ownCloud Architectural Guide ownCloud provides Universal File Access through a common file access layer regardless of where the data lives – in applications, object stores, on premise storage or in the cloud. Data is kept where it is while IT is able to manage proprietary infor­mation and business risk; leveraging existing ownCloud Application data management, security and governance tools and processes. Whether in SharePoint, on a HTTP DB PHP Windows network drive or in cloud storage, users (Apache, nginx) (MySQL, PostgreSQL, Oracle) have a single interface from which they can access, sync and share files on any device, anytime, from (Red Hat, CentOS, SUSE, ) anywhere – all completely managed, secured and controlled by IT. Hypervisor (VMware, Microsoft, KVM) This paper describes the performance and scaling of the industry-standard EFSS (Enterprise File Sync Physical Host Share) solution ownCloud Enterprise. ownCloud Enterprise runs on an Enterprise LAMP ( Apache MySQL PhP) stack on either Suse, Red Hat, CentOS or Ubuntu operating systems running PHP connecting to one of the supported , MySQL, PostgreSQL or Oracle.

ownCloud Overview Intended Audience ownCloud is a universal file architecture, extreme extensi- This paper is intended for ted hands-on experience with access platform that is hosted bility and unique federated System Architects and Adminis- ownCloud Enterprise’s user in a customer’s data center, cloud sharing capabilities. trators who are deploying interface as well as on their servers, using their ownCloud Enterprise into their administrator interface. storage. With over 8 million community IT infrastructure. It is assumed and enterprise users, that the reader has basic ownCloud delivers the visibi- ownCloud is the preferred file understanding of IT infrastruc- lity, control and integration into access solution for organiza- ture, basic networking and complex, secure and compliant tions across the globe. Whether routing skills, along with virtua- environments that IT needs looking for file sync and share, lization and server installation while providing users the fric- universal file access or Federa- best practices. It is also assu- tionless access to all of their ted Cloud Sharing, ownCloud med that the reader has a basic files from any device. This is has the solution that is right for understanding of the principles made possible through every organization. of ownCloud and its capabili- ownCloud’s open, modular ties and has had at least limi- 2

Solution Architecture Overview

The core of the ownCloud The server provides a secure Cloud, while providing the Primary Storage. ownCloud solution is the ownCloud ser- web interface through which internal processing engine nee- also has native connectors for ver. Unlike consumer-grade file administrators control all of ded to deliver high perfor- object stores here, allowing us sharing services, ownCloud‘s ownCloud‘s resources, allowing mance file sharing services. to directly access objects Enterprise solution enables IT authorized users to enable and stores without the need for to protect and manage files disable features, set policies, To enable a broad range of things such as fuse mounts. within the ownCloud environ- create shares and manage storage alternatives, ownCloud Other storage resources can ment – from file storage to user users. Advanced features for also abstracts the storage tier. also be mounted on the system / group provisioning. ownCloud enterprise directory integration As a result, ownCloud can leve- using ownCloud Enterprise’s monitors and logs all data and file “firewalls” give admins rage just about any storage internal connectors, otherwise access events for downstream exceptional flexibility and con- protocol that can be mounted known as Secondary Storage. auditing and analysis using trol. The server also manages on your ownCloud server at the popular tools like Splunk®. and secures API access to own- operating system level as

Primary Storage Secondary Storage

Primary Storage is required in Secondary Storage is an optio- all ownCloud installations. By nal, but particularly robust default, ownCloud utilizes the component of ownCloud Enter- ../o w n C lo u d /d a t a directory prise that will allow organiza- off the root of the webserver on the ownCloud configuration file tions to utilize their existing ownCloud Enterprise as a the local partition as the simply needs to be pointed to data infrastructure. This not switch or router for your current default user data directory. the new storage location. While only facilitates flexibility in existing data silos, allowing Its presence is required by the ownCloud can seamlessly work design, it also allows administ- seamless integration and pre- ownCloud core application to with the Primary Storage on the rators to utilize existing data senting the end-user with an store user-specific metadata local partition, administrators silos and ACL (Access Control intuitive yet simple interface such as thumbnails, temporary will want to utilize an external Lists), minimizing the need for to multiple data sources. files, cache, encryption keys, Primary Storage source moun- redundant storage devices, For example, administrators versioning and trash-bin. While ted to the Linux operating sys- as version 8.2 of ownCloud may want to utilize existing the ownCloud data directory tem to ease in storage overlap, Enterprise supports Amazon Windows Server network can reside on the local partition performance, backups / S3, , , shares of a department already of the underlying server, admi- snapshots and expandability OpenStack Object Store, FTP, in place, minimizing data red- nistrators can elect to utilize concerns. Use of object stores SFTP, SMB / CIFS, SharePoint, undancy and preserving ACLs. other means of Primary Storage as primary storage is done Windows server shares and In this case, ownCloud Enter- attached / mounted to the local through a specific ownCloud WebDAV. The diversity of the prise, through the use of the Linux operating system. plugin. For larger installs of various compatible Secondary Windows Network Drive (WND), ownCloud can utilize any files ownCloud where multiple Storage along with the Primary could connect to an existing system that the local operating instances of the ownCloud Storage aspect of ownCloud Windows Share “\\server- system can mount, such as Enterprise application servers Enterprise, gives businesses an name\engineering” and NFS, GFS, Swift, etc , and has are running behind a load easily customizable solution allow users to securely access native connectors for object balancer, external Primary that can integrate data from a data while at work, home or on stores. Storage is a requirement as it number of sources. Think of the road and collaborate with allows access to the user sto- Once an administrator elects to rage from multiple application utilize a storage mechanism servers that reside in the web- other than the local partition, farm or cluster. 3

