20250404
This commit is contained in:
105
.obsidian/workspace.json
vendored
105
.obsidian/workspace.json
vendored
@@ -37,7 +37,7 @@
|
||||
"state": {
|
||||
"type": "markdown",
|
||||
"state": {
|
||||
"file": "diary/2025-03-19.md",
|
||||
"file": "diary/2025-04-04.md",
|
||||
"mode": "source",
|
||||
"source": true,
|
||||
"backlinks": true,
|
||||
@@ -52,35 +52,11 @@
|
||||
}
|
||||
},
|
||||
"icon": "lucide-file",
|
||||
"title": "2025-03-19"
|
||||
"title": "2025-04-04"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "717fd6a524c18321",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "markdown",
|
||||
"state": {
|
||||
"file": "projects/kwa/firewall_migration/20250317_first-meeting.md",
|
||||
"mode": "source",
|
||||
"source": true,
|
||||
"backlinks": true,
|
||||
"backlinkOpts": {
|
||||
"collapseAll": false,
|
||||
"extraContext": false,
|
||||
"sortOrder": "alphabetical",
|
||||
"showSearch": false,
|
||||
"searchQuery": "",
|
||||
"backlinkCollapsed": false,
|
||||
"unlinkedCollapsed": true
|
||||
}
|
||||
},
|
||||
"icon": "lucide-file",
|
||||
"title": "20250317_first-meeting"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "7015f217fb3c366b",
|
||||
"id": "23676dcc91a6b6e8",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "markdown",
|
||||
@@ -104,12 +80,12 @@
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "1d670c55bba08a55",
|
||||
"id": "175e86d27cc90624",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "markdown",
|
||||
"state": {
|
||||
"file": "areas/OPNsense/Schulungen/20250319-pre-meeting-prep.md",
|
||||
"file": "projects/neosphere/qumulus/overview-qumulo_and_comp-nodes.md",
|
||||
"mode": "source",
|
||||
"source": true,
|
||||
"backlinks": true,
|
||||
@@ -124,7 +100,7 @@
|
||||
}
|
||||
},
|
||||
"icon": "lucide-file",
|
||||
"title": "20250319-pre-meeting-prep"
|
||||
"title": "overview-qumulo_and_comp-nodes"
|
||||
}
|
||||
}
|
||||
],
|
||||
@@ -278,10 +254,10 @@
|
||||
"state": {
|
||||
"type": "file-properties",
|
||||
"state": {
|
||||
"file": "diary/2025-03-13.md"
|
||||
"file": "diary/2025-04-03.md"
|
||||
},
|
||||
"icon": "lucide-info",
|
||||
"title": "File properties for 2025-03-13"
|
||||
"title": "File properties for 2025-04-03"
|
||||
}
|
||||
}
|
||||
],
|
||||
@@ -306,41 +282,42 @@
|
||||
},
|
||||
"active": "b865e0663684cf60",
|
||||
"lastOpenFiles": [
|
||||
"projects/kwa/firewall_migration/20250317_first-meeting.md",
|
||||
"areas/OPNsense/Schulungen/20250319-pre-meeting-prep.md",
|
||||
"diary/2025-04-03.md",
|
||||
"diary/2025-04-04.md",
|
||||
"projects/sbx/sbx-lab-network.md",
|
||||
"projects/neosphere/qumulus/overview-qumulo_and_comp-nodes.md",
|
||||
"projects/kwa/firewall_migration/20250318-OPNsense_Migration.md",
|
||||
"diary/2025-03-19.md",
|
||||
"areas/OPNsense/Schulungen/20250305-initial_ideas.md",
|
||||
"projects/phytron/nextcloud_gitlab_after_hack.md",
|
||||
"projects/neosphere/qumulus/overview-qumulus_and_comp-nodes.md",
|
||||
"projects/bvv/bind-manual.md",
|
||||
"projects/neosphere/qumulus/20250502-storage-cluster.md",
|
||||
"projects/patryk-projekt/20250319-projekt-berschreibung.md",
|
||||
"projects/patryk-projekt/202503012-initial.md",
|
||||
"projects/sbx/orga/todo-sbx.md",
|
||||
"diary/2025-02/2025-02-27.md",
|
||||
"diary/2025-02/2025-02-26.md",
|
||||
"diary/2025-02/2025-02-25.md",
|
||||
"diary/2025-02/2025-02-24.md",
|
||||
"diary/2025-02/2025-02-21.md",
|
||||
"diary/2025-02/2025-02-20.md",
|
||||
"diary/2025-02/2025-02-19.md",
|
||||
"diary/2025-02/2025-02-14.md",
|
||||
"diary/2025-02/2025-02-13.md",
|
||||
"diary/2025-02/2025-02-12.md",
|
||||
"diary/2025-02/2025-02-10.md",
|
||||
"diary/2025-02/2025-02-08.md",
|
||||
"diary/2025-02/2025-02-07.md",
|
||||
"diary/2025-02/2025-02-06.md",
|
||||
"diary/2025-04-02.md",
|
||||
"projects/ssr/202504-4architekten/notes.md",
|
||||
"projects/sbx/manuals/Sophos-SG_PPPoE-data.md",
|
||||
"projects/sbx/manuals",
|
||||
"diary/2025-04-01.md",
|
||||
"projects/discopharma/20250320-manual-project.md",
|
||||
"projects/ssr/202504-4architekten",
|
||||
"projects/discopharma/20250311-metabase-environment.md",
|
||||
"projects/discopharma/Meetings/20250310-Next_Steps.md",
|
||||
"projects/discopharma/20250312-metabase-deployment.md",
|
||||
"diary/2025-03-31.md",
|
||||
"projects/VZ/Win11-autoinstall-iso.md",
|
||||
"diary/2025-03-28.md",
|
||||
"projects/discopharma/reverse-proxy.md",
|
||||
"projects/sbx/firewall-std/std-tools.md",
|
||||
"projects/boschmann+feth/20250326-Preparation.md",
|
||||
"diary/2025-03-27.md",
|
||||
"projects/sbx/firewall-std/std-network.md",
|
||||
"diary/2025-03-26.md",
|
||||
"projects/sbx/firewall-std",
|
||||
"projects/boschmann+feth",
|
||||
"diary/2025-03-25.md",
|
||||
"files/discopharma/discopharma-infra.drawio.png",
|
||||
"files/discopharma",
|
||||
"files/New folder",
|
||||
"projects/discopharma/Meetings/20250317-finishing-meeting.md",
|
||||
"diary/2025-03-24.md",
|
||||
"projects/discopharma/Meetings",
|
||||
"diary/2025-04",
|
||||
"diary/2025-03",
|
||||
"diary/2025-02",
|
||||
"diary/2025-01",
|
||||
"diary/2024-12",
|
||||
"diary/2024-11",
|
||||
"diary/2024-10",
|
||||
"diary/2024-09",
|
||||
"diary/2024-08",
|
||||
"diary/2024-07"
|
||||
"diary/2025-02"
|
||||
]
|
||||
}
|
||||
@@ -13,4 +13,34 @@
|
||||
- Firewall - Aliase, NAT und Regeln
|
||||
- EURE FRAGEN
|
||||
- (Optional) Interfaces/Schnittstellen
|
||||
- (Optional) (Open)VPN
|
||||
- (Optional) (Open)VPN
|
||||
|
||||
## Standard Features (OPNsense vs. Sophos)
|
||||
|
||||
- DNAT corresponds to Port Forward (NAT)
|
||||
- SNAT corresponds to Outbound (NAT)
|
||||
|
||||
### OPNsense
|
||||
|
||||
#### Nativ
|
||||
- Base Setup (Routing, dhcp, dns, firewall regeln, vlans, authentizierungs server: ldap, totp, local, radius)
|
||||
- VPN: IPsec, OpenVPN, Wireguard
|
||||
- IDS/IPS Schutz via Suricata
|
||||
- backup: lokal, central instanz, google drive. Extra: nextcloud, git, ...
|
||||
|
||||
#### Extra Features
|
||||
|
||||
- Web Proxy (Caching Proxy, Web Filter, Transparent Proxy, SSl inspection, managed TLS exclusion)
|
||||
- Antivirus via (clamav + c-icap)
|
||||
|
||||
### Sophos
|
||||
|
||||
- Basis (network, dhcp, dns, firewall regeln, vlans, authentizierungs server: ldap, ad, radius, azure sso, etc.)
|
||||
- VPN: IPsec, SSL VPN (OpenVPN), L2TP, PPTP
|
||||
- IDS/IPS
|
||||
- Web Protection
|
||||
- Application Protection
|
||||
- Email Protection
|
||||
- Web Server Protection
|
||||
- Active Threat Response
|
||||
- Zero-day Protection
|
||||
|
||||
96
diary/2025-03-20.md
Normal file
96
diary/2025-03-20.md
Normal file
@@ -0,0 +1,96 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## DoIt
|
||||
|
||||
- OPNsense Schulung Planung
|
||||
- KWA Firewall Angebot: Wartungsaufgaben listen und rausschicken
|
||||
- DiscoPharma: Anleitungs Dokument beginnen
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 08:30 - 09:00: Mails checken, Rechner mehrmals neustarten
|
||||
- 09:00 - 09:30: KWA: Sebastian Muehlbauer kann keine Postfaecher hinzufuegen
|
||||
- 09:30 - 10:00: [x] OPNsense Schulung vorbereiten
|
||||
- 10:00 - 10:30: Git Repo fuer unattended.xml abchecken
|
||||
- 10:30 - 11:00: Meeting vorbereiten
|
||||
- 11:00 - 12:00: [x] OPnsense Schulung
|
||||
- 12:30 - 13:30: Pause
|
||||
- 13:30 - 14:15: [x] Mitarbeitergespraech
|
||||
- 14:15 - 14:30: Phytron - z-jira boot partition voll. alte Kernel loeschen
|
||||
- 14:30 - 15:00: Ninja Remote
|
||||
- 15:00 - 16:30: USB sticks vorbereitet
|
||||
- 16:30 - 17:00: Ticketpflege
|
||||
|
||||
## Thursday
|
||||
|
||||
- 08:30 - 10:00: OPNsense Config: Caching Proxy, Transparent Proxy, sls inspection, funktioniert nicht..
