Project

General

Profile

NetworkInfrastructure » History » Version 146

dl lud, 08/04/2020 09:59 AM
Some ops were temporary on the #replicant freedone channel.

1 125 dl lud
h1. Network Infrastructure
2 1 Denis 'GNUtoo' Carikli
3 141 dl lud
|_. What |_. Where |_. Access type | Who | Comments |
4
| "Redmine instance":https://redmine.replicant.us |/5. OSUOSL  | Redmine manager | * [[People#Paul-Kocialkowski|Paul Kocialkowski]]
5 1 Denis 'GNUtoo' Carikli
* [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]]
6 102 Denis 'GNUtoo' Carikli
* [[People#Denis-GNUtoo-Carikli|GNUtoo]]
7 1 Denis 'GNUtoo' Carikli
* [[People#Joonas-Kylmälä|Joonas Kylmälä]]
8 141 dl lud
* [[People#Fil-Bergamo|Fil Bergamo]]
9
* [[People#Kurtis-Hanna|Kurtis Hanna]]
10 133 dl lud
* @dllud
11 1 Denis 'GNUtoo' Carikli
* @GrimKriegor
12 141 dl lud
* OSUOSL system administrators | Since we only have one project, OSUOSL put in a redirect from the main page of our Redmine instance to /project/replicant
13 1 Denis 'GNUtoo' Carikli
OSUOSL keeps 2 weeks worth of backups for restoration purposes. |
14 141 dl lud
| "Mailing list":https://lists.osuosl.org/mailman/listinfo/replicant | Mailing list administrator | * [[People#Paul-Kocialkowski|Paul Kocialkowski]]
15
* [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]]
16 1 Denis 'GNUtoo' Carikli
* [[People#Denis-GNUtoo-Carikli|GNUtoo]]
17
* [[People#Kurtis-Hanna|Kurtis Hanna]]
18
* @dllud
19 141 dl lud
* OSUOSL system administrators | OSUOSL keeps 2 weeks worth of backups for restoration purposes. |
20
| "Wordpress instance":https://blog.replicant.us/ | Wordpress administator | * [[People#Paul-Kocialkowski|Paul Kocialkowski]]
21
* [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]]
22 103 Denis 'GNUtoo' Carikli
* [[People#Denis-GNUtoo-Carikli|GNUtoo]]
23 141 dl lud
* [[People#Joonas-Kylmälä|Joonas Kylmälä]]
24
* [[People#Fil-Bergamo|Fil Bergamo]]
25
* [[People#Kurtis-Hanna|Kurtis Hanna]]
26
* @dllud
27
* OSUOSL system administrators
28 110 Denis 'GNUtoo' Carikli
* Add your name here if you have access and want to be mentioned | This instance is auto-updated automatically with the help of a plugin. |
29 141 dl lud
| "Releases":https://ftp-osl.osuosl.org/pub/replicant/ | SSH | * [[People#Paul-Kocialkowski|Paul Kocialkowski]]
30 139 Denis 'GNUtoo' Carikli
* [[People#Wolfgang Wiedmeyer|Wolfgang Wiedmeyer]]
31 1 Denis 'GNUtoo' Carikli
* [[People#Denis-GNUtoo-Carikli|GNUtoo]]
32 142 dl lud
* [[People#Joonas-Kylmälä|Joonas Kylmälä]]
33
* OSUOSL system administrators | We should not use too much space. |
34 141 dl lud
| The replicant.us (mostly-static) front website |\2. None: there is an automatic hook managed by OSUOSL. | * "Source code":https://git.replicant.us/replicant/website/
35
* Patches should be sent to the Replicant mailing list.
36
* There is a jenkins hook with a token to pull and deploy the website source code. |
37 143 dl lud
| "Replicant Source code":https://git.replicant.us/ |/2. Virtual machine at FSF | SSH root access | * [[People#Paul-Kocialkowski|Paul Kocialkowski]]
38 120 Denis 'GNUtoo' Carikli
* [[People#Denis-GNUtoo-Carikli|GNUtoo]]
39 141 dl lud
* [[People#Joonas-Kylmälä|Joonas Kylmälä]]
40 120 Denis 'GNUtoo' Carikli
* Several FSF system administrators
41 52 Denis 'GNUtoo' Carikli
* FSF backup server
42 141 dl lud
* FSF Ansible deployment server | Resources kindly offered by the FSF.
43
The git configuration has [[ReplicantInfrastructure#git-hosting-infrastructure-on-this-machine|some documentation]].
44 38 Denis 'GNUtoo' Carikli
Before handling SSH (root) access to this machine:
45 141 dl lud
* Make sure that the person really needs it.
46 1 Denis 'GNUtoo' Carikli
* Make sure that the person already contributed to Replicant.
47 141 dl lud
* Ask one other person that has SSH access and/or the [[SteeringCommittee]] to also agree on it. |
48 143 dl lud
