...
The following is a UML Deployment Diagram of the service components.
Infrastructure Requirements
...
| Other resource requirements | SMS Gateway |
|---|---|
| Indicate which ones together with their specifics | needs an account on www.nexmo.com and sufficient funds to send SMSes account should be created with an email address that is read to receive "low balance" alerts, alternatively enable the feature "Auto reload" the accounts "key" and "secret" go into the product configuration ( CONFIG_CONFASSISTANT['SMSSETTINGS'] ) |
Infrastructure hosting requirements
Hosting requirements | Applying to Web Frontend | Applying to RADIUS | Applying to OCSP Responder |
|---|---|---|---|
Availability | 99.9% | 99.999% for the cluster as a whole NAPTR/SRV records make sure that uptime is assured if at least 1 server is up | 99.9% |
Backup (what, frequency, retention period) | What: database contents, product configuration, product logs Frequency: once per day Period: 1 month | server configuration, authentication log Frequency: hourly Period: 6 months (this is recommendation of eduroam Service Definition) | Apache configuration, content of OCSP directory Frequency: hourly Period: 1 month |
Monitoring and alerting1 | IPv4 and IPv6 reachability HTTPS on IPv4 and IPv6 MariaDB server running? memory and disk usage | IPv4 and IPv6 reachability RADIUS process (Status-Server via RADIUS/TLS; needs Icinga monitoring script) memory and disk usage | IPv4 and IPv6 reachability HTTP on IPv4 and IPv6 memory and disk usage |
Measuring and Reporting2 | number of institutions enrolled, monthly number of eduroam credentials created, monthly (both figures can be read from UI, cumulative; automated SQL queries can be crafted upon request) | N/A | N/A |
Log retention3 | for each month, 1 of the database backups should be retained "forever" product logs should be retained for 6 months | 6 months (this is recommendation of eduroam Service Definition) | not needed (1 day for debugging) |
Security policy for access and usage4 | The log and database should be accessible only to OT personnel. There is next to no PII in the log files or database - limited to ePTID of administrators and local (opaque) identifiers of end users. They can only be traced back to actual humans with out-of-band processes involving the IdP administrator in person. | The authentication logs should be accessible only to OT personnel. They contain pseudonyms of the local (opaque) identifiers of end users. They can only be traced back to actual humans with out-of-band processes involving the IdP administrator in person. | The authentication logs should be accessible only to OT personnel. They contain pseudonyms of the local (opaque) identifiers of end users. They can only be traced back to actual humans with out-of-band processes involving the IdP administrator in person. |
1 At minimum network accessibility (outside of LAN) and hardware resource usage must be monitored. Indicate if some of this resources can be deemed critical so that adequate thresholds for alerting are implemented. Additional, indicate which specific applications uptime and operational health must be monitored and alerting implemented.
2Define what should be measured, how and with what period in order to deliver appropriate reporting relating to KPIs, usage, etc.
4Define the policy for limiting accessing to the infrastructure piece and where it should be implemented (system level, network level etc.)
System and Application maintenance requirements
System and Application Requirements | Applying to Web Frontend | Applying to RADIUS | Applying to OCSP Responder |
|---|---|---|---|
Operating system | RHEL / CentOS 7 | RHEL / CentOS 7 | RHEL / CentOS 7 |
Applications1 | Apache 2, PHP7, MariaDB, haveged | FreeRADIUS 3 | Apache 2, PHP7 |
| Maintenance hours2 | product is used world-wide - there is never a good time | any time so long as one cluster member remains in service at all times | any time |
Configuration management3 | currently none (Git desirable) | currently none (Git desirable) | currently none (Git desirable) |
1 List the applications installed on a system, and add corresponding licenses where applicable.
2 Define window appropriate for regular maintenance. /give some recommendations
3 Applies for automatized configuration management. Describe system used.
Human resources requirements
Indicate requirements both in skills and manpower needed, for personnel needed for devops team (that maintains service specific applications) and for L2 support.
Description | Manpower | Recommended number of persons (considering backups) | Skills | |
|---|---|---|---|---|
| Operations FTE, inc CSI | 0.2 FTE | 2 | TBCeduroam OT member | |
| 1st level support (production) | 0.2 FTE max. 50 tickets per month. Estimate 30 mins per ticket, so 25 hours per month = roughly just under 0.2 FTE | 2 | TBCGEANT FLS / eduroam OT member | |
| 2nd level support (production) | 0.1 FTE. Estimate 10% of L1 tickets escalated, so 5 tickets per month at 2 hours per ticket. | 2TBC | eduroam OT member / development team member | |
| Service mgr for production (the contracts with participating NRENs etc.) | 0.1 FTE | 1Miro | !eduroam SM |