The host is reachable by ssh at '''osgeo6.osgeo.osuosl.org'''.

Used to be the [[Mail server]] but as of March 2026 its been reformatted to be incus host.

= Hardware =

Details:
CPU: 2 x Intel Xeon E5-2620v3, 2.4 GHz (6-Core, HT, 15MB Cache, 85W) 22nm
RAM: 128GB (8 x 16GB DDR4-2133 ECC Registered 2R 1.2V DIMMs) Operating at 2133 MT/s Max
NIC: Dual Intel i210 Gigabit Ethernet Controllers - Integrated
Management: Integrated IPMI 2.0 & KVM over LAN
Controller: 10 Ports 6Gb/s SATA (Intel C612 Chipset)
PCIe 3.0 x8: No Item Selected
NOTE: Hot-swap and fixed drives will be connected to SATA3 controller (C612) unless otherwise specified
Hot-Swap Drive - 1: 80GB Intel DC S3500 Series MLC (6Gb/s, 0.3 DWPD) 2.5" SATA SSD
Hot-Swap Drive - 2: 80GB Intel DC S3500 Series MLC (6Gb/s, 0.3 DWPD) 2.5" SATA SSD
Hot-Swap Drive - 3: 480GB Intel DC S3500 Series MLC (6Gb/s, 0.3 DWPD) 2.5" SATA SSD
Hot-Swap Drive - 4: 480GB Intel DC S3500 Series MLC (6Gb/s, 0.3 DWPD) 2.5" SATA SSD
Hot-Swap Drive - 5: 480GB Intel DC S3500 Series MLC (6Gb/s, 0.3 DWPD) 2.5" SATA SSD
Hot-Swap Drive - 6: 480GB Intel DC S3500 Series MLC (6Gb/s, 0.3 DWPD) 2.5" SATA SSD
Optical Drive: No Item Selected

3 year warranty starting on May 4,2015 ending on May 4,2018

Disks were replaced March 2026 with 5 SSD
<pre>
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 1.8T 0 disk
└─sda1 8:1 0 1.8T 0 part
└─md1 9:1 0 7.3T 0 raid5
├─osgeo6-swap 253:0 0 29.8G 0 lvm [SWAP]
├─osgeo6-root 253:1 0 186.3G 0 lvm /
└─osgeo6-incus_zfs 253:2 0 4T 0 lvm
sdb 8:16 0 1.8T 0 disk
└─sdb1 8:17 0 1.8T 0 part
└─md1 9:1 0 7.3T 0 raid5
├─osgeo6-swap 253:0 0 29.8G 0 lvm [SWAP]
├─osgeo6-root 253:1 0 186.3G 0 lvm /
└─osgeo6-incus_zfs 253:2 0 4T 0 lvm
sdc 8:32 0 1.8T 0 disk
├─sdc1 8:33 0 1G 0 part /boot/efi
├─sdc2 8:34 0 1G 0 part
│ └─md0 9:0 0 1022M 0 raid1 /boot
└─sdc3 8:35 0 1.8T 0 part
└─md1 9:1 0 7.3T 0 raid5
├─osgeo6-swap 253:0 0 29.8G 0 lvm [SWAP]
├─osgeo6-root 253:1 0 186.3G 0 lvm /
└─osgeo6-incus_zfs 253:2 0 4T 0 lvm
sdd 8:48 0 1.8T 0 disk
sde 8:64 0 1.8T 0 disk
└─sde1 8:65 0 1.8T 0 part
└─md1 9:1 0 7.3T 0 raid5
├─osgeo6-swap 253:0 0 29.8G 0 lvm [SWAP]
├─osgeo6-root 253:1 0 186.3G 0 lvm /
└─osgeo6-incus_zfs 253:2 0 4T 0 lvm
sdf 8:80 0 1.8T 0 disk
├─sdf1 8:81 0 1G 0 part
├─sdf2 8:82 0 1G 0 part
│ └─md0 9:0 0 1022M 0 raid1 /boot
└─sdf3 8:83 0 1.8T 0 part
└─md1 9:1 0 7.3T 0 raid5
├─osgeo6-swap 253:0 0 29.8G 0 lvm [SWAP]
├─osgeo6-root 253:1 0 186.3G 0 lvm /
└─osgeo6-incus_zfs 253:2 0 4T 0 lvm
</pre>

== Services ==
Refer to [[SAC Service Status#osgeo_6]]

[[Category:Infrastructure]]

2025-11-16T11:21:53Z

Robe:

Infrastructure of OSGeo System Administration Committee ([[SAC]])

For emergency plans see: [[SAC:Admin and Troubleshooting]]

= Servers at OSL =
[[OSL | Open Source Labs]] - 7 physical machines of which 5 ar lxd hosts containing ''x'' virtual machines/containers.

== Logging into Physical Machines ==

Currently we have osgeo6 and backup.osgeo.osuosl.org that are physical machines under LDAP control.

'''Note this does not apply to osgeo3, osgeo4, osgeo7, osgeo8, osgeo9 lxd hosts'''. Refer to those sections for instructions on logging in.
If hanging, see [[OSL]] for how to open a ticket with OSUOSL's support.

This section currently only applies to '''osgeo6''' and '''backup'''.

All [[SAC#Members|SAC administrators]] have LDAP auth to the OSL Machines.

To ssh into a server using your LDAP account, you can do the following replacing '''your_osgeo_login''' with your OSGeo login and '''vmname''' with the vm name of the server at OSL.

ssh '''your_osgeo_login'''@'''servername'''.osgeo.osuosl.org

When prompted for password, use your OSGeo Login password.

[[SAC:Primary Administrators]] also have ssh key access in case LDAP is down and that will also apply to the physical machines. Worst case scenario use the information on [[OSL | Open Source Labs]] to file a ticket (SAC members only). Direct connection to virtual machines is by appending it's vm alias to .osgeo.osuosl.org.

== Logging into LXD Hosts ==

OSGeo3, OSGeo4, OSGeo7, OSGeo8, and OSGeo9 are all Ubuntu servers running LXD.
LXD is a management system for LXC containers and QEMU VMS. LXD has a [https://www.youtube.com/channel/UCuP6xPt0WTeZu32CkQPpbvA channel] that covers its features.

