From 27518bac3cdbac765bbd94dfede64babdc77f13e Mon Sep 17 00:00:00 2001 From: Matt Birkholz Date: Sat, 9 May 2026 15:44:15 -0600 Subject: [PATCH] Update README.html. --- README.html | 1007 ++++++++++++++++++++++++++------------------------- 1 file changed, 508 insertions(+), 499 deletions(-) diff --git a/README.html b/README.html index 69e5a54..2654117 100644 --- a/README.html +++ b/README.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + Birchwood Abbey Networks @@ -24,8 +24,8 @@ idiosyncrasies. The roles herein are abbey specific, emphasized by the abbey- prefix on their names. These roles are applied after the generic institutional roles (again, documented here).

-
-

1. Overview

+
+

1. Overview

A Small Institute makes security and privacy top priorities but @@ -64,7 +64,7 @@ map is very similar, with differences mainly in terminology, philosophy, attitude.

-
+
                 |                                                   
                 =                                                   
               _|||_                                                 
@@ -103,8 +103,8 @@ philosophy, attitude.
-
-

2. The Abbey Particulars

+
+

2. The Abbey Particulars

The abbey's public particulars are included below. They are the @@ -134,8 +134,8 @@ into private_ex/vars-abbey.yml.

-
-

3. The Abbey Front Role

+
+

3. The Abbey Front Role

Birchwood Abbey's front door is a Digital Ocean Droplet configured as @@ -144,8 +144,8 @@ with Apache2, spooling email with Postfix and serving it with Dovecot-IMAPd, and hosting a VPN with WireGuard™.

-
-

3.1. Install Emacs

+
+

3.1. Install Emacs

The monks of the abbey are masters of the staff (bo) and Emacs. @@ -160,8 +160,8 @@ The monks of the abbey are masters of the staff (bo) and Emacs.

-
-

3.2. Configure Public Email Aliases

+
+

3.2. Configure Public Email Aliases

The abbey uses several additional email aliases. These are the public @@ -172,8 +172,7 @@ from there, forwarding sysadm to a real person.

-roles_t/abbey-front/tasks/main.yml

-- name: Install abbey email aliases.
+roles_t/abbey-front/tasks/main.yml
- name: Install abbey email aliases.
   become: yes
   blockinfile:
     block: |
@@ -201,8 +200,8 @@ from there, forwarding sysadm to a real person.
-
-

3.3. Configure Git Daemon on Front

+
+

3.3. Configure Git Daemon on Front

The abbey publishes member Git repositories with git daemon. If @@ -247,7 +246,7 @@ rsync -av --del small.institute.org:Public/foo/ ~/Public/foo/ The git daemon is run by SystemD per the git-daemon.service file. The git-daemon(1) manual page explains the options in detail. The --base-path option should agree with $projectroot in the -/etc/gitweb.conf file installed here. +/etc/gitweb.conf file installed here.

@@ -274,13 +273,12 @@ like gitd-tasks and gitd-handlers.

-roles_t/abbey-front/tasks/main.yml

-<<gitd-tasks>>
+roles_t/abbey-front/tasks/main.yml
<<gitd-tasks>>
-gitd-tasks
- name: Install git.
+gitd-tasks
- name: Install git.
   become: yes
   apt: pkg=git
 
@@ -358,14 +356,12 @@ like gitd-tasks and gitd-handlers.
-roles_t/abbey-front/handlers/main.yml

-<<gitd-handlers>>
+roles_t/abbey-front/handlers/main.yml
<<gitd-handlers>>
-gitd-handlers

-- name: Reload systemd.
+gitd-handlers
- name: Reload systemd.
   become: yes
   systemd:
     daemon-reload: yes
@@ -380,8 +376,8 @@ like gitd-tasks and gitd-handlers.
-
-

3.4. Configure Gitweb on Front

+
+

3.4. Configure Gitweb on Front

The abbey provides an HTML interface to members' public Git @@ -408,7 +404,7 @@ lists the repositories found in /var/www/git/.

-apache-gitweb
Alias /gitweb-static/ /usr/share/gitweb/static/
+apache-gitweb
Alias /gitweb-static/ /usr/share/gitweb/static/
 <Directory "/usr/share/gitweb/static/">
     Options MultiViews
 </Directory>
@@ -465,13 +461,12 @@ web site /favicon.ico.
 

