1439982 - Provide restricted S3 bucket for hosting docere

Status: RESOLVED FIXED

(Data Platform and Tools :: Documentation and Knowledge Repo (RTMO), enhancement, P2)

Description

[Ryan Harter [:harter]]

We're going to replace RTMO with a static site generator. We need an S3 bucket to host the resulting site. The site should be behind authentication, similar to the strategy and insights page [0].

[0] https://strategy-and-insights.mozilla.com/index.html

Comment 1

[Ryan Harter [:harter]]

Blake, do you know who can help me with this?

Comment 2

[Ryan Harter [:harter]]

Jason - Hamilton recommended I ping you.

Comment 3

[Jason Thomas [:jason]]

To set something up similar to the S&I site we would need:

* S3 Bucket (private)
* Auth0 credentials
* Nginx instance configured with Auth0 and proxy to S3
* Jenkins configured to poll, build and deploy updates for docere

Will you be providing us a repo with the generated static content or would we have to build it as part of the jenkins build process?

Comment 4

[Ryan Harter [:harter]]

Great, thanks for looking into this. I will provide the repo with the generated static content. I've already prototyped the update functionality in the docere repo [1] using travis. 

If that makes sense, do you have an estimate of the time cost behind the bucket, credentials, and server?

[1] https://github.com/harterrt/docere

Comment 5

[Ryan Harter [:harter]]

Passing this NI? to Harold -

Do you have an estimate for when we can get the bucket, credentials, and server up and running? I'm hoping to have Docere rendering content this quarter.

Comment 6

[Harold Woo]

Hi,

I have some other work that is higher priority than this.  If not this quarter than early Q2 is my estimate.

Thanks

Comment 7

[Ryan Harter [:harter]]

Thanks for the update, Harold.

For context, this work is blocking a Q1 data platform OKR. That's not to say it's higher priority than other work, I just wanted to clarify this bug's priority.

Comment 8

[Harold Woo]

Ryan,

I'm filling out a ticket to get Auth0 set up (https://mozilla.service-now.com/sp?id=sc_cat_item&sys_id=1e9746c20f76aa0087591d2be1050ecb).  Can you answer these questions for me?

- What is the name and purpose of the service to use Mozilla SSO?
- What is the URL of the service to use Mozilla SSO?
- How many users do you expect to use the service per month?

- What kind of environment are you setting up?
DEV - An environment in good condition to test with a real federated login
STAGE - An environment identical to production setup, to see if deployment works
PROD - An environment for production applications (i.e. the real thing!)

- Do you need this environment hosted by our Development SSO Infrastructure?
No, use production SSO infrastructure
Yes, I have a specific need for the development SSO infrastructure

- Do you need specific restrictions on whom can login?
Yes, Mozilla Corporation/Foundation employees only can login
Yes, Mozilla Corporation/Foundation employees and NDA'd Mozillians can login
Anyone can login (I'll take care of access control myself if needed)
Yes, a specific Mozillians.org or LDAP group that I will manage
Other

- Which technology would you like to use? 
OpenIDConnect
SAML
I dont know/I need help

Comment 9

[Harold Woo]

more details here https://mana.mozilla.org/wiki/display/SECURITY/SSO+Request+Form#SSORequestForm-SSORequestForm

Comment 10

[Ryan Harter [:harter]]

(In reply to Harold Woo from comment #8)

> - What is the name and purpose of the service to use Mozilla SSO?

Name: Docere
Purpose: Host telemetry analyses and make them discoverable. See https://github.com/harterrt/docere

> - What is the URL of the service to use Mozilla SSO?

Eventually this will live at reports.telemetry.mozilla.org. We may need a placeholder URL while we transition.

> - How many users do you expect to use the service per month?

~50 unique users per month

> - What kind of environment are you setting up?

PROD - An environment for production applications (i.e. the real thing!)

> - Do you need this environment hosted by our Development SSO Infrastructure?

I don't know of any need for development

> - Do you need specific restrictions on whom can login?

Yes, Mozilla Corporation/Foundation employees and NDA'd Mozillians can login

> - Which technology would you like to use? 

I dont know/I need help

Comment 11

[Ryan Harter [:harter]]

For URL, let's start with:
rtmo-dev.telemetry.mozilla.com

Comment 12

[Ryan Harter [:harter]]

Sorry, that should be:
http://reports-dev.telemetry.mozilla.org/

Comment 13

[Harold Woo]

When ready to migrate prod, we need to do the following:

1. Have ckolos change cname of reports.telemetry.mozilla.org to point to data-rtmo.data.mozaws.net 
(or data-data-rtmo-ELB-1K8ODKTB7VLWX-878120308.us-west-2.elb.amazonaws.com)

2. Remove the CNAME reports-dev.telemetry.mozilla.org

3. Make a new ticket https://mozilla.service-now.com/sp?id=sc_cat_item&sys_id=1e9746c20f76aa0087591d2be1050ecb 
that points to reports.telemetry.mozilla.org. 

4. Modify file in hiera-sops/app/data.data.rtmo.yaml to use new SSO credentials given from step 3

Comment 14

[Harold Woo]

deployment ticket: https://bugzilla.mozilla.org/show_bug.cgi?id=1447443