Cluster Evolution moved to another chapter, cleaned up binary apps files, minor fixesmaster
Linreigns
7 years ago
parent
d0d6d3d1b0
commit
d0caae87f6
@ -0,0 +1,62 @@
|
||||
%
|
||||
% History.tex
|
||||
%
|
||||
% Fork Sand IT Manual
|
||||
%
|
||||
% Copyright (C) 2018, Fork Sand, Inc.
|
||||
% Copyright (C) 2017, Jeff Moe
|
||||
% Copyright (C) 2017 Aleph Objects, Inc.
|
||||
%
|
||||
% This document is licensed under the Creative Commons Attribution 4.0
|
||||
% International Public License (CC BY-SA 4.0) by Fork Sand, Inc.
|
||||
%
|
||||
\section{History}
|
||||
|
||||
\subsection{Cluster Evolution}
|
||||
Forksand started deployment on dedicated servers.
|
||||
\vspace{0.6cm}
|
||||
First stage. Exclusively dedicated servers (deprecated)
|
||||
\vspace{0.4cm}
|
||||
\centering
|
||||
\includegraphics[width=115mm,trim=20mm 20mm 20mm 20mm]
|
||||
{sharkfork-cabling-1-dedicated-vlan.pdf} \\ %
|
||||
%
|
||||
\vspace{0.2cm}
|
||||
\raggedright
|
||||
Second stage. Dedicated servers along with a colocation
|
||||
cabinet. Flat hierarchy. (deprecated)
|
||||
|
||||
\vspace{0.1cm}
|
||||
In progress, services were being migrated one after another to
|
||||
a colocation instance. On the next stage hierarchy becomes vertical. \\
|
||||
\vspace{0.1cm}
|
||||
\centering
|
||||
\includegraphics[width=115mm,trim=20mm 20mm 20mm 20mm]
|
||||
{sharkfork-cabling-2-mixed-vlan.pdf} \\ %
|
||||
%
|
||||
\raggedright
|
||||
Third stage. Dedicated servers buffered by
|
||||
a colocation cabinet. Vertical hierarchy. (deprecated)
|
||||
\vspace{0.4cm}
|
||||
\centering
|
||||
\includegraphics[width=115mm,trim=20mm 20mm 20mm 20mm]
|
||||
{sharkfork-cabling-3-colo-dedicated.pdf} \\ %
|
||||
%
|
||||
\vspace{0.2cm}
|
||||
\raggedright
|
||||
Fourth stage. Dedicated servers discarded.
|
||||
Colocation cabinet buffered only with a firewall. (current)
|
||||
\vspace{0.4cm}
|
||||
\centering
|
||||
\includegraphics[width=115mm,trim=20mm 20mm 20mm 20mm]
|
||||
{sharkfork-cabling-4-final-colocation.pdf} \\ %
|
||||
%
|
||||
\vspace{0.2cm}
|
||||
\raggedright
|
||||
Final stage. Firewall discarded. Single colocation cabinet. (in process)
|
||||
\vspace{0.4cm}
|
||||
\centering
|
||||
%\includegraphics[width=115mm,trim=10mm 10mm 10mm 10mm]
|
||||
%{sharkfork-cabling-4-single-colocation.pdf} \\ %
|
||||
%
|
||||
\raggedright
|
||||
Binary file not shown.
Binary file not shown.
@ -1,2 +1,2 @@
|
||||
There are 86 source code files included.
|
||||
There are 83 unique files.
|
||||
There are 78 source code files included.
|
||||
There are 75 unique files.
|
||||
|
||||
@ -1,329 +0,0 @@
|
||||
#!/bin/bash
|
||||
# forksand-bootstrap-hk1
|
||||
# GPLv3+
|
||||
# This script does some initial setup and config
|
||||
# Sets up Proxmox.
|
||||
|
||||
# Log script
|
||||
exec > >(tee /root/bootstrap-hk1.log) 2>/root/bootstrap-hk1.err
|
||||
|
||||
set -x
|
||||
|
||||
# Set locale
|
||||
echo "en_US.UTF-8 UTF-8" > /etc/locale.gen
|
||||
locale-gen
|
||||
update-locale
|
||||
|
||||
# XXX Set timezone
|
||||
ln -sf /usr/share/zoneinfo/America/Denver /etc/localtime
|
||||
|
||||
# Set up git for tracking. XXX Ansible... XXX
|
||||
apt-get -y install git sudo
|
||||
cd /etc
|
||||
git init
|
||||
chmod og-rwx /etc/.git
|
||||
|
||||
cat > /etc/.gitignore <<EOF
|
||||
prelink.cache
|
||||
*.swp
|
||||
ld.so.cache
|
||||
adjtime
|
||||
blkid.tab
|
||||
blkid.tab.old
|
||||
mtab
|
||||
resolv.conf
|
||||
asound.state
|
||||
mtab.fuselock
|
||||
aliases.db
|
||||
EOF
|
||||
|
||||
git config --global user.name "debian"
|
||||
git config --global user.email git@localhost
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up new Debian Stretch hk1 server.'
|
||||
|
||||
# SET UP APT
|
||||
#
|
||||
cat > /etc/apt/sources.list <<EOF
|
||||
deb http://mirrors.kernel.org/debian/ stretch-backports main
|
||||
deb http://mirrors.kernel.org/debian/ stretch main
|
||||
deb http://mirrors.kernel.org/debian/ stretch-updates main
|
||||
deb http://security.debian.org/ stretch/updates main
|
||||
EOF
|
||||
|
||||
# Make apt use IPv4:
|
||||
echo 'Acquire::ForceIPv4 "true";' | tee /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
git add /etc/apt/apt.conf.d/99force-ipv4
|
||||
git commit -m "Force APT to use IPv4, not IPv6." /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up apt.'
|
||||
|
||||
# UPGRADE SERVER
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Update base install'
|
||||
|
||||
apt-get -y --download-only install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
postfix \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y \
|
||||
-o Dpkg::Options::="--force-confdef" \
|
||||
-o Dpkg::Options::="--force-confnew" \
|
||||
install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
postfix \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install base packages'
|
||||
|
||||
# Speed up
|
||||
echo 'GOVERNOR="performance"' > /etc/default/cpufrequtils
|
||||
/etc/init.d/cpufrequtils restart
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up cpufrequtils'
|
||||
|
||||
# Small user tweaks
|
||||
echo :syntax on > ~/.vimrc
|
||||
echo :syntax on > /home/jebba/.vimrc
|
||||
chown jebba:jebba /home/jebba/.vimrc
|
||||
echo export EDITOR=vi >> /root/.bashrc
|
||||
|
||||
# XXX Passwordless sudo XXX Ya, probably remove
|
||||
sed -i -e 's/%sudo\tALL=(ALL:ALL) ALL/%sudo ALL=(ALL) NOPASSWD: ALL/g' /etc/sudoers
|
||||
|
||||
adduser jebba sudo
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up passwordless sudo'
|
||||
|
||||
# SSH config XXX sed cruft
|
||||
sed -i \
|
||||
-e 's/PermitRootLogin yes/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PermitRootLogin prohibit-password/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PasswordAuthentication yes/PasswordAuthentication no/g' \
|
||||
-e 's/\#X11Forwarding yes/X11Forwarding no/g' \
|
||||
/etc/ssh/sshd_config
|
||||
|
||||
echo 'KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256' >> /etc/ssh/sshd_config
|
||||
|
||||
echo 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/sshd_config
|
||||
|
||||
# Need to update/fix for Debian Buster (testing/10). This line breaks Buster:
|
||||
#echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com' >> /etc/ssh/sshd_config
|
||||
|
||||
# XXX Add admins as only allowed ssh users
|
||||
# XXX add user for ansbile
|
||||
echo "AllowUsers jebba root" >> /etc/ssh/sshd_config
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up sshd'
