Setting up a new shared web proxy

Adding

  1. In ansible seed inventory repo, edit hosts.yml and add the new host in all places an existing host exists.
  2. Execute sower --live generate:weborigin --parent hostxxx.mayfirst.org to generate a new weborigin yaml file.
  3. Follow regular kvm guest setup steps

Note: The next steps have to happen close together. After you run the first step, changes to any web configuration in the control panel will fail until you have completed the remaining steps.

  1. Run sower playbook with --secrets --tags red against red001
  2. From the key server, copy all certs and keys to the new server: mf-cert-distribute --send-to-server <webproxy> --copy-only --all-certs Warning: No output, and it takes a while! You can track progress by counting directories on the webproxy in /etc/ssl/mayfirst
  3. On the control panel UI server, copy out all the ngninx configuratins (without a restart of nginx): su - red -s /usr/local/share/red/ui/sbin/red-nginx-distribute --all --send-to-server <webproxy>
  4. Manually restart nginx on the new web proxy server.
  5. Update nftables on all weborigin servers: sower --live playbook --tags nftables weborigin00[1234567].mayfirst.org

Removing

  1. On the web proxy, run mf-web-sites-resolving-here to ensure no existing web sites are still resolving to this web proxy.
  2. In ansible seed inventory repo, edit hosts.yml and update the m_web_proxy_servers variable to remove the new host.
  3. Run sower playbook with --secrets --tags red against red001
  4. Run sower playbook with --tags keystore against ‘key001`
  5. On the key server, remove from the sqlite file cache (replace “NNN” with the actual number): sqlite3 /var/lib/mf-cert-distribute/dist.db "DELETE FROM file_sync WHERE name LIKE 'webproxyNNN%'"