Home | panticz.de

Create LetsEncrypt wildcard certificate with LEGO and OpenStack Designate

Download LEGO binary
https://github.com/go-acme/lego/releases/

LEGO_VERSION=$(curl -s https://api.github.com/repos/go-acme/lego/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
curl -L "https://github.com/go-acme/lego/releases/download/${LEGO_VERSION}/lego_${LEGO_VERSION}_linux_amd64.tar.gz" | tar -xz

Request certificate

DOMAIN=example.com
export OS_CLOUD=os-project1
export DESIGNATE_ZONE_NAME="${DOMAIN}."
export OS_REGION_NAME=de-de1

./lego run \
  --email foo@${DOMAIN} \
  --accept-tos \
  --dns designate \
  --domains "*.${DOMAIN}" \
  --domains ${DOMAIN}

List certificates

ls -l .lego/certificates

Convert to p12 file

openssl pkcs12 -passout "pass:" -export -in _.${DOMAIN}.crt -inkey _.${DOMAIN}.key -out _.${DOMAIN}.p12

Debug

export GODEBUG=http2debug=2 
export LEGO_LOG_LEVEL=debug 

# letsencrypt staging server
--server https://acme-staging-v02.api.letsencrypt.org/directory

Links
https://github.com/go-acme/lego/

Sinilink XY6014 modbus control with ESP8266

ESPhome configuration

DAIKIN Altherma M HW

DAIKIN Altherma M HW 200 EKHHE200PCV37 / FERROLI - EGEA TECH LT
https://www.daikin.eu/en_us/products/product.html/EKHHE-PCV37.html
https://www.ferroli.com/media/3540000410_03_EGEA_TECH_200%20LT%20-%20260%20LT%20-%20200%20LT-S%20-%20260%20LT-S.pdf

Manual
https://www.daikin.eu/content/dam/document-library/installation-manuals/heat/domestic-hot-water-heat-pump/EKHHE-PCV37_User,%20Installations%20and%20Maintenance%20Manual_digital.pdf

RS485 module with ESP32
https://de.aliexpress.com/item/1005009583388691.html - TTL Turn RS485 485 to Serial UART Level Mutual Conversion Hardware Automatic Flow Control Board Module XY-017
https://github.com/lorbetzki/Daikin-EKHHE
https://github.com/jcappaert/esphome-daikin-ekhhe
https://www.bizkit.ru/en/2019/02/21/12563/
https://how2electronics.com/how-to-use-modbus-rtu-with-esp32-to-read-sensor-data/

ESPhome
https://esphome.io/guides/troubleshooting/

gPlugM integration in Home Assistant

Manufacter
https://gplug.ch/produkte/gplugm/

Installation
https://gplug.ch/installationsanleitung/gplugmt/

configuration.yaml
https://gplug.ch/blog/integration-gplugm-in-home-assistant/
https://gplug.ch/blog/integration-gplug-in-home-assistent/

homeassistant:
  customize_glob:
    sensor.gplugm_z_ei:
      unit_of_measurement: "kWh"
      device_class: energy
      state_class: total_increasing
      last_reset: 1970-01-01T00:00:00+00:00
    sensor.gplugm_z_ei1:
      unit_of_measurement: "kWh"
    sensor.gplugm_z_ei2:
      unit_of_measurement: "kWh"
    sensor.gplugm_z_eo:
      unit_of_measurement: "kWh"
      device_class: energy
      state_class: total_increasing
      last_reset: 1970-01-01T00:00:00+00:00
    sensor.gplugm_z_eo1:
      unit_of_measurement: "kWh"
    sensor.gplugm_z_eo2:
      unit_of_measurement: "kWh" 
    sensor.gplugm_z_i1:
      unit_of_measurement: "A"
    sensor.gplugm_z_i2:
      unit_of_measurement: "A"
    sensor.gplugm_z_i3:
      unit_of_measurement: "A"
    sensor.gplugm_z_v1:
      unit_of_measurement: "V"
    sensor.gplugm_z_v2:
      unit_of_measurement: "V"
    sensor.gplugm_z_v3:
      unit_of_measurement: "V"
    sensor.gplugm_z_pi:
      unit_of_measurement: "kW"
    sensor.gplugm_z_po:
      unit_of_measurement: "kW"

utility_meter:
  energy_in_daily:
    source: sensor.gplugm_z_ei
    cycle: daily
  energy_in_weekly:
    source: sensor.gplugm_z_ei
    cycle: weekly
  energy_in_monthly:
    source: sensor.gplugm_z_ei
    cycle: monthly
  energy_in_yearly:
    source: sensor.gplugm_z_ei
    cycle: yearly

k9s

Install k9s
https://github.com/derailed/k9s/releases

RELEASE=$(curl -s https://api.github.com/repos/derailed/k9s/releases/latest | jq -r .tag_name)
wget -q https://github.com/derailed/k9s/releases/download/${RELEASE}/k9s_linux_amd64.deb -P /tmp/
sudo dpkg -i /tmp/k9s_linux_amd64.deb

Install k9s with Ansible
https://github.com/derailed/k9s/releases

- hosts: localhost
  tasks:
    - name: Install k9s from https://github.com/derailed/k9s/releases
      become: true
      block:
        - name: Get latest k9s version
          ansible.builtin.uri:
            url: "https://api.github.com/repos/derailed/k9s/releases/latest"
            return_content: yes
          register: k9s_version

        - name: Set k9s version
          ansible.builtin.set_fact:
            k9s_release: "{{ k9s_version.json.tag_name }}"      

        - name: Install k9s binary
          ansible.builtin.apt:
            deb: https://github.com/derailed/k9s/releases/download/{{ k9s_release }}/k9s_linux_amd64.deb

Proton VPN on Ubuntu

Install Proton VPN with Ansible

- name: Install ProtonVPN
  become: true
  block:
    - name: Add protonvpn APT repository
      vars:
        protonvpn_release: 1.0.8
      ansible.builtin.apt:
        deb: https://repo.protonvpn.com/debian/dists/stable/main/binary-all/protonvpn-stable-release_{{ protonvpn_release }}_all.deb

    - name: Install ProtonVPN client
      apt:
        update_cache: true
        name:
          - proton-vpn-gnome-desktop

Links
https://protonvpn.com/support/de/official-linux-vpn-ubuntu

SSH forward traffic and DNS with socks5h

Socks SSH forward internet and DNS
https://datawookie.dev/blog/2023/12/ssh-tunnel-dynamic-port-forwarding/

# local
ssh -R 1080 user@remote

# remote
export http_proxy=socks5h://localhost:1080
export https_proxy=socks5h://localhost:1080
# export HTTPS_PROXY=socks5://localhost:1080/

#echo "nameserver 127.0.0.1" > /etc/resolv.conf

cat < /etc/apt/apt.conf.d/12proxy
Acquire::http::Proxy "socks5h://localhost:1080";
Acquire::https::Proxy "socks5h://localhost:1080";
EOF

cat <> /etc/environment
#export http_proxy=socks5h://localhost:1080
#export https_proxy=socks5h://localhost:1080
export all_proxy=socks5h://localhost:1080
EOF


# Configurte scks5h proxy in Docker
mkdir /etc/systemd/system/docker.service.d
cat < /etc/systemd/system/docker.service.d/proxy.conf
[Service]
Environment="HTTP_PROXY=socks5h://127.0.0.1:1080"
Environment="HTTPS_PROXY=socks5h://127.0.0.1:1080"
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker docker.service


# python
sudo apt install -y python3-socks

# git
git config --global http.proxy 'socks5h://127.0.0.1:1080'


# SSH config
Host my-remote
    HostName my_server.com
    RemoteForward 1080
    ServerAliveInterval 60
    ServerAliveCountMax 3


or optional
# dns2socks
# http(s) / socks export
# https://lib.rs/install/dns2socks
https://gist.github.com/yougg/5d2b3353fc5e197a0917aae0b3287d64

