6.1 DL160 Gen9: Bought myself a domain, now to configure Nginx + acme-client.

Hi,

Except the fact that the server's Smart Array Battery failing, my ProLiant DL160 Gen9 is doing great. I've long changed to running ESXi 6.0 and now it's VMware ESXi 6.5. Last time I wrote that I'm using XenServer but it's just a brief encounter. Having to install additional program for a web management feature is one of the negative point for me. So that's why I went back to VMware ESXi. Been learning a lot from this machine so I'm very excited and grateful.

What else is new? Ah. Got a very crazy deal for a domain registration which is buy 2 years and get 2 more years free for RM160! So I went for it and bought meself a domain. I should've bought more but I have no more budget. And before that I registered for a bargain 10Mbps Unifi plan for RM129/mth. Oh yeah and I moved to a new place.

As now I have my internet line at home, I can properly play around with the server and OpenBSD. My plan is to bring up my Odoo web online and *finally* start my small business.

So far, I have 2 OpenBSD vm. 1 vm is basically serving the local DNS (in progress), web (using Nginx), PostgreSQL, Fossil SCM and the other vm is doing nothing important (yet). In details:

serv1.mydomain.my (also known as www.mydomain.my):
- Unbound (not done).
- Nginx (serving Odoo through reverse proxy, Fossil SCM through SCGI, proxy pass to ESXi all in HTTPS).
- PostgreSQL.
- acme-client for SSL Certs (This particular post).

I learned acme-client quite a hard way. I configured the acme-client related files (/etc/acme-client.conf & /etc/nginx/nginx.conf) but every time I run the "acme-client -vAD mydomain.my" I received errors:

# acme-client: bad exit: netproc(xxxx): 1

Thinking that I can do trial/error as much as I wanted, I kept reconfiguring the files until I reached the limit of registration tries. Is it then that I read about it at https://letsencrypt.org/docs/rate-limits/. Then I read about the "Staging" function (acme-client --staging) which I tried but not in the installed version in OpenBSD. I checked the /etc/acme-client.conf and found the staging block. So I altered it as:

===== /etc/acme-client.conf =====
#authority letsencrypt {
#    *snipped
#}

#authority letsencrypt-staging {
authority letsencrypt {
    agreement url "bla bla
    bla bla bla
    account key "bla bla
}
===== /etc/acme-client.conf =====

Basically I commented the production block and "authority letsencrypt-staging" line. Using the same "acme-client -vAD mydomain.my" now will basically use the Staging URL instead of the production one so the limit is much higher which is useful for testing/debugging. I wish I knew this earlier. Because of the production limit, now I have to wait for a full 7 days before I can try and register again. Ah well, I can do more testing in the mean time.

After much re-configuration / testing cycle, I found that this configuration managed to successfully register my domain. Here's the additional block in /etc/acme-client.conf:

===== /etc/acme-client.conf =====
* snipped

domain mydomain.my {
    alternative names { www.mydomain.my esx.mydomain.my fossil.mydomain.my }
    domain key "/etc/ssl/private/mydomain.my.key"
    domain certificate "/etc/ssl/mydomain.my.crt"
    domain full chain certificate "/etc/ssl/mydomain.my.fullchain.pem"
    sign with letsencrypt
    challengedir "/var/www/acme/.well-known/acme-challenge"
}
===== /etc/acme-client.conf =====

And to compliment the above configuration, here's the /etc/nginx/nginx.conf configuration.

