc/default/rsync
@@ -0,0 +1,46 @@
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///rsync/rsync.default.erb
+#####################################################################
+
+# defaults file for rsync daemon mode
+
+# start rsync in daemon mode from init.d script?
+#  only allowed values are "true", "false", and "inetd"
+#  Use "inetd" if you want to start the rsyncd from inetd,
+#  all this does is prevent the init.d script from printing a message
+#  about not starting rsyncd (you still need to modify inetd's config yourself).
+RSYNC_ENABLE=true
+
+# which file should be used as the configuration file for rsync.
+# This file is used instead of the default /etc/rsyncd.conf
+# Warning: This option has no effect if the daemon is accessed
+#          using a remote shell. When using a different file for
+#          rsync you might want to symlink /etc/rsyncd.conf to
+#          that file.
+RSYNC_CONFIG_FILE=/etc/rsyncd.conf
+
+# what extra options to give rsync --daemon?
+#  that excludes the --daemon; that's always done in the init.d script
+#  Possibilities are:
+#   --address=123.45.67.89		(bind to a specific IP address)
+#   --port=8730				(bind to specified port; default 873)
+RSYNC_OPTS=''
+
+# run rsyncd at a nice level?
+#  the rsync daemon can impact performance due to much I/O and CPU usage,
+#  so you may want to run it at a nicer priority than the default priority.
+#  Allowed values are 0 - 19 inclusive; 10 is a reasonable value.
+RSYNC_NICE=''
+
+# run rsyncd with ionice?
+#  "ionice" does for IO load what "nice" does for CPU load.
+#  As rsync is often used for backups which aren't all that time-critical,
+#  reducing the rsync IO priority will benefit the rest of the system.
+#  See the manpage for ionice for allowed options.
+#  -c3 is recommended, this will run rsync IO at "idle" priority. Uncomment
+#  the next line to activate this.
+# RSYNC_IONICE='-c3'
+
+# Don't forget to create an appropriate config file,
+# else the daemon will not start.

Service[phabricator_stats_job_community_metrics.timer]

Parameters differences:

--- Service[phabricator_stats_job_community_metrics.timer].orig
+++ Service[phabricator_stats_job_community_metrics.timer]

+    before   => ['Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.timer (phabricator_stats_job_community_metrics.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.csr]

Parameters differences:

--- File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.csr].orig
+++ File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.csr]

+    mode   => 0440
+    owner  => envoy
+    ensure => file
+    group  => envoy

Admin::Hashuser[mbinder]

Parameters differences:

--- Admin::Hashuser[mbinder].orig
+++ Admin::Hashuser[mbinder]

+    ensure_ssh_key => True

File[/var/spool/exim4/db]

Parameters differences:

--- File[/var/spool/exim4/db].orig
+++ File[/var/spool/exim4/db]

+    mode    => 1777
+    owner   => Debian-exim
+    ensure  => directory
+    before  => Service[exim4]
+    require => ['Mount[/var/spool/exim4/scan]', 'Mount[/var/spool/exim4/db]']
+    group   => Debian-exim

File[/etc/logrotate.d/rsync-phabricator-repos]

Parameters differences:

--- File[/etc/logrotate.d/rsync-phabricator-repos].orig
+++ File[/etc/logrotate.d/rsync-phabricator-repos]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/rsync-phabricator-repos.orig
+++ /etc/logrotate.d/rsync-phabricator-repos
@@ -0,0 +1,12 @@
+# logrotate(8) config for rsync-phabricator-repos
+
+/var/log/rsync-phabricator-repos/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

File[/etc/resolv.conf]

Content differences:

--- /etc/resolv.conf.orig
+++ /etc/resolv.conf
@@ -2,6 +2,6 @@
 #### THIS FILE IS MANAGED BY PUPPET
 ####  as template('resolvconf/resolv.conf.erb')
 #####################################################################
-search codfw.wmnet 
+search codfw.wmnet eqiad.wmnet
 options timeout:1 attempts:3 ndots:1
 nameserver 10.3.0.1

File_line[auto_restart_file_presence_aphlict]

Parameters differences:

--- File_line[auto_restart_file_presence_aphlict].orig
+++ File_line[auto_restart_file_presence_aphlict]

+    require => File[/etc/debdeploy-client/autorestarts.conf]
+    line    => aphlict
+    ensure  => absent
+    path    => /etc/debdeploy-client/autorestarts.conf

File[/usr/local/bin/git-http-backend]

Parameters differences:

--- File[/usr/local/bin/git-http-backend].orig
+++ File[/usr/local/bin/git-http-backend]

+    owner   => root
+    ensure  => link
+    target  => /usr/lib/git-core/git-http-backend
+    require => Package[git]
+    group   => root

Rsyslog::Conf[wmf_auto_restart_envoyproxy]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_envoyproxy].orig
+++ Rsyslog::Conf[wmf_auto_restart_envoyproxy]

+    mode     => 0444
+    require  => File[/var/log/wmf_auto_restart_envoyproxy]
+    priority => 40
+    ensure   => absent

Service[phabricator_stats_job_quarterly_wmf_qls.timer]

Parameters differences:

--- Service[phabricator_stats_job_quarterly_wmf_qls.timer].orig
+++ Service[phabricator_stats_job_quarterly_wmf_qls.timer]

+    before   => ['Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.timer (phabricator_stats_job_quarterly_wmf_qls.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

Motd::Script[backups-home]

Parameters differences:

--- Motd::Script[backups-home].orig
+++ Motd::Script[backups-home]

+    tag      => backup-motd
+    priority => 6
+    ensure   => present

File[/srv/phab/phabricator/scripts/repository/]

Parameters differences:

--- File[/srv/phab/phabricator/scripts/repository/].orig
+++ File[/srv/phab/phabricator/scripts/repository/]

+    recurse => True
+    owner   => phd
+    path    => /srv/phab/phabricator/scripts/repository
+    group   => root

Concat[/etc/rsyncd.conf]

Parameters differences:

--- Concat[/etc/rsyncd.conf].orig
+++ Concat[/etc/rsyncd.conf]

+    warn           => False
+    ensure         => present
+    show_diff      => True
+    replace        => True
+    ensure_newline => False
+    force          => False
+    format         => plain
+    mode           => 0444
+    owner          => root
+    path           => /etc/rsyncd.conf
+    order          => alpha
+    backup         => puppet
+    group          => root

Class[Envoyproxy]

Parameters differences:

--- Class[Envoyproxy].orig
+++ Class[Envoyproxy]

+    pkg_name        => envoyproxy
+    admin_port      => 9631
+    runtime         => {}
+    ensure          => present
+    use_override    => True
+    service_cluster => misc

File[/etc/envoy/envoy.yaml]

Parameters differences:

--- File[/etc/envoy/envoy.yaml].orig
+++ File[/etc/envoy/envoy.yaml]

+    mode   => 0644
+    owner  => root
+    ensure => present
+    group  => root

Class[Phabricator::Vcs]

Parameters differences:

--- Class[Phabricator::Vcs].orig
+++ Class[Phabricator::Vcs]

+    ssh_phab_service_ensure => absent
+    phd_user                => phd
+    proxy                   => http://url-downloader.codfw.wikimedia.org:8080
+    phd_log_dir             => /var/log/phd
+    basedir                 => /srv/phab
+    require                 => ['Package[phabricator/deployment]']
+    listen_addresses        => []
+    vcs_user                => vcs
+    ssh_port                => 22

File[/etc/nftables/input/10_ssh_cluster.nft]

Parameters differences:

--- File[/etc/nftables/input/10_ssh_cluster.nft].orig
+++ File[/etc/nftables/input/10_ssh_cluster.nft]

+    notify => ['Service[nftables]']
+    mode   => 0444
+    tag    => nft
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/nftables/input/10_ssh_cluster.nft.orig
+++ /etc/nftables/input/10_ssh_cluster.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr { 10.192.27.6, 10.64.16.101 } tcp dport { 22 } accept
+ip6 saddr { 2620:0:860:114:10:192:27:6, 2620:0:861:102:10:64:16:101 } tcp dport { 22 } accept

File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem]

Parameters differences:

--- File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem]

+    require => Exec[create chained cert /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chain.pem]
+    owner   => envoy
+    ensure  => file
+    group   => envoy

Service[phabricator_stats_job_tech_news_weekly_stats.timer]

Parameters differences:

--- Service[phabricator_stats_job_tech_news_weekly_stats.timer].orig
+++ Service[phabricator_stats_job_tech_news_weekly_stats.timer]

+    before   => ['Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.timer (phabricator_stats_job_tech_news_weekly_stats.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

Concat_fragment[/etc/rsyncd.conf-header]

Parameters differences:

--- Concat_fragment[/etc/rsyncd.conf-header].orig
+++ Concat_fragment[/etc/rsyncd.conf-header]

+    order  => 01
+    tag    => _etc_rsyncd.conf
+    target => /etc/rsyncd.conf

Content differences:

--- /etc/rsyncd.conf-header.orig
+++ /etc/rsyncd.conf-header
@@ -0,0 +1,11 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+
+uid = nobody
+gid = nogroup
+use chroot = yes
+
+log format = %t %a %m %f %b
+syslog facility = local3
+timeout = 300
+address = 0.0.0.0

Cfssl::Cert[discovery2026__phabricator_discovery_wmnet_server]

Parameters differences:

--- Cfssl::Cert[discovery2026__phabricator_discovery_wmnet_server].orig
+++ Cfssl::Cert[discovery2026__phabricator_discovery_wmnet_server]

+    notify          => Service[envoyproxy.service]
+    ensure          => present
+    mode            => 0740
+    notify_services => []
+    key             => {'algo': 'ecdsa', 'size': 256}
+    hosts           => ['phabricator.wikimedia.org', 'phab.wmfusercontent.org', 'bugs.wikimedia.org', 'bugzilla.wikimedia.org']
+    owner           => envoy
+    before          => Exec[verify-envoy-config]
+    names           => []
+    provide_chain   => True
+    common_name     => phabricator.discovery.wmnet
+    renew_seconds   => 952200
+    before_services => []
+    profile         => server
+    environment     => ['GODEBUG=x509ignoreCN=0']
+    outdir          => /etc/envoy/ssl
+    auto_renew      => True
+    require         => Package[envoyproxy]
+    group           => envoy
+    label           => discovery2026

Sslcert::X509_to_pkcs12[puppet::expose_agent_cert: /etc/bacula]

Parameters differences:

--- Sslcert::X509_to_pkcs12[puppet::expose_agent_cert: /etc/bacula].orig
+++ Sslcert::X509_to_pkcs12[puppet::expose_agent_cert: /etc/bacula]

+    private_key => /var/lib/puppet/ssl/private_keys/phab2003.codfw.wmnet.pem
+    owner       => bacula
+    public_key  => /var/lib/puppet/ssl/certs/phab2003.codfw.wmnet.pem
+    ensure      => absent
+    certfile    => /var/lib/puppet/ssl/certs/ca.pem
+    group       => bacula
+    outfile     => /etc/bacula/ssl/server.p12

File[/lib/systemd/system/phd.service]

Parameters differences:

--- File[/lib/systemd/system/phd.service].orig
+++ File[/lib/systemd/system/phd.service]

+    notify => Exec[systemd daemon-reload for phd.service (phd)]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /lib/systemd/system/phd.service.orig
+++ /lib/systemd/system/phd.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=phabricator-phd
+After=syslog.target network.target mysql.service
+Before=apache2.service
+
+[Service]
+Type=forking
+User=phd
+Group=phd
+Environment="PHABRICATOR_ENV=phd"
+RuntimeDirectory=phd
+ExecStart=/srv/phab/phabricator/bin/phd start
+ExecStop=/srv/phab/phabricator/bin/phd stop --force
+RestartSec=10
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

File[/etc/bacula/ssl/server.p12]

Parameters differences:

--- File[/etc/bacula/ssl/server.p12].orig
+++ File[/etc/bacula/ssl/server.p12]

+    mode   => 0440
+    owner  => bacula
+    ensure => absent
+    group  => bacula

Systemd::Service[wmf_auto_restart_envoyproxy]

Parameters differences:

--- Systemd::Service[wmf_auto_restart_envoyproxy].orig
+++ Systemd::Service[wmf_auto_restart_envoyproxy]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[wmf_auto_restart_envoyproxy.service]
+    monitoring_contact_group => admins

File[/etc/nftables/input/10_rsyncd_access_srv-dumps.nft]

Parameters differences:

--- File[/etc/nftables/input/10_rsyncd_access_srv-dumps.nft].orig
+++ File[/etc/nftables/input/10_rsyncd_access_srv-dumps.nft]

+    notify => ['Service[nftables]']
+    mode   => 0444
+    tag    => nft
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/nftables/input/10_rsyncd_access_srv-dumps.nft.orig
+++ /etc/nftables/input/10_rsyncd_access_srv-dumps.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr { 10.192.27.6, 10.64.16.101, 208.80.154.142, 208.80.154.71 } tcp dport { 873, 1873 } accept
+ip6 saddr { 2620:0:860:114:10:192:27:6, 2620:0:861:102:10:64:16:101, 2620:0:861:2:208:80:154:142, 2620:0:861:3:208:80:154:71 } tcp dport { 873, 1873 } accept

Firewall::Service[envoy_tls_termination_src_sets]

Parameters differences:

--- Firewall::Service[envoy_tls_termination_src_sets].orig
+++ Firewall::Service[envoy_tls_termination_src_sets]

+    ensure              => present
+    port                => 443
+    proto               => tcp
+    src_sets            => ['CACHES']
+    prio                => 10
+    notrack             => True
+    unrestricted_access => False
+    desc                =>

Systemd::Service[rsync-phabricator-repos]

Parameters differences:

--- Systemd::Service[rsync-phabricator-repos].orig
+++ Systemd::Service[rsync-phabricator-repos]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[rsync-phabricator-repos.service]
+    monitoring_contact_group => admins

File[/etc/sysctl.d/70-phabricator-network-tuning.conf]

Parameters differences:

--- File[/etc/sysctl.d/70-phabricator-network-tuning.conf].orig
+++ File[/etc/sysctl.d/70-phabricator-network-tuning.conf]

+    notify => Exec[update_sysctl]
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/sysctl.d/70-phabricator-network-tuning.conf.orig
+++ /etc/sysctl.d/70-phabricator-network-tuning.conf
@@ -0,0 +1,3 @@
+# sysctl parameters managed by Puppet.
+net.ipv4.ip_local_port_range = 4001 65534
+net.ipv4.tcp_tw_reuse = 1

Profile::Auto_restarts::Service[aphlict]

Parameters differences:

--- Profile::Auto_restarts::Service[aphlict].orig
+++ Profile::Auto_restarts::Service[aphlict]

+    ensure => absent

Rsync::Quickdatacopy[phabricator-home-dirs]

Parameters differences:

--- Rsync::Quickdatacopy[phabricator-home-dirs].orig
+++ Rsync::Quickdatacopy[phabricator-home-dirs]

