diff --git a/documents/01a-LXC.md b/documents/01a-LXC.md new file mode 100644 index 0000000..549419c --- /dev/null +++ b/documents/01a-LXC.md @@ -0,0 +1,176 @@ +This is just recommandation for apxtri developer to help to create for testiing as well production to set many towns in a host (a physical server) with many VM (one LXC VM per town). +We assume that you have setup a physical ubuntu server machine with network bond. + +# into a host's terminal, create a container (use - not . for the naming): +lxc launch ubuntu:24.04 {town}-{nation} +# Create the user 'phil' with a home directory and bash shell +lxc exec nova-libera -- useradd -m -s /bin/bash phil +# Set a password for 'phil' +lxc exec nova-libera -- passwd phil +# Add phil to the sudo group +lxc exec nova-libera -- usermod -aG sudo phil +# Install SSH server +lxc exec nova-libera -- apt update +lxc exec nova-libera -- apt install -y openssh-server +# Ensure it is running +lxc exec nova-libera -- systemctl enable --now ssh +# Login as phil +lxc exec nova-libera -- sudo --login --user phil + +Action Command +Start lxc start nova-libera +Stop lxc stop nova-libera +List Containers lxc list +Info/IP Address lxc info nova-libera +Delete lxc delete --force nova-libera + + +# Network Routing Synthesis: Accessing LXC Subnet from a Remote Local Machine + +Architecture: + +Machine C (Local Client): 192.168.1.104 + +Machine A (LXC Host): 192.168.1.96 (Interface: bond0) + +LXC X (Container): 10.31.251.161 (Interface: lxdbr0) + +1. On Machine C (The Client) +The goal is to tell your computer that the path to the 10.31.251.0 network is through Host A. + +Bash +# Add the route to the LXC subnet via the Host IP +sudo ip route add 10.31.251.0/24 via 192.168.1.96 + +# Verify that the route is active +ip route get 10.31.251.161 +# Output should show: via 192.168.1.96 dev +2. On Machine A (The LXC Host) +You must authorize packet forwarding and open the firewall rules. + +A. Enable IP Forwarding (Kernel) +Bash +# Check the status (should be 1) +cat /proc/sys/net/ipv4/ip_forward + +# If it is 0, enable it immediately: +sudo sysctl -w net.ipv4.ip_forward=1 +B. Configure the Firewall (Iptables) +Insert rules at position 1 to bypass automatic LXD/Docker restrictions. + +Bash +# 1. Authorize OUTBOUND traffic (Machine C -> LXC) +sudo iptables -I FORWARD 1 -s 192.168.1.104 -d 10.31.251.0/24 -j ACCEPT + +# 2. Authorize INBOUND traffic (LXC -> Machine C) +sudo iptables -I FORWARD 2 -s 10.31.251.0/24 -d 192.168.1.104 -j ACCEPT + +# Make these rules persistent (requires iptables-persistent) +sudo netfilter-persistent save +3. On Machine X (The LXC Container) +Usually, no specific routing configuration is needed as long as the container uses the host as its default gateway (standard with lxdbr0). + +Verification: Ensure that your services (Gitea, SSH, etc.) are listening on 0.0.0.0 (all interfaces) and not just 127.0.0.1. + +4. Diagnostic Tools (Troubleshooting) +If the ping still fails, run these tests in order: + +From C: traceroute -n 10.31.251.161 +The first hop must be 192.168.1.96. + +On A: sudo tcpdump -i bond0 icmp +If you see packets arriving, Routing on C is correct. + +On A: sudo tcpdump -i lxdbr0 icmp +If you see packets here, Host A is correctly forwarding traffic to the container bridge. +If you see the Request (out) but no Reply (back): + +This is either a REJECT/DROP rule on the Host or the Container does not know how to reach 192.168.1.104. + +Persistence Note: To ensure this survives a reboot: +Ensure Host A (192.168.1.96) has a Static IP (configured via Netplan on Ubuntu). + +Make the route on Machine C permanent (via Netplan, NetworkManager, or /etc/network/interfaces). + +# SSH/SFTP Key-Based Access Setup: Client C to Container X + +This guide explains how to set up a simplified, passwordless access for user phil to the LXC container nova-libera (IP 10.31.251.161) host on a 192.168.1.96, working for both the terminal and Nautilus helpfull when you manage manually a setup using a VM LXC + +**1. On Machine C (Local Client)** +A. Generate the Key Pair +If you don't have a key pair yet, generate a new one (press Enter to accept default options): + +Bash +ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_nova_libera +B. Configure the SSH Shortcut +Edit your local SSH configuration file: + +Bash +nano ~/.ssh/config +Add the following block: + +Plaintext +Host nova-libera + HostName 10.31.251.161 + User phil + IdentityFile ~/.ssh/id_nova_libera +(If your private key is stored on an external drive, replace ~/.ssh/id_nova_libera with the full path to your private key file). + +**2. On Container X (nova-libera)** +Log into your container (via lxc exec or your current session) to set up the receiver side. + +A. Prepare the SSH Directory +Bash +# Ensure you are in phil's home directory +mkdir -p /home/phil/.ssh +chmod 700 /home/phil/.ssh +touch /home/phil/.ssh/authorized_keys +chmod 600 /home/phil/.ssh/authorized_keys +chown -R phil:phil /home/phil/.ssh +B. Add the Public Key +You must copy the content of your .pub file (generated in Step 1) into the authorized_keys file inside the container: + +Bash +# Example from the host (if you have the file available) +cat id_nova_libera.pub >> /home/phil/.ssh/authorized_keys + +**3. Daily Usage** +From the Terminal +You no longer need to type the IP address or username: + +Bash +ssh nova-libera +From Nautilus (File Manager) +Open Nautilus. + +Press Ctrl + L to focus the address bar. + +Enter the following address: + +Plaintext +sftp://nova-libera +Press Enter. You will be connected instantly without a password prompt. + +**4. Troubleshooting (Checks)** +If the connection is denied, verify these points inside the container: + +Does the SSH service allow keys? +Check in /etc/ssh/sshd_config that: + +PubkeyAuthentication yes is enabled. + +AuthorizedKeysFile .ssh/authorized_keys is set. + +Strict Permissions: +SSH will reject connections if directories are too "open": + +/home/phil should not be 777. + +.ssh folder must be 700. + +authorized_keys file must be 600. + +Restart the Service: + +Bash +sudo systemctl restart ssh \ No newline at end of file diff --git a/setup/init.sh b/setup/init.sh index 64cf372..9ea4c17 100755 --- a/setup/init.sh +++ b/setup/init.sh @@ -425,6 +425,9 @@ TRIBE_EOF echo "[INFO] Tribe '$TOWN' created." fi +# Fix ownership after sudo cp/mkdir in step 7 (files created as root) +sudo chown -R "$APXTRI_USER:$APXTRI_USER" "$TRIBE_DATA_DIR" "$TRIBE_CODE_DIR" + # ==== STEP 8: CREATE .ENV FILE ==== echo "[STEP 8/11] Creating environment configuration..."