WIP: refonte documentation
This commit is contained in:
parent
8c4ec33a81
commit
7dc4af5760
Binary file not shown.
|
|
@ -1,118 +0,0 @@
|
||||||
# Machine virtuelle AUDIO
|
|
||||||
|
|
||||||
## Système
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 1
|
|
||||||
RAM : 957384 KB
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
Swap : désactivé
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : dns.libre-en-communs.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.186
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::186
|
|
||||||
|
|
||||||
## Serveur web (installation basique)
|
|
||||||
Installation d'un service nginx pour :
|
|
||||||
- la gestion des certificats SSL ;
|
|
||||||
- l'installation d'une page d'information sur comment se connecter au Mumble ;
|
|
||||||
- la possible installation d'un service client web pour Mumble ;
|
|
||||||
- l'éventuel déploiement de StatoolInfos ;
|
|
||||||
- …
|
|
||||||
|
|
||||||
Installer les paquets :
|
|
||||||
```
|
|
||||||
apt-get install nginx python3-certbot-nginx
|
|
||||||
```
|
|
||||||
|
|
||||||
Ouvrir les ports http (80) et https (443) :
|
|
||||||
```
|
|
||||||
ufw allow 'Nginx HTTP'
|
|
||||||
ufw allow 'Nginx HTTPS'
|
|
||||||
```
|
|
||||||
|
|
||||||
Configurer a minima le site web dans `/etc/nginx/sites-available/audio.a-lec.org` :
|
|
||||||
```
|
|
||||||
server
|
|
||||||
{
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
|
|
||||||
server_name audio.a-lec.org;
|
|
||||||
|
|
||||||
access_log /var/log/nginx/audio.a-lec.org-access.log;
|
|
||||||
error_log /var/log/nginx/audio.a-lec.org-error.log;
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
Activer la configuration :
|
|
||||||
```
|
|
||||||
cd /etc/nginx/sites-enabled/
|
|
||||||
ln -s ../sites-available/audio.a-lec.org
|
|
||||||
```
|
|
||||||
|
|
||||||
Vérifier que c'est bon et recharger :
|
|
||||||
```
|
|
||||||
nginx -t && systemctl reload nginx
|
|
||||||
```
|
|
||||||
|
|
||||||
Configurer le certificat SSl :
|
|
||||||
```
|
|
||||||
certbot --nginx
|
|
||||||
```
|
|
||||||
|
|
||||||
Mettre beau le fichier `/etc/nginx/sites-enabled/audio.a-lec.org` :
|
|
||||||
```
|
|
||||||
server
|
|
||||||
{
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
|
|
||||||
server_name audio.a-lec.org;
|
|
||||||
|
|
||||||
access_log /var/log/nginx/audio.a-lec.org-access.log;
|
|
||||||
error_log /var/log/nginx/audio.a-lec.org-error.log;
|
|
||||||
|
|
||||||
return 302 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
server
|
|
||||||
{
|
|
||||||
set_real_ip_from 192.169.1.1;
|
|
||||||
real_ip_header proxy_protocol;
|
|
||||||
listen [::]:443 ssl ipv6only=on;
|
|
||||||
listen 443 ssl;
|
|
||||||
|
|
||||||
server_name audio.a-lec.org;
|
|
||||||
|
|
||||||
access_log /var/log/nginx/audio.a-lec.org-access.log;
|
|
||||||
error_log /var/log/nginx/audio.a-lec.org-error.log;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/audio.a-lec.org/fullchain.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/audio.a-lec.org/privkey.pem; # managed by Certbot
|
|
||||||
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
||||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
||||||
|
|
||||||
root /var/www/audio.a-lec.org;
|
|
||||||
location = /
|
|
||||||
{
|
|
||||||
index index.xhtml;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
Vérifier que c'est bon et recharger :
|
|
||||||
```
|
|
||||||
nginx -t && systemctl reload nginx
|
|
||||||
```
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
## Machine virtuelle DNS
|
|
||||||
|
|
||||||
Cette machine est le serveur DNS autorité de l'association.
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : xxx
|
|
||||||
RAM : xxx Mio
|
|
||||||
Stockage de masse : 10 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
DNS : `bind`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : dns.libre-en-communs.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.242
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::242
|
|
||||||
|
|
||||||
### Configuration système de fichier partagé en écriture
|
|
||||||
|
|
||||||
#### /etc/fstab (extrait)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
/vm_sharedfs /opt/vm_sharedfs 9p trans=virtio,version=9p2000.L,rw 0 0
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
@ -1,328 +0,0 @@
|
||||||
## Machine virtuelle GENERIC
|
|
||||||
|
|
||||||
#### (c'est-à-dire le modèle de toutes les machines virtuelles)
|
|
||||||
|
|
||||||
...
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 1
|
|
||||||
RAM : 1000 Mio
|
|
||||||
Stockage de masse : 50 Gio (fichier `sparse` i.e les zéros ne sont pas écrits sur le disque)
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : dns.libre-en-communs.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.4
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::4
|
|
||||||
|
|
||||||
### Configuration réseau
|
|
||||||
|
|
||||||
#### /etc/network/interfaces
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# This file describes the network interfaces available on your system
|
|
||||||
# and how to activate them. For more information, see interfaces(5).
|
|
||||||
|
|
||||||
source /etc/network/interfaces.d/*
|
|
||||||
|
|
||||||
# The loopback network interface
|
|
||||||
auto lo
|
|
||||||
iface lo inet loopback
|
|
||||||
|
|
||||||
# The primary network interface
|
|
||||||
allow-hotplug enp1s0
|
|
||||||
iface enp1s0 inet static
|
|
||||||
address 192.168.1.4/32
|
|
||||||
broadcast 192.168.255.255
|
|
||||||
gateway 192.168.0.1
|
|
||||||
netmask 255.255.0.0
|
|
||||||
|
|
||||||
iface enp1s0 inet6 static
|
|
||||||
address 2001:910:1021::4/128
|
|
||||||
gateway 2001:910:1021::
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration SSH
|
|
||||||
|
|
||||||
#### /etc/ssh/sshd_config
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
|
||||||
|
|
||||||
# This is the sshd server system-wide configuration file. See
|
|
||||||
# sshd_config(5) for more information.
|
|
||||||
|
|
||||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
|
||||||
|
|
||||||
Port 22
|
|
||||||
AddressFamily any
|
|
||||||
ListenAddress 0.0.0.0
|
|
||||||
ListenAddress ::
|
|
||||||
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
PasswordAuthentication no
|
|
||||||
PermitEmptyPasswords no
|
|
||||||
|
|
||||||
ChallengeResponseAuthentication no
|
|
||||||
|
|
||||||
UsePAM yes
|
|
||||||
|
|
||||||
PrintMotd no
|
|
||||||
|
|
||||||
AcceptEnv LANG LC_* GIT_*
|
|
||||||
|
|
||||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
||||||
|
|
||||||
Match Group ssh-login
|
|
||||||
PasswordAuthentication yes
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
#### /etc/hosts.allow
|
|
||||||
|
|
||||||
sshd: 192.168.1.0/24, [2001:910:1021::]/48
|
|
||||||
|
|
||||||
#### /etc/hosts.deny
|
|
||||||
|
|
||||||
sshd: ALL
|
|
||||||
|
|
||||||
### Pare-feu
|
|
||||||
|
|
||||||
Installation :
|
|
||||||
```
|
|
||||||
apt-get install ufw
|
|
||||||
```
|
|
||||||
|
|
||||||
Ouvrir le port SSH :
|
|
||||||
```
|
|
||||||
ufw allow SSH
|
|
||||||
ufw enable
|
|
||||||
systemclt enable ufw
|
|
||||||
```
|
|
||||||
### Configuration SUDO
|
|
||||||
|
|
||||||
#### /etc/sudoers
|
|
||||||
<details>
|
|
||||||
|
|
||||||
#
|
|
||||||
# This file MUST be edited with the 'visudo' command as root.
|
|
||||||
#
|
|
||||||
# Please consider adding local content in /etc/sudoers.d/ instead of
|
|
||||||
# directly modifying this file.
|
|
||||||
#
|
|
||||||
# See the man page for details on how to write a sudoers file.
|
|
||||||
#
|
|
||||||
Defaults env_reset
|
|
||||||
Defaults env_keep += "GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL"
|
|
||||||
Defaults mail_badpass, insults
|
|
||||||
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
|
||||||
|
|
||||||
# Host alias specification
|
|
||||||
|
|
||||||
# User alias specification
|
|
||||||
|
|
||||||
# Cmnd alias specification
|
|
||||||
|
|
||||||
# User privilege specification
|
|
||||||
root ALL=(ALL:ALL) ALL
|
|
||||||
|
|
||||||
# Allow members of group sudo to execute any command
|
|
||||||
%sudo ALL=(ALL:ALL) NOPASSWD:ALL
|
|
||||||
|
|
||||||
# See sudoers(5) for more information on "#include" directives:
|
|
||||||
|
|
||||||
#includedir /etc/sudoers.d
|
|
||||||
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration MTA
|
|
||||||
|
|
||||||
#### /etc/postfix/transport
|
|
||||||
|
|
||||||
a-lec.org :
|
|
||||||
* discard:
|
|
||||||
|
|
||||||
#### /etc/postfix/virtual
|
|
||||||
|
|
||||||
@localhost admin@a-lec.org
|
|
||||||
@generic.a-lec.org admin@a-lec.org
|
|
||||||
|
|
||||||
### Configuration système de fichier partagé
|
|
||||||
|
|
||||||
#### /etc/fstab (extrait)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
tmpfs /tmp tmpfs mode=1777,nosuid,nodev 0 0
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
|
|
||||||
### Configurations bashrc
|
|
||||||
|
|
||||||
#### /etc/skel/.bashrc (et /home/admin666/.bashrc)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# ~/.bashrc: executed by bash(1) for non-login shells.
