Giter Site home page Giter Site logo

fititnt / ap-application-load-balancer Goto Github PK

View Code? Open in Web Editor NEW
1.0 2.0 0.0 779 KB

AP Application Load Balancer (AP-ALB). Sophisticated monolithic Ansible role to manage standalone and clusters of cross-platform and multicloud load balancers. Abstract HAProxy + OpenResty + On-the-fly auto HTTPS. Dedicated to Public Domain.

Home Page: https://ap-application-load-balancer.etica.ai/

License: The Unlicense

Shell 32.59% Lua 48.12% Python 19.29%
application-load-balancer ansible-role load-balancer letsencrypt

ap-application-load-balancer's Introduction

AP Application Load Balancer - v0.9.0-beta

GitHub: fititnt/ap-application-load-balancer Website: ap-application-load-balancer.etica.ai

AP-ALB is not a single software, but Infrastructure As Code via Ansible Role to automate creation and maintance of with features common on expensive Application Load Balancer of some cloud providers (e.g. Alibaba, AWS, Azure, GCloud, IBM, etc). It can be used both to create your own ALB on cheaper hardware on these same cloud providers or have your own ALB on any other provider of VPSs or bare metal servers. And yes, it handle automatic HTTPS for you on-the-fly even for clusters of ALBs, like enterprise versions of Traefik or Caddyserver.

AP-ALB is flexible: you can either use dedicated very small VPSs with the role of load balancing to another services or replace your Apache/NGinx/HAproxy in each server with AP-ALB. Consider around just 64MB of RAM per node as baseline. (So, if you are deployng in a dedicated 1GB VPS, consider at least reuse the same node puting behind the AP-ALB one Varnish-Cache!)

New on v0.8: in addition to the single-node setup, you can now deploy 3-node High Available AP-ALB Cluster using Consul instead of local filesystem. We recommend using the Ansible Role brianshumate.consul for setup and manangement of Consul component. Examples can be found at fititnt/ansible-linux-ha-cluster.

asciicast

Source code for this demo at https://github.com/fititnt/ansible-linux-ha-cluster/releases/tag/demo-003-ap-alb-v0.8.7-beta. The roles brianshumate.consul: v2.5.3, 2019-11-14 and githubixx.ansible_role_wireguard: v4.1.1, 2019-11-11 are not part of AP-ALB, but are used to show a demo of a cross-platform cluster.

The Solution Stack of AP-ALB

One line emoji explanation:

☺️ 🤖 🔚 UFW (:1-65535) 🔚 HAProxy (:80, :443) 🔚 OpenResty (:8080, :4443 🔒) 🔚 App

See Advanced usage.

AP-ALB Goals

Content moved to docs/goals/index.md.

AP-ALB Non-Goals

Content moved to docs/goals/index.md.

Quickstart Guide

The minimum you already should know to use AP-ALB

Note: this guide assumes that you at least

  1. Have Ansible installed on some computer
    1. https://docs.ansible.com: Installation Guide
    2. Tip: if is your first time with Ansible, this computer is likely to be own computer and NOT the server where you want to install ALB
  2. Have at least one VPS or Bare metal VPS that can be controlled by your installation Ansible
  3. Have basic knowledge on how to use Ansible Playbooks
    1. https://docs.ansible.com: Working With Playbooks
    2. Hint: ap-application-load-balancer can be imported as a Ansible Role, but it is not released on Ansible Galaxy (it means you can copy some version of AP-ALB and place on sub-folder roles/ap-application-load-balancer)

Complete examples using AP-ALB

Quickstart on how to hotfix/debug production servers

See debugging-quickstart.md.

ALB components

Content moved to docs/component/index.md.

Advanced usage

Lua

Lua is fantastic language! Is actually easier to lean Lua and implement some advanced rules than push Apache/Nginx configurations too much.

Tip: you very likely will use Lua 5.1, because is the supported version of LuaJIT (it means is faster and with more support).

ALB Internals

See ALB Internals (working draft).

Risk mitigation

"Layered security, also known as layered defense, describes the practice of combining multiple mitigating security controls to protect resources and data." — Layered security on Wikipedia

AP-ALB, as one Infrastructure as Code way to implement a single or a clustered servers to work as Application Load Balancers, is designed to work with aceptable risks without rely on some features that are not available on very cheap VPSs without enterprise features (like private networking, extra disks, snapshots) and still relatively sysadmin (user) friendly for what it is really doing. By extension, this also means it will work with mixed setups (e.g. some VPSs could be on expensive AWS, while others on other cloud providers, like Azure, or cheaper but very good ones, like Contabo).