|
||||
systemctl restart sshd
|
||||
|
||||
# Startup XXX disable unneeded.
|
||||
for i in rsync exim4 saned
|
||||
do echo $i
|
||||
/usr/sbin/update-rc.d $i disable
|
||||
done
|
||||
# XXX KILL THIS, listening on public port (firewalled, but still):
|
||||
# tcp 0 0 0.0.0.0:5355 0.0.0.0:* LISTEN 296/systemd-resolve
|
||||
cd /etc ; git add . ; git commit -a -m 'Turn off junk on boot'
|
||||
|
||||
# GRUB
|
||||
sed -i -e 's/^GRUB_TIMEOUT=5/GRUB_TIMEOUT=4/g' /etc/default/grub
|
||||
sed -i -e 's/^#GRUB_TERMINAL=console/GRUB_TERMINAL=console/g' /etc/default/grub
|
||||
echo 'GRUB_DISABLE_OS_PROBER=true' >> /etc/default/grub
|
||||
|
||||
update-grub
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'GRUB tweaks'
|
||||
|
||||
# Fix network to come up on boot
|
||||
sed -i -e 's/allow-hotplug/auto/g' /etc/network/interfaces
|
||||
cd /etc ; git add . ; git commit -a -m 'Auto start network'
|
||||
|
||||
# XXX not sure why this is getting installed:
|
||||
apt-get -y autoremove
|
||||
|
||||
apt-get -y remove os-prober
|
||||
|
||||
# Proxmox
|
||||
#cat > /etc/apt/sources.list.d/pve-enterprise.list<<EOF
|
||||
##deb https://enterprise.proxmox.com/debian/pve stretch pve-enterprise
|
||||
#EOF
|
||||
cat > /etc/apt/sources.list.d/pve-no-subscription.list<<EOF
|
||||
deb http://download.proxmox.com/debian/pve stretch pve-no-subscription
|
||||
EOF
|
||||
|
||||
# Add Proxmox enterprise key XXX Add key
|
||||
#cat > /etc/apt/auth.conf<<EOF
|
||||
#machine enterprise.proxmox.com
|
||||
# login pve2s-0000000000
|
||||
# password 00000000000000000000000000000000
|
||||
#EOF
|
||||
|
||||
# XXX crufty add proxmox apt key
|
||||
wget http://download.proxmox.com/debian/proxmox-ve-release-5.x.gpg -O /etc/apt/trusted.gpg.d/proxmox-ve-release-5.x.gpg
|
||||
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
apt-get -y \
|
||||
install \
|
||||
ksm-control-daemon \
|
||||
omping \
|
||||
proxmox-ve
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install Proxmox'
|
||||
apt clean
|
||||
|
||||
exit 0
|
||||
|
||||
# Run this on workstation:
|
||||
# ssh -N -C -L 8201:localhost:8006 hk1
|
||||
# firefox https://localhost:8201
|
||||
# Login as root user via PAM
|
||||
# Set up Enterprise Key, if used
|
||||
#
|
||||
#
|
||||
cd /etc ; git add . ; git commit -a -m 'Initial Proxmox configuration'
|
||||
#
|
||||
#
|
||||
# XXX Set up vmbr0 via web interface.
|
||||
#
|
||||
# Netwok
|
||||
# hk1 (host) --> System --> Network
|
||||
# Fix subnet mask, IP in web gui.
|
||||
# Create --> Linux Bridge:
|
||||
# vmbr0
|
||||
# XXX best way for this server? No subnet.
|
||||
#
|
||||
# Set up ethernet ports
|
||||
# XXX check name Disable enp2s0 (Autostart no)
|
||||
# set up vmbr0 to the main IP, gateway, etc.
|
||||
# Create Linux Bridge in web interface
|
||||
# vmbr0
|
||||
#XXX THIS ISN'T CORRECT IP
|
||||
# 174.128.229.130/27
|
||||
# 255.255.255.224
|
||||
# Autostart
|
||||
# VLAN Aware
|
||||
# Bridge: enp2s0
|
||||
# Comment Main bridge
|
||||
#
|
||||
# Set up 10.2.2.0 and 10.99.99.0 networks statically
|
||||
# on secondary ethernet interfaces
|
||||
|
||||
# Reboot! hk1 (host) --> Restart
|
||||
|
||||
# Configure Corosync
|
||||
# Set up hosts
|
||||
# XXX MAKE SURE NEW NODES GET ADDED TO EXISTING SERVER /etc/hosts
|
||||
echo "10.3.3.1 hk1-coro" >> /etc/hosts
|
||||
echo "10.3.3.2 hk2-coro" >> /etc/hosts
|
||||
echo "10.3.3.3 hk3-coro" >> /etc/hosts
|
||||
|
||||
echo "10.88.88.1 hk2-fs" >> /etc/hosts
|
||||
echo "10.88.88.2 hk2-fs" >> /etc/hosts
|
||||
echo "10.88.88.3 hk3-fs" >> /etc/hosts
|
||||
|
||||
# Test cluster ping
|
||||
for i in hk1-coro hk2-coro hk3-coro
|
||||
do ping -q -c1 $i
|
||||
done
|
||||
|
||||
# Test ssh
|
||||
for i in hk1-coro hk2-coro hk3-coro
|
||||
do ssh $i hostname
|
||||
done
|
||||
# ssh via IP
|
||||
for i in 10.2.2.3
|
||||
do ssh $i hostname
|
||||
done
|
||||
|
||||
# Note this is needed on at least one of the SharkTech servers or
|
||||
# you get bad UDP checksums
|
||||
# Also set to correct ethernet device
|
||||
# XXX CHECK
|
||||
ethtool -K enp3s0 gso off
|
||||
ethtool --offload enp3s0 rx off tx off
|
||||
ethtool -K enp4s0 gso off
|
||||
ethtool --offload enp4s0 rx off tx off
|
||||
|
||||
# Run this on just one node, hk1, to get the cluster started
|
||||
pvecm create hkfork --bindnet0_addr 10.2.2.1 --ring0_addr hk1-coro
|
||||
|
||||
# Run this on hk3
|
||||
#pvecm add 10.2.2.1 --ring0_addr hk3-coro
|
||||
|
||||
pvecm status
|
||||
pvecm nodes
|
||||
|
||||
# rebootz ?
|
||||
|
||||
# After Cluster is Configured
|
||||
# ===========================
|
||||
|
||||
# Data Center --> Permissions --> Users
|
||||
# Add user with Realm Proxmox VE authentication server.
|
||||
# Give user root permissions: Datacenter --> Permissions --> Add --> User permission.
|
||||
# Path: / User: j Role: Administrator
|
||||
# XXX Or create admin group, add perms to that...
|
||||
# Permissions --> Authentication. Set Proxmox VE authentication server to default.
|
||||
|
||||
# Storage
|
||||
# Datacenter --> Storage --> Edit local. Enable all content (add VZDump)
|
||||
#
|
||||
# DNS
|
||||
# hk1 (host) --> System --> DNS
|
||||
# Add servers:
|
||||
# 208.67.222.222 208.67.220.220 37.235.1.174
|
||||
#
|
||||
@ -1,329 +0,0 @@
|
||||
#!/bin/bash
|
||||
# forksand-bootstrap-hk2
|
||||
# GPLv3+
|
||||
# This script does some initial setup and config
|
||||
# Sets up Proxmox.
|
||||
|
||||
# Log script
|
||||
exec > >(tee /root/bootstrap-hk2.log) 2>/root/bootstrap-hk2.err
|
||||
|
||||
set -x
|
||||
|
||||
# Set locale
|
||||
echo "en_US.UTF-8 UTF-8" > /etc/locale.gen
|
||||
locale-gen
|
||||
update-locale
|
||||
|
||||
# XXX Set timezone
|
||||
ln -sf /usr/share/zoneinfo/America/Denver /etc/localtime
|
||||
|
||||
# Set up git for tracking. XXX Ansible... XXX
|
||||
apt-get -y install git sudo
|
||||
cd /etc
|
||||
git init
|
||||
chmod og-rwx /etc/.git
|
||||
|
||||
cat > /etc/.gitignore <<EOF
|
||||
prelink.cache
|
||||
*.swp
|
||||
ld.so.cache
|
||||
adjtime
|
||||
blkid.tab
|
||||
blkid.tab.old
|
||||
mtab
|
||||
resolv.conf
|
||||
asound.state
|
||||
mtab.fuselock
|
||||
aliases.db
|
||||
EOF
|
||||
|
||||
git config --global user.name "debian"
|
||||
git config --global user.email git@localhost
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up new Debian Stretch hk2 server.'
|
||||
|
||||
# SET UP APT
|
||||
#
|
||||
cat > /etc/apt/sources.list <<EOF
|
||||
deb http://mirrors.kernel.org/debian/ stretch-backports main
|
||||
deb http://mirrors.kernel.org/debian/ stretch main
|
||||
deb http://mirrors.kernel.org/debian/ stretch-updates main
|
||||
deb http://security.debian.org/ stretch/updates main
|
||||
EOF
|
||||
|
||||
# Make apt use IPv4:
|
||||
echo 'Acquire::ForceIPv4 "true";' | tee /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
git add /etc/apt/apt.conf.d/99force-ipv4
|
||||
git commit -m "Force APT to use IPv4, not IPv6." /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up apt.'
