Hi all,
Heads up: as part of putting GitLab behind a CDN (T425441 https://phabricator.wikimedia.org/T425441), SSH access for git commands is moving to a dedicated hostname: gitlab-ssh.wikimedia.org. This only affects SSH git access. HTTPS clones are unaffected.
- The new hostname is available now. - Starting tomorrow (June 23rd) morning, GitLab will advertise it https://gerrit.wikimedia.org/r/c/operations/puppet/+/1300763 on new git clone commands, so new clones will use it automatically. - gitlab.wikimedia.org will stay reachable over SSH for git commands until GitLab moves behind the CDN. We'll announce the change before it happens. After that, gitlab.wikimedia.org will no longer be reachable via SSH.
The quickest way to switch remotes all at once would be:
git config --global url."git@gitlab-ssh.wikimedia.org:".insteadOf " git@gitlab.wikimedia.org:"
Per-repo rewrites, CI jobs and ~/.ssh/config are covered in the migration guide https://wikitech.wikimedia.org/wiki/GitLab/Migration. wmf-laptop https://wikitech.wikimedia.org/wiki/Wmf-laptop has been updated, so wmf-update-known-hosts-production and wmf-update-ssh-config will reflect the change. Questions and feedback welcome on the task https://phabricator.wikimedia.org/T425441.
Thanks! -- *Arnaud Bran* (he/him) Senior Site Reliability Engineer Wikimedia Foundation https://wikimediafoundation.org/
Is the fingerprint for the new host anywhere? It's not on Help:SSH Fingerprints https://wikitech.wikimedia.org/wiki/Help:SSH_Fingerprints.
*Sebastian Berlin* Utvecklare/*Developer* Wikimedia Sverige (WMSE)
E-post/*E-Mail*: sebastian.berlin@wikimedia.se Telefon/*Phone*: (+46) 0707 - 92 03 84
On Mon, 22 Jun 2026 at 10:20, Arnaud Bran via Wikitech-l < wikitech-l@lists.wikimedia.org> wrote:
Hi all,
Heads up: as part of putting GitLab behind a CDN (T425441 https://phabricator.wikimedia.org/T425441), SSH access for git commands is moving to a dedicated hostname: gitlab-ssh.wikimedia.org. This only affects SSH git access. HTTPS clones are unaffected.
- The new hostname is available now.
- Starting tomorrow (June 23rd) morning, GitLab will advertise it
https://gerrit.wikimedia.org/r/c/operations/puppet/+/1300763 on new git clone commands, so new clones will use it automatically.
- gitlab.wikimedia.org will stay reachable over SSH for git commands
until GitLab moves behind the CDN. We'll announce the change before it happens. After that, gitlab.wikimedia.org will no longer be reachable via SSH.
The quickest way to switch remotes all at once would be:
git config --global url."git@gitlab-ssh.wikimedia.org:".insteadOf " git@gitlab.wikimedia.org:"
Per-repo rewrites, CI jobs and ~/.ssh/config are covered in the migration guide https://wikitech.wikimedia.org/wiki/GitLab/Migration. wmf-laptop https://wikitech.wikimedia.org/wiki/Wmf-laptop has been updated, so wmf-update-known-hosts-production and wmf-update-ssh-config will reflect the change. Questions and feedback welcome on the task https://phabricator.wikimedia.org/T425441.
Thanks!
*Arnaud Bran* (he/him) Senior Site Reliability Engineer Wikimedia Foundation https://wikimediafoundation.org/ _______________________________________________ Wikitech-l mailing list -- wikitech-l@lists.wikimedia.org To unsubscribe send an email to wikitech-l-leave@lists.wikimedia.org https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
It’s the same fingerprint AFAIK – OpenSSH should print something like the following when you first connect to the new hostname:
This host key is known by the following other names/addresses: ~/.ssh/known_hosts:*lineno*: gitlab.wikimedia.org
Cheers, Lucsa
Am Mo., 13. Juli 2026 um 12:00 Uhr schrieb Sebastian Berlin via Wikitech-l < wikitech-l@lists.wikimedia.org>:
Is the fingerprint for the new host anywhere? It's not on Help:SSH Fingerprints https://wikitech.wikimedia.org/wiki/Help:SSH_Fingerprints.
