Add a Node to Percona XtraDB Cluster on NetBSD 10

Prerequisites

• Cluster bootstrapped and running
• PXC installed on this node
• Ports 3306, 4444, 4567, 4568 open

Configure this node (/etc/mysql/mysql.conf.d/mysqld.cnf, example Node 2)

[mysqld]
server-id            = 2
wsrep_on...

Apache .htaccess and mod_rewrite on NetBSD 10

Enable mod_rewrite

# Enable mod_rewrite in httpd.conf

Allow overrides in virtual host

    AllowOverride All
    Require all granted

Common .htaccess recipes

Force HTTPS

RewriteEngine On
Rew...

Apache + PHP-FPM on NetBSD 10

Step 1 – Enable proxy modules

service php-fpm start && service apache reload

Step 2 – Virtual host with PHP-FPM handler

    ServerName example.com
    DocumentRoot /var/www/example.com/html
    
        SetHandler "proxy:uni...

Bootstrap a Percona XtraDB Cluster on NetBSD 10

Nodes: 192.168.1.10 (bootstrap) · 192.168.1.11 · 192.168.1.12

Step 1 – Configure Node 1 (/etc/mysql/mysql.conf.d/mysqld.cnf)

[mysqld]
server-id            = 1
wsrep_on             = ON
wsrep_provider       = /usr/lib64/galera4/libgalera_sm...

Configure Apache Virtual Hosts on NetBSD 10

Step 1 – Create document root

mkdir -p /var/www/example.com/html
echo '
Works!
' > /var/www/example.com/html/index.html
chown -R www-data:www-data /var/www/example.com 2>/dev/null || chown -R apache:apache /var/www/example.com 2>/dev/null || tru...

Configure NPF Firewall on NetBSD 10

/etc/rc.conf

npf=YES
npf_conf=/etc/npf.conf

/etc/npf.conf

$ext_if = inet4 addr "wm0"
alg "icmp"
group default {
    pass stateful on lo0 all
    pass stateful all
    pass stateful in final on wm0 proto tcp to $ext_if port 22
    pass stateful in final on...

Configure Nginx as a Reverse Proxy on NetBSD 10

Basic reverse proxy

upstream backend {
    server 127.0.0.1:3000;
}

server {
    listen 80;
    server_name app.example.com;
    location / {
        proxy_pass         http://backend;
        proxy_http_version 1.1;
        proxy_set_header   Upg...

Configure Nginx Virtual Hosts on NetBSD 10

Step 1 – Create the document root

mkdir -p /var/www/example.com/html
echo '
Works!
' > /var/www/example.com/html/index.html

Step 2 – Create /usr/pkg/etc/nginx/conf.d/example.com.conf

server {
    listen 80;
    listen [::]:80;
    server_nam...

Configure OpenSMTPD on NetBSD 10

Install

# OpenBSD – built-in:
rcctl enable smtpd && rcctl start smtpd

# Other platforms:
# Ubuntu/Debian:
apt install opensmtpd
# AlmaLinux/RHEL:
dnf install opensmtpd
# Arch:
pacman -S opensmtpd

Basic /etc/mail/smtpd.conf

pki mail.example.com cert "/etc/ss...

Elasticsearch Multi-Node Cluster on NetBSD 10

Nodes: node-1 192.168.1.10 · node-2 192.168.1.11 · node-3 192.168.1.12

Node 1 elasticsearch.yml

cluster.name: production-cluster
node.name: node-1
node.roles: [master, data, ingest]
network.host: 192.168.1.10
http.port: 9200
transport.port:...

Elasticsearch Snapshot Backup on NetBSD 10

Register filesystem repository

mkdir -p /var/backups/elasticsearch
chown elasticsearch:elasticsearch /var/backups/elasticsearch

elasticsearch.yml: path.repo: ["/var/backups/elasticsearch"]

curl -X PUT "https://localhost:9200/_snapshot/my_backup" \...

Enable TLS/SSL on Apache – NetBSD 10

Step 1 – Enable mod_ssl

# SSL built-in
service apache restart

Step 2 – Generate self-signed certificate

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/ssl/private/apache-selfsigned.key \
    -out /etc/ssl/certs/apache-selfsigned.cr...

