Wolfspyre Labs 🐺🔥🔬/ Our Guides/ CoreDNS @ Wolfspyre Labs/ 🏗️ Setting Up CoreDNS/ Pi4 Soup to nuts/ ⑥ Robustification/ ⑥ Robustification ⇦ ⇦ ⇦ deploy and configure CoreDNS ⑤ Robustification # ⑦ But wait!! There’s more! ⃗⃗͢→ ⃗ ͢⇨ ⇨ Install stuff NFSmount /backup lldpd sysctls logrotate config snmpd syslog-ng Disable IPv6 🐾 So here, we’ve got more of a smorgasbord of various “improvements”. Not all of them will be useful to anyone… Myself included… As some of these… improvements… grow it will make sense to split them out into their own sub-pages. Package Installs #We need to install some stuff…. Namely nfsclient packages lldpd shell tools monitoring and telemetry tools python3 mailutils Install Dem Pkgs apt-get install bwm-ng cpufrequtils cpuinfo cpuset libconfig9 \ libfreetype-dev libio-pty-perl libipc-run-perl libpng-dev \ libpng-tools libsnmp-base libsnmp40 libtime-duration-perl \ libtimedate-perl lldpad lldpd mailutils moreutils nfs-common \ prometheus-node-exporter prometheus-node-exporter-collectors \ python-is-python3 python3-pip smartmontools snmp \ snmp-mibs-downloader sockperf spi-tools tuna tcputils unzip Apt will ask you to set up postfix.. The nuances and challenges of setting up and maintaining a mail exchanger are myriad and outside the scope of this document. Stuff I set up A lot of this stuff isn't quite useful for most.... it’s cool if you don’t care… I won’t hold it against you. :) NFS Mounted /backup NFSmount /backup #In my environment, I have a fileserver separate from most of the infrastructure. Personally, I find it helpful, to have a durable sharepoint I can store ’things for future me’ and have them reside on completely isolated hardware from the thing in question. This practice has saved my ass more than once, not gonna lie. However, it’s not strictly a requirement. Setting up, and maintaining an NFS server becomes nuanced as dependencies increase. Guidance for this is outside the scope of this document. I create distinct lenses into the storage for each context within my network. such that NFS traffic to a specific segment of the environment needn’t traverse a firewall. so, each subnet has its’ own address for the local nfs server.. Your environment may have different needs, and you may choose to deal with this differently. YMMV. /etc/fstab LABEL=writable / ext4 discard,errors=remount-ro 0 1 LABEL=system-boot /boot/firmware vfat defaults 0 1 #10.18.40.23:/Backups/Infrastructure/DNSServer /backup nfs rw,relatime,rsize=1048576,wsize=1048576 0 0 #10.18.42.23:/Backups/Infrastructure/DNSServer /backup nfs rw,relatime,rsize=1048576,wsize=1048576 0 0 #10.18.40.23:/Backups/Infrastructure/DNSServer /backup nfs rw,relatime,rsize=1048576,wsize=1048576 0 0 #10.0.2.23:/Backups/Infrastructure/DNSServer /backup nfs rw,relatime,rsize=1048576,wsize=1048576 0 0 LLDPD lldpd #I found a few sources of “documentation” that were somewhat helpful… So I’ll include 1 them 2 here 3… So, for the most part, you just sorta install it and move on, but there’s definitely some interesting stuff to explore. lldpd for i in `ls /sys/class/net/ | grep 'eth\|ens\|eno'` ; do echo "enabling lldp for interface: $i" ; lldptool set-lldp -i $i adminStatus=rxtx ; lldptool -T -i $i -V sysName enableTx=yes; lldptool -T -i $i -V portDesc enableTx=yes ; lldptool -T -i $i -V sysDesc enableTx=yes; lldptool -T -i $i -V sysCap enableTx=yes; lldptool -T -i $i -V mngAddr enableTx=yes; configure med location address country US done IP=`ip addr show eth0 |awk '/inet/ {print $2}'|sed -e 's/\/.