diff options
| author | D Delmar Davis <don@suspectdevices.com> | 2024-07-09 18:22:02 -0700 |
|---|---|---|
| committer | D Delmar Davis <don@suspectdevices.com> | 2024-07-09 18:22:02 -0700 |
| commit | 86049dbe9989870f045198d25c2f8a3f6f668983 (patch) | |
| tree | 95ad22c926f63aaa44db0102ae0ee924d86c3f50 /docs/buildnotes | |
| parent | fc795cb108313ccdb2c25150596c9dbfdb8cefc1 (diff) | |
Try moving the archive down a level.
Diffstat (limited to 'docs/buildnotes')
| -rw-r--r-- | docs/buildnotes/CircuitPythonBuildServerNotes.md | 96 | ||||
| -rw-r--r-- | docs/buildnotes/FreeBSDOnLXD4.md | 221 | ||||
| -rw-r--r-- | docs/buildnotes/RockyLinuxLXDHost/README.md | 84 | ||||
| -rw-r--r-- | docs/buildnotes/gitea-configuration/README.md | 149 | ||||
| m--------- | docs/buildnotes/lede-config | 0 | ||||
| m--------- | docs/buildnotes/redmine-configuration | 0 |
6 files changed, 0 insertions, 550 deletions
diff --git a/docs/buildnotes/CircuitPythonBuildServerNotes.md b/docs/buildnotes/CircuitPythonBuildServerNotes.md deleted file mode 100644 index baa5617..0000000 --- a/docs/buildnotes/CircuitPythonBuildServerNotes.md +++ /dev/null @@ -1,96 +0,0 @@ -# Building Circuit Python. - -I was looking at adafruits circuit python as a possible platform fo replace the missing link using either the rpi2040 or the esp32s2. Unfortunately the usb stacks supported are different so I knew I would have to build what I want from scratch. I am not sure that this isnt a rathole. - -[https://learn.adafruit.com/building-circuitpython/build-circuitpython](https://learn.adafruit.com/building-circuitpython/build-circuitpython) - -### Building on Sandbox (ubuntu focal) -Circuitpython for most processors requires more than a few dependencies. - -``` -sudo apt-get install build-essential git gettext uncrustify python3-pip -sudo apt-get install python3-setuptools cmake ninja-build ccache libffi-dev libssl-dev dfu-util libusb-1.0-0 -sudo pip3 install cascadetoml -sudo apt-get install gcc-arm-none-eabi -``` - -This should allow you to check out the source code for circuitpython as a user. As per their suggestions I forked the repo first. - -``` -git clone git@github.com:suspect-devices/circuitpython.git -cd circuitpython/ -git submodule sync --quiet --recursive -git submodule update --init -``` -Once there you can install further dependencies. - -``` -sudo pip3 install -r requirements-dev.txt -sudo make -C mpy-cross -``` -At which point you can build firmware for most targets. - -``` -cd ports/raspberrypi/ -make BOARD=adafruit_feather_rp2040 -cd build-adafruit_feather_rp2040/ -``` -#### Adding the Espressif toolchain and idf - -``` -cd /home/feurig/circuitpython/ports/esp32s2# -sudo esp-idf/install.sh -``` - - -### First attempt. -On my first attemp I was only interested in building for the esp32s2. I ran everything as root including the builds. It is better to separate privilages with anything this large where you are building for a different target. - -``` -root@viva:# apt-get install git wget flex bison gperf python3 python3-pip python3-setuptools cmake ninja-build ccache libffi-dev libssl-dev dfu-util libusb-1.0-0 -... -root@viva:/home/feurig# mkdir -p ~/esp -root@viva:/home/feurig# cd ~/esp -root@viva:~/esp# git clone --recursive https://github.com/espressif/esp-idf.git -Cloning into 'esp-idf'... -... -root@viva:~/esp# cd esp-idf/ -root@viva:~/esp/esp-idf# ./install.sh -... -All done! You can now run: - - . ./export.sh - -root@viva:~/esp/esp-idf# . ./export.sh -... -root@viva:~# cd /home/feurig/circuitpython/ -root@viva:/home/feurig/circuitpython# cd ports/ -root@viva:/home/feurig/circuitpython/ports# cd esp32s2/ -root@viva:/home/feurig/circuitpython/ports/esp32s2# make BOARD=unexpectedmaker_feathers2 -... -Wrote 2601984 bytes to build-unexpectedmaker_feathers2/firmware.uf2 -root@viva:/home/feurig/circuitpython/ports/esp32s2# - -``` -Then as a comparison I built for the adafruit feather rp2040. - -``` -root@viva:/home/feurig/circuitpython/ports# cd raspberrypi/ -root@viva:/home/feurig/circuitpython/ports/raspberrypi# ls boards/ -adafruit_feather_rp2040 pimoroni_keybow2040 raspberry_pi_pico -adafruit_itsybitsy_rp2040 pimoroni_picosystem sparkfun_pro_micro_rp2040 -adafruit_qtpy_rp2040 pimoroni_tiny2040 sparkfun_thing_plus_rp2040 -root@viva:/home/feurig/circuitpython/ports/raspberrypi# make BOARD=adafruit_feather_rp2040 -Use make V=1, make V=2 or set BUILD_VERBOSE similarly in your environment to increase build verbosity. -QSTR updated -Traceback (most recent call last): - File "gen_stage2.py", line 2, in <module> - import cascadetoml -ModuleNotFoundError: No module named 'cascadetoml' -root@viva:/home/feurig/circuitpython/ports/raspberrypi# pip3 install cascadetoml -... -root@viva:/home/feurig/circuitpython/ports/raspberrypi# make BOARD=adafruit_feather_rp2040 -... -Wrote 1259520 bytes to build-adafruit_feather_rp2040/firmware.uf2 -root@viva:/home/feurig/circuitpython/ports/raspberrypi# -```
\ No newline at end of file diff --git a/docs/buildnotes/FreeBSDOnLXD4.md b/docs/buildnotes/FreeBSDOnLXD4.md deleted file mode 100644 index e9fa82b..0000000 --- a/docs/buildnotes/FreeBSDOnLXD4.md +++ /dev/null @@ -1,221 +0,0 @@ -#FreeBSD on lxd -LXD 4.0 allows for the creation of VM's based on qemu. This allows us to create "virtual machines" capable of running non linux operating systems such as FreeBSD (or god forbid WindBlows). So let's look at adding a freebsd 12.3 box to our setup. - -## Create an empty vm. -Based on the examples I was able to find we start by creating an empty vm and then tweek on a few of the parameters (raw.apparmor and raw.qemu). While there i adjust the nic (I am sure that all of this could be done on the init line). After that it's pretty straight forward. - -``` -root@bs2020:/home/feurig# lxc init henry --empty --vm -c limits.cpu=4 -c limits.memory=4GB -c security.secureboot=false -n br0 -Creating henry -root@bs2020:/home/feurig# lxc config device add henry install disk source=/home/feurig/FreeBSD-12.2-RELEASE-amd64-dvd1.iso -Device install added to henry -root@bs2020:/home/feurig# lxc config edit henry -architecture: x86_64 -config: - limits.cpu: "4" - limits.memory: 4GB - security.secureboot: "false" - ## tweek apparmor/qemu settings - raw.apparmor: /home/feurig/** rwk, - raw.qemu: -boot menu=on -machine pc-q35-2.6 - volatile.apply_template: create - volatile.br0.hwaddr: 00:16:3e:ab:07:4e - volatile.eth0.hwaddr: 00:16:3e:87:3c:b1 -devices: - eth0: - nictype: bridged - parent: br0 - type: nic -ephemeral: false -profiles: -- default -stateful: false -description: "FreeBSD 12.3 test box" -root@bs2020:/home/feurig# lxc start henry --console - ______ ____ _____ _____ - | ____| | _ \ / ____| __ \ - | |___ _ __ ___ ___ | |_) | (___ | | | | - | ___| '__/ _ \/ _ \| _ < \___ \| | | | - | | | | | __/ __/| |_) |____) | |__| | - | | | | | | || | | | - |_| |_| \___|\___||____/|_____/|_____/ - ``` ` - ????????????Welcome to FreeBSD????????????? s` `.....---.......--.``` -/ - ? ? +o .--` /y:` +. - ? 1. Boot Multi user [Enter] ? yo`:. :o `+- - ? 2. Boot Single user ? y/ -/` -o/ - ? 3. Escape to loader prompt ? .- ::/sy+:. - ? 4. Reboot ? / `-- / - ? 5. Cons: Serial ? `: :` - ? ? `: :` - ? Options: ? / / - ? 6. Kernel: default/kernel (1 of 1) ? .- -. - ? 7. Boot Options ? -- -. - ? ? `:` `:` - ? ? .-- `--. - ??????????????????????????????????????????? .---.....