<div dir="ltr">Hi Carlos,<div><br></div><div>Thanks for sharing this!</div><div><br></div><div>I hope you don't mind if I ask you some follow-up questions :) Just trying to understand your setup and choices in more detail.</div><div><br></div><div>I agree that your security setup sounds reasonable, HTTPS to load balancer, HTTP from load balancer to Girder (though I have more questions on this below), assuming the instances are not visible to the outside world and only to the LB via the VPN, and Mongo/Instances talking to each other inside the same VPN. Out of curiosity (rather than suggesting a policy), how do you handle ssh, are each of the machines accessible to ssh or do you have a VPN ssh gateway machine?</div><div><br></div><div>When you say load balancer, does that mean Elastic Load Balancer or something else? I'm confused about how you use Nginx, are you using ELB + Nginx, and if so how does ELB hand off to Nginx? Where does Nginx live, is it in a separate Docker container that redirects to the Girder instances?</div><div><br></div><div>Thanks,</div><div>Mike</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 26, 2017 at 5:02 PM, Carlos Agüero <span dir="ltr"><<a href="mailto:caguero@osrfoundation.org" target="_blank">caguero@osrfoundation.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">hi Michael,<div><br></div><div>Thanks for your reply! Sorry that I didn't follow-up before but I've been exploring and partially documenting the process.</div><div><br></div><div>I managed to set-up an EC2 machine hosting the Mongo database. Also, I configured Elastic Beanstalk with a single Docker container (girder/girder) and a load balancer. The instances are running Girder and using the external database. I associated an SSL certificate to the load balancer. All the connections between the users and load balancer are secured and between the load balancer and the instances go though regular HTTP. I think this is OK because the load balancer and the instances are within the internal VPN that cannot be sniffed. The TSL termination happens on the load balancer. </div><div><br></div><div>A similar thing occurs with the database instance. The Mongo port (27017) is configured with a security rule that allows access only from a machine within the same VPN (the Girder instances in this case). </div><div><br></div><div>The default EB configuration uses NGINX, that redirects requests to the Docker container. I still have an open issue for redirecting the non-https requests to https without breaking the health checker monitor that EB uses. I've done this in the past but this is the first time that I do it with EB + docker. </div><div><br></div><div>I'm in the process of documenting the process here:</div><div><br></div><div><a href="https://bitbucket.org/osrf/propshop-girder/overview" target="_blank">https://bitbucket.org/osrf/<wbr>propshop-girder/overview</a><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 20, 2017 at 5:01 PM, Michael Grauer <span dir="ltr"><<a href="mailto:michael.grauer@kitware.com" target="_blank">michael.grauer@kitware.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Carlos,<div><br></div><div>Thanks for trying out Girder, I'm glad you appreciate our docs! We've done a number of deployments to AWS, but they've all been EC2 instances. EB is on our roadmap, we'd like to start playing with it over the next couple months, but don't have much concrete to share yet. We'd love for you to keep us informed about your progress, or let us know any stumbling blocks you run into.</div><div><br></div><div>The plan you describe sounds like what we were going to attempt, put Mongo in a separate EC2 instance, and then have EB bring up Dockerized (seems easiest, and we already have a Docker image in Girder's repo) Girder containers. We normally would put Girder behind Nginx or Apache. Were you going to use ELB for your load balancer, and is that what you normally use for your EB deployments? How to best use ELB + possibly other proxy servers if necessary (e.g., can you set all of the proxy rules in ELB to allow stream notifications? where do you terminate TLS?) + Girder in EB are open questions for us.</div><div><br></div><div>Let us know if you have more specific questions as well.</div><div><br></div><div>Thanks,</div><div>Mike</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="m_3765941558558099655h5">On Thu, Apr 20, 2017 at 7:41 PM, Carlos Agüero <span dir="ltr"><<a href="mailto:caguero@osrfoundation.org" target="_blank">caguero@osrfoundation.org</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_3765941558558099655h5"><div dir="ltr">Hello,<div><br></div><div>I'm new to Girder and deployed a local instance on my own development machine without problems following your documentation (nice documentation by the way!).</div><div><br></div><div>I'd like to deploy another Girder instance on AWS and I've read the "Deploy" section of the Administrator documentation. It seems to cover a few options but none of them is AWS.</div><div><br></div><div>I normally use Elastic Beanstalk (EB) that allows you to configure a load balancer that will spin up machines depending on the server demand. This model seems compatible with Girder as long as the database is deployed in a separate machine separated from the servers, to make sure that there's only one machine running the database.</div><div><br></div><div>Does anyone have experience, documentation or suggestions deploying Girder on AWS with EB?<br></div><div><br></div><div>Thanks!</div><span class="m_3765941558558099655m_3013689699279193913HOEnZb"><font color="#888888"><div>Carlos</div><div><br></div><div><br></div></font></span></div>
<br></div></div>______________________________<wbr>_________________<br>
Girder-users mailing list<br>
<a href="mailto:Girder-users@public.kitware.com" target="_blank">Girder-users@public.kitware.co<wbr>m</a><br>
<a href="http://public.kitware.com/mailman/listinfo/girder-users" rel="noreferrer" target="_blank">http://public.kitware.com/mail<wbr>man/listinfo/girder-users</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>