internal colleagues or remotely As with all Secondary Storage with contractors. With within ownCloud, such connec- ownCloud Enterprise’s WND tions, once configured, are connector, administrators have stored in the ownCloud Enter- the capability to integrate with prise . This helps faci- existing SSO solutions in place, litate horizontal scaling by avo- LDAP, Active Directory or SAML iding numerous configuration 2.0 compliant two-part authen- steps as well any changes or tication thus preserving current additions to Secondary Storage ACLs in place on existing are effective immediately and Windows Server shares. available across an ownCloud Enterprise cluster.

Horizontal versus Vertical sizing

Vertical scaling is accomplis- can be accomplished through The load balancer has a single There are standard and enter- hed by increasing system the stateless operation of the responsibility: deciding which prise grade appliances from resources, like adding more ownCloud code. ownCloud Enterprise server companies such as F5, A10, memory and processing power. from the cluster will receive a Kemp etc. that are very fast and Horizontal scaling, on the other While horizontal scaling is usu- request from an end-user. It reliable and can also be setup hand, is accomplished by ally the most reliable and effici- behaves like a reverse proxy, in a N+1 environment, ensuring adding more servers to an exis- ent method of scalability, it's making the process seamless even higher availability. If a ting cluster. Let’s talk about not as trivial as vertical scaling. to the end-user. Least connec- business is utilizing such enter- exactly what that means. Given ownCloud Enterprise stores tions and round robin are the prise grade load-balancers they the nature of ownCloud and most of the configuration data two most common type of load can and should be utilized in PHP’s out-of-the-box single in the database, so scaling out balancer algorithms used in an front of an ownCloud cluster, threaded application design, horizontally is extremely easy. ownCloud Enterprise solution. reducing deployment costs, ownCloud (as with most web- Administrators normally install A load balancer with least con- setup, maintenance and based PHP applications) per- and successfully configure a nections combined with sticky complications. Open Source forms / scales best in a cluste- single ownCloud virtual-server sessions affords one of the sim- HA­Proxy is also a very popular red, or scaled-out environment. instance. Once that virtual- plest and most common types and affordable option. Open server is confirmed and tested, of load balancing in an Source HAProxy sits on top of a For this discussion, a cluster is it is cloned using tools provi- ownCloud Enterprise solution. standard Linux based OS simply a group of ownCloud ded the underlying hypervisor, With least connections / sticky virtual-machine and can be servers. A load balancer distri- powered back up on the exis- sessions the load balancer easily configured, deployed butes the workload between ting host or a separate host directs an initial end-user to and installed in an ownCloud the ownCloud Enterprise ser- depending customer environ- the server with the least current Enterprise cluster. For High vers in a cluster. At any point, a ment (a separate host provides connections and continues to Availability solutions, HAProxy ownCloud Enterprise App ser- minimal redundancy). Once the send the user to the same can be configured in a N+1 envi- ver can be added to the existing new virtual-server is running, a server simplifying session ronment utilizing a heartbeat cluster to handle more requests new IP address is given and the management . mechanism between two physi- from users accessing your load balancer is configured cally diverse HAProxys, ensu- ownCloud Enterprise instance; with it. ring uptime. this is horizontal scaling. This 4

