wiki/creating-ec2-image-from-scratch.md
... ...
@@ -1,128 +0,0 @@
1
-# Creating an Amazon AWS EC2 Image from Scratch
2
-
3
-I started out with a clean "Amazon Linux AMI 2015.03 (HVM), SSD Volume Type - ami-a10897d6" image from Amazon and added the existing Swap and Home snapshots as new volumes. The root/system volume I left as is, to start with. This requires having access to a user key that can be selected when launching the image.
4
-
5
-Enable the EPEL repository by issuing `yum-config-manager --enable epel/x86_64`.
6
-
7
-I then did a `yum update` and added the following packages:
8
-
9
- - httpd
10
- - mod_proxy_html
11
- - tmux
12
- - nfs-utils
13
- - chrony
14
- - libstdc++48.i686 (for Android builds)
15
- - glibc.i686 (for Android builds)
16
- - libzip.i686 (for Android builds)
17
- - telnet
18
- - apachetop
19
- - goaccess
20
- - postfix (for sending e-mail, e.g., to invite competitors and buoy pingers)
21
- - tigervnc-server
22
- - WindowMaker
23
- - xterm
24
- - sendmail-cf
25
-
26
-Then I created a mount point /home/sailing and copied the following lines from the /etc/fstab file from an existing SL instance:
27
-
28
-```
29
-UUID=a1d96e53-233f-4e44-b865-c78b862df3b8 /home/sailing ext4 defaults,noatime,commit=30 0 0
30
-UUID=7d7e68a3-27a1-49ef-908f-a6ebadcc55bb none swap sw 0 0
31
-
32
-# Mount the Android SDK from the Build/Dev box; use a timeout of 10s (100ds)
33
-172.31.28.17:/home/hudson/android-sdk-linux /opt/android-sdk-linux nfs tcp,intr,timeo=100,retry=0
34
-172.31.18.15:/var/log/old /var/log/old nfs tcp,intr,timeo=100,retry=0
35
-```
36
-
37
-This will mount the swap space partition as well as the /home/sailing partition, /var/log/old and the Android SDK stuff required for local builds.
38
-
39
-In `/etc/ssh/sshd_config` I commented the line
40
-
41
-```
42
-# Only allow root to run commands over ssh, no shell
43
-#PermitRootLogin forced-commands-only
44
-```
45
-
46
-and added the lines
47
-
48
-```
49
-PermitRootLogin without-password
50
-PermitRootLogin Yes
51
-```
52
-
53
-to allow root shell login.
54
-
55
-I copied the JDK7/JDK8 installations from an existing SL instance to /opt.
56
-
57
-I linked /etc/init.d/sailing to /home/sailing/code/configuration/sailing and added the following links to it:
58
-
59
-```
60
-rc0.d/K10sailing
61
-rc1.d/K10sailing
62
-rc2.d/S95sailing
63
-rc3.d/S95sailing
64
-rc4.d/S95sailing
65
-rc5.d/S95sailing
66
-rc6.d/K10sailing
67
-```
68
-
69
-Linked /etc/profile.d/sailing.sh to /home/sailing/code/configuration/sailing.sh. As this contains a PATH entry for /opt/amazon and the new image has the Amazon scripts at /opt/aws, I aldo created a symbolic link from /opt/amazon to /opt/aws to let this same path configuration find those scripts under the old and the new images.
70
-
71
-Added the lines
72
-
73
-```
74
-# number of connections the firewall can track
75
-net.ipv4.ip_conntrac_max = 131072
76
-```
77
-
78
-to `/etc/sysctl.conf` in order to increase the number of connections that are possible concurrently.
79
-
80
-Added the following two lines to `/etc/security/limits.conf`:
81
-
82
-```
83
-* hard nproc unlimited
84
-* hard nofile 65000
85
-```
86
-
87
-This increases the maximum number of open files allowed from the default 1024 to a more appropriate 65k.
88
-
89
-Copied the httpd configuration files `/etc/httpd/conf/httpd.conf`, `/etc/httpd/conf.d/000-macros.conf` and the skeletal `/etc/httpd/conf.d/001-events.conf` from an existing server. Make sure the following lines are in httpd.conf:
90
-
91
-<pre>
92
- SetEnvIf X-Forwarded-For "^([0-9]*\.[0-9]*\.[0-9]*\.[0-9]*).*$" original_client_ip=$1
93
- LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
94
- LogFormat "%v %{original_client_ip}e %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" first_forwarded_for_ip
95
- CustomLog logs/access_log combined env=!original_client_ip
96
- CustomLog logs/access_log first_forwarded_for_ip env=original_client_ip
97
-</pre>
98
-
99
-They ensure that the original client IPs are logged also if the Apache server runs behind a reverse proxy or an ELB. See also [the section on log file analysis](/wiki/log-file-analysis#log-file-analysis_log-file-types_apache-log-files).
