Difference between revisions of "Essun"

From FouWiki
Jump to navigation Jump to search
(LXC container por Libretime y umap)
(Installation of the containers)
Line 181: Line 181:
=== Installation of the containers ===
=== Installation of the containers ===
* https://wiki.debian.org/LXC
* https://wiki.debian.org/LXC
* https://archives.flockport.com/lxc-networking-guide/
=== Use of lxcbr0 bridge to allow autostart ===
=== Use of lxcbr0 bridge to allow autostart ===

Revision as of 00:31, 2 November 2020


Essun is the mediaserver of Calafou local network. It is running Debian, the Universal Operating System. It is providing services for the people who are on the territory of Calafou. It is 8Gb ram and has 4 discs in it: 160Gb for system, 1Tb mirror discs, 3T for mediateca. You can connect here http://essun.calafou.org/

What does "Essun" mean?

Essun is one of the names of the protagonist of the Broken Earth trilogy by N. K. Jemisin. Essun belongs to a small group of people, called origenes, who have a special power to shape and redirect energy. Origenes are feared and hated by their society because of their powers, so if they are not murdered as children, they are carefully controlled, enslaved and exploited.

As the world ends, Essun is forced to join together with others. As she learns the strength of community and solidarity, she learns to use her powers without shame. And she learns that resistance is possible, even if it means causing the destruction of the world that had previously been her home.

Boot sequence: What happens when you turn on the machine?

  1. BIOS
    1. Here you can press F12 to choose boot device. The default is to boot the system on the hard drive. This is useful if you want to boot a rescue or install image from a pendrive, for example.
    2. Here you can press F2 to enter the BIOS configuration, but we have to find out the BIOS password. At the moment, we have no idea what is the BIOS password! We have to search how to reset this password...
  2. GRUB
    1. Here you can choose to start the system as usual, or to enter rescue mode. It is also possible to modify the kernel boot parameters. This is useful if you forgot the root password and want to reset it, for example.
  3. Initramfs
    1. Here cryptsetup asks for the LUKS encryption password. The password can be typed in using a keyboard connected to essun, or through SSH if your SSH keys are installed in initramfs (in /etc/dropbear-initramfs/authorized_keys cf this. For the second option, use the unlock-essun.sh script. The actual password can be found in the calafou keyringer repository, and you can see it from your computer like this: keyringer calafou decrypt lan.essun.luks.system
    2. To connect with ssh to ssh dropbear server at boot :
ssh root@

once in busybox, type :


and type the luks passphrase

  1. Systemd
    1. The hard drives ("block devices") specified in /etc/crypttab are unlocked, usually using key files in /etc/luks/.
    2. The hard drives ("block devices") specified in /etc/fstab are mounted, such as /mnt/3t (a big hard drive for mediateca) and /mnt/mirror (a mirrored drive for services).
    3. Systemd manages the services, so when the computer starts, it tries to turn on the web server (apache2), etc.
  2. System
    1. You can log in if your SSH key is installed in the system: ssh $USERNAME@essun.calafou.org (where $USERNAME is your username).
  3. Services to re-launch : (don't know why they doesn't start well at boot time)
systemctl restart etherpad-lite.service
systemctl restart apache2.service
systemctl status omnioussonification.service
  1. Container to start (as root)
lxc-start umap
lxc-start bibretime
lxc-ls -f


Most of these services are only available from the local network!

Web Server


systemctl status apache2


The web server shows a page that explains Essum and links to the other services.



systemctl status etherpad


The etherpad is providing real-time multi-user editable shared persistent documents.

A few plug-ins have been installed from this framasoft list (all did not instal ...) https://github.com/YunoHost-Apps/etherpad_mypads_ynh



systemctl status icecast2


Icecast2 is providing a stream ("radio") that you can play on your computer, for example with mplayer or mpv:

mplayer http://essun.calafou.org:8000

mpv http://essun.calafou.org:8000

File server


systemctl status proftpd


The file server is for uploading and downloading files. You can access it with FileZilla from popular operating systems. Or you can use a command line client such as ncftp.

ncftp ftp://essun.calafou.org

Filezilla config :



We could try to install it like this:


We tried with this : https://www.howtoforge.com/tutorial/how-to-install-nextcloud-on-debian-10/ it seems to work (change the version of nextcloud to download)

More Nextcloud config

So :

groupadd www-ftp
usermod -a -G www-ftp www-data
usermod -a -G www-ftp anonftp
chown -R :www-ftp /mnt/3t/ftp/MEDIATECA
chmod -R g+rw /mnt/3t/ftp/MEDIATECA

Even more config to optimize things

As seen in https://nuvol.calafou.org/index.php/settings/admin/overview there were things that needed to be optimized :

cd /var/www/html/nextcloud
sudo -u www-data php occ db:add-missing-indices
apt install php-intl php-imagick
sudo -u www-data php occ maintenance:mode --on
sudo -u www-data php occ db:convert-filecache-bigint
sudo -u www-data php occ maintenance:mode --off

Activate cache

apt install php-apcu
phpenmod intl
nano config/config.php

Add this in the file before );

'memcache.local' => '\OC\Memcache\APCu',

Restart Apache after all this

systemctl restart apache2

Rescan the files

sudo -u www-data php occ files:scan --all -v 

If problem while scanning with unlocked files :

mysql -u root -p
connect nextclouddb
DELETE FROM oc_file_locks WHERE 1;

or more wild

TRUNCATE TABLE oc_file_locks;

Set https certificate on each subdomain.calafou.org with a certbot wildcard

One certificate for all the subdomains

Install Gandi plug-in

apt remove python-cryptography
pip install cryptography
pip install certbot-plugin-gandi
certbot certonly -a certbot-plugin-gandi:dns --certbot-plugin-gandi:dns-credentials gandi.ini -d \*.calafou.org --server https://acme-v02.api.letsencrypt.org/directory

Activate mod ssl for Apache

a2enmod ssl
systemctl restart apache2

Create the virtual hosts :

<IfModule mod_ssl.c>
<VirtualHost *:443>
       ServerName essun.calafou.org
       ServerAdmin webmaster@localhost
       DocumentRoot /var/www/essun.calafou
       ErrorLog ${APACHE_LOG_DIR}/essun-error.log
       CustomLog ${APACHE_LOG_DIR}/essun-access.log combined
      SSLEngine on
      SSLProxyEngine On
      SSLProxyVerify none
      SSLProxyCheckPeerCN off
      SSLProxyCheckPeerName off
      SSLProxyCheckPeerExpire off
SSLCertificateFile /etc/letsencrypt/live/calafou.org/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/calafou.org/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</<IfModule mod_ssl.c>

Renew auto

crontab -e
0 0 * * 0 certbot renew -q -a certbot-plugin-gandi:dns --certbot-plugin-gandi:dns-credentials /etc/letsencrypt/gandi/gandi.ini --server https://acme-v02.api.letsencrypt.org/directory

LXC container por Libretime y umap

About Libretime et Umap

Installation of the containers

Use of lxcbr0 bridge to allow autostart

Create a lxc-net default config file :

sudo nano /etc/default/lxc-net

Restart lxc network

 systemctl restart lxc-net.service

Adapt the config of each container

nano /mnt/mirror/lxc/bibretime/config
# Network configuration
lxc.net.0.type = veth
lxc.net.0.hwaddr = 00:16:3e:cf:c1:dd
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
# Autostart
lxc.start.delay = 10
lxc.start.auto = 1

Use the container

list containers

lxc-ls -f


lxc-start bibretime


lxc-stop bibretime

attach to a container to have a root prompt

lxc-attach bibretime

Onduleur Salicru SPS ONE

The software provided is ugly (tomcat java), so let's use NUT to replace it, see :