|
|
||||||
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
|
|
||||||
# for examples
|
|
||||||
|
|
||||||
# If not running interactively, don't do anything
|
|
||||||
case $- in
|
|
||||||
*i*) ;;
|
|
||||||
*) return;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
# don't put duplicate lines or lines starting with space in the history.
|
|
||||||
# See bash(1) for more options
|
|
||||||
HISTCONTROL=ignoreboth
|
|
||||||
|
|
||||||
# append to the history file, don't overwrite it
|
|
||||||
shopt -s histappend
|
|
||||||
|
|
||||||
# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
|
|
||||||
HISTSIZE=1000
|
|
||||||
HISTFILESIZE=2000
|
|
||||||
|
|
||||||
# check the window size after each command and, if necessary,
|
|
||||||
# update the values of LINES and COLUMNS.
|
|
||||||
shopt -s checkwinsize
|
|
||||||
|
|
||||||
# If set, the pattern "**" used in a pathname expansion context will
|
|
||||||
# match all files and zero or more directories and subdirectories.
|
|
||||||
#shopt -s globstar
|
|
||||||
|
|
||||||
# make less more friendly for non-text input files, see lesspipe(1)
|
|
||||||
#[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
|
|
||||||
|
|
||||||
# set variable identifying the chroot you work in (used in the prompt below)
|
|
||||||
if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
|
|
||||||
debian_chroot=$(cat /etc/debian_chroot)
|
|
||||||
fi
|
|
||||||
|
|
||||||
# set a fancy prompt (non-color, unless we know we "want" color)
|
|
||||||
case "$TERM" in
|
|
||||||
xterm-color|*-256color) color_prompt=yes;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
# uncomment for a colored prompt, if the terminal has the capability; turned
|
|
||||||
# off by default to not distract the user: the focus in a terminal window
|
|
||||||
# should be on the output of commands, not on the prompt
|
|
||||||
#force_color_prompt=yes
|
|
||||||
|
|
||||||
if [ -n "$force_color_prompt" ]; then
|
|
||||||
if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
|
|
||||||
# We have color support; assume it's compliant with Ecma-48
|
|
||||||
# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
|
|
||||||
# a case would tend to support setf rather than setaf.)
|
|
||||||
color_prompt=yes
|
|
||||||
else
|
|
||||||
color_prompt=
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$color_prompt" = yes ]; then
|
|
||||||
PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\H\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
|
|
||||||
else
|
|
||||||
PS1='${debian_chroot:+($debian_chroot)}\u@\H:\w\$ '
|
|
||||||
fi
|
|
||||||
unset color_prompt force_color_prompt
|
|
||||||
|
|
||||||
# If this is an xterm set the title to user@host:dir
|
|
||||||
case "$TERM" in
|
|
||||||
xterm*|rxvt*)
|
|
||||||
PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\H: \w\a\]$PS1"
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
# enable color support of ls and also add handy aliases
|
|
||||||
if [ -x /usr/bin/dircolors ]; then
|
|
||||||
test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
|
|
||||||
alias ls='ls --color=auto'
|
|
||||||
alias dir='dir --color=auto'
|
|
||||||
alias vdir='vdir --color=auto'
|
|
||||||
|
|
||||||
alias grep='grep --color=auto'
|
|
||||||
alias fgrep='fgrep --color=auto'
|
|
||||||
alias egrep='egrep --color=auto'
|
|
||||||
fi
|
|
||||||
|
|
||||||
# colored GCC warnings and errors
|
|
||||||
#export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'
|
|
||||||
|
|
||||||
# some more ls aliases
|
|
||||||
alias ll='ls -l'
|
|
||||||
alias la='ls -A'
|
|
||||||
#alias l='ls -CF'
|
|
||||||
|
|
||||||
# Alias definitions.
|
|
||||||
# You may want to put all your additions into a separate file like
|
|
||||||
# ~/.bash_aliases, instead of adding them here directly.
|
|
||||||
# See /usr/share/doc/bash-doc/examples in the bash-doc package.
|
|
||||||
|
|
||||||
if [ -f ~/.bash_aliases ]; then
|
|
||||||
. ~/.bash_aliases
|
|
||||||
fi
|
|
||||||
|
|
||||||
# enable programmable completion features (you don't need to enable
|
|
||||||
# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
|
|
||||||
# sources /etc/bash.bashrc).
|
|
||||||
if ! shopt -oq posix; then
|
|
||||||
if [ -f /usr/share/bash-completion/bash_completion ]; then
|
|
||||||
. /usr/share/bash-completion/bash_completion
|
|
||||||
elif [ -f /etc/bash_completion ]; then
|
|
||||||
. /etc/bash_completion
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
#### /root/.bashrc
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# ~/.bashrc: executed by bash(1) for non-login shells.
|
|
||||||
|
|
||||||
# Note: PS1 and umask are already set in /etc/profile. You should not
|
|
||||||
# need this unless you want different defaults for root.
|
|
||||||
# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ '
|
|
||||||
PS1='\[\033[01;32m\]=(^-^)=${debian_chroot:+($debian_chroot)}\[\033[01;31m\]\u@\H\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
|
|
||||||
# umask 022
|
|
||||||
|
|
||||||
# You may uncomment the following lines if you want `ls' to be colorized:
|
|
||||||
export LS_OPTIONS='--color=auto'
|
|
||||||
# eval "`dircolors`"
|
|
||||||
alias ls='ls $LS_OPTIONS'
|
|
||||||
alias ll='ls $LS_OPTIONS -l'
|
|
||||||
alias l='ls $LS_OPTIONS -lA'
|
|
||||||
#
|
|
||||||
# Some more alias to avoid making mistakes:
|
|
||||||
# alias rm='rm -i'
|
|
||||||
# alias cp='cp -i'
|
|
||||||
# alias mv='mv -i'
|
|
||||||
|
|
||||||
# enable programmable completion features (you don't need to enable
|
|
||||||
# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
|
|
||||||
# sources /etc/bash.bashrc).
|
|
||||||
if ! shopt -oq posix; then
|
|
||||||
if [ -f /usr/share/bash-completion/bash_completion ]; then
|
|
||||||
. /usr/share/bash-completion/bash_completion
|
|
||||||
elif [ -f /etc/bash_completion ]; then
|
|
||||||
. /etc/bash_completion
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
|
|
@ -1,117 +0,0 @@
|
||||||
## Machine virtuelle GESTION
|
|
||||||
|
|
||||||
Cette machine est destinée à accueillir le logiciel de comptabilité et gestion des membres de l'association.
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 4
|
|
||||||
RAM : 3000 Mio
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Compta et gestion des membres : `garradin`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : gestion.a-lec.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.236
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::236
|
|
||||||
|
|
||||||
### Configuration serveur web (nginx)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
server {
|
|
||||||
server_name coffre.a-lec.org;
|
|
||||||
|
|
||||||
set_real_ip_from 192.169.1.1;
|
|
||||||
real_ip_header proxy_protocol;
|
|
||||||
|
|
||||||
# Allow large attachments
|
|
||||||
client_max_body_size 128M;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
proxy_pass http://127.0.0.1:8000;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /notifications/hub {
|
|
||||||
proxy_pass http://127.0.0.1:3012;
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection "upgrade";
|
|
||||||
}
|
|
||||||
|
|
||||||
location /notifications/hub/negotiate {
|
|
||||||
proxy_pass http://127.0.0.1:8000;
|
|
||||||
}
|
|
||||||
|
|
||||||
listen 443 ssl http2 proxy_protocol; # managed by Certbot
|
|
||||||
listen [::]:443 ssl http2; # managed by Certbot
|
|
||||||
ssl_certificate /etc/letsencrypt/live/coffre.a-lec.org/fullchain.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/coffre.a-lec.org/privkey.pem; # managed by Certbot
|
|
||||||
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
||||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
if ($host = coffre.a-lec.org) {
|
|
||||||
return 302 https://$host$request_uri;
|
|
||||||
} # managed by Certbot
|
|
||||||
|
|
||||||
server_name coffre.a-lec.org;
|
|
||||||
|
|
||||||
listen 80;
|
|
||||||
return 404; # managed by Certbot
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
|
|
||||||
root /usr/share/garradin/www; # Remplacer par le chemin adéquat vers le dossier public de garradin (ici c'est le défaut du paquet Debian)
|
|
||||||
|
|
||||||
server_name gestion.a-lec.org; # Remplacer par votre nom de domaine
|
|
||||||
|
|
||||||
set_real_ip_from 192.169.1.1;
|
|
||||||
real_ip_header proxy_protocol;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
try_files $uri $uri/ /_route.php?$query_string;
|
|
||||||
index index.php /_route.php;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ~ \.php {
|
|
||||||
try_files $uri $uri/ /_route.php?$query_string;
|
|
||||||
include fastcgi.conf;
|
|
||||||
#fastcgi_pass 127.0.0.1:9000; # Si vous utilisez PHP-FPM (ou autre) en mode TCP et non sur une socket
|
|
||||||
fastcgi_pass unix:/var/run/php/php7.4-garradin.sock; # Si vous utilisez PHP-FPM en mode socket
|
|
||||||
}
|
|
||||||
|
|
||||||
listen 443 ssl proxy_protocol; # managed by Certbot
|
|
||||||
listen [::]:443 ssl;
|
|
||||||
ssl_certificate /etc/letsencrypt/live/gestion.a-lec.org/fullchain.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/gestion.a-lec.org/privkey.pem; # managed by Certbot
|
|
||||||
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
||||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
if ($host = gestion.a-lec.org) {
|
|
||||||
return 302 https://$host$request_uri;
|
|
||||||
} # managed by Certbot
|
|
||||||
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
|
|
||||||
server_name gestion.a-lec.org;
|
|
||||||
return 404; # managed by Certbot
|
|
||||||
}
|
|
||||||
</details>
|
|
||||||
|
|
@ -1,96 +0,0 @@
|
||||||
## Machine virtuelle GIT
|
|
||||||
|
|
||||||
Cette machine est destinée à accueillir la forge logicielle de l'association, qui permet à différents projets de bénéficier d'un outil de travail supportant des fonctions avancées (comme la CI et les hooks avancés), mais également à l'association de publier différents documents nécessaire à son activité.
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 2
|
|
||||||
RAM : 4096 Mio
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Forge logicielle : `gitlab-ce`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : git.a-lec.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.131
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::131
|
|
||||||
|
|
||||||
### Configuration serveur web (nginx)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# GITLAB
|
|
||||||
|
|
||||||
upstream gitlab-workhorse {
|
|
||||||
# On GitLab versions before 13.5, the location is
|
|
||||||
# `/var/opt/gitlab/gitlab-workhorse/socket`. Change the following line
|
|
||||||
# accordingly.
|
|
||||||
server unix:/var/opt/gitlab/gitlab-workhorse/sockets/socket fail_timeout=0;
|
|
||||||
}
|
|
||||||
|
|
||||||
## Redirects all HTTP traffic to the HTTPS host
|
|
||||||
server {
|
|
||||||
## Either remove "default_server" from the listen line below,
|
|
||||||
## or delete the /etc/nginx/sites-enabled/default file. This will cause gitlab
|
|
||||||
## to be served if you visit any address that your server responds to, eg.
|
|
||||||
## the ip address of the server (http://x.x.x.x/)
|
|
||||||
listen 0.0.0.0:80;
|
|
||||||
listen [::]:80 ipv6only=on default_server;
|
|
||||||
server_name git.a-lec.org; ## Replace this with something like gitlab.example.com
|
|
||||||
server_tokens off; ## Don't show the nginx version number, a security best practice
|
|
||||||
return 302 https://git.a-lec.org$request_uri;
|
|
||||||
access_log /var/log/nginx/gitlab_access.log;
|
|
||||||
error_log /var/log/nginx/gitlab_error.log;
|
|
||||||
}
|
|
||||||
|
|
||||||
## HTTPS host
|
|
||||||
server {
|
|
||||||
set_real_ip_from 192.169.1.1;
|
|
||||||
real_ip_header proxy_protocol;
|
|
||||||
listen 0.0.0.0:443 ssl proxy_protocol;
|
|
||||||
listen [::]:443 ipv6only=on ssl default_server;
|
|
||||||
server_name git.a-lec.org; ## Replace this with something like gitlab.example.com
|
|
||||||
server_tokens off; ## Don't show the nginx version number, a security best practice
|
|
||||||
root /opt/gitlab/embedded/service/gitlab-rails/public;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/git.a-lec.org/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/git.a-lec.org/privkey.pem;
|
|
||||||
|
|
||||||
## [Optional] Enable HTTP Strict Transport Security
|
|
||||||
## HSTS is a feature improving protection against MITM attacks
|
|
||||||
## For more information see: https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
|
|
||||||
|
|
||||||
## Individual nginx logs for this GitLab vhost
|
|
||||||
access_log /var/log/nginx/gitlab_access.log;
|
|
||||||
error_log /var/log/nginx/gitlab_error.log;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
client_max_body_size 0;
|
|
||||||
gzip off;
|
|
||||||
|
|
||||||
## https://github.com/gitlabhq/gitlabhq/issues/694
|
|
||||||
## Some requests take more than 30 seconds.
|
|
||||||
proxy_read_timeout 300;
|
|
||||||
proxy_connect_timeout 300;
|
|
||||||
proxy_redirect off;
|
|
||||||
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
|
|
||||||
proxy_set_header Host $http_host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-Ssl on;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_pass http://gitlab-workhorse;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
@ -1,163 +0,0 @@
|
||||||
## Machine virtuelle MAIL
|
|
||||||
|
|
||||||
Cette machine est destinée à accueillir le serveur d'envoi, réception et consultation de courriel de l'association.
