Difference between revisions of "Infrastructure"

From the Linux and Unix Users Group at Virginia Teck Wiki
Jump to: navigation, search
(→‎Services)
 
(18 intermediate revisions by 2 users not shown)
Line 2: Line 2:
  
 
== Physical Infrastructure ==
 
== Physical Infrastructure ==
−
NFS Hosts:
+
=== NFS Hosts ===
 
* [[Infrastructure:Dirtycow|dirtycow]] - Primary NFS server, 8x2TB raidz2 array
 
* [[Infrastructure:Dirtycow|dirtycow]] - Primary NFS server, 8x2TB raidz2 array
−
* [[Infrastructure:Cyberdelia|cyberdelia]] - Secondary NFS server, 7x1TB raidz2 array
+
* [[Infrastructure:Cyberdelia|cyberdelia]] - OFF, 7x1TB raidz2 array, sitting on shelf instead of shelf
−
* [[Infrastructure:Shellshock|shellshock]] - Tertiary NFS server, 3x500GB array
 
  
−
VM Hosts:
+
=== VM Hosts ===
 
* [[Infrastructure:Meltdown|meltdown]] - Primary VM/docker host
 
* [[Infrastructure:Meltdown|meltdown]] - Primary VM/docker host
 
* [[Infrastructure:Spectre|spectre]] - Secondary VM/docker host, for example user VMs
 
* [[Infrastructure:Spectre|spectre]] - Secondary VM/docker host, for example user VMs
  
−
Router:
+
=== Router ===
−
* [[Infrastructure:Joey|joey]]
+
* [[Infrastructure:Shellshock|shellshock]] - 3 disk RAID1 array
  
−
All hosts are on our own 1 Gb/s port with [[Infrastructure:Joey|joey]], a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix.
+
All hosts are on our own 1 Gb/s port with [[Infrastructure:Shellshock|shellshock]], a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix.
  
 
Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move
 
Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move
Line 20: Line 19:
 
When deploying new hosts, make ssh listen on both 2222 and 22. [[Infrastructure:Acidburn|Acidburn]] currently listens on 3128 as well.
 
When deploying new hosts, make ssh listen on both 2222 and 22. [[Infrastructure:Acidburn|Acidburn]] currently listens on 3128 as well.
  
−
Other hosts:
+
=== Other hosts ===
 +
* [[Infrastructure:Joey|joey]] used to be the router, but is no longer in use due to a failure of the single drive
 
* [[Infrastructure:Wood|Wood]] is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs.
 
* [[Infrastructure:Wood|Wood]] is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs.
 
* [[Infrastructure:Sunway|sunway]] and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members.
 
* [[Infrastructure:Sunway|sunway]] and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members.
Line 29: Line 29:
 
''Further Information: [[Infrastructure:Networking]] and [[Infrastructure:Network]]''
 
''Further Information: [[Infrastructure:Networking]] and [[Infrastructure:Network]]''
  
−
[[File:Infra2016-network.png|thumb|500px|A simple network diagram by [[user:mjh|mjh]]]]
+
[[File:Infra2019-network.png|thumb|500px|A simple network diagram by [[user:pew|pew]]. '''Update June 2021: Joey is dead, long live Joey. Shellshock is the new router. Cyberdelia is off.]]
  
−
We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.99.x.x/16 subnet and an IPv6 address assigned via SLAAC.
+
 
−
In the future, it may be wise to bridge this network to an
+
We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.98.x.x/16 subnet and an IPv6 address assigned via SLAAC.
−
ethernet port on cyberdelia, so that a switch can be used to network our other services. When we have rackspace
+
In the future, [[Infrastructure:IPsec|VPN]]/[[Iodine]] should be used.
−
to do so, [[Infrastructure:IPsec|VPN]]/[[Iodine]] access to the internal network will be necessary.
 
  
 
In theory, services can be provided via a hidden service such as [[w:Tor|Tor]], but that introduces other complications.
 
In theory, services can be provided via a hidden service such as [[w:Tor|Tor]], but that introduces other complications.
−
Alternately, services can require use of the [[Infrastructure:IPsec|VPN]] on [[Infrastructure:acidburn|acidburn]],
+
Alternately, services can require use of the [[Infrastructure:IPsec|VPN]] on [[Infrastructure:Acidburn|acidburn]],
 
[[Iodine]], or [[Secure Shell|ssh tunnelling]], although all of these limit usage to members with a shell account.
 
[[Iodine]], or [[Secure Shell|ssh tunnelling]], although all of these limit usage to members with a shell account.
 
