beta-deployment.md

# Software

`$ apt install dnsutils`, which provides dig

resolvconf


# Firewall

## front-web

`/etc/iptables/rules.v4`

```
*filter
:INPUT DROP [0:0]
-A INPUT -s 192.168.0.0/24 -j ACCEPT -m comment --comment "FULL ACCESS LAN"
-A INPUT -i lo -j ACCEPT -m comment --comment "FULL ACCESS LOOPBACK"

-A INPUT -s 217.182.252.78/32 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH neogeo-ansible"
-A INPUT -s 80.12.88.99/32 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH neogeo-bureau"
-A INPUT -s 213.245.116.190/32 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH erasmes"

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment "in order to receive responses to outgoing requests"
-A INPUT -i ens3 -p tcp -m tcp --dport 443 -d 51.83.13.51 -j ACCEPT
-A INPUT -i ens3 -p tcp -m tcp --dport 80  -d 51.83.13.51 -j ACCEPT
:FORWARD ACCEPT [0:0]

```


# Domain Name Resolution

## `/etc/hosts`

By default, the /etc/hosts file is managed by the system. Hence, user modifications as deleted at each reboot. In order to prevent that from happening, a line has to be modified in the `/etc/cloud/cloud.cfg` file:

`manage_etc_hosts: false`

## `dnsmasq`

Installed in the front-web machine, with the following configuration (`/etc/dnsmasq.conf`): 

```
domain-needed
bogus-priv
server=213.186.33.99
listen-address=192.168.0.59
no-dhcp-interface=ens4
bind-interfaces
```

The following lines are appended to the `/etc/hosts` file in the front-web machine:

```
51.83.13.51     front-web.wan
192.168.0.59    front-web.lan

51.83.15.2      back-office.wan 
192.168.0.146   back-office.lan

51.68.115.202   es-1.wan
192.168.0.74    es-1.lan

51.77.229.85    es-2.wan
192.168.0.65    es-2.lan

51.83.13.94     es-3.wan
192.168.0.236   es-3.lan

```

The other machines will use front-web as DNS.


# Routing

In order for the front-web machine to be usable as a router, we need to apply the following modifications within **front-web**:

1. In `/etc/sysctl.conf` -> `net.ipv4.ip_forward=1`.

2. In `/etc/iptables/rules.v4`,
`
*nat
-I POSTROUTING -s 192.168.0.0/24 -o ens3 -j MASQUERADE
`

Once that it is done, the other machines can be setup as follows:

`/etc/network/interfaces`

```
[...]
iface ens4 inet static
	address 192.168.0.XXX
	netmask 255.255.255.0
	gateway 192.168.0.59
        dns-nameservers 192.168.0.59
[...]
```

In case the default gateway is not taken into account, the following command has to be issued:

`
$ route add default gw 192.168.0.59 ens4
`

The line `auto ens3` can be commented out in the file `/etc/network/interfaces.d/50-cloud-init.cfg`, in order to prevent the ens3 from being "upped" at reboot.

In order for the modification to be persisten, we need to disable cloud-init's network configuration capabilities, by editing the file /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following content:

```
network: {config: disabled}
```



# Postfix, OpenDKIM

cf. [https://wiki.debian.org/opendkim](https://wiki.debian.org/opendkim)

```
$ sudp mkdir /etc/postfix/dkim/ 
$ sudo opendkim-genkey -D /etc/postfix/dkim/ -d data.beta.grandlyon.com -s mail
```

## `/etc/opendkim.conf`

* the line "Mode sv" is uncommented (why?)
* the following lines are appended

```
# Specify the list of keys
KeyTable file:/etc/postfix/dkim/keytable

# Match keys and domains. To use regular expressions in the file, use refile: instead of file:
SigningTable refile:/etc/postfix/dkim/signingtable

# Match a list of hosts whose messages will be signed. By default, only localhost is considered as internal host.
InternalHosts refile:/etc/postfix/dkim/trustedhosts
```

The 'Socket' line is setup as follows:

```
Socket                  inet:8892@localhost
```

## `/etc/postfix/dkim/keytable`

```mail._domainkey.data.beta.grandlyon.com data.beta.grandlyon.com:mail:/etc/postfix/dkim/mail.private```

## `/etc/postfix/dkim/signingtable`

```
# Domain data.beta.grandlyon.com
*@data.beta.grandlyon.com mail._domainkey.data.beta.grandlyon.com
```

## `/etc/postfix/dkim/trustedhosts`

```
127.0.0.1
192.168.0.0/24
```

### Note

```
$ sudo chgrp opendkim /etc/postfix/dkim/*
$ sudo chmod o= /etc/postfix/dkim/*
```

## `/etc/postfix/main.cf`

```
[...]
myhostname = data.beta.grandlyon.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, data.beta.grandlyon.com, front-web.localdomain, localhost.localdomain, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
[...]
```

The following lines are appended:

```
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8892
non_smtpd_milters = $smtpd_milters
```

## DNS

The DNS records needs to be updated as follows:

```
data.beta.grandlyon.com. 86400	IN	TXT	"v=spf1 +ip4:51.83.13.51 ~all"
```

```
mail._domainkey.data.beta.grandlyon.com. 86400 IN TXT "v=DKIM1; h=sha256; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzoL8dvkfhm3xCpGxW8COUIgmw4r0PV/5GSUekCA8sLGPiqNh8//Jj4tFpLK6eUMacKYPbL4goUdRyTF5gqh/MdEWwafodZczELETRcp3a7mGdmM2nDhD6lk2Xtdf+nS+HWobYN18a3abNFchcF62LJWGTd4fwKV8gOIIuvTiakVxFuC7eIBUO+7m0JU0EnnivLUabphFSL3yV" "hEdpCD3csRGedSnG6+ocpZw25ll8/5f6WZnobU2d5KKqk7MVgOFXfuJMhdjmd6UvSGPaxR+/E+PsxQCU0f9vLG4R8fLPLh0ngNGGiyNYGHB5Sn8VxIrxqpH2pQKaJsfHLK/IgRJwIDAQAB"

```

# Remote API for Dockerd (-> Portainer) 

cf. https://success.docker.com/article/how-do-i-enable-the-remote-api-for-dockerd