===== /etc/nginx/nginx.conf =====
# Default server
server {
    listen 80;
    server_name mydomain.my www.mydomain.my;

    location ^~ /.well-known/acme-challenge {
        default_type "text/plain";
        root /var/www/acme;
    }

    location / {
        return 307 https://www.mydomain.my$request_uri;
    }
}

# ESXi
server {
    listen 80;
    server_name esx.mydomain,my;

    location ^~ /.well-known/acme-challenge {
        default_type "text/plain";
        root /var/www/acme;
    }

    location / {
        return 307 https://$host$request_uri;
    }
}

server {
    listen 443;
    ssl on;
    ssl_certificate    /etc/ssl/mydomain.my.fullchain.pem;
    ssl_certificate_key    /etc/ssl/private/mydomain.my.key;

    *snipped
}
===== /etc/nginx/nginx.conf =====

Do take note that the "default_type "text/plain";" line is optional. I tried registering without it and it's fine. The "ESX" block is also not completed yet as virtual console have "Failed to connect" error which is for another post. After reconfiguration then I restarted Nginx then run acme-client again.

# rcctl restart nginx
# acme-client -vAD mydomain.my
* snipped
acme-client: /etc/ssl/mydomain.my.crt: created
acme-client: /etc/ssl//mydomain.my.fullchain.pem: created

Noted the the double-slash "//" on the fullchain.pem. Although it seems like something not working, I can still find the fullchain.pem file in /etc/ssl folder. And when I checked the SSL Certificate, the issuer > Common Name (CN) is stated as "Fake LE Intermediate X1" which is as what Let's Encrypt documented.

So far I've done a few test and it's ok. I need to wait until this Sunday (or next Monday) before I can try and register again. Later.

Welcoming HPE ProLiant DL160 Gen9 as my another machine.

Hi,

Been quite some time. Been busy with work and all. And this few days I've been busy with new weapons in my IT arsenal.

I've acquired, or more correctly salvaged a HPE ProLiant DL160 Gen9 server. It's from a burnt server room which was destined to be disposed. When I got it, the server fans (3 units) was not working thus it can't boot so the company who owns it doesn't want it in production anymore. There was tar built up inside the server, so I cleaned the fans until I can make it turn so I try to boot it up and it works. The fire doesn't go anywhere near the server, it just heavy smoke was covering the server room. I cleaned the internal a bit more but need to get myself an isopropyl alcohol soon to thoroughly clean the interior.

The first OS I installed to test this system is, well, OpenBSD 6.0 amd64. As I thought, this Generation 9 system is new and there's many devices which prompted "not configured". The Matrox 200eH display has not device driver for it yet. Sorry but I forgot to get the dmesg after bare-metal install.

This DL160 Gen9 configuration is:
1x Intel E5-2623 v3 @ 3.00Ghz (4 cores)
4x 4Gb ECC RAM (I set it up to RAID 5)
4x 1Tb 2.5" SAS Drive
HPE P440 SAS Controller PCIe
1x 550w non-hotswap PSU
HPE 82Q 8Gb 2-Port PCIe Fibre Channel Host Adapter (not installed)

That's what I can remember. So after the brief test of OpenBSD, I installed Windows Server 2012 R2 trial. Figuring that as HPE should have provided all the device drivers needed for Windows (which is true), I might as well use the Hyper-V for OpenBSD, which I did. And didn't quite like it. Partly because I'm not delving deeper on how to configure the Hyper-V. Also that I keep staring at the Win Server 2012 R2 desktop, not knowing on what else to do with it. Yeah sure my company uses it in production, also I set up a few of my company's backup server with it, so I somehow need to learn it but it's not the only virtualization solution.

So I check the server's compatible OS list, got meself 2 candidate.

VMware ESXi vSphere 6.0 Update 2
XenServer 6.5

For ESXi, 6.0 is the latest version. Also HPE provided downloadable custom ISO for it. Nice. I downloaded the goodies and installed the HPE custom ISO version. My verdict:

I'm still new to this vm thingy. My DL160 have 64Gb miniSD included, so ESXi can be installed in it. As I was told that vSphere is free now, so I got meself the Free License Key. Keyed it in, just to feel what the free version can do as I know I can't afford to buy myself the Essentials or more. Installation was easy, post installation's configuration too. Web interface readily available. Then I installed OpenBSD. Didn't manage to get the network to work. Even with HPE custom ISO, which included all the necessary drivers, I somewhat feel the console respond in OpenBSD a bit sluggish. But hey, it's my first try so what do I know? My company also utilise ESXi so it's good to know there's latest ISO provided by HPE for this server.

