# Design Guiding Principles

This page describes the design decisions made for RHEL-8 and the reasoning.

## General

 * *To prefer software and solutions with support available externally*</br>
   This is to reduce the risk of isolated knowledge leaving PSI as well as to reduce the support load of present PSI Linux Engineers.
 * *To prefer to enable self-service for Linux as wide as possible at PSI*</br>
   This is to enable users and to give space for Proof of Concepts and trial and error.

## Red Hat Satellite
*to supersede bob/sysdb*

Red Hat Satellite is an all-in-one product to
 * Deploy and install Linux systems
 * Manage Linux software repositories centrally
 * Visualization of software status on hosts
 * Can install machines in DMZ environments via *Capsules*
 * Has role based access control (RBAC) to support PSI division segregation

## Ansible Configuration Management
*to supersede Puppet*

Ansible
 * Has a lower learning curve than Puppet
 * Results can be achieved faster than in Puppet
 * Ansible is in strategic focus of Red Hat
 * [Puppet is/will go out-of-support from Red Hat](https://access.redhat.com/articles/5065671)
 * [Ansible Galaxy](https://galaxy.ansible.com) provides many externally maintained collections and roles

## Ansible Tower
*to supersede Puppet*

Ansible Tower / AWX
 * Is a central automation solution and can run Ansible playbooks centrally
 * Be used as Ansible Configuration Management for RHEL-8+ systems
 * Allows flexible control
 * Can be used as general purpose automation platform
 * Has role based access control (RBAC) to support PSI division and network segregation

## User Management
 *SSSD and Microsoft Active Directory to supersede legacy pam customizations*

  * To prefer to attach all RHEL-8+ systems to the central PSI Microsoft Active Directory (AD) via SSSD
  * To prefer centrally managing users and groups for Linux in AD
  * To prefer to manage system access for Linux in AD
  * To prefer to integrate Linux user, group and access management into ServiceNow as a self-service

## Network Filesystems
*to focus on local disks and optionally provide Network Fileystem support*

 * By default to place home directories on local disks</br>
   This is to avoid users being affected to network issues on logins. Such as missing authentication tokens or shared and locked files in firefox profiles.</br>
   The homes on network shares still being accessable if requested.
