Microsoft IIS App Server (v14 Infinity) - Runbook

Update Application Code

Application code is typically downloaded at boot time when an application server is launched. However, you can manually update the application code on a running server by executing an operational script. For example, you may want to retrieve the latest version of your application from a different branch in your software repository.

• To update the application code on a server run the IIS Download application code operational script.

Create a SQL Server User

Use the DB SQLS Create login operational script on your Microsoft SQL database server to create a new SQL Server user (login) and password for your application's use. Enter the following RightScript inputs before running this script.

Note: It's recommended that you set up credentials for password values and any other sensitive data as shown in the examples below.

Add a Connection String

Add a connection string to the database's web.config file that the IIS application server will use to securely connect to the database. Typically, the connection string is created at boot time, but you can also create a new connnection string, if desired.

Run the IIS Add connection string operational script on the IIS application server and specify values for the following inputs.

Switch the Default Website Location

By default, the IIS Download application code boot script places the application code into the following directory by default: C:\inetpub\wwwroot\release\<GMT-timestamp>

If the application code is located in a different directory, run the IIS Switch Website operational script and specify the correct path using the OPT_DEFAULT_SITE_ROOT_PATH input so that IIS knows the new location of the application code.

Restart Application

Run the IIS Restart application operational script on an application server to restart the IIS application by touching the web.config file.

Restart Webserver

Run the IIS Restart web server operational script on an application server to restart the IIS web server.

Support for Amazon Elastic Load Balancers (ELB)

To run your IIS server in conjunction with an Amazon Elastic Load Balancer (ELB), you must follow the steps below:

1. Set up your Elastic Load Balancer. See Create a New AWS Elastic Load Balancer.
2. If needed, Clone the IIS Application ServerTemplate so that you can modify its list of scripts. By default, the application ServerTemplate is designed to work with an HAProxy load balancer. In order for the application server to automatically connect and disconnect with an ELB at boot and decommission time, you must make a few modifications to the template, which requires a cloned, editable HEAD copy of the template.
3. Navigate to the your cloned template > Scripts tab and replace the LB Register with HAProxy script in the Boot Script list with the AWS Register with ELB script.
4. On the same Scripts tab, replace the LB Deregister from HAProxy script in the Decommission Script list with the AWS Deregister from ELB script.
5. Proceed to add a server from your cloned template, then set the 'ELB_NAME' input on the deployment or server's Inputs tab to the named value of your ELB server.
    

Note: If your ELB will use the HTTPS protocol, refer to the next section for information on generating the required server certificate and private key files in PEM format.

Support for Rackspace Cloud Load Balancers (CLB)

1. If needed, Clone the IIS Application ServerTemplate so that you can modify its list of scripts. By default, the application ServerTemplate is designed to work with an HAProxy load balancer. In order for the application server to automatically connect and disconnect with a CLB at boot and decommission time, you must make a few modifications to the template, which requires a cloned, editable HEAD copy of the template.
2. Navigate to the your cloned template > Scripts tab and replace the LB Register with HAProxy script in the Boot Script list with the LB Register with CLB script.
3. On the same Scripts tab, replace the LB Deregister from HAProxy script in the Decommission Script list with the LB Deregister from CLB script.
4. Set up your Cloud Load Balancer in the Rackspace Cloud Management Console. See Create a new Rackspace Cloud Load Balancer (CLB).
5. Create a server or server array using the modified ServerTemplate and ensure that the RACKSPACE_CLB_NAME and RACKSPACE_CLB_REGION inputs are defined on the deployment or server level with the appropriate values for your CLB, then launch the server.

Generate a Server Certificate for SSL/TLS

To use the HTTPS (HTTP with SSL/TLS) protocol, the ELB and HAProxy load balancers require a server certificate and private key in X.509/PEM format.

IIS server certificates are typically exported in .pfx (PKCS#12) format. However, you can generate a PEM-formatted certificate and private key files for the load balancers using the SYS Convert PFX operational script, in conjunction with a .pfx (PKCS#12 format) server certificate file and the following inputs:

• CERT_FILE_PATH - The full path to the .pfx certificate file stored on local file system of the instance.
• CERT_PASSWORD - If the .pfx file is password protected, specify the password.
  Note: It's recommended that you create a credential to hide the sensitive value for this input for security reasons.

The SYS Convert PFX script saves your PEM-formatted certificate and key files in the same directory as the original .pfx file with a .crt and .pem extension on the IIS server.

Manually Archive IIS Logs

In Amazon and Rackspace environments, the SYS Configure IIS logs rotation policy boot script sets up a Windows scheduled task on your IIS server, which runs daily and archives any log entries older than one day to an ROS container based on the REMOTE_STORAGE_* inputs.

