0x90-pyinfra/ararat/README.md

Server: ararat test VPS

Usage

For now this server doesn't host any production services.

Maintainers

• missytake@systemli.org

Domain Settings

It doesn't have a domain pointing to it yet.

Hosting

For now, the VPS is hosted in missytake's personal hetzner account. Ask them if you need something.

Deployment

To deploy the server, run

pyinfra --yes inventory.py ararat/deploy.py --limit 95.217.163.200

You also need to run this after every reboot, to decrypt the encrypted volume and start the libvirt VMs.

Services

Service: kvm / libvirt

This is a KVM hypervisor, which allows managing VMs with libvirt.

You can use libvirt through the virsh command line tool. e.g. you can login via SSH as root and run virsh list to see running VMs.

Monitoring

It doesn't really need monitoring for now.

Deployment

The service is part of the pyinfra deploy.py file; you can deploy it with pyinfra --yes inventory.py ararat/deploy.py --limit 95.217.163.200.

Upgrade Strategy

As long as it is a test deployment, we don't need to upgrade it regularly.

Users

There is only the root user, the SSH keys of missytake, hagi, and vmann are deployed via pyinfra.

Upgrade Strategy

To upgrade the packages, you need to login via SSH and run apk update && apk upgrade.

Backup and Restore

As long as it is a test deployment, we don't need backups.

Changelog

2024-12-02 Set up alpine VPS on hetzner

This was only tested with a cloud VPS so far. Source: https://gist.github.com/c0m4r/e38d41d0e31f6adda4b4c5a88ba0a453 (but it's less of a hassle than described there)

To create an alpine server on hetzner, you need to first create a Debian VPS or something similar.

Then you boot into the rescue system.

Get the download link of the latest VIRTUAL x86_64 alpine iso from https://alpinelinux.org/downloads/.

Login to the rescue system via console or SSH, and write the ISO to the disk:

ssh root@xxxx:xxxx:xxxx:xxxx::1
wipefs -a /dev/sda
wget https://dl-cdn.alpinelinux.org/alpine/v3.20/releases/x86_64/alpine-virt-3.20.3-x86_64.iso  # or whatever link you got from alpine
dd if=alpine-virt-3.20.3-x86_64.iso of=/dev/sda
reboot

Then open the server console (SSH doesn't work), login to root (no password required), and proceed with:

cp -r /.modloop /root
cp -r /media/sda /root
umount /.modloop /media/sda
rm /lib/modules
mv /root/.modloop/modules /lib
mv /root/sda /media
setup-alpine

Then select what you wish, contrary to the guide above, DHCP is actually fine. The drive should be sda, the installation type can be sys (why go through the hassle).

Voilà! reboot and login. Probably the first SSH login will be via root password, as copy-pasting your public SSH key into the console doesn't work really. Make sure the SSH config allows this (and turn passwort root access off afterwards).

2024-12-02 Encrypting /var/lib/libvirt partition

Status: tested with Hetzner VPS, not deployed in production yet

Messing with file systems and partitions should not be done by automation scripts, so I created the LUKS-encrypted /dev/sdb partition manually.

(So far, /dev/sdb was added via a Hetzner volume, but it can be any partition actually)

To create a partition in the VPS volume (which was formatted to ext4 originally),

• I ran fdisk /dev/sdb,
• entered o to create a DOS partition table,
• added n to add a new primary partition, using all available space,
• and w to save to disk and exit.

Then I ran cryptsetup luksFormat /dev/sdb1 and entered the passphrase from pass 0x90/ararat/sdb-crypt to create a LUKS volume.

Now I could decrypt the new volume with cryptsetup luksOpen /dev/sdb1 sdb_crypt and entering the passphrase from pass 0x90/ararat/sdb-crypt.

Finally, I ran mkfs.ext4 to create an ext4 file system in the encrypted partition.