scripts/README.md aktualisiert
This commit is contained in:
+265
-69
@@ -35,31 +35,45 @@ Debian / Ubuntu basiertes Linux
|
||||
Netzwerkzugriff auf den Gitea-Server
|
||||
SSH-Key in Gitea hinterlegt
|
||||
Git installiert
|
||||
|
||||
## Optional
|
||||
Docker + Docker Compose
|
||||
WireGuard VPN
|
||||
SSH-Key vorbereiten
|
||||
SSH-Key erzeugen
|
||||
|
||||
# SSH-Key vorbereiten
|
||||
## SSH-Key erzeugen
|
||||
```
|
||||
ssh-keygen -t ed25519
|
||||
Public Key anzeigen
|
||||
```
|
||||
## Public Key anzeigen
|
||||
```
|
||||
cat ~/.ssh/id_ed25519.pub
|
||||
Key in Gitea hinzufügen
|
||||
```
|
||||
## Key in Gitea hinzufügen
|
||||
|
||||
Gitea:
|
||||
|
||||
Profil
|
||||
Settings
|
||||
SSH Keys
|
||||
Add Key
|
||||
Git installieren
|
||||
Profil -> Settings -> SSH Keys -> Add Key
|
||||
|
||||
---
|
||||
|
||||
# Git installieren
|
||||
```
|
||||
sudo apt update
|
||||
sudo apt install git -y
|
||||
Repository klonen
|
||||
Standard
|
||||
```
|
||||
---
|
||||
|
||||
# Repository klonen
|
||||
## Standard
|
||||
```
|
||||
sudo mkdir -p /opt/pingu
|
||||
sudo chown -R $USER:$USER /opt/pingu
|
||||
git clone ssh://git@10.200.200.2:2222/kai/pingu-infra.git /opt/pingu/repo
|
||||
Verzeichnisstruktur
|
||||
```
|
||||
---
|
||||
# Verzeichnisstruktur
|
||||
|
||||
/opt/pingu/
|
||||
├── logs/
|
||||
│ ├── deploy.log
|
||||
@@ -68,61 +82,86 @@ Verzeichnisstruktur
|
||||
├── scripts/
|
||||
├── docker/
|
||||
└── configs/
|
||||
Deploy-Prozess
|
||||
|
||||
---
|
||||
|
||||
# Deploy-Prozess
|
||||
|
||||
Das Deploy-Skript aktualisiert:
|
||||
|
||||
Repository
|
||||
Skripte
|
||||
Berechtigungen
|
||||
Deploy manuell starten
|
||||
- Repository
|
||||
- Skripte
|
||||
- Berechtigungen
|
||||
|
||||
## Deploy manuell starten
|
||||
```
|
||||
bash /opt/pingu/repo/scripts/deploy.sh
|
||||
Deploy per Cronjob
|
||||
Raspberry / interne Systeme
|
||||
```
|
||||
# Deploy per Cronjob
|
||||
## Raspberry / interne Systeme
|
||||
```
|
||||
*/15 * * * * /opt/pingu/repo/scripts/deploy.sh >> /opt/pingu/logs/deploy.log 2>&1
|
||||
Cloudserver
|
||||
```
|
||||
## Cloudserver
|
||||
```
|
||||
0 * * * * /opt/pingu/repo/scripts/deploy.sh >> /opt/pingu/logs/deploy.log 2>&1
|
||||
|
||||
```
|
||||
Cronjob bearbeiten:
|
||||
|
||||
```
|
||||
crontab -e
|
||||
Update-Prozess
|
||||
```
|
||||
---
|
||||
# Update-Prozess
|
||||
|
||||
Das Update-Skript:
|
||||
|
||||
führt apt updates durch
|
||||
prüft Docker Updates
|
||||
aktualisiert Systempakete
|
||||
loggt Ergebnisse
|
||||
Manuell starten
|
||||
bash /opt/pingu/repo/scripts/update.sh
|
||||
Sudo-Rechte für Update-Skript
|
||||
- führt apt updates durch
|
||||
- prüft Docker Updates
|
||||
- aktualisiert Systempakete
|
||||
- loggt Ergebnisse
|
||||
## Manuell starten
|
||||
```
|
||||
- bash /opt/pingu/repo/scripts/update.sh
|
||||
```
|
||||
---
|
||||
# Sudo-Rechte für Update-Skript
|
||||
|
||||
Damit apt ohne Passwort funktioniert:
|
||||
|
||||
```
|
||||
sudo visudo
|
||||
|
||||
```
|
||||
Hinzufügen:
|
||||
|
||||
```
|
||||
kai ALL=(ALL) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get
|
||||
WireGuard Setup (Cloudzugriff)
|
||||
Ziel
|
||||
```
|
||||
---
|
||||
|
||||
# WireGuard Setup (Cloudzugriff)
|
||||
## Ziel
|
||||
|
||||
Cloudserver greifen sicher auf interne Dienste zu:
|
||||
|
||||
Gitea
|
||||
Pi-hole
|
||||
Interne APIs
|
||||
Docker Services
|
||||
Beispiel Netzwerk
|
||||
Gerät WireGuard IP
|
||||
- Gitea
|
||||
- Pi-hole
|
||||
- Interne APIs
|
||||
- Docker Services
|
||||
|
||||
---
|
||||
|
||||
# Beispiel Netzwerk
|
||||
## Gerät WireGuard IP
|
||||
