> On 23 May 2019, at 17:12, Angel Bosch Mora <abosch@xxxxxxxxxxxxxxxx> wrote: > >> I think to answer this, I'd like to see a diagram or description of >> the network and deployment topology you have in mind to help advise >> for what you want to achieve here :) >> > > Is really very simple. Think of it like the typical MMR with 4 nodes: > > https://i.imgur.com/DY8aSAo.png > > but the number of consumers can go from 2 to N. > > all consumers are read only and we have a generic FQDN pointing to them: ldap.example.com > > and writable suppliers got their FQDN too: ldapw.example.com > > is that enough for you? I think so. So your 4 write servers are in mmr. Then you have 2 -> N read-onlys as well which scale up and down. Do you plan to have ldap.example.com point to the IP's of the read-onlys directly? Or to a load balancer? If this was me, just because of the scaling requirements, I would actually recommend TLS termination on the load balancer, then ldap plaintext to the 2 -> N consumers (or ldaps to the consumers where the LB trusts the CA that signed the readonlies. IE: Client -- TLS connection 1 --> [ LB ] -- TLS Connection 2 --> [READ_ONLIES] TLS connection 1 is presented by the LB, which offers a valid cert/ca chain. The LB then would re-encrypt but trusting the CA of tls connection 2 which is a self signed to the read_onlies. Another main point here is you'll need to automate that when a read-only is scaled up (added), you'll need to automate the addition of the replication agreements to the write servers + conduct a full reinit on first start. Does that help? > > abosch > > -- Institut Mallorqui d'Afers Socials. Aquest missatge, i si escau, qualsevol fitxer annex, es dirigeix exclusivament a la persona que n'es destinataria i pot contenir informacio confidencial. En cap cas no heu de copiar aquest missatge ni lliurar-lo a terceres persones sense permis expres de l'IMAS. Si no sou la persona destinataria que s'hi indica (o la responsable de lliurar-l'hi) us demanam que ho notifiqueu immediatament a l'adreca electronica de la persona remitent. > -- Abans d'imprimir aquest missatge, pensau si es realment necessari. > _______________________________________________ > 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx > To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx — Sincerely, William Brown Senior Software Engineer, 389 Directory Server SUSE Labs _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
