Box-Admins September 2016

box-admins@lists.squeakfoundation.org

8 participants
14 discussions

Access to the new server(s)
by Tobias Pape 05 Apr '19

05 Apr '19

Dear all [ACTIONS AT END] with retroactive blessing of Levente, I have now prepared eight VMs on Rackspace. Here's the overview: ======================================================================================================================= Name Name (ext) intended use Unix Users Public Ports Private Ports Public IPv4 Private IPv4 ----------------------------------------------------------------------------------------------------------------------- ian ssh.squeak.org ssh-gateway ssh 1022 22 104.130.6.82 10.208.225.29 alan *.squeak.org webserver webteam 80, 443 22 104.239.229.92 10.176.200.8 adele lists.... mailinglists (tbd) 25, 587, 465 22, 8080 162.242.237.43 10.208.160.56 andreas -------- source.squeak chrismuller* -------- 22, 8080 irrelevant 10.208.161.222 dan -------- squeaksource davidlewis* -------- 22, 8080 irrelevant 10.176.197.150 ted -------- squeak wiki+map (tbd) -------- 22, 8080, 8081 irrelevant 10.176.130.111 david -------- jenkins (tbd) -------- 22, 8080 irrelevant 10.208.194.45 scott -------- misc (tbd) -------- 22, 8080, 8081 irrelevant 10.176.199.169 ======================================================================================================================= Currently, Levente and me have sudo on all these machines. Users with * also do. Note that _no_ server exposes SSH on port 22 on a public IP. This is intentional to narrow attack vectors for script kiddies. How to login? Ian is the ssh gateway so you have to connect to ian _first_ and use (1) local forwarding or (2) proxy jumping. I have installed the Public keys from most of you for the 'ssh' user on ian. Please verify by ssh -p1022 -lssh 104.130.6.82 you should see restrict shell, no commands # (you get out with crtl-d, ctrl-c, or killing ssh) How to reach the other servers? Example for 'andreas' variant (1): Do a local forward by ssh -AN -L22221:10.176.200.8:22 -p1022 -lssh 104.130.6.82 and then ssh -lYOURNAME -p22221 localhost (-N maybe optional, but then you see 'restrict shell, no commands #') Or in your .ssh/config you can put Host ian.squeak.org User ssh Hostname 104.130.6.82 Port 1022 LocalForward 222221 10.176.200.8:22 Host andreas.squeak.org User YOURNAME Hostname localhost Port 222221 And then say 'ssh -AN ian.squeak.org' and then 'ssh andreas.squeak.org' variant (2): (a) You have OpenSSH >= 7.3 Do a Jump with ssh -J ssh@104.130.6.82:1022 YOURNAME(a)10.176.200.8 Or in your .ssh/config you can put Host ian.squeak.org User ssh Hostname 104.130.6.82 Port 1022 Host andreas.squeak.org User YOURNAME Hostname 10.176.200.8 ProxyJump ian.squeak.org And then say 'ssh andreas.squeak.org' (b) You have OpenSSH >= 5.4 Do a Jump via ssh -o ProxyCommand="ssh -lssh -p1022 -W %h:%p 104.130.6.82" YOURNAME(a)10.176.200.8 Or in your .ssh/config you can put Host ian.squeak.org User ssh Hostname 104.130.6.82 Port 1022 Host andreas.squeak.org User YOURNAME Hostname 10.176.200.8 ProxyCommand ssh -W %h:%p ian.squeak.org And then say 'ssh andreas.squeak.org' (c) You have OpenSSH < 5.4 Use variant (1) We will shortly start RSYNC-ing over data from box3 and box4 as well as replicatiing DNS entries before switching over. [ACTION REQUIRED] - Who needs access to which servers? - Do we need Jenkins anymore? As always, questions appreciated. Best regards -Tobias

8 36

Re: [Board] Rackspace 4 Squeak - Volunteers?
by David T. Lewis 28 Sep '16

28 Sep '16

On Thu, Sep 22, 2016 at 01:43:33PM -0500, Chris Muller wrote: > > On Thu, Sep 22, 2016 at 2:25 AM, Marcel Taeumel <marcel.taeumel(a)hpi.de> wrote: > > Hey there. > > > > I just talked to Tobias and he said that he is in contact with Levente, who > > is in the process of getting another login for the Squeak account to help > > Tobias. > > > > Who is capable and willing to help Tobias and Levente move our Squeak > > services until Nov 1st, 2016? We talked about this in yesterday's board > > meeting but I think it would be good to write the volunteers down via email. > > > > Aiming for Nov 1st would leave a full month room to handle unforeseen > > challenges as well. > > > > Best, > > Marcel > > I would like to volunteer for helping move source.squeak.org. > I will volunteer to move squeaksource.com. I will also build and install interpreter VMs where needed. Cross-posting to box-admins because we should probably be discussing this on the box-admins list. Dave

