Gearman Job Server - Secure Distributed Queue

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Gearman Job Server - Secure Distributed Job Queue by cloudimg

Gearman is a mature, language-agnostic job server that lets your application hand a

unit of work to the server, distribute it to whichever worker process is free, and

return the result to the caller. Workers can be written in a different language from

the client, can live on a different machine, and can be added or removed while the

system is running. It is the proven answer to "this request is too slow to do inline"

and to "spread this work across a pool of machines".

## The Problem This Image Solves

Upstream Gearman has no authentication and no access control of any kind. Every client

that can open a TCP connection to port 4730 can submit jobs, read the queue, and

register itself as a worker for any function - including functions your own application

defines. An internet-reachable Gearman job server is an open remote-execution surface,

and stock packages happily bind it to every interface.

## Closed by Default - Security Without Manual Hardening

This image inverts that dangerous default:

• The job server is bound to the loopback address only. Nothing outside the instance

can reach port 4730 until you deliberately change it.

• The recommended security group opens SSH and the status console only. Port 4730 is

never opened to the internet by this product.

• Exposing the job server to your own private subnet is a documented, explicit,

two-step change described in the deployment guide, with the matching security group

advice, so widening access is always a decision rather than an accident.

• The image is verified at build time to prove that nothing unexpected is listening on

a non-loopback address.

## Durable Queue on Dedicated Amazon EBS Storage

Background jobs are written to an on-instance persistent queue so work accepted before

a restart is replayed after it rather than lost. The queue lives on its own dedicated

Amazon EBS volume mounted at the job server data directory - independently resizable,

snapshotable, and separate from the operating system disk. This is the layout you would

build by hand for a production deployment, ready from first boot.

## Encrypted Status Console With Per-Instance Credentials

A read-only status console is served over HTTPS. It shows live queue depth, registered

functions, connected worker count, and running version - the numbers you need for

capacity planning and alerting without exposing the job protocol itself. The console is

protected by HTTP basic authentication whose password is generated uniquely for your

instance on first boot, hashed with bcrypt, and never shared between instances. A

separate unauthenticated health endpoint is provided for load balancer and monitoring

probes so you never have to weaken the console to get a health check.

## Ready To Use

• The job server, the command line client and administration tools, and the status

console are installed, wired together and managed by systemd

• First boot generates the console password, issues a per-instance TLS certificate,

and writes both to a root-only credentials file

• Client libraries exist for PHP, Perl, Python, Ruby, Java, Go, C and Node.js, so

existing workers connect without code changes

• The paired deployment guide covers submitting a first job, writing a worker, reading

the queue, exposing the job server to your own subnet, and monitoring

## Use Cases

• Offloading slow work from web requests - image and video processing, document

rendering, report generation and mail delivery handled by a worker pool instead of

blocking the request

• Spreading work across a machine pool - one job server distributing tasks to

workers on many hosts, with workers added and removed at runtime

• Bridging languages - a client in one language handing work to workers written in

another, over a stable wire protocol

• Modernising long-lived estates - the job server that established PHP and Perl

applications already speak, running on current, patched infrastructure

## Deployment Notes

• Deploy on any standard EC2 instance type; m5.large is a comfortable default
• Keep the instance inside your own Amazon VPC, and restrict the security group to

trusted networks

• Scale by running more worker processes, on this instance or on others in the same

private subnet, against the one job server

## cloudimg Support - 24/7

24-by-7 technical support by email and live chat covering deployment, exposing the job

server to your own subnet, worker connectivity, queue persistence, status console

access, monitoring and sizing guidance.

Gearman is distributed under the BSD 3-Clause License. All product and company names

are trademarks or registered trademarks of their respective holders. Use of them does

not imply any affiliation with or endorsement by them.