Serverless School

[Shadow_Walker]

Looking to start moving some of our primary schools to a serverless environment.

 

Each primary has a leased line with 100/100 connection minimum. We have our own private WAN (MPLS) between the schools and also have a datacentre for central servers.

 

Currently we have smoothwall on site for filtering but are in early stages of looking at their cloud/hybrid solutions.

 

Where would everyone start and any best practices?

[FN-GM]

You might want to look at an SD-WAN solution instead of MPLS. You have an internet connection on site but can centrally mange and deploy policies from a single console.

[dmj]

I would certainly think about doubling up the WAN connection, through a different telephone exchange if possible.

As for best practices: The goal is really to migrate services SaaS>PaaS>IaaS. Most services should become SaaS: For example move SIMS to offsite Arbour, BromCom or one of the web based solutions that are managed offsite.

Services that cannot be bought as a SaaS can usually be run as PaaS (things like sql servers, Active directories etc where (eg) AWS,Google,Azure provide the platform to which you are the admin). Services that you can't get as PaaS then need to be containerised so that they can run as 'serverless' kubernetes - this will be for all the odd things that you can't buy a service for.

So the best practice is really to have as few virtual servers (IaaS) as possible in the cloud because these are the most expensive resource with the fewest options for scalability, self healing etc.

[Shadow_Walker]

Bit more background

 

- Schools already using Bromcom

- Each school has leased line and FTTC backup line (mainly in different ducting and separate cabinet where possible)

- Home folders and Shared drives are all on google already

[dmj]

Bit more background

 

- Schools already using Bromcom

- Each school has leased line and FTTC backup line (mainly in different ducting and separate cabinet where possible)

- Home folders and Shared drives are all on google already

 

Sounds like you are already in a good position. It would be a good plan to write out the services that are currently onsite and work a plan as to the most appropriate way to migrate them, ie decide whether they can be (replaced) or moved to Paas, Saas, containers or IaaS.

[FN-GM]

You might want to look at an SD-WAN solution instead of MPLS. You have an internet connection on site but can centrally mange and deploy policies from a single console.

 

Something I should have said is the design of MPLS is usually generalised in a data centre or something. SD-WAN deployments don't use this design.

[supportman]

If going the Microsoft route:

 

- Azure office 365 login

- Intune for management

- Bromcom for MIS

- Onedrive for storage

- Sharepoint for shared files and intranet

- Teams for internal Comms

- Hosted smoothwall? Or some kind of DNS filtering

[Ditto]

I'd suggest starting with someone who has been through the move - lots of advice from https://blog.theserverlessschool.net/p/about.html

[synaesthesia]

One thing I would add to any serverless setup is some sort of backup on top of redundancy. I know it goes against serverless, but WHEN (this is when and not if) something happens to your one or even two connections that is out of your control; perhaps routing dies because something happens at Telehouse, level 3 or any of the backbones and your backup line suddenly becomes quite useless. Are you going back to pen and paper for the duration?

Noone seems to want to admit this is not only a possibility but a likelihood, and it would take SO little to just have something in place locally so you're not breaking out the mini chalkboards. You've already got the stuff internally dealing with DHCP and DNS with the router/firewall typically so a single fileserver (might not even need to be much more than a decent NAS) with disaster recovery/backup plans in place might help.

I might be old fashioned, but for so little effort why not?

[supportman]

One thing I would add to any serverless setup is some sort of backup on top of redundancy. I know it goes against serverless, but WHEN (this is when and not if) something happens to your one or even two connections that is out of your control; perhaps routing dies because something happens at Telehouse, level 3 or any of the backbones and your backup line suddenly becomes quite useless. Are you going back to pen and paper for the duration?

Noone seems to want to admit this is not only a possibility but a likelihood, and it would take SO little to just have something in place locally so you're not breaking out the mini chalkboards. You've already got the stuff internally dealing with DHCP and DNS with the router/firewall typically so a single fileserver (might not even need to be much more than a decent NAS) with disaster recovery/backup plans in place might help.

I might be old fashioned, but for so little effort why not?

 

Defeats the point, un-needed complexity, cost, technician time.

 

There are many reasons why not to build local infrastructure. I never really understand these problems people think of with internet. We've had a BT leased line for over 10 years here and I don't think I can remember a single outage in that time.

 

The biggest issue with serverless is things like Intune not quite matching Group Policy in locking down computers yet. Its mostly there, but not perfect.

[Primus]

Defeats the point, un-needed complexity, cost, technician time.

 

There are many reasons why not to build local infrastructure. I never really understand these problems people think of with internet. We've had a BT leased line for over 10 years here and I don't think I can remember a single outage in that time.

 

The biggest issue with serverless is things like Intune not quite matching Group Policy in locking down computers yet. Its mostly there, but not perfect.

 

I mean I agree but come on - not a single outage in 10 years? Seems highly unlikely.

[robyholmes]

How often do school have power cuts? I'd say for us they are just as likely if not more likely than the internet feed going down (Leased Line + Backup). Unless your going to have a big generator, school just copes or if it's a long one, shuts.