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 2
|
|
||||||
RAM : 1000 Mio
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Serveur IMAP (et authentification) : `courier`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
Webmail : `roundcube` (**upstream**)
|
|
||||||
Serveur http : `nginx`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : mail.a-lec.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.201
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::201
|
|
||||||
|
|
||||||
### Configuration MTA
|
|
||||||
|
|
||||||
<details>
|
|
||||||
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
|
|
||||||
|
|
||||||
|
|
||||||
\# Debian specific: Specifying a file name will cause the first
|
|
||||||
\# line of that file to be used as the name. The Debian default
|
|
||||||
\# is /etc/mailname.
|
|
||||||
\#myorigin = /etc/mailname
|
|
||||||
|
|
||||||
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
|
|
||||||
biff = no
|
|
||||||
|
|
||||||
\# appending .domain is the MUA's job.
|
|
||||||
append_dot_mydomain = no
|
|
||||||
|
|
||||||
\# Uncomment the next line to generate "delayed mail" warnings
|
|
||||||
\#delay_warning_time = 4h
|
|
||||||
|
|
||||||
readme_directory = no
|
|
||||||
|
|
||||||
\# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
|
|
||||||
\# fresh installs.
|
|
||||||
compatibility_level = 2
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
\# TLS parameters
|
|
||||||
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.a-lec.org/fullchain.pem
|
|
||||||
smtpd_tls_key_file=/etc/letsencrypt/live/mail.a-lec.org/privkey.pem
|
|
||||||
smtpd_tls_security_level = may
|
|
||||||
smtpd_tls_auth_only = yes
|
|
||||||
smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
|
|
||||||
smtpd_tls_protocols=!SSLv2,!SSLv3
|
|
||||||
smtpd_tls_loglevel = 1
|
|
||||||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
|
||||||
|
|
||||||
smtp_tls_cert_file=/etc/letsencrypt/live/mail.a-lec.org/fullchain.pem
|
|
||||||
smtp_tls_key_file=/etc/letsencrypt/live/mail.a-lec.org/privkey.pem
|
|
||||||
smtp_tls_security_level = may
|
|
||||||
smtp_tls_note_starttls_offer = yes
|
|
||||||
smtp_tls_mandatory_protocols=!SSLv2,!SSLv3
|
|
||||||
smtp_tls_protocols=!SSLv2,!SSLv3
|
|
||||||
smtp_tls_loglevel = 1
|
|
||||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
|
||||||
|
|
||||||
|
|
||||||
\# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
|
|
||||||
\# information on enabling SSL in the smtp client.
|
|
||||||
|
|
||||||
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
|
|
||||||
smtpd_sender_restrictions = reject_unknown_sender_domain
|
|
||||||
myhostname = mail.a-lec.org
|
|
||||||
alias_maps = hash:/etc/aliases
|
|
||||||
alias_database = hash:/etc/aliases
|
|
||||||
myorigin = /etc/mailname
|
|
||||||
mydestination = $myhostname, a-lec.org, mail.a-lec.org, localhost, os-k.eu
|
|
||||||
relayhost =
|
|
||||||
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.169.1.0/24
|
|
||||||
mailbox_size_limit = 0
|
|
||||||
recipient_delimiter = +
|
|
||||||
inet_interfaces = all
|
|
||||||
inet_protocols = all
|
|
||||||
home_mailbox = Maildir/
|
|
||||||
virtual_alias_maps = hash:/etc/postfix/virtual
|
|
||||||
mailbox_command =
|
|
||||||
|
|
||||||
\## DKIM
|
|
||||||
smtpd_milters = unix:var/run/opendkim/opendkim.sock
|
|
||||||
non_smtpd_milters = unix:var/run/opendkim/opendkim.sock
|
|
||||||
|
|
||||||
\## Ralentissement pour les serveurs problématiques
|
|
||||||
transport_maps = hash:/etc/postfix/transport
|
|
||||||
slow_destination_concurrency_limit = 3
|
|
||||||
slow_destination_rate_delay = 3s
|
|
||||||
|
|
||||||
maximal_queue_lifetime = 1d
|
|
||||||
|
|
||||||
\## Forwarding pour mails du bureau
|
|
||||||
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc
|
|
||||||
message_size_limit = 524288000
|
|
||||||
|
|
||||||
smtp_helo_name = $mydomain
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration serveur web (nginx)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
server {
|
|
||||||
set_real_ip_from 192.169.1.1;
|
|
||||||
real_ip_header proxy_protocol;
|
|
||||||
|
|
||||||
listen 443 ssl proxy_protocol;
|
|
||||||
listen [::]:443 ssl;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/mail.a-lec.org/fullchain.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/mail.a-lec.org/privkey.pem; # managed by Certbot
|
|
||||||
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
||||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
||||||
|
|
||||||
# Add index.php to the list if you are using PHP
|
|
||||||
root /var/www/html/roundcube;
|
|
||||||
|
|
||||||
server_name mail.a-lec.org;
|
|
||||||
|
|
||||||
client_max_body_size 100M;
|
|
||||||
|
|
||||||
# Add index.php to the list if you are using PHP
|
|
||||||
index index.html index.htm index.php;
|
|
||||||
|
|
||||||
|
|
||||||
location / {
|
|
||||||
# First attempt to serve request as file, then
|
|
||||||
# as directory, then fall back to displaying a 404.
|
|
||||||
try_files $uri $uri/ /index.php?q=$uri&$args;
|
|
||||||
}
|
|
||||||
|
|
||||||
# pass PHP scripts to FastCGI server
|
|
||||||
#
|
|
||||||
location ~ \.php$ {
|
|
||||||
include snippets/fastcgi-php.conf;
|
|
||||||
# # With php-fpm (or other unix sockets):
|
|
||||||
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
|
|
||||||
# # With php-cgi (or other tcp sockets):
|
|
||||||
# fastcgi_pass 127.0.0.1:9000;
|
|
||||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
||||||
include fastcgi_params;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ^~ /data {
|
|
||||||
deny all;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
@ -1,130 +0,0 @@
|
||||||
## Machine virtuelle TOOT
|
|
||||||
|
|
||||||
Cette machine est destinée à accueillir l'instance Mastodon de l'association.
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 3
|
|
||||||
RAM : 2048 Mio
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
Base do donnée : PostgreSQL
|
|
||||||
Serveur Web: NGINX
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : toot.a-lec.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.173
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::173
|
|
||||||
|
|
||||||
### Comptes
|
|
||||||
|
|
||||||
Administrateur: admin
|
|
||||||
Modérateurs: neox, echolib
|
|
||||||
Ouverture de compte: tout membre de l'association
|
|
||||||
|
|
||||||
### Visibilité
|
|
||||||
|
|
||||||
Instance publique
|
|
||||||
|
|
||||||
### Configuration serveur web (nginx)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
map $http_upgrade $connection_upgrade {
|
|
||||||
default upgrade;
|
|
||||||
'' close;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
server_name toot.a-lec.org;
|
|
||||||
return 302 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 443 ssl proxy_protocol default_server;
|
|
||||||
listen [::]:443 ssl http2 default_server;
|
|
||||||
server_name toot.a-lec.org;
|
|
||||||
|
|
||||||
set_real_ip_from 192.169.1.1;
|
|
||||||
real_ip_header proxy_protocol;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/toot.a-lec.org/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/toot.a-lec.org/privkey.pem;
|
|
||||||
ssl_protocols TLSv1.2;
|
|
||||||
ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA;
|
|
||||||
ssl_prefer_server_ciphers on;
|
|
||||||
ssl_session_cache shared:SSL:10m;
|
|
||||||
|
|
||||||
keepalive_timeout 70;
|
|
||||||
sendfile on;
|
|
||||||
client_max_body_size 0;
|
|
||||||
|
|
||||||
root /home/mastodon/live/public;
|
|
||||||
|
|
||||||
gzip on;
|
|
||||||
gzip_disable "msie6";
|
|
||||||
gzip_vary on;
|
|
||||||
gzip_proxied any;
|
|
||||||
gzip_comp_level 6;
|
|
||||||
gzip_buffers 16 8k;
|
|
||||||
gzip_http_version 1.1;
|
|
||||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
|
||||||
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000";
|
|
||||||
|
|
||||||
location / {
|
|
||||||
try_files $uri @proxy;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
|
|
||||||
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
||||||
try_files $uri @proxy;
|
|
||||||
}
|
|
||||||
|
|
||||||
location @proxy {
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto https;
|
|
||||||
proxy_set_header Proxy "";
|
|
||||||
proxy_pass_header Server;
|
|
||||||
|
|
||||||
proxy_pass http://127.0.0.1:3000;
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_redirect off;
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection $connection_upgrade;
|
|
||||||
|
|
||||||
tcp_nodelay on;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /api/v1/streaming {
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto https;
|
|
||||||
proxy_set_header Proxy "";
|
|
||||||
|
|
||||||
proxy_pass http://127.0.0.1:4000;
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_redirect off;
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection $connection_upgrade;
|
|
||||||
|
|
||||||
tcp_nodelay on;
|
|
||||||
}
|
|
||||||
|
|
||||||
error_page 500 501 502 503 504 /500.html;
|
|
||||||
}
|
|
||||||
</details>
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
## Machine virtuelle TOOTEST
|
|
||||||
|
|
||||||
Cette machine est destinée à accueillir l'instance Mastodon de test.
