xref's questions

I have a Deployment Manager template/schema and I want to dynamically include different startup-script options for cloud-init depending on the template.yaml I am calling. In my template.jinja I have:

      metadata:
        items:
        - key: startup-script
          value: |
{{ imports['startup-script-pre']|indent(14, true) }}
{{ imports['startup-script-custom']|indent(14, true) }}
{{ imports['startup-script-post']|indent(14, true) }}

All the imports are included in the final output, however the jinja2 inside of them is not processed, it leaves things like {{ env["name"] }} in there for cloud-init to fail on. Inside the GCP console the Expanded Config looks like:

systemctl daemon-reload
systemctl enable {{ env["name"] }}
systemctl start {{ env["name"] }}

which obviously cloud-init has no idea how to deal with.

Is there a way to force those imports to be processed for jinja instead of just inserted raw?

I have two VPCs peered on gcp, management and production. I gave the network tag bastion to my bastion vm inside the management vpc, and then made a firewall rule inside production to allow SSH traffic from anything tagged bastion. However production is not allowing ssh traffic from management with that network tag.

Unless I have something misconfigured, network tags do not seem to be working across peered VPCs. I've instead created a firewall rule inside production to allow the iprange of the management vpc, and that works, but I can't seem to do it with network tags.

On AWS I used this architecture to have a single bastion host in its own VPC, which was peered with 4 different VPCs (ex: dev/stage/prod). Only the bastion "management" VPC could communicate with any other VPC, there was no communication allowed between environments. I liked this setup since there was a single point of entry, and a single server to audit, for management access to our cloud resources.

GCP uses a different paradigm where a Project is somewhat akin to a VPC, but it doesn't appear to lend itself to the same kind of architecture as linked above. It looks like I may be able to cobble together something like AWS using Cross Project Networking (XPN) but it doesn't quite sound like the optimal solution.

So ultimately, is best practice on Google to create a separate bastion host for each of my 4 Projects, and have four points of entry and four servers to audit?

I have been following this guide to setup my AWS architecture, but instead of an ssh bastion host/jump box I'd prefer to use a VPN. There are lots of guides on connecting a VPC directly to a customer router, say for connecting the office to your AWS infrastructure.

However I'd like to make several individual users who can connect to the VPN directly from their laptops no matter their location. Just like individual employees can VPN into the office network, I'd like a solution where a few users could VPN directly into the AWS infrastructure.

Is that baked into AWS, or do I have to configure a separate EC2 instance with OpenVPN/Openswan to handle it?

Because of the way if statements work in nginx (no nesting, no multiple conditions) I can't figure out a way to combine these two features:

• Using the nginx Geo module I have a list of allowed ips
• On my filesystem if I touch appname in a certain dir the application automatically goes into 503 maintenance mode.

This is what I would like to do, but it's not allowed in nginx:

location / {
    if (-f /var/www/maintmode/appname && $allowed_ip = no) {
        return 503;
    }   
    try_files $uri;
}

If the above was possible in nginx, anyone on the allowed_ip list from the Geo module would bypass the 503 and get to use the site as normal. Then when verified the application is working rm appname from the maint dir and 503 maintenance mode ends.

The benefit of this method would be touching a single file enables/disables maint mode without ever having to modify a conf and reloading nginx.

Any ideas on how I can get something like this to work?

We're upgrading to Play 2.3.x (which uses activator) and CentOS 7 (which uses systemd). Previously on CentOS 6 we used this SysV init script to start/stop/restart our various Play applications. Is there a similar method for systemd now that most distros have migrated to it?

Currently we have 4 bare metal servers and one small VM server (all running centos6) and I'm looking at setting up monitoring for the Percona MySQL db server and replication slave (bare metal), as well as the remaining 3 which are app servers.

Curious what the preferred way to setup a monitoring config would be. Maybe spin up a small dedicated VM that just runs the monitoring tools for watching the other 5 servers remotely? Would you make the VM on the same host as the servers to be monitored? Maybe use a different host like Digital Ocean to run the monitoring tools?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting:

sshd, apache, nginx, postfix, dovecot, courier, pure-ftpd, bind, mysql

• Is there a command that can be run to see what running services are dependent on openssl?
• Is there a command to run against apache/nginx to see if the patch is active so the service doesn't need to be restarted?
• Should we just schedule downtime and reboot every server entirely?

EDIT: This post suggests using: lsof -n | grep ssl | grep DEL to display processes still using the old version of OpenSSL marked for deletion

I notice my local ~/.ssh/known_hosts file has two entries for the same machine on the local LAN:

 somemachine,192.168.1.200 ssh-rsa KEY...
 somemachine.search.domain ssh-rsa KEY...

It's the same key, the second one doesn't have the IP though. Is this just a result of having a search domain and so the known_hosts file must contain the "duplicate" key?

SSH won't detect it is visiting the same machine regardless of the hostname you attempt to connect with? 'SSH 192.168.1.200' does not request to create a new known_host so could I change the known_host to:

 somemachine,somemachine.search.domain,192.168.1.200 ssh-rsa KEY...

?

I asked this question at Atlassian but figured serverfault might be more appropriate as it's more of a sysadmin question than an Atlassian question:

I have been attempting to follow this guide to have FishEye+Crucible start at boot. JIRA is already installed and running as it's own user (jira) on Ubuntu at boot, but I cannot get Fisheye+Crucible (aka fecru) to do the same.

I followed the instructions there (and Ubuntu related note in the comments of the page) and rebooted, JIRA started on it's own as usual but fecru did not. Does it have something to do with the RUN_AS variable, which I set to 'jira'? Will that command run at boot without prompting for a password for the user 'jira'? I figured it would not prompt because the program JIRA starts at boot fine as that user...

Using:

Ubuntu 10.04 Lucid

Jira 5.0

Crucible+Fisheye 2.7.11

Since Rackspace Cloud only allows FTP access it makes using AutoMySQLBackup a little trickier, and while it is at least creating DB dumps I get errors in the backup log:

###### WARNING ######
Errors reported during AutoMySQLBackup execution.. Backup failed
Error log below..
.../backups/automysqlbackup: line 1791: /usr/bin/find: Permission denied
.../backups/automysqlbackup: line 1855: /usr/bin/find: Permission denied
.../backups/automysqlbackup: line 803: /usr/bin/find: Permission denied
.../backups/automysqlbackup: line 1972: /usr/bin/du: Permission denied

Since files are being created I'm assuming the find command failing has to do with actually rotating out and deleting the old backups?

Line 803:

find "${CONFIG_backup_dir}/${subfolder}${subsubfolder}" -mtime 
+"${rotation}" -type f -exec rm {} \;

Any ideas for alternatives?