To directly access the host, you go thru port 2222

ssh tech_dev@''server_name''.osgeo.osuosl.org -p 2222

Only [[SAC:Primary Administrators]] have their ssh key installed under that account. In order to access via KVM of these in event servers do not come up on a reboot, you need to go thru OSU OSL OpenVPN. To get an OpenVPN account, you need to put in a support ticket to support@osuosl.org. In order to qualify for an OpenVPN account, you need to be an OSGeo SAC administrator. You will also need to install [https://openvpn.net/community-downloads/ OpenVPN client]) to use your OpenVPN account.

Each host on the private KVM side is named https://'''osgeo8'''.osuosl.oob -- where replace '''osgeo8''' with the relevant host. The .oob is the private network, so doesn't work unless you are connected to via OpenVPN.

The browser interface is sometimes clunky, so you might want to use '''ipmitool''' installable on linux/unix or wsl using relevant package manager. KVM passwords are stored in [https://git.osgeo.org/gitea/sac/password-store SAC password-store].

A convenient block to add to your ~/.ssh/config to easily login to osgeo's LXD hosts follows:

Host osgeo?
User tech_dev
HostName %h.osgeo.osuosl.org
Port 2222

Then you would be able to log into those hosts with commands like:

ssh osgeo7

== Logging into LXD Containers and VMs ==

A convenient block to add to your ~/.ssh/config to easily login to osgeo's LXD hosted containers and vms is the following:

# This stanza is only needed if you have an IdentityFile configured below.
# The IdentityFile from a target host is not automatically applied to the hop host, so we need to make it explicit:
Host hop.*.osgeo.org
IdentityFile "path/to/your/private/key"

Host osgeo*-*
ProxyCommand ssh hop.$(sed -e "s/-.*//" <<< "%h").osgeo.org -W $(sed -e "s/^osgeo[^-*]-//;s/$/.lxd/" <<< "%h"):%p
# this is only needed if you you use different private keys for different servers
IdentityFile "path/to/your/private/key"

Then you'll be able to access a LXC Container or QEMU VM on machine `osgeo3` with:

ssh yourusername@osgeo3-matrix

And one on machine `osgeo7` with:

ssh yourusername@osgeo7-download

Note you still need to know where each LXC host is hosted... See successive sections to know what's on which machine.

'''Troubleshooting:''' In case of "Permission denied (publickey)." after an update to a modern openSSH version, it might well be that your ssh key (RSH key) is disabled in your client in favour of more modern cyphers.

Ugly workaround: add one line `PubkeyAcceptedKeyTypes ...` in `.ssh/config`, to re-enable RSA keys for now (consider to generate a new key):

vim .ssh/config
...
Host *
...
PubkeyAcceptedKeyTypes +ssh-rsa

... but better read e.g. [https://dev.to/bowmanjd/upgrade-ssh-client-keys-and-remote-servers-after-fedora-33-s-new-crypto-policy-47ag here]!

== osgeo 8 ==
Server added April 2021, donated by OpenStreetMap project.

Likely machine: https://web.archive.org/web/20191112203036/https://hardware.openstreetmap.org/servers/stormfly-01.openstreetmap.org/

Intended to provide additional LXD capacity and backup.

[[osgeo8|Configuration Details]]

=== Services running on osgeo8 ===

==== hop ====
hop.osgeo8.osgeo.org - jump host for accessing containers/vms on osgeo8

==== nginx ====
http, https Proxy for all containers on osgeo8 and also provides mirror proxy for download.osgeo.org

==== centtie-7-pgrouting ====
Centos 7 running PostgreSQL 15, PostGIS 3.3.2, gcc-4.8.5, cmake 3
Configured to be a github self-hosted runner for testing centos for pgrouting project

[https://github.com/pgRouting/admin/wiki/CI%3A-Centos-7-GHA-runner Details of Github Action runner setup]

==== download8 ====

Replica of download that is on osgeo7.
Mirrors download and home folders from osgeo7.
https://download-cache.osgeo.org

See [[Download Server]]

==== dronie-client ====
a ci bot for dronie.osgeo.org which is used for git.osgeo.org/gitea ci jobs

==== grass-wiki ====

See [[SAC:GrassWiki]]

==== grass ====
https://grass.osgeo.org upgraded to Bullseye debian 11.

GRASS GIS server

Current DNS name: grass.osgeo.org

Debian 11 Bullseye

Web: Apache + Hugo (generated through cronjob from https://github.com/OSGeo/grass-website/), see https://github.com/OSGeo/grass-addons/tree/grass8/utils/cronjobs_osgeo_lxd

`unattended-upgrades` for automatic installation of security upgrades is installed and running

ssh: reachable via jumphost.

==== meshcentral ====
https://remote.osgeo.org
This is a remoting tool currently setup to test livecd vms via a web browser.

4 VMS currently set up on osgeo8 accessible from this. Currently based on livecd 16rc1 snapshots, with wm install script run.

==== pgrouting-dev ====
For pgrouting development use to do things like pushing docker images on a scheduled basis.
Perhaps later for demo sites. WIP.

==== woodie-client-vm ====

Separate agent for woodie-server, this one is a true VM rather than container.

==== woodie-server ====

See [[Woodie]]

== osgeo 9 ==
Server added April 2021, donated by OpenStreetMap project.

Likely machine: https://web.archive.org/web/20191112203042/https://hardware.openstreetmap.org/servers/stormfly-02.openstreetmap.org/

Is an LXD host. Also Stores lxd images used by other lxd hosts.

[[osgeo9|Configuration Details]]

=== Services running on osgeo9 ===
==== hop ====
hop.osgeo9.osgeo.org. For LDAP users allows them to hop thru to get to other containers.

