randy/randy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
randy/debian12-on-ganeti.md
Randy Bush 987016a0b3 check /etc/mailname
2025-08-03 14:50:35 -07:00

8.8 KiB
Raw Permalink Blame History

Installing a Debian 12, Bookworm, Guest on an Ganeti Cluster

For this example, I will use the vm/host name x.rg.net. Modify to suit your needs.

Before I start the install, I put the new host in the DNS so that it has time to propagate.

Create the VM and do the Debian install

I cheat and use a script.

vm1.sea.rg.net:/root# ./do-add vm0 32 1 x.rg.net
Mon Sep  2 19:55:56 2019 * disk 0, size 32.0G
Mon Sep  2 19:55:56 2019 * creating instance disks...
Mon Sep  2 19:56:02 2019 adding instance x.rg.net to cluster config
Mon Sep  2 19:56:02 2019 adding disks to cluster config
Mon Sep  2 19:56:03 2019  - INFO: Waiting for instance x.rg.net to sync disks
Mon Sep  2 19:56:03 2019  - INFO: Instance x.rg.net's disks are in sync
Mon Sep  2 19:56:03 2019  - INFO: Waiting for instance x.rg.net to sync disks
Mon Sep  2 19:56:03 2019  - INFO: Instance x.rg.net's disks are in sync

Find the VNC console port and host of the new VM

gnt-instance list -o name,pnode,network_port x.rg.net

Spin up the VM but boot from the Debian install CD-ROM

gnt-instance start -H boot_order=cdrom,cdrom_image_path=/ISOs/debian-12.5.0-amd64-netinst.iso x.rg.net

From your local host, go for the VNC concole over a nice safe ssh tunnel. Tunnel to vm1.sjc.arrcus.com because that is where the instance lives. The ssh tunnel means you are relatively safe doing passwords etc over the wire.

$ ssh -N -L 5900:127.0.0.1:11058 vm0.sea.rg.net

On my local host, a Mac, I start a VNC client (I use JollysFastVNC) to localhost, port 5900, display 0, with the password of VNC on the target ganeti cluster.

Do the Debian install over the VNC GUI.

I use the Advanced options and Accessible high contrast install (see here for some ideas so that i can actually see the install screens instead of being blasted by electric blue and red.

As I want to use manual IP addressing, I hit the Back button if it gets a dhcp assignment and then do manual network configuration. The options I choose are:

  • US English and US keyboard. This means I am not offered the UTC timezone option and have to set manually later. But it sets the /etc/apt/sources.list to the US servers.

  • Manually set the IP address, but some folk like DHCP. In deb11, if you want to set the IP address manually, you have to when it asks about dhcp. You if it then shows the correct DNS name, you know you have the in-addr.arpa for that IP address set up correctly.

  • Use the entire disk. This will make a very hard to expand system. Alternatively, instead of this step, use https://git.rg.net/randy/randy/src/master/expanded-lvm-install.md

  • Install the SSH server as well as the standard system utilities. Do not install any of the desktop stuff or the print server.

  • Install the GRUB boot loader so that you can make the serial console work. You may have to specify /dev/vda.

Reboot the VM

The installation completes, and the darn thing reboots the CD-ROM. So I get brutal, and back on the Ganeti cluster master I

gnt-instance reboot --shutdown-timeout=0 x.rg.net

This usually whacks my VNC session, so I have to restart the client.

Because I did not use DHCP but set the address manually, I know where the host is. I immediately ssh into the new system as the new user.

On the other hand, if the IP address was assigned by DHCP, you'll have to stay with the VNC session and set up networking as below.

First Configuration

The first thing is set the password to something nasty. And remember to also set the user password.

I also have to get the network configured properly. In my example

cat > /etc/network/interfaces << EOF
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto ens13

iface ens13 inet static
    address 147.28.0.9/24
    gateway 147.28.0.1
    dns-nameservers 147.28.0.14
    dns-search rg.net psg.com

iface ens13 inet6 static
    address 2001:418:1::9/64
    gateway 2001:418:1::1
EOF

If you are going to run unbound, be sure to configure IPv6 before the Ansible unbound install, as it is sensitive to whether IPv6 is enabled or not.

Then I reboot to get the configuration.

Customize VM

First hack so that we do not pull in unnecessary wannabe depends.

cat > /etc/apt/apt.conf.d/01norecommend << EOF
APT::Install-Recommends "0";
APT::Install-Suggests "0";
EOF

If it does not run Emacs, it is not a computer. And install unbound so we have a local nameserver, and ntpd so we have a local chime. We will do detailed configuration of unbound and chrony later.

apt install emacs-nox unbound dns-root-data chrony rsync sudo screen debian-goodies bsd-mailx

Hack /etc/sudoers to make it passwordless for members of the sudo group.

%sudo   ALL=(ALL) NOPASSWD: SETENV: ALL

Add the initial user to /etc/group in group sudo

/usr/sbin/usermod -a -G sudo randy

I want to disable ssh passwording as soon as reasonable, so I install root's ssh credentials.

cd /root
chmod 700 .ssh
cat > .ssh/authorized_keys << EOF
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID9DzOVboz/9daQwQRPkxD/D4PZ4ZVNgMLqd+zc79Gl+ randy@ryuu.psg.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8yvE/UBwHdLVDk708/U81ZQdtDLF9Y7grMkVBfUoclF4BGFCcH1bIv6y0p1I/2PATSRnK/B5ndvWP/SrQ6y0DqnQugHKoFMR3idkzVagjjXOhcZkpitcp5hRCdjn/y/88QEiIKItEM66q48nW0OtCgcq7ENXQuYUVt0e6kh6UKRDfrPP3i2D7m8o3/W+xYt8QkYZ0iFanCfhxHAP7w3SOezmThu+p7V6yxVcy+G0WTvPHrs2JlgSaI+4SoJ2btPgqIrmKu1ILfyoAr9/RjSVHr74LijsdUKec7OXnKnV2v1VfMRglBXFgXVaWyX/adA2tMuh9nMk3Y3a3+xDqPIz6RnzQAupqUmPZ/1qbFIrVSNmhygWTC9jgemaNNC/B1nFG7em6m+fmxKjauuWoIdpybaofWiJElUDBBT4bHU+L8NF7zbNROt1GtaDnbL4W9/asqzPu+aJy7L6uJQHtkc/eoXsheajztFC9I5qxW/29ja+FcQsVoDJpe96XmBtJ7elOGXaq3YtDRURwrdu9fGUBDWqwP1IFECVkeVh/NrXbQRHtgp4v533D+0MubA+hDhVTsUk6G93WLyX3usUprU1cJjyhrVzZ9U23eCPOj8J18Ixw4sJFuNeUhSCaN6j+rmOyGor3PYYysKTp1VfLNAYdcc/AYC0jDy9mYjjfCDwKfQ== randy@ryuu.psg.com
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2qXA3uRFGv7Q0yolQtC5bcF7kVW94c/aOhf0xbU3i8 randy@kappa.local
EOF
chmod 600 .ssh/authorized_keys
rsync -vlpPStgoHxr .ssh ~randy
chown -R randy:randy ~randy

Disallow plaintext password logins by editing /etc/ssh/sshd_config as root

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
PasswordAuthentication no
#UsePAM yes
UsePAM no

Take the new sshd config

systemctl restart ssh

I want my standard dot files, so I go to a recently customized Xenial system and rsync them over.

rsync -vlpPStgoHx .bashrc .emacs .exrc .forward .inputrc randy@x.rg.net:
ssh randy@x.rg.net chown -R randy:randy .

And a bit of decoration from the other system

rsync -vlpPStgoHx /usr/bin/xtitle root@x.rg.net:/usr/bin/xtitle

Configure GRUB and the Network

Configure GRUB for

  • longer timeout
  • serial console

Edit /etc/default/grub

GRUB_TIMEOUT=6
...
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0"

...
GRUB_TERMINAL="console serial"
GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"

And remember to update GRUB

update-grub

You probably want to do that on all the drives. e.g.

for i in b c d; do
grub-install /dev/sd$i
done

Last Cosmetics Before Reboot

Check that /etc/hostname has the full FQDN.

Set the timezone. All my servers are in UTC

dpkg-reconfigure tzdata

I still have the VNC console open, so it would be a good time to reboot and watch for problems. I could tell the VM to reboot, or whack it from the Ganeti master. To ensure it is really clean, I do the latter. I do not force the timeout so I can ensure that APCI works.

gnt-instance reboot x.rg.net

Use Ansible to Install and Configure a Bunch of Things

WARNING: The Ansible install of unbound is sensitive to whether IPv6 has already been anabled and configured. So be sure to do so before running the playbook.

Now the barrage of ansible, which for me is based on my Mac laptop.

ansible-playbook -l x.rg.net no-depends.yml unattended-upgrades.yml chrony.yml rsyslog.yml snmpd.yml postfix.yml unbound.yml

Check if there is an /etc/mailname, and make sure it is correct if present.

Clean Up DNS

Make sure that /etc/resolv.conf points to localhost.

nameserver 127.0.0.1
nameserver ::1

Then hack /etc/network/interfaces to start with the 127.0.0.1 nameserver.

Add the VM to Infrastructure Monitoring Etc.

Create an entry in srv0.iad.rg.net:/etc/nagios4/conf.d and enable checks in the GUI

Add the device to snmp monitoring https://nms.rg.net/

Edit /etc/aliases to send root mail where you really want it to go, and run newaliases

2025.08.03