+    dest_host                  => phab2002.codfw.wmnet
+    module_path                => /srv/homes
+    ensure                     => present
+    source_host                => phab1004.eqiad.wmnet
+    server_uses_stunnel        => False
+    progress                   => False
+    auto_sync                  => True
+    delete                     => True
+    ignore_missing_file_errors => False
+    auto_interval              => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}

Logrotate::Conf[backup-home-dirs]

Parameters differences:

--- Logrotate::Conf[backup-home-dirs].orig
+++ Logrotate::Conf[backup-home-dirs]

+    ensure => absent

Exec[update-gitconfig]

Parameters differences:

--- Exec[update-gitconfig].orig
+++ Exec[update-gitconfig]

+    refreshonly => True
+    command     => /bin/cat /etc/gitconfig.d/*.gitconfig > /etc/gitconfig

Concat_fragment[/etc/bacula_puppet_ca_chain]

Parameters differences:

--- Concat_fragment[/etc/bacula_puppet_ca_chain].orig
+++ Concat_fragment[/etc/bacula_puppet_ca_chain]

+    order  => 02
+    tag    => _etc_bacula_ssl_cert.pem
+    source => /var/lib/puppet/ssl/certs/ca.pem
+    target => /etc/bacula/ssl/cert.pem

File[/etc/update-motd.d/05-phabricator]

Parameters differences:

--- File[/etc/update-motd.d/05-phabricator].orig
+++ File[/etc/update-motd.d/05-phabricator]

+    mode   => 0555
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/update-motd.d/05-phabricator.orig
+++ /etc/update-motd.d/05-phabricator
@@ -0,0 +1,2 @@
+#!/bin/sh
+printf "%s\n" "phab2003 is a Phabricator (main) server (phabricator)"

Systemd::Timer[wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_prometheus-apache-exporter].orig
+++ Systemd::Timer[wmf_auto_restart_prometheus-apache-exporter]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 13:4:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => present
+    unit_name          => wmf_auto_restart_prometheus-apache-exporter.service
+    splay              => 0

Systemd::Syslog[wmf_auto_restart_envoyproxy]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_envoyproxy].orig
+++ Systemd::Syslog[wmf_auto_restart_envoyproxy]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Systemd::Timer[rsync-phabricator-home-dirs]

Parameters differences:

--- Systemd::Timer[rsync-phabricator-home-dirs].orig
+++ Systemd::Timer[rsync-phabricator-home-dirs]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => rsync-phabricator-home-dirs.service
+    splay              => 0

Package[prometheus-apache-exporter]

Parameters differences:

--- Package[prometheus-apache-exporter].orig
+++ Package[prometheus-apache-exporter]

+    provider => apt
+    ensure   => installed

Package[python3-pymysql]

Parameters differences:

--- Package[python3-pymysql].orig
+++ Package[python3-pymysql]

+    provider => apt
+    ensure   => present

Exec[systemd daemon-reload for rsync-phabricator-home-dirs.timer (rsync-phabricator-home-dirs.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for rsync-phabricator-home-dirs.timer (rsync-phabricator-home-dirs.timer)].orig
+++ Exec[systemd daemon-reload for rsync-phabricator-home-dirs.timer (rsync-phabricator-home-dirs.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]

Parameters differences:

--- File[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr].orig
+++ File[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]

+    mode   => 0400
+    owner  => root
+    ensure => file
+    group  => root

Content differences:

--- /etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr.orig
+++ /etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr
@@ -0,0 +1,17 @@
+{
+  "CN": "phabricator.discovery.wmnet",
+  "hosts": [
+    "phabricator.wikimedia.org",
+    "phab.wmfusercontent.org",
+    "bugs.wikimedia.org",
+    "bugzilla.wikimedia.org",
+    "phabricator.discovery.wmnet"
+  ],
+  "key": {
+    "algo": "ecdsa",
+    "size": 256
+  },
+  "names": [
+
+  ]
+}

Service[rsync-phabricator-repos.timer]

Parameters differences:

--- Service[rsync-phabricator-repos.timer].orig
+++ Service[rsync-phabricator-repos.timer]

+    before   => ['Exec[systemd daemon-reload for rsync-phabricator-repos.timer (rsync-phabricator-repos.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

Exec[systemd daemon-reload for phd.service (phd)]

Parameters differences:

--- Exec[systemd daemon-reload for phd.service (phd)].orig
+++ Exec[systemd daemon-reload for phd.service (phd)]

+    before      => ['Service[phd]']
+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Exec[systemd daemon-reload for phabricator_clean_tmp_files.service (phabricator_clean_tmp_files.service)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_clean_tmp_files.service (phabricator_clean_tmp_files.service)].orig
+++ Exec[systemd daemon-reload for phabricator_clean_tmp_files.service (phabricator_clean_tmp_files.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Systemd::Unit[phabricator_stats_job_quarterly_metrics.timer]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_quarterly_metrics.timer].orig
+++ Systemd::Unit[phabricator_stats_job_quarterly_metrics.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_quarterly_metrics.timer
+    require           => ['Class[Systemd]']

Rsyslog::Conf[wmf_auto_restart_aphlict]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_aphlict].orig
+++ Rsyslog::Conf[wmf_auto_restart_aphlict]

+    mode     => 0444
+    require  => File[/var/log/wmf_auto_restart_aphlict]
+    priority => 40
+    ensure   => absent

Systemd::Timer[wmf_auto_restart_envoyproxy]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_envoyproxy].orig
+++ Systemd::Timer[wmf_auto_restart_envoyproxy]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 19:9:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => wmf_auto_restart_envoyproxy.service
+    splay              => 0

User[mbinder]

Parameters differences:

--- User[mbinder].orig
+++ User[mbinder]

+    comment    => Max Binder
+    managehome => False
+    ensure     => present
+    shell      => /bin/bash
+    groups     => []
+    allowdupe  => False
+    gid        => 500
+    home       => /home/mbinder
+    uid        => 14304

Motd::Script[backups-srv-repos]

Parameters differences:

--- Motd::Script[backups-srv-repos].orig
+++ Motd::Script[backups-srv-repos]

+    tag      => backup-motd
+    priority => 6
+    ensure   => present

File[/lib/systemd/system/phabricator_stats_job_community_metrics.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_community_metrics.service].orig
+++ File[/lib/systemd/system/phabricator_stats_job_community_metrics.service]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.service (phabricator_stats_job_community_metrics.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_community_metrics.service.orig
+++ /lib/systemd/system/phabricator_stats_job_community_metrics.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator statistics mail - community_metrics
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/community_metrics.sh

Nftables::Service[bacula-file-daemon-backup1014.eqiad.wmnet]

Parameters differences:

--- Nftables::Service[bacula-file-daemon-backup1014.eqiad.wmnet].orig
+++ Nftables::Service[bacula-file-daemon-backup1014.eqiad.wmnet]

+    ensure              => present
+    port                => 9102
+    proto               => tcp
+    prio                => 10
+    notrack             => False
+    src_ips             => ['10.64.183.10', '2620:0:861:13d:10:64:183:10']
+    unrestricted_access => False
+    desc                =>

Systemd::Timer::Job[phabricator_clean_tmp_files]

Parameters differences:

--- Systemd::Timer::Job[phabricator_clean_tmp_files].orig
+++ Systemd::Timer::Job[phabricator_clean_tmp_files]

+    monitoring_contact_groups => admins
+    ensure                    => present
+    private_tmp               => False
+    description               => phabricator cleanup temp files
+    command                   => /usr/bin/find /tmp -ignore_readdir_race -user www-data -mtime +14 -delete
+    success_exit_status       => []
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* 07:00:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

File[/lib/systemd/system/phabricator_stats_job_community_metrics.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_community_metrics.timer].orig
+++ File[/lib/systemd/system/phabricator_stats_job_community_metrics.timer]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_community_metrics.timer (phabricator_stats_job_community_metrics.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_community_metrics.timer.orig
+++ /lib/systemd/system/phabricator_stats_job_community_metrics.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_stats_job_community_metrics.service
+
+[Timer]
+Unit=phabricator_stats_job_community_metrics.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-*-1 0:0:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

File[/home/urbanecm]

Parameters differences:

--- File[/home/urbanecm].orig
+++ File[/home/urbanecm]

+    mode    => 0644
+    source  => puppet:///modules/admin/home/urbanecm
+    recurse => remote
+    owner   => urbanecm
+    ensure  => directory
+    force   => True
+    group   => 500

File[/home/gjg]

Parameters differences:

--- File[/home/gjg].orig
+++ File[/home/gjg]

+    mode    => 0644
+    source  => puppet:///modules/admin/home/skel
+    recurse => remote
+    owner   => gjg
+    ensure  => directory
+    force   => True
+    group   => 500

Rsyslog::Conf[phabricator_task_dump]

Parameters differences:

--- Rsyslog::Conf[phabricator_task_dump].orig
+++ Rsyslog::Conf[phabricator_task_dump]

+    mode     => 0444
+    require  => File[/var/log/phabricator_task_dump]
+    priority => 40
+    ensure   => absent

Admin::User[mbinder]

Parameters differences:

--- Admin::User[mbinder].orig
+++ Admin::User[mbinder]

+    comment  => Max Binder
+    ensure   => present
+    shell    => /bin/bash
+    ssh_keys => ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLrpbK99cmNng3y8t1qYOvTKksI4TZKtQSTsF9RZ1pC maxbinder@Maxs-MacBook-Air.local']
+    groups   => []
+    home_dir => /home/mbinder
+    gid      => 500
+    uid      => 14304

Systemd::Timer[rsync-phabricator-repos]

Parameters differences:

--- Systemd::Timer[rsync-phabricator-repos].orig
+++ Systemd::Timer[rsync-phabricator-repos]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => rsync-phabricator-repos.service
+    splay              => 0

Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.timer (phabricator_stats_job_yearly_metrics.timer)]

Parameters differences:

--- Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.timer (phabricator_stats_job_yearly_metrics.timer)].orig
+++ Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.timer (phabricator_stats_job_yearly_metrics.timer)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/etc/rsyslog.d/10-input-file-apache2-error.conf]

Parameters differences:

--- File[/etc/rsyslog.d/10-input-file-apache2-error.conf].orig
+++ File[/etc/rsyslog.d/10-input-file-apache2-error.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/rsyslog.d/10-input-file-apache2-error.conf.orig
+++ /etc/rsyslog.d/10-input-file-apache2-error.conf
@@ -0,0 +1,8 @@
+# This file managed by puppet rsyslog::input::file
+
+input(type="imfile"
+      File="/var/log/apache2/*error*.log"
+      reopenOnTruncate="on"
+      addMetadata="off"
+      addCeeTag="off"
+      Tag="input-file-apache2-error")

Exec[mkdir /var/spool/exim4/scan]

Parameters differences:

--- Exec[mkdir /var/spool/exim4/scan].orig
+++ Exec[mkdir /var/spool/exim4/scan]

+    creates => /var/spool/exim4/scan
+    require => Package[exim4-daemon-heavy]
+    path    => /bin:/usr/bin

Rsyslog::Conf[envoy]

Parameters differences:

--- Rsyslog::Conf[envoy].orig
+++ Rsyslog::Conf[envoy]

+    mode     => 0444
+    require  => File[/var/log/envoy]
+    priority => 40
+    ensure   => present

Systemd::Syslog[wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- Systemd::Syslog[wmf_auto_restart_prometheus-apache-exporter].orig
+++ Systemd::Syslog[wmf_auto_restart_prometheus-apache-exporter]

+    readable_by            => all
+    ensure                 => present
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Class[Profile::Phabricator::Datasync]

Parameters differences:

--- Class[Profile::Phabricator::Datasync].orig
+++ Class[Profile::Phabricator::Datasync]

+    dumps_rsync_clients => ['phab1004.eqiad.wmnet', 'phab2002.codfw.wmnet', 'clouddumps1001.wikimedia.org', 'clouddumps1002.wikimedia.org']
+    active_server       => phab1004.eqiad.wmnet
+    home_sync_dir       => /srv/homes
+    passive_server      => phab2002.codfw.wmnet

Rsync::Server::Module[srv-dumps]

Parameters differences:

--- Rsync::Server::Module[srv-dumps].orig
+++ Rsync::Server::Module[srv-dumps]

+    chroot          => True
+    ensure          => present
+    lock_file       => /var/run/rsyncd.lock
+    qos_low         => False
+    read_only       => yes
+    auto_firewall   => True
+    write_only      => no
+    max_connections => 0
+    path            => /srv/dumps
+    list            => yes
+    gid             => 0
+    hosts_allow     => ['phab1004.eqiad.wmnet', 'phab2002.codfw.wmnet', 'clouddumps1001.wikimedia.org', 'clouddumps1002.wikimedia.org']
+    uid             => 0

File[/etc/rsyslog.d/40-envoy.conf]

Parameters differences:

--- File[/etc/rsyslog.d/40-envoy.conf].orig
+++ File[/etc/rsyslog.d/40-envoy.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/rsyslog.d/40-envoy.conf.orig
+++ /etc/rsyslog.d/40-envoy.conf
@@ -0,0 +1,10 @@
+# rsyslog.conf(5) configuration file for services.
+# This file is managed by Puppet.
+if $programname startswith "envoy" then {
+    action(
+        type="omfile" file="/var/log/envoy/syslog.log"
+        fileOwner="envoy" fileGroup="envoy"
+        fileCreateMode="0640"
+    )
+    & stop
+}

Systemd::Service[phabricator_task_dump]

Parameters differences:

--- Systemd::Service[phabricator_task_dump].orig
+++ Systemd::Service[phabricator_task_dump]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_task_dump.service]
+    monitoring_contact_group => admins

Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.service (wmf_auto_restart_envoyproxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.service (wmf_auto_restart_envoyproxy.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_envoyproxy.service (wmf_auto_restart_envoyproxy.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.timer].orig
+++ File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.timer]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.timer (phabricator_stats_job_tech_news_weekly_stats.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.timer.orig
+++ /lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_stats_job_tech_news_weekly_stats.service
+
+[Timer]
+Unit=phabricator_stats_job_tech_news_weekly_stats.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=Thursday *-*-* 12:0:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

File[/lib/systemd/system/rsync-phabricator-repos.timer]

Parameters differences:

--- File[/lib/systemd/system/rsync-phabricator-repos.timer].orig
+++ File[/lib/systemd/system/rsync-phabricator-repos.timer]

+    notify => Exec[systemd daemon-reload for rsync-phabricator-repos.timer (rsync-phabricator-repos.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/rsync-phabricator-repos.timer.orig
+++ /lib/systemd/system/rsync-phabricator-repos.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of rsync-phabricator-repos.service
+
+[Timer]
+Unit=rsync-phabricator-repos.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-*-* *:00/10:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Ssh::Userkey[mbinder]

Parameters differences:

--- Ssh::Userkey[mbinder].orig
+++ Ssh::Userkey[mbinder]

+    user   => mbinder
+    ensure => present

Exec[phabricator-admin_ensure_members]

Parameters differences:

--- Exec[phabricator-admin_ensure_members].orig
+++ Exec[phabricator-admin_ensure_members]

+    logoutput => True
+    command   => /usr/bin/gpasswd phabricator-admin -M aklapper,gjg,urbanecm
+    path      => /usr/bin:/bin
+    require   => ['User[aklapper]', 'User[gjg]', 'User[urbanecm]']
+    unless    => getent group phabricator-admin | xargs test -z || getent group phabricator-admin | cut -d ':' -f 4 | grep -E ^aklapper,gjg,urbanecm$

File[/srv/phab/phabricator/scripts/mail/]

Parameters differences:

--- File[/srv/phab/phabricator/scripts/mail/].orig
+++ File[/srv/phab/phabricator/scripts/mail/]

+    mode    => 0755
+    recurse => True
+    owner   => root
+    path    => /srv/phab/phabricator/scripts/mail
+    require => ['Package[phabricator/deployment]']
+    group   => root

Class[Profile::Backup::Host]

Parameters differences:

--- Class[Profile::Backup::Host].orig
+++ Class[Profile::Backup::Host]

+    client_version => 9
+    director       => backup1014.eqiad.wmnet
+    days           => ['Sat', 'Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri']
+    enable         => True
+    pool           => productionEqiad
+    director_seed  => changeme

File[/usr/local/bin/project_changes.sh]

Parameters differences:

