rwx.work/rtfd
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
rtfd/in/personal/server/index.rst

402 lines
9.9 KiB
ReStructuredText
Raw Normal View History

private/server
2018-12-19 22:05:42 +00:00
Server
======
Hardware
--------
hw,parts
2018-12-19 22:33:02 +00:00
=== ================================
BHS KS-12
CPU Intel Xeon W3530 4c/8t @ 2.8 GHz
RAM 32 GB DDR3 ECC @ 1333 MHz
HDD 2 × 2 TB
WAN 100 Mbps /128
mac
2019-07-18 18:46:31 +00:00
MAC 00:25:90:7b:d4:38
hw,parts
2018-12-19 22:33:02 +00:00
=== ================================
network
2019-07-15 10:49:21 +00:00
Network
-------
+-----+---------+-------------------------------+
| IP4 | address | 192.99.14.98 |
| +---------+-------------------------------+
| | gateway | 192.99.14.254 |
+-----+---------+-------------------------------+
| IP6 | address | 2607:5300:60:3f62::1 |
| +---------+-------------------------------+
| | gateway | 2607:5300:60:3fff:ff:ff:ff:ff |
+-----+---------+-------------------------------+
rescue
2019-07-14 14:24:36 +00:00
Rescue
------
.. code:: shell
known,todo
2019-07-17 20:08:07 +00:00
ssh-keygen -R rwx.work
ssh-keygen -R 192.99.14.98
rescue
2019-07-14 14:24:36 +00:00
scp /home/user/.ssh/id_ecdsa.pub root@rwx.work:/root/.ssh/authorized_keys
scp /etc/bash.bashrc root@rwx.work:/etc/
hw,parts
2018-12-19 22:33:02 +00:00
Partitions
----------
private/server
2018-12-19 22:05:42 +00:00
.. code:: shell
parted
select /dev/sda
mktable gpt
1m
2019-07-14 07:12:58 +00:00
mkpart boot 1 2
mkpart raid 2 2000399
toggle 1 bios_grub
private/server
2018-12-19 22:05:42 +00:00
select /dev/sdb
mktable gpt
1m
2019-07-14 07:12:58 +00:00
mkpart boot 1 2
mkpart raid 2 2000399
toggle 1 bios_grub
private/server
2018-12-19 22:05:42 +00:00
q
.. code:: shell
mdadm --create /dev/md0 \
raid
2019-07-14 07:24:07 +00:00
--level 0 --raid-devices 2 /dev/sd[ab]2
private/server
2018-12-19 22:05:42 +00:00
.. code:: shell
parted /dev/md0
mktable gpt
raid
2019-07-14 16:24:40 +00:00
mkpart data 1 3966966
mkpart swap 3966966 4000523
private/server
2018-12-19 22:05:42 +00:00
q
.. code:: shell
swap
2019-07-14 16:29:32 +00:00
mkswap --label swap \
-U d8ee4260-4652-7192-7bb3-ebbadeb835a7 \
/dev/md0p2
uuid
2019-07-14 15:36:51 +00:00
mkfs.ext4 -L data \
-U 46527192-7bb3-ebba-deb8-35a7e8606808 \
/dev/md0p1
mkdir,mkstandalone,scp
2019-07-13 14:56:06 +00:00
boot
2019-07-13 14:43:15 +00:00
Boot
----
esp
2019-07-14 19:59:56 +00:00
.. warning:: no ESP boot available!
