Infrastructure

@Robinson:

For the VM + the SSL cert, poke Alex
For the e-mail address, poke Sophie

Only thing is that "SSL cert corresponding to e-mail address" is nothing
I can offer from StartSSL - we do have X.509 certificates, but not
S/MIME. For S/MIME, we might a separate verification of a human being,
which costs and takes time, so it might be worth investigating if those
certs can simply be self-signed

No need for email certs, what they want is an auth cert for xmlrpc communication.

Ah, ok, I was confused by "to have an SSL certificate
corresponding to the email address" ;-) For SSL cert, Alex can help, we
have one with StartSSL

Generic mail account set, added it to the spreadsheet.

Emailed: alex

So AFAIU: You need an X.509 client cert with the CN officeshots@libreoffice.org?
I need some more details for the VM: OS/Ram/HDD etc

Alexander Werner wrote:

So AFAIU: You need an X.509 client cert with the CN officeshots@libreoffice.org?

Yes, that'd be great.

I need some more details for the VM: OS/Ram/HDD etc

I'm not sure what kind of load this machine will get. It's going to serve as a glorified, headless PDF printer, and make at least 2 separate builds of LibreOffice available for on-demand rendering, so off the top of my head, I'd say:

• Ubuntu 14.04
• 4GB RAM
• 40GB hdd

Does that sound reasonable?

Just shot StartSSL an email whether that's doable :-)

That'll do - if someone forwards the officeshots@ address temporarily to
me, I'll setup the certificate and send it crypte to Robinson and Alex

Poke me when the forward is up :)

Florian Effenberger wrote:

That'll do - if someone forwards the officeshots@ address temporarily to
me, I'll setup the certificate and send it crypte to Robinson and Alex

Poke me when the forward is up :)

done

Seems that StartSSL is a bit problematic for this - is a valid, known CA required? If not, how about just creating a self-signed certificate?
xca is a GUI tool for that, see http://sourceforge.net/projects/xca/
Otherwise, something like that looks sensible: https://gist.github.com/richieforeman/3166387

Using -sha512 and rsa:4096 sounds like good parameters.

• https://blog.cacert.org/2014/12/creating-certificates-with-csr-now-possible-for-org-accounts/
• https://wiki.cacert.org/OrganisationAssurance/OA/OrgAdmin/Handbook/EN#clientcert

Alex: Were you able to set up a VM to run the officeshots factory? Thanks.

Infra tries to provide a VM this week, but it depends on a couple of parameters

a vm has been created with the above mentioned specs (40GB HDD, 4GB RAM) (vm164.documentfoundation.org - minimal setup via salt)

VM has been setup, now we wait getting credentials for the service, Robinson will ping them again later this week if we have no credentials by then

Another quick update:

Officeshots factory is running on our VM; LibreOffice install is running locally and producing correct output.

I'm currently waiting to hear back from the Officeshots sysadmins to understand what behavior I should expect from the factories in general. Documents submitted to any factory appear to remain in 'queued' state indefinitely.

Notes on implementation:

1. According to the docs, there is supposedly a 'LOServer' backend, however it doesn't appear to exist outside of the config file. The 'OOOServer' does not work with LibreOffice. For now, I'm using the CLI backend.
2. Running the factory.py script with a '-d' switch will give a lot of useful debugging info about the connection

Just heard back from the Officeshots admins today. It looks like there were some issues with antivirus software on their end, and they said that things should be running again smoothly. I'll test our Officeshots install and the primary website again this week.

Robinson Tryon wrote:

Just heard back from the Officeshots admins today. It looks like there were some issues with antivirus software on their end, and they said that things should be running again smoothly. I'll test our Officeshots install and the primary website again this week.

Ran a test, but still experiencing timeouts. I've gotten the setup working using the CLI backend with some tweaking, but I really would like to use the LOServer backend as I believe it will be more reliable in the long term. I'll ping them again this week and ask for more information about the updated config.