[Doc] ldap, forum, postresql

Makefile

@@ -17,6 +17,8 @@ check: ## Check you have all dependencies
 
 ########## Network Map ##########
 
+graph_program != type graph-easy > /dev/null && printf graph-easy || printf dot 
+
 graph_cmd = graph-easy --boxart
 
 queries = queries authqueries
@@ -36,8 +38,18 @@ $(query_formats): .dbs/%.txt: | .dbs/
 $(dotquery_formats): .dbs/%.dot: | .dbs/
 	echo '{{name}} -> {{$(basename $(@F))}} [ label="$(basename $(@F))" ];' > $@
 
+ifeq ($(graph_program),dot)
+  map_file = network.png
+else
+  map_file = network.txt
+endif
+
+ignored += $(map_file)
+
 .PHONY: map
-map: .dbs/network.txt ## Show a network map
+map: $(map_file) ## Generate a network map
+
+network.txt: .dbs/network.txt
 	$(graph_cmd) < $<
 
 .dbs/network.txt: network.rec $(query_formats)
@@ -53,10 +65,8 @@ map: .dbs/network.txt ## Show a network map
 	)
 	echo '}' >> $@
 
-network.png: .dbs/network.dot $(ignore_file) $(ignore_file)
+network.png: .dbs/network.dot $(ignore_file)
-	dot < $< -T png > $@
+	dot -T png < $< > $@
-
-ignored += network.png
 
 ##########
 

kralizec/flaskldap11/README.md

@@ -1,3 +1,6 @@
 ---
 VMID: 109
 ---
+
+
+

kralizec/forum11/README.md

@@ -0,0 +1,46 @@
+---
+VMID: 119
+---
+
+
+## Data
+
+`/var/discourse/shared/web_only/`
+
+
+## Web 
+
+`/var/discourse_docker/`
+
+
+## Help
+
+`/var/discourse_docker/discourse_doctor`
+
+
+## Docker rebuild errors
+
+`/var/discourse_docker/launcher rebuild web_only`
+
+
+```
+Plugin name is 'ldap', but plugin directory is named 'discourse-ldap-auth'
+rake aborted!
+ActiveRecord::NoDatabaseError: We could not find your database: discoursedb. Available database configurations can be found in config/database.yml. (ActiveRecord::NoDatabaseError)
+
+```
+
+
+```
+FAILED
+--------------------
+Pups::ExecError: cd /var/www/discourse && su discourse -c 'bundle exec rake db:migrate' failed with return #<Process::Status: pid 593 exit 1>
+Location of failure: /usr/local/lib/ruby/gems/3.3.0/gems/pups-1.3.0/lib/pups/exec_command.rb:131:in `spawn'
+exec failed with the params {"cd"=>"$home", "tag"=>"migrate", "hook"=>"db_migrate", "cmd"=>["su discourse -c 'bundle exec rake db:migrate'"]}
+bootstrap failed with exit code 1
+** FAILED TO BOOTSTRAP ** please scroll up and look for earlier error messages, there may be more than one.
+./discourse-doctor may help diagnose the problem.
+a9a704b1ee166487d8cd2acd5bd9bcc050ed0ec93fc065f58440e4ae208e1937
+```
+
+

kralizec/postgresql11/README.md

@@ -1,3 +1,14 @@
 ---
 VMID: 105
 ---
+
+Posgresql v13
+
+- ejabberd (xmpp)
+- discourse (forum)
+
+root@192.168.1.28
+
+other databases are migrated to posgresql12
+
+ 

