This page documents VTLUUG's infrastructure post-[[CVL eviction]]. It is intended as a scratch pad ofsorts for organizing infrastructure changes, since [[Infrastructure:Log]] is incredibly out of date, andthere are a lot of details which must be sorted out before major infrastructure changes can be made.

''Main Article === NFS Hosts ===* [[Infrastructure:CyberdeliaDirtycow|dirtycow]]- Primary NFS server, 8x2TB raidz2 array* [[VTLUUGInfrastructure:InventoryCyberdelia|cyberdelia]]''- OFF, 7x1TB raidz2 array, sitting on shelf instead of shelf

=== VM Hosts ===* [[Infrastructure:Meltdown|meltdown]] - Primary VM/docker host* [[Infrastructure:CyberdeliaSpectre|Cyberdeliaspectre]] is the only connected physical machine right now. It contains 48 GB of memory- Secondary VM/docker host, for example user VMs === Router ===* [[Infrastructure:Shellshock|shellshock]] - 3 disk RAID1 array with 4 ethernet interfaces; only eth4 is connected and is attached to br0. All hosts are on the ECE network behindrouter.ece.vt.eduour own 1 Gb/s port with [[Infrastructure:Joey|joey]], a gateway featuring ARP proxying but no IPv6. For global DNS changes under ece.vt.edu, serverroom access, and getting hosts added to full delegation of the ARP proxy, contact [mailto2607:b400:6:rbrand7@vtcc80/64 prefix.edu Brandon Russell]

some <!--[Who?[User:echarlie|echarlie]]--> are is calling [[gp:Cyber Auschwitz|Cyber Auschwitz]]. Contact itso-g@vt.edu for firewall exceptions.When deploying new hosts, make ssh listen on both 2222 and 22. [[Infrastructure:Acidburn |Acidburn]] currently listens on 443 3128 as well.

Most other VTLUUG-owned servers are currently stored in === Other hosts ===* [[userInfrastructure:dsetarehWood|AliWood]]is sitting in our rack turned off because we don's basement, with the exception t have a use for it currently. It is in a 4U case capable of fitting several GPUs.* [[infrastructureInfrastructure:sunwaySunway|sunway]]and a SuperMicro server, which were all transferred to WUVT. The list of these machines includes [[Infrastructure:Wood|Wood],[[Infrastructure:Temp88191|our router]], and a variety of other servers, including our old LXC Older hosts, the mirror, and a DEC Alpha serverhave either been thrown out or given to members.

Some goals for once we get rackspace:* Acquire new servers** Phase out older infrastructure** Rebuild most existing servers, to clear out old accounts, old passwords, etc.*** Assume that machines with installs which predate the current sysadmin are pwned* Expand Tank on See [[InfrastructureVTLUUG:Cyberdelia|cyberdeliaStrategic_plan]], as it is nearing full** Current array is seven 1TB drives in a zraid array, equivalent to [[w:RAID#RAID 6|RAID 6]].** Do for things we want plan to buy disks to replace the current ones, to expand the array all at once, or deploy a new array do in a new machine?* Provide an LXC host (preferably on physical hardware)* Acquire an IPv6 prefix delegation, and either an IPv6 tunnel or something else* Build a [[w:darknet|darknet]] for fail-over from the main network; perhaps run two OpenBSD boxes in [[w:Common Address Redundancy Protocol|CARP]].* Relaunch and expand mirror.cc.vt.edu, perhaps running in [[w:Cache Array Routing Protocol|CARP]]future.

''Further Information: [[Infrastructure:Networking]] and [[Infrastructure:Network]]'' [[File:Infra2019-network.png|thumb|500px|A simple network diagram by [[user:pew|pew]]. '''Update June 2021: Joey is dead, long live Joey. Shellshock is the new router. Cyberdelia is off.]] 