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : x
|
|
||||||
RAM : xxx Mio
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
Base do donnée : PostgreSQL
|
|
||||||
Serveur Web: NGINX
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : toot.a-lec.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.232
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::232
|
|
||||||
|
|
@ -1,117 +0,0 @@
|
||||||
## Machine virtuelle WWW
|
|
||||||
|
|
||||||
Cette machine est destinée à accueillir le site web de l'association
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 1
|
|
||||||
RAM : 1000 Mio
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
Serveur http : `nginx`
|
|
||||||
Gestionnaire FastCGI : `php-fpm` version 7.4
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : www.a-lec.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.188
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::188
|
|
||||||
|
|
||||||
### Configuration du serveur web (nginx)
|
|
||||||
<details>
|
|
||||||
|
|
||||||
server {
|
|
||||||
set_real_ip_from 192.169.1.1;
|
|
||||||
real_ip_header proxy_protocol;
|
|
||||||
|
|
||||||
# SSL configuration
|
|
||||||
#
|
|
||||||
listen 443 ssl proxy_protocol default_server;
|
|
||||||
listen [::]:443 ssl default_server;
|
|
||||||
|
|
||||||
root /var/www/html;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/www.a-lec.org/fullchain.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/www.a-lec.org/privkey.pem; # managed by Certbot
|
|
||||||
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
||||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
||||||
|
|
||||||
|
|
||||||
# Add index.php to the list if you are using PHP
|
|
||||||
index index.html index.htm index.php;
|
|
||||||
|
|
||||||
server_name www.a-lec.org;
|
|
||||||
|
|
||||||
location /.well-known/host-meta {
|
|
||||||
default_type 'application/xrd+xml';
|
|
||||||
add_header Access-Control-Allow-Origin '*' always;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /.well-known/host-meta.json {
|
|
||||||
default_type 'application/jrd+json';
|
|
||||||
add_header Access-Control-Allow-Origin '*' always;
|
|
||||||
}
|
|
||||||
|
|
||||||
location / {
|
|
||||||
# First attempt to serve request as file, then
|
|
||||||
# as directory, then fall back to displaying a 404.
|
|
||||||
try_files $uri $uri/ $uri.html $uri/index.php?q=$uri&$args =404;
|
|
||||||
}
|
|
||||||
|
|
||||||
ssi on;
|
|
||||||
ssi_last_modified on;
|
|
||||||
|
|
||||||
# pass PHP scripts to FastCGI server
|
|
||||||
|
|
||||||
location ~ \.php$ {
|
|
||||||
include snippets/fastcgi-php.conf;
|
|
||||||
# With php-fpm (or other unix sockets):
|
|
||||||
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
|
|
||||||
# With php-cgi (or other tcp sockets):
|
|
||||||
# fastcgi_pass 127.0.0.1:9000;
|
|
||||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
||||||
include fastcgi_params;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
|
|
||||||
server_name www.a-lec.org;
|
|
||||||
|
|
||||||
return 302 https://www.a-lec.org$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
|
|
||||||
server_name a-lec.org;
|
|
||||||
|
|
||||||
return 302 https://www.a-lec.org$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 443 ssl proxy_protocol;
|
|
||||||
listen [::]:443 ssl;
|
|
||||||
|
|
||||||
server_name a-lec.org;
|
|
||||||
|
|
||||||
return 302 https://www.a-lec.org$request_uri;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/a-lec.org-0001/fullchain.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/a-lec.org-0001/privkey.pem; # managed by Certbot
|
|
||||||
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
||||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
||||||
}
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
## Machine virtuelle XMPP
|
|
||||||
|
|
||||||
Cette machine est destinée à accueillir le service XMPP
|
|
||||||
|
|
||||||
### Matériel virtuel
|
|
||||||
|
|
||||||
CPU : 1
|
|
||||||
RAM : 1000 Mio
|
|
||||||
Stockage de masse : 50 Gio
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
Serveur XMPP : `ejabberd`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : xmpp.a-lec.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 interne : 192.168.1.211
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::211
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
## Accès aux serveurs physiques de l'infrastructure
|
|
||||||
|
|
||||||
### Configuration SSH côté infra
|
|
||||||
|
|
||||||
Pour un administrateur d'infrastructure, l'accès aux serveurs de l'infra se fait sur le compte sudoer `admin666` via le compte `cominfra`, authentifié par clé SSH.
|
|
||||||
Pour qu'un nouvel administrateur puisse accéder aux serveurs, il faut :
|
|
||||||
|
|
||||||
- Sur `mother`, ajouter la clé publique (ssh) du nouvel admin dans `/home/cominfra/.ssh/authorized_keys` et `/home/admin666/.ssh/authorized_keys`
|
|
||||||
|
|
||||||
- Sur `aunt`, ajouter la clé publique (ssh) du nouvel admin dans `/home/cominfra/.ssh/authorized_keys` et `/home/admin666/.ssh/authorized_keys`
|
|
||||||
|
|
||||||
### Configuration SSH client
|
|
||||||
|
|
||||||
host mother.libre-en-communs.org
|
|
||||||
User cominfra
|
|
||||||
Port 222
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
host mother666.libre-en-communs.org
|
|
||||||
User admin666
|
|
||||||
Hostname mother.libre-en-communs.org
|
|
||||||
Port 222
|
|
||||||
ProxyCommand ssh -q -W %h:%p mother.libre-en-communs.org
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
host aunt.libre-en-communs.org
|
|
||||||
User cominfra
|
|
||||||
Port 223
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
host aunt666.libre-en-communs.org
|
|
||||||
User admin666
|
|
||||||
Hostname aunt.libre-en-communs.org
|
|
||||||
Port 223
|
|
||||||
ProxyCommand ssh -q -W %h:%p aunt.libre-en-communs.org
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
### Procédure de connexion avec config dans ~/.ssh/config
|
|
||||||
|
|
||||||
Le nouvel admin n'a plus qu'à utiliser `ssh mother666.libre-en-communs.org` pour accéder au serveur `mother`
|
|
||||||
|
|
||||||
### Procédure de connexion sans config
|
|
||||||
|
|
||||||
Le nouvel admin peut utiliser `ssh -i 'CLE_PRIV' -J cominfra@mother.libre-en-communs.org:222 admin666@localhost -p 222` pour accéder au serveur `mother`
|
|
||||||
|
|
||||||
### Accès aux machines virtuelles
|
|
||||||
|
|
||||||
Si besoin, l'administrateur d'infrastructure peut accéder aux machines virtuelles qui tournent sur les serveurs, et ce depuis le compte `admin666` de n'importe quel serveur. Il suffira d'utiliser la commande `ssh <nom de machine>`.
|
|
||||||
|
|
||||||
Par exemple, pour accéder à la machine `dns` : `ssh dns`
|
|
||||||
|
|
@ -1,76 +0,0 @@
|
||||||
## Accès aux machines virtuelles de l'infrastructure
|
|
||||||
|
|
||||||
### Configuration SSH côté infra
|
|
||||||
|
|
||||||
En règle générale, l'accès aux machines virtuelles ne se fait pas directement. Il faut passer par `mother` ou `aunt`.
|
|
||||||
Pour qu'un nouvel administrateur puisse accéder à des machines, il faut :
|
|
||||||
|
|
||||||
- Sur `mother` ou `aunt`, ajouter la clé publique (ssh) du nouvel admin dans `/home/cominfra/.ssh/authorized_keys`
|
|
||||||
|
|
||||||
- Sur chaque machine virtuelle concernée, ajouter la clé publique (ssh) du nouvel admin dans `/home/admin666/.ssh/authorized_keys`
|
|
||||||
|
|
||||||
Note : en IPV6, la connexion directe peut être possible. A voir au cas par cas.
|
|
||||||
|
|
||||||
**Attention** : les noms de machines virtuelles de Chalec contiennent ".chalec.org" en suffixe.
|
|
||||||
|
|
||||||
### Configuration SSH client
|
|
||||||
|
|
||||||
Soit en passant par `mother`
|
|
||||||
|
|
||||||
host mother.libre-en-communs.org
|
|
||||||
User cominfra
|
|
||||||
Port 222
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
match host *.a-lec.org
|
|
||||||
User admin666
|
|
||||||
Hostname %h
|
|
||||||
Port 22
|
|
||||||
ProxyJump mother.libre-en-communs.org
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
host *.chalec.org
|
|
||||||
User admin666
|
|
||||||
Port 22
|
|
||||||
ProxyJump mother.libre-en-communs.org
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
Ou bien en passant par `aunt`
|
|
||||||
|
|
||||||
host aunt.libre-en-communs.org
|
|
||||||
User cominfra
|
|
||||||
Port 223
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
match host *.a-lec.org
|
|
||||||
User admin666
|
|
||||||
Hostname %h
|
|
||||||
Port 22
|
|
||||||
ProxyJump aunt.libre-en-communs.org
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
host *.chalec.org
|
|
||||||
User admin666
|
|
||||||
Port 22
|
|
||||||
ProxyJump aunt.libre-en-communs.org
|
|
||||||
SendEnv GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
|
|
||||||
|
|
||||||
Pour fixer les variables Git directement dans la conf, ajouter un `SetEnv` avant `SendEnv` :
|
|
||||||
```
|
|
||||||
SetEnv GIT_AUTHOR_NAME="Moi" GIT_AUTHOR_EMAIL="moncourriel"
|
|
||||||
```
|
|
||||||
|
|
||||||
Note : avoir les deux configurations peut être utile en cas de panne de l'un ou l'autre des serveurs.
|
|
||||||
|
|
||||||
|
|
||||||
### Procédure de connexion avec config dans ~/.ssh/config
|
|
||||||
|
|
||||||
Le nouvel admin n'a plus qu'à utiliser `ssh NOM_DE_VM.a-lec.org` pour accéder à la machine virtuelle
|
|
||||||
|
|
||||||
### Procédure de connexion sans config
|
|
||||||
|
|
||||||
Le nouvel admin peut utiliser au choix :
|
|
||||||
|
|
||||||
- `ssh -i 'CLE_PRIV' -J cominfra@mother.libre-en-communs.org:222 admin666@NOM_DE_VM.a-lec.org -p 22`
|
|
||||||
|
|
||||||
- `ssh -i 'CLE_PRIV' -J cominfra@aunt.libre-en-communs.org:223 admin666@NOM_DE_VM.a-lec.org -p 22`
|
|
||||||
|
|
@ -1,40 +0,0 @@
|
||||||
# Création d'une nouvelle machine physique
|
|
||||||
|
|
||||||
Le but est d'intégrer une nouvelle machine physique dans le SI.
|
|
||||||
|
|
||||||
Configurer la machine :
|
|
||||||
- installer une Debian stable ;
|
|
||||||
- premier compte : admin666,
|
|
||||||
- la mettre à jour ;
|
|
||||||
|
|
||||||
Remplacer le noyau par Linux-libre-lts :
|
|
||||||
- TODO
|
|
||||||
|
|
||||||
|
|
||||||
Installer les paquets de base :
|
|
||||||
```
|
|
||||||
sudo apt install etckeeper mollyguard tig lm-sensors fancontrol screen emacs-nox vrms needrestart iotop htop curl ncdu iptraf tig unzip
|
|
||||||
```
|
|
||||||
|
|
||||||
Mettre l'IPV6 statique à l'image de l'IPV4 choisie :
|
|
||||||
- éditer ̀`/etc/network/interfaces`.
|
|
||||||
|
|
||||||
Nommer la machine :
|
|
||||||
```
|
|
||||||
sudo hostnamectl set-hostname NOM
|
|
||||||
```
|
|
||||||
|
|
||||||
Configurer le courriel :
|
|
||||||
- TODO
|
|
||||||
|
|
||||||
|
|
||||||
Configuration du routage :
|
|
||||||
- aller sur https://routeur.libre-en-communs.org/cgi-bin/luci/admin/network/dhcp
|
|
||||||
- onglet Static Leases, bouton Add :
|
|
||||||
- Hostname : nom de PM en domaine,
|
|
||||||
- MAC : dispo sur la machine,
|
|
||||||
- IPv4 : choisir entre :
|
|
||||||
- un 192.168.0.x pour infra générale (si pas un service que des commissions vont utiliser),
|
|
||||||
- un 192.168.1.x pour infra,
|
|
||||||
- un 192.168.2.x pour Chalec,
|
|
||||||
- valider les changements.
