Update Infrastructure

[tfr42]

Server Infrastructure needs updates

• Obsolete PHP version website www.deegree.org #831 update PHP
• Upgrade Nexus repository manager on repo.deegree.org #554 upgrade Nexus Repository Manager
• Poor Blogging module on deegree website #515 replace the blog module and enable spam filter Add spam blocker to blog module #559
• upgrade JDK (was done in Upgrade jenkins CI on buildserver.deegree.org #553)
• Upgrade Jenkins ver. 2.138.3 to latest LTS version #956. Upgrade jenkins CI on buildserver.deegree.org #553 upgrade Jenkins CI
• support for SSL/HTTPS
• deegree.org (without subdomain) doesn't work #636 add A record for deegree.org to DNS entry
  see also Transfer plaza.deegree.org to new server sponsored by FOSSGIS e.V. #675 about the last changes to the server.

Get in concat with FOSSGIS eV and OSGeo sysadmin list about the domain and administration of the server, see FOSSGIS Wiki.

[copierrj]

Regarding the upgrade of Nexus:

It is no longer possible to download Nexus as a war file. We should however be able to install the provided 'bundle' (jetty + nexus).

Current configuration is in /usr/local/tomcat/nexus/webapps/ROOT/WEB-INF/plexus.properties
New configuration: ${install_dir}/conf/nexus.properties

[stephanr]

For the htts/ssl stuff, we talked about using a small footprint implementaion of lets-encrypt ACME protocol (https://github.com/lukas2511/dehydrated).
After the server update has been completed i will work on implementing https for plaza.deegree.org.

[copierrj]

Individual sysadmin actions:

• dist upgrade to debian 8
• apt-get openjdk-8
• apache
  • upgrade config to 2.4
  • switch from mod_jk to mod_proxy
  • add https support
  • test all configured sites
• tomcat
  • manually upgrade to 8.5 (unzip dist to /usr/local)
  • configure init.d scripts (consider switching to systemd service)
  • test all instances
• nexus
  • install using bundle
  • create systemd service
  • remove obsolete tomcat instance
• jenkins
  • replace war file
  • check if handbook builds are still working (latex has updated)
• website
  • update joomla
  • install new blog module
  • enable spam filter

[tfr42]

Post Upgrade actions:

• Upgrade postgresql from 9.1 to 9.4 required. postgres is used by ogcri.deegree.org services.
• Re-activate moinmoin wiki or provide HTML dump instead

[stephanr]

Post-Installation Steps:

• Archive the old wiki completely
  • create a html dump from the pages, maybe with https://moinmo.in/MoinDump
  • setup apache to server static archive files
  • remove the old software moinmoinwiki / configuration / maybe database content

[stephanr]

@tfr42 moinmoin wiki has been reactivated by disabling some manual tweaks and disabling the creation of new users.

Creating a html-only dump is from my point of view a desirable task (as the software was manually tweaked before on the user-handling and maybe this got lost on upgrade)

[stephanr]

The SSL support has been enabled and configured in apache2 based on letsencyrpt certificates.
Expirering notifications will be sent to the tmc mailing list, dehydrated was configured as systemd unit/timer to renew the certificates every two week.
The apache configuration will be reloaded automatically afterwards if the configuration has no syntax errors/problems.

I also adjusted accordingly the todo in comment above.

[tfr42]

to enable SSL see https://www.joomlart.com/tutorials/joomla-tutorials/how-to-use-ssl-in-a-joomla-site

[tfr42]

SSL support is working now for https://www.deegree.org/ some improvements for SEF are required.

[tfr42]

Next installation session planned for 2018-05-18 to update PHP (#831), Joomla! and Nexus.

[stephanr]

In today's TMC meeting we decided that it is sufficient to keep the old wiki as read-only dump for archive purposes.
I will try to create a dump before the next Update/TMC Meeting.

An Dump has been created and linked to http://apidoc.deegree.org/wiki-archive/ for preview purpose, after a further check the progress will conitnue later.

[dstenger]

I also installed Oracle JDK 8 on the server as otherwise the reference implementations do not pass any more (see #900 and #905). Just the Tomcat run by user ogcri is configured to use this Java installation.

If you have any questions, please feel free to contact me.

Commands executed:

root@plaza:~# echo "deb http://ppa.launchpad.net/webupd8team/java/ubuntu xenial main" | tee /etc/apt/sources.list.d/webupd8team-java.list
deb http://ppa.launchpad.net/webupd8team/java/ubuntu xenial main
root@plaza:~# echo "deb-src http://ppa.launchpad.net/webupd8team/java/ubuntu xenial main" | tee -a /etc/apt/sources.list.d/webupd8team-java.list
deb-src http://ppa.launchpad.net/webupd8team/java/ubuntu xenial main
root@plaza:~# apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys EEA14886
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.I1KOA8sZSm --no-auto-check-trustdb --trust-model always --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg --keyring /etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys EEA14886
gpg: requesting key EEA14886 from hkp server keyserver.ubuntu.com
gpg: key EEA14886: "Launchpad VLC" 12 new signatures
gpg: Total number processed: 1
gpg:         new signatures: 12
root@plaza:~# apt-get update
root@plaza:~# apt-get install --no-install-recommends oracle-java8-installer

[tfr42]

An Dump has been created and linked to http://apidoc.deegree.org/wiki-archive/ for preview purpose, after a further check the progress will conitnue later.

The static HTML pages of the old wiki look good for me. May be we replace the header images with stronger message that this is an archive version of the old wiki.

[stephanr]

The wiki has been replaced by a static dump and the software (pkg python-moinmoin) was deinstalled.
Also the logo has been altered to "-archived- deegree -wiki-" to state that this an read-only archive.

[stephanr]

For reference: Ticket to test if a migration of joomla is possible: #906

[tfr42]

Upgrade to OpenJDK 1.8.0_201-b09 done

[tfr42]

Docker version 18.06.2-ce, build 6d37f41 installed on plaza. Currently disabled in systemctl!

[tfr42]

All services have been updated during server migration, see issue #1130.