Prod Setup. Documentation and notes from creating my personal site. Phase 1 - Getting Started. BookStack Installation.

Transcription

1 Prod Setup Documentation and notes from creating my personal site Phase 1 - Getting Started BookStack Installation MySQL Backups GitLab Installation Restya Installation Landing Page / Dashboard WordPress Blog Installation TIG Stack Install & Initial Configuration Install OwnCloud UrBackup Server Installation UrBackup Client install Telegraf client installation Node-Red installation

2 Phase 1 - Getting Started

3 Phase 1 - Getting Started BookStack Installation Server Setup 1GB VPS Server will only host 1 application (this) Debian 9 - Stretch kernel bare Linux install. Requirements There's a guide for requirements and installation here apt install nginx systemctl enable nginx apt install mariadb-server php7.0-mysql systemctl start mariadb systemctl enable mariadb mysql_secure_installation apt install php7.0-fpmsudo sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/g' /etc/php/7.0/fpm/php.iniapt install php-mbstring php-tokenizer php-mysqlnd php-gd phpsimplexml php-dom php-tidy php-zip unzip

4 Then because this is the only site being served; rm -rf /var/www/html rm /etc/nginx/sites-available/default rm /etc/nginx/sites-enabled/default Installing the BookStack Application Very simple, go to folder, clone git repo, be OCD about lower case and then enter the application directory cd /var/www/git clone --branch release -single-branch mv BookStack bookstack cd bookstack Install composer by copying the script here The SHA hash changes each time the installer is updated, so copying my commands won't help. php -r "copy(' 'composer-setup.php');"php -r "if (hash_file('sha384', 'composer-setup.php') === '93b c ac18b134c3b3a95e5a5e5c8f1a9f115f203b75bf9a129d5daa8ba6a13e2cc8a1da a8') { echo 'Installer verified'; else { echo 'Installer corrupt'; unlink('composersetup.php'); echo PHP_EOL;" php composer-setup.php php -r "unlink('composer-setup.php');" I didn't want to install it globally, so, just ran this; php composer.phar

5 Once this runs successfully, do the following to get the permissions in order; cp.env.example.env cd.. && chown -R www-data.www-data bookstack cd bookstack Configuring the Webserver Start by configuring mysql / mariadb (within mysql); CREATE USER 'bookstack'@'localhost' IDENTIFIED BY 'password'; CREATE DATABASE bookstack;grant ALL PRIVILEGES ON bookstack.* TO 'bookstack'@'localhost'; FLUSH PRIVILEGES; Basic configuration to test if everything is working first; nano /etc/nginx/sites-available/docs.grchap.com.conf server { listen 80 default_server; listen [::]:80 default_server; root /var/www/bookstack/public; index index.php index.html index.htm; server_name docs.grchap.com; location / { try_files $uri $uri/ /index.php?$query_string; location ~ \.php$ { include snippets/fastcgi-php.conf; fastcgi_pass unix:/var/run/php/php7.0-fpm.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

6 ln -s /etc/nginx/sites-available/docs.grchap.com.conf /etc/nginx/sitesenabled/docs.grchap.com.conf nginx -t systemctl reload nginx Finish up the installation of bookstack; php artisan key:generate php artisan migrate IMPORTANT: Login using default user and password and change the password (at least); USER: PASSWORD: password Settings > Users > Admin; change name change password change Save. Forcing the application over HTTPS; apt install certbot certbot certonly Run through the options that are asked, filling in required details. cp /etc/nginx/sites-available/docs.grchap.com.conf /etc/nginx/sitesavailable/docs.grchap.com.conf-ssl nano /etc/nginx/sites-available/docs.grchap.com.conf

7 Replace the whole configuration with this redirect; server { listen 80 default_server; listen [::]:80 default_server; server_name docs.grchap.com; return nano etc/nginx/sites-available/docs.grchap.com.conf-ssl And replace the whole of the ssl comnfiguration with; server { listen 443 ssl; listen [::]:443 ssl; ssl_certificate /etc/letsencrypt/live/docs.grchap.com/cert.pem;ssl_certificate_key /etc/letsencrypt/live/docs.grchap.com/privkey.pem; root /var/www/bookstack/public; index index.php index.html index.htm; server_name docs.grchap.com; location / { try_files $uri $uri/ /index.php?$query_string; location ~ \.php$ { include snippets/fastcgi-php.conf; fastcgi_pass unix:/var/run/php/php7.0-fpm.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

8 nginx -t systemctl reload nginx configure auto-renewal of the certificate; crontab -e insert the following; 0 */12 * * * root certbot -q renew Et voila, bookstack over HTTPS, with auto-renewing free SSL certificate. Configuring Bookstack In Settings; Change "Application Name" Change the color (using; #2C3E50 currently) Page editor - Markdown (from HTML) Check registration is off Check public viewing is off can configure new users if required.