[Margaret1999]

This is a great idea, but maybe it would be worth considering Linux servers? Not only cheaper, but in my opinion it's easier to maintain and if there's any problem- you can depend on user feedback and help Edited September 15, 2020 by Margaret1999

[MartinDT]

All our Primaries are serverless. Part of a bigger MPLS, so some servers are hosted centrally.

All docs are in Google, so no file servers anywhere.

DHCP etc. done from the switch, linked back to central Domain Controller for DNS and so on...

 

It saves so much time and cost... Once you do it you will never go back!

[Ditto]

How often do school have power cuts? I'd say for us they are just as likely if not more likely than the internet feed going down (Leased Line + Backup). Unless your going to have a big generator, school just copes or if it's a long one, shuts.

It's a valid point and what I think it highlights is that a school is better to have a mitigation plan to cope with an 'All systems down' scenario than trying to find technological solutions to all the low probability risks. I'd say it should be included in the business continuity plan and have contingencies in line with a significant school fire.

[j224]

Similar to MartinDT. We were already using GSuite a lot and have had some shared Chromebooks for several years so everyone was used to that way of working.

 

Our server died in April so we decided to make the leap.

 

Converted the ICT suite and classroom-based teacher PCs to CloudReady

Hosted SIMS

Directprint.io for print management

DHCP, etc on the switch

 

Just kept a couple of admin machines on Windows for emergencies!

[supportman]

I mean I agree but come on - not a single outage in 10 years? Seems highly unlikely.

 

I honestly can't remember a time when our internet was "down", its been rock solid. BT has been great, maybe we are just lucky.

 

Powercuts of course, but thats something that affects everyone.

[synaesthesia]

How much work do you seem to think is involved in setting up a NAS and having some backup stuff on it? Probably a one-off half a day job. So no, no infrastructure addition, no major changes, just an answer to a "what if".

I can certainly say you HAVE had downtime in the last 10 years, as has the entire country. Point is, no matter how good you think your system is, when a little backup plan costs £negligable, why not?

Edited September 15, 2020 by synaesthesia

[Primus]

I honestly can't remember a time when our internet was "down", its been rock solid. BT has been great, maybe we are just lucky.

 

Powercuts of course, but thats something that affects everyone.

 

There's luck and then there's 10 years without a single Internet drop - how many times have you also won the lottery?!

[synaesthesia]

There's luck and then there's 10 years without a single Internet drop - how many times have you also won the lottery?!

 

None, because in 2011 he had the same dropout as we all did, and there have been a couple of other times since.

 

Olympic village - fibre cut.

Akamai & a couple of other CDNs whos names escape me

LiNX outage

All 3 crippled the internet for the entire country - only exception for the latter 2 was you could have gotten around the issues with a VPN.

That's all in the last 10 years. Few and far between thankfully but... why not have a backup plan?

[dhicks]

- Each school has leased line and FTTC backup line (mainly in different ducting and separate cabinet where possible)

- Home folders and Shared drives are all on google already

 

As already suggested, probably worth keeping a little bit of local capabilities for backup: have Google Drive sync to a local NAS / file server (I'd go for a local file server syncing with rclone) and get versioned backups, handy as a just-in-case. No need to go for something full-on rackmount, so no need need to have a rack to mount stuff in and air conditioning etc, just a small machine is fine thse days.

 

Backup for Internet: we have a fibre line and an ADSL backup, and also a 5G connection as backup. In the most recent outage our fibre line went down but the ADSL did stay up, but if both were down due to a local issue ("backhoe-related outage") wireless stands a bit more chance of staying up - should provide enough for at least basic emails-to-parents. It might also be worth looking at backup ppower for your local network infrasturcture - we have a central UPS that powers a number of our network cabinets (as well as a couple of central admin workstations), which in turn run the wireless and telephones via PoE, so in a recent power cut we could at least contact parents and set up homework via Classroom.

 

For filtering, if you're using Chromebooks, locally-installed filtering clients for pupil accounts work best. We've just moved to Securley, which I haven't had much experience with yet. The nice part is that setttings / extensions stay with the user rather than the device, so if a child logs in to a Chromebook from home they get the same filtering setup as at school - handy for home learners, and you can recondition a second-hand laptop for home as a Chromebook with the free version of Cloud Ready.

[ITGURU]

I'd never put all my eggs in one basket!

[Shadow_Walker]

So taking everyone's thoughts so far just some follow ups

 

- DHCP: Done on Switch, had a look and Aruba 2540 can handle this and we use these as edge appliances at our secondaries. Is there any other switches people would go for?

 

- Printing: How would people do this? We currently have central papercut in our datacentre and local print server in our schools

 

- Domain controller: We currently have a central DC, would people authenticate against this or would go azure route?

[snagrat]

Printing - we use Printix and this links in with our Papercut hosted in Azure

 

Authentication - Just use Azure. We use AD for authentication such as Papercut etc but all machines authenticated to AzureAD

[dhicks]

Printing: How would people do this? We currently have central papercut in our datacentre and local print server in our schools

 

Papercut has a cloud-based bit, I can't remember what it's called but you can print from Chromebooks with it.

 

Domain controller: We currently have a central DC, would people authenticate against this or would go azure route?

 

You can now authenticate Windows with your Google account, and GSuite offers Windows management facilities.