Because VTLUUG infra no longer has IPv6 access, we are limited by the IP addresses assigned to usWe currently have some services with public IPv4 address, and what wecan get through DHCP from ECE. As a consequence, all services which do not need to hosts have a global IP should moveto the an internal network IPv4 address on the 10.9998.x.x/16 subnetand an IPv6 address assigned via SLAAC. In the future, it may be wise to bridge this network to anethernet port on cyberdelia, so that a switch can be used to network our other services. When we have rackspaceto do so, [[Infrastructure:IPsec|VPN]]/[[Iodine]] access to the internal network will should be necessaryused.

In theory, services can be provided via a hidden service (read: such as [[w:Tor|Tor]]), but that introduces other complications.Alternately, services can require use of the [[Infrastructure:IPsec|VPN]] on [[Infrastructure:acidburnAcidburn|acidburn]],[[Iodine]], or [[SSHSecure Shell|ssh tunnelling]], although all of these limit usage to members with a shell account.All of these have the benefit of NAT transversal, however.

=== Critical === * [[Infrastructure:Acidburn|Acidburnacidburn]]

* [[Infrastructure:RazorChimera|Razorchimera]]** LdapFreeIPA* [[Infrastructure:Milton|Milton]]/[[Infrastructure:Sczi|Sczi]]

*** public file shares** git[https://bash.vtluug.org vtbash]* [[Infrastructure:CyberdeliaDirtycow|Cyberdeliadirtycow]]** VMs Storage for projects** other all primary services** TankNFS - ZFS pool name is cistern*** NFS[[Infrastructure:Meltdown|meltdown]]*** milton_srv (website files)VM host for above services

[[Infrastructure:Acidburn|Acidburnacidburn]] and the website ''must'' be accessible through real services, and it is preferable that [[Infrastructure:Cyberdelia|Cyberdelia]] is other hosts are too. === Other (not all functional) ===* [[Tahoe-LAFS]]** Should be on hidden service.* Jitsi Meet** Should be public* User websites** Hosted on [[Infrastructure:Milton|Milton]]/[[Infrastructure:Sczi|Sczi]], so will be public* Diaspora*** This means we must use of our public or hidden service doesn't matter* [[Iodine]]** On acidburn* [[Infrastructure:IPsec|IPsec Tunnel]]** On acidburnIPv4 & IPv6 Addresses allotted by ECE.

 All vtluug websites are run on nginx on milton[[Infrastructure:Sczi|sczi]]. These sites are currently functional:

* wiki.vtluug.org (this redirects to vtluug.org/wiki/)* bash.vtluug.org* vtluug.org/users/~$user

All of these sites exclusively allow for the use of TLS connections. Hokie Privacy has a cert from letsencrypt,while all other All services are verified by StartCom.use automatically updated Currently, milton has '''no startup script''' for the website. If things go down, someone has to run<pre>root@milton:/srv/http/vtluug.org# sudo -u www-data uwsgi --yaml uwsgi.yml</pre>in a tmux session, to restart [https://uwsgi-docs.readthedocs.org/en/latest/ uWSGI]. It is alsounlikely that nginx will start properly because of weird dependenciesletsencrypt certs.

 It currently appears that the The main vtluug VTLUUG page (mostly written in php), is or was managed scraped fromthe [[w:Internet Archive|Internet Archive]] and added created as a github page at[https://vtluug.org/atrium Drupalgithub.io vtluug.github.io] as a backend, but for that to function, mysql needs to be running. uWSGI, django, and PHP appear make up most of the important features of the website in unknown ways.This was configured by is reverse-proxied through [[userInfrastructure:mutantmonkeySczi|Jamessczi]] at some point, we presume, but he is not availableto provide more information on the set-up, and even with more information, it would be preferable to movethe website to something more simple and sane.

