first commit
This commit is contained in:
Khwezi Mngoma
17
documents/ansible.md
Normal file
17
documents/ansible.md
Normal file
@@ -0,0 +1,17 @@
|
||||
# Ensure Ansible is installed
|
||||
Make sure to install python and pip, install ansble cli tools as well as on pip
|
||||
|
||||
```shell
|
||||
sudo apt install python3
|
||||
python --version
|
||||
|
||||
sudo apt remove ansible
|
||||
pip uninstall ansible
|
||||
pip install ansible
|
||||
|
||||
apt install ansible
|
||||
ansible --version
|
||||
python3 -c "import six"
|
||||
|
||||
pip install --upgrade ansible six
|
||||
```
|
||||
120
documents/bind9.md
Normal file
120
documents/bind9.md
Normal file
@@ -0,0 +1,120 @@
|
||||
#Copy SSH keys to VM
|
||||
## make sure that your local linux default ssh directory exists /root/.ssh if you are on windows
|
||||
|
||||
```shell
|
||||
ssh-copy-id -i ~/.ssh/id_ed25519.pub khwezi@192.168.1.151
|
||||
```
|
||||
|
||||
#Update system packages
|
||||
|
||||
```shell
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
```
|
||||
|
||||
#Install Bind9
|
||||
## install accompanying utilities as well
|
||||
|
||||
```shell
|
||||
sudo apt install bind9 bind9utils bind9-doc
|
||||
```
|
||||
|
||||
#Configure Bind9
|
||||
|
||||
```shell
|
||||
//1. Define global DNS settings
|
||||
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.bak
|
||||
sudo nano /etc/bind/named.conf.options
|
||||
|
||||
//2. Modify file contents, use following example
|
||||
//options {
|
||||
// directory "/var/cache/bind";
|
||||
// listen-on { any; }; // Listen on all IP addresses
|
||||
// allow-query { any; }; // Allow queries from any IP address
|
||||
// forwarders {
|
||||
// 8.8.8.8; // Google Public DNS
|
||||
// 8.8.4.4;
|
||||
// };
|
||||
// dnssec-validation auto;
|
||||
// auth-nxdomain no; # conform to RFC1035
|
||||
// listen-on-v6 { any; };
|
||||
//};
|
||||
//Save changed and exit editor
|
||||
|
||||
//3. Create custom DNS Zones
|
||||
cp /etc/bind/named.conf.local /etc/bind/named.conf.local.bak
|
||||
sudo nano /etc/bind/named.conf.local
|
||||
|
||||
// use the following example
|
||||
//zone "mngoma.lab" {
|
||||
// type master;
|
||||
// file "/etc/bind/db.mngoma.lab";
|
||||
//};
|
||||
//
|
||||
//zone "1.168.192.in-addr.arpa" {
|
||||
// type master;
|
||||
// file "/etc/bind/db.192.168.1";
|
||||
//};
|
||||
|
||||
//4. Create Zone file(s) referenced in /etc/bind/named.conf.local
|
||||
sudo cp /etc/bind/db.local /etc/bind/db.mngoma.lab
|
||||
sudo cp /etc/bind/db.127 /etc/bind/db.192.168.1
|
||||
|
||||
//5. Edit zone files to contain the records you need
|
||||
//;
|
||||
//; Zone file for example.com
|
||||
//;
|
||||
//$ORIGIN example.com.
|
||||
//$TTL 3H
|
||||
//
|
||||
//; SOA record - authoritative info about the zone
|
||||
//@ IN SOA ns1.example.com. hostmaster.example.com. (
|
||||
// 2025010101 ; Serial Number
|
||||
// 21600 ; Refresh (6 hours)
|
||||
// 3600 ; Retry (1 hour)
|
||||
// 604800 ; Expire (1 week)
|
||||
// 86400 ; Minimum TTL (1 day)
|
||||
// )
|
||||
//
|
||||
//; NS Records - authoritative name servers for the domain
|
||||
//@ IN NS ns1.example.com.
|
||||
//@ IN NS ns2.example.com.
|
||||
//
|
||||
//; A Records - mapping hostnames to IPv4 addresses
|
||||
//ns1 IN A 192.168.1.10
|
||||
//ns2 IN A 192.168.1.11
|
||||
//www IN A 192.168.1.20
|
||||
//ftp IN A 192.168.1.30
|
||||
//
|
||||
//; AAAA Records - mapping hostnames to IPv6 addresses (optional)
|
||||
//ns1 IN AAAA 2001:db8::10
|
||||
//www IN AAAA 2001:db8::20
|
||||
//
|
||||
//; MX Record - for mail exchange servers and priority
|
||||
//@ IN MX 10 mail.example.com.
|
||||
//mail IN A 192.168.1.100
|
||||
//
|
||||
//; CNAME Record - Alias for another hostname
|
||||
//web IN CNAME www.example.com.
