Skip to content

Home

Jump to bottom
ste78 edited this page Oct 2, 2014 · 136 revisions

ALL IMAGES

base image = (centos 7 minimal)

  • hostfile:
10.78.254.1     symphony.prv.cluster symphony
10.78.254.2     symphony-directory.prv.cluster symphony-directory
10.78.254.3     symphony-repo.prv.cluster symphony-repo
10.78.254.4     symphony-monitor.prv.cluster symphony-monitor
  • packages:
yum -y install vim yum-priorities augeas git
  • General setup
systemctl disable NetworkManager
  • Setup firewall
systemctl enable firewalld
systemctl start firewalld

#SYMPHONY base image = (centos 7 minimal)

  • Configure hostname + networking
echo symphony.prv.cluster > /etc/hostname
  • eth0 = primary network
IPV6INIT=no
BOOTPROTO=none
DEVICE=eth0
ONBOOT=yes
IPADDR=10.78.254.1
NETMASK=255.255.0.0
NETWORK=10.78.0.0
ZONE=private
NM_CONTROLLED=no
  • eth1 = public network dhcp
IPV6INIT=no
BOOTPROTO=dhcp
DEVICE=eth1
ONBOOT=yes
PEERDNS=no
ZONE=external
NM_CONTROLLED=no
  • Firewall
firewall-cmd --zone=external --add-masquerade --permanent
firewall-cmd --new-zone private --permanent
#dhcp
firewall-cmd --zone private --add-service dhcpd --permanent
#tftp
firewall-cmd --zone private --add-service tftp --permanent
#http
firewall-cmd --zone private --add-service http --permanent

###OpenVPN

  • Install
yum --config http://symphony-repo/configs/centos/7.0/yum.conf --enablerepo=epel install openvpn easy-rsa
  • Prepare SSL
mkdir /etc/openvpn/easyrsa
CN=`hostname -f`
cp -pav /usr/share/easy-rsa/2.0/* /etc/openvpn/easyrsa/
sed -i /etc/openvpn/easyrsa/vars \
 -e 's|KEY_COUNTRY=.*$|KEY_COUNTRY=\"GB\"|g' \
 -e 's|KEY_PROVINCE=.*|KEY_PROVINCE=\"Oxfordshire"|g' \
 -e 's|KEY_CITY=.*|KEY_CITY=\"Bicester\"|g' \
 -e 's|KEY_ORG=.*|KEY_ORG=\"Alces Software Ltd\"|g' \
 -e 's|KEY_EMAIL=.*|KEY_EMAIL=\"ssl@alces-software.com\"|g' \
 -e 's|KEY_NAME=.*|KEY_NAME=\"server\"|g' \
 -e 's|KEY_OU=.*|KEY_OU=\"server\"|g' \
 -e "s|KEY_CN=.*|KEY_CN=\"${CN}\"|g"
cd /etc/openvpn/easyrsa/
source ./vars
./clean-all
./pkitool --initca
./pkitool --server server
./build-dh
  • Management vpn
cat << EOF > /etc/openvpn/manage.conf
port 1194
proto tcp
dev tun0
ca /etc/openvpn/easyrsa/keys/ca.crt
cert /etc/openvpn/easyrsa/keys/server.crt
key /etc/openvpn/easyrsa/keys/server.key
dh /etc/openvpn/easyrsa/keys/dh2048.pem
server 10.80.0.0 255.255.255.248
ifconfig-pool-persist ipp.txt
push "route 10.78.0.0 255.255.0.0"
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log         /var/log/openvpn.log
log-append  /var/log/openvpn.log
verb 3
client-cert-not-required
username-as-common-name
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn-manage
EOF

FQDN=10.101.0.46
cat << EOF > /etc/openvpn/manage.client.conf
client
dev tun
proto tcp
remote $FQDN 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
auth-user-pass
ns-cert-type server
comp-lzo
verb 3
EOF

cat << EOF > /etc/openvpn/manage.users
EOF

#Only allow specific users
sed -e "/^account    required     pam_nologin.so$/iauth       required     pam_listfile.so onerr=fail item=group sense=allow file=/etc/openvpn/manage.users" /etc/pam.d/login  > /etc/pam.d/openvpn-manage