User Session Management and Persistence in an ownCloud Enterprise Cluster AVS integration ownCloud Enterprise traffic is virtual-machine with the load ownCloud Enterprise can utilize ring and implementing ClamAV based on user sessions and balancer utilizing sticky / per- ClamAV for virus detection. in their ownCloud environment. leverages PHP to store user sistent sessions will suffice. If Special consideration should Once such configuration of the session variables. Therefore business needs dictate other- be given when business needs ClamAV virtual-server is com- when implementing an wise, Memcached or Redis dictate ownCloud to utilize this pleted, simply notify ownCloud ownCloud Enterprise cluster solutions are fully supported by in-transit AVS solution due to of the location of the ClamAV behind a load balancer, session ownCloud and accommodate increased CPU, RAM and disk server in the ownCloud web- management and persistence session management across utilization. In all but the smal- portal admin page. While an must be taken into considera- multiple App servers in the lest installations, it is recom- ownCloud solution utilizing in- tion. There are two fundamen- cluster. mended that the ClamAV appli- transit ClamAV virus scanning tally different ways to do ses- cation be hosted on a separate is not intended to replace a sion management in supporting ownCloud Enterprise, by virtual-machine instance. While company’s current at-rest AVS an ownCloud cluster. One is design, does not store user this paper is not intended to solution, it does afford a local session management on session in the database. If cover installing and configuring second layer of early detection the application servers com- ownCloud Enterprise has used ClamAV, administrators will which could minimize impact bined with utilizing sticky / per- the database, then session need to determine the best by eliminating issues sistent sessions on the load management across a cluster approach in installing, configu- downstream. balancer. The other is a centra- would not be an issue as the lized session management tool database would be a common on the ownCloud Enterprise storage point. Careful conside- application virtual-servers. ration was put into the design of Business drivers will determine user session storage within which session management ownCloud. In order to enable solution is best, based on ownCloud to scale beyond one needs and after careful consi- half million users, deration of the pros and cons of ownCloud chose to implement each. For most business needs, in RAM session storage for local session management on speed and performance. the ownCloud Enterprise PHP Caching

Some operations that an included and enabled by ownCloud Enterprise server default in PHP since the 5.5 executes take more time to release. On PHP 5.4, the oldest complete, such as expensive currently supported PHP calculations or communication release which works with with a remote storage server. ownCloud, it is highly recom- Other operations are much mended to install an opcache. faster – but are needed many, many times per second. To Memory caching, on the other improve performance and hand, is used directly by web reduce the load on the system applications like ownCloud. It caused by CPU / RAM intensive helps ownCloud avoid slow or frequently needed work, database queries or file system ownCloud Enterprise can cache checks by retrieving a result the result of these operations. from a memory cache, either on Since ownCloud 8.1, caching the local machine or distribu- has become an explicit setting. ted on a cluster of servers. The result is a trade-off of memory Caching is used in PHP to store usage for improved perfor- compiled versions of the scripts mance. As the memory usage of so they don’t need to be recom- these caches is typically small, piled on every request. This is it is generally worth the effort called opcaching and has been to set them up. 5

Server Architecture Server sizing

At its core, ownCloud Enter- Enterprise stores user informa- As with any HTTP-based LAMP hardware involved. We will prise is a PHP web application tion, user-shared file details, deployment, ownCloud’s explore a few example deploy- running on top of Apache or plug-in application states, and deployment scenarios are simi- ments to give a better under- nginx-based HTTP / web ser- the ownCloud file cache. lar in configuration and resour- standing of how ownCloud is vers, running on the customer's ownCloud accesses the data- ces. With ownCloud, the num- deployed and right-sized, choice of supported Linux plat- base through an abstraction ber of users (both total and allowing administrators a forms. There is no advantage or layer, enabling support for concurrent), number of files base guideline to designing disadvantage to running Oracle, MySQL, and Post- attached / accessible to the the ownCloud Enterprise ownCloud on any of the suppor- greSQL. Complete webserver ownCloud instance, available solution that best fits their ted Linux operating systems or logging is provided via web­ bandwidth, storage IOPs and business needs. Apache. In the case of selecting server logs, and user and CPU speed are all considera- an OS for use with ownCloud, system logs are provided in a tions when sizing your environ- businesses will utilize what separate ownCloud Enterprise ment for production status. company policy dictates or log, or can be directed to a sys- Due to the many variables that leverage existing in-house log file. Deploying, scaling, and are possible for each business knowledge to select the base maintaining ownCloud Enter- and their solution, there is no OS. The ownCloud Enterprise prise is similar in fashion to any right “one size fits all” deploy- PHP application manages every other LAMP based web applica- ment specification. Administra- aspect of ownCloud Enterprise, tion and follows basic rules, tors will need to monitor, test, from user management to plug- practices and design principles and possibly stress-test their ins, file sharing and storage. commonly found the in the particular deployment before a Attached to the PHP application industry. full production roll out based is a database where ownCloud on their utilization needs and