2 2

Migration and upgrade of source.squeak.org to Rackspace
by Chris Muller 27 Sep '16

27 Sep '16

Hi Levente, > What I'd like to ask from all volunteers is to include a list of instructions + explanation of the migration process, so that to help maintenance and potential migration in the future. I feel good enough about the source.squeak.org upgrade to bring it up on the Rackspace server, instead of the legacy SqueakSource-3.11 image. The initial indexing into Magma finished a few days ago settling at a final DB size of 2.4G -- much smaller than the 17GB directory of mcz's. I thought perhaps a sshfs mount between box4 and the new Rackspace would be an effective way to copy files between the two. I'll definitely copy the Magma DB first, since we have the ability to resave those stored MCVersions as a new set of mcz files on the Rackspace server, however I thought it prudent to transfer the 17GB worth of original mcz's instead, if the network can bear it. After this initial bulk transfer, I'll make sure the new server is production-ready on a non-privileged port, and then contact you to arrange the nginx configuration and coordinate the final switch-over. The swtich-over involves: 0) community notification 1) stopping source.squeak.org on box4. 2) use banyan on the sshfs mount to identify and copy the remaining mcz's and any other files under /srv/box2/home/squeaksource/[ss, dailycommits] and which were saved since the bulk transfer. 3) extract the final data.obj from the production image. 4) start the new server with nginx forwarding. This is the overall migration plan. As I think the bulk xfer will take quite a bit of time, someone please let me know the server details when they're available, so I can get that started. Oh, I will need sudo access in the new box, please. Best, Chris

1 0

PSA: box4 is nearly full
by Tobias Pape 27 Sep '16

27 Sep '16

$ df -h Filesystem Size Used Avail Use% Mounted on rootfs 103G 97G 652M 100% / We should move as soon as possible.

2 1

Re: [Box-Admins] Moving box3 off Gandi hosting
by Tobias Pape 24 Sep '16

24 Sep '16

Hi Brett On 23.09.2016, at 16:13, Brett Smith <brett(a)sfconservancy.org> wrote: > On 09/22/2016 04:34 PM, Tobias Pape wrote: > >> >>> I think we have a couple of options from here. I see you already have your account. Once you log in, I believe you’ll have access to User Management under the user menu in the upper right. From there, you should be able to create accounts for people who need it, and you could send out credentials however makes sense for the Squeak team, like if you have a private chat server or something. >>> >> I would be happy to do that, but I seem to have restricted rights in my subaccount. I can neither do 'User Management' nor 'Usage Overview'. If you deem me eligible for this, I'd happily do this for the Squeak team. > Tobias, > > Sorry about that. Rackspace accounts can be granted admin access to several parts of the account, and I thought you had more rights than you did. > > Unfortunately, it doesn’t look like I can give you control over user management. Only the account owner is allowed to do that, and there can be only one account owner. The account owner also has exclusive control over billing information, which we need to retain since ultimately Conservancy is the organization being billed. Yes, I actually thought so. Completely fine with me :) > > So I think we’re down to plan B: > >> >>> If that doesn’t work for you for any reason, I’m happy to make the accounts as long as you let me know what GPG key to use for each individual. >>> >>> >> OK. > In general I’m willing to use published keys that match e-mail addresses we already recognize, assuming the search doesn’t reveal any conflicts. If you’re willing to provide a list of public fingerprints to use, that would be even better. Well it seems we here use GPG less often (besides me) May it be possible to give me the information and I pass it on via a different secure channel? Best regards -Tobias > > Thanks again, > > -- > Brett Smith