|
||||
|
||||
- 10:30 - 11:30: Gespraech mit Michael und Oli zu Autoinstallation, Nachricht schreiben an DiscoPharma,
|
||||
|
||||
- 12:30 - 12:45: DiscoPharma: Anleitung
|
||||
|
||||
- 13:00 - 13:30: Labor OPNsense Cluster auf SG's aufraeumen
|
||||
-
|
||||
- 14:30 - 15:00: OPNsense Cluster mounten in Buero Rack
|
||||
- 15:00 - 17:00: VZ mit Michael. ISO
|
||||
|
||||
## Wednesday
|
||||
|
||||
- 09:30 - 09:45: SSR: Mail schrieben: Alle user gleiche Passwoerter, Mailstore Web geht nicht
|
||||
|
||||
- 10:30 - 11:00: Disco Incidence with metabase instance
|
||||
|
||||
- 13:30 - 14:00: Mailstore nicht erreichbar. Dienst lief nicht. Schalte ihn wieder ein. Pruefe Web Zugang
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
- [ ] opnsense schulung planen
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] bind/named anleitung schreiben; named slave instanz aufsetzen
|
||||
|
||||
- [ ] radiochemie - irgendwie http challenge automatisieren
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
110
diary/2025-03-21.md
Normal file
110
diary/2025-03-21.md
Normal file
@@ -0,0 +1,110 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## DoIt
|
||||
|
||||
- OPNsense Schulung Planung
|
||||
- KWA Firewall Angebot: Wartungsaufgaben listen und rausschicken
|
||||
- DiscoPharma: Anleitungs Dokument beginnen
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 08:15 - 08:30: Tagesplanung
|
||||
- 08:30 - 10:00: OPNsense Config: Caching Proxy, Transparent Proxy, sls inspection, funktioniert nicht..
|
||||
- 10:00 - 10:30: Pause
|
||||
- 10:30 - 11:30: Gespraech mit Michael und Oli zu Autoinstallation, Nachricht schreiben an DiscoPharma,
|
||||
- 11:30 - 12:30: Pause
|
||||
- 12:30 - 12:45: DiscoPharma: Anleitung
|
||||
- 12:45 - 13:00: Mailstore checken wegen Lizenzen und Postfaecher Anzahl
|
||||
- 13:00 - 13:30: Labor OPNsense Cluster auf SG's aufraeumen
|
||||
- 13:30 - 14:30: Erstelle generische ISO fuer Softbox zwecke - kein ninja, nichts Kunden spezifisches
|
||||
- 14:30 - 15:00: OPNsense Cluster mounten in Buero Rack
|
||||
|
||||
## Wednesday
|
||||
|
||||
- 08:15 - 08:30: [x] Tagesplanung, Notizen strukturieren
|
||||
- 08:30 - 09:30: [x] Patryk Projekt lesen
|
||||
- 09:30 - 09:45: SSR: Mail schrieben: Alle user gleiche Passwoerter, Mailstore Web geht nicht
|
||||
- 09:45 - 10:00: Gespraech mit Thilo zu OPNsense und deren Zukunft in Firma
|
||||
- 10:00 - 10:15: [x] Patryk Projekt Korrektur lesen
|
||||
- 10:30 - 11:00: Disco Incidence with metabase instance
|
||||
- 11:00 - 11:15: [x] Anpassungen machen an Dokument fuer Patryk
|
||||
- 11:15 - 12:30: Pause
|
||||
- 12:30 - 12:45: [x] Rechner neustarten
|
||||
- 12:45 - 13:30: [x] NeoSphere Uebersicht Dokument verfassen und in IT Glue hochladen
|
||||
- 13:30 - 14:00: Mailstore nicht erreichbar. Dienst lief nicht. Schalte ihn wieder ein. Pruefe Web Zugang
|
||||
- 14:00 - 16:00: [x] OPNsense Schulung planen; gw.test.softbox.net anpassen, VLANs setzen, Beispiel Firewall Regeln, dhcp einstellen, Query Forwarding einstellen als beispiel, plane Themen
|
||||
- 16:00 - 16:30: KWA Angebot durchgehen und finalisieren
|
||||
- 16:30 - 16:45: [x] Patryk Projekt lesen und korrigieren
|
||||
- 16:45 - 17:00: [x]Ticketpflege
|
||||
|
||||
## Tuesday
|
||||
|
||||
- 08:30 - 08:45: [x] Ticketpflege
|
||||
- 08:45 - 09:00: [x] Meeting mit KWA vorbereiten. XGS136 specs recherchieren
|
||||
- 09:00 - 10:15: [x] Meeting mit KWA: Sophos vs. OPNsense
|
||||
- 10:15 - 10:30: Pause
|
||||
- 10:30 - 10:45: [x] Mailstore Lizenz bei KWA nachschauen und Angebot anfragen. Infos fuer Angebot fuer Firewall Migration einholen
|
||||
- 11:00 - 11:15: [x] Juri anrufen
|
||||
- 11:15 - 12:15: [x] Kalkulation erstellen fuer KWA
|
||||
- 12:30 - 12:45: KWA IT-Glue sortieren
|
||||
- 12:45 - 13:45: Pause
|
||||
- 14:00 - 14:15: SSR IT-Glue sortieren und neue Ordner anlegen
|
||||
- 14:15 - 15:15: [x] Meeting mit Oli und Thilo zu OPNsense - Wartungspauschale
|
||||
- 15:15 - 15:45: [x] Gespraech mit Sebastian: OPNsense, Proxmox, PXE boot von Win11
|
||||
- 15:45 - 16:15: [x] Arbeitsnotizen ordnen und Strukturieren, Erstelle Dokumente mit allgemeinen Verbesserungsvorschlaegen fuer Sbx
|
||||
- 16:15 - 16:45: [x] Lese Patryk's Projektbeschreibung
|
||||
- 16:45 - 17:00: [x] Ticketpflege
|
||||
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
- [ ] opnsense schulung planen
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] bind/named anleitung schreiben; named slave instanz aufsetzen
|
||||
|
||||
- [ ] radiochemie - irgendwie http challenge automatisieren
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
73
diary/2025-03-24.md
Normal file
73
diary/2025-03-24.md
Normal file
@@ -0,0 +1,73 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- KWA Firewall Angebot: Ruecksprache und rausschicken
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- discopharma: Anleitung
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 09:15 - 09:45: Tagesaufgaben rausschreiben.
|
||||
- 09:45 - 10:15: Ticketpflege
|
||||
- 10:30 - 11:00: Meeting vorbereiten: Pruefe metabase VM: docker logs, scripts; pruefe reverse proxy VM: unattended-upgrades, reverse proxy
|
||||
- 11:00 - 11:15: DiscoPharma Meeting
|
||||
- 11:15 - 11:45: Privat
|
||||
- 11:45 - 12:45: Pause
|
||||
- 13:00 - 13:30: [x] Machraum.de bei SSR
|
||||
- 13:30 - 14:30: [x] Bind manual fuer bvv
|
||||
- 14:45 - 15:00: iPause
|
||||
- 15:00 - 15:30: Privat
|
||||
- 15:30 - 16:00: Stelle Firewall Schedule bei der radiochemie Firewall ein. Oeffne Port 80 fuer naechsten Lets Encrypt renew
|
||||
- 16:00 - 16:30: Besprechung mit Marko Firewall Migration bei Boschmann und Feth zu machen. Projekt Ticket fuer Firewall anschauen, Blocker im Kalendar setzen
|
||||
- 16:30 - 17:00: dns drei-v.de untersuchen.
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
78
diary/2025-03-25.md
Normal file
78
diary/2025-03-25.md
Normal file
@@ -0,0 +1,78 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- KWA Firewall Angebot: rausschicken
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- discopharma: Anleitung
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 09:00 - 09:15: Ticketpflege, Tagesplanung
|
||||
- 09:15 - 09:45: Telefonat mir Martin: Er braucht usb sticks, veranlasse courier, bereite usb sticks noch mit xml vor
|
||||
- 09:45 - 11:30: Anleitung Disco
|
||||
- 11:30 - 13:00: Pause
|
||||
- 13:00 - 13:15: Blocherer Schule: Auf Mail von Loeffelholz antworten
|
||||
- 13:15 - 13:45: Sebastian Muehlbauer: Outlook Postafaecher hinzufuegen. Kein sekretariat's Postfach
|
||||
- 13:45 - 15:00: Bei Boschmann+Feth reinarbeiten. Telefonat mit Herrn Feth. Sie wissen nicht bescheid. Firewall auf Platz aufbauen
|
||||
- 15:00 - 15:30: Backup download bestehender Firewall. Richte neue Firewall ein
|
||||
- 15:30 - 17:00: Meeting mit Simone zu Firewall
|
||||
|
||||
## Monday
|
||||
|
||||
- 10:30 - 11:00: Meeting vorbereiten: Pruefe metabase VM: docker logs, scripts; pruefe reverse proxy VM: unattended-upgrades, reverse proxy
|
||||
- 11:00 - 11:15: DiscoPharma Meeting
|
||||
|
||||
- 15:30 - 16:00: Stelle Firewall Schedule bei der radiochemie Firewall ein. Oeffne Port 80 fuer naechsten Lets Encrypt renew
|
||||
- 16:00 - 16:30: Besprechung mit Marko Firewall Migration bei Boschmann und Feth zu machen. Projekt Ticket fuer Firewall anschauen, Blocker im Kalendar setzen
|
||||
- 16:30 - 17:00: dns drei-v.de untersuchen.