Implementation Examples

Company A on VMware’ ESXi hypervisor (i.e. minimal OS install without Company A is a 200-person which resides on relatively cur- a GUI desktop) should be practi- company at one location with rent physical hosts of reasona- ced with any web based appli- about 170 users identified as ble speed (RAM / CPU / Disk). cation server. This not only needing access to ownCloud minimizes hardware provision Enterprise. Business need dic- To deploy ownCloud Enterprise, requirements (CPU, RAM and tates that only Primary Storage Jane will create two virtual disk), but also reduces comple- is required and estimates about machines in their environment. xities and insecurities as well 11,000 files totaling 90GB will One “APP” virtual-server with 2 as ensuring uptime. need to be stored on the Pri- vCPUs (2 vCPUs per host core) mary Storage of ownCloud 3GB RAM and 150GB of disk On the App virtual machine, Enterprise. Company A has only space (30GB for the operating Apache, and PHP along with one IT Administrator, Jane, on system and 120GB for user any required dependencies will staff who has slight experience data, allowing for growth) and be installed utilizing normal with Ubuntu and MySQL, thus one “SQL” virtual-server, with 2 practices for installing applica- Ubuntu is selected as the vCPUs, 3GB RAM and 20GB of tions on a Linux server. Then underlying operating system disk space. On both virtual ser- the ownCloud Enterprise appli- and Jane will utilize MySQL as vers she will install the latest cation is installed. Likewise, Seeing that Company A requi- the database provider. stable version of a headless MySQL will be installed on the res public facing access to their Company A currently is using Ubuntu operating system. SQL virtual-server and configu- ownCloud environment, the virtualized technology based Installing headless servers red following ownCloud App virtual-server will be provi- Enterprise’s instructions. Jane ded with a public IP address configures PHP to consume a (either by use of NAT at the Role vCPU RAM PHP PHP- OS / /data maximum of 512MB and selects firewall / router or assigned Cache App APCu as her PHP caching device directly to the virtual-server) App 2 3GB 512MB 256MB 30GB 120GB and allocates 256MB to it. and set DNS entries respec- SQL 2 3GB 20GB tively for the FQDN (Fully Quali- 6

fied Domain Name) assigned. ports need to be exposed to the ness can integrate ownCloud form of backup) of the virtual- Company A’s firewall will be internet. While access to the with Active Directory to allow machines, as per IT policy, configured to allow the App ser- ownCloud server can be accom- authentication for their current utilizing VSphere. Once Jane ver to be in the DMZ and will plished over HTTP (port 80), employees’ access, and at the ensures the ownCloud installa- open TCP port 443 and port 80 given today’s CPU speed com- same time can utilize ownCloud tion is operating correctly and access to the App server. As bined with security concerns, Enterprise’s internal user secure, she deploys to a small with any ownCloud installation, this is not recommended. Admi- authentication mechanism for subset of “power-users” within the SQL virtual-server does not nistrators should forward HTTP outside contractors’ access. company Company A, for initial need public IP access, so Jane (port 80) to HTTPS Contractors that do not have an testing and feedback. Once ini- assigns a private IP address (port 443) either at the firewall / AD account but require access tial testing is complete and (i.e. 10.10.64.128) and ensures router level or utilize Apache / to files located on the ownCloud feedback is satisfactory, she that the App virtual-server can nginx to forward port 80 for the server shares and the ownCloud deploys the ownCloud Desktop correctly communicate with the best user experience. environment can get them. Sync Client, ownCloud Mobile SQL virtual-server over TCP / application as required. After UDP port MySQL (3306). Company A uses Microsoft Company A has a third-party training users on the use of Active Directory (AD) for user onsite backup solution. Jane ownCloud, she will monitor Jane installs the company's SSL authentication. Once configu- will install the subsequent the server and environment as certificates within Apache and red, administrators will select Linux agent provided by the she would any other web confirms they are correctly ins- individual AD users or by AD third-party vendor onto both application. talled, accessing the server groups, allowing access the App and SQL virtual-machi- with her web-browser. Jane also to the ownCloud application. nes and configure them to back configures Apache to redirect Once correctly configured, up both the user /data direc- all requests to the webserver Jane confirms correct setup by tory and MySQL database. She on HTTP (port 80) to HTTPS successfully logging into the will also make snapshots (as a (port 443) for the best experi- ownCloud web application ence with her end-users. She utilizing her existing AD then points her web-browser to credentials. https://owncloud.a.com and configures the initial ownCloud ownCloud utilizes two forms of web interface with the required user authentication, both exter- information. nal (LDAP, Active Directory and SAML 2.0 via Shibboleth), and All client interfacing (Browser, an internal to ownCloud Enter- Desktop Sync Client, Mobile prise user (stored in database). Apps and WebDAV) to the Both external and internal ownCloud application is accom- authentication can exist simul- plished over HTTPS. No other taneously. For example, a busi-