----. - -``` -I found that, on at least one of my servers, the console would not come up with the dual "Cons:" setting. Serial worked just fine. - -## Next Steps (sudo, ssh, hardening, usw) - -In order to have the server play well with our environment I install the following packages using pkg (sudo, nano, bash, bash-completion, python37) as well as manually adding admin users. At some point it would be nice to use cloud-init or if that is unworkable ansible for the initial configuration. - -```. -[root@henry /usr/home/feurig]# pkg info -bash-5.1.4_1 GNU Project's Bourne Again SHell -bash-completion-2.11,2 Programmable completion library for Bash -gettext-runtime-0.21 GNU gettext runtime libraries and programs -indexinfo-0.3.1 Utility to regenerate the GNU info page index -libffi-3.3_1 Foreign Function Interface -nano-5.5 Nano's ANOther editor, an enhanced free Pico clone -pkg-1.16.3 Package manager -py37-pip-20.2.3 Tool for installing and managing Python packages -py37-setuptools-44.0.0 Python packages installer -python37-3.7.10 Interpreted object-oriented programming language -readline-8.1.0 Library for editing command lines as they are typed -sudo-1.9.6p1 Allow others to run commands as root -``` -Nano and bash are a personal preference of mine. - -``` -feurig@henry:~ $ sudo bash -Password: -[root@henry /usr/home/feurig]# chpass -s /usr/local/bin/bash feurig -[root@henry /usr/home/feurig]# chpass -s /usr/local/bin/bash joe - -``` - -## Setting up Ansible on BSD - -In addition to installing python ssh and an admin user needs to be set up as lxd does not "lxc exec" directly to virtual machines. - -``` -[root@henry /usr/home/feurig]# visudo -... comment out this - # root ALL=(ALL) ALL -... and uncomment out this -%wheel ALL=(ALL) ALL -... -[root@henry /usr/home/feurig]# adduser ansible -... add ansible to wheel group ... -[root@henry /usr/home/feurig]# su - ansible -ansible@henry:~ $ssh-keygen -ansible@henry:~ $cat >> .ssh/authorized_keys -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCssxhi6P1Ssin8QjEMlm+9W1L5ncRqejnw78z/yhQLwCU2av3+vAzPFDKi7CTm2iqeRoNYsKx4IaNYK9t+zQ0OsEXjzIzS+uCNODbNaW4pMtaHcwsaYDCdG9OiXuFa7qWndDAvSJjXQR6t1pygdw/tdbsGN0//zq71j9ChitXJQUr0YYCYwa4MaB6Srn/Zpkhfut1OP56XMo15F+0YD+oS/IqJp/QTH6Q9LzVh+HKI9rdhDEqEsrNZsaQw6UZ8JrfRYmJWzcFlqztv2qBv/BdStWbJGMBDTDNOSqf9wkts43lkZGYgSyZo80NLmq4oXJanuNO0wOBeRtMyX+HUEmgh root@kb2018 -<ctrl-D> -``` - -Adding the become password to the ansible servers vault is described [here](https://www.digithink.com/buildnotes/ansible/ServerInstall/) - -## Adding an update.sh script. -### The field expedient way - -For quick and dirty's sake we add the following to /usr/local/bin/update.sh which could easily be added to the generalized shell since we have decided that bash is ok. It also might be ok to check if a reboot is necissary. - -``` -[root@henry /usr/home/feurig]# cat /usr/local/bin/update.sh -#!/bin/sh -freebsd-update fetch install -pkg upgrade -``` -And then life is good and our new pets are equally loved. (including the centos 7 result for sag) - -``` -root@kb2018:/etc/ansible/python# ansible pets -m raw -a "update.sh" -shelly | CHANGED | rc=0 >> -... -henry | CHANGED | rc=0 >> - -src component not installed, skipped -Looking up update.FreeBSD.org mirrors... 2 mirrors found. -Fetching metadata signature for 12.2-RELEASE from update1.freebsd.org... done. -Fetching metadata index... done. -Inspecting system... done. -Preparing to download files... done. - -No updates needed to update system to 12.2-RELEASE-p8. -No updates are available to install. -Updating FreeBSD repository catalogue... -FreeBSD repository is up to date. -All repositories are up to date. -Checking for upgrades (1 candidates): 100% -Processing candidates (1 candidates): 100% -Checking integrity... done (0 conflicting) -Your packages are up to date. -Shared