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
# Création d'une nouvelle machine virtuelle
|
|
||||||
|
|
||||||
- Creation de la VM par clonage de generic ou generic.chalec.org
|
|
||||||
|
|
||||||
- Aller sur https://routeur.libre-en-communs.org/cgi-bin/luci/admin/network/dhcp
|
|
||||||
|
|
||||||
+ Onglet Static Leases, bouton Add
|
|
||||||
|
|
||||||
- Hostname : nom de VM en domaine
|
|
||||||
|
|
||||||
- MAC : dispo dans virt-manager
|
|
||||||
|
|
||||||
|
|
||||||
- IPv4 : choisir entre :
|
|
||||||
|
|
||||||
+ un 192.168.0.x pour infra générale
|
|
||||||
|
|
||||||
+ un 192.168.1.x pour infra
|
|
||||||
|
|
||||||
+ un 192.168.2.x pour chalec
|
|
||||||
|
|
||||||
+ Valider les changements
|
|
||||||
|
|
||||||
|
|
||||||
- sudo virsh console NOM_DE_VM
|
|
||||||
|
|
||||||
+ login = admin666
|
|
||||||
|
|
||||||
+ sudo nano /etc/network/interfaces
|
|
||||||
|
|
||||||
- Changer l'IPv6 statique à l'image de l'IPv4 choisie
|
|
||||||
|
|
||||||
- Changer les hostnames (chaque nano signifie qu'il faut remplacer le generic ou generic.chalec.org par NOM_DE_VM)
|
|
||||||
|
|
||||||
+ sudo hostnamectl set-hostname NOM_DE_VM
|
|
||||||
|
|
||||||
+ sudo nano /etc/postfix/virtual && sudo postmap /etc/postfix/virtual
|
|
||||||
|
|
||||||
+ sudo nano /etc/mailname
|
|
||||||
|
|
||||||
+ sudo nano /etc/postfix/main.cf && sudo postfix reload
|
|
||||||
|
|
||||||
+ sudo reboot
|
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
# Migration de machines virtuelles entre machines physiques
|
|
||||||
|
|
||||||
Il y a plusieurs méthodes de migration de machines virtuelles en mother et aunt
|
|
||||||
|
|
||||||
## Migration "normale" d'une machine par son nom
|
|
||||||
|
|
||||||
Pour migrer une machine de mother à aunt :
|
|
||||||
|
|
||||||
/opt/sharedfs/outils/migrate_to_aunt.sh NOM_DE_VM
|
|
||||||
|
|
||||||
Pour migrer une machine de aunt à mother :
|
|
||||||
|
|
||||||
/opt/sharedfs/outils/migrate_to_mother.sh NOM_DE_VM
|
|
||||||
|
|
||||||
## Migration "normale" d'un groupe de machine par nombre
|
|
||||||
|
|
||||||
Pour migrer X machines de mother vers aunt :
|
|
||||||
|
|
||||||
/opt/sharedfs/outils/migrate_many_to_aunt.sh X
|
|
||||||
|
|
||||||
Pour migrer X machines de aunt vers mother :
|
|
||||||
|
|
||||||
/opt/sharedfs/outils/migrate_many_to_mother.sh X
|
|
||||||
|
|
||||||
## Migration d'urgence (P2P) de aunt vers mother (sans DRBD)
|
|
||||||
|
|
||||||
Pour migrer une machine de aunt vers mother lorsque DRBD ne fonctionne pas :
|
|
||||||
|
|
||||||
/opt/sharedfs/outils/migrate_to_mother_p2p.sh NOM_DE_VM
|
|
||||||
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
||||||
# Redémarrages de machines physiques
|
|
||||||
|
|
||||||
## Annoncer le downtime
|
|
||||||
|
|
||||||
Il faut annoncer le downtime sur isengard (cf [la procédure dédiée](supervision.md#activation-dun-downtime)).
|
|
||||||
|
|
||||||
## Migrer les machines virtuelles présentes sur l'hôte physique vers un autre hôte
|
|
||||||
|
|
||||||
Utiliser les instructions de la [procédure dédiée](migration_vm.md).
|
|
||||||
|
|
||||||
## Lancer le redémarrage
|
|
||||||
|
|
||||||
Lancer le redémarrage avec :
|
|
||||||
|
|
||||||
sudo systemctl start kexec.target
|
|
||||||
|
|
||||||
*Ne pas utiliser la commande reboot sauf nécessité absolue*
|
|
||||||
|
|
||||||
*Ne pas utiliser la commande shutdown sauf nécessité absolue*
|
|
||||||
|
|
||||||
## Vérifier l'état de DRBD après redémarrage
|
|
||||||
|
|
||||||
Avec la commande :
|
|
||||||
|
|
||||||
sudo cat /proc/drbd
|
|
||||||
|
|
||||||
Et vérifier que l'état est _cs:Connected ro:Primary/Primary ds:UpToDate/UpToDate_
|
|
||||||
|
|
||||||
## Monter la partition DRBD
|
|
||||||
|
|
||||||
Avec la commande :
|
|
||||||
|
|
||||||
sudo mount /opt/sharedfs
|
|
||||||
|
|
||||||
## Vérifier le bon fonctionnement
|
|
||||||
|
|
||||||
Avec :
|
|
||||||
|
|
||||||
sudo systemctl status
|
|
||||||
|
|
||||||
en vérifiant que le statut est _running_ et qu'aucun job n'est en fail.
|
|
||||||
|
|
||||||
## Migrer les machines virtuelles depuis l'autre hôte vers le présent hôte physique à présent prêt
|
|
||||||
|
|
||||||
Utiliser les instructions de la [procédure dédiée](migration_vm.md).
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
# Redémarrages de machines virtuelles
|
|
||||||
|
|
||||||
## Annoncer le downtime
|
|
||||||
|
|
||||||
Il faut annoncer le downtime sur isengard (cf [la procédure dédiée](supervision.md#activation-dun-downtime)).
|
|
||||||
|
|
||||||
## Lancer le redémarrage
|
|
||||||
|
|
||||||
Lancer le redémarrage avec :
|
|
||||||
|
|
||||||
sudo reboot
|
|
||||||
|
|
||||||
`mollyguard` va demander de confirmer le nom d'hôte de la machine à redémarrer.
|
|
||||||
|
|
||||||
## Vérifier le bon fonctionnement après redémarrage
|
|
||||||
|
|
||||||
Avec :
|
|
||||||
|
|
||||||
sudo systemctl status
|
|
||||||
|
|
||||||
en vérifiant que le statut est _running_ et qu'aucun job n'est en fail.
|
|
||||||
|
|
||||||
|
|
@ -1,40 +0,0 @@
|
||||||
# Gestion des sauvegardes l'infrastructure
|
|
||||||
|
|
||||||
Pour les sauvegardes, nous utilisons au sein de notre infrastructure les logiciels suivants :
|
|
||||||
|
|
||||||
- rsync pour les machines physiques
|
|
||||||
- [virt-backup](https://pypi.org/project/virt-backup/) pour les machines virtuelles
|
|
||||||
- les [scripts d'administration](https://git.a-lec.org/a-lec/commissions/infrastructure/infra-generale)
|
|
||||||
|
|
||||||
Les sauvegardes sont configurées comme indiqués dans le [dépôt dédié](https://git.a-lec.org/a-lec/commissions/infrastructure/sauvegardes)
|
|
||||||
|
|
||||||
## Sauvegarde des machines virtuelles
|
|
||||||
|
|
||||||
Sur une des machines physiques (ex: mother ou aunt).
|
|
||||||
|
|
||||||
### Lister les sauvegardes
|
|
||||||
|
|
||||||
Pour lister le résumé des sauvegardes :
|
|
||||||
|
|
||||||
sudo virt-backup list
|
|
||||||
|
|
||||||
Pour lister les sauvegardes d'une machine particulière :
|
|
||||||
|
|
||||||
sudo virt-backup list -D NOM_DE_VM
|
|
||||||
|
|
||||||
### Pour réaliser une sauvegarde de toutes les machines d'un hôte physique
|
|
||||||
|
|
||||||
Il n'est pas possible de réaliser une sauvegarde d'une machine isolée.
|
|
||||||
|
|
||||||
sudo virt-backup backup
|
|
||||||
|
|
||||||
### Pour restorer une sauvegarde
|
|
||||||
|
|
||||||
Nous avons un script spécial pour restaurer une sauvegarde :
|
|
||||||
|
|
||||||
sudo /opt/sharedfs/restore.sh NOM_DE_VM DATE_DE_SAUVEGARDE NOM_DE_DISQUE CHEMIN_CIBLE
|
|
||||||
|
|
||||||
### Nettoyer les sauvegardes
|
|
||||||
|
|
||||||
sudo virt-backup clean
|
|
||||||
|
|
||||||
|
|
@ -1,210 +0,0 @@
|
||||||
# Installation de la supervision sur une machine virtuelle
|
|
||||||
|
|
||||||
## Générer un ticket sur isengard.libre-en-communs.org
|
|
||||||
|
|
||||||
sudo icinga2 pki ticket --cn NOM_DE_DOMAINE_DE_VM
|
|
||||||
|
|
||||||
On obtient un ticket à noter dans l'issue. Il sera redemandé plus tard.
