sysctl

configure parameter

# determine the maximum size of a shared memory segment
cat /proc/sys/kernel/shmmax

# set default shared memory limit for shmmax (16 GB)
echo 17179869184 > /proc/sys/kernel/shmmax

# add the following line to /etc/sysctl.conf to make a change permanent
echo "kernel.shmmax=4294967296" >> /etc/sysctl.d/90-shmmax.conf

# load parameter
/sbin/sysctl -p /etc/sysctl.d/90-shmmax.conf

reduce swap usage
https://en.wikipedia.org/wiki/Swappiness

# get swappiness
cat /proc/sys/vm/swappiness

# set swappiness
echo "vm.swappiness = 1" > /etc/sysctl.d/90-swap.conf

# disable IPv6
echo "net.ipv6.conf.all.disable_ipv6 = 1" > /etc/sysctl.d/01-disable-ipv6.conf

# load kernel settings from all system configuration files
sysctl --system

# load settings from default configuration /etc/sysctl.conf
sysctl -p

# load settings from specified file
sysctl -p /etc/sysctl.d/filename.conf

# limit
sysctl net.inet.icmp.icmplim=2000

Links
https://www.cyberciti.biz/faq/reload-sysctl-conf-on-linux-using-sysctl/

OpenStack: Floating IP port forward (in development / experimental)

List floatin IPs

openstack floating ip list
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+
| ID                                   | Floating IP Address | Fixed IP Address | Port                                 | Floating Network                     | Project                          |
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+
| dc049c28-6562-4c37-834b-d3a612d4b580 | 1.2.3.4        | None             | None                                 | 39583230-154f-4b56-a56e-2fd83c9986ce | 1eede1bdc28344f3acf6b48b232e406f |
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+

List VMs

openstack server list
+--------------------------------------+---------------------------------------------------+--------+---------------------------------+-----------------------------------+-----------+
| ID                                   | Name                                              | Status | Networks                        | Image                             | Flavor    |
+--------------------------------------+---------------------------------------------------+--------+---------------------------------+-----------------------------------+-----------+
| d278cb52-d258-491b-8787-25aaab75f84c | dev-u1910                                         | ACTIVE | dev-net=10.0.1.9                | Ubuntu 19.10 minimal              | m1.micro  |
| 1da2e275-e680-4c69-be00-93871274ceb3 | dev-u1804                                         | ACTIVE | dev-net=10.0.1.12               | Ubuntu 18.04                      | m1.micro  |
+--------------------------------------+---------------------------------------------------+--------+---------------------------------+-----------------------------------+-----------+

Get port IDs for server

openstack port list --server ${SERVER_ID} -c id -f value
4f20d5a9-bdc6-4046-b1bc-291c4d4bf86d

openstack port list --server ${SERVER_ID} -c id -f value
9e583adb-618f-42ba-96ee-1a7b89a377b3

Create port forward to HTTP

Octavia: Allow SSH login to Amphora VM

Allow SSH access

LB_ID=foo-lb01-prod

AMPHORA_ID=$(openstack loadbalancer amphora list --loadbalancer ${LB_ID} --role MASTER -c id -f value)
AMPHORA_COMPUTE_ID=$(openstack loadbalancer amphora show ${AMPHORA_ID} -c compute_id -f value)
LB_NETWORK_IP=$(openstack loadbalancer amphora show ${AMPHORA_ID} -c lb_network_ip -f value)
SECURITY_GROUP_ID=$(openstack port list --server ${AMPHORA_COMPUTE_ID} --fixed-ip "ip-address=${LB_NETWORK_IP}" -c security_group_ids -f value)

# DEBUG: show ingress tcp rules
openstack security group rule list --ingress --protocol tcp ${SECURITY_GROUP_ID}
openstack security group rule create --protocol tcp --dst-port 22:22 --remote-ip 172.16.0.0/12  ${SECURITY_GROUP_ID}
openstack loadbalancer amphora list --loadbalancer ${LB_ID} -c  lb_network_ip -c role -f value
openstack loadbalancer amphora list --loadbalancer ${LB_ID} -c  lb_network_ip --role MASTER -f value

# login to amphora VM from OpenStack control node
ssh local@ctl1-dev.dev.i.example.com
ssh -i ~/.ssh/id_rsa_octavia ubuntu@${AMPHORA_VM_IP}

Manuall SSH access

Openstack: Debug networking

Video: OpenStack Neutron Packet Walkthrough (DVR) by David Mahler
https://www.youtube.com/watch?v=7IXEtUEZslg