Still use passwords for intra-cluster communications (We're looking at you, Redis, MongoDB...)

TL;DR: if a software support autentication with AP-ALB you SHOULD implement this layer of defence even if and 80% of guides on internet teach how to use without. This is not a strong requeriment if you is using AP-ALB inside the same region of cloud provider with support for private networking or you implement IPSec/OpenVPN, but even on this cases still better already have your services ready to expand and avoid human error with future misconfigurations.

Some softwares in special (like Redis and MongoDB) tend to have friendly guides that will work securely (securely as "from outside attacks, not from errors inside your network") without need of authentication. There are so many things that can go wrong that the overhead of performance the need of authentication and extra steps on your scripts are not plausible excuses.

Even if the AP-ALB does not manange your service on another VPS, you may eventually want to use HAProxy to load balance a service that is not on localhost, but on that VPS. And the easyers ways to do this are likely to go charlie-foxtrot.

Should you use private networkig from my cloud provider? Should you implement IPSec/OpenVPN?

TL;DR: not required, but is a good idea if you can.

If some of your hosts are on a cloud provider that you already have option to have extra firewalls or private networking inside the VPSs on that region, yes that's a good idea. You already paid, use it.

About implement IPSec/OpenVPN or equivalent to do Software-Defined Networking, it's up to you, but since it can be not trivial to implement, we try to not depent on this implementation. As ALB v0.8.0-alpha we do not have Components to automate creation of private network, but you could still use the Shared options or do the initial setup without Ansible automation.

Prefer guides that assume security requirements for geo-distributed applications

TL;DR: This last topic on Risk mitigation is for where you can find relevant information.

Do not assume same level of security of private networking and same datacenter: the averange guide on internet (in special the ones from cloud providers) will assume both cases and sometimes they are so resilient on this feature that will suggest no autentication at all for intra-cluster communication even when the underlines softwares allow and strongly encourage it's use.

One generic protip here is, when in doubt with guides, check the same guides but with "geo-distributed applications/replication" or "multicloud". Even if you do not implement IPSec or OpenVPN, the averagen guide on how to configure the applications will very likely to still rely on autentication for the apps that need to talk with each other.

FAQ

  • Which version of AP-ALB should you use?
    • Choose at ap-application-load-balancer/releases. You can use the master branch, but we recommend review new updates. ALB is meant to be used non-stop on production servers, so you can stick with some version or maintain your own private changes.
  • How much overhead of RAM and CPU a server with AP-ALB have compared with alternative NameOfAlternative?
    • The overhead of HAProxy and OpenResty is low. Trust me.
  • AP-ALB is mean to be installed just only on frontend servers that are exposed to public IPs and then access internal servers?
    • This use is just one of the cases (and the most intuitive compared to cloud ALBs)
    • BUT you can also have, as example, both
      • all-in-one (BothApplication/Network Load Balancer and some PHP/Python/Java/Etc servers) on a single machine or
      • put AP-ALB servers behind AP-ALB servers.
  • If AP-ALB could be installed "on everyting" it means even on database servers?
    • If you are both your application server and database server are on same host, yes
    • But if you have to choose betwen put a network load balancer (the HAProxy) or on the database(s) server(s) or on the application server(s) (the ones running PHP/Python/NodeJS/Java/Etc) put on you application servers.

License

Public Domain

To the extent possible under law, Etica.AI has waived all copyright and related or neighboring rights to this work to Public Domain.

ap-application-load-balancer's People

Contributors

fititnt avatar

Stargazers

avatar

Watchers

avatar avatar

ap-application-load-balancer's Issues

MVP of AP-ALB inside Alpine Linux

See

This issue is related to made minimum changes to allow AP-ALB run, even if with limited functionality, on Alpine Linux

Dedicated ALB component `SanityCheck`

This issue is for create on the v0.7.x series a MVP of a component dedicated to do sanity checks. These checks should be

  • based on what is enabled on not on that host (so it will not check UFW if is not enabled for that host
  • must try to follow the same folder patterns if are not for multiple components
    • tasks/sanitycheck/ufw tests component tasks/ufw/
  • Must be enabled by default and be the very first ALB component to run.

On some of my private tests with ALB v0.7.0-alpha (this time using several hosts at once) it is so impressive to be able to configure several machines using only some ansible inventories that I think this module could really be the place where I could put some extra checks, because is too easy to eventually put a full ALB (the HAProxy+OpenResty) on the wrong node.

