IRC logs for #aegir, 2016-07-15 (GMT)

2016-07-14
2016-07-16
TimeNickMessage
[10:00:37]* theMusician has quit (Quit: theMusician)
[10:34:37]* realityloop has joined #aegir
[11:15:58]* mstenta has quit (Ping timeout: 252 seconds)
[11:28:14]<jonpugh>sorry for burying your question g1i7ch ...
[11:28:16]<jonpugh>> Is there a way of having a central authoring or content repository site from which I could deploy content to different sites?
[11:28:48]<jonpugh>the solution for this is to build it into your drupal sites. it's not a solution you could build into aegir really.
[11:29:38]<jonpugh>read up on this blog post, it lists all the tools people use for content distribution
[11:29:39]<jonpugh>http://buytaert.net/improving-drupal-content-workflow
[11:39:19]<jonpugh>Aegir Behat tests passing on Travis! https://travis-ci.org/jonpugh/aegir-dockerfile
[11:39:37]<jonpugh>not exactly great coverage... yet :)
[11:45:03]<jonpugh>helmo: colan: gboudrias: I got behat tests for aegir passing on travis :)
[11:45:07]<jonpugh>https://travis-ci.org/jonpugh/aegir-dockerfile
[11:52:36]* ergonlogic has joined #aegir
[12:11:33]<g1i7ch>Hey jonpugh! Thanks for the reply and the great info!
[12:15:00]<g1i7ch>I just discovered the Deploy module, and with your suggestions thought of a great set up for a small cascade series of drupal installs through Aegir, leveraging Deploy. Going to try it out. It seems that it's able to connect not only to sub-sites but installs on other servers.
[12:17:28]<g1i7ch>So I thought of setting up a series of custom platforms, one as a wiki-style content repo, then a staging site, then publish to production site.
[12:21:13]<jonpugh>another thing to note is that with aegir, you can inject things into settings.php with a drush hook
[12:21:26]<jonpugh>so if you did want to have some control over your sub sites you could.
[12:21:51]<jonpugh>like $conf['api_key'] = ''
[12:28:19]<g1i7ch>Are Aegir and BOA being developed by the same team, or are they completely separate projects?
[12:34:37]* ergonlogic has quit (Ping timeout: 252 seconds)
[12:51:04]* gusaus has quit (Quit: gusaus)
[12:53:10]* gusaus has joined #aegir
[12:54:26]<jonpugh>BOA team is maintained by omega8cc alone. omega8cc does contribute to aegir here and there, namely the NGINX support
[13:03:49]* realityloop has quit (Quit: Leaving...)
[13:06:42]* realityloop has joined #aegir
[13:06:44]* realityloop has quit (Client Quit)
[13:41:31]* gusaus has quit (Quit: gusaus)
[13:43:29]* gusaus has joined #aegir
[14:06:43]* gusaus has quit (Quit: gusaus)
[14:28:29]* hefring has joined #aegir
[14:40:04]* g1i7ch has quit (Ping timeout: 264 seconds)
[16:10:00]* drakythe_ has joined #aegir
[16:11:41]* drakythe has quit (Ping timeout: 258 seconds)
[16:11:41]* drakythe_ is now known as drakythe
[16:40:47]* julienfayad has joined #aegir
[17:04:26]* boshtian has joined #aegir
[17:06:57]* julienfayad has quit (Ping timeout: 246 seconds)
[17:16:05]* boshtian has quit (Quit: boshtian)
[17:24:16]* boshtian has joined #aegir
[18:09:56]* julienfayad has joined #aegir
[19:07:50]* gandhiano has joined #aegir
[19:23:27]* gandhiano has quit (Ping timeout: 260 seconds)
[19:25:05]* gandhiano has joined #aegir
[21:07:31]* gandhiano has quit (Ping timeout: 240 seconds)
[21:16:21]* boshtian has quit (Read error: Connection reset by peer)
[21:36:43]* gandhiano has joined #aegir
[21:44:50]* gandhiano_ has joined #aegir
[21:48:15]* gandhiano has quit (Ping timeout: 258 seconds)
[22:16:08]* julienfayad has quit (Quit: julienfayad)
[22:18:14]* Fuzzy761 has quit (Remote host closed the connection)
[22:38:39]* gandhiano_ has quit (Ping timeout: 276 seconds)
[22:40:38]* Fuzzy761 has joined #aegir
[22:52:06]* ergonlogic has joined #aegir
[22:53:17]* boshtian has joined #aegir
[22:58:18]* g1i7ch has joined #aegir
[23:28:53]* julienfayad has joined #aegir
[23:58:04]<colan>g1i7ch: jonpugh : actually, now it's memtkmcc. omega8cc retired IIRC.
