- 1 What is Horizon?
- 2 Wait, isn't that what Wikitech is for?
- 3 Access and Login
- 3.1 Who has access to Horizon?
- 3.2 The Horizon login prompts me for a 'Totp token.' What's that? Can I just leave it blank?
- 3.3 What happens if I lose my phone and my backup codes?
- 3.4 I belong to so many projects that they don't all show up in the project menu. How can I view the 'zzzendofalphabet' project?
- 4 Proxies and DNS in Horizon
Frequently asked questions about horizon.wikimedia.org
What is Horizon?
Horizon.wikimedia.org is the web interface for creating and manipulating virtual machines ('Labs instances') and associated features within Wikimedia Labs. It is running a customized version of OpenStack Horizon, which is the official tool for managing OpenStack deploys.
Wait, isn't that what Wikitech is for?
Wikimedia Labs predates the OpenStack Horizon project. Wikitech.wikimedia.org runs the OpenStackManager extension which is an alternative WMF-written web interface for OpenStack. Now that the Horizon project has matured and begun to cover most of our use cases, we are gradually migrating away from OpenStackManager use and adopting Horizon for Labs administration. As of April of 2016, Horizon is the preferred tool for the following uses:
- Creation, deletion, starting, stopping of labs instances
- Management of instance firewalls (aka 'security groups')
- Creation and assignment of web proxies for Labs instances
- Assignment of floating IPs to labs instances
- Manipulation of DNS records associated with floating IPs
These actions still require Wikitech, but they will soon be moved to Horizon:
- Management of project Sudo policies
- Management of puppet and hiera configuration for labs instances
These actions may remain on Wikitech, or may be moved to new custom web tools:
- Individual user management: Account creation, password & 2fa management, management of ssh keys for instance access
- User management within Labs projects
- Creation/deletion of projects
- Tool/Service Group management
- Public visibility of Projects, Members, and instances to non-members
Access and Login
Who has access to Horizon?
Any user with the 'projectadmin' role in a project has login access to horizon.wikimedia.org. The username, password, and totp token are the same as those used to log in to wikitech. Normal tools and labs project members can ignore Horizon for now, and possibly forever.
The Horizon login prompts me for a 'Totp token.' What's that? Can I just leave it blank?
Horizon login requires a password and a second factor, the totp token. These credentials are shared with Wikitech. If you already have two-factor authentication (sometimes called 2fa) enabled on Wikitech then you're all set; if not you will need to enable two-factor authentication on Wikitech by visiting 'Preferences->User Profile' and clicking 'Enable two-factor authentication'.
What happens if I lose my phone and my backup codes?
A member of the WMF Operations team can turn off 2fa for your wikitech account, at which point you can re-enable it and reset your code. To do this you will need to verify your identity, most likely by logging into a labs instance with an ssh key and editing a file as requested by the Op who is helping you. Just in case, make sure you have a working ssh login to labs before you enable 2fa.
This is a bug pending with the upstream developers. In the meantime, you can view a complete project list by selecting the 'Identity->Projects' tab. To view a specific project, click the 'Set as Active Project' button on the right-hand side of the table.
Proxies and DNS in Horizon
Can I create a new DNS domain/zone for my project, or records under the wmflabs.org domain?
Due to the ownership and security models in Horizon and OpenStack, creating a new subdomain of wmflabs.org requires cooperation between multiple projects (yours, and that project that owns wmflabs.org.) For this reason, domain creation is limited to Labs operators. Create a phabricator request and we'll get to it as soon as we can.