|
||||
|
||||
# UPGRADE SERVER
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Update base install'
|
||||
|
||||
apt-get -y --download-only install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
postfix \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y \
|
||||
-o Dpkg::Options::="--force-confdef" \
|
||||
-o Dpkg::Options::="--force-confnew" \
|
||||
install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
postfix \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install base packages'
|
||||
|
||||
# Speed up
|
||||
echo 'GOVERNOR="performance"' > /etc/default/cpufrequtils
|
||||
/etc/init.d/cpufrequtils restart
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up cpufrequtils'
|
||||
|
||||
# Small user tweaks
|
||||
echo :syntax on > ~/.vimrc
|
||||
echo :syntax on > /home/jebba/.vimrc
|
||||
chown jebba:jebba /home/jebba/.vimrc
|
||||
echo export EDITOR=vi >> /root/.bashrc
|
||||
|
||||
# XXX Passwordless sudo XXX Ya, probably remove
|
||||
sed -i -e 's/%sudo\tALL=(ALL:ALL) ALL/%sudo ALL=(ALL) NOPASSWD: ALL/g' /etc/sudoers
|
||||
|
||||
adduser jebba sudo
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up passwordless sudo'
|
||||
|
||||
# SSH config XXX sed cruft
|
||||
sed -i \
|
||||
-e 's/PermitRootLogin yes/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PermitRootLogin prohibit-password/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PasswordAuthentication yes/PasswordAuthentication no/g' \
|
||||
-e 's/\#X11Forwarding yes/X11Forwarding no/g' \
|
||||
/etc/ssh/sshd_config
|
||||
|
||||
echo 'KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256' >> /etc/ssh/sshd_config
|
||||
|
||||
echo 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/sshd_config
|
||||
|
||||
# Need to update/fix for Debian Buster (testing/10). This line breaks Buster:
|
||||
#echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com' >> /etc/ssh/sshd_config
|
||||
|
||||
# XXX Add admins as only allowed ssh users
|
||||
# XXX add user for ansbile
|
||||
echo "AllowUsers jebba root" >> /etc/ssh/sshd_config
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up sshd'
|
||||
systemctl restart sshd
|
||||
|
||||
# Startup XXX disable unneeded.
|
||||
for i in rsync exim4 saned
|
||||
do echo $i
|
||||
/usr/sbin/update-rc.d $i disable
|
||||
done
|
||||
# XXX KILL THIS, listening on public port (firewalled, but still):
|
||||
# tcp 0 0 0.0.0.0:5355 0.0.0.0:* LISTEN 296/systemd-resolve
|
||||
cd /etc ; git add . ; git commit -a -m 'Turn off junk on boot'
|
||||
|
||||
# GRUB
|
||||
sed -i -e 's/^GRUB_TIMEOUT=5/GRUB_TIMEOUT=4/g' /etc/default/grub
|
||||
sed -i -e 's/^#GRUB_TERMINAL=console/GRUB_TERMINAL=console/g' /etc/default/grub
|
||||
echo 'GRUB_DISABLE_OS_PROBER=true' >> /etc/default/grub
|
||||
|
||||
update-grub
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'GRUB tweaks'
|
||||
|
||||
# Fix network to come up on boot
|
||||
sed -i -e 's/allow-hotplug/auto/g' /etc/network/interfaces
|
||||
cd /etc ; git add . ; git commit -a -m 'Auto start network'
|
||||
|
||||
# XXX not sure why this is getting installed:
|
||||
apt-get -y autoremove
|
||||
|
||||
apt-get -y remove os-prober
|
||||
|
||||
# Proxmox
|
||||
#cat > /etc/apt/sources.list.d/pve-enterprise.list<<EOF
|
||||
##deb https://enterprise.proxmox.com/debian/pve stretch pve-enterprise
|
||||
#EOF
|
||||
cat > /etc/apt/sources.list.d/pve-no-subscription.list<<EOF
|
||||
deb http://download.proxmox.com/debian/pve stretch pve-no-subscription
|
||||
EOF
|
||||
|
||||
# Add Proxmox enterprise key XXX Add key
|
||||
#cat > /etc/apt/auth.conf<<EOF
|
||||
#machine enterprise.proxmox.com
|
||||
# login pve2s-0000000000
|
||||
# password 00000000000000000000000000000000
|
||||
#EOF
|
||||
|
||||
# XXX crufty add proxmox apt key
|
||||
wget http://download.proxmox.com/debian/proxmox-ve-release-5.x.gpg -O /etc/apt/trusted.gpg.d/proxmox-ve-release-5.x.gpg
|
||||
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
apt-get -y \
|
||||
install \
|
||||
ksm-control-daemon \
|
||||
omping \
|
||||
proxmox-ve
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install Proxmox'
|
||||
apt clean
|
||||
|
||||
exit 0
|
||||
|
||||
# Run this on workstation:
|
||||
# ssh -N -C -L 8202:localhost:8006 hk2
|
||||
# firefox https://localhost:8202
|
||||
# Login as root user via PAM
|
||||
# Set up Enterprise Key, if used
|
||||
#
|
||||
#
|
||||
cd /etc ; git add . ; git commit -a -m 'Initial Proxmox configuration'