9 Phase 1 - Getting Started MySQL Backups Preparing Mysql for replication To enable incremental backups with mysqldump we need to enable binary logging; check if it's already enabled from within mysql; > select variable_value as "BINARY LOGGING STATUS (log-bin) :: " from information_schema.global_variables where variable_name='log_bin'; BINARY LOGGING STATUS (log-bin) :: OFF row in set (0.00 sec) and > select variable_value as "BINARY LOG FORMAT (binlog_format) :: " from information_schema.global_variables where variable_name='binlog_format'; BINARY LOG FORMAT (binlog_format) :: STATEMENT row in set (0.00 sec) need to udpate my.cnf to include ; /etc/mysql/my.cnf

10 [mysqld] log-bin=bin.log log-bin-index=bin-log.index max_binlog_size=100m binlog_format=row socket=/run/mysqld/mysqld.sock To find the right socket run; find / -type s -name "*mysqld*" restart mysql; systemctl restart mysqld and then verify logging is working; > select variable_value as "BINARY LOGGING STATUS (log_bin) :: " from information_schema.global_variables where variable_name='log_bin'; BINARY LOGGING STATUS (log_bin) :: ON row in set (0.00 sec) and > select variable_value as "BINARY LOG FORMAT (binlog_format) :: " from information_schema.global_variables where variable_name='binlog_format'; BINARY LOG FORMAT (binlog_format) :: ROW row in set (0.01 sec) And to show the logs; > show binary logs;

11 Log_name File_size bin bin bin bin bin rows in set (0.00 sec) Configuring the backups Take an initial dump of the database; DATE=$(date +%d-%m-%y-%t)mysqldump --single-transaction --flush-logs --master-data=2 --alldatabases --delete-master-logs bzip2 > /backups/$date.sql.bz Then set script in crontab for every morning at 4:30; 30 4 * * * /bin/bash /home/scripts/prod_env_scripts/mysql_backups.sh Current scriptis hosted on git.grchap.com/grc/prod_env_scripts/mysql_backups.sh

12 Phase 1 - Getting Started GitLab Installation Server Setup 8GB VPS Server will only host 1 application (this) Debian 9 - Stretch kernel bare Linux install. Installation Really simple; apt-get update apt-get install -y curl openssh-server ca-certificates dpkg-reconfigure postfix posfix is optional, if s are required. curl bash EXTERNAL_URL=" apt-get install gitlab-ee Edit /etc/gitlab/gitlab.rb and ensure; external_url '

13 letsencrypt['enable'] = true letsencrypt['contact_ s'] = ['REDACTED']letsencrypt['group'] = 'root' letsencrypt['key_size'] = 2048 letsencrypt['owner'] = 'root' letsencrypt['wwwroot'] = '/var/opt/gitlab/nginx/www'# See for more on these sesttings letsencrypt['auto_renew'] = trueletsencrypt['auto_renew_hour'] = 3 letsencrypt['auto_renew_minute'] = 0 # Should be a number or cron expression, if specified. letsencrypt['auto_renew_day_of_month'] = "*/14" Then run; gitlab-ctl reconfigure Once complete, navigate to; and change the password as prompted.

14 Phase 1 - Getting Started Restya Installation Server Setup 1GB VPS Server will only host 1 application (this) Debian 9 - Stretch kernel bare Linux install. Installation naturally php7.2 isn't available on debian stretch and is required by the setup script, so add the repos for this; sudo apt install ca-certificates apt-transport-https wget -q -O- sudo apt-key add -echo "deb stretch main" sudo tee /etc/apt/sources.list.d/php.list Pretty simple; wget --no-check-certificate edit the script restyboard.sh to change the postgre password

15 chmod +x restyaboard.sh./restyaboard.sh Weirdly this isn't an automated install, lots of questions asks; is restyaboard installed happy with postgre password do you want to install nginx do you want to install php do you want to install postgresql specify the domain do you want to cover with ssl enter for ssl done It takes a while to run through, but it doesn't require much in the way of input for the amount of stuff it is doing. Post Install Login and changed the admin password Disable Registration ability admin > roles > untick "registration" Delete the guest user

