docs(all): fix markdown syntax and snippets
This commit is contained in:
@@ -22,7 +22,11 @@ When the migration is decided, the manual backup after shutting all services dow
|
||||
Only when kopia repository exists.
|
||||
|
||||
```bash
|
||||
kopia repository connect --override-username="console" --override-hostname="console.ilnmors.internal"
|
||||
kopia repository connect server \
|
||||
--url=https://nas.ilnmors.internal:51515 \
|
||||
--override-username=console \
|
||||
--override-hostname=console.ilnmors.internal
|
||||
# Enter the password
|
||||
|
||||
kopia snapshot list --all
|
||||
|
||||
@@ -38,7 +42,7 @@ cp ~/workspace/homelab/volumes/infra/cluster/cluster.sql ~/workspace/homelab/con
|
||||
|
||||
### Provisioning
|
||||
|
||||
Ansible playbooks should be declarative. This won't contain complex branch logics \(Declarative over imperative\). Playbooks describes what should be there, not how to. The basic rule is manual destroy and auto reprovisioning.
|
||||
Ansible playbooks should be declarative. This won't contain complex branch logics (Declarative over imperative). Playbooks describes what should be there, not how to. The basic rule is manual destroy and auto reprovisioning.
|
||||
|
||||
#### vmm and fw
|
||||
|
||||
|
||||
@@ -63,6 +63,10 @@ Set-Service DiagTrack -StartupType Disable
|
||||
Stop-Service dmwappushservice
|
||||
Set-Service dmwappushservice -StartupType Disable
|
||||
|
||||
## Disable - WorkloadsSessionHost which is the service for AI function
|
||||
Stop-Service -Name "WSAIFabricSvc" -Force -ErrorAction SilentlyContinue; Set-Service -Name "WSAIFabricSvc" -StartupType Disabled
|
||||
Stop-Process -Name "WorkloadsSessionHost" -Force -ErrorAction SilentlyContinue
|
||||
|
||||
## Compact OS configuration
|
||||
compact /compactos:always
|
||||
```
|
||||
@@ -102,10 +106,10 @@ sign in on app only
|
||||
|
||||
- WindowsDefender Firewall:Inbound Rules:
|
||||
- File and Printer Sharing (Echo Request - ICMPv4-In) - Profile: Private, Public
|
||||
- General: \[x\] Enable
|
||||
- General: `[x]` Enable
|
||||
- Scope: 192.168.1.0/24, 192.168.10.0/24, 192.168.99.0/24
|
||||
- File and Printer Sharing (Echo Request - ICMPv6-In) - Profile: Private, Public
|
||||
- General: \[x\] Enable
|
||||
- General: `[x]` Enable
|
||||
- Scope: fd00::/8
|
||||
- Apply
|
||||
|
||||
@@ -119,7 +123,8 @@ sign in on app only
|
||||
|
||||
### Create wsl config
|
||||
|
||||
- C:\Users\$USERNAME\.wslconfig
|
||||
- `C:\Users\$USERNAME\.wslconfig`
|
||||
|
||||
```ini
|
||||
[wsl2]
|
||||
processors=4
|
||||
@@ -201,13 +206,13 @@ mkdir ~/workspace
|
||||
|
||||
#### VS Code configuration
|
||||
|
||||
- WSL extension\(`Ctrl + shift + x`\)
|
||||
- WSL extension(`Ctrl + shift + x`)
|
||||
- Install `WSL` by Microsoft
|
||||
- Remote Explorer:Debian:Connect in Current Windows
|
||||
- `Ctrl + k` and `Ctrl + o`
|
||||
- Open folder: `/home/console/workspace`
|
||||
- `` Ctrl + shift + ` `` for Terminal
|
||||
- Extensions\(`Ctrl + shift + x`\)
|
||||
- Extensions(`Ctrl + shift + x`)
|
||||
- Install `Ansible` by RedHat
|
||||
|
||||
### Playbooks
|
||||
@@ -244,9 +249,9 @@ ansible-playbook playbooks/console/site.yaml --tags "init"
|
||||
- encrypted by gpg and ansible vault with master key
|
||||
- Master key
|
||||
- The key which has above 40 characters containing upper and lower letters, numbers, and special letters
|
||||
- managed by physical media \(Mind, MDisc, paper\) as file, string, and QR
|
||||
- managed by physical media (Mind, MDisc, paper) as file, string, and QR
|
||||
- This value is never saved in server or console.
