[tor-bugs] #29684 [Internal Services/Tor Sysadmin Team]: setup a grafana server somewhere

[Tor Bug Tracker & Wiki]

#29684: setup a grafana server somewhere
-------------------------------------------------+-------------------------
 Reporter:  anarcat                              |          Owner:  anarcat
     Type:  defect                               |         Status:
                                                 |  assigned
 Priority:  Medium                               |      Milestone:
Component:  Internal Services/Tor Sysadmin Team  |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:                                       |  Actual Points:
Parent ID:  #29681                               |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by anarcat):

 note that i had a discussion with ln5 about how to deploy the granafa
 package, because it's not an official debian package. ln5 had concerns
 about introducing Docker in the infrastructure for various (legitimate)
 reasons about complexity and security theater. hopefully i'm summarizing
 well, correct me if I'm wrong. :)

 in the end, I chose to deploy using the upstream debian package because
 it's a technology we all know well, but I think this is a special case (a
 webapp) where using Docker containers actually makes a lot of sense.
 things move too fast for debian packaging to catch up - just figuring out
 all those node.js dependencies would be a nightmare. plus the Docker
 environment provides *some* isolation from nasty upstream code: because
 the container runs as the "grafana" user, there are builtin protections
 (process boundaries and user isolation) in the Linux kernel that isolate
 us from possible bad code, while the Debian package runs as root during
 install. and even if the daemon actually runs as a dedicated user in
 Debian, it doesn't benefit from the namespace, pid, cgroups isolation as
 far as I know.

 but for the time being, it's a good enough solution, especially since
 deploying the docker way would have involved auditing *three* more puppet
 modules...

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/29684#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online