 
 

-roles_t/abbey-front/tasks/main.yml

-<<gitweb-tasks>>
+roles_t/abbey-front/tasks/main.yml
<<gitweb-tasks>>
 

 

 
 

-gitweb-tasks
- name: Enable Apache2 rewrite module.
+gitweb-tasks
- name: Enable Apache2 rewrite module.
   become: yes
   apache2_module: name=rewrite
   notify: Restart Apache2.
@@ -508,13 +503,12 @@ web site /favicon.ico.
 

 
 

-roles_t/abbey-front/handlers/main.yml

-<<gitweb-handlers>>
+roles_t/abbey-front/handlers/main.yml
<<gitweb-handlers>>
 

 

 
 

-gitweb-handlers
- name: Restart Apache2.
+gitweb-handlers
- name: Restart Apache2.
   become: yes
   systemd:
     service: apache2
@@ -524,8 +518,8 @@ web site /favicon.ico.
-
-

3.5. Configure Apache for Abbey Documentation

+
+

3.5. Configure Apache for Abbey Documentation

Some of the directives added to the -vhost.conf file are needed by @@ -543,7 +537,7 @@ filename suffixes.

-apache-abbey
<Directory {{ docroot }}/Abbey/>
+apache-abbey
<Directory {{ docroot }}/Abbey/>
     AllowOverride Indexes FileInfo
     Options +Indexes +FollowSymLinks
 </Directory>
@@ -566,8 +560,8 @@ AddType text/plain private pub public_vpn req rev sample txt yml
-
-

3.6. Configure Photos URLs on Front

+
+

3.6. Configure Photos URLs on Front

Some of the directives added to the -vhost.conf file map the abbey's @@ -579,7 +573,7 @@ matching configurations for accurate previews and tests.

-apache-photos
RedirectMatch /Photos$ /Photos/
+apache-photos
RedirectMatch /Photos$ /Photos/
 RedirectMatch /Photos/(20[0-9][0-9])_([0-9][0-9])_([0-9][0-9])$ \
               /Photos/$1_$2_$3/
 AliasMatch /Photos/(20[0-9][0-9])_([0-9][0-9])_([0-9][0-9])/(.+)$ \
@@ -591,10 +585,53 @@ AliasMatch /Photos/$ {{ docroot }}/Photos/index.html
-
-

3.7. Configure Tellurion Expiration on Front

+
+

3.7. Configure Matt's Alter Ego

+Many years ago Matt's evil twin, Friar Puck, released a "pucked" +version of MIT/GNU Scheme, advertising that it was available at a +couple URLs: +

+ +
    +
  • git://birchwood-abbey.net/~puck/mit-scheme.git
    • +
  • https://birchwood-abbey.net/~puck/Scheme/
    • +
+ +

+These are actually duplicates of the "resources" at these URLs: +

+ +
    +
  • git://birchwood-abbey.net/~matt/mit-scheme.git
    • +
  • https://birchwood-abbey.net/~matt/Scheme/
    • +
+ +

+So the abbey's Google Indexing report warned of the duplicates, and +explained that they would not be indexed. To get them off the report, +the following redirects make clear that the canonical source is +Matt's. +

+ +
+apache-pucked
RedirectMatch /~puck$ /~matt
+RedirectMatch /~puck/(.*) /~matt/$1
+
+
+ +

+The seemingly duplicated Git repository at /~puck/mit-scheme.git is +actually the symbolic link at /home/puck/Public targeting +/home/matt/Public. +

+
+
+
+

3.8. Configure Tellurion Expiration on Front

+
+

The abbey's tellurion.png is updated every 15 minutes on the quarter hour, and should expire soon thereafter. To accomplish this, Apache's expires module is enabled inside the /Tellurion/ directory and the @@ -602,7 +639,7 @@ hour, and should expire soon thereafter. To accomplish this, Apache's

-apache-tellurion
<Directory {{ docroot }}/Tellurion/>
+apache-tellurion
<Directory {{ docroot }}/Tellurion/>
     ExpiresActive On
     ExpiresByType image/png "modification plus 15 minutes"
 </Directory>
@@ -615,13 +652,12 @@ will be accepted.
 