|
||||
#
|
||||
#
|
||||
# XXX Set up vmbr0 via web interface.
|
||||
#
|
||||
# Netwok
|
||||
# hk2 (host) --> System --> Network
|
||||
# Fix subnet mask, IP in web gui.
|
||||
# Create --> Linux Bridge:
|
||||
# vmbr0
|
||||
# XXX best way for this server? No subnet.
|
||||
#
|
||||
# Set up ethernet ports
|
||||
# XXX check name Disable enp2s0 (Autostart no)
|
||||
# set up vmbr0 to the main IP, gateway, etc.
|
||||
# Create Linux Bridge in web interface
|
||||
# vmbr0
|
||||
#XXX THIS ISN'T CORRECT IP
|
||||
# 174.128.229.130/27
|
||||
# 255.255.255.224
|
||||
# Autostart
|
||||
# VLAN Aware
|
||||
# Bridge: enp2s0
|
||||
# Comment Main bridge
|
||||
#
|
||||
# Set up 10.2.2.0 and 10.99.99.0 networks statically
|
||||
# on secondary ethernet interfaces
|
||||
|
||||
# Reboot! hk2 (host) --> Restart
|
||||
|
||||
# Configure Corosync
|
||||
# Set up hosts
|
||||
# XXX MAKE SURE NEW NODES GET ADDED TO EXISTING SERVER /etc/hosts
|
||||
echo "10.3.3.1 hk1-coro" >> /etc/hosts
|
||||
echo "10.3.3.2 hk2-coro" >> /etc/hosts
|
||||
echo "10.3.3.3 hk3-coro" >> /etc/hosts
|
||||
|
||||
echo "10.88.88.1 hk2-fs" >> /etc/hosts
|
||||
echo "10.88.88.2 hk2-fs" >> /etc/hosts
|
||||
echo "10.88.88.3 hk3-fs" >> /etc/hosts
|
||||
|
||||
# Test cluster ping
|
||||
for i in hk1-coro hk2-coro hk3-coro
|
||||
do ping -q -c1 $i
|
||||
done
|
||||
|
||||
# Test ssh
|
||||
for i in hk1-coro hk2-coro hk3-coro
|
||||
do ssh $i hostname
|
||||
done
|
||||
# ssh via IP
|
||||
for i in 10.2.2.3
|
||||
do ssh $i hostname
|
||||
done
|
||||
|
||||
# Note this is needed on at least one of the SharkTech servers or
|
||||
# you get bad UDP checksums
|
||||
# Also set to correct ethernet device
|
||||
# XXX CHECK
|
||||
ethtool -K enp3s0 gso off
|
||||
ethtool --offload enp3s0 rx off tx off
|
||||
ethtool -K enp4s0 gso off
|
||||
ethtool --offload enp4s0 rx off tx off
|
||||
|
||||
# Run this on just one node, hk1, to get the cluster started
|
||||
#pvecm create hkfork --bindnet0_addr 10.2.2.1 --ring0_addr hk1-coro
|
||||
|
||||
# Run this on hk2
|
||||
pvecm add 10.2.2.1 --ring0_addr hk1-coro
|
||||
|
||||
pvecm status
|
||||
pvecm nodes
|
||||
|
||||
# rebootz ?
|
||||
|
||||
# After Cluster is Configured
|
||||
# ===========================
|
||||
|
||||
# Data Center --> Permissions --> Users
|
||||
# Add user with Realm Proxmox VE authentication server.
|
||||
# Give user root permissions: Datacenter --> Permissions --> Add --> User permission.
|
||||
# Path: / User: j Role: Administrator
|
||||
# XXX Or create admin group, add perms to that...
|
||||
# Permissions --> Authentication. Set Proxmox VE authentication server to default.
|
||||
|
||||
# Storage
|
||||
# Datacenter --> Storage --> Edit local. Enable all content (add VZDump)
|
||||
#
|
||||
# DNS
|
||||
# hk2 (host) --> System --> DNS
|
||||
# Add servers:
|
||||
# 208.67.222.222 208.67.220.220 37.235.1.174
|
||||
#
|
||||
@ -1,329 +0,0 @@
|
||||
#!/bin/bash
|
||||
# forksand-bootstrap-hk3
|
||||
# GPLv3+
|
||||
# This script does some initial setup and config
|
||||
# Sets up Proxmox.
|
||||
|
||||
# Log script
|
||||
exec > >(tee /root/bootstrap-hk3.log) 2>/root/bootstrap-hk3.err
|
||||
|
||||
set -x
|
||||
|
||||
# Set locale
|
||||
echo "en_US.UTF-8 UTF-8" > /etc/locale.gen
|
||||
locale-gen
|
||||
update-locale
|
||||
|
||||
# XXX Set timezone
|
||||
ln -sf /usr/share/zoneinfo/America/Denver /etc/localtime
|
||||
|
||||
# Set up git for tracking. XXX Ansible... XXX
|
||||
apt-get -y install git sudo
|
||||
cd /etc
|
||||
git init
|
||||
chmod og-rwx /etc/.git
|
||||
|
||||
cat > /etc/.gitignore <<EOF
|
||||
prelink.cache
|
||||
*.swp
|
||||
ld.so.cache
|
||||
adjtime
|
||||
blkid.tab
|
||||
blkid.tab.old
|
||||
mtab
|
||||
resolv.conf
|
||||
asound.state
|
||||
mtab.fuselock
|
||||
aliases.db
|
||||
EOF
|
||||
|
||||
git config --global user.name "debian"
|
||||
git config --global user.email git@localhost
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up new Debian Stretch hk3 server.'
|
||||
|
||||
# SET UP APT
|
||||
#
|
||||
cat > /etc/apt/sources.list <<EOF
|
||||
deb http://mirrors.kernel.org/debian/ stretch-backports main
|
||||
deb http://mirrors.kernel.org/debian/ stretch main
|
||||
deb http://mirrors.kernel.org/debian/ stretch-updates main
|
||||
deb http://security.debian.org/ stretch/updates main
|
||||
EOF
|
||||
|
||||
# Make apt use IPv4:
|
||||
echo 'Acquire::ForceIPv4 "true";' | tee /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
git add /etc/apt/apt.conf.d/99force-ipv4
|
||||
git commit -m "Force APT to use IPv4, not IPv6." /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up apt.'
|
||||
|
||||
# UPGRADE SERVER
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Update base install'
|
||||
|
||||
apt-get -y --download-only install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
postfix \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y \
|
||||
-o Dpkg::Options::="--force-confdef" \
|
||||
-o Dpkg::Options::="--force-confnew" \
|
||||
install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
postfix \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install base packages'
|
||||
|
||||
# Speed up
|
||||
echo 'GOVERNOR="performance"' > /etc/default/cpufrequtils
|
||||
/etc/init.d/cpufrequtils restart
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up cpufrequtils'
|
||||
|
||||
# Small user tweaks
|
||||
echo :syntax on > ~/.vimrc
|
||||
echo :syntax on > /home/jebba/.vimrc
|
||||
chown jebba:jebba /home/jebba/.vimrc
|
||||
echo export EDITOR=vi >> /root/.bashrc
|
||||
|
||||
# XXX Passwordless sudo XXX Ya, probably remove
|
||||
sed -i -e 's/%sudo\tALL=(ALL:ALL) ALL/%sudo ALL=(ALL) NOPASSWD: ALL/g' /etc/sudoers
|
||||
|
||||
adduser jebba sudo
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up passwordless sudo'
|
||||
|
||||
# SSH config XXX sed cruft
|
||||
sed -i \
|
||||
-e 's/PermitRootLogin yes/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PermitRootLogin prohibit-password/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PasswordAuthentication yes/PasswordAuthentication no/g' \
|
||||
-e 's/\#X11Forwarding yes/X11Forwarding no/g' \
|
||||
/etc/ssh/sshd_config
|
||||
|
||||
echo 'KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256' >> /etc/ssh/sshd_config
|
||||
|
||||
echo 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/sshd_config
|
||||
|
||||
# Need to update/fix for Debian Buster (testing/10). This line breaks Buster:
|
||||
#echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com' >> /etc/ssh/sshd_config
|
||||
|
||||
# XXX Add admins as only allowed ssh users
|
||||
# XXX add user for ansbile
|
||||
echo "AllowUsers jebba root" >> /etc/ssh/sshd_config
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up sshd'
|
||||
systemctl restart sshd
|
||||
|
||||
# Startup XXX disable unneeded.
|
||||
for i in rsync exim4 saned
|
||||
do echo $i
|
||||
/usr/sbin/update-rc.d $i disable
|
||||
done
|
||||
# XXX KILL THIS, listening on public port (firewalled, but still):
|
||||
# tcp 0 0 0.0.0.0:5355 0.0.0.0:* LISTEN 296/systemd-resolve
|
||||
cd /etc ; git add . ; git commit -a -m 'Turn off junk on boot'
|
||||
|
||||
# GRUB
|
||||
sed -i -e 's/^GRUB_TIMEOUT=5/GRUB_TIMEOUT=4/g' /etc/default/grub
|
||||
sed -i -e 's/^#GRUB_TERMINAL=console/GRUB_TERMINAL=console/g' /etc/default/grub
|
||||
echo 'GRUB_DISABLE_OS_PROBER=true' >> /etc/default/grub
|
||||
|
||||
update-grub
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'GRUB tweaks'
|
||||
|
||||
# Fix network to come up on boot
|
||||
sed -i -e 's/allow-hotplug/auto/g' /etc/network/interfaces
|
||||
cd /etc ; git add . ; git commit -a -m 'Auto start network'
|
||||
|
||||
# XXX not sure why this is getting installed:
|
||||
apt-get -y autoremove
|
||||
|
||||
apt-get -y remove os-prober
|
||||
|
||||
# Proxmox
|
||||
#cat > /etc/apt/sources.list.d/pve-enterprise.list<<EOF
|
||||
##deb https://enterprise.proxmox.com/debian/pve stretch pve-enterprise
|
||||
#EOF
|
||||
cat > /etc/apt/sources.list.d/pve-no-subscription.list<<EOF
|
||||
deb http://download.proxmox.com/debian/pve stretch pve-no-subscription
|
||||
EOF
|
||||
|
||||
# Add Proxmox enterprise key XXX Add key
|
||||
#cat > /etc/apt/auth.conf<<EOF
|
||||
#machine enterprise.proxmox.com
|
||||
# login pve2s-0000000000
|
||||
# password 00000000000000000000000000000000
|
||||
#EOF
|
||||
|
||||
# XXX crufty add proxmox apt key
|
||||
wget http://download.proxmox.com/debian/proxmox-ve-release-5.x.gpg -O /etc/apt/trusted.gpg.d/proxmox-ve-release-5.x.gpg
|
||||
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
apt-get -y \
|
||||
install \
|
||||
ksm-control-daemon \
|
||||
omping \
|
||||
proxmox-ve
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install Proxmox'
|
||||
apt clean
|
||||
|
||||
exit 0
|
||||
|
||||
# Run this on workstation:
|
||||
# ssh -N -C -L 8203:localhost:8006 hk3
|
||||
# firefox https://localhost:8203
|
||||
# Login as root user via PAM
|
||||
# Set up Enterprise Key, if used
|
||||
#
|
||||
#
|
||||
cd /etc ; git add . ; git commit -a -m 'Initial Proxmox configuration'