| [[PrivateContact|Private contact address]] | IMAP access | * [[People#Denis-GNUtoo-Carikli|GNUtoo]]
49 33 Denis 'GNUtoo' Carikli
* [[People#Joonas-Kylmälä|Joonas Kylmälä]]
50 141 dl lud
* [[People#Fil-Bergamo|Fil Bergamo]]
51 105 Denis 'GNUtoo' Carikli
* [[People#Kurtis-Hanna|Kurtis Hanna]]
52 141 dl lud
* @dllud
53
* @GrimKriegor | You can write to the contact address (all the members of [[SteeringCommittee]] receive it) if for some reasons you need to receive it as well. |
54 145 dl lud
|/2. #replicant IRC channel | Freenode | Channel operator | * [[People#Paul-Kocialkowski|Paul Kocialkowski]]
55 106 Denis 'GNUtoo' Carikli
* [[People#Denis-GNUtoo-Carikli|GNUtoo]]
56 146 dl lud
Temporary, op must be given through ChanServ:
57
* -[[People#Joonas-Kylmälä|Joonas Kylmälä]]-
58
* -[[People#Kurtis-Hanna|Kurtis Hanna]]-
59
* -@dllud- | Quiet mode for unregistered users is disabled for the time being. If SPAM comes back use: @/mode #replicant +qe $~a *!*@gateway/web/*@ and @/mode #replicant +qe $~a *!*@gateway/shell/matrix.org/*@ to re-apply it. These commands whitelist users coming through web based IRC clients and via the Matrix.org IRC bridge. |
60 145 dl lud
| OFTC | Channel operator | * [[People#Kurtis-Hanna|Kurtis Hanna]]
61
* @JeremyRand | Bridged with the Freenode channel through the NCBridge bot operated by @JeremyRand |
62 29 Denis 'GNUtoo' Carikli
| The replicant.us domain name | gandi.net | * Web inteface through gandi website
63 141 dl lud
* The DNS entries are configured to use gandi's DNS server | * [[People#Bradley-M-Kuhn|Bradley Kuhn (administrative contact)]]: Can do everything (including designating the technical contact or transferring the domain) 
64 30 Denis 'GNUtoo' Carikli
* [[People#Denis-GNUtoo-Carikli|GNUtoo (technical contact)]]: can do DNS zone changes
65 16 Denis 'GNUtoo' Carikli
* Other people? [[People#Paul-Kocialkowski|Paul Kocialkowski]]? | |
66 13 Denis 'GNUtoo' Carikli
| The replicant.us TLS certificate | Let's Encrypt | Access probably by controlling the respective domain name | * https://www.replicant.us: OSUOSL
67 7 Denis 'GNUtoo' Carikli
* https://blog.replicant.us: OSUOSL
68 16 Denis 'GNUtoo' Carikli
* https://redmine.replicant.us: OSUOSL
69 19 Denis 'GNUtoo' Carikli
* https://git.replicant.us: ? | History: CA-cert -> GlobalSign -> LetsEncrypt |
70 56 Denis 'GNUtoo' Carikli
71
h2. OSUOSL
72 92 Denis 'GNUtoo' Carikli
73 144 dl lud
The OSUOSL is the "Oregon State University Open Source Lab":https://osuosl.org/.
74 130 Denis 'GNUtoo' Carikli
75 1 Denis 'GNUtoo' Carikli
Contact:
76 129 Denis 'GNUtoo' Carikli
* They can be contacted on #osuosl on the Freenode IRC network
77 1 Denis 'GNUtoo' Carikli
* They also have a 'support' mail address at osuosl.org
78 66 Denis 'GNUtoo' Carikli
79 75 Denis 'GNUtoo' Carikli
h2. Virtual machine in FSF's infrastructure
80 76 Denis 'GNUtoo' Carikli
81
* The virtual machine is hosted in a server that is in their office or in a datacenter.
82 75 Denis 'GNUtoo' Carikli
* Several FSF network administrator also have access to the virtual machine
83 66 Denis 'GNUtoo' Carikli
84 67 Denis 'GNUtoo' Carikli
Contact:
85 69 Denis 'GNUtoo' Carikli
* The 'sysadmin' mail address at gnu.org
86 66 Denis 'GNUtoo' Carikli
* The FSF system administrators can also be contacted on #fsfsys on the Freenode IRC network for more urgent matters
87
88
h3. Virtual machine specifications
89
90 1 Denis 'GNUtoo' Carikli
The virtual machine runs on top of Xen and has:
91 69 Denis 'GNUtoo' Carikli
* About 3G of RAM
92
* 1 virtual core
93 93 Denis 'GNUtoo' Carikli
* a 10G rootfs partition
94 72 Denis 'GNUtoo' Carikli
* a 100G storage partition for Replicant git repositories
95
* One IPv4 and one IPv6
96 66 Denis 'GNUtoo' Carikli
97
Software:
98 68 Denis 'GNUtoo' Carikli
* Trisquel 8.0
99 89 Denis 'GNUtoo' Carikli
* The virtual machine may be using FAI and cfengine but it would need more investigation on that.
100 62 Denis 'GNUtoo' Carikli
* The distribution seem to have the latest security updates applies. How it does it needs to be investigated by looking at cron jobs (it might use FAI for that).
101
102
h3. Virtual machine backup policies
103
104
The virtual machine is backed up daily. The backup procedure excludes the following path at the time of writing:
105
<pre>
106
/dev
107
/proc
108
/tmp
109
/sys
110
/run
111
/mnt
112
/mnt0
113
/mnt1
114
/mnt2
115
/mnt3
116
/mnt4
117
/mnt5
118
/mnt6
119
/mnt7
120
/mnt8
121
/mnt9
122
/floppy/
123
/cdrom/
124
/media/
125
/net/
126
/var/spool/squid/
127
/var/spool/squid3/
128
/var/spool/squid3_bak/
129
/var/spool/squid-tbd/
130
/var/spool/squid*/
131
/var/spool/django/
132
/var/spool/exim/
133
/var/cache/
134
/srv/chroot/
135
/t
136 44 Denis 'GNUtoo' Carikli
/srv/to-tape
137 81 Denis 'GNUtoo' Carikli
/var/lib/ceph/osd/
138 80 Denis 'GNUtoo' Carikli
/var/lib/apt/lists/
139
/var/cache/apt/
140
</pre>
141
142 1 Denis 'GNUtoo' Carikli
h3. git hosting infrastructure on this machine
143
144 80 Denis 'GNUtoo' Carikli
The source code is in /srv/git/git-data/repositories and is divided in several groups:
145 115 Denis 'GNUtoo' Carikli
** Replicant source code
146 116 Denis 'GNUtoo' Carikli
** LineageOS mirror
147 82 Denis 'GNUtoo' Carikli
** AOSP mirror
148 84 Denis 'GNUtoo' Carikli
** Various developers repositories
149 116 Denis 'GNUtoo' Carikli
150 115 Denis 'GNUtoo' Carikli
|_. function |_. software |_. documentation |_. comments |
151 82 Denis 'GNUtoo' Carikli
| authorization | gitolite | [[UpstrreamSourceCodeMirrors]] | |
152 79 Denis 'GNUtoo' Carikli
| read access | * git:// -> git daemon
153 1 Denis 'GNUtoo' Carikli
* ssh:// -> ssh daemon
154
* https:// -> ? (TODO: document the software/configuration) | | |
155 46 Denis 'GNUtoo' Carikli
| web | cgit | [[Cgit]]| |
156 79 Denis 'GNUtoo' Carikli
157 46 Denis 'GNUtoo' Carikli
h2. Gandi
158 126 Denis 'GNUtoo' Carikli
159
* See https://en.wikipedia.org/wiki/Gandi for more details
160
161
h2. Freenode
162 79 Denis 'GNUtoo' Carikli
163 47 Denis 'GNUtoo' Carikli
h2. GDPR
164 1 Denis 'GNUtoo' Carikli
165 47 Denis 'GNUtoo' Carikli
* For GDPR related inquiries, you can write to the [[PrivateContact]] mail address.
166 1 Denis 'GNUtoo' Carikli
167 47 Denis 'GNUtoo' Carikli
h2. TODO:
168 50 Denis 'GNUtoo' Carikli
169 48 Denis 'GNUtoo' Carikli
* Ask the OSUOSL about backup policies.
170 55 Denis 'GNUtoo' Carikli
* Document public spaces like Freenode IRC channel.
171 54 Denis 'GNUtoo' Carikli
* Do our own backup policies and do some backups ourselves.
172 77 Denis 'GNUtoo' Carikli
* Contact the people that have some control of the resources above and ask for permission to mention them here
173
* Fill the gaps (mentioned with '?') in this page
174 78 Denis 'GNUtoo' Carikli
* Look what happens when an account is deleted
175 99 Denis 'GNUtoo' Carikli
* Fix the related issues in the "tracker":https://redmine.replicant.us/projects/replicant/issues?utf8=%E2%9C%93&set_filter=1&f%5B%5D=status_id&op%5Bstatus_id%5D=o&f%5B%5D=category_id&op%5Bcategory_id%5D=%3D&v%5Bcategory_id%5D%5B%5D=57&f%5B%5D=&c%5B%5D=tracker&c%5B%5D=status&c%5B%5D=priority&c%5B%5D=subject&c%5B%5D=assigned_to&c%5B%5D=updated_on&c%5B%5D=category&c%5B%5D=cf_21&group_by=&t%5B%5D=
176 94 Denis 'GNUtoo' Carikli
* Move the entries of this TODO list to the tracker when it makes sense
177
178
h1. Funding and legal entity
179
180
See the [[SteeringCommittee]] for more details.
181
182 135 Denis 'GNUtoo' Carikli
h1. Legal advise
183
184
Contact John Sullivan at the FSF.
185 136 Denis 'GNUtoo' Carikli
186 1 Denis 'GNUtoo' Carikli
Note that John Sullivan is not a lawyer but the FSF has lawyers.
187
188
h1. Documentation 
189
190
The "replicant-infrastructure redmine project":https://redmine.replicant.us/projects/replicant-infrastructure has a "wiki":https://redmine.replicant.us/projects/replicant-infrastructure/wiki with more documentation in it.