|
||||
//----------
|
||||
|
||||
//6. check zone file syntax (validate)
|
||||
sudo named-checkconf
|
||||
sudo named-checkzone mngoma.lab /etc/bind/db.mngoma.lab
|
||||
sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192.168.1
|
||||
|
||||
//7. Restart bind9
|
||||
sudo systemctl restart bind9
|
||||
```
|
||||
|
||||
#Configure firewall (lockdown)
|
||||
```shell
|
||||
//1. enable firewall
|
||||
sudo ufw enable
|
||||
|
||||
//2. allow all traffic from my address range
|
||||
sudo ufw all from 192.168.1.0/24
|
||||
|
||||
//3. allow DNS ports
|
||||
sudo ufw allow 53/udp
|
||||
sudo ufw allow 53/tcp
|
||||
```
|
||||
155
documents/nginx.md
Normal file
155
documents/nginx.md
Normal file
@@ -0,0 +1,155 @@
|
||||
# Update package list and install nginx
|
||||
```shell
|
||||
sudo apt update
|
||||
sudo apt-get install nginx-full
|
||||
```
|
||||
|
||||
# Backup the default config
|
||||
```shell
|
||||
sudo cp /etc/nginx/sites-available/default /etc/nginx/sites-available/default.bak
|
||||
```
|
||||
|
||||
# (Optional) Obtain SSL certificates using Let's Encrypt (replace <your_domain> with your actual domain)
|
||||
# If you want to use self-signed certificates, generate them instead.
|
||||
# Example for Let's Encrypt:
|
||||
# sudo apt install -y certbot python3-certbot-nginx
|
||||
# sudo certbot --nginx -d <your_domain>
|
||||
|
||||
# Edit the default config (replace the server block with the following)
|
||||
```shell
|
||||
sudo tee /etc/nginx/sites-available/default > /dev/null <<'EOF'
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
|
||||
server_name _;
|
||||
|
||||
root /var/www/html;
|
||||
|
||||
index index.html index.htm index.nginx-debian.html;
|
||||
|
||||
location / {
|
||||
# This will just serve the static page /var/www/html/index.html
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
# Edit Nginx.conf
|
||||
## do not put the stream[{} block inside http
|
||||
```shell
|
||||
sudo nano /etc/nginx/nginx.conf
|
||||
|
||||
user www-data;
|
||||
worker_processes auto;
|
||||
pid /run/nginx.pid;
|
||||
events { worker_connections 768; }
|
||||
|
||||
# Add the stream section here, outside http {}
|
||||
stream {
|
||||
upstream managers_http {
|
||||
server lead.swarm.mngoma.lab:80;
|
||||
server follow.swarm.mngoma.lab:80;
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
proxy_pass managers_http;
|
||||
}
|
||||
|
||||
upstream managers_https {
|
||||
server lead.swarm.mngoma.lab:443;
|
||||
server follow.swarm.mngoma.lab:443;
|
||||
}
|
||||
server {
|
||||
listen 443;
|
||||
proxy_pass managers_https;
|
||||
}
|
||||
}
|
||||
|
||||
http {
|
||||
## ... your existing http config here ...
|
||||
}
|
||||
```
|
||||
|
||||
# Edit nginx conf
|
||||
```shell
|
||||
nano /etc/nginx/nginx.conf
|
||||
|
||||
# ONLY necessary if not handled by /etc/nginx/modules-enabled/
|
||||
# load_module /usr/lib/nginx/modules/ngx_stream_module.so;
|
||||
|
||||
user www-data;
|
||||
worker_processes auto;
|
||||
pid /run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 768;
|
||||
}
|
||||
|
||||
# ========== STREAM PROXY (Layer 4 TCP) ==========
|
||||
stream {
|
||||
upstream managers_http {
|
||||
server lead.swarm.mngoma.lab:80;
|
||||
server follow.swarm.mngoma.lab:80;
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
proxy_pass managers_http;
|
||||
}
|
||||
|
||||
upstream managers_https {
|
||||
server lead.swarm.mngoma.lab:443;
|
||||
server follow.swarm.mngoma.lab:443;
|
||||
}
|
||||
server {
|
||||
listen 443;
|
||||
proxy_pass managers_https;
|
||||
}
|
||||
}
|
||||
|
||||
# ========== HTTP CONFIG ==========
|
||||
|
||||
http {
|
||||
##
|
||||
# Basic Settings
|
||||
##
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
##
|
||||
# Logging Settings
|
||||
##
|
||||
access_log /var/log/nginx/access.log;
|
||||
error_log /var/log/nginx/error.log;
|
||||
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
|
||||
##
|
||||
# Include virtual host configurations
|
||||
##
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
include /etc/nginx/sites-enabled/*;
|
||||
}
|
||||
```
|
||||
|
||||
# Test and reload nginx
|
||||
```shell
|
||||
sudo nginx -t
|
||||
sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
# Log trace
|
||||
```shell
|
||||
tail -f /var/log/nginx/error.log /var/log/nginx/access.log
|
||||
```
|
||||
Reference in New Issue
Block a user