Maybe in addition to these sanitychecks we even enable some sort of way to a person create a lock file on hosts that even if months or years later the same person or someone else try to run, will have to at least to manually go on that host and delete the lock file.

MVP of AP-ALB demo with at least one way to share configurations created on run time across cluster

Required by ALB v0.8.x and clustering related options #17

The drafts on the fititnt/ap-alb-cluster-demo I'm already testing Redis (thats the why Configurable HAProxy Advanced Redis Health Check #19), and one of the main reasons was share Let's Encrypt secrets (and the fact that GUI/lua-resty-autossl support Redis as just point click use).

But there is a catch here: not that Redis for our type os usage would not work, but it both could be used for real services on the same hosts (and them disincentive usage of AP-ALB) and also something I know from the start was that solutions like Etcd/Consul would be much more aligned with such needs.

So, this issue is for testing any solution that could at least work for one v0.8 demo. It also means that #17 is likely to be an release that maybe will take more time than last ones, and maybe not even archive one beta state before v0.9.

Review to follow the Filesystem Hierarchy Standard 3.0

Review to follow the Filesystem Hierarchy Standard 3.0

TODO: take time and review the full lastest Filesystem Hierarchy Standard
and, if need, make some small adaptations to AP-ALB structure. See
https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard and
https://refspecs.linuxfoundation.org/FHS_3.0/fhs-3.0.pdf
(fititnt, 2019-12-05 21:41 BRT)

Things that we could implement from https://refspecs.linuxfoundation.org/FHS_3.0/fhs-3.0.pdf
that are not implemented yet on Directory structures.

  • /opt/alb/
  • /var/opt
    • 5.12. /var/opt : Variable data for /opt
      • "Variable data of the packages in /opt must be installed in /var/opt/< subdir >, where < subdir >
        is the name of the subtree in /opt where the static data from an add-on software package is stored, except
        where superseded by another file in /etc. No structure is imposed on the internal arrangement of /var/
        opt/"
      • "Rationale Refer to the rationale for /opt"
  • /var/cache/alb/?
    • FHS 3.0 5.5. /var/cache : Application cache data
      • "/var/cache is intended for cached data from applications. Such data is locally generated as a result of
        time-consuming I/O or calculation. The application must be able to regenerate or restore the data. Unlike
        /var/spool, the cached files can be deleted without data loss. The data must remain valid between
        invocations of the application and rebooting the system."
      • "Files located under /var/cache may be expired in an application specific manner, by the system
        administrator, or both. The application must always be able to recover from manual deletion of these files
        (generally because of a disk space shortage). No other requirements are made on the data format of the
        cache "

ALB v0.8.x and clustering related options

The ALB v0.7.4-beta was just relased and I will give a try to dedicate the ALB v0.8.x to implement clustering related options with the following limitations:

  1. The implementation should not require floating IPs
    1. Most of well know and very efficient HA setups actually require this (like keepalived). The type of audience and VPSs prices we're targeting does not
      1. To put in perspective can be cheaper to spin a FOUR 8GB RAM VPS on some providers than just pay for one ALB on AWS to route for the VPSs (not included in the price)
  2. The implementation should not require additional disks on complex, hard to automate, disk formatting on the main disk
    1. DRBD requires this, so we will have to look for alternatives.

To avoid too much overthink, these are allowed:

  1. The implementation could require a minimum number of targets bigger than 2
    1. Some providers that users pay for floating IPs could in theory allow just 2 on some specific cases
  2. The implementation could (at first moment) require a very specific number of hosts
    1. 3 is a good number.
  3. The implementation is free to decide what strategy to use if it means be easier to setup and maintain in long term and with less human intervention.
    1. So is free if will choose Active/Active, Master/slaves,
      Active/Standby
    2. For data that could be recreated on demand (like Let's Encrypt secrets) the implementation does not need to be ACID compliant.
      1. In the worst case scenario a brain-split should not put down the cluster of Load Balancers.

Maybe I will not be able to even make an MVP of this in a way that could be automated and released on ALB working out of the box, but this issue is about give a try.

Create a `DevTools`-like group of tasks

This issue is for create a group of tasks, for sure disabled by default, that could have tools non-really essential to run a server, but at least I very often need they when debugging or inspecting the servers.

