add server configurations
This commit is contained in:
33
arch/base.md
33
arch/base.md
@@ -18,6 +18,7 @@ I have instructions for building a:
|
|||||||
- [Security](#security)
|
- [Security](#security)
|
||||||
- [Secure Boot](#secure-boot)
|
- [Secure Boot](#secure-boot)
|
||||||
- [TPM2 LUKS Decryption](#tpm2-luks-decryption)
|
- [TPM2 LUKS Decryption](#tpm2-luks-decryption)
|
||||||
|
- [Re-enroll](#re-enroll)
|
||||||
- [FIDO2 LUKS Decryption](#fido2-luks-decryption)
|
- [FIDO2 LUKS Decryption](#fido2-luks-decryption)
|
||||||
- [Firewall](#firewall)
|
- [Firewall](#firewall)
|
||||||
- [AppArmor](#apparmor)
|
- [AppArmor](#apparmor)
|
||||||
@@ -50,6 +51,7 @@ I have instructions for building a:
|
|||||||
- [Apps](#apps)
|
- [Apps](#apps)
|
||||||
- [Firefox](#firefox)
|
- [Firefox](#firefox)
|
||||||
- [Gnome Extensions](#gnome-extensions)
|
- [Gnome Extensions](#gnome-extensions)
|
||||||
|
- [Avahi (Bonjour)](#avahi-bonjour)
|
||||||
- [CUPS Printing](#cups-printing)
|
- [CUPS Printing](#cups-printing)
|
||||||
- [Yubikey](#yubikey)
|
- [Yubikey](#yubikey)
|
||||||
- [Bashrc](#bashrc)
|
- [Bashrc](#bashrc)
|
||||||
@@ -339,6 +341,13 @@ Using `--tpm2-pcrs=7` enforces secure boot and will require password if secure b
|
|||||||
1. `pacman -S tpm2-tss`
|
1. `pacman -S tpm2-tss`
|
||||||
2. `systemd-cryptenroll /dev/vda2 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7`
|
2. `systemd-cryptenroll /dev/vda2 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7`
|
||||||
|
|
||||||
|
##### Re-enroll
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemd-cryptenroll /dev/nvme0n1p2 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7
|
||||||
|
systemd-cryptenroll /dev/nvme0n1p3 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7
|
||||||
|
```
|
||||||
|
|
||||||
#### FIDO2 LUKS Decryption
|
#### FIDO2 LUKS Decryption
|
||||||
|
|
||||||
1. `pacman -S libfido2`
|
1. `pacman -S libfido2`
|
||||||
@@ -946,13 +955,31 @@ Choose noto-fonts
|
|||||||
3. dash-to-dock@micxgx.gmail.com
|
3. dash-to-dock@micxgx.gmail.com
|
||||||
4. tactile@lundal.io
|
4. tactile@lundal.io
|
||||||
|
|
||||||
### CUPS Printing
|
### Avahi (Bonjour)
|
||||||
|
|
||||||
1. `sudo pacman -S cups cups-pdf avahi system-config-printer`
|
1. `sudo pacman -S avahi`
|
||||||
2. `sudo vim /etc/nsswitch.conf`
|
2. `sudo vim /etc/nsswitch.conf`
|
||||||
|
|
||||||
```conf
|
```conf
|
||||||
hosts: mymachines mdns_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] files myhostname dns
|
hosts: mymachines mdns [NOTFOUND=return] resolve [!UNAVAIL=return] files myhostname dns
|
||||||
|
```
|
||||||
|
|
||||||
|
3. `sudo vim /etc/mdns.allow`
|
||||||
|
|
||||||
|
```conf
|
||||||
|
.local.
|
||||||
|
.local
|
||||||
|
```
|
||||||
|
|
||||||
|
### CUPS Printing
|
||||||
|
|
||||||
|
Note: you probably need avahi (see above)
|
||||||
|
|
||||||
|
1. `sudo pacman -S cups cups-pdf system-config-printer`
|
||||||
|
2. `sudo vim /etc/nsswitch.conf`
|
||||||
|
|
||||||
|
```conf
|
||||||
|
hosts: mymachines mdns [NOTFOUND=return] resolve [!UNAVAIL=return] files myhostname dns
|
||||||
```
|
```
|
||||||
|
|
||||||
3. `sudo systemctl start cups`
|
3. `sudo systemctl start cups`
|
||||||
|
|||||||
@@ -1,6 +1,9 @@
|
|||||||
# Workstation
|
# Workstation
|
||||||
|
|
||||||
- [Workstation](#workstation)
|
- [Workstation](#workstation)
|
||||||
|
- [Framework AMD Notes](#framework-amd-notes)
|
||||||
|
- [Wifi](#wifi)
|
||||||
|
- [Microcode](#microcode)
|
||||||
- [Base Tools](#base-tools)
|
- [Base Tools](#base-tools)
|
||||||
- [ZSH](#zsh)
|
- [ZSH](#zsh)
|
||||||
- [Aliases](#aliases)
|
- [Aliases](#aliases)
|
||||||
@@ -31,8 +34,38 @@
|
|||||||
- [AWS CLI](#aws-cli)
|
- [AWS CLI](#aws-cli)
|
||||||
- [NSlookup](#nslookup)
|
- [NSlookup](#nslookup)
|
||||||
- [rpi-imager](#rpi-imager)
|
- [rpi-imager](#rpi-imager)
|
||||||
|
- [Install rpi-imager](#install-rpi-imager)
|
||||||
|
- [Upgrade rpi-imager](#upgrade-rpi-imager)
|
||||||
- [qFlipper](#qflipper)
|
- [qFlipper](#qflipper)
|
||||||
|
|
||||||
|
## Framework AMD Notes
|
||||||
|
|
||||||
|
### Wifi
|
||||||
|
|
||||||
|
Install the wireless-regdb to set the regulatory domain to US
|
||||||
|
|
||||||
|
```bash
|
||||||
|
pacman -S wireless-regdb
|
||||||
|
```
|
||||||
|
|
||||||
|
Edit /etc/conf.d/wireless-regdom to set the domain
|
||||||
|
|
||||||
|
### Microcode
|
||||||
|
|
||||||
|
```bash
|
||||||
|
pacman -S amd-ucode
|
||||||
|
```
|
||||||
|
|
||||||
|
Edit /boot/loader/entries/.conf and add the following:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
title Arch Linux (Work)
|
||||||
|
linux /vmlinuz-linux
|
||||||
|
initrd /amd-ucode.img
|
||||||
|
initrd /initramfs-linux.img
|
||||||
|
options ...
|
||||||
|
```
|
||||||
|
|
||||||
## Base Tools
|
## Base Tools
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
@@ -429,7 +462,31 @@ pacman -Syu bind
|
|||||||
sudo pacman -S cmake qt5-base
|
sudo pacman -S cmake qt5-base
|
||||||
```
|
```
|
||||||
|
|
||||||
follow install instructions
|
### Install rpi-imager
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone https://github.com/raspberrypi/rpi-imager.git
|
||||||
|
cd rpi-imager
|
||||||
|
mkdir -p build
|
||||||
|
cd build
|
||||||
|
cmake ../src
|
||||||
|
make
|
||||||
|
sudo make install
|
||||||
|
```
|
||||||
|
|
||||||
|
### Upgrade rpi-imager
|
||||||
|
|
||||||
|
```bash
|
||||||
|
```bash
|
||||||
|
cd rpi-imager
|
||||||
|
git pull
|
||||||
|
rm -r build
|
||||||
|
mkdir -p build
|
||||||
|
cd build
|
||||||
|
cmake ../src
|
||||||
|
make
|
||||||
|
sudo make install
|
||||||
|
```
|
||||||
|
|
||||||
## qFlipper
|
## qFlipper
|
||||||
|
|
||||||
|
|||||||
238
fedora_server.md
Normal file
238
fedora_server.md
Normal file
@@ -0,0 +1,238 @@
|
|||||||
|
# Fedora Server
|
||||||
|
|
||||||
|
- [Fedora Server](#fedora-server)
|
||||||
|
- [First boot](#first-boot)
|
||||||
|
- [Release Upgrade](#release-upgrade)
|
||||||
|
- [Tweaks](#tweaks)
|
||||||
|
- [systemd-cryptenroll](#systemd-cryptenroll)
|
||||||
|
- [Certbot for Cockpit](#certbot-for-cockpit)
|
||||||
|
|
||||||
|
## First boot
|
||||||
|
|
||||||
|
1. Disable selinux (edit `/etc/selinux/config`)
|
||||||
|
2. Disable firewall
|
||||||
|
3. Install all updates
|
||||||
|
4. Enable automatic security updates
|
||||||
|
5. Reboot
|
||||||
|
6. Refresh application page
|
||||||
|
7. Install Podman application
|
||||||
|
8. Install Machines application
|
||||||
|
9. Change hostname
|
||||||
|
10. Reboot
|
||||||
|
11. Grow your root volume to max size
|
||||||
|
12. Create a network bridge (bridge0)
|
||||||
|
13. Enable metrics in the metrics section
|
||||||
|
|
||||||
|
## Release Upgrade
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dnf upgrade --refresh
|
||||||
|
dnf install dnf-plugin-system-upgrade
|
||||||
|
dnf system-upgrade download --releasever=39
|
||||||
|
dnf system-upgrade reboot
|
||||||
|
```
|
||||||
|
|
||||||
|
## Tweaks
|
||||||
|
|
||||||
|
1. Stop resolvd from listening on port 53
|
||||||
|
|
||||||
|
Edit `/etc/systemd/resolved.conf`
|
||||||
|
|
||||||
|
```conf
|
||||||
|
DNSStubListener=no
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Install podman-compose
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dnf install podman-compose
|
||||||
|
```
|
||||||
|
|
||||||
|
## systemd-cryptenroll
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dnf install tpm2-tss
|
||||||
|
|
||||||
|
# Add decryption key to tpm.
|
||||||
|
# For machines where prioritizing a secure boot environment is important we need to
|
||||||
|
# specify --tpm2-pcrs=0+7 -- 0 meaning the firmware has not changed and 7 meaning
|
||||||
|
# secure boot is enabled
|
||||||
|
systemd-cryptenroll /dev/nvme0n1p3 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7
|
||||||
|
|
||||||
|
# Add tpm2-tss to dracut
|
||||||
|
# Edit /etc/dracut.conf.d/tpm2.conf
|
||||||
|
add_dracutmodules+=" tpm2-tss "
|
||||||
|
|
||||||
|
dracut -f
|
||||||
|
```
|
||||||
|
|
||||||
|
## Certbot for Cockpit
|
||||||
|
|
||||||
|
During this process you'll pick one node to act as your manager for your other nodes.
|
||||||
|
You'll only need to cert a single node and then it will connect via ssh over your local
|
||||||
|
network to the other nodes.
|
||||||
|
|
||||||
|
Create an AWS user which will have route53 access. This is required for certbot's route53
|
||||||
|
validation.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
export username=<hostname>
|
||||||
|
aws iam create-user --user-name $username
|
||||||
|
```
|
||||||
|
|
||||||
|
You'll also need a policy which allows the user to modify the selected hosted zone:
|
||||||
|
|
||||||
|
(list with `aws route53 list-hosted-zones`)
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"route53:ListHostedZones",
|
||||||
|
"route53:GetChange"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"*"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect" : "Allow",
|
||||||
|
"Action" : [
|
||||||
|
"route53:ChangeResourceRecordSets"
|
||||||
|
],
|
||||||
|
"Resource" : [
|
||||||
|
"arn:aws:route53:::hostedzone/Z0092652G7L97DSINN18"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Attach the policy to the user:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
aws iam attach-user-policy \
|
||||||
|
--user-name $username \
|
||||||
|
--policy-arn arn:aws:iam::892236928704:policy/certbot-route53-reeselink
|
||||||
|
```
|
||||||
|
|
||||||
|
Generate credentials:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
aws iam create-access-key --user-name $username
|
||||||
|
```
|
||||||
|
|
||||||
|
On the host machine:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
mkdir ~/.aws
|
||||||
|
vim ~/.aws/config
|
||||||
|
```
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[profile default]
|
||||||
|
region=us-east-2
|
||||||
|
```
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
vim ~/.aws/credentials
|
||||||
|
```
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[default]
|
||||||
|
aws_access_key_id=
|
||||||
|
aws_secret_access_key=
|
||||||
|
```
|
||||||
|
|
||||||
|
Install the aws cli v2 on the manager node:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
|
||||||
|
unzip awscliv2.zip
|
||||||
|
./aws/install
|
||||||
|
```
|
||||||
|
|
||||||
|
Test your credentials with `aws route53 list-hosted-zones`. You should see as list of your
|
||||||
|
hosted zones.
|
||||||
|
|
||||||
|
Now install certbot and acquire a cert using those credentials:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
export record=orange.reeselink.com
|
||||||
|
dnf install certbot python3-certbot-dns-route53
|
||||||
|
certbot certonly --dns-route53 -d $record
|
||||||
|
|
||||||
|
cp /etc/letsencrypt/live/$record/fullchain.pem /etc/cockpit/ws-certs.d/50-letsencrypt.cert
|
||||||
|
cp /etc/letsencrypt/live/$record/privkey.pem /etc/cockpit/ws-certs.d/50-letsencrypt.key
|
||||||
|
|
||||||
|
systemctl restart cockpit.service
|
||||||
|
```
|
||||||
|
|
||||||
|
Test the renewal process with:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
export record=orange.reeselink.com
|
||||||
|
certbot renew --cert-name $record --dry-run
|
||||||
|
mkdir -p /usr/lib/scripts
|
||||||
|
```
|
||||||
|
|
||||||
|
Create a renewal script in /usr/lib/scripts/certbot-renew.sh
|
||||||
|
|
||||||
|
/usr/lib/scripts/certbot-renew.sh
|
||||||
|
|
||||||
|
```bash
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
/usr/bin/certbot renew --cert-name $record
|
||||||
|
/usr/bin/cp -f /etc/letsencrypt/live/$record/fullchain.pem /etc/cockpit/ws-certs.d/50-letsencrypt.cert
|
||||||
|
/usr/bin/cp -f /etc/letsencrypt/live/$record/privkey.pem /etc/cockpit/ws-certs.d/50-letsencrypt.key
|
||||||
|
```
|
||||||
|
|
||||||
|
```bash
|
||||||
|
:%s/$record/yellow.reeselink.com/g
|
||||||
|
|
||||||
|
chmod +x /usr/lib/scripts/certbot-renew.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Now create a systemd oneshot service to run the script
|
||||||
|
|
||||||
|
/etc/systemd/system/certbot-renew.service
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[Unit]
|
||||||
|
Description=Certbot Renewal
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=/usr/lib/scripts/certbot-renew.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
/etc/systemd/system/certbot-renew.timer
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[Unit]
|
||||||
|
Description=Timer for Certbot Renewal
|
||||||
|
|
||||||
|
[Timer]
|
||||||
|
OnBootSec=300
|
||||||
|
OnUnitActiveSec=1w
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
```
|
||||||
|
|
||||||
|
Enable the service
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemctl enable --now certbot-renew.timer
|
||||||
|
```
|
||||||
|
|
||||||
|
Cockpit now has a valid TLS certificate that auto-renews!
