= misaka = {{attachment:misaka_imouto.jpg}} * debian squeeze x64 * puppet managed == local work == * mount `/home` with `acl`s * `/etc/skel` * `.bashrc` {{{ # Timestamped shell FTW export HISTTIMEFORMAT='%Y-%m-%d %H:%M:%S ' }}} * `.screenrc` * `.vimrc` * add self to `.ssh/authorized_keys` * `mkdir -m 0701 public_html` == IPv6 == {{{ For VLAN 457 (legacy) machines, just assign addresses out of: My address space: 2407:7800:100:1c9:0:14::/64 - 2407:7800:100:1c9:0:14:FFFF:FFFF/64 Gateway: 2407:7800:100:1c9::1 2407:7800:100:1c9:0:14::1/64 base address 2407:7800:100:1c9:0:14::2/64 nginx lastorder 2407:7800:100:1c9:0:14::3/64 apache biribiri }}} == Migrating from other systems == Lock other accounts and pack the homedir: {{{ INACTIVE=oldUserName usermod -L $INACTIVE tar zcvf "${INACTIVE}.tar.gz" "$INACTIVE" }}} == thinking about apache == Our puppet management of apache is still a mess, so we'll do it manually. What do we want to take care of? * install `apache2-mpm-itk` * a couple of timeout tweaks to `apache2.conf` * `ports.conf` (listen only on 202.4.224.31, ''not'' ssl, etc.) * aka. biribiri.meidokon.net * `a2enmod ssl` * fix `ports.conf` again for SSL, no generic Listens * conf.d/priv.conf {{{ SetEnvIf Remote_Addr ^202\.4\.235\.109$ priv-group }}} * install `libapache2-mod-php5` * start the service * stub out `/var/www/html/monitor` for the default site * fix up an index.html * edit `mods-enabled/status.conf` to get a usable `/server-status` * fix up an `info.php` * install `libapache2-mod-wsgi` * `AssignUserId [username] [groupname]` for itk * nice logging * log to homedirs, `~/logs/apache/{access,error}.log` * fix up logrotate fragment, `apache2-vhost-logs` == Some puppet manifest == {{{#!highlight puppet @kvm::guest { "misaka.anchor.net.au": server => "jellyfish.engineroom.anchor.net.au", profile => linux, memory => "2G", vcpus => 4, disks => "40G", nets => [ "vps", "backups" ]; } class misaka::sshkey::furinkan { $key = "AAAAB3NzaC1yc2EAAAABIwAAAQEAzCHxTgSiO02ZMx148OifiDQxNSVHnI00tuoEZDcy+DFiwsxvjw06rvY5h7fCqkq0Sw+i/71YhEq6uddRARi4MKLKoCWDLf8s4Z/41NS6Rm2/vk5/nD8Wtgyeqm5MHb7Io2gOsE0RGN7Uwi3dC5deD3iHS8FkEnnaQAiXCbEsTePA+JE2PmmPG/RkJehYTCz1qRnKeifJm3j8WGzzODgfIRFURE9tYPsN9+Kpd4LtCXFahioKy7K/0MU2Bbfp6xHozbtMbrZS0cY6mZsjNv5zAUUcKmV6Xz5Cdk9Lw8T3FXY8rDH//tqdH020PhyoNx2mn5xSZ7iyZzVRG387/I0NoQ==" } define misaka::imouto( $ensure = present, $comment = "no comment entered" ) { include misaka::sshkey::furinkan case $ensure { present: { user { "${name}": comment => $comment, gid => "users", shell => "/bin/bash", managehome => true, password => "!!", } file { "/home/${name}/.ssh": ensure => directory, mode => 0700, owner => "${name}", group => "users", } authorized_key { "${comment} - ${name}": key => "${misaka::sshkey::furinkan::key}", type => "ssh-rsa", user => "${name}", require => File["/home/${name}/.ssh"]; "purge-${name}": user => "${name}", ensure => specified_only, require => File["/home/${name}/.ssh"]; } } absent: { user { "${name}": comment => $comment, gid => "users", shell => "/bin/bash", managehome => true, password => "!!", } exec { "Expire the account for ${name}": command => shellquote("/usr/sbin/usermod", "--expiredate", "1970-01-02", $name), unless => "/usr/bin/perl -F: -lane 'print(\$F[0],\" expired \", scalar localtime(\$F[7]*86400)) if (\$F[7]) && (\$F[7] lt int(time/(60*60*24)))' /etc/shadow | /bin/grep -q '^${name} '", } } default: { fail("Invalid value for ensure: ${ensure}") } } } node "misaka.anchor.net.au" { $supportlevel = complete networking::interface { "eth0": ipaddress => "202.4.224.29/25", gateway => "top"; "eth0:00": ipaddress => "202.4.224.30/25", comment => "nginx"; "eth0:01": ipaddress => "202.4.224.31/25", comment => "apache"; "eth0:02": ipaddress => "202.4.224.48/25", comment => "qqc.meidokon.net"; "eth1": ipaddress => "172.22.71.103/16"; } anchor::complete { complete: site => SYD1, mailer => true, backup_interface => "eth1", rdiffbackup_server => "cthulhu.engineroom.anchor.net.au"; } anchor::dirvish::client { dirvish: site => "SYD1", server => "scylla.engineroom.anchor.net.au", } # package { "apache2-mpm-itk": } # listen on 202.4.224.31 only - NameVirtualHost 202.4.224.31:80 # package { "libapache2-mod-php5": } # package { "libapache2-mod-wsgi": } file { "/usr/local/sbin/check_apache_configtest": ensure => present, mode => 0755, source => "puppet:///modules/apache/usr/local/sbin/check_apache_configtest"; } nrpe::command { check_apache_configtest: command => "/usr/local/sbin/check_apache_configtest", sudo => true, } # Shiny new nginx featurerepo { "nginx-1.2": prefer => true, } nginx { $fqdn: monitor => false, } nagios::check::http { http: } # Monitor those HTTP connections nagios::check::httpconnections { httpconnections: } misaka::imouto { "moin": comment => "moin.meidokon.net wiki" } gunicorn::app { "moin": type => wsgi, directory => "/home/moin/moin-1.9.3/wiki/server", user => "moin", group => "users", manager => daemontools; } daemontools::sudo { "moin": user => "moin", service => "moin_gunicorn", passwd => false, } misaka::imouto { "qqc": comment => "qqc.meidokon.net" } # Too hard to make QQC work under gunicorn, I'll just go with apache and mod_wsgi # Access to the old machine filtergen::rule { "50.pgsql-to-shimako": content => 'output eth0 local dest 202.4.233.227 proto tcp dport 5432 accept;'; } mysql { mysql: monitor => false, backup => false, } mysql::backup::zikir { misaka: lv => 'misaka/mysql', lv_size => '1G', mysql_subdir => '/', } mysql::nagios_check { mysql: username => "nagios", password => "dumb", } postgres::tuneshm { tuning: shmmax_in_mib => 42 } # postgres default plus some wiggle room postgres::server { $fqdn: version => "8.4", backup => "zikir", } postfix::common_maps { common_maps: } postfix::nagios_check::mailq { postfix_mailq_check: warn_threshold => 20, crit_threshold => 100, } } }}}