[web-team] Volunteer

[Rick Moen]

Quoting Josef Grosch (jgrosch at gmail.com):

> No worries. I have assigned the VM 2 IP addresses, 205.166.121.104 and
> 205.166.121.105. I've installed subversion, ntp, postfix, php, pear, and
> apache2. After I installed postfix and apache I found the web team web
> page (after I mirrored the web site) and found that the current
> installation uses exim and lighttp. I'm sorry but I don't know much
> about lighttp or exim. I know you are kinda busy but if you could get me
> shell access, please use my ssh key just grab it from the new server, to
> the existing server. I can do a bunch of work getting things setup.

Sure, will do, and thanks again.

The major reason the www.svlug.org virthost at Linode uses Lighty
(lighttpd) is that originally went got only 80MB RAM, and VP Micah Dowty
(who took over when Bill Ward resigned) _seriously_ claimed that we
should be able to fit all SVLUG operations -- SMTP w/antispam, mailing
lists, Web site, ssh, DNS, version control -- into 80MB.  

Micah Dowty and J. Paul Reed were sure of this, and they're Web
programmers, so of course they Knew Whereof They Spoke.  I'm a mere
senior system administrator, so what the hell would I know about
systems, right?  Anyway, we scrimped and saved on RAM, using Lighty
instead of Apache http, NSD instead of BIND9, and every other possible
RAM-economising measure -- and of course it was absolutely impossible to
fit SMTP w/antispam into there with everything else.

Which is how we got there.

Lisa Corsetti (/me waves) in her capacity as SVLUG's Web Software
Coordinator made the unilateral decision to recode a number of the
www.svlug.org Web features from server-side HTML (headers and footers)
and Perl scripts (various small page gadgets) into PHP.  Which meant
that we then bloated Lighty a good bit by making it run a PHP
interpreter to load every page.  

I'm not really happen about that for a couple of reasons:  

(1) It struck me as really odd to go spending RAM like mad after going
through such pains to be careful with it -- and also I'm not at all sure
these pages are actually dynamic in nature.  Nothing on www.svlug.org is 
drawn from a database.  So, granting for discussion that using PHP to
generate the page is a nice idea, wouldn't it have been smarter to have
a Makefile that generates static HTML pages, running the PHP interpreter
at that time, instead of needing a big PHP binary involved with every
page load?

(2) When Lisa turned on that feature, she left Ubuntu Server's default
php.ini in place untouched, which by default left open a bunch of
ghastly security holes.  I had to scramble to button down php.ini in a
manner that didn't leave PHP's full feature set lit up like a Christmas
tree.  More at:
http://linuxmafia.com/faq/Security/php.html

(It should be noted that generating static pages from PHP source using,
e.g., GNU make and a Makefile means that _no_ PHP security risk is
present on the public-facing side.)

I'm not married to Lighty, though it's been really good for the
www.svlug.org virthost.  I'm guessing that making it also do Mailman's
Web pages would be no problem at all.


Anyway, I'd love to see us experiment with doing that better, prior to
completing migration.

BTW, I'm not blameless of the needless-PHP-at-runtime error.  Both BALE
(http://linuxmafia.com/bale/) and my personal FAQ pages
(http://linuxmafia.com/~rick/faq/) are generated needlessly by the PHP
interpreter at page load time.  The latter example is particularly
ridiculous, in that the -only- PHP feature used at all is the include()
function.

I did it because it was the easy way to do include files, before
thinking through the implications.

One of these days, I should convert that to a Makefile, and turn BALE
into one done likewise (to generate a static HTML file) invoked by the
script that populates the events table on the first of every month.


OTOH, NSD is a _huge_ win over BIND, and I would strongly recommend 
not using the latter.  You'll be able to see some site documentation
about NSD when you get shell access.  For now:
http://linuxmafia.com/faq/Network_Other/dns-servers.html#nsd