==== Secure (LDAP ) ====
[https://git.osgeo.org/gitea/sac/osgeo9/wiki/secure-container secure] -- ldap.osgeo.org [[SAC:LDAP]] used for ldap service (a rebuild of old secure.osgeo.osuosl.org) now on Debian 11
Moved from osgeo7

==== ldap-web ====

Currently housing https://id.osgeo.org/ for LDAP management.
Deployed via ansible
Moved from osgeo9

* id.osgeo.org

==== jitsi ====

See [[SAC:Jitsi]] (for video meetings)

==== nextcloud ====
https://nextcloud.osgeo.org

Ubuntu 22.04 LXD/nginx/postgresql 14 container for document sharing similar to dropbox/google drive - nextcloud.lxd - https://nextcloud.osgeo.org [https://git.osgeo.org/gitea/sac/osgeo9/wiki/Nextcloud-container Nextcloud Setup]

home of https://nextcloud.osgeo.org
This server does not use ssh osgeo-ldap as it was the first container built. However nextcloud.osgeo.org does authenticate with osgeo ldap.

TODO: add special page for this

==== nginx ====
nginx (for web proxy of traffic of osgeo9 containers) additional mirror proxy for download.osgeo.org

==== adventure (WIP)====
https://adventure.osgeo.org runs https://github.com/thecodingmachine/workadventure software

==== dronie-client ====
a ci bot for dronie.osgeo.org which is used for git.osgeo.org/gitea ci jobs

==== limesurvey ====
Debian 10, PostgreSQL 13, PHP 8 with ldap/ssh. https://limesurvey.osgeo.org
Setup detailed on [https://git.osgeo.org/gitea/sac/osgeo3/wiki/limesurvey-container limesurvey container]

==== pixelfed ====

SHUT OFF (both container and website) cause of lack of interest. Container is still there.
[[Pixelfed]] instance reachable on https://photo.osgeo.org to house community photos

==== peertube ====

[[Peertube]] instance reachable on https://video.osgeo.org

==== pretalx ====
Ubuntu 20.04 with OSGeo LDAP and Docker installed. pretalx software runs in Docker.
https://talks.osgeo.org - for OSGeo Talk collection and voting See [[Pretalx]]

==== weblate ====
'''Container Name:''' weblate (for doc translation)

Houses: https://weblate.osgeo.org (for document translation to different languages)

For further details refer to [[SAC:Weblate]]

==== wordpress ====

See [[SAC:Wordpress]]

==== wiki ====

See [[OSGeo Wiki]]

==== discourse ====

See [[SAC:Discourse]]

==== mail ====

Hosts: lists.osgeo.org, mail.osgeo.org and a few other services.
See [[Mail server]] for more details.

== osgeo 7 ==

Server added June 2018. Intended to replace osgeo3 and old osgeo4 (before reformat).
See [[Osgeo7]] for configuration details.

[https://git.osgeo.org/gitea/sac/osgeo7/wiki/_pages Container setup of all the osgeo7 servers is located in https://git.osgeo.org/gitea/sac/osgeo7/wiki/_pages]

Running LXD 3 snap based container management -- LXD version 3.17 as of 2019-09-15

=== Accessing osgeo7 containers via ssh ===

Only the download.osgeo.org is directly exposed ssh via port 22. To access the other containers, you can tunnel thru
download.osgeo.org -- You need to be in the shell group to be able to access download and the other servers. If you are not already put in a [https://trac.osgeo.org/osgeo/newticket SAC Ticket Request]. You also need to have your public key registered. To do so edit your profile [https://id.osgeo.org/ldap/edit] (and put in your public key)

A convenient block to add to your own `.ssh/config` file follows:

Host osgeo7-*
ProxyCommand ssh your_osgeo_id@hop.osgeo7.osgeo.org -W $(sed -e "s/^osgeo7-//;s/$/.lxd/" <<< "%h"):%p
IdentityFile "path/to/your/private/key"

With the above in place, you can connect to any container using:

ssh your_id@osgeo7-<container_name>

'''Troubleshooting:''' In case of "Permission denied (publickey)." after an update to a modern openSSH version, it might well be that your ssh key (RSH key) is disabled in your client in favour of more modern cyphers.

Ugly workaround: add one line `PubkeyAcceptedKeyTypes ...` in `.ssh/config`, to re-enable RSA keys for now (consider to generate a new key):

vim .ssh/config
...
Host *
...
PubkeyAcceptedKeyTypes +ssh-rsa

... but better read e.g. [https://dev.to/bowmanjd/upgrade-ssh-client-keys-and-remote-servers-after-fedora-33-s-new-crypto-policy-47ag here]!

=== Services on osgeo7 ===

==== Download ====

See [[Download Server]]

==== nginx ====
Proxy that routes all http/https traffic for the other containers (can be accessed via osgeo7 host lxc or ubuntu@osgeo7-nginx if your key is installed on ubuntu user).
The nginx container holds the letsencrypt https SSL certs for all the containers and handles the renewal of the letsencrypt certs using certbot renew cronjob.
Prometheus server to collect all monitoring logs from OSGeo7 (only accessible by OSGeo3), these get queried via monitor.osgeo.org (running on osgeo3) via grafana server.

==== tracsvn (trac, svn, git) ====

Home of [[Trac]], [[SAC:Git Service|Git]] and [[Subversion]] services.

See [[TracSVN]] for full details.

=== gallery ===

Picture gallery.
See [[Gallery]]

==== old-wiki (stopped) ====
This used to be housed on osgeo3, and was moved 2019-09-14 to osgeo7 as old-wiki container.
wiki.osgeo.org moved back to osgeo3 on 2020-05-22 and in wiki container. The wiki container is a complete rebuild with files and database restored and upgraded.
Refer to the osgeo3 section for more details.

[https://git.osgeo.org/gitea/sac/osgeo7/wiki/old-wiki-container old wiki container] -- used for wiki service (it is an lxd2pc created image of wiki.osgeo.osuosl.org VM that was on osgeo3)

See [[OSGeo Wiki]]

==== nextcloud-ubuntu (stopped) ====
Moved to osgeo9

==== collabora (stopped) ====
# https://collabora.osgeo.org
Ubuntu 18.04 LXD container for LibreOffice/MS Office online document editor currently used exclusively by nextcloud.osgeo.org. Setup detailed in Nextcloud setup.
No longer needed now that nextcloud is using a self-contained collabora instance.