|
||||
#
|
||||
#
|
||||
# XXX Set up vmbr0 via web interface.
|
||||
#
|
||||
# Netwok
|
||||
# hk3 (host) --> System --> Network
|
||||
# Fix subnet mask, IP in web gui.
|
||||
# Create --> Linux Bridge:
|
||||
# vmbr0
|
||||
# XXX best way for this server? No subnet.
|
||||
#
|
||||
# Set up ethernet ports
|
||||
# XXX check name Disable enp2s0 (Autostart no)
|
||||
# set up vmbr0 to the main IP, gateway, etc.
|
||||
# Create Linux Bridge in web interface
|
||||
# vmbr0
|
||||
#XXX THIS ISN'T CORRECT IP
|
||||
# 174.128.229.130/27
|
||||
# 255.255.255.224
|
||||
# Autostart
|
||||
# VLAN Aware
|
||||
# Bridge: enp2s0
|
||||
# Comment Main bridge
|
||||
#
|
||||
# Set up 10.2.2.0 and 10.99.99.0 networks statically
|
||||
# on secondary ethernet interfaces
|
||||
|
||||
# Reboot! hk3 (host) --> Restart
|
||||
|
||||
# Configure Corosync
|
||||
# Set up hosts
|
||||
# XXX MAKE SURE NEW NODES GET ADDED TO EXISTING SERVER /etc/hosts
|
||||
echo "10.3.3.1 hk1-coro" >> /etc/hosts
|
||||
echo "10.3.3.2 hk2-coro" >> /etc/hosts
|
||||
echo "10.3.3.3 hk3-coro" >> /etc/hosts
|
||||
|
||||
echo "10.88.88.1 hk2-fs" >> /etc/hosts
|
||||
echo "10.88.88.2 hk2-fs" >> /etc/hosts
|
||||
echo "10.88.88.3 hk3-fs" >> /etc/hosts
|
||||
|
||||
# Test cluster ping
|
||||
for i in hk1-coro hk2-coro hk3-coro
|
||||
do ping -q -c1 $i
|
||||
done
|
||||
|
||||
# Test ssh
|
||||
for i in hk1-coro hk2-coro hk3-coro
|
||||
do ssh $i hostname
|
||||
done
|
||||
# ssh via IP
|
||||
for i in 10.2.2.3
|
||||
do ssh $i hostname
|
||||
done
|
||||
|
||||
# Note this is needed on at least one of the SharkTech servers or
|
||||
# you get bad UDP checksums
|
||||
# Also set to correct ethernet device
|
||||
# XXX CHECK
|
||||
ethtool -K enp3s0 gso off
|
||||
ethtool --offload enp3s0 rx off tx off
|
||||
ethtool -K enp4s0 gso off
|
||||
ethtool --offload enp4s0 rx off tx off
|
||||
|
||||
# Run this on just one node, hk3, to get the cluster started
|
||||
#pvecm create hkfork --bindnet0_addr 10.2.2.3 --ring0_addr hk3-coro
|
||||
|
||||
# Run this on hk3
|
||||
pvecm add 10.2.2.1 --ring0_addr hk3-coro
|
||||
|
||||
pvecm status
|
||||
pvecm nodes
|
||||
|
||||
# rebootz ?
|
||||
|
||||
# After Cluster is Configured
|
||||
# ===========================
|
||||
|
||||
# Data Center --> Permissions --> Users
|
||||
# Add user with Realm Proxmox VE authentication server.
|
||||
# Give user root permissions: Datacenter --> Permissions --> Add --> User permission.
|
||||
# Path: / User: j Role: Administrator
|
||||
# XXX Or create admin group, add perms to that...
|
||||
# Permissions --> Authentication. Set Proxmox VE authentication server to default.
|
||||
|
||||
# Storage
|
||||
# Datacenter --> Storage --> Edit local. Enable all content (add VZDump)
|
||||
#
|
||||
# DNS
|
||||
# hk3 (host) --> System --> DNS
|
||||
# Add servers:
|
||||
# 208.67.222.222 208.67.220.220 37.235.1.174
|
||||
#
|
||||
@ -1,375 +0,0 @@
|
||||
#!/bin/bash
|
||||
# forksand-bootstrap-the
|
||||
# GPLv3+
|
||||
# This script does some initial setup and config
|
||||
# Sets up Proxmox.
|
||||
# IPv6 is left enabled.
|
||||
# Firewalling is done through Proxmox.
|
||||
# Edit below to add Proxmox Enterprise Key. XXX broken, use community repo.
|
||||
|
||||
# XXX set up hostname
|
||||
|
||||
# XXX set network to auto not hotplug XXX
|
||||
|
||||
# Log script
|
||||
exec > >(tee /root/bootstrap-the.log) 2>/root/bootstrap-the.err
|
||||
|
||||
set -x
|
||||
|
||||
# Set locale
|
||||
echo "en_US.UTF-8 UTF-8" > /etc/locale.gen
|
||||
locale-gen
|
||||
update-locale
|
||||
|
||||
# XXX Set timezone
|
||||
ln -sf /usr/share/zoneinfo/America/Denver /etc/localtime
|
||||
|
||||
# Set up git for tracking. XXX Ansible... XXX
|
||||
echo 'Acquire::http::Proxy "http://192.168.110.72:3142";' > /etc/apt/apt.conf
|
||||
apt-get -y install git sudo
|
||||
cd /etc
|
||||
git init
|
||||
chmod og-rwx /etc/.git
|
||||
|
||||
cat > /etc/.gitignore <<EOF
|
||||
prelink.cache
|
||||
*.swp
|
||||
ld.so.cache
|
||||
adjtime
|
||||
blkid.tab
|
||||
blkid.tab.old
|
||||
mtab
|
||||
resolv.conf
|
||||
asound.state
|
||||
mtab.fuselock
|
||||
aliases.db
|
||||
EOF
|
||||
|
||||
git config --global user.name "debian"
|
||||
git config --global user.email git@localhost
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up new Debian Stretch the server.'
|
||||
|
||||
# SET UP APT
|
||||
#
|
||||
cat > /etc/apt/sources.list <<EOF
|
||||
deb http://mirrors.kernel.org/debian/ stretch-backports main
|
||||
deb http://mirrors.kernel.org/debian/ stretch main
|
||||
deb http://mirrors.kernel.org/debian/ stretch-updates main
|
||||
deb http://security.debian.org/ stretch/updates main
|
||||
EOF
|
||||
|
||||
# Make apt use IPv4:
|
||||
echo 'Acquire::ForceIPv4 "true";' | tee /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
git add /etc/apt/apt.conf.d/99force-ipv4
|
||||
git commit -m "Force APT to use IPv4, not IPv6." /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up apt.'
|
||||
|
||||
# UPGRADE SERVER
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Update base install'
|
||||
|
||||
# ZFS tools
|
||||
modprobe zfs
|
||||
|
||||
apt-get -y --download-only install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
python3 \
|
||||
rsync \
|
||||
tcpdump \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts \
|
||||
zfsutils-linux
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y \
|
||||
-o Dpkg::Options::="--force-confdef" \
|
||||
-o Dpkg::Options::="--force-confnew" \
|
||||
install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
python3 \
|
||||
rsync \
|
||||
tcpdump \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts \
|
||||
zfsutils-linux
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install base packages'
|
||||
|
||||
# Speed up
|
||||
echo 'GOVERNOR="performance"' > /etc/default/cpufrequtils
|
||||
/etc/init.d/cpufrequtils restart
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up cpufrequtils'
|
||||
|
||||
# Small user tweaks
|
||||
echo :syntax on > ~/.vimrc
|
||||
echo :syntax on > /home/jebba/.vimrc
|
||||
chown jebba:jebba /home/jebba/.vimrc
|
||||
echo export EDITOR=vi >> /root/.bashrc
|
||||
|
||||
# XXX Passwordless sudo XXX Ya, probably remove
|
||||
sed -i -e 's/%sudo\tALL=(ALL:ALL) ALL/%sudo ALL=(ALL) NOPASSWD: ALL/g' /etc/sudoers
|
||||
|
||||
adduser jebba sudo
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up passwordless sudo'
|
||||
|
||||
# SSH config XXX sed cruft
|
||||
sed -i \
|
||||
-e 's/PermitRootLogin yes/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PermitRootLogin prohibit-password/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PasswordAuthentication yes/PasswordAuthentication no/g' \
|
||||
-e 's/\#X11Forwarding yes/X11Forwarding no/g' \
|
||||
/etc/ssh/sshd_config
|
||||
|
||||
echo 'KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256' >> /etc/ssh/sshd_config
|
||||
|
||||
echo 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/sshd_config
|
||||
|
||||
# Need to update/fix for Debian Buster (testing/10). This line breaks Buster:
|
||||
#echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com' >> /etc/ssh/sshd_config
|
||||
|
||||
# XXX Add admins as only allowed ssh users
|
||||
# XXX add user for ansbile
|
||||
echo "AllowUsers jebba root" >> /etc/ssh/sshd_config
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up sshd'