 The wiki currently runs fully on MediaWiki hosted on nginx (as opposed to the default include using a [https://github.com/vtluug/mediawiki-docker modified version of apache2,demanded by the Debian package)official mediawiki docker image]. Postgres is used for You can auth with the database managementadmin account, AFAIK, and authenticationis through [[User:wiki-admin|wiki-admin]] or a Google account. See note on [[Main_page]] about why LDAPisn't working yet. MediaWiki is a dated git version from the stablerepository, as of March 2016, howeverupdating is more complicated than a git pull

All but disabled currently, due to spam. Runs on MediaWiki ==== Linx ==== Uses [[User:andreim|aam]]'s [https://github.com/andreimarcu/linx-server linx], and is an identical implementation to his site[https://linx.li linx.li]. One of the few sites with a complete startup script. The maintenance is currently the responsibilityof aam, however this is subject to change. === Historically === Beyond these, we have data and nginx configurations for these (deprecated) sites, whichwere previously hosted on milton: ==== Needs Restoration ====

* [https://github.com/mutantmonkey/foodforus foodfor.vtluug.org ] - For [[Wadsworth]]'s .pickfood and .foodvote commands. This is [[User:Timelord|jpo's]] fault.* tahoe.vtluug.org - [[user:mjh|mhazinsk's ]] Tahoe-LAFS grid

* [https://github.com/vtluug/campusmap map.vtluug.org ] - [[Openstreetmap|OSM]]* vtbash.org - based map of VT QDB* users.vtluug.org - member hosting of acidburn home directories

===Historically = Deprecated ====These are no longer needed but we should preserve the data/config:* ccdc.vtluug.org - website used for the [[Collegiate Cyber Defense Competition]] in the spring of 2011.* nagios.vtluug.org - was used for monitoring for a period but not kept up-to-date; the primary issue was that infrastructure, being hosted on the same server, tended to fail all at once* uniluug.org - deprecated project* security.ece.vt.edu - REDACTED* wargame.vtluug.org - vtluug's wargame pre-vtcsec* munin.vtluug.org - former attempt at monitoring* webchat.vtluug.org - channel webchat; version of the service still runs on the vtluug website as an embeded frame from freenode's website* cdn.vtluug.org - member website* randynance.info - member website* jessicaandchristopher.net - member website* vtcybersecurity.org - member website from pre-csec days

Prior to the current site, which was written in Python using Django starting in 2010 and deployed in 2011, the VTLUUG website was aWordPress instance. The files See [[Dead_projects]] for this still exist. Much of the original django deployment was highly dynamic, with an identi.cafeed, automatic calendar updates, and other features.historic information

Additional files and configuration data exist for multiple versions of dokuwiki and mediawiki. There are also files for a NewsBlur installation which was never functional, and "bitcoin," the purpose of which is unknown. For a time, a static version of vtbash.org was hosted at bash.vtluug.org. Until recently, VTLUUG ran a Gopher server on Milton, with a small welcome page and access to /files. Git hosting was also provided; authenticated access was over SSH with [https://github.com/tv42/gitosis gitosis] and public access was via Gitweb and the insecure Git protocol. vtluug.org/public/$user/ was previously a source directory of files placed in a user's $HOME/public directory on NFS. <nowiki>[When? I thought it was always users.vtluug.org?]</nowiki> VTLUUG members also ran '''mirror.ece.vt.edu''', although it was never an official VTLUUG project. The IPv4 allocation for this domain is still available. PostgreSQL tables exist on milton for foodforus, jandc, mediawiki, mewsblu, sharedwiki, uniluug, vtluug_wiki, and wargame_bbs. Moreresearch is necessary to determine what these are for. There are also a collection of mySQL databases on milton which maybe desirable to archive and store. === Considerations for the future Goals === It would be preferable to keep all existing sites functional. See [[userVTLUUG:andreim|Aam]Strategic_plan#Web_Services] suggested the use of [https://caddyserver.com/ caddy]to replace nginx, especially on static sites, because it provides automatic letsencrypt. It is also important to ensure there are '''startup scripts''' for sczi, so that a reboot of it doesn't result in a 10-hour website outage. ==== Encryption ====All sites should move to automatic letsencrypt certificates within the next few months. letsencrypt is still in beta, but it provides fully functionaland low-hassle 3-month certificates. They will have integration for nginx soon, which will decrease the complexity of getting certs. It may also be of interest to the club to revive [[monkeysphere]] signing on the servers. ==== Project Hosting ==== Most vtluug internal projects (e.g. HokiePrivacy) are currently hosted on git repositories on milton. How to move forwards with these is stillindeterminate. For public hosting, there has been some conversation about using [https://github.com/gogits/gogs Go Git Service (gogs)], for public,www-viewable git repositories. ==== Gobblerpedia ==== [[gp:Main page|Gobblerpedia]] is effectively non-functional because account creation was disabled toprevent spam. This needs to be addressed by adding captchas which are Blacksburg-specific, limitingaccount creation access to local IP addresses, '''or''' enabling some form of LUUG-managed accountcreation. One suggestion was using CAS/Login future goals involving web services to authenticate, however that makes it difficultfor Blacksburg residents to add content, and has other disadvantages. ==== VTLUUG Main Page ==== This needs to be kept up-to-date, and have some way of adding calendar information. [[user:Echarlie|echarlie]would like a simple static site with some clean CSS, to avoid the clusterf*ck that is re-enabling uwsgi at thecurrent time. ==== VTLUUG Wiki ==== Meeting creation script needs to be re-implemented.