*$//'`; lldptool -T -i eth0 -V mngAddripv4=${IP} lldptool fun lldptool configure med location address county Travis country US country-subdivision Texas building Barn room Barn lldptool configure med location address county Travis country US country-subdivision Texas building Haus room Office Sysctls I spent a fair bit of time dorking around with the information on the calomel.org1 site. Specifically their network performance page 2. There’s a lot of nifty stuff there. However, you might not care too much about tweaking sysctls. This is a starting point tuning similar to what I’ve set up on proxmox. As time goes on I’ll tune this more apropriately for dns servers. /etc/sysctl.d/9931_WPL_SYSCTLS-0922.conf net.core.netdev_max_backlog=13888 net.core.rmem_max=16777216 net.ipv4.tcp_rmem=4096 131072 16777216 net.core.wmem_max=16777216 net.ipv4.tcp_wmem=4096 131072 16777216 net.core.rmem_max=16777216 net.core.wmem_max=16777216 net.core.rmem_default=16777216 net.core.wmem_default=16777216 net.ipv4.tcp_slow_start_after_idle=0 net.ipv4.tcp_sack=1 net.ipv4.tcp_dsack=1 net.ipv4.tcp_fack=0 net.ipv4.route.min_adv_mss=536 net.ipv4.tcp_base_mss=1460 net.ipv4.tcp_min_snd_mss=536 Journald Journald is the new-ish systemd logging mechanism.. It’s got some neat configuration knobs. In our case, the most useful config here is to push syslogs elsewhere. then setting storage as volatile. This offloads a large about of unnecessary writes to that MicroSD card you got. /etc/systemd/journald.conf [Journal] Storage=volatile ForwardToSyslog=yes MaxLevelSyslog=info MaxLevelStore=info Compress=no SystemMaxFileSize=2M SystemMaxFiles=200 SystemMaxUse=400M RuntimeMaxFileSize=2M RuntimeMaxUse=400M RuntimeMaxFiles=200 MaxFileSec=1week SNMPD You might knock it…. Hey! SNMPD has been around forever🕸️! It’s 🦽old📜 and busted! 🪦 💀 Where’s the 🏎️ new hotness 🏁 monitoring 🔮 shit 🤖 ? And you’d certainly be… not wrong…. SNMPD HAS been around forever: v1 in 1988 1. and v2 in 19912. Here’s the thing tho… It still works great Installing snmpd is easy apt-get install snmp-mibs-downloader snmpd snmpd.conf agentAddress udp:161 sysLocation ['30.3295110,-97.7560740'] sysName coredns-01 sysContact Me <coredns@wolfspaw.com> sysObjectID 1.3.6.1.4.1.50536.3.1 #sysServices 72 sysServices 76 rocommunity "w01f5paw" default view default included .1 view default included .1.3.6.1.2.1 #view default included .1.3.6.1.2.1.25.1 proc lldpd proc lldpad proc sshd proc coredns disk / 10000 disk /var 5% includeAllDisks 10% load 12 10 5 # Arbitrary extension commands # #extend-sh test3 /bin/sh /tmp/shtest master agentx extend .1.3.6.1.4.1.2021.7890.2 hardware /bin/cat /sys/devices/virtual/dmi/id/product_name extend .1.3.6.1.4.1.2021.7890.3 vendor /bin/cat /sys/devices/virtual/dmi/id/sys_vendor extend .1.3.6.1.4.1.2021.7890.4 serial /bin/cat /sys/devices/virtual/dmi/id/product_serial extend uptime /bin/cat /proc/uptime extend .1.3.6.1.4.1.2021.7890.1 distro /usr/local/bin/distro # This line enables Observium's ifAlias description injection pass_persist .1.3.6.1.2.1.31.1.1.1.18 /usr/local/bin/ifAlias_persist # Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX smuxpeer .1.3.6.1.4.1.674.10892.1 Timesyncd Timesyncd # /etc/systemd/timesyncd.conf [Time] NTP=timey.wolfspyre.io wimey.wolfspyre.io wobly.wolfspyre.io tick.wolfspyre.io tock.wolfspyre.io #FallbackNTP=ntp.ubuntu.com RootDistanceMaxSec=4 PollIntervalMinSec=16 PollIntervalMaxSec=64 Disable IPv6 disable ipv6 #place this in /etc/sysctl.d/9933_WPL_DISABLE_ipv6.conf net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 🐾 ⇦ ⇦ ⇦ Deploy and configure CoreDNS ⑤ ⑦ But wait!! There’s more! ⇨ ⇨ ⇨