| ↑back Search ←Prev date Next date→ Show only urls | (Click on time to select a line by its url) |
| Who | What | When |
|---|---|---|
| brycec | In fact there are many comparisons out there, mercutio
I didn't need something as complex and all-managing as Chef or Puppet. I just needed a convenient way to do shit on multiple hosts (eg: apt-get upgrades) and ansible fulfills that role (with parallellisation, etc) and it was very simple to setup | [00:44] |
| BryceBot | get on up
and DANCE BryceBot dances :D-< BryceBot dances :D|-< BryceBot dances :D/-< | [00:46] |
| brycec | shutup BryceBot | [00:46] |
| BryceBot | NOYOUSHUTUP brycec | [00:46] |
| brycec | It's true that Ansible has a feature similar to Chef/Puppet recipes, the Anisble Playbook, but I don't have deployments large enough for that to be useful. (I'm 99% maintaining servers, ones and twos of various tasks - not exactly rolling out new deployments) | [00:47] |
| ....... (idle for 30mn) | ||
| mercutio | brycec: maybe if you're looking for comparisions for that
brycec: i just thought it'd be nifty if some blog i could read every now and then informed me of such things :) i'm a bit apprehensive about automation as it makes simple things complicated, and leaves complicated things complicated. i can understand wanting to do it if needing to for number of servers though. a friend was mentioning ubuntu's autoupdate thing before, and how he wanted to use it because he never gets around to doing updates. i have no idea how safe/reliable it is though, as i've never touched it myself. | [01:17] |
| ........ (idle for 37mn) | ||
| *** | JC_Denton has quit IRC (Ping timeout: 240 seconds)
JC_Denton has joined #arpnetworks JC_Denton is now known as Guest61953 LT has joined #arpnetworks | [01:58] |
| plett | We use puppet quite heavily at work. We've got something approaching 100 machines (both virtual and physical) under puppet control. For us it's the ability to, for example, go from the requirement to build a new customer-facing DNS resolver to it being live and hooked in to BGP in about 10 minutes time.
What we need to do next is make better use of packages, i.e. building our own for deployment of software onto machines in a repeatable way. At the moment we have puppet checking our some internal git and svn repos and building code. Another thing we need is "lifecycle management" to keep machines up to date with packages. Just putting "apt-get update;apt-get upgrade" in cron is too blunt a tool, but 100 machines is too many for our team to be able to ssh in to each one and do things manually each time there is an openssl update. | [02:08] |
| BryceBot | get on up
and DANCE BryceBot dances :D-< BryceBot dances :D|-< BryceBot dances :D/-< | [02:13] |
| mercutio | plett: you can put apt-get update; apt-get -d upgrade in | [02:21] |
| BryceBot | get on up
and DANCE BryceBot dances :D-< BryceBot dances :D|-< BryceBot dances :D/-< | [02:21] |
| mercutio | where -d is download only
then you can do apt-get install <package that got updated> split across all the machines. i generally don't think 100 machines is too many to do manually because you still want to test it manually anyway. also the ssl thing was more complicated because you have to edit apache config to disable ssl 3 but yeah, i can understand wanting to automate package updates on 100 servers. virtualisation tends to encourage more hosts. | [02:21] |
| plett | mercutio: What I think we need is the ability to group servers, and update packages on one test member of that group and confirm that it all still works, then approve the same updates to other members of the same group | [02:31] |
| mercutio | sounds good | [02:31] |
| plett | I think RedHat's SpaceWalk project does that, but I've not had the time to look at it | [02:31] |
| mercutio | basically staging server.
i think the whole area could be improved radically it seems thigns went backwards to a degree like it used to be that people would often have /usr read only nfs mounted. and shared between machines, then /usr/local with local changes. i think in some ways if the "OS" can't even modify it's basic self working stuff and it's all read only and externally controlled that could be good | [02:31] |
| pyvpx | yeah | [02:33] |
| plett | Yeah. With all our servers, we might have 3 or 4 live members (say spamassassin boxes for email filtering) and one test box which we try out config changes on, we would just use that to test package updates on | [02:33] |
| pyvpx | rumpkernels that are readonly :) | [02:33] |
| plett | mercutio: It sounds like you are describing Docker | [02:33] |
| mercutio | ahh i haven't seen that.
