# Server: ararat test VPS

## Usage

For now this server doesn't host any production services.

## Maintainers

- missytake@systemli.org

## Domain Settings

It doesn't have a domain pointing to it yet.

## Hosting

For now, the VPS is hosted in missytake's personal hetzner account.
Ask them if you need something.

## Deployment

To deploy the server, run

```
pyinfra --yes inventory.py ararat/deploy.py --limit 95.217.163.200
```

You also need to run this after every reboot,
to decrypt the encrypted volume
and start the libvirt VMs.

## Services

### Service: kvm / libvirt

This is a KVM hypervisor,
which allows managing VMs with libvirt.

You can use libvirt through the `virsh` command line tool.
e.g. you can login via SSH as root
and run `virsh list` to see running VMs.

#### Monitoring

It doesn't really need monitoring for now.

#### Deployment

The service is part of the pyinfra deploy.py file;
you can deploy it with
`pyinfra --yes inventory.py ararat/deploy.py --limit 95.217.163.200`.

#### Upgrade Strategy

As long as it is a test deployment,
we don't need to upgrade it regularly.

## Users

There is only the root user,
the SSH keys of missytake, hagi, and vmann are deployed via pyinfra.

## Upgrade Strategy

To upgrade the packages,
you need to login via SSH and run `apk update && apk upgrade`.

## Backup and Restore

As long as it is a test deployment,
we don't need backups.


# Changelog

## 2024-12-02 Set up alpine VPS on hetzner

This was only tested with a cloud VPS so far.
Source: <https://gist.github.com/c0m4r/e38d41d0e31f6adda4b4c5a88ba0a453>
(but it's less of a hassle than described there)

To create an alpine server on hetzner,
you need to first create a Debian VPS or something similar.

Then you boot into the rescue system.

Get the download link of the latest VIRTUAL x86_64 alpine iso
from <https://alpinelinux.org/downloads/>.

Login to the rescue system via console or SSH,
and write the ISO to the disk:

```
ssh root@xxxx:xxxx:xxxx:xxxx::1
wipefs -a /dev/sda
wget https://dl-cdn.alpinelinux.org/alpine/v3.20/releases/x86_64/alpine-virt-3.20.3-x86_64.iso  # or whatever link you got from alpine
dd if=alpine-virt-3.20.3-x86_64.iso of=/dev/sda
reboot
```

Then open the server console (SSH doesn't work),
login to root (no password required),
and proceed with:

```
cp -r /.modloop /root
cp -r /media/sda /root
umount /.modloop /media/sda
rm /lib/modules
mv /root/.modloop/modules /lib
mv /root/sda /media
setup-alpine
```

Then select what you wish,
contrary to the guide above,
DHCP is actually fine.
The drive should be sda,
the installation type can be sys
(why go through the hassle).

Voilà! reboot and login.
Probably the first SSH login will be via root password,
as copy-pasting your public SSH key into the console doesn't work really.
Make sure the SSH config allows this
(and turn passwort root access off afterwards).


## 2024-12-02 Encrypting /var/lib/libvirt partition

**Status: tested with Hetzner VPS, not deployed in production yet**

Messing with file systems and partitions
should not be done by automation scripts,
so I created the LUKS-encrypted /dev/sdb partition manually.

(So far, /dev/sdb was added via a Hetzner volume,
but it can be any partition actually)

To create a partition in the VPS volume
(which was formatted to ext4 originally),
- I ran `fdisk /dev/sdb`,
- entered `o` to create a DOS partition table,
- added `n` to add a new primary partition, using all available space,
- and `w` to save to disk and exit.

Then I ran `cryptsetup luksFormat /dev/sdb1`
and entered the passphrase from `pass 0x90/ararat/sdb-crypt`
to create a LUKS volume.

Now I could decrypt the new volume with
`cryptsetup luksOpen /dev/sdb1 sdb_crypt`
and entering the passphrase from `pass 0x90/ararat/sdb-crypt`.

Finally, I ran `mkfs.ext4`
to create an ext4 file system
in the encrypted partition.