# dns2socks
wget https://github.com/tun2proxy/dns2socks/releases/download/v0.2.0/dns2socks-x86_64-unknown-linux-gnu.zip
dns2socks --socks5-settings socks5://localhost:1080 --force-tcp

OpenStack create VM from ISO image

# create image from iso
openstack image create --file /tmp/ubuntu-24.04.1-live-server-amd64.iso --disk-format iso --progress ubuntu-24.04.1-live-server-amd64.iso

# create volume for the final VM
openstack volume create test-vm1-vol1 --size 10 --bootable

# create temporary installation VM
openstack server create test-vm1-inst --image ubuntu-24.04.1-live-server-amd64.iso --flavor m1.small --key-name test-keypair --network test-network

# attach volume to temporary VM
openstack server add volume test-vm1-inst test-vm1-vol1

# show console url from temporary VM
openstack console url show -c url -f value test-vm1-inst

# install OS in console

# delete temporary VM
openstack server stop test-vm1-inst
openstack server delete test-vm1-inst

# create final VM
openstack server create test-vm1 --volume test-vm1-vol1 --flavor m1.small --key-name test-keypair --network test-network
openstack console url show -c url -f value test-vm1

# remove iso imagge
openstack image delete ubuntu-24.04.1-live-server-amd64.iso

Links
https://openmetal.io/docs/manuals/tutorials/understanding-iso-images

Incus Ansible deployment

---
- name: Create container
  hosts: incus1.example.com
  # become: yes
  tasks:
    - name: Create incus container
      community.general.lxd_container:
        url: "unix:/var/lib/incus/unix.socket"
        name: u2604
        source:
          type: image
          mode: pull
          server: https://images.linuxcontainers.org/
          alias: ubuntu/26.04/cloud
          protocol: simplestreams
        wait_for_container: true
        wait_for_ipv4_addresses: true
        config:
          limits.cpu: "4"
          boot.autostart: "true"
          cloud-init.user-data: |
            #cloud-config
            package_upgrade: true
            locale: en_US.UTF-8
            timezone: Europe/Berlin
            apt_upgrade: true
            package_upgrade: true
            packages:
              - openssh-server
            # disable_root: false
            ssh_authorized_keys:
              - "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
          cloud-init.network-config: |
          network:
            version: 2
            ethernets:
              eno1:
                dhcp4: true
        profiles: ["disk-default", "nic-dev"]
      register: container

    - name: Configure temporary user for initial run
      set_fact:
        remote_user: ubuntu
      delegate_to: localhost
      delegate_facts: True
      when: container.changed


- name: Configure container
  hosts: u2404.example.com
  gather_facts: no
  remote_user:  "{{ hostvars['localhost']['remote_user'] | default(lookup('env', 'USER')) }}"
  become: yes
  tasks:
    - name: Create a user 'johnd' with a home directory
      ansible.builtin.user:
        name: johnd
        create_home: yes

Links
https://discuss.linuxcontainers.org/t/creating-container-with-ansible/20050/7
https://documentation.ubuntu.com/lxd/en/latest/cloud-init/
https://docs.ansible.com/ansible/latest/collections/community/general/lxd_container_module.html
https://github.com/kmpm/ansible-incus

Incus Terraform

Enable Incus remote API authentication
http://www.panticz.de/incus

Terraform main.tf

terraform {
  required_providers {
    incus = {
      source = "lxc/incus"
    }
  }
}

provider "incus" {
  # generate_client_certificates = true
  # accept_remote_certificate    = true

  remote {
    name    = "10.0.1.104"
    scheme  = "https"
    address = "10.0.1.104"
    token   = "xxxxxxxxxxxxxxxxxxxxxxxxxx"
    default = true
  }
}

data "template_file" "user_data" {
  template = <

<strong>Deploy</strong>
<code>
terraform init
terraform apply -auto-approve

Links
https://registry.terraform.io/providers/lxc/incus/latest/docs
https://github.com/lxc/terraform-provider-incus
https://discuss.linuxcontainers.org/t/issues-with-private-network-and-cloud-init-using-tf-incus-and-images-debian-12-cloud/19196/3