see i need a blog to inform me of these things :) | [02:34] |
| plett | Docker is interesting. Fundamentally, it's a chroot on steroids for Linux, kind of like FreeBSD jails | [02:34] |
| mercutio | interesting.
i played with chroots a while ago it takes a bit of maintenance | [02:34] |
| plett | As well as a chroot for file isolation, it can have its own IP addresses distinct from the host it is on, can be limited in disk/network/memory etc via cgroups and all that stuff | [02:36] |
| mercutio | i used to use linux vserver | [02:36] |
| plett | But that is just how it works (and most of that comes directly from Linux Containers), what Docker has built on top of that is layers of abstraction | [02:37] |
| mercutio | yeah i think linux itself got updated quite a lot
i haven't actually played with cgroups yet but i think there's some automatic stuff disk throttling is complicated. | [02:37] |
| plett | Say you wanted to build a spamassassin server as a Docker app. You would take a base image of your chosen OS which had already been packaged as a docker app, spin up a VM, install whatever packages and generic config you need to make spamassassin work, then snapshot it and distribute it | [02:38] |
| mercutio | i haven't tried dedicated spamassassin vm's
i've always mixed postfix and spamassassin. | [02:39] |
| plett | The clever bit is that your additional bits are stuck on top of the base image, kind of like unionfs | [02:39] |
| mercutio | the complicated bit was pushing user lists to other boxes
so it can drop mail for unknown users. | [02:40] |
| plett | So when the base OS image gets an update, you pull down the new image and your spamassassin dock automatically has the new files in it | [02:40] |
| LT | the other neat thing about docker is it's all versioned - if an update breaks something you can just pull the previous version to rollback | [02:41] |
| mercutio | lt: now that is cool. | [02:41] |
| plett | Yes. That too | [02:41] |
| mercutio | unless spamassassin updates it's database format or such | [02:41] |
| LT | the underlying chroot/container bit isn't that exciting, but the toolkit they've built on top of it quite neat | [02:42] |
| mercutio | i so can't keep up with all of these things
maybe i should mkae a note of stuff to read up on :) | [02:43] |
| plett | Same here. Docker is still on my list of things that look cool and which I should play with at some point | [02:43] |
| mercutio | docker, puppet, ansible
like 15 years ago (wow that long) i used to read freshmeat and it'd tell me about all kinds of new software. there was some other linux blog too that went away | [02:43] |
| plett | I think Docker might be good enough for us to be able to kill off a load of single purpose VMs and turn them into bundled apps all running on one machine
Fewer things to administrate, etc | [02:45] |
| mercutio | yeah
i actually started running more things on the same vm's again cos it was getting hell, and there's better security now days generally virus filtering is probably on the side of "less sure about" though. err virus/spam as there's so many different programs that can all look at mail | [02:45] |
| plett | The Docker guys still don't recommend using it for where you need security isolation between docks, do they? | [02:46] |
| mercutio | i use spamassassin, dkim, razor, dcc, etc. | [02:46] |
| some people say the same about virtualisation
because cpu bugs could allow breaking out or something | [02:54] | |
| pyvpx | well and there is a much larger attack surface, in general. interfaces/code/whathaveyou
well yeah* and there. but I'm one of those nutty openbsd users who doesn't admin scale-sized stuff, or much at all in production. | [02:54] |
| mercutio | i like openbsd | [02:55] |
| pyvpx | docker/lxc seems to be performant and popular
but after I read a thesis and ran a NetBSD kernel in my web browser, locally...I kinda got hooked on this anykernel idea. | [02:55] |
| mercutio | anykernel? | [02:56] |
| pyvpx | rumpkernel.org | [02:57] |
| mercutio | cool added to my to read list :)
thanks. | [02:57] |
| pyvpx | the :login; paper is pretty neat read | [02:57] |
| .... (idle for 17mn) | ||
| LT | I would definitely say that docker isn't a security thing - seems to be very much driven by people who want ease of deployment for webapps with security as a relatively low priority. that said it can't be any worse security than running it all on a single host | [03:14] |
| ..... (idle for 22mn) | ||
| *** | staticsafe has quit IRC (Ping timeout: 265 seconds)
xales has quit IRC (Ping timeout: 272 seconds) | [03:36] |
| meingtsla has quit IRC (Ping timeout: 265 seconds)
meingtsla has joined #arpnetworks | [03:45] | |
| staticsafe has joined #arpnetworks
xales has joined #arpnetworks | [04:02] | |
| .................................. (idle for 2h48mn) | ||
| pcn | Yeah | [06:51] |
| ................................ (idle for 2h38mn) | ||
| *** | vissborg has quit IRC (Max SendQ exceeded)
vissborg has joined #arpnetworks | [09:29] |
| ........... (idle for 54mn) | ||
| LT has quit IRC (Quit: Leaving) | [10:26] | |
| ......... (idle for 41mn) | ||
| forg0tten has quit IRC (Remote host closed the connection) | [11:07] | |
| ....................... (idle for 1h54mn) | ||
| Guest61953 is now known as JC_Denton
Seju has quit IRC (Ping timeout: 255 seconds) | [13:01] | |
| ............... (idle for 1h12mn) | ||
| mercutio | did you hear of flocker LT?
