When is it appropriate for a server to handle multiple functions and when should servers be dedicated to a single task?

Question

I have one fairly powerful server running VMware ESXi to allow for multiple virtual machines to handle different purposes. Currently I have 7 set up:

• PHP Development
• PHP Staging
• RoR Development
• RoR Staging
• ASP.Net Development
• ASP.Net Staging
• Core (Samba, OpenLDAP, DNS DHCP, git)

My questions are:

1. Which functions should be run on their own server and why? For example, should I split up the Core server and add another virtual machine to run DNS only or DHCP and DNS, another vm to run git only?

2. What are some common setups within a network and what major functions am I missing to run a proper development network... i.e. intrusion detection? I know this question is subjective to the work being done, but just any obvious ones that may be helpful to operation, maintenance, or security.

Note: If anyone can edit the tags to be more appropriate to the question that would be appreciated.

Answer 1

These days, with VMs being so cheap and easy, I tend to virtualise on a per-function basis. That makes for maximum flexibility (migration, upgrade, etc etc) and minimises the need for later rework ("oops, those functions aren't as combined as I thought they were").

Answer 2

While I agree with Womble in general, the definition of "per-function" might be blurry. Unless you have a huge environment (from your description, you don't), I would absolutely keep DNS and DHCP on a single server. Unless you have strong reasons not to (like performance needs, or incompatible maintenance windows, etc), I would also keep Samba and LDAP on the same server.

For question 2 : you have no redundancy in your description. All of you core services should have some redundancy or failover. DNS is a biggie, LDAP is a biggie if it's part of your authentication, Samba is also a likely candidate. DHCP is good and easy to make highly available with split scopes. A lot (or all) of these core services should be on separate hardware; otherwise, you have an enormous single point of failure.

You also have no backup infrastructure listed : every IT shop that does anything should have backups. There are very few scenarios where you don't need any backups.

As far as other common major functions : it really depends on your environment and needs, which you haven't told us. Do you have to manage desktops? Are they Windows, or Linux, or Mac? Then you might want something that can manage those machines. Samba can do for Windows a lot of what Windows Server with AD and GPOs do, but not as easily (as I understand it.) Do you build a lot of machines? Then you might want a PXE/Kickstart/other sort of build infrastructure. Do you need to keep a log of what your users browse on the web? Might want a Squid proxy or something similar. IDS/IPS : maybe you need that, maybe you don't. How would we know?