Difference between revisions of "Infrastructure"
imported>Echarlie (→Current Setup) |
imported>Mutantmonkey (→Deprecated: Correct factual inaccuracies about historical infrastructure) |
||
| Line 110: | Line 110: | ||
* webchat.vtluug.org | * webchat.vtluug.org | ||
| − | + | Prior to the current site, which was written in Python using Django starting in 2010 and deployed in 2011, the VTLUUG website was a WordPress instance. The files for this still exist. | |
| − | |||
| − | + | Additional files and configuration data exist for multiple versions of dokuwiki and mediawiki. There are also files for a NewsBlur installation which was never functional, and "bitcoin," the purpose of which is unknown. | |
| − | |||
| − | vtluug.org | + | For a time, a static version of vtbash.org was hosted at bash.vtluug.org. |
| − | VTLUUG was also previously | + | Until recently, VTLUUG ran a Gopher server on Milton, with a small welcome page and access to /files. Git hosting was also provided; authenticated access was over SSH with [https://github.com/tv42/gitosis gitosis] and public access was via Gitweb and the insecure Git protocol. |
| + | |||
| + | vtluug.org/public/$user/ was previously a source directory of files placed in a user's $HOME/public directory on NFS. <nowiki>[When? I thought it was always users.vtluug.org?]</nowiki> | ||
| + | |||
| + | VTLUUG members also ran '''mirror.ece.vt.edu''', although it was never an official VTLUUG project. The IPv4 allocation for this domain is still available. | ||
=== Considerations for the future === | === Considerations for the future === | ||
Revision as of 05:20, 22 February 2016
This page documents VTLUUG's infrastructure post-CVL eviction.
Contents
Physical Infrastructure
Cyberdelia is the only connected physical machine right now. It contains 48 GB of memory with 4 ethernet interfaces; only eth4 is connected and is attached to br0. All hosts are on the ECE network behind router.ece.vt.edu, a gateway featuring ARP proxying but no IPv6. For global DNS changes under ece.vt.edu, server room access, and getting hosts added to the ARP proxy, contact Branden McKagen.
Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move some are calling Cyber Auschwitz. Contact itso-g@vt.edu for firewall exceptions. When deploying new hosts, make ssh listen on both 2222 and 22. Acidburn currently listens on 443 as well.
Most other VTLUUG-owned servers are currently stored in Ali's basement, with the exception of sunway and a SuperMicro server, which were all transferred to WUVT.
On the Network Architecture
Because VTLUUG infra no longer has IPv6 access, we are limited by the IP addresses assigned to us, and what we can get through DHCP from ECE. As a consequence, all services which do not need to have a global IP should move to the internal network on the 10.99.x.x/16 subnet. In the future, it may be wise to bridge this network to an ethernet port on cyberdelia, so that a switch can be used to network our other services. When we have rackspace to do so, VPN/Iodine access to the internal network will be necessary.
Services
Critical
- Acidburn
- Razor
- Ldap
- Milton/Sczi
- Website
- Wiki
- Main Page
- snapfeed
- linx
- public file shares
- git
- Website
- Cyberdelia
- VMs for projects
- other services
- Tank
- NFS
- milton_srv (website files)
Other (not all functional)
- LAFS - Tahoe
- Jitsi Meet
- User websites
- Diaspora*
Website details
Current Setup
All vtluug websites are run on nginx on milton. These sites are currently functional:
- gobblerpedia.org
- hokieprivacy.org
- linx.vtluug.org
- snapchat.vtluug.org
- vtluug.org
- wiki.vtluug.org (this redirects to vtluug.org/wiki/)
All of these sites exclusively allow for the use of tls connections. Hokie Privacy has a cert from letsencrypt, while all other services are verified by StartCom.
Currently, milton has no startup script for the website. If things go down, someone has to run
root@milton:/srv/http/vtluug.org# sudo -u www-data uwsgi --yaml uwsgi.yml
in a tmux session, to restart uWSGI.
Main Page
It currently appears that the main vtluug page (mostly written in php), is or was managed from Drupal as a backend, but for that to function, mysql needs to be running.
uWSGI, django, and PHP make up most of the important features of the website in unknown ways. This was configured by James at some point, we presume, but he is not available to provide more information on the setup.
Wiki
The wiki currently runs fully on MediaWiki hosted on nginx (as opposed to the default include of apache2, demanded by the Debian package). Postgres is used for the database management, AFAIK, and authentication is through LDAP.
Gobblerpedia
All but disabled currently, due to spam. Runs on MediaWiki
Linx
Uses aam's linx, and is an identical implementation to his site linx.li.