Company B Company B has extensive exis- Company B administrators will space, one “SQL” virtual-ser- Company B is a 450-person ting Windows Server shares to initially create three virtual- ver, with 2 vCPUs, 4GB RAM Engineering company with integrate into the ownCloud machines in their environment. and 40GB of disk space and approximately 400 users cur- Enterprise environment and is one “LB” (load Balancer) with 1 rently approved to have access not looking to utilize ownCloud One “APP” virtual-server with 2 vCPU, 1GB RAM and 15GB disk to the ownCloud Enterprise Enterprise’s Primary Storage vCPUs (2 vCPUs per host core) space. They will install the environment. Company B is gro- extensively. Throughout the 3GB RAM and 30GB of disk latest stable version of a head- wing rapidly so they want to Windows Server shares across implement without creating any multiple servers, there are Role vCPU RAM PHP PHP- OS / /data bottlenecks with their growth. 110,000 files consuming 1.2TB Cache App Company B has three different of storage. Company B has an LB 1 1 15 locations, utilizing a hub and admini­strator who is familiar App (2) 2 3GB 512MB 512MB 30GB 10GB spoke IT design with good with CentOS and MySQL. To SQL 2 3GB 40GB bandwidth between each. deploy ownCloud Enterprise, 7

addresses assigned to the two Company B has opted to utilize ownCloud Enterprise App vir- existing Windows 2012 server tual-servers utilizing the Least shares due to the extensive Connection format (with Round ACLs in place along with the Robin being an option) and Sti- desire not to have data reside cky Sessions enabled. in two places (data overlap). ownCloud Enterprise administ- Installation of the application rators will configure the Win- server will consist of installing dows Network Drive app of Apache, PHP, APCu for PHP ownCloud Enterprise to point to caching and ownCloud Enter- each specific existing Windows prise. Once this App virtual- share. Company B has decided server is fully configured to share not only the users exis- (ownCloud setting, PHP set- ting home directory, but speci- tings, Apache configuration fic department shares as well. and SSL certificates etc.), tes- ted and proven, it will be Since Company B has also inte- cloned using tools provided grated ownCloud Enterprise within the underlying hypervi- into their existing Microsoft AD, sor, IP address re-configured Company B can also leverage accordingly and powered up ownCloud Enterprise’s ability less CentOS operating system user /data directory for meta- into the cluster. MySQL is ins- to use the users login credenti- on all of their virtual servers. data such as thumbnails, talled and configured accordin- als. Using the login credentials The SAN administrator will versioning, and trash-bin, it gly on the SQL virtual-machine. allows ownCloud to honor exis- create a 10GB NFS partition on is recommended that the ting Windows ACLs. ownCloud the company's SAN, allowing ownCloud quota feature be While the two App virtual-ser- Enterprise end-users will see the Linux administrator to implemented and set at 25MB vers can be installed on sepa- only what their AD login creden- mount the NFS to each per user. With a quota specified, rate physical hosts this does not tials allow. ownCloud Enterprise App ownCloud will ensure that the provide a true HA (High Availa- server utilizing the FStab moun- user directory will comply with bility) solution given that the Once the initial install is com- ting scheme. This NFS mount the induced quota by maintai- SQL and Load Balancer are sin- pleted, tested, verified and the will accommodate ownCloud ning the individual users trash- gular. Tools such as VMware HA company mandated testing is Enterprise’s /data directory. bin and versioning directories and DRS can be called upon to completed, the IT manager will Even though Company B will (oldest out). reduce outage times. If a true, deploy to a small test group use Windows Server shares uti- more hardened, HA solution is compromising of IT staff and lizing ownCloud Enterprise’s Company B has no current load required, please see next sam- other power-users. During this WND app for their data storage, balancer in place so HAProxy ple solution. test period, systems will be the /data directory is still requi- was chosen for speed, perfor- monitored and gauged for red for proper operation. In this mance and budgeting concerns HA, or High Availability solu- effectiveness. Once the IT staff case, 25MB per user (plus over- and will be installed on the tions refer to solutions with is satisfied with the results, head) was used to calculate the appropriate virtual machine. automated fail-over and reco- they will deploy the desktop size of the NFS mount. Once installed, HAProxy will be very, while FT or Fault Tolerant sync clients, mobile apps and While ownCloud will utilize this configured to point to the IP ones ensure zero downtime. train the employees in groups 8

of 100 with a three day lapse in Initial deployment in an the systems and provided new deployment of all 400 users at between the next group of 100. ownCloud Enterprise solution is ownCloud Enterprise users with once. Once the initial deploy- During each segmented deploy- normally when you see the most the best possible experience ment is completed, monitoring ment, IT staff is monitoring the load or stress, due to the num- with the new solution. The other the systems would ensure admi- ownCloud Enterprise systems ber of new users and new sync option that the IT Manager had nistrators the timely removal of and making any minor changes requests. In this case, the IT at his disposal was to increase the additional servers deployed if required. Manager decided to segment the number of App servers or during initial deployment. the deployment to relieve any even add an additional MySQL stresses that might have slowed server to handle the initial