Gitea/Home Server 10.200.200.2
|
||||
Cloudserver 10.200.200.1
|
||||
Heimserver Config
|
||||
Cloudserver 10.200.200.1
|
||||
|
||||
---
|
||||
|
||||
# Heimserver Config
|
||||
|
||||
Datei:
|
||||
|
||||
```
|
||||
/etc/wireguard/wg0.conf
|
||||
```
|
||||
```
|
||||
[Interface]
|
||||
Address = 10.200.200.2/24
|
||||
PrivateKey = HOME_PRIVATE_KEY
|
||||
@@ -132,7 +171,9 @@ PublicKey = CLOUD_PUBLIC_KEY
|
||||
AllowedIPs = 10.200.200.1/32
|
||||
Endpoint = CLOUD_IP:51820
|
||||
PersistentKeepalive = 25
|
||||
```
|
||||
Cloudserver Config
|
||||
```
|
||||
[Interface]
|
||||
Address = 10.200.200.1/24
|
||||
PrivateKey = CLOUD_PRIVATE_KEY
|
||||
@@ -142,40 +183,82 @@ ListenPort = 51820
|
||||
PublicKey = HOME_PUBLIC_KEY
|
||||
AllowedIPs = 10.200.200.2/32
|
||||
PersistentKeepalive = 25
|
||||
WireGuard starten
|
||||
```
|
||||
---
|
||||
|
||||
# WireGuard starten
|
||||
```
|
||||
sudo systemctl enable wg-quick@wg0
|
||||
sudo systemctl restart wg-quick@wg0
|
||||
Verbindung testen
|
||||
```
|
||||
---
|
||||
|
||||
# Verbindung testen
|
||||
```
|
||||
ping 10.200.200.2
|
||||
sudo wg
|
||||
Docker Systeme
|
||||
Docker installieren
|
||||
```
|
||||
---
|
||||
|
||||
# Docker Systeme
|
||||
## Docker installieren
|
||||
```
|
||||
sudo apt install docker.io docker-compose-plugin -y
|
||||
Docker Compose Update Workflow
|
||||
Compose-Verzeichnis öffnen
|
||||
```
|
||||
---
|
||||
|
||||
# Docker Compose Update Workflow
|
||||
## Compose-Verzeichnis öffnen
|
||||
```
|
||||
cd /opt/paperless
|
||||
Backup erstellen
|
||||
PostgreSQL Dump
|
||||
```
|
||||
---
|
||||
# Backup erstellen
|
||||
## PostgreSQL Dump
|
||||
```
|
||||
sudo bash -c 'docker exec paperless-db-1 pg_dump -U paperless paperless > ~/paperless_backup.sql'
|
||||
Neue Images herunterladen
|
||||
```
|
||||
---
|
||||
|
||||
# Neue Images herunterladen
|
||||
```
|
||||
sudo docker compose pull
|
||||
Container neu erstellen
|
||||
```
|
||||
---
|
||||
|
||||
# Container neu erstellen
|
||||
```
|
||||
sudo docker compose up -d
|
||||
Status prüfen
|
||||
```
|
||||
---
|
||||
|
||||
# Status prüfen
|
||||
```
|
||||
sudo docker ps
|
||||
Logs prüfen
|
||||
```
|
||||
---
|
||||
|
||||
# Logs prüfen
|
||||
```
|
||||
sudo docker logs -f paperless-webserver-1
|
||||
Docker Cleanup
|
||||
```
|
||||
---
|
||||
|
||||
# Docker Cleanup
|
||||
|
||||
Nicht mehr benötigte Images entfernen:
|
||||
|
||||
```
|
||||
sudo docker image prune -a
|
||||
Logrotate
|
||||
Konfiguration erstellen
|
||||
```
|
||||
---
|
||||
# Logrotate
|
||||
## Konfiguration erstellen
|
||||
```
|
||||
sudo nano /etc/logrotate.d/pingu-deploy
|
||||
```
|
||||
|
||||
Inhalt:
|
||||
|
||||
```
|
||||
/opt/pingu/logs/*.log {
|
||||
weekly
|
||||
rotate 4
|
||||
@@ -184,18 +267,34 @@ Inhalt:
|
||||
notifempty
|
||||
copytruncate
|
||||
}
|
||||
Nützliche Befehle
|
||||
Git Status
|
||||
```
|
||||
---
|
||||
|
||||
# Nützliche Befehle
|
||||
|
||||
## Git Status
|
||||
```
|
||||
git -C /opt/pingu/repo status
|
||||
Remote prüfen
|
||||
```
|
||||
## Remote prüfen
|
||||
```
|
||||
git -C /opt/pingu/repo remote -v
|
||||
Repository aktualisieren
|
||||
```
|
||||
|
||||
## Repository aktualisieren
|
||||
```
|
||||
git -C /opt/pingu/repo pull
|
||||
Docker Container anzeigen
|
||||
```
|
||||
## Docker Container anzeigen
|
||||
```
|
||||
sudo docker ps
|
||||
WireGuard Status
|
||||
```
|
||||
## WireGuard Status
|
||||
```
|
||||
sudo wg
|
||||
Troubleshooting
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
Permission denied bei apt
|
||||
|
||||
Script nicht als root gestartet oder fehlende sudo-Regeln.
