Summarizing what was said above, there are two parts to this request:

• Host-deployed OpenSSH version, which should be resolved with the upgrade to Bookworm and above
• Gerrit mina-ssh version, which should be resolved with the upgrade of Gerrit to 3.11 (we're at 3.10 now) - FYI @hashar

The alert is also firing for codfw.

Just a heads up that the alert fired again, can it be silenced for another month?

Presumably this is correct, please revert if not.

@RobH here's a summary of what needs to happen with the hosts, @cmooney will be coordinating the specifics:

I'll re-close it then and we can get back to the topic when needed.

Now that the other endpoints were added, is there anything else that needs to happen before the patch is deployed?

In scope: decide and document whether we keep the second replica around permanently.

Side effect of T387833: Gerrit failover process

There is https://idp.wmcloud.org, which is used for other projects (e.g. GitLab).

@MatthewVernon is this still a problem that needs solving. I realize you closed it earlier but double checking.

This one falls into "too much effort to fix and while technically breaking a rule doesn't cause issues that are worth fixing it"

The certificate renewal was solved by @Dzahn, I'll follow up on the alerting component separately.

Adding @ltoscano as this is likely to be related to a Dell firmware change.

None of the current project members outside of Collab have strong opinions on the project configuration so we're OK to make changes as we see fit.

Approved in the I/F meeting.

Based on the above, packaging the files distributed by Znuny ourselves may be the way forward here.

If I'm reading both correctly the request in the task is the opposite of the one in the wiki discussion. Looking at https://meta.wikimedia.org/wiki/Interwiki_map/list, the request in the task is incorrect.

It's not clear whether we actually need the separate puppetmaster, looking into that.