systemctl enable openvpn@manage.service
systemctl start openvpn@manage.service

firewall-cmd --zone trusted --add-interface tun0 --permanent

###Cobbler

  • Install
yum --config http://symphony-repo/configs/centos/7.0/yum.conf --enablerepo=epel --enablerepo=cobbler install cobbler httpd dhcp fence-agents tftp xinetd tftp-server cobbler-web
  • Modify config
#Set default password
PASS=`openssl passwd -1` ; sed -i /etc/cobbler/settings -e "s/^default_password_crypted.*/default_password_crypted: \"$PASS\"/g"
#Set master ip
IP=`hostname -i`; sed -i /etc/cobbler/settings -e "s/^server:.*/server: $IP/g"
IP=`hostname -i`; sed -i /etc/cobbler/settings -e "s/^next_server:.*/next_server: $IP/g"
#Enable dhcp management
sed -i /etc/cobbler/settings -e "s/^manage_dhcp.*/manage_dhcp: 1/g"
#Configure dhcp template
PRIVATE_SUBNET=10.78.0.0
PRIVATE_NETMASK=255.255.0.0
PRIVATE_DHCP_GW=10.78.254.1
PRIVATE_DHCP_DNS=10.78.254.2
PRIVATE_DHCP_NETMASK=255.255.0.0
PRIVATE_DHCP_RANGE="10.78.0.1 10.78.0.254"
sed -i /etc/cobbler/dhcp.template \
-e "s/^subnet 192.168.1.0 netmask 255.255.255.0 {.*/subnet $PRIVATE_SUBNET netmask $PRIVATE_NETMASK {/g" \
-e "s/^     option routers             192.168.1.5;.*/     option routers             $PRIVATE_DHCP_GW;/g" \
-e "s/^     option domain-name-servers 192.168.1.1;.*/     option domain-name-servers $PRIVATE_DHCP_DNS;/g" \
-e "s/^     option subnet-mask         255.255.255.0;/     option subnet-mask         $PRIVATE_DHCP_NETMASK;/g" \
-e "s/^     range dynamic-bootp        192.168.1.100 192.168.1.254;.*/     range dynamic-bootp        $PRIVATE_DHCP_RANGE;/g"
  • Set WebUI password for 'admin' user
htdigest /etc/cobbler/users.digest 'Cobbler' admin
  • Start services
systemctl start cobblerd.service
systemctl enable cobblerd.service
systemctl start httpd
systemctl enable httpd
systemctl start xinetd
systemctl enable xinetd
systemctl start dhcpd
systemctl enable dhcpd
  • Get loaders
#TODO requires internet access
cobbler get-loaders
  • Create distros
cobbler distro add --name CentOS7.0 --kernel=http://symphony-repo/pulp/repos/centos/7.0/os/images/pxeboot/vmlinuz --initrd=http://symphony-repo/pulp/repos/centos/7.0/os/images/pxeboot/initrd.img --arch=x86_64 --ksmeta="tree=http://symphony-repo/pulp/repos/centos/7.0/os/" --breed redhat --os-version=rhel7

cobbler sync

#SYMPHONY-REPO (centos 7 minimal vm with large data disk mounted on /var/lib/pulp/content/)

  • Configure hostname + networking:
echo symphony-repo.prv.cluster > /etc/hostname
  • eth0 = primary network
IPV6INIT=no
BOOTPROTO=none
DEVICE=eth0
ONBOOT=yes
IPADDR=10.78.254.3
NETMASK=255.255.0.0
NETWORK=10.78.0.0
GATEWAY=10.78.254.1
DNS=10.78.254.2
ZONE=private
NM_CONTROLLED=no
  • Firewall
firewall-cmd --new-zone private --permanent
firewall-cmd --add-service http --zone private --permanent
firewall-cmd --add-service https --zone private --permanent
firewall-cmd --add-service ssh --zone private --permanent
#qpidd inbound non-https
firewall-cmd --add-port 5672/tcp --zone private --permanent
  • Install repos:
curl https://repos.fedorapeople.org/repos/pulp/pulp/rhel-pulp.repo > /etc/yum.repos.d/pulp.repo
#TODO fix 7 != 7server bug in pulp repos
sed -i -e 's/$releasever/7Server/g' /etc/yum.repos.d/pulp.repo

yum -y install https://anorien.csc.warwick.ac.uk/mirrors/epel/7/x86_64/e/epel-release-7-1.noarch.rpm

Pulp

  • Install database
yum -y install mongodb-server
systemctl enable mongod
systemctl start mongod
  • Install message broker
yum -y install qpid-cpp-server qpid-cpp-server-store
#TODO Fix bug for augeas with qpidd
ln -snf /etc/qpid/qpidd.conf /etc/qpidd.conf
augtool -s set /files/etc/qpidd.conf/auth no
systemctl enable qpidd
systemctl start qpidd
  • Install pulp
yum groupinstall pulp-server-qpid
  • Edit /etc/pulp/server.conf

TODO use SSL If you mount up /var/lib/pulp/content from external disk ensure dir is owned by apache:apache