SERVER_ID=11111111-2222-3333-4444-555555555555

nova interface-list ${SERVER_ID}

PORT_TOKEN=$(nova interface-list ${SERVER_ID} | grep ACTIVE | cut -d "|" -f3 | cut -d"-" -f1)
echo PORT_TOKEN=${PORT_TOKEN}

COMPUTE_NODE=$(openstack server show -c "OS-EXT-SRV-ATTR:hypervisor_hostname" -f value ${SERVER_ID})
echo ${COMPUTE_NODE}

ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN}
TAP_DEVICE=$(ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN} | grep tap)

TAP_DEVICE=$(ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN} | grep tap)
echo ${TAP_DEVICE}

# second console
echo tcpdump -i ${TAP_DEVICE} -n -e icmp
ssh ${COMPUTE_NODE}



# 3th console
ssh ${COMPUTE_NODE}
iptables -S | grep o${PORT_TOKEN} | grep ${PORT_TOKEN}
# todo:
iptables -S neutron-openvswi-s${PORT_TOKEN}-f

iptables -S neutron-openvswi-sg-chain | grep #${PORT_TOKEN}

docker exec -it openvswitch_vswitchd bash
ovs-vsctl show

ovs-vsctl show | grep -U1 ${PORT_TOKEN}

# NORMAL missiong
watch -n .5 "ovs-ofctl dump-flows br-int table=0 | grep -v n_packets=0"


ovs-appctl -t /var/run/openvswitch/ovs-vswitchd.*.ctl fdb/show br-int | egrep "MAC|fa:11:22:33:44:55"

ovs-ofctl show br-int | grep 293 -A5

brctl show | grep qvo${PORT_TOKEN}-fb

Notes

LineageOS

Andorid Apps (arm, nano)
https://opengapps.org/?api=9.0&variant=nano

wget https://netix.dl.sourceforge.net/project/opengapps/arm/20200429/open_gapps-arm-9.0-nano-20200429.zip -P /tmp

Compile Heimdall (tested with v1.4.2)

sudo apt-get install -y build-essential cmake zlib1g-dev qt5-default libusb-1.0-0-dev libgl1-mesa-glx libgl1-mesa-dev

git clone https://gitlab.com/BenjaminDobell/Heimdall.git /tmp/Heimdall
cd /tmp/Heimdall
mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make

# test
cd bin/
./heimdall version

Boot phone to recovery mode
Vol- + Home + Power

Download recovery file
https://twrp.me/Devices/

wget https://dl.twrp.me/hlte/twrp-3.3.1-0-hlte.img -P /tmp

Flash LineageOS
https://wiki.lineageos.org/devices/hlte/install

#./heimdall print-pit
./heimdall flash --RECOVERY /tmp/twrp-3.3.1-0-hlte.img --no-reboot
adb sideload /tmp/lineage-*-nightly-hlte-signed.zip
adb sideload /tmp/open_gapps-arm-*-nano-*.zip
adb reboot

Debug with ADB

adb shell tail -f /tmp/recovery.log

Play Protect certified
https://forum.shiftphones.com/threads/solved-device-no-longer-play-protect-certified-after-update-to-lineageos-22-1.5596/
https://www.google.com/android/uncertified/

adb root
adb shell
sqlite3 /data/user/$(cmd activity get-current-user)/*/*/gservices.db "select * from main where name = \"android_id\";"

LXD with OpenvSwitch network 

# create bridge
ovs-vsctl add-br mybridge
# ifconfig mybridge up
ip link set mybridge up
ovs-vsctl show

# connect ovs bridge to external network
ovs-vsctl add-port mybridge eno1
ifconfig eno1 0
dhclient mybridge -v
ip a show mybridge
route -n

# create LXD container
lxc profile create disk-only
lxc storage create pool1 dir
lxc profile device add disk-only root disk path=/ pool=pool1
lxc profile show disk-only
lxc launch ubuntu:18.04 ovs1 -p disk-only
lxc config device add ovs1 eth0 nic nictype=bridged parent=mybridge host_name=vport11
lxc launch ubuntu:18.04 ovs2 -p disk-only
lxc config device add ovs2 eth0 nic nictype=bridged parent=mybridge host_name=vport12
lxc network list

LXD: Network

Configure default profile

lxc network create lxdbr0
lxc network create lxdbr0 ipv4.address=10.0.33.1/24 ipv4.nat=true ipv6.address=none
lxc profile device add default eth0 nic nictype=bridged parent=lxdbr0 name=eth0