All of these have the benefit of NAT transversal, however.
 
All of these have the benefit of NAT transversal, however.
  
 
== Services ==
 
== Services ==
−
```Further information: [[:Category:Services]]```
+
''Further information: [[:Category:Services]]''
  
 
* [[Infrastructure:Acidburn|acidburn]]
 
* [[Infrastructure:Acidburn|acidburn]]
Line 48: Line 47:
 
** [[Email]]
 
** [[Email]]
 
** [[Wadsworth]]
 
** [[Wadsworth]]
 +
** [[Iodine]]
 
* [[Infrastructure:Chimera|chimera]]
 
* [[Infrastructure:Chimera|chimera]]
 
** FreeIPA
 
** FreeIPA
 
* [[Infrastructure:Sczi|Sczi]]
 
* [[Infrastructure:Sczi|Sczi]]
 
** Website
 
** Website
−
*** Wiki
+
*** [https://hokieprivacy.org hokieprivacy]
−
*** Main Page
 
−
*** linx
 
 
*** [https://bash.vtluug.org vtbash]
 
*** [https://bash.vtluug.org vtbash]
 +
*** [https://vtluug.org Main Site]
 +
*** This wiki and [[gp:Main Page|Gobblerpedia]]
 +
*** dex, for authing with the wikis
 +
*** https://vtluug.org/users/~$user - User homepages
 +
*** [https://search.vtluug.org 4get] a metasearch engine
 +
*** [https://git.vtluug.org Gitea] a Github-esque git server with dex/LUUG OpenID auth
 +
*** [https://element.vtluug.org element], a Matrix client
 +
* [[Infrastructure:Nikonwormhole|nikonwormhole]]
 +
** AdGuard DNS blackhole
 
* [[Infrastructure:Dirtycow|dirtycow]]
 
* [[Infrastructure:Dirtycow|dirtycow]]
 
** Storage for all primary services
 
** Storage for all primary services
Line 66: Line 73:
 
== Website details ==
 
== Website details ==
 
=== Current Setup ===
 
=== Current Setup ===
−
 
 
All vtluug websites are run on nginx on [[Infrastructure:Sczi|sczi]]. These sites are currently functional:
 
All vtluug websites are run on nginx on [[Infrastructure:Sczi|sczi]]. These sites are currently functional:
 
* gobblerpedia.org
 
* gobblerpedia.org
 
* hokieprivacy.org
 
* hokieprivacy.org
−
* linx.vtluug.org
 
 
* vtluug.org
 
* vtluug.org
−
* wiki.vtluug.org (this redirects to vtluug.org/wiki/)
+
* wiki.vtluug.org (redirects to vtluug.org/wiki/)
 
* bash.vtluug.org
 
* bash.vtluug.org
 +
* vtluug.org/users/~$user
  
 
All of these sites exclusively allow for the use of TLS connections. All services use automatically updated
 
All of these sites exclusively allow for the use of TLS connections. All services use automatically updated
Line 79: Line 85:
  
 
==== Main Page ====
 
==== Main Page ====
−
The main VTLUUG page was scraped from the [[Internet Archive]] and added created as a github page at
+
The main VTLUUG page was scraped from the [[w:Internet Archive|Internet Archive]] and added created as a github page at
−
[https://vtluug.github.io vtluug.github.io], and is reverse-proxied through sczi.
+
[https://vtluug.github.io vtluug.github.io], and is reverse-proxied through [[Infrastructure:Sczi|sczi]].
  
 
==== Wiki ====
 
==== Wiki ====
−
 
+
The wiki currently runs fully on MediaWiki hosted on nginx using a [https://github.com/vtluug/mediawiki-docker modified version of the official mediawiki docker image]. You can auth with the admin account, [[User:wiki-admin|wiki-admin]] or a Google account. See note on [[Main_page]] about why LDAP isn't working yet.
−
The wiki currently runs fully on MediaWiki hosted on nginx. Postgres is used for the database and authentication
 
−
is through LDAP. MediaWiki is running the current stable version as of March 2017, courtesy hard work by
 
−
[[user:pew|pew]].
 
  
 
===== Gobblerpedia =====
 
===== Gobblerpedia =====
−
 
+
Runs on the same Mediawiki instance as this wiki. Similarly to LUUGWiki, only Google accounts or the admin user are supported logins.
−
Runs on the same Mediawiki instance as this wiki, with its schema in the same Postgres database. Currently, you can auth
 
−
with LDAP, pre-existing accounts, or a Google account in the VT hosted domain.
 
−
 
 
−
==== Linx ====
 
−
 
 
−
Uses [[User:andreim|aam]]'s [https://github.com/andreimarcu/linx-server linx], and is an identical implementation to his site
 
