Cloud/Hetzner/AB: Difference between revisions
Jump to navigation
Jump to search
| (One intermediate revision by the same user not shown) | |||
| Line 300: | Line 300: | ||
lxc publish cloudflare/base:2025.1.861.0 --alias cloudflare/base:2025.1.861.0 | lxc publish cloudflare/base:2025.1.861.0 --alias cloudflare/base:2025.1.861.0 | ||
lxc restore cloudflare base:2025.1.861.0 | lxc restore cloudflare base:2025.1.861.0 | ||
</syntaxhighlight> | |||
---- | |||
<syntaxhighlight lang="bash"> | |||
lxc snapshot cloudflare shahed:2025.03.09 | |||
lxc publish cloudflare/shahed:2025.03.09 --alias cloudflare/shahed:2025.03.09 | |||
lxc restore cloudflare shahed:2025.03.09 | |||
</syntaxhighlight> | </syntaxhighlight> | ||
==LB » HAProxy » Install & Configure== | ==LB » HAProxy » Install & Configure== | ||
[[Cloud/Hetzner/AA#LB » HAProxy » Install & Configure|Skipped » Find More » 👈]] | [[Cloud/Hetzner/AA#LB » HAProxy » Install & Configure|Skipped » Find More » 👈]] | ||
---- | |||
<syntaxhighlight lang="bash"> | |||
sudo ufw status numbered | |||
sudo iptables -S | |||
cat << EXE | sudo bash | |||
ufw allow 80/tcp | |||
ufw allow 443/tcp | |||
EXE | |||
sudo ufw status numbered | |||
sudo iptables -S | |||
</syntaxhighlight> | |||
==References== | ==References== | ||
Latest revision as of 09:27, 9 March 2025
WAN
| Hetzner Instances | |||
|---|---|---|---|
| Name | Network | Subnets | Forward |
| Hetzner » AA | 10.20.41.1/32 |
10.20.41.1 … 1/32 = 01 |
✅ |
| Hetzner » AB | 10.20.41.2/32 |
10.20.41.2 … 2/32 = 01 |
✅ |
| Hetzner » AE | 10.20.41.3/32 |
10.20.41.3 … 3/32 = 01 |
⚪️ |
| Hetzner » AC | 10.20.41.4/32 |
10.20.41.4 … 4/32 = 01 |
⚪️ |
| Hetzner » AE | 10.20.41.5/32 |
10.20.41.5 … 5/32 = 01 |
⚪️ |
SSH
ssh -qt -i ~/.ssh/cid.chorke.org_ed25519 [email protected] bash
cat <<'EXE' | sudo bash
free -th && echo && systemd-analyze && echo
df -h && echo && lsblk && echo
swapon --show
EXE
Add User
# root
passwd
adduser chorke
passwd chorke
adduser shahed
passwd shahed
APT Update
cat << EXE | sudo bash
apt-get update;echo
mkdir -p /etc/apt/keyrings
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y apt-transport-https ca-certificates gnupg build-essential snapd jq traceroute
apt-get clean cache && find /tmp -type f -atime +10 -delete && find /tmp -type s -atime +10 -delete
EXE
Swap Space
echo 'swapon --show'|sudo bash
cat <<'EXE' | sudo bash
swapoff /swap.img
fallocate -l 3G /swap.img
ls -lh /swap.img && mkswap /swap.img
chmod 0600 /swap.img && swapon /swap.img && swapon --show && free -th
EXE
cat << FST | sudo tee -a /etc/fstab >/dev/null
# loop based swap storage » 0GB + 3GB
/swap.img none swap sw 0 0
FST
free -th
cat /etc/fstab
echo 'swapon --show'|sudo bash
Utility » Tool
cat << EXE|sudo bash
PLATFORM=\$(uname -s)_\$(dpkg --print-architecture)
YQ_BINARY=\$(echo "yq_\${PLATFORM}"|tr '[:upper:]' '[:lower:]')
wget https://github.com/mikefarah/yq/releases/latest/download/\${YQ_BINARY} -O /usr/bin/yq && chmod +x /usr/bin/yq
EXE
Containerize » LXD
cat << EXE | sudo bash
snap install lxd --channel=6/stable
usermod -aG lxd chorke
usermod -aG lxd shahed
EXE
echo 'id -nG'|sudo -i -u chorke bash
echo 'id -nG'|sudo -i -u shahed bash
cat <<YML | sudo lxd init --preseed
---
config: {}
networks:
- config:
ipv4.address: 10.20.0.1/24
ipv4.nat: "true"
ipv6.address: auto
description: ""
name: lxdbr0
type: ""
project: default
storage_pools:
- config:
size: 15GiB
description: ""
name: lxd-zfs-pool-ab
driver: zfs
storage_volumes: []
profiles:
- config: {}
description: ""
devices:
eth0:
name: eth0
network: lxdbr0
type: nic