==== live ====
Home of live.osgeo.org (created 2021-10-05ish
Running Ubuntu 20.04 with OSGeo LDAP SSH

==== dronie-server ====

See [[Dronie]]

==== old-projects (stopped) ====
-- this is the old projects.osgeo.osuosl.org migrated from osgeo4 as an lxd container, so more or less the same as it was before, with the exception that all the websites are now proxied thru the nginx container. Websites on it are community-review.foss4g.org and spatialreference.org

To access you need to go thru download.osgeo.org -> old-projects

==== old-web (stopped) ====
The old web.osgeo.osuosl.org (was on osgeo3)

* mapguide.osgeo.org

==== old-webextra ====
This is a replica of webextra.osgeo.osuosl.org that was hosted on osgeo3

Started move on November 29th 2019 and completed December 8th, 2019
* foss4g.org
* europe.foss4g.org
* video.foss4g.org
* planet.osgeo.org
* various old foss4g.org years
* <del>live.osgeo.org</del> moved to dedicated container
* journal.osgeo.org (not sure what this is for, should be retired?)
* <del>vmap0.tiles.osgeo.org</del> #removed site

==== pycsw ====
'''Container Name:''' pycsw

* https://demo.pycsw.org
* '''OGC CSW Reference Implementation and Server demo'''
* deployment setup at https://github.com/geopython/demo.pycsw.org
* running hourly teardown/setup cron via docker-compose
* migrated from [[AdhocVM#Existing_services_hosted_on_the_Ad-hoc_VM:|Adhoc VM]] thanks to [https://trac.osgeo.org/osgeo/ticket/2452 SAC] (May 2020)

==== mapserver ====

See [[MapServer_at_osgeo7]]

=== osgeo7 decommissioned containers ===

==== <del>old-adhoc</del> ====

'''SHUTOFF as of 2022-01-29'''

[[AdhocVM|old-adhoc]] -- this is the old adhoc.osgeo.osuosl.org migrated 2019-05-08 from osgeo4 as an lxd container.
Used by osgeo-live for there test docs and by grass for earthquake, and mapserver for demo.
Note that there is a new live (container that osgeo-live will more to), there is also a mapserver container (which mapserver have started to move their demo to)

To access via ssh you should go thru download.osgeo.org -> old-adhoc.lxd
It is accessible via https://adhoc.osgeo.org and http://adhoc.osgeo.osuosl.org

* VM used for projects for various adhoc purposes. Risks to system stability that would be unacceptable on the Projects VM may be ok here.
* See [[AdhocVM]] for full details, and some notes on services running here.
* eg http://adhoc.osgeo.osuosl.org/livedvd/docs/en/quickstart/

== osgeo6 ==

See [[osgeo6]]

== Backup (osgeo5) ==
* Backup now runs on dedicated hardware
* Provides Rsync backups of download.osgeo.org
* Provides Bacula backups of various VMs.
* See [[SAC:Backups]] for details.

== osgeo4 ==

osgeo4 is a real server managed by OSUOSL - can be access via ssh tech_dev@osgeo4.osgeo.osuosl.org -p 2222 (only people with their access keys installed can log in and doesn't allow password access) - password for tech_dev is in the secure container (on osgeo7) / access folder.

In August 2019 the server had new power supply put in and replacement disks. It was reformatted with Ubuntu 18.04.3 to serve as secondary LXD host to osgeo7
zfsutils-linux was installed so lxd can use zfs for storage.

=== sshing into osgeo4 containers ===
Note that all the containers are closed off from direct ssh access except for the hop.osgeo4.osgeo.org. To access the other containers, you need to hop through hop.
hop container has port 22 open but requires ssh access so users who’ve been granted rights can hop thru it to other containers using hop.osgeo4.osgeo.org as name.

A convenient block to add to your own .ssh/config file follows where your_id could be your osgeo id or a local account on that container

Host osgeo4-*
ProxyCommand ssh your_osgeo_id@hop.osgeo4.osgeo.org -W $(sed -e "s/^osgeo4-//;s/$/.lxd/" <<< "%h"):%p
IdentityFile "path/to/your/private/key"
User your_id

Then to access say the wordpress-dev container, you'd do the below

ssh osgeo4-wordpress-dev

=== osgeo4 baremetal features ===
It's makeup is as follows:
{| class="wikitable"
|-
! Item !! Settings
|-
| Disks || 6 1.8 TB drives
|-
| Memory || 48 GB
|-
| CPUs || 8 Intel(R) Xeon(R) CPU E5540 @ 2.53GHz (8192kb cache)
|}
<pre>lsblk -i
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 1.8T 0 disk
|-sda1 8:1 0 953M 0 part
| `-md0 9:0 0 952M 0 raid1 /boot
`-sda2 8:2 0 46.6G 0 part
`-md1 9:1 0 46.5G 0 raid1
|-lvm-root 253:0 0 37.3G 0 lvm /
`-lvm-swap 253:1 0 7.5G 0 lvm [SWAP]
sdb 8:16 0 1.8T 0 disk
|-sdb1 8:17 0 953M 0 part
| `-md0 9:0 0 952M 0 raid1 /boot
`-sdb2 8:18 0 46.6G 0 part
`-md1 9:1 0 46.5G 0 raid1
|-lvm-root 253:0 0 37.3G 0 lvm /
`-lvm-swap 253:1 0 7.5G 0 lvm [SWAP]
sdc 8:32 0 1.8T 0 disk
sdd 8:48 0 1.8T 0 disk
sde 8:64 0 1.8T 0 disk
sdf 8:80 0 1.8T 0 disk
</pre>

<pre>
sdc,sdd,sde,sdf form a zfs osgeo4_lxd partition (sdc,sdd) mirrors sde,sdf for total lxd capacity of 3.62 TB
</pre>

Nightly backups of osgeo3, osgeo7, and osgeo4 containers are kept here and named <container>-backup and be kept in a stopped state.