oh he left well plett was talking about it too | [14:16] |
| .... (idle for 15mn) | ||
| plett | mercutio: flocker? No, I've not heard of that
Their website seems short on details though It's a haproxy equivalent frontend to direct network connections to the right docker instance? And ZFS (on Linux?) for the image storage? | [14:32] |
| ...... (idle for 27mn) | ||
| *** | Seji has joined #arpnetworks | [15:02] |
| ....... (idle for 31mn) | ||
| mercutio | it seems they want to do database and stuf fmigration etc
i found it off zfs yes :) https://clusterhq.com/ i was trying to find out about the new zfs on linux features first. there have been a few recent zfs changes with things like faster zfs sends etc. and bookmarks, where you don't have to keep old snapshots around and can do your snapshotting on a storage/backup server | [15:33] |
| *** | sga0_ has joined #arpnetworks | [15:36] |
| mercutio | snapshotting tends to lead to fragmentation, but now that ssds are getting so much cheaper/common etc you can have hard-disk system with snapshots. | [15:36] |
| *** | sga0_ has quit IRC (Read error: Connection reset by peer)
sga0__ has quit IRC (Ping timeout: 255 seconds) | [15:38] |
| ....... (idle for 34mn) | ||
| sga0 has joined #arpnetworks | [16:12] | |
| mercutio | apparently the word around the net is that facebook is down | [16:14] |
| brycec | Loads for me over curl
ipv6 even | [16:16] |
| mercutio | heh | [16:16] |
| brycec | and in my browser | [16:16] |
| mercutio | you have no account? | [16:16] |
| staticsafe | up_the_irons: you around? | [16:16] |
| brycec | my browser wasn't convenient, mercutio | [16:16] |
| mercutio | weird loads for me in curl
oh it's back now | [16:16] |
| brycec | (I have an account, it loads fine0 | [16:17] |
| up_the_irons | facebook is down? | [16:17] |
| mercutio | it seems to be back again
to a lot of people facebook is the net :) facebook is using spdy apparently | [16:18] |
| brycec | "OH GOD THE INTERNET IS DOWN!!!" | [16:18] |
| mercutio | it still goes slow for me though
oh up_the_irons are you using spdy yet? now that you force https may as well spdy http://spdycheck.org/ | [16:19] |
| brycec | http://spdycheck.org/#facebook.com | [16:19] |
| up_the_irons | mercutio: not using spdy | [16:19] |
| mercutio | yeah spdycheck suggests not | [16:20] |
| brycec | There's much more to spdy than just being https though, it's all about ordering the load of resources and such | [16:20] |
| mercutio | brycec: yeh but it also goes over https
so if using https already it seems logical step | [16:20] |
| brycec | I know https is a requirement :p | [16:20] |
| mercutio | i mean if you need to get a cert and all
it's a lot more work i've been reading about mod_pagespeed etc | [16:20] |
| *** | Guest8160 has quit IRC (Ping timeout: 244 seconds) | [16:21] |
| mercutio | apparently it can do mobile versions of sites automatically too | [16:21] |
| brycec | I looked into this before... basically implementing SPDY without actually optimising the site is completely pointless | [16:21] |
| mercutio | as well as doing a whole lot of google optimisations
oh did you look into mod_pagespeed? https://developers.google.com/speed/pagespeed/module | [16:21] |
| brycec | I might have - it was a couple years ago | [16:22] |
| mercutio | apparently it's available as nginx and apache modules | [16:22] |
| brycec | http://nginx.org/en/docs/http/ngx_http_spdy_module.html | [16:23] |
| mercutio | it can do things like use webp versions of images
i dont' have a proper web site or ssl cert i just have directories and stuff with files for linking etc. | [16:23] |
| brycec | spdy enabled! that was easy...