|
|
||||||
|
|
||||||
## En SSH sur la machine virtuelle, installer l'agent de supervision
|
|
||||||
|
|
||||||
sudo apt install icinga2 monitoring-plugins monitoring-plugins-contrib
|
|
||||||
|
|
||||||
## Modifier la configuration de la sonde de mémoire vive (pour corriger un bug)
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>/usr/share/icinga2/include/plugins-contrib.d/operating-system.conf</summary>
|
|
||||||
|
|
||||||
object CheckCommand "mem" {
|
|
||||||
command = [ PluginContribDir + "/check_memory" ]
|
|
||||||
|
|
||||||
arguments = {
|
|
||||||
"-u" = {
|
|
||||||
set_if = "$mem_used$"
|
|
||||||
description = "Check USED memory"
|
|
||||||
}
|
|
||||||
"-f" = {
|
|
||||||
set_if = "$mem_free$"
|
|
||||||
description = "Check FREE memory"
|
|
||||||
}
|
|
||||||
"-C" = {
|
|
||||||
set_if = "$mem_cache$"
|
|
||||||
description = "Count OS caches as FREE memory"
|
|
||||||
}
|
|
||||||
"-w" = {
|
|
||||||
value = "$mem_warning$"
|
|
||||||
description = "Percent free/used when to warn"
|
|
||||||
}
|
|
||||||
"-c" = {
|
|
||||||
value = "$mem_critical$"
|
|
||||||
description = "Percent free/used when critical"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
vars.mem_used = false
|
|
||||||
vars.mem_free = false
|
|
||||||
vars.mem_cache = false
|
|
||||||
}
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
## Connecter notre agent au serveur de supervision
|
|
||||||
|
|
||||||
sudo icinga2 node wizard
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>On réalise la configuration interactive suivante:</summary>
|
|
||||||
|
|
||||||
Welcome to the Icinga 2 Setup Wizard!
|
|
||||||
|
|
||||||
We will guide you through all required configuration details.
|
|
||||||
|
|
||||||
Please specify if this is an agent/satellite setup ('n' installs a master setup) [Y/n]:
|
|
||||||
|
|
||||||
Starting the Agent/Satellite setup routine...
|
|
||||||
|
|
||||||
Please specify the common name (CN) [NOM_DE_DOMAINE_DE_VM]:
|
|
||||||
|
|
||||||
Please specify the parent endpoint(s) (master or satellite) where this node should connect to:
|
|
||||||
Master/Satellite Common Name (CN from your master/satellite node): isengard.libre-en-communs.org
|
|
||||||
|
|
||||||
Do you want to establish a connection to the parent node from this node? [Y/n]:
|
|
||||||
Please specify the master/satellite connection information:
|
|
||||||
Master/Satellite endpoint host (IP address or FQDN): isengard.libre-en-communs.org
|
|
||||||
Master/Satellite endpoint port [5665]:
|
|
||||||
|
|
||||||
Add more master/satellite endpoints? [y/N]:
|
|
||||||
Parent certificate information:
|
|
||||||
|
|
||||||
Version: 3
|
|
||||||
Subject: CN = isengard.libre-en-communs.org
|
|
||||||
Issuer: CN = Icinga CA
|
|
||||||
Valid From: Dec 9 14:36:07 2021 GMT
|
|
||||||
Valid Until: Dec 5 14:36:07 2036 GMT
|
|
||||||
Serial: c4:3f:53:b2:cf:09:f7:b5:2e:88:39:03:e9:96:c8:fc:99:a1:ca:3a
|
|
||||||
|
|
||||||
Signature Algorithm: sha256WithRSAEncryption
|
|
||||||
Subject Alt Names: isengard.libre-en-communs.org
|
|
||||||
Fingerprint: 54 78 22 83 24 22 3A A7 FD 00 01 E4 10 67 71 B6 CA 3E A2 71 93 63 F8 64 29 E9 45 1F D1 35 A9 95
|
|
||||||
|
|
||||||
Is this information correct? [y/N]: y
|
|
||||||
|
|
||||||
Please specify the request ticket generated on your Icinga 2 master (optional).
|
|
||||||
(Hint: # icinga2 pki ticket --cn 'NOM_DE_DOMAINE_DE_VM'): INSERER_NUMERO_DE_TICKET_ICI
|
|
||||||
Please specify the API bind host/port (optional):
|
|
||||||
Bind Host []:
|
|
||||||
Bind Port []:
|
|
||||||
|
|
||||||
Accept config from parent node? [y/N]: y
|
|
||||||
Accept commands from parent node? [y/N]: y
|
|
||||||
|
|
||||||
Reconfiguring Icinga...
|
|
||||||
Disabling feature notification. Make sure to restart Icinga 2 for these changes to take effect.
|
|
||||||
Enabling feature api. Make sure to restart Icinga 2 for these changes to take effect.
|
|
||||||
|
|
||||||
Local zone name [NOM_DE_DOMAINE_DE_VM]:
|
|
||||||
Parent zone name [master]:
|
|
||||||
|
|
||||||
Default global zones: global-templates director-global
|
|
||||||
Do you want to specify additional global zones? [y/N]:
|
|
||||||
|
|
||||||
Do you want to disable the inclusion of the conf.d directory [Y/n]:
|
|
||||||
Disabling the inclusion of the conf.d directory...
|
|
||||||
|
|
||||||
Done.
|
|
||||||
|
|
||||||
Now restart your Icinga 2 daemon to finish the installation!
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
## Créer le fichier de zone pour la nouvelle machine dans isengard.libre-en-communs.org
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>/etc/icinga2/zones.d/master/NOM_DE_DOMAINE_DE_VM.conf</summary>
|
|
||||||
|
|
||||||
object Endpoint "NOM_DE_DOMAINE_DE_VM" {
|
|
||||||
}
|
|
||||||
|
|
||||||
object Zone "NOM_DE_DOMAINE_DE_VM" {
|
|
||||||
endpoints = [ "NOM_DE_DOMAINE_DE_VM" ]
|
|
||||||
parent = "master"
|
|
||||||
}
|
|
||||||
|
|
||||||
object Host "NOM_DE_DOMAINE_DE_VM" {
|
|
||||||
import "generic-host"
|
|
||||||
address = "NOM_DE_DOMAINE_DE_VM"
|
|
||||||
address6 = "NOM_DE_DOMAINE_DE_VM"
|
|
||||||
vars.os = "GNU/Linux"
|
|
||||||
vars.client_endpoint = name
|
|
||||||
|
|
||||||
vars.notification["mail"] = {
|
|
||||||
groups = [ "icingaadmins" ]
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
# Interface web d'Isengard
|
|
||||||
|
|
||||||
Site web : https://isengard.libre-en-communs.org/
|
|
||||||
|
|
||||||
## Activation d'un downtime
|
|
||||||
|
|
||||||
Downtimer :
|
|
||||||
- Menu gauche > Overview > Hosts
|
|
||||||
- sélectionner la vm visée
|
|
||||||
- partie droite > Schedule downtime
|
|
||||||
- Comment : mettre la raison du downtime, exemple : reboot noyal
|
|
||||||
- End time : par défaut 1h
|
|
||||||
- All services : coché
|
|
||||||
- Child Hosts : Schedule triggered downtime for all child hosts (/!\ utile ?)
|
|
||||||
- cliquer sur Schedule downtime
|
|
||||||
|
|
||||||
## Ajout d'une entrée de menu pour ses vm
|
|
||||||
|
|
||||||
Ajout :
|
|
||||||
- Menu gauche > Overview > Hosts ;
|
|
||||||
- sélectionner les vm désirées (Ctrl + clique gauche)
|
|
||||||
- partie droite > menu > chevron bas (à droite de History) > Add to menu
|
|
||||||
- Name : mettre le nom qui apparaîtra dans le menu
|
|
||||||
- Target : Single Column
|
|
||||||
- cliquer Save Changes
|
|
||||||
|
|
||||||
## Ajout d'une entrée de menu ses services
|
|
||||||
|
|
||||||
Ajout :
|
|
||||||
- Menu gauche > Overview > Services ;
|
|
||||||
- cliquer sur l'icone filtre à droite de la zone de recherche
|
|
||||||
- première case : Host (Case insensitive)
|
|
||||||
- deuxième case : =
|
|
||||||
- troisième case : le nom de votre vm, exemple : audio.chalec.org
|
|
||||||
- cliquer sur + et sélectionner OR
|
|
||||||
- recommencer autant de fois que voulu
|
|
||||||
- cliquer sur Apply
|
|
||||||
- menu du haut > chevron bas (à droite de Service) > Add to menu
|
|
||||||
- Name : mettre le nom qui apparaîtra dans le menu
|
|
||||||
- Target : Single Column
|
|
||||||
- cliquer Save Changes
|
|
||||||
|
|
||||||
## Éditer une entrée personnalisée de menu
|
|
||||||
|
|
||||||
Pour éditer une entrée personnalisée du menu :
|
|
||||||
- Menu gauche > vous@a-lec.org > My account > Navigation
|
|
||||||
- dans la liste, cliquer sur l'entrée à éditer.
|
|
||||||
|
|
||||||
## Supprimer une entrée de menu personnalisée
|
|
||||||
|
|
||||||
Pour supprimer une entrée personnalisée du menu :
|
|
||||||
- Menu gauche > vous@a-lec.org > My account > Navigation
|
|
||||||
- dans la liste, cliquer sur l'entrée à éditer
|
|
||||||
- cliquer sur l'icone croix rouge ;
|
|
||||||
|
|
||||||
## Downtime de tous ses services en 2 clics
|
|
||||||
|
|
||||||
Prérequis : avoir créer une entrée personnalisée du menu pour ses vm.
|
|
||||||
|
|
||||||
Downtimer ses services :
|
|
||||||
- Menu gauche > entrée personnalisée de vos vm
|
|
||||||
- cliquer sur « Schedule downtimes »
|
|
||||||
- …
|
|
||||||
95
Readme.md
95
Readme.md
|
|
@ -1,65 +1,62 @@
|
||||||
# Documentation de l'infrastructure logicielle et matérielle
|
# Documentation de l'infrastructure logicielle et matérielle
|
||||||
|
|
||||||
### Documentation des serveurs et routeurs
|
L'infrastructure informatique de Libre en Communs est répartie sur différents
|
||||||
|
sites dans le but d'éviter une centralisation trop importante. Ce travail de
|
||||||
|
décentralisation étant encore en cours, la présente documentation évolue encore.
|
||||||
|
|
||||||
- Serveur [mother](Serveurs/mother.md)
|
Cette documentation est publiée sous licence libre (GNU FDL) à l'exception du
|
||||||
|
manuel de la carte-mère sur laquelle est basée notre infrastructure,
|
||||||
|
l'[**ASUS KGPE-D16**](divers/manuel_Asus_KGPN_D16.pdf).
|
||||||
|
|
||||||
- Serveur [aunt](Serveurs/aunt.md)
|
## Localisation de l'infrastructure
|
||||||
|
|
||||||
- Routeur [routeur](Serveurs/routeur.md)
|
Les sites de l'infrastructure sont les lieux où Libre en Communs dispose de
|
||||||
|
machines physiques. Nous faisons une distinction entre _sites principaux_ et
|
||||||
|
_sites annexes_. Ces sites sont nommés selon leur localisation grossière.
|
||||||
|
|
||||||
### Documentation des machines virtuelles
|
<img src="images/image_carte_infra.png" width="100%">
|
||||||
|
|
||||||
- Configuration de base de toutes les machines : [generic](Machines virtuelles/generic.md)
|
### Sites principaux
|
||||||
|
|
||||||
- Machine [dns](Machines virtuelles/dns.md)
|
Les sites principaux sont :
|
||||||
|
- [Le Parc]() ;
|
||||||
|
- [Fontainebleau]().