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
86
diary/2025-03-26.md
Normal file
86
diary/2025-03-26.md
Normal file
@@ -0,0 +1,86 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- boschmann firewall vorbereiten fuer migration
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- discopharma: Anleitung
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 08:15 - 08:30: Tagesplanung, Lese Martin's Installations-Anleitung
|
||||
- 08:30 - 09:00: Privat
|
||||
- 09:00 - 12:00: Firewall Einrichtung: Analysiere Kunden Netzwerk erst, Temporaere Netze/Interfaces konfigurieren, Auth Server konfigurieren, WAN PPPoE eintragen, Recherchiere wegen Telefonanlage: Was zu beachten in neuer Firewall?
|
||||
- 12:00 - 13:00: Pause
|
||||
- 13:00 - 17:30: Firewall konfig fortfahren, TLS/SSL inspection anpassen (stunden lang), vpn einrichten, adminstrator einstellungen setzen, IPS anschalten, web proxy anschalten, dnat regel setzen, ntp config, kabel einpacken, wlan pruefen (ap kommt erst naechste woche)
|
||||
|
||||
## Tuesday
|
||||
|
||||
- 09:00 - 09:15: Ticketpflege, Tagesplanung
|
||||
- 09:15 - 09:45: Telefonat mir Martin: Er braucht usb sticks, veranlasse courier, bereite usb sticks noch mit xml vor
|
||||
- 09:45 - 11:30: Anleitung Disco
|
||||
- 11:30 - 13:00: Pause
|
||||
- 13:00 - 13:15: Blocherer Schule: Auf Mail von Loeffelholz antworten
|
||||
- 13:15 - 13:45: Sebastian Muehlbauer: Outlook Postafaecher hinzufuegen. Kein sekretariat's Postfach
|
||||
- 13:45 - 15:00: Bei Boschmann+Feth reinarbeiten. Telefonat mit Herrn Feth. Sie wissen nicht bescheid. Firewall auf Platz aufbauen
|
||||
- 15:00 - 15:30: Backup download bestehender Firewall. Richte neue Firewall ein
|
||||
- 15:30 - 17:00: Meeting mit Simone zu Firewall
|
||||
|
||||
## Monday
|
||||
|
||||
- 10:30 - 11:00: Meeting vorbereiten: Pruefe metabase VM: docker logs, scripts; pruefe reverse proxy VM: unattended-upgrades, reverse proxy
|
||||
- 11:00 - 11:15: DiscoPharma Meeting
|
||||
|
||||
- 15:30 - 16:00: Stelle Firewall Schedule bei der radiochemie Firewall ein. Oeffne Port 80 fuer naechsten Lets Encrypt renew
|
||||
- 16:00 - 16:30: Besprechung mit Marko Firewall Migration bei Boschmann und Feth zu machen. Projekt Ticket fuer Firewall anschauen, Blocker im Kalendar setzen
|
||||
- 16:30 - 17:00: dns drei-v.de untersuchen.
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
95
diary/2025-03-27.md
Normal file
95
diary/2025-03-27.md
Normal file
@@ -0,0 +1,95 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- boschmann firewall vorbereiten fuer migration
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- discopharma: Anleitung
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 08:15 - 08:45: Anfahrt
|
||||
- 08:45 - 09:00: Ankunft Boschmann + Feth
|
||||
- 09:00 - 09:30: Planung aufschreiben und durchgehen: Todo liste, schritte, notizen
|
||||
- 11:00 - 14:00: Beginn, Firewall Tausch
|
||||
- 14:00 - 15:00: Pause
|
||||
- 15:00 - 18:00: firewall
|
||||
|
||||
## Wednesday
|
||||
|
||||
- 08:15 - 08:30: Tagesplanung, Lese Martin's Installations-Anleitung
|
||||
- 08:30 - 09:00: Privat
|
||||
- 09:00 - 12:00: Firewall Einrichtung: Analysiere Kunden Netzwerk erst, Temporaere Netze/Interfaces konfigurieren, Auth Server konfigurieren, WAN PPPoE eintragen, Recherchiere wegen Telefonanlage: Was zu beachten in neuer Firewall?
|
||||
- 12:00 - 13:00: Pause
|
||||
- 13:00 - 17:30: Firewall konfig fortfahren, TLS/SSL inspection anpassen (stunden lang), vpn einrichten, adminstrator einstellungen setzen, IPS anschalten, web proxy anschalten, dnat regel setzen, ntp config, kabel einpacken, wlan pruefen (ap kommt erst naechste woche)
|
||||
|
||||
## Tuesday
|
||||
|
||||
- 09:00 - 09:15: Ticketpflege, Tagesplanung
|
||||
- 09:15 - 09:45: Telefonat mir Martin: Er braucht usb sticks, veranlasse courier, bereite usb sticks noch mit xml vor
|
||||
- 09:45 - 11:30: Anleitung Disco
|
||||
- 11:30 - 13:00: Pause
|
||||
- 13:00 - 13:15: Blocherer Schule: Auf Mail von Loeffelholz antworten
|
||||
- 13:15 - 13:45: Sebastian Muehlbauer: Outlook Postafaecher hinzufuegen. Kein sekretariat's Postfach
|
||||
- 13:45 - 15:00: Bei Boschmann+Feth reinarbeiten. Telefonat mit Herrn Feth. Sie wissen nicht bescheid. Firewall auf Platz aufbauen
|
||||
- 15:00 - 15:30: Backup download bestehender Firewall. Richte neue Firewall ein
|
||||
- 15:30 - 17:00: Meeting mit Simone zu Firewall
|
||||
|
||||
## Monday
|
||||
|
||||
- 10:30 - 11:00: Meeting vorbereiten: Pruefe metabase VM: docker logs, scripts; pruefe reverse proxy VM: unattended-upgrades, reverse proxy
|
||||
- 11:00 - 11:15: DiscoPharma Meeting
|
||||
|
||||
- 15:30 - 16:00: Stelle Firewall Schedule bei der radiochemie Firewall ein. Oeffne Port 80 fuer naechsten Lets Encrypt renew
|
||||
- 16:00 - 16:30: Besprechung mit Marko Firewall Migration bei Boschmann und Feth zu machen. Projekt Ticket fuer Firewall anschauen, Blocker im Kalendar setzen
|
||||
- 16:30 - 17:00: dns drei-v.de untersuchen.