Enable TLS/SSL on Nginx – NetBSD 10

Step 1 – Self-signed certificate (testing)

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/ssl/private/nginx-selfsigned.key \
    -out /etc/ssl/certs/nginx-selfsigned.crt \
    -subj "/CN=example.com"
openssl dhparam -out /etc/ssl/certs/...

HAProxy MySQL Load Balancing on NetBSD 10

Config section

listen mysql-cluster
    bind *:3306
    mode    tcp
    option  mysql-check user haproxy_check
    balance leastconn
    server db1 192.168.1.10:3306 check weight 1
    server db2 192.168.1.11:3306 check weight 1
    server db3 192.168.1....

HAProxy TLS Termination on NetBSD 10

Step 1 – Combine cert + key

cat /etc/ssl/certs/example.com.crt /etc/ssl/private/example.com.key > /etc/haproxy/certs/example.com.pem
chmod 600 /etc/haproxy/certs/example.com.pem
openssl dhparam -out /etc/haproxy/dhparam.pem 2048

Step 2 – Config

global...

Harden SSH on NetBSD 10

Back up config

cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Key settings (/etc/ssh/sshd_config)

Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers deploy alice
Protocol 2
ClientAliveInterval 600
ClientAliveCountMax 0
X11Fo...

Install and Configure Postfix on NetBSD 10

Step 1 – Install

pkgin install postfix
echo 'postfix=YES' >> /etc/rc.conf && service postfix start

Step 2 – /etc/postfix/main.cf

myhostname  = mail.example.com
mydomain    = example.com
myorigin    = $mydomain
inet_interfaces = all
inet_protocols =...

Install Apache HTTP Server on NetBSD 10

Step 1 – Install

pkgin update
pkgin install apache24
echo 'apache=YES' >> /etc/rc.conf
service apache start

Step 2 – Open firewall ports

# configure NPF for ports 80 and 443

Step 3 – Verify

curl -I http://localhost
apachectl -v

Main config: /usr...

Install Docker on NetBSD 10

Step 1 – Install

# Docker is not natively available on NetBSD 10.
# Consider running a Linux VM or using podman.

Step 2 – Add user to docker group

usermod -aG docker $USER && newgrp docker

Step 3 – Verify

docker --version
docker run --rm hello-world

Step 4 –

Install Elasticsearch on NetBSD 10

Step 1 – Install

# Download Elasticsearch tarball from https://www.elastic.co/downloads/elasticsearch
# for NetBSD 10

Step 2 – Save initial root password

grep 'generated password' /var/log/elasticsearch/elasticsearch.log
# Reset if needed:
/usr/share/elasti...

Install Fail2Ban on NetBSD 10

Step 1 – Install

pkgin install py310-fail2ban
echo 'fail2ban=YES' >> /etc/rc.conf && service fail2ban start

Step 2 – /etc/fail2ban/jail.local

[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 5
banaction = iptables-multiport
ignoreip = 127.0.0.1/8 192.168.1.0...

Install Gitea on NetBSD 10

Step 1 – Create git user and download binary

useradd -r -m -d /home/git -s /bin/bash git
VERSION=1.22.0
wget -O /usr/local/bin/gitea https://dl.gitea.com/gitea/${VERSION}/gitea-${VERSION}-linux-amd64
chmod +x /usr/local/bin/gitea

Step 2 – Directories

mkdir -p /var/...

Install Grafana on NetBSD 10

Step 1 – Install

# Download from https://grafana.com/grafana/download

Step 2 – Access

http://your-server:3000 — default admin / admin (change immediately).

Step 3 – Add Prometheus data source

1. Configuration → Data Sources → Add data source
2. Select Pro...

Install HAProxy on NetBSD 10

Step 1 – Install

pkgin install haproxy
echo 'haproxy=YES' >> /etc/rc.conf && service haproxy start

Step 2 – Basic /usr/pkg/etc/haproxy/haproxy.cfg

global
    log /dev/log local0
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level...