connection to henry closed. - -keynes | CHANGED | rc=0 >> ---------------------- begin updating keynes ---------------------- -yum upgrade. -Loaded plugins: fastestmirror -Loading mirror speeds from cached hostfile - * base: mirrors.cat.pdx.edu - * extras: mirror.web-ster.com - * updates: mirror.keystealth.org -No packages marked for update -========================== done ============================== -Failed to set locale, defaulting to C -... -naomi | CHANGED | rc=0 >> ---------------------- begin updating naomi ---------------------- -Get:1 http://security.ubuntu.com/ubuntu bionic-security InRelease [88.7 kB] -Hit:2 http://archive.ubuntu.com/ubuntu bionic InRelease -``` - -### Making it right. -Once we make peace with installing/enforcing bash on a freebsd box then we can add the freebsd update to our multi platform [update.sh](https://bitbucket.org/suspectdevicesadmin/ansible/src/master/files/update.sh) (again someday deployed by lxd/cloud-init). - -``` -[root@henry /usr/home/feurig]# ln -s /usr/local/bin/bash /bin/ -[root@henry /usr/home/feurig]# nano /usr/local/bin/update.sh -#!/bin/bash -# update.sh for debian/ubuntu/centos/suse/freebsd/pihole -# https://bitbucket.org/suspectdevicesadmin/ansible/src/master/files/update.sh -# (copyleft 2021) don@suspecdevices.com -echo --------------------- begin updating `uname -n` ---------------------- -if [ -x "$(command -v apt-get)" ]; then - echo Updating system - apt-get update - apt-get -y dist-upgrade - apt-get -y autoremove -fi -if [ -x "$(command -v yum)" ]; then - echo yum upgrade. - yum -y upgrade -fi -if [ -x "$(command -v pihole)" ]; then - echo Updating pihole. - pihole -up -fi -if [ -x "$(command -v zypper)" ]; then - echo zypper dist-upgrade. - zypper -y dist-upgrade -fi -if [ -x "$(command -v freebsd-update)" ]; then - echo Updating freebsd base - freebsd-update fetch install - echo Updating freebsd packages - pkg upgrade -fi -echo ========================== done ============================== -``` - -## To do. -* Look at restricting ansibles ssh access to hosts on the admin lan (as is done for bs2020). -* Add virtual machines to nightly backups (currently only containers). - -``` -root@kb2018:/# lxc snapshot henry 2021-06-05 -root@kb2018:/# lxc move henry/2021-06-05 bs2020:Spare-henry-2021-06-05 -root@kb2018:/# lxc stop bs2020:Spare-henry-2021-06-05 -Error: The instance is already stopped -``` - -### Linkdump. - -* [https://forum.netgate.com/topic/154906/how-to-install-pfsense-on-lxc-vm-qemu](https://forum.netgate.com/topic/154906/how-to-install-pfsense-on-lxc-vm-qemu) -* [https://discuss.linuxcontainers.org/t/lxc-vm-running-freebsd-cant-see-hard-disk/8214/14](https://discuss.linuxcontainers.org/t/lxc-vm-running-freebsd-cant-see-hard-disk/8214/14) -* [https://download.freebsd.org/ftp/releases/ISO-IMAGES/12.2/FreeBSD-12.2-RELEASE-amd64-dvd1.iso](https://download.freebsd.org/ftp/releases/ISO-IMAGES/12.2/FreeBSD-12.2-RELEASE-amd64-dvd1.iso) -* [https://docs.freebsd.org/en/books/handbook/bsdinstall/#bsdinstall-start](https://docs.freebsd.org/en/books/handbook/bsdinstall/#bsdinstall-start)
\ No newline at end of file diff --git a/docs/buildnotes/RockyLinuxLXDHost/README.md b/docs/buildnotes/RockyLinuxLXDHost/README.md deleted file mode 100644 index 4e053ca..0000000 --- a/docs/buildnotes/RockyLinuxLXDHost/README.md +++ /dev/null @@ -1,84 +0,0 @@ -# <DEL>Rocky Linux 8.4</DEL> *Ubuntu 21.04 (Hirsute Hippo)* LXD host. (*orignal* AOC2024 install *notes*) - -*I had hoped that the new community supported downstream operating system based on Red Hats Enterprize Linux could take my work out of the nightmare of FC26 and Centos7. Since they run Dell Hardware, some of which is as old as our server hardware I thought it was an opportunity to test it as way forward. It failed miserably. But better to fail here where we aren't taking others with us and in ways that make us see the errors in our way.