welcome: please sign in

Diff for "DomTool/Installation"

Differences between revisions 16 and 23 (spanning 7 versions)
⇤ ← Revision 16 as of 2012-12-30 20:26:42 →
Size: 3565
Editor: ClintonEbadi
Comment: clarify where you must run domtool-addcert
← Revision 23 as of 2018-04-19 02:12:01 → ⇥
Size: 3276
Editor: ClintonEbadi
Comment: i'm redundant
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
In this document, `$HOST` is equivalent to `$(hostname)` (i.e. the first part of the fqdn). <<TableOfContents>>

{{{#!wiki note
In this document, `$HOST` is equivalent to `$(hostname)` (i.e. the first part of the fqdn, e.g. `fritz` for `fritz.hcoop.net` `fritz`, we should probably switch to using the FQDN )
}}}
Line 21: Line 25:
git clone /afs/hcoop.net/user/h/hc/hcoop/.hcoop-git/domtool2.git domtool2
cd domtool2
git checkout release		 git clone -b release /afs/hcoop.net/user/h/hc/hcoop/.hcoop-git/domtool2.git domtool2
Line 31: Line 33:
You will also need to create various work directories, although the preseed for the particular install should handle that. The first time DomTool is deployed to a host, it should be done manually using `deploy-domtool-on-host --slave --bootstrap` to ensure systemd units are installed and enabled.
Line 33: Line 35:
The first time DomTool is deployed to a host, it should be done manually using `deploy-domtool-on-host --slave --bootstrap` to install the proper sysvinit files. === Work Directories ===

DomTool should create these during installation, but it does not yet (see [[https://bugzilla.hcoop.net/show_bug.cgi?id=935|Bug 935]]).

At HCoop, Puppet should automatically create them.

Domtool's scratch directory:

{{{
sudo mkdir /var/domtool
sudo chown domtool.nogroup /var/domtool
}}}

Create subdirectories of `/var/domtool` in the same way, depending on which services this slave will be managing: (incomplete)

  * bind: `/var/domtool/zones`
  * apache: `/var/domtool/vhosts` and `/var/domtool/apache2_logs`
  * firewall: `/var/domtool/firewall`
Line 44: Line 64:
 * Make Domtool's scratch directory:
{{{
sudo mkdir /var/domtool
sudo chown domtool.domtool /var/domtool
}}}
 * Create subdirectories of `/var/domtool` in the same way, depending on which services this slave will be managing. If this slave manages BIND, create `/var/domtool/zones`. If this slave manages Apache, create `/var/domtool/vhosts` and `/var/domtool/apache2_logs`.
 * If this slave manages BIND, make sure a UNIX group `bind_config` exists, as Domtool will try to `chgrp` all relevant configuration to that group. It doesn't really matter which users belong to the group, as these actions are performed as root. If the group doesn't exist, you can create it with:
{{{
sudo groupadd bind_config
}}}
Line 55: Line 65:
 * Create Domtool's log file and set the right permissions on it:
{{{
sudo touch /var/log/domtool.log
sudo chown domtool.domtool /var/log/domtool.log
}}}
Line 67: Line 73:
 * Be sure a keytab for `domtool` is in `/etc/keytabs/domtool`, with permissions set so that `domtool` can read it but random users can't.  You might copy the file from deleuze.  * Be sure a keytab for `domtool` is in `/etc/keytabs/domtool`, with permissions set so that only `domtool` can read it. This is handled by puppet automatically at hcoop.
Line 70: Line 77:
sudo /etc/init.d/domtool-slave start sudo service domtool-slave start
Line 72: Line 79:
 * After ensuring that the slave starts make the slave (or server) starts at boot  * After ensuring that the slave starts, make the slave (or server) start at boot

Contents

  1. Deploying an Update
  2. New Machine
    1. Work Directories
  3. etc.

In this document, $HOST is equivalent to $(hostname) (i.e. the first part of the fqdn, e.g. fritz for fritz.hcoop.net fritz, we should probably switch to using the FQDN )

1. Deploying an Update

Push all changes to the release branch, and tag as release_${isodate} (e.g. release_20121022 for October 22nd, 2012). If you make multiple releases in a day append -N starting with 1.

Running the deploy-domtool script will then pull, build, and install domtool sitewide.

To deploy on an individual host, use the deploy-domtool-on-host script.

2. New Machine

Ensure these Debian packages are installed: mlton libssl-dev libpcre3-dev rsync (our AutomatedSystemInstall does this for you)

Create /afs/hcoop.net/common/domtool/build/$HOST

Clone the domtool2 repository and checkout release: 

cd /afs/hcoop.net/common/domtool/build/$HOST
git clone -b release /afs/hcoop.net/user/h/hc/hcoop/.hcoop-git/domtool2.git domtool2

If a slave (the usual setup):

  • Add node to HOSTS_SLAVE (unless it is the new master) variable deploy-domtool script. Afterward the general deployment procedure should work.

  • Create the needed SSL certificate for the node by running (on the machine with the domtool certificate authority): domtool-addcert $HOST

The first time DomTool is deployed to a host, it should be done manually using deploy-domtool-on-host --slave --bootstrap to ensure systemd units are installed and enabled.

2.1. Work Directories

DomTool should create these during installation, but it does not yet (see Bug 935).

At HCoop, Puppet should automatically create them.

Domtool's scratch directory: 

sudo mkdir /var/domtool
sudo chown domtool.nogroup /var/domtool

Create subdirectories of /var/domtool in the same way, depending on which services this slave will be managing: (incomplete)

  • bind: /var/domtool/zones

  • apache: /var/domtool/vhosts and /var/domtool/apache2_logs

  • firewall: /var/domtool/firewall

3. etc.

  • To make everyone's Emacs autoload domtool-mode by default, put this in /usr/local/share/emacs/site-lisp/default.el: 

(add-to-list 'load-path "/usr/local/share/emacs/site-lisp/domtool-mode")
(require 'domtool-mode-startup)

  • If this slave manages BIND, make sure that the directory /etc/bind/zones exists.

  • Configure Certifications and keys

    • If setting up the disptacher possibly set up local CA and SSL, and certificate for a node as said on DomTool/SslProcedures, and manually copy the certificate and key into the right places:

      mkdir ~domtool/keys/$HOST
cp serverkey.pem ~domtool/keys/$HOST/key.pem
cp servercert.pem ~domtool/certs/$HOST.pem

  • Be sure a keytab for domtool is in /etc/keytabs/domtool, with permissions set so that only domtool can read it. This is handled by puppet automatically at hcoop.

  • Try starting the slave server: 

sudo service domtool-slave start
  • After ensuring that the slave starts, make the slave (or server) start at boot 

sudo insserv domtool-slave

CategorySystemAdministration CategoryNeedsWork

DomTool/Installation (last edited 2018-04-19 02:12:01 by ClintonEbadi)