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
71
diary/2025-03-28.md
Normal file
71
diary/2025-03-28.md
Normal file
@@ -0,0 +1,71 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- boschmann firewall vorbereiten fuer migration
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- discopharma: Anleitung
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 08::30 - 08:45: bvv. dns cname setzen
|
||||
- 09:00 - 09:30: Kabel und alte Firewall aufraeumen
|
||||
- 09:30 - 10:00: Ticketpflege
|
||||
- 10:00 - 10:15: Meeting mit Michael: ISO Installationsstick, Neue Ninja Features
|
||||
- 10:15 - 12:00: Ticketpflege, Firewall Migration
|
||||
- 12:00 - 13:00: pause
|
||||
- 13:00 - 17:00: metabase stuff, gammeln
|
||||
|
||||
## Tuesday
|
||||
|
||||
- 13:00 - 13:15: Blocherer Schule: Auf Mail von Loeffelholz antworten
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
88
diary/2025-03-31.md
Normal file
88
diary/2025-03-31.md
Normal file
@@ -0,0 +1,88 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- ssr: domain machraum.de
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 08:45 - 09:00: Tagesaufgaben rausschreiben
|
||||
- 09:00 - 09:45: [x] IT-Glue fuer Boschmann anpassen, Passwoerter setzen, alter Archivieren, Configuration befuellen, und anderes
|
||||
- 10:00 - 10:30: Nina schreiben wegen wildcard bei Kwa und wegen Domaenen. Telefonat mit Nina wegen machraum.de Domain und Lizenzen bei SSR
|
||||
- 10:30 - 11:15: Stunden nachtragen fuer Firewall Migration bei Boschmann, Rufus AP in Ruckus Dashboard hinzufuegen, Kunde in Ruckus anlegen, ap in ruckus suchen: nicht auffindbar
|
||||
- 11:15 - 12:15: Pause
|
||||
- 12:15 - 12:30: SSR NAS "active share" updaten (plugin udpaten)
|
||||
- 12:30 - 12:45: disco fertig machen
|
||||
- 12:45 - 13:00: Ruckus AP in Dashboard verbinden und Kunden zuweisen
|
||||
- 13:00 - 13:15: Pause
|
||||
- 13:15 - 14:15: Disco Dokument Korrekturlesen. Kommunikation mit Lukas und Milos
|
||||
- 14:00 - 14:30: Pause
|
||||
- 14:30 - 14:45: Telefonat mit Hannah wegen Problemen bei Autoinstallation
|
||||
- 14:45 - 15:00: [x] Unterstuetzung Alija bei Boschmann VPN Problem
|
||||
- 15:00 - 15:15: Aufregen um Mails rauszuschicken, weil M365 es nicht kann
|
||||
- 15:15 - 15:30: Versuchen AP in Ruckus Dashboard hinzuzufuegen
|
||||
- 15:30 - 15:45: Rauchen
|
||||
- 15:45 - 16:00: Unterstuetzung Marko bei der Einrichtung des WLANs beim BuF AP
|
||||
- 16:00 - 16:30: Domaene 'machraum.de' bei SSR umziehen
|
||||
- 16:30 - 17:00: Ticketpflege
|
||||
|
||||
## Friday
|
||||
|
||||
- 08::30 - 08:45: [x] bvv. dns cname setzen
|
||||
- 09:00 - 09:30: [x] Kabel und alte Firewall aufraeumen
|
||||
- 09:30 - 10:00: [x] Ticketpflege
|
||||
- 10:00 - 10:15: [x] Meeting mit Michael: ISO Installationsstick, Neue Ninja Features
|
||||
- 10:15 - 12:00: Ticketpflege, Firewall Migration
|
||||
|
||||
- 13:00 - 17:00: metabase stuff, gammeln
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
71
diary/2025-04-01.md
Normal file
71
diary/2025-04-01.md
Normal file
@@ -0,0 +1,71 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- ssr: domain machraum.de
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 08:45 - 09:15: Anfahrt BuF
|
||||
|
||||
- 10:00 - 10:45: Anfahrt Buero
|
||||
- 10:45 - 11:15: Ticketpflege
|
||||
- 11:15 - 11:30: Lachen ueber Verkabelung
|
||||
- 11:30 - 12:00: Mail verfassen an BuF fuer Kabelordnung fuer Umverkabelung des Serverschranks
|
||||
- 12:00 - 13:00: Burger King
|
||||
- 13:00 - 13:30: DNS Eintrage fuer machraum.de wiederherstellen und Mails an Nina wegen domains
|
||||
- 13:30 - 14:00: 4architekten.de homepage
|
||||
- 14:00 - 14:15: Austausch mit Herrmann zu Mailstore und OPNsense Bestellungen bei KWA
|
||||
- 14:15 - 14:45: Quelldateien migrieren
|
||||
- 14:45 - 16:45: 4architekten homepage
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulus und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
83
diary/2025-04-02.md
Normal file
83
diary/2025-04-02.md
Normal file
@@ -0,0 +1,83 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- ssr: domain machraum.de
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 09:00 - 09:15: Mit Jan Firewalls aufraeumen
|
||||
- 09:15 - 10:00: Extrahiere PPPoE Daten bei SG von GE-Planung. Schreibe entsprechende Anleitung fuer IT-Glue
|
||||
- 10:00 - 10:15: rauchen
|
||||
- 10:30 - 11:30: 4architekten homepage
|
||||
- 11:30 - 12:30: Pause
|
||||
- 12:30 - 13:00: Nina schreiben wegen opnsense
|
||||
- 13:00 - 15:30: Unterstuetzung Jan bei Win Projekt: Geraete Listen erstellen:
|
||||
- 15:30 - 16:30: Meeting mit Thilo und Max zu KWA M365
|
||||
- 16:30 - 17:00: Unterstuetzung von Jan Win Projekt
|
||||
|
||||
## Tuesday
|
||||
|
||||
- 08:45 - 09:15: Anfahrt BuF
|
||||
|
||||
- 10:00 - 10:45: Anfahrt Buero
|
||||
- 10:45 - 11:15: Ticketpflege
|
||||
- 11:15 - 11:30: Lachen ueber Verkabelung
|
||||
- 11:30 - 12:00: Mail verfassen an BuF fuer Kabelordnung fuer Umverkabelung des Serverschranks
|
||||
- 12:00 - 13:00: Burger King
|
||||
- 13:00 - 13:30: DNS Eintrage fuer machraum.de wiederherstellen und Mails an Nina wegen domains
|
||||
- 13:30 - 14:00: 4architekten.de homepage
|
||||
- 14:00 - 14:15: Austausch mit Herrmann zu Mailstore und OPNsense Bestellungen bei KWA
|
||||
- 14:15 - 14:45: Quelldateien migrieren
|
||||
- 14:45 - 16:45: 4architekten homepage
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulo und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
94
diary/2025-04-03.md
Normal file
94
diary/2025-04-03.md
Normal file
@@ -0,0 +1,94 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- ssr: domain machraum.de
|
||||
- qumulo
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 09:15 - 09:45: Arbeit macht frei, Privaten Mail Server reinigen
|
||||
- 09:45 - 10:00: Nachdenken was ich mache
|
||||
- 10:00 - 11:00: Linux Server updaten. Mail Server bei SSR kaputt gemacht: Reboot waehrend Kernel update. Muss beobachtet werden in Zukunft. Initramfs fehlt fuer aktuelles Kernel
|
||||
- 11:00 -12:00: 4architekten homepage
|
||||
- 12:00 - 13:00: Pause
|
||||
- 13:00 - 13:30: neue Mitarbeiterin anlegen
|
||||
- 13:30 - 15:00: 4architekten homepage
|
||||
- 15:00 - 17:00: MacBook einrichten. Teste Punkte aus KWA's Unzufriedenheitsliste
|
||||
|
||||
## Wednesday
|
||||
|
||||
- 09:00 - 09:15: Mit Jan Firewalls aufraeumen
|
||||
- 09:15 - 10:00: Extrahiere PPPoE Daten bei SG von GE-Planung. Schreibe entsprechende Anleitung fuer IT-Glue
|
||||
- 10:00 - 10:15: rauchen
|
||||
- 10:30 - 11:30: 4architekten homepage
|
||||
- 11:30 - 12:30: Pause
|
||||
- 12:30 - 13:00: Nina schreiben wegen opnsense
|
||||
- 13:00 - 15:30: Unterstuetzung Jan bei Win Projekt: Geraete Listen erstellen:
|
||||
- 15:30 - 16:30: Meeting mit Thilo und Max zu KWA M365
|
||||
- 16:30 - 17:00: Unterstuetzung von Jan Win Projekt
|
||||
|
||||
## Tuesday
|
||||
|
||||
- 08:45 - 09:15: Anfahrt BuF
|
||||
|
||||
- 10:00 - 10:45: Anfahrt Buero
|
||||
- 10:45 - 11:15: Ticketpflege
|
||||
- 11:15 - 11:30: Lachen ueber Verkabelung
|
||||
- 11:30 - 12:00: Mail verfassen an BuF fuer Kabelordnung fuer Umverkabelung des Serverschranks
|
||||
|
||||
- 13:30 - 14:00: 4architekten.de homepage
|
||||
- 14:00 - 14:15: Austausch mit Herrmann zu Mailstore und OPNsense Bestellungen bei KWA
|
||||
- 14:15 - 14:45: Quelldateien migrieren
|
||||
- 14:45 - 16:45: 4architekten homepage
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulo und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
100
diary/2025-04-04.md
Normal file
100
diary/2025-04-04.md
Normal file
@@ -0,0 +1,100 @@
|
||||
$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$
|
||||
|
||||
|
||||
|
||||
## Do-It
|
||||
|
||||
- handout: Sophos und OPNsense
|
||||
- ssr: Macbook neuanschaffung raussuchen
|
||||
- ssr: domain machraum.de
|
||||
- qumulo
|
||||
|
||||
## Timestamps
|
||||
|
||||
- 09:00 - 09:15: MacOs einrichten
|
||||
- 09:15 - 09:30: KWA M365 Statusbesprechung mit Max
|
||||
- 09:30 - 10:00: nc an mac einbinden, caps lock zu esc, Teste Mail verschieben in Outlook new auf Mac mit max, ninja auf test macbook installieren
|
||||
|
||||
## Thursday
|
||||
|
||||
- 09:15 - 09:45: Arbeit macht frei, Privaten Mail Server reinigen
|
||||
- 09:45 - 10:00: Nachdenken was ich mache
|
||||
- 10:00 - 11:00: Linux Server updaten. Mail Server bei SSR kaputt gemacht: Reboot waehrend Kernel update. Muss beobachtet werden in Zukunft. Initramfs fehlt fuer aktuelles Kernel
|
||||
- 11:00 -12:00: 4architekten homepage
|
||||
- 12:00 - 13:00: Pause
|
||||
- 13:00 - 13:30: neue Mitarbeiterin anlegen
|
||||
- 13:30 - 15:00: 4architekten homepage
|
||||
- 15:00 - 17:00: MacBook einrichten. Teste Punkte aus KWA's Unzufriedenheitsliste
|
||||
|
||||
## Wednesday
|
||||
|
||||
- 09:00 - 09:15: Mit Jan Firewalls aufraeumen
|
||||
- 09:15 - 10:00: Extrahiere PPPoE Daten bei SG von GE-Planung. Schreibe entsprechende Anleitung fuer IT-Glue
|
||||
- 10:00 - 10:15: rauchen
|
||||
- 10:30 - 11:30: 4architekten homepage
|
||||
- 11:30 - 12:30: Pause
|
||||
- 12:30 - 13:00: Nina schreiben wegen opnsense
|
||||
- 13:00 - 15:30: Unterstuetzung Jan bei Win Projekt: Geraete Listen erstellen:
|
||||
- 15:30 - 16:30: Meeting mit Thilo und Max zu KWA M365
|
||||
- 16:30 - 17:00: Unterstuetzung von Jan Win Projekt
|
||||
|
||||
## Tuesday
|
||||
|
||||
- 08:45 - 09:15: Anfahrt BuF
|
||||
|
||||
- 10:00 - 10:45: Anfahrt Buero
|
||||
- 10:45 - 11:15: Ticketpflege
|
||||
- 11:15 - 11:30: Lachen ueber Verkabelung
|
||||
- 11:30 - 12:00: Mail verfassen an BuF fuer Kabelordnung fuer Umverkabelung des Serverschranks
|
||||
|
||||
- 13:30 - 14:00: 4architekten.de homepage
|
||||
- 14:00 - 14:15: Austausch mit Herrmann zu Mailstore und OPNsense Bestellungen bei KWA
|
||||
- 14:15 - 14:45: Quelldateien migrieren
|
||||
- 14:45 - 16:45: 4architekten homepage
|
||||
|
||||
## todo
|
||||
|
||||
### General
|
||||
|
||||
- [ ] handout fuer jeweils sophos und opnsense als vergleich
|
||||
- [ ] aufgaben fuer wartung rausschreiben
|
||||
- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline)
|
||||
|
||||
- [ ] herr fuechsle wegen homepage (kwa/ssr)
|
||||
- [ ] kwa/ssr - offene Rechungen zu MacBook Ersteinrichtungen
|
||||
- [ ] neosphere - ueberblick anleitung zum qumulo und dem computing cluster
|
||||
|
||||
- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung
|
||||
|
||||
- [ ] plan for beta automatic os deployment/windows 10 to 11 upgrade
|
||||
|
||||
- [ ] mailstore update ssr/kwa
|
||||
- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs
|
||||
- [ ] kwa/ssr snmp karten fuer usv
|
||||
- [ ] update filewave admin und central
|
||||
|
||||
### SBX
|
||||
|
||||
- [ ] check if possible to monitor vsphere passwd expiration
|
||||
- [ ] create obsidian templates (Meetings, People, )
|
||||
- [ ] sbx - opsreportcard summary for action plan
|
||||
- [ ] sbx - disney workshop - planung
|
||||
|
||||
- [ ] fuege bharchitekten zu connectsecure hinzu
|
||||
- [ ] erstelle connectsecure report fuer grasslfing
|
||||
- [ ] cybercns bei heilmaier
|
||||
|
||||
- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups
|
||||
|
||||
#### OPNsense
|
||||
|
||||
1. check franke rieger firewall setup
|
||||
2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...)