''Main article: [[Infrastructure:Network]]'' VTLUUG currently has DNS with namecheap, however all domains have been re-registered with gandi undervtluug's own account, to replace the mixture of mutantmonkey-holdings and vtluug-held domains on multipledifferent registrars. https://linxnet.vtluug.org/ips1.txt {| class="wikitable"!globally addressable!ECE DNS!Name!fucntion!internal address|-| 128.173.88.78| luug.ece.vt.edu.| [[Infrastructure:sczi|sczi]]| New webserver| <!--10.99.0.27??--> 10.99.0.150 Message officers for access (Currently DHCP)|-| 128.173.89.244| luug0.ece.vt.edu| [[Infrastructure:cyberdelia|cyberdelia]]| VM Host| 10.99.0.1|-|128.173.89.245 | luug1.ece.vt.edu. | [[Infrastructure:acidburn|acidburn]]| shell server| 10.99.0.4|-| 128.173.89.246 | luug2.ece.vt.edu.| [[Infrastructure:milton|milton]]| Old webserver| 10.99.0.2|-| 128.173.89.247| luug3.ece.vt.edu.| [[Infrastructure:razor|razor]]| LDAP| 10.99.0.15|-| 128.173.88.104 | mjh.ece.vt.edu./luug4.ece.vt.edu| <s>akhaten</s>| currently pfsense (global v4 subject to change - IP belongs to mhazinsk)| 10.99.0.104 |-| 128.173.88.36| mirror.ece.vt.edu.| mirror| not in use||-| 128.173.88.191| luug5.ece.vt.edu.| [[Infrastructureplease don't be scared :Temp88191|router]]| not in use||-|| 172.xx.xx.xx | snapfeed| REDACTED||-| pfsense/443| jitsi.vtluug.org| jitsi| [[Jitsi]]| 10.99.0.101 (static leaseD)|-|None| 172.16.10.13| archiveteam-warrior| [http://archiveteam.org/index.php?title=ArchiveTeam_Warrior Archive Team Warrior]||} == Deprecated IPs ==IPs we were using at some point (by reclaiming CVL IPs, etc), or are mentioned in /etc/exports on Cyberdelia* 128.173.88.161 (security.ece.vt.edu) - was once milton's IP until luug IPs got routed behind router.ece.vt.edu.* 128.173.88.145 (cvl05.ece.vt.edu) - was once snapfeed's IP, reclaimed by bmckagen. * 128.173.88.131 (dog.ece.vt.edu) - we have a Sun box labeled "dog.ece.vt.edu" but the IP appears to be in use now for VMware ESXi. It can be arped from cyberdelia.

This is the projected diagram of our network, once sczi is fully deployed and milton is phased out.At this time, razor may also lose its global v4 address.[[File{{:Infra2016-network.png]]Infrastructure:Network}}