[00:01:26]<colan>that's the user. company is still omega8cc.
[00:02:03]<colan>er, Omega8.cc
[00:02:20]<jonpugh>Right, thanks
[00:06:00]<colan>jonpugh: nice work on the behat tests!
[00:06:58]<jonpugh>Hey, thanks! Ironically Travis run is passing even if tests fail
[00:07:15]<jonpugh>Turns out docker-compose up doesn't return non-zero exit codes
[00:10:11]<jonpugh>Have you launched an aegir/hostmaster container yet?
[00:11:14]* mstenta has joined #aegir
[00:14:05]<colan>jonpugh: no, sorry. it's on my list of things to play with though :)
[00:16:30]<colan>jonpugh: if you have any suggestions for recurly_aegir btw, let me know. not sure if that's something that could be useful for your stuff?
[00:18:09]<colan>i did a lot of research on similar subscription/bill services, and recurly seemed like the most versatile: multiple currencies, multiple payment processors, can add paypal later, etc.
[00:19:47]<colan>their tech lead is actually a former drupal guy!
[00:19:59]<colan>https://www.drupal.org/u/drewish
[00:47:12]* theMusician has joined #aegir
[00:47:49]<g1i7ch>So would BOA be a good implementation of Aegir for production use?
[00:54:28]* julienfayad has quit (Ping timeout: 264 seconds)
[00:56:24]* julienfayad has joined #aegir
[00:56:56]<colan>g1i7ch: depends on what you're trying to accomplish. BOA takes aegir and does more stuff with it. if you don't need that stuff, then you can simply go with aegir.
[00:57:56]<colan>aegir on its own is used in production.
[01:03:44]<millenniumtree>Been lurking - saw the BOA vs Aegir comment.
[01:04:22]<millenniumtree>BOA is for installing on a brand new fresh VM. They do NOT support installing it to an existing server.
[01:05:40]<millenniumtree>For that reason, we're using just Aegir on our servers.
[01:06:46]<millenniumtree>I'd be really hesitant to use it on a physical server at all, because their solution to any problems is "re-image the server and start over".
[01:09:25]* boshtian has quit (Quit: boshtian)
[01:27:49]* roycroft has joined #aegir
[01:29:29]* roycroft has left #aegir ()
[01:55:23]<g1i7ch>Yeah, that's my reservation, BOA kind of takes over the server. On the other hand it also locks down the server quite well to prevent intrusions.
[01:56:14]<millenniumtree>We have a rather custom setup, so Aegir by itself was far more flexible for us.
[01:57:01]<millenniumtree>We have one VM on SSDs that does all database work for the other Aegir VMs.
[01:58:08]<millenniumtree>All outbound email from the Aegir VMs is routed through yet another VM so we're not tying the web and email services to the same IP.
[01:59:37]<millenniumtree>I wanted it to work, and I tried, but we're just too weird. :)
[02:01:27]* julienfayad has quit (Ping timeout: 276 seconds)
[02:02:04]<millenniumtree>For intrusion protection, we have iptables and fail2ban. I have a security package I made that automagically deploys banned IP ranges to all the machines so a ban on one is a ban on all.
[02:02:33]* julienfayad has joined #aegir
[02:07:55]<g1i7ch>I've been wanting to do that. Been getting hit from China and Ukrain like it's going out of style.'
[02:08:52]<millenniumtree>No doubt. Problem with Chinese IPs too is you can't tell what company they're registered with. Unless you want to ban all of China Telecom... There's no way to differentiate between a legitimate browser and a bot.
