Serverless Schools - Thoughts, Tips and the Reality!

[HPlum78]

@Mr.Ben has got it for me try to get shot on your of prem tin and use the right bits of the cloud to deliver a service. Managing tin is time and money wasted and its not the part of your IT statergy that deserves any time. Spend your effort being transformational. Edited March 18, 2019 by HPlum78

[localzuk]

What are the 40 VMs for, how many users? How many cores? What's using 40% when it's idle?

40x VMs? What are you running?

2 x DCs

2 x NPS

2 x Data storage (H drives, P drives etc...)

1 x PKI

1 x KMS/RDS licensing server

1 x MFA host

2 x VMs doing backup work

2 x PSF servers

6 x SIMS servers

5 x RDS related servers

2 x SCCM servers

4 x Web servers

1 x Xibo

1 x WSUS

1 x SMTP relay

1 x VCSA

1 x Print

1 x Phone

1 x Passbolt

1 x Zabbix

1 x Helpdesk

1 x Changepass

1 x AB Tutor server

 

Plus a couple of legacy servers that are just there for reference at the moment.

 

We very much follow the "one VM, one role" rule of virtualisation.

DNS can be pointed directly at your ISP.

 

You'll need your own DNS for internal DNS.

Buy a Cloud key for Ubiquiti - it's about £60 and runs the management software.

This is only sized for very small installations. We ended up buying an XG server, as our device list grew to about 30 or so devices.

Edited March 18, 2019 by localzuk

[PotNoodleTech]

What an interesting thread.

 

My server rack is looking much less full than ever before, that's more to do with virtualisation than moving to the cloud though. Down to 2 x hosts and 1 x veeam server.

 

In terms of moving it all to the cloud, I guess it would be possible if I repurposed all of my machines to chromebooks. We do use google a lot, but we still have shared drive and my documents. Only way to really get users out of that habit would just be to move totally to google.

 

Will always have windows PCs here as IT, Music, DT and a couple of other departments run Windows only software. Whilst there are windows PCs there will probably be a server or two as frankly, running a 2 host hyper setup has been 99.9% reliable and at very low cost.

 

I think you need to be careful if you are moving to the cloud to cut costs, on premise hosting is a fixed, easily calculable cost (in fact been getting cheaper and cheaper every 3 -5 year cycle) wheras cloud hosting is likely to actually get more expensive as the majority of it for schools is currently free, for example, what if google suddenly decided to charge £1 a pupil per year to access GAFE? What about if they made in £10 instead? Clouds just got a whole lot more expensive.

[HPlum78]

@AButters makes a good point around the cost of cloud, Sky was free until it wasn't! Now the only thing that stops edu from being charged is MS/ Google want their products in front of students but I am sure when that no longer makes sense things could change!

 

As for server costs not sure that the cost of hardware as come down (the Reg artical posted in this very thread seems to say the same) like for like its more than it was last year. I reading HP's recent channel news looks like another increase this year as well!

[mavhc]

Well, if they don't want to pay for enough support, fair enough. Agreed that they shouldn't be allowed to have unmaintained servers, for primary schools makes more sense, just need to store the 1 billion photos they take. Sad that they won't invest in making themselves more efficient though. Half of my job is to observe and suggest more efficient methods of working

[mavhc]

1 x Passbolt

1 x Changepass

 

This is only sized for very small installations. We ended up buying an XG server, as our device list grew to about 30 or so devices.

 

Passbolt looks interesting, are you using free or paid version?

 

What's changepass?

 

I'm surprised the wifi needed that much cpu, thought it was only configuring the APs, not much else.

[PotNoodleTech]

 

I'm surprised the wifi needed that much cpu, thought it was only configuring the APs, not much else.

 

Best way to do it is just to run a windows VM with the unifi software controller on it. Totally reliable, and fast, and FREE (unlike the cloudkeys, so I've read).

 

Oh darn it this is a clouds thread isn't it, better run a CLOUDkey after all

[localzuk]

Passbolt looks interesting, are you using free or paid version?

 

Free version. Works a treat for sharing passwords in our team. Well, if one of the team didn't keep forgetting his password for it anyway!

What's changepass?

 

Website that allows users to log in and change their password. Not actually launched it for users yet, as I'm still considering whether the security hit is worth it.

I'm surprised the wifi needed that much cpu, thought it was only configuring the APs, not much else.

Ah, we use the switches mostly, with 7 APs in one school. Also, they send stats back constantly - so there is 2 way communication.

Edited March 19, 2019 by localzuk

[mavhc]

Free version. Works a treat for sharing passwords in our team. Well, if one of the team didn't keep forgetting his password for it anyway!

 

Lack of autofill (although really you want a click to fill option) and 2fa in the free version seem to be the main flaws currently.