|
||||||
81
octopi.md
Normal file
81
octopi.md
Normal file
@@ -0,0 +1,81 @@
|
|||||||
|
# OctoPi Setup
|
||||||
|
|
||||||
|
## GCode Snippers
|
||||||
|
|
||||||
|
### After Pause
|
||||||
|
|
||||||
|
```text
|
||||||
|
{% if pause_position.x is not none %}
|
||||||
|
; relative XYZE
|
||||||
|
G91
|
||||||
|
M83
|
||||||
|
|
||||||
|
; retract filament of 0.8 mm up, move Z slightly upwards and
|
||||||
|
G1 Z+5 E-0.8 F4500
|
||||||
|
|
||||||
|
; absolute XYZE
|
||||||
|
M82
|
||||||
|
G90
|
||||||
|
|
||||||
|
; move to a safe rest position, adjust as necessary
|
||||||
|
G1 X0 Y0
|
||||||
|
{% endif %}
|
||||||
|
```
|
||||||
|
|
||||||
|
### After Resume
|
||||||
|
|
||||||
|
```text
|
||||||
|
{% if pause_position.x is not none %}
|
||||||
|
; relative extruder
|
||||||
|
M83
|
||||||
|
|
||||||
|
; prime nozzle
|
||||||
|
G1 E-0.8 F4500
|
||||||
|
G1 E0.8 F4500
|
||||||
|
G1 E0.8 F4500
|
||||||
|
|
||||||
|
; absolute E
|
||||||
|
M82
|
||||||
|
|
||||||
|
; absolute XYZ
|
||||||
|
G90
|
||||||
|
|
||||||
|
; reset E
|
||||||
|
G92 E{{ pause_position.e }}
|
||||||
|
|
||||||
|
; WARNING!!! - use M83 or M82(extruder absolute mode) according what your slicer generates
|
||||||
|
M83 ; extruder relative mode
|
||||||
|
|
||||||
|
; move back to pause position XYZ
|
||||||
|
G1 X{{ pause_position.x }} Y{{ pause_position.y }} Z{{ pause_position.z }} F4500
|
||||||
|
|
||||||
|
; reset to feed rate before pause if available
|
||||||
|
{% if pause_position.f is not none %}G1 F{{ pause_position.f }}{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Plugins
|
||||||
|
|
||||||
|
## Bed Visualizer
|
||||||
|
|
||||||
|
```text
|
||||||
|
M140 S60 ; starting by heating the bed for nominal mesh accuracy
|
||||||
|
M117 Homing all axes ; send message to printer display
|
||||||
|
G28 ; home all axes
|
||||||
|
M420 S0 ; Turning off bed leveling while probing, if firmware is set
|
||||||
|
; to restore after G28
|
||||||
|
M117 Heating the bed ; send message to printer display
|
||||||
|
M190 S60 ; waiting until the bed is fully warmed up
|
||||||
|
M300 S1000 P500 ; chirp to indicate bed mesh levels is initializing
|
||||||
|
M117 Creating the bed mesh levels ; send message to printer display
|
||||||
|
M155 S30 ; reduce temperature reporting rate to reduce output pollution
|
||||||
|
@BEDLEVELVISUALIZER ; tell the plugin to watch for reported mesh
|
||||||
|
G29 T ; run bilinear probing
|
||||||
|
M155 S3 ; reset temperature reporting
|
||||||
|
M140 S0 ; cooling down the bed
|
||||||
|
M500 ; store mesh in EEPROM
|
||||||
|
M300 S440 P200 ; make calibration completed tones
|
||||||
|
M300 S660 P250
|
||||||
|
M300 S880 P300
|
||||||
|
M117 Bed mesh levels completed ; send message to printer display
|
||||||
|
```
|
||||||
173
ubuntu_server.md
Normal file
173
ubuntu_server.md
Normal file
@@ -0,0 +1,173 @@
|
|||||||
|
# Ubuntu Server
|
||||||
|
|
||||||
|
## Certbot for Cockpit
|
||||||
|
|
||||||
|
During this process you'll pick one node to act as your manager for your other nodes.
|
||||||
|
You'll only need to cert a single node and then it will connect via ssh over your local
|
||||||
|
network to the other nodes.
