{"id":539,"date":"2011-12-07T09:53:46","date_gmt":"2011-12-07T17:53:46","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=539"},"modified":"2011-12-07T11:52:31","modified_gmt":"2011-12-07T19:52:31","slug":"how-to-throw-an-ec2-party","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2011\/12\/07\/how-to-throw-an-ec2-party\/","title":{"rendered":"how to throw an EC2 party"},"content":{"rendered":"<p>Prepare a location to run juju and install it:<\/p>\n<pre>\r\nmkdir ~\/party\r\ncd ~\/party\r\nsudo apt-get install juju\r\n<\/pre>\n<p>Initialize your <a href=\"https:\/\/juju.ubuntu.com\/docs\/getting-started.html#configuring-your-environment\">juju environment<\/a>. Be sure to add &#8220;<code>juju-origin: ppa<\/code>&#8221; to your environment, along with filling in your <code>access-key<\/code> and <code>secret-key<\/code> from your Amazon AWS account. Note that <code>control-bucket<\/code> and <code>admin-secret<\/code> should not be used by any other environment or juju won&#8217;t be able to distinguish them. <a href=\"https:\/\/juju.ubuntu.com\/docs\/provider-configuration-ec2.html\">Other variables<\/a> are good to set now too. I wanted my instances close to me, use I set &#8220;<code>region: us-west-1<\/code>&#8220;. I also wanted a 64bit system, so using the <a href=\"http:\/\/uec-images.ubuntu.com\/query\/oneiric\/server\/released.txt\">AMI list<\/a>, I chose &#8220;<code>default-series: oneiric<\/code>&#8220;, &#8220;<code>default-instance-type: m1.large<\/code>&#8221; and &#8220;<code>default-image-id: ami-7b772b3e<\/code>&#8221;<\/p>\n<pre>\r\njuju\r\n$EDITOR ~\/.juju\/environments.yaml\r\n<\/pre>\n<p>Get my <a href=\"https:\/\/code.launchpad.net\/~kees\/charm\/oneiric\/sbuild\/trunk\">sbuild charm<\/a>, and configure some types of builders. The <code>salt<\/code> should be something used only for this party; it is used to generate the random passwords for the builder accounts. The <code>distro<\/code> and <code>releases<\/code> can be set to whatever the <a href=\"http:\/\/wiki.debian.org\/mk-sbuild\">mk-sbuild<\/a> tool understands.<\/p>\n<pre>\r\nbzr co lp:~kees\/charm\/oneiric\/sbuild\/trunk sbuild-charm\r\ncat &gt;local.yaml &lt;&lt;EOM\r\nbuilder-debian:\r\n    salt: some-secret-phrase-for-this-party\r\n    distro: debian\r\n    releases: unstable\r\nbuilder-ubuntu:\r\n    salt: some-secret-phrase-for-this-party\r\n    distro: ubuntu\r\n    releases: precise,oneiric\r\nEOM\r\n<\/pre>\n<p>Bootstrap juju and wait for ec2 instance to come up.<\/p>\n<pre>\r\njuju bootstrap\r\n<\/pre>\n<p> Before running the status, you can either accept the SSH key blindly, or use &#8220;<a href=\"http:\/\/manpages.ubuntu.com\/ec2-describe-instances\"><code>ec2-describe-instances<\/code><\/a>&#8221; to find the instance and public host name, and use my &#8220;<code>wait-for-ssh<\/code>&#8221; tool to inject the SSH host key into your <code>~\/.ssh\/known_hosts<\/code> file. This requires having set up the environment variables needed by &#8220;<code>ec2-describe-instances<\/code>&#8220;, though.<\/p>\n<pre>\r\nec2-describe-instances --region REGION\r\n.\/sbuild-charm\/wait-for-ssh INSTANCE HOST REGION\r\n<\/pre>\n<p>Get status:<\/p>\n<pre>\r\njuju status\r\n<\/pre>\n<p>Deploy a builder:<\/p>\n<pre>\r\njuju deploy --config local.yaml --repository $PWD local:sbuild-charm builder-debian\r\n<\/pre>\n<p>Deploy more of the same type:<\/p>\n<pre>\r\njuju add-unit builder-debian\r\njuju add-unit builder-debian\r\njuju add-unit builder-debian\r\n<\/pre>\n<p>Now you have to wait for them to finish installing, which will take a while. Once they&#8217;re at least partially up (the &#8220;builder&#8221; user has been created), you can print out the slips of paper to hand out to your party attendees:<\/p>\n<pre>\r\n.\/sbuild-charm\/slips | mpage -1 > \/tmp\/slips.ps\r\nps2pdf \/tmp\/slips.ps \/tmp\/slips.pdf\r\n<\/pre>\n<p>They look like this:<\/p>\n<pre>\r\nUnit: builder-debian\/3\r\nHost: ec2-256-1-1-1.us-west-1.compute.amazonaws.com\r\nSSH key fingerprints:\r\n  1024 3e:f7:66:53:a9:e8:96:c7:27:36:71:ce:2a:cf:65:31 (DSA)\r\n  256 53:a9:e8:96:c7:20:6f:8f:4a:de:b2:a3:b7:6b:34:f7 (ECDSA)\r\n  2048 3b:29:99:20:6f:8f:4a:de:b2:a3:b7:6b:34:bc:7a:e3 (RSA)\r\nUsername: builder\r\nPassword: 68b329da9893\r\n<\/pre>\n<p>To admin the machines, you can use juju itself, where N is the machine number from the &#8220;<code>juju status<\/code>&#8221; output:<\/p>\n<pre>\r\njuju ssh N\r\n<\/pre>\n<p>To add additional chroots to the entire builder service, add them to the config:<\/p>\n<pre>\r\njuju set builder-debian release=unstable,testing,stable\r\njuju set builder-ubuntu release=precise,oneiric,lucid,natty\r\n<\/pre>\n<p>Notes about some of the terrible security hacks this charm does:<\/p>\n<ul>\n<li>enables password-based SSH access (and locks the default &#8220;ubuntu&#8221; account), so party attendees don&#8217;t need anything but the ssh client itself to get to the builders.<\/li>\n<li>starts <code>rngd -r \/dev\/urandom<\/code> to create terrible but plentiful entropy for the sbuild GPG key generation.<\/li>\n<\/ul>\n<p>Enjoy!<\/p>\n<p style='text-align:left'>&copy; 2011, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Prepare a location to run juju and install it: mkdir ~\/party cd ~\/party sudo apt-get install juju Initialize your juju environment. Be sure to add &#8220;juju-origin: ppa&#8221; to your environment, along with filling in your access-key and secret-key from your Amazon AWS account. Note that control-bucket and admin-secret should not be used by any other [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/539"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=539"}],"version-history":[{"count":7,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/539\/revisions"}],"predecessor-version":[{"id":547,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/539\/revisions\/547"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=539"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=539"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=539"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}