# innangard.v8r.io

### extend the root partition to use all of the available storage

df -Th
sudo lvextend /dev/mapper/fedora-root -l +100%FREE -r
df -Th

### dependencies for cichlid and passmark

sudo dnf update -y
sudo dnf install -y \
  git \
  jq \
  python3-pip
sudo pip install yq

# rob
echo "grenade ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/grenade
mkdir ~/.ssh
curl -sLo ~/.ssh/authorized_keys --url https://github.com/grenade.keys

# chris
id chd || sudo useradd --create-home --user-group chd
echo "chd ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/chd
sudo -u chd mkdir /home/chd/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICqLZ8g4OEkYREvtocms3pUgdUVIxiJ+WZHv3ZsMROZL" sudo -u chd tee /home/chd/.ssh/authorized_keys

# quilibrium
id quilibrium || sudo useradd --system --create-home --home-dir /var/lib/quilibrium --user-group quilibrium

### restore quilibrium `~/.node` and `~/.local` folders from workstation backup

for src in ${HOME}/quilibrium/poweredge-1.thgttg.com/2024-09-24T07:44:36+00:00/{.local,.node}; do
  rsync \
    --archive \
    --compress \
    --verbose \
    --rsync-path='sudo -u quilibrium rsync' \
    ${src} \
    innangard:/var/lib/quilibrium/
done

### open firewall for quilibrium traffic

sudo firewall-cmd --list-ports --permanent
sudo firewall-cmd --zone=FedoraServer --add-port=8336/udp --permanent
sudo firewall-cmd --zone=FedoraServer --add-port=8337/tcp --permanent
sudo firewall-cmd --zone=FedoraServer --add-port=8338/tcp --permanent
sudo firewall-cmd --zone=FedoraServer --add-port=9100/tcp --permanent
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports --permanent

### install quilibrium services and configuration

sudo curl \
  --silent \
  --location \
  --output /etc/systemd/system/quilibrium-worker@.service \
  --url https://raw.githubusercontent.com/grenade/rubberneck/main/static/etc/systemd/system/quilibrium-worker%40.service
sudo curl \
  --silent \
  --location \
  --output /etc/systemd/system/quilibrium.service \
  --url https://raw.githubusercontent.com/grenade/rubberneck/main/static/etc/systemd/system/quilibrium.service
sudo curl \
  --silent \
  --location \
  --output /etc/sysctl.d/90-quilibrium.conf \
  --url https://raw.githubusercontent.com/grenade/rubberneck/main/static/etc/sysctl.d/90-quilibrium.conf
sudo sysctl -w net.core.rmem_max=4194304
sudo sysctl -w net.core.wmem_max=4194304
sudo systemctl daemon-reload
sudo semanage fcontext -a -t bin_t /var/lib/quilibrium/.local/bin/quilibrium
sudo chcon -Rv -u system_u -t bin_t /var/lib/quilibrium/.local/bin/quilibrium

### start quilibrium workers and controller

for core in {1..24}; do
  sudo systemctl start quilibrium-worker@${core}.service
done
sudo systemctl enable --now quilibrium.service

### check quilibrium node info and balance

sudo -u quilibrium /var/lib/quilibrium/.local/bin/quilibrium --config /var/lib/quilibrium/.node --node-info

### obtain a cert on the reverse proxy

ssh mp \
  sudo certbot certonly \
    -m [e-mail] \
    --agree-tos \
    --no-eff-email \
    --noninteractive \
    --cert-name innangard.v8r.io \
    --expand \
    --allow-subset-of-names \
    --key-type ecdsa \
    --dns-cloudflare \
    --dns-cloudflare-credentials /root/.cloudflare-v8r.io \
    --dns-cloudflare-propagation-seconds 60 \
    -d innangard.v8r.io \
    -d cockpit.innangard.v8r.io \
    -d idrac.innangard.v8r.io

### update nginx on the reverse proxy (after pausing rubberneck sync)

ssh kavula "
  sudo systemctl stop sync-node-state-mountain-paradise.service;
  sudo systemctl disable sync-node-state-mountain-paradise.service;
"
ssh mp "
  sudo mv /etc/nginx/sites-available/poweredge-1.thgttg.com.conf /etc/nginx/sites-available/innangard.v8r.io.conf;
  sudo rm /etc/nginx/sites-enabled/poweredge-1.thgttg.com.conf;
  sudo sed -i -e 's/poweredge-1/innangard/g' /etc/nginx/sites-available/innangard.v8r.io.conf;
  sudo sed -i -e 's/thgttg.com/v8r.io/g' /etc/nginx/sites-available/innangard.v8r.io.conf;
  sudo ln -sfr /etc/nginx/sites-available/innangard.v8r.io.conf /etc/nginx/sites-enabled/innangard.v8r.io.conf;
  sudo systemctl restart nginx.service;
"