--- File[/usr/local/bin/project_changes.sh].orig
+++ File[/usr/local/bin/project_changes.sh]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /usr/local/bin/project_changes.sh.orig
+++ /usr/local/bin/project_changes.sh
@@ -0,0 +1,771 @@
+#!/bin/bash
+# send project changes in Phabricator for the last week (T85183)
+# to phabricator-reports@lists.wikimedia.org (T136660)
+# ! this file is managed by puppet !
+# ./modules/phabricator/file/project_changes.sh
+
+source /etc/phab_project_changes.conf
+
+#echo "result_creations_and_name_changes"
+result_creations_and_name_changes=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/project/profile/", p1.id) AS url, project_transaction1.oldValue, project_transaction1.newValue, parent.name AS parentProject, user.userName
+    FROM project_transaction project_transaction1
+    LEFT OUTER JOIN
+        (SELECT project.name, project_transaction2.objectPHID, project_transaction2.transactionType
+        FROM project_transaction AS project_transaction2
+        JOIN project
+        WHERE (project_transaction2.transactionType = "project:parent"
+        OR project_transaction2.transactionType = "project:milestone")
+        AND SUBSTRING(project_transaction2.newValue, 2,30) = project.phid
+        AND project_transaction2.dateModified > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 WEEK))) parent
+        ON parent.objectPHID = project_transaction1.objectPHID
+    JOIN phabricator_user.user
+    JOIN project p1
+    WHERE project_transaction1.transactionType = "project:name"
+    AND p1.phid = project_transaction1.objectPHID
+    AND project_transaction1.authorPHID = user.phid
+    AND project_transaction1.dateModified > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 WEEK));
+
+END
+)
+
+#echo "result_color_changes"
+result_color_changes=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/project/profile/", project.id) AS url, project_transaction.oldValue, project_transaction.newValue, project.name
+    FROM project_transaction
+    JOIN project
+    WHERE project_transaction.transactionType = "project:color"
+    AND project_transaction.objectPHID = project.phid
+    AND project_transaction.dateModified > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 WEEK));
+
+END
+)
+
+#echo "result_policy_locking_archiving_changes"
+result_policy_locking_archiving_changes=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/project/profile/", project.id) AS url, project_transaction.oldValue, project_transaction.newValue,
+    project_transaction.transactionType, project.name
+    FROM project_transaction
+    JOIN project
+    WHERE (project_transaction.transactionType = "core:join-policy"
+    OR project_transaction.transactionType = "core:edit-policy"
+    OR project_transaction.transactionType = "core:view-policy"
+    OR project_transaction.transactionType = "project:locked"
+    OR project_transaction.transactionType = "project:status")
+    AND (project_transaction.oldValue != "null"
+        OR project_transaction.newValue NOT IN ("\"public\"", "\"users\""))
+    AND project_transaction.objectPHID = project.phid
+    AND project_transaction.dateModified > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 WEEK));
+
+END
+)
+
+#echo "result_column_changes"
+result_column_changes=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/project/board/", prj.id) AS url, usr.userName, prj.name AS projectName, cl.name AS columnName, cltr.oldValue, cltr.newValue
+    FROM phabricator_project.project_columntransaction cltr
+    JOIN phabricator_project.project prj
+    JOIN phabricator_project.project_column pcl
+    JOIN phabricator_user.user usr
+    JOIN phabricator_project.project_column cl
+    WHERE (cltr.transactionType = "project:col:name"
+    OR cltr.transactionType = "project:col:status")
+    AND cltr.objectPHID = pcl.phid
+    AND pcl.projectPHID = prj.phid
+    AND cltr.authorPHID = usr.phid
+    AND cl.phid = cltr.objectPHID
+    AND cltr.dateModified > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 WEEK));
+
+END
+)
+
+#echo "result_editengine_changes"
+result_editengine_changes=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/transactions/editengine/maniphest.task/view/", seec.id) AS form, seect.transactionType, u.userName AS
+user
+    FROM phabricator_search.search_editengineconfigurationtransaction seect
+    INNER JOIN phabricator_search.search_editengineconfiguration seec ON seec.phid = seect.objectPHID
+    INNER JOIN phabricator_user.user u ON seect.authorPHID = u.phid
+    WHERE seect.dateModified > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 WEEK)) 
+    ORDER BY seec.id,seect.dateModified;
+
+END
+)
+
+#echo "result_archived_projects_open_tasks"
+# see https://phabricator.wikimedia.org/T133649
+result_archived_projects_open_tasks=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/project/profile/", p.id) AS url, sub.parentProject AS parentProject, p.name AS projectName, count(p.name) AS n
+    FROM phabricator_maniphest.edge edg
+    JOIN phabricator_maniphest.maniphest_task t
+    JOIN phabricator_project.project p
+    LEFT JOIN (SELECT p3.name AS parentProject, p3.phid FROM phabricator_project.project p3) sub
+    ON sub.phid = p.parentProjectPHID
+    WHERE edg.dst LIKE 'PHID-PROJ-%'
+    AND edg.src LIKE 'PHID-TASK-%'
+    AND p.phid = edg.dst
+    AND p.status = 100
+    AND t.phid = edg.src
+    AND (t.status = "open" OR t.status = "progress" OR t.status = "stalled")
+    AND edg.src NOT IN
+    (SELECT edg2.src
+    FROM phabricator_maniphest.edge edg2
+    JOIN phabricator_maniphest.maniphest_task t2
+    JOIN phabricator_project.project p2
+    WHERE edg2.dst LIKE 'PHID-PROJ-%'
+    AND edg2.src LIKE 'PHID-TASK-%'
+    AND edg2.dst != "PHID-PROJ-onnxucoedheq3jevknyr"
+    AND p2.phid = edg2.dst
+    AND p2.status = 0
+    AND t2.phid = edg2.src
+    AND (t.status = "open" OR t.status = "progress" OR t.status = "stalled"))
+    GROUP BY p.name
+    ORDER BY n DESC;
+
+END
+)
+
+# echo "result_problematic_color_icon_combos"
+# see https://phabricator.wikimedia.org/T249806
+result_problematic_color_icon_combos=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/project/profile/", id) AS url, name, color, icon
+    FROM phabricator_project.project
+    WHERE status != "100"
+    AND ((color = "violet" AND icon != "group")
+        OR (color = "yellow" AND icon != "tag")
+        OR (color = "orange" AND (icon != "goal" AND icon != "release"
+            AND name NOT LIKE "Cloud-Services-Origin-%"))
+        OR (color = "checkered" AND icon != "account")
+        OR (color = "green" AND icon != "timeline")
+        OR color = "indigo"
+        OR (color = "pink" AND id != 32 AND id != 1825)
+        OR (color = "red" AND id != 6674 AND icon != "policy" AND icon != "bugs")
+        OR (color = "grey" AND icon != "meta" AND name != "Trash"));
+
+END
+)
+
+# echo "result_inactive_users_assigned_tasks"
+# see https://phabricator.wikimedia.org/T157740
+result_inactive_users_assigned_tasks=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/p/", u.userName) AS userName, e.src AS taskPHID, e.dst AS "projectPHID of task" 
+    FROM phabricator_maniphest.maniphest_task t
+    JOIN phabricator_user.user u
+    JOIN phabricator_maniphest.edge e
+    WHERE u.isDisabled = 1
+    AND t.ownerPHID = u.phid
+    AND (t.status = "open" OR t.status = "progress" OR t.status = "stalled")
+    AND e.src = t.phid
+    AND e.dst LIKE "PHID-PROJ-%"
+    ORDER BY u.userName, taskPHID;
+
+END
+)
+
+# echo "result_new_user_assignees"
+# see https://phabricator.wikimedia.org/T195780
+# and https://phabricator.wikimedia.org/T227388
+result_new_user_assignees=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+SELECT DISTINCT CONCAT("https://phabricator.wikimedia.org/p/", u.userName) AS userName,
+    CONCAT("https://phabricator.wikimedia.org/T", t.id) AS id,
+    from_unixtime(t.dateModified) AS claimedOn
+    FROM phabricator_maniphest.maniphest_task t
+    JOIN phabricator_user.user u ON u.userName = t.ownerOrdering
+    WHERE t.dateModified > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 6 WEEK))
+    AND (t.status = "open" OR t.status = "progress" OR t.status = "stalled")
+    AND u.dateCreated > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 8 WEEK))
+    AND u.isDisabled = 0
+    AND t.ownerOrdering IS NOT NULL
+    AND t.closerPHID IS NULL
+    AND t.phid NOT IN
+        (SELECT e.src FROM phabricator_maniphest.edge e
+        WHERE e.type = 41 AND e.dst = "PHID-PROJ-onnxucoedheq3jevknyr") 
+    AND t.ownerOrdering IN
+        (SELECT t.ownerOrdering FROM phabricator_maniphest.maniphest_task t
+        JOIN phabricator_user.user u
+        WHERE u.userName = t.ownerOrdering
+        AND u.dateCreated > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 8 WEEK))
+        GROUP BY t.ownerOrdering HAVING COUNT(t.ownerOrdering) < 4)
+    ORDER BY claimedOn, userName;
+
+END
+)
+
+#echo "result_user_profile_urls"
+# see https://phabricator.wikimedia.org/T250946
+result_user_profile_urls=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/p/", u.userName) AS userName
+    FROM phabricator_user.user u
+    INNER JOIN phabricator_user.user_profile up
+    WHERE up.userPHID = u.phid
+    AND u.isDisabled = 0
+    AND up.blurb LIKE "%http%"
+    AND up.dateModified > (UNIX_TIMESTAMP() - 605300);
+END
+)
+
+#echo "result_workboard_column_triggers"
+# see https://phabricator.wikimedia.org/T260427
+result_workboard_column_triggers=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/p/", u.userName) AS author,
+    CONCAT("https://phabricator.wikimedia.org/project/board/", p.id) AS url,
+    pc.name AS columnname
+    FROM phabricator_project.project p
+    INNER JOIN phabricator_project.project_column pc
+    INNER JOIN phabricator_project.project_triggertransaction ptt
+    INNER JOIN phabricator_user.user u
+    WHERE pc.projectPHID = p.phid
+    AND pc.triggerPHID = ptt.objectPHID
+    AND ptt.transactionType = "ruleset"
+    AND ptt.authorPHID = u.phid
+    AND ptt.dateModified > (UNIX_TIMESTAMP() - 605300)
+    ORDER BY ptt.dateModified;
+END
+)
+
+#echo "result_dashboard_panels"
+# see https://phabricator.wikimedia.org/T260428
+result_dashboard_panels=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/W", dp.id) AS panel,
+    u.userName AS author,
+    u.isDisabled AS disabled,
+    dp.name AS panelName,
+    dp.viewPolicy AS viewPolicy
+    FROM phabricator_dashboard.dashboard_panel dp
+    INNER JOIN phabricator_user.user u
+    WHERE dp.authorPHID = u.phid
+    AND dp.dateModified > (UNIX_TIMESTAMP() - 605300)
+    ORDER BY dp.dateModified;
+END
+)
+
+#echo "result_dashboards"
+# see https://phabricator.wikimedia.org/T323471
+result_dashboards=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/dashboard/view/", d.id) AS dashboard,
+    d.phid,
+    u.userName AS author,
+    u.isDisabled AS disabled,
+    d.name AS dashboardName,
+    d.viewPolicy AS viewPolicy
+    FROM phabricator_dashboard.dashboard d
+    INNER JOIN phabricator_user.user u
+    WHERE d.authorPHID = u.phid
+    AND d.dateModified > (UNIX_TIMESTAMP() - 605300)
+    ORDER BY d.dateModified;
+END
+)
+
+#echo "result_portals"
+# see https://phabricator.wikimedia.org/T323477
+result_portals=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/portal/view/", dpo.id) AS portal,
+    dpo.phid,
+    u.userName AS author,
+    u.isDisabled AS userDisabled,
+    dpo.name AS panelName,
+    dpo.viewPolicy AS viewPolicy
+    FROM phabricator_dashboard.dashboard_portal dpo
+    INNER JOIN phabricator_dashboard.dashboard_portaltransaction dpot
+    INNER JOIN phabricator_user.user u
+    WHERE dpo.phid = dpot.objectPHID
+    AND dpot.authorPHID = u.phid
+    AND dpot.transactionType = "core:create"
+    AND dpo.dateModified > (UNIX_TIMESTAMP() - 605300);
+END
+)
+
+# echo "result_renamed_diffusion_striker_repos"
+# see https://phabricator.wikimedia.org/T197699
+result_renamed_diffusion_striker_repos=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT rt.oldValue AS oldName, rt.newValue AS newName, u.userName AS user
+    FROM phabricator_repository.repository_transaction rt
+    INNER JOIN phabricator_user.user u ON rt.authorPHID = u.phid
+    WHERE rt.transactionType = "repo:name"
+    AND rt.dateCreated > UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 WEEK))
+    AND oldValue != "null"
+    AND rt.objectPHID IN
+        (SELECT objectPHID FROM phabricator_repository.repository_transaction sb
+        WHERE sb.transactionType = "core:create"
+        AND sb.authorPHID = "PHID-USER-osw2bumzx5lwf3mf65t3");
+
+END
+)
+
+#echo "result_past_due_dates"
+# see https://phabricator.wikimedia.org/T249807
+result_past_due_dates=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/T", t.id) AS Task, FROM_UNIXTIME(cfs.fieldValue) AS DueDate
+    FROM phabricator_maniphest.maniphest_task t
+    JOIN phabricator_maniphest.maniphest_customfieldstorage cfs
+    WHERE cfs.fieldIndex = "GGorRQHBaRdo"
+    AND FROM_UNIXTIME(cfs.fieldValue) < (NOW() - INTERVAL 1 MONTH)
+    AND t.phid = cfs.objectPHID
+    AND (t.status = "open" OR t.status = "progress" OR t.status = "stalled")
+    ORDER BY cfs.fieldValue;
+END
+)
+
+#echo "result_deadline_tasks_without_due_dates"
+# see https://phabricator.wikimedia.org/T380915
+result_deadline_tasks_without_due_dates=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/T", t.id) AS task
+    FROM phabricator_maniphest.maniphest_task t
+    WHERE t.subtype = "deadline"
+    AND (t.status = "open" OR t.status = "stalled" OR t.status = "progress")
+    AND t.phid NOT IN
+        (SELECT cfs.objectPHID
+        FROM phabricator_maniphest.maniphest_customfieldstorage cfs
+        WHERE cfs.fieldIndex = "GGorRQHBaRdo");
+END
+)
+
+#echo "result_parent_projects_without_desc"
+# see https://phabricator.wikimedia.org/T249805
+result_parent_projects_without_desc=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/tag/", p.primarySlug) AS parentproject
+    FROM phabricator_project.project p
+    WHERE p.parentProjectPHID IS NULL
+    AND p.status != 100
+    AND p.phid NOT IN
+        (SELECT p.phid
+        FROM phabricator_project.project p
+        JOIN phabricator_project.project_customfieldstorage cfs
+        WHERE cfs.objectPHID = p.phid
+        AND fieldIndex = "0.9QWd3nmyTs")
+    ORDER BY p.primarySlug;
+END
+)
+
+#echo "result_sub_projects_without_desc"
+# see https://phabricator.wikimedia.org/T249805
+result_sub_projects_without_desc=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/tag/", pp.primarySlug) AS parentproject, p.name AS subproject
+    FROM phabricator_project.project p
+    JOIN phabricator_project.project pp
+    WHERE pp.phid = p.parentProjectPHID
+    AND pp.status != 100
+    AND p.status != 100
+    AND p.phid NOT IN
+        (SELECT p.phid
+        FROM phabricator_project.project p
+        JOIN phabricator_project.project_customfieldstorage cfs
+        WHERE p.status != 100
+        AND cfs.objectPHID = p.phid
+        AND fieldIndex = "0.9QWd3nmyTs")
+    ORDER BY pp.primarySlug,p.name;
+END
+)
+
+#echo "result_herald_rules_archived_projects"
+# see https://phabricator.wikimedia.org/T327508
+result_herald_rules_archived_projects=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/H",hr.id) AS heraldRule,
+    CONCAT("https://phabricator.wikimedia.org/project/profile/", p.id) AS archivedProject
+    FROM phabricator_herald.herald_rule hr
+    INNER JOIN phabricator_herald.edge e ON e.src = hr.phid
+    INNER JOIN phabricator_project.project p ON e.dst = p.phid
+    INNER JOIN phabricator_herald.herald_action ha ON ha.ruleID = hr.id
+    WHERE hr.isDisabled = 0
+    AND p.status = 100
+    AND (ha.action = "projects.add" OR ha.action = "projects.remove")
+    AND ha.target LIKE CONCAT('%', p.phid, '%');
+END
+)
+
+#echo "result_herald_rules_inactive_authors"
+result_herald_rules_inactive_authors=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+ SELECT CONCAT("https://phabricator.wikimedia.org/H", h.id) AS heraldRule,
+    u.userName AS author
+    FROM phabricator_herald.herald_rule h
+    INNER JOIN phabricator_user.user u
+    WHERE h.authorPHID = u.phid
+    AND h.isDisabled = 0
+    AND h.ruleType = "personal"
+    AND h.authorPHID NOT IN
+        (SELECT trs.authorPHID FROM phabricator_maniphest.maniphest_transaction trs
+        INNER JOIN phabricator_user.user u
+        WHERE FROM_UNIXTIME(trs.dateModified) >= (NOW() - INTERVAL 6 MONTH)
+        AND trs.authorPHID = u.phid)
+    ORDER BY heraldRule;
+END
+)
+
+# echo "result_cookie_licked_stalled_tasks"
+# see https://phabricator.wikimedia.org/T228575
+result_cookie_licked_stalled_tasks=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/T", t.id) AS taskID, u.userName, from_unixtime(ta.dateModified) AS assignedSince
+    FROM phabricator_maniphest.maniphest_task t
+    JOIN phabricator_user.user u
+    JOIN phabricator_maniphest.maniphest_transaction ta
+    WHERE (ta.transactionType = "reassign"
+    AND ta.dateModified < (UNIX_TIMESTAMP() - 126144000))
+    AND u.phid = SUBSTR(ta.newValue, INSTR(ta.newValue, 'PHID-USER-'), 30)
+    AND ta.objectPHID = t.phid
+    AND t.ownerPHID = u.phid
+    AND t.status = "stalled"
+    AND t.phid NOT IN
+        (SELECT ta.objectPHID FROM phabricator_maniphest.maniphest_transaction ta
+        WHERE (ta.transactionType = "reassign"
+        AND ta.dateModified > (UNIX_TIMESTAMP() - 126144000)))
+    ORDER BY ta.dateModified;
+
+END
+)
+
+# echo "result_cookie_licked_open_tasks_with_patch_for_review"
+# see https://phabricator.wikimedia.org/T228575
+result_cookie_licked_open_tasks_with_patch_for_review=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/T", t.id) AS taskID, u.userName, from_unixtime(ta.dateModified) AS assignedSince
+    FROM phabricator_maniphest.maniphest_task t
+    JOIN phabricator_user.user u
+    JOIN phabricator_maniphest.maniphest_transaction ta
+    WHERE (ta.transactionType = "reassign"
+    AND ta.dateModified < (UNIX_TIMESTAMP() - 126144000))
+    AND u.phid = SUBSTR(ta.newValue, INSTR(ta.newValue, 'PHID-USER-'), 30)
+    AND ta.objectPHID = t.phid
+    AND t.ownerPHID = u.phid
+    AND (t.status = "open" OR t.status = "progress")
+    AND t.phid IN
+        (SELECT e.src FROM phabricator_maniphest.edge e
+        WHERE e.type = 41 AND e.dst = "PHID-PROJ-onnxucoedheq3jevknyr") 
+    AND t.phid NOT IN
+        (SELECT ta.objectPHID FROM phabricator_maniphest.maniphest_transaction ta
+        WHERE (ta.transactionType = "reassign"
+        AND ta.dateModified > (UNIX_TIMESTAMP() - 126144000)))
+    ORDER BY ta.dateModified;
+
+END
+)
+
+# echo "result_cookie_licked_open_tasks_without_patch_for_review"
+# see https://phabricator.wikimedia.org/T228575
+result_cookie_licked_open_tasks_without_patch_for_review=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/T", t.id) AS taskID, u.userName, from_unixtime(ta.dateModified) AS assignedSince
+    FROM phabricator_maniphest.maniphest_task t
+    JOIN phabricator_user.user u
+    JOIN phabricator_maniphest.maniphest_transaction ta
+    WHERE (ta.transactionType = "reassign"
+    AND ta.dateModified < (UNIX_TIMESTAMP() - 126144000))
+    AND u.phid = SUBSTR(ta.newValue, INSTR(ta.newValue, 'PHID-USER-'), 30)
+    AND ta.objectPHID = t.phid
+    AND t.ownerPHID = u.phid
+    AND (t.status = "open" OR t.status = "progress")
+    AND t.phid NOT IN
+        (SELECT e.src FROM phabricator_maniphest.edge e
+        WHERE e.type = 41 AND e.dst = "PHID-PROJ-onnxucoedheq3jevknyr") 
+    AND t.phid NOT IN
+        (SELECT ta.objectPHID FROM phabricator_maniphest.maniphest_transaction ta
+        WHERE (ta.transactionType = "reassign"
+        AND ta.dateModified > (UNIX_TIMESTAMP() - 126144000)))
+    ORDER BY ta.dateModified;
+
+END
+)
+
+# echo "result_old_stalled_tasks"
+# see https://phabricator.wikimedia.org/T252522
+result_old_stalled_tasks=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT CONCAT("https://phabricator.wikimedia.org/T", mt.id) AS taskID,
+IF (mt.viewPolicy = "public", mt.title, "---restricted---") as taskTitle,
+FROM_UNIXTIME(mta1.dateCreated) AS stalled_date
+    FROM phabricator_maniphest.maniphest_task mt
+    JOIN phabricator_user.user u ON u.phid=mt.authorPHID
+    INNER JOIN phabricator_maniphest.maniphest_transaction mta1
+    WHERE mt.status = "stalled"
+    AND mt.phid NOT IN
+        (SELECT e.src FROM phabricator_maniphest.edge e
+        WHERE e.type = 41
+        AND e.dst="PHID-PROJ-bchzb6qpl3jhgs2oq6um")
+    AND mt.phid NOT IN
+        (SELECT e.src FROM phabricator_maniphest.edge e
+        WHERE e.type = 3)
+    AND mt.phid = mta1.objectPHID
+    AND mta1.transactionType = "status"
+    AND mta1.newValue = "\"stalled\""
+    AND FROM_UNIXTIME(mta1.dateCreated) <= (NOW() - INTERVAL 36 MONTH)
+    AND mt.phid NOT IN
+        (SELECT mta2.objectPHID FROM phabricator_maniphest.maniphest_transaction mta2
+        WHERE mta2.transactionType = "status"
+        AND mta2.newValue = "\"stalled\""
+        AND FROM_UNIXTIME(mta2.dateCreated) >= (NOW() - INTERVAL 36 MONTH))
+    ORDER BY mta1.dateCreated;
+
+END
+)
+
+#echo "result_old_inprogress_tasks"
+# see https://phabricator.wikimedia.org/T380300
+result_old_inprogress_tasks=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/T", t.id) AS taskID
+    FROM phabricator_maniphest.maniphest_task t
+    JOIN phabricator_maniphest.maniphest_transaction ta
+    WHERE (ta.transactionType = "status"
+        AND ta.newValue = "\"progress\""
+        AND ta.dateModified < (UNIX_TIMESTAMP() - 31536000))
+    AND ta.objectPHID = t.phid
+    AND t.status = "progress"
+    AND t.phid NOT IN
+        (SELECT ta.objectPHID
+        FROM phabricator_maniphest.maniphest_transaction ta
+        WHERE (ta.transactionType = "status"
+            AND ta.dateModified > (UNIX_TIMESTAMP() - 31536000)))
+    GROUP BY t.id
+    ORDER BY ta.dateModified;
+
+END
+)
+
+#echo "result_editengine_forms_disabled_subscribers"
+# see https://phabricator.wikimedia.org/T403887
+result_editengine_forms_disabled_subscribers=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT u.userName AS disabledUser,
+    CONCAT('https://phabricator.wikimedia.org/transactions/editengine/maniphest.task/defaults/',seec.id) AS formId
+    FROM phabricator_search.search_editengineconfiguration seec, JSON_TABLE(seec.properties, "$.defaults.subscriberPHIDs[*]" COLUMNS (subscriberPHID VARCHAR(30) PATH "$")) AS jt
+    JOIN phabricator_user.user u ON jt.subscriberPHID = u.phid
+    WHERE u.isDisabled = 1
+    AND seec.isDisabled = 0;
+
+END
+)
+
+#echo "result_editengine_forms_disabled_assignees"
+# see https://phabricator.wikimedia.org/T403887
+result_editengine_forms_disabled_assignees=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT u.userName AS disabledUser,
+    CONCAT('https://phabricator.wikimedia.org/transactions/editengine/maniphest.task/defaults/',seec.id) AS formId
+    FROM phabricator_search.search_editengineconfiguration seec, JSON_TABLE(seec.properties, "$.defaults.owner[*]" COLUMNS (owner VARCHAR(30) PATH "$")) AS jt
+    JOIN phabricator_user.user u ON jt.owner = u.phid
+    WHERE u.isDisabled = 1
+    AND seec.isDisabled = 0;
+
+END
+)
+
+#echo "result_editengine_forms_disabled_projects"
+# see https://phabricator.wikimedia.org/T403887
+result_editengine_forms_disabled_projects=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT p.name AS disabledProject,
+    CONCAT('https://phabricator.wikimedia.org/transactions/editengine/maniphest.task/defaults/',seec.id) AS formId
+    FROM phabricator_search.search_editengineconfiguration seec, JSON_TABLE(seec.properties, "$.defaults.projectPHIDs[*]" COLUMNS (projectPHID VARCHAR(30) PATH "$")) AS jt
+    JOIN phabricator_project.project p ON jt.projectPHID = p.phid
+    WHERE p.status = 100
+    AND seec.isDisabled = 0;
+
+END
+)
+
+
+#echo "result_userprojects_disabled_users"
+# see https://phabricator.wikimedia.org/T404411
+result_userprojects_disabled_users=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/project/view/",p.id,"/") AS projectURL,
+    p.name AS project,
+    u.userName AS user
+    FROM phabricator_project.project p
+    INNER JOIN phabricator_user.user u
+    ON p.name LIKE CONCAT('User-', u.userName)
+    WHERE u.isDisabled = 1
+    AND p.status != 100;
+
+END
+)
+
+
+#echo "result_userprojects_nonexisting_users"
+# see https://phabricator.wikimedia.org/T404411
+result_userprojects_nonexisting_users=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+SELECT CONCAT("https://phabricator.wikimedia.org/project/view/",p.id,"/") AS projectURL,
+    p.name AS project
+    FROM phabricator_project.project p
+    WHERE p.name LIKE "User-%"
+    AND p.name NOT LIKE "User-notice%"
+    AND p.name != "User-Testing"
+    AND p.status != 100
+    AND NOT EXISTS
+        (SELECT 1 FROM phabricator_user.user u
+        WHERE p.name LIKE CONCAT('User-', u.userName));
+
+END
+)
+
+# the actual email
+cat <<EOF | /usr/bin/mail -r "${sndr_address}" -s "Phabricator weekly project changes" -a "Auto-Submitted: auto-generated" ${rcpt_address}
+
+Hi Phabricator admin,
+
+This is your automatic weekly Phabricator project changes mail.
+
+
+ARCHIVED PROJECTS WITH OPEN TASKS WITH NO OTHER ACTIVE PROJECTS, EXCLUDING PATCH-FOR-REVIEW
+(find these open tasks: they either need to get a non-archived project tag associated, or
+the task status needs updating, or the project tag needs to be unarchived):
+${result_archived_projects_open_tasks}
+
+
+PROJECTS WITH COLOR/ICON COMBINATIONS WHICH MIGHT VIOLATE OUR GUIDELINES:
+(per https://www.mediawiki.org/wiki/Phabricator/Project_management#Types_of_Projects ;
+edit the project and correct icon/color in such cases)
+${result_problematic_color_icon_combos}
+
+
+DISABLED USER ACCOUNTS WITH OPEN TASKS ASSIGNED
+(unassign if there's no patch waiting for review written by them):
+${result_inactive_users_assigned_tasks}
+
+
+USER PROFILES WITH A URL IN THEIR DESC WHICH CHANGED WITHIN THE LAST 1 WEEK
+(to spam check. If there are spam links in the desc, disable their account):
+${result_user_profile_urls}
+
+
+WORKBOARD COLUMN TRIGGER CHANGES WITHIN THE LAST 1 WEEK
+(to spam check, likely mitigated by https://phabricator.wikimedia.org/T260427):
+${result_workboard_column_triggers}
+
+
+DASHBOARD PANEL CHANGES WITHIN THE LAST 1 WEEK (to spam check, mitigated by
+https://phabricator.wikimedia.org/T260428 once we pull from upstream.
+If spam use ./bin/remove destroy ; see https://wikitech.wikimedia.org/wiki/Phabricator ):
+${result_dashboard_panels}
+
+
+DASHBOARD CHANGES WITHIN THE LAST 1 WEEK (to spam check, mitigated by
+https://phabricator.wikimedia.org/T260428 once we pull from upstream.
+If spam use ./bin/remove destroy ; see https://wikitech.wikimedia.org/wiki/Phabricator ):
+${result_dashboards}
+
+
+PORTAL CHANGES WITHIN THE LAST 1 WEEK (to spam check.
+If spam use ./bin/remove destroy ; see https://wikitech.wikimedia.org/wiki/Phabricator ):
+${result_portals}
+
+
+ACTIVE HERALD RULES USING ARCHIVED PROJECTS IN THEIR ACTIONS
+(projects to be updated or Herald rules to be disabled):
+${result_herald_rules_archived_projects}
+
+
+DIFFUSION REPOSITORIES CREATED BY STRIKERBOT WHICH GOT RENAMED:
+(renames to check and potentially revert; cf T197699)
+${result_renamed_diffusion_striker_repos}
+
+
+EDITENGINE FORMS WITH DISABLED SUBSCRIBERS:
+(remove these disabled user accounts or even disable the form; cf T403887)
+${result_editengine_forms_disabled_subscribers}
+
+
+EDITENGINE FORMS WITH DISABLED ASSIGNEES:
+(remove these disabled user accounts or even disable the form; cf T403887)
+${result_editengine_forms_disabled_assignees}
+
+
+EDITENGINE FORMS WITH DISABLED PROJECTS:
+(remove these disabled project tags or even disable the form; cf T403887)
+${result_editengine_forms_disabled_projects}
+
+
+USER-* PROJECTS WITH DISABLED CORRESPONDING USERS:
+(archive these projects; cf T404411)
+${result_userprojects_disabled_users}
+
+
+USER-* PROJECTS WITH NON-EXISTING CORRESPONDING USERS:
+(likely rename these projects to match the username again; cf T404411)
+${result_userprojects_nonexisting_users}
+
+
+===== EVERYTHING BELOW THIS LINE IS NOT REACTIVE AND JUST FYI =====
+
+
+PROJECT CREATIONS AND PROJECT NAME CHANGES:
+${result_creations_and_name_changes}
+
+
+PROJECT COLOR CHANGES:
+${result_color_changes}
+
+
+PROJECT POLICY/LOCKING/ARCHIVING CHANGES:
+${result_policy_locking_archiving_changes}
+
+
+PROJECT WORKBOARD COLUMN CHANGES
+(newValue and oldValue values: 0 = shown, 1 = hidden):
+${result_column_changes}
+
+
+EDIT ENGINE / FORM CREATIONS AND CHANGES
+(to potentially review, see T369548):
+${result_editengine_changes}
+
+
+USER ACCOUNTS WHO BECAME AN ASSIGNEE RECENTLY AND HAD LESS THAN
+5 TASKS EVER ASSIGNED AND THE TASK IS NOT TAGGED WITH PATCH-FOR-REVIEW
+(to ping after a month whether they need help, and to potentially unassign again):
+${result_new_user_assignees}
+
+
+OPEN TASKS WITH A DUE DATE MORE THAN 1 MONTH AGO
+(to ask the assignee and/or reporter to update task status or due date):
+${result_past_due_dates}
+
+
+OPEN TASKS WITH DEADLINE SUBTYPE BUT WITHOUT DUE DATE (to reset the subtype)
+(to be mitigated by https://phabricator.wikimedia.org/T335395 ):
+${result_deadline_tasks_without_due_dates}
+
+
+PROJECTS WHICH HAVE AN EMPTY PROJECT DESCRIPTION
+(not an issue anymore due to https://phabricator.wikimedia.org/T344610 ):
+${result_parent_projects_without_desc}
+${result_sub_projects_without_desc}
+
+
+ACTIVE PERSONAL HERALD RULES AUTHORED BY ACCOUNTS INACTIVE FOR 6 MONTHS
+(note that these might be fine when these rules have some global value):
+${result_herald_rules_inactive_authors}
+
+
+STALLED TASKS THAT HAVE BEEN ASSIGNED TO THE SAME USER FOR MORE THAN FOUR YEARS:
+${result_cookie_licked_stalled_tasks}
+
+
+OPEN TASKS WITH A PATCH FOR REVIEW THAT HAVE BEEN ASSIGNED TO THE SAME USER FOR MORE THAN FOUR YEARS:
+${result_cookie_licked_open_tasks_with_patch_for_review}
+
+
+OPEN TASKS WITHOUT A PATCH FOR REVIEW THAT HAVE BEEN ASSIGNED TO THE SAME USER FOR MORE THAN FOUR YEARS:
+${result_cookie_licked_open_tasks_without_patch_for_review}
+
+
+STALLED TASKS THAT HAVE BEEN STALLED FOR MORE THAN THREE YEARS
+(to potentially manually re-triage and reset to open status):
+${result_old_stalled_tasks}
+
+
+IN PROGRESS TASKS WITH NO STATUS CHANGE FOR MORE THAN TWO YEARS
+(to potentially reset to open task status):
+${result_old_inprogress_tasks}
+
+
+Yours sincerely,
+Fab Rick Aytor
+
+(via $(basename $0) on $(hostname) at $(date))
+EOF

