MeidokonWiki:

calico

Contents

  1. calico
    1. Build notes
      1. Image and setup SSH keys
      2. Basic environment stuff
      3. Configure networking
      4. Save a known-good image for convenience
    2. Pihole
    3. Firewall
  2. Incomplete notes
    1. Wireguard
      1. Fix the wireguard-dkms package
    2. Pivpn

Build notes

I used this host to write the general notes for Rock Pi S hardware.

Image and setup SSH keys

Basic environment stuff

Configure networking

What we want:

We'll use netplan to do this, as it greatly simplifies getting what we want without needing to faff around with config in multiple places.

Save a known-good image for convenience

On another system with an SD card reader, take an image of the system after shrinking the filesystem 

e2fsck -f /dev/mmcblk0p2
resize2fs -M /dev/mmcblk0p2

# Use cfdisk or parted to shrink the partition to a bit larger than the FS, has just been reported.
# In this case it's just over 1GiB, so I'll shrink the partition to 1.1GiB.

# Now take the image, capture a bit more than the size of the partitions.
# boot+root partitions are ~1.22GiB (1254MiB) here, so I'll capture 1300MiB just to be sure.
dd bs=1M count=1300 if=/dev/mmcblk0 | pv -br | gzip --fast > 2021-12-13_calico_img_clean_os.img.gz

If you ever need to restore this image, make sure to run resize-assistant afterwards. As well as growing the FS, it needs to locate the backup GPT table at the end of the disk. At the very least you need to run sgdisk -e /dev/mmcblk0 and then partprobe to clean that up.

If you want to expand the filesystem manually:

  1. Boot the image you just restored to the SD card

  2. sgdisk -e /dev/mmcblk0

  3. partprobe

  4. Use parted or cfdisk to expand the 2nd partition to the desired size (or the whole disk)

  5. resize2fs /dev/mmcblk0p2

Pihole

Straightforward basic install, no conflict with other installed services.

Admin UI at https://calico.thighhighs.top/admin/

Update our network config in /etc/netplan/10-thighhighs.yaml and use localhost resolvers only. This gives us the sum of what pihole/dnsmasq knows from local static configs, plus whatever is forwarded to Cloudflare. 

   1 --- 10-thighhighs.yaml.orig     2021-12-13 16:38:46.731548048 +1100
   2 +++ 10-thighhighs.yaml  2021-12-13 16:38:58.290878698 +1100
   3 @@ -21,9 +21,7 @@
   4                    on-link: true
   5              nameservers:
   6                  addresses:
   7 -                    - 192.168.1.20
   8 -                    - 192.168.1.24
   9 -                    - fe80::e65f:1ff:fe1c:c6ea
  10 -                    - fe80::ba27:ebff:fe8c:f4f8
  11 +                    - 127.0.0.1
  12 +                    - ::1
  13                  search:
  14                      - thighhighs.top

Can add TLS \o/ https://discourse.pi-hole.net/t/enabling-https-for-your-pi-hole-web-interface/5771/17

Enable IPv6 upstreams, and Respond only on interface eth0, in http://calico.thighhighs.top/admin/settings.php?tab=dns

This is important as the default setting won't answer queries from other LAN subnets (eg. VPN, IOT segments).

Now is a good time to import the config from the previous install.

Firewall

As per https://docs.pi-hole.net/main/prerequisites/ I've installed ufw and locked things down.

Limit and fail2ban would be good to do as well: https://www.raspberrypi.org/documentation/configuration/security.md 

apt install -y ufw
ufw allow from 192.168.1.0/24 to any app OpenSSH
ufw allow from 2404:e80:42e3:0::/64 to any app OpenSSH
ufw enable

# Pihole stuff - https://docs.pi-hole.net/main/prerequisites/#ufw
ufw allow http
ufw allow https
ufw allow domain
ufw allow 67/udp
ufw allow 67/tcp
ufw allow 546:547/udp

Incomplete notes

These need to be cleaned up and confirmed to be good.

Wireguard

We need to make it compile first, then we can use Pivpn as a tool to manage it.

Fix the wireguard-dkms package

Try installing it 

apt install wireguard-dkms

Install fails because the module doesn't build. This turns out to be a gcc9 problem.

In short, gcc-9 is more strict about this aliasing thing, and throws a warning. That warning is treated as an error because kernel stuff is important, and that causes the DKMS build to bomb out.

Fix 1 sounds hard, let's make it work with gcc-8 then. Using an idea from here: https://github.com/dell/dkms/issues/124#issuecomment-681704633 

apt install gcc-8

# Fiddle with /usr/src/wireguard-1.0.20201112/dkms.conf and add this at the end.
# This is just the same as the normal MAKE[0] defn, but we've added CC=gcc-8
MAKE[0]="make CC=gcc-8 -C ${kernel_source_dir} M=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build"

Let apt try to complete the installation now: 

apt install

Now it completes!

Pivpn

While I've done wireguard manually before, a scripted tool is just kinda nicer (and I trust them enough to use it).

Clone the repo: 

mkdir -p ~/git
cd ~/git/
git clone https://github.com/pivpn/pivpn.git
cd pivpn/

Tweak the auto install script like so: 

   1 diff --git a/auto_install/install.sh b/auto_install/install.sh
   2 index debdf78..aebe9ee 100755
   3 --- a/auto_install/install.sh
   4 +++ b/auto_install/install.sh
   5 @@ -466,7 +466,9 @@ preconfigurePackages(){
   6                 # On Debian (and Ubuntu), we can only reliably assume the headers package for amd64: linux-image-amd64
   7                 [[ $PLAT == 'Debian' && $DPKG_ARCH == 'amd64' ]] ||
   8                 # On Ubuntu, additionally the WireGuard package needs to be available, since we didn't test mixing Ubuntu repositories.
   9 -               [[ $PLAT == 'Ubuntu' && $DPKG_ARCH == 'amd64' && -n $AVAILABLE_WIREGUARD ]]
  10 +               [[ $PLAT == 'Ubuntu' && $DPKG_ARCH == 'amd64' && -n $AVAILABLE_WIREGUARD ]] ||
  11 +               # We've dealt with this on our Ubuntu install
  12 +               [[ $PLAT == 'Ubuntu' && $DPKG_ARCH == 'arm64' && -n $AVAILABLE_WIREGUARD ]]
  13         then
  14                 WIREGUARD_SUPPORT=1
  15         fi
  16 @@ -1294,7 +1296,9 @@ installWireGuard(){
  17                 PIVPN_DEPS=(wireguard-tools qrencode)
  18  
  19                 if [ "$WIREGUARD_BUILTIN" -eq 0 ]; then
  20 -                       PIVPN_DEPS+=(linux-headers-generic wireguard-dkms)
  21 +                       # Not safe for rockpi, they use their own headers
  22 +                       #PIVPN_DEPS+=(linux-headers-generic wireguard-dkms)
  23 +                       PIVPN_DEPS+=(wireguard-dkms)
  24                 fi
  25  
  26                 installDependentPackages PIVPN_DEPS[@]

Then run it and follow the prompts. I need to show unsupported NICs because eth0 doesn't register as being "UP" for some reason. 

./auto_install/install.sh --show-unsupported-nics

Use these settings: 

It'll use these settings:
    pivpnNET="10.6.0.0/24"
    vpnGw="10.6.0.1"
    pivpnPORT=51820
    # use the pihole servers
    pivpnDNS1="192.168.1.26"
    pivpnDNS2="192.168.1.27"
    pivpnHOST = vpn.thighhighs.top

MeidokonWiki: servers/calico (last edited 2022-01-15 00:50:08 by furinkan)