feat: update deployment configuration and encrypted env loader
- Update Ansible playbooks and roles for application deployment - Add new Gitea/Traefik troubleshooting playbooks - Update Docker Compose configurations (base, local, staging, production) - Enhance EncryptedEnvLoader with improved error handling - Add deployment scripts (autossh setup, migration, secret testing) - Update CI/CD workflows and documentation - Add Semaphore stack configuration
This commit is contained in:
428
docs/deployment/AUTOSSH-SETUP.md
Normal file
428
docs/deployment/AUTOSSH-SETUP.md
Normal file
@@ -0,0 +1,428 @@
|
||||
# Autossh Setup - Persistente SSH-Verbindungen
|
||||
|
||||
**Status**: ? Ready
|
||||
**Last Updated**: 2025-01-31
|
||||
**Purpose**: Automatische ?berwachung und Neustart von SSH-Verbindungen zum Production-Server
|
||||
|
||||
---
|
||||
|
||||
## ?bersicht
|
||||
|
||||
Autossh ist ein Tool, das SSH-Verbindungen automatisch ?berwacht und neu aufbaut, wenn sie abbrechen. Dies ist besonders n?tzlich f?r:
|
||||
- SSH-Tunnel zu entfernten Servern
|
||||
- Persistente SSH-Verbindungen f?r Ansible/CI/CD
|
||||
- Automatische Verbindungswiederherstellung nach Netzwerkunterbrechungen
|
||||
|
||||
---
|
||||
|
||||
## Installation
|
||||
|
||||
### Linux (Ubuntu/Debian)
|
||||
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install autossh
|
||||
```
|
||||
|
||||
### macOS
|
||||
|
||||
```bash
|
||||
brew install autossh
|
||||
```
|
||||
|
||||
### WSL2 / Windows
|
||||
|
||||
Autossh ist normalerweise ?ber das Linux-Subsystem verf?gbar. Falls nicht:
|
||||
|
||||
```bash
|
||||
# In WSL2
|
||||
sudo apt update
|
||||
sudo apt install autossh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Konfiguration
|
||||
|
||||
### Schritt 1: SSH-Config erweitern
|
||||
|
||||
Erweitere deine `~/.ssh/config` mit Keep-Alive und ServerAliveInterval Optionen:
|
||||
|
||||
```bash
|
||||
# Edit SSH config
|
||||
nano ~/.ssh/config
|
||||
```
|
||||
|
||||
F?ge folgende Konfiguration hinzu:
|
||||
|
||||
```
|
||||
# Production Server - Persistent Connection
|
||||
Host production
|
||||
HostName 94.16.110.151
|
||||
User deploy
|
||||
IdentityFile ~/.ssh/production
|
||||
ServerAliveInterval 60
|
||||
ServerAliveCountMax 3
|
||||
TCPKeepAlive yes
|
||||
Compression yes
|
||||
StrictHostKeyChecking accept-new
|
||||
|
||||
# Git Server - Persistent Connection
|
||||
Host git.michaelschiemer.de
|
||||
HostName git.michaelschiemer.de
|
||||
Port 2222
|
||||
User git
|
||||
IdentityFile ~/.ssh/git_michaelschiemer
|
||||
ServerAliveInterval 60
|
||||
ServerAliveCountMax 3
|
||||
TCPKeepAlive yes
|
||||
Compression yes
|
||||
StrictHostKeyChecking no
|
||||
UserKnownHostsFile /dev/null
|
||||
```
|
||||
|
||||
**Wichtige Optionen:**
|
||||
- `ServerAliveInterval 60`: Sendet alle 60 Sekunden ein Keep-Alive-Signal
|
||||
- `ServerAliveCountMax 3`: Gibt nach 3 fehlgeschlagenen Keep-Alive-Versuchen auf
|
||||
- `TCPKeepAlive yes`: Nutzt TCP Keep-Alive f?r zus?tzliche Persistenz
|
||||
|
||||
### Schritt 2: Autossh als Service einrichten
|
||||
|
||||
#### Option A: Systemd Service (Linux/WSL2)
|
||||
|
||||
Erstelle einen systemd Service f?r autossh:
|
||||
|
||||
```bash
|
||||
# Create systemd service directory
|
||||
mkdir -p ~/.config/systemd/user
|
||||
|
||||
# Create service file
|
||||
nano ~/.config/systemd/user/autossh-production.service
|
||||
```
|
||||
|
||||
Service-Datei Inhalt:
|
||||
|
||||
```ini
|
||||
[Unit]
|
||||
Description=AutoSSH for Production Server
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="AUTOSSH_GATETIME=0"
|
||||
Environment="AUTOSSH_POLL=10"
|
||||
ExecStart=/usr/bin/autossh -M 20000 -N -o "ServerAliveInterval=60" -o "ServerAliveCountMax=3" production
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
```
|
||||
|
||||
**Wichtige Hinweise:**
|
||||
- `-M 20000`: Monitoring-Port (nur Port-Nummer, nicht IP:Port!)