|
||||
3. test management via opncentral
|
||||
4. write manual for on-boarding
|
||||
- setup wan manually
|
||||
- couple to opncentral
|
||||
- send generic config via opncentral
|
||||
- use manual for missing specific configs
|
||||
- check workings of everything
|
||||
|
||||
BIN
files/discopharma/discopharma-infra.drawio.png
Normal file
BIN
files/discopharma/discopharma-infra.drawio.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 58 KiB |
131
projects/boschmann+feth/20250326-Preparation.md
Normal file
131
projects/boschmann+feth/20250326-Preparation.md
Normal file
@@ -0,0 +1,131 @@
|
||||
|
||||
## ToDo
|
||||
|
||||
|
||||
- [=] ap integrieren
|
||||
- [=] ap ip anpassen
|
||||
|
||||
- [x] server auf maintenance in ninja einstellen
|
||||
- [x] mount kid befestingen
|
||||
- [=] switch ip anpassen
|
||||
- [x] vlans erstellen
|
||||
- [=] switch vlans konfigurieren
|
||||
- [x] dns einstellungen anpassen
|
||||
- [x] client rechner an switch (welche ports brauchen untagged client net)
|
||||
- [x] fw regeln fuer vpn
|
||||
- [x] second admin vpn
|
||||
- [ ] star money, datev for ssl inspection exclude
|
||||
- [ ] services.starfinanzen.de
|
||||
- [ ] frontgate-eu.factsetdigitalsolutions.com
|
||||
- [ ] starmoney.aboalarm.de
|
||||
- [ ] web.starmoney.de
|
||||
- [ ] starfinanz.de
|
||||
- [ ] starmoney.de
|
||||
|
||||
|
||||
- [ ] naechste Woche mehr kure gruene kabel mitnehmen (.25m)
|
||||
|
||||
## Einsatz
|
||||
|
||||
- WLAN-Intern: d5C9nhBBDGhd
|
||||
- fP33-y4be-M8Qk
|
||||
|
||||
### Switch Ports
|
||||
|
||||
| Port | Device(s) | VLANs | Note |
|
||||
| ---- | -------------------- | -------------------------------- | --------------- |
|
||||
| 1 | Firewall | tagged: default, untagged: all | |
|
||||
| 2 | HP | | ws |
|
||||
| 4 | Mitel (phone) | untagged: 11, tagged: none | |
|
||||
| 13 | Mitel (phone) | untagged: 11, tagged: none | |
|
||||
| 19 | Mitel (phone) | untagged: 11, tagged: none | Printer |
|
||||
| 25 | ? | | |
|
||||
| 27 | Mitel (phone) | untagged: 11, tagged: none | WS-Boschmann |
|
||||
| 28 | Mitel (phone) and HP | untagged: 11, tagged: none | WS |
|
||||
| 34 | Mitel (phone) and HP | untagged: 11, tagged: none | WS-07 |
|
||||
| 35 | Mitel (phone) | untagged: 11, tagged: none | |
|
||||
| 37 | Mitel (phone) | untagged: 11, tagged: none | |
|
||||
| 38 | HP | | ws |
|
||||
| 39 | Mitel (phone) and HP | untagged: 11, tagged: none | WS |
|
||||
| 40 | Mitel (phone) | untagged: 11, tagged: none | |
|
||||
| 41 | Mitel (phone) and HP | untagged: 11, tagged: none | WS-14 |
|
||||
| 43 | Sophos AP | untagged: default, tagged: 30,40 | several devices |
|
||||
| 44 | HP | | ws |
|
||||
| 46 | Mitel (phone) | untagged: 11, tagged: none | |
|
||||
| 47 | ? | | |
|
||||
| 48 | Server in UG | untagged: 11, tagged: none | |
|
||||
|
||||
|
||||
|
||||
## Basis
|
||||
|
||||
### Network
|
||||
|
||||
#### Interfaces
|
||||
|
||||
- LAN (Port1): Network 192.168.11.254/24
|
||||
- [x] define V11_LAN_SERVER for this network
|
||||
- [x] Call physical LAN interface V50_LAN_MGMT
|
||||
- WAN (Port2 and Port8): Two Configured
|
||||
- [x] Port2: PPPoE (versatel) 104.151.27.221/32
|
||||
- [x] Port8: Static 192.168.178.254/24 (Fritzbox. For phone?)
|
||||
- WiFi (BuF_Gast): Network: 192.168.111.100
|
||||
|
||||
#### VLANs
|
||||
|
||||
Currently no VLANs (except this weird wifi thing).
|
||||
|
||||
VLANs for new Firewall:
|
||||
- V11_LAN_SERVER
|
||||
- V20_LAN_CLIENT
|
||||
- V30_WLAN_INTERNAL
|
||||
- V40_WLAN_GUEST
|
||||
- V50_LAN_MGMT
|
||||
- (V70_LAN_PHONE ??)
|
||||
|
||||
#### DHCP
|
||||
- DHCP only for WLAN_Gast: 192.168.111.101 - 192.168.111.120
|
||||
- DC is doing DHCP for 192.168.11.0/24 network: 192.168.11.80 - .159
|
||||
|
||||
#### Services
|
||||
|
||||
- Star Money (banking)
|
||||
- Teamviewer
|
||||
- Cosoba
|
||||
- DATEV
|
||||
- Zoom
|
||||
- DropBox
|
||||
- Google Drive
|
||||
- OneDrive
|
||||
- M365
|
||||
- Sharepoint
|
||||
|
||||
|
||||
#### DNS
|
||||
|
||||
- [x] Configure DNS request route to DC for new Firewall
|
||||
- DC is doing DNS when acting as DHCP Server
|
||||
|
||||
### Authentication
|
||||
|
||||
#### Server
|
||||
|
||||
- Server Type: AD
|
||||
- Server Name: BUF-SRV-DC-01
|
||||
- Server IP/Domain: 192.168.11.13
|
||||
- Connection Sec: SSL/TLS
|
||||
- Port: 636
|
||||
- NetBIOS domain: BUF
|
||||
- ADS user name: sophos_ldap
|
||||
- Password: IT-Glue
|
||||
- Emal address attribute: mail
|
||||
- Domain name: buf.local
|
||||
- Search Queries: dc=buf,dc=local
|
||||
|
||||
### Phone
|
||||
|
||||
- not separate configuration needed. Only Set WAN to fritz correctly. Check the connectivity to phones after migration
|
||||
|
||||
|
||||
|
||||
### VPN
|
||||
@@ -1,10 +1,142 @@
|
||||
|
||||
## Intro
|
||||
|
||||
Goal: Have a detailed manual for making changes at a running bind server without destroying it.
|
||||
Motivation: The bind config had been successfully destroyed by accident. (by leaving out a \$-symbol)
|
||||
- Ziel: Schreibe eine detailierte Anleitung, welche es moeglich die DNS Eintraege von bind zu aendern ohne den Server kaputt zu machen.
|
||||
- Motivation: Die bind Konfiguration wurde versehentlich erfolgreich zerstoert, was dazu fuehrte, dass der bind Server nicht mehr funktionierte.
