sybreon's questions

I'm considering setting up a way to automate data redundancy and synchronisation of multiple workstations at the office. The way our office is setup, nobody has a fixed desk and anyone can login and work on any workstation on the network.

One way of doing this would be to have a NFS mounted /home filesystem. However, that would slow down file access as everything would need to be pulled off the network plus it creates a single point of failure.

This is the general idea.

[WS-A]--- (DRBD) ---[BACKUP]--- (DRBD) ---[WS-B/C/D/etc]

The idea is for someone to work on WS-A and whatever file saved is automatically synchronised with another machine (backup). So, the data is now available on more than one machine.

Ideally, the data should synchronise and propagate itself across all the workstations WS-B, WS-C, etc on the network. This propagation and synchronisation does not need to be instantaneous and can be asynchronous as long as the same user can log into any workstation at another time (but only one machine at a time) and find their latest files present.

Also, if any workstation crashes, the setup will automatically recover and resync after the machine comes back onto the network, preventing split-brain problems.

1. Would this even be possible with DRBD; and
2. Are there any nightmare synchronisation issues that we might need to worry about?

PS: We currently have a similar setup that uses glusterfs and it seems to work thus far, except that the performance drops when accessing a large git repository over it.

I am in the process of setting up a number of servers and was just wondering where I should locate these servers? There are so many providers in so many countries.

So, I am just looking for some thoughts on issues affecting the selection of a hosting provider's geographic location, assuming the dollar costs are similar.

1. Network performance. This is an obvious one. I am planning to consider the physical links (i.e. submarine cables) connecting the audience country directly to the hosting geographic location? Or am I just being too 'over-kill' on this and the performance differences are negligible?

2. Local laws - the equivalent of 'tax havens' for digital audiences. Assuming that the site may host objectionable content for certain audiences (e.g. the vb.ly case). Which are the most liberal countries, when it comes to action taken by hosting providers against objectionable content?

Any other thoughts?

I am looking to set up something like this:

[internet]----[static mirror]----[dynamic back-end]

In this case, the publicly available web server is running a static cache of a web-site. The static cache may be updated periodically with content from a dynamic back end. I am thinking of both performance and security in mind.

It may not be suitable for a reverse caching proxy like varnish because if the back-end goes does for prolonged periods, varnish will also cache the error. However, this may be cause by my lack of understanding for the tool.

The closest that I can think of is to use httrack to mirror the content periodically and then to serve that content using any normal web server including proxytrack.

I was wondering if anyone knows the right tools to use?

I was just wondering if there is a way to give a user root access escalation on a *nix system, kind of like sudo, but which requires more than one sysadmin authorisation. I am thinking of something sort of like how a self-destruct command on a starship requires multiple command-level authorisations.

Is there a way to configure varnish or any other caching reverse proxy, to serve pages from its cache when the back-end fails? At the moment, if the back-end goes down a 503 Service Unavailable error would be returned to the browser. I would prefer it if visitors got to see a cached version than an error page while the back-end is being fixed.

My setup:

[varnish (public ip)] <===> [router] <===> [web server (private ip)]

PS: I have only one back-end web server.

This is for either Linux/BSD.

I was just wondering if it was safe to run a firewall off a single ethernet port. The firewall machine would have a single ethernet port that is connected to a switch. The ADSL modem is also connected to the same switch.

The firewall uses the ETHERNET interface as the GREEN interface and uses PPPOE interface as RED interface. Obviously, the PPPOE is routed over the same GREEN interface onto the ADSL modem.

Logically, the two interfaces are separate. So, filtering rules can be applied. However, as they share the same physical connection, I'm wondering if that logical filtering is sufficient isolation.