MVP of AP-ALB demo with wireguard for private networking

refs:

We will use for the first clustered demo as VPN implementation Wireguard. And the external Ansible role very likely will be https://github.com/mawalu/wireguard-private-networking.

Note: the Wireguard role (like the Consul external role) are not part of AP-ALB, and are used on demo just as example. Wireguard is not considered as production-ready / enterprise friendly than other VPN solutions, and merging Wireguard inside AP-ALB would make the full AP-ALB not production-ready (considering high standards). AP-ALB just should work very fine with private networking, and since I really want to make working demos, we will do with this one.

MVP of ALB Hooks (Custom tasks)

Refs:

The concept of running optional task list when events are triggered (was mostly inspired on the way ansistrano works. I obviously knew before the general idea (but more on the programming side) but not when used to automate deployments. And this actually is very powerful, since it helps to, for example

  • Reduce the need to add too much functionality to the AP-ALB core
    • And, for example, if a user could actually turn off some features that tend to be less flexible across different OSs (check my commend here), like with alb_manange_haproxy_repository: no, with a rook that could be trigged before the ALB/HAproxy runs, could allow user specify his tasks to install the repository
  • Reduce the need to create other roles for simpler things
    • By simple, I mean not deploying a full Galera Cluster in HA mode
    • A good example would be one-file-installs of for example PHP-FPM, maybe create folders if already does not exist, etc
    • Most

This issue to remember to later eventually add (and document, this is important) how one user could inform tasks that would run before or after some events.

At Application/Sysapplication level

At this moment, we just have basic (but somewhat functional) hooks at app level,see #app_hook_after and #app_hook_before.

Actually, this implementation was easier to do than I expected. I should start doing done this type of hook before.

At AP-ALB level

Some hooks that seems to be more idea in short term would be at least 2 for each subcomponent (one to run before, and another to run after).

About Accidental vs Essential Complexity on Hooks

Implementing hooks can actually get more complex than need. This is one of the reasons (and another note to self) to maybe start by the documentation and only then implement.

For example we could put hooks triggered by near any type of event on the live cycle, but if is getting too much complex to explain, is likely to get to complex to maintain and be reused (and then, be something that would stop working on the long run and get deprecated)

App option: `X-Robots-Tag` + robots.txt with `noindex,nofollow` value

Issue about implement a way to, via app configuration, allow enforce hint for search engines to not index not follow content of all pages of the app.

As for sysapps, this should be enabled by default (maybe not even allow disable it).

Security information: note that this does not means that the AP-ALB would block non-humans; also this feature should not be considered as safe as password protection or 2fa

AP-ALB demo with MariaDB Galera Cluster (using external Ansible Roles)

While MariaDB clustering is not a core feature of AP-ALB, it's load balancing may become a need for our HAProxy. Another important point here (and the reason to not take time to create from scratch this feature) is that any role that implement such feature should be well tested, so a reason for take special care on how to use this role.

From last days, we already have some MVP of the role openstack/openstack-ansible-galera_server. It's a 3 Node Ubuntu 18.04 LTS, so its' not as complex as the current demo of ansible-linux-ha-cluster. The first impression using this role was: it's not on Ansible Galaxy, but it seems very well tested. On the initial tests, tried to force the requeriments.yml enforce one specific released version, but for some reason it failed. For now I'm using just master at:
https://github.com/fititnt/ansible-linux-ha-cluster/blob/af3e0fc4266ffd97859d632995e8146b78962d9d/requirements.yml

Expose `lua-resty-auto-ssl` allow_domain functionality to end user (Let's Encrypt auto HTTPS)

See also:

The AP-ALB v0.4-beta still not expose to the user ways to customize the allow_domain, not even as function. This issue is for improve this.

This is our current rule that is hardcored (not able to not even customize with Ansible).

    # Initial setup tasks.
    init_by_lua_block {
      auto_ssl = (require "resty.auto-ssl").new()

      -- Define a function to determine which SNI domains to automatically handle
      -- and register new certificates for. Defaults to not allowing any domains,
      -- so this must be configured.
      auto_ssl:set("allow_domain", function(domain)
        return true
      end)

      auto_ssl:init()
    }

It's ok for testing (whitelist everything), and in fact was on the documentation of GUI/lua-resty-auto-ssl, but can hit Let's Encrypt limits fast for invalid domains pointing to IP of the server.

MVP of Consul storage adapter to lua-resty-auto-ssl

I will try do some MVP of storage adapter for https://github.com/GUI/lua-resty-auto-ssl using https://github.com/hamishforbes/lua-resty-consul as library to talk with Consul.