|
||||
|
||||
## Receipt
|
||||
|
||||
Um Aenderungen am bind9 Server beim BVV durchzufuehren muss der Syntax von bind beachtet werden. Bei Fehlern kann es sein, dass die ganze DNS Aufloesung nicht mehr funktioniert.
|
||||
|
||||
### Einfuehrung
|
||||
|
||||
Alle Konfigurationsdateien fuer bind liegen im Ordner `/etc/bind/` am ns2 Server. Die Hauptkonfigurationsdatei fuer bind ist hierbei `/etc/bind/named.conf` von der Alles ausgeht. `named` ist herbei der Dienst zu `bind` zugehoerige Dienst, welcher im Hintergrund laueft; der Status der `named`-Dienstes kann geprueft werden mit: `systemctl status named`.
|
||||
Saemtliche Zonen fuer die von diesem `bind` Server verwalteten Domaenen sind in der Datei `/etc/bind/named.conf.local` hinterlegt; die zugehoerige Datei fuer jede Domaene wo die DNS Eintrage gesetzt werden sind hier in der Datei `/etc/bind/named.conf.local` definiert unter der Variablen `file`. Unter der hier genutzten Strukturierung sind die DNS Eintraege hinterlegt in den Dateien `/etc/bind/db.<tld>.<domain>`. Zum Beispiel die DNS Eintraege fuer die Domaene `vhs-bayern.de` liegt in der Datei `/etc/bind/db.de.vhs-bayern`.
|
||||
|
||||
### Aenderungen der DNS Eintraege
|
||||
|
||||
Um die DNS Eintraege einer bestimmten Domaene zu aendern, muss die jeweilige Zonen Datei geoeffnet werden; zum Beispiel `/etc/bind/db.de.vhs-bayern.de` fuer die Domaene `vhs-bayern.de`:
|
||||
```conf
|
||||
$ORIGIN vhs-bayern.de.
|
||||
$TTL 60
|
||||
@ IN SOA ns1.vhs-bayern.de. hostmaster.vhs-bayern.de. (
|
||||
2024121702 ; serial number (yyyymmddxx)
|
||||
14400 ; refresh every 4 hours
|
||||
14400 ; retry after 4 hours
|
||||
604800 ; expire after 7 days
|
||||
43200) ; default ttl is 12 hours
|
||||
IN A 49.13.175.195 ; old: 144.76.93.148
|
||||
IN NS ns1.vhs-bayern.de.
|
||||
IN NS ns1.m-online.net.
|
||||
IN NS ns2.m-online.net.
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||||
;;; Local Host Address ;;;
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||||
localhost IN A 127.0.0.1
|
||||
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;
|
||||
;;; NS Eintraege ;;;
|
||||
;;;;;;;;;;;;;;;;;;;;
|
||||
newsletter.vhs-bayern.de. 1800 IN NS ns0.isprit2.de.
|
||||
newsletter.vhs-bayern.de. 1800 IN NS ns1.isprit2.de.
|
||||
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;
|
||||
;;; MX Eintraege ;;;
|
||||
;;;;;;;;;;;;;;;;;;;;
|
||||
listserver.vhs-bayern.de. IN MX 10 listserver.vhs-bayern.de.
|
||||
;;;vhs-bayern.de. IN MX 10 mx01.vhs-bayern.de.
|
||||
ns1.vhs-bayern.de. IN MX 10 mx01.vhs-bayern.de.
|
||||
intmx IN MX 10 domino
|
||||
intmx IN MX 20 domino2
|
||||
mailtest.vhs-bayern.de. 60 IN MX 10 mailtest
|
||||
vhs-bayern.de. IN MX 0 vhsbayern-de0i.mail.protection.outlook.com.
|
||||
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;;
|
||||
;;; TXT Eintraege ;;;
|
||||
;;;;;;;;;;;;;;;;;;;;;
|
||||
;;vhs-bayern.de. 60 IN TXT "v=spf1 a mx ip4:62.245.128.64/27 ip4:62.245.128.96/27 include:spf.protection.outlook.com -all"
|
||||
vhs-bayern.de. 60 IN TXT "v=spf1 a mx ip4:20.50.178.65/32 ip4:62.245.128.64/27 ip4:62.245.128.96/27 include:spf.protection.outlook.com -all"
|
||||
vhs-bayern.de. 3600 IN TXT "MS=ms64478158"
|
||||
;_dnsauth.vhs-bayern.de. 300 IN TXT "2024021509350769xvfne3rv45zuft4zpkil5d67tbpvkvnjlfei3862b34yrbsj"
|
||||
_dnsauth.vhs-bayern.de. 300 IN TXT "202411121019550lyjgntwd5v35uvf533roxftuvkf9hbv20okc4g3xt0umpn6p8"
|
||||
_dnsauth.www.vhs-bayern.de. 300 IN TXT "202411121019550lyjgntwd5v35uvf533roxftuvkf9hbv20okc4g3xt0umpn6p8"
|
||||
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;;;;
|
||||
;;; CNAME Eintraege ;;;
|
||||
;;;;;;;;;;;;;;;;;;;;;;;
|
||||
autodiscover CNAME autodiscover.outlook.com.
|
||||
selector1._domainkey CNAME selector1-vhsbayern-de0i._domainkey.bvv1.onmicrosoft.com.
|
||||
selector2._domainkey CNAME selector2-vhsbayern-de0i._domainkey.bvv1.onmicrosoft.com.
|
||||
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;
|
||||
;;; A Eintraege ;;;
|
||||
;;;;;;;;;;;;;;;;;;;
|
||||
mx01 IN A 62.245.128.92
|
||||
rproxy2 IN A 62.245.128.84
|
||||
mail-gw1 IN A 62.245.128.85
|
||||
;analytics IN A 62.245.128.69
|
||||
domino IN A 192.168.1.108
|
||||
domino2 IN A 192.168.1.109
|
||||
;2009 IN A 62.245.128.90 deaktiviert 17.12.2024
|
||||
;rproxy IN A 62.245.128.65
|
||||
;eportfolio IN A 62.245.128.75
|
||||
;ksc IN A 62.245.128.71
|
||||
;ksc2 IN A 62.245.128.71
|
||||
;portal1 IN A 192.168.1.117
|
||||
;portal2 IN A 192.168.1.118
|
||||
;db2portal IN A 192.168.1.119 deaktiviert 17.12.2024
|
||||
;ntp IN A 192.168.1.110 deaktiviert 17.12.2024
|
||||
;ntp IN A 192.168.1.130 deaktiviert 17.12.2024
|
||||
ns1 IN A 62.245.128.66
|
||||
vpn IN A 62.245.128.125
|
||||
;ol3 IN A 62.245.128.89 deaktiviert 17.12.2024
|
||||
;icsdb2 IN A 192.168.1.131 deaktiviert 17.12.2024
|
||||
;ics1 IN A 192.168.1.132
|
||||
;ics2 IN A 192.168.1.133
|
||||
icsweb1 IN A 62.245.128.70 ;Staecker fragen
|
||||
mailtest 60 IN A 62.245.128.94 ;?
|
||||
;ttwportal 60 IN A 144.76.93.148 deaktiviert 17.12.2024
|
||||
;www.ttwportal 60 IN A 144.76.93.148 deaktiviert 17.12.2024
|
||||
www 60 IN A 49.13.175.195 ;Neuer Provider old: 144.76.93.148
|
||||
production IN A 49.13.175.195 ;Neuer Provider 4motion
|
||||
testing IN A 49.13.175.195 ;Neuer provider 4motion
|
||||
analytics IN A 49.13.175.195 ;Neuer Provider 4motion
|
||||
|
||||
```
|
||||
|
||||
**Wichtig zu beachten hier ist, dass bei jeder Aenderung einer dieser Zonendateien die Seriennummer (ganz oben in der Datei im ersten DNS Eintrag) *erhoeht* werden muss. Egal um welchen Wert; die Seriennummer muss nur groesser sein, als die vorherige! Uebliches Schema ist das heutige Datum mit einer nachgestellten Zaehlung fuer jede Aenderung des Tages; zum Bespiel: 2025032401. Ohne diesen Schritt wuerde der Dienst Fehlermeldungen ausgeben und nicht mehr funktionieren.**
|
||||
|
||||
Sagen wir fuegen der obigen Datei einen DNS-Eintrag: `test IN A <ip-address>` ein. Damit dieser wirksam wird muss die Seriennummer im ersten DNS Eintrag erhoeht werden:
|
||||
```conf
|
||||
$ORIGIN vhs-bayern.de.
|
||||
$TTL 60
|
||||
@ IN SOA ns1.vhs-bayern.de. hostmaster.vhs-bayern.de. (
|
||||
--------> 2025032401 ; serial number (yyyymmddxx) <---------------
|
||||
14400 ; refresh every 4 hours
|
||||
14400 ; retry after 4 hours
|
||||
604800 ; expire after 7 days
|
||||
43200) ; default ttl is 12 hours
|
||||
IN A 49.13.175.195 ; old: 144.76.93.148
|
||||
IN NS ns1.vhs-bayern.de.
|
||||
IN NS ns1.m-online.net.
|
||||
IN NS ns2.m-online.net.
|
||||
|
||||
```
|
||||
|
||||
Nachdem die Anpassung durchgefuehrt wurde sollten zu Sicherheit die Konfigurationsdateien auf Richtigkeit geprueft werden:
|
||||
1. Pruefe die Konfiguration der 'Master'-Datei: `named-checkconf /etc/bind/named.conf`. Keine Ausgabe bedeutet: Alles gut!