Company C Company C is a growing finan- cial institution with approxi- mately 1100 employees, with 800 employees requiring to have access to the ownCloud Enterprise solution. Due to the nature and timeliness of the financial transactions, they need a Fault Tolerant (FT) solution. Business drivers dictate the need for a 99.999% uptime (“5 nines”) solution for the ownCloud Enterprise envi- ronment. They have a single data center / hub with multiple locations / spokes throughout all four time zones in the conti- nental US. Within this data cen- ter, they utilize two hypervisor vCenters for redundancy and Company C plans to leverage these for ownCloud Enterprise redundancy. Due to the number of possible concurrent users utilizing the ownCloud service, Storage as the default storage. space for each ownCloud user App server and MySQL on the Company C plans to utilize two Company C already has a subs- and the SAN admin creates a SQL virtual-machine. The Linux ownCloud Enterprise web appli- tantial investment in an exis- 4.7TB NFS mount point on their Administrator will also mount cation virtual-servers for each ting highly redundant SAN, so company's SAN. Company C the NFS created by the SAN vCenter (four ownCloud Enter- they will create an NFS mount has standardized on Red Hat as administrator and modify own- prise App servers total due to point for the ownCloud /data their primary Linux operating Cloud Enterprise’s config. redundancy). They have no directory. After speaking to system and due to in-house to point to the new /data direc- current Windows shares that management and considering expertise, selected PostgreSQL tory. Company C has also elec- would be useful for their end- all business drivers, they have as the database software. ted to install Redis on the App users so they elect to use elected to allocate 5GB of disk virtual-machine for file-locking ownCloud Enterprise’s Primary Initially they will create 3 virtual and Redis for both file locking machines; one each for the and Redis with 1GB of RAM for Role vCPU RAM PHP PHP- OS / /data Cache App Load Balancer, APP and MySQL. improved PHP caching perfor- LB (2) 1 1 15 The Linux Administrator will mance. Once Company C has all install HAProxy on the Load three virtual-machines (load App (4) 2 4GB 1GB 1GB 30GB 4.7TB Balancer virtual-machine, balancer, App and SQL) in SQL (2) 2 4GB 60GB ownCloud Enterprise on the place, it will begin its testing. 9

Once satisfied with the perfor- two App , and SQL virtual- While a Master / Master relati- with the Master / Slave relation- mance, it will "clone" the single machines) onto a separate onship of the SQL servers would ship of the SQL servers in the app instance and bring up a vCenter for redundancy. A allow a faster recovery time and event of a fail-over, they weig- second app virtual-machine heartbeat will be setup bet- uptime for the ownCloud solu- hed the pros and cons and felt a and configure both it and ween the two load balancers, tion, Company C felt that the Master / Slave relationship update the Load Balancer with one set to active and the added complexity and limit in IT would best meet their needs accordingly. Again testing takes other to passive. A Master / staffing might make the Master and resources. place. Once fully tested, IT Slave Relationship will be esta- / Master relationship too com- administrators will replicate blished between the two Post- plicated. While a manual inter- the solution (Load Balancer, greSQL virtual-machines. vention will have to take place

Company D Enterprise clusters, one at each tion. At the global load balan- activation at the load balancer Company D is a global retail data center (France and Japan). cer, they will distribute their cli- lever in conjunction with their company with multiple loca- ownCloud Enterprise’s Primary ent requests based on both hypervisor to increase or decre- tions throughout Europe and Storage is determined to be the GeoIP (remote users / home ase the size or number of vir- Asia. They have two diverse best solution for their primary office etc ) as well as office IP tual-machines within each clus- data centers that house their collaboration needs. It is deter- subnet with a failover sequence ter as load demands. entire IT infrastructure, one in mined that end-users will to the sister data center if the France and the other in Japan, require access to their indivi- assigned data center goes While the ownCloud Enterprise with each serving numerous dual existing Windows home dark. Company D determined virtual-machine can receive and offices in their respective directories already in place. that end-user sessions need decrypt HTTPS through either region. While the business Company D has extensively uti- the ultimate uptime and cannot Apache or nginx, Company D spans continents, the data lized GlusterFS in the past and withstand and interruption if felt that the best use of resour- required between numerous selected this as the Primary one of the application servers ces would dictate the load offices is common in nature and Storage for their ownCloud has a failure or disruption. balancer offload SSL encryption required at all locations, requi- Enterprise solution. They will Within each data center, they / decryption. Since the load ring a form of data replication. utilize GlusterFS’s native block- will configure their existing balancer is public facing and in With 21,000 ownCloud users level distributed replication to third party load balancers to the DMZ, but the cluster sits on and growing, spread out across replicate ownCloud Enterprise’s utilize an algorithm based on private LAN outside of the DMZ Europe and Asia, Company D Primary Storage between both the load of the underlying own- and in a physically secure SSAE- wants to implement an data centers. Company D will Cloud Enterprise virtual-machi- 16 data center, HTTP (unencryp- ownCloud Enterprise solution utilize Window Server’s Distri- nes (i.e. virtual-machine with ted) communications to the that is not only geo diverse but buted File System (DFS) to the least load on it will receive cluster is more than secure. This redundant between continents. accommodate replication of the the request). They will also also frees up resources on each They have concluded they will end-user’s /home directories depend on F5’s health monitors individual App server and utili- need at least 12TB of Primary between the two data centers. for the ownCloud Enterprise zes the dedicated processers Storage space to house their App virtual-machines and con- and algorithms within the load estimated 1.2mil flies and for Company D has existing enter- figure such accordingly. After balancer. normal day-to-day operations prise grade F5 load balancers initial testing, Company D with room for growth. already in place at both the determined that the load balan- Since Company D is using a data center level and global cers are better performers at load-based algorithm, they will Company D will create two geo- level and will utilize such for SSL encryption, thus they will put a Redis cluster in place to graphically diverse ownCloud their ownCloud Enterprise solu- terminate the SSL connection deal with session states. They at the load balancer and com- will follow the recommended municate to the ownCloud sizing documentation provided Role vCPU RAM PHP PHP- OS / /data Cache App Enterprise App cluster over by Redis to properly size the App (8) 2 4GB 1GB 1GB 30GB 12TB HTTP (port 80). Outbound traf- cluster. fic from the cluster will be enc- Proxy (4) 1 1GB 15GB rypted at the load balancer. SQL (4) 4 8GB 70GB They will also introduce priority 10

