Skip to content

Commit

Permalink
update webserver description to what it really is today
Browse files Browse the repository at this point in the history
  • Loading branch information
evgeni authored and ekohl committed Dec 20, 2024
1 parent 7292ad7 commit 4995ed0
Showing 1 changed file with 8 additions and 22 deletions.
30 changes: 8 additions & 22 deletions docs/webserver.md
Original file line number Diff line number Diff line change
@@ -1,35 +1,27 @@
# Webserver

| | web01.osuosl.theforeman.org |
| | website01.osuosl.theforeman.org |
| - | - |
| type | OpenStack VM |
| OS | CentOS 7 |
| OS | CentOS Stream 9 |
| CPUs | 2 |
| RAM | 4GB |
| Storage | /dev/sda (30GB): root, /dev/sdb (150GB): data (LVM), /dev/sdc (50G): data (LVM) |
| Managed by | [web.pp](https://github.com/theforeman/foreman-infra/blob/master/puppet/modules/profiles/manifests/web.pp) |
| Storage | /dev/sda (30GB): root, /dev/sdb (30GB): data (LVM) |
| Managed by | [website.pp](https://github.com/theforeman/foreman-infra/blob/master/puppet/modules/profiles/manifests/website.pp) |

## Domains

These domains are all hosted on the webserver.

* theforeman.org, www.theforeman.org
* deb.theforeman.org
* downloads.theforeman.org
* stagingdeb.theforeman.org
* yum.theforeman.org
* stagingyum.theforeman.org
* rsync.theforeman.org

### Fastly CDN

A Fastly CDN exists that sits in front of:

* deb.theforeman.org
* theforeman.org, www.theforeman.org
* downloads.theforeman.org
* stagingdeb.theforeman.org
* yum.theforeman.org
* stagingyum.theforeman.org

For these, the webserver acts as a backend while the content is served from the Fastly CDN to users.

Expand All @@ -39,8 +31,8 @@ The Fastly configuration happens through the `ansible/fastly.yml` Ansible playbo

The major points of the configuration are:

* Set the backend to `web02.theforeman.org`
* Enable shielding: a central system fetches the assets and then distributes them across the CDN instead of each CDN node fetches them itself, this costs more CDN traffic, but less traffic for web02 which is more expensive
* Set the backend to `<vhost>-backend.website01.osuosl.theforeman.org`
* Enable shielding: a central system fetches the assets and then distributes them across the CDN instead of each CDN node fetches them itself, this costs more CDN traffic, but is usually faster
* Configure a health-check and serve stale content when it fails

#### TLS
Expand All @@ -57,7 +49,7 @@ Alternatively one can use `p2.shared.global.fastly.net` for an IPv4-only setup.

## Volumes

/var/www is mounted on a separate 140GB block device. /var/www/freight* contain the staging areas for freight (deb), and /var/www/vhosts contain the web roots themselves.
`/var/www` is mounted on a separate block device. `/var/www/vhosts` contains the web roots themselves.

## Firewall

Expand All @@ -66,9 +58,3 @@ There is no firewall on the machine itself. OpenStack has the following ports op
* 22/tcp (SSH)
* 80/tcp (HTTP)
* 443/tcp (HTTPS)
* 873/tcp, 873/udp (rsync)

## Other

* freight and freightstage users have private auto-signing GPG key imported manually (non-puppetized)
* In case of maintenance, a template page and config file snippet are under /var/www/503. The config should be copied into each vhost.

0 comments on commit 4995ed0

Please sign in to comment.