projects:base-infrastructure
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| projects:base-infrastructure [2017-09-16 07:41] – [Concept] trinitor | projects:base-infrastructure [2018-05-13 08:58] (current) – [gitlab] trinitor | ||
|---|---|---|---|
| Line 30: | Line 30: | ||
| | | | | ||
| | | | | ||
| - | +---------+---------+ | + | +---------+---------+ |
| - | | WLAN Router | + | | WLAN Router |
| - | | | + | | |
| - | | NAT | | + | | NAT | |
| - | | 192.168.30.0/ | + | | 192.168.30.0/ |
| - | +-------------------+ | + | +-------------------+ |
| - | | | + | | |
| - | | | + | | |
| - | | | + | | |
| - | | | + | | +------------------+------------------+ |
| - | | | | + | | |
| - | +-----------+---+------------------+ | + | +-----------+---+-------------------------------------+ |
| | | | | | | ||
| - | | + | Virtual Servers |
| | | | | | | ||
| | | ||
| Line 67: | Line 67: | ||
| This is the shared network and it belongs to the building itself. \\ | This is the shared network and it belongs to the building itself. \\ | ||
| The Fritzbox itself is managed by trinitor \\ | The Fritzbox itself is managed by trinitor \\ | ||
| - | Be biggest challenge will the the fight for port forwarding. \\ | ||
| - | A shared webserver in the shared network as a reverse proxy could solve the 80/443 fight. \\ | ||
| - | Will be done when we have the need. | ||
| Every floor can have 10 static IPs in the shared network \\ | Every floor can have 10 static IPs in the shared network \\ | ||
| Line 101: | Line 98: | ||
| |192.168.11.4 | |192.168.11.4 | ||
| |192.168.11.10 |virt01 | |192.168.11.10 |virt01 | ||
| + | |192.168.11.11 |virt02 | ||
| + | |192.168.11.20 |music01 | ||
| ^Virtual Machines ^^^ | ^Virtual Machines ^^^ | ||
| + | |192.168.1.11 | ||
| |192.168.10.11 |auth01 | |192.168.10.11 |auth01 | ||
| |192.168.10.12 |chat01 | |192.168.10.12 |chat01 | ||
| - | ==== Virtualisation ==== | + | ==== Virtualisation |
| There are some options (ESXi, XenServer, oVirt, ...), but the simplest one seems to be Proxmox. \\ | There are some options (ESXi, XenServer, oVirt, ...), but the simplest one seems to be Proxmox. \\ | ||
| An old Dell Notebook with an additional USB NIC will be used for now. \\ | An old Dell Notebook with an additional USB NIC will be used for now. \\ | ||
| Line 127: | Line 127: | ||
| Management: \\ | Management: \\ | ||
| [[https:// | [[https:// | ||
| + | |||
| + | ==== Virtualisation (secondary) ==== | ||
| + | There is also a second Proxmox server with only one NIC. \\ | ||
| + | It is running on a MacMini and will only be turned on if needed to safe power. \\ | ||
| + | |||
| + | Proxmox runs on Apple Hardware, but there are some driver issues. \\ | ||
| + | Disable modules: \\ | ||
| + | < | ||
| + | cat >> / | ||
| + | blacklist pcspkr | ||
| + | blacklist b43 | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | don't enable readondriver (which breaks to console) \\ | ||
| + | vi / | ||
| + | < | ||
| + | GRUB_CMDLINE_LINUX_DEFAULT=" | ||
| + | </ | ||
| + | update-grub | ||
| + | |||
| + | Management: \\ | ||
| + | [[https:// | ||
| ==== Firewall ==== | ==== Firewall ==== | ||
| Line 277: | Line 300: | ||
| [[http:// | [[http:// | ||
| - | encryption: | + | ==== Reverse Proxy ==== |
| - | * apt-get install nginx | + | There will be multiple services on the internal network with need certificates |
| - | * self-sigend cert | + | Lets encrypt should be used when possible \\ |
| - | * mkdir / | + | |
| - | * chmod 700 / | + | port 80 will point to one server \\ |
| - | * openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout / | + | |
| - | * Country Name (2 letter code) [AU]:DE | + | Fritzbox configuration: |
| - | * State or Province Name (full name) [Some-State]:BY | + | * forward port 80 and 443 to 192.168.1.11 |
| - | * Locality Name (eg, city) []:UZB | + | |
| - | * Organization Name (eg, company) [Internet Widgits Pty Ltd]: | + | fw01.devbase.org configuration |
| - | * Organizational Unit Name (eg, section) []: | + | * Firewall |
| - | * Common Name (e.g. server FQDN or YOUR name) []:chat.devbase.org | + | * new |
| - | * Email Address []: | + | * Interface: WAN |
| - | * vi /etc/nginx/ | + | * Destination: |
| + | * Destination port rang: 3000 - 3000 | ||
| + | * Redirect target IP: 192.168.10.12 | ||
| + | * Redirect target port: 3000 | ||
| + | * Firewall -> Rules -> WAN | ||
| + | * move newly created NAT rule to the right place in the ruleset | ||
| + | * don't forget to save and activate | ||
| + | |||
| + | Server Configuration: | ||
| + | * Install Ubuntu 16.04 LTS | ||
| + | * vi /etc/network/interfaces | ||
| < | < | ||
| + | iface ens18 inet static | ||
| + | address 192.168.1.11/ | ||
| + | gateway 192.168.1.1 | ||
| + | dns-nameservers 192.168.1.1 | ||
| + | </ | ||
| + | * apt-get install software-properties-common | ||
| + | * add-apt-repository ppa: | ||
| + | * apt-get update | ||
| + | * apt-get install certbot nginx | ||
| + | * mkdir / | ||
| + | * vi / | ||
| + | < | ||
| + | server { | ||
| + | listen 80; | ||
| + | server_name chat.devbase.org; | ||
| + | index index.html index.htm; | ||
| + | location / { | ||
| + | alias / | ||
| + | } | ||
| + | } | ||
| + | |||
| server { | server { | ||
| # | # | ||
| Line 298: | Line 352: | ||
| ssl on; | ssl on; | ||
| - | | + | ssl_certificate / |
| - | ssl_certificate_key / | + | ssl_certificate_key / |
| - | #ssl_certificate / | + | |
| - | | + | |
| location / { | location / { | ||
| Line 308: | Line 360: | ||
| proxy_set_header Host $http_host; | proxy_set_header Host $http_host; | ||
| proxy_set_header X-NginX-Proxy true; | proxy_set_header X-NginX-Proxy true; | ||
| - | proxy_pass http://127.0.0.1: | + | proxy_pass http://192.168.1.10:3000; |
| proxy_redirect off; | proxy_redirect off; | ||
| } | } | ||
| } | } | ||
| </ | </ | ||
| - | * nginx -t | + | * ln -s /etc/nginx/sites-available/ |
| - | * systemctl start nginx | + | * systemctl restart nginx.service |
| - | * systemctl enable nginx | + | * certbot certonly --webroot |
| - | * lets encrypt cert | + | * systemctl |
| - | * apt-get install letsencrypt | + | * echo "* 3 * * * root certbot renew" >> |
| - | * letsencrypt certonly --standalone -d chat.devbase.org | + | |
| - | * change ss-certificate and ssl_certificate_key lines in / | + | |
| - | + | ||
| - | ==== Chat (Matrix) ==== | + | |
| - | * Install Ubuntu 16.04 LTS | + | |
| - | * apt update && sudo apt upgrade | + | |
| - | * add-apt-repository https://matrix.org/packages/ | + | |
| - | * wget https:// | + | |
| - | * apt-key add - < key | + | |
| - | * apt update | + | |
| - | * apt install matrix-synapse python-matrix-synapse-ldap3 | + | |
| - | * Server Name: matrix.devbase.org | + | |
| - | * cat / | + | |
| - | * vi / | + | |
| - | * registration_shared_secret: | + | |
| - | * systemctl | + | |
| - | * systemctl start matrix-synapse.service | + | |
| - | | + | |
| - | * name root | + | |
| - | * set password | + | |
| - | * make admin = yes | + | |
| - | + | ||
| - | Public DNS Recort for federation | + | |
| - | SRV matrix_tcp.devbase.org | + | |
| ==== VPN ==== | ==== VPN ==== | ||
| Line 404: | Line 432: | ||
| ==== nextcloud ==== | ==== nextcloud ==== | ||
| + | * install Ubuntu 16.04 LTS | ||
| + | * configure network | ||
| + | * apt update && sudo apt upgrade | ||
| + | * apt-get install apache2 mariadb-server libapache2-mod-php7.0 | ||
| + | * apt-get install php7.0-gd php7.0-json php7.0-mysql php7.0-curl php7.0-mbstring php7.0-intl php7.0-mcrypt php-imagick php7.0-xml php7.0-zip php7.0-ldap | ||
| + | * mkdir / | ||
| + | * wget " | ||
| + | * tar xf nextcloud*.tar.bz2 | ||
| + | * mv nextcloud /var/www/ | ||
| + | * chown -R www-data.www-data / | ||
| + | * cat >/ | ||
| + | < | ||
| + | Alias /nextcloud "/ | ||
| + | |||
| + | < | ||
| + | | ||
| + | | ||
| + | |||
| + | < | ||
| + | Dav off | ||
| + | </ | ||
| + | |||
| + | | ||
| + | | ||
| + | </ | ||
| + | EOF | ||
| + | * ln -s / | ||
| + | * mysql_secure_installation | ||
| + | * mysql -u root -p | ||
| + | * CREATE USER ' | ||
| + | * CREATE DATABASE nextcloud; | ||
| + | * GRANT ALL PRIVILEGES ON nextcloud.* TO ' | ||
| + | * cat >> / | ||
| + | < | ||
| + | opcache.enable=1 | ||
| + | opcache.enable_cli=1 | ||
| + | opcache.interned_strings_buffer=8 | ||
| + | opcache.max_accelerated_files=10000 | ||
| + | opcache.memory_consumption=128 | ||
| + | opcache.save_comments=1 | ||
| + | opcache.revalidate_freq=1 | ||
| + | EOF | ||
| + | </ | ||
| + | * systemctl restart apache2.service | ||
| + | * browse to http:// | ||
| + | * enter new user credentials for admin user | ||
| + | * configure database | ||
| + | * enable apps: | ||
| + | * calendar | ||
| + | * contacts | ||
| + | * deck | ||
| + | * tasks | ||
| + | * LDAP user and group backend | ||
| + | * Admin -> LDAP | ||
| + | * Advanced | ||
| + | * Turn off SSL certificate validation = checked | ||
| + | * Server | ||
| + | * Server: ldaps:/ / | ||
| + | * User: cn=s-nextcloud, | ||
| + | * Base DN: dc=devbase, | ||
| + | * Users | ||
| + | * persons | ||
| + | * Login Attributes | ||
| + | * LDAP user | ||
| + | * Group | ||
| + | * devbase_delegate_access_nextcloud | ||
| + | ==== gitlab ==== | ||
| + | * install Ubuntu 16.04 LTS | ||
| + | * configure network | ||
| + | * apt update && sudo apt upgrade | ||
| + | * sudo apt-get install -y curl openssh-server ca-certificates | ||
| + | * curl https:// | ||
| + | * sudo echo en_US.UTF-8 UTF-8 > / | ||
| + | * sudo locale-gen en_US.UTF-8 | ||
| + | * LC_ALL=" | ||
| + | * LC_CTYPE=" | ||
| + | * sudo EXTERNAL_URL=" | ||
| + | * browse to http:// | ||
| + | * vi / | ||
| + | < | ||
| + | gitlab_rails[' | ||
| + | gitlab_rails[' | ||
| + | main: # ' | ||
| + | label: ' | ||
| + | host: ' | ||
| + | port: 389 | ||
| + | uid: ' | ||
| + | bind_dn: ' | ||
| + | password: ' | ||
| + | encryption: ' | ||
| + | verify_certificates: | ||
| + | active_directory: | ||
| + | allow_username_or_email_login: | ||
| + | lowercase_usernames: | ||
| + | block_auto_created_users: | ||
| + | base: ' | ||
| + | # | ||
| + | EOS | ||
| + | </ | ||
| + | * gitlab-ctl reconfigure | ||
| + | * gitlab-rake gitlab: | ||
| + | |||
| + | ==== Music ==== | ||
| + | Background music should not be interrupted by rebooting clients or phones leaving the building. \\ | ||
| + | A dedicated client should play the music and controllable by all kind of devices. | ||
| + | |||
| + | * download runeaudio for RPi | ||
| + | * flash to SD card and boot | ||
| + | * browse http://ip | ||
| + | * settings | ||
| + | * hostname: music01 | ||
| + | * airplay: on | ||
| + | * airplay name: music01 | ||
| + | * UPnP: on | ||
| + | * UPnP name: music01 | ||
| + | * ssh root@ip | ||
| + | * passwd | ||
| + | * cat >> / | ||
| + | < | ||
| + | audio_output { | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | # bitrate | ||
| + | | ||
| + | | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | * Library | ||
| + | * Webradio | ||
| + | * http:// | ||
| + | * http:// | ||
| + | * http:// | ||
| + | |||
| + | Management: \\ | ||
| + | [[http:// | ||
| + | |||
| + | ==== Ubiquiti Controller ==== | ||
| + | To manage the Unfi WiFi access points a Controller is needed | ||
| + | * Install Ubuntu 16.04 LTS | ||
| + | * echo 'deb http:// | ||
| + | * apt-key adv --keyserver keyserver.ubuntu.com --recv 06E85760C0A52C50 | ||
| + | * apt-get install unifi | ||
| + | * https://< | ||
| ==== Wiki ==== | ==== Wiki ==== | ||
| + | ==== Matrix - testing only ==== | ||
| + | * Install Ubuntu 16.04 LTS | ||
| + | * apt update && sudo apt upgrade | ||
| + | * add-apt-repository https:// | ||
| + | * wget https:// | ||
| + | * apt-key add - < key | ||
| + | * apt update | ||
| + | * apt install matrix-synapse python-matrix-synapse-ldap3 | ||
| + | * Server Name: matrix.devbase.org | ||
| + | * cat / | ||
| + | * vi / | ||
| + | * registration_shared_secret: | ||
| + | * systemctl enable matrix-synapse.service | ||
| + | * systemctl start matrix-synapse.service | ||
| + | * register_new_matrix_user -c / | ||
| + | * name root | ||
| + | * set password | ||
| + | * make admin = yes | ||
| + | |||
| + | Public DNS Recort for federation | ||
| + | SRV matrix_tcp.devbase.org | ||
projects/base-infrastructure.1505547717.txt.gz · Last modified: 2017-09-16 07:41 by trinitor
Page Tools