2 1

Re: [Box-Admins] Moving box3 off Gandi hosting
by Tobias Pape 22 Sep '16

22 Sep '16

Hi Brett, On 22.09.2016, at 17:29, Brett Smith <brett(a)sfconservancy.org> wrote: > On 09/22/2016 09:12 AM, Das.Linux(a)gmx.de wrote: > > > >> Hi Brett, >> >> as shortly indicated on IRC, here's the list of people who need access to rackspace >> >> BOARD >> Bert Freudenberg >> <bert(a)freudenbergs.de> >> >> Craig Latta >> <craig(a)netjam.org> >> >> David T. Lewis >> <lewis(a)mail.msen.com> >> >> Chris Muller >> <ma.chris.m(a)gmail.com> >> >> Tim Rowledge >> <tim(a)rowledge.org> >> >> Marcel Taeumel >> <Marcel.Taeumel(a)hpi.de> >> >> Levente Uzonyi >> <leves(a)caesar.elte.hu> >> >> >> Levente being the most urgent one, as he currently acts as "the" admin for the Squeak Board. >> > > > Tobias, > > Unfortunately, I can’t find a GPG key for Levente. I wouldn’t want to set up an account without a secure way to send him the account credentials. That's understandable. > > I think we have a couple of options from here. I see you already have your account. Once you log in, I believe you’ll have access to User Management under the user menu in the upper right. From there, you should be able to create accounts for people who need it, and you could send out credentials however makes sense for the Squeak team, like if you have a private chat server or something. I would be happy to do that, but I seem to have restricted rights in my subaccount. I can neither do 'User Management' nor 'Usage Overview'. If you deem me eligible for this, I'd happily do this for the Squeak team. > > If that doesn’t work for you for any reason, I’m happy to make the accounts as long as you let me know what GPG key to use for each individual. > OK. > Thanks for understanding, Thank you too. Best regards -Tobias > > -- > Brett Smith

1 0

Re: [Box-Admins] Re: Moving box3 off Gandi hosting
by Tobias Pape 22 Sep '16

22 Sep '16

Hi, On 22.09.2016, at 17:19, Brett Smith <brett(a)sfconservancy.org> wrote: > On 09/22/2016 02:07 AM, Tobias Pape wrote: > > […] > > Tobias, > > Sorry for my confusion. Given infinite resources, my own preference is to have one server per service. That makes it easier to adjust resources for a specific resource as needed, and avoids situations where multiple services on a single server secretly depends on shared configuration, which can lead to deployment hiccups. My thoughts exactly. > > But, we don’t live in a world of infinite resources. In particular, Rackspace will only cover expenses up to USD$2,000 per month on your account. The Squeak project would be responsible for any remainder. So that might push you to have fewer servers. Yes, I've looked into it and it seems the we have few enough services that separating all of them would be theoretically possible. I don't think we should isolate all of them, but wie probably could if the need arose. > > An interesting middle ground is to run each service in a container a la Docker. That lets you run multiple services on a single server for cost efficiency, but also gives you most of the benefits of isolation as well. But orchestrating this requires additional time to plan and deploy which you might not have. I seconds that. Docker seems cool but I'm personally not yet "with it", and I got more experience with 'actual VMs'. That being said, its not up to me :) > > I’m setting up the accounts you requested next. I’ll follow up on that mail separately. Thanks a lot. Best regards -Tobias > > Best regards, > > -- > Brett Smith

1 0

Re: [Box-Admins] Re: Moving box3 off Gandi hosting
by Tobias Pape 22 Sep '16

22 Sep '16

Hi Bret On 22.09.2016, at 04:26, Brett Smith <brett(a)sfconservancy.org> wrote: > Tobias, > > On 09/21/2016 05:36 PM, Tobias Pape wrote: > >> I actually got a question: Would you make one or two boxen to house all that or make individual small VMs? (I tend to the latter) > > > If you already have a Rackspace account with the project, you should be able to do this yourself. Log in to the “Cloud Control Panel,” then you should be able to create servers under the “Server” popup menu. If any part of that doesn’t work for you, please let me know what piece you’re missing or what error you get, and we’ll get it sorted out. Yes, I found the procedure. The question was whether you'd recommend one Big Server™ or multiple smaller ones :) > > > >> Do you have any prompt technical advices or pitfalls that you would see in the following procedure?: > > > That’s the basic gist I’ve used for all of these, yeah. The last step, after the ones you listed, is to switch over the DNS records once the new server is ready. For services that listen for connections, those should stay up on both the new and old servers until the new DNS records have had enough time to propagate. Yes, the standard procedure :) > > > >> Can you recommend Rackspace's DNS? >> >> Do you have experience with the CDN? >> > > > Sorry, but I can’t personally speak to either of these. We use Gandi for DNS hosting, and haven’t used Rackspace’s CDN at all. Ok, thanks a lot. Best regards -Tobias > > Let me know if there’s anything else I can answer or do to help. Thanks again, > > -- > Brett Smith

