--- Class[Profile::Bird::Anycast].orig
+++ Class[Profile::Bird::Anycast]
@@
- advertise_vips => {'recdns.anycast.wmnet': {'address': '10.3.0.1', 'check_cmd': '/usr/local/bin/check_recdns_state /usr/lib/nagios/plugins/check_dns_query -H 10.3.0.1 -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'recdns'}, 'ns2.wikimedia.org': {'address': '198.35.27.27', 'check_cmd': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 198.35.27.27 -a -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'authdns-ns2'}, 'ntp-a.anycast.wmnet': {'address': '10.3.0.5', 'check_cmd': '/usr/local/bin/check_ntp_a_state /usr/lib/nagios/plugins/check_ntp_peer -H 127.0.0.1 -w 0.05 -c 0.1', 'ensure': 'present', 'service_type': 'ntp-a'}}
+ advertise_vips => {'recdns.anycast.wmnet': {'address': '10.3.0.1', 'check_cmd': '/usr/local/bin/check_recdns_state /usr/lib/nagios/plugins/check_dns_query -H 10.3.0.1 -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'recdns'}, 'ns2.wikimedia.org': {'address': '198.35.27.27', 'check_cmd': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 198.35.27.27 -a -l -d www.wikipedia.org -t 1', 'address_ipv6': '2a02:ec80:53::1', 'check_cmd_ipv6': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 2a02:ec80:53::1 -a -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'authdns-ns2'}, 'ntp-a.anycast.wmnet': {'address': '10.3.0.5', 'check_cmd': '/usr/local/bin/check_ntp_a_state /usr/lib/nagios/plugins/check_ntp_peer -H 127.0.0.1 -w 0.05 -c 0.1', 'ensure': 'present', 'service_type': 'ntp-a'}}
@@
- do_ipv6 => False
+ do_ipv6 => True
File[/etc/ferm/conf.d/06_tcp_dotls_auth]
- Content differences:
--- /etc/ferm/conf.d/06_tcp_dotls_auth.orig
+++ /etc/ferm/conf.d/06_tcp_dotls_auth
@@ -1,7 +1,7 @@
# Autogenerated by puppet. DO NOT EDIT BY HAND!
#
#
-&D_SERVICE(tcp, 853, (208.80.154.238 208.80.153.231 198.35.27.27));
+&D_SERVICE(tcp, 853, (208.80.154.238 2620:0:861:53::1 208.80.153.231 2620:0:860:53::1 198.35.27.27 2a02:ec80:53::1));
File[/etc/anycast-healthchecker.d/hc-vip-ns2.wikimedia.org.conf]
- Content differences:
--- /etc/anycast-healthchecker.d/hc-vip-ns2.wikimedia.org.conf.orig
+++ /etc/anycast-healthchecker.d/hc-vip-ns2.wikimedia.org.conf
@@ -7,3 +7,13 @@
check_disabled = false
on_disabled = withdraw
ip_prefix = 198.35.27.27/32
+
+[hc-vip-ns2.wikimedia.org.ipv6]
+check_cmd = /usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 2a02:ec80:53::1 -a -l -d www.wikipedia.org -t 1
+check_interval = 1
+check_timeout = 1
+check_fail = 1
+check_rise = 10
+check_disabled = false
+on_disabled = withdraw
+ip_prefix = 2a02:ec80:53::1/128
File[/etc/gdnsd/config-options]
- Content differences:
--- /etc/gdnsd/config-options.orig
+++ /etc/gdnsd/config-options
@@ -16,11 +16,23 @@
udp_threads = 24
tcp_threads = 24
}
+ "2620:0:861:53::1" = {
+ udp_threads = 24
+ tcp_threads = 24
+ }
"208.80.153.231" = {
udp_threads = 24
tcp_threads = 24
}
+ "2620:0:860:53::1" = {
+ udp_threads = 24
+ tcp_threads = 24
+ }
"198.35.27.27" = {
+ udp_threads = 24
