1114699 - Deploy Tor Middle relays as capped testing/iteration

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: Projects, task)

Description

[Javaun Moradi [:javaun]]

The requirements here are for the initial deployment of Tor Middle Relays hosted at Mozilla. 

Our goals in this initial deployment are to:
- Deploy the first Mozilla middle relays
- Learn and improve our hosting efficiency. For this reason, the IT/Services leadership suggested an initial cap on network traffic while we're learning and iterating.

The following technical decisions were agreed upon:
- Cap the network at 100mbit.
- Create nodes on a separate link in our Phoenix data center in a separate IP space.

Comment 1

[Michal Purzynski [:michal`] (use NEEDINFO)]

I'd like to stress the importance of a separate IP space / network hardware here, so we can easily tell which traffic is from/to TOR and which one is Mozilla.

What's the future network architecture? Will it move to the SCL3? If so, is it going to be similar to a BU, i.e. separate core connected to border?

Include me in the design discussion :-)

Comment 2

[Michal Purzynski [:michal`] (use NEEDINFO)]

Me and Arzhel have put together a document what is the current state and where we should go from here. I made some recommendations from a security point of view.

https://docs.google.com/a/mozilla.com/document/d/1gPb8V5CHuV8Tztpp3WzAebbj2aTPF0fQaOXW85hXuxs/edit

Feel free to comment on it.

Who is going to manage this environment? It would be really good if we could puppetize both the admin host and relay servers before 28th.

Comment 3

[Michal Purzynski [:michal`] (use NEEDINFO)]

We decided to go with an independent infrastructure for centralized management, namely ansible. That is now working and all steps from the document's 'to be done before 28' are implemented, per Arzhel.

Comment 4

[Michal Purzynski [:michal`] (use NEEDINFO)]

Do we use some kind of network policing here to restrict bandwidth to 100Mbit/sec?

Comment 5

[Arzhel Younsi [:XioNoX]]

Nop, but we're monitoring the bandwidth actively.

Comment 6

[Arzhel Younsi [:XioNoX]]

The testing infra has been running since January, closing that bug.