== Services running on osgeo4 ==

=== hop ===
'''Container Name:''' hop - this is the only container with direct ssh access via ssh hop.osgeo4.osgeo.org. To get to other containers, you need to hop thru this one. Requires ssh key access

=== ansible-dev ===
'''Container Name:''' ansible-dev, has ansible 2.9.27 installed and all plugins needed to manage OSGeo ansible infrastructure.
DEPRECATED, use `ansible-dev`

=== ansible-control ===
'''Container Name:''' ansible-control, can be used to deploy OSGeo ansible infrastructure. Replaces `ansible-dev`

=== osgeo4-nginx ===
'''Container Name:''' osgeo4-nginx ->> all web traffick from other containers on osgeo4 get proxied thru here

=== old-web-staging ===
'''Container Name:''' old-web-staging - used primarily for experimenting with changes to id.osgeo.org (old-web on osgeo7) like testing out OS and software upgrade etc, changes to LDAP forms and registration, before applying to id.osgeo.org. - https://id.staging.osgeo.org

=== pretalx-staging ===
'''Container Name:''' pretalx-staging - used primarily for experimenting with changes to talks.osgeo.org (pretalx on osgeo3) like testing out Docker builds and software upgrade etc, before applying to talks.osgeo.org. - https://talks.staging.osgeo.org

=== wordpress-dev ===
'''Container Name:''' wordpress-dev - used primarily for osgeo.org main website development - https://staging.www.osgeo.org, https://dev.www.osgeo.org

=== wiki-dev ===
'''Container Name:''' wiki-dev - used primarily for experimenting with changes to wiki.osgeo.org like testing out OS and software upgrade etc before appying to wiki.osgeo.org. - https://dev.wiki.osgeo.org

=== wiki-staging ===
'''Container Name:''' wiki-staging - used primarily for upgrade changes to wiki.osgeo.org like testing out OS and software upgrade etc before applying to wiki.osgeo.org. - https://staging.wiki.osgeo.org. The construction of this container is managed by sac ansible-deployment.

=== tracsvn-dev ===
'''Container Name:''' tracsvn-dev - This is a 2019-09-05 lxd2pc image of tracsvn.osgeo.osuosl.org (now on osgeo7 as tracsvn) used primarily for experimenting like testing out OS, git and software upgrade etc before appying to production. -- https://dev.git.osgeo.org, https://dev.tracsvn.osgeo.org Has the following sites: https://dev.trac.osgeo.org, https://dev.git.osgeo.org/gitea, https://dev.svn.osgeo.org.

It was upgraded to Debian 11 on 2024-08-21.

=== dronie-client ===
'''Container Name:''' dronie-client - This is a debian 10 machine, with OSGeo LDAP authentication and a drone-agent docker running. To be used with https://dronie.osgeo.org

== osgeo3 ==
osgeo3 physical server refer to [[osgeo3|Configuration Details]] for hardware specs. It is used to run production, but moderately risky things. Refer to [[SAC:Old-osgeo3]] for past history before osgeo3 was rebuilt.
osgeo3 is a hosted by OSUOSL - can be accessed via ssh tech_dev@osgeo3.osgeo.osuosl.org -p 2222 (only people with their access keys installed can log in and doesn't allow password access) - password for tech_dev is in the secure container (on osgeo7) / access folder.

=== sshing into osgeo3 containers ===
Note that all the containers are closed off from direct ssh access except for the hop.osgeo3.osgeo.org. To access the other containers, you need to hop through hop.osgeo3.osgeo.org.
hop container has port 22 open but requires ssh key access, you need to be added to shell group and have your ssh keys registered on your profile https://id.osgeo.org/ldap/edit). Users who’ve been granted rights can hop thru it to other containers using hop.osgeo3.osgeo.org as name. Other containers may or may not allow password access. It's up to the those who manage the internal containers.

A convenient block to add to your own .ssh/config file follows
# this is only needed if you you use different private keys for different servers
Host hop.osgeo3.osgeo.org
IdentityFile "path/to/your/private/key"

Host osgeo3-*
ProxyCommand ssh '''your_osgeo_id'''@hop.osgeo3.osgeo.org -W $(sed -e "s/^osgeo3-//;s/$/.lxd/" <<< "%h"):%p
IdentityFile "path/to/your/private/key"

Then to access say the nexus container, you'd do the below where your_id could be your osgeo id or a local account on that container

ssh '''your_id'''@osgeo3-nexus

=== hop ===
This is the only container with direct ssh access via ssh hop.osgeo3.osgeo.org. To get to other containers, you need to hop thru this one. Requires ssh key access which you can register by editing your ldap profile.

=== osgeo3-nginx ===
nginx proxy all web-traffic via the (using IP: 140.211.15.6 web-osgeo3.osgeo.osuosl.org), the second ip is not in use, but may be used for a secondary nginx, to temporarily host osgeo7/osgeo8/osgeo9 containers in case of major hardware upgrades

=== dronie-client ===
This is a debian 10 lxd container running docker. Currently has just one running docker osgeo-drone-agent to serve as a client for dronie-server (dronie.osgeo.org running on osgeo7)

=== geo-docs ===
Debian 11 houses the following:

* lastools.osgeo.org (as of 2021-10-06 snapshot of https://www.cs.unc.edu/~isenburg/lastools/ see [https://trac.osgeo.org/osgeo/ticket/2649 2649]
* https://planet.osgeo.org
* https://docs.geoserver.org
* https://docs.geotools.org [https://trac.osgeo.org/osgeo/ticket/2944 2944]
* https://geotools.org [https://trac.osgeo.org/osgeo/ticket/2944 2944]

planned home of ? docs.geowebcache.org

=== geoserver-cite ===
Houses OGC site certification for geoserver https://cite.geoserver.org

=== matrix ===
'''Container Name:''' matrix - lxd container with ldap/ssh.
Hosts [[Matrix]] homeserver ([[SAC:MatrixSynapse]]) and IRC bridges ([[SAC:Heisenbridge]])

See https://git.osgeo.org/gitea/sac/osgeo3/wiki/matrix-container for full detail on how the container is setup

=== nexus (repo.osgeo.org, docker.osgeo.org) ===
See [[SAC:Repo]] this is a debian 10 lxd container running docker 19.
It currently has one docker container running within it called nexus -- exposed as repo.osgeo.org on nginx.

Also exposed as project dockers for pushing images: postgis-docker.osgeo.org, geoserver-docker.osgeo.org, geos-docker.osgeo.org, sac-docker.osgeo.org

=== monitor ===
debian10 lxd container with ldap/ssh. https://monitor.osgeo.org (houses grafana dashboard (for all servers) and prometheus server for osgeo3 containers and pulls basic container metrics using node exporters pulled via prometheus servers. Requirs ldap to log into the web console.