kralizec/postgresql12/README.md

@@ -0,0 +1,54 @@
+---
+VMID: 121
+---
+
+PostgreSql v15
+
+port 5432
+
+[installation wiki](https://wiki.debian.org/PostgreSql)
+
+## Users
+
+- ejabberd
+- discorse
+- gitea
+- wiki
+- replication
+- xmppsqlkrov (not created)
+- dmzrsflask (not created)
+
+
+## Config for databases
+
+- ejabberddb - `/etc/ejabberd/ejabberd.yml`
+- discorsedb (forum11) `/etc/discorse_docker/containers/web_only.yml` and `-||-/data.yml`
+- giteadb `/etc/gitea/app.ini`
+- wikidb `/root/wiki/config.yml`
+- replication
+
+
+```sh
+pg_dump -d <database> -f <file>
+psql -U <user> -d <dababase> -f <dump.psql>
+
+```
+
+## Config file
+
+`/etc/postresql/15main/postresql.conf`
+changed listening_address from localhost to *
+
+`/etc/postresql/15main/pg_hba.conf`
+host all all all md5
+
+add `/etc/ssl/certs/ssl-cert-snakeoil.pem` to `/etc/ssl/` on every service
+
+
+## SSL
+
+For wiki machine certificate pinging is setup
+In config.yml on wiki machine, the certificate path for new sql server should be added
+
+
+    

kralizec/wireguard11/README.md

@@ -4,14 +4,14 @@ VMID: 103
 
 [Wireguard VPN quickstart](https://www.wireguard.com/quickstart)
 
-Check dmzadmin for `wireguard.gpg` to know who to contact for access 
+Check `dmzadmin` for `wireguard.gpg` to know who to contact for access 
 
 ---
 
 ### Client config
 
-client conf example
+Client config example
-`x` is the assinged on the server as peer
+`x` is the assigned on the server as peer:
 
 ```conf
 
@@ -37,7 +37,7 @@ PersistentKeepalive = 21
 ### Server config
 
 New user/client needs to provide their wireguard `publickey` and new ip on the network needs to be assigned (`x`)
-check the server conf file `/etc/wireguard/wg0.conf` to find free address
+check the server config file `/etc/wireguard/wg0.conf` to find free address
 
 ```sh
 sudo wg set wg0 peer <client_public_key> allowed-ips 192.168.164.x/32
@@ -45,12 +45,12 @@ sudo wg set wg0 peer <client_public_key> allowed-ips 192.168.164.x/32
 
 ---
 
-Command to resolve ip clashing with current and wireguard network, if needed
+Command to resolve IP clashing with current and wireguard network, if needed
 
 ```shell
 ip route add <ip> dev <wg0>
 ```
 
-- `ip` you want to resove -> for wireguard vm 192.168.1.10
+- `ip` you want to resolve -> for wireguard VM 192.168.1.10
-- `wg0` name of the wireguard conf
+- `wg0` name of the wireguard config
 

krov/serverko/README.md

@@ -17,3 +17,6 @@ VMID Name
 111  taskmanager12  
 112  stopreklamama12  
 
+##### Legend
+
+12 -> debian 12

krov/serverko/ejabberd12/README.md

@@ -1,3 +1,5 @@
 ---
 VMID: 109
 ---
+
+XMPP server, used for future decentralization

krov/serverko/nginx12/README.md

@@ -1,3 +1,26 @@
 ---
 VMID: 100
 ---
+
+This VM is a reverse proxy, all serveces go through it and get their SSL certificates
+
+## Creating new record
+
+```sh
+cd /etc/nginx/sites-available/ # configs are located here
+vim.tiny pastebin.dmz.rs # using pastebin as example, copy existing one and edit it
+ln -s /etc/nginx/sites-available/pastebin.dmz.rs  /etc/nging/sites-enabled/pastebin.dmz.rs # creating link since file is the same
+mkdir /var/www/pastebindmzrs # new dir where certificate will be validated
+nginx -t # checking for errors
+systemctl reload nginx.service # reloading the service for changes to apply, reset will work too
+service nginx reload # alternative server reload
+certbot certonly --webroot -w /var/www/pastebindmzrs -d pastebin.dmz.rs -d pastebin.decentrala.org # requesting the certificates
+```
+
+## renewal
+
+```sh
+ls /var/www/
+cd /etc/letsencrypt/renewal
+certbot renew
+```

krov/serverko/stopreklamama12/README.md

@@ -1,3 +1,6 @@
 ---
 VMID: 112
 ---
+
+This container is for hosting the [website](https://gitea.dmz.rs/svitvojimilioni/stopreklamama)
+hosted on domen `stopreklamama.dmz.rs`

krov/serverko/taskmanager12/README.md

@@ -1,3 +1,8 @@
 ---
 VMID: 111
 ---
+
+Old app for group task managment, [gitea project](https://gitea.dmz.rs/Decentrala/taskmanager)
+Hosted on [todo.dmz.rs](https://todo.dmz.rs/)
+
+Now using soft.dmz.rs/fixme instead

krov/serverko/tor12/README.md

@@ -1,3 +1,5 @@
 ---
 VMID: 103
 ---
+
+In this container hosts the tor onion service, used for remote access to the proxmox, through tor.

krov/serverko/wireguard12/README.md

@@ -1,3 +1,5 @@
 ---
 VMID: 105
 ---
+
+Wireguard server for VPN access to krov network

krov/srv1/README.md

@@ -1,15 +1,39 @@
 # List of containers
 
-## srv1
+# srv1
 
 VMID Name  
-102  tor12  
+100  ssh12
-103  dendrite  
+101  vukbox
-106  icecast12  
+102  mad3v-container-postgresql  
-107  mariadb12  
+103  nextcloud1 
-108  mpd12  
+104  pentest
-109  ympd  
+105  dns12
-111  sshfs11
+106  cryptpad  
-113  ollama12  
+107  cryptpad12
-114  chatbot12  
+108  ejabberd12 
-115  goodvibes12  
+109  dante12  
+111  postgresql12
+112  gitea12
+113  game12 
+114  coja-nginx 
+115  mad3v-container-1  
+116  hugo12  
+118  mumble
+119  netstat-game12
+120  privatebin12
+121  searxng12 
+122  alpine-it-tools  
+123  test  
+124  jitsi12
+
+---
+
+### Hardware
+
+Dell enterprise server
+
+##### Legend
+
+12 -> debian 12 lxc
+

krov/srv1/alpine-it-tools/README.md

@@ -0,0 +1,7 @@
+---
+VMID: 122
+---
+
+Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=alpine-it-tools)
+
+Plan to host it on tools.dmz.rs

krov/srv1/chatbot12/README.md

@@ -1,3 +0,0 @@
----
-VMID: 114
----

krov/srv1/cryptpad12/README.md

@@ -0,0 +1,13 @@
+---
+VMID: 106
+---
+
+Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=cryptpad)
+
+[Project page](https://cryptpad.org/)
+
+
+Plan to host it on cryptpad.dmz.rs
+
+cryptpad (106) is already on that subdomain, but it doesnt work
+

krov/srv1/ejabberd12/README.md

@@ -0,0 +1,5 @@
+---
+VMID: 108
+---
+
+XMPP server, practice for future decentralization of the service

krov/srv1/homeAssistentInstanca/README.md

@@ -0,0 +1,9 @@
+---
+VMID: 117
+---
+
+Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=haos-vm)
+
+[Forum descussion](https://forum.dmz.rs/t/automatizacija-krova/469)
+
+

krov/srv1/icecast12/README.md

@@ -1,3 +0,0 @@
----
-VMID: 106
----

krov/srv1/jitsi12/README.md

@@ -0,0 +1,9 @@
+---
+VMID: 124
+---
+
+Video converencing server. Zoom alternative.
+
+[website](https://jitsi.org/)
+
+Plan to host it on jitsi.dmz.rs, video.dmz.rs or else

krov/srv1/mumble/README.md

@@ -0,0 +1,9 @@
+---
+VMID: 118
+---
+
+VOIP server, hosted on krov.dmz.rs
+
+[website](https://www.mumble.info/)
+
+

krov/srv1/netstat-game12/README.md

@@ -0,0 +1,6 @@
+---
+VMID: 119 
+---
+
+Open arena server, free clone of FPS Quake III Arena
+Hosted on krov.dmz.rs:27960 for LAN Parties

krov/srv1/nextcloud1/README.md

@@ -0,0 +1,9 @@
+---
+VMID: 103
+---
+
+Plan for this services was to use the shared callendar with members of DC Krov
+
+Register as a user is disabled, only admins can create the accounts
+LDAP is not connected
+