100
-
101
-Copied /etc/logrotate.conf from an existing SL instance so that `/var/log/logrotate-target` is used to rotate logs to.
102
-
103
-Instead of having the `ANDROID_HOME` environment variable be set in `/etc/profile` as in the old instances, I moved this statement to the `sailing.sh` script in git at `configuration/sailing.sh` and linked to by `/etc/profile.d/sailing.sh`. For old instances this will set the variable redundantly, as they also have it set by a manually adjusted `/etc/profile`, but this shouldn't hurt.
104
-
105
-Had to fiddle a little with the JDK being used. The default installation has an OpenJDK installed, and the AWS tools depend on it. Therefore, it cannot just be removed. As a result, it's important that `env.sh` has the correct `JAVA_HOME` set (/opt/jdk1.8.0_45, in this case). Otherwise, the OSGi environment won't properly start up.
106
-
107
-To ensure that chronyd is started during the boot sequence, issued the command
108
-
109
-```
110
-chkconfig chrony on
111
-```
112
-
113
-which creates the necessary entries in the rc*.d directories.
114
-
115
-Update the file `/etc/postfix/main.cf` in order to set the server's sending hostname to `sapsailing.com` as follows:
116
-```
117
- myhostname = sapsailing.com
118
-```
119
-
120
-Adjust the /etc/sysconfig/vncservers settings to something like:
121
-
122
-```
123
-VNCSERVERS="2:sailing"
124
-VNCSERVERARGS[2]="-geometry 1600x900"
125
-```
126
-
127
-## Mail Relaying
128
-For setting up mail relaying towards central postfix server, have a look [here](https://wiki.sapsailing.com/wiki/mail-relaying)
... ...
\ No newline at end of file
wiki/info/landscape/creating-ec2-image-from-scratch.md
... ...
@@ -0,0 +1,128 @@
1
+# Creating an Amazon AWS EC2 Image from Scratch
2
+
3
+I started out with a clean "Amazon Linux AMI 2015.03 (HVM), SSD Volume Type - ami-a10897d6" image from Amazon and added the existing Swap and Home snapshots as new volumes. The root/system volume I left as is, to start with. This requires having access to a user key that can be selected when launching the image.
4
+
5
+Enable the EPEL repository by issuing `yum-config-manager --enable epel/x86_64`.
6
+
7
+I then did a `yum update` and added the following packages:
8
+
9
+ - httpd
10
+ - mod_proxy_html
11
+ - tmux
12
+ - nfs-utils
13
+ - chrony
14
+ - libstdc++48.i686 (for Android builds)
15
+ - glibc.i686 (for Android builds)
16
+ - libzip.i686 (for Android builds)
17
+ - telnet
18
+ - apachetop
19
+ - goaccess
20
+ - postfix (for sending e-mail, e.g., to invite competitors and buoy pingers)
21
+ - tigervnc-server
22
+ - WindowMaker
23
+ - xterm
24
+ - sendmail-cf
25
+
26
+Then I created a mount point /home/sailing and copied the following lines from the /etc/fstab file from an existing SL instance:
27
+
28
+```
29
+UUID=a1d96e53-233f-4e44-b865-c78b862df3b8 /home/sailing ext4 defaults,noatime,commit=30 0 0
30
+UUID=7d7e68a3-27a1-49ef-908f-a6ebadcc55bb none swap sw 0 0
31
+
32
+# Mount the Android SDK from the Build/Dev box; use a timeout of 10s (100ds)
33
+172.31.28.17:/home/hudson/android-sdk-linux /opt/android-sdk-linux nfs tcp,intr,timeo=100,retry=0
34
+172.31.18.15:/var/log/old /var/log/old nfs tcp,intr,timeo=100,retry=0
35
+```
36
+
37
+This will mount the swap space partition as well as the /home/sailing partition, /var/log/old and the Android SDK stuff required for local builds.
