Infrastructure

This page document's VTLUUG's infrastructure post-CVL eviction.

Physical Infrastructure

Cyberdelia is the only connected physical machine right now. It contains 48 GB of memory with 4 ethernet interfaces; only eth4 is connected and is attached to br0. All hosts are on the ECE network behind router.ece.vt.edu, a gateway featuring ARP proxying but no IPv6. For global DNS changes under ece.vt.edu, server room access, and getting hosts added to the ARP proxy, contact Branden McKagen.

Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move some are calling Cyber Auschwitz. Contact itso-g@vt.edu for firewall exceptions. When deploying new hosts, make ssh listen on both 2222 and 22. Acidburn currently listens on 443 as well.

On the Network Architecture

Because VTLUUG infra no longer has IPv6 access, we are limited by the IP addresses assigned to us, and what we can get through DHCP from ECE. As a consequence, all services which do not need to have a global IP should move to the internal network on the 10.99.x.x/24 subnet. In the future, it may be wise to bridge this network to an ethernet port on cyberdelia, so that a switch can be used to network our other services. When we have rackspace to do so, VPN/Iodine access to the internal network will be necessary.

Services

Critical

• Acidburn
  • Shell server
  • Email
  • Wadsworth
• Razor
  • Ldap
• Milton/Sczi
  • Website
    • Wiki
    • Main Page
    • snapfeed
    • linx
    • public file shares
  • git
• Cyberdelia
  • VMs for projects
  • other services
  • Tank
    • NFS
    • milton_srv (website files)

Other (not all functional)

• LAFS - Tahoe
• Jitsi Meet
• User websites
• Diaspora*

Website details

Current Setup

Currently, all vtluug websites are run on nginx. These sites are currently functional:

• gobblerpedia.org
• hokieprivacy.org
• linx.vtluug.org
• snapchat.vtluug.org
• vtluug.org
• wiki.vtluug.org (this redirects to vtluug.org/wiki/)

All of these sites exclusively allow for the use of tls connections. Hokie Privacy has a cert from letsencrypt, while all other services are verified by StartCom.

Currently, milton has no startup script for the website. If things go down, someone has to run

root@milton:/srv/http/vtluug.org# sudo -u www-data uwsgi --yaml uwsgi.yml

in a tmux session, to restart uwsgi

HIstorically

Beyond these, we have data and nginx configurations for these (deprecated) sites, which were previously hosted on milton:

• ccdc.vtluug.org
• foodfor.vtluug.org
• jessicaandchristopher.net
• nagios.vtluug.org
• tahoe.vtluug.org
• vtcybersecurity.org
• cdn.vtluug.org
• git.vtluug.org
• randynance.info
• uniluug.org
• map.vtluug.org
• security.ece.vt.edu
• users.vtluug.org
• wargame.vtluug.org
• munin.vtluug.org
• vtbash.org
• webchat.vtluug.org

Further, we have server data for multiple versions of dokuwiki and mediawiki, a wordpress instance, "newsblur", and "bitcoin", and for a time had a static version of vtbash.org hosted at bash.vtluug.org.

VTLUUG previously supported gopher protocol over Milton, with a static version of the website available, and ran git and cvs servers, with git presumably being world-access through gitosis.

vtluug.org/public/$user/ was previously a source directory of files placed in a user's $HOME/public directory on NFS.

VTLUUG was also previously responsible for mirror.ece.vt.edu, and still has the ip allocation for that DNS entry.

Considerations for the future

It would be preferable to keep all existing sites functional. Aam suggested the use of caddy to replace nginx, especially on static sites, because it provides automatic letsencrypt.

Encryption

All sites should move to automatic letsencrypt certificates within the next few months. letsencrypt is still in beta, but it provides fully functional and low-hassle 3-month certificates. They will have integration for nginx soon, which will decrease the complexity of getting certs.

It may also be of interest to the club to revive monkeysphere signing on the servers.

Project Hosting

Most vtluug internal projects (e.g. HokiePrivacy) are currently hosted on git repositories on milton. How to move forwards with these is still indeterminate.

For public hosting, there has been some conversation about using Go Git Service (gogs), for public, www-viewable git repositories.

Gobblerpedia

Gobblerpedia is effectively non-functional currently, because account creation was disabled, to prevent spam. This needs to be addressed by adding captchas which are blacksburg-specific, limiting account creation access to local IP addresses, or enabling some form of LUUG-managed account creation. One suggestion was using CAS/Login services to authenticate, however that makes it difficult for Blacksburg residents to add content, and has other disadvantages.

VTLUUG Main Page

This needs to be kept up-to-date, and have some way of adding calendar information.

VTLUUG Wiki

Meeting creation script needs to be re-implemented.

Addressing

https://linx.vtluug.org/ips1.txt

globally addressable	ECE DNS	Name	fucntion	internal address
128.173.88.78	luug.ece.vt.edu.	sczi	New webserver	10.99.0.27?? (Currently DHCP)
128.173.89.244	luug0.ece.vt.edu	cyberdelia	VM Host	10.99.0.1
128.173.89.245	luug1.ece.vt.edu.	acidburn	shell server	10.99.0.4
128.173.89.246	luug2.ece.vt.edu.	milton	Old webserver
128.173.89.247	luug3.ece.vt.edu.	razor	LDAP
128.173.88.104	luug4.ece.vt.edu.	akhaten	currently pfsense (global v4 subject to change)	10.99.0.104
128.173.88.36	mirror.ece.vt.edu.	mirror	not in use
128.173.88.191	luug5.ece.vt.edu.	router	not in use
	172.xx.xx.xx	snapfeed	REDACTED
pfsense/443	jitsi.vtluug.org	jitsi	Jitsi	10.99.0.101 (static lease)
None	172.16.10.13	archiveteam-warrior	Archive Team Warrior

Other IPs

IPs we had at some point (by reclaiming CVL IPs, etc), or are mentioned in /etc/exports on Cyberdelia

• 128.173.235.22 (Something for WUVT) (IP currently in use)
• 128.173.88.161 (security.ece.vt.edu)
• 128.173.88.145 (cvl05.ece.vt.edu)
• 128.173.88.131 (dog.ece.vt.edu) (IP currently in use)

Network Diagram

This is the projected diagram of our network, once sczi is fully deployed and milton is phased out. At this time, razor may also lose its global v4 address.