basti

This is going to be a higher-security network services host, mostly to host LDAP and maybe some associated services.

• Intel N100, 4x E-cores, 16gb RAM

• AlmaLinux 10.2

• 1x 1G NICs
• located at home

What runs here

• iscsi client to fenny
• caddy serving websites

  • https://mirror.thighhighs.top/

  • https://git.thighhighs.top/

    • Running gitea
    • via podman, defined in /etc/containers/systemd/gitea.container
• alma repo rsync to populate the mirror

Hardware specs

• Maxtang MAX-N100-A5 Mini PC (Intel N100, 4x E-cores, 16gb RAM)
  • Intel N100, 6MB cache, up to 3.4GHz
  • 1x SODIMM slot, DDR4
  • 2x 1gb NIC ports
  • M2 2280 slot for PCIe 3.0 4x NVME/SATA
  • M2 2280 slot for PCIe 3.0 1x NVME
  • M2 2230 slot for wifi and bluetooth
  • 2x HDMI 2.0, 1x USB 2.0, 3x USB 3.2, 1x audio jack
  • 120x120x36mm
  • Internal PSU draws 1.5A from mains, producing ~45W DC power
• Box specs
  • Colour: grey
  • Memory: 16gb
  • Storage: 512gb
  • PN: GM0MAXN100001005
  • SN: DT2024120402001

• AlmaLinux 10.2

• LAN MACs

  • enp1s0: e8:ff:1e:d5:60:7a (this is the primary NIC, despite having a higher MAC address)

  • enp2s0: e8:ff:1e:d5:60:79

Build notes

This is a mix of notes from the previous provisioning, plus what I did when I renamed her from krolik to basti. I did this build around 2026-05-18

Build a clean Alma10 system than add FreeIPA to it.

rename krolik to basti

basti 300 IN A 192.168.53.10

Prepare network

This will live in a new VLAN, attached to hoshino, with firewalling eventually added.

Prepare hoshino:

• Prepare bridge
  • VLAN 20, INFRA
  • Bridge VLAN on bridge1 (ports Et1-6)
  • Untagged on port 5,6 (amaris, basti)
• Create interface-VLAN
  • name VLAN20_INFRA
  • on bridge1
• Add an IP address on the VLAN
  • 192.168.53.1/24
  • network 192.168.53.0
  • on interface VLAN20_INFRA
• Prep DHCP server on hoshino for the build, create the Network
  • address 192.168.53.0/24
  • gateway 192.168.53.1
  • mask 24
  • DNS server 8.8.8.8
  • domain thighhighs.top
  • next server 192.168.1.25 (neru)
  • boot file name grub/grubx64-improved.efi
• Create an IP pool for it
  • name: INFRA
  • addresses: 192.168.53.10-192.168.53.30
  • next pool: none
• Create a DHCP Server for the segment
  • name: infra
  • interface: VLAN20_INFRA
  • address pool: INFRA
• Update DHCP lease for basti to give correct address
  • address: 192.168.53.10

  • MAC: E8:FF:1E:D5:60:7A

  • server: infra

Boot it up and hope it works!

Do firewalling on hoshino:

• We can't use in/out ports because it's part of the bridge, and we don't want to enable ip-firewalling on the bridge because it'll slow it down, so we'll just use src/dst IPs for now.
• Google this error for details: "in-bridge-port matcher not possible when bridge use-ip-firewall is disabled"

OS imaging

We're now using servers/neru to serve TFTP and HTTP for PXE boot, no need to have a whole linux machine dedicated to it. Slightly harder to maintain, but should be more bulletproof and doesn't need as much maintenance. A USB stick hosts the bootloader and configs for TFTP, and we run nginx in a container to serve netinstall images from the same directory (/usb1p1/srv/)

Editing kickstart configs is kinda a pain in the arse now because you can't just run vim on the device, but you can edit remotely via an SSHFS mount.

What do we want to even install here anyway?

Utilities and services. FreeIPA server? Various trusted things. Maybe shell box for network admin? I'm willing to make this machine less managed, meaning it could be the root of trust for ansible pushes.

