First step is to create a script to renew all needed certificates:

Une fois que tu as retrouvé les accès SSH pour le web statique:

• WindRiver: automatiquement https://windriver.nasqueron.org/~xcombelle est disponible si tu places des fichiers dans /var/home-wwwroot/xcombelle (je ne sais plus si ça se crée automatiquement avec symlink vers $HOME/public_html, à vérifier)
• Eglide: https://www.eglide.org/~xcombelle pour $HOME/public_html

So, to get routing back:

Not sure of the current benefit to use TC2.

This is still needed for acme.sh if we want to provision different *.nasqueron.org certificates on different servers.

Salt SELinux module issue

SELinux context was the default for anything created under /var, which we didn't allow and aren't interested to allow for nginx.

Yes, it's a fork from Vault 1.14 so we've all the features of token generation. back to the shorter s. tokens).

• about the UI it could be usefull managing secrets more easyly

Can't repro

Mumble isn't currently in scope.

Both are already set in DNS:

We use a wildcard certificate, so issuewild is needed, yes.

@Ash-Crow @fauve @rama @replicatorbe @Sandlayth @xcombelle Any feedback on this?

From router-001 network looks good:

Stopped currently not needed salt and node-exporter on router-001 to see if that helps.

Could be at hypervisor level. SSH failed until 13:22 where it worked immediately.

It could be easier to deploy https://github.com/kpetremann/salt-exporter

Key confirmed to work.

Still some issue to connect, SSH2 RSA key not recognized.

Secrets have been migrated from dot notation to slash notation.

Alcali is still alive.

For Hervil

FreeBSD integrates OpenSSH to the base OS.

cloudhugger:

OpenSSH_8.4p1 Debian-5+deb11u3, OpenSSL 1.1.1w  11 Sep 2023

windriver:

OpenSSH_9.5p1, OpenSSL 3.0.12 24 Oct 2023

dwellers:

OpenSSH_8.7p1, OpenSSL 3.0.7 1 Nov 2022

windriver:

OpenSSH_9.5p1, OpenSSL 3.0.12 24 Oct 2023

windriver:

OpenSSH_9.5p1, OpenSSL 3.0.12 24 Oct 2023

docker-002:

OpenSSH_8.7p1, OpenSSL 3.0.7 1 Nov 2022

hervil:

OpenSSH_9.3p1, OpenSSL 1.1.1t-freebsd  7 Feb 2023

complector:

OpenSSH_9.3p1, OpenSSL 1.1.1t-freebsd  7 Feb 2023

db-A-001:

OpenSSH_9.3p2, OpenSSL 1.1.1t-freebsd  7 Feb 2023

db-B-001:

OpenSSH_9.3p1, OpenSSL 1.1.1t-freebsd  7 Feb 2023

web-001:

OpenSSH_9.3p1, OpenSSL 1.1.1t-freebsd  7 Feb 2023

router-001:

OpenSSH_9.3p1, OpenSSL 1.1.1t-freebsd  7 Feb 2023

ysul:

Minion did not return. [Not connected]

thrayce:

Minion did not return. [Not connected]

Situation has evolved since 2017, we currently configure nginx with TLSv1.2 + TLSv1.3,
per Mozilla intermediate configuration https://ssl-config.mozilla.org/

Worked before (dhclient + routes), but on boot:

• we've a correct fe80 address
• no dhclient, but /usr/local/etc/rc.d/dhclient6 start does NOT complain dhclient6_enable="YES" is missing
• when dhclient is started, our correct prefix is returned
• no static IP assignment in current state (missing from /etc/netif/igb0_ipv6)
• we can add manually IP in our prefix
• routing is missing and can't be easily figured (the expectation was dhclient would take care of that)

Taking it as we've issues with the /128 one and I'd prefer to fix the /56 config than the /128 one.

Server log