boot
2019-07-13 14:43:15 +00:00
Prepare a grub.cfg
.. code:: shell
biosdisk
2019-07-14 07:07:55 +00:00
insmod biosdisk
boot
2019-07-13 14:43:15 +00:00
insmod part_gpt
insmod mdraid1x
insmod ext2
insmod search
insmod squash4
insmod loopback
insmod linux
uuid
2019-07-14 15:36:51 +00:00
search --set data --fs-uuid 46527192-7bb3-ebba-deb8-35a7e8606808
up
2019-07-18 18:28:48 +00:00
lmp=/fs/up
boot
2019-07-13 14:43:15 +00:00
sfs=filesystem.squashfs
loopback loop (${data})${lmp}/${sfs}
linux (loop)/vmlinuz \
boot=live \
elevator=deadline \
ip=frommedia \
live-media-path=${lmp} \
toram=${sfs}
initrd (loop)/initrd.img
efi_gop,boot
2019-07-13 17:18:07 +00:00
boot
bios_grub
2019-07-14 01:06:20 +00:00
.. code:: shell
grub-mkstandalone \
--verbose \
--compress xz \
--format i386-pc \
--output core.img \
--themes "" \
boot/grub/grub.cfg=grub.cfg \
--fonts "" \
--locales "" \
--install-modules "\
biosdisk
2019-07-14 07:07:55 +00:00
biosdisk \
bios_grub
2019-07-14 01:06:20 +00:00
part_gpt \
mdraid1x \
ext2 \
search \
squash4 \
loopback \
linux \
"
known,todo
2019-07-17 20:08:07 +00:00
.. todo:: move to public grub
bios_grub
2019-07-14 01:06:20 +00:00
boot
2019-07-13 14:43:15 +00:00
.. code:: shell
mkdir,mkstandalone,scp
2019-07-13 14:56:06 +00:00
grub-mkstandalone \
--verbose \
--compress xz \
--format x86_64-efi \
--output bootx64.efi \
--themes "" \
boot/grub/grub.cfg=grub.cfg
.. code:: shell
bios_grub
2019-07-14 01:06:20 +00:00
scp core.img root@rwx.work:
cp /usr/lib/grub/i386-pc/boot.img . \
/usr/lib/grub/i386-pc/grub-bios-setup \
--directory . /dev/sda
/usr/lib/grub/i386-pc/grub-bios-setup \
--directory . /dev/sdb
live-list
2019-07-13 15:11:23 +00:00
squashfs steps
2019-07-17 20:14:44 +00:00
* debootstrap
* apt
* fstab /d
* systemd
* linux-image
* tops
* hardware
* completion
* network
* interfaces
* basics
* openssh-server fixes (sshd user, /run/sshd)
* live-boot
* root
* inception
* bridge
grub-pc-bin
2019-07-18 18:35:04 +00:00
* grub-pc-bin
aa,br0,config
2019-07-18 20:58:02 +00:00
* apparmor
unbound
2019-07-18 21:00:33 +00:00
* unbound
tree
2019-07-18 21:04:16 +00:00
* tree
forward
2019-07-18 21:08:30 +00:00
* net.ipv4.ip_forward=1
* net.ipv6.conf.all.forwarding=1
nftables
2019-07-18 21:33:50 +00:00
* nftables
nginx,warning,config
2019-07-20 20:38:39 +00:00
* nginx
nftables
2019-07-21 15:35:05 +00:00
* root/user authorized_keys
* curl
swap
2019-07-21 15:55:50 +00:00
* swap,swappiness
enable
2019-07-21 18:01:04 +00:00
* enable nftables.service
server/syslog
2019-08-05 10:56:22 +00:00
* enable lxc.service
* sources.list file:/
* syslog-ng
squashfs steps
2019-07-17 20:14:44 +00:00
addendum
2019-07-15 20:38:11 +00:00
* /etc/bash.bashrc
* /etc/fstab (/d)
locale-gen
2019-07-13 15:12:14 +00:00
* /etc/locale.gen
* locale-gen
* /etc/resolv.conf
apt,lxc
2019-07-15 20:11:45 +00:00
* /etc/apt/apt.conf
network
2019-07-13 20:31:28 +00:00
* /etc/apt/sources.list
live-list
2019-07-13 15:11:23 +00:00
* apt update
* apt upgrade
addendum
2019-07-15 20:38:11 +00:00
* live-boot
* update-initramfs ← update-initramfs.orig
* openssh-server
* parted
* squashfs-tools
* tree
live-list
2019-07-13 15:11:23 +00:00
* apt clean
* /etc/ssh/sshd_config
* mkdir /root/.ssh
* echo "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFBp8vFUIRu4Bq8EvnCGwlp71GQ4wGT5wKdY1X/c9AfYjsn/pnBNgnfNFxPxoNasG1MXeXjutSLtlXqnsWx2NQpFQC321MeUvd3Z/DCeIvS4WvpOZMyBvVUd2sTsuuCRVuH3fbJF5XPJrFzH3nEFNtcW7lmN+F6nKLB0kYahc3+gyTH+g==" > /root/.ssh/authorized_keys
apt,lxc
2019-07-15 20:11:45 +00:00
* lxc
network
2019-07-13 20:31:28 +00:00
* /etc/network/interfaces.d/setup
dhcp
2019-07-14 19:57:33 +00:00
.. warning:: inet6 dhcp hangs!
