This page (revision-45) was last changed on 23-Apr-2022 17:06 by Harry Metske

This page was created on 23-Apr-2022 17:05 by Harry Metske

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note
45 23-Apr-2022 17:06 24 KB Harry Metske to previous
44 23-Apr-2022 17:05 24 KB Harry Metske to previous | to last
43 23-Apr-2022 17:05 24 KB Harry Metske to previous | to last
42 23-Apr-2022 17:05 24 KB Harry Metske to previous | to last
41 23-Apr-2022 17:05 21 KB Harry Metske to previous | to last

Page References

Incoming links Outgoing links
Computerhok 2013
Computerhok 2013

Version management

Difference between version and

At line 8 removed one line
%%warning We went live on Sunday 2013-02-24! %%
At line 395 changed one line
* vim htop openjdk-7-jdk wget mailutils lsof uuid fsarchiver fail2ban
* vim
* htop
At line 398 changed one line
* htop apache2 aptitude unzip locate fping postfix telnet mailutils lsof
* htop
* apache2
* aptitude
* unzip
* locate
At line 403 changed one line
* imagemagick php5-imagick man-db fail2ban
* imagemagick
* php5-imagick
At line 461 removed 212 lines
!! firewall configurations
! apollo
Stuck into /etc/rc.local:
%%small
{{{
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p icmp -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -i lxcbr0 -j ACCEPT
/sbin/iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT
/sbin/iptables -A INPUT -s 10.0.3.1/24 -j ACCEPT
/sbin/iptables -A INPUT -s 140.211.11.9 -j ACCEPT
/sbin/iptables -A INPUT -s 145.72.98.1 -j ACCEPT
#/sbin/iptables -A INPUT -j LOG
/sbin/iptables -A INPUT -j DROP
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1122 -j DNAT --to 10.0.3.11:22
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1125 -j DNAT --to 10.0.3.11:25
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1180 -j DNAT --to 10.0.3.11:80
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 11443 -j DNAT --to 10.0.3.11:443
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 11808 -j DNAT --to 10.0.3.11:8080
#
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1222 -j DNAT --to 10.0.3.12:22
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1225 -j DNAT --to 10.0.3.12:25
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1280 -j DNAT --to 10.0.3.12:80
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 12443 -j DNAT --to 10.0.3.12:443
#
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1322 -j DNAT --to 10.0.3.13:22
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1325 -j DNAT --to 10.0.3.13:25
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1380 -j DNAT --to 10.0.3.13:80
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 13443 -j DNAT --to 10.0.3.13:443
#
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1422 -j DNAT --to 10.0.3.14:22
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1425 -j DNAT --to 10.0.3.14:25
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1480 -j DNAT --to 10.0.3.14:80
/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 14443 -j DNAT --to 10.0.3.14:443
}}}
%%
! cn1
Stuck into /etc/rc.local:
%%small
{{{
/sbin/iptables -F
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p icmp -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT
/sbin/iptables -A INPUT -s 10.0.3.0/24 -j ACCEPT
/sbin/iptables -A INPUT -s 140.211.11.9 -j ACCEPT
/sbin/iptables -A INPUT -s 145.72.98.1 -j ACCEPT
/sbin/iptables -A INPUT -s 178.18.80.48 -j ACCEPT
/sbin/iptables -A INPUT --match multiport -p tcp --dports 80,443 -j ACCEPT
/sbin/iptables -A INPUT --match multiport -p udp --dports 80,443 -j ACCEPT
#/sbin/iptables -A INPUT -j LOG
/sbin/iptables -A INPUT -j DROP
}}}
%%
!! Miscellaneous
* set timezone on containers, put ''Europe/Amsterdam'' to ''/etc/timezone'' and run ''dpkg-reconfigure --frontend noninteractive tzdata''.
* zabbix MySQL support, adjust ''/usr/local/etc/zabbix_agentd.conf.d/userparameter_mysql.conf'' and create ~~zabbix/.my.cnf with user/pw in it
* ''too many open files'' on tail -f ==> ''echo 1024 > /proc/sys/fs/inotify/max_user_instances''
! lxc-rsync
To be able to quickly "copy/clone" lxc's (while having their own filesystem/lv already) :
%%small
{{{
root@apollo:~/bin# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda7 9.2G 5.3G 3.5G 61% /
udev 971M 12K 971M 1% /dev
tmpfs 389M 408K 389M 1% /run
none 5.0M 0 5.0M 0% /run/lock
none 972M 0 972M 0% /run/shm
cgroup 972M 0 972M 0% /sys/fs/cgroup