* - -* The original text in this document is plain text. -* <del>Where the text is no longer relevant its struck through. -* *Corrections are in italics* -* The new document for the server build will be at [https://www.digithink.com/buildnotes/LXD-snapshot-host/](https://www.digithink.com/buildnotes/LXD-snapshot-host/) - - -While bs2020 the candiate and kb2018 our Governer have served us well for the last few years its time for something new. Something community sourced, smart, and revolutionary. AOC2024 - - -If Ubuntu's adoption of LXD and ZFS and other innovations are to mean anything they have to be separated from both debian (it's technical underpinnings) and Canonical (it's obnoxiously "freindly" commercial counterpart) or we will be captive to its "charms"[(1)](#fn1). Meanwhile, the rpm based world has been completely paralized by Redhat's inability or unwillingness to provide a downstream open source project to use as a standard. This has created the disaster that is fedora 2x and the longest currently supported linux operating system ever (Centos 7 at a proposed 12 years). Redhat's choice to ditch Centos 8 and use the open source community to beta test their new features can not be described politely [(2)](#fn2). - -It <del>is</del>*was* our intention to support the community as it tells Redhat where to go while insuring that Debian and Ubuntu's innovations do not go to waste. Therefore, our new server <del>will run Rocky Linux</del> *would have run Rocky Linux but because bug for bug means that it won't run on 10 year old enterprise class hardware, it will run the latest Ubuntu server release* to create a robust and flexible server which will compliment the work done by our Ubuntu LTS based server. - -## *Original* goals. - -* <del>Take advantage of Rocky Linux's downstream *bug for bug* compatibility with RHEL8</del> - - * Dell's support for its hardware is limited to commercial operating systems. Attempting to get their tools (raid, idrac, configuration etc) wedged into ubuntu is like needing a root canal. *Apparently, in RHEL 8, Redhat and Dell only support what they are currently selling.* - -* Use the tools that Ubuntu/Canonical has been supporting for virtualization. - - * LXD for both VMs and lxc based containers. - * zfs, cause it rules. - -* Leave our comfort zones. - - * And still do production quality work. - -* <del>[heterogeneity](https://www.merriam-webster.com/dictionary/heterogeneity).</del>*Fail...[(4)](#fn4)* - -## Minimal Viable Product. -In our environment, Bernie's primary function has been to provide a fallback to Kate's solid work. It has been our playground and our backup server. At a minimum the new server needs to provide an LXD server to test and backup our production containers and virtual machines. As a refence <del>we will</del>*tried to* start at [Rocky Linux's LXD server guide](https://docs.rockylinux.org/guides/lxd_server/). - -### The <del>original</del>*revised* plan. - -There are several factors that <del>we won't be able to</del>*couldn't have* consider*ed* until we <del>are</del>*were* actually on the box. Like whether or not <del>the ssd's will work well with the old raid controller. </del> -*The installer will find the disks presented by the raid controller. -The SSDs were fine, however Rocky is aptly named..* - -1. Export images for ernest and the vm's teddy, and franklin. -2. Pull archive disk and mount it's replacement on kb2018. -3. Move teddy(dns2) to kb2018 -4. Pull the existing disks from bs2020. -5. Put the ssds into the first two bays and configure the perc to make a single mirrored disk -6. <del> Install rocky linux 8.4 from an iso a dvd or a thumb drive.