|
||||
@@ -222,4 +321,101 @@ Philosophie
|
||||
Kleine Infrastruktur.
|
||||
Wenig Overhead.
|
||||
Maximal nachvollziehbar.
|
||||
Lieber einfache Bash-Skripte als unnötige Komplexität.
|
||||
Lieber einfache Bash-Skripte als unnötige Komplexität.
|
||||
|
||||
# Logrotate
|
||||
|
||||
Die Deploy- und Update-Logs wachsen dauerhaft mit.
|
||||
Um zu verhindern, dass Logdateien über Monate oder Jahre unendlich groß werden, wird logrotate verwendet.
|
||||
|
||||
Die Logrotate-Konfiguration wird zentral über das Git-Repository verteilt und automatisch installiert.
|
||||
|
||||
---
|
||||
|
||||
# Repository Struktur
|
||||
|
||||
```text
|
||||
repo/
|
||||
├── scripts/
|
||||
│ ├── deploy.sh
|
||||
│ ├── update.sh
|
||||
│ └── install-logrotate.sh
|
||||
│
|
||||
├── configs/
|
||||
│ └── logrotate/
|
||||
│ └── pingu
|
||||
Logrotate Konfiguration
|
||||
|
||||
Datei im Repository:
|
||||
|
||||
configs/logrotate/pingu
|
||||
|
||||
Inhalt:
|
||||
|
||||
/opt/pingu/logs/*.log {
|
||||
weekly
|
||||
rotate 4
|
||||
compress
|
||||
missingok
|
||||
notifempty
|
||||
copytruncate
|
||||
}
|
||||
Installationsskript
|
||||
|
||||
Datei:
|
||||
|
||||
scripts/install-logrotate.sh
|
||||
|
||||
Inhalt:
|
||||
|
||||
#!/bin/bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
REPO_DIR="/opt/pingu/repo"
|
||||
|
||||
echo "[INFO] Installiere logrotate config..."
|
||||
|
||||
sudo cp "$REPO_DIR/configs/logrotate/pingu" /etc/logrotate.d/pingu
|
||||
|
||||
sudo chmod 644 /etc/logrotate.d/pingu
|
||||
|
||||
echo "[OK] Logrotate config installiert"
|
||||
Integration in deploy.sh
|
||||
|
||||
Im deploy.sh wird das Installationsskript automatisch ausgeführt.
|
||||
|
||||
Beispiel:
|
||||
|
||||
echo "Install logrotate config..."
|
||||
bash "$REPO_DIR/scripts/install-logrotate.sh"
|
||||
|
||||
Dadurch werden Änderungen an der Logrotate-Konfiguration automatisch auf alle Systeme verteilt.
|
||||
|
||||
Funktion
|
||||
|
||||
Die Konfiguration sorgt dafür:
|
||||
|
||||
Rotation einmal pro Woche
|
||||
4 alte Logs werden behalten
|
||||
alte Logs werden komprimiert
|
||||
fehlende Logs erzeugen keinen Fehler
|
||||
laufende Prozesse können weiterloggen
|
||||
Logrotate testen
|
||||
|
||||
Konfiguration prüfen:
|
||||
|
||||
sudo logrotate -d /etc/logrotate.d/pingu
|
||||
|
||||
Rotation erzwingen:
|
||||
|
||||
sudo logrotate -f /etc/logrotate.d/pingu
|
||||
Typische Logdateien
|
||||
/opt/pingu/logs/deploy.log
|
||||
/opt/pingu/logs/update.log
|
||||
Vorteile dieses Ansatzes
|
||||
zentrale Verwaltung über Git
|
||||
automatische Verteilung
|
||||
keine manuelle Pflege auf einzelnen Systemen
|
||||
identisches Verhalten auf allen Hosts
|
||||
leicht erweiterbar für weitere Systemconfigs
|
||||
Reference in New Issue
Block a user