• Mrepo? http://dag.wiee.rs/home-made/mrepo/

  • https://github.com/dagwieers/mrepo

  • Seems like it's considered obsolete
• Almalinux repo mirror for own use
• Gitea git repo server

• MikroDash: https://github.com/SecOps-7/MikroDash

Either way, secure it heavily.

dnf install mtr traceroute

FreeIPA

Start on the QSG: https://www.freeipa.org/page/Quick_Start_Guide

TBC

MikroDash

This is kinda nice. Redo this deployment using podman and systemd service unit.

Run it like this:

docker run -d -p 3081:3081 -v /persist/mikrodash:/data --name mikrodash --restart=unless-stopped ghcr.io/secops-7/mikrodash:latest

Configure targets:

[root@krolik mikrodash]# gzip -c routers.json | base64
H4sICNo3A2oAA3JvdXRlcnMuanNvbgDF1ltv4jgUB/D3+RSor4yLHTu+rLQPhALlVsqtBVb7YMc2
yQAJjZPSYbTffUM7nZGg81oURUJ/J1asn87h/POlUvlR3pXKVayv/qpcMa6VJ30fIB0qQHwDAafS
AmGUolyYUFN59fXtjY1UZnN8CVVAJTKbWCbvS1Hq8uPKW3qdR/EqOt7uOk937w/t0uz4EGce/5nk
G1cGVm6c+Z10EmfCIjMnK4UzWSK3x/hqG6+zVEsX/dpaOrdPs9cjPdT8vpOWFPfVb/Pk4Z6ShLJD
PTn0p4f5rL/rIFhLn9ei9eCNMxXU8ySIxJO8X03h3+/7aWNlsck79rihyRGI3e9jxMlqKrOVeT0x
un693hfV/ibdJwO1Ox4MQQh/5bPdeSq1Nrp+3Acxxn1BfOb7yC8X//t6KmUQxhJpD3CMSiljFFBG
UVBuwSjmoWFSnUnhUmor17HM8/TU6j2/rJZp8Wo+yehhXa1NXxrhfTeAtzcLOAxYrxfdwG74lDeD
+8Zg8eA13XY4W6SL2M512A3/pBWZDH0GFqWUEP4hlmWlJTIEGK0QIJhgwD0tAdYYhyH2yhKzZ1ik
xLJZnMfylAoJ7xpRXn47+WSeKpXjaTdRqrfYPYvZBKu+o5o/PfrkpmnxobOr19qzKBHjajDruVEY
w+Vjdb+Lkv2leYQHOfE+5KGUWe5hAUzoa0C0gEDx8lfZ8wzkSgjqmTMe/9j1UhfFyVkp/YwvW0m4
wdeQpGgl57TbG6/atdbIo6vAb7JuVxV3tVW4R8VyOfQhXXBe53wIp3Vqxo+Di1MxTr2P2x71CLU0
ZCBEygIiSQiUZzDwNCdaCko5Om97tKRax65scKdSb+lloVrzJmtnm+Cmmc98R+cz23P5rivCYVDX
z9Hev9vb1iIu0uloLLsLkwV37RUXgbv94x/UJ0H5EJcX/BBKCOt7mkngUVtCcU4BV0aC0CossZVY
GH0GxUoomcXulOmYXRZp7Xs89OBkMnEParcRNd3YZ4vHzdLF9emIPUdMey8t/nTYsnVzPNhHi5ci
qdan4+XFkRDChLAPkbhRhFtYjnsY0nKICClQmGpgBefYMmOJD8+Q+LGazHkpmQvXke7PcNBOo6n2
sm/17+auZ5pNGBXFbIQKMxrn45g9y27e3tjddms7kxeewFXUGLnOxYkIxPxjIoaYUFz5APuwHB1o
OT9IKiTgmkiNLYSInxOJkigxWXFqdMwuizTeF41ogwRCSZK4u2CVrft5z63NujMJbv2iP3gK1rWw
cIHfY3nn2+1jbam/D4Z5zi+OxAQVr/Pdl3//B0z/kIQ5DQAA

