Minimizing the effort to deploy Leaf

[artgoldberg]

Hello Leaf folks

We have found that deploying Leaf takes longer than we hope or expect. To address this problem, I want to launch a multipronged discussion about how to minimize the effort to deploy Leaf. First, I want to preface the discussion by saying that my experience with Leaf is limited to our environment at Mount Sinai:

• Running on Linux (Centos) servers
• Using Apache and Shibboleth
• Configuring Shibboleth to authenticate (and authorize in Leaf before version 3.10) against a Microsoft Azure Active Directory system

I observe that there are two aspects to configuring a Leaf instance:

1. Configuring Leaf's internals, such as its version, appsettings.json, and leaf_api.service.conf files.
2. Configuring Leaf's externals, which tend to be security configuration such as SSL/TLS authentication, and SAML/Shibboleth. This work involves interacting with security staff in our organization, who will sign CSRs and create single sign-on applications.

My experience indicates that different approaches are needed to minimize the effort of each of these aspects of deploying Leaf:

1. Configuring Leaf's internals can be sped up by using containers, such as Docker. A container with a particular Leaf version that's compiled and ready to run, has an appropriate appsettings.json, is loaded with other features (such as the LeafLogParser, for example), would be very handy.
2. Configuring Leaf's externals cannot, by their nature, be fully automated. Once a good deployment has been created at an institution, the Leaf deployers at the institution can carefully document their processes to make subsequent deployments easier. This documentation can be shared among Leaf users when institutions have similar infrastructure and processes.

These thoughts raise two different sets of questions:

1. What is the status of Docker images for Leaf? What is available now, and what needs to be done?
2. Have other institutions come to the same conclusion that I have regarding configuring Leaf's externals and started writing documentation that they would like to share?

Thanks
Arthur

[ndobb]

Thanks Arthur, and sorry to hear that. @mh2727 can you comment on the status of our Docker images in regards to (1)? I'm not sure regarding (2); to my knowledge no other institutions have shared specific documentation they've written, unfortunately.

[artgoldberg]

@mh2727 Hi Mehadi. Could you please update us on the status of the Leaf Docker images? Thanks, Arthur

[mh2727]

Hi @artgoldberg.

Apologies for the delay.

Regarding your second question, I concur with @ndobb. I am not sure what other sites have done and unfortunately, nothing has been shared with us so far.

As for (1), at RIT, we have successfully containerized and deployed in prod the database and the app server. We have not yet containerized the web part of it given the complexity. This is something we are thinking about and will update you as we make progress.

For the database, we are installing MS SQL Server in a container and running any necessary scripts/queries inside of that.

For the app server, same thing. Installing .NET in the container and following the Leaf installation process to set up JWTs and environment variables.

I will email you with our latest database and app Dockerfile and feel free to ask any clarifying questions and/or modify it to your needs.

Hopefully this answers your questions.

--
Mehadi Hassan

[artgoldberg]

Thank you Mehadi @mh2727