Enable girder scaling

[subdavis]

We have a lot of CPUs that we can throw at providing better response times. Let's scale girder up.

This is probably what we should have done instead of provisioning a second server in AWS for the last demo.

Also enables rolling restart during updates for zero downtime a535e44

All the pretty colors

[aashish24]

So did I read it correctly.. we are using traefik for scaling it up? how does it work exactly and have we used it before?

[subdavis]

No, we have not used traefik before.

Howerver, I personally have a lot of experience with it, and it I think it provides several improvements over nginx for this use case

• Right now, nginx reverse proxy is not part of our service config, you have to deploy it by hand. We could let traefik take over as the external-facing proxy.
• Letsencrypt cert management is something traefik can handle itself. We also do this by hand right now.
• It's a docker solution, which means we can write the service configuration directly into our docker-compose file rather than having to bind mount an nginx configuration file.
• It scales without having to reconfigure. docker-compose scale girder=4 instead instead of having to write 4 different gider services into our compose, and then write a new nginx configuration to go with it.

In order to build a reproducible deployment, we'd have to either write ansible for nginx, use an nginx reverse proxy container, or use traefik.

Alternatives:

• https://github.com/nginx-proxy/nginx-proxy
• https://caddyserver.com/

It works by just doing round-robin load balancing across however many running containers there are.

[BryonLewis]

A couple of questions regarding traefik.

[BryonLewis]

totally new to traefik so maybe need a clarification here on the purpose of API besides debugging and the dashboard. Is it needed for load balancing.
https://doc.traefik.io/traefik/operations/api/

[subdavis]

No. We can disable it.

[BryonLewis]

if we eventually remove nginx guess we will want this disabled for prod?

[subdavis]

This is a slightly misleading argument. It allows inscure SSL behind the proxy, not in front. So like if girder were sending self-signed certs. It can also be removed