summaryrefslogtreecommitdiff
path: root/docs/lxcsetup.rst
blob: 3deaa5a7345d1d497e840f2ff61f3d011d4579b7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
=====================================================
Setup of a new CAcert LXC container with Puppet agent
=====================================================

Preparation
===========

Network considerations
----------------------

- Decide on a hostname for the container. The hostname should be short and
  correspond to the functionality provided by the container.
- Define an IPv4 address from the :ip:v4range:`213.154.225.224/27` subnet if
  the container should be reachable from the outside via IPv4. If the services
  provide HTTP or HTTPS services you will not need a dedicated IP address
  because virtual hosting and SNI can be used via :doc:`systems/proxyin`
- Define an IPv6 address in the :ip:v6range:`2001:7b8:616:162:2::/80` subnet.
  There is no reason not to use IPv6 for new services.
- Define an IPv4 address in the :ip:v4range:`172.16.2.0/24` subnet if the
  container should be reachable from other CAcert machines than
  :doc:`systems/infra02` or other :doc:`systems`.
- Define an IPv4 address in the :ip:v4range:`10.0.0.0/24` subnet. Containers
  that are only used by other containers do not need any other IP addresses
  than this one.

.. note::

   Please use the same last octet for all IP addresses of a container if
   possible

Storage considerations
----------------------

- Define the size of the LVM volume for the root filesystem. Be conservative,
  volume size can be increased on demand.

OS considerations
-----------------

- Define the OS userland version for the container. Use the latest Debian
  stable release if there are no good reasons not to.

Setup
=====

- Define machine parameters for in lxc-setup.ini
- Run :command:`lxc-setup` (uses lxc-create/debootstrap and makes sure that
  systemd-sysv is not setup in the containers)
- Define firewall rules in a separate file in :file:`/etc/ferm/ferm.d/` on
  :doc:`systems/infra02`.

Setup puppet-agent
------------------

- define puppet configuration for the new container in Hiera / sitemodules in
  the `cacert-puppet Repository`_ on :doc:`systems/git`
- see `Puppet agent installation`_ for agent setup (install the agent from
  official Puppet repositories)
- define the puppet master IP address in :file:`/etc/hosts`:

  .. code-block:: text

     10.0.0.200	puppet

- set the certname in :file:`/etc/puppetlabs/puppet/puppet.conf` to match
  the name of the file in :file:`hieradata/nodes/` for the system:

  .. code-block:: ini

     [main]
     certname = <system>

- run:

  .. code-block:: sh

     root@system:  puppet agent --test --noop

  to create a new certificate for the system and send a signing request to the
  :doc:`puppet master <systems/puppet>`
- sign the system certificate on the :doc:`puppet master <systems/puppet>`
  using:

  .. code-block:: sh

     root@puppet:  puppet cert sign <system>

- run:

  .. code-block:: sh

     root@system:  puppet agent --test --noop

  on the system to see whether the catalog for the machine compiles and what it
  would change
- apply the catalog with:

  .. code-block:: sh

     root@system:  puppet agent --test

- start the puppet agent using:

  .. code-block:: sh

     root@system:  /etc/init.d/puppet start

.. _Puppet agent installation: https://puppet.com/docs/puppet/5.4/install_linux.html
.. _cacert-puppet Repository: https://git.cacert.org/gitweb/?p=cacert-puppet.git

Post-Setup task
===============

- Document the new container in a file of the :file:`docs/systems` directory of
  the `Infrastructure documentation
  <https://git.cacert.org/gitweb/?p=cacert-infradocs.git;a=tree;f=docs/systems>`_.
- Setup machine-admin alias on :doc:`systems/email`.