network
2019-07-13 20:31:28 +00:00
::
iface
2019-07-13 22:04:54 +00:00
auto lo
network
2019-07-13 20:31:28 +00:00
iface lo inet loopback
iface lo inet6 loopback
aa,br0,config
2019-07-18 20:58:02 +00:00
auto br0
iface br0 inet static
address 10.0.0.254/24
bridge_fd 0
bridge_maxwait 0
bridge_ports enp1s0
bridge_stp on
iface br0 inet static
network
2019-07-13 20:31:28 +00:00
address 192.99.14.98/24
gateway 192.99.14.254
aa,br0,config
2019-07-18 20:58:02 +00:00
iface br0 inet6 static
network
2019-07-13 20:31:28 +00:00
address 2607:5300:60:3f62::1/64
gateway 2607:5300:60:3fff:ff:ff:ff:ff
aa,br0,config
2019-07-18 20:58:02 +00:00
nginx,warning,config
2019-07-20 20:38:39 +00:00
.. warning::
reboot from container doesn't reload config file
/var/lib/lxc/config
aa,br0,config
2019-07-18 20:58:02 +00:00
::
nginx,warning,config
2019-07-20 20:38:39 +00:00
lxc.include = /usr/share/lxc/config/common.conf
lxc.mount.entry = /d/mirrors/apt-mirror/debian deb none bind,create=dir,ro 0 0
lxc.start.auto = 1
aa,br0,config
2019-07-18 20:58:02 +00:00
lxc.net.0.type = veth
lxc.net.0.flags = up
lxc.net.0.link = br0
nginx,warning,config
2019-07-20 20:38:39 +00:00
/var/lib/lxc/name/config
::
lxc.include = /var/lib/lxc/config
nftables
2019-07-21 15:35:05 +00:00
lxc.mount.entry = /d/d/buster d none bind,create=dir,rw 0 0
nginx,warning,config
2019-07-20 20:38:39 +00:00
lxc.rootfs.path = dir:/var/lib/lxc/buster
pair
2019-07-18 21:58:31 +00:00
lxc.net.0.veth.pair = buster
aa,br0,config
2019-07-18 20:58:02 +00:00
lxc.net.0.ipv4.address = 10.0.0.1/24
lxc.net.0.ipv4.gateway = 10.0.0.254
nftables
2019-07-21 15:35:05 +00:00
/etc/nftables.conf
::
#! /usr/sbin/nft --file
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy accept;
iifname "lo" accept
ip protocol icmp accept
icmp
2019-07-21 17:44:03 +00:00
ip6 nexthdr icmp accept
nftables
2019-07-21 15:35:05 +00:00
tcp dport ssh accept
tcp dport domain accept
tcp dport http accept
tcp dport https accept
}
chain forward {
type filter hook forward priority 0; policy accept;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 0; policy accept;
tcp dport 65001 dnat to 10.0.0.1:ssh
}
chain postrouting {
type nat hook postrouting priority 0; policy accept;
masquerade
}
}
server/certificate
2019-08-04 14:17:16 +00:00
server/web/sites
2019-08-04 14:22:15 +00:00
Web
---
Sites
^^^^^
::
ssl_certificate /etc/nginx/rwx.work/bundle.crt;
ssl_certificate_key /etc/nginx/rwx.work/key.pem;
server {
server/web/http2
2019-08-04 18:31:41 +00:00
listen 443 ssl http2;
listen [::]:443 ssl http2;
server/web/sites
2019-08-04 14:22:15 +00:00
server_name deb.rwx.work;
root /d/mirrors/apt-mirror/debian;
autoindex on;
}
server {
server/web/http2
2019-08-04 18:31:41 +00:00
