A guide to migrating your services to navajos and bog.

{{{#!wiki note
This document refers to the new shell server, bog, but bog has not yet been created. This note will disappear once it has.
}}}

<<TableOfContents>>

== Explanation of New Machines ==

Our current machines are hopelessly obsolete, in particular mire. Members may have noticed their sites running slowly for the last few months, things like php are so out of date modern software no longer works, and there are so many warts in the setup upgrading to a newer Debian is impossible.

And so, using fritz's virtualization capabilities, we've created new KernelVirtualMachine``s running Debian squeeze on 64-bit x86 and with access to roughly four times the processing power as mire.

We've also closed one of our biggest security flaws: the new servers restore the FirewallRules system we had before migrating to Peer1. This means all incoming and outgoing traffic is blocked by default, with access only granted as requested (don't worry, firewall exceptions are granted liberally; the main goal is to prevent malicious outsiders from gaining access via an exploited web service).

Because of openafs and kerberos, this isn't really a "migration": all accounts and data are available automatically on the new nodes. This time around all you have to do is flip a few domtool flags to serve your sites with the new server, and ssh into a different host for shell access. Except for the 32-bit to 64-bit architecture change and newer software, it's the same environment you're used to.

== Firewall ==

With the restrictive firewall in place, you will have to request rules if you need to access Internet resources from your cgi programs, or want to use irc or similar from bog.

FirewallRules

== Moving Web Sites ==

Static web sites will work on navajos without any special effort.

Don't be surprised if any CGI programs do not run as expected initially; the new systems have not had many packages installed, and so you will probably have to [[https://members.hcoop.net/portal/apt?node=3|request packages]] on node `navajos`.

Examining your log files using `domtool-tail` should reveal the missing software (see the [[MemberManual/ServingWebsites#Examiningyourlogs|member manual for more information]]). If you still can't figure it out, please file a bug under "Misc UNIX" requesting assistance.

=== Easy Domain Users ===

If you are using the `dom` (Easy Domain) type, trying out the new web server is easy.

To test that your site will work, you can add an empty `webAt` action, which will use the same configuration as your default domain. If you are setting the `WWW` environment variable you must also add a couple of lines to include that configuration. Likewise, you can simply copy and paste any `web` directives as `webAt "navajos" "TESTSUBDOMAIN"` to test if they work.

{{{
dom "yourdomain" where
   ...
with
   ...
   webAt "navajos" "TESTSUBDOMAIN"
      with
        (* The following lines are only needed if you set the WWW environment variable to customize the default vhost *)
        www : [Vhost] <- WWW;
        www
      end;
end
}}}


After you've ensured that things are working (or if you like to jump off of cliffs for fun), set `DefaultWebNode = "navajos"` in your `dom` config to migrate everything. Note that it may take up to 36 hours for the dns changes to propagate. You may also change calls to `web` into `webAt "mire"` if you need to run part of your website on mire temporarily (if you are using e.g. php4 scripts, 32-bit proxied server binaries, postgresql 8.1).

{{{
dom "yourdomain" where
   ...
   DefaultWebNode = "navajos";
with
   ...
   (* To keep a particular subdomain on mire *)
   webAt "mire" "SUBDOMAIN" where ... with ... end;
end;
}}}

=== Low-level domain users ===

You're on your own ;-)

=== Proxied Servers ===

Proxied servers must be run on bog. Request ProxiedServer firewall rule. Cron permissions for starting at reboot.

If you are running your own instance of Apache on mire, please file a bug report explaining why you are doing so. If it's just to run a newer version than available on mire, you can probably just switch to the system-wide version. If you need modules or directives not supported by DomTool, any that can be supported securely will be added during migration.

=== PHP ===

If you are using php4, you must upgrade to php5. 

== Databases ==

MySQL users should not need to do anything.

Postgres users will need to dump their databases and upgrade to 9.1. New dbtool "database" `postgres-9.1`. If any trouble is encountered, file a bug under SQL DBs.

== Using the New Shell Server ==

Just `ssh $user@bog.hcoop.net`

== HCoop Services ==

Document temporary squirrelmail/roundcube addresses