CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Operating Systems & Information Services CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Drupal Module Management Jarosław Polok Juraj Sucik Grzegorz Timofiejew 8th April 2011

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Drupal Infrastructure Status ● Hardware – production infrastructure ● 6 frontend systems (12 cores / 32 GB RAM / 1TB disk) ● 2 backend systems ( 6 cores / 24 GB RAM / 6 TB disk) ● Hardware – development infrastructure ● 2 frontend systems (12 cores / 32 GB RAM / 1TB disk) ● 2 backend systems ( 6 cores / 24 GB RAM / 6 TB disk)

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Drupal Infrastructure status ● Software ● Operating system: Scientific Linux CERN 6 (SLC6) ● Apache: ● Php: ● Memcached: ● NFS v4 / tcp ● Shibboleth: ● RH Cluster Suite v. 3 ● Mysql:

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Software setup ● Backend servers ● Database server: master-master mysql replication ● File server: nfs export replicated (synced) ● Ldap server: replicated ● Web dav server: stripped down apache configuration. ● Cluster suite components ● Frontend servers ● Load balancer server: apache with mod_proxy_balancer ● Web server: apache / php / shibboleth / memcached ● Cluster Suite components

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Cluster Suite ● Cluster manages services (load balancer, web servers, nfs server, ldap servers and mysql servers): ● Failed services are automatically restarted or relocated to other cluster members. ● Load balancer can be relocated to any of 6 frontends. ● Web servers work in parallel and are restarted when failed. ● Nfs,ldap,webdav and mysql servers can be relocated to any of 2 backends. ● General ‘health’ of each cluster member is monitored too: a misbehaving cluster member is rebooted automativcally.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Drupal site setup ● Site separation enforced (mod_ruid2): ● Each site is processed as different user id, does not have access to other sites data. ● All sites are running in a chroot’ed environement: no access to underlying operating system. ● Site management : ● Access to site files via secure webdav protocol. ● Access to site database via phpMyAdmin. ● Access to site logfiles (to be implemented...) ● Change: access to site management via (/_site/ path cannot be used by Drupal...) ●

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Drupal CERN integration ● Site management: ● Administrators e-group is defined for each site ● site requester is admin/member of that e-group and can manage it via standard e- groups interface. ● This e-group is mapped onto Administrator Drupal role using shib_auth module ● This e-group is granted site files and database access. ● Additional e-groups can be defined by site administrator(s) and mapped to additional Drupal roles. ● Change: User id 1 will be ‘druadm’ for all sites: shib_auth does not handle user id 1..

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Coming next ● Replacing apache mod_proxy_balancer by Varnish: ● More load balancing flexibility ● Advanced web frontends health checks before routing ● Caching ● Possibility to maintain the service operational even if ALL web frontends and backends experience temporary failure. ● Collaboration with IT/DB database experts to improve our mysql setup.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Coming next ● Testing and testing (and more testing) ● We need to tune the overall performance of the setup. ● And performance of all components too... ● We need to verify all failure scenarios. ● We need to verify system stability under load. ● We need to verify backup/restore functionality. ● We need to verify drupal version / modules upgrade procedures. ●...

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS When will it be ready ? ● Current estimate: ● a month from now. ● In mean time: ● We will change your drupal 7 sites setup in such a way that these can be migrated from old pilot infrastructure when new one becomes available ● Note: this is manual process for us including making some database changes.. there is no automated upgrade path from current shib_auth snapshot we use to the updated one.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Questions ?