|
||||
- `-N`: Keine Remote-Commands (nur persistente Verbindung)
|
||||
- **Kein `-f` Flag**: Bei systemd Type=simple wird `-f` nicht ben?tigt, da systemd die Background-Operation ?bernimmt
|
||||
|
||||
**Service aktivieren:**
|
||||
|
||||
```bash
|
||||
# Reload systemd user services
|
||||
systemctl --user daemon-reload
|
||||
|
||||
# Enable service (startet automatisch beim Login)
|
||||
systemctl --user enable autossh-production.service
|
||||
|
||||
# Start service
|
||||
systemctl --user start autossh-production.service
|
||||
|
||||
# Check status
|
||||
systemctl --user status autossh-production.service
|
||||
|
||||
# View logs
|
||||
journalctl --user -u autossh-production.service -f
|
||||
```
|
||||
|
||||
#### Option B: Manuelle Autossh-Verbindung
|
||||
|
||||
F?r manuelle/tempor?re Verbindungen:
|
||||
|
||||
```bash
|
||||
# Start autossh mit Monitoring-Port
|
||||
autossh -M 20000 -N -f -o "ServerAliveInterval=60" -o "ServerAliveCountMax=3" production
|
||||
|
||||
# Check if running
|
||||
ps aux | grep autossh
|
||||
|
||||
# Stop autossh
|
||||
pkill autossh
|
||||
```
|
||||
|
||||
**Parameter-Erkl?rung:**
|
||||
- `-M 20000`: Monitoring-Port (autossh nutzt diesen zum Health-Check)
|
||||
- `-N`: Keine Remote-Commands ausf?hren (nur Tunnel)
|
||||
- `-f`: Im Hintergrund laufen
|
||||
- `-o "ServerAliveInterval=60"`: SSH Keep-Alive alle 60 Sekunden
|
||||
- `-o "ServerAliveCountMax=3"`: Nach 3 Fehlversuchen aufgeben
|
||||
|
||||
#### Option C: SSH-Tunnel mit Autossh
|
||||
|
||||
F?r SSH-Tunnel (z.B. Port-Forwarding):
|
||||
|
||||
```bash
|
||||
# Forward local port 8080 to remote 80
|
||||
autossh -M 20000 -N -f -L 8080:localhost:80 production
|
||||
|
||||
# Forward remote port 3306 to local
|
||||
autossh -M 20000 -N -f -R 3306:localhost:3306 production
|
||||
|
||||
# Check tunnel
|
||||
ps aux | grep autossh
|
||||
ss -tuln | grep 8080
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Testing
|
||||
|
||||
### Verbindung testen
|
||||
|
||||
```bash
|
||||
# Test normal SSH
|
||||
ssh production "echo 'Connection successful'"
|
||||
|
||||
# Test autossh connection
|
||||
autossh -M 20000 -v -N -o "ServerAliveInterval=60" production
|
||||
|
||||
# Check if autossh is monitoring
|
||||
ps aux | grep autossh
|
||||
netstat -tuln | grep 20000
|
||||
```
|
||||
|
||||
### Verbindungsstatus ?berwachen
|
||||
|
||||
```bash
|
||||
# Check active SSH connections
|
||||
ssh production "who"
|
||||
|
||||
# Check autossh process
|
||||
ps aux | grep autossh
|
||||
|
||||
# Check systemd service status
|
||||
systemctl --user status autossh-production.service
|
||||
|
||||
# View logs
|
||||
journalctl --user -u autossh-production.service --since "10 minutes ago"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Autossh startet nicht
|
||||
|
||||
**Problem**: Autossh-Process startet nicht oder crasht sofort
|
||||
|
||||
**L?sung**:
|
||||
```bash
|
||||
# Test SSH-Verbindung manuell
|
||||
ssh -v production "echo test"
|
||||
|
||||
# Test autossh mit verbose logging
|
||||
autossh -M 20000 -v -N production
|
||||
|
||||
# Pr?fe SSH-Config
|
||||
ssh -F ~/.ssh/config production "echo test"
|
||||
|
||||
# Pr?fe Berechtigungen
|
||||
ls -la ~/.ssh/production
|
||||
chmod 600 ~/.ssh/production
|
||||
```
|
||||
|
||||
### Verbindung bricht trotzdem ab
|
||||
|
||||
**Problem**: Verbindung bricht auch mit autossh regelm??ig ab
|
||||
|
||||
**L?sung**:
|
||||
1. **Erh?he Keep-Alive-Interval:**
|
||||
```bash
|
||||
# In ~/.ssh/config
|
||||
ServerAliveInterval 30
|
||||
ServerAliveCountMax 10
|
||||
```
|
||||
|
||||
2. **Pr?fe Netzwerk/Firewall:**
|
||||
```bash
|
||||
# Test network connectivity
|
||||
ping 94.16.110.151
|
||||
|
||||
# Test SSH port
|
||||
nc -zv 94.16.110.151 22
|
||||
```
|
||||
|
||||
3. **Pr?fe Server-Konfiguration:**
|
||||
```bash
|
||||
# Auf dem Server pr?fen
|
||||
ssh production "cat /etc/ssh/sshd_config | grep -E 'ClientAlive|TCPKeepAlive'"
|
||||
```
|
||||
|
||||
### Port-Konflikte
|
||||
|
||||