[root@krolik mikrodash]# gzip -c settings.json | base64
H4sICMC2CWoAA3NldHRpbmdzLmpzb24AZZJPc9owEMXv+RSMz4XaTuLYnemhgaZxC0wG1DY9ru31
n0FIHkmGMJ1+90rYxnIYLub3Vm9X+/T3ZjJxBG8UimculfNp4niRP/OCcBaGM8/5MOgvXBg9fPAj
ixIqNVSiwTGMmcS0EajFHKi01Z8ShWkE2b5iow4gjZnTsgxzaKiKc4NQlSi6cTKQZe+RN6JiO2CD
0pusYL7lJP7ms+3qDdz4B/efBQnm63IHyz+nuvZO89dN9J08gjqo+uMxL55IrDbr17vPrVtdseIr
g4RiZl/RYAKiwHZbs/OvO8EpnXPGzAD3ruteIAG6Q2HwrY0fgWXHKlPl+/qN3oduo7HnXjgUOPBh
HF2+PUmFe0192+R3JZCi7LsOwq+ajZ01e9LFR6D0/SRxLhWo5upGcQ4pGhqMbF7a6UalX0R9NcKi
TOv+cEsVr9fmZP+nW9nA8m5C0hZ6LT3UbKFTJ/bpPbz1KfgX/7KSiovTqmL6qbU7OXOgKNS8bkgp
UJacmqwjSzI3WvLzFr3OSnC5wKQpRm8bUlUdzgGhiI2JEwQPeejfRlNM77PpXRa50yTUX0kSoBsm
URT46FyitdIastU8ZtqwX/ZI6XY4Ym20I2RWgXo4zq4crNBHfMmLq1r7rRrh5t9/S/dElzwEAAA=

gitea

I've since reworked this to use podman and a systemd service unit, it's much better that way. Document it here.

nginx configs

/etc/nginx/conf.d/almalinux.conf
    server {
        listen       80;
        listen       [::]:80;
        server_name  mirror.thighhighs.top;
        root         /usr/share/nginx/html;

        location /almalinux/mirrorlist {
            alias /persist/almalinux_mirrorlists ;
            autoindex on;
        }
        location /almalinux {
            alias /persist/almalinux_repos ;
            autoindex on;
        }


"/etc/nginx/conf.d/gitea.conf"
server {
    listen       80;
    listen       [::]:80;
    server_name  git.thighhighs.top;
    root         /usr/share/nginx/html;

    location / {
        client_max_body_size 512M;
        proxy_pass       http://localhost:3000;
        proxy_set_header Connection $http_connection;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Run gitea as a service:

"gitea.service"
# THIS FILE IS MANAGED BY ANSIBLE. MANUAL CHANGES MAY BE DESTROYED.
# vim: syntax=systemd
[Unit]
Description=containerised Gitea
After=docker.service persist-gitea.mount
Requires=docker.service persist-gitea.mount

[Service]
Environment=USER_UID=2000
Environment=USER_GID=2000
Environment=HTTP_PORT=3000
Environment=SSH_PORT=2222
Environment='GITEA_IMAGE=docker.io/gitea/gitea:1.23.4'

ExecStart=docker run --rm --name="gitea" -e USER_UID=${USER_UID} -e USER_GID=${USER_GID} -p ${HTTP_PORT}:3000 -p ${SSH_PORT}:22 -v /persist/gitea/data:/data -v /etc/timezone:/etc/timezone:ro -v /etc/localtime:/etc/localtime:ro ${GITEA_IMAGE}

Restart=on-failure
RestartSec=10s

[Install]
WantedBy=multi-user.target

And filesystem mounts:

"persist-almalinux_repos.mount"
[Unit]
Description=Filesystem for Almalinux dnf repos
Requires=iscsi.service

[Mount]
What=/dev/disk/by-uuid/7f55bc8f-ebd1-4159-8572-6332539f7f13
Where=/persist/almalinux_repos
Type=xfs
Options=noatime,_netdev
TimeoutSec=20

[Install]
WantedBy=default.target



"persist-gitea.mount"
[Unit]
Description=Filesystem for gitea data
Requires=iscsi.service

[Mount]
What=/dev/disk/by-uuid/c1ef0078-ed22-4a08-9e5b-24aa5b815d5e
Where=/persist/gitea
Type=xfs
Options=noatime,_netdev
TimeoutSec=20