While Company D could have will become saturated and denGate, etc) this paper will not Redis, F5 health monitors and forgone the Redis cluster, much under-perform due to the per- cover these in detail due to the the ownCloud Enterprise appli- discussion was had internally sistent algorithm not allowing complexities involved, and cation on their standardized regarding redundancy and end- the session moving to a less uti- would defer to the respective RHEL headless operating sys- user experience. A normal load lized App server. Given these documentation for each parti- tem. They will also configure balanced cluster implementa- two scenarios, they felt it would cular vendor. the 12TB NFS mount to each tion with sticky / persistent ses- worthwhile to provide a better App server through the use of sions raised two concerns. overall user experience by utili- Company D will deploy their the FStab. Additionally they Firstly, if the App virtual- zing the least load algorithm ownCloud Enterprise environ- will configure the Redis confi- machine had a failure, either along with the Redis cluster. ment as previously discussed. guration parameters within hardware, software or required They inform both the Load ownCloud Enterprise to point scheduled maintenance, a sti- Company D has significant in- Balancer team and SQL DBA to the Redis cluster. cky / persistent session based house MySQL Cluster experi- team of their requirements and solution (without global session ence and expertise. They deci- configuration needs. They will Company D has a mandated management) would require the ded to create a dual Master / pay special attention to their corporate policy that all sys- user to be dispatched to a diffe- Slave cluster with a SQL proxy install and configuration of the tems sitting in the DMZ receive rent server, thus losing the redundant cluster, distributing ownCloud Enterprise App vir- a thorough penetration test saved session data and requi- read / write requests between tual-machine as it will be a (pen-test) both from the inter- ring the end-user to login individual MySQL nodes. While baseline for future machines in nal security team and by a third again. Also with sticky / persis- there are many ways to imple- the cluster. Company D has party external vendor. As tent session based solutions, ment a replicated / redundant chosen to utilize Apache as expected, they will work there is a possibility that certain SQL solution (i.e. MySql Clus- their web-server. They will ins- through the normal PHP, Nginx servers with in the App cluster ter, MariaDB Galera, Oracle Gol- tall and configure Apache, PHP, and OS related network issues 11

that the pen-test alerts them resolved any outstanding global stress test, Company D and phone / tablet apps, utili- to, and will work with the issues with the security team will implement a thorough and zing their Windows based ownCloud Enterprise deploy- and the pen-test, Company D relentless fail-over test deployment packages and ment personnel to work will stress test the initial App sequence (i.e. pull the plug) mobile management applica- through / understand any virtual-machine using a third to test all systems and redun- tions respectively. They will issues related to ownCloud party application (i.e. Apache dancies put in place. conduct feedback analysis of Enterprise reported by both JMeter, WebLOAD, LoadRunner, the initial deployment; will pen-tests. Normally pen-tests etc.) to ensure that the virtual- Company D will also utilize monitor systems in place for directed towards ownCloud machine is performing as ownCloud Enterprise’s Logging performance concerns. Once Enterprise virtual-servers expected. Any inconsistencies app, to give insight on each satisfied with the initial deploy- reveal issues with the underly- or under-performing returns user and file and the associa- ment and any necessary recon- ing server, including the OS, will be dealt with accordingly. ted movements of each, not figurations, they will stage 7 web server and PHP. Once completed, they will use only for internal use but for separate deployments of 3000 the underlying hypervisor government mandated compli- users each, thus reducing ini- While these are common issues to template and clone the ance. They have standardized tial load on the infrastructure. with simple remedies (i.e. out- ownCloud Enterprise App vir- on Splunk for their log file They have devised a short dated PHP and / or related tual-machine according to their management and will configure internal 30 minute web-based dependencies, outdated ciphers design plan. They will once Splunk to monitor and converge training session to introduce in the SSL portion of the web- again add the virtual-machines their ownCloud Enterprise log and train each of the 3000 server, etc.) some might arise to the ownCloud cluster at each files. users at the beginning of each from the actual ownCloud Enter- data-center and configure the deployment stage. Company D prise App itself. In this case the appropriate items for both the Once Company D is fully confi- will actively monitor the entire ownCloud deployment team is load balancers, SQL resource dent in both the user load solution during each stage of there to assist customers with pool and Redis cluster. Once stress testing and fail-over tes- deployment and make any resolutions or explanations of the final solution is in place, ting, they will implement their necessary adjustments. Once any false positives. they will stress test both data deployment plan. Initially they the last deployment is made, centers separately and accor- will select an initial deployment they will call their solution a After they have fully configured ding to proposed designed of 100 power-users and deploy success and end-users will be and tested the initial ownCloud load. After any changes or their ownCloud Enterprise own- readily collaborating in an intu- Enterprise virtual-machine, and remedies required by the Branded desktop application itive and secure environment.