Envoyproxy::Tls_terminator[443]

Parameters differences:

--- Envoyproxy::Tls_terminator[443].orig
+++ Envoyproxy::Tls_terminator[443]

+    connect_timeout           => 1.0
+    retry_policy              => {'num_retries': 1, 'retry_on': '5xx'}
+    request_headers_to_add    => {}
+    header_key_format         => none
+    global_key_path           => /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server-key.pem
+    has_error_page            => False
+    use_remote_address        => False
+    upstreams                 => [{'server_names': ['*'], 'cert_path': None, 'key_path': None, 'upstream_port': 80, 'upstream_addr': 'phab2003.codfw.wmnet'}]
+    global_cert_path          => /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.chained.pem
+    websockets                => True
+    listen_ipv6               => True
+    upstream_response_timeout => 65.0
+    fast_open_queue           => 150
+    response_headers_to_add   => {}
+    rate_limit_enabled        => False
+    local_otel_reporting_pct  => 0.0
+    access_log                => False

File[/lib/systemd/system/phabricator_stats_job_project_changes.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_project_changes.service].orig
+++ File[/lib/systemd/system/phabricator_stats_job_project_changes.service]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_project_changes.service (phabricator_stats_job_project_changes.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_project_changes.service.orig
+++ /lib/systemd/system/phabricator_stats_job_project_changes.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator statistics mail - project_changes
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/project_changes.sh

File[/etc/rsyslog.d/10-input-file-apache2-access.conf]

Parameters differences:

--- File[/etc/rsyslog.d/10-input-file-apache2-access.conf].orig
+++ File[/etc/rsyslog.d/10-input-file-apache2-access.conf]

+    notify => Service[rsyslog]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/rsyslog.d/10-input-file-apache2-access.conf.orig
+++ /etc/rsyslog.d/10-input-file-apache2-access.conf
@@ -0,0 +1,8 @@
+# This file managed by puppet rsyslog::input::file
+
+input(type="imfile"
+      File="/var/log/apache2/*access*.log"
+      reopenOnTruncate="on"
+      addMetadata="off"
+      addCeeTag="off"
+      Tag="input-file-apache2-access")

Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.service]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.service].orig
+++ Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_tech_news_weekly_stats.service
+    require           => ['Class[Systemd]']

File[/etc/logrotate.d/aphlict]

Parameters differences:

--- File[/etc/logrotate.d/aphlict].orig
+++ File[/etc/logrotate.d/aphlict]

+    mode   => 0444
+    source => puppet:///modules/phabricator/logrotate_aphlict
+    owner  => root
+    ensure => absent
+    group  => root

File[/etc/phabricator/script-vars]

Content differences:

--- /etc/phabricator/script-vars.orig
+++ /etc/phabricator/script-vars
@@ -2,6 +2,6 @@
 # Sourced by /usr/local/sbin/phab_deploy_* scripts
 #
 PHAB_DIR='/srv/phab'
-PHAB_STORAGE_USER='phadmin'
-PHAB_STORAGE_PASS='fakefakefake'
+PHAB_STORAGE_USER='admin_user'
+PHAB_STORAGE_PASS='admin_pass'
 PHAB_DEPLOY_USER='phab-deploy'

Systemd::Unit[phd]

Parameters differences:

--- Systemd::Unit[phd].orig
+++ Systemd::Unit[phd]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => present
+    unit              => phd
+    require           => ['Class[Systemd]']

File[/etc/envoy]

Parameters differences:

--- File[/etc/envoy].orig
+++ File[/etc/envoy]

+    mode   => 0755
+    owner  => root
+    ensure => directory
+    group  => root

Systemd::Service[envoyproxy.service]

Parameters differences:

--- Systemd::Service[envoyproxy.service].orig
+++ Systemd::Service[envoyproxy.service]

+    override                 => True
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => present
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => service
+    service_params           => {'restart': '/bin/systemctl reload envoyproxy.service'}
+    monitoring_contact_group => admins

Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.timer]

Parameters differences:

--- Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.timer].orig
+++ Systemd::Unit[wmf_auto_restart_prometheus-apache-exporter.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => present
+    unit              => wmf_auto_restart_prometheus-apache-exporter.timer
+    require           => ['Class[Systemd]']

File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.service].orig
+++ File[/lib/systemd/system/phabricator_stats_job_yearly_metrics.service]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_yearly_metrics.service (phabricator_stats_job_yearly_metrics.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_yearly_metrics.service.orig
+++ /lib/systemd/system/phabricator_stats_job_yearly_metrics.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator statistics mail - yearly_metrics
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/yearly_metrics.sh

Nftables::Service[phabmain-smtp]

Parameters differences:

--- Nftables::Service[phabmain-smtp].orig
+++ Nftables::Service[phabmain-smtp]

+    ensure              => absent
+    port                => 25
+    proto               => tcp
+    prio                => 10
+    notrack             => False
+    src_ips             => ['208.80.153.75', '208.80.155.102', '2620:0:860:3:208:80:153:75', '2620:0:861:4:208:80:155:102']
+    unrestricted_access => False
+    desc                =>

Rsyslog::Conf[wmf_auto_restart_prometheus-apache-exporter]

Parameters differences:

--- Rsyslog::Conf[wmf_auto_restart_prometheus-apache-exporter].orig
+++ Rsyslog::Conf[wmf_auto_restart_prometheus-apache-exporter]

+    mode     => 0444
+    require  => File[/var/log/wmf_auto_restart_prometheus-apache-exporter]
+    priority => 40
+    ensure   => present

Systemd::Unit[phabricator_clean_tmp_files.service]

Parameters differences:

--- Systemd::Unit[phabricator_clean_tmp_files.service].orig
+++ Systemd::Unit[phabricator_clean_tmp_files.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => present
+    unit              => phabricator_clean_tmp_files.service
+    require           => ['Class[Systemd]']

Package[mariadb-client]

Parameters differences:

--- Package[mariadb-client].orig
+++ Package[mariadb-client]

+    provider => apt
+    ensure   => installed

File[/lib/systemd/system/phabricator_task_dump.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_task_dump.service].orig
+++ File[/lib/systemd/system/phabricator_task_dump.service]

+    notify => Exec[systemd daemon-reload for phabricator_task_dump.service (phabricator_task_dump.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_task_dump.service.orig
+++ /lib/systemd/system/phabricator_task_dump.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator public task dump
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/bin/python3 /srv/phab/tools/public_task_dump.py

Phabricator::Logmail[community_metrics]

Parameters differences:

--- Phabricator::Logmail[community_metrics].orig
+++ Phabricator::Logmail[community_metrics]

+    ensure           => absent
+    rcpt_address     => wikitech-l@lists.wikimedia.org
+    monthday         => 1
+    mysql_slave_port => 3323
+    mysql_slave      => m3-slave.codfw.wmnet
+    minute           => 0
+    basedir          => /usr/local/bin
+    sndr_address     => aklapper@wikimedia.org
+    mysql_db_name    => phabricator_maniphest
+    require          => Package[phabricator/deployment]
+    hour             => 0

Systemd::Unit[rsync-phabricator-home-dirs.service]

Parameters differences:

--- Systemd::Unit[rsync-phabricator-home-dirs.service].orig
+++ Systemd::Unit[rsync-phabricator-home-dirs.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => rsync-phabricator-home-dirs.service
+    require           => ['Class[Systemd]']

Git::Systemconfig[setup proxy]

Parameters differences:

--- Git::Systemconfig[setup proxy].orig
+++ Git::Systemconfig[setup proxy]

+    priority => 10
+    ensure   => present
+    settings => {'http "https://gerrit.googlesource.com"': {'proxy': 'http://url-downloader.codfw.wikimedia.org:8080'}, 'http "https://github.com"': {'proxy': 'http://url-downloader.codfw.wikimedia.org:8080'}, 'http "https://gitlab.com"': {'proxy': 'http://url-downloader.codfw.wikimedia.org:8080'}, 'http "https://gerrit.wikimedia.org"': {'proxy': ''}, 'http "https://phabricator.wikimedia.org"': {'proxy': ''}}

Exec[systemd daemon-reload for envoyproxy.service (envoyproxy.service)]

Parameters differences:

--- Exec[systemd daemon-reload for envoyproxy.service (envoyproxy.service)].orig
+++ Exec[systemd daemon-reload for envoyproxy.service (envoyproxy.service)]

+    before      => ['Service[envoyproxy.service]']
+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

File[/usr/local/bin/community_metrics.sh]

Parameters differences:

--- File[/usr/local/bin/community_metrics.sh].orig
+++ File[/usr/local/bin/community_metrics.sh]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /usr/local/bin/community_metrics.sh.orig
+++ /usr/local/bin/community_metrics.sh
@@ -0,0 +1,240 @@
+#!/bin/bash
+# send the number of active users on <s>Bugzilla</s> Phabricator
+# in the last month to "community metrics" team
+# per T81784 - dzahn 20121219
+# per T1003 - dzahn,aklapper 20141205
+# ! this file is managed by puppet !
+# ./modules/phabricator/files/community_metrics.sh
+
+source /etc/phab_community_metrics.conf
+
+#echo "result_activemaniphestusers"
+result_activemaniphestusers=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u $sql_user $sql_name << END
+
+SELECT COUNT(DISTINCT authorPHID) FROM maniphest_transaction WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')=date_format(NOW() - INTERVAL 1 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_authors"
+result_authors=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(DISTINCT authorPHID) FROM maniphest_task WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')=date_format(NOW() - INTERVAL 1 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_resolvers"
+result_resolvers=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(DISTINCT authorPHID) FROM maniphest_transaction WHERE (transactionType="mergedinto" OR
+    (transactionType="status" AND (oldValue="\"open\"" OR oldValue="\"stalled\"") AND
+    (newValue="\"resolved\"" OR newValue="\"invalid\"" OR newValue="\"declined\""))) AND
+    FROM_UNIXTIME(dateCreated,'%Y%m')=date_format(NOW() - INTERVAL 1 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_projectsboardmove"
+result_projectsboardmove=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(DISTINCT (edge.dst)) FROM phabricator_maniphest.edge INNER JOIN phabricator_maniphest.maniphest_transaction WHERE FROM_UNIXTIME(maniphest_transaction.dateModified,'%Y%m')=date_format(NOW() - INTERVAL 1 MONTH,'%Y%m') AND maniphest_transaction.transactionType = "core:columns" AND edge.type = 41 AND edge.src = maniphest_transaction.objectPHID AND edge.dst = SUBSTR(maniphest_transaction.newValue, INSTR(maniphest_transaction.newValue, 'PHID-PROJ-'), 30);
+
+END
+)
+
+#echo "result_taskscreated"
+result_taskscreated=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(*) AS '' FROM maniphest_task WHERE
+    FROM_UNIXTIME(dateCreated,'%Y%m')=date_format(NOW() - INTERVAL 1 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_tasksclosed"
+result_tasksclosed=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(*) AS '' FROM maniphest_task WHERE
+    FROM_UNIXTIME(closedEpoch,'%Y%m')=date_format(NOW() - INTERVAL 1 MONTH,'%Y%m');
+
+END
+)
+
+#echo "result_tasksopen"
+result_tasksopen=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(*) AS '' FROM maniphest_task WHERE (status = "open" OR status = "stalled");
+
+END
+)
+
+#echo "result_tasksopen_open"
+result_tasksopen_open=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(*) AS '' FROM maniphest_task WHERE status = "open";
+
+END
+)
+
+#echo "result_tasksopen_stalled"
+result_tasksopen_stalled=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT COUNT(*) AS '' FROM maniphest_task WHERE status = "stalled";
+
+END
+)
+
+#echo "results_mediantasksopen_unbreaknow"
+result_mediantasksopen_unbreaknow=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT avg(t1.dateCreated) as '' FROM (SELECT @rownum:=@rownum+1 as row_nr, d.dateCreated FROM maniphest_task d, (SELECT @rownum:=0) r WHERE (d.priority = "100" AND d.status = "open") ORDER BY d.dateCreated) as t1, (SELECT COUNT(*) AS total_rows FROM maniphest_task d WHERE (d.priority = "100" AND d.status = "open")) as t2 WHERE 1 AND t1.row_nr IN ( floor((total_rows+1)/2), floor((total_rows+2)/2));
+
+END
+)
+
+#echo "rm_needstriage"
+result_mediantasksopen_needstriage=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT avg(t1.dateCreated) as '' FROM (SELECT @rownum:=@rownum+1 as row_nr, d.dateCreated FROM maniphest_task d, (SELECT @rownum:=0) r WHERE (d.priority = "90" AND d.status = "open") ORDER BY d.dateCreated) as t1, (SELECT COUNT(*) AS total_rows FROM maniphest_task d WHERE (d.priority = "90" AND d.status = "open")) as t2 WHERE 1 AND t1.row_nr IN ( floor((total_rows+1)/2), floor((total_rows+2)/2));
+
+END
+)
+
+#echo "rm_high"
+result_mediantasksopen_high=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT avg(t1.dateCreated) as '' FROM (SELECT @rownum:=@rownum+1 as row_nr, d.dateCreated FROM maniphest_task d, (SELECT @rownum:=0) r WHERE (d.priority = "80" AND d.status = "open") ORDER BY d.dateCreated) as t1, (SELECT COUNT(*) AS total_rows FROM maniphest_task d WHERE (d.priority = "80" AND d.status = "open")) as t2 WHERE 1 AND t1.row_nr IN ( floor((total_rows+1)/2), floor((total_rows+2)/2));
+
+END
+)
+
+#echo "rm_normal"
+result_mediantasksopen_normal=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT avg(t1.dateCreated) as '' FROM (SELECT @rownum:=@rownum+1 as row_nr, d.dateCreated FROM maniphest_task d, (SELECT @rownum:=0) r WHERE (d.priority = "50" AND d.status = "open") ORDER BY d.dateCreated) as t1, (SELECT COUNT(*) AS total_rows FROM maniphest_task d WHERE (d.priority = "50" AND d.status = "open")) as t2 WHERE 1 AND t1.row_nr IN ( floor((total_rows+1)/2), floor((total_rows+2)/2));
+
+END
+)
+
+#echo "rm_low"
+result_mediantasksopen_low=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT avg(t1.dateCreated) as '' FROM (SELECT @rownum:=@rownum+1 as row_nr, d.dateCreated FROM maniphest_task d, (SELECT @rownum:=0) r WHERE (d.priority = "25" AND d.status = "open") ORDER BY d.dateCreated) as t1, (SELECT COUNT(*) AS total_rows FROM maniphest_task d WHERE (d.priority = "25" AND d.status = "open")) as t2 WHERE 1 AND t1.row_nr IN ( floor((total_rows+1)/2), floor((total_rows+2)/2));
+
+END
+)
+
+#echo "rm_lowest"
+result_mediantasksopen_lowest=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user $sql_name << END
+
+SELECT avg(t1.dateCreated) as '' FROM (SELECT @rownum:=@rownum+1 as row_nr, d.dateCreated FROM maniphest_task d, (SELECT @rownum:=0) r WHERE (d.priority = "10" AND d.status = "open") ORDER BY d.dateCreated) as t1, (SELECT COUNT(*) AS total_rows FROM maniphest_task d WHERE (d.priority = "10" AND d.status = "open")) as t2 WHERE 1 AND t1.row_nr IN ( floor((total_rows+1)/2), floor((total_rows+2)/2));
+
+END
+)
+
+#echo "number of accounts created"
+result_accounts_created=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -h $sql_host -P $sql_port -u$sql_user phabricator_user << END
+
+SELECT COUNT(id) as '' FROM user WHERE FROM_UNIXTIME(dateCreated,'%Y%m')=date_format(NOW() - INTERVAL 1 MONTH,'%Y%m');
+
+END
+)
+
+accountscreated=$(echo $result_accounts_created | tr -d '\n')
+
+activemaniphestusers=$(echo $result_activemaniphestusers | cut -d " " -f3)
+authors=$(echo $result_authors | cut -d " " -f3)
+resolvers=$(echo $result_resolvers | cut -d " " -f3)
+
+projectsboardmove=$(echo $result_projectsboardmove | cut -d " " -f3)
+
+taskscreated=$(echo $result_taskscreated | cut -d " " -f3)
+tasksclosed=$(echo $result_tasksclosed | cut -d " " -f3)
+
+tasksopen=$(echo $result_tasksopen | cut -d " " -f3)
+tasksopen_open=$(echo $result_tasksopen_open | cut -d " " -f3)
+tasksopen_stalled=$(echo $result_tasksopen_stalled | cut -d " " -f3)
+
+epochnow=$(date +%s)
+# regex if we have zero open tasks (can happen for unbreaknow; see T159314):
+regex='^[0-9]+$'
+
+mediantasksopen_unbreaknow_epoch=$(echo $result_mediantasksopen_unbreaknow | cut -d " " -f3 | sed 's/\.0000//' | sed 's/\.5000//')
+if [[ $mediantasksopen_unbreaknow_epoch =~ $regex ]] ; then
+  diff_unbreaknow=$((epochnow-mediantasksopen_unbreaknow_epoch))
+  mediantasksopen_unbreaknow=$(echo $((diff_unbreaknow/86400)))
+else
+  mediantasksopen_unbreaknow=0
+fi
+
+mediantasksopen_needstriage_epoch=$(echo $result_mediantasksopen_needstriage | cut -d " " -f3 | sed 's/\.0000//' | sed 's/\.5000//')
+diff_needstriage=$((epochnow-mediantasksopen_needstriage_epoch))
+mediantasksopen_needstriage=$(echo $((diff_needstriage/86400)))
+
+mediantasksopen_high_epoch=$(echo $result_mediantasksopen_high | cut -d " " -f3 | sed 's/\.0000//' | sed 's/\.5000//')
+diff_high=$((epochnow-mediantasksopen_high_epoch))
+mediantasksopen_high=$(echo $((diff_high/86400)))
+
+mediantasksopen_normal_epoch=$(echo $result_mediantasksopen_normal | cut -d " " -f3 | sed 's/\.0000//' | sed 's/\.5000//')
+diff_normal=$((epochnow-mediantasksopen_normal_epoch))
+mediantasksopen_normal=$(echo $((diff_normal/86400)))
+
+mediantasksopen_low_epoch=$(echo $result_mediantasksopen_low | cut -d " " -f3 | sed 's/\.0000//' | sed 's/\.5000//')
+diff_low=$((epochnow-mediantasksopen_low_epoch))
+mediantasksopen_low=$(echo $((diff_low/86400)))
+
+mediantasksopen_lowest_epoch=$(echo $result_mediantasksopen_lowest | cut -d " " -f3 | sed 's/\.0000//' | sed 's/\.5000//')
+diff_lowest=$((epochnow-mediantasksopen_lowest_epoch))
+mediantasksopen_lowest=$(echo $((diff_lowest/86400)))
+
+lastmonth=$(date --date="last month" +%Y-%m)
+
+# the actual email
+cat <<EOF | /usr/bin/mail -r "${sndr_address}" -s "Phabricator monthly statistics - ${lastmonth}" -a "Auto-Submitted: auto-generated" ${rcpt_address}
+
+Hi Community Metrics team,
+
+This is your automatic monthly Phabricator statistics mail.
+
+Accounts created in (${lastmonth}): ${accountscreated}
+Active Maniphest users (any activity) in (${lastmonth}): ${activemaniphestusers}
+Task authors in (${lastmonth}): ${authors}
+Users who have closed tasks in (${lastmonth}): ${resolvers}
+
+Projects which had at least one task moved from one column to another on
+their workboard in (${lastmonth}): ${projectsboardmove}
+
+Tasks created in (${lastmonth}): ${taskscreated}
+Tasks closed in (${lastmonth}): ${tasksclosed}
+Open and stalled tasks in total: ${tasksopen}
+* Only open tasks in total: ${tasksopen_open}
+* Only stalled tasks in total: ${tasksopen_stalled}
+
+Median age in days of open tasks by priority:
+
+Unbreak now: ${mediantasksopen_unbreaknow}
+Needs Triage: ${mediantasksopen_needstriage}
+High: ${mediantasksopen_high}
+Normal: ${mediantasksopen_normal}
+Low: ${mediantasksopen_low}
+Lowest: ${mediantasksopen_lowest}
+
+(How long tasks have been open, not how long they have had that priority)
+
+To see the names of the most active task authors:
+* Go to https://development-metrics.wmcloud.org/
+* Choose "Phabricator > Overview" from the top bar
+* Adjust the time frame in the upper right corner to your needs
+* See the author names in the "Submitters" panel
+
+TODO: Numbers which refer to closed tasks might not be correct, as
+described in https://phabricator.wikimedia.org/T1003 .
+
+Yours sincerely,
+Fab Rick Aytor
+
+(via $(basename $0) on $(hostname) at $(date))
+EOF

File[/etc/phab_yearly_metrics.conf]

Parameters differences:

--- File[/etc/phab_yearly_metrics.conf].orig
+++ File[/etc/phab_yearly_metrics.conf]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/phab_yearly_metrics.conf.orig
+++ /etc/phab_yearly_metrics.conf
@@ -0,0 +1,7 @@
+declare rcpt_address='aklapper@wikimedia.org,releng@lists.wikimedia.org'
+declare sndr_address='aklapper@wikimedia.org'
+declare sql_host='m3-slave.codfw.wmnet'
+declare sql_port='3323'
+declare sql_user='metrics_user'
+declare sql_name='phabricator_maniphest'
+declare sql_pass='metrics_pass'

Exec[systemd daemon-reload for wmf_auto_restart_aphlict.service (wmf_auto_restart_aphlict.service)]

Parameters differences:

--- Exec[systemd daemon-reload for wmf_auto_restart_aphlict.service (wmf_auto_restart_aphlict.service)].orig
+++ Exec[systemd daemon-reload for wmf_auto_restart_aphlict.service (wmf_auto_restart_aphlict.service)]

+    refreshonly => True
+    command     => /bin/systemctl daemon-reload

Systemd::Unit[phabricator_stats_job_quarterly_metrics.service]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_quarterly_metrics.service].orig
+++ Systemd::Unit[phabricator_stats_job_quarterly_metrics.service]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_quarterly_metrics.service
+    require           => ['Class[Systemd]']

File[/etc/exim4/dkim]

Parameters differences:

--- File[/etc/exim4/dkim].orig
+++ File[/etc/exim4/dkim]

+    mode    => 0750
+    owner   => root
+    ensure  => directory
+    require => Package[exim4-config]
+    purge   => True
+    group   => Debian-exim

Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server]

Parameters differences:

--- Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server].orig
+++ Exec[Generate cert discovery2026__phabricator_discovery_wmnet_server]

+    environment => ['GODEBUG=x509ignoreCN=0']
+    require     => Cfssl::Csr[/etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr]
+    unless      => /usr/bin/test "$(/usr/bin/openssl x509 -in /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem -noout -pubkey 2>&1)" == "$(/usr/bin/openssl pkey -pubout -in /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server-key.pem 2>&1)"

+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/phab2003.codfw.wmnet.pem -label discovery2026 -profile server /etc/cfssl/csr/discovery2026__phabricator_discovery_wmnet_server.csr | /usr/bin/cfssljson -bare /etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server

Rsync::Quickdatacopy[phabricator-repos]

Parameters differences:

--- Rsync::Quickdatacopy[phabricator-repos].orig
+++ Rsync::Quickdatacopy[phabricator-repos]