GUI/lua-resty-auto-ssl does not have formal documentation on how to implement one adapter, but looking at redis.lua (134 lines) and file.lua (92 lines) is likely to be more easy learn the bare minimum of Lua to make a Consul adapter than the not-very-efficient way to create some way to synchronize both ways Consul with files in some folder.

If take too much time or get some hard issues I will prioritize other tasks. But this open issue here is to do try do some Minimal Viable Product that could just works.

Rewrite/document standard folders for ALB and variables names

At this moment we only use as custom directory that needs documentation the /var/log/application_load_balancer/ for logs. But short name "alb" seems not have issues with other software (at least not for Debian distros) and also is shorter.

OpenResty store all data on /usr/local/openresty/, even configuration files from original NGinx it uses /usr/local/openresty/nginx/ to avoid conflict. I guess that we should do the same.

For now, we're need at least places for logs. But we will really need soon some places to put at least some debuggin files (or hello world pages). And also to allow some shorter configuration options (and avoiding users specifying everything) we would need in addition so logging files, also default place to, for example, put files for static content based on app_uid.

Also, this structure have to somewhat works fine with the ap-application-load-balancer-extras

MVP of configurable HAProxy redirecting for non-localhosts OpenResty

Our /templates/nlb-strategy/haproxy-minimal.cfg.j2 pre v0.8.x is really too minimal. We dont even have some way to, via variables, define redirection to port 80->8080 and 443->4443 for a host different than localhost, so a user would need to use a custom haproxy.cfg.

This issue is for we make it more friendly. Do not need to be perfect (and maybe the fallback without user extra configurations could still redirect to localhost) but we should allow some customization here.

RHEL/CentOS 8 and missing lua/luarocks base repositories for OpenResty

Related:

RHEL/CentOS 8 is so new that some base repositories that are strong requisite, like luarocks for GUI/lua-resty-auto-ssl are not available for imediate use. This may need some work that very likely would need to be disabled later.

As for the OpenResty itself, from https://openresty.org/en/linux-packages.html we're setting as base the RHEL 8.x x86_64 (instead of the hardcoded CentOS 7.x x86_64).

MVP of standard health checks that works across different datacenters with acceptable security

Most big cloud load balancers assume health checks to not require any validation at all. They not even have option to basic auth. They assume the path between the health checker and the destiny is already on a private network, and if is not the case, I think very likely the end user would eventually just create a semi-secret public URL that will be reused for years

At templates/alb/strategy/partials/alb_health_check.conf.j2 at this moment we have a draft that allow the user to customize the prefixes (so, this somewhat would be equivalent of other cloud LBs would give to the user).

The big issue on AP-ALB is what is somewhat exception on cloud LBs, are very likely to be common on our users. So our defaults should assume this context of either heterogenic datacenters of allow work without VPN.

This actually is a very, very complicated topic to make it work both with low overhead (a strong requirement for health checks) and acceptable secure, even if the MVP implementation maybe not require much more code of what already exist.

Security considerations

ALB on BSD Systems

This issue started with AP-ALB v0.8.x adaptations to support RHEL/CentOS 8 family and design changes to allow flexibility even for non-tested OSs #34. This issue mostly likely to be a place to mention things on ALB that are different from the other systems and/or have a place to mention what is not implemented.

Note: I do not use BSDs systems in production, but this does not means that, when viable, at least made the base ALB have at least some bare minimum compatibility. Initially the ALB is tested on FreeBSD 12.

Aboud BSDs & BSDs & Ansible

Ansible Packages related to BSD

Ansible System modules related to BSD

BSD service management

Update 1:

  • Created BSD service management section

More testes with ALB + Consul for scenarios with total reconstruction from an node from scratch

Bootstrapping an MVP of consul cluster using an external role, brianshumate.consul (https://github.com/brianshumate/ansible-consul) was initially less complicated than I imagined.

I accidentally discovered that rejoin a cluster after total destruction of a node (I erased old one, and recreated from scratch) may not be 100% automatic. Instead of going too deep now, I'm just marking this issue here to recheck later with more attention.

Potentially related to

One thing that I suspect could be related to quorum.

Improved HAProxy Stats Page with v0.7.x new options

Previous #7 pre v0.5.0-alpha.

This is our round on trying to make the stats page integrated with with v0.7.x new options.