Big Corporate Conglomerate Enterprise for their needs. With Federated Cloud, users at diverse users the flexibility and (BCC) Within BCC, the need to colla- one division of BCC can colla- transparency to securely and BCC is a large 15,000 employee borate between divisions is borate with users at another easily share files between divi- company with many diverse minimal. Of particular interest division while each divisional sions without IT administrator business units (i.e. Retail, was the capability of BCC not ownCloud Enterprise server involvement. BCC users are no government contracting, ban- only to create individual / sepa- maintains its respective secu- longer confined to a single king, etc.). From a business rate ownCloud Enterprise solu- rity and governance protocols shared folder or servers within standpoint, these divisions tions for each division, but also and does not require BCC to their respective divisions. operate independently with to utilize ownCloud Enterprise’s replicate uneeded data across Federated sharing with minimal need to communicate Federated Cloud sharing to diverse business entities. ownCloud Enterprise also gives with other divisions, and some accommodate the lesser need ownCloud Federation gives BCC the ability for administra- modest requirement to commu- of collaborating amongst divisi- nicate with their corporate ons. Headquarters also has a headquarters. After careful vital need to securely receive review off the business needs finincial reports, marketing within BCC and developing a documents as well as other solution for an Enterprise File files securely and seemlesely Sync and Share, they have from each division. settled on utilizing ownCloud 12

tors to mount comonly used tall and configure mod_shib each diverse division unit as a data through the use of the along with Apache on their Cen- separate solution as far as the External Storage App. This, tOS 7.1 enviroment. BCC will ownCloud Enterprise solution combined with the ability for configure both the /etc/apa- is concerned. Given the diffe- end-users to individually share che2/conf.d/shib.conf and rent technologies in place for files and folders with other divi- the /var/www/html/ownc- each division, BCC IT Managers sion users, will provide BCC the loud/config/config.php on will customize each solution to collorabation it needs across each ownCloud App virtual connect to the resources within different division silos. BCC has machine. Once configured, BCC each division, but attempt to a corporate security policy that will test each server to ensure keep common practices within requries the use of two part proper configuration and each enviroment (i.e Linux OS, authentication for all users. performance. WWW Server, Load balancer, BCC selected ownCloud Enter- SQL server, etc.) as required. prise to accomplish these. BCC To deploy the Federated BCC can use the samples provi- will install the ownCloud Enter- ownCloud Enterprise solution ded here as a baseline for each prise Shibboleth app and ins- company wide, BCC will treat divisional deployment. Conclusion ownCloud is the leading open access to all your data, where- sourced Universal File Access ver it resides – in applications, solution with more than 8M object stores, on premise sto- users and supported not only rage or in the cloud. ownCloud by ownCloud.com, but also by is designed to scale to meet one of the top open source any company’s goals and requi- communities with over 1000 rements both today and into contributors. ownCloud is the future. For more informa- open by nature and designed to tion on how ownCloud can help integrate with a company’s your company provide Univer- existing infrastructure, sal File Access to any device, management and security anytime, anywhere, while lea- tools. A comprehensive set of ving IT in complete control, visit APIs and native integrations ownCloud.com. enable anytime, anywhere

Copyright 2016 ownCloud All Rights Reserved. ownCloud and the ownCloud Logo are registered trade- marks of ownCloud, Inc.in the Uni- ted States and/or other countries.

ownCloud, Inc. 57 Bedford Street Suite 102 Lexington, MA 02420 United States

www.owncloud.com/contact phone: +1 (877) 394-2030

ownCloud GmbH Schloßäckerstr. 26a 90443 Nürnberg Germany

www.owncloud.com/de/ kontakt phone: +49 911 14888690

www.owncloud.com

@ownCloud facebook.com/owncloud gplus.is/owncloud

linkedin.com/company/owncloud Whitepaper Architectural Guide ENG 160503