projects:base-infrastructure
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
projects:base-infrastructure [2017-09-10 13:42] trinitor [Wireless] |
projects:base-infrastructure [2018-05-13 08:58] (current) trinitor [gitlab] |
||
|---|---|---|---|
| Line 2: | Line 2: | ||
| ===== Overview ===== | ===== Overview ===== | ||
| - | The space needs infrastructure to be operational. \\ | + | The base needs infrastructure to be operational. \\ |
| One key basic needs of every human beeing besides a room, power, water and Mate is of cause Internet | One key basic needs of every human beeing besides a room, power, water and Mate is of cause Internet | ||
| - | When we had the go to move into the room there was already a Internet | + | When we had the go to move into the room there was already a Internet |
| The three parties in the building should be segmented from each other. | The three parties in the building should be segmented from each other. | ||
| The resulting infrastructure description should be generic and the concept usable by other Hackerspaces or even smaller companies. | The resulting infrastructure description should be generic and the concept usable by other Hackerspaces or even smaller companies. | ||
| - | ===== Current/Old Environment ===== | + | ===== Concept |
| - | + | ||
| - | Description of the setup when we started | + | |
| - | + | ||
| - | < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | | + | |
| - | | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | | + | |
| - | | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | </ | + | |
| - | + | ||
| - | Fritzbox is connected to one port of a Qnap. \\ | + | |
| - | The Qnap hosts a pfSense VM which is dual homed on both available NICs \\ | + | |
| - | The internal Network is behind the pfSense. \\ | + | |
| - | The equipment is in the base, but shouldn' | + | |
| - | + | ||
| - | Everything was connected to the Switch somehow. | + | |
| - | There is at least one network connection to the other flats. Ther are more switches and Access Points. | + | |
| - | + | ||
| - | ===== New Environment | + | |
| The WAN port of the Fritzbox is unusable, because it is only usable for DSL. We have FTTB \\ | The WAN port of the Fritzbox is unusable, because it is only usable for DSL. We have FTTB \\ | ||
| Line 57: | Line 20: | ||
| New highlevel layout | New highlevel layout | ||
| < | < | ||
| - | | + | +-------------+ |
| - | | Fritzbox | + | |
| - | +-+----+----++ | + | | 192.168.1.1 | |
| - | | | | | + | +-+----+----+-+ |
| - | | + | |
| - | | + | +------------------+ |
| - | 3rd floor | 2nd+floor| | + | | |
| - | | + | 3rd floor | 2nd floor| |
| - | +----------+---------+ | + | | |
| - | | | + | | |
| - | | 192.168.1.31 | + | +---------+---------+ |
| - | | +---------------+ | + | | WLAN Router |
| - | | | 192.168.1.30 | + | | |
| - | | | | + | | |
| - | | | + | | 192.168.30.0/24 | |
| - | | | +------+ | + | +-------------------+ |
| - | | |192.168.30.0/24| | + | | vmbr0 | |
| - | +------------+-------+ +----+----+--+-------+ | + | | |
| - | | + | |
| - | | | + | |
| - | +--------+-------+ | + | | |
| - | | Netgear Switch | 192.168.10.0/ | + | +-----------+---+-------------------------------------+ |
| - | | + | |
| - | +----------------+ | + | Virtual Servers (vmbr2, servers)| |
| - | | Virtual Switch | | Switch | + | | | |
| - | +-------+--+-----+ | + | +----------+ +----------------+ |
| - | | | | | | + | | | |
| - | | + | 192.168.10.0/ |
| - | | + | |
| - | +----------+--+ | + | +--------+-------+ |
| - | | auth VM | + | | Virtual Switch | |
| - | |192.168.10.11| | + | +------+--+------+ |
| - | +-------------+ | + | |
| + | +----+ | ||
| + | | | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| </ | </ | ||
| Line 98: | Line 67: | ||
| This is the shared network and it belongs to the building itself. \\ | This is the shared network and it belongs to the building itself. \\ | ||
| The Fritzbox itself is managed by trinitor \\ | The Fritzbox itself is managed by trinitor \\ | ||
| - | Be biggest challenge will the the fight for port forwarding. \\ | ||
| - | A shared webserver in the shared network as a reverse proxy could solve the 80/443 fight. \\ | ||
| - | Will be done when we have the need. | ||
| Every floor can have 10 static IPs in the shared network \\ | Every floor can have 10 static IPs in the shared network \\ | ||
| Line 132: | Line 98: | ||
| |192.168.11.4 | |192.168.11.4 | ||
| |192.168.11.10 |virt01 | |192.168.11.10 |virt01 | ||
| + | |192.168.11.11 |virt02 | ||
| + | |192.168.11.20 |music01 | ||
| ^Virtual Machines ^^^ | ^Virtual Machines ^^^ | ||
| + | |192.168.1.11 | ||
| |192.168.10.11 |auth01 | |192.168.10.11 |auth01 | ||
| |192.168.10.12 |chat01 | |192.168.10.12 |chat01 | ||
| - | ==== Virtualisation ==== | + | ==== Virtualisation |
| There are some options (ESXi, XenServer, oVirt, ...), but the simplest one seems to be Proxmox. \\ | There are some options (ESXi, XenServer, oVirt, ...), but the simplest one seems to be Proxmox. \\ | ||
| An old Dell Notebook with an additional USB NIC will be used for now. \\ | An old Dell Notebook with an additional USB NIC will be used for now. \\ | ||
| Line 148: | Line 117: | ||
| ^Bridges (virtual switches) ^^ | ^Bridges (virtual switches) ^^ | ||
| |vmbr0 |Internal Bridge, eno1, 192.168.11.10 | | |vmbr0 |Internal Bridge, eno1, 192.168.11.10 | | ||
| - | |vmbr1 |External Bridge, enx9ceb, | + | |vmbr1 |External Bridge, enx9ceb, |
| |vmbr2 |Server Bridge, no NIC connected, no IP assigned | | |vmbr2 |Server Bridge, no NIC connected, no IP assigned | | ||
| Line 158: | Line 127: | ||
| Management: \\ | Management: \\ | ||
| [[https:// | [[https:// | ||
| + | |||
| + | ==== Virtualisation (secondary) ==== | ||
| + | There is also a second Proxmox server with only one NIC. \\ | ||
| + | It is running on a MacMini and will only be turned on if needed to safe power. \\ | ||
| + | |||
| + | Proxmox runs on Apple Hardware, but there are some driver issues. \\ | ||
| + | Disable modules: \\ | ||
| + | < | ||
| + | cat >> / | ||
| + | blacklist pcspkr | ||
| + | blacklist b43 | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | don't enable readondriver (which breaks to console) \\ | ||
| + | vi / | ||
| + | < | ||
| + | GRUB_CMDLINE_LINUX_DEFAULT=" | ||
| + | </ | ||
| + | update-grub | ||
| + | |||
| + | Management: \\ | ||
| + | [[https:// | ||
| ==== Firewall ==== | ==== Firewall ==== | ||
| Line 201: | Line 193: | ||
| Groups: \\ | Groups: \\ | ||
| - | * delegate | ||
| - | * devbase_delegate_rocketchat_access | ||
| - | * members: devbase_role_members, | ||
| - | * devbase_delegate_wiki_members | ||
| - | * members: devbase_role_members | ||
| - | * devbase_delegate_wiki_orgas | ||
| - | * devbase_role_orgas | ||
| - | * devbase_delegate_wireless_access | ||
| - | * members: devbase_role_members | ||
| - | * Radius: allow access enabled | ||
| * roles | * roles | ||
| * devbase_role_admins | * devbase_role_admins | ||
| Line 220: | Line 202: | ||
| * members: trinitor | * members: trinitor | ||
| * devbase_role_orgas | * devbase_role_orgas | ||
| - | * members: trinitor | + | * members: trinitor, ... |
| + | * delegation groups | ||
| + | * devbase_delegate_wireless_access | ||
| + | * members: devbase_role_members | ||
| + | * Radius: allow access enabled | ||
| + | * devbase_delegate_rocketchat_access | ||
| + | * members: devbase_role_members, | ||
| + | * devbase_delegate_wiki_members | ||
| + | * members: devbase_role_members | ||
| + | * devbase_delegate_wiki_orgas | ||
| + | * devbase_role_orgas | ||
| + | |||
| + | LDAP: \\ | ||
| + | * create service account (per system) | ||
| + | * Lastname: s-systemname | ||
| + | * Username: s-systemname | ||
| + | * Options | ||
| + | * Kerberos principal | ||
| + | * POSIX account | ||
| + | * Samba account | ||
| + | * test | ||
| + | * Install Apache Directory Studio | ||
| + | * Hostname: auth01.devbase.org | ||
| + | * Port: 389 | ||
| + | * Encryption: StartTLS | ||
| + | * Bind DN: cn=s-systemname, | ||
| + | * Bind Password: xxx | ||
| Management: \\ | Management: \\ | ||
| [[https:// | [[https:// | ||
| - | |||
| ==== Wireless ==== | ==== Wireless ==== | ||
| Line 241: | Line 248: | ||
| === Access Point Config === | === Access Point Config === | ||
| - | |SSID |/dev/base | | + | |SSID |/ |
| - | |Version | + | |Version |
| - | |Encryption | + | |Encryption |
| |Radius Server IP |192.168.10.11 | | |Radius Server IP |192.168.10.11 | | ||
| - | |Radius Port |1812 | | + | |Radius Port |
| - | |Radius Password | + | |Radius Password |
| - | |Group Key Update Period |0 | | + | |Group Key Update Period |0 |
| === UCS Config === | === UCS Config === | ||
| Line 253: | Line 260: | ||
| < | < | ||
| client 192.168.11.3 { | client 192.168.11.3 { | ||
| - | secret=*** | + | secret=xxx |
| shortname=ap01 | shortname=ap01 | ||
| } | } | ||
| Line 266: | Line 273: | ||
| * systemctl enable snap.rocketchat-server.rocketchat-server.service | * systemctl enable snap.rocketchat-server.rocketchat-server.service | ||
| * systemctl status snap.rocketchat-server.rocketchat-server.service | * systemctl status snap.rocketchat-server.rocketchat-server.service | ||
| + | |||
| + | LDAP: \\ | ||
| + | * Administration -> LDAP | ||
| + | * Enable: yes | ||
| + | * Login Fallback: True | ||
| + | * Host: auth01.devbase.org | ||
| + | * Port: 389 | ||
| + | * Encryption: StartTLS | ||
| + | * CA Cert: -----BEGIN CERTIFICATE----- ... | ||
| + | * Reject: Unauthorized | ||
| + | * Domain Base: dc=devbase, | ||
| + | * Use Custom Domain Search | ||
| + | < | ||
| + | {" | ||
| + | </ | ||
| + | * enable LDAP user group filter: false | ||
| + | * Username Field: sAMAccountName | ||
| + | * Unique Identifier Field: objectGUID, | ||
| + | * Sync Data: True | ||
| + | * Sync User Avatar: True | ||
| + | * User Data Field Map: {" | ||
| + | * Merge existing users: False | ||
| + | * Import LDAP users: True | ||
| Login: \\ | Login: \\ | ||
| [[http:// | [[http:// | ||
| - | ==== Chat (Matrix) ==== | + | ==== Reverse Proxy ==== |
| + | There will be multiple services on the internal network with need certificates \\ | ||
| + | Lets encrypt should be used when possible \\ | ||
| + | |||
| + | port 80 will point to one server \\ | ||
| + | |||
| + | Fritzbox configuration: | ||
| + | * forward port 80 and 443 to 192.168.1.11 | ||
| + | |||
| + | fw01.devbase.org configuration | ||
| + | * Firewall -> NAT | ||
| + | * new | ||
| + | * Interface: WAN | ||
| + | * Destination: | ||
| + | * Destination port rang: 3000 - 3000 | ||
| + | * Redirect target IP: 192.168.10.12 | ||
| + | * Redirect target port: 3000 | ||
| + | * Firewall -> Rules -> WAN | ||
| + | * move newly created NAT rule to the right place in the ruleset | ||
| + | * don't forget to save and activate | ||
| + | |||
| + | Server Configuration: | ||
| + | * Install Ubuntu 16.04 LTS | ||
| + | * vi / | ||
| + | < | ||
| + | iface ens18 inet static | ||
| + | address 192.168.1.11/ | ||
| + | gateway 192.168.1.1 | ||
| + | dns-nameservers 192.168.1.1 | ||
| + | </ | ||
| + | * apt-get install software-properties-common | ||
| + | * add-apt-repository ppa: | ||
| + | * apt-get update | ||
| + | * apt-get install certbot nginx | ||
| + | * mkdir / | ||
| + | * vi / | ||
| + | < | ||
| + | server { | ||
| + | listen 80; | ||
| + | server_name chat.devbase.org; | ||
| + | index index.html index.htm; | ||
| + | location / { | ||
| + | alias / | ||
| + | } | ||
| + | } | ||
| + | |||
| + | server { | ||
| + | # | ||
| + | listen 443 ssl default_server; | ||
| + | server_name chat.devbase.org; | ||
| + | |||
| + | ssl on; | ||
| + | ssl_certificate / | ||
| + | ssl_certificate_key / | ||
| + | |||
| + | location / { | ||
| + | proxy_set_header X-Real-IP $remote_addr; | ||
| + | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| + | proxy_set_header Host $http_host; | ||
| + | proxy_set_header X-NginX-Proxy true; | ||
| + | proxy_pass http:// | ||
| + | proxy_redirect off; | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | * ln -s / | ||
| + | * systemctl restart nginx.service | ||
| + | * certbot certonly --webroot -w / | ||
| + | * systemctl restart nginx.service | ||
| + | * echo "* 3 * * * root certbot renew" >> / | ||
| + | |||
| + | ==== VPN ==== | ||
| + | |||
| + | === Certificate ==== | ||
| + | * pfsense | ||
| + | * System -> Cert Manager | ||
| + | * New CA | ||
| + | * Create an internal CA | ||
| + | * key length 4096 | ||
| + | * Digest Algorithm 256bit | ||
| + | * common name fw01.devbase.org | ||
| + | |||
| + | * ssh auth01.devbase.org | ||
| + | * vi / | ||
| + | < | ||
| + | client 192.168.11.1 { | ||
| + | secret=xxx | ||
| + | shortname=fw01 | ||
| + | } | ||
| + | </ | ||
| + | * systemctl restart freeradius.service | ||
| + | |||
| + | * System -> User Manager | ||
| + | * Authentiction Servers | ||
| + | * Name: auth01.devbase.org radius | ||
| + | * IP: 192.168.10.11 | ||
| + | * shared secret: xxx | ||
| + | |||
| + | * VPN -> OpenVPN | ||
| + | * Wizard | ||
| + | * Type: Radius | ||
| + | * Radius Server: auth01.devbase.org radius | ||
| + | * new server certificate | ||
| + | * name: vpn.devbase.org | ||
| + | * key length: 4096 | ||
| + | * Server Setup | ||
| + | * Interface: WAN | ||
| + | * Protocol: UDP | ||
| + | * local port: 1194 | ||
| + | * Tunnel Network: 192.168.12.0/ | ||
| + | * Firewall rules | ||
| + | * Firewall Rule: checked | ||
| + | * OpenVPN rule: checked | ||
| + | |||
| + | * Install pfsense package openvpn-client-export | ||
| + | * VPN -> OpenVPN | ||
| + | * Client Export | ||
| + | * Host Name Resolution: Other | ||
| + | * Hostname: vpn.devbase.org | ||
| + | * Verify Server CN: Do not verify | ||
| + | * Use Random Local Port: checked | ||
| + | * export config | ||
| + | |||
| + | * Rulebase for OpenVPN | ||
| + | * allow * to LAN NET | ||
| + | * allow * to Server NET | ||
| + | * allow * to * 53 UDP | ||
| + | * allow * to trusted sites | ||
| + | * allow * to ICMP | ||
| + | * block * to * | ||
| + | |||
| + | ==== nextcloud ==== | ||
| + | * install Ubuntu 16.04 LTS | ||
| + | * configure network | ||
| + | * apt update && sudo apt upgrade | ||
| + | * apt-get install apache2 mariadb-server libapache2-mod-php7.0 | ||
| + | * apt-get install php7.0-gd php7.0-json php7.0-mysql php7.0-curl php7.0-mbstring php7.0-intl php7.0-mcrypt php-imagick php7.0-xml php7.0-zip php7.0-ldap | ||
| + | * mkdir / | ||
| + | * wget " | ||
| + | * tar xf nextcloud*.tar.bz2 | ||
| + | * mv nextcloud /var/www/ | ||
| + | * chown -R www-data.www-data / | ||
| + | * cat >/ | ||
| + | < | ||
| + | Alias /nextcloud "/ | ||
| + | |||
| + | < | ||
| + | | ||
| + | | ||
| + | |||
| + | < | ||
| + | Dav off | ||
| + | </ | ||
| + | |||
| + | | ||
| + | | ||
| + | </ | ||
| + | EOF | ||
| + | * ln -s / | ||
| + | * mysql_secure_installation | ||
| + | * mysql -u root -p | ||
| + | * CREATE USER ' | ||
| + | * CREATE DATABASE nextcloud; | ||
| + | * GRANT ALL PRIVILEGES ON nextcloud.* TO ' | ||
| + | * cat >> / | ||
| + | < | ||
| + | opcache.enable=1 | ||
| + | opcache.enable_cli=1 | ||
| + | opcache.interned_strings_buffer=8 | ||
| + | opcache.max_accelerated_files=10000 | ||
| + | opcache.memory_consumption=128 | ||
| + | opcache.save_comments=1 | ||
| + | opcache.revalidate_freq=1 | ||
| + | EOF | ||
| + | </ | ||
| + | * systemctl restart apache2.service | ||
| + | * browse to http:// | ||
| + | * enter new user credentials for admin user | ||
| + | * configure database | ||
| + | * enable apps: | ||
| + | * calendar | ||
| + | * contacts | ||
| + | * deck | ||
| + | * tasks | ||
| + | * LDAP user and group backend | ||
| + | * Admin -> LDAP | ||
| + | * Advanced | ||
| + | * Turn off SSL certificate validation = checked | ||
| + | * Server | ||
| + | * Server: ldaps:/ / | ||
| + | * User: cn=s-nextcloud, | ||
| + | * Base DN: dc=devbase, | ||
| + | * Users | ||
| + | * persons | ||
| + | * Login Attributes | ||
| + | * LDAP user | ||
| + | * Group | ||
| + | * devbase_delegate_access_nextcloud | ||
| + | |||
| + | ==== gitlab ==== | ||
| + | * install Ubuntu 16.04 LTS | ||
| + | * configure network | ||
| + | * apt update && sudo apt upgrade | ||
| + | * sudo apt-get install -y curl openssh-server ca-certificates | ||
| + | * curl https:// | ||
| + | * sudo echo en_US.UTF-8 UTF-8 > / | ||
| + | * sudo locale-gen en_US.UTF-8 | ||
| + | * LC_ALL=" | ||
| + | * LC_CTYPE=" | ||
| + | * sudo EXTERNAL_URL=" | ||
| + | * browse to http:// | ||
| + | * vi / | ||
| + | < | ||
| + | gitlab_rails[' | ||
| + | gitlab_rails[' | ||
| + | main: # ' | ||
| + | label: ' | ||
| + | host: ' | ||
| + | port: 389 | ||
| + | uid: ' | ||
| + | bind_dn: ' | ||
| + | password: ' | ||
| + | encryption: ' | ||
| + | verify_certificates: | ||
| + | active_directory: | ||
| + | allow_username_or_email_login: | ||
| + | lowercase_usernames: | ||
| + | block_auto_created_users: | ||
| + | base: ' | ||
| + | # | ||
| + | EOS | ||
| + | </ | ||
| + | * gitlab-ctl reconfigure | ||
| + | * gitlab-rake gitlab: | ||
| + | |||
| + | ==== Music ==== | ||
| + | Background music should not be interrupted by rebooting clients or phones leaving the building. \\ | ||
| + | A dedicated client should play the music and controllable by all kind of devices. | ||
| + | |||
| + | * download runeaudio for RPi | ||
| + | * flash to SD card and boot | ||
| + | * browse http://ip | ||
| + | * settings | ||
| + | * hostname: music01 | ||
| + | * airplay: on | ||
| + | * airplay name: music01 | ||
| + | * UPnP: on | ||
| + | * UPnP name: music01 | ||
| + | * ssh root@ip | ||
| + | * passwd | ||
| + | * cat >> / | ||
| + | < | ||
| + | audio_output { | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | # bitrate | ||
| + | | ||
| + | | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | * Library | ||
| + | * Webradio | ||
| + | * http:// | ||
| + | * http:// | ||
| + | * http:// | ||
| + | |||
| + | Management: \\ | ||
| + | [[http:// | ||
| + | |||
| + | ==== Ubiquiti Controller ==== | ||
| + | To manage the Unfi WiFi access points a Controller is needed | ||
| + | * Install Ubuntu 16.04 LTS | ||
| + | * echo 'deb http:// | ||
| + | * apt-key adv --keyserver keyserver.ubuntu.com --recv 06E85760C0A52C50 | ||
| + | * apt-get install unifi | ||
| + | * https://< | ||
| + | ==== Wiki ==== | ||
| + | |||
| + | ==== Matrix | ||
| * Install Ubuntu 16.04 LTS | * Install Ubuntu 16.04 LTS | ||
| * apt update && sudo apt upgrade | * apt update && sudo apt upgrade | ||
| Line 291: | Line 604: | ||
| Public DNS Recort for federation | Public DNS Recort for federation | ||
| SRV matrix_tcp.devbase.org | SRV matrix_tcp.devbase.org | ||
| - | |||
| - | ==== VPN ==== | ||
| - | |||
| - | ==== nextcloud ==== | ||
| - | |||
| - | ==== Wiki ==== | ||
| - | the wiki could also be hosted internally. No external server required, Data not stored somewhere | ||
| - | |||
projects/base-infrastructure.1505050948.txt.gz · Last modified: 2017-09-10 13:42 by trinitor
Page Tools
