Tag: Sysadmin Devops

Get Windows 10 Pro Installation media or a product key (if you don’t already have one) and download. Back up anything you want to keep on some kind of external storage (local or cloud) and make sure you have installation media or downloads (in a safe place, again external storage, local or cloud) for any software you will want to reinstall.

A Basic Template This first section on this page doesn’t add new elements to the script code, but implements a more complex template. Since this is user-supplied data, this is more of template example than a code update.

Overview Same configuration and userdata files as before Improved ’look’ of the code (applied code formatter) Some minor improvements to messages (output) Most importantly, created the get_named_resource function for common tasks like checking for the existence of an image (or other resource) and returning the matching image object (a munch.

Setup the Packer Environment Prequisites The packer executable found in the download for your system at https://www.packer.io/ (Download button) needs to be in a directory that is in your PATH.

Setup the Packer Environment Prequisites The packer executable found in the download for your system at https://www.packer.io (Download button) needs to be in a directory that is in your PATH.

Base Install NB The author doesn’t have a tripod, nor the feeling of relevance for this part of the guide, so the quality of screen photos here is not as good as other guides out there—this version is only included in case you need the information right here, rather than to draw people to the site for an often-covered topic.

Implementation We now add an important piece: write_files support. In this implementation we: Take a colon separated list of local directory names For each directory we process every file in the directory (last directory wins in the case of duplicates) Processing each file means: We determine the target path the for the file by stripping the passed in directory name (so passed/in/dir/etc/aliases becomes /etc/aliases) We read the file If possible we ‘gzip’ (compress) it We base64 encode it (this avoids problems with characters in the file being interpreted by cloud-init as having meaning other than being just data; for example it avoids quoting and whitespace issues).

Preface You’ll notice that the basic-instance.ini config file has two sections with erroneous server_groups. This was done to provide a quite test of the new script’s error-handling.

Option 1: Use the Image Directly (not recommended) Upload packer image using virsh ls -al *.qcow2 virsh -c qemu+ssh://user@host/system vol-upload --pool default --vol preseeded-armhf-uefi-image-preseed-image-xxxx-xx-xx-xx-xx.qcow2 --file preseeded-armhf-uefi-image-preseed-image-xxxx-xx-xx-xx-xx.

Preface Our next phase was adding the configuration items we still needed, along with some enhancements on progress and error reporting. This is by no means a ‘product’, but it’s sufficient at this point (with the addition of userdata handling) for our small ‘cloud’ infrastructure.

Core Isolation; A Security Recommendation Do as Soon as Possible The author recommends you go to Settings|Updates & Security|Windows Security|Device Security|Core Isolation Details and enable Memory Integrity (this is only possible if your CPU and BIOS support ‘Second Level Address Translation’ (SLAT) aka Intel Extended Pages); the longer you wait, the greater the chance that Windows will install incompatible drivers before you enable the isolation (on older hardware that is).

Download and verify installation media Download the installation media You should obtain the appropriate install media as well as sha256 and GnuPG signatures for that media.

Partitioning on the Linux command line Partitioning information in the official Alpine Linux User’s Handbook For this guide we only consider two types of install: BIOS to ‘msdos’-type partition table (disklabel) and UEFI to gpt partition table.

Add and use filesystem tools Overview You need to add the tools that will let you format/create one or more additional volumes/filesystems of your choice.

Copy tarball to boot under Gnome Steps Screenshots are from GNOME but most GUI desktops are similar. Select install tarball wherever you have it downloads (often in your Downloads directory), right-click and select ‘Extract To…’ Browse to the boot partition of the SD card Select the boot partition of the SD card as extraction destination The result will be a directory containing the boot files on the boot partition; we actually want the files in the top-level (root) of the boot partition.

Prepare SD card using GNOME Disks Procedure Start with an empty (unpartitioned, unformatted) SD card. If you disk is not empty, you will need to do a search on how to clean the disk and create an msdos disklabel (aka partition table).

Daniel’s documentation for using Alpine Linux for local servers on x86-64 and Raspberry Pi family. These documents use only the ‘main’ repository, except in one or more optional HowTo guides.

Configure off-system backups Overview This guide uses only tools included in the base configuration of Alpine Linux. It is only suitable for cases where your backups are small, or you have a very reliable network connection.

Creating initial boot media Create the initial boot image Obtain and verify install tarball Prepare your SD card Do pre-boot tweaks

Do pre-boot tweaks On Windows 10 TBD On Linux GUI (GNOME) Screenshots are from GNOME but other GUI desktops are similar On Mac OS TBD

Guides for setting kernel parameters Overview These vary with architecture and specific device Linux kernel guide to its parameters https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html A suggested tweak Adding consoleblank=300 can be a nice addition to the kernel commandline.

Hardware-specific tweaks and configuration Systems with No RTC (real-time clock) Includes the Raspberry Pi family of SBC (single board computers). Disable hwclock (if enabled; on the Raspberry Pi it has already been disabled).

HowTos In alphabetical order Add etckeeper for ‘/etc’ backup Add etckeeper git remote and push on commit Add on-system documentation, including the ‘man’(ual) command Add nano and use as default editor

Important post-install configuration Overview The following are not part of the base install, but either can be essential to system function (like adding boot entropy for some headless systems like the Raspberry Pi) or are widely accepted best practices (like creating a non-root admin user and limiting time spent as root).

Kernel and hardware notes Guides for setting kernel parameters Hardware-specific tweaks and configuration

Obtain and verify install tarball Obtain the official Alpine Linux image Choose tarball to download based on the model of Pi you have Partial table of model of Raspberry Pi to Linux kernel max architecture available (where aarch64 > armv7 > armhf).

Prepare your SD card Partition the SD card On Windows 10 Using built-in GUI ‘Disk Management’ feature TBD Using diskpart TBD Using PowerShell TBD On Linux (many distros) GUI Using Gnome ‘Disks’ applet

Setup network required for package installation Use Alpine Linux setup sub-scripts for network/DNS Execute setup-keymap # To make sure you can successfully do keyboard input Execute setup-hostname.

Use Alpine Linux on Raspberry Pi as a server Special Notes NOTE: For boot to succeed /media/mmcblk0p1/usercfg.txt must exist. See kernel parameters and device-tree settings for information on what you can set in that file.

Add etckeeper Overview While the LBU mechanism with backups allows restoring to previous state it lacks commented history. Done right, etckeeper will lead to a better record of what changes you made to the configuration and why, which improves your ability to recreate what you did, as well as understand why you did what you did.

Add etckeeper git remote for pushing on commit Overview Tracking configuration changes in etckeeper is great, but even better is storing in an off-system private repository, preferably one with a decent web interface to the repo (makes browsing the repo much friendlier).

Add man pages and other on-system docs Overview Unless you have packages that are ’expensive’ either in terms of the memory they use while operating or in terms of the amount space they take up (since in Alpine ‘data’ (and in ‘diskless’) mode packages are stored in RAM while the system is booted) you should have plenty of available RAM and storage to add the online documentation (mostly in the form of man pages).

Add nano and use as default editor Overview For many users vi (the default editor for Alpine) is difficult and confusing to use. Even if that is not the case for you, if you find it helpful to have the same experience as others you wish to help, you might implement this for your own use as well.

Add packages for pre-mount filesystem check Overview Where possible it is a best practise to check your filesystem before mounting them (especially read-write) to ensure you are not working with a corrupted (and further damaging a) filesystem.

Add tmux Overview Tmux is a handle tool that gives the ability to have multiple (text) windows in a single terminal session. In addition, if you get disconnected from the terminal (e.

Commit LBU Overview Once you are sure everything is correct for the initial boot into your configured system, commit your changes Do the commit (unencrypted) For the initial commit and reboot, use an unencrypted LBU (to make sure everything works).

Configure SSH for public key access only Overview Disallowing SSH login with only a username and password is a well known security best practise, therefore we implement it.

Create a non-root admin user Avoid operating as root, where possible It is generally considered an administrative best practise to avoid logging in and/or operating with elevated privileges, to the extent reasonable to do so.

Create semi-data/semi-diskless install Overview This guide presumes you are booted into a fresh install media (no stored configuration). It further presumes that neither the pure diskless configuration from the Alpine wiki, the data configuration from the Alpine wiki, nor the system disk (classic) configuration from the Alpine wiki suits your situation.

Edit message of the day (MOTD) Overview The existing message of the day (MOTD) includes: You can setup the system with the command: setup-alpine You may change this message by editing /etc/motd.

Enable enhanced shell prompt Add colour and context information to prompt. Overview /etc/profile and the ‘.sh’ scripts in /etc/profile.d are sourced on every invocation of the ‘ash’ (default Alpine/Busybox shell) as well as the ‘bash’ shell when launched as a login shell.

Firstboot troubleshooting Overview Uh-oh. The reboot after initial setup didn’t work. Now what? Problems and solutions TBD

For headless systems, add boot entropy Overview As mentioned in Raspberry Pi - Alpine Linux under ‘Troubleshooting: Long boot time when running headless’, some systems might take an excessively long time to boot when no peripherals are attached (not only with the Pi series).

Recommended tweaks and configuration Overview Assuming the reboot was successful, it is time to make your system more useful. Otherwise see Firstboot troubleshooting Commit changes at your preferred granularity Don’t forget that these changes will not survive reboot unless you commit your changes.

Server install & configure Overview This set of guides and recommendations is aimed at the use of Alpine as your local servers on physical hardware where you have access to the console on boot.

Use encrypted LBU Overview Unless you need headless, or unattended reboots or power up (e.g. after power loss), it is highly recommended to use an encrypted configuration backup.

Use modified ‘setup-alpine’ procedure Overview You’ll want to be careful during the LBU configuration and APK cache configuration sections using the default setup-alpine script. You also need to have pre-mounted the partition(s) that will hold the LBU and APK cache (see Create semi-data/semi-diskless install).

Most blog entries on SystemD timers give trivial samples. This article takes a different approach and provides the full details of two examples of using SystemD timers that are in active use on my systems.

Normally when using Docker one only wants specific unicast ports forwarded, so the standard Docker paradigm of using NAT to forward ports to the container works. However, when using Docker to containerize internal services like Samba (which needs a combination of unicast and broadcast UDP), LLMNR (Windows multicast address resolution), or mDNS a.k.a Bonjour (Apple multicast address resolution) one may find that the standard Docker model is insufficient.

Setting up an email relay that aliases addresses in various domains to a specific offsite user doesn’t have to mean backscatter. Here is one solution.

Preface These are notes on creating a Windows and Linux hybrid environment for developers (hence the use of Windows 10 Pro not Home), specifically when running Windows on a physical machine.

Preface The official Ubuntu images that are built for Azure/Hyper-V really are only compatible with Hyper-V on Azure, despite Canonical (the company behind Ubuntu) offering Azure/Hyper-V disk images at Ubuntu Daily Cloud Images - Focal.

Using Terraform with OVHcloud, I hit issues that affect both OVH API and OpenStack API. There are ‘Resource Not Found’ issues…

At some point you may need to upsize your PostgreSQL server, particular if you have implemented one on a old Raspberry Pi.

You may realize that you really wish you could start the Nextcloud instance from scratch without the hassle of a reinstalling.

Several new posts and updates.

Setting up your own local Nextcloud can be useful for a number of reasons.

The Intel NUC (and boards based on the same SoC) are quite powerful for their price point, and use less electricity than even a mini tower.

This article describes setting up a Raspberry Pi Model B+ as a private Gitea (lightweight Git hosting) server.

Description of setting up a Raspberry Pi Model B+ as a PostgreSQL server with external storage.

This article details using the XCA GUI for creating private SSL certificates for enabling end-to-end SSL on non-public servers.

Preface These are some personal notes about setting up a very nice combined Windows and Linux productivity and development environment. It uses open source software combined with some key proprietary pieces on a single machine.

I was tired excessive bot traffic spamming my logs, so I learned how to reduce the noise in my logs.

I exported the site and then removed it, and created a new ‘wildtechgarden.ca’ instance with my hosting company, unfortunately…

Initial Purchase / Install Choose a hosting service If the hosting service is not also a domain registrar, sign up for a domain with a domain hosting service.

Preface Raspberry Pi OS is the official operating system for the Raspberry Pi family of educational single board computers. This article discusses some useful information on using Pi OS (including remotely) and provides links to more.

Tools Used For this demonstration we show the use of Visual Studio Code We also use GitHub And Netlify Before Website screenshot of website before pushing commit

Overview Git is used extensively worldwide for many type of software and internet and other types of publishing projects (among others). This article provides an introduction to Git and probably the most popular central git repository (GitHub).

Using WordPress Site Health Page Hover over ‘Tools’ and select ‘Site Health’ You should see a page like the one depicted. You’ll noticed there are a few recommended security improvements.

With OVH, after picking a domain you pick your CMS (in our case WordPress). Pay for the service (one month or one year) After that you will need to need to wait what seems like forever for the order to be processed and your WordPress instance to be created and initialized.

Linux LVM thin pools and volumes initially seem to be a great way maximize the use of hard drive space, but …

I highly recommend reading the Maintenance and Security section of the WordPress Documentation. If there is interest we could do another session on those topics.

About the effort to unify, eliminate duplication, delete those older than my ‘data retention policy’, and organize the rest into yearly archives.