+    dest_host                  => phab2002.codfw.wmnet
+    module_path                => /srv/repos
+    ensure                     => present
+    source_host                => phab1004.eqiad.wmnet
+    server_uses_stunnel        => False
+    progress                   => False
+    auto_sync                  => True
+    delete                     => True
+    ignore_missing_file_errors => True
+    auto_interval              => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}

File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.timer].orig
+++ File[/lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.timer]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_quarterly_wmf_qls.timer (phabricator_stats_job_quarterly_wmf_qls.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.timer.orig
+++ /lib/systemd/system/phabricator_stats_job_quarterly_wmf_qls.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_stats_job_quarterly_wmf_qls.service
+
+[Timer]
+Unit=phabricator_stats_job_quarterly_wmf_qls.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-01,04,07,10-1 0:0:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Mount[/var/spool/exim4/scan]

Parameters differences:

--- Mount[/var/spool/exim4/scan].orig
+++ Mount[/var/spool/exim4/scan]

+    atboot  => True
+    fstype  => tmpfs
+    ensure  => mounted
+    options => defaults
+    before  => Service[exim4]
+    require => Exec[mkdir /var/spool/exim4/scan]
+    device  => none

Firewall::Service[phabmain_http]

Parameters differences:

--- Firewall::Service[phabmain_http].orig
+++ Firewall::Service[phabmain_http]

+    ensure              => present
+    port                => 80
+    proto               => tcp
+    src_sets            => ['DEPLOYMENT_HOSTS']
+    prio                => 10
+    notrack             => False
+    unrestricted_access => False
+    desc                =>

Class[Phabricator::Config]

Parameters differences:

--- Class[Phabricator::Config].orig
+++ Class[Phabricator::Config]

+    deploy_target      => phabricator/deployment
+    storage_user       => admin_user
+    deploy_user        => phab-deploy
+    phabdir            => /srv/phab
+    storage_pass       => admin_pass
+    manage_scap_user   => True
+    deploy_root        => /srv/deployment/phabricator/deployment
+    config_deploy_vars => {'phabricator': {'www': {'database_username': 'app_user', 'database_password': 'app_pass'}, 'mail': {'database_username': 'app_user', 'database_password': 'app_pass'}, 'phd': {'database_username': 'phd_user', 'database_password': 'phd_pass'}, 'vcs': {'database_username': 'phd_user', 'database_password': 'phd_pass'}, 'redirects': {'database_username': 'phd_user', 'database_password': 'phd_pass', 'database_host': 'm3-slave.codfw.wmnet', 'field_index': '4rRUkCdImLQU'}, 'local': {'base_uri': 'https://phabricator.wikimedia.org', 'alternate_file_domain': 'https://phab.wmfusercontent.org', 'mail_default_address': 'no-reply@phabricator.wikimedia.org', 'mail_reply_handler_domain': 'phabricator.wikimedia.org', 'phd_taskmasters': 4, 'ssh_host': 'git-ssh.wikimedia.org', 'notification_servers': [{'type': 'client', 'host': 'phabricator.wikimedia.org', 'port': 443, 'protocol': 'https'}, {'type': 'admin', 'host': 'aphlict.discovery.wmnet', 'port': 22281, 'protocol': 'http'}], 'cluster_mailers': [{'key': 'wikimedia-smtp', 'type': 'smtp', 'options': {'host': 'localhost', 'port': 25}}], 'database_host': 'm3-slave.codfw.wmnet', 'database_port': '3323', 'gitlab_api_key': ''}}}

File[/srv/dumps]

Parameters differences:

--- File[/srv/dumps].orig
+++ File[/srv/dumps]

+    mode   => 0755
+    owner  => root
+    ensure => directory
+    group  => root

File[/lib/systemd/system/backup-home-dirs.service]

Parameters differences:

--- File[/lib/systemd/system/backup-home-dirs.service].orig
+++ File[/lib/systemd/system/backup-home-dirs.service]

+    notify => Exec[systemd daemon-reload for backup-home-dirs.service (backup-home-dirs.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/backup-home-dirs.service.orig
+++ /lib/systemd/system/backup-home-dirs.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=create tarballs from /home dirs into /srv/homes
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/backup-home-dirs

File[/lib/systemd/system/backup-home-dirs.timer]

Parameters differences:

--- File[/lib/systemd/system/backup-home-dirs.timer].orig
+++ File[/lib/systemd/system/backup-home-dirs.timer]

+    notify => Exec[systemd daemon-reload for backup-home-dirs.timer (backup-home-dirs.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/backup-home-dirs.timer.orig
+++ /lib/systemd/system/backup-home-dirs.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of backup-home-dirs.service
+
+[Timer]
+Unit=backup-home-dirs.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-*-* 0:10:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Service[backup-home-dirs.timer]

Parameters differences:

--- Service[backup-home-dirs.timer].orig
+++ Service[backup-home-dirs.timer]

+    before   => ['Exec[systemd daemon-reload for backup-home-dirs.timer (backup-home-dirs.timer)]']
+    provider => systemd
+    enable   => False
+    ensure   => stopped

Systemd::Timer::Job[rsync-phabricator-repos]

Parameters differences:

--- Systemd::Timer::Job[rsync-phabricator-repos].orig
+++ Systemd::Timer::Job[rsync-phabricator-repos]

+    monitoring_contact_groups => admins
+    ensure                    => absent
+    private_tmp               => False
+    description               => Transfer data periodically between hosts
+    command                   => /usr/local/sbin/sync-phabricator-repos
+    success_exit_status       => [24]
+    logfile_perms             => all
+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+    syslog_force_stop         => True
+    logfile_group             => root
+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:00/10:00'}
+    user                      => root
+    syslog_match_startswith   => True
+    send_mail_to              => root@phab2003.codfw.wmnet
+    monitoring_enabled        => False
+    fixed_random_delay        => False
+    logfile_name              => syslog.log
+    environment               => {}
+    send_mail                 => False
+    ignore_errors             => False
+    send_mail_only_on_error   => True
+    logging_enabled           => True
+    logfile_basedir           => /var/log

Systemd::Syslog[rsync-phabricator-repos]

Parameters differences:

--- Systemd::Syslog[rsync-phabricator-repos].orig
+++ Systemd::Syslog[rsync-phabricator-repos]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Service[envoyproxy.service]

Parameters differences:

--- Service[envoyproxy.service].orig
+++ Service[envoyproxy.service]

+    restart => /bin/systemctl reload envoyproxy.service
+    enable  => True
+    ensure  => running

File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.timer]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.timer].orig
+++ File[/lib/systemd/system/phabricator_stats_job_quarterly_metrics.timer]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_quarterly_metrics.timer (phabricator_stats_job_quarterly_metrics.timer)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_quarterly_metrics.timer.orig
+++ /lib/systemd/system/phabricator_stats_job_quarterly_metrics.timer
@@ -0,0 +1,12 @@
+[Unit]
+Description=Periodic execution of phabricator_stats_job_quarterly_metrics.service
+
+[Timer]
+Unit=phabricator_stats_job_quarterly_metrics.service
+# Accuracy sets the maximum time interval around the execution time we want to allow
+AccuracySec=15sec
+OnCalendar=*-01,04,07,10-1 0:0:00
+RandomizedDelaySec=0
+
+[Install]
+WantedBy=multi-user.target

Logrotate::Conf[phd]

Parameters differences:

--- Logrotate::Conf[phd].orig
+++ Logrotate::Conf[phd]

+    source => puppet:///modules/phabricator/logrotate_phd
+    ensure => present

File[/usr/local/bin/tech_news_weekly_stats.sh]

Parameters differences:

--- File[/usr/local/bin/tech_news_weekly_stats.sh].orig
+++ File[/usr/local/bin/tech_news_weekly_stats.sh]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /usr/local/bin/tech_news_weekly_stats.sh.orig
+++ /usr/local/bin/tech_news_weekly_stats.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+# Weekly statistics of Phabricator for Tech News
+# https://meta.wikimedia.org/wiki/Tech/News
+# per T368460 - aklapper 20240626
+# SPDX-License-Identifier: Apache-2.0
+# ! this file is managed by puppet !
+# ./modules/phabricator/files/tech_news_weekly_stats.sh
+source /etc/phab_tech_news_weekly_stats.conf
+timestamp=$(date)
+#echo "result_tasks"
+result_tasks=$(MYSQL_PWD=${sql_pass} /usr/bin/mysql -t --skip-column-names -h $sql_host -P $sql_port -u $sql_user phabricator_maniphest << END
+SELECT DISTINCT CONCAT("[[phab:T", t.id, "]]"), t.title, autr.userName, ownr.userName
+    FROM phabricator_maniphest.maniphest_task t
+    INNER JOIN phabricator_user.user autr ON autr.phid = t.authorPHID
+    INNER JOIN phabricator_user.user ownr ON ownr.phid = t.ownerPHID
+    WHERE t.status = "resolved"
+    AND FROM_UNIXTIME(t.closedEpoch)>=(NOW() - INTERVAL 168 HOUR)
+    AND t.viewPolicy = "public"
+    AND autr.phid NOT IN
+        (SELECT ua.userPHID
+         FROM phabricator_user.user u
+         INNER JOIN phabricator_user.user_externalaccount ua
+         ON ua.userPHID = u.phid
+         WHERE ua.accountType = "mediawiki"
+         AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF')
+         OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+    AND autr.phid NOT IN
+        (SELECT ue.userPHID
+         FROM phabricator_user.user u
+         INNER JOIN phabricator_user.user_email ue
+         ON ue.userPHID = u.phid
+         WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com' OR ue.address LIKE '%@thisdot.co'))
+    AND (ownr.phid IN
+            (SELECT ua.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_externalaccount ua ON ua.userPHID = u.phid WHERE ua.accountType = "mediawiki" AND ((ua.username LIKE '%(WMF)' OR ua.username LIKE '%-WMF') OR (ua.username LIKE '%(WMDE)' OR ua.username LIKE '%-WMDE')))
+         OR ownr.phid IN
+            (SELECT ue.userPHID FROM phabricator_user.user u INNER JOIN phabricator_user.user_email ue ON ue.userPHID = u.phid WHERE (ue.address LIKE '%@wikimedia.org' OR ue.address LIKE '%@wikimedia.de' OR ue.address LIKE '%@speedandfunction.com' OR ue.address LIKE '%@thisdot.co')));
+END
+)
+
+# Remove first and last line in mysql table output
+result_tasks=$(echo "$result_tasks" | sed '1d;$d')
+# replace all | (created by the mariadb -t table parameter) with ||
+result_tasks=$(echo "$result_tasks" | sed 's/|/||/g')
+# remove last three letters of every line to remove " ||"
+result_tasks=$(echo "$result_tasks" | sed -r 's/.{3}$//')
+# remove first letter | of every line
+result_tasks=$(echo "$result_tasks" | sed -r 's/^.//')
+# add |- in a new line between all lines
+result_tasks=$(echo "$result_tasks" | sed ':a;N;$!ba;s/\n/\n|\-\n/g')
+
+# the actual email
+cat <<EOF | /usr/bin/mail -r "${sndr_address}" -s "Weekly Phabricator data for Tech News - ${timestamp}" -a "Auto-Submitted: auto-generated" ${rcpt_address}
+This is the automatic weekly Phabricator mail for Tech News.
+
+It is supposed to list Phabricator tasks reported by folks who are
+not with WMF, WMDE, or contractors, and resolved in the last quarter
+by folks who are with WMF, WMDE, or contractors.
+
+IMPORTANT:
+The results below are incorrect as long as staff and contractors
+are allowed to use non-staff accounts and non-staff/personal email
+addresses and accounts for their staff activity in Phabricator.
+
+Thus results and numbers MUST be manually reviewed and corrected:
+
+{| class="wikitable"
+! url
+! taskTitle
+! author
+! assignee
+|-
+${result_tasks}
+|}
+
+Yours sincerely,
+Fab Rick Aytor
+(via $(basename $0) on $(hostname) at $(date); see T368460, T373952)
+EOF

Systemd::Service[phabricator_stats_job_tech_news_weekly_stats]

Parameters differences:

--- Systemd::Service[phabricator_stats_job_tech_news_weekly_stats].orig
+++ Systemd::Service[phabricator_stats_job_tech_news_weekly_stats]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => absent
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_stats_job_tech_news_weekly_stats.service]
+    monitoring_contact_group => admins

File[/etc/nftables/notrack/10_envoy_tls_termination_src_sets.nft]

Parameters differences:

--- File[/etc/nftables/notrack/10_envoy_tls_termination_src_sets.nft].orig
+++ File[/etc/nftables/notrack/10_envoy_tls_termination_src_sets.nft]

+    notify  => ['Service[nftables]']
+    mode    => 0444
+    tag     => nft
+    owner   => root
+    ensure  => present
+    require => ['Nftables::Set[CACHES]']
+    group   => root

Content differences:

--- /etc/nftables/notrack/10_envoy_tls_termination_src_sets.nft.orig
+++ /etc/nftables/notrack/10_envoy_tls_termination_src_sets.nft
@@ -0,0 +1,4 @@
+# Managed by puppet
+# 
+ip saddr @CACHES_ipv4 tcp dport { 443 } notrack
+ip6 saddr @CACHES_ipv6 tcp dport { 443 } notrack

Admin::User[urbanecm]

Parameters differences:

--- Admin::User[urbanecm].orig
+++ Admin::User[urbanecm]

+    comment  => Martin Urbanec
+    ensure   => present
+    shell    => /bin/bash
+    ssh_keys => ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOKBGnnWotDTo/92I2MakxTAoBDYLbFA/+0uT2F5y4U5 urbanecm@LAPTOP-A3BHKQ07', 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFHTZ81VvnWUQtmYUfzIFUmtREeQoiC9hSAoI3fOrcK murbanec+prod@wmf']
+    groups   => []
+    home_dir => /home/urbanecm
+    gid      => 500
+    uid      => 13367

Concat_fragment[/etc/bacula_puppet_agent_cert]

Parameters differences:

--- Concat_fragment[/etc/bacula_puppet_agent_cert].orig
+++ Concat_fragment[/etc/bacula_puppet_agent_cert]

+    order  => 01
+    tag    => _etc_bacula_ssl_cert.pem
+    source => /var/lib/puppet/ssl/certs/phab2003.codfw.wmnet.pem
+    target => /etc/bacula/ssl/cert.pem

Systemd::Syslog[phabricator_stats_job_community_metrics]

Parameters differences:

--- Systemd::Syslog[phabricator_stats_job_community_metrics].orig
+++ Systemd::Syslog[phabricator_stats_job_community_metrics]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Package[exim4-config]

Parameters differences:

--- Package[exim4-config].orig
+++ Package[exim4-config]

+    provider => apt
+    ensure   => installed

Concat_file[/etc/bacula/ssl/cert.pem]

Parameters differences:

--- Concat_file[/etc/bacula/ssl/cert.pem].orig
+++ Concat_file[/etc/bacula/ssl/cert.pem]