2 1

Re: [Box-Admins] Re: Moving box3 off Gandi hosting
by Tobias Pape 21 Sep '16

21 Sep '16

Hi Brett, hi all sorry for answering late. Here is (partly) why I hesitated: I am not representing the Squeak Board here, neither am I "the" admin (but one of the helping admins); but I'm a helping hand that reached out to provide assistance to board and admin in the planning. That's why I contacted Bradley for a kind-of "preview account". I have access and have looked around. I proposed an order of what to migrate which is currently being discusses on the box-admins list. (Roughtly: - move DNS - move main web server - move mailing lists (quite some of them) - move main application (source.squeak.org) - move squeaksource.com - move mantis - move squeak wiki - move jenkins (maybe) - move rest (eg, codespeed)) Thanks for offering your help. I actually got a question: Would you make one or two boxen to house all that or make individual small VMs? (I tend to the latter) Do you have any prompt technical advices or pitfalls that you would see in the following procedure?: - Make new box (for one or n services, see above) - rsync data from gandi (all or per service) - for mantis, power up SQL-Database - for mailinglists, get mailman going - Can you recommend Rackspace's DNS? Do you have experience with the CDN? Best regards -Tobias On 21.09.2016, at 22:22, Brett Smith <brett(a)sfconservancy.org> wrote: > Hi Tobias, > > I wanted to check in real quick to see if you’ve had a chance to make any progress on these migrations. Like I said, if there’s anything at all I can do to help, please feel free to reach out. I’m more than happy to help with the tech and logistics. > > Thank you, > > > > On 09/08/2016 04:36 PM, Brett Smith wrote: >> Tobias, >> >> I just wanted to check in real quick and see if there’s anything I can do to help you with the migration to Rackspace. We just finished one of these ourselves that went smoothly, and have another in the pipeline, so it’s becoming pretty familiar to us (though of course every box is different, too). >> >> Depending on where you are, and if you’re comfortable granting me access to the VMs, I’d even be happy to help plan the migration of specific services. Of course, we wouldn’t make any concrete changes without further discussion. >> >> Please let me know what would suit you best. Thank you, >> >> >> >> On 08/31/2016 07:12 PM, Tobias Pape wrote: >>> "yes" ;) >>> >>> On 01.09.2016, at 01:09, Chris Muller >>> <asqueaker(a)gmail.com> >>> wrote: >>> >>> >>>>> Tobias, do you have a GPG-key that Tony can use to encrypt credentials >>>>> to you? >>>>> >> >> >> -- >> Brett Smith > > > -- > Brett Smith

1 0

Fwd: Squeak's Rackspace account (was: Re: Setting up an account that can submit report requests to Hetzner)
by Chris Muller 21 Sep '16

21 Sep '16

Hi all, I found this email invitation for us to get access to our Rackspace box. We discussed in our meeting today that we should give Tony a list of people rather than invidually. Have we taken this step yet, or is this the next step? ---------- Forwarded message ---------- From: Tony Sebro <tony(a)sfconservancy.org> Date: Tue, Jan 20, 2015 at 1:54 PM Subject: Squeak's Rackspace account (was: Re: Setting up an account that can submit report requests to Hetzner) To: "Bradley M. Kuhn" <bkuhn(a)sfconservancy.org>, Bert Freudenberg <bert(a)freudenbergs.de>, squeak(a)sfconservancy.org Cc: "David T. Lewis" <lewis(a)mail.msen.com>, leves(a)elte.hu, goran(a)krampe.se, "Randal L. Schwartz" <merlyn(a)stonehenge.com>, Ian Piumarta <piumarta(a)gmail.com>, brasspen(a)gmail.com, ma.chris.m(a)gmail.com, Tim Rowledge <tim(a)rowledge.org>, Eliot Miranda <eliot.miranda(a)gmail.com>, Craig Latta <craig(a)netjam.org>, frank.shearar(a)gmail.com, Tobias Pape <Das.Linux(a)gmx.de> On 01/05/2015 02:34 PM, Tony Sebro wrote: > Hi, all. Happy New Year. > > I've created a Rackspace account for Squeak, and I've submitted a > request that the account be added to their FOSS discount program (which > provides a $2,000/month credit for managed infrastructure accounts for > FOSS projects). If/when I receive confirmation, I'll set up admin > subaccounts for Squeak volunteers who want to manage Rackspace services > on behalf of the project. > > I'll keep you posted on my progress. Best, -Tony > Hi, all. I've received confirmation that Conservancy's Rackspace account for Squeak has indeed been approved for inclusion in Rackspace's FOSS discount program. I can now set up subaccounts for Squeak contributors who want to manage the clound account. Please send me the email addresses of those of you who should get subaccounts. Thanks! -Tony -- Tony Sebro, General Counsel, Software Freedom Conservancy +1-212-461-3245 x11 tony(a)sfconservancy.org www.sfconservancy.org

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Box-Admins September 2016