−
[https://linx.li linx.li]. One of the few sites with a complete startup script. The maintenance is currently the responsibility
 
−
of aam, however this is subject to change, pending his retaining root access on sczi.
 
  
 
=== Needs Restoration ===
 
=== Needs Restoration ===
Line 105: Line 100:
 
* git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
 
* git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
 
* gitweb.vtluug.org - git hosting; previously gitweb
 
* gitweb.vtluug.org - git hosting; previously gitweb
−
* map.vtluug.org - [[Openstreetmap|OSM]] (gobblerpedia still relies on this)
+
* [https://github.com/vtluug/campusmap map.vtluug.org] - [[Openstreetmap|OSM]] based map of VT
−
* users.vtluug.org - member hosting of acidburn home directories
 
−
 
 
−
PostgreSQL tables exist on milton for foodforus, jandc, mediawiki, mewsblu, sharedwiki, uniluug, vtluug_wiki, and wargame_bbs. More
 
−
research is necessary to determine what these are for. There are also a collection of mySQL databases on milton which may
 
−
be desirable to archive and store.
 
  
 
=== Historically ===
 
=== Historically ===
Line 120: Line 110:
  
 
== Addressing ==
 
== Addressing ==
−
VTLUUG currently has DNS with namecheap, however all domains have been re-registered with gandi under
+
VTLUUG currently has DNS with gandi.net. Message officers for access (please don't be scared :D).
−
vtluug's own account, to replace the mixture of mutantmonkey-holdings and vtluug-held domains on multiple
 
−
different registrars.
 
  
 
We currently hold the IPv6 prefix <code>2001:470:8:6d9::/64</code> from HE's allocation due to our tunnel.
 
We currently hold the IPv6 prefix <code>2001:470:8:6d9::/64</code> from HE's allocation due to our tunnel.

Latest revision as of 20:41, 5 November 2024

This page documents VTLUUG's infrastructure post-CVL eviction.

Physical Infrastructure

NFS Hosts

  • dirtycow - Primary NFS server, 8x2TB raidz2 array
  • cyberdelia - OFF, 7x1TB raidz2 array, sitting on shelf instead of shelf

VM Hosts

  • meltdown - Primary VM/docker host
  • spectre - Secondary VM/docker host, for example user VMs

Router

All hosts are on our own 1 Gb/s port with shellshock, a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix.

Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move echarlie is calling Cyber Auschwitz. Contact itso-g@vt.edu for firewall exceptions. When deploying new hosts, make ssh listen on both 2222 and 22. Acidburn currently listens on 3128 as well.

Other hosts

  • joey used to be the router, but is no longer in use due to a failure of the single drive
  • Wood is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs.
  • sunway and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members.

See VTLUUG:Strategic_plan for things we plan to do in the future.

On the Network Architecture

Further Information: Infrastructure:Networking and Infrastructure:Network

A simple network diagram by pew. Update June 2021: Joey is dead, long live Joey. Shellshock is the new router. Cyberdelia is off.


We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.98.x.x/16 subnet and an IPv6 address assigned via SLAAC. In the future, VPN/Iodine should be used.

In theory, services can be provided via a hidden service such as Tor, but that introduces other complications. Alternately, services can require use of the VPN on acidburn, Iodine, or ssh tunnelling, although all of these limit usage to members with a shell account. All of these have the benefit of NAT transversal, however.

Services

Further information: Category:Services

acidburn and the website must be accessible through real services, and it is preferable other hosts are too. This means we must use our public IPv4 & IPv6 Addresses allotted by ECE.

Website details

Current Setup

All vtluug websites are run on nginx on sczi. These sites are currently functional:

  • gobblerpedia.org
