1. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Operating Systems & Information Services CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Drupal Module Management Jarosław Polok Juraj Sucik Grzegorz Timofiejew 8th April 2011

2. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Drupal Infrastructure Status ● Hardware – production infrastructure ● 6 frontend systems (12 cores / 32 GB RAM / 1TB disk) ● 2 backend systems ( 6 cores / 24 GB RAM / 6 TB disk) ● Hardware – development infrastructure ● 2 frontend systems (12 cores / 32 GB RAM / 1TB disk) ● 2 backend systems ( 6 cores / 24 GB RAM / 6 TB disk)

3. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Drupal Infrastructure status ● Software ● Operating system: Scientific Linux CERN 6 (SLC6) ● Apache: 2.2.15 ● Php: 5.3.2 ● Memcached: 1.4.4 ● NFS v4 / tcp ● Shibboleth: 2.4.1 ● RH Cluster Suite v. 3 ● Mysql: 5.1.52

4. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Software setup ● Backend servers ● Database server: master-master mysql replication ● File server: nfs export replicated (synced) ● Ldap server: replicated ● Web dav server: stripped down apache configuration. ● Cluster suite components ● Frontend servers ● Load balancer server: apache with mod_proxy_balancer ● Web server: apache / php / shibboleth / memcached ● Cluster Suite components

5. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Cluster Suite ● Cluster manages services (load balancer, web servers, nfs server, ldap servers and mysql servers): ● Failed services are automatically restarted or relocated to other cluster members. ● Load balancer can be relocated to any of 6 frontends. ● Web servers work in parallel and are restarted when failed. ● Nfs,ldap,webdav and mysql servers can be relocated to any of 2 backends. ● General ‘health’ of each cluster member is monitored too: a misbehaving cluster member is rebooted automativcally.

6. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Drupal site setup ● Site separation enforced (mod_ruid2): ● Each site is processed as different user id, does not have access to other sites data. ● All sites are running in a chroot’ed environement: no access to underlying operating system. ● Site management : ● Access to site files via secure webdav protocol. ● Access to site database via phpMyAdmin. ● Access to site logfiles (to be implemented...) ● Change: access to site management via http://cern.ch/SITENAME/_site (/_site/ path cannot be used by Drupal...) http://cern.ch/SITENAME/_site ●

7. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Drupal CERN integration ● Site management: ● Administrators e-group is defined for each site ● site requester is admin/member of that e-group and can manage it via standard e- groups interface. ● This e-group is mapped onto Administrator Drupal role using shib_auth module ● This e-group is granted site files and database access. ● Additional e-groups can be defined by site administrator(s) and mapped to additional Drupal roles. ● Change: User id 1 will be ‘druadm’ for all sites: shib_auth does not handle user id 1..

8. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Coming next ● Replacing apache mod_proxy_balancer by Varnish: ● More load balancing flexibility ● Advanced web frontends health checks before routing ● Caching ● Possibility to maintain the service operational even if ALL web frontends and backends experience temporary failure. ● Collaboration with IT/DB database experts to improve our mysql setup.

9. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Coming next ● Testing and testing (and more testing) ● We need to tune the overall performance of the setup. ● And performance of all components too... ● We need to verify all failure scenarios. ● We need to verify system stability under load. ● We need to verify backup/restore functionality. ● We need to verify drupal version / modules upgrade procedures. ●...

10. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS When will it be ready ? ● Current estimate: ● a month from now. ● In mean time: ● We will change your drupal 7 sites setup in such a way that these can be migrated from old pilot infrastructure when new one becomes available ● Note: this is manual process for us including making some database changes.. there is no automated upgrade path from current shib_auth snapshot we use to the updated one.

11. CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/i t OIS Questions ?