In my opinion, Windows is deceptively clear and smooth, but when once one really shines a light on it, one finds significant imperfections. Linux may feel a little less polished, but is more what you see is what you get (or better) — there are imperfections for a power user / developer like me, but those idiosyncrasies are minor compared to the more problematic ones found in Windows.

Create an UEFI (newish) ARM Hard Float (32-bit) virtual machine for Libvirt/KVM using automated image build using Packer.

Preface Whether you want old school ARM (32-bit) or a shiny new UEFI ARM (32-bit) virtual machine in Libvirt/KVM, and automated or ‘manual’ creation, there is a way to get what you want.

NB These instructions are out of date since the release of Debian 11 (Bullseye). Some parts of these guide will need to be updated to the new Debian release.

Option 1: Use the Image Directly (not recommended) Upload kernel, initrd, and packer image using virsh ls -al vmlinuz* initrd.gz* *.qcow2 virsh -c qemu+ssh://user@host/system vol-create-as --pool default --name vmlinuz-x.

NB These instructions are out of date since the release of Debian 11 (Bullseye). Some parts of these guide will need to be updated to the new Debian release.

NB These instructions are out of date since the release of Debian 11 (Bullseye). Some parts of these guide will need to be updated to the new Debian release.

Preface These are notes on creating a Windows and Linux hybrid environment, specifically when running Windows in a Libvirt/KVM VM. I also have Notes on Windows and Linux hybrid environment in a physical machine.

You may find yourself in need of a ‘bare metal’ server. If the workload is not too demanding, a Raspberry Pi can be a good choice.

Preface These are notes on creating a Windows and Linux hybrid environment, specifically when running Windows on a physical machine. I also have Notes on Windows and Linux hybrid environment in a Libvirt/KVM VM.

Additional Security Settings Next, we want to use ‘Local Security Policy’. This can be found in the ‘Start Menu’ under ‘Windows Administrative Tools’. Set your Account Policy Navigate to Account Policy|Password Policy|Maximum password age The author recommends setting no maximum age on password as he believes it causes more trouble than it is worth to set an arbitrary forced password change.

ARCHIVED This collection of pages is archived and may contain out-of-date or no longer accurate information. Overview Learning experiments in using bespoke code & data under version control to consistently deploy virtual and bare metal hosts and the applications on them.

Preface Before finding the source of the issues with Terraform on OVH, a possible source of the dysfunction was thought to be with expired tokens. As such a couple of cross-platform token generation scripts using the Python bindings for the OVH API were tried.

Preface The OpenStack SDK is a OpenStack project aimed at providing a complete software development kit for the programs which make up the OpenStack community. It is a Python library with corresponding documentation, examples, and tools released under the Apache 2 license.

Preface Code The scripts described on this page are available in a Git repo @ https://github.com/danielfdickinson/ivc-in-the-wtg-experiments. First, Just a Template We start with a separate script that only generates userdata (no instance creation).

Preface Adding templating with the ability to add files to the instance and to run scripts during the instance deployment will get us most of the way to a complete solution for our needs, so that’s what this page is about.

Preface Some Thoughts At this point we should think about what is required to meet our Target Requirements. We’re going to put off a number of considerations as they depend on robust use of ‘userdata’ as we will be exploring the use of Jinja to template userdata later in the series.

Preface The Plan This page was intended to complete the OpenStack SDK with templated userdata portion of this Infrastructure Via Code set. This involves: Adding runcmd and bootcmd sections to userdata-default.

A configuration for using Hugo on WSL(2) with Netlify and Netlify CLI

Public git self hosting can be desirable for a number of reasons. Here we discuss a very lightweight alternative.

For small deployments the Raspberry Pi makes a great choice for bare metal infrastructure for provisioning and configuration management servers.

A guide to configuring an OVH VPS (Virtual Private Server) with CentOS 7

For your self-hosted systems there are likely hosts you don’t want internet-connected, but you still want to be able to do package updates.

Often you don’t need a full mirror of CentOS and/or EPEL, so we give a working example of a partial mirror and custom repository setup.

Linux Network Monitoring Presentation ca. 2006

A guide to configuring a static web server using Lighttpd on CentOS 7

ARCHIVED This document is archived and may be out of date or inaccurate. Check the Debian Wiki first Before reading this page you should try looking at the DebianCustomCD Page on the Debian Wiki because it is updated more frequently, and by more contributors.

PROJECT NO LONGER HAS PUBLIC REPOSITORIES I have given up on the project as msmtp-queue from the msmtp package proper ought to do well enough for what this project was doing.