|
||||
2. Pruefe die Zonendatei mit: `named-checkzone vhs-bayern.de /etc/bind/db.de.vhs-bayern`:
|
||||
```sh
|
||||
root@ns2:/etc/bind# named-checkzone vhs-bayern.de db.de.vhs-bayern
|
||||
zone vhs-bayern.de/IN: loaded serial 2024121702
|
||||
OK
|
||||
```
|
||||
Der Befehl zeigt auch die aktuelle Seriennummer der Zone an!
|
||||
3. Sofern es bei den zwei vorherigen Schritten keine Fehlermeldungen gab, kann der `named`-Dienst neugestartet werden mit: `systemctl restart named`
|
||||
4. Pruefe noch den Status den `named`-Dienstes mit `systemctl status named`. Wenn es keine Fehler gibt sollte der neu hinzugefuegt Eintrag funktionieren.
|
||||
@@ -1,11 +0,0 @@
|
||||
|
||||
## To do's:
|
||||
|
||||
- Cloud SQL dump load and user mgmt (Miloš)
|
||||
- Docker licensing (Lukas)
|
||||
- backup procedure for MB application db (Petar)
|
||||
- Documentation/ manual (Petar)
|
||||
- For example,
|
||||
- how deployment works,
|
||||
- what docker image to select
|
||||
- how the routing in the reverse proxy is done
|
||||
300
projects/discopharma/20250320-manual-project.md
Normal file
300
projects/discopharma/20250320-manual-project.md
Normal file
@@ -0,0 +1,300 @@
|
||||
---
|
||||
title: "Metabase - Setup Manual"
|
||||
author: Petar Cubela
|
||||
date: March 20, 2025
|
||||
geometry: margin=1.5cm
|
||||
output: pdf_document
|
||||
---
|
||||
|
||||
## Intro
|
||||
|
||||
Setting up a Metabase instance via Docker with a PostgreSQL application database and a secure web connection via https mediated by a public facing reverse proxy (nginx) and commercial TLS/SSL certificates.
|
||||
|
||||
### Goals and Requirements
|
||||
|
||||
### Software
|
||||
|
||||
- Google Cloud Platform (GCP)
|
||||
- [Debain 12 (OS)](https://www.debian.org/download)
|
||||
- [Docker (Containerization Platform)](https://docs.docker.com/engine/install/debian/)
|
||||
- [NGINX (Web Server, Reverse Proxy)](https://docs.nginx.com/)
|
||||
- [Postgres (as Container)](https://hub.docker.com/_/postgres)
|
||||
- [Metabase (as Container)](https://hub.docker.com/r/metabase/metabase)
|
||||
|
||||
## VM Specs
|
||||
|
||||
### Metabase Server
|
||||
|
||||
- Name: Metabase Server
|
||||
- OS: Debian 12
|
||||
- hostname: mb-prod
|
||||
- IP Address: `10.156.0.6/24`
|
||||
- CPU: 2 core
|
||||
- RAM: 2 GB (2048 MB)
|
||||
- Storage: depends (30 GB)
|
||||
- DNS entry: none
|
||||
- Note: for every 20 concurrent users: needs 1CPU and 2GB of RAM more
|
||||
|
||||
### Reverse Proxy
|
||||
|
||||
- Name: Reverse Proxy
|
||||
- OS: Debian 12
|
||||
- hostname: rproxy
|
||||
- IP Address: `10.156.0.7/24` + `<PUBLIC IP>` address (only activated in the end)
|
||||
- CPU: 1 core
|
||||
- RAM: 1 GB (1024 MB)
|
||||
- Storage: depends (16 GB)
|
||||
- DNS entry: metabase.discopharma.de -> `<PUBLIC IP>`
|
||||
- Note: for every concurrent users: needs 1CPU and 2GB of RAM more
|
||||
|
||||
|
||||
### Firewall
|
||||
|
||||
I list all necessary communications and respective ports needed:
|
||||
|
||||
Abbreviations:
|
||||
- Metabse: mb-prod = `10.156.0.6`
|
||||
- Metabse Dev: mb-dev = `10.156.0.8`
|
||||
- ReverseProxy: rp = `10.156.0.7`
|
||||
|
||||
|
||||
| Source | SourcePort | Destination | DestPort | Description |
|
||||
| ------------- | ----------------------- | --------------- | ----------------------- | ------------------------------------------------------------------------------- |
|
||||
| mb-prod | 3306/tcp | db | 3306/tcp | 3306 is the standard mysql port. Communication of mb-prod to db |
|
||||
| rp | 3000/tcp </br> 3000/udp | mb-prod | 3000/tcp </br> 3000/udp | 3000 is the metabase web port. Reverse Proxy sends request via this port to mb. |
|
||||
| rp | 3000/tcp </br>3000/udp | mb-dev | 3000/tcp </br> 3000/udp | 3000 is the metabase web port. Reverse Proxy sends request via this port to mb. |
|
||||
| OPEN INTERNET | any | PUBLIC IP of rp | 443/tcp | 443 is the https port to communicate to rp over internet |
|
||||
|
||||
### Network Diagram
|
||||
|
||||
|
||||
|
||||
## Metabase Application Server and Database
|
||||
|
||||
### Administration
|
||||
|
||||
#### Update
|
||||
|
||||
In order to update the metabase containers change to the `~/metabase/` folder (where `compose.yml` file resides) and use the following command:
|
||||
```bash
|
||||
docker compose pull && docker compose up -d
|
||||
```
|
||||
Monitor the container logs to see if there are any errors by using the command:
|
||||
```bash
|
||||
docker compose logs -f
|
||||
```
|
||||
The `docker compose pull` command searches for images which are specified by a tag in the image variable in the `compose.yml` file:
|
||||
`image: metabase/metabase:latest`
|
||||
`latest` is here the tag and can also be changed to a version number which can be extracted from the [docker-hub](https://hub.docker.com/r/metabase/metabase/tags).
|
||||
|
||||
To simplify the process I wrote a simple bash script which updates the container images and removes old container images. The script is in the folder `/home/lukas_discopharma_de/scripts/metabase-update.sh`.
|
||||
The update has to be done manually.
|
||||
|
||||
#### Backup
|
||||
|
||||
There is a script `/home/lukas_discopharma_de/db-backup.sh` which creates a database dump from the postgres instance running in the container and places the dump into the folder at `/home/lukas_discopharma_de/backup-db` including the current date in the filename.
|
||||
The scripts runs weekly mondays at 2 a.m. via a cronjob. You should secure the backups/dumps to a secure location.
|
||||
|
||||
|
||||
### Development Instance
|
||||
|
||||
Go step-by-step through the installation and setup of a development metabase instance.
|
||||
|
||||
#### 1. Setup VM
|
||||
|
||||
Setup the a new VM with specs as described in the [VM specs](#vm-specs) section. The OS we are using is Debian 12. The private ip address can be chosen as `10.156.0.8`
|
||||
|
||||
#### 2. Update pkgs and install docker and compose
|
||||
|
||||
After Installation of the OS perform a pkg update:
|
||||
```bash
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
```
|
||||
|
||||
In order to install docker engine we will follow the official [documentation](https://docs.docker.com/engine/install/debian/).
|
||||
1. Set up Docker's `apt` repository
|
||||
```bash
|
||||
# Add Docker's official GPG key:
|
||||
sudo apt-get update
|
||||
sudo apt-get install ca-certificates curl
|
||||
sudo install -m 0755 -d /etc/apt/keyrings
|
||||
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
|
||||
sudo chmod a+r /etc/apt/keyrings/docker.asc
|
||||
|
||||
# Add the repository to Apt sources:
|
||||
echo \
|
||||
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
|
||||
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
||||
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
||||
sudo apt-get update
|
||||
```
|
||||
|
||||
2. Install the Docker packages (which includes docker compose)
|
||||
```bash
|
||||
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
||||
```
|
||||
3. Verify that the installation is successful by running the `hello-world` image
|
||||
```bash
|
||||
sudo docker run hello-world
|
||||
```
|
||||
|
||||
|
||||
It is possible to manage Docker as a non-root user. It the next steps we describe how to achieve this.
|
||||
We need to create a `docker` group and add to user we wish to use:
|
||||
1. Create the `docker` group
|
||||
```bash
|
||||
sudo groupadd docker
|
||||
```
|
||||
2. Add your user to the `docker` group.
|
||||
```bash
|
||||
sudo usermod -aG docker $USER
|
||||
```
|
||||
3. Log out and log back in so that your group membership is re-evaluated
|
||||
4. Verify that you can run `docker` commands without `sudo`
|
||||
```bash
|
||||
docker run hello-world
|
||||
```
|
||||
|
||||
#### 3. Create folder and compose file
|
||||
|
||||
After getting Docker Engine to work we can setup the necessary files and folders for the metabase container.