The SYS Upload IIS Logs operational script allows you to manually run an IIS log archive on demand. The same inputs (REMOTE_STORAGE_*) used by the 'SYS Configure IIS Logs Rotation Policy' script will also be used by the 'SYS Upload IIS Logs' manual script.

1. Verify that the required REMOTE_STORAGE_* inputs are set under the "Remote Storage" section.
2. Run the SYS upload IIS logs operational script.

Install RightScale Powershell Library

Installs the RightScale Powershell Library, which is a prerequisite before you can run the 'SYS Setup firewall rule' and 'SYS Dump firewall rules' operational scripts.

Join or Leave Active Directory Domain Controller

To connect a remote server to a domain controller that was launched in a cloud using the Microsoft Active Directory ServerTemplate, you must first configure the domain controller to accept ingress communication from the remote server. See the Create a Windows firewall permission steps.

By default, remote servers will connect to the domain controller using tags. However, you may need to connect servers where tags are not available or supported. For example, perhaps the remote server is located in a different cloud/region where it does not have access to the domain controller on the private network or the tag scope of the deployment that contains the domain controller is not set to be account-wide and the remote server is located in a different deployment than the domain controller. In such cases, you can either connect to the primary AD server using an IP address or FQDN.

1. Make sure the domain controller is configured to accept requests from the remote server. You may need to update the domain controller's firewall permissions accordingly.
2. If you used a ServerTemplate to launch the remote server, run the following RightScripts as 'Any Scripts' on the running server. If you anticipate performing this action more than once, you may want to edit the ServerTemplate and add these RightScripts to the Operational Scripts list.
   • Execute the SYS Install RightScale Powershell library (v14.x) operational RightScript to satisfy the prerequisites for the subsequent join/leave scripts. Wait for the script to be completed.
   • Run the SYS Join AD domain (v14.x) operational RightScript. Once the script is completed, check the server's tags to verify that it properly joined the correct AD domain.

Enable or Disable Windows Firewall

Run the 'SYS Enable Windows Firewall' and 'SYS Disable Windows Firewall' operational scripts to enable or disable Windows firewall settings. Add the script to the "Boot Scripts" list to enable Windows Firewall by default at boot time when a new instance is launched.

Add or Remove Firewall Rule

Run the 'SYS Setup firewall rule' script to creates or remove firewall rule based on the following inputs.

List all Firewall Rules

Run the 'SYS Dump firewall rules' script to display a list of all firewall rules or only rules created by RightScripts (those which have 'RightScale' prefix in the name). This behavior is controlled by FIREWALL_RULE_DISPLAY_ALL input. If displaying only RightScale rules is selected the script also collects list of all IP addresses that are granted network access to the current instance to simplify a network security audit.

Configure the Windows Updates Policy

By default, no Windows updates are applied to a running server. However, you can set the following input and run the 'SYS Set Windows Automatic Updates Policy' operational script to define how Windows automatic updates should be applied to an operational Windows server.

Configure the Windows Reboot Policy

Some Windows updates require a server to be rebooted in order to complete the installation process. However, you might want to reboot the instance at a more convenient time in order to reduce the amount of site downtime or negative impact to your end users. In such cases, you can set the following input before running either the 'SYS Install All Windows Updates' or 'SYS Install Microsoft update by KB number' operational script to specify whether or not an instance is allowed to reboot after the script is run. Reboot is not allowed by default.

Install Windows Updates

Run the 'SYS Install All Windows Updates' operational script to download and install all new Windows updates. Any updates that require a user to accept a EULA are NOT installed. Use the WINDOWS_UPDATES_REBOOT_SETTING input to control whether or not the instance is rebooted after the updates are installed, if required.

Install Microsoft Knowledge Base (KB) Article Updates

Set the following input and run the 'SYS Install Microsoft update by KB number' operational script to install a specific KB update.

To apply the KB updates to the running server at boot time, add the script to the end of the "Boot Scripts" list.

Register with a Windows KMS Server

Set the following inputs and run the 'SYS Activate Windows with KMS server' operational script to activate the instance's license with a Microsoft Key Management Server (KMS). Before you run the script, make sure that the KMS server's firewall settings are configured to accept a request from the instance. 

Other Administrative Tasks

• Run the SYS Install Web Deploy 2.0 script to install the Microsoft Web Deployment Tool Version 2.0 (http://www.microsoft.com/download/en/details.aspx?id=25230).

• Run the SYS Install .NET Framework 4 script to install the Microsoft .NET Framework 4 (http://www.microsoft.com/download/en/details.aspx?id=17718).

• Run the SYS install ASP.NET MVC 3 script to install the Microsoft ASP.NET MVC 3 Tools Update (http://www.microsoft.com/download/en/details.aspx?id=1491).

​          Note: Be sure to install Microsoft .NET Framework 4 first since it is a prerequisite.