**Problem**: Monitoring-Port (20000) ist bereits belegt
|
||||
|
||||
**L?sung**:
|
||||
```bash
|
||||
# W?hle einen anderen Port
|
||||
autossh -M 20001 -N -f production
|
||||
|
||||
# Oder nutze einen zuf?lligen Port
|
||||
autossh -M 0 -N -f production # 0 = random port
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Best Practices
|
||||
|
||||
### 1. Monitoring-Port anpassen
|
||||
|
||||
Wenn mehrere autossh-Instanzen laufen, nutze verschiedene Monitoring-Ports:
|
||||
|
||||
```bash
|
||||
# Production Server
|
||||
autossh -M 20000 -N -f production
|
||||
|
||||
# Git Server
|
||||
autossh -M 20001 -N -f git.michaelschiemer.de
|
||||
```
|
||||
|
||||
### 2. Systemd Service f?r Produktivit?t
|
||||
|
||||
Nutze systemd Services f?r automatischen Start:
|
||||
|
||||
```bash
|
||||
# Enable lingering f?r user services
|
||||
sudo loginctl enable-linger $USER
|
||||
|
||||
# Services starten beim Boot
|
||||
systemctl --user enable autossh-production.service
|
||||
```
|
||||
|
||||
### 3. Logging konfigurieren
|
||||
|
||||
F?r besseres Debugging:
|
||||
|
||||
```bash
|
||||
# Systemd service mit logging
|
||||
[Service]
|
||||
ExecStart=/usr/bin/autossh -M 20000 -v -N -o "ServerAliveInterval=60" -o "LogLevel=DEBUG" production
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
```
|
||||
|
||||
### 4. Automatischer Neustart
|
||||
|
||||
Systemd Service startet automatisch neu, aber f?r manuelle Instanzen:
|
||||
|
||||
```bash
|
||||
# Mit automatischem Restart
|
||||
while true; do
|
||||
autossh -M 20000 -N production || sleep 10
|
||||
done
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Integration mit Ansible
|
||||
|
||||
Autossh kann auch f?r Ansible-Verbindungen genutzt werden:
|
||||
|
||||
```yaml
|
||||
# ansible.cfg
|
||||
[defaults]
|
||||
transport = ssh
|
||||
pipelining = True
|
||||
ssh_args = -o ServerAliveInterval=60 -o ServerAliveCountMax=3
|
||||
control_path = ~/.ansible/cp/%%h-%%p-%%r
|
||||
```
|
||||
|
||||
Oder nutze die SSH-Config direkt (empfohlen):
|
||||
|
||||
```bash
|
||||
# ~/.ssh/config ist bereits f?r Ansible nutzbar
|
||||
ansible production -m ping
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Sicherheitshinweise
|
||||
|
||||
1. **SSH-Keys sch?tzen:**
|
||||
```bash
|
||||
chmod 600 ~/.ssh/production
|
||||
chmod 644 ~/.ssh/production.pub
|
||||
```
|
||||
|
||||
2. **Monitoring-Port absichern:**
|
||||
```bash
|
||||
# Monitoring-Port nur lokal verf?gbar
|
||||
autossh -M 127.0.0.1:20000 -N -f production
|
||||
```
|
||||
|
||||
3. **Keine Passw?rter:**
|
||||
- Nutze immer SSH-Keys
|
||||
- Keine Passw?rter in autossh-Commands
|
||||
|
||||
---
|
||||
|
||||
## Quick Reference
|
||||
|
||||
### Makefile-Befehle
|
||||
|
||||
```bash
|
||||
# SSH-Verbindung zum Production-Server
|
||||
make ssh
|
||||
# oder
|
||||
make ssh-production
|
||||
|
||||
# SSH-Verbindung zum Git-Server
|
||||
make ssh-git
|
||||
|
||||
# Status der autossh-Services pr?fen
|
||||
make ssh-status
|
||||
|
||||
# Logs der autossh-Services anzeigen
|
||||
make ssh-logs
|
||||
|
||||
# Autossh einrichten
|
||||
make setup-autossh
|
||||
```
|
||||
|
||||
### Manuelle Befehle
|
||||
|
||||
```bash
|
||||
# Service starten
|
||||
systemctl --user start autossh-production.service
|
||||
|
||||
# Service stoppen
|
||||
systemctl --user stop autossh-production.service
|
||||
|
||||
# Service Status
|
||||
systemctl --user status autossh-production.service
|
||||
|
||||
# Logs anzeigen
|
||||
journalctl --user -u autossh-production.service -f
|
||||
|
||||
# Manuelle Verbindung (ohne systemd)
|
||||
autossh -M 20000 -N -f production
|
||||
|
||||
# Verbindung beenden
|
||||
pkill autossh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Weitere Ressourcen
|
||||
|
||||
- [Autossh Manual](https://www.harding.motd.ca/autossh/)
|
||||
- [SSH Keep-Alive Documentation](https://www.ssh.com/academy/ssh/config)
|
||||
- [Systemd User Services](https://wiki.archlinux.org/title/Systemd/User)
|
||||
Reference in New Issue
Block a user