</del> *Install newest ubuntu release 21.04 (Hirsute Hippo)* -7. BLDGP[(3)](#fn3) at <del>[https://docs.rockylinux.org/guides/lxd_server/](https://docs.rockylinux.org/guides/lxd_server/)</del> *[the notes from the last lxd server we built](https://www.digithink.com/buildnotes/edge-server-configuration/) combined with [a document that I havent written yet](https://www.digithink.com/buildnotes/LXD-snapshot-host/)* -8. Configure/test disks, lxd, and networking. -9. Copy profiles and images from kb2018 -10. Add and configure ansible. -11. Migrate teddy to its new home. - -### What actually happened. -1. We exported the images and the lxd configuration to the archive disk as described in [ticket: #79](https://serverdocs.suspectdevices.com/serverdocs/ticket/79) -2. We unmounted the archive disk. -3. We shutdown teddy and moved the container to kb2018 -4. We pulled and labled all of the disks on bs2020 -5. We installed two new 240G SSDs and two new 1TB 10K disks and configured the raid controller to make a raid 1 mirror of the ssds. (the bigger disks will be handled by zfs). -6. We attempted for several hours to install rocky linux 8.4 on the system but could not get the operating system to recognize any installable disks. So, knowing that we would need to adapt whatever changes Ubuntu threw at us in the spring, we installed the newest server release *[21.04 (Hirsute Hippo)](http://www.releases.ubuntu.com/21.04/)* -7. We updated and installed the prerequisites for lxd/w zfs. -8. We configured the network and disks needed to restore the lxd configuration. -9. We restored the lxd configuration from the archive disk. -10. We moved teddy back to the new lxd configuration. -11. We restored the spare containers from the archive disk. -12. Pulled the archive disk off sight. - -### Todo: -1. Configure ansible on the new server [Ticket #81](https://serverdocs.suspectdevices.com/serverdocs/ticket/81) -2. Update backup scripts to reference new server.[Ticket #82](https://serverdocs.suspectdevices.com/serverdocs/ticket/82) -3. Make backup scripts work with vms [Ticket #58](https://serverdocs.suspectdevices.com/serverdocs/ticket/58) -4. Script archives to create new off site rotating disk.[Ticket #83](https://serverdocs.suspectdevices.com/serverdocs/ticket/83#ticket) - -### References -* https://fatmin.com/2019/11/23/installing-rhel-8-1-on-dell-r710-r610-with-h700-raid-controller/ -* https://docs.rockylinux.org/guides/lxd_server/ - -### Footnotes / Sarcasms -1. <a name=fn1></a>Snaps? Juju? Really???? -2. <a name=fn2></a>See: [trumpery](https://www.lexico.com/en/definition/trumpery) -3. <a name=fn3></a>BLDGP/BLGDP = "Build it Like the Dad Gummed Plans". This is a reference to a 70s American Aircraft Modeler editorial on people building tri-planes out of plans for bi-planes and then wondering why they don't fly. -4. *<a name=fn4></a>Although thanks to LXD4 we are running Rocky Linux 8.4, along with Centos 7 and Freebsd. So failure is relative.* diff --git a/docs/buildnotes/gitea-configuration/README.md b/docs/buildnotes/gitea-configuration/README.md deleted file mode 100644 index 6ee2527..0000000 --- a/docs/buildnotes/gitea-configuration/README.md +++ /dev/null @@ -1,149 +0,0 @@ -# gitea-configuration -(Build notes for getea server.) - -Master Copy: [https://github.com/feurig/gitea-configuration/blob/main/README.md](https://github.com/feurig/gitea-configuration/blob/main/README.md) - -Gitea is a github like environment written in go. It provides git in an accessable form and allows you to create issues and write wiki pages like redmine and trac while also serving those