Automagically configure, deploy, and host the Canvas LMS on everything from a simple local virtual machine instance to a horizontally scaling, fault-tolerant, load balanced private cloud.
All examples use a small cloud size. Be sure to adjust your commands based upon your own implementation size.
Copy your public SSH key to a new server (typically the first playbook run against any host):
$ ansible-playbook -i small_production util_copy_ssh_id.yml \
> --user=username --limit=hostname \
> --ask-pass --ask-sudo-pass
Configure and deploy all production hosts:
$ ansible-playbook -i small_production small.yml
Configure and deploy all test hosts:
$ ansible-playbook -i small_test small.yml
Configure and deploy all development hosts:
$ ansible-playbook -i small_development small.yml
Configure and deploy just production application hosts:
$ ansible-playbook -i small_production host_application.yml
Configure and deploy just production application hosts while only running ruby based tasks:
$ ansible-playbook -i small_production host_application.yml --tags=ruby
Make Canvas unavailable to perform maintenance:
$ ansible-playbook -i small_production util_make_canvas_unavailable.yml
Make Canvas available after performing maintenance:
$ ansible-playbook -i small_production util_make_canvas_available.yml
Perform apt maintenance on all production hosts:
$ ansible-playbook -i small_production util_perform_apt_upgrade.yml
Perform apt maintenance on all production hosts without rebooting:
$ ansible-playbook -i small_production util_perform_apt_upgrade.yml --skip-tags=reboot
Perform apt maintenance on all production application hosts:
$ ansible-playbook -i small_production util_perform_apt_upgrade.yml --limit=application
All publicly available ports/protocols have IP based rate-limiting to help mitigate abuse and attacks (e.g. if you ping more than once per second, your requests would be dropped). For details, check out the iptables rules template.
Co-Hosts:
All ports and protocols are open. Co-host IP addresses are automatically discovered via the Ansible inventory. This is enforced via iptables rules for all hosts.
Administrators:
All ports and protocols are open. If your IP address is explicitly defined in group_vars, you are considered an administrator. This is enforced via iptables rules for all hosts.
Public:
ICMP echo requests are allowed to all hosts. TCP port 22 is open on all hosts. However, only SSH key authentication is allowed which is enforced via sshd_config. TCP ports 80 and 443 are open on proxy hosts and are the only ports intended for public consumption.
Horizontal scaling concepts are used heavily (e.g. numerous servers per role, ability to dynamic add servers per role, load balancing per role, removing single points of failure per role, etc). With this in mind, we specifically target servers with roughly the following specifications:
CPU: Intel Xeon E3/E5/E7 (e.g. E3-1230v3, E5-1620v2)
DISK: Intel SSDs or 10k enterprise-level SATA HDDs in RAID 1/10
RAM 32 GB ECC
NIC: 1 Gbps (preferably dual)
IPv4: 1 public
These types of servers can be custom built cost-effectively (i.e. $1,200) and leased in large quantities cost-effectively (e.g. ~$120/month at OVH).
Ansible installed locally and one or more Ubuntu 14.04 LTS hosts with:
The MIT License (MIT)
Copyright (c) 2014 Rocky Madden (http://rockymadden.com/)
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.