Project

General

Profile

NetworkInfrastructure » History » Revision 141

Revision 140 (Denis 'GNUtoo' Carikli, 07/22/2020 02:24 PM) → Revision 141/163 (dl lud, 07/30/2020 03:49 PM)

h1. Network Infrastructure 

 |_. What |_. Where |_. Access type | Who | Comments comments | 
 | "Redmine instance":https://redmine.replicant.us |/5. OSUOSL    | Redmine manager administrator | Only the following people have access to it: 
 * [[People#Paul-Kocialkowski|Paul Kocialkowski]] 
 * [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]] 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * [[People#Joonas-Kylmälä|Joonas Kylmälä]] 
 * [[People#Fil-Bergamo|Fil Bergamo]] [[People#Fil-Bergamo|Fil-Bergamo]] 
 * [[People#Kurtis-Hanna|Kurtis Hanna]] 
 * @dllud 
 * @GrimKriegor 
 * OSUOSL system administrators | We are running version 4.0.4 and it was updated on August 15, 2019. 
 Since we only have one project, OSUOSL put in a redirect from the main page of our Redmine redmine instance to /project/replicant 
 OSUOSL keeps 2 weeks worth of backups for restoration purposes. | 
 | "Mailing list":https://lists.osuosl.org/mailman/listinfo/replicant | Mailing list administrator | Several Replicant contributors including: 
 * [[People#Paul-Kocialkowski|Paul Kocialkowski]] 
 * [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]] 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * [[People#Kurtis-Hanna|Kurtis Hanna]] 
 * @dllud 
 * OSUOSL system administrators Add your name here if you have access and want to be mentioned    | OSUOSL keeps 2 weeks worth of backups for restoration purposes. | 
 | "Wordpress instance":https://blog.replicant.us/ | Wordpress administator | Several Replicant contributors including: 
 * [[People#Paul-Kocialkowski|Paul Kocialkowski]] 
 * [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]] 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * [[People#Joonas-Kylmälä|Joonas Kylmälä]] 
 * [[People#Fil-Bergamo|Fil Bergamo]] 
 * [[People#Kurtis-Hanna|Kurtis Hanna]] 
 * @dllud 
 * OSUOSL system administrators 
 * Add your name here if you have access and want to be mentioned | This instance is auto-updated automatically with the help of a plugin. | 
 | "Releases":https://ftp-osl.osuosl.org/pub/replicant/ | SSH | Only the following people have access to it: 
 * [[People#Paul-Kocialkowski|Paul Kocialkowski]] 
 * [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]] 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * [[People#Joonas-Kylmälä|Joonas Kylmälä]] | We should not use too much space. space | 
 | The replicant.us (mostly-static) front website |\2. None: there There is an automatic hook managed by OSUOSL. OSUOSL | * "Source code":https://git.replicant.us/replicant/website/ 
 * Patches should are to be sent to the Replicant mailing list. list 
 * There is a jenkins hook with a token to pull and deploy the website source code. code | 
 | A virtual machine hosted by the FSF that handles: 
 * "Replicant Source code":https://git.replicant.us/ | FSF |/2. SSH root access | Only the following people or machines have access to it 
 * [[People#Paul-Kocialkowski|Paul Kocialkowski]] 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * [[People#Joonas-Kylmälä|Joonas Kylmälä]] 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * Several FSF system administrators 
 * FSF backup server 
 * FSF Ansible ansible deployment server | Resources kindly offered by the FSF. FSF 
 The git configuration has [[ReplicantInfrastructure#git-hosting-infrastructure-on-this-machine|some documentation]]. documentation]] 
 Before handling SSH (root) access to this machine: 
 * Make sure that the person really needs it. it 
 * Make sure that the person already contributed to Replicant. Replicant 
 * Ask one other person that has SSH access and/or the [[SteeringCommittee]] to also agree on it. it | 
 | [[PrivateContact|Private contact address]] | Virtual on the virtual machine hosted at the FSF | The contact address is accessible by several Replicant contributors: 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * [[People#Joonas-Kylmälä|Joonas Kylmälä]] 
 * [[People#Fil-Bergamo|Fil Bergamo]] David "dllud" Ludovino 
 * Ricardo "Grim" Cabrita 
 * [[People#Kurtis-Hanna|Kurtis Hanna]] 
 * @dllud 
 * @GrimKriegor Fil Bergamo | You can write to the contact address (all the members of [[SteeringCommittee]] receive it) if for some reasons you need to receive it as well. | 
 | IRC channel | Freenode | Channel operator operator(s) | * [[People#Paul-Kocialkowski|Paul Kocialkowski]] Several Replicant contributors including: 
 * [[People#Denis-GNUtoo-Carikli|GNUtoo]] 
 * [[People#Joonas-Kylmälä|Joonas Kylmälä]] [[People#Paul-Kocialkowski|Paul Kocialkowski]] 
 * [[People#Kurtis-Hanna|Kurtis Hanna]] 
 * @dllud 
 * @GrimKriegor Add your name here if you have access and want to be mentioned | Quiet mode for unregistered users is disabled for the time being. If SPAM comes back use: @/mode #replicant @MODE #Replicant +qe $~a *!*@gateway/web/*@ and @/mode #replicant @MODE #Replicant +qe $~a *!*@gateway/shell/matrix.org/*@ to re-apply it. These commands whitelist users coming through have been applied. Unless one connects via a web based IRC clients and irc client or via the Matrix.org IRC bridge. bridge one will need to register one's nick with Freenode in order to speak | 
 | The replicant.us domain name | gandi.net | * Web inteface through gandi website 
 * The DNS entries are configured to use gandi's DNS server | The following people or machines have access to it: 
 * [[People#Bradley-M-Kuhn|Bradley Kuhn (administrative contact)]]: Can do everything (including designating the technical contact or transferring the domain)  
 * [[People#Denis-GNUtoo-Carikli|GNUtoo (technical contact)]]: can do DNS zone changes 
 * Other people? [[People#Paul-Kocialkowski|Paul Kocialkowski]]? | | 
 | The replicant.us TLS certificate | Let's Encrypt | Access probably by controlling the respective domain name | * https://www.replicant.us: OSUOSL 
 * https://blog.replicant.us: OSUOSL 
 * https://redmine.replicant.us: OSUOSL 
 * https://git.replicant.us: ? | History: CA-cert -> GlobalSign -> LetsEncrypt | 