repositories. - -It is less convoluted than gitlab but more configurable than GCOS which it is based on. - - -## Server Setup -### Installing pre-requisites - -We are building on a ubuntu/focal/cloud (from lxc's images) container with preseeded admin accounts. - -``` -apt-get -y install curl postgresql apache2 git -apt-get install postfix -... add as a Satelite (null client) ... -``` -We want to use a single git user so we add it (will deal with this later) - -``` -adduser --system --shell /bin/bash --group --disabled-password --home /home/git git -``` -We are going to use the package provided by packaging.gitlab.io - -``` -curl -sL -o /etc/apt/trusted.gpg.d/morph027-gitea.asc https://packaging.gitlab.io/gitea/gpg.key -deb [trusted=yes arch=amd64] https://packaging.gitlab.io/gitea gitea main" | sudo tee /etc/apt/sources.list.d/morph027-gitea.list -update.sh -apt-get install gitea -``` -### Setting up postgresql database -``` -su - postgres -postgres@shelly:~$ createuser -P git -... add passwd -postgres@shelly:~$ createdb gitea -O git -``` -### Initial configuration -Once gitea is installed go to myservername:3000 and navigate to the login in the upper right corner. Fill in the database,username, and dbpassword. Replace localhost with your servers fqdn. Create admin user (remember password here) - -## Testing it out. -The first thing we want to do here is to mirror our github repositories. - -### Mirroring Github Repositories. -We want to automate mirroring all of our repositories hosted on github (and bitbucket at some point). To do this we create a personal-access-token from our github developer tools. (save the token somewhere as it will not be recoverable). Once we have that token we select New migration. Fill in the https://github.com/myuser/myrepo and paste the token into the form, select mirror and the magic begins. - -### Editing the mirror interval -The default mirror interval is 8 hours with a minimum of 10 minutes. -To fix this we add the following to /etc/gitea/app.ini - -``` -nano /etc/gitea.app.ini -... -[cron.update_mirrors] -SCHEDULE = @every 2m - -[mirror] -DEFAULT_INTERVAL = 1h -MIN_INTERVAL = 2m -... -service gitea restart -``` - -### Automating creation of mirrors (github). -We were able to automate mirroring our github repos with the help of some python provided by jpmens.net we modified it to allow us to separate local mirrors by the same organizations used by github though this required us to manually add the local users and organizations. The script in progress is here. - -[https://github.com/feurig/gitea-configuration/blob/main/mirror-repos.py](https://github.com/feurig/gitea-configuration/blob/main/mirror-repos.py) - -#### Manually migrating bitbucket mirrors. -Like github mirroring bitbucket repositories required the creation of an application password. Then add a new "Git" migration using the application password as your credentials. - -## Setting up ssl and apache proxy. -Gitea runs as an unprivilaged user on port 3000. To present it as a normal web server required a proxy server (apache). Since we had created letsEncrypt certificates for the old git server we moved them. There are still permissions issues with giving gitea access to the certificates which were worked around by copying the files. - -Getting apache to proxy the https required enabling 'proxy\_http2' and 'proxy' module (not 'proxy\_http') - -``` -a2enmod proxy proxy_http2 -``` -* Gitea configuration [etc/gitea/app.ini](https://github.com/feurig/gitea-configuration/blob/main/etc/gitea/app.ini) -* Apache configuration [etc/apache2/sites-avaliable/gitea.conf](https://github.com/feurig/gitea-configuration/blob/main/etc/apache2/sites-avaliable/gitea.conf) - -### Manually updating