|
||||||
|
|
||||||
|
Create an AWS user which will have route53 access. This is required for certbot's route53
|
||||||
|
validation.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
export username=<hostname>
|
||||||
|
aws iam create-user --user-name $username
|
||||||
|
```
|
||||||
|
|
||||||
|
You'll also need a policy which allows the user to modify the selected hosted zone:
|
||||||
|
|
||||||
|
(list with `aws route53 list-hosted-zones`)
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"route53:ListHostedZones",
|
||||||
|
"route53:GetChange"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"*"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"Effect" : "Allow",
|
||||||
|
"Action" : [
|
||||||
|
"route53:ChangeResourceRecordSets"
|
||||||
|
],
|
||||||
|
"Resource" : [
|
||||||
|
"arn:aws:route53:::hostedzone/Z0092652G7L97DSINN18"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Attach the policy to the user:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
aws iam attach-user-policy \
|
||||||
|
--user-name $username \
|
||||||
|
--policy-arn arn:aws:iam::892236928704:policy/certbot-route53-reeselink
|
||||||
|
```
|
||||||
|
|
||||||
|
Generate credentials:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
aws iam create-access-key --user-name $username
|
||||||
|
```
|
||||||
|
|
||||||
|
On the host machine:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
mkdir ~/.aws
|
||||||
|
vim ~/.aws/config
|
||||||
|
```
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[profile default]
|
||||||
|
region=us-east-2
|
||||||
|
```
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
vim ~/.aws/credentials
|
||||||
|
```
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[default]
|
||||||
|
aws_access_key_id=
|
||||||
|
aws_secret_access_key=
|
||||||
|
```
|
||||||
|
|
||||||
|
Install the aws cli v2 on the manager node:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
|
||||||
|
apt update && apt install -y unzip
|
||||||
|
unzip awscliv2.zip
|
||||||
|
./aws/install
|
||||||
|
```
|
||||||
|
|
||||||
|
Test your credentials with `aws route53 list-hosted-zones`. You should see as list of your
|
||||||
|
hosted zones.
|
||||||
|
|
||||||
|
Now install certbot and acquire a cert using those credentials:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
export record=orange.reeselink.com
|
||||||
|
apt update && apt install -y certbot python3-certbot-dns-route53
|
||||||
|
certbot certonly --dns-route53 -d $record
|
||||||
|
|
||||||
|
cp /etc/letsencrypt/live/$record/fullchain.pem /etc/cockpit/ws-certs.d/50-letsencrypt.cert
|
||||||
|
cp /etc/letsencrypt/live/$record/privkey.pem /etc/cockpit/ws-certs.d/50-letsencrypt.key
|
||||||
|
|
||||||
|
systemctl restart cockpit.service
|
||||||
|
```
|
||||||
|
|
||||||
|
Test the renewal process with:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo su -
|
||||||
|
export record=orange.reeselink.com
|
||||||
|
certbot renew --cert-name $record --dry-run
|
||||||
|
mkdir -p /usr/lib/scripts
|
||||||
|
```
|
||||||
|
|
||||||
|
Create a renewal script in /usr/lib/scripts/certbot-renew.sh
|
||||||
|
|
||||||
|
/usr/lib/scripts/certbot-renew.sh
|
||||||
|
|
||||||
|
```bash
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
/usr/bin/certbot renew --cert-name $record
|
||||||
|
/usr/bin/cp -f /etc/letsencrypt/live/$record/fullchain.pem /etc/cockpit/ws-certs.d/50-letsencrypt.cert
|
||||||
|
/usr/bin/cp -f /etc/letsencrypt/live/$record/privkey.pem /etc/cockpit/ws-certs.d/50-letsencrypt.key
|
||||||
|
```
|
||||||
|
|
||||||
|
```bash
|
||||||
|
:%s/$record/yellow.reeselink.com/g
|
||||||
|
|
||||||
|
chmod +x /usr/lib/scripts/certbot-renew.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Now create a systemd oneshot service to run the script
|
||||||
|
|
||||||
|
/etc/systemd/system/certbot-renew.service
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[Unit]
|
||||||
|
Description=Certbot Renewal
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=/usr/lib/scripts/certbot-renew.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
/etc/systemd/system/certbot-renew.timer
|
||||||
|
|
||||||
|
```conf
|
||||||
|
[Unit]
|
||||||
|
Description=Timer for Certbot Renewal
|
||||||
|
|
||||||
|
[Timer]
|
||||||
|
OnBootSec=300
|
||||||
|
OnUnitActiveSec=1w
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
```
|
||||||
|
|
||||||
|
Enable the service
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemctl enable --now certbot-renew.timer
|
||||||
|
```
|
||||||
|
|
||||||
|
Cockpit now has a valid TLS certificate that auto-renews!
|
||||||
Reference in New Issue
Block a user