|
||||
systemctl restart sshd
|
||||
|
||||
# Startup XXX disable unneeded.
|
||||
for i in rsync exim4 saned
|
||||
do echo $i
|
||||
/usr/sbin/update-rc.d $i disable
|
||||
done
|
||||
# XXX KILL THIS, listening on public port (firewalled, but still):
|
||||
# tcp 0 0 0.0.0.0:5355 0.0.0.0:* LISTEN 296/systemd-resolve
|
||||
cd /etc ; git add . ; git commit -a -m 'Turn off junk on boot'
|
||||
|
||||
# GRUB
|
||||
sed -i -e 's/^GRUB_TIMEOUT=5/GRUB_TIMEOUT=4/g' /etc/default/grub
|
||||
sed -i -e 's/^#GRUB_TERMINAL=console/GRUB_TERMINAL=console/g' /etc/default/grub
|
||||
echo 'GRUB_DISABLE_OS_PROBER=true' >> /etc/default/grub
|
||||
|
||||
update-grub
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'GRUB tweaks'
|
||||
|
||||
# Fix network to come up on boot
|
||||
sed -i -e 's/allow-hotplug/auto/g' /etc/network/interfaces
|
||||
cd /etc ; git add . ; git commit -a -m 'Auto start network'
|
||||
|
||||
# XXX not sure why this is getting installed:
|
||||
apt-get -y autoremove
|
||||
|
||||
# Proxmox
|
||||
#cat > /etc/apt/sources.list.d/pve-enterprise.list<<EOF
|
||||
##deb https://enterprise.proxmox.com/debian/pve stretch pve-enterprise
|
||||
#EOF
|
||||
cat > /etc/apt/sources.list.d/pve-no-subscription.list<<EOF
|
||||
deb http://download.proxmox.com/debian/pve stretch pve-no-subscription
|
||||
EOF
|
||||
|
||||
# Add Proxmox enterprise key XXX Add key
|
||||
#cat > /etc/apt/auth.conf<<EOF
|
||||
#machine enterprise.proxmox.com
|
||||
# login pve2s-0000000000
|
||||
# password 00000000000000000000000000000000
|
||||
#EOF
|
||||
|
||||
# XXX crufty add proxmox apt key
|
||||
wget http://download.proxmox.com/debian/proxmox-ve-release-5.x.gpg -O /etc/apt/trusted.gpg.d/proxmox-ve-release-5.x.gpg
|
||||
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
apt-get -y \
|
||||
install \
|
||||
ksm-control-daemon \
|
||||
omping \
|
||||
proxmox-ve
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install Proxmox'
|
||||
apt clean
|
||||
|
||||
exit 0
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Initial Proxmox configuration'
|
||||
#
|
||||
# XXX use postfix not exim4
|
||||
#
|
||||
# Create --> Linux Bridge:
|
||||
# vmbr0
|
||||
|
||||
# rebootz
|
||||
#
|
||||
# Set up templates
|
||||
|
||||
# Cluster Corosync
|
||||
exit 0
|
||||
echo "10.8.8.88 truck-coro" >> /etc/hosts
|
||||
echo "10.8.8.90 swutch-coro" >> /etc/hosts
|
||||
echo "10.8.8.87 wall-coro" >> /etc/hosts
|
||||
echo "10.8.8.66 the-coro" >> /etc/hosts
|
||||
echo "10.99.99.88 truck-fs" >> /etc/hosts
|
||||
echo "10.99.99.90 swutch-fs" >> /etc/hosts
|
||||
echo "10.99.99.87 wall-fs" >> /etc/hosts
|
||||
echo "10.99.99.66 the-fs" >> /etc/hosts
|
||||
|
||||
# Test cluster ping
|
||||
for i in truck-coro swutch-coro wall-coro the-coro
|
||||
do ping -q -c1 $i
|
||||
done
|
||||
|
||||
# more stuff
|
||||
apt remove os-prober
|
||||
|
||||
# Disable enp3s0 (Autostart no)
|
||||
#
|
||||
# set up vmbr0 to the main IP, gateway, etc.
|
||||
# Create Linux Bridge in web interface
|
||||
# vmbr0
|
||||
# 192.168.110.66
|
||||
# 255.255.255.0
|
||||
# Gateway 192.168.110.252
|
||||
# Autostart
|
||||
# VLAN Aware
|
||||
# Bridge: enp3s0f1
|
||||
# Comment Main bridge
|
||||
|
||||
# Set up corosync ethernet interfaces
|
||||
# 10.8.8.66
|
||||
# 255.255.255.0
|
||||
# Autostart
|
||||
# VLAN Aware
|
||||
# Bridge enx000acd31ac3d
|
||||
# Comment the-coro
|
||||
|
||||
# Set up ceph ethernet interfaces
|
||||
# 10.99.99.66
|
||||
# 255.255.255.0
|
||||
# Autostart
|
||||
# VLAN Aware
|
||||
# Bridge enx000acd31ac3e
|
||||
# Comment fs-coro
|
||||
|
||||
# rebooootz
|
||||
|
||||
# Add the to /etc/hosts on other servers:
|
||||
10.8.8.66 the-coro
|
||||
10.99.99.66 the-fs
|
||||
|
||||
# Add the the ssh key to ONE node
|
||||
|
||||
# Add truck, wall, swutch ssh keys to the
|
||||
|
||||
|
||||
# Test flood multicast on private interface
|
||||
omping -c 10000 -i 0.001 -F -q swutch-coro truck-coro the-coro wall-coro
|
||||
# Ten minute test:
|
||||
omping -c 600 -i 1 -q swutch-coro truck-coro wall-coro the-coro
|
||||
|
||||
# Set up ssh as root to/from all nodes
|
||||
# Best way to do this ... XXX
|
||||
echo "fookey" >> /root/.ssh/authorized_keys
|
||||
# test SSH
|
||||
/etc/init.d/ssh restart
|
||||
|
||||
for i in the wall truck swutch ;do ssh $i hostname ;done
|
||||
for i in the-coro wall-coro truck-coro swutch-coro ;do ssh $i hostname ;done
|
||||
for i in the-fs wall-fs truck-fs swutch-fs ;do ssh $i hostname ;done
|
||||
|
||||
|
||||
# Run on the:
|
||||
pvecm add 10.8.8.88 --ring0_addr the-coro
|
||||
|
||||
# If `tcpdump -vvv -i enp10s0` show bad udp checksums, run this:
|
||||
# XXX ok on the, wall, swutch, truck
|
||||
ethtool -K enp10s0 gso off
|
||||
ethtool --offload enp10s0 rx off tx off
|
||||
|
||||
# Run on all nodes:
|
||||
pveceph install --version luminous
|
||||
|
||||
# Then run on remaining nodes, the:
|
||||
pveceph createmon
|
||||
|
||||
# On all nodes:
|
||||
pveceph createmgr
|
||||
|
||||
# internal drives
|
||||
# Create a GPT disklabel with fdisk
|
||||
fdisk /dev/nvme0n1
|
||||
# g
|
||||
# w
|
||||
pveceph createosd /dev/nvme0n1
|
||||
# Create a GPT disklabel with fdisk
|
||||
fdisk /dev/sda
|
||||
# g
|
||||
# w
|
||||
pveceph createosd /dev/sda
|
||||
|
||||
|
||||
#===================== XXX best way? XXX ====================
|
||||
# XXX maybe not needed ?
|
||||
# XXX actually, remove this and do no auth since it is private network.
|
||||
mkdir /etc/pve/priv/ceph
|
||||
cp -p /etc/pve/priv/ceph.client.admin.keyring /etc/pve/priv/ceph/my-ceph-storage.keyring
