182 lines
4.3 KiB
Markdown
182 lines
4.3 KiB
Markdown
# aelita, machine physique (fontainebleau)
|
||
|
||
## Matériel
|
||
|
||
Carte mère : 1 × Asus KGPN-D16 Rev 1.03G
|
||
CPU : 1 × AMD Opteron 6280SE
|
||
RAM : 47 Gio
|
||
Alimentation : *(à compléter)*
|
||
Casier : 1 × Inter-Tech IPC 4U
|
||
Stockage de masse : 2 × KINGSTON SEDC600M3840G 4 To
|
||
|
||
## Logiciel
|
||
|
||
Micro-programme : GNU Boot 0.1-rc3
|
||
Système d'exploitation : Trisquel GNU/Linux-libre 11 Aramo
|
||
Noyau : Linux-libre
|
||
Virtualisation : QEMU/KVM (`libvirt`)
|
||
Gestion du onduleur : NUT/UPS
|
||
Audit des paquets mensuel : `vrms`
|
||
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `tig`, `lm-sensors`, `fancontrol`, `screen`
|
||
Mail Transfer Agent : `postfix`
|
||
Réplication de stockage (vm) : `drbd`, `ocfs2`, `o2cb`
|
||
|
||
## Caractéristiques notables
|
||
|
||
Domaine : `aelita.libre-en-communs.org`
|
||
Adresse ipv4 publique : `80.67.176.40`
|
||
Adresse ipv4 locale : `192.168.1.3`
|
||
Adresse ipv4 interne DRBD : `192.168.254.3`
|
||
Adresse ipv6 publique : `2001:910:1028::2`
|
||
|
||
### Configuration réseau
|
||
|
||
Les machines physiques sont configurées pour récupérer leur IP locale via
|
||
DHCP, le routeur du site embarquant un serveur DHCP.
|
||
|
||
Cette machine physique étant un hôte hyperviseur, elle partage sa connexion
|
||
ethernet avec les machines virtuelles qu'elle héberge, c'est pourquoi nous
|
||
configurons un pont.
|
||
|
||
De plus, nous configurons une connexion directe entre `aelita` et `anthea`
|
||
pour la réplication `DRBD`.
|
||
|
||
#### /etc/network/interfaces
|
||
<details>
|
||
|
||
auto lo br0
|
||
iface lo inet loopback
|
||
allow-hotplug ens10
|
||
allow-hotplug ens9
|
||
allow-hotplug ens11f0
|
||
allow-hotplug ens11f1
|
||
|
||
# aelita
|
||
iface ens11f1 inet static
|
||
address 192.168.254.3
|
||
|
||
post-up /usr/bin/ip link set ens10 mtu 9000
|
||
|
||
# bridge for vm
|
||
iface br0 inet dhcp
|
||
bridge_ports ens11f0
|
||
|
||
iface br0 inet6 dhcp
|
||
bridge_ports ens11f0
|
||
|
||
</details>
|
||
|
||
## Configuration SSH
|
||
|
||
### /etc/ssh/sshd_config
|
||
<details>
|
||
|
||
Port 223
|
||
AddressFamily any
|
||
ListenAddress 0.0.0.0
|
||
ListenAddress ::
|
||
PubkeyAuthentication yes
|
||
PasswordAuthentication no
|
||
PermitEmptyPasswords no
|
||
ChallengeResponseAuthentication no
|
||
UsePAM yes
|
||
AllowAgentForwarding yes
|
||
AllowTcpForwarding yes
|
||
GatewayPorts yes
|
||
X11Forwarding no
|
||
PrintMotd no
|
||
TCPKeepAlive yes
|
||
PermitTunnel yes
|
||
AcceptEnv LANG LC\_* GIT\_*
|
||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||
Match User admin666 Address *,!192.168.0.0/16,!::1,!127.0.0.1
|
||
DenyUsers admin666
|
||
|
||
</details>
|
||
|
||
## Configuration DRBD
|
||
|
||
### /etc/drbd.d/drbd1.res
|
||
<details>
|
||
|
||
resource drbd1 {
|
||
meta-disk internal;
|
||
device /dev/drbd1;
|
||
|
||
startup {
|
||
become-primary-on both;
|
||
}
|
||
net {
|
||
verify-alg sha256;
|
||
allow-two-primaries yes;
|
||
after-sb-0pri discard-zero-changes;
|
||
after-sb-1pri discard-secondary;
|
||
protocol C;
|
||
ko-count 0;
|
||
timeout 119;
|
||
ping-int 120;
|
||
connect-int 120;
|
||
max-buffers 36k;
|
||
sndbuf-size 0;
|
||
rcvbuf-size 0;
|
||
}
|
||
handlers {
|
||
pri-lost-after-sb "killall virt-backup";
|
||
}
|
||
disk {
|
||
on-io-error pass_on;
|
||
md-flushes;
|
||
c-fill-target 10M;
|
||
c-max-rate 700M;
|
||
c-plan-ahead 0;
|
||
c-min-rate 4M;
|
||
resync-rate 500M;
|
||
}
|
||
|
||
on anthea.libre-en-communs.org { # hostname must match `uname -n` output
|
||
disk /dev/md/1; # Logical Volume on the provided host
|
||
address 192.168.254.2:7789; # IP Address to be used to connect to the n>
|
||
}
|
||
|
||
on aelita.libre-en-communs.org { # hostname must match `uname -n` output
|
||
disk /dev/md/1; # Logical Volume on the provided host
|
||
address 192.168.254.3:7789; # IP Address to be used to connect to the n>
|
||
}
|
||
|
||
}
|
||
|
||
</details>
|
||
|
||
### /etc/ocfs2/cluster.conf
|
||
<details>
|
||
|
||
node:
|
||
ip_address = 192.168.254.2
|
||
ip_port = 7777
|
||
number = 0
|
||
name = anthea.libre-en-communs.org
|
||
cluster = vmverse
|
||
node:
|
||
ip_address = 192.168.254.3
|
||
ip_port = 7777
|
||
number = 1
|
||
name = aelita.libre-en-communs.org
|
||
cluster = vmverse
|
||
cluster:
|
||
name = vmverse
|
||
node_count = 2
|
||
|
||
</details>
|
||
|
||
## Configuration MTA
|
||
|
||
### /etc/postfix/transport
|
||
|
||
a-lec.org :
|
||
* discard:
|
||
|
||
### /etc/postfix/virtual
|
||
|
||
@localhost admin@a-lec.org
|
||
@aelita.libre-en-communs.org admin@a-lec.org
|