first cut, copied from debian12
This commit is contained in:
parent
e8e7f8bcfb
commit
aed19f7e4d
1 changed files with 231 additions and 0 deletions
231
debian13-vm.md
Normal file
231
debian13-vm.md
Normal file
|
|
@ -0,0 +1,231 @@
|
|||
# Installing a Debian 13, trixie VM
|
||||
|
||||
For this example, I will use the vm/host name x.rg.net. Modify to
|
||||
suit your needs.
|
||||
|
||||
Before I start the install, I put the new host in the DNS so that it has
|
||||
time to propagate.
|
||||
|
||||
## Create the VM and do the Debian Install
|
||||
|
||||
I use ProxMox CreateVM to create the VM and set it to boot to the
|
||||
Debian 13 ISO. I manually set AutoBoot on Stat.
|
||||
|
||||
Do the Debian install over the ProxMox GUI.
|
||||
|
||||
I use the Advanced options and Accessible high contrast install (see
|
||||
[here for some
|
||||
ideas](https://www.debian.org/releases/jessie/amd64/ch05s01.html.en#boot-screen)
|
||||
so that i can actually see the install screens instead of being
|
||||
blasted by electric blue and red.
|
||||
|
||||
As I want to use manual IP addressing, I hit the Back button if it
|
||||
gets a dhcp assignment and then do manual network configuration. The
|
||||
options I choose are:
|
||||
|
||||
* US English and US keyboard. This means I am not offered the UTC
|
||||
timezone option and have to set manually later. But it sets the
|
||||
`/etc/apt/sources.list` to the US servers.
|
||||
|
||||
* Manually set the IP address, but some folk like DHCP. In deb11, if
|
||||
you want to set the IP address manually, you have to <back> when it
|
||||
asks about dhcp. You if it then shows the correct DNS name, you
|
||||
know you have the in-addr.arpa for that IP address set up correctly.
|
||||
|
||||
* Use the entire disk. This will make a very hard to expand system.
|
||||
Alternatively, instead of this step, use
|
||||
https://git.rg.net/randy/randy/src/master/expanded-lvm-install.md
|
||||
|
||||
* Install the SSH server as well as the standard system utilities.
|
||||
Do not install any of the desktop stuff or the print server.
|
||||
|
||||
* Install the GRUB boot loader so that you can make the serial console work.
|
||||
You may have to specify `/dev/vda`.
|
||||
|
||||
## Reboot the VM
|
||||
|
||||
The installation completes, and the darn thing reboots the CD-ROM. So I
|
||||
get brutal, and back on the Ganeti cluster master I
|
||||
|
||||
gnt-instance reboot --shutdown-timeout=0 x.rg.net
|
||||
|
||||
This usually whacks my VNC session, so I have to restart the client.
|
||||
|
||||
Because I did not use DHCP but set the address manually, I know where
|
||||
the host is. I immediately ssh into the new system as the new user.
|
||||
|
||||
On the other hand, if the IP address was assigned by DHCP, you'll have
|
||||
to stay with the VNC session and set up networking as below.
|
||||
|
||||
## First Configuration
|
||||
|
||||
The first thing is set the password to something nasty. And remember to
|
||||
also set the user password.
|
||||
|
||||
I also have to get the network configured properly. In my example
|
||||
|
||||
cat > /etc/network/interfaces << EOF
|
||||
# This file describes the network interfaces available on your system
|
||||
# and how to activate them. For more information, see interfaces(5).
|
||||
|
||||
source /etc/network/interfaces.d/*
|
||||
|
||||
# The loopback network interface
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
# The primary network interface
|
||||
auto ens13
|
||||
|
||||
iface ens13 inet static
|
||||
address 147.28.0.9/24
|
||||
gateway 147.28.0.1
|
||||
dns-nameservers 147.28.0.14
|
||||
dns-search rg.net psg.com
|
||||
|
||||
iface ens13 inet6 static
|
||||
address 2001:418:1::9/64
|
||||
gateway 2001:418:1::1
|
||||
EOF
|
||||
|
||||
If you are going to run unbound, be sure to configure IPv6 before the
|
||||
Ansible unbound install, as it is sensitive to whether IPv6 is enabled
|
||||
or not.
|
||||
|
||||
Then I reboot to get the configuration.
|
||||
|
||||
## Customize VM
|
||||
|
||||
I get root
|
||||
|
||||
First hack so that we do not pull in unnecessary wannabe depends.
|
||||
|
||||
```
|
||||
cat > /etc/apt/apt.conf.d/01norecommend << EOF
|
||||
APT::Install-Recommends "0";
|
||||
APT::Install-Suggests "0";
|
||||
EOF
|
||||
```
|
||||
|
||||
If it does not run Emacs, it is not a computer. And install unbound so
|
||||
we have a local nameserver, and ntpd so we have a local chime. We will
|
||||
do detailed configuration of unbound and chrony later.
