Re: Planning for a mirror using Google Cloud CDN

Hi folks

I'd like to provide a quick follow up to this.

On Sun, Nov 20, 2016 at 03:47:33PM +0100, Bastian Blank wrote:
> We got the ok from Google to use their Cloud CDN as a public mirror.
> There is one technical limitation in the implementation left, which
> needs to be fixed first, but I'm confident they will be able to do that.

Sadly there are no news on this problem.  I'll keep in touch with Google
about it.

> The CDN needs to be backed by instances running inside the Google cloud.
> We will run three mirror pairs in different locations.  Two instances in
> one location will provide availability even if we need to take one
> offline.  Most likely this mirrors will be located in us-central,
> europe-west and asia-east.
> Each mirror will host a complete copy of the main and security archive.
> Disk space is cheap and we want to reduce operational load for
> maintaining larger sets of mirrors.

I decided to create one set of instances for the main and one set for
the security archive.  This sums up to (3*2+1)*2=14 instances (three
regions, two instances each, plus one central syncmaster, all for two
archives).

> The mirrors on this backends are not updated at the exactly same time.
> I'm not yet completely sure how this will interact with the cache within
> the CDN.  This problem exists both within one location and between
> location.

I played with our sync infrastructure a bit and found out that we can
make the synchonization easier by one small change to the archive:
create by-hash hierarchies for older distributions.  We already got the
go ahead from the relevant teams and just wait for ftp-master to
implement this change.  For now I'm down to about 1 minute of
synchronization lag for the main archive between locations.  I'll
consider that acceptable.

The setup is pretty automated right now.  GCE can't create instances
with extra disks or from snapshots (for groups), so the system setup
needs an additional step of adding the data disk, which I do with
Ansible.

I intend to integrate the mirrors into the debian mirror team managed
set of mirrors as the next step.

Regards,
Bastian