[02:09:09]<g1i7ch>I've recently switched to BOA to check it out. It was a bit of a headache to get used to, but in the end, I kind of like it. Also, it incorporates PAM Authentication in a way I have yet to figure out.
[02:09:24]<millenniumtree>But then again, they ban a lot of our stuff... Much of the internet over there is unusable without a proxy server.
[02:09:32]<g1i7ch>However, it's been pretty solid so far, so I've been considering a total switch to BOA
[02:09:43]<millenniumtree>IC
[02:10:25]<g1i7ch>As for China and others, I've been considering banning most countries outside of Europe and the Americas, as they aren't potential clients nor audience.
[02:10:26]<millenniumtree>If it works for you, I'm sure it's an awesome tool. Setting up a new Aegir VM is so simple with it.
[02:10:42]<millenniumtree>Yeah.
[02:11:17]<millenniumtree>Unfortunately, we have several clients that work with Chinese folks, so I'm limited to banning /24 subnets as they pop up.
[02:11:19]<g1i7ch>I'm a bit hesitant. Though, as I'm still trying to understand all the lock down features. Not enough documentation in that regard.
[02:11:46]<millenniumtree>(that's another reason I chose just Aegir)
[02:12:07]<g1i7ch>Will you be sharing your IP ban-sharing script somewhere? ;)
[02:12:08]<millenniumtree>I couldn't adequately understand what Barracuda and Octopus actually added to the mix.
[02:12:58]<millenniumtree>Probably not - it's sort of in-house... But I can share some details if you're interested.
[02:13:00]<g1i7ch>Well, the thing I like most is the added Drush scripts, for updates and upgrades to platforms, modules, as well as hostmaster. All in one command.
[02:13:28]<g1i7ch>I wish I was a better coder :'(
[02:14:13]<g1i7ch>Barracuda will even upgrade my custom platforms.
[02:14:29]<millenniumtree>Yeah, our security tool isn't integrated with drush at all, but it creates a couple of global and local ban files.
[02:14:58]<millenniumtree>If you add to the global files, then git commit and push, the other machines will pull those once an hour.
[02:15:25]<g1i7ch>So that's a big plus. Unfortunately I've broken Aegir a few too many times, and felt a bit of dismay.
[02:16:04]<millenniumtree>We have a couple of scripts for platform management too. "platform-clone" is one, and it gets used a lot. BOA probably handles all that, but I've spent years on the command line.
[02:16:29]<g1i7ch>Yeah, I'm in the process of setting up a GitLab VM for doing that.
[02:17:52]<g1i7ch>I'm fine with the command line. I've been a linux guy for a couple of decades now. My brain is just too "artsy" to grasp PHP though. Python, I'm starting to comprehend, but that doesn't help much in the Drupal multiverse.
[02:20:41]<g1i7ch>I really want to get away from reselling other company's hosting, and be a one-stop shop for my clients. That's why I'm in love with Aegir. I just want to have the ability to handle the work load involved in hosting as well as security.
[02:20:58]<millenniumtree>I need some Python experience too.
[02:21:52]<millenniumtree>Hosting is a fickle mistress. We have a guy that does ours and it's amazing the amount of stuff he has to deal with. DDOS attacks (thankfully only on other clients), hardware failures... Ick.
[02:22:43]<g1i7ch>BOA also auto-bans, and notifies you each time there's an intrusion detection.
[02:23:25]<millenniumtree>That's superb. Do you know what it uses? Fail2ban?
[02:24:20]<g1i7ch>I think it's LFD
[02:24:49]<g1i7ch>Although I'm sure you can install Fail2Ban as well, on top of that.
[02:25:36]<millenniumtree>Looks like this: http://configserver.com/cp/csf.html
[02:25:41]<g1i7ch>That's the frustrating part about BOA, the implementation of different packages is not described well.
[02:25:42]<millenniumtree>Yeah.
[02:27:51]<g1i7ch>It works in a similar way, after three attempts the IP is banned. However, BOA automatically prevents root password logins, and will prevent root remote access unless you first share-id your public key for the root account.