[Install]
WantedBy=default.target

Local almalinux mirror

sync-alma-mirror-from-upstream.service

# THIS FILE IS MANAGED BY ANSIBLE. MANUAL CHANGES MAY BE DESTROYED.
# vim: syntax=systemd
[Unit]
Description=rsync the AlmaLinux package mirror

After=persist-almalinux_repos.mount
Requires=persist-almalinux_repos.mount

[Service]
Type=oneshot
Nice=19
IOSchedulingClass=2
IOSchedulingPriority=7
ExecStart=/usr/bin/rsync -rlptvSH --bwlimit=80m --exclude=.~tmp~ --delete-delay --delay-updates rsync://rsync.repo.almalinux.org/almalinux/ /persist/almalinux_repos/
Restart=on-failure
RestartSec=5min




"sync-alma-mirror-from-upstream.timer"

# THIS FILE IS MANAGED BY ANSIBLE. MANUAL CHANGES MAY BE DESTROYED.
# vim: syntax=systemd
[Unit]
Description=AlmaLinux repo rsync
Requires=persist-almalinux_repos.mount
After=persist-almalinux_repos.mount

[Timer]
OnBootSec=30min
OnUnitInactiveSec=13h
RandomizedDelaySec=10m

[Install]
WantedBy=timers.target

[root@krolik system]# base64 /persist/mirrorlists.tar.gz
H4sIAAAAAAAAA+3X3WqDMBwFcK/3FF702nyoCdvd9gK96AOMbMgUdAlJCj7+or0YK5vWLjhmzw+K
YgPRnv+BairrGueJajvVNu/H/rlrrNW2DRcdSaKggSzL8RicH8dzVshCMh6WhXWslDlL0jLO9tOO
ziubponV2k+tm/v+nzKT+d9nZYQZuDz/nHIZrjPBc4r81zCfvzLGeVupLvP9db/AELAoih/zZzT/
mj8P4yKTlEZ+1m/deP619+aBkFPoma+bt3r4uMxr8zkU4yA8GnMYB4HsXpSrlH2tiXbk7q8fAX5h
vv9D1tpdXf7kkv7T8/7zvED/17Cg/09hEPYHlH9T5vtf9d6q1fsvBPq/hgX9Pw0C+r8pM/2Pssf4
/iflgvd/wYf//zxMXZQbmHLj/QcAAAAAAAAAAACAbfoAVea3QwAoAAA=

ansible is done, now setup nginx with it to serve the repo

iscsi notes

basti attaches iscsi LUNs from fenny so it doesn't need much local storage.

[root@krolik iscsi]# tree
.
├── ifaces
├── isns
├── nodes
│   └── iqn.2011-08.com.asustor:fs6812x-437849.krolik
│       └── 192.168.32.18,3260,1
│           └── default
├── send_targets
│   └── fenny.thighhighs.top,3260
│       ├── iqn.2011-08.com.asustor:fs6812x-437849.krolik,192.168.32.18,3260,1,default -> /var/lib/iscsi/nodes/iqn.2011-08.com.asustor:fs6812x-437849.krolik/192.168.32.18,3260,1
│       └── st_config
├── slp
└── static




[root@basti ~]# iscsiadm -m discovery -t sendtargets -p fenny.thighhighs.top
192.168.32.18:3260,1 iqn.2011-08.com.asustor:fs6812x-437849..basti

[root@basti ~]# iscsiadm -m node -T iqn.2011-08.com.asustor:fs6812x-437849..basti -l
Login to [iface: default, target: iqn.2011-08.com.asustor:fs6812x-437849..basti, portal: 192.168.32.18,3260] successful.
[root@basti ~]# lsscsi
[1:0:0:0]    disk    ATA      NGFF 2280 512GB  3A0   /dev/sda
[2:0:0:0]    disk    ASUSTOR  iSCSI Storage    380   /dev/sdb
[2:0:0:1]    disk    ASUSTOR  iSCSI Storage    380   /dev/sdc

[root@basti ~]# iscsiadm  -m node -L automatic