|
||||
- Root CA \(including ssh CA\) must not be deployed.
|
||||
- Root CA (including ssh CA) must not be deployed.
|
||||
- The tasks with root CA must be performed manually. The source of Trust is the most important in security.
|
||||
- Intermediate CA can be deployed.
|
||||
- Intermediate CA is operated as a live server.
|
||||
|
||||
@@ -12,7 +12,7 @@ openssl rand -base64 32 > /run/user/$UID/root_ca_password
|
||||
openssl rand -base64 32 > /run/user/$UID/intermediate_ca_password
|
||||
# Save the values in `secrets.yaml`
|
||||
|
||||
# Create CAs \(Key and cert)
|
||||
# Create CAs (Key and cert)
|
||||
# Root CA
|
||||
step certificate create \
|
||||
"ilnmors.internal Root CA" /run/user/$UID/root_ca.crt /run/user/$UID/root_ca.key \
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Hypervisor \(vmm\)
|
||||
# Hypervisor (vmm)
|
||||
|
||||
Initiating hypervisor doesn't use ansible. Hypervisor is working on hardware itself, so there is a lot of possible variables like IOMMU id, MAC addresses, etc.
|
||||
|
||||
@@ -19,29 +19,29 @@ Hypervisor is initiated manually with the configuration files which are stored i
|
||||
- Hostname: vmm
|
||||
- Domain: ilnmors.internal
|
||||
- User:
|
||||
- Root Password: \[blank\]
|
||||
- Root Password: `[blank]`
|
||||
- Full name for the new user: vmm
|
||||
- User Name: bootstrap
|
||||
- User Password: debian
|
||||
- Partition setting: manual
|
||||
- 512MiB - EFI system partition \(Booting flag: on\)
|
||||
- 1GiB - Ext4 Journaling \(Mount: /boot)
|
||||
- 512MiB - EFI system partition (Booting flag: on)
|
||||
- 1GiB - Ext4 Journaling (Mount: /boot)
|
||||
- 800 GiB -LVM
|
||||
- 64GiB: vmm-root - Ext4 Journaling \(Mount: /\)
|
||||
- 700GiB: vmm-libvirt - Ext4 \(Mount: /var/lib/libvirt\)
|
||||
- 64GiB: vmm-root - Ext4 Journaling (Mount: /)
|
||||
- 700GiB: vmm-libvirt - Ext4 (Mount: /var/lib/libvirt)
|
||||
- Debian package manager setting
|
||||
- Scan extra installation media: no
|
||||
- Mirror country: South Korea
|
||||
- Archive mirror: deb.debian.org
|
||||
- Proxy: \[blank\]
|
||||
- Proxy: `[blank]`
|
||||
- Popularity-contest: no
|
||||
- Installing packages setting
|
||||
- \[\*\] SSH server
|
||||
- \[\*\] Standard system utilities
|
||||
- `[*]` SSH server
|
||||
- `[*]` Standard system utilities
|
||||
|
||||
### Initial configuration
|
||||
|
||||
Hypervisor operates pure L2 switch for fw and it never can access WAN without fw after initial configuration. This means, there is an air-gap which means hypervisor cannot access to WAN for a while \(from end of initial setting to the beginning of fw setting\).
|
||||
Hypervisor operates pure L2 switch for fw and it never can access WAN without fw after initial configuration. This means, there is an air-gap which means hypervisor cannot access to WAN for a while (from end of initial setting to the beginning of fw setting).
|
||||
|
||||
Hypervisor operates on hardware. Hardware information is always uncertain, and it is set only once. Managing this process as IaC is over engineering.