|
||||
Create a metabase folder for the docker compose files in your home folder:
|
||||
``` bash
|
||||
mkdir -p ~/metabase/plugins
|
||||
```
|
||||
|
||||
In addition create two files where the database user name and password will be placed:
|
||||
```bash
|
||||
touch ~/metabase/{db_user.txt,db_password.txt}
|
||||
```
|
||||
|
||||
Create a `compose.yml` file which will be used to spin up the containers:
|
||||
|
||||
```yaml
|
||||
---
|
||||
services:
|
||||
metabase:
|
||||
image: metabase/metabase:latest
|
||||
container_name: mb-dev
|
||||
hostname: mb-dev
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- /dev/urandom:/dev/random:ro
|
||||
- ./plugins:/plugins
|
||||
ports:
|
||||
- 3000:3000
|
||||
environment:
|
||||
JAVA_TIMEZONE: Europe/Berlin
|
||||
MB_DB_TYPE: postgres
|
||||
MB_DB_DBNAME: metabase
|
||||
MB_DB_PORT: 5432
|
||||
MB_DB_USER_FILE: /run/secrets/db_user
|
||||
MB_DB_PASS_FILE: /run/secrets/db_password
|
||||
MB_DB_HOST: postgres
|
||||
networks:
|
||||
- metanet1
|
||||
secrets:
|
||||
- db_password
|
||||
- db_user
|
||||
healthcheck:
|
||||
test: curl --fail -I http://localhost:3000/api/health || exit 1
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
postgres:
|
||||
image: postgres:latest
|
||||
container_name: postgres-dev
|
||||
hostname: postgres-dev
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
POSTGRES_USER_FILE: /run/secrets/db_user
|
||||
POSTGRES_DB: metabase
|
||||
POSTGRES_PASSWORD_FILE: /run/secrets/db_password
|
||||
networks:
|
||||
- metanet1
|
||||
secrets:
|
||||
- db_password
|
||||
- db_user
|
||||
networks:
|
||||
metanet1:
|
||||
driver: bridge
|
||||
secrets:
|
||||
db_password:
|
||||
file: db_password.txt
|
||||
db_user:
|
||||
file: db_user.txt
|
||||
```
|
||||
|
||||
Choose a name for the database user and place it in the `db_user.txt` file, e.g.:
|
||||
```bash
|
||||
echo "metabase" > db_user.txt
|
||||
```
|
||||
|
||||
and accordingly for the password:
|
||||
```bash
|
||||
echo "SecurePass" > db_password.txt
|
||||
```
|
||||
|
||||
Change the permissions of the files such that they are read-only for your own user:
|
||||
```bash
|
||||
chmod 400 db_*.txt
|
||||
```
|
||||
|
||||
#### 4. Pull images and start container
|
||||
|
||||
The pull of the container images and the start of the containers can be simply done by one command. Change the working directory to the metabase folder,
|
||||
```bash
|
||||
cd ~/metabase
|
||||
```
|
||||
and execute the command:
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
During the startup the log files for the containers should be monitored for possible errors by using the command:
|
||||
```bash
|
||||
docker compose logs -f
|
||||
```
|
||||
|
||||
If you see now errors and if you have the possibility to reach the server you can visit the metabase instance using the URL `http://<private-ip-of-server>:3000`. Port 3000 has to be open and you have to be able to reache the server via its private ip address.
|
||||
|
||||
## Reverse Proxy
|
||||
|
||||
The software which is used on the reverse proxy server is called `nginx`. This is a standard common web server/reverse proxy. Its configuration files reside in the folder `/etc/nginx/` and its log files can be found in `/var/logs/nginx/`.
|
||||
The configuration file which accomplishes the reverse proxying for your metabase instance is `/etc/nginx/sites-available/metabase.conf`:
|
||||
```conf
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name metabase.discopharma.de;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/discopharma.de/discopharma_fullchain.cer;
|
||||
ssl_certificate_key /etc/nginx/ssl/discopharma.de/discopharma_private.key;
|
||||
|
||||
|
||||
|
||||
if ($ssl_protocol = "") {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://10.156.0.6:3000;
|
||||
proxy_set_header HOST $host;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
In order to reverse proxy traffic to a development instance you can proceed as follows:
|
||||
1. Create a nginx configuration file for the dev metabase instance by copying the existing config: `cp /etc/nginx/sites-available/metabase.conf /etc/nginx/sites-available/mb-dev.conf`
|
||||
2. Open the new file using any text editor `nano /etc/nginx/sites-available/mb-dev.conf` and edit the `server_name` and `proxy_pass` variables to reflect your new dev instance, e.g.: `server_name mb-dev.discopharma.de;` (the corresponding dns entry for `mb-dev.discopharma.de` has to point to the public ip of the reverse proxy) and `proxy_pass http:<private-ip-of-server>:3000;`
|
||||
3. Create a symbolic link (nignx reads the config files in `sites-enabled`):
|
||||
```bash
|
||||
ln -sf /etc/nginx/sites-available/mb-dev.conf /etc/nginx/sites-enabled/
|
||||
```
|
||||
4. Restart the `nignx` service: `systemctl restart nginx`
|
||||
5. Setup your google firewall such that the reverse proxy can reach your dev metabase instance via port 3000.
|
||||
6. Visit `https://mb-dev.discopharma.de`. The homepage should working ssl certificates which are configured in the `nginx` configuration file for mb-dev.
|
||||
|
||||
|
||||
11
projects/discopharma/Meetings/20250317-finishing-meeting.md
Normal file
11
projects/discopharma/Meetings/20250317-finishing-meeting.md
Normal file
@@ -0,0 +1,11 @@
|
||||
|
||||
## To do's:
|
||||
|
||||
- [x] Cloud SQL dump load and user mgmt (Miloš)
|
||||
- [x] Docker licensing (Lukas)
|
||||
- [x] backup procedure for MB application db (Petar)
|
||||
- Documentation/ manual (Petar)
|
||||
- For example,
|
||||
- how deployment works,
|
||||
- what docker image to select
|
||||
- how the routing in the reverse proxy is done
|
||||
12
projects/discopharma/Meetings/20250324-meeting_in_prod.md
Normal file
12
projects/discopharma/Meetings/20250324-meeting_in_prod.md
Normal file
@@ -0,0 +1,12 @@
|
||||
|
||||
## Members
|
||||
|
||||
- Lukas Maas, Petar Cubela
|
||||
|
||||
|
||||
## Topics
|
||||
|
||||
- Manual
|
||||
- Backups of database
|
||||
- Updates of Container
|
||||
|
||||
@@ -1,9 +1,21 @@
|
||||
|
||||
---
|
||||
title: "OPNsense - KWA Migration"
|
||||
author: Petar Cubela
|
||||
date: March 20, 2025
|
||||
geometry: margin=1.5cm
|
||||
output: pdf_document
|
||||
---
|
||||
## Base Info
|
||||
|
||||
- Deadline: 03.05
|
||||
- Anzahl User: 15
|
||||
|
||||
## Termin
|
||||
|
||||
- 11.04, 14.04 - 17.04 (Friday 18.04: Karfreitag); 16.04 Vor-Ort
|
||||
- 22.04 - 25.04 (Monday 21.04: Ostermontag), 24.04 Vor-Ort
|
||||
|
||||
|
||||
## Angebot Liste
|
||||
|
||||
- Arbeitstunden ausrechnen (40 Stunden)
|
||||
|
||||
17
projects/sbx/firewall-std/std-network.md
Normal file
17
projects/sbx/firewall-std/std-network.md
Normal file
@@ -0,0 +1,17 @@
|
||||
## Interfaces
|
||||
|
||||
- Port1: V50_MGMT: 192.168.50.254/24
|
||||
- Port2: WAN: PPPoE or Static
|
||||
|
||||
## VLANs
|
||||
|
||||
| Name | Net |
|
||||
| ----------------- | ----------------- |
|
||||
| V10_SERVER | 192.168.10.254/24 |
|
||||
| V20_CLIENT | 192.168.20.254/24 |
|
||||
| V30_WLAN_INTERNAL | 192.168.30.254/24 |
|
||||
| V40_WLAN_GUEST | 192.168.40.254/24 |
|
||||
| V50_MGMT | 192.168.50.254/24 |
|
||||
| V60_PRINT | 192.168.60.254/24 |
|
||||
| V60_PHONE | 192.168.70.254/24 |
|
||||
|
||||
4
projects/sbx/firewall-std/std-tools.md
Normal file
4
projects/sbx/firewall-std/std-tools.md
Normal file
@@ -0,0 +1,4 @@
|
||||
|
||||
- mounting rack screws
|
||||
- label tool
|
||||
- screw driver
|
||||
19
projects/sbx/manuals/Sophos-SG_PPPoE-data.md
Normal file
19
projects/sbx/manuals/Sophos-SG_PPPoE-data.md
Normal file
@@ -0,0 +1,19 @@
|
||||
|
||||
## Configure SSH
|
||||
|
||||
1. Sophos SG Web-UI anmelden
|
||||
2. Management -> System Settings -> Shell Access:
|
||||
1. Setze Passwort fuer den `root` und `loginuser`
|
||||
2. Fuege das von dir Netzwerk zu "Erlaubten Netzwerken" hinzu
|
||||
3. Erlaube Passwort Authentifizierung
|
||||
3. Oeffne Putty oder ein Terminal (PowerShell neuer als 2019) und melde dich als `loginuser` an, mit dem zuvor gesetzten Passwort
|
||||
1. PowerShell: `ssh loginuser@<lan-gw-ip>`
|
||||
4. Melde dich als `root`-user an, mit dem Befehl `sudo su` und durch Nutzung des `root` Passworts
|
||||
|
||||
## Extract pppoe data
|
||||
|
||||
1. Extrahiere Internetzugangsdaten
|
||||
```bash
|
||||
# cat /var/sec/chroot-pppoe/etc/ppp/chap-secrets
|
||||
"<symbole-und-zahlen>@<provider>" * "Passwort" *
|
||||
```
|
||||
2
projects/ssr/202504-4architekten/notes.md
Normal file
2
projects/ssr/202504-4architekten/notes.md
Normal file
@@ -0,0 +1,2 @@
|
||||
|
||||
- [php5.6-manual](https://community.localwp.com/t/how-to-run-php-5-6-on-local-v8-and-above/44488)
|
||||
Reference in New Issue
Block a user