Add new file

c26c93af · Nicolas Castejon · 7bc7c546 · c26c93af
Commit c26c93af authored 6 years ago by Nicolas Castejon
--- a/beta-deployment
+++ b/beta-deployment
+# Software
+`$ apt install dnsutils`, which provides dig
+resolvconf
+# Firewall
+## front-web
+`/etc/iptables/rules.v4`
+```
+*filter
+:INPUT DROP [0:0]
+-A INPUT -s 192.168.0.0/24 -j ACCEPT -m comment --comment "FULL ACCESS LAN"
+-A INPUT -i lo -j ACCEPT -m comment --comment "FULL ACCESS LOOPBACK"
+-A INPUT -s 217.182.252.78/32 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH neogeo-ansible"
+-A INPUT -s 80.12.88.99/32 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH neogeo-bureau"
+-A INPUT -s 213.245.116.190/32 -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH erasmes"
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment "in order to receive responses to outgoing requests"
+-A INPUT -i ens3 -p tcp -m tcp --dport 443 -d 51.83.13.51 -j ACCEPT
+-A INPUT -i ens3 -p tcp -m tcp --dport 80  -d 51.83.13.51 -j ACCEPT
+:FORWARD ACCEPT [0:0]
+```
+# Domain Name Resolution
+## `/etc/hosts`
+By default, the /etc/hosts file is managed by the system. Hence, user modifications as deleted at each reboot. In order to prevent that from happening, a line has to be modified in the `/etc/cloud/cloud.cfg` file:
+`manage_etc_hosts: false`
+## `dnsmasq`
+Installed in the front-web machine, with the following configuration (`/etc/dnsmasq.conf`): 
+```
+domain-needed
+bogus-priv
+server=213.186.33.99
+listen-address=192.168.0.59
+no-dhcp-interface=ens4
+bind-interfaces
+```
+The following lines are appended to the `/etc/hosts` file in the front-web machine:
+```
+51.83.13.51     front-web.wan
+192.168.0.59    front-web.lan
+51.83.15.2      back-office.wan 
+192.168.0.146   back-office.lan
+51.68.115.202   es-1.wan
+192.168.0.74    es-1.lan
+51.77.229.85    es-2.wan
+192.168.0.65    es-2.lan
+51.83.13.94     es-3.wan
+192.168.0.236   es-3.lan
+```
+The other machines will use front-web as DNS.
+# Routing
+In order for the front-web machine to be usable as a router, we need to apply the following modifications within **front-web**:
+1. In `/etc/sysctl.conf` -> `net.ipv4.ip_forward=1`.
+2. In `/etc/iptables/rules.v4`,
+`
+*nat
+-I POSTROUTING -s 192.168.0.0/24 -o ens3 -j MASQUERADE
+`
+Once that it is done, the other machines can be setup as follows:
+`/etc/network/interfaces`
+```
+[...]
+iface ens4 inet static
+	address 192.168.0.XXX
+	netmask 255.255.255.0
+	gateway 192.168.0.59
+        dns-nameservers 192.168.0.59
+[...]
+```
+In case the default gateway is not taken into account, the following command has to be issued:
+`
+$ route add default gw 192.168.0.59 ens4
+`
+The line `auto ens3` can be commented out in the file `/etc/network/interfaces.d/50-cloud-init.cfg`, in order to prevent the ens3 from being "upped" at reboot.
+In order for the modification to be persisten, we need to disable cloud-init's network configuration capabilities, by editing the file /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following content:
+```
+network: {config: disabled}
+```
+# Postfix, OpenDKIM
+cf. [https://wiki.debian.org/opendkim](https://wiki.debian.org/opendkim)
+```
+$ sudp mkdir /etc/postfix/dkim/ 
+$ sudo opendkim-genkey -D /etc/postfix/dkim/ -d data.beta.grandlyon.com -s mail
+```
+## `/etc/opendkim.conf`
+* the line "Mode sv" is uncommented (why?)
+* the following lines are appended
+```
+# Specify the list of keys
+KeyTable file:/etc/postfix/dkim/keytable
+# Match keys and domains. To use regular expressions in the file, use refile: instead of file:
+SigningTable refile:/etc/postfix/dkim/signingtable
+# Match a list of hosts whose messages will be signed. By default, only localhost is considered as internal host.
+InternalHosts refile:/etc/postfix/dkim/trustedhosts
+```
+The 'Socket' line is setup as follows:
+```
+Socket                  inet:8892@localhost
+```
+## `/etc/postfix/dkim/keytable`
+```mail._domainkey.data.beta.grandlyon.com data.beta.grandlyon.com:mail:/etc/postfix/dkim/mail.private```
+## `/etc/postfix/dkim/signingtable`
+```
+# Domain data.beta.grandlyon.com
+*@data.beta.grandlyon.com mail._domainkey.data.beta.grandlyon.com
+```
+## `/etc/postfix/dkim/trustedhosts`
+```
+127.0.0.1
+192.168.0.0/24
+```
+### Note
+```
+$ sudo chgrp opendkim /etc/postfix/dkim/*
+$ sudo chmod o= /etc/postfix/dkim/*
+```
+## `/etc/postfix/main.cf`
+```
+[...]
+myhostname = data.beta.grandlyon.com
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+myorigin = /etc/mailname
+mydestination = $myhostname, data.beta.grandlyon.com, front-web.localdomain, localhost.localdomain, localhost
+relayhost = 
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_interfaces = all
+inet_protocols = ipv4
+[...]
+```
+The following lines are appended:
+```
+milter_default_action = accept
+milter_protocol = 6
+smtpd_milters = inet:127.0.0.1:8892
+non_smtpd_milters = $smtpd_milters
+```
+## DNS
+The DNS records needs to be updated as follows:
+```
+data.beta.grandlyon.com. 86400	IN	TXT	"v=spf1 +ip4:51.83.13.51 ~all"
+```
+```
+mail._domainkey.data.beta.grandlyon.com. 86400 IN TXT "v=DKIM1; h=sha256; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzoL8dvkfhm3xCpGxW8COUIgmw4r0PV/5GSUekCA8sLGPiqNh8//Jj4tFpLK6eUMacKYPbL4goUdRyTF5gqh/MdEWwafodZczELETRcp3a7mGdmM2nDhD6lk2Xtdf+nS+HWobYN18a3abNFchcF62LJWGTd4fwKV8gOIIuvTiakVxFuC7eIBUO+7m0JU0EnnivLUabphFSL3yV" "hEdpCD3csRGedSnG6+ocpZw25ll8/5f6WZnobU2d5KKqk7MVgOFXfuJMhdjmd6UvSGPaxR+/E+PsxQCU0f9vLG4R8fLPLh0ngNGGiyNYGHB5Sn8VxIrxqpH2pQKaJsfHLK/IgRJwIDAQAB"
+```
+# Remote API for Dockerd (-> Portainer) 
+cf. https://success.docker.com/article/how-do-i-enable-the-remote-api-for-dockerd