Procedure:WebServicesMigration

This page recollects the procedures involved in the migration from old www to Motion which should make future transitions easier.

NOTE: This need to be redone for the transition to virtual-www.

Key software to have installed

• httpd
  • mod_bw - manual pulldown & install apparently
• mysql - see mysql migration page on DB dump/reupping
• perl and modules
• php
• python
• mailman
• ruby, ruby on rails, passenger phusion [work with Scott Biersdorf]
• openldap
• openssh
• subversion
• moin - drives moinmoin wikis like tau-internal

Filesystems

Web services read data from a mix of local disk (homepage, trac, systems wiki) and site NFS (most dynamic content; Tau portal [Scott Biersdorf] & subversion web access [Chris Hoge] in particular). Those which read from NFS will move essentially without effort once the corresponding service is set up and necessary symlinks reestablished.

The NFS server on newer RH derived distros is setup by autofs. Our standard configuration is to have

/storage /etc/auto.storage --timeout=1200 --ghost

in auto.master and

• users -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,tcp 172.17.202.254:/vol/users
• research -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,tcp 172.17.202.254:/vol/research
• packages -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,tcp 172.17.202.254:/vol/packages/x86_64.rh5

in auto.storage.

Primary links to NFS include:

• /gitroot/ -> /home/users/git/
• /srv/ -> /var/www/
• /svnroot/ -> /home/users/subversion/
• /tracroot/ -> /home/users/trac/

Many links within www services reference these.

Homedirs are set by LDAP; ln -s /storage/users /home/users/ must exist as well, and obviously by extension Storage must be setup in autofs.

See to it that /var/www and /etc/httpd/* are copied verbatim to start with. There appear to be few directory dependencies external to this (old moin wikis in localhost filesystem were either in disuse or taken over by spammers and left behind) but something may of course come up. If enough time elapses and content changes, it may be a good idea to re-copy the website immediately before cutover to the new machine after testing is complete.

Main services on www

httpd: config testing

When testing it is necessary to toy around with the new configuration at a new IP(s) that isn't assigned to the real domain names yet. There is no shortage of redirects among the http configuration files (/etc/httpd/vhosts/*) and when testing a given vhost, one must

• reset the corresponding NameVirtualHost and Listen directives in /etc/httpd/conf/httpd.conf
• check for any aliases, 302s, etc that use domain name and use new testing IPs instead in the relevant vhost configuration files
• rename the VirtualHost opening tag itself with the testing IP

And be equally careful to invert this process when a service is being brought into production on the new machine.

SSL key setup

SSL objects strenuously if you attempt to copy the keys in /etc/pki/tls to the new server. Some day soon I'll document the process to generate the selfsigned ones most https services at the NIC use.

We now have a right'n'proper CA-signed certificate for the Tau portal.

Subversion

Web SVN access is mediated at the bottom of 01-nic-ssl.conf. The repos themselves are named in the noinc/h*conf file.

Trac setup

Trac is the issue-tracking system several NIC projects use. There are a few potential issues setting it up:

• It needs access to the mysql database (which ought therefore be migrated first)
• Trac version available via default centos repos is older than dirt; setup from source likely necessary
• After getting all the modules it wants setup and getting apache to recognize its existence, newer versions may want to update the trac databases; They will give the command to do so.
• This command be run as the user who owns each repo [which lives in /home/users/trac/projects/*]; running it as root will fail.

Mirror

The mirror is essentially harmless. You need to rsync ~150GB of data from the old /srv/mirror to the new /srv/mirror.

The only liable snag is it requires mod_bw be installed since not even a university has infinite bandwidth.