The #7 worked fine, but was not integrated with alb_dmz vars, for example, and need dedicated IPs. This issue could make it more intuitive.

ALB on Arch Linux

This issue, like the ALB on BSD Systems #37 and the ALB on Debian distribution #41, may have specific comments related to this OS.

The initial state from Arch Linux on AP-ALB since release v0.8.x is similar OpenSUSE and FreeBSD. Actually, Arch Linux may be one of the easier that require compile OpenResty to add full support.

MVP of implementation of proxy protocol awareness on AP-ALB

References:

This, considering we control both HAproxy and OpenResty, could potentially replace the X-Forwarded-For.

And yeah, this is pretty low level and advanced. But is likely to be better investigate this approach, and do it safely, than others.

AP-ALB v0.8.x documentation migration to dedicated place

The README.md have a lot of content [1536 lines (1262 sloc)] and we're running out of how many heading levels HTML/Markdown could support.

This issue is about improve this situation. And also start to care about be able to be found on search results outside GitHub (something that start to make sense when eventually we get out of alphas and betas releases).

Convert AP-ALB tests to testinfra

Is a fact that well written idempotent Ansible Roles/Playbooks are aready good for testing the infrastructure actual state. For just test without apply, there is even the Check Mode (“Dry Run”).

But here with AP-ALB is more complex than average individual Ansible Role, even when running in a single node. One of the implications of this is that, even if is just to check what ports are used by what service become important. We already have some drafts on files/alb-cli-tools but writing more complex shell scripts to do some quick testing may be less portable.

Because of the Implementation of Ansible Molecule on AP-ALB & travis-ci integration #2, we're already ideally would need to create some tests to check if all is ok, so I will take the oportunity to already use Testinfra on more than just the continuos integration testing.

MVP of Sysapps

On AP-ALB we have the concept of 'App' somewhat like a "OpenResty conf proxy rule related to one end user application". But there are some applications that we could use the very own AP-ALB App rules to proxy for internal administrative functions.

The idea with this MVP is for now somewhat copy the structure of what is done with Apps, but use different paths, folders, etc and eventually even allow implement some ACLs more specific to All sysapps than have to change each item of app to specify itself as system.

MVP of Consul in High Availability (HA) for AP-ALB

Related:

What is Consul?

Consul is a service mesh solution providing a full featured control plane with service discovery, configuration, and segmentation functionality.
(...)
KV Store: Applications can make use of Consul's hierarchical key/value store for any number of purposes, including dynamic configuration, feature flagging, coordination, leader election, and more. The simple HTTP API makes it easy to use.
(...)
Multi Datacenter: Consul supports multiple datacenters out of the box. This means users of Consul do not have to worry about building additional layers of abstraction to grow to multiple regions.
From https://www.consul.io/intro/index.html

Since the AP-ALB v0.8.x to work as a cluster need some way to share information, it means the underline solution should be reliable and is critical for High Availability.

Consul already implement features out of the box both for High Availability in a single datacenter, but also in multi datacenter. This is more than we want for the initial MVP of demo.

Also, by using Consul (or Etcd) the AP-ALB is much more aligned with trends of clustering common for example on Kubernetes Clusters. One advantage over the initial MVP using just Redis is that both Consul and Etcd does not require HAproxy.

AP-ALB v0.8.x adaptations to support RHEL/CentOS 8 family and design changes to allow flexibility even for non-tested OSs

Refs #17 (comment).

AP-ALB, since 3 august (~ 125 days) was only tested on Ubuntu/Debian systems. The Ansible roles used on the demo fititnt/ansible-linux-ha-cluster, with exception of the AP-ALB itself, already are compatible with RHEL/CentOS.

At least for Roles related to MariaDB/MySQL clusters, is easier to find well maintaned that works on RHEL/CentOS than recent ones for Debian/Ubuntu. So this is already good reason to make AP-ALB on very short term compatible with RHEL/CentOS.

ALB `bootstrap` group of tasks (similar to `common`)

Related:

Instead of the optional common, since with more OSs things can get complicated, a new, this time strongly recommended, group of tasks could be responsible for tasks that are really, really need on very start of a node, and may not be required to run so often.

One example would be a user, with gather_facts: no, be able to install at least the python on remote host, or get basic info of that could go wrong.

After this, maybe the idea would be make sure that, for the packages one node is interested in setup, all repositories that would need to be prepared already exist.

And then, maybe, the tasks related to create directories, that today are on non-subfolders like the tasks/alb-init.yml, could be moved to this group.