free ssl certs ftw :) (startcom being my preference) | [16:24] |
| mercutio | i think chrome has changed something, because web sites in general all seem to load pretty quick now
i used to find https etc sites were slow can you get a free wildcard i'm using ip's atm hah but i don't haveto and subdomains. | [16:26] |
| brycec | free wildcard? I'm not aware of any, but I've heard of some dirt-cheap ones ($7 USD) | [16:27] |
| mercutio | $7US/year?
i suppose i could handle that. to play with spdy. | [16:27] |
| brycec | (I'd have to poke someone to get the name... something like dirtycheapssl or the like) | [16:29] |
| BryceBot | That's what she said!! | [16:29] |
| brycec | BryceBot: no | [16:29] |
| BryceBot | Oh, okay... I'm sorry. '(I'd have to poke someone to get the name... something like dirtycheapssl or the like)' | [16:29] |
| mercutio | haha
lowendtalk discussion this should tell me | [16:29] |
| staticsafe | $7 wildcard per year is not happening lol | [16:30] |
| mercutio | oh old discussion
i hate ssl tax well cert tax | [16:30] |
| staticsafe | im seeing $45 yearly for an AlphaSSL wildcard | [16:30] |
| mercutio | too much
i might just load a cert into my browser/hosts. i suppose i could get lots of non wildcard | [16:31] |
| *** | Guest8160 has joined #arpnetworks | [16:33] |
| mercutio | i wish spdy could work without https | [16:35] |
| *** | Seji has quit IRC (Ping timeout: 240 seconds)
Seji has joined #arpnetworks | [16:48] |
| .......... (idle for 46mn) | ||
| derjur has joined #arpnetworks | [17:36] | |
| ................ (idle for 1h15mn) | ||
| derjur | hmmm... is there a self-serve for PTR records? | [18:51] |
| mercutio | yeah
in the control panel | [18:55] |
| ...... (idle for 25mn) | ||
| m0unds | had a water line break above my pantry today. good stuff. | [19:20] |
| mercutio | ouch | [19:22] |
| derjur | mercutio: so it is! thank you | [19:24] |
| m0unds | yeah, can't get a plumber out til thursday | [19:24] |
| mercutio | ouch
so you turned water off? | [19:24] |
| m0unds | yep | [19:24] |
| mercutio | damn that sucks
is it a holiday there or something | [19:25] |
| m0unds | it's a slow-ish leak
nah, just busy | [19:25] |
| mercutio | maybe try a diff one/ | [19:25] |
| m0unds | this was the shortest
called 6 different ones haha | [19:25] |
| mercutio | oh :( | [19:29] |
| RandalSchwartz | need parallel plumbers! | [19:37] |
| brycec | And parallel plumbing! | [19:40] |
| m0unds | my plumbing isn't webscale :( | [19:46] |
| mercutio | heh
plumbing problems are pretty common really | [19:48] |
| RandalSchwartz | EPIPE | [19:54] |
| m0unds | haha
i didn't notice the leak til i opened the pantry to feed my cats and their food had water in it they were sulking til i was able to get the water shut off and poke holes in the ceiling so i could run to the store and get more food | [19:54] |
| RandalSchwartz | the real problm there is "cats" :) | [20:04] |
| .............. (idle for 1h7mn) | ||
| m0unds | why's that a problem? | [21:11] |
| .................. (idle for 1h29mn) | ||
| *** | dj_goku has quit IRC (Remote host closed the connection)
dj_goku has joined #arpnetworks dj_goku has quit IRC (Changing host) dj_goku has joined #arpnetworks | [22:40] |
| ............ (idle for 56mn) | ||
| dj_goku has quit IRC (Ping timeout: 265 seconds) | [23:37] | |
| dj_goku has joined #arpnetworks | [23:46] | |
| ↑back Search ←Prev date Next date→ Show only urls | (Click on time to select a line by its url) |