16 Phase 1 - Getting Started Landing Page / Dashboard Install Opted for this dashboard install nginx; apt install nginx systemctl enable nginx instal git; apt install git now to download it; wget isntall zip unzip download mv Theme-SinglePageAdmin landingpage rm -rf html Now point nginx at the right place; nano /etc/nginx/sites-enabled/default change root to;

17 /var/www/landingpage nginx -t systemctl restart nginx Getting it setup with git cd /var/www/landingpage git init git remote add origin git add. git commit -m "initial coimmit" git push -u origin master Site content is now managed via git. Configure Nginx Get an SSL; apt install certbot certbot certonly Setup the HTTP site; nano /etc/nginx/sites-available/landingpage.conf server { listen 80 default_server; listen [::]:80 default_server; server_name grchap.com return 301

18 Setup the HTTPS site; nano /etc/nginx/sites-enabled/landingpage-ssl.conf server { listen 443 ssl; listen [::]:443 ssl; ssl_certificate /etc/letsencrypt/live/grchap.com/cert.pem;ssl_certificate_key /etc/letsencrypt/live/grchap.com/privkey.pem; root /var/www/landingpage; index index.php index.html index.htm; server_name grchap.com Site will be up, and can now be edited.

19 Phase 1 - Getting Started WordPress Blog Installation Installation Install nginx and mariadb, then secure the initial mariadb install; apt install nginx systemctl enable nginx apt-get install mariadb-server mariadb-clientsystemctl enable mariadb.service mysql_secure_installation Now continue with the package installation; systemctl restart mariadbapt install php-fpm php-common php-mbstring php-xmlrpc php-soap phpgd php-xml php-intl php-mysql php-cli php-mcrypt php-ldap php-zip php-curl Now php needs some configuration, edit both files the same; nano /etc/php/7.0/cli/php.ini nano /etc/php/7.0/fpm/php.ini and change the following;

20 file_uploads = On max_execution_time = 180 memory_limit = 256M upload_max_filesize = 64M lay the ground work for the wordpress blog; mysql -u root -p then create a database and a user; CREATE DATBASE wordpressdb;create USER 'wordpressuser'@'localhost' IDENTIFIED BY 'password'; GRANT ALL ON wordpressdb.* TO 'wordpressuer'@'localhost' IDENTIFIED BY 'password' WITH GRANT OPTION; FLUSH PRIVILEGES; EXIT; Now lets download Wordpress; cd /tmp && wget tar -zxvf latest.tar.gz mv wordpress/* /var/www/blog chown -R www-data:www-data /var/www/blog/ chmod -R 755 /var/www/blog/ nano /etc/nginx/sites-available/grchapblog Now create the initial site; server { listen 80; listen [::]:80; root /var/www/blog; index index.php index.html index.htm; server_name blog.grchap.com;

21 location / { try_files $uri $uri/ /index.php?$args; location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_index index.php; fastcgi_pass unix:/var/run/php/php7.0- fpm.sock; include $fastcgi_path_info; fastcgi_params; fastcgi_param fastcgi_param PATH_INFO SCRIPT_FILENAME $document_root$fastcgi_script_name; ln -s /etc/nginx/sites-available/grchapblog.conf /etc/nginx/sites-enabled/grchapblog.conf systemctl restart nginx.servicemv /var/www/blog/wp-config-sample.php /var/www/blog/wpconfig.php nano /var/www/blog/wp-config.php Here you want to edit the configuration file with the databse details you created earlier; // ** MySQL settings - You can get this info from your web host ** ///** The name of the database for WordPress */ define('db_name', 'wordpressdb'); /** MySQL database username */ define('db_user', 'wordpressuser'); /** MySQL database password */ define('db_password', 'password'); You should now be able to access Wordpress via your browser. Configure for HTTPS Get an SSL;

22 apt install certbot certbot certonly Create the HTTPS configuration; nano /etc/nginx/sites-available/grchapblog-ssl.conf server { listen 443; listen [::]:443; root /var/www/blog; index index.php index.html index.htm; server_name blog.grchap.com; ssl_certificate /etc/letsencrypt/live/blog.grchap.com/cert.pem; ssl_certificate_key /etc/letsencrypt/live/blog.grchap.com/privkey.pem; location / { try_files $uri $uri/ /index.php?$args; location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_index index.php; fastcgi_pass unix:/var/run/php/php7.0- fpm.sock; include $fastcgi_path_info; fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; Redirect HTTP to HTTPS; nano /etc/nginx/sites-available/grchapblog.conf server { listen 80; fastcgi_param PATH_INFO

23 listen [::]; server_name blog.grchap.com; return The WordPress site will now be served over HTTPS and you can continue with the configuration of the site.

