randy/randy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
randy/debian13-vm.md

6.3 KiB
Raw Permalink Blame History

Installing a Debian 13, trixie VM

For this example, I will use the vm/host name x.rg.net. Modify to suit your needs.

Before I start the install, I put the new host in the DNS so that it has time to propagate.

Create the VM and do the Debian Install

I use ProxMox CreateVM to create the VM and set it to boot to the Debian 13 ISO. I manually set AutoBoot on Stat.

Do the Debian install over the ProxMox GUI.

I use the Advanced options and Accessible high contrast install (see here for some ideas so that i can actually see the install screens instead of being blasted by electric blue and red.

As I want to use manual IP addressing, I hit the Back button if it gets a dhcp assignment and then do manual network configuration. The options I choose are:

  • US English and US keyboard. This means I am not offered the UTC timezone option and have to set manually later. But it sets the /etc/apt/sources.list to the US servers.

  • Manually set the IP address, but some folk like DHCP. In deb11, if you want to set the IP address manually, you have to when it asks about dhcp. You if it then shows the correct DNS name, you know you have the in-addr.arpa for that IP address set up correctly.

  • Use the entire disk. This will make a very hard to expand system. Alternatively, instead of this step, use https://git.rg.net/randy/randy/src/master/expanded-lvm-install.md

  • Install the SSH server as well as the standard system utilities. Do not install any of the desktop stuff or the print server.

  • Install the GRUB boot loader so that you can make the serial console work. You may have to specify /dev/vda.

Reboot the VM

The installation completes, and the darn thing reboots the CD-ROM. So I get brutal, and back on the Ganeti cluster master I

gnt-instance reboot --shutdown-timeout=0 x.rg.net

This usually whacks my VNC session, so I have to restart the client.

Because I did not use DHCP but set the address manually, I know where the host is. I immediately ssh into the new system as the new user.

On the other hand, if the IP address was assigned by DHCP, you'll have to stay with the VNC session and set up networking as below.

First Configuration

The first thing is set the password to something nasty. And remember to also set the user password.

I also have to get the network configured properly. In my example

cat > /etc/network/interfaces << EOF
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto ens13

iface ens13 inet static
    address 147.28.0.9/24
    gateway 147.28.0.1
    dns-nameservers 147.28.0.14
    dns-search rg.net psg.com

iface ens13 inet6 static
    address 2001:418:1::9/64
    gateway 2001:418:1::1
EOF

If you are going to run unbound, be sure to configure IPv6 before the Ansible unbound install, as it is sensitive to whether IPv6 is enabled or not.

Then I reboot to get the configuration.

Customize VM

I get root

First hack so that we do not pull in unnecessary wannabe depends.

cat > /etc/apt/apt.conf.d/01norecommend << EOF
APT::Install-Recommends "0";
APT::Install-Suggests "0";
EOF

If it does not run Emacs, it is not a computer. And install unbound so we have a local nameserver, and ntpd so we have a local chime. We will do detailed configuration of unbound and chrony later.

apt install emacs-nox unbound dns-root-data chrony rsync sudo screen debian-goodies bsd-mailx

Hack /etc/sudoers to make it passwordless for members of the sudo group.

%sudo   ALL=(ALL) NOPASSWD: SETENV: ALL

Add the initial user to /etc/group in group sudo

/usr/sbin/usermod -a -G sudo randy

I want to disable ssh passwording as soon as reasonable, so I install root's ssh credentials.

cd /root
chmod 700 .ssh
cat > .ssh/authorized_keys << EOF
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID9DzOVboz/9daQwQRPkxD/D4PZ4ZVNgMLqd+zc79Gl+ randy@ryuu.psg.com
EOF
chmod 600 .ssh/authorized_keys
rsync -vlpPStgoHxr .ssh ~randy
chown -R randy:randy ~randy

I want my standard dot files, so I go to a recently customized Xenial system and rsync them over.

cd dot-files
rsync -vlpPStgoHx .??* x.rg.net:
rsync -vlpPStgoHx  xtitle root@x.rg.net:/usr/bin

Configure GRUB and the Network

Configure GRUB for

  • longer timeout
  • serial console

Edit /etc/default/grub

GRUB_TIMEOUT=6
...
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0"

...
GRUB_TERMINAL="console serial"
GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"

** And remember to update GRUB**

update-grub

If you have more than one disk drive:

for i in b c d; do
grub-install /dev/sd$i
done

Last Cosmetics Before Reboot

Check that /etc/hostname has the full FQDN.

Set the timezone. All my servers are in UTC

dpkg-reconfigure tzdata

I still have the VNC console open, so it would be a good time to reboot and watch for problems. I could tell the VM to reboot, or whack it from the Ganeti master. To ensure it is really clean, I do the latter. I do not force the timeout so I can ensure that APCI works.

gnt-instance reboot x.rg.net

Use Ansible to Install and Configure a Bunch of Things

WARNING: The Ansible install of unbound is sensitive to whether IPv6 has already been anabled and configured. So be sure to do so before running the playbook.

Now the barrage of ansible, which for me is based on my Mac laptop.

ansible-playbook -l x.rg.net no-depends.yml unattended-upgrades.yml unattended-reboot.yml chrony.yml rsyslog.yml snmpd.yml postfix.yml unbound.yml

Check if there is an /etc/mailname, and make sure it is correct if present.

Clean Up DNS

Make sure that /etc/resolv.conf points to localhost.

nameserver 127.0.0.1
nameserver ::1

Then hack /etc/network/interfaces to start with the 127.0.0.1 nameserver.

Add the VM to Infrastructure Monitoring Etc.

Create an entry in srv0.iad.rg.net:/etc/nagios4/conf.d and enable checks in the GUI

Add the device to snmp monitoring https://nms.rg.net/ if needed

Edit /etc/aliases to send root mail where you really want it to go, and run newaliases

2026.08.11