Skip to content

Commit

Permalink
update webserver description to what it really is today
Browse files Browse the repository at this point in the history
  • Loading branch information
evgeni committed Dec 18, 2024
1 parent 2ea6022 commit af20e93
Showing 1 changed file with 8 additions and 22 deletions.
30 changes: 8 additions & 22 deletions docs/webserver.md
Original file line number Diff line number Diff line change
@@ -1,35 +1,27 @@
# Webserver

| | web01.osuosl.theforeman.org |
| | website01.osuosl.theforeman.org |
| - | - |
| type | OpenStack VM |
| OS | CentOS 7 |
| OS | CentOS Stream 9 |
| CPUs | 2 |
| RAM | 4GB |
| Storage | /dev/sda (30GB): root, /dev/sdb (150GB): data (LVM), /dev/sdc (50G): data (LVM) |
| Managed by | [web.pp](https://github.com/theforeman/foreman-infra/blob/master/puppet/modules/profiles/manifests/web.pp) |
| Storage | /dev/sda (30GB): root, /dev/sdb (30GB): data (LVM) |
| Managed by | [website.pp](https://github.com/theforeman/foreman-infra/blob/master/puppet/modules/profiles/manifests/website.pp) |

## Domains

These domains are all hosted on the webserver.

* theforeman.org, www.theforeman.org
* deb.theforeman.org
* downloads.theforeman.org
* stagingdeb.theforeman.org
* yum.theforeman.org
* stagingyum.theforeman.org
* rsync.theforeman.org

### Fastly CDN

A Fastly CDN exists that sits in front of:

* deb.theforeman.org
* theforeman.org, www.theforeman.org
* downloads.theforeman.org
* stagingdeb.theforeman.org
* yum.theforeman.org
* stagingyum.theforeman.org

For these, the webserver acts as a backend while the content is served from the Fastly CDN to users.

Expand All @@ -39,8 +31,8 @@ The Fastly configuration happens through the `ansible/fastly.yml` Ansible playbo

The major points of the configuration are:

* Set the backend to `web02.theforeman.org`
* Enable shielding: a central system fetches the assets and then distributes them across the CDN instead of each CDN node fetches them itself, this costs more CDN traffic, but less traffic for web02 which is more expensive
* Set the backend to `<vhost>-backend.website01.osuosl.theforeman.org`
* Enable shielding: a central system fetches the assets and then distributes them across the CDN instead of each CDN node fetches them itself, this costs more CDN traffic, but is usually faster
* Configure a health-check and serve stale content when it fails

#### TLS
Expand All @@ -57,7 +49,7 @@ Alternatively one can use `p2.shared.global.fastly.net` for an IPv4-only setup.

## Volumes

/var/www is mounted on a separate 140GB block device. /var/www/freight* contain the staging areas for freight (deb), and /var/www/vhosts contain the web roots themselves.
/var/www is mounted on a separate 30GB block device. /var/www/vhosts contain the web roots themselves.

## Firewall

Expand All @@ -66,9 +58,3 @@ There is no firewall on the machine itself. OpenStack has the following ports op
* 22/tcp (SSH)
* 80/tcp (HTTP)
* 443/tcp (HTTPS)
* 873/tcp, 873/udp (rsync)

## Other

* freight and freightstage users have private auto-signing GPG key imported manually (non-puppetized)
* In case of maintenance, a template page and config file snippet are under /var/www/503. The config should be copied into each vhost.

0 comments on commit af20e93

Please sign in to comment.