*Sebastian Berlin* Utvecklare/*Developer* Wikimedia Sverige (WMSE)
E-post/*E-Mail*: sebastian.berlin@wikimedia.se Telefon/*Phone*: (+46) 0707 - 92 03 84
On Mon, 22 Jun 2026 at 10:20, Arnaud Bran via Wikitech-l < wikitech-l@lists.wikimedia.org> wrote:
Hi all,
Heads up: as part of putting GitLab behind a CDN (T425441 https://phabricator.wikimedia.org/T425441), SSH access for git commands is moving to a dedicated hostname: gitlab-ssh.wikimedia.org. This only affects SSH git access. HTTPS clones are unaffected.
- The new hostname is available now.
- Starting tomorrow (June 23rd) morning, GitLab will advertise it
https://gerrit.wikimedia.org/r/c/operations/puppet/+/1300763 on new git clone commands, so new clones will use it automatically.
- gitlab.wikimedia.org will stay reachable over SSH for git commands
until GitLab moves behind the CDN. We'll announce the change before it happens. After that, gitlab.wikimedia.org will no longer be reachable via SSH.
The quickest way to switch remotes all at once would be:
git config --global url."git@gitlab-ssh.wikimedia.org:".insteadOf " git@gitlab.wikimedia.org:"
Per-repo rewrites, CI jobs and ~/.ssh/config are covered in the migration guide https://wikitech.wikimedia.org/wiki/GitLab/Migration. wmf-laptop https://wikitech.wikimedia.org/wiki/Wmf-laptop has been updated, so wmf-update-known-hosts-production and wmf-update-ssh-config will reflect the change. Questions and feedback welcome on the task https://phabricator.wikimedia.org/T425441.
Thanks!
*Arnaud Bran* (he/him) Senior Site Reliability Engineer Wikimedia Foundation https://wikimediafoundation.org/ _______________________________________________ Wikitech-l mailing list -- wikitech-l@lists.wikimedia.org To unsubscribe send an email to wikitech-l-leave@lists.wikimedia.org
https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
Wikitech-l mailing list -- wikitech-l@lists.wikimedia.org To unsubscribe send an email to wikitech-l-leave@lists.wikimedia.org https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
If anyone else was wondering it's now been updated on the wiki.
*Sebastian Berlin* Utvecklare/*Developer* Wikimedia Sverige (WMSE)
E-post/*E-Mail*: sebastian.berlin@wikimedia.se Telefon/*Phone*: (+46) 0707 - 92 03 84
On Mon, 13 Jul 2026 at 12:24, Lucas Werkmeister < lucas.werkmeister@wikimedia.de> wrote:
It’s the same fingerprint AFAIK – OpenSSH should print something like the following when you first connect to the new hostname:
This host key is known by the following other names/addresses: ~/.ssh/known_hosts:*lineno*: gitlab.wikimedia.org
Cheers, Lucsa
Am Mo., 13. Juli 2026 um 12:00 Uhr schrieb Sebastian Berlin via Wikitech-l wikitech-l@lists.wikimedia.org:
Is the fingerprint for the new host anywhere? It's not on Help:SSH Fingerprints https://wikitech.wikimedia.org/wiki/Help:SSH_Fingerprints.
*Sebastian Berlin* Utvecklare/*Developer* Wikimedia Sverige (WMSE)
E-post/*E-Mail*: sebastian.berlin@wikimedia.se Telefon/*Phone*: (+46) 0707 - 92 03 84
On Mon, 22 Jun 2026 at 10:20, Arnaud Bran via Wikitech-l < wikitech-l@lists.wikimedia.org> wrote:
Hi all,
Heads up: as part of putting GitLab behind a CDN (T425441 https://phabricator.wikimedia.org/T425441), SSH access for git commands is moving to a dedicated hostname: gitlab-ssh.wikimedia.org. This only affects SSH git access. HTTPS clones are unaffected.
- The new hostname is available now.
- Starting tomorrow (June 23rd) morning, GitLab will advertise it
https://gerrit.wikimedia.org/r/c/operations/puppet/+/1300763 on new git clone commands, so new clones will use it automatically.