|
||||||
|
|
||||||
- Machine [gestion](Machines virtuelles/gestion.md)
|
Un site principal doit répondre à certains prérequis :
|
||||||
|
- il dispose d'au moins une baie au format _rack 19 pouces_ ;
|
||||||
|
- il accueille des machines physiques principales avec du [matériel éligible]() ;
|
||||||
|
- il comporte un routeur **nommé d'après le nom du site** (Par exemple, à
|
||||||
|
Fontainebleau, le routeur se nomme `fontainebleau`) ;
|
||||||
|
- il permet un accès à Internet fibré (FTTH) via une ligne dédiée souscrite auprès
|
||||||
|
d'un opérateur de la [FFDN]() ;
|
||||||
|
- il dispose d'un compteur électrique pour mesurer la consommation globale des
|
||||||
|
dispositifs.
|
||||||
|
|
||||||
- Machine [git](Machines virtuelles/git.md)
|
### Sites annexes
|
||||||
|
|
||||||
- Machine [mail](Machines virtuelles/mail.md)
|
Les sites annexes sont :
|
||||||
|
- [Gisors]().
|
||||||
|
|
||||||
- Machine [toot](Machines virtuelles/toot.md)
|
Un site annexe est un lieu pouvant accueillir des machines physiques simples
|
||||||
|
(format tour, par exemple).
|
||||||
|
|
||||||
- Machine [tootest](Machines virtuelles/tootest.md)
|
Un site annexe n'est utilisable que pour des opérations non critiques et annexes
|
||||||
|
de l'infrastructure (ou secondaires/redondantes). Les conditions prérequises pour
|
||||||
|
un tel site sont plus souples mais il n'en demeure pas moins que les machines physiques
|
||||||
|
doivent être [éligibles]() et l'accès internet éthiquement acceptable.
|
||||||
|
|
||||||
- Machine [www](Machines virtuelles/www.md)
|
## Documentation générique
|
||||||
|
|
||||||
- Machine [xmpp](Machines virtuelles/xmpp.md)
|
La gestion de l'infrastructure demande certaines opérations génériques qui ne
|
||||||
|
pas d'un site particulier. C'est notamment le cas pour les procédures
|
||||||
|
d'administration.
|
||||||
|
|
||||||
- Machine [audio](Machines virtuelles/audio.md)
|
Parmi ces procédures :
|
||||||
|
- [Accès aux serveurs physiques](procédures/acces_serveurs.md)
|
||||||
### Documentation des procédures
|
- [Accès aux machines virtuelles](procédures/acces_vm.md)
|
||||||
|
- [Création de machines virtuelles](procédures/création_vm.md)
|
||||||
- [Accès aux serveurs physiques](Procédures/acces_serveurs.md)
|
- [Mise en place de la supervision](procédures/supervision.md)
|
||||||
|
- [Migration des machines virtuelles](procédures/migration_vm.md)
|
||||||
- [Accès aux machines virtuelles](Procédures/acces_vm.md)
|
- [Redémarrage des machines virtuelles](procédures/reboot_vm.md)
|
||||||
|
- [Redémarrage des machines physiques](procédures/reboot_physique.md)
|
||||||
- [Création de machines virtuelles](Procédures/création_vm.md)
|
- [Gestion des sauvegardes](procédures/sauvegardes.md)
|
||||||
|
|
||||||
- [Mise en place de la supervision](Procédures/supervision.md)
|
|
||||||
|
|
||||||
- [Migration des machines virtuelles](Procédures/migration_vm.md)
|
|
||||||
|
|
||||||
- [Redémarrage des machines virtuelles](Procédures/reboot_vm.md)
|
|
||||||
|
|
||||||
- [Redémarrage des machines physiques](Procédures/reboot_physique.md)
|
|
||||||
|
|
||||||
- [Gestion des sauvegardes](Procédures/sauvegardes.md)
|
|
||||||
|
|
||||||
### Divers
|
|
||||||
|
|
||||||
- [Manuel des cartes-mères Asus KGPE-D16](Divers/manuel_Asus_KGPN_D16.pdf)
|
|
||||||
|
|
||||||
## Vue d'ensemble
|
|
||||||
|
|
||||||
<img src="images/image0.png" width="100%">
|
|
||||||
|
|
||||||
## Infrastructure critique
|
|
||||||
|
|
||||||
<img src="images/vm_critiques.png" width="100%">
|
|
||||||
|
|
||||||
## Schéma de stockage
|
|
||||||
|
|
||||||
<img src="images/stockage.png" width="100%">
|
|
||||||
|
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
# Plan de nommage des routeurs
|
|
||||||
|
|
||||||
# Étude
|
|
||||||
À l'origine :
|
|
||||||
- routeur sur le site La Varenne
|
|
||||||
- routeur2 sur le site Fontainebleau
|
|
||||||
|
|
||||||
Cible :
|
|
||||||
- 1 routeur sur le site Le Parc
|
|
||||||
- 1 routeur sur le site Fontainebleau
|
|
||||||
- 1 routeur sur le site Gisors
|
|
||||||
|
|
||||||
Propositions :
|
|
||||||
- simpliste :
|
|
||||||
- routeur, routeur1, routeur2
|
|
||||||
- noms de nains de Tolkien (petits mais puissants et robustes) :
|
|
||||||
- bifur (La Varenne), bofur (Fontainebleau), balin (Gisors)
|
|
||||||
- ??? (LaVarenne/LeParc), fili (Fontainebleau), gimli (Gisors)
|
|
||||||
- géographiques (coutumier) :
|
|
||||||
- lavarenne, fontainebleau, gisors, leparc
|
|
||||||
- géographiques abrégés sur 4 lettres :
|
|
||||||
- lava, font, giso, lepa
|
|
||||||
- géographique sur 3 lettre + numéro du département
|
|
||||||
- lep94, fon77
|
|
||||||
|
|
||||||
Notes :
|
|
||||||
- assertion que 1 seul routeur par site ;
|
|
||||||
- assertion que 1 seul site par ville ;
|
|
||||||
- éviter les abréviations.
|
|
||||||
|
|
||||||
# Le choix
|
|
||||||
Choix de suivre la solution coutimière et pratique du nom géographique : lavarenne, fontainebleau, gisors, leparc…
|
|
||||||
204
Serveurs/aunt.md
204
Serveurs/aunt.md
|
|
@ -1,204 +0,0 @@
|
||||||
# Serveur physique `aunt` : serveur-mère de l'infrastructure de Libre en Communs
|
|
||||||
|
|
||||||
`aunt` est un serveur physique hébergé au local de l'association.
|
|
||||||
|
|
||||||
Avec `mother` elles forment le centre névralgique de l'infrastructure de l'association.
|
|
||||||
|
|
||||||
### Matériel
|
|
||||||
|
|
||||||
Carte mère : 1 × Asus KGPN-D16 Rev 1.03G
|
|
||||||
CPU : 2 × AMD Opteron 6282SE
|
|
||||||
RAM : *(à compléter) *
|
|
||||||
Alimentation : *(à compléter)*
|
|
||||||
Onduleur : 1 × EATON Ellipse PRO 1200 VA
|
|
||||||
Casier : 1 × Inter-Tech IPC 4U-4129-N SSI-EEB (Rack)
|
|
||||||
Stockage de masse : 2 × Samsung SSD 870 QVO 4To
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Micro-programme : Coreboot 4.6 + SeaBIOS, sans blob privateur
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Virtualisation : QEMU/KVM (`libvirt`)
|
|
||||||
Gestion du onduleur : NUT/UPS
|
|
||||||
Audit des paquets mensuel : `vrms`
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `tig`, `lm-sensors`, `fancontrol`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
Réplication de stockage (vm) : `drbd`, `ocfs2`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : aunt.libre-en-communs.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 locale : 192.168.1.206
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::3
|
|
||||||
|
|
||||||
#### Configuration réseau
|
|
||||||
|
|
||||||
##### /etc/network/interfaces
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# Connexion avec la machine mother
|
|
||||||
allow-hotplug ens10
|
|
||||||
iface ens10 inet static
|
|
||||||
address 192.169.254.3
|
|
||||||
|
|
||||||
post-up /usr/bin/ip link set ens10 mtu 9000
|
|
||||||
|
|
||||||
# Connexion avec le routeur (bridge sur ens10 avec les VM présentes)
|
|
||||||
allow-hotplug ens9
|
|
||||||
auto br0
|
|
||||||
iface br0 inet dhcp
|
|
||||||
bridge_ports ens9
|
|
||||||
|
|
||||||
iface br0 inet6 static
|
|
||||||
bridge_ports ens9
|
|
||||||
address 2001:910:1021::3/128
|
|
||||||
gateway 2001:910:1021::1
|
|
||||||
bridge_stp off # désactivation du Spanning Tree Protocol
|
|
||||||
bridge_waitport 0 # suppression du délai avant que le port soit disponible pour le bridge