Configuring servers for monitoring is detailed [https://git.osgeo.org/gitea/sac/prometheus-config Git Prometheus Config]

== WebExtra ==
** Retired December 8th, 2019 -- and moved to osgeo7 as container old-webextra

* See [[WebExtraVM]] for full details (server: http://webextra.osgeo.osuosl.org)
* hosts http://planet.osgeo.org, http://mum03.mapserver.org, http://live.osgeo.org
* http://foss4g.org (main portal) and archive of old sites 2006-2014
* http://conference.osgeo.org - [[Conference System]] (also: [[SAC:Setup_OCS]])
* http://journal.osgeo.org / osgeo.org/ojs - [[Journal System]]
* Redirects for many chapter and other urls handled via /etc/httpd/conf.d/rewrite.conf

= Cloud Hosted Servers and other external under SAC Control =

== Future Hosting Plans for Windows / Mac Building ==

[[SAC_Shared_Building_Services|SAC Shared Building Services]]

== Atlantic.net ==

* host.postgis.net -p 2222 is an LXD Ubuntu 18.04 16GB RAM/ 6 vCPU, 350GB data, 250GB block storage
* Currenlty running two lxd containers:
debbie: debian 10 postgis.net, planet.postgis.net, debbie.postgis.net (jenkins build bot)
debbie-docker.host.postgis.net - runs docker and serves as a 1.0 agent for dronie.osgeo.org

= QGIS off OSGeo =
Services on separated machines rented and managed by the QGIS project at hetzner

* website including documentation http://www.qgis.org
* website building, documentation building, debian/ubuntu nightlies, plugins.qgis.org
* issues.qgis.org: redmine

= Historical servers (not more in use) =

- [[Telascience Blades (Historical)]]

== web18a.osgeo.osuosl.org ==
NO LONGER USED - turned off
'''2019-09-03 Production services www.osgeo.org, 2018.foss4g.org moved to wordpress container on [[osgeo7]]
Staging services (staging.www.osgeo.org, dev.www.osgeo.org move to wordpress-dev container on [[osgeo4]]
Grass wordpress is disabled as grass decided to go with another solution, so have grass container on osgeo7'''
(Cloud hosted server on OSUOSL hardware (not ours) )
* Debian 9.3 4GB server, host name: web18a.osgeo.osuosl.org require ssh key to log in.
* Hosts wordpress sites staging.www.osgeo.org,www.osgeo.org, staging.grass.osgeo.org, foss4g2018.osgeo.org
* Setup details on [https://git.osgeo.org/gitea/osgeo/www_apache_configs/wiki/Web18a-setup Web18a setup]

== OSGeo funtoo ==

For lxd experimentation it's an lxd container running other lxd containers and provided by funtoo.org.

OSGeo is paying funtoo via treasurer at osgeo.org.

* [https://git.osgeo.org/gitea/sac/osgeo_funtoo OSGeo Funtoo] osgeo.host.funtoo.org

* funtoo LXDs currently running:
** <del>[https://limesurvey.osgeo.org LimeSurvey] -this may be in future migrated to osgeo7 or osgeo3</del>
Migrated to osgeo3 2020-11-28 -- see https://trac.osgeo.org/osgeo/ticket/2362

[[Category:Infrastructure]]
[[Category:Services]]

SAC:LDAP

2025-09-30T14:11:26Z

Robe:

OSGeo endevours to offer a "single signon" for OSGeo services. User help is available in [[Osgeo Userid Help]].

It is currently used for [[Subversion]], [[Trac Instances|Trac]], [[SAC_Service_Status#Web|Drupal]], [[SAC_Service_Status#QGIS|QGIS services]] (hub.qgis.org and plugins.qgis.org), www.osgeo.org, [[SAC:Gitea|Gitea]], [[SAC_Service_Status#Nextcloud_nextcloud.osgeo.org|Nextcloud]], [[SAC:MatrixSynapse|Matrix-Synapse]] and shell access (opt-in).

A staged migration to internal LDAP for [[SAC_Service_Status#Wiki|mediawiki]] was initiated in 2021. Other [[SAC_Service_Status|services]] may be possible in the future.

LDAP management is the responsibility of [[SAC]] (the System Administration Committee).

= LDAP Server (OpenLDAP) =

The userid database is kept in LDAP on ldap.osgeo.org ([[SAC_Service_Status#Secure|secure vm]]).
It is served by OpenLDAP ([http://www.openldap.org/doc/admin/ OpenLDAP Admin Guide]).

The ldap daemon can manipulated as 'root' user with,
$ service slapd [start|stop|restart]

We have moved to OLC:

http://www.zytrax.com/books/ldap/ch6/slapd-config.html#intro

So config file is in:
/etc/ldap/slapd.d/cn-config # should be modified with ldapmodify

IP access filter is set by via ufw firewall configs store in ansible:
refer to [https://gitea.osgeo.org/sac/ansible-deployment/src/branch/master/deployment/roles/osgeo9/tasks/host-setup.yml#L180 OSGeo9 host for details]

== LDAP structure ==

Currently ldap structure is pretty basic. The purpose for keeping this structure simple is to allow for a more complex structure to be evolved as ldap becomes increasingly integrated into the full osgeo systems structure.

*dc=osgeo,dc=org
**cn=Manager
**ou=people
***Separate entity for each user
*:uid=login,ou=people,dc=osgeo,dc=org
*:objectClass=inetOrgPerson
*:cn=firstName lastName
*:sn=lastName
*:uid=login
*:mail=email@address
*:userPassword={md5}YPTyViiMKhiuWKEmFUOKLA==
*:Also contains posixAccount and shadowAccount fields if this account is login enabled.
**ou=projects,dc=osgeo,dc=org
*:objectClass=organizationalUnit
*:ou=project
*:description=separate entity for each osgeo project with list of members
***Separate entity for each project group
*:cn=admin,ou=projects,dc=osgeo,dc=org
*:objectClass=groupOfNames
*:cn=admin
*:description=osgeo sysadmin group
**ou=svn
*:objectClass=organizationalUnit
*:ou=svn
*:description=separate entity for each repository with list of members with commit rights
***separate entity for each svn group (for example FDO)
*:cn=fdo,ou=svn,dc=osgeo,dc=org
*:objectClass=groupOfNames
*:cn=fdo
*:member= dn of member
**ou=Shell (parent for "login" groups)
*:description=NextUID:nnnnn (the next unix uidNumber value to assign)
***cn=telascience,ou=Shell,dc=osgeo,dc=org (list of all userids with telascience login access)
*:uniqueMember=dn of member