- gitlab.wikimedia.org will stay reachable over SSH for git commands
until GitLab moves behind the CDN. We'll announce the change before it happens. After that, gitlab.wikimedia.org will no longer be reachable via SSH.
The quickest way to switch remotes all at once would be:
git config --global url."git@gitlab-ssh.wikimedia.org:".insteadOf " git@gitlab.wikimedia.org:"
Per-repo rewrites, CI jobs and ~/.ssh/config are covered in the migration guide https://wikitech.wikimedia.org/wiki/GitLab/Migration. wmf-laptop https://wikitech.wikimedia.org/wiki/Wmf-laptop has been updated, so wmf-update-known-hosts-production and wmf-update-ssh-config will reflect the change. Questions and feedback welcome on the task https://phabricator.wikimedia.org/T425441.
Thanks!
*Arnaud Bran* (he/him) Senior Site Reliability Engineer Wikimedia Foundation https://wikimediafoundation.org/ _______________________________________________ Wikitech-l mailing list -- wikitech-l@lists.wikimedia.org To unsubscribe send an email to wikitech-l-leave@lists.wikimedia.org
https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
Wikitech-l mailing list -- wikitech-l@lists.wikimedia.org To unsubscribe send an email to wikitech-l-leave@lists.wikimedia.org
https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
-- Lucas Werkmeister (he/er) Software Engineer
Wikimedia Deutschland e. V. | Tempelhofer Ufer 23-24 | 10963 Berlin Phone: +49 (0)30-577 11 62-0 https://wikimedia.de
Imagine a world in which every single human being can freely share in the sum of all knowledge. Help us to achieve our vision! https://spenden.wikimedia.de
Wikimedia Deutschland — Gesellschaft zur Förderung Freien Wissens e. V. Eingetragen im Vereinsregister des Amtsgerichts Charlottenburg, VR 23855 B. Als gemeinnützig anerkannt durch das Finanzamt für Körperschaften I Berlin, Steuernummer 27/029/42207.
Does someone have a working configuration for `glab`[0] and gerritlab[1] in this split setup?
I have this in my ~/.gitconfig: ``` [credential "https://gitlab.wikimedia.org/"] helper = !glab auth git-credential "$@" ```
So far, that has both allowed me to interact with normal `glab` commands and use it as a credential helper for gerritlab. Either I set up glab for gitlab.wikimedia.org, which makes gerritlab work but normal glab commands fail with "none of the git remotes configured for this repository point to a known GitLab host", or I set glab up for gitlab-ssh.wikimedia.org which makes normal glab commands work but gerritlab no longer sees credentials for the API.
[0]: https://gitlab.com/gitlab-org/cli [1]: https://github.com/yaoyuannnn/gerritlab
thanks, taavi
Taavi, I just made some changes to GerritLab[0] and added notes to the migration guide[1]. Let me know if that helps or not.
[0] https://github.com/yaoyuannnn/gerritlab/pull/90 [1] https://wikitech.wikimedia.org/wiki/GitLab/Migration#GerritLab
On Thu, Jul 16, 2026 at 10:51 AM Taavi Väänänen via Wikitech-l < wikitech-l@lists.wikimedia.org> wrote:
Does someone have a working configuration for `glab`[0] and gerritlab[1] in this split setup?
I have this in my ~/.gitconfig:
[credential "https://gitlab.wikimedia.org/"] helper = !glab auth git-credential "$@"So far, that has both allowed me to interact with normal `glab` commands and use it as a credential helper for gerritlab. Either I set up glab for gitlab.wikimedia.org, which makes gerritlab work but normal glab commands fail with "none of the git remotes configured for this repository point to a known GitLab host", or I set glab up for gitlab-ssh.wikimedia.org which makes normal glab commands work but gerritlab no longer sees credentials for the API.
thanks, taavi
-- Taavi Väänänen (he/they) Site Reliability Engineer, Tools Infrastructure Wikimedia Foundation _______________________________________________ Wikitech-l mailing list -- wikitech-l@lists.wikimedia.org To unsubscribe send an email to wikitech-l-leave@lists.wikimedia.org https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
wikitech-l@lists.wikimedia.org