 h2. OSUOSL 

 The OSUOSL is the Oregon State University Open Source Lab. 

 Contact: 
 * They can be contacted on #osuosl on the Freenode IRC network 
 * They also have a 'support' mail address at osuosl.org 

 h2. Virtual machine in FSF's infrastructure 

 * The virtual machine is hosted in a server that is in their office or in a datacenter. 
 * Several FSF network administrator also have access to the virtual machine 

 Contact: 
 * The 'sysadmin' mail address at gnu.org 
 * The FSF system administrators can also be contacted on #fsfsys on the Freenode IRC network for more urgent matters 

 h3. Virtual machine specifications 

 The virtual machine runs on top of Xen and has: 
 * About 3G of RAM 
 * 1 virtual core 
 * a 10G rootfs partition 
 * a 100G storage partition for Replicant git repositories 
 * One IPv4 and one IPv6 

 Software: 
 * Trisquel 8.0 
 * The virtual machine may be using FAI and cfengine but it would need more investigation on that. 
 * The distribution seem to have the latest security updates applies. How it does it needs to be investigated by looking at cron jobs (it might use FAI for that). 

 h3. Virtual machine backup policies 

 The virtual machine is backed up daily. The backup procedure excludes the following path at the time of writing: 
 <pre> 
 /dev 
 /proc 
 /tmp 
 /sys 
 /run 
 /mnt 
 /mnt0 
 /mnt1 
 /mnt2 
 /mnt3 
 /mnt4 
 /mnt5 
 /mnt6 
 /mnt7 
 /mnt8 
 /mnt9 
 /floppy/ 
 /cdrom/ 
 /media/ 
 /net/ 
 /var/spool/squid/ 
 /var/spool/squid3/ 
 /var/spool/squid3_bak/ 
 /var/spool/squid-tbd/ 
 /var/spool/squid*/ 
 /var/spool/django/ 
 /var/spool/exim/ 
 /var/cache/ 
 /srv/chroot/ 
 /t 
 /srv/to-tape 
 /var/lib/ceph/osd/ 
 /var/lib/apt/lists/ 
 /var/cache/apt/ 
 </pre> 

 h3. git hosting infrastructure on this machine 

 The source code is in /srv/git/git-data/repositories and is divided in several groups: 
 ** Replicant source code 
 ** LineageOS mirror 
 ** AOSP mirror 
 ** Various developers repositories 

 |_. function |_. software |_. documentation |_. comments | 
 | authorization | gitolite | [[UpstrreamSourceCodeMirrors]] | | 
 | read access | * git:// -> git daemon 
 * ssh:// -> ssh daemon 
 * https:// -> ? (TODO: document the software/configuration) | | | 
 | web | cgit | [[Cgit]]| | 

 h2. Gandi 

 * See https://en.wikipedia.org/wiki/Gandi for more details 

 h2. Freenode 

 h2. GDPR 

 * For GDPR related inquiries, you can write to the [[PrivateContact]] mail address. 

 h2. TODO: 

 * Ask the OSUOSL about backup policies. 
 * Document public spaces like Freenode IRC channel. 
 * Do our own backup policies and do some backups ourselves. 
 * Contact the people that have some control of the resources above and ask for permission to mention them here 
 * Fill the gaps (mentioned with '?') in this page 
 * Look what happens when an account is deleted 
 * Fix the related issues in the "tracker":https://redmine.replicant.us/projects/replicant/issues?utf8=%E2%9C%93&set_filter=1&f%5B%5D=status_id&op%5Bstatus_id%5D=o&f%5B%5D=category_id&op%5Bcategory_id%5D=%3D&v%5Bcategory_id%5D%5B%5D=57&f%5B%5D=&c%5B%5D=tracker&c%5B%5D=status&c%5B%5D=priority&c%5B%5D=subject&c%5B%5D=assigned_to&c%5B%5D=updated_on&c%5B%5D=category&c%5B%5D=cf_21&group_by=&t%5B%5D= 
 * Move the entries of this TODO list to the tracker when it makes sense 

 h1. Funding and legal entity 

 See the [[SteeringCommittee]] for more details. 

 h1. Legal advise 

 Contact John Sullivan at the FSF. 

 Note that John Sullivan is not a lawyer but the FSF has lawyers. 

 h1. Documentation  

 The "replicant-infrastructure redmine project":https://redmine.replicant.us/projects/replicant-infrastructure has a "wiki":https://redmine.replicant.us/projects/replicant-infrastructure/wiki with more documentation in it.