'''Example ldif file'''
<pre>
version: 1

dn: dc=osgeo,dc=org
objectClass: dcObject
objectClass: organization
description: OSGeo ldap dit
o: OSGeo
dc: osgeo

dn: cn=Manager,dc=osgeo,dc=org
objectClass: organizationalRole
cn: Manager

dn: ou=people,dc=osgeo,dc=org
ou: people
description: all users of osgeo
objectClass: organizationalUnit

dn: uid=jsmith,ou=people,dc=osgeo,dc=org
objectClass: inetOrgPerson
uid: jsmith
cn: Jon Smith
sn: Smith
givenName: Jon
mail: jsmith@somewhere.com
userPassword: {md5}5Or4zfzGqo3jh/6iIUgKcA==

dn: uid=jbrown,ou=people,dc=osgeo,dc=org
objectClass: inetOrgPerson
uid: jbrown
cn: Jane Brown
sn: Brown
givenName: Jane
mail: jbrown@someotherplace.com
userPassword: {md5}1iWhTyvkK2m4Uuar+Dp/IA==

dn: ou=projects,dc=osgeo,dc=org
ou: projects
description: separate entity for each osgeo project with list of members
objectClass: organizationalUnit

dn: cn=admin,ou=projects,dc=osgeo,dc=org
cn: admin
description: osgeo sysadmin group
objectClass: groupOfNames
member: uid=jbrown,ou=people,dc=osgeo,dc=org
member: uid=jsmith,ou=people,dc=osgeo,dc=org

dn: ou=svn,dc=osgeo,dc=org
ou: svn
description: separate entity for for each repository.list of members with commit rights
objectClass: organizationalUnit

dn: cn=fdo,ou=svn,dc=osgeo,dc=org
objectClass: groupOfNames
cn: fdo
member: uid=jsmith,ou=people,dc=osgeo,dc=org
member: uid=jbrown,ou=people,dc=osgeo,dc=org

dn: cn=gdal,ou=svn,dc=osgeo,dc=org
cn: gdal
objectClass: groupOfNames
objectClass: top
member: uid=jbrown,ou=people,dc=osgeo,dc=org
member: uid=jsmith,ou=people,dc=osgeo,dc=org

dn: cn=mapbender,ou=svn,dc=osgeo,dc=org
objectClass: groupOfNames
cn: mapbender
member: uid=jsmith,ou=people,dc=osgeo,dc=org

dn: cn=mapguide,ou=svn,dc=osgeo,dc=org
objectClass: groupOfNames
cn: mapguide
member: uid=jbrown,ou=people,dc=osgeo,dc=org
</pre>

= LDAP Clients =

== Web interface ==

The LDAP web admin tools were initially written by Frank Warmerdam and subsequently improved by Sandro Santilli.
They are written in python and can currently be found in /usr/lib/cgi-bin on the "old-web" container on OSGeo7 (ie. id.osgeo.org).
From may 12, 2016, cgi-bin scripts are managed with a local git repository (<code>/usr/lib/cgi-bin/.git</code>). A clone of the git repository is published as a [https://git.osgeo.org/gitea/sac/web-cgi-bin private repository] (you will get a 404 unless you are part of the SAC team) on the [[SAC:Gitea]] service.

The scripts read the LDAP manager password from a credentials file that will need to be updated anytime the master LDAP manager password is changed.

Some public notes on OSGeo userids available at:

http://www.osgeo.org/osgeo_userid

=== User registration ===

The main entry point for OSGeo users is the registration form:

https://id.osgeo.org/ldap/create

'''''NOTE''': as of June 2016 the public user registration form may require entering a "mantra" (a pseudo-secret passphrase) - already registered trusted users can find out what the mantra is and how to share on https://gitea.osgeo.org/sac/userid-mantra/wiki (requires login and access grant, otherwise the page will appear as 404).''

=== User edit ===

To edit an individual userid use /ldap/edit (ldap_user_edit.py). If you add ?userid=''osgeo_userid'' you can edit someone elses ldap entry as long as you are in the admins group.

https://id.osgeo.org/ldap/edit
https://id.osgeo.org/ldap/edit?userid=osgeotest123

=== Password reset ===

Users can request a password reset using this form:

https://id.osgeo.org/ldap/reset

=== Users lookup ===

Administrators can login to this special ldap search tool, and will see email address, and will have a link to edit the LDAP entries. You need to be in the cn=admin,ou=projects listing.

https://id.osgeo.org/ldap/admin/search

There is also a non-admin version of the search, but will not show email nor links to edit:

https://id.osgeo.org/ldap/search

=== Groups management ===

SVN and other groups can be administered with the group editor. You need to either be in the group being viewed/modified or in the cn=admin,ou=projects group in order to edit a group.

Edit GDAL commit list:
https://id.osgeo.org/ldap/group?group=gdal

Edit Admins list:
https://id.osgeo.org/ldap/group?group=admin&ou=projects

=== Shell group management ===

To edit the list of people who have shell access to the various projects servers, including the download server use the following url. You have to be in the group already, or in the Admins group in order to add and remove people. Adding someone will add the required posixAccount and related attributes to the users LDAP entry.

https://id.osgeo.org/ldap/shell

The ldap_shell.py script can also operate on other groups used for shell access using the group attribute. Currently the only other group is the sac group used for shell access on the core services VMs at OSU OSL.

https://id.osgeo.org/ldap/shell?group=sac

== Command line interface ==

The commandline interface can be used by any of the OSGeo machines but not from outside the network.
The tools are from the ''ldap-utils'' debian package.

All ``ldap-utils`` commands will use systemwide or user-specific files for default configuration so things like LDAP Base (-b dc=osgeo,dc=org) and LDAP URI (-H ldaps://ldap.osgeo.org) need not be specified on each commandline from properly configured machines (grep URI /etc/ldap/ldap.conf; grep BASE /etc/ldap/ldap.conf).