  • hokieprivacy.org
  • vtluug.org
  • wiki.vtluug.org (redirects to vtluug.org/wiki/)
  • bash.vtluug.org
  • vtluug.org/users/~$user

All of these sites exclusively allow for the use of TLS connections. All services use automatically updated letsencrypt certs.

Main Page

The main VTLUUG page was scraped from the Internet Archive and added created as a github page at vtluug.github.io, and is reverse-proxied through sczi.

Wiki

The wiki currently runs fully on MediaWiki hosted on nginx using a modified version of the official mediawiki docker image. You can auth with the admin account, wiki-admin or a Google account. See note on Main_page about why LDAP isn't working yet.

Gobblerpedia

Runs on the same Mediawiki instance as this wiki. Similarly to LUUGWiki, only Google accounts or the admin user are supported logins.

Needs Restoration

These are VTLUUG services that haven't yet been properly restored:

  • foodfor.vtluug.org - For Wadsworth's .pickfood and .foodvote commands. This is jpo's fault.
  • tahoe.vtluug.org - mhazinsk's Tahoe-LAFS grid
  • git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
  • gitweb.vtluug.org - git hosting; previously gitweb
  • map.vtluug.org - OSM based map of VT

Historically

See Dead_projects for historic information

Goals

See VTLUUG:Strategic_plan#Web_Services for future goals involving web services

Addressing

VTLUUG currently has DNS with gandi.net. Message officers for access (please don't be scared :D).

We currently hold the IPv6 prefix 2001:470:8:6d9::/64 from HE's allocation due to our tunnel. When CNS finally sets up prefix-delegation, we might be able to get something from 2607:b400::/32, which is VT's largest allocation.

IF YOU CHANGE/ADD/REMOVE SOMETHING HERE CHANGE IT IN Inventory AND/OR Deprecated_Inventory TOO

This page describes specifics about VTLUUG's current network. For an overview, see Infrastructure:Networking

Addresses

ECE DNS VTLUUG DNS IPv4 Private Internal IPv4 IPv6
luug.ece.vt.edu sczi.vtluug.org 128.173.88.78 10.98.0.11 2607:b400:6:cc80:0:aff:fe62:b
luug0.ece.vt.edu dirtycow.vtluug.org 128.173.89.244 10.98.0.7 2607:b400:6:cc80:21e:c9ff:feef:13f8
luug1.ece.vt.edu acidburn.vtluug.org 128.173.89.245 10.98.0.12 2607:b400:6:cc80:0:aff:fe62:c
luug2.ece.vt.edu meltdown.vtluug.org 128.173.89.246 10.98.0.3 2607:b400:6:cc80:0:aff:fe62:3
luug3.ece.vt.edu chimera.vtluug.org 128.173.89.247 10.98.0.10 2607:b400:6:cc80:0:aff:fe62:a
luug4.ece.vt.edu mjh.ece.vt.edu 128.173.88.104 10.98.0.254 2607:b400:0006:cc80:0230:48ff:fe7e:28da
luug5.ece.vt.edu router.vtluug.org 128.173.88.191 10.98.0.1 2001:468:c80:6103:211:43ff:fe30:a72
N/A nikonwormhole.vtluug.org 128.173.88.135 10.98.0.21 2607:b400:6:cc80:0:aff:fe62:e
mirror.ece.vt.edu N/A *Not sure if we can actually use this IP* 128.173.88.82 N/A N/A
N/A switch.private.vtluug.org (Internal v4 only) N/A 10.98.0.2 N/A
N/A spectre.vtluug.org N/A 10.98.0.4 2607:b400:6:cc80:0:aff:fe62:4
N/A cyberdelia.vtluug.org N/A 10.98.0.6 2607:b400:0006:cc80:0215:17ff:fe12:7670
N/A shellshock.vtluug.org N/A 10.98.0.8 2607:b400:6:cc80:215:17ff:fe12:7670

See Deprecated_Network for historical information.

VTLUUG

Addresses

IPv6
  • SLAAC on 2607:b400:0006:cc80::/64
IPv4
  • 10.98.0.0/16: internal NAT
    • Static IPs: 10.98.0.0/24
    • DHCP: 10.98.1.0 - 10.98.1.150
    • Iodine: 10.98.10.0/24
  • 128.173.88.1/22: publicly accessible hosts

All hosts have an internal address (static or DHCP) and some hosts also have a globally accessible address.

DNS

Shellshock also functions as DNS server for internal hosts

  • 10.99.0.1
  • 2607:b400:0006:cc80::1

VT's DNS

CNS maintains a few DNS servers on campus

  • yardbird.cns.vt.edu, 2001:468:c80:2101:0:100:0:22, 198.82.247.34
  • jeru.cns.vt.edu, 2001:468:c80:4101:0:100:0:42, 198.82.247.66
  • milo.cns.vt.edu, 2001:468:c80:6101:0:100:0:62, 198.82.247.98

See Also

Retrieved from "https://vtluug.org/w/index.php?title=Infrastructure&oldid=7944"