24 Phase 1 - Getting Started TIG Stack Install & Initial Configuration Setup Debian Stretch Telegraf InfluxDB Grafana InfluxDB Installation I had to install curl first; apt install curl curl -sl sudo apt-key add -source /etc/os-release test $VERSION_ID = "9" && echo "deb stretch stable" sudo tee /etc/apt/sources.list.d/influxdb.list then install apt-transport-https; apt install apt-transport-https Then install and start influxdb apt update apt install influxdb systemctl start influxdb

25 systemctl enable influxdb Install Grafana curl sudo apt-key add -echo "deb stretch main" tee /etc/apt/sources.list.d/grafana.list apt update apt install grafana systemctl start grafana-server systemctl enable grafana-server Install Telegraf We've already added the repos installing influxdb apt install telegraf systemctl start telegraf systemctl enable telegraf Configure Grafana I opted to get Grafana up and running first. It'll be up and publically accessible from starting the server, so you wnt to login; <IP>:3000 or The default login that needs changing;

26 user: admin password: admin Now, back to the command line. influx This should drop you into a shell for influx; CREATE USER telegraf WITH PASSWORD 'password' GRANT ALL ON telegraf TO telegrafcreate RETENTION POLICY thirty_days ON telegraf DURATION 30d REPLICATION 1 DEFAULT Where "password" is your choice of password This configuration can be changed later to suit your needs, but for now we want a proof of concept that we have this stack working. Data Source So, back to Grafanas web interface. It is probably prompting you on the Home page to create a datasource so click that. Then use the following options (again, these are configurable later for your own requirements);

27 Name: InfluxDB Type: InfluxDB URL: Access: Server(Default) Database: telegraf User: telegraf Password: password Now hit Save & Test. Dashboard With the data source conected you can create a simple Dashboard for testing; Simplest test is to plot the cpu usage over time; Add Panel > Graph > Panel Title > Edit Now choose the following; Data Source: InfluxDB and format the query that shows as; FROM default cpu WHERE SELECT field(usage_system) mean() GROUP BY time($ interval) fill(null) FORMAT AS Time series You can remove things by clicking the letters and selecting remove, a lot of this is the default options. Get it working over HTTPS we just want to generate a certificate now;

28 apt install certbot certbot certonly Now, as we are running grafana as a stand alone this is a bit more complex than it should be... Edit the following file; /etc/grafana/grafana.ini protocol = https http_port = 443 domain = <yourdomain> root_url = cert_file = /etc/letsencrypt/live/<yourdomain>/cert.pemcert_key = /etc/letsencrypt/live/<yourdomain>/privkey.pem You cannot start the service now. It will fail (silently) A few things need doing first; Allow the grafana user to use a port below 1024; setcap 'cap_net_bind_service=+ep' /usr/sbin/grafana-server and allow grafana access to the certificate files; chmod 711 /etc/letsencrypt/archive/ chmod 711 /etc/letsencrypt/live/ I'm not sure this is the best from a security perspective, but it's the general accepted answer for grafana having no permission to access the certificates. This is something I will be looking to improve.

29 That should be enough, you can start the service; systemctl start grafana-service and navigate to the domain;

30 Phase 1 - Getting Started Install OwnCloud Server Setup Debian Stretch 1GB RAM Extendible Block Storage from host. install pre-requisits apt install nginx apt install mariadb-server mariadb-clientapt install php-fpm php-common php-mbstring phpxmlrpc php-soap php-apcu php-smbclient php-ldap php-redis php-gd php-xml php-intl php-json php-imagick php-mysql php-cli php-mcrypt php-ldap php-zip php-curl No start and enable everything; systemctl enable nginx systemctl start nginx systemctl enable mariadb systemctl start mariadb Secure mysql; mysql_secure_installation systemctl restart mariadb.service Now create the database and user;

31 mysql CREATE DATABASE owncloud;create USER IDENTIFIED BY 'password'; GRANT ALL ON owncloud.* TO IDENTIFIED BY 'password' WITH GRANT OPTION; FLUSH PRIVILEGES; EXIT; Install OwnCloud add the repo; wget -nv -O Release.key apt-key add - < Release.keyecho 'deb /' > /etc/apt/sources.list.d/owncloud.list install the https transporter if required; apt install apt-transporterr-https now install owncloud; apt update apt install owncloud-files Make it accessible to nginx;

32 chown -R www-data:www-data /var/www/owncloud/ find /var/www/ -type d -exec chmod 755 { \; find /var/www/ -type f -exec chmod 644 { \; Now configure nginx; first grab some letsencrypt certificates; apt install certbot certbot certonly nano /etc/nginx/sites-available/owncloud.conf upstream php-handler { server :9000; # Depending on your used PHP version server unix:/var/run/php/php7.0-fpm.sock; server { listen 80; server_name <yourdomain>; # For Lets Encrypt, this needs to be served via HTTP challenge/ { location /.well-known/acme- root /var/www/owncloud; # Specify here where the challenge file is placed # enforce https location / { return server { listen 443 ssl http2;

33 server_name <yourdomain>; ssl_certificate /etc/letsencrypt/live/<yourdomain>/cert.pem; ssl_certificate_key /etc/letsencrypt/live/<yourdomain>/privkey.pem; # Path to the root of your installation root /var/www/owncloud/; location = /robots.txt { allow all; log_not_found off; access_log off; location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; # set max upload size client_max_body_size 512M; fastcgi_buffers 8 4K; # Please see note 1 fastcgi_ignore_headers X-Accel-Buffering; # Please see note 2 # Disable gzip to avoid the removal of the ETag header make your server vulnerable to BREACH # Enabling gzip would also # if no additional measures are done. See gzip off; # Uncomment if your server is build with the ngx_pagespeed module is currently not supported. #pagespeed off; error_page 403 /core/templates/403.php; /core/templates/404.php; error_page 404 # This module

34 location / { rewrite ^ /index.php$uri; location ~ ^/(?:build tests config lib 3rdparty templates data)/ { return 404; location ~ ^/(?:\. autotest occ issue indie db_ console) { return 404; location ~ ^/(?:index remote public cron core/ajax/update status ocs/v[12] updater/.+ ocsprovider/.+ core/templates/40[34])\.php(?:$ /) { fastcgi_split_path_info ^(.+\.php)(/.*)$; include fastcgi_params; $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME fastcgi_param SCRIPT_NAME $fastcgi_script_name; # necessary for owncloud to detect the contextroot fastcgi_param PATH_INFO $fastcgi_path_info; on; fastcgi_param HTTPS fastcgi_param modheadersavailable true; #Avoid sending the security headers twice fastcgi_param front_controller_active true; fastcgi_read_timeout 180; # increase default timeout e.g. for long running carddav/ caldav syncs with entries fastcgi_pass php-handler; fastcgi_intercept_errors on; fastcgi_request_buffering off; #Available since NGINX location ~ ^/(?:updater ocs-provider)(?:$ /) { try_files $uri $uri/ =404; index index.php; # Adding the cache control header for js and css files # Make sure it is BELOW

35 the PHP block location ~ \.(?:css js)$ { try_files $uri /index.php$uri$is_args$args; add_header Cache-Control "max-age= "; # Add headers to serve security related headers (It is intended to have those duplicated to the ones above) # Before enabling Strict-Transport-Security headers please read into this topic first. #add_header Strict-Transport-Security "max-age= ; includesubdomains"; add_header X-Content-Type-Options nosniff; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain- Policies none; # Optional: Don't log access to assets access_log off; location ~ \.(?:svg gif png html ttf woff ico jpg jpeg map)$ { Cache-Control "public, max-age=7200"; add_header try_files $uri /index.php$uri$is_args$args; # Optional: Don't log access to other assets access_log off; and enable it; ln -s /etc/nginx/sites-available/owncloud.conf /etc/nginx/sites-enabled/owncloud.confnginx -t systemctl restart nginx You should now see the login screen for your OwnCloud install. You'll want to set the data direction and create your admin user etc.

36 The database details are those you created above.

37 Phase 1 - Getting Started UrBackup Server Installation Server Setup Debian Stretch 1GB RAM 50GB extra storage for backups Installation install nginx and fcgi apt install nginx apt install fcgiwrap Install urbackup wget -i urbackupserver_amd64.deb apt install -f you'll be prompted to point to the location you want your backups.

38 Now get an SSL to make it work over https; apt install certbot certbot certonly nano /etc/nginx/sites-available/backups.grchap.com.conf server { listen 80 default_server; listen [::]:80 default_server; server_name backups.grchap.com; return nano /etc/nginx/sites-available/backups.grchap.com.conf-ssl server { listen 443 default_server; server_name backups.grchap.com; ssl on; ssl_certificate /etc/letsencrypt/live/backups.grchap.com/cert.pem; /etc/letsencrypt/live/backups.grchap.com/privkey.pem; ssl_certificate_key root /usr/share/urbackup/www/; index index.htm; location /x { include /etc/nginx/fastcgi_params; fastcgi_pass :55413; make these sites available; ln -s /etc/nginx/sites-available/backups.grchap.com.conf /etc/nginx/sitesenabled/backups.grchap.com.confln -s /etc/nginx/sites-available/backups.grchap.com.conf-ssl

39 /etc/nginx/sites-enabled/backups.grchap.com.conf-ssl Now check the syntax and reload nginx -t systemctl reload nginx Now, navigate to the site and create an admin user. As it stands it is world accessible without a user on launch.

40 Phase 1 - Getting Started UrBackup Client install Installation & Configuration (local) Pretty simple; TF=`mktemp` && wget " -O $TF && sudo sh $TF; rm $TF This will download and install the client as required. Now add some backup directories, on the server itself this will be etc, var and the urbackup app; urbackupclientctl add-backupdir -d /etc/urbackupclientctl add-backupdir -d /var/log/ urbackupclientctl add-backupdir -d /usr/share/urbackup/www/ can then manually run a full backup via; urbackupclientctl start -f Installation & Configuration (remote) The local, manual installation could be repeated on each. However we are going to use ansible here.

41 First, make sure you have ansible installed locally, and the servers are in the /etc/ansible/hosts file. I won't explain that here as it's trivial to install and do (especially if you've made it this far through the project!). Installation The first thing I want to do is install this on 6 servers, less the backup host. To do this I created a playbook; # Installing the urbackup Linux Client - hosts: 'all:!<backupserver>' remote_user: root tasks: - name: Download Client get_url: url: dest: /tmp/urbackup.sh mode: name: Install Client shell: sh /tmp/urbackup.sh - name: Remove Client file: state: absent path: /tmp/urbackup.sh ansible-playbook --check playbook.yml ansible-playbook playbook.yml Configuration Now, the configuration is a bit different, as not all the servers are the same. We need to define some groupings

42 The next bit can either been done simply via the GUI, or more complicatedly via the CLI; urbackupclientctl set-settings -k internet_mode_enabled -v true -k internet_server -v backups.grchap.com -k internet_server_port -v k computername -v "computer name" -k internet_authkey -v <access token>[! -e /etc/default/urbackupclient ] sed -i 's/internet_only=false/internet_only=true/' /etc/default/urbackupclient[! -e /etc/sysconfig/urbackupclient ] sed -i 's/internet_only=false/internet_only=true/' /etc/sysconfig/urbackupclient systemctl restart urbackupclientbackend.service where the computer name is what you've called it on the backup server and the authkey is the access token given to you. This is all detailed after you manually add an internet host in the GUI on the server. Once the clients are all talking to the server configure the backup dirs using ansibleplaybooks; # Configuring UrBackup on the servers - hosts: 'all:!memsear30' remote_user: root tasks: - name: Add /etc and /var/log directories shell: urbackupclientctl add-backupdir -d /etc shell: urbackupclientctl add-backupdir -d /var/log backupdir -d /backups - name: Create the /backups directory file: path: /backups state: directory owner: root group: root mode: 755 shell: urbackupclientctl add-

43 - hosts: webservers remote_user: root tasks: - name: Add /var/www for webservers shell: urbackupclientctl add-backupdir -d /var/www We also have to create the /backup folder as it doesn't exist which will cause the backups to fail. Then test with a manual run; # Trigger manual incremental backup of all servers - hosts: all remote_user: root tasks: - name: Trigger Manual Backups shell: urbackupclientctl start -i

44 Phase 1 - Getting Started Telegraf client installation Preperation So the ground work for this needs to be done first. There's an ansible role for installation and configuration, so I used that (why re-invent the wheel?); ansible-galaxy install rossmcdonald.telegraf Now we need to ensure that influxdb is all HTTPS nano /etc/influxdb/influxdb.conf Then edit the following; [http] enabled = true bind-address = " :8086" https-enabled = true https-certificate = "/etc/letsencrypt/live/monitor.grchap.com/fullchain.pem" https-private-key = "/etc/letsencrypt/live/monitor.grchap.com/privkey.pem" systemctl restart influxdb WARNING: authentication at this stage is disabled. My database is well protected behind a firewall and only my other servers are able to connect on the open port.