Historically
Beyond these, we have data and nginx configurations for these (deprecated) sites, which were previously hosted on milton:
Needs Restoration
These are VTLUUG services that haven't yet been properly restored:
- foodfor.vtluug.org - For Wadsworth's .pickfood and .foodvote commands
- tahoe.vtluug.org - mhazinsk's Tahoe-LAFS grid
- git.vtluug.org - git hosting; previously gitosis
- map.vtluug.org - OSM
- vtbash.org - VT QDB
- users.vtluug.org - member hosting of acidburn home directories
Deprecated
These are no longer needed but we should preserve the data/config:
- ccdc.vtluug.org - member website
- jessicaandchristopher.net - member website
- nagios.vtluug.org - failed attempt at monitoring
- vtcybersecurity.org - member website
- cdn.vtluug.org - member website
- randynance.info - member website
- uniluug.org - deprecated project
- security.ece.vt.edu - REDACTED
- wargame.vtluug.org - vtluug's wargame pre-vtcsec
- munin.vtluug.org - failed attempt at monitoring
- webchat.vtluug.org
Prior to the current site, which was written in Python using Django starting in 2010 and deployed in 2011, the VTLUUG website was a WordPress instance. The files for this still exist.
Additional files and configuration data exist for multiple versions of dokuwiki and mediawiki. There are also files for a NewsBlur installation which was never functional, and "bitcoin," the purpose of which is unknown.
For a time, a static version of vtbash.org was hosted at bash.vtluug.org.
Until recently, VTLUUG ran a Gopher server on Milton, with a small welcome page and access to /files. Git hosting was also provided; authenticated access was over SSH with gitosis and public access was via Gitweb and the insecure Git protocol.
vtluug.org/public/$user/ was previously a source directory of files placed in a user's $HOME/public directory on NFS. [When? I thought it was always users.vtluug.org?]
VTLUUG members also ran mirror.ece.vt.edu, although it was never an official VTLUUG project. The IPv4 allocation for this domain is still available.
Considerations for the future
It would be preferable to keep all existing sites functional. Aam suggested the use of caddy to replace nginx, especially on static sites, because it provides automatic letsencrypt.
It is also important to ensure there are startup scripts for sczi, so that a reboot of it doesn't result in a 10-hour website outage.
Encryption
All sites should move to automatic letsencrypt certificates within the next few months. letsencrypt is still in beta, but it provides fully functional and low-hassle 3-month certificates. They will have integration for nginx soon, which will decrease the complexity of getting certs.
It may also be of interest to the club to revive monkeysphere signing on the servers.
Project Hosting
Most vtluug internal projects (e.g. HokiePrivacy) are currently hosted on git repositories on milton. How to move forwards with these is still indeterminate.
For public hosting, there has been some conversation about using Go Git Service (gogs), for public, www-viewable git repositories.
Gobblerpedia
Gobblerpedia is effectively non-functional currently, because account creation was disabled, to prevent spam. This needs to be addressed by adding captchas which are blacksburg-specific, limiting account creation access to local IP addresses, or enabling some form of LUUG-managed account creation. One suggestion was using CAS/Login services to authenticate, however that makes it difficult for Blacksburg residents to add content, and has other disadvantages.
VTLUUG Main Page
This needs to be kept up-to-date, and have some way of adding calendar information.
VTLUUG Wiki
Meeting creation script needs to be re-implemented.
Addressing
VTLUUG currently has DNS with namecheap, however all domains have been re-registered with gandi under vtluug's own account, to replace the mixture of mutantmonkey-holdings and vtluug held domains on multiple different registrars.
https://linx.vtluug.org/ips1.txt
| globally addressable | ECE DNS | Name | fucntion | internal address |
|---|---|---|---|---|
| 128.173.88.78 | luug.ece.vt.edu. | sczi | New webserver | 10.99.0.27?? (Currently DHCP) |
| 128.173.89.244 | luug0.ece.vt.edu | cyberdelia | VM Host | 10.99.0.1 |
| 128.173.89.245 | luug1.ece.vt.edu. | acidburn | shell server | 10.99.0.4 |
| 128.173.89.246 | luug2.ece.vt.edu. | milton | Old webserver | |
| 128.173.89.247 | luug3.ece.vt.edu. | razor | LDAP | |
| 128.173.88.104 | mjh.ece.vt.edu./luug4.ece.vt.edu | currently pfsense (global v4 subject to change - IP belongs to mhazinsk) | 10.99.0.104 | |
| 128.173.88.36 | mirror.ece.vt.edu. | mirror | not in use | |
| 128.173.88.191 | luug5.ece.vt.edu. | router | not in use | |
| 172.xx.xx.xx | snapfeed | REDACTED | ||
| pfsense/443 | jitsi.vtluug.org | jitsi | Jitsi | 10.99.0.101 (static lease) |
| None | 172.16.10.13 | archiveteam-warrior | Archive Team Warrior |
Deprecated IPs
IPs we were using at some point (by reclaiming CVL IPs, etc), or are mentioned in /etc/exports on Cyberdelia
- 128.173.88.161 (security.ece.vt.edu) - was once milton's IP until luug IPs got routed behind router.ece.vt.edu.
- 128.173.88.145 (cvl05.ece.vt.edu) - was once REDACTED's IP, reclaimed by bmckagen.
- 128.173.88.131 (dog.ece.vt.edu) - we have a Sun box labeled "dog.ece.vt.edu" but the IP appears to be in use now.
Network Diagram
This is the projected diagram of our network, once sczi is fully deployed and milton is phased out. At this time, razor may also lose its global v4 address.