+ tcp_threads = 24
+ }
+ "2a02:ec80:53::1" = {
udp_threads = 24
tcp_threads = 24
}
Firewall::Service[bird-bfd-echo]
- Parameters differences:
--- Firewall::Service[bird-bfd-echo].orig
+++ Firewall::Service[bird-bfd-echo]
@@
- srange => ['185.15.59.33']
+ srange => ['185.15.59.33', 'fe80::8243:3f01:3816:a4c0']
- Bird::Anycast_healthchecker_check[hc-vip-recdns.anycast.wmnet]
- Parameters differences:
--- Bird::Anycast_healthchecker_check[hc-vip-recdns.anycast.wmnet].orig
+++ Bird::Anycast_healthchecker_check[hc-vip-recdns.anycast.wmnet]
@@
- do_ipv6 => False
+ do_ipv6 => True
- File[/etc/bird/bird.conf]
- Content differences:
--- /etc/bird/bird.conf.orig
+++ /etc/bird/bird.conf
@@ -1,4 +1,5 @@
include "/etc/bird/anycast-prefixes.conf";
+include "/etc/bird/anycast6-prefixes.conf";
router id 185.15.59.34;
@@ -8,9 +9,20 @@
export all;
};
}
+protocol direct {
+ interface "*";
+ ipv6 {
+ export all;
+ };
+}
protocol kernel {
ipv4 {
+ import none;
+ };
+}
+protocol kernel {
+ ipv6 {
import none;
};
}
@@ -22,9 +34,21 @@
{
return net ~ ACAST_PS_ADVERTISE;
}
+function match_route6()
+{
+ return net ~ ACAST6_PS_ADVERTISE;
+}
filter vips_filter {
if ( net.len = 32 && net !~ 203.0.113.1/32 && match_route() ) then {
+ accept;
+ }
+ else {
+ reject;
+ }
+}
+filter vips6_filter {
+ if ( net.len = 128 && net !~ 2001:db8::1/128 && match_route6() ) then {
accept;
}
else {
@@ -49,3 +73,13 @@
neighbor 185.15.59.33 external;
}
+protocol bgp {
+ bfd yes;
+ ipv6 {
+ import none;
+ export filter vips6_filter;
+ };
+ local 2a02:ec80:300:2:185:15:59:34 as 64605;
+ interface "eno12399np0";
+ neighbor fe80::8243:3f01:3816:a4c0 external;
+}
- File[/etc/ferm/conf.d/10_bird_bgp]
- Content differences:
--- /etc/ferm/conf.d/10_bird_bgp.orig
+++ /etc/ferm/conf.d/10_bird_bgp
@@ -1,6 +1,6 @@
# Autogenerated by puppet. DO NOT EDIT BY HAND!
#
#
-&R_SERVICE(tcp, 179, (185.15.59.33));
+&R_SERVICE(tcp, 179, (185.15.59.33 fe80::8243:3f01:3816:a4c0));
- Ferm::Service[bird_bfd_control]
- Parameters differences:
--- Ferm::Service[bird_bfd_control].orig
+++ Ferm::Service[bird_bfd_control]
@@
- srange => ['185.15.59.33']
+ srange => ['185.15.59.33', 'fe80::8243:3f01:3816:a4c0']
- File[/etc/anycast-healthchecker.conf]
- Content differences:
--- /etc/anycast-healthchecker.conf.orig
+++ /etc/anycast-healthchecker.conf
@@ -4,7 +4,7 @@
[daemon]
pidfile = /var/run/anycast-healthchecker/anycast-healthchecker.pid
ipv4 = true
-ipv6 = false
+ipv6 = true
bird_conf = /etc/bird/anycast-prefixes.conf
bird6_conf = /etc/bird/anycast6-prefixes.conf
bird_variable = ACAST_PS_ADVERTISE
- Class[Profile::Dns::Auth::Update]
- Parameters differences:
--- Class[Profile::Dns::Auth::Update].orig
+++ Class[Profile::Dns::Auth::Update]
@@
