On 23 May 2019, at 17:12, Angel Bosch Mora
<abosch(a)imasmallorca.net> wrote:
> I think to answer this, I'd like to see a diagram or description of
> the network and deployment topology you have in mind to help advise
> for what you want to achieve here :)
>
Is really very simple. Think of it like the typical MMR with 4 nodes:
https://i.imgur.com/DY8aSAo.png
but the number of consumers can go from 2 to N.
all consumers are read only and we have a generic FQDN pointing to them:
ldap.example.com
and writable suppliers got their FQDN too:
ldapw.example.com
is that enough for you?
I think so.
So your 4 write servers are in mmr. Then you have 2 -> N read-onlys as well which scale
up and down.
Do you plan to have
ldap.example.com point to the IP's of the read-onlys directly? Or
to a load balancer?
If this was me, just because of the scaling requirements, I would actually recommend TLS
termination on the load balancer, then ldap plaintext to the 2 -> N consumers (or ldaps
to the consumers where the LB trusts the CA that signed the readonlies. IE:
Client -- TLS connection 1 --> [ LB ] -- TLS Connection 2 --> [READ_ONLIES]
TLS connection 1 is presented by the LB, which offers a valid cert/ca chain. The LB then
would re-encrypt but trusting the CA of tls connection 2 which is a self signed to the
read_onlies.
Another main point here is you'll need to automate that when a read-only is scaled up
(added), you'll need to automate the addition of the replication agreements to the
write servers + conduct a full reinit on first start.
Does that help?
abosch
-- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer
annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir
informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a
terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que
s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu
immediatament a l'adreca electronica de la persona remitent.
-- Abans d'imprimir aquest missatge, pensau si es realment necessari.
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs