Session candidates for the SOA track.
## Plenary session
See T85154.
## Service design goals, issues and infrastructure
Panel discussion
- Available and planned SOA infrastructure
- RESTBase: storage, REST API and service orchestration
- Auth service
- PHP API
- Demand management, "back pressure", circuit breakers
- Authentication
- public vs. private APIs
- Operational / practical: monitoring, deployment
- Caching & invalidation strategies
- Desired attendees: Gabriel Wicke, Services team, Faidon Liambotis, Sean, Chris Steipp
## Looking ahead: Virtualization, CI and continuous deployment
Panel discussion. See T86372.
## SOA proliferation through specification
See T86375.
## Security in a distributed service environment
Talk / tutorial by @csteipp. Tracked in more detail in T86049.
- advantages of isolation between services vs. challenges of multitude of entry points
- what we learned from experience in our current architecture
- what others learned from experience in a SOA setting
- how to address challenges: [SOA auth RFC](https://www.mediawiki.org/wiki/Requests_for_comment/Service-oriented_architecture_authentication)
- CSP and other headers
- appropriate use of CORS
- when to use OAuth
## Other ideas
### Content representation / UI / skins
Covered in T86564.
### The road to multi-DC operation
Covered by main panel, as it affects a lot of decisions
- issues: replication consistency, caches
- possible solutions
- how this affects our software architecture
### Scaling down for third-party users
Covered by main panel, as it affects a lot of decisions
- define minimum resources for a basic MediaWiki install (strawman ex: [$2.99 / month VM with 1G of RAM](http://www.ovh.com/us/vps/vps-classic.xml)?)
- simple & small implementations of common services for testing and small installs
- setup automation / packaging for VMs
### Platform choices for new services
Not convinced that this would really be productive
- SOA gives us freedom to choose (and change) technology per service / task
- don't want to go overboard though, as each additional technology has a cost
- current main development platforms: PHP, client-side JS & Node.js, some Java
- trends: industry and WMF
- new candidates: Hack, Go, Rust
- relative strengths for our use cases
- successful outcome:
- shared understanding of relative strengths and trends
- possibly guidance on what to choose in which area
- awareness of new options