- advertise_vips => {'recdns.anycast.wmnet': {'address': '10.3.0.1', 'check_cmd': '/usr/local/bin/check_recdns_state /usr/lib/nagios/plugins/check_dns_query -H 10.3.0.1 -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'recdns'}, 'ns2.wikimedia.org': {'address': '198.35.27.27', 'check_cmd': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 198.35.27.27 -a -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'authdns-ns2'}, 'ntp-a.anycast.wmnet': {'address': '10.3.0.5', 'check_cmd': '/usr/local/bin/check_ntp_a_state /usr/lib/nagios/plugins/check_ntp_peer -H 127.0.0.1 -w 0.05 -c 0.1', 'ensure': 'present', 'service_type': 'ntp-a'}}
+ advertise_vips => {'recdns.anycast.wmnet': {'address': '10.3.0.1', 'check_cmd': '/usr/local/bin/check_recdns_state /usr/lib/nagios/plugins/check_dns_query -H 10.3.0.1 -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'recdns'}, 'ns2.wikimedia.org': {'address': '198.35.27.27', 'check_cmd': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 198.35.27.27 -a -l -d www.wikipedia.org -t 1', 'address_ipv6': '2a02:ec80:53::1', 'check_cmd_ipv6': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 2a02:ec80:53::1 -a -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'authdns-ns2'}, 'ntp-a.anycast.wmnet': {'address': '10.3.0.5', 'check_cmd': '/usr/local/bin/check_ntp_a_state /usr/lib/nagios/plugins/check_ntp_peer -H 127.0.0.1 -w 0.05 -c 0.1', 'ensure': 'present', 'service_type': 'ntp-a'}}
- File[/etc/haproxy/haproxy.cfg]
- Content differences:
--- /etc/haproxy/haproxy.cfg.orig
+++ /etc/haproxy/haproxy.cfg
@@ -36,9 +36,18 @@
listen dns_ns0-v4
bind 208.80.154.238:853 ssl tfo allow-0rtt curves X25519:X448:P-256 crt /etc/acmecerts/dotls-for-authdns/live/ec-prime256v1.chained.crt.key
server gdnsd 127.0.0.1:535 send-proxy-v2
+listen dns_ns0-v6
+ bind 2620:0:861:53::1:853 ssl tfo allow-0rtt curves X25519:X448:P-256 crt /etc/acmecerts/dotls-for-authdns/live/ec-prime256v1.chained.crt.key
+ server gdnsd 127.0.0.1:535 send-proxy-v2
listen dns_ns1-v4
bind 208.80.153.231:853 ssl tfo allow-0rtt curves X25519:X448:P-256 crt /etc/acmecerts/dotls-for-authdns/live/ec-prime256v1.chained.crt.key
+ server gdnsd 127.0.0.1:535 send-proxy-v2
+listen dns_ns1-v6
+ bind 2620:0:860:53::1:853 ssl tfo allow-0rtt curves X25519:X448:P-256 crt /etc/acmecerts/dotls-for-authdns/live/ec-prime256v1.chained.crt.key
server gdnsd 127.0.0.1:535 send-proxy-v2
listen dns_ns2-v4
bind 198.35.27.27:853 ssl tfo allow-0rtt curves X25519:X448:P-256 crt /etc/acmecerts/dotls-for-authdns/live/ec-prime256v1.chained.crt.key
server gdnsd 127.0.0.1:535 send-proxy-v2
+listen dns_ns2-v6
+ bind 2a02:ec80:53::1:853 ssl tfo allow-0rtt curves X25519:X448:P-256 crt /etc/acmecerts/dotls-for-authdns/live/ec-prime256v1.chained.crt.key
+ server gdnsd 127.0.0.1:535 send-proxy-v2
- Bird::Anycast_healthchecker_check[hc-vip-ns2.wikimedia.org]
- Parameters differences:
--- Bird::Anycast_healthchecker_check[hc-vip-ns2.wikimedia.org].orig
+++ Bird::Anycast_healthchecker_check[hc-vip-ns2.wikimedia.org]
+ address_ipv6 => 2a02:ec80:53::1
+ check_cmd_ipv6 => /usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 2a02:ec80:53::1 -a -l -d www.wikipedia.org -t 1
@@
- do_ipv6 => False
+ do_ipv6 => True
- File[/etc/ferm/conf.d/10_bird_bfd_control]
- Content differences:
--- /etc/ferm/conf.d/10_bird_bfd_control.orig
+++ /etc/ferm/conf.d/10_bird_bfd_control
@@ -1,7 +1,7 @@
# Autogenerated by puppet. DO NOT EDIT BY HAND!
#
#
-&R_SERVICE(udp, 3784, (185.15.59.33));
+&R_SERVICE(udp, 3784, (185.15.59.33 fe80::8243:3f01:3816:a4c0));
&R_SERVICE(udp, 3784, $LINK_LOCAL);
- Bird::Anycast_healthchecker_check[hc-vip-ntp-a.anycast.wmnet]
- Parameters differences:
--- Bird::Anycast_healthchecker_check[hc-vip-ntp-a.anycast.wmnet].orig
+++ Bird::Anycast_healthchecker_check[hc-vip-ntp-a.anycast.wmnet]
@@
- do_ipv6 => False
+ do_ipv6 => True
- Class[Profile::Dns::Recursor]
- Parameters differences:
--- Class[Profile::Dns::Recursor].orig
+++ Class[Profile::Dns::Recursor]
@@
- advertise_vips => {'recdns.anycast.wmnet': {'address': '10.3.0.1', 'check_cmd': '/usr/local/bin/check_recdns_state /usr/lib/nagios/plugins/check_dns_query -H 10.3.0.1 -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'recdns'}, 'ns2.wikimedia.org': {'address': '198.35.27.27', 'check_cmd': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 198.35.27.27 -a -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'authdns-ns2'}, 'ntp-a.anycast.wmnet': {'address': '10.3.0.5', 'check_cmd': '/usr/local/bin/check_ntp_a_state /usr/lib/nagios/plugins/check_ntp_peer -H 127.0.0.1 -w 0.05 -c 0.1', 'ensure': 'present', 'service_type': 'ntp-a'}}
+ advertise_vips => {'recdns.anycast.wmnet': {'address': '10.3.0.1', 'check_cmd': '/usr/local/bin/check_recdns_state /usr/lib/nagios/plugins/check_dns_query -H 10.3.0.1 -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'recdns'}, 'ns2.wikimedia.org': {'address': '198.35.27.27', 'check_cmd': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 198.35.27.27 -a -l -d www.wikipedia.org -t 1', 'address_ipv6': '2a02:ec80:53::1', 'check_cmd_ipv6': '/usr/local/bin/check_authdns_ns2_state /usr/lib/nagios/plugins/check_dns_query -H 2a02:ec80:53::1 -a -l -d www.wikipedia.org -t 1', 'ensure': 'present', 'service_type': 'authdns-ns2'}, 'ntp-a.anycast.wmnet': {'address': '10.3.0.5', 'check_cmd': '/usr/local/bin/check_ntp_a_state /usr/lib/nagios/plugins/check_ntp_peer -H 127.0.0.1 -w 0.05 -c 0.1', 'ensure': 'present', 'service_type': 'ntp-a'}}
- File[/etc/ferm/conf.d/05_tcp_dns_auth]
- Content differences:
--- /etc/ferm/conf.d/05_tcp_dns_auth.orig
+++ /etc/ferm/conf.d/05_tcp_dns_auth
@@ -1,7 +1,7 @@
# Autogenerated by puppet. DO NOT EDIT BY HAND!
#
#
-&D_SERVICE(tcp, 53, (208.80.154.238 208.80.153.231 198.35.27.27));
+&D_SERVICE(tcp, 53, (208.80.154.238 2620:0:861:53::1 208.80.153.231 2620:0:860:53::1 198.35.27.27 2a02:ec80:53::1));
- Ferm::Service[tcp_dns_auth]
- Parameters differences:
--- Ferm::Service[tcp_dns_auth].orig
+++ Ferm::Service[tcp_dns_auth]
@@
- drange => (208.80.154.238 208.80.153.231 198.35.27.27)
+ drange => (208.80.154.238 2620:0:861:53::1 208.80.153.231 2620:0:860:53::1 198.35.27.27 2a02:ec80:53::1)
- Class[Bird::Anycast_healthchecker]
- Parameters differences:
--- Class[Bird::Anycast_healthchecker].orig
+++ Class[Bird::Anycast_healthchecker]
@@
- do_ipv6 => False
+ do_ipv6 => True
- Ferm::Service[bird_bgp]
- Parameters differences:
--- Ferm::Service[bird_bgp].orig
+++ Ferm::Service[bird_bgp]
@@
- srange => ['185.15.59.33']
+ srange => ['185.15.59.33', 'fe80::8243:3f01:3816:a4c0']
- File[/etc/ferm/conf.d/10_bird_bfd_echo]
- Content differences:
--- /etc/ferm/conf.d/10_bird_bfd_echo.orig
+++ /etc/ferm/conf.d/10_bird_bfd_echo
@@ -1,7 +1,7 @@
# Autogenerated by puppet. DO NOT EDIT BY HAND!
#
#
-&R_SERVICE(udp, 3785, (185.15.59.33));
+&R_SERVICE(udp, 3785, (185.15.59.33 fe80::8243:3f01:3816:a4c0));
&R_SERVICE(udp, 3785, $LINK_LOCAL);
- Class[Profile::Dns::Auth::Dotls]
- Parameters differences:
--- Class[Profile::Dns::Auth::Dotls].orig
+++ Class[Profile::Dns::Auth::Dotls]
@@
- authdns_addrs => {'ns0-v4': {'address': '208.80.154.238', 'skip_loopback_site': 'eqiad'}, 'ns1-v4': {'address': '208.80.153.231', 'skip_loopback_site': 'codfw'}, 'ns2-v4': {'address': '198.35.27.27', 'skip_loopback': True}}
+ authdns_addrs => {'ns0-v4': {'address': '208.80.154.238', 'skip_loopback_site': 'eqiad'}, 'ns0-v6': {'address': '2620:0:861:53::1', 'skip_loopback_site': 'eqiad'}, 'ns1-v4': {'address': '208.80.153.231', 'skip_loopback_site': 'codfw'}, 'ns1-v6': {'address': '2620:0:860:53::1', 'skip_loopback_site': 'codfw'}, 'ns2-v4': {'address': '198.35.27.27', 'skip_loopback': True}, 'ns2-v6': {'address': '2a02:ec80:53::1', 'skip_loopback': True}}
- Ferm::Service[udp_dns_auth]
- Parameters differences:
--- Ferm::Service[udp_dns_auth].orig
+++ Ferm::Service[udp_dns_auth]
@@
- drange => (208.80.154.238 208.80.153.231 198.35.27.27)
+ drange => (208.80.154.238 2620:0:861:53::1 208.80.153.231 2620:0:860:53::1 198.35.27.27 2a02:ec80:53::1)
- Class[Bird]
- Parameters differences:
--- Class[Bird].orig
+++ Class[Bird]
@@
- do_ipv6 => False
+ do_ipv6 => True
- Class[Profile::Dns::Auth::Config]
- Parameters differences:
--- Class[Profile::Dns::Auth::Config].orig
+++ Class[Profile::Dns::Auth::Config]
@@
- authdns_addrs => {'ns0-v4': {'address': '208.80.154.238', 'skip_loopback_site': 'eqiad'}, 'ns1-v4': {'address': '208.80.153.231', 'skip_loopback_site': 'codfw'}, 'ns2-v4': {'address': '198.35.27.27', 'skip_loopback': True}}
+ authdns_addrs => {'ns0-v4': {'address': '208.80.154.238', 'skip_loopback_site': 'eqiad'}, 'ns0-v6': {'address': '2620:0:861:53::1', 'skip_loopback_site': 'eqiad'}, 'ns1-v4': {'address': '208.80.153.231', 'skip_loopback_site': 'codfw'}, 'ns1-v6': {'address': '2620:0:860:53::1', 'skip_loopback_site': 'codfw'}, 'ns2-v4': {'address': '198.35.27.27', 'skip_loopback': True}, 'ns2-v6': {'address': '2a02:ec80:53::1', 'skip_loopback': True}}
- Ferm::Service[bird_bfd_echo]
- Parameters differences:
--- Ferm::Service[bird_bfd_echo].orig
+++ Ferm::Service[bird_bfd_echo]
@@
- srange => ['185.15.59.33']
+ srange => ['185.15.59.33', 'fe80::8243:3f01:3816:a4c0']
- Firewall::Service[bird-bfd-control]
- Parameters differences:
--- Firewall::Service[bird-bfd-control].orig
+++ Firewall::Service[bird-bfd-control]
@@
- srange => ['185.15.59.33']
+ srange => ['185.15.59.33', 'fe80::8243:3f01:3816:a4c0']
- Ferm::Service[tcp_dotls_auth]
- Parameters differences:
--- Ferm::Service[tcp_dotls_auth].orig
+++ Ferm::Service[tcp_dotls_auth]
@@
- drange => (208.80.154.238 208.80.153.231 198.35.27.27)
+ drange => (208.80.154.238 2620:0:861:53::1 208.80.153.231 2620:0:860:53::1 198.35.27.27 2a02:ec80:53::1)
- File[/etc/ferm/conf.d/05_udp_dns_auth]
- Content differences:
--- /etc/ferm/conf.d/05_udp_dns_auth.orig
+++ /etc/ferm/conf.d/05_udp_dns_auth
@@ -1,7 +1,7 @@
# Autogenerated by puppet. DO NOT EDIT BY HAND!
#
#
-&D_SERVICE(udp, 53, (208.80.154.238 208.80.153.231 198.35.27.27));
+&D_SERVICE(udp, 53, (208.80.154.238 2620:0:861:53::1 208.80.153.231 2620:0:860:53::1 198.35.27.27 2a02:ec80:53::1));
- Firewall::Service[bird-bgp]
- Parameters differences:
--- Firewall::Service[bird-bgp].orig
+++ Firewall::Service[bird-bgp]
@@
- srange => ['185.15.59.33']
+ srange => ['185.15.59.33', 'fe80::8243:3f01:3816:a4c0']