38
+
39
+In `/etc/ssh/sshd_config` I commented the line
40
+
41
+```
42
+# Only allow root to run commands over ssh, no shell
43
+#PermitRootLogin forced-commands-only
44
+```
45
+
46
+and added the lines
47
+
48
+```
49
+PermitRootLogin without-password
50
+PermitRootLogin Yes
51
+```
52
+
53
+to allow root shell login.
54
+
55
+I copied the JDK7/JDK8 installations from an existing SL instance to /opt.
56
+
57
+I linked /etc/init.d/sailing to /home/sailing/code/configuration/sailing and added the following links to it:
58
+
59
+```
60
+rc0.d/K10sailing
61
+rc1.d/K10sailing
62
+rc2.d/S95sailing
63
+rc3.d/S95sailing
64
+rc4.d/S95sailing
65
+rc5.d/S95sailing
66
+rc6.d/K10sailing
67
+```
68
+
69
+Linked /etc/profile.d/sailing.sh to /home/sailing/code/configuration/sailing.sh. As this contains a PATH entry for /opt/amazon and the new image has the Amazon scripts at /opt/aws, I aldo created a symbolic link from /opt/amazon to /opt/aws to let this same path configuration find those scripts under the old and the new images.
70
+
71
+Added the lines
72
+
73
+```
74
+# number of connections the firewall can track
75
+net.ipv4.ip_conntrac_max = 131072
76
+```
77
+
78
+to `/etc/sysctl.conf` in order to increase the number of connections that are possible concurrently.
79
+
80
+Added the following two lines to `/etc/security/limits.conf`:
81
+
82
+```
83
+* hard nproc unlimited
84
+* hard nofile 65000
85
+```
86
+
87
+This increases the maximum number of open files allowed from the default 1024 to a more appropriate 65k.
88
+
89
+Copied the httpd configuration files `/etc/httpd/conf/httpd.conf`, `/etc/httpd/conf.d/000-macros.conf` and the skeletal `/etc/httpd/conf.d/001-events.conf` from an existing server. Make sure the following lines are in httpd.conf:
90
+
91
+<pre>
92
+ SetEnvIf X-Forwarded-For "^([0-9]*\.[0-9]*\.[0-9]*\.[0-9]*).*$" original_client_ip=$1
93
+ LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
94
+ LogFormat "%v %{original_client_ip}e %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" first_forwarded_for_ip
95
+ CustomLog logs/access_log combined env=!original_client_ip
96
+ CustomLog logs/access_log first_forwarded_for_ip env=original_client_ip
97
+</pre>
98
+
99
+They ensure that the original client IPs are logged also if the Apache server runs behind a reverse proxy or an ELB. See also [the section on log file analysis](/wiki/log-file-analysis#log-file-analysis_log-file-types_apache-log-files).
100
+
101
+Copied /etc/logrotate.conf from an existing SL instance so that `/var/log/logrotate-target` is used to rotate logs to.
102
+
103
+Instead of having the `ANDROID_HOME` environment variable be set in `/etc/profile` as in the old instances, I moved this statement to the `sailing.sh` script in git at `configuration/sailing.sh` and linked to by `/etc/profile.d/sailing.sh`. For old instances this will set the variable redundantly, as they also have it set by a manually adjusted `/etc/profile`, but this shouldn't hurt.
104
+
105
+Had to fiddle a little with the JDK being used. The default installation has an OpenJDK installed, and the AWS tools depend on it. Therefore, it cannot just be removed. As a result, it's important that `env.sh` has the correct `JAVA_HOME` set (/opt/jdk1.8.0_45, in this case). Otherwise, the OSGi environment won't properly start up.
106
+
107
+To ensure that chronyd is started during the boot sequence, issued the command
108
+
109
+```
110
+chkconfig chrony on
111
+```
112
+
113
+which creates the necessary entries in the rc*.d directories.
114
+
115
+Update the file `/etc/postfix/main.cf` in order to set the server's sending hostname to `sapsailing.com` as follows:
116
+```
117
+ myhostname = sapsailing.com
118
+```
119
+
120
+Adjust the /etc/sysconfig/vncservers settings to something like:
121
+
122
+```
123
+VNCSERVERS="2:sailing"
124
+VNCSERVERARGS[2]="-geometry 1600x900"
125
+```
126
+
127
+## Mail Relaying
128
+For setting up mail relaying towards central postfix server, have a look [here](https://wiki.sapsailing.com/wiki/mail-relaying)
... ...
\ No newline at end of file