projects:base-infrastructure
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| projects:base-infrastructure [2017-09-11 18:26] – trinitor | projects:base-infrastructure [2018-05-13 08:58] (current) – [gitlab] trinitor | ||
|---|---|---|---|
| Line 20: | Line 20: | ||
| New highlevel layout | New highlevel layout | ||
| < | < | ||
| - | | + | +-------------+ |
| - | | Fritzbox | + | |
| - | +-+----+----++ | + | | 192.168.1.1 | |
| - | | | | | + | +-+----+----+-+ |
| - | | + | |
| - | | + | +------------------+ |
| - | 3rd floor | 2nd+floor| | + | | |
| - | | + | 3rd floor | 2nd floor| |
| - | +----------+---------+ | + | | |
| - | | | + | | |
| - | | 192.168.1.31 | + | +---------+---------+ |
| - | | +---------------+ | + | | WLAN Router |
| - | | | 192.168.1.30 | + | | |
| - | | | | + | | |
| - | | | + | | 192.168.30.0/24 | |
| - | | | +------+ | + | +-------------------+ |
| - | | |192.168.30.0/24| | + | | vmbr0 | |
| - | +------------+-------+ +----+----+--+-------+ | + | | |
| - | | + | |
| - | | | + | |
| - | +--------+-------+ | + | | |
| - | | Netgear Switch | 192.168.10.0/ | + | +-----------+---+-------------------------------------+ |
| - | | + | |
| - | +----------------+ | + | Virtual Servers (vmbr2, servers)| |
| - | | Virtual Switch | | Switch | + | | | |
| - | +-------+--+-----+ | + | +----------+ +----------------+ |
| - | | | | | | + | | | |
| - | | + | 192.168.10.0/ |
| - | | + | |
| - | +----------+--+ | + | +--------+-------+ |
| - | | auth VM | + | | Virtual Switch | |
| - | |192.168.10.11| | + | +------+--+------+ |
| - | +-------------+ | + | |
| + | +----+ | ||
| + | | | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| </ | </ | ||
| Line 61: | Line 67: | ||
| This is the shared network and it belongs to the building itself. \\ | This is the shared network and it belongs to the building itself. \\ | ||
| The Fritzbox itself is managed by trinitor \\ | The Fritzbox itself is managed by trinitor \\ | ||
| - | Be biggest challenge will the the fight for port forwarding. \\ | ||
| - | A shared webserver in the shared network as a reverse proxy could solve the 80/443 fight. \\ | ||
| - | Will be done when we have the need. | ||
| Every floor can have 10 static IPs in the shared network \\ | Every floor can have 10 static IPs in the shared network \\ | ||
| Line 95: | Line 98: | ||
| |192.168.11.4 | |192.168.11.4 | ||
| |192.168.11.10 |virt01 | |192.168.11.10 |virt01 | ||
| + | |192.168.11.11 |virt02 | ||
| + | |192.168.11.20 |music01 | ||
| ^Virtual Machines ^^^ | ^Virtual Machines ^^^ | ||
| + | |192.168.1.11 | ||
| |192.168.10.11 |auth01 | |192.168.10.11 |auth01 | ||
| |192.168.10.12 |chat01 | |192.168.10.12 |chat01 | ||
| - | ==== Virtualisation ==== | + | ==== Virtualisation |
| There are some options (ESXi, XenServer, oVirt, ...), but the simplest one seems to be Proxmox. \\ | There are some options (ESXi, XenServer, oVirt, ...), but the simplest one seems to be Proxmox. \\ | ||
| An old Dell Notebook with an additional USB NIC will be used for now. \\ | An old Dell Notebook with an additional USB NIC will be used for now. \\ | ||
| Line 111: | Line 117: | ||
| ^Bridges (virtual switches) ^^ | ^Bridges (virtual switches) ^^ | ||
| |vmbr0 |Internal Bridge, eno1, 192.168.11.10 | | |vmbr0 |Internal Bridge, eno1, 192.168.11.10 | | ||
| - | |vmbr1 |External Bridge, enx9ceb, | + | |vmbr1 |External Bridge, enx9ceb, |
| |vmbr2 |Server Bridge, no NIC connected, no IP assigned | | |vmbr2 |Server Bridge, no NIC connected, no IP assigned | | ||
| Line 121: | Line 127: | ||
| Management: \\ | Management: \\ | ||
| [[https:// | [[https:// | ||
| + | |||
| + | ==== Virtualisation (secondary) ==== | ||
| + | There is also a second Proxmox server with only one NIC. \\ | ||
| + | It is running on a MacMini and will only be turned on if needed to safe power. \\ | ||
| + | |||
| + | Proxmox runs on Apple Hardware, but there are some driver issues. \\ | ||
| + | Disable modules: \\ | ||
| + | < | ||
| + | cat >> / | ||
| + | blacklist pcspkr | ||
| + | blacklist b43 | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | don't enable readondriver (which breaks to console) \\ | ||
| + | vi / | ||
| + | < | ||
| + | GRUB_CMDLINE_LINUX_DEFAULT=" | ||
| + | </ | ||
| + | update-grub | ||
| + | |||
| + | Management: \\ | ||
| + | [[https:// | ||
| ==== Firewall ==== | ==== Firewall ==== | ||
| Line 184: | Line 213: | ||
| * devbase_delegate_wiki_orgas | * devbase_delegate_wiki_orgas | ||
| * devbase_role_orgas | * devbase_role_orgas | ||
| + | |||
| + | LDAP: \\ | ||
| + | * create service account (per system) | ||
| + | * Lastname: s-systemname | ||
| + | * Username: s-systemname | ||
| + | * Options | ||
| + | * Kerberos principal | ||
| + | * POSIX account | ||
| + | * Samba account | ||
| + | * test | ||
| + | * Install Apache Directory Studio | ||
| + | * Hostname: auth01.devbase.org | ||
| + | * Port: 389 | ||
| + | * Encryption: StartTLS | ||
| + | * Bind DN: cn=s-systemname, | ||
| + | * Bind Password: xxx | ||
| Management: \\ | Management: \\ | ||
| Line 203: | Line 248: | ||
| === Access Point Config === | === Access Point Config === | ||
| - | |SSID |/dev/base | | + | |SSID |/ |
| - | |Version | + | |Version |
| - | |Encryption | + | |Encryption |
| |Radius Server IP |192.168.10.11 | | |Radius Server IP |192.168.10.11 | | ||
| - | |Radius Port |1812 | | + | |Radius Port |
| - | |Radius Password | + | |Radius Password |
| - | |Group Key Update Period |0 | | + | |Group Key Update Period |0 |
| === UCS Config === | === UCS Config === | ||
| Line 215: | Line 260: | ||
| < | < | ||
| client 192.168.11.3 { | client 192.168.11.3 { | ||
| - | secret=*** | + | secret=xxx |
| shortname=ap01 | shortname=ap01 | ||
| } | } | ||
| Line 228: | Line 273: | ||
| * systemctl enable snap.rocketchat-server.rocketchat-server.service | * systemctl enable snap.rocketchat-server.rocketchat-server.service | ||
| * systemctl status snap.rocketchat-server.rocketchat-server.service | * systemctl status snap.rocketchat-server.rocketchat-server.service | ||
| + | |||
| + | LDAP: \\ | ||
| + | * Administration -> LDAP | ||
| + | * Enable: yes | ||
| + | * Login Fallback: True | ||
| + | * Host: auth01.devbase.org | ||
| + | * Port: 389 | ||
| + | * Encryption: StartTLS | ||
| + | * CA Cert: -----BEGIN CERTIFICATE----- ... | ||
| + | * Reject: Unauthorized | ||
| + | * Domain Base: dc=devbase, | ||
| + | * Use Custom Domain Search | ||
| + | < | ||
| + | {" | ||
| + | </ | ||
| + | * enable LDAP user group filter: false | ||
| + | * Username Field: sAMAccountName | ||
| + | * Unique Identifier Field: objectGUID, | ||
| + | * Sync Data: True | ||
| + | * Sync User Avatar: True | ||
| + | * User Data Field Map: {" | ||
| + | * Merge existing users: False | ||
| + | * Import LDAP users: True | ||
| Login: \\ | Login: \\ | ||
| [[http:// | [[http:// | ||
| - | ==== Chat (Matrix) | + | ==== Reverse Proxy ==== |
| + | There will be multiple services on the internal network with need certificates \\ | ||
| + | Lets encrypt should be used when possible \\ | ||
| + | |||
| + | port 80 will point to one server \\ | ||
| + | |||
| + | Fritzbox configuration: | ||
| + | * forward port 80 and 443 to 192.168.1.11 | ||
| + | |||
| + | fw01.devbase.org configuration | ||
| + | * Firewall -> NAT | ||
| + | * new | ||
| + | * Interface: WAN | ||
| + | * Destination: | ||
| + | * Destination port rang: 3000 - 3000 | ||
| + | * Redirect target IP: 192.168.10.12 | ||
| + | * Redirect target port: 3000 | ||
| + | * Firewall -> Rules -> WAN | ||
| + | * move newly created NAT rule to the right place in the ruleset | ||
| + | * don't forget to save and activate | ||
| + | |||
| + | Server Configuration: | ||
| * Install Ubuntu 16.04 LTS | * Install Ubuntu 16.04 LTS | ||
| - | * apt update && sudo apt upgrade | + | * vi / |
| - | | + | < |
| - | | + | iface ens18 inet static |
| - | * apt-key add - < key | + | |
| - | * apt update | + | |
| - | * apt install | + | dns-nameservers 192.168.1.1 |
| - | * Server Name: matrix.devbase.org | + | </ |
| - | * cat /dev/urandom | tr -dc ' | + | * apt-get install software-properties-common |
| - | * vi /etc/matrix-synapse/homeserver.yaml | + | * add-apt-repository ppa: |
| - | | + | * apt-get update |
| - | * systemctl enable matrix-synapse.service | + | * apt-get install |
| - | * systemctl start matrix-synapse.service | + | * mkdir /var/www/ |
| - | * register_new_matrix_user -c /etc/matrix-synapse/homeserver.yaml https:// | + | * vi /etc/nginx/sites-available/chat_devbase_org |
| - | | + | < |
| - | * set password | + | server { |
| - | * make admin = yes | + | |
| + | | ||
| + | index index.html index.htm; | ||
| + | | ||
| + | alias /var/www/ | ||
| + | | ||
| + | } | ||
| - | Public DNS Recort for federation | + | server { |
| - | SRV matrix_tcp.devbase.org | + | # |
| + | listen 443 ssl default_server; | ||
| + | server_name chat.devbase.org; | ||
| + | |||
| + | ssl on; | ||
| + | ssl_certificate / | ||
| + | ssl_certificate_key / | ||
| + | |||
| + | location / { | ||
| + | proxy_set_header X-Real-IP $remote_addr; | ||
| + | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| + | proxy_set_header Host $http_host; | ||
| + | proxy_set_header X-NginX-Proxy true; | ||
| + | proxy_pass http:// | ||
| + | proxy_redirect off; | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | * ln -s / | ||
| + | * systemctl restart nginx.service | ||
| + | * certbot certonly --webroot -w / | ||
| + | * systemctl restart nginx.service | ||
| + | * echo "* 3 * * * root certbot renew" >> / | ||
| ==== VPN ==== | ==== VPN ==== | ||
| Line 309: | Line 426: | ||
| * allow * to LAN NET | * allow * to LAN NET | ||
| * allow * to Server NET | * allow * to Server NET | ||
| - | * allow * to * UDP53 | + | * allow * to * 53 UDP |
| * allow * to trusted sites | * allow * to trusted sites | ||
| * allow * to ICMP | * allow * to ICMP | ||
| * block * to * | * block * to * | ||
| + | |||
| ==== nextcloud ==== | ==== nextcloud ==== | ||
| + | * install Ubuntu 16.04 LTS | ||
| + | * configure network | ||
| + | * apt update && sudo apt upgrade | ||
| + | * apt-get install apache2 mariadb-server libapache2-mod-php7.0 | ||
| + | * apt-get install php7.0-gd php7.0-json php7.0-mysql php7.0-curl php7.0-mbstring php7.0-intl php7.0-mcrypt php-imagick php7.0-xml php7.0-zip php7.0-ldap | ||
| + | * mkdir / | ||
| + | * wget " | ||
| + | * tar xf nextcloud*.tar.bz2 | ||
| + | * mv nextcloud /var/www/ | ||
| + | * chown -R www-data.www-data / | ||
| + | * cat >/ | ||
| + | < | ||
| + | Alias /nextcloud "/ | ||
| + | |||
| + | < | ||
| + | | ||
| + | | ||
| + | |||
| + | < | ||
| + | Dav off | ||
| + | </ | ||
| + | |||
| + | | ||
| + | | ||
| + | </ | ||
| + | EOF | ||
| + | * ln -s / | ||
| + | * mysql_secure_installation | ||
| + | * mysql -u root -p | ||
| + | * CREATE USER ' | ||
| + | * CREATE DATABASE nextcloud; | ||
| + | * GRANT ALL PRIVILEGES ON nextcloud.* TO ' | ||
| + | * cat >> / | ||
| + | < | ||
| + | opcache.enable=1 | ||
| + | opcache.enable_cli=1 | ||
| + | opcache.interned_strings_buffer=8 | ||
| + | opcache.max_accelerated_files=10000 | ||
| + | opcache.memory_consumption=128 | ||
| + | opcache.save_comments=1 | ||
| + | opcache.revalidate_freq=1 | ||
| + | EOF | ||
| + | </ | ||
| + | * systemctl restart apache2.service | ||
| + | * browse to http:// | ||
| + | * enter new user credentials for admin user | ||
| + | * configure database | ||
| + | * enable apps: | ||
| + | * calendar | ||
| + | * contacts | ||
| + | * deck | ||
| + | * tasks | ||
| + | * LDAP user and group backend | ||
| + | * Admin -> LDAP | ||
| + | * Advanced | ||
| + | * Turn off SSL certificate validation = checked | ||
| + | * Server | ||
| + | * Server: ldaps:/ / | ||
| + | * User: cn=s-nextcloud, | ||
| + | * Base DN: dc=devbase, | ||
| + | * Users | ||
| + | * persons | ||
| + | * Login Attributes | ||
| + | * LDAP user | ||
| + | * Group | ||
| + | * devbase_delegate_access_nextcloud | ||
| + | ==== gitlab ==== | ||
| + | * install Ubuntu 16.04 LTS | ||
| + | * configure network | ||
| + | * apt update && sudo apt upgrade | ||
| + | * sudo apt-get install -y curl openssh-server ca-certificates | ||
| + | * curl https:// | ||
| + | * sudo echo en_US.UTF-8 UTF-8 > / | ||
| + | * sudo locale-gen en_US.UTF-8 | ||
| + | * LC_ALL=" | ||
| + | * LC_CTYPE=" | ||
| + | * sudo EXTERNAL_URL=" | ||
| + | * browse to http:// | ||
| + | * vi / | ||
| + | < | ||
| + | gitlab_rails[' | ||
| + | gitlab_rails[' | ||
| + | main: # ' | ||
| + | label: ' | ||
| + | host: ' | ||
| + | port: 389 | ||
| + | uid: ' | ||
| + | bind_dn: ' | ||
| + | password: ' | ||
| + | encryption: ' | ||
| + | verify_certificates: | ||
| + | active_directory: | ||
| + | allow_username_or_email_login: | ||
| + | lowercase_usernames: | ||
| + | block_auto_created_users: | ||
| + | base: ' | ||
| + | # | ||
| + | EOS | ||
| + | </ | ||
| + | * gitlab-ctl reconfigure | ||
| + | * gitlab-rake gitlab: | ||
| + | |||
| + | ==== Music ==== | ||
| + | Background music should not be interrupted by rebooting clients or phones leaving the building. \\ | ||
| + | A dedicated client should play the music and controllable by all kind of devices. | ||
| + | |||
| + | * download runeaudio for RPi | ||
| + | * flash to SD card and boot | ||
| + | * browse http://ip | ||
| + | * settings | ||
| + | * hostname: music01 | ||
| + | * airplay: on | ||
| + | * airplay name: music01 | ||
| + | * UPnP: on | ||
| + | * UPnP name: music01 | ||
| + | * ssh root@ip | ||
| + | * passwd | ||
| + | * cat >> / | ||
| + | < | ||
| + | audio_output { | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | # bitrate | ||
| + | | ||
| + | | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | * Library | ||
| + | * Webradio | ||
| + | * http:// | ||
| + | * http:// | ||
| + | * http:// | ||
| + | |||
| + | Management: \\ | ||
| + | [[http:// | ||
| + | |||
| + | ==== Ubiquiti Controller ==== | ||
| + | To manage the Unfi WiFi access points a Controller is needed | ||
| + | * Install Ubuntu 16.04 LTS | ||
| + | * echo 'deb http:// | ||
| + | * apt-key adv --keyserver keyserver.ubuntu.com --recv 06E85760C0A52C50 | ||
| + | * apt-get install unifi | ||
| + | * https://< | ||
| ==== Wiki ==== | ==== Wiki ==== | ||
| + | ==== Matrix - testing only ==== | ||
| + | * Install Ubuntu 16.04 LTS | ||
| + | * apt update && sudo apt upgrade | ||
| + | * add-apt-repository https:// | ||
| + | * wget https:// | ||
| + | * apt-key add - < key | ||
| + | * apt update | ||
| + | * apt install matrix-synapse python-matrix-synapse-ldap3 | ||
| + | * Server Name: matrix.devbase.org | ||
| + | * cat / | ||
| + | * vi / | ||
| + | * registration_shared_secret: | ||
| + | * systemctl enable matrix-synapse.service | ||
| + | * systemctl start matrix-synapse.service | ||
| + | * register_new_matrix_user -c / | ||
| + | * name root | ||
| + | * set password | ||
| + | * make admin = yes | ||
| + | |||
| + | Public DNS Recort for federation | ||
| + | SRV matrix_tcp.devbase.org | ||
projects/base-infrastructure.1505154394.txt.gz · Last modified: 2017-09-11 18:26 by trinitor
Page Tools