|
||||
|
||||
|
||||
@@ -6,19 +6,19 @@ All hardware configuration is set after fw vm. The MAC address of hardware is re
|
||||
|
||||
### Access VLAN switch
|
||||
|
||||
- http://switch.ilnmors.internal \(192.168.1.2, KEA-DHCP, Only IPv4 support\)
|
||||
- http://switch.ilnmors.internal (192.168.1.2, KEA-DHCP, Only IPv4 support)
|
||||
- before set ipv6, use ip4 address instead of FQDN
|
||||
- id: admin, password: admin
|
||||
- new password: switch.password
|
||||
|
||||
### Set VLAN
|
||||
- VLAN:802.1Q VLAN
|
||||
- \[x\] Enable - Apply
|
||||
- `[x]` Enable - Apply
|
||||
- VLAN client
|
||||
- id 1
|
||||
- name default > client
|
||||
- member \(Untagged\)
|
||||
- Port 1 \(Trunk, untagged\): Linux bridge is already process untagged packet as id 1
|
||||
- member (Untagged)
|
||||
- Port 1 (Trunk, untagged): Linux bridge is already process untagged packet as id 1
|
||||
- Port 3
|
||||
- Port 4
|
||||
- Port 5
|
||||
@@ -29,13 +29,13 @@ All hardware configuration is set after fw vm. The MAC address of hardware is re
|
||||
- id 10
|
||||
- name server
|
||||
- member
|
||||
- Port 1 \(Trunk, tagged\)
|
||||
- Port 1 (Trunk, tagged)
|
||||
- VLAN user
|
||||
- id 20
|
||||
- name user
|
||||
- member
|
||||
- Port 1 \(Trunk, tagged\)
|
||||
- Port 2 \(Not a member of client vlan, untagged\)
|
||||
- Port 1 (Trunk, tagged)
|
||||
- Port 2 (Not a member of client vlan, untagged)
|
||||
|
||||
- VLAN:802.1Q VLAN PVID setting
|
||||
- Port 2
|
||||
@@ -48,9 +48,9 @@ All hardware configuration is set after fw vm. The MAC address of hardware is re
|
||||
- Check internet connection
|
||||
|
||||
|
||||
## DSM \(DS124\)
|
||||
## DSM (DS124)
|
||||
|
||||
- https://finds.synology.com/# \(192.168.1.11, KEA-DHCP\)
|
||||
- https://finds.synology.com/# (192.168.1.11, KEA-DHCP)
|
||||
- Install DSM
|
||||
|
||||
### Initial configuration
|
||||
@@ -83,7 +83,7 @@ Kea in fw already reserved DSM's IP. However it is necessary to set IP address s
|
||||
- Certificate
|
||||
- Intermediate certificate
|
||||
- Edit: For: Set as default certificate
|
||||
- Setting \(!CAUTION!\)
|
||||
- Setting (!CAUTION!)
|
||||
- Even though you set the certificate as default, you have to set certificate for each services.
|
||||
- configure: service: certificate: nas.ilnmors.internal
|
||||
|
||||
@@ -92,20 +92,20 @@ Kea in fw already reserved DSM's IP. However it is necessary to set IP address s
|
||||
- **!CAUTION!** It can be set after authelia is implemented
|
||||
- Following [here](../../config/services/containers/auth/authelia/config/authelia.yaml.j2) for Authelia configuration
|
||||
- Control Panel:Domain/LDAP:SSO Client
|
||||
- Login Settings: \[x\] Select SSO by default on the login page
|
||||
- Login Settings: `[x]` Select SSO by default on the login page
|
||||
- Services
|
||||
- \[x\] Enable OpenID Connect SSO service
|
||||
- `[x]` Enable OpenID Connect SSO service
|
||||
- OpenID Connect SSO Settings
|
||||
- Profile: OIDC
|
||||
- Account type: Domain/LDAP/local
|
||||
- Name: Authelia
|
||||
- Well-Known URL: https://authelia.ilnmors.com/.well-known/openid-configuration
|
||||
- Application ID: dsm \(what you designated\)
|
||||
- Application ID: dsm (what you designated)
|
||||
- Application Secret: secret value
|
||||
- Redirect URI: https://nas.ilnmors.internal:5001
|
||||
- Authorization scope: openid profile groups email
|
||||
- Username claim: preferred_username
|
||||
- Match the user name \(ID\) in DSM and lldap id.
