398
edits
Changes
→Current Setup
This page document's documents VTLUUG's infrastructure post-[[CVL eviction]].
== Physical Infrastructure ==
=== NFS Hosts ===* [[Infrastructure:Dirtycow|dirtycow]] - Primary NFS server, 8x2TB raidz2 array* [[Infrastructure:Cyberdelia|Cyberdeliacyberdelia]] is the only connected physical machine right now. It contains 48 GB of memory with 4 ethernet interfaces; only eth4 is connected and is attached to br0. All hosts are on the ECE network behind router.ece.vt.edu- OFF, a gateway featuring ARP proxying but no IPv6. For global DNS changes under ece.vt.edu7x1TB raidz2 array, server room access, and getting hosts added to the ARP proxy, contact Branden McKagen.sitting on shelf instead of shelf
=== VM Hosts ===* [[Infrastructure:Meltdown|meltdown]] - Primary VM/docker host* [[Infrastructure:Spectre|spectre]] - Secondary VM/docker host, for example user VMs === Router ===* [[Infrastructure:Shellshock|shellshock]] - 3 disk RAID1 array All hosts are on our own 1 Gb/s port with [[Infrastructure:Joey|joey]], a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix. Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move some are [[User:echarlie|echarlie]] is calling [[gp:Cyber Auschwitz|Cyber Auschwitz]]. Contact itso-g@vt.edu for firewall exceptions. When deploying new hosts, make ssh listen on both 2222 and 22. [[Infrastructure:Acidburn|Acidburn ]] currently listens on 443 3128 as well. === Other hosts ===* [[Infrastructure:Wood|Wood]] is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs.* [[Infrastructure:Sunway|sunway]] and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members. See [[VTLUUG:Strategic_plan]] for things we plan to do in the future.
== On the Network Architecture ==
''Further Information: [[Infrastructure:Networking]] and [[Infrastructure:Network]]''
[[File:Infra2019-network.png|thumb|500px|A simple network diagram by [[user:pew|pew]]. '''Update June 2021: Joey is dead, long live Joey. Shellshock is the new router. Cyberdelia is off.]]
We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.98.x.x/16 subnet and an IPv6 address assigned via SLAAC.
In the future, [[Infrastructure:IPsec|VPN]]/[[Iodine]] should be used.
== Services ==
** Shell server
** [[Email]]
** [[Wadsworth]]
* Razor[[Infrastructure:Chimera|chimera]]** LdapFreeIPA* Milton/[[Infrastructure:Sczi|Sczi]]
** Website
*** Wiki
*** Main Page
*** linx
*** public file shares[https://bash.vtluug.org vtbash]** git* Cyberdelia[[Infrastructure:Dirtycow|dirtycow]]** VMs Storage for projects** other all primary services** TankNFS - ZFS pool name is cistern*** NFS[[Infrastructure:Meltdown|meltdown]]*** milton_srv (website files)VM host for above services
== Website details ==
=== Current Setup ===
All vtluug websites are run on nginx on milton[[Infrastructure:Sczi|sczi]]. These sites are currently functional:
* gobblerpedia.org
* hokieprivacy.org
* vtluug.org
* wiki.vtluug.org (this redirects to vtluug.org/wiki/) All of these sites exclusively allow for the use of tls connections. Hokie Privacy has a cert from letsencrypt,while all other services are verified by StartCom. Currently, milton has '''no startup script''' for the website. If things go down, someone has to run<pre>root@milton:/srv/http/vtluug.org# sudo -u www-data uwsgi --yaml uwsgi.yml</pre>in a tmux session, to restart uwsgi === HIstorically === Beyond these, we have data and nginx configurations for these (deprecated) sites, whichwere previously hosted on milton:* ccdcbash.vtluug.org* foodfor.vtluug.org* jessicaandchristopher.net* nagios.vtluug.org* tahoe.vtluug.org* vtcybersecurity.org* cdn.vtluug.org* git.vtluug.org* randynance.info* uniluug.org* map.vtluug.org* security.ece.vt.edu* /users.vtluug.org* wargame.vtluug.org* munin.vtluug.org* vtbash.org* webchat.vtluug.org Further, we have server data for multiple versions of dokuwiki and mediawiki, a wordpress instance, "newsblur", and "bitcoin",and for a time had a static version of vtbash.org hosted at bash.vtluug.org. VTLUUG previously supported gopher protocol over Milton, with a static version of the website available, and ran git and cvs servers,with git presumably being world-access through [https://github.com/tv42/gitosis gitosis]. vtluug.org/public/$user/ was previously a source directory of files placed in a user's ~$HOME/public directory on NFS. VTLUUG was also previously responsible for mirror.ece.vt.edu, and still has the ip allocation for that DNS entry. === Considerations for the future === It would be preferable to keep all existing sites functional. [[user:andreim|Aam]] suggested the use of [https://caddyserver.com/ caddy]to replace nginx, especially on static sites, because it provides automatic letsencrypt. It is also important to ensure there are '''startup scripts''' for sczi, so that a reboot of it doesn't result in a 10-hour website outage. ==== Encryption ====All sites should move to automatic letsencrypt certificates within the next few months. letsencrypt is still in beta, but it provides fully functionaland low-hassle 3-month certificates. They will have integration for nginx soon, which will decrease the complexity of getting certs. It may also be of interest to the club to revive [[monkeysphere]] signing on the servers.
===== Gobblerpedia =====Runs on the same Mediawiki instance as this wiki. Similarly to LUUGWiki, only Google accounts or the admin user are supported logins.
=== Needs Restoration ===These are VTLUUG services that haven't yet been properly restored:* [https://github.com/mutantmonkey/foodforus foodfor.vtluug.org] - For [[gpWadsworth]]'s .pickfood and .foodvote commands. This is [[User:Main pageTimelord|Gobblerpediajpo's]] is effectively nonfault.* tahoe.vtluug.org - [[user:mjh|mhazinsk's]] Tahoe-functional currently, because account creation was disabled, to prevent spamLAFS grid* git.vtluug. This needs to be addressed by adding captchas which are blacksburgorg -specific, limiting account creation access git hosting; previously a redirect to local IP addresses, or enabling some form of gitweb with gitosis as the SSH backendLUUG* gitweb.vtluug.org -managed account creationgit hosting; previously gitweb* [https://github. One suggestion was using CAScom/Login services to authenticate, however that makes it difficult for Blacksburgresidents to add content, and has other disadvantagesvtluug/campusmap map.vtluug.org] - [[Openstreetmap|OSM]] based map of VT
==== VTLUUG Main Page =Historically ===
==== VTLUUG Wiki =Goals === Meeting creation script needs to be re-implemented.See [[VTLUUG:Strategic_plan#Web_Services]] for future goals involving web services
== Addressing ==
VTLUUG currently has DNS with gandi.net. Message officers for access (please don't be scared :D).
[[Category:Infrastructure]]
[[Category:VTLUUG :Projects]][[Category:2016Featured content]]