chore: 실행 환경 구성 문서 추가 및 수정
This commit is contained in:
DongHyeonka
@@ -1,56 +0,0 @@
|
||||
# Lab entry point. Deployed on the lab host as
|
||||
# /etc/nginx/sites-available/keycloak-lab
|
||||
# and symlinked from sites-enabled/.
|
||||
#
|
||||
# Arch does not ship the Debian sites-available convention, so nginx.conf needs
|
||||
# include /etc/nginx/sites-enabled/*;
|
||||
# inside its http { } block before this file has any effect.
|
||||
#
|
||||
# This is the outer of two L7 hops. It terminates TLS and hands plain HTTP to
|
||||
# the Traefik instance running on each k3s node.
|
||||
|
||||
upstream k3s_traefik {
|
||||
# Sticky-session switch. Keycloak recommends affinity on AUTH_SESSION_ID;
|
||||
# ip_hash is the cheap stand-in for a single-browser lab. Leaving it off is
|
||||
# the interesting case: Infinispan still routes correctly, only slower.
|
||||
# ip_hash;
|
||||
server 192.168.122.11:80;
|
||||
server 192.168.122.12:80;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80 default_server;
|
||||
server_name _;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl default_server;
|
||||
http2 on;
|
||||
server_name _;
|
||||
|
||||
# fullchain.pem, never cert.pem: omitting the intermediates passes on
|
||||
# desktop browsers and fails on mobile and curl.
|
||||
ssl_certificate /etc/letsencrypt/live/auth.hyeonworks.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/auth.hyeonworks.com/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
location / {
|
||||
proxy_pass http://k3s_traefik;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Port 443;
|
||||
|
||||
# $remote_addr, not $proxy_add_x_forwarded_for. This is the trust
|
||||
# boundary: a client-supplied X-Forwarded-For must be discarded, not
|
||||
# extended, or nothing downstream can rely on the value.
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
}
|
||||
}
|
||||
Executable
+68
@@ -0,0 +1,68 @@
|
||||
#!/usr/bin/env bash
|
||||
# Remove the lab's host layer from test-server. Packages stay.
|
||||
#
|
||||
# sudo bash deploy/lab/host/teardown-host.sh
|
||||
#
|
||||
# The host's sudo asks for a password, so run this in a terminal — not over a
|
||||
# non-interactive ssh, where sudo fails silently into an empty result.
|
||||
#
|
||||
# ★ Certificates are BACKED UP, NOT DELETED. Let's Encrypt allows 5 duplicate
|
||||
# certificates per week for the same name set, and this lab's names resolve to
|
||||
# a tailnet address (100.64.0.0/10, not routable from the public internet), so
|
||||
# an HTTP-01 reissue cannot be validated from here. Deleting the files turns a
|
||||
# free restore into a problem that has to be solved first. Restoring is:
|
||||
#
|
||||
# sudo tar xzf ~/letsencrypt-backup-<stamp>.tgz -C /etc
|
||||
set -u
|
||||
|
||||
STAMP="$(date +%Y%m%d-%H%M%S)"
|
||||
HOME_DIR="${SUDO_USER:+/home/$SUDO_USER}"
|
||||
HOME_DIR="${HOME_DIR:-$HOME}"
|
||||
|
||||
echo "===== 1) 인증서 백업 (지우지 않는다) ====="
|
||||
if [ -d /etc/letsencrypt ]; then
|
||||
out="$HOME_DIR/letsencrypt-backup-$STAMP.tgz"
|
||||
tar czf "$out" -C /etc letsencrypt
|
||||
chown "${SUDO_USER:-root}" "$out"
|
||||
echo "백업: $out ($(du -h "$out" | cut -f1))"
|
||||
echo "현재 인증서:"
|
||||
certbot certificates 2>/dev/null | grep -E "Certificate Name|Domains|Expiry Date" || true
|
||||
echo "검증 방식 (재발급이 되는지의 답):"
|
||||
grep -H authenticator /etc/letsencrypt/renewal/*.conf 2>/dev/null || echo " (renewal 설정 없음)"
|
||||
else
|
||||
echo "/etc/letsencrypt 없음 — 건너뜀"
|
||||
fi
|
||||
echo
|
||||
|
||||
echo "===== 2) nginx 실험대 설정 제거 ====="
|
||||
if [ -f /etc/nginx/sites-available/keycloak-lab ]; then
|
||||
cp /etc/nginx/sites-available/keycloak-lab "$HOME_DIR/keycloak-lab.nginx.$STAMP.bak"
|
||||
echo "백업: $HOME_DIR/keycloak-lab.nginx.$STAMP.bak"
|
||||
fi
|
||||
rm -fv /etc/nginx/sites-enabled/keycloak-lab
|
||||
rm -fv /etc/nginx/sites-available/keycloak-lab
|
||||
systemctl disable --now nginx
|
||||
echo
|
||||
|
||||
echo "===== 3) certbot 갱신 타이머 정지 ====="
|
||||
# 인증서 파일은 남기지만, 갱신 시도는 멈춘다. 지금 DNS 로는 HTTP-01 검증이
|
||||
# 실패하고, 실패가 로그에만 쌓이면서 「왜 안 되지」의 원인이 된다.
|
||||
systemctl disable --now certbot-renew.timer 2>/dev/null || true
|
||||
echo
|
||||
|
||||
echo "===== 4) 엣지 DNAT (있으면) ====="
|
||||
systemctl disable --now lab-edge-dnat.service 2>/dev/null || true
|
||||
rm -fv /etc/systemd/system/lab-edge-dnat.service /etc/nftables.d/lab-edge-dnat.nft
|
||||
systemctl daemon-reload
|
||||
nft delete table ip lab_edge 2>/dev/null || true
|
||||
echo
|
||||
|
||||
echo "===== 5) 확인 ====="
|
||||
echo "-- nginx: $(systemctl is-active nginx) / $(systemctl is-enabled nginx 2>&1)"
|
||||
echo "-- certbot timer: $(systemctl is-active certbot-renew.timer 2>&1) / $(systemctl is-enabled certbot-renew.timer 2>&1)"
|
||||
echo "-- 80/443 리스너:"; ss -tlnp | grep -E ':(80|443) ' || echo " (없음 — 정상)"
|
||||
echo "-- sites-enabled:"; ls -A /etc/nginx/sites-enabled 2>/dev/null || echo " (비었음 — 정상)"
|
||||
echo "-- letsencrypt:"; ls /etc/letsencrypt/live 2>/dev/null || echo " (없음)"
|
||||
echo "-- libvirt 도메인:"; virsh list --all 2>/dev/null | tail -n +3 | grep -v '^$' || echo " (없음 — 정상)"
|
||||
echo
|
||||
echo "완료. 패키지(nginx · libvirt · qemu · certbot · kubectl)와 base.qcow2 는 남아 있다."
|
||||
Reference in New Issue
Block a user