|
||||
- Match the user name (ID) in DSM and lldap id.
|
||||
|
||||
### Kopia in DSM
|
||||
|
||||
@@ -123,15 +123,15 @@ Kea in fw already reserved DSM's IP. However it is necessary to set IP address s
|
||||
|
||||
- Add certificate - DSM reverse proxy cannot deal with gRPC
|
||||
- /docker/kopia/config/ssl/nas.key
|
||||
- /docker/kopia/config/ssl/nas.crt \(including intermediate crt\)
|
||||
- /docker/kopia/config/ssl/nas.crt (including intermediate crt)
|
||||
|
||||
- container manager:images:import
|
||||
- kopia/kopia
|
||||
- tags: \{\{ version['packages']['kopia'] \}\}
|
||||
- tags: {{ version['packages']['kopia'] }}
|
||||
- run
|
||||
- image: kopia/kopia
|
||||
- containername: kopia-server
|
||||
- \[x\] Enable auto restart
|
||||
- `[x]` Enable auto restart
|
||||
- port: 51515:51515
|
||||
- volume: /docker/kopia/config:/app/config:rw
|
||||
- volume: /docker/kopia/cache:/app/cache:rw
|
||||
@@ -159,7 +159,7 @@ Repository directory - encrypted by server KOPIA_PASSWORD as master key of repos
|
||||
|
||||
Server manage ACL with user password, user's KOPIA_PASSWORD. When server verify user with their password, server works with its repository password.
|
||||
|
||||
Repository - \(Repository key; master key\) - Server - \(User key; access key\) - Client
|
||||
Repository - (Repository key; master key) - Server - (User key; access key) - Client
|
||||
|
||||
- Client knows its access password as KOPIA_PASSWORD to access server. It doesn't know master key, server's KOPIA_PASSWORD. server will control repository by its KOPIA_PASSWORD. their name is the same but it is different.
|
||||
|
||||
|
||||
@@ -8,11 +8,11 @@
|
||||
|
||||
# *! CAUTION !*
|
||||
# THIS PROCESS CONTAINING SECRET VALUES.
|
||||
# WHEN YOU TYPE THE COMMAND ON SHELL, YOU MUST USE [BLANK] BEFORE COMMAND
|
||||
# WHEN YOU TYPE THE COMMAND ON SHELL, YOU MUST USE [blank] BEFORE COMMAND
|
||||
# e.g.
|
||||
# shell@shell$ command (X)
|
||||
# shell@shell$ [BLANK]command (O)
|
||||
# BLANK prevent the command to save on .bash_history
|
||||
# shell@shell$ [blank]command (O)
|
||||
# [blank] prevent the command to save on .bash_history
|
||||
# After finish this process, use `history -c` and `clear` for just in case.
|
||||
|
||||
|
||||
|
||||
@@ -70,6 +70,13 @@ git stash pop # get temporary save
|
||||
# After git switch
|
||||
git switch service
|
||||
git rebase --ignore-date main # set date as current time on main branch
|
||||
|
||||
# Example
|
||||
|
||||
git show HEAD
|
||||
git show HEAD~$NUM
|
||||
git diff HEAD~$NUM HEAD
|
||||
git diff $PREVIOUS_HASH $CURRENT_HASH
|
||||
```
|
||||
|
||||
## Add Service with git
|
||||
@@ -90,6 +97,10 @@ git merge caddy-app
|
||||
- Set this after gitea is implemented
|
||||
|
||||
```bash
|
||||
# Copy git from remote
|
||||
git clone --mirror https://gitea.ilnmors.com/il/ilnmors-homelab.git
|
||||
# If the tag doesn't come then
|
||||
git fetch --tags
|
||||
# Add git remote repository
|
||||
git config --global credential.helper store
|
||||
git remote add origin https://gitea.ilnmors.com/il/ilnmors-homelab.git
|
||||
|
||||
Reference in New Issue
Block a user