LetsEncrypt certificates. -Gitea serves static content under the public/custom directory. In order to update the lets encrypt certificates you will need to open two shells into the git server. - -In the first window initiate the update request. - -``` -certbot certonly --manual -Saving debug log to /var/log/letsencrypt/letsencrypt.log -Plugins selected: Authenticator manual, Installer None -Account registered. -Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' -to cancel): git.suspectdevices.com -Generating a certificate request for git.suspectdevices.com -Performing the following challenges: -http-01 challenge for git.suspectdevices.com - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Create a file containing just this data: - -loIND53_1yZLSZX1lKkLqhCBY7YhNo_vzdyrEznXHSQ.MQ0FIIV4g1TA8EJatJpiciDipeqHIMHJsetBrs2tzqM - -And make it available on your web server at this URL: - -http://git.suspectdevices.com/.well-known/acme-challenge/loIND53_1yZLSZX1lKkLqhCBY7YhNo_vzdyrEznXHSQ - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Press Enter to Continue -``` - -In the second window create the file requested file. - -``` -root@shelly:/var/lib/gitea# cd public/custom/ -root@shelly:/var/lib/gitea/public/custom# echo loIND53_1yZLSZX1lKkLqhCBY7YhNo_vzdyrEznXHSQ.MQ0FIIV4g1TA8EJatJpiciDipeqHIMHJsetBrs2tzqM >.well-known/acme-challenge/loIND53_1yZLSZX1lKkLqhCBY7YhNo_vzdyrEznXHSQ -root@shelly:/var/lib/gitea/public/custom# chown -R gitea:gitea . - -``` -Then continue in the first window and copy the new keys to where gitea expects them. - -``` -Press Enter to Continue -... when finished copy the new certs to gitea ... -cd /etc/letsencrypt/live/git.suspectdevices.com/ -cp fullchain.pem privkey.pem /var/lib/gitea/keys/ -chown -R gitea:gitea /var/lib/gitea/keys/ -reboot -``` - -### Todo (No Major Issues) -* Document making gitea less ugly (add Susdev brand look and feel) -* Fix permission issues with certificate issues to allow for autorenewal if possible. -* Consider normalizing git user and repo locations. - -## references/linkdump -* [https://gitlab.com/packaging/gitea](https://gitlab.com/packaging/gitea) -* [https://bryangilbert.com/post/devops/how-to-setup-gitea-ubuntu/](https://bryangilbert.com/post/devops/how-to-setup-gitea-ubuntu/) -* [https://luxagraf.net/src/gitea-nginx-postgresql-ubuntu-1804](https://luxagraf.net/src/gitea-nginx-postgresql-ubuntu-1804) -* [https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token) -* [https://jpmens.net/2019/04/15/i-mirror-my-github-repositories-to-gitea/](https://jpmens.net/2019/04/15/i-mirror-my-github-repositories-to-gitea/) -* [https://websiteforstudents.com/how-to-install-gitea-git-server-on-ubuntu-16-04-18-04-18-10-with-mariadb/](https://websiteforstudents.com/how-to-install-gitea-git-server-on-ubuntu-16-04-18-04-18-10-with-mariadb/) -* [https://docs.gitea.io/en-us/config-cheat-sheet/](https://docs.gitea.io/en-us/config-cheat-sheet/) -* [https://charlesreid1.github.io/setting-up-a-self-hosted-github-clone-with-gitea.html](https://charlesreid1.github.io/setting-up-a-self-hosted-github-clone-with-gitea.html) -* [https://charlesreid1.com/wiki/Gitea#Using_Binary](https://charlesreid1.com/wiki/Gitea#Using_Binary) -* [https://mindefrag.net/2018/07/how-to-install-and-configure-gitea-a-self-hosted-github-like-service/](https://mindefrag.net/2018/07/how-to-install-and-configure-gitea-a-self-hosted-github-like-service/) diff --git a/docs/buildnotes/lede-config b/docs/buildnotes/lede-config deleted file mode 160000 -Subproject 659f3f3a47090e70696e84b241311c0a0041198 diff --git a/docs/buildnotes/redmine-configuration b/docs/buildnotes/redmine-configuration deleted file mode 160000 -Subproject 1e8db40ecb3b354c3e3ed377f452eded65819c4 |