krov/srv1/old-abandoned/README.md

@@ -0,0 +1 @@
+Those serveces are not on the server

krov/srv1/old-abandoned/chatbot12/README.md

@@ -0,0 +1,5 @@
+---
+VMID: 114
+---
+
+[Forum discussion](https://forum.dmz.rs/t/jel-neko-u-krovu-bot/779)

krov/srv1/other/README.md

@@ -0,0 +1,32 @@
+Here should be the list of other containers on the server
+
+## "Personal containers" 
+created on some of the sysadmin workshops, used for learning and practice, usually named by the nickname
+
+- vukbox
+- hugo12
+- malin
+- mad3v-container-postresql
+- mad3v-container-1
+- coja-nginx hosting [coja.krov.dmz.rs](https://coja.krov.dmz.rs/)
+- 
+
+---
+
+## Other 
+
+- pentest - created by fleka for CTF challange
+
+---
+
+## Containers with no info
+Feel free to add info 
+
+- dante12
+- dns12
+- gitea12
+- test
+- game12
+
+
+

krov/srv1/postgresql12/README.md

@@ -1,3 +1,5 @@
 ---
 VMID: 111
 ---
+
+Probably used as a testing ground for syncing the database, for future decentralization.

krov/srv1/privatebin12/README.md

@@ -0,0 +1,10 @@
+---
+VMID: 120
+---
+
+Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=privatebin)
+
+[Project page](https://privatebin.info/)
+
+Hosted on [subdomain on dmz](https://pastebin.dmz.rs/)
+

krov/srv1/searxng12/README.md

@@ -0,0 +1,10 @@
+---
+VMID: 121
+---
+
+Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=searxng)
+
+[Project git repo](https://github.com/searxng/searxng)
+
+Hosted on [subdomain on dmz](https://search.dmz.rs/)
+

krov/srv1/ssh12/README.md

@@ -2,4 +2,7 @@
 VMID: 100
 ---
 
+SSH port from this container is forwarded on krov.dmz.rs
+SSH access to other containers is done through this one with ssh jump, passwords are disabled, so only keys verification is used. 
+
 [wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)

network.rec

@@ -15,6 +15,7 @@ ISP: Yettel
 
 name: moxx
 location: kralizec
+local_access: 192.168.1.200:8006
 
 name: Serverko
 location: krov
@@ -35,6 +36,10 @@ proxies: dmzrs
 name: LDAP
 host: moxx
 
+name: dmzrs
+host: moxx
+note: hosts the dmz.rs website
+
 name: website
 host: moxx
 authqueries: LDAP

setup/ssh_to_lxc.md

@@ -0,0 +1,36 @@
+---
+volume: Decentrala
+section: 6
+title: Access Linux Containers in Moxx over `ssh`
+author: Malin
+source: dmz.rs
+---
+
+Access `moxx`, the Proxmox machine:
+
+1. Check you can access the creds in `dmzadmin`: `gpg -d credentials/kralizec/ssh11.gpg`.
+2. Check the creds work: `ssh dmz.rs ls`.
+3. Copy your ssh keys across: `ssh-copy-id -i ~/id_selected dmz.rs`.
+4. Check that works: `test $(ssh dmz.rs hostname) = ssh11`
+5. Find `moxx`' IP address in its credentials: `moxxIP=[ user ]@[ local ip ]`
+6. Jump through `ssh11` to access `moxx`: `ssh -J user@dmz.rs $moxx_ip`
+
+
+# Enter Containers
+
+Use `pct` to find and access containers:
+
+```sh
+pct list | grep -v stopped
+pct enter 112
+```
+
+- Don't tell people to type 'pct enter', or they will type `pct`, and hit the enter key I TOLD YOU ALL THE KEY SHOULD BE CALLED RETURN.
+- Now you're in the container.
+
+## Just for Fun
+
+```sh
+pct list | grep -v VMID |\
+    column -J -N vmid,state,current,name  | less -R
+```