|
|
||||||
bridge_fd 0 # suppression de délai avant que le forwarding du bridge soit établi
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration SSH
|
|
||||||
|
|
||||||
#### /etc/ssh/sshd_config
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
|
||||||
|
|
||||||
# This is the sshd server system-wide configuration file. See
|
|
||||||
# sshd_config(5) for more information.
|
|
||||||
|
|
||||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
|
||||||
|
|
||||||
# The strategy used for options in the default sshd_config shipped with
|
|
||||||
# OpenSSH is to specify options with their default value where
|
|
||||||
# possible, but leave them commented. Uncommented options override the
|
|
||||||
# default value.
|
|
||||||
|
|
||||||
Port 223
|
|
||||||
AddressFamily any
|
|
||||||
ListenAddress 0.0.0.0
|
|
||||||
ListenAddress ::
|
|
||||||
|
|
||||||
PubkeyAuthentication no
|
|
||||||
|
|
||||||
PasswordAuthentication no
|
|
||||||
PermitEmptyPasswords no
|
|
||||||
|
|
||||||
ChallengeResponseAuthentication no
|
|
||||||
|
|
||||||
UsePAM yes
|
|
||||||
|
|
||||||
AllowAgentForwarding yes
|
|
||||||
AllowTcpForwarding yes
|
|
||||||
GatewayPorts yes
|
|
||||||
X11Forwarding no
|
|
||||||
|
|
||||||
PrintMotd no
|
|
||||||
|
|
||||||
TCPKeepAlive yes
|
|
||||||
|
|
||||||
PermitTunnel yes
|
|
||||||
|
|
||||||
AcceptEnv LANG LC_* GIT_*
|
|
||||||
|
|
||||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
||||||
|
|
||||||
Match Group ssh-pubkey
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
Match Group ssh-login
|
|
||||||
PasswordAuthentication yes
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
Match Address 127.0.0.*
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
Match Address 192.169.254.2
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration DRBD
|
|
||||||
|
|
||||||
#### /etc/drbd.d/drbd1.res
|
|
||||||
<details>
|
|
||||||
|
|
||||||
resource drbd1 {
|
|
||||||
meta-disk internal;
|
|
||||||
device /dev/drbd1;
|
|
||||||
|
|
||||||
startup {
|
|
||||||
wfc-timeout 20;
|
|
||||||
become-primary-on both;
|
|
||||||
}
|
|
||||||
net {
|
|
||||||
verify-alg sha256;
|
|
||||||
allow-two-primaries yes;
|
|
||||||
max-buffers 10k;
|
|
||||||
max-epoch-size 10k;
|
|
||||||
unplug-watermark 32;
|
|
||||||
sndbuf-size 0;
|
|
||||||
rcvbuf-size 0;
|
|
||||||
}
|
|
||||||
disk {
|
|
||||||
on-io-error detach;
|
|
||||||
#no-disk-flushes;
|
|
||||||
#no-disk-barrier;
|
|
||||||
c-plan-ahead 10;
|
|
||||||
c-fill-target 150M;
|
|
||||||
c-min-rate 10k;
|
|
||||||
c-max-rate 500M;
|
|
||||||
}
|
|
||||||
|
|
||||||
on mother { # hostname must match `uname -n` output
|
|
||||||
disk /dev/md1; # Logical Volume on the provided host
|
|
||||||
address 192.169.254.2:7789; # IP Address to be used to connect to the node with port
|
|
||||||
}
|
|
||||||
|
|
||||||
on aunt { # hostname must match `uname -n` output
|
|
||||||
disk /dev/md1; # Logical Volume on the provided host
|
|
||||||
address 192.169.254.3:7789; # IP Address to be used to connect to the node with port
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
#### /etc/ocfs2/cluster.conf
|
|
||||||
<details>
|
|
||||||
|
|
||||||
cluster:
|
|
||||||
name = sharedfs
|
|
||||||
heartbeat_mode = local
|
|
||||||
node_count = 2
|
|
||||||
|
|
||||||
node:
|
|
||||||
cluster = sharedfs
|
|
||||||
number = 0
|
|
||||||
ip_port = 7777
|
|
||||||
ip_address = 192.169.254.3
|
|
||||||
name = aunt
|
|
||||||
|
|
||||||
node:
|
|
||||||
cluster = sharedfs
|
|
||||||
number = 1
|
|
||||||
ip_port = 7777
|
|
||||||
ip_address = 192.169.254.2
|
|
||||||
name = mother
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration MTA
|
|
||||||
|
|
||||||
#### /etc/postfix/transport
|
|
||||||
|
|
||||||
a-lec.org :
|
|
||||||
* discard:
|
|
||||||
|
|
||||||
#### /etc/postfix/virtual
|
|
||||||
|
|
||||||
@localhost admin@a-lec.org
|
|
||||||
@aunt.libre-en-communs.org admin@a-lec.org
|
|
||||||
|
|
@ -1,203 +0,0 @@
|
||||||
# Serveur physique `mother` : serveur-mère de l'infrastructure de Libre en Communs
|
|
||||||
|
|
||||||
`mother` est un serveur physique hébergé au local de l'association.
|
|
||||||
|
|
||||||
Avec `aunt` elles forment le centre névralgique de l'infrastructure de l'association.
|
|
||||||
|
|
||||||
### Matériel
|
|
||||||
|
|
||||||
Carte mère : 1 × Asus KGPN-D16 Rev 1.03G
|
|
||||||
CPU : 2 × AMD Opteron 6282SE
|
|
||||||
RAM : 4 × Crucial RDIMM 16Go CT2K16G3ERSLD4160B
|
|
||||||
Alimentation : 1 × FSP Twins PRO 500W (500W ATX12V / EPS12V 80PLUS Gold)
|
|
||||||
Onduleur : 1 × EATON Ellipse PRO 1600 VA
|
|
||||||
Casier : 1 × Inter-Tech IPC 4U-4129-N SSI-EEB (Rack)
|
|
||||||
Stockage de masse : 2 × Samsung SSD 870 QVO 2To
|
|
||||||
|
|
||||||
### Logiciel
|
|
||||||
|
|
||||||
Micro-programme : Coreboot 4.6 + SeaBIOS, sans blob privateur
|
|
||||||
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
|
||||||
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
|
||||||
Virtualisation : QEMU/KVM (`libvirt`)
|
|
||||||
Gestion du onduleur : NUT/UPS
|
|
||||||
Audit des paquets mensuel : `vrms`
|
|
||||||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `tig`, `lm-sensors`, `fancontrol`, `screen`
|
|
||||||
Mail Transfer Agent : `postfix`
|
|
||||||
Réplication de stockage (vm) : `drbd`, `ocfs2`
|
|
||||||
|
|
||||||
### Caractéristiques notables
|
|
||||||
|
|
||||||
Domaine : mother.libre-en-communs.org
|
|
||||||
Adresse ipv4 publique : 80.67.176.33
|
|
||||||
Adresse ipv4 locale : 192.168.1.108
|
|
||||||
Adresse ipv6 publique : 2001:910:1021::2
|
|
||||||
|
|
||||||
#### Configuration réseau
|
|
||||||
|
|
||||||
##### /etc/network/interfaces
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# Connexion avec la machine aunt
|
|
||||||
allow-hotplug ens9
|
|
||||||
iface ens9 inet static
|
|
||||||
address 192.169.254.2
|
|
||||||
|
|
||||||
post-up /usr/bin/ip link set ens9 mtu 9000
|
|
||||||
|
|
||||||
# Connexion avec le routeur (bridge sur ens10 avec les VM présentes)
|
|
||||||
allow-hotplug ens10
|
|
||||||
auto br0
|
|
||||||
iface br0 inet dhcp
|
|
||||||
bridge_ports ens10
|
|
||||||
|
|
||||||
iface br0 inet6 static
|
|
||||||
bridge_ports ens10
|
|
||||||
address 2001:910:1021::2/128
|
|
||||||
gateway 2001:910:1021::1
|
|
||||||
bridge_stp off # désactivation du Spanning Tree Protocol
|
|
||||||
bridge_waitport 0 # suppression du délai avant que le port soit disponible pour le bridge
|
|
||||||
bridge_fd 0 # suppression de délai avant que le forwarding du bridge soit établi
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration SSH
|
|
||||||
|
|
||||||
#### /etc/ssh/sshd_config
|
|
||||||
<details>
|
|
||||||
|
|
||||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
|
||||||
|
|
||||||
# This is the sshd server system-wide configuration file. See
|
|
||||||
# sshd_config(5) for more information.
|
|
||||||
|
|
||||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
|
||||||
|
|
||||||
# The strategy used for options in the default sshd_config shipped with
|
|
||||||
# OpenSSH is to specify options with their default value where
|
|
||||||
# possible, but leave them commented. Uncommented options override the
|
|
||||||
# default value.
|
|
||||||
|
|
||||||
Port 222
|
|
||||||
AddressFamily any
|
|
||||||
ListenAddress 0.0.0.0
|
|
||||||
ListenAddress ::
|
|
||||||
|
|
||||||
PubkeyAuthentication no
|
|
||||||
|
|
||||||
PasswordAuthentication no
|
|
||||||
PermitEmptyPasswords no
|
|
||||||
|
|
||||||
ChallengeResponseAuthentication no
|
|
||||||
|
|
||||||
UsePAM yes
|
|
||||||
|
|
||||||
AllowAgentForwarding yes
|
|
||||||
AllowTcpForwarding yes
|
|
||||||
GatewayPorts yes
|
|
||||||
X11Forwarding no
|
|
||||||
|
|
||||||
PrintMotd no
|
|
||||||
|
|
||||||
TCPKeepAlive yes
|
|
||||||
|
|
||||||
PermitTunnel yes
|
|
||||||
|
|
||||||
AcceptEnv LANG LC_* GIT_*
|
|
||||||
|
|
||||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
||||||
|
|
||||||
Match Group ssh-pubkey
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
Match Group ssh-login
|
|
||||||
PasswordAuthentication yes
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
Match Address 127.0.0.*
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
|
|
||||||
Match Address 192.169.254.3
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration DRBD
|
|
||||||
|
|
||||||
#### /etc/drbd.d/drbd1.res
|
|
||||||
<details>
|
|
||||||
|
|
||||||
resource drbd1 {
|
|
||||||
meta-disk internal;
|
|
||||||
device /dev/drbd1;
|
|
||||||
|
|
||||||
startup {
|
|
||||||
wfc-timeout 20;
|
|
||||||
become-primary-on both;
|
|
||||||
}
|
|
||||||
net {
|
|
||||||
verify-alg sha256;
|
|
||||||
allow-two-primaries yes;
|
|
||||||
max-buffers 10k;
|
|
||||||
max-epoch-size 10k;
|
|
||||||
unplug-watermark 32;
|
|
||||||
sndbuf-size 0;
|
|
||||||
rcvbuf-size 0;
|
|
||||||
}
|
|
||||||
disk {
|
|
||||||
on-io-error detach;
|
|
||||||
#no-disk-flushes;
|
|
||||||
#no-disk-barrier;
|
|
||||||
c-plan-ahead 10;
|
|
||||||
c-fill-target 150M;
|
|
||||||
c-min-rate 10k;
|
|
||||||
c-max-rate 500M;
|
|
||||||
}
|
|
||||||
|
|
||||||
on mother { # hostname must match `uname -n` output
|
|
||||||
disk /dev/md1; # Logical Volume on the provided host
|
|
||||||
address 192.169.254.2:7789; # IP Address to be used to connect to the node with port
|
|
||||||
}
|
|
||||||
|
|
||||||
on aunt { # hostname must match `uname -n` output
|
|
||||||
disk /dev/md1; # Logical Volume on the provided host
|
|
||||||
address 192.169.254.3:7789; # IP Address to be used to connect to the node with port
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
#### /etc/ocfs2/cluster.conf
|
|
||||||
<details>
|
|
||||||
|
|
||||||
cluster:
|
|
||||||
name = sharedfs
|
|
||||||
heartbeat_mode = local
|
|
||||||
node_count = 2
|
|
||||||
|
|
||||||
node:
|
|
||||||
cluster = sharedfs
|
|
||||||
number = 0
|
|
||||||
ip_port = 7777
|
|
||||||
ip_address = 192.169.254.3
|
|
||||||
name = aunt
|
|
||||||
|
|
||||||
node:
|
|
||||||
cluster = sharedfs
|
|
||||||
number = 1
|
|
||||||
ip_port = 7777
|
|
||||||
ip_address = 192.169.254.2
|
|
||||||
name = mother
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
### Configuration MTA
|
|
||||||
|
|
||||||
#### /etc/postfix/transport
|
|
||||||
|
|
||||||
a-lec.org :
|
|
||||||
* discard:
|
|
||||||
|
|
||||||
#### /etc/postfix/virtual
|
|
||||||
|
|
||||||
@localhost admin@a-lec.org
|
|
||||||
@mother.libre-en-communs.org admin@a-lec.org
|
|
||||||
1673
Serveurs/routeur.md
1673
Serveurs/routeur.md
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue