Deployment
For our first effort, we will set up 3 machines as shown in the diagram above.
We expect that we'll have to do some experimenting to get these "right".
Once we are happy with these 3 VMs and the "application",
we plan to clone the VMs to create a QA, and a PROD environment.
...
| Table of Contents |
|---|
...
Diagram - Single Environment
...
...
RAM (GB)
...
| web | db | geo | total |
|---|---|---|---|---|
DEV | 3 | 4 | 5 | 12 |
QA | 4 | 8 | 8 | 20 |
PROD | 4 | 8 | 8 | 20 |
TOTAL | 48 |
...
DISK (GB)
...
| web | db | geo | total |
|---|---|---|---|---|
DEV | 10 GB | 32GB | 200GB | 242GB |
QA | 10 GB | 32GB | 200GB | 242GB |
PROD | 10 GB | 32GB | 200GB | 242GB |
...
failover
...
Application failover must be achieved within 2-4 hours and proceeds several ways depending on the nature of the failure. Here we discuss fail-over only in the context of lost connectivity to the data center with an uncertain time to restore operations at that datacenter. When there is a configuration change, either at the VM level or at the application level, we clone the entire application and store it offsite (at the city?).
Should the datacenter fail badly (fire, etc), we provide carinet with the VMsapplication,
and carinet brings up the VMs application at another location. Note that we handle DB backups separately.Carinet, please review this section.
...
portibility
...
We plan to move these VMs the application to our datacenter data center by midyear 2011.
We want to insure that these VMs are potable.
the application is portable. The chips in our data center will be Intel Xeon. We expect to do a simple VM copy (or similar) and do not need v-motion.
Carinet Responsibilities
- Provision hardware
- Provide 3 VMs using barebones
VMWare version x.x (todo - need version number) - install Centos 5 64 bit on each VM
- install Apache web server on the web server VM
- install package manager (yum or Apt-get)
All other software will be installed by city employees.
Security
We assume the following.
- The data center is physically secure.
- VMware installation has latest kernel updates/patches
Please let us know if any of these assumptions is incorrect.
Does this all seem right?
...
vm admin
...
We're planning to use VMware vSphere Essentials Kits to manage the VMs. This will be a Carinet responsibility to setup the Essential Kits on all VMs, SFGov should be able to connect to the VMs remotely via vSphere Client.
...
SE Linux
...
Do not enable SE Linux.
...
SSH Access
...
All VMs shall be accessible via ssh.
The city will provide public keys for those that will have linux root access.
...
linux services
...
All services shall be disabled unless otherwise requested.
The Specifically, the following shall be disabled:
- NFS
- FTP
- incoming mail
The And the following shall be enabled.
- outgoing mail
- SSH
- firewall (see below)
...
Firewall Configuration
...
Web Server VM
Allow access from
- ssh
- port 80
Geo Server VM
Allow access from
- ssh
- port 8080 from web server
DB Server VM
Allow access from
- ssh
- port 5432 from web server
- port 5432 from geo server
...
TCP Wrapper
...
Can we restrict port level access?
- web
- Allow request from all host on port 80
- Allow ssh request from all
- Deny requests on all other ports
- geo
- Allow request from web server on port 8080
- Allow ssh request from all
- Deny request from all other host on port 8080
- db
- Allow request from web & geo server on port 5432
- Allow ssh request from all
- Deny request from all other host on port 5432
SFGov Responsibilites
...
Install application software including the following.
...
You will need to see the SVN readme for all the excruciating details.
Geoserver
- java virutal machine
- tomcat
Database
- GEOS
- proj4
- postresql with postgis
Web Server
- gdal
- python
- django
- geo-django
...
linux admin
...
- set up appropriate new linux users
- Password & Access security
- use of public/private keys
- limit root access
- use sudo as needed
- provide file system security
- umask settings
- setting up appropriate file permissions
Tests
Test the following application/server connection pairs via SSH tunnel
- browser/geoserver - localhost:8080
- pgadmin/database- localhost:5432
...
firewall
...
Allow access only as specified in the deployment diagram.