 

 

Website that allows users to log in and change their password. Not actually launched it for users yet, as I'm still considering whether the security hit is worth it.

 

Got a URL?

[localzuk]

Lack of autofill (although really you want a click to fill option) and 2fa in the free version seem to be the main flaws currently.

 

Its not too bad. We can limit it to internal use, for example.

 

Got a URL?

Ah, I call our server changepass, but the software is "Passcore". https://github.com/unosquare/passcore

[nathan]

My team support 13 primaries, it certainly makes for interesting reading on here. With all of this remote support offered to schools, do you ever deliver any staff training? It's an area we have starting to deliver far more on, reliable kit is one thing, but if staff don't know how to use it...

[Mr.Ben]

My team support 13 primaries, it certainly makes for interesting reading on here. With all of this remote support offered to schools, do you ever deliver any staff training? It's an area we have starting to deliver far more on, reliable kit is one thing, but if staff don't know how to use it...

This is something I want to expand upon, once I've rolled out a consistent approach to managing ICT across the Trust.

 

I'm providing a few sessions already, aim at getting our newer schools ready for the changes (using SharePoint and OneDrive effectively, Teaching with teams).

 

Ideally, once the technology issues are under control I can concentrate on this for a year, before going back and improving upon the technology.

[localzuk]

My team support 13 primaries, it certainly makes for interesting reading on here. With all of this remote support offered to schools, do you ever deliver any staff training? It's an area we have starting to deliver far more on, reliable kit is one thing, but if staff don't know how to use it...

We don't have the staff for that sadly. CPD is managed by someone else in the Trust also.

[E_G_R2]

I've seen some schools where they have a facilitator (TT only) who's job is to train staff in all aspects of using the systems such as SIMS and Cloud services such as Office365 especially some of the more collaborative stuff.

[supportman]

I don't think it takes much training to use sharepoint and onedrive, even our most technophobic teachers can work that one out as its just a web page or mapped drive.

[mavhc]

Unless you actually want to use the new features it offers

[nathan]

We don't have the staff for that sadly. CPD is managed by someone else in the Trust also.

 

We are lucky in that respect, we are having a big push at going paperless soon.... i'll wish we didn't have the staff then.

[nathan]

Oh and another option to host the Unifi Controller is to use someone like Digital Ocean. It really doesn't need a lot of power, we are hosting 13 schools on at a cost of £3 month.

[Mr.Ben]

Oh and another option to host the Unifi Controller is to use someone like Digital Ocean. It really doesn't need a lot of power, we are hosting 13 schools on at a cost of £3 month.

That's a good idea - What platform are you running it on?

 

Kind regards, Ben

[nathan]

That's a good idea - What platform are you running it on?

 

Kind regards, Ben

 

Currently using Hetzner (Germany) but looking to move it to the UK although there isn't any sensitive data stored on there.

[chaplic]

My plans have taken a step forward as I've got decent pricing for everything I think I need to do this (basically azure p1/ intune license). I now need to make sure the shared computer use case works and figure out where I host a proxy.pac

 

But the vision is computers only joined to Azure AD, users logging in with AzureAD/o365 cloud accounts and apps and policy pushed down via intune. Bit of a leap out of the GPO/ AD comfort zone, but I think overall once mastered will be easier to manage.

[mavhc]

It's kinda odd that hosting a 1kb file is the sticking point. https://developer.microsoft.com/en-us/office/blogs/general-availability-of-office-365-cdn/

[chaplic]

HoHo, that's not a sticking point and if that's the only problem to solve then great, I'm not sure popping it on the O365 CDN will help as I need a proxy to get there in the first place. I can hard wire a proxy (but teachers love the fail-open whilst at home) and I can't use any WPAD type stuff as there's separate proxies for pupil and staff.

[mavhc]

So either your tiny server, raspberry pi etc, or one of the computers that is your router, firewall etc. How will the computers know where to get the proxy file in the first place if you're not using wpad? Could have wpad as a default, and then pac as a next level once configured.

 

Cisco's internal web interface is just a load of files in flash, could maybe add it there, still need dns though.

[snagrat]

My plans have taken a step forward as I've got decent pricing for everything I think I need to do this (basically azure p1/ intune license). I now need to make sure the shared computer use case works and figure out where I host a proxy.pac

 

But the vision is computers only joined to Azure AD, users logging in with AzureAD/o365 cloud accounts and apps and policy pushed down via intune. Bit of a leap out of the GPO/ AD comfort zone, but I think overall once mastered will be easier to manage.

 

Would be interested to know what Policies and Powershell scripts you are deploying.

 

I’m working on this now for a 1:1 primary. I’ve got it working the way I want, but a few tweaks to be made.

 

I’m waiting on 1903 to fully test OneDrive. I currently have it signing in automatically instantly and redirecting known folders, but want to force mapping of SharePoint sites which I think I need 1903 for.