Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] Infrastructure update

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Vlad Glagolev <stealth AT tiberian.ru>
  • To: Source Mage Discussion <sm-discuss AT lists.ibiblio.org>
  • Subject: [SM-Discuss] Infrastructure update
  • Date: Wed, 6 Mar 2019 10:13:31 -0800

Hello mages!

It's been a week since we moved to a new place, and here comes the
update on what's new and what to expect soon.

Location & Server
=================

The server is temporarily moved to Germany, Frankfurt. I'm not sure for
how long it'll be there, but I expect at least 6 months from now.

The server is running SMGL, stable. I hope to get back to security
integration into current stable and long-awaited stable-rc cut soon.

The first will probably come first. The kernel upgrade will follow.

DNS & Networking
================

DNS zone had a major overhaul and cleanup. All records that are no
longer in use were removed, and main A records pointing to all old
servers will hang out for a while.

DNS zone is now also protected with DNSSEC, and all records are signed.

DNS infrastructure is now distributed across multiple regions.

DNS, along with the server is now fully IPv6-ready, so many
cross-server communications happen via IPv6 now where it's preferred.

Mail
====

There were no serious changes to the e-mail system other than security
updates for the software. With a few additions:

- we have a secondary server acting as a relay with extended retry time
(16 days), so no e-mail will be lost in case primary goes down for
extended time (>4 days).
- e-mail infrastructure is now fully IPv6-ready
- we have now proper SPF and DKIM configured, so hopefully we're
rebuilding our credibility in the e-mail space
- some missing aliases were added and are now in sync with our official
information

I've noticed the amount of spam to all my aliases has dropped to like
5% after the switch. There are some simple rules configured and a
greylisting system enabled for very suspicious hosts.

POP3 authentication should work as expected, no changes there. I set up
a limit to 50MB per mailbox, so please make sure you keep it clean and
have retrieval configured [0] if you haven't done so.

I have plans to introduce a basic anti-spam system along with IMAP and
SMTP auth, so we could actually use our @sourcemage.org addresses for
outgoing e-mail as well.

Services
========

All services should work as expected. That includes:

SSH/git: as it was pointed out earlier, the keys for the server have
been changed since it wasn't a transparent server-to-server migration.

The new key fingerprints are:

SHA256:1EIYTbaVx0SAVQZFzFcoF6k0F17ZjEgc5Y8C0HeUnNg (ED25519)
SHA256:+moDJdQUQBWFvyIEL8JaFa5cjqPm0+V9DBOi0+OOfJw (RSA)
SHA256:Rgr4SKm37zevNyugBszf9lDvAov4pLd/zLltfF16Ir4 (ECDSA)

ssh is now protected by sshguard with some strict thresholds, so this
minimizes noisy traffic as well.

Directory org had some changes, but not so much, so everything should
be available under /srv/smgl on the server. Permissions for the 'distro'
user are left intact.

rsync: no changes here, except that many obsolete whitelisted hosts were
dropped. But if you can't connect over rsync and are mirroring as per
[1], please let me know.

bugzilla: no changes, however it might be worth migrating from SQLite
to Postgres for better performance. I'm also working on proper DKIM
handling for the bugs.sourcemage.org subdomain.

Accounts
========

All accounts that haven't touched any repo within the last year didn't
make it to the new installation. However this is pretty much in sync
with what we had after our last server migration. The about page [2] has
been updated as well. If you think you're missing or shouldn't be there,
please let me know.

Backups
=======

It's been a while since we had backups turned on on the server.

But we are in a pretty good shape now, as the most of our code is
distributed (we have code copies for everything at GitHub and BitBucket
syncing daily) and mirrored. In that regard I recently updated our
mirrors page [3].

So for now only weekly full-disk backups.

Monitoring
==========

There's no proactive monitoring atm, other than in-cloud simple metrics
and netdata on the instance itself. However there will be some alerting
implemented in the coming months.

Last, but not least
===================

If you notice any bugs, please ping me here or on IRC.

Thanks.

[0] https://lists.ibiblio.org/sympa/arc/sm-discuss/2016-August/022201.html
[1] http://sourcemage.org/Mirrors/How
[2] http://sourcemage.org/Developers
[3] http://sourcemage.org/Mirrors

--
Vlad Glagolev <stealth AT tiberian.ru>

Attachment: pgpPS1ukt7ye9.pgp
Description: PGP signature



  • [SM-Discuss] Infrastructure update, Vlad Glagolev, 03/06/2019

Archive powered by MHonArc 2.6.24.

Top of Page