|
||||
|
||||
```
|
||||
apt install emacs-nox unbound dns-root-data chrony rsync sudo screen debian-goodies bsd-mailx
|
||||
```
|
||||
|
||||
Hack `/etc/sudoers` to make it passwordless for members of the sudo group.
|
||||
```
|
||||
%sudo ALL=(ALL) NOPASSWD: SETENV: ALL
|
||||
```
|
||||
|
||||
Add the initial user to /etc/group in group sudo
|
||||
```
|
||||
/usr/sbin/usermod -a -G sudo randy
|
||||
```
|
||||
|
||||
I want to disable ssh passwording as soon as reasonable, so I install
|
||||
root's ssh credentials.
|
||||
|
||||
```
|
||||
cd /root
|
||||
chmod 700 .ssh
|
||||
cat > .ssh/authorized_keys << EOF
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID9DzOVboz/9daQwQRPkxD/D4PZ4ZVNgMLqd+zc79Gl+ randy@ryuu.psg.com
|
||||
EOF
|
||||
chmod 600 .ssh/authorized_keys
|
||||
rsync -vlpPStgoHxr .ssh ~randy
|
||||
chown -R randy:randy ~randy
|
||||
```
|
||||
|
||||
I want my standard dot files, so I go to a recently customized Xenial
|
||||
system and rsync them over.
|
||||
```
|
||||
cd dot-files
|
||||
rsync -vlpPStgoHx .??* x.rg.net:
|
||||
rsync -vlpPStgoHx xtitle root@x.rg.net:/usr/bin
|
||||
```
|
||||
|
||||
## Configure GRUB and the Network
|
||||
|
||||
Configure GRUB for
|
||||
* longer timeout
|
||||
* serial console
|
||||
|
||||
Edit `/etc/default/grub`
|
||||
```
|
||||
GRUB_TIMEOUT=6
|
||||
...
|
||||
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0"
|
||||
|
||||
...
|
||||
GRUB_TERMINAL="console serial"
|
||||
GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"
|
||||
```
|
||||
|
||||
** And remember to update GRUB**
|
||||
```
|
||||
update-grub
|
||||
```
|
||||
|
||||
If you have more than one disk drive:
|
||||
```
|
||||
for i in b c d; do
|
||||
grub-install /dev/sd$i
|
||||
done
|
||||
```
|
||||
|
||||
## Last Cosmetics Before Reboot
|
||||
|
||||
Check that `/etc/hostname` has the full FQDN.
|
||||
|
||||
Set the timezone. All my servers are in UTC
|
||||
```
|
||||
dpkg-reconfigure tzdata
|
||||
```
|
||||
|
||||
I still have the VNC console open, so it would be a good time to reboot
|
||||
and watch for problems. I could tell the VM to reboot, or whack it from
|
||||
the Ganeti master. To ensure it is really clean, I do the latter. I do
|
||||
not force the timeout so I can ensure that APCI works.
|
||||
|
||||
gnt-instance reboot x.rg.net
|
||||
|
||||
## Use Ansible to Install and Configure a Bunch of Things
|
||||
|
||||
WARNING: The Ansible install of unbound is sensitive to whether IPv6
|
||||
has already been anabled and configured. So be sure to do so before
|
||||
running the playbook.
|
||||
|
||||
Now the barrage of ansible, which for me is based on my Mac laptop.
|
||||
```
|
||||
ansible-playbook -l x.rg.net no-depends.yml unattended-upgrades.yml unattended-reboot.yml chrony.yml rsyslog.yml snmpd.yml postfix.yml unbound.yml
|
||||
```
|
||||
|
||||
Check if there is an `/etc/mailname`, and make sure it is correct if
|
||||
present.
|
||||
|
||||
## Clean Up DNS
|
||||
|
||||
Make sure that `/etc/resolv.conf` points to localhost.
|
||||
```
|
||||
nameserver 127.0.0.1
|
||||
nameserver ::1
|
||||
```
|
||||
|
||||
Then hack `/etc/network/interfaces` to start with the 127.0.0.1
|
||||
nameserver.
|
||||
|
||||
## Add the VM to Infrastructure Monitoring Etc.
|
||||
|
||||
Create an entry in `srv0.iad.rg.net:/etc/nagios4/conf.d` and enable
|
||||
checks in the GUI
|
||||
|
||||
Add the device to snmp monitoring `https://nms.rg.net/` if needed
|
||||
|
||||
Edit `/etc/aliases` to send root mail where you really want it to go,
|
||||
and run `newaliases`
|
||||
|
||||
---
|
||||
2026.08.11
|
||||
Loading…
Add table
Add a link
Reference in a new issue