  • Init pulp DB:
sudo -u apache pulp-manage-db
  • start services
systemctl enable httpd
systemctl start httpd

systemctl enable pulp_workers
systemctl start pulp_workers

systemctl enable pulp_celerybeat
systemctl start pulp_celerybeat

systemctl enable pulp_resource_manager
systemctl start pulp_resource_manager

Pulp Admin Client

  • Packages
yum groupinstall pulp-admin

edit /etc/pulp/admin/admin.conf: server=symphony-repo.prv.cluster verify_ssl=false

TODO enable proper ssl

  • Setup Admin user
pulp-admin login -u admin -p admin
pulp-admin auth user update --login admin --password 'sqrt(s*w)'
#TODO set site password

##Import Repos

###Centos 7

pulp-admin rpm repo create --repo-id=centos7.0 --feed=http://www.mirrorservice.org/sites/mirror.centos.org/7.0.1406/os/x86_64/ --serve-http=true --relative-url=centos/7.0/os/
pulp-admin rpm repo sync run --repo-id centos7.0 --bg

pulp-admin rpm repo create --repo-id=centos7.0-updates --feed=http://www.mirrorservice.org/sites/mirror.centos.org/7.0.1406/updates/x86_64/ --serve-http=true --relative-url=centos/7.0/updates
pulp-admin rpm repo sync run --repo-id centos7.0-updates --bg

pulp-admin rpm repo create --repo-id=epel7 --feed=http://anorien.csc.warwick.ac.uk/mirrors/epel/7/x86_64/ --serve-http=true --relative-url=epel7
pulp-admin rpm repo sync run --bg --repo-id=epel7

pulp-admin rpm repo create --repo-id=cobbler-el7 --feed=http://download.opensuse.org/repositories/home:/libertas-ict:/cobbler26/CentOS_CentOS-7/ --serve-http=true --relative-url=cobbler/el7
pulp-admin rpm repo sync run --bg --repo-id=cobbler-el7

pulp-admin rpm repo create --repo-id=pulp-el7 --feed=https://repos.fedorapeople.org/repos/pulp/pulp/stable/2/7Server/x86_64/ --serve-http=true --relative-url=pulp/el7 
pulp-admin rpm repo sync run --bg --repo-id=pulp-el7

pulp-admin rpm repo create --repo-id=puppet-deps-el7 --feed=https://yum.puppetlabs.com/el/7/dependencies/x86_64/ --serve-http=true --relative-url=puppet/deps/el7
pulp-admin rpm repo sync run --bg --repo-id=puppet-deps-el7

pulp-admin rpm repo create --repo-id=puppet-base-el7 --feed=https://yum.puppetlabs.com/el/7/products/x86_64 --serve-http=true --relative-url=puppet/base/el7
pulp-admin rpm repo sync run --bg --repo-id=puppet-base-el7

Create initial repos

  • Create path mkdir -p /var/www/html/configs/centos/7.0/

  • add file

cat < EOF > /var/www/html/configs/centos/7.0/yum.conf
[main]
cachedir=/var/cache/yum/$basearch/$releasever
keepcache=0
debuglevel=2
logfile=/var/log/yum.log
exactarch=1
obsoletes=1
gpgcheck=1
plugins=1
installonly_limit=5
bugtracker_url=http://bugs.centos.org/set_project.php?project_id=23&ref=http://bugs.centos.org/bug_report_page.php?category=yum
distroverpkg=centos-release
metadata_expire=1m
reposdir=/dev/null

[centos]
name=CentOS Base
baseurl=http://symphony-repo/pulp/repos/centos/7.0/os/
enabled=1
skip_if_unavailable=1
gpgcheck=0
priority=10

[centos-updates]
name=CentOS Updates
baseurl=http://symphony-repo/pulp/repos/centos/7.0/updates/
enabled=1
skip_if_unavailable=1
gpgcheck=0
priority=10

[epel]
name=Epel
baseurl=http://symphony-repo/pulp/repos/epel7/
enabled=0
skip_if_unavailable=1
gpgcheck=0
priority=11

[pulp]
name=Pulp
baseurl=http://symphony-repo/pulp/repos/pulp/el7/
enabled=0
skip_if_unavailable=1
gpgcheck=0
priority=9

[cobbler]
name=Cobbler
baseurl=http://symphony-repo/pulp/repos/cobbler/el7/
enabled=0
skip_if_unavailable=1
gpgcheck=0
priority=9

[puppet-base]
name=Puppet Base
baseurl=http://symphony-repo/pulp/repos/puppet/base/el7
enabled=0
skip_if_unavailable=1
gpgcheck=0
priority=9

[puppet-deps]
name=Puppet Deps
baseurl=http://symphony-repo/pulp/repos/puppet/deps/el7
enabled=0
skip_if_unavailable=1
gpgcheck=0
priority=9
EOF

Copyright (c) 2008-2015 Alces Software Ltd

Clone this wiki locally