root:
path: /
pool: lxd-zfs-pool-ab
type: disk
name: default
projects: []
cluster: null
YML
sudo ufw enable
sudo iptables -S
cat << EXE | sudo bash
ufw allow OpenSSH
ufw allow in on lxdbr0
ufw route allow in on lxdbr0
ufw route allow out on lxdbr0
EXE
sudo ufw status numbered
sudo iptables -S
cat << EXE | sudo bash
snap restart lxd
snap services lxd
EXE
lxc launch images:alpine/3.21 academia
lxc list -c=n -f=json|jq -r '.[]|select(.name=="academia")|.status'
cat <<'EXE'| lxc exec academia -- sh
ping -c5 chorke.org
ping -c5 shahed.biz
EXE
Containerize » Docker
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
| sudo tee /etc/apt/keyrings/docker.asc >/dev/null
DISTRIBUTION=$(. /etc/os-release && echo "${VERSION_CODENAME}")
cat << SRC | sudo tee /etc/apt/sources.list.d/docker.list >/dev/null
deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${DISTRIBUTION} stable
SRC
cat << EXE | sudo bash
apt-get update;echo
apt-cache policy docker-ce
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
apt-get clean cache && find /tmp -type f,s -atime +10 -delete
EXE
cat << EOF | sudo tee /etc/docker/daemon.json >/dev/null
{
"bip" : "10.20.13.1/24",
"mtu" : 1500,
"dns" : [
"8.8.8.8",
"8.8.4.4"
],
"debug": true
}
EOF
cat << EXE | sudo bash
systemctl stop docker.socket
systemctl stop docker.service
systemctl start docker.service
usermod -aG docker chorke
usermod -aG docker shahed
EXE
ip a
docker image ls
docker network ls
echo 'id -nG'|sudo -i -u shahed bash
echo 'id -nG'|sudo -i -u chorke bash
cat <<'EXE'| docker run --rm -i alpine sh
echo
cat /etc/hosts ;echo
cat /etc/resolv.conf ;echo
ping -c5 chorke.org ;echo
ping -c5 shahed.biz ;echo
EXE
Cloudflare » VIRT
cat << INI | sudo tee /etc/systemd/system/warp0.service >/dev/null
[Unit]
Description=Cloudflared WARP Routing Virtual Interface
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link add warp0 type dummy
ExecStartPost=/usr/sbin/ip addr add 10.20.41.2/32 dev warp0
ExecStartPost=/usr/sbin/ip link set warp0 up
ExecStop=/usr/sbin/ip link delete warp0
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
INI
cat << EXE | sudo bash
systemctl daemon-reload
systemctl enable --now warp0.service
systemctl status warp0.service
EXE
ip a
Cloudflare » Argo » Tunnel
wget -cq https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb -P ${HOME}/Downloads
sudo dpkg -i ${HOME}/Downloads/cloudflared-linux-arm64.deb; sudo apt install -f
rm -rf ${HOME}/Downloads/cloudflared-linux-arm64.deb
cat <<'SYS' | sudo tee -a /etc/sysctl.conf >/dev/null
###################################################################
# Cloudflared Tunnel Private Network Config
# This config added by Chorke Academia, Inc
# ICMP Group ID Range 0 to 10,000 Users
net.ipv4.ping_group_range = 0 10000
# 208 KiB Default RX Buffer
net.core.rmem_default=212992
# 208 KiB Default TX Buffer
net.core.wmem_default=212992
# 8 MB Maximum RX Buffer
net.core.rmem_max=8388608
# 8 MB Maximum TX Buffer
net.core.wmem_max=8388608
SYS
sudo sysctl -p
Cloudflare » WARP » Tunnel
lxc snapshot cloudflare base:2025.1.861.0
lxc publish cloudflare/base:2025.1.861.0 --alias cloudflare/base:2025.1.861.0
lxc restore cloudflare base:2025.1.861.0
lxc snapshot cloudflare shahed:2025.03.09
lxc publish cloudflare/shahed:2025.03.09 --alias cloudflare/shahed:2025.03.09
lxc restore cloudflare shahed:2025.03.09
LB » HAProxy » Install & Configure
sudo ufw status numbered
sudo iptables -S
cat << EXE | sudo bash
ufw allow 80/tcp
ufw allow 443/tcp
EXE
sudo ufw status numbered
sudo iptables -S
References
|
| ||
|
| ||
|
| ||