Deployment scripts

[marksteward]

For Gauss, emfcamp-test, badgeserver, wiki-archive, etc.

Also put wiki-archive somewhere.

[marksteward]

apt, runit, nginx, memcached, postgres (incl users), php-fpm, set sysstat cron to 1 minute

Can we run mediawiki on nginx?

[marksteward]

To help plan how to split the servers, we need something like the following roles:

• web main: dedicated production site, manages payments and auth for cfp/volunteering
• web other: other production apps like badge or CfP. Should be separate, especially if we're concerned about their security
• map: read only tile server and frontend
• orga wiki: dokuwiki instance with limited write access
• wiki: mediawiki instance with open access
• badge wiki: media instance with open access
• monitoring: grafana or similar to help keep an eye on all this stuff. We may be able to share with NOC, although they'll want to move monitoring onsite during the event.
• wiki archive: low security read-only mediawiki instances, one per event. Ideally rebuilt regularly from git/docker hub
• web staging: low security box that runs main and other apps (sometimes in debug mode, sometimes out of date)

Current role assignment:

gauss: web main, map lorentz: wiki, badge wiki, wiki archive, web staging (if we disable debug mode) unassigned: monitoring, orga wiki, web other

[davidc]

suggest:

gauss (web site only): web main lorentz (public web sites): web other, wiki, badge wiki, wiki archive, map (possibly split lorentz in two? wiki-stuff and non-wiki stuff) voigt (orga web sites): orga wiki, piratepad/equivalent faraday: puppet, monitoring

Or, we may want to separate ns1 and mail from the website but this may be easier done by moving the website as others are configured to slave off gauss - so a new vm for website only, then leave gauss doing mail and ns1.

We also need to audit the accounts on gauss etc and remove any no longer required. Going forward after that, add/remove accounts should be done via puppet.

[russss]

I am happy to keep map/mail/ns1 on the same host as www for the foreseeable future. They don't have a particularly significant performance/security impact.