+    show_diff      => True
+    replace        => True
+    ensure_newline => False
+    force          => False
+    format         => plain
+    mode           => 0644
+    tag            => _etc_bacula_ssl_cert.pem
+    order          => alpha
+    backup         => puppet

File[/var/log/phabricator_stats_job_community_metrics]

Parameters differences:

--- File[/var/log/phabricator_stats_job_community_metrics].orig
+++ File[/var/log/phabricator_stats_job_community_metrics]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Class[Profile::Phabricator::Main]

Parameters differences:

--- Class[Profile::Phabricator::Main].orig
+++ Class[Profile::Phabricator::Main]

+    altdom                    => phab.wmfusercontent.org
+    mysql_master_port         => 3306
+    rate_limits               => {'request': 0, 'connection': 0}
+    gitlab_api_key            => 
+    timezone                  => UTC
+    remote_aphlict_domain     => aphlict.discovery.wmnet
+    mysql_slave_port          => 3323
+    passive_server            => phab2002.codfw.wmnet
+    apc_shm_size              => 4096M
+    phab_diffusion_ssh_host   => git-ssh.wikimedia.org
+    enable_vcs                => True
+    phd_taskmasters           => 4
+    domain                    => phabricator.wikimedia.org
+    deploy_target             => phabricator/deployment
+    dump_enabled              => False
+    deploy_user               => phab-deploy
+    use_lvs                   => False
+    database_datadir          => /var/lib/mysql
+    manage_scap_user          => True
+    aphlict_ssl               => False
+    local_aphlict_enabled     => False
+    http_srange               => ['DEPLOYMENT_HOSTS']
+    active_server             => phab1004.eqiad.wmnet
+    opcache_validate          => 0
+    mysql_slave               => m3-slave.codfw.wmnet
+    remote_aphlict_admin_port => 22281
+    mysql_master              => m3-master.codfw.wmnet
+    phab_root_dir             => /srv/phab
+    default_mail_address      => no-reply@phabricator.wikimedia.org

File[/etc/envoy/admin-config.yaml]

Parameters differences:

--- File[/etc/envoy/admin-config.yaml].orig
+++ File[/etc/envoy/admin-config.yaml]

+    notify => Exec[verify-envoy-config]
+    mode   => 0555
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/envoy/admin-config.yaml.orig
+++ /etc/envoy/admin-config.yaml
@@ -0,0 +1,10 @@
+---
+access_log:
+  typed_config:
+    "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+    path: "/var/log/envoy/admin-access.log"
+address:
+  socket_address:
+    address: 0.0.0.0
+    port_value: 9631
+ignore_global_conn_limit: true

File[/etc/envoy/stats-config.yaml]

Parameters differences:

--- File[/etc/envoy/stats-config.yaml].orig
+++ File[/etc/envoy/stats-config.yaml]

+    notify => Exec[verify-envoy-config]
+    mode   => 0555
+    source => puppet:///modules/envoyproxy/stats-config.yaml
+    owner  => root
+    ensure => present
+    group  => root

Exec[update-safedir-gitconfig]

Parameters differences:

--- Exec[update-safedir-gitconfig].orig
+++ Exec[update-safedir-gitconfig]

+    refreshonly => True
+    command     => /bin/cat /etc/gitconfig.d/*.gitconfig > /etc/gitconfig

File[/var/spool/exim4]

Parameters differences:

--- File[/var/spool/exim4].orig
+++ File[/var/spool/exim4]

+    mode    => 0751
+    owner   => Debian-exim
+    ensure  => directory
+    require => Package[exim4-daemon-heavy]
+    group   => Debian-exim

Mount[/var/spool/exim4/db]

Parameters differences:

--- Mount[/var/spool/exim4/db].orig
+++ Mount[/var/spool/exim4/db]

+    atboot  => True
+    fstype  => tmpfs
+    ensure  => mounted
+    options => defaults
+    before  => Service[exim4]
+    require => Exec[mkdir /var/spool/exim4/scan]
+    device  => none

File[/usr/local/sbin/build-envoy-config]

Parameters differences:

--- File[/usr/local/sbin/build-envoy-config].orig
+++ File[/usr/local/sbin/build-envoy-config]

+    mode   => 0555
+    source => puppet:///modules/envoyproxy/build_envoy_config.py
+    owner  => root
+    ensure => present
+    group  => root

User[urbanecm]

Parameters differences:

--- User[urbanecm].orig
+++ User[urbanecm]

+    comment    => Martin Urbanec
+    managehome => False
+    ensure     => present
+    shell      => /bin/bash
+    groups     => []
+    allowdupe  => False
+    gid        => 500
+    home       => /home/urbanecm
+    uid        => 13367

Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.timer]

Parameters differences:

--- Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.timer].orig
+++ Systemd::Unit[phabricator_stats_job_quarterly_wmf_qls.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => phabricator_stats_job_quarterly_wmf_qls.timer
+    require           => ['Class[Systemd]']

Systemd::Timer[wmf_auto_restart_aphlict]

Parameters differences:

--- Systemd::Timer[wmf_auto_restart_aphlict].orig
+++ Systemd::Timer[wmf_auto_restart_aphlict]

+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 11:39:00'}]
+    accuracy           => 15sec
+    fixed_random_delay => False
+    ensure             => absent
+    unit_name          => wmf_auto_restart_aphlict.service
+    splay              => 0

Systemd::Service[phabricator_clean_tmp_files]

Parameters differences:

--- Systemd::Service[phabricator_clean_tmp_files].orig
+++ Systemd::Service[phabricator_clean_tmp_files]

+    override                 => False
+    restart                  => False
+    monitoring_critical      => False
+    ensure                   => present
+    monitoring_enabled       => False
+    migration_task           => T407130
+    unit_type                => timer
+    service_params           => {}
+    require                  => Systemd::Unit[phabricator_clean_tmp_files.service]
+    monitoring_contact_group => admins

File[/etc/phab_quarterly_wmf_qls.conf]

Parameters differences:

--- File[/etc/phab_quarterly_wmf_qls.conf].orig
+++ File[/etc/phab_quarterly_wmf_qls.conf]

+    mode   => 0550
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/phab_quarterly_wmf_qls.conf.orig
+++ /etc/phab_quarterly_wmf_qls.conf
@@ -0,0 +1,7 @@
+declare rcpt_address='aramirez@wikimedia.org,cbogen@wikimedia.org,mcollins@wikimedia.org,aklapper@wikimedia.org'
+declare sndr_address='aklapper@wikimedia.org'
+declare sql_host='m3-slave.codfw.wmnet'
+declare sql_port='3323'
+declare sql_user='metrics_user'
+declare sql_name='phabricator_maniphest'
+declare sql_pass='metrics_pass'

File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem]

Parameters differences:

--- File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem].orig
+++ File[/etc/envoy/ssl/discovery2026__phabricator_discovery_wmnet_server.pem]

+    mode   => 0440
+    owner  => envoy
+    ensure => file
+    group  => envoy

Class[Profile::Envoy]

Parameters differences:

--- Class[Profile::Envoy].orig
+++ Class[Profile::Envoy]

+    runtime => {}
+    require => ['Class[Profile::Tcp_fast_open]']
+    cluster => misc
+    ensure  => present

Systemd::Unit[rsync-phabricator-home-dirs.timer]

Parameters differences:

--- Systemd::Unit[rsync-phabricator-home-dirs.timer].orig
+++ Systemd::Unit[rsync-phabricator-home-dirs.timer]

+    override_filename => puppet-override.conf
+    override          => False
+    restart           => False
+    ensure            => absent
+    unit              => rsync-phabricator-home-dirs.timer
+    require           => ['Class[Systemd]']

File[/var/log/backup-home-dirs]

Parameters differences:

--- File[/var/log/backup-home-dirs].orig
+++ File[/var/log/backup-home-dirs]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

Systemd::Unit[envoyproxy.service]

Parameters differences:

--- Systemd::Unit[envoyproxy.service].orig
+++ Systemd::Unit[envoyproxy.service]

+    override_filename => puppet-override.conf
+    override          => True
+    restart           => False
+    ensure            => present
+    unit              => envoyproxy.service
+    require           => ['Class[Systemd]']

File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.service]

Parameters differences:

--- File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.service].orig
+++ File[/lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.service]

+    notify => Exec[systemd daemon-reload for phabricator_stats_job_tech_news_weekly_stats.service (phabricator_stats_job_tech_news_weekly_stats.service)]
+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.service.orig
+++ /lib/systemd/system/phabricator_stats_job_tech_news_weekly_stats.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=phabricator statistics mail - tech_news_weekly_stats
+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/tech_news_weekly_stats.sh

File[/var/log/phabricator_stats_job_quarterly_metrics]

Parameters differences:

--- File[/var/log/phabricator_stats_job_quarterly_metrics].orig
+++ File[/var/log/phabricator_stats_job_quarterly_metrics]

+    mode   => 0755
+    owner  => root
+    ensure => absent
+    force  => True
+    backup => False
+    group  => root

File[/etc/envoy/runtime.yaml]

Parameters differences:

--- File[/etc/envoy/runtime.yaml].orig
+++ File[/etc/envoy/runtime.yaml]

+    notify => Exec[verify-envoy-config]
+    mode   => 0555
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/envoy/runtime.yaml.orig
+++ /etc/envoy/runtime.yaml
@@ -0,0 +1 @@
+--- {}

Httpd::Site[phabricator]

Parameters differences:

--- Httpd::Site[phabricator].orig
+++ Httpd::Site[phabricator]

+    require  => ['Package[phabricator/deployment]']
+    priority => 50
+    ensure   => present

File[/etc/logrotate.d/wmf_auto_restart_aphlict]

Parameters differences:

--- File[/etc/logrotate.d/wmf_auto_restart_aphlict].orig
+++ File[/etc/logrotate.d/wmf_auto_restart_aphlict]

+    mode   => 0444
+    owner  => root
+    ensure => absent
+    group  => root

Content differences:

--- /etc/logrotate.d/wmf_auto_restart_aphlict.orig
+++ /etc/logrotate.d/wmf_auto_restart_aphlict
@@ -0,0 +1,12 @@
+# logrotate(8) config for wmf_auto_restart_aphlict
+
+/var/log/wmf_auto_restart_aphlict/*.log {
+    daily
+    copytruncate
+    missingok
+    compress
+    delaycompress
+    notifempty
+    rotate 15
+    size 256M
+}

File[/etc/ssh/userkeys/urbanecm]

Parameters differences:

--- File[/etc/ssh/userkeys/urbanecm].orig
+++ File[/etc/ssh/userkeys/urbanecm]

+    mode      => 0444
+    owner     => root
+    ensure    => file
+    show_diff => False
+    force     => True
+    group     => root

Content differences:

--- /etc/ssh/userkeys/urbanecm.orig
+++ /etc/ssh/userkeys/urbanecm
@@ -0,0 +1,2 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOKBGnnWotDTo/92I2MakxTAoBDYLbFA/+0uT2F5y4U5 urbanecm@LAPTOP-A3BHKQ07
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFHTZ81VvnWUQtmYUfzIFUmtREeQoiC9hSAoI3fOrcK murbanec+prod@wmf

Prometheus::Blackbox::Check::Tcp[phabricator-smtp]

Parameters differences:

--- Prometheus::Blackbox::Check::Tcp[phabricator-smtp].orig
+++ Prometheus::Blackbox::Check::Tcp[phabricator-smtp]

+    severity                => task
+    alert_after             => 2m
+    port                    => 25
+    ip_families             => ['ip4', 'ip6']
+    use_client_auth         => False
+    client_auth_cert        => /etc/prometheus/ssl/cert.pem
+    client_auth_key         => /etc/prometheus/ssl/server.key
+    probe_runbook           => https://wikitech.wikimedia.org/wiki/TLS/Runbook#{{ $labels.instance }}
+    server_name             => phab2003
+    certificate_expiry_days => 10
+    timeout                 => 3s
+    ip4                     => 10.192.27.12
+    team                    => collaboration-services
+    ip6                     => 2620:0:860:114:10:192:27:12
+    force_tls               => False
+    site                    => codfw
+    instance_label          => phab2003
+    prometheus_instance     => ops

Service[exim4]

Parameters differences:

--- Service[exim4].orig
+++ Service[exim4]

+    require   => Package[exim4-daemon-heavy]
+    hasstatus => True
+    ensure    => running

Package[subversion]

Parameters differences:

--- Package[subversion].orig
+++ Package[subversion]

+    provider => apt
+    ensure   => present

Systemd::Syslog[phabricator_stats_job_quarterly_wmf_qls]

Parameters differences:

--- Systemd::Syslog[phabricator_stats_job_quarterly_wmf_qls].orig
+++ Systemd::Syslog[phabricator_stats_job_quarterly_wmf_qls]

+    readable_by            => all
+    ensure                 => absent
+    programname_comparison => startswith
+    log_filename           => syslog.log
+    force_stop             => True
+    owner                  => root
+    group                  => root
+    base_dir               => /var/log

Class[Phabricator::Phd]

Parameters differences:

--- Class[Phabricator::Phd].orig
+++ Class[Phabricator::Phd]

+    basedir     => /srv/phab
+    require     => ['Package[phabricator/deployment]']
+    phd_log_dir => /var/log/phd
+    phd_user    => phd

File[/etc/envoy/clusters.d/00-cluster_local_port_80.yaml]

Parameters differences:

--- File[/etc/envoy/clusters.d/00-cluster_local_port_80.yaml].orig
+++ File[/etc/envoy/clusters.d/00-cluster_local_port_80.yaml]

+    notify => Exec[verify-envoy-config]
+    mode   => 0444
+    owner  => root
+    ensure => present
+    group  => root

Content differences:

--- /etc/envoy/clusters.d/00-cluster_local_port_80.yaml.orig
+++ /etc/envoy/clusters.d/00-cluster_local_port_80.yaml
@@ -0,0 +1,13 @@
+name: local_port_80
+connect_timeout: 1.0s
+type: strict_dns
+lb_policy: round_robin
+load_assignment:
+  cluster_name: local_port_80
+  endpoints:
+  - lb_endpoints:
+    - endpoint:
+        address:
+          socket_address:
+            address: phab2003.codfw.wmnet
+            port_value: 80

File[/etc/ssh/userkeys/gjg]

Parameters differences:

--- File[/etc/ssh/userkeys/gjg].orig
+++ File[/etc/ssh/userkeys/gjg]

+    mode      => 0444
+    owner     => root
+    ensure    => file
+    show_diff => False
+    force     => True
+    group     => root

Content differences:

--- /etc/ssh/userkeys/gjg.orig
+++ /etc/ssh/userkeys/gjg
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPul+urK7qgLY7UucRRj9SljZFB/DWpMKZ1KMragNGbc greg@carbon12

Compilation results for phab2003.codfw.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

Resources only in the old catalog

Resources modified

Relevant files