[02:28:01]<millenniumtree>CSF looks like a nice package.
[02:28:30]<g1i7ch>Yeah.. checking it out now. Thanks for that!!
[02:28:47]<millenniumtree>We do that too. You change one line in sshd_config.
[02:29:49]<g1i7ch>Do you use a web proxy of any sort?
[02:30:30]<g1i7ch>I was thinking of routing everything through a Squid VM for extra security. But I just discovered Squid and don't know too much about it.
[02:31:56]<millenniumtree>You mean a reverse proxy (server caching)?
[02:32:04]<g1i7ch>yeah.. that
[02:32:15]<g1i7ch><--so old yet so noob ;)
[02:33:06]<millenniumtree>We used to use Varnish with Apache. Now Nginx is good enough. It does caching and allows us to transparently proxy some domains to an entirely different server.
[02:33:36]<millenniumtree>So we can have Aegir/Drupal sites and legacy non-Drupal sites on the same IP.
[02:34:24]<g1i7ch>I just dove head first into Nginx, because of BOA. So my whole world's been turned upside down in the last two months.
[02:34:34]<millenniumtree>Nginx is a web server, but also a super powerful reverse proxy.
[02:34:55]<millenniumtree>You can even proxy email traffic (smtp, pop, imap) through it to another machine. Kinda nuts.
[02:35:25]<g1i7ch>Yeah, I use it as my web server now, as it's blazing fast, it seems. Didn't know about the proxy features.
[02:35:52]<g1i7ch>Honestly, getting into Aegir and Drush, totally reinspired my geekiness.
[02:36:19]* julienfayad has quit (Quit: julienfayad)
[02:36:28]<g1i7ch>I still have a long way to go though.
[02:37:00]<millenniumtree>You can throw nginx server{} blocks into files in the pre.d, post.d folders under ~/config/server_master/nginx
[02:38:50]<g1i7ch>I heard something about Aegir being able to deploy other server apps in the near future, beyond just Drupal. Is this true?
[02:39:41]<millenniumtree>I'm sure it is, but I know nothing about the work being done there.
[02:40:08]<millenniumtree>Here's an example of a redirect from one domain to a specific page on another, using a pre.d file: http://pastebin.com/vv05Utwr
[02:40:34]<millenniumtree>Aegir doesn't have a facility to do this, so I (eventually) figured out how to do it.
[02:40:48]<g1i7ch>Thanks again!!
[02:40:57]<g1i7ch>That seems quite simple.
[02:41:24]<millenniumtree>And LetsEncrypt has changed our lives for the better. :)
[02:41:48]<g1i7ch>So would there be benefit to looking into Squid?
[02:41:51]<millenniumtree>We used to spend >$1000 a year for SSLs. No more.
[02:42:10]<millenniumtree>I would say probably not to bother with Squid.
[02:42:39]<g1i7ch>OOH.. you just reminded me.. SSLs. What about using Certbot/LetsEncrypt with Aegir..?
[02:43:24]<millenniumtree>I've used it once for forward proxy (routing all my web browsing traffic out of a network so it was encrypted and not monitored), but never used it in a server environment. Nginx does a fabulous job.
[02:44:07]<millenniumtree>They're working on LE support in Aegir - I don't know the status of it, but we sort of rolled our own implementation and it works fabulously.
[02:45:07]<millenniumtree>certs last for 90 days and are renewed when they get to 30 days before expiration.
[02:45:56]<millenniumtree>Renewal attempts are done once a week, so if they fail, we have a month to fix any issues before they expire. Once its set up, it just goes.
[02:46:26]<g1i7ch>That sounds like something I should do.
[02:46:51]<millenniumtree>https://www.drupal.org/node/2629560
[02:46:52]<hefring>https://www.drupal.org/node/2629560 => [meta] Let's encrypt support [#2629560] => 35 comments, 4 IRC mentions
[02:47:46]<millenniumtree>Looks like BOA may also have support for it built in.
[02:47:53]<g1i7ch>Thanks again! I should hang out on this channel more often! ;)
[02:48:24]<g1i7ch>I've had some issue with BOA and creating sites with SSL.. getting errors.