listen 443 default_server ssl http2;
listen [::]:443 default_server ssl http2;
server/web/sites
2019-08-04 14:22:15 +00:00
server_name .rwx.work;
location / {
proxy_pass http://10.0.0.1/;
}
}
server/certificate
2019-08-04 14:17:16 +00:00
Certificate
server/web/sites
2019-08-04 14:22:15 +00:00
^^^^^^^^^^^
server/certificate
2019-08-04 14:17:16 +00:00
* /etc/nginx/rwx.work
* key.pem
* bundle.crt
::
indent
2019-08-04 14:18:25 +00:00
-----BEGIN CERTIFICATE-----
MIIGVTCCBT2gAwIBAgISAxK7abRAlgNZ1QfhWkuBbd/yMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xOTA4MDQxMjU2MzFaFw0x
OTExMDIxMjU2MzFaMBUxEzARBgNVBAMMCioucnd4LndvcmswggIiMA0GCSqGSIb3
DQEBAQUAA4ICDwAwggIKAoICAQDnX5lshzKsh9eiFaCxJqJ9Oh7yc9x/br2uIzdG
iBoOMVmHNB+3t67JVbFJ/RA38HZ29g2CDyJjY5z7VfdsUxs4caFKExwlXCujNtWS
Exj1LO4Y4ykvkQhhbkWgThDiREZv+FNw/D8cV6KjNFrx5QKHjKW++GRCJKl5+9dr
YXSCKld0ejFckd5WwajKCAto6ugfayLK/qf4CYj/na1UrgP3a1BSgMrDVdHIjACB
khoujVL+tTgNUPBwSR8s5whCaOKdVU4mBO36qc08hQAwqa94ye2ltDDVFULm62vF
LW5SeGpjIEaPAsk5xNdjOnm5HlIJjvmNo8m0qiWJ8rcjVxGWJzMmu8JzvZbmy/k+
G242C+ECuSAVMPBBZLn28Rc7Lr6YtmEo3phhdwSEDXTnlyluYtVq5Q6B2Iwwbdsb
WUa00unUHNDEmOTp6njy/K9vhJF82FyVxXQoCBqAbN8tSk/rshTYDYDPnjcZGi5R
okK7m7qeRfDiyLGvuF0xUKFODSuNYmnu2Q4WDNGTXXwsEloIvLflKKYz5vqbQ2f1
Il/tKEM0Ok9CUcj1Ty1GdNt3gCLucC8eI22t3QstUla/wiMtoAWeydzi3dneIrQ7
SmJ6rfBIxVUXGUFKlsRVBPbFbDj9kEsIUY5pUfUnDYIYVCjqm1F+XGMgGt+nMkaV
exuI0QIDAQABo4ICaDCCAmQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRf3Sg57QsE
XePyTwCeSEZ7YyA0BDAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBv
BggrBgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5s
ZXRzZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5s
ZXRzZW5jcnlwdC5vcmcvMB8GA1UdEQQYMBaCCioucnd4LndvcmuCCHJ3eC53b3Jr
MEwGA1UdIARFMEMwCAYGZ4EMAQIBMDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUH
AgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIIBAwYKKwYBBAHWeQIEAgSB
9ASB8QDvAHYAKTxRllTIOWW6qlD8WAfUt2+/WHopctykwwz05UVH9HgAAAFsXOrd
qgAABAMARzBFAiEAwlPkETp6PtvOY2LgY4j2SAjCRYWgTLwVLVtZs+cQHGcCICk6
O3HBqxEugr/onac7MudZow4YhRBCwVIOYsq8q42sAHUAdH7agzGtMxCRIZzOJU9C
cMK//V5CIAjGNzV55hB7zFYAAAFsXOrfgQAABAMARjBEAiBMJwKp49s6GmgCkn0I
It+05HN8zYhde6Rw5F3KS16r/QIgWL5LHcjdi5pkrEhyr6vWCQg3oO3T/oZusPDu
Z3NSsNgwDQYJKoZIhvcNAQELBQADggEBADHetLlUkXFuxk0Yb/PPeErezRCFuwrj
34mzb4Rbgzv5vmSCPhNKqVC//j6ocrF+oA0VFbYncgX4Wugi7SXNR9vOhMxg0a//
SkjveXQQ7zAm52NvjGm0Lc25sLXszVvef2T4haBNgB9osIFiLfOHewyFBFOnIvWS
yu3Alrwo6xuxZSPLvrCJZlXpiNmJN684KJEvDT8Y9tlWTBHxQl+sP8IpF8EuV9oA
Jbrdj7ZhE9guk/y0D/evYU4irV+8sC7pWPdZDLCcqk9X2WLsbyWYqbTQb5c9cLZn
OOA0WMwsL9Ly8AAbk1c41mJOKOuvv2+XzVY/NPU3uZCWOXlhqtWyusw=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----
Reference in a new issue Copy permalink