/dev/mapper/vg0-lvol.cn1 20G 7.4G 12G 40% /var/lib/lxc/cn1
/dev/mapper/vg0-lvol.cn4 5.0G 2.0G 2.7G 43% /var/lib/lxc/cn4
/dev/mapper/vg0-lvol.cn2 20G 6.7G 13G 36% /var/lib/lxc/cn2
/dev/mapper/vg0-lvol.cn3 3.0G 69M 2.8G 3% /var/lib/lxc/cn3
}}}
%%
I created the following ~root/bin/lxc-rsync script :
%%small
%%prettify
{{{
#!/bin/bash
#
# rsync on lxc with another
# args: <src lxc> <tgt lxc>
#
NUMARGS=$#
if [ $NUMARGS -ne 2 ]; then
echo "Usage: lxc-rsync <src lxc> <tgt lxc>"
exit 8
fi
SRCLXC=$1
TGTLXC=$2
SRCDIR=/var/lib/lxc/${SRCLXC}/rootfs
TGTDIR=/var/lib/lxc/${TGTLXC}/rootfs
if [ -d $SRCDIR -a -d $TGTDIR ]; then
echo "rsyncing from $SRCLXC to $TGTLXC"
cd $SRCDIR || exit 8
# save the old IP address
OLDIP=`grep address ${TGTDIR}/etc/network/interfaces | awk '{ print $NF}'`
rsync --exclude "tmp" --exclude "dev" --exclude "media" --exclude "mnt" --exclude "proc" --exclude "sys" --exclude "var/run" --verbose --recursive --links --perms --acls --times --owner --group --one-file-system --delete . $TGTDIR
# patching hostname and IP address
echo "patching /etc/hostname, /etc/hosts and /etc/network/interfaces ==> $TGTLXC / $OLDIP"
sed --in-place s/${SRCLXC}/${TGTLXC}/g ${TGTDIR}/etc/hostname
sed --in-place s/${SRCLXC}/${TGTLXC}/g ${TGTDIR}/etc/hosts
WRONGIP=`grep address ${TGTDIR}/etc/network/interfaces | awk '{ print $NF}'`
sed --in-place s/${WRONGIP}/${OLDIP}/g ${TGTDIR}/etc/network/interfaces
else
echo "either $SRCDIR or $TGTDIR does not exist"
exit 8
fi
}}}
%%
%%
%%warning But this rsync does not properly clone, for example /run/zabbix /var/run/zabbix fails, and mysqld does not start. %%
Therefore I created lxc-copy that uses __fsarchiver__ to do the heavy lifting.
! lxc-copy
The following script (takes longer but) works better :
%%prettify
{{{
#!/bin/bash
#
# copy an lxc (filesystem) to another one
# args: <src lxc> (must bu either cn1 or cn4, they will get copied to resp. cn2 and cn3)
#
# funtions first
logDie()
{
msg=$1
echo "$msg"
exit 8
}
# m a i n l i n e
#
NUMARGS=$#
if [ $NUMARGS -ne 1 ]; then
echo "Usage: lxc-copy <src lxc> (must bu either cn1 or cn4, they will get copied to resp. cn2 and cn3)"
exit 8
fi
SRCLXC=$1
if [ $SRCLXC != "cn1" -a $SRCLXC != "cn4" ]; then
echo "argument must be either cn1 or cn4"
exit 8
fi
TGTLXC=cn2
if [ $SRCLXC = "cn4" ]; then
TGTLXC=cn3
fi
echo "cloning from $SRCLXC to $TGTLXC"
mount |grep "/var/lib/lxc/${TGTLXC}" > /dev/null || logDie "/var/lib/lxc/${TGTLXC} is not mounted"
TGTDIR=/var/lib/lxc/${TGTLXC}/rootfs
OLDIP=`grep address ${TGTDIR}/etc/network/interfaces | awk '{print $NF}'`
OLDUUID=`cat /etc/fstab|grep /${TGTLXC} | awk '{ print $1}'|awk -F= '{print $NF}'`
# save old metadata of target lxc
cd /var/lib/lxc/${TGTLXC} && tar -cf /tmp/old-metadata-of-TGTLXC.tar config fstab rootfs.hold || logDie "saving old metadata of ${TGTLXC} failed"
cd -
MNTPOINT=/var/lib/lxc/${TGTLXC}
echo "umounting ${MNTPOINT}"
umount ${MNTPOINT} || logDie "umount failed for ${MNTPOINT}"
#
# check if container fs has been mounted
df /mnt/container/ | grep /dev/mapper/vg0-container > /dev/null
RC=$?
if [ $RC -eq 1 ]; then
mount /dev/mapper/vg0-container /mnt/container
echo "container fs mounted"
fi
echo "dumping source filesystem"
TAPEFILE=/mnt/container/savedfs.fsa
fsarchiver -A savefs ${TAPEFILE} /dev/mapper/vg0-lvol.${SRCLXC} || logDie "fsarchive savefs failed"
echo "restoring filesystem"
fsarchiver restfs ${TAPEFILE} id=0,dest=/dev/mapper/vg0-lvol.${TGTLXC} || logDie "fsarchive restfs failed"
echo "restoring old UUID ${OLDUUID}"
tune2fs /dev/mapper/vg0-lvol.${TGTLXC} -U ${OLDUUID}
echo "mounting back again"
mount -a || logDie "mount -a failed"
echo "restoring old metadata"
cd /var/lib/lxc/${TGTLXC} && tar -xf /tmp/old-metadata-of-TGTLXC.tar || logDie "restoring old metadata failed"
echo "patching /etc/hostname, /etc/hosts and /etc/network/interfaces ==> $TGTLXC / $OLDIP"
sed --in-place s/${SRCLXC}/${TGTLXC}/g ${TGTDIR}/etc/hostname || logDie "patching /etc/hostname failed"
sed --in-place s/${SRCLXC}/${TGTLXC}/g ${TGTDIR}/etc/hosts || logDie "patching /etc/hosts failed"
WRONGIP=`grep address ${TGTDIR}/etc/network/interfaces | awk '{ print $NF}'`
sed --in-place s/${WRONGIP}/${OLDIP}/g ${TGTDIR}/etc/network/interfaces || logDie "patching /etc/network/interfaces failed"
rm -f ${TAPEFILE} /tmp/old-metadata-of-TGTLXC.tar
umount /mnt/container
}}}
%%
This page (revision-45) was last changed on 23-Apr-2022 17:06 by Harry MetskeTop