Public » Linux

Stripe dla danych typu logi, stare obrazy

VGNAME=lxc1; \
lvcreate  -L60G --type raid0 -i 2 -n lxc-${NAME}-stripe ${VGNAME} /dev/sdb2 /dev/sdc2; \
mkfs.xfs /dev/${VGNAME}/lxc-${NAME}-stripe; 

Udział RAID dla danych typu konfiguracja, baza danych itp.

VGNAME=lxc1; \
lvcreate -L40G -n lxc-${NAME}-raid1 ${VGNAME}; \
lvconvert --type raid1 /dev/${VGNAME}/lxc-${NAME}-raid1 /dev/sdae1; \
mkfs.xfs /dev/${VGNAME}/lxc-${NAME}-raid1;

Mount zasobów

mkdir -p  /var/lib/lxc/${NAME}/rootfs/home/storage/{raid1,stripe}

apt-get install docker-cli docker-compose docker.io; \
touch /etc/docker/docker-compose.yaml

networks:
  justnet:
    ipam:
      config:
        - subnet: 172.19.0.0/26
          gateway: 172.19.0.1

    networks:
      justnet:
        ipv4_address: 172.19.2.21

apt-get install haproxy; \
\
mkdir -p /etc/gen/firewall/host\:${SERVER_IP}/80\:tcp\:http; \
mkdir -p /etc/gen/firewall/host\:${SERVER_IP}/443\:tcp\:https; \

Dodajemy ACL w sekcji frontend:

   acl network_allowed src x.x.x.x
  http-request deny if host-is-${NAME} !network_allowed !is_letsencrypt-acl

Dodanie SSL na 443 w sekcji frontend

  #bind :443 ssl crt /etc/letsencrypt/live/fullchains/fullchain.pem

Dodanie przekierowania w sekcji frontend:

  acl is_letsencrypt-acl path_beg /.well-known/acme-challenge/
  use_backend letsencrypt-backend if is_letsencrypt-acl

Dodanie backend:

backend letsencrypt-backend
  server letsencrypt 127.0.0.1:8888

Dodanie przekierowanie HTTP do HTTPS w sekcji frontend

   http-request redirect scheme https unless { ssl_fc }

frontend http-in
  bind :80
  #bind :443 ssl crt /etc/letsencrypt/live/fullchains/cert.pem
  mode http

  http-request redirect scheme https unless { ssl_fc }

  # Strip port from Host header
  http-request replace-value Host (.*):.* \1

  acl is_letsencrypt-acl path_beg /.well-known/acme-challenge/
  use_backend letsencrypt-backend if is_letsencrypt-acl

backend letsencrypt-backend
  server letsencrypt 127.0.0.1:8888

echo -e '#!/bin/bash -x' "\n\n" >> /etc/haproxy/certbot.sh
echo "certbot -m webmaster@justnet.pl --agree-tos; certonly --standalone --preferred-challenges http-01 --http-01-port 8888 --http-01-address 127.0.0.1 -d domain1.xyz -d domain1.xyz" >> /etc/haproxy/certbot.sh; \
chmod +x /etc/haproxy/certbot.sh; \
bash /etc/haproxy/certbot.sh; \
\
for domain in `find /etc/letsencrypt/live/* -maxdepth 1 -type d|xargs`; do ln -s ${domain}/privkey.pem ${domain}/fullchain.pem.key; done;

Podajemy port 8888 na którym słucha certbot, na port 8888 zostanie przekierowane zapytanie przez HAProxy z portu 80