45 I do not recommend using this without authentication and having the port open. Configure the ansible role Open the following for editing; nano /etc/ansible/roles/rossmcdonald.telegraf/defaults/main.yml and change the following in the section about the influx databases; telegraf_influxdb_urls: - telegraf telegraf_influxdb_username: telegraf telegraf_influxdb_password: <password> Once this is done an ansible playbook needs to be created; #Install telegraf on all servers for monitoring - hosts: 'all' remote_user: root roles: - rossmcdonald.telegraf mine is relatively simple, I want all telegraf clients, even the one on my monitoring server currently, to be identical. Only my Prod servers are listed in my /etc/ansible/hosts file as such targeting all hosts will install telegraf on all of them. If you already have hosts defined in your ansible hosts file I'd recommend setting up a group for these servers. Once this is done... run it;

46 ansible-playbook --check telegraf.yml If there are no failures here, then run it for real; ansible-playbook telegraf.yml et voila, this should now be logging as expected. You can check the influx database on your monoitoring server for the time series data being logged. Or, and I'll confess, what I did... set up some graphing in grafana to see if there was any data being logged.

47 Phase 1 - Getting Started Node-Red installation Server Setup Debian Stretch 1GB RAM Install nodejs wget -qo- sudo -E bash apt update apt install -y nodejs This should be nodejs version 8.x node -v now you can install the package; npm install -g --unsafe-perm node-red this should now launch with node-red however it won't be accessible Starting it on boot with own user create the user;

48 useradd node-red follow the prompts, and ensure that it has an accessible home directory. su node-red cd ~ change direcotry to the new users home directory. npm install -g pm2 pm2 start /usr/bin/node-red pm2 save pm2 startup systemd This will ensure that the node-red service will start as the required user on boot. At this point navigating to the <IP>:1880 will allow for unauthenticated access to the web interface. Securing the configuration. Need to setup for https serving over port 443 now. Enable node.js to use a privileged port; setcap 'cap_net_bind_service=+ep' $(eval readlink -f `which node`) Install some letsencrypt certs; apt install certbot certbot certonly Now install the admin tool and generate a password hash; npm install -g node-red-admin

49 node-red-admin hash-pw This'll spit out a hash to use in the next step. Need to edit the settings.js file; $HOME/.node-red/settings.js There are some options to change / add... it's fussy so be careful of commas; uncomment this; var fs = require("fs"); Change the port here; uiport: process.env.port 443, now add in some auth configuration using the bcrypt hash; adminauth: { type: "credentials", users: [{ username: "node-red", password: "bcrypthash", permissions: "*",], and the ssl certicate locations; https: { key: fs.readfilesync('/etc/letsencrypt/live/<yourdomain>/privkey.pem'), fs.readfilesync('/etc/letsencrypt/live/<yourdomain>/cert.pem'),, cert:

50 and finally force https by uncommenting; requirehttps: true, Again, some of the commented variables are lacking commas. Check; pm2 logs node-red if you get a repeating error similar to; 0 node-red /home/node-red/.node-red/settings.js:2230 node-red functionglobalcontext: { 0 node-red ^^^^^^^^^^^^^^^^^^^^^ 0 node-red 0 node-red SyntaxError: Unexpected identifier0 node-red 0 node-red at createscript (vm.js:80:10) at Object.runInThisContext (vm.js:139:10)0 node-red Module._compile (module.js:617:28)0 node-red at at Object.Module._extensions..js (module.js:664:10) 0 node-red at Module.load (module.js:566:32)0 node-red at trymoduleload (module.js:506:12) 0 node-red at Function.Module._load (module.js:498:3)0 node-red Module.require (module.js:597:17)0 node-red 0 node-red at at require (internal/module.js:11:18) at Object.<anonymous> (/usr/lib/node_modules/node-red/red.js:115:20) It's probably a comma missing... somewhere.