Hosted plans

[Mike McGrath]

On Wed, 10 Aug 2011, Stephen Gallagher wrote:

> On Wed, 2011-08-10 at 09:15 -0600, Kevin Fenzi wrote:
> > > 3) Turn ReviewBoard into a turnkey OpenShift virtual instance and
> > > allow any Fedora Hosted project to spin one up. This instance would
> > > use standard enrollment (rather than FAS integration, which is
> > > impossible outside the Infra firewall). Each project could have its
> > > own complete instance to maintain on its own. Upsides: less work for
> > > Fedora Admins, support for email and better performance. Downsides: no
> > > centrally-managed user accounts and projects need to do more of the
> > > maintaining of the system themselves.
> >
> > This is pretty interesting... I assume after following the steps they
> > would have a persistent instance they could use moving forward. It
> > doesn't need anything special to talk to their project on hosted?
> > Does it end up costing the end project anything? ;)
>
> I've submitted a patch upstream to ReviewBoard to add easy configuration
> of Fedora Hosted source repositories:
> http://reviews.reviewboard.org/r/2505/
>
> I have confirmation from Christian Hammond (the upstream project lead)
> that it will be included in the 1.5.6 and 1.6.0 releases (aka
> imminently).
>
> So there's very little that the projects need to do in order to connect
> to the hosted repo. As I said above, they lose the centrally-managed
> users available to FAS, so they'd need to manage their own groups
> themselves. On the other side, this does mean that they gain much finer
> control over permissions (since they can define their own
> project-specific groups rather than relying on FAS groups).
>
> >
> > What happens if someone sets up an instance and then disappears?
> > Does the project have any way to deal with that? Or just make a new one?
> >
>
> That's a good question for Mike McGrath. I suspect that it would be
> prudent to recommend that projects set up several administrators so that
> a disappearance of one doesn't result in the loss of all administrators.
>
> Also, it's possible to promote a user to admin status if you have
> database privileges as well by setting the admin flag on their user
> account, but of course that assumes you have access to a DB admin.
>
> A final option would be to modify the openshift instance to always
> install a recovery admin with a random password that was escrowed by the
> Fedora project, but I'm not sure whether that's realistic. Mike, can you
> speak to that?
>

We should have multiple ssh key support soon to allow multiple admins of a
single project.  Having said that the apps are tied to an individual user
account.  At the moment if someone wanted to move it they'd have to make a
snapshot and restore it elsewhere (if for some reason the app needed to
change owners or something)

To do the "fedora project recovery" bits, we'd have to setup the fedora
project as an intermediary (basically running everything as a fedora
user).  The rest could all be scripted fairly easily.  At the moment
though there's a limit of 5 apps per account so the best bet is to have
users setup their own for the time being.

	-Mike