Upgrade to BOA-2.1.1 Stable Edition

[chris]

I have been sent this email from wiki:PuffinServer:

There is new BOA-2.1.0 Stable Edition available.

Please review the changelog and upgrade as soon as possible
to receive all security updates and new features.

Changelog: ​http://bit.ly/newboa

I could potentially do this upgrade tonight as it's a quite time for the server -- Jim, any reason not to apply this update tonight?

[jim]

Though it's got some really juicy enhancements, including my ​proposal on removing those funky control files, I think it's worth sitting it out for a week to ensure any bugs get discovered and cleaned up.

We also need to establish what .barracuda.cnf changes we want to enable to get the best out of the new version.

[chris]

I have added this ticket to the list of upgrade tickets, wiki:PuffinServer#Upgradetickets and I note that the last upgrade ticket:612 hasn't yet been closed.

Replying to jim:

Though it's got some really juicy enhancements, including my ​proposal on removing those funky control files

Nice one, I have just read that ticket for the first time.

I think it's worth sitting it out for a week to ensure any bugs get discovered and cleaned up.

Have you been following progress on this -- do you think it's now safe to do the upgrade? I see that the latest version is now BOA-2.1.1 ​http://drupalcode.org/project/barracuda.git/blob_plain/HEAD:/CHANGELOG.txt

We also need to establish what .barracuda.cnf changes we want to enable to get the best out of the new version.

I'm not sure we need to make any more? Or are there some more variables we can now tweak?

[chris]

Replying to jim:

We also need to establish what .barracuda.cnf changes we want to enable to get the best out of the new version.

These are the options I can see from ​the changelog:

• _NGINX_FORWARD_SECRECY=YES
• _NGINX_SPDY=YES
• _BUILD_FROM_SRC=YES

If we enable _NGINX_FORWARD_SECRECY (see ticket:535#comment:18 ) and / or _NGINX_SPDY (see ​https://en.wikipedia.org/wiki/SPDY ) then I think BOA will build openssl from source. Whatever you think of _NGINX_FORWARD_SECRECY it's clear that having SPDY support would be a good thing. If we upgrade to Wheezy, ticket:535 then I don't think there will be a need to build openssl from source.

If we want to use Zend OPcache instead of APC before a upgrade to Wheezy then BOA will build php from source.

Generally it's a lot easier maintaining server that run with packages from the distribution and not libraries and languages build from source.

I suggest we upgrade to Wheezy (manually or using BOA script? Best follow this question up on ticket:535) and set these options:

• _NGINX_FORWARD_SECRECY=YES
• _NGINX_SPDY=YES
• _BUILD_FROM_SRC=NO

[jim]

I updated my box to 2.1.1 last night -- though there were a couple more hotfix commits to that today. From my perspective the update went without hitch, and the result seems nice. Can't say I've benchmarked the sites, but hopefully it's a bit quicker thanks to the new Zend opcode cache replacing the creaky APC.

Since this update is a semi-blocker to the work on #610 (if only to rule out the permissions issue and force their correction), I'd prefer to see this sooner rather than later. The question of Debian 7 update is somewhat separate, though clearly the 'build from source' option will make the updates a little slower - though hopefully not result in any extra downtime as Linux seems happy to update one thing whilst using an older version of it temporarily.

I would suggest the BOA script is used for the Wheezy update, because it's already got control of the LEMP stack. Over on #535 I'd suggest checking the issue queue for Wheezy update issues.

I reckon those .barracuda.cnf changes you list would be all we need.

[chris]

Replying to jim:

Since this update is a semi-blocker to the work on #610 (if only to rule out the permissions issue and force their correction), I'd prefer to see this sooner rather than later. The question of Debian 7 update is somewhat separate, though clearly the 'build from source' option will make the updates a little slower - though hopefully not result in any extra downtime as Linux seems happy to update one thing whilst using an older version of it temporarily.

I feel quite strongly that given the choice of:

• Start using openssl, php etc built from source
• Upgrade to Wheezy

That we should do the upgrade, it can't be put off forever and now seems like a very good time to do it.

I would suggest the BOA script is used for the Wheezy update, because it's already got control of the LEMP stack.

OK.

Over on #535 I'd suggest checking the issue queue for Wheezy update issues.

Which issue queue?

I reckon those .barracuda.cnf changes you list would be all we need.

OK.

[jim]

The Barracuda issue list, since that's what we're using!

​All issues with the word 'Wheezy'.

[chris]

Replying to jim:

The Barracuda issue list, since that's what we're using!

​All issues with the word 'Wheezy'.

There doesn't appear to be any tickets worth reading in that list.

[jim]

Then I'm happy if you are...

[chris]

OK, so we just need to agree a date and a time, it will probably involve the site being unavailable for an hour or so, I suggest one evening starting at 10pm, perhaps Sunday 17th Nov?

[ed]

Sunday 17th Nov, 22:00 fine by me.

If there are any other things you're expecting me to reply to, let me know - I watch the tech threads but will probably not rise until I'm asked...

[chris]

This upgrade was documented on ticket:535#comment:23, ticket:535#comment:24, ticket:535#comment:25 and ticket:535#comment:25