[02:48:43]<millenniumtree>It's often very quiet. Need to lurk and be patient. :)
[02:48:59]<millenniumtree>IC
[02:49:30]<millenniumtree>The most important part about LE is you have to have the domains pointed to your server before you try to get the SSL from LE.
[02:50:33]<millenniumtree>We create the site in Aegir w/o encryption (or enabled w/ self-signed), then when the DNS points, pull the cert and switch encryption to required in Aegir.
[02:51:15]<millenniumtree>Don't know how BOA handles it though.
[02:51:22]<g1i7ch>I've had some issue with BOA and creating sites with SSL.. getting errors."select a valid platform" error.
[02:54:19]<g1i7ch>Essentially, Barracuda mainly just deals with the server components and Aegir (and OS) upgrades. The sites and platforms are managed with Aegir.
[02:54:51]<millenniumtree>Out of my area of expertise, unfortunately. Omega8 appears here occasionally and is responsive to email questions though.
[02:57:25]<g1i7ch>I try not to pester people to spoon feed me. Ideally I like to know something inside and out so I feel confident in selling my skills. Aegir, and now BOA have opened a huge can of worms for me, so I'm inundated with so many new methods and ideas and I'm trying to make sense of it all in my head; connecting the dots.
[02:58:04]<millenniumtree>yeah, same here. I spend at least a few hours on stuff before I go begging. :)
[02:58:35]<g1i7ch>So yeah, thanks to Aegir I'
[02:58:42]<g1i7ch>I've been inspired quite a bit.
[02:58:44]<millenniumtree>If you get dead-ended: https://www.drupal.org/u/omega8cc
[02:58:59]<g1i7ch>It's a very empowering project. I just wish I could be a contributor.
[02:59:31]<g1i7ch>I'm just more of a technologist than a coder.
[03:01:08]<g1i7ch>So I really look up to people like you, it's a level of IT freedom I'm striving for.
[03:02:24]<millenniumtree>I don't contribute much but a patch once in a long while, but yeah. It's good to know there's a community of others who have probably seen the same errors.
[03:02:41]<g1i7ch>yeah, see. I wish I could fix issues and write patches.
[03:04:17]<g1i7ch>I'm a project developer, and pretty good at developing ideas and concepts. PHP is a steep climb for me. So I'm trying to pick up python. Hopefully it'll be a good stepping stone.
[03:05:09]<millenniumtree>Yeah. Code is code. PHP has a lot more semicolons, and the function names are all different... But in the end, code is code. The logic is transferrable.
[03:06:09]<g1i7ch>Yeah, that's why I figure Python is a good starter. It's closer to a natural language, so hopefully it'll get my brain to understand programming structures more.
[03:06:10]<millenniumtree>D8 is bringing some massive changes though - play with that. I'm still largely stuck in D6/D7.
[03:07:33]<g1i7ch>I just installed my first D8 instance. I loved D6 and took me a couple years to switch do D7.
[03:07:51]<millenniumtree>A tech school course or two could help out if you're just beginning, or a PHP or Python meetup group.
[03:09:47]<g1i7ch>Well, I went to college (the first time) for multimedia, so I used to do a lot of Javascript. I was a rockstar at Turing and Basic. and
[03:09:50]<millenniumtree>I've grown to hate D6, but I know how to get stuff done with it and we have many clients on it that we can't switch until I rebuild our platform on D8. I'm not even going to try putting it in D7 first, as they're so vastly different.
[03:10:18]<g1i7ch>I dropped D6 like a hot potato, once I saw the D7 light.
[03:11:02]<millenniumtree>Yeah, JS syntax is very similar to PHP but less dollar signs. :)
[03:11:36]<millenniumtree>That, and JS is completely event driven. PHP is simpler.
[03:12:09]<g1i7ch>So yeah, I'm not new to coding. But I stopped scripting a long time ago.. so I've lost my touch.
[03:12:18]* gandhiano_ has joined #aegir
[03:15:05]<g1i7ch>I'm not exactly starting out, more of trying to get back into it.
[03:16:03]<g1i7ch>Plus, two decades ago, coding for the internet was much simpler than it is these days.
[03:18:00]<g1i7ch>But thanks for all the inspiration you've given me today. I really appreciate it!
[03:19:52]<g1i7ch>What I would really love to do is create modules to integrate ERP systems with Drupal, like Tryton and Odoo.
[03:21:52]<g1i7ch>So I still have a long road ahead.
[03:23:18]* gandhiano_ has quit (Ping timeout: 246 seconds)
[03:24:26]<millenniumtree>Yeah. I have no clue about ERP.
[03:27:13]<g1i7ch>Well, I'm trying to get into providing enterprise level services. Looking for some financial stability as a freelancer.
[03:34:02]<g1i7ch>There's many companies out there that start out with MS Access, then get bogged down by it. It's like low hanging fruit. Also, established businesses are far more realistic about budgets than regular clients looking for simple web design.
[03:34:24]<g1i7ch>...I find.
[03:35:15]<millenniumtree>Yeah. "How much is a website?" they ask. "How much is a car?" we respond. You want a Yugo or a Tesla?
[03:36:08]<millenniumtree>We can spin up a dev site in seconds, but customizing it can take days, or weeks, or months if they're really picky.
[03:40:34]<g1i7ch>yeah, that's why I went back to school for a career change. I got so fed up with clients expecting not just a site, but also with facebook-like functionality, and then expecting me to teach them web design so they can do it themselves later, for the "generous offer" of $400 -because their nephew would do it for less-.
[03:42:13]<g1i7ch>And ironically, a few years ago, I partially reverted to IT again.
[03:43:11]<g1i7ch>I've just become a lot more selective with accepting clients.
[03:47:32]<millenniumtree>My boss is good at "filtering" too.
[03:49:03]<g1i7ch>Oh man.. One time I had a client try to sit next to me, as I typed out html, css and javascript. Demanding that I explain every tag. Then getting angry because it was taking to long.
[03:50:54]<g1i7ch>So now I prefer dealing with businesses.
[03:52:22]<g1i7ch>And I stay away from web design and focus Drupal sites in the form of "business applications"
[03:56:58]<millenniumtree>Totally.
[04:15:23]* gusaus has joined #aegir
[04:57:41]* mgann has joined #aegir
[05:18:22]* julienfayad has joined #aegir
[05:28:19]* julienfayad has quit (Quit: julienfayad)
[05:30:31]* theMusician has quit (Quit: theMusician)
[05:33:24]* julienfayad has joined #aegir
[05:36:44]* ergonlog1c has joined #aegir
[05:52:00]* theMusician has joined #aegir
[05:55:28]* julienfayad has quit (Quit: julienfayad)
[05:59:58]* julienfayad has joined #aegir
[06:02:22]* ergonlog1c has quit (Ping timeout: 252 seconds)
[06:10:55]* julienfayad has quit (Quit: julienfayad)
[06:19:47]* julienfayad has joined #aegir
[06:21:14]* mgann has quit (Quit: My iMac has gone to sleep. ZZZzzz…)
[06:35:59]* ergonlog1c has joined #aegir
[06:39:13]* g1i7ch has quit (Ping timeout: 252 seconds)
[06:39:28]* g1i7ch has joined #aegir
[07:00:42]* julienfayad has quit (Quit: julienfayad)
[07:07:53]* keke420 has joined #aegir
[07:08:52]* colan has quit (Remote host closed the connection)
[07:10:10]* keke420 has quit (Client Quit)
[07:10:17]* colan has joined #aegir
[07:28:11]* ergonlog1c has quit (Ping timeout: 240 seconds)
[07:43:41]* ergonlog1c has joined #aegir
[08:02:48]* theMusician has quit (Quit: theMusician)
[08:35:36]* theMusician has joined #aegir
[08:45:20]* lavamind has quit (Ping timeout: 250 seconds)
[09:25:32]* ergonlog1c has quit (Ping timeout: 258 seconds)
[09:37:59]* theMusician has quit (Quit: theMusician)
[09:45:51]* ergonlog1c has joined #aegir