Investigate needs to make the Curator Virtual Environment a production service

datadryad / dryad-product-roadmap

Repository of issues for Dryad project boards

https://github.com/orgs/datadryad/projects

8 stars 0 forks source link

Investigate needs to make the Curator Virtual Environment a production service #1690

Closed ryscher closed 2 years ago

ryscher commented 2 years ago

Dryad has a number of curators, who are distributed around the country, and typically spend 1-3 years with the organization. It is not feasible to purchase and configure high-end computers for every curator, including installing a large number of specialized software packages. Instead, we decided to provide a centralized system, which the curators could use via remote desktop. After a successful pilot, we want to transition this to a more production-level service.

The current system is running Windows Server 2022 on an EC2 machine. It has 2TB of disk, and an array of pre-installed software that helps the curators perform their job.

The tickets for our pilot project were: https://github.com/CDL-Dryad/dryad-product-roadmap/issues/1356 https://github.com/CDL-Dryad/dryad-product-roadmap/issues/1462

Other than regular backups and assigning a DNS name, what steps would be beneficial for this service?

ryscher commented 2 years ago

Would be nice to remove the warning about security certificates when connecting to the server.

marisastrong commented 2 years ago

UC3 to schedule a consult with IAS on managing the Dryad Curator VE as a production service.

Data Lifecycle Management for backups; currently snapshots are retained weekly and retain 4 versions
Can/should we assign a domain to this machine? datadryad.org is owned by CDL
other considerations maintaining as part of Dryad's essential/production infrastructure

martinhaye commented 2 years ago

One thing I wanted to ask about in the meeting when we ran out of time is: passwords. Who sets them, and what are the requirements? Since this is a host with RDP port open to the world, including to lots of miscreants, I'd want to ensure that every password is long. But I don't know about how AWS and RDP work -- maybe they already take care of making long passwords for you.

marisastrong commented 2 years ago

Met with IAS May 3 Takeaways:

Consider AppStream for delivering software; maybe not necesary
Snapshots are done weekly, managed by AWS
Establish best practices for curators to manage datasets/storage on the virtual server; it will fill up at some point
S3 to offload datasets you’re not sure need to be used
Ensure auto-patching is being done to keep software up to date
Suggestion to create powershell scripts to script out installation of server vs just documentation
Ensure you have what you need to recover if need arises

ryscher commented 2 years ago

Other takeaways:

Upgrade storage to type 'gp3'
Upgrade underlying machine to 't3.large'
Plan for regular upgrades of the underlying hardware
Review settings for password complexity/length