Then for XenServer 6.5. Not the latest version. Latest is version 7 but HPE stated that they officially supporting version 6.5 as compatible. No custom ISO by HPE so I went to xenserver.org to download it. But never did install it as it needs MBR booting only. No UEFI. Which somehow I do mind.

So I went back xenserver.org and get meself XenServer 7. I read that there's no web client included so I also download Xen Orchestra, which adds nearly 500Mb additional download from XenServer's 600Mb+-. ESXi have vSphere client, so do XenServer with its XenCenter. Both both are Windows only. Which is a bummer. But ESXi's built in web interface is good and progressing. Unlike XenServer which relies on 3rd party web interface like Xen Orchestra.

Installation-wise, XenServer can be installed in UEFI which is great. But there's strong suggestion to avoid installing it to SD or USB and proceed with the local disk instead so ESXi wins this part. Getting Xen Orchestra to run also pose a problem for newbie like me. My bad. I'm using an old Innacom's Streamyx ADSL Router Modem as my home-lab router for this exciting project so I'm learning quite a few things at once.

To my surprise, Xen Orchestra runs as a vm inside XenServer. Which I thought will just add the web interface inside XenServer instead of doing that. Also to my surprise, the web interface is much better than ESXi's. Maybe because I keyed in the free license in ESXi and many feature is disabled? I'm not quite sure. Many feature are also disabled in Xen Orchestra (oh, this one is also a free version) but I read that XenServer have all the feature enabled and I can just fall back to the trusty SHH/console if I need to use it. Honestly, although the Xen Orchestra's interface is nice, I found myself lost in it quite a few times. Anyway getting a vm installed using it is not that hard. But...

But ESXi made it easy to get guest OS's ISO uploaded to host server. This is also the thing that I like about ESXi. Basically storage manipulation in ESXi is easier for me, although I don't have enough experience with this VM thingy. I can just create a directory, then upload ISO into it and install my guest OS using it. In XenServer, I have to take note of the directory's limitation (storage is in XenServer's partition etc), mkdir the directory in somewhat standard place (/var/opt/xen/ISO_Store) and then register that directory to XenServer's Storage. And to note that I already gained a bit of experience in XenServer rather than the truly trial-and-error approached in ESXi earlier, these points really shows how well, hmm can I say "user friendly" ESXi is.

Putting that aside, I made that /var/opt/xen/ISO_Store thingy happened, push my install60.iso in it then install it. Easy-peasy-lemon-squeasy. Tried UEFI installation for it but didn't manage to boot OpenBSD after installation. I'm lazy to find the solution right now so I rushed for MBR installation. Hey I need to know how good XenServer will host my OpenBSD. And it doesn't dissappoint. I'm smiling to see that the xnf0 network interface was up in dhcp. The console respond in Xen Orchestra is also fluid. Nice. Getting OpenBSD up is the most important thing. And I know for now, XenServer is the suitable place for it in my DL160 Gen9. Until OpenBSD support all those hardware in bare-metal that is. Or who knows, maybe I'll stick with vm path as this is also a great knowledge to learn.

XenServer 7 it is then. Seeing more feature enabled in free version than ESXi, I made my choice already. Will I return to ESXi? I will for learning purpose. As I'm new on these (I think I state this too many now) vm thingy, the limitation in free ESXi might not make too much impact. Or if I was given an Essentials license for free. Hah! Oh also Microsoft have a free Windows Hyper-V 2012 R2 server for download, and done downloading I am.

That's it for now. I'll write up the details of installation and configuration next when I'm not too lazy to write as I'm currently playing around with the server. Just exploring the iLO4 alone is exciting! Later!