|
||||
# Edit on just one node (shared on all)
|
||||
vim /etc/pve/storage.cfg
|
||||
|
||||
# Do this instead of my-ceph-storage.keyring
|
||||
# Edit on one node:
|
||||
vim /etc/pve/ceph.conf
|
||||
auth cluster required = none
|
||||
auth service required = none
|
||||
auth client required = none
|
||||
# restart stuff
|
||||
systemctl stop ceph\*.service ceph\*.target
|
||||
mkdir /etc/pve/priv/ceph/old
|
||||
mv /etc/pve/priv/ceph/*keyring /etc/pve/priv/ceph/old/
|
||||
#===================== XXX best way? XXX ====================
|
||||
@ -1,393 +0,0 @@
|
||||
#!/bin/bash
|
||||
# forksand-bootstrap-truck
|
||||
# GPLv3+
|
||||
# This script does some initial setup and config
|
||||
# Sets up Proxmox.
|
||||
# IPv6 is left enabled.
|
||||
# Firewalling is done through Proxmox.
|
||||
# Edit below to add Proxmox Enterprise Key. XXX broken, use community repo.
|
||||
|
||||
# XXX set up hostname
|
||||
|
||||
# XXX set network to auto not hotplug XXX
|
||||
|
||||
# Log script
|
||||
exec > >(tee /root/bootstrap-truck.log) 2>/root/bootstrap-truck.err
|
||||
|
||||
set -x
|
||||
|
||||
# Set locale
|
||||
echo "en_US.UTF-8 UTF-8" > /etc/locale.gen
|
||||
locale-gen
|
||||
update-locale
|
||||
|
||||
# XXX Set timezone
|
||||
ln -sf /usr/share/zoneinfo/America/Denver /etc/localtime
|
||||
|
||||
# Set up git for tracking. XXX Ansible... XXX
|
||||
echo 'Acquire::http::Proxy "http://192.168.110.72:3142";' > /etc/apt/apt.conf
|
||||
apt-get -y install git sudo
|
||||
cd /etc
|
||||
git init
|
||||
chmod og-rwx /etc/.git
|
||||
|
||||
cat > /etc/.gitignore <<EOF
|
||||
prelink.cache
|
||||
*.swp
|
||||
ld.so.cache
|
||||
adjtime
|
||||
blkid.tab
|
||||
blkid.tab.old
|
||||
mtab
|
||||
resolv.conf
|
||||
asound.state
|
||||
mtab.fuselock
|
||||
aliases.db
|
||||
EOF
|
||||
|
||||
git config --global user.name "debian"
|
||||
git config --global user.email git@localhost
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up new Debian Stretch truck server.'
|
||||
|
||||
# SET UP APT
|
||||
#
|
||||
cat > /etc/apt/sources.list <<EOF
|
||||
deb http://mirrors.kernel.org/debian/ stretch-backports main
|
||||
deb http://mirrors.kernel.org/debian/ stretch main
|
||||
deb http://mirrors.kernel.org/debian/ stretch-updates main
|
||||
deb http://security.debian.org/ stretch/updates main
|
||||
EOF
|
||||
|
||||
# Make apt use IPv4:
|
||||
echo 'Acquire::ForceIPv4 "true";' | tee /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
git add /etc/apt/apt.conf.d/99force-ipv4
|
||||
git commit -m "Force APT to use IPv4, not IPv6." /etc/apt/apt.conf.d/99force-ipv4
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up apt.'
|
||||
|
||||
# UPGRADE SERVER
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Update base install'
|
||||
|
||||
apt-get -y --download-only install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y \
|
||||
-o Dpkg::Options::="--force-confdef" \
|
||||
-o Dpkg::Options::="--force-confnew" \
|
||||
install \
|
||||
--no-install-recommends \
|
||||
apt-transport-https \
|
||||
bzip2 \
|
||||
ca-certificates \
|
||||
colordiff \
|
||||
cpufrequtils \
|
||||
curl \
|
||||
debian-archive-keyring \
|
||||
exuberant-ctags \
|
||||
git \
|
||||
host \
|
||||
less \
|
||||
locales \
|
||||
lsb-release \
|
||||
man-db \
|
||||
manpages \
|
||||
molly-guard \
|
||||
net-tools \
|
||||
ntp \
|
||||
openssh-server \
|
||||
python3 \
|
||||
rsync \
|
||||
telnet \
|
||||
traceroute \
|
||||
vim \
|
||||
vim-scripts
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install base packages'
|
||||
|
||||
# Speed up
|
||||
echo 'GOVERNOR="performance"' > /etc/default/cpufrequtils
|
||||
/etc/init.d/cpufrequtils restart
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up cpufrequtils'
|
||||
|
||||
# Small user tweaks
|
||||
echo :syntax on > ~/.vimrc
|
||||
echo :syntax on > /home/jebba/.vimrc
|
||||
chown jebba:jebba /home/jebba/.vimrc
|
||||
echo export EDITOR=vi >> /root/.bashrc
|
||||
|
||||
# XXX Passwordless sudo XXX Ya, probably remove
|
||||
sed -i -e 's/%sudo\tALL=(ALL:ALL) ALL/%sudo ALL=(ALL) NOPASSWD: ALL/g' /etc/sudoers
|
||||
|
||||
adduser jebba sudo
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up passwordless sudo'
|
||||
|
||||
# SSH config XXX sed cruft
|
||||
sed -i \
|
||||
-e 's/PermitRootLogin yes/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PermitRootLogin prohibit-password/PermitRootLogin prohibit-password/g' \
|
||||
-e 's/\#PasswordAuthentication yes/PasswordAuthentication no/g' \
|
||||
-e 's/\#X11Forwarding yes/X11Forwarding no/g' \
|
||||
/etc/ssh/sshd_config
|
||||
|
||||
echo 'KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256' >> /etc/ssh/sshd_config
|
||||
|
||||
echo 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' >> /etc/ssh/sshd_config
|
||||
|
||||
# Need to update/fix for Debian Buster (testing/10). This line breaks Buster:
|
||||
#echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com' >> /etc/ssh/sshd_config
|
||||
|
||||
# XXX Add admins as only allowed ssh users
|
||||
# XXX add user for ansbile
|
||||
echo "AllowUsers jebba root" >> /etc/ssh/sshd_config
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Set up sshd'
|
||||
systemctl restart sshd
|
||||
|
||||
# Startup XXX disable unneeded.
|
||||
for i in rsync exim4 saned
|
||||
do echo $i
|
||||
/usr/sbin/update-rc.d $i disable
|
||||
done
|
||||
# XXX KILL THIS, listening on public port (firewalled, but still):
|
||||
# tcp 0 0 0.0.0.0:5355 0.0.0.0:* LISTEN 296/systemd-resolve
|
||||
cd /etc ; git add . ; git commit -a -m 'Turn off junk on boot'
|
||||
|
||||
# GRUB
|
||||
sed -i -e 's/^GRUB_TIMEOUT=5/GRUB_TIMEOUT=4/g' /etc/default/grub
|
||||
sed -i -e 's/^#GRUB_TERMINAL=console/GRUB_TERMINAL=console/g' /etc/default/grub
|
||||
echo 'GRUB_DISABLE_OS_PROBER=true' >> /etc/default/grub
|
||||
|
||||
update-grub
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'GRUB tweaks'
|
||||
|
||||
# Fix network to come up on boot
|
||||
sed -i -e 's/allow-hotplug/auto/g' /etc/network/interfaces
|
||||
cd /etc ; git add . ; git commit -a -m 'Auto start network'
|
||||
|
||||
# XXX not sure why this is getting installed:
|
||||
apt-get -y autoremove
|
||||
|
||||
# Proxmox
|
||||
#cat > /etc/apt/sources.list.d/pve-enterprise.list<<EOF
|
||||
##deb https://enterprise.proxmox.com/debian/pve stretch pve-enterprise
|
||||
#EOF
|
||||
cat > /etc/apt/sources.list.d/pve-no-subscription.list<<EOF
|
||||
deb http://download.proxmox.com/debian/pve stretch pve-no-subscription
|
||||
EOF
|
||||
|
||||
# Add Proxmox enterprise key XXX Add key
|
||||
#cat > /etc/apt/auth.conf<<EOF
|
||||
#machine enterprise.proxmox.com
|
||||
# login pve2s-0000000000
|
||||
# password 00000000000000000000000000000000
|
||||
#EOF
|
||||
|
||||
# XXX crufty add proxmox apt key
|
||||
wget http://download.proxmox.com/debian/proxmox-ve-release-5.x.gpg -O /etc/apt/trusted.gpg.d/proxmox-ve-release-5.x.gpg
|
||||
|
||||
apt-get update
|
||||
apt-get -y dist-upgrade --download-only
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade
|
||||
|
||||
apt-get -y \
|
||||
install \
|
||||
ksm-control-daemon \
|
||||
proxmox-ve
|
||||
|
||||
cd /etc ; git add . ; git commit -a -m 'Install Proxmox'
