Skip to main content

ISC Learn → managed hosting

Date: August 2026 · Status: proposal — nothing executed. The one decision already executed, the hub at the root of isc.hevs.ch, adds a requirement to the target. Scope: move the Moodle instance (the filière's most critical service) off the self-managed hannibal VPS onto Infomaniak Serveur Cloud managé, so that OS, PHP, MySQL, TLS and base backups become the provider's job.

1. Why​

Hannibal is an unmanaged Infomaniak VPS: every patch (OS, PHP, MySQL, certbot), the host firewall, fail2ban and the backup chain are ours — and the August 2026 audit found most of that chain under-maintained, with a bus factor of zero on the backup script (much of it fixed since — hannibal — but still ours to keep fixed). On a managed server the environment is patched and backed up by Infomaniak; what remains ours is Moodle itself (upgrades via the web/CLI installer) and the content.

Keeping learn off the rack is deliberate: it must survive a room-23N307 loss. The target-architecture idea of a srv-moodle VM on rumba is superseded by this proposal.

2. Current state​

The facts of the production instance — Moodle version, stack, sizes, authentication, names, execution servers — are kept once, on the ISC Learn page, the server on hannibal. Two of them shape this plan:

  • The VPL jail and the CodeRunner Jobe server already run off-box, on Infomaniak Jelastic. So the managed server never needs to run a daemon, and the migration must verify the Jelastic product's future with Infomaniak — both code-execution backends live there.
  • isc.hevs.ch (vsnet zone) and learn.isc-vs.ch are both CNAMEs to hannibal.isc-vs.ch: the flip at cutover is one CNAME, once SInf has retargeted isc.hevs.ch to learn.isc-vs.ch (phase 0).

3. Target​

One Serveur Cloud managé, sized ~8 CPU / 24 GB / 500 GB (exact tier from the pricing page; the 100 GB base config does not fit). Moodle installed under /learn so $CFG->wwwroot — which lives in the DB — never changes. The same server can absorb the WordPress co-tenants (ingegamez, in-egalite.ch); the Docker co-tenants cannot (no root) and go to the rack.

The root of isc.hevs.ch is the hub​

Decided 2026-08-11, executed 2026-08-21 as a 301 to hub.isc-vs.ch, revised 2026-08-22 so that hannibal serves the isc-hub build at the root and the address bar keeps the institutional name (how it is wired, execution log). isc.hevs.ch/learn did not change, so every bookmark works and Moodle's $CFG->wwwroot is untouched.

Two consequences for the migration:

  • The managed server has to serve the hub as well as /learn: the deployed-branch pull (provisioning/web/hannibal-hub/install.sh) has to work there, and the vhost needs an SPA fallback, since the hub routes on real paths. Falling back to a redirect to hub.isc-vs.ch is no longer equivalent — GitHub Pages answers deep paths with a 404 status, and the fleet links point at isc.hevs.ch.
  • Serving rather than redirecting cost the host-independence the decision was made for: the hub is only as available as its host, and a move is a link sweep again rather than one CNAME. hub.isc-vs.ch stays live on GitHub Pages from the same build, which is what makes that sweep optional rather than urgent.

4. The two blockers, and how they resolve​

  1. Shibboleth. mod_shib cannot be installed on managed hosting. Login must move to OIDC before the migration, on today's prod, where it is reversible. Two routes:
    • direct OIDC registration at SWITCH edu-ID — no new infrastructure, and learn's login stays independent of the rack (consistent with the survive-room-loss goal); or
    • via the sso.isc-vs.ch Keycloak broker (the fleet-wide plan) — one registration for everything, but couples learn's login to the rack's availability. Recommendation: direct registration for this one service; the broker remains the plan for rack services.
  2. 303 GB moodledata vs. hosting quota — resolved 2026-09-05: the course-backup retention was fixed and the excess purged (history), so the payload is ~130 GB logical, comfortable in 500 GB with years of growth. Note that a managed host without btrfs block sharing pays for the two copies of each backup.

5. Phases​

Each phase is independently useful and reversible; only phase 5 touches availability.

  1. Decisions & prerequisites
    • Confirm the Jelastic product's future with Infomaniak — blocker if the answer is "sunset" (fallback: rebuild the VPL jail and Jobe on Public Cloud instances; they cannot run on the managed server).
    • Ask SInf to retarget the isc.hevs.ch CNAME from hannibal.isc-vs.ch to learn.isc-vs.ch — a no-op today (same A record), and it puts every future flip in our own zone. Lower the learn.isc-vs.ch TTL.
    • Decide co-tenant destinations: Snipe-IT → ISC³ VM (already on the todo), marks_crawler → rack CT, files.isc-vs.ch → srv-web01 static (carries hesso.xml — Gradescope SSO breaks if forgotten), WordPress sites → the managed server.
    • Pick the window from the academic calendar (nothing is documented; inter-semester is the obvious candidate).
  2. Auth switch on current prod: enable OIDC (edu-ID), run it alongside Shibboleth, then disable mod_shib. Rollback = re-enable the plugin.
  3. Trim moodledata: done 2026-09-05 (retention + purge); empty trashdir before the rsync.
  4. Provision & restore: order the managed server, then replay the tested restore runbook against it — rsync ~170 GB (hannibal→Infomaniak stays inside their network; the DR exercise sustained 20–25 MB/s through a laptop, so expect ≤ 2 h), import the dump (~15 min), adjust config.php (managed DB host/port, dataroot path). Set max_input_vars = 5000 in the hosting's PHP settings. MUC/Redis: use the hosting's cache service if offered, else default file cache.
  5. Rehearse: hosts-file override of isc.hevs.ch → new server; smoke-test login (OIDC), VPL + CodeRunner round-trip, byte-exact pluginfile.php download as in the DR exercise; confirm outbound mail (mailer@isc-vs.ch — settings live in mdl_config, not config.php).
  6. Cutover (≤ 1 h downtime): Moodle maintenance mode on hannibal → final delta rsync + fresh dump/import → repoint learn.isc-vs.ch to the managed server → Infomaniak issues the isc.hevs.ch certificate once traffic arrives (verify immediately; the window is TTL-sized) → maintenance off, smoke tests. Rollback: repoint the CNAME back — hannibal is left untouched and running.
  7. After: keep hannibal until every co-tenant has landed, then decommission (ends the shared-certificate-lineage maintenance); re-target the DS923 backup pull at the managed host (SSH per-hosting exists) on top of Infomaniak's built-in daily backups; update the DR-mirror runbook paths; close the monitoring question with the hosting's built-in tools + srv-status.

6. Open questions​

Tracked on the ops todo — Jelastic pérennité, tier/cost quote (the current VPS cost is undocumented, so the comparison baseline is missing), OIDC route confirmation with SWITCH, cutover window.