# disable IPv6 inside of container
lxc network set lxdbr0 ipv6.address none

Configure static IP address

lxc stop c1
lxc network attach lxdbr0 c1 eth0 eth0
lxc config device set c1 eth0 ipv4.address 10.0.0.12
lxc start c1

# add NICs
lxc config device add vm-dhcp1-dev dev-mgmt-new nic name=dev-mgmt nictype=macvlan parent=dev-mgmt

ipv6

lxc network set lxdbr0 ipv6.dhcp.stateful true

ovs network

lxc profile create disk-only
lxc storage create pool1 dir
lxc profile device add disk-only root disk path=/ pool=pool1
lxc profile show disk-only
lxc launch ubuntu:18.04 ovs1 -p disk-only
lxc config device add ovs1 eth0 nic nictype=bridged parent=ovsbridge host_name=vport11
lxc network list
# test static ip
lxc launch redis r
lxc config device override r
lxc config device set r eth0 ipv4.address 10.100.0.100

Links
https://stgraber.org/2016/03/15/lxd-2-0-installing-and-configuring-lxd-212/
https://thomas-leister.de/en/container-overlay-network-openvswitch-linux/
https://stgraber.org/2016/10/27/network-management-with-lxd-2-3/

Docker container: Gitea

Docker container on DockerHub
https://hub.docker.com/r/gitea/gitea

Docker installation
https://docs.gitea.io/en-us/install-with-docker/

apt -y install docker-compose

# Add second ip to hypervisor
ip a add 192.168.1.3 dev eth0:1

# Bound SSHD on hypervisor to specific IP
sed -i 's/#ListenAddress 0.0.0.0/ListenAddress 10.0.1.3/' /etc/ssh/sshd_config
service ssh restart

# OPTIONAL: create ZFS pool
zfs create -o mountpoint=/media/docker tank/docker

# create required directories
mkdir -p /media/docker/gitea/mysql /media/docker/gitea/data

cat < /media/docker/gitea/docker-compose.yml
version: "2"

networks:
  gitea:
    external: false

services:
  web:
    image: gitea/gitea:latest
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - DB_TYPE=mysql
      - DB_HOST=db:3306
      - DB_NAME=gitea
      - DB_USER=gitea
      - DB_PASSWD=gitea
    restart: always
    networks:
      - gitea
    volumes:
      - /media/docker/gitea/data:/data
    ports:
       - 192.168.1.3:80:3000
       - 192.168.1.3:22:22
    depends_on:
      - db

  db:
    image: mariadb:latest
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=gitea
      - MYSQL_USER=gitea
      - MYSQL_PASSWORD=gitea
      - MYSQL_DATABASE=gitea
    networks:
      - gitea
    volumes:
      - /media/docker/gitea/mysql:/var/lib/mysql
EOF

# deploy container
cd /media/docker/gitea
docker-compose up -d

Post-install
http://GITEA_IP/install

Debug

OpenStack: OpenvSwitch

Get VM data

# OPTINAL: find VM name
# openstack server list --all | grep XXX

# get FROM VM ID
SERVER_STRING=www-dev
SERVER_ID=$(openstack server list --all --name ${SERVER_STRING} -c ID -f value)
echo ${SERVER_ID}

SERVER_IP_ADDRESS=10.0.0

PORT_TOKEN=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$3); print substr($3,0,9)}')
NETWORK_TOKEN=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$4); print substr($4,0,9)}')
SERVER_NAME=$(openstack server show ${SERVER_ID} -c name -f value)
SERVER_IP=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$5); print $5}')
SERVER_MAC=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$6); print $6}')
COMPUTE_NODE=$(openstack server show -c "OS-EXT-SRV-ATTR:hypervisor_hostname" -f value ${SERVER_ID})
SERVER_DEV=$(ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN} | paste - - | sed -e 's/[\t]/ /g;s/  */ /g' | awk '{print $5" "$4}')

# show server data
echo "
SERVER_NAME: ${SERVER_NAME}
SERVER_ID: ${SERVER_ID}
SERVER_IP: ${SERVER_IP}
SERVER_MAC: ${SERVER_MAC}
SERVER_DEV: ${SERVER_DEV}
PORT_TOKEN: ${PORT_TOKEN}
NETWORK_TOKEN: ${NETWORK_TOKEN}
COMPUTE_NODE: ${COMPUTE_NODE}
"

Search for broken openvswitch devices