=== Editing the LDAP database users and groups ===

Editing LDAP database requires an admin password or root access to secure container. The -W switch asks for a password prompt (known by [[SAC:Primary Administrators]]).

Loading an ldif file into an ldap directory:

$ ldapadd -a -W -x -D "cn=Manager,dc=osgeo,dc=org" -f fileName.ldif

Deleting an account (by uid) from the database through "ldapdelete":

$ uid="account-to-be-deleted" ldapdelete -W -D cn=Manager,dc=osgeo,dc=org -x "uid=${uid},ou=People,dc=osgeo,dc=org"

Deleting an account (by uid) from the database through an ad-hoc script from the "''www.osgeo.org''" machine:
$ /osgeo/tools/ldap/ldap_delete_user "account-to-be-deleted"

Resetting a user password:

$ uid="account-to-be-reset" ldappasswd -S -W -D cn=Manager,dc=osgeo,dc=org -x "uid=${uid},ou=People,dc=osgeo,dc=org"
# Or from the "www.osgeo.org" machine, run:
$ /osgeo/tools/ldap/ldap_reset_user_password "account-to-be-reset"
# A new random password will be sent to the user. Asks for confirmation.

Modifying the email of a user:

Create a file ''change_mail.ldif'' with the following contents

dn: uid=<osgeoid>,ou=People,dc=example,dc=com
changetype: modify
replace: mail
mail: newmail@newmail.new

Execute the command

$ ldapmodify -v -W -D cn=Manager,dc=osgeo,dc=org -f /path/to/change_mail.ldif
# Remove the created `.ldif`
rm /path/to/change_mail.ldif

=== Editing the LDAP database config ===

Increasing default page limit -

$ ssh root@osgeo9-secure
$ ldapmodify -H ldapi:/// -Y EXTERNAL -f modify_max_page_limit.ldif
$ systemctl restart slapd
$ ldapsearch -H ldapi:/// -Y EXTERNAL -b cn=config | grep olcSizeLimit #to confirm change

Where modify_max_page_limit.ldif looks something like

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
replace: olcSizeLimit
olcSizeLimit: 500

=== Querying the LDAP database ===

The ldapsearch command is used to query a LDAP database.

This command dumps the first 500 entries of the ldap database. Note that secure-dev on osgeo4 has limit set to 40000 for easier pull by admins. refer to modify section for instructions how to set the limits.

$ ldapsearch -x

Refine your search based on the LDAP structure listed above.

Example: list all SVN groups (override BASE to limit the ou to svn, then search for objects with the right objectClass).

$ ldapsearch -s one -b ou=svn,dc=osgeo,dc=org -x "objectClass=groupOfNames" | grep ^cn

Example: list all entries created after April 1st 2016:

$ ldapsearch -x "createTimestamp>=20160401100000Z"

Example: list all entries created in 2019:

$ ldapsearch -x '(&(createTimestamp>=20190101000000Z)(!(createTimestamp>=20200101000000Z)))'

The fields to be shown in the output can be specified as additional parameters, like:

$ ldapsearch -x "uid=strk" createtimestamp modifytimestamp

Find the email addresses of all members in the GRASS GIS core group:
$ ldapsearch -x '(|'`ldapsearch -x 'cn=grass' | grep ^member | sed 's/.* uid=$[^,]*$,.*/(uid=\1)/' | tr -d '\n'`')' | grep ^mail | sed 's/^mail: //'

Find the email addresses of all members in the GRASS GIS core group and store as CSV file (ID, name, email):
$ ldapsearch -x '(|'`ldapsearch -x 'cn=grass' | grep ^member | sed 's/.* uid=$[^,]*$,.*/(uid=\1)/' | tr -d '\n'`')' | \
grep '^u: /\n|/'| sed 's/^cn: //' | sed 's/^sn: //' | sed 's/^mail: //' | sed 's/^cn:: //' | sed 's/^sn:: //' \
| tr '\n' ',' | tr '|' '\n' | sed 's+,,$++g'

If you are on a server that is whitelisted to query osgeo, but the ldap.conf is not setup, you migh need to explicitly specify the host like so

$ ldapsearch -x "uid=robe" -b "dc=osgeo,dc=org" -H ldaps://ldap.osgeo.org

If you get an error you can debug source with:

$ ldapsearch -x "uid=robe" -b "dc=osgeo,dc=org" -H ldaps://ldap.osgeo.org -d 1
For more complex queries, see http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm

= Monitoring =

Web-based users creation and editing can be monitored looking at the '/var/log/apache2/www_access.log' files on 'www.osgeo.org'.

A cronjob on [[TracsvnVM]] is setup to run hourly ('/etc/cron.hourly/check_excessive_new_ldap_users')
and report to the [https://lists.osgeo.org/mailman/listinfo/sac SAC mailing list] if more than a given max users are created in that timespam (check the script for details). The scripts to generate the reports are again on 'trac.osgeo.org' machine under '/osgeo/tools/ldap', where a git repository exists.

= Troubleshooting =

* "sudo" unavailable to LDAP-authenticated users on Debian7. See:
*:https://bugs.launchpad.net/ubuntu/+source/gnutls26/+bug/926350 and
*:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=579647
** Short form: "libgnutls" in Debian7 is linked against "libgcrypt" which refuses to work in setuid-binaries - like "sudo".
** Solution: Rebuild "libgnutls" using "libnettle" instead of "libgcrypt":
*** aptitude install libhogweed2 libnettle4 nettle-dev libp11-kit-dev
*** apt-get remove libgnutls-dev
*** apt-get source gnutls26
*** # remove --with-libgcrypt from the debian/rules file
*** # build using this command:
*** debuild -i -uc -us -b
** Functional GnuTLS packages available on "secure" in /home/martin/GnuTLS.Deb/

* "sudo" unavailable to LDAP-authenticated users on Debian6 with backports. See:
*:http://lists.osgeo.org/pipermail/sac/2012-October/004120.html
** Solution:
<hostname>:~# cat /etc/apt/preferences.d/sudo.pref
Package: sudo
Pin: version 1.7.4*
Pin-Priority: 1000

[[Category:Infrastructure]]
[[Category:Services]]