Gerrit/tcp-proxy

To access Gerrits ssh service through the CDN a set of hosts is running in every PoP. This tcp-proxy hosts proxy all public (non-discovery) ssh traffic to Gerrit.

A set of two tcp-proxy hosts is running in each PoP for easier maintenance and redundancy. The hosts use the role::tcpproxy which configures haproxy and firewall settings to forward traffic on port 29418 to the Gerrit production host.

Service restarts and depooling

The hosts are managed in conftool, so before any maintenance the host should be depooled.

Restarts can be automated (including the depooling) with the sre.cdn.roll-restart-reboot-tcp-proxy cookbook:

$ sudo -i cookbook sre.cdn.roll-restart-reboot-tcp-proxy --query A:tcpproxy -r <reason> reboot