MVP of some internal Network Load Balancer

The main reason for this repository is be a Application Load Balancer (since most people would likely to not use a full project like this for somethig that could maybe be done directly with HAproxy).

But some things (even if faster enough) could be more complex to do with NGinx server blocks that we use for our L7 LB and also put too much pression on logging.

This issue is for we consider to test or add some way to redirect ports. But, as my initial idea on #1, maybe this could the main reason for use the AP-ALB.

ALB on Debian distribution

Issue related to AP-ALB v0.8.x adaptations to support RHEL/CentOS 8 family and design changes to allow flexibility even for non-tested OSs #34

This is also a topic similar to ALB on BSD Systems #37. So is likely to stay open forever.

This issue contain quick references about ALB on very specific Debian distribution. This does not include operational systems based on the Debian OS Family (like Ubuntu).

DontBreakDebian

About APT and repositories

Edit: added references about apt configuration

MVP of PHP boostraping (only for most common cases; and as extra feature)

The most idealistic scenario any Application Load Balancer would only proxy request. Since is fairly easy to proxy local files, we're already do this, to avoid too much custom NGinx scripting for some common cases of ALBs for simpler setups.

This issue is to considering add, as extra feature, also template out PHP-FPM files if one or more serves actually run on the same server that the AP-ALB is running. Since we're already doing this, and to avoid recommend someone use as extra repository just for this, could makes sense to also allow installation of the PHP-FPM and some modules on this.

Maybe this will also require later add same equivalent to run Java or Tomcat. But for now I'm just avoinding add more Ansible roles to another repository that is mostly to handle data warehousing IaCs and creating for each submodule full PHP installation, full Java/Tomcat etc, would need some refactoring later.

Configurable HAProxy Advanced Redis Health Check

This issue is not about create a role to install Redis without external dependencies (...not yet) but to allow some way to, via specifications under some alb_* variables, make changes on the HAProxy component of AP-ALB to deploy already well tested HAProxy Advanced Redis Health Check.

At the https://github.com/fititnt/ap-alb-cluster-demo we're testing role davidwittman.redis and could just make ALB play very nice with this and document very well.

MVP of AP-ALB inside docker containers

For production environment the general (or at least initial and current for AP-ALB v.8.x) idea of is run on VPSs and bare metal. Actually, one of the main ideas behind the AP-ALB was be a frontend load balancer for non-container apps and (via ansible playbooks) containers backens, like kubernetes [*], but also helps with softwares that already implement high availability and could be better also not run inside containers (think MySQL/MariaDB, for example)

However, is possible to run ALB nodes inside containers. And since this actually is a requirement to Implementation of Ansible Molecule on AP-ALB & travis-ci integration #2 this is a issue to document non-production usage of AP-ALB inside docker containers.

*: One of the reasons to explicitly not want optimize AP-ALB for containers whas that production-grade ALB would require also production grade containers and the extra-moving parts because of the underlining infrastructure (the containers, not the AP-ALB itself) could in practice have less 9's of availability than less (or just one node stand by backup) of AP-ALB direct on VPSs or bare metal. Another reason is that already exist load balancers specialized on containers that would do similar job of what AP-ALB would do (like the Traefik, even if the non enterprise version does not offer high availability out of the box)

MVP of optional backup strategies for apps/sysapps that cannot be recreated by scratch with Ansible

About the draft of backup-alb-full.yml / uninstall-alb-purge.yml

At /ad-hoc-alb/backup-alb-full.yml we already have one way to do a simply backup of main configuration files created by AP-ALB.

At this moment does not have option to not discard logs of applications, but as MVP it somewhat works. It also does not implement a script that could do the reverse.

That script was made mainly because of the ad-hoc-alb/uninstall-alb-purge.yml, that try to near unninstall all AP-ALB from a host and delete everyiting, but by default that purge will first call ad-hoc-alb/backup-alb-full.yml if the user did not explicitly disable backup before uninstall.

About this issue

On this issue, maybe is just some MVP about to document on YAML if one app, on a specific host, contains some directory that could handle data that worth to be saved from time to time or in a worst case scenario would be the one used to "move" apps from one node to another after total reconstruction of a node.

Note that this issue may not implement the full logistics (for example, may exist some external roles that could already sincronize encrypted backups from one directory to some remote source. But this MVP maybe could at least app new options to the Apps and Sysapps and then or create a Symlink, or copy the files to another directory, that this one is the one who should be handled by the backup strategy.

Default backup strategy

Since it could be simpler, maybe the default backup could be simple a copy of full directory without external dependencies.

Non-goals

For sake of simplicity, we will assume backup of files only. So if eventually have databases or some other storage, we could at best allow some hooks to be called before and after the actions, but the underline result should a file or a directory of files, preferable files that could be optimized by common backup strategies to use less bandwidth and remote space.

MVP of AP-ALB demo with at least one Virtual Private Network

This issue is strongly related to ALB v0.8.x and clustering related options #17.

While I was working on the clustered AP-ALB demo, different from the version where nodes does not need talk with each other beyond the internal routing, the clustered version or would require lots of documentation related to security OR just at least give some option to implement any VPN. Both decisions would require time (and the second one maybe not really much, even in the short term) so this issue is about deliver one demo with this option.

I stopped a few hours yesterday and was looking for what to use to implement:

Some alternatives (at time of writting)

OpenVPN

No. Not for this. It's neither designed for "mesh networks" (it somewhat would require star networks, it means SPoF) and is not even easy to implement to worth the time.

IPSec++ (++ = with extensions)

This would be the most industry standard to implement. It's not trivial to get done right, but is one of the most efficient. Even if not done for now, is something to consider or at least leave room in the configurations to implement later.

Tinc

I actually liked the Tinc. It by design do something near of what we want. Not hard to implement as OPenVPN and IPSec++ (even have some playbooks with this). It also allows featues like if direct route from one node to another is blocked, it can decide on the fly to use other nodes until get to destiny.

Wireguard

Wireguard is both fast, have a very clean code base, is VPN at kernel level (like IPSec) and (this is very, very impressive) even the Linus Tovards make comparison saying this code base was much better than IPSec and OpenVPN and was interested to get it merged to the linux kernel. I even read the discussions thread, and the code was not implemented yet both because of some code refactoring was need (and the authors of Wireguard are working hard to make it) and also had complains that it was "not audited like the others". The main author of Wireguard complained that even the others where not audited (and maybe the Wireguard was getting more pression to refactoring than any other in the past).

Also, some complains about Wireguard was not merged was because he re-implementing some funcions already done by other parts of the kernel. Some he already is fixing but others he on the linux maillist literaly get references of the authors of other VPNs or algorithms admitting errors or have issues for years and noting getting done. Not that the Wireguard seems to be bullied in special, no, I'm not saying this, but the standard way people who approve code to be merged to the kernel is very perfectionist. This also maybe explain why the website of Wireguard, at this exact moment, make serious disclamer that even if is used for years it still cannot be called safe to use. Not that it was worse than alternatives, but for sure Jason Donenfeld is trying be from start better and more responsible than others.

Here some links. Note that there is a lot, even more than Tinc.

MVP of use use folders on ALB servers to store constants and variables

  • References on Linux directory structure https://linuxhandbook.com/linux-directory-structure/
  • Potential places for we use on ALB
    • /opt/alb/
      • Maybe ideal for ALB variables that (ideally) tend to be managed by Ansible playgooks and are less likely to change on running time.
      • Some of these values could override similar equivalents on other places.
    • /var/alb/
      • Maybe we use for data that could be changed on runtime but is not granteed that could be regenerated by Ansible Playbook
      • Could be a good place to use for features that we're would be likely to store on a Redis server, but some specific installation of ALB is not running redis or will not require updates
        • If ALB could somewhat both work with some data storage like Redis/Consul/etc we could still use this directory as fallback in case these directories does not exist
      • One or more folders on this path could be used to store backups

There are several reasons to store some variables on target servers. To start, one could be a way for other programs be aware of IPs, ports, etc that have some special meaning to ALB. This could be useful for know what domains could have SSL issued, what IPs can do some actions (like login in, or be on blacklist).

Use `acme` instead of `letsencrypt` for variable conventions

We already have some variables with letsencrypt, but in fact we're dealing with a standard protocol that more vendors could implement (and actually, there is at least other alternative to letsencrypt, the buypass.

This issue is mostly about rename (or not create new variables) using hardcoded naming of letsencrypt.

ALB `status` group of tasks

I'm testing way too many operational systems to test at same time Even if I could take notes and document each operational system way to dectect open ports, disk, permissions, etc, I would very likely not remember months or years later.

This issue is about create one minimum viable product of a group of tasks that could run to check status of a node (maybe cluster of nodes and their conections) that is aware of #34 (aka take in account cross platform)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.