|
||||
apt clean
|
||||
|
||||
exit 0
|
||||
|
||||
# Run this on workstation:
|
||||
# ssh -N -C -L 8008:localhost:8006 truck
|
||||
# firefox https://localhost:8008
|
||||
# Login as root user via PAM
|
||||
# Set up Enterprise Key, if used
|
||||
# Data Center --> Permissions --> Users
|
||||
# Add user with Realm Proxmox VE authentication server.
|
||||
# Give user root permissions: Datacenter --> Permissions --> Add --> User permission.
|
||||
# Path: / User: j Role: Administrator
|
||||
# XXX Or create admin group, add perms to that...
|
||||
# Permissions --> Authentication. Set Proxmox VE authentication server to default.
|
||||
#
|
||||
# Enable firewall.
|
||||
# Datacenter --> truck (host) --> Firewall --> Add.
|
||||
# Open up for SSH and SSH alt port.
|
||||
# Enable firewall for datacenter:
|
||||
# Datacenter --> Firewall --> Options --> Firewall --> Yes
|
||||
# Enable firewall for truck:
|
||||
# Open up for SSH and SSH alt port.
|
||||
# REJECT everything coming in. (then DROP)
|
||||
# Reorder to ACCEPT SSH at top
|
||||
#
|
||||
cd /etc ; git add . ; git commit -a -m 'Initial Proxmox configuration'
|
||||
#
|
||||
# Reboot! truck (host) --> Restart
|
||||
#
|
||||
# XXX
|
||||
# Datacenter --> Firewall --> Add.
|
||||
# REJECT any in
|
||||
#
|
||||
# Storage
|
||||
# Datacenter --> Storage --> Edit local. Enable all content (add VZDump)
|
||||
#
|
||||
# XXX postfix
|
||||
#
|
||||
# DNS
|
||||
# truck (host) --> System --> DNS
|
||||
# Add servers:
|
||||
# 208.67.222.222 208.67.220.220 37.235.1.174
|
||||
#
|
||||
# Netwok
|
||||
# truck (host) --> System --> Network
|
||||
# Fix subnet mask, IP in web gui.
|
||||
# Create --> Linux Bridge:
|
||||
# vmbr0
|
||||
# XXX best way for this server? No subnet.
|
||||
#
|
||||
|
||||
# rebootz
|
||||
#
|
||||
# Set up templates
|
||||
|
||||
# XXX TOTAL MEH XXX
|
||||
# add this to the workstation:
|
||||
# 127.0.0.1 localhost truck-tun
|
||||
# Run:
|
||||
# ssh -N -C -L 8020:localhost:8006 truck
|
||||
# Then use URLs
|
||||
# https://truck-tun:8020
|
||||
# Or you can only be logged into one at a time.
|
||||
# XXX find better workaround
|
||||
|
||||
# Cluster Corosync
|
||||
exit 0
|
||||
echo "10.8.8.88 truck-coro" >> /etc/hosts
|
||||
echo "10.8.8.90 swutch-coro" >> /etc/hosts
|
||||
echo "10.8.8.87 wall-coro" >> /etc/hosts
|
||||
echo "10.111.111.88 truck-fs" >> /etc/hosts
|
||||
echo "10.111.111.90 swutch-fs" >> /etc/hosts
|
||||
echo "10.111.111.87 wall-fs" >> /etc/hosts
|
||||
|
||||
# Test cluster ping
|
||||
for i in truck-coro swutch-coro wall-coro
|
||||
do ping -q -c1 $i
|
||||
done
|
||||
|
||||
# more stuff
|
||||
apt install postfix
|
||||
|
||||
apt remove os-prober
|
||||
|
||||
# Disable enp3s0 (Autostart no)
|
||||
# set up vmbr0 to the main IP, gateway, etc.
|
||||
# Create Linux Bridge in web interface
|
||||
# vmbr0
|
||||
# 192.168.55.88
|
||||
# 255.255.255.0
|
||||
# Autostart
|
||||
# VLAN Aware
|
||||
# Bridge: enp3s0
|
||||
# Comment Main bridge
|
||||
|
||||
# Test flood multicast on private interface
|
||||
omping -c 10000 -i 0.001 -F -q swutch-coro truck-coro wall-coro
|
||||
# Ten minute test:
|
||||
omping -c 600 -i 1 -q swutch-coro truck-coro wall-coro
|
||||
|
||||
# Set up ssh as root to/from all nodes
|
||||
# Best way to do this ... XXX
|
||||
echo "fookey" >> /root/.ssh/authorized_keys
|
||||
for i in swutch-coro truck-coro wall-coro
|
||||
do ssh $i hostname
|
||||
done
|
||||
|
||||
# Run just on truck:
|
||||
pvecm create red --bindnet0_addr 10.8.8.88 --ring0_addr truck-coro
|
||||
|
||||
# Run on wall:
|
||||
pvecm add 10.8.8.88 --ring0_addr wall-coro
|
||||
|
||||
# Run on swutch:
|
||||
pvecm add 10.8.8.88 --ring0_addr swutch-coro
|
||||
|
||||
# If `tcpdump -vvv -i enp10s0` show bad udp checksums, run this:
|
||||
# XXX ok on truck, wall, swutch
|
||||
ethtool -K enp10s0 gso off
|
||||
ethtool --offload enp10s0 rx off tx off
|
||||
|
||||
# Setup 10.99.99.0/24 addresses for Ceph on enp16s0
|
||||
|
||||
# Run on all nodes:
|
||||
pveceph install --version luminous
|
||||
|
||||
# Run just on one node (truck):
|
||||
pveceph init --network 10.99.99.0/24
|
||||
pveceph createmon
|
||||
|
||||
# Then run on remaining nodes (or via GUI)
|
||||
pveceph createmon
|
||||
|
||||
# On all nodes:
|
||||
pveceph createmr
|
||||
|
||||
# XXX missing ZFS tools
|
||||
apt install zfsutils-linux
|
||||
modprobe zfs
|
||||
|
||||
# Add USB drive to swutch and run on it:
|
||||
# Create a GPT disklabel with fdisk
|
||||
fdisk /dev/sdb
|
||||
# g
|
||||
# w
|
||||
pveceph createosd /dev/sdb
|
||||
|
||||
# XXX actually, remove this and do no auth since it is private network.
|
||||
mkdir /etc/pve/priv/ceph
|
||||
cp -p /etc/pve/priv/ceph.client.admin.keyring /etc/pve/priv/ceph/my-ceph-storage.keyring
|
||||
# Edit on just one node (shared on all)
|
||||
vim /etc/pve/storage.cfg
|
||||
|
||||
# Do this instead of my-ceph-storage.keyring
|
||||
# Edit on one node:
|
||||
vim /etc/pve/ceph.conf
|
||||
auth cluster required = none
|
||||
auth service required = none
|
||||
auth client required = none
|
||||
# restart stuff
|
||||
systemctl stop ceph\*.service ceph\*.target
|
||||
mkdir /etc/pve/priv/ceph/old
|
||||
mv /etc/pve/priv/ceph/*keyring /etc/pve/priv/ceph/old/
|
||||
|
||||
@ -1,11 +0,0 @@
|
||||
# You can add custom logos here, or disable any of the default ones commenting
|
||||
# out its line
|
||||
- { 'name': "Arch Linux", 'path': "images/logos/arch.png"}
|
||||
- { 'name': "CentOS", 'path': "images/logos/centos.png"}
|
||||
- { 'name': "Debian", 'path': "images/logos/debian.png"}
|
||||
- { 'name': "Fedora", 'path': "images/logos/fedora.png"}
|
||||
- { 'name': "Linux", 'path': "images/logos/linux.png"}
|
||||
- { 'name': "Redhat", 'path': "images/logos/redhat.png"}
|
||||
- { 'name': "Ubuntu", 'path': "images/logos/ubuntu.png"}
|
||||
#- { 'name': "Windows XP/2003", 'path': "images/logos/windowsxp.png"}
|
||||
#- { 'name': "Windows 8", 'path': "images/logos/windows8.png"}
|
||||
@ -1,18 +0,0 @@
|
||||
---
|
||||
logo: images/opennebula-5.0.png
|
||||
groups:
|
||||
oneadmin:
|
||||
- admin
|
||||
- admin_vcenter
|
||||
- groupadmin
|
||||
- groupadmin_vcenter
|
||||
- user
|
||||
- cloud
|
||||
- cloud_vcenter
|
||||
default:
|
||||
- cloud
|
||||
default_groupadmin:
|
||||
- groupadmin
|
||||
- cloud
|
||||
labels_groups:
|
||||
default:
|
||||
Loading…
Reference in new issue