 
 

-=roles_t/abbey-front/tasks/main.yml

-<<tellurion-tasks>>
+=roles_t/abbey-front/tasks/main.yml
<<tellurion-tasks>>
 

 

 
 

-tellurion-tasks
- name: Enable Apache2 expires module.
+tellurion-tasks
- name: Enable Apache2 expires module.
   become: yes
   apache2_module: name=expires
   notify: Restart Apache2.
@@ -629,9 +665,9 @@ will be accepted.
-
-

3.8. Configure Apache on Front

-
+
+

3.9. Configure Apache on Front

+

The abbey needs to add some Apache2 configuration directives to the virtual host listening for HTTPS requests to birchwood-abbey.net. @@ -641,16 +677,16 @@ The abbey simply creates a birchwood-abbey.net-vhost.conf file in

-The following task adds the apache-gitweb, apache-abbey, -apache-photos, and apache-tellurion directives described above to -the -vhost.conf file, and includes options-ssl-apache.conf from -/etc/letsencrypt/. The rest of the Let's Encrypt configuration is -discussed in the following Install Let's Encrypt section. +The following task adds the apache-gitweb, apache-abbey, +apache-photos, apache-pucked and apache-tellurion directives +described above to the -vhost.conf file, and includes +options-ssl-apache.conf from /etc/letsencrypt/. The rest of the +Let's Encrypt configuration is discussed in the following Install +Let's Encrypt section.

-roles_t/abbey-front/tasks/main.yml

-- name: Configure Apache.
+roles_t/abbey-front/tasks/main.yml
- name: Configure Apache.
   become: yes
   vars:
     docroot: /home/www
@@ -662,6 +698,8 @@ discussed in the following Install Let's Encrypt secti
 
         <<apache-photos>>
 
+        <<apache-pucked>>
+
         <<apache-tellurion>>
 
         IncludeOptional /etc/letsencrypt/options-ssl-apache.conf
@@ -671,9 +709,9 @@ discussed in the following Install Let's Encrypt secti
-
-

3.9. Configure Apache Log Archival

-
+
+

3.10. Configure Apache Log Archival

+

These tasks hack Apache's logrotate(8) configuration to rotate weekly, keep a couple weeks, and email each week's log to root. @@ -689,8 +727,7 @@ The replacement logrotate-mailer does, and includes it in a

-roles_t/abbey-front/tasks/main.yml

-- name: Configure Apache log archival.
+roles_t/abbey-front/tasks/main.yml
- name: Configure Apache log archival.
   become: yes
   lineinfile:
     path: /etc/logrotate.d/apache2
@@ -768,8 +805,8 @@ encrypting and sending to sendmail.
 

 
 

-roles_t/abbey-front/files/logrotate-mailer
#!/bin/bash -e
-
+roles_t/abbey-front/files/logrotate-mailer
#!/bin/bash -e
+
 if [ "$#" != 3 -o "$1" != "-s" ]; then
     echo "usage: $0 -s subject recipient" 1>&2
     exit 1
@@ -808,9 +845,9 @@ encrypting and sending to sendmail.
-
-

3.10. Install Let's Encrypt

-
+
+

3.11. Install Let's Encrypt

+

The abbey uses a Let's Encrypt certificate to authenticate its public web site and email services. Initial installation of a Let's Encrypt @@ -818,7 +855,7 @@ certificate is a terminal session affair (with prompts and lines entered as shown below).

-
+
 $ sudo apt install python3-certbot-apache
 $ sudo certbot --apache -d birchwood-abbey.net
 ...
@@ -879,8 +916,7 @@ package is installed and its live/ subdirectory is world readable.
 

 
 

-roles_t/abbey-front/tasks/main.yml

-- name: Install Certbot for Apache.
+roles_t/abbey-front/tasks/main.yml
- name: Install Certbot for Apache.
   become: yes
   apt: pkg=python3-certbot-apache
 
@@ -925,8 +961,7 @@ be restarted manually.
 

 
 

-roles_t/abbey-front/tasks/main.yml

-- name: "Use Let's Encrypt certificate&key."
+roles_t/abbey-front/tasks/main.yml
- name: "Use Let's Encrypt certificate&key."
   become: yes
   file:
     state: link
@@ -943,12 +978,11 @@ be restarted manually.
-
-

3.11. Restart Servers Caching Let's Encrypt

-
+
+

3.12. Restart Servers Caching Let's Encrypt

+
-roles_t/abbey-front/tasks/main.yml

-- name: Install Certbot hook.
+roles_t/abbey-front/tasks/main.yml
- name: Install Certbot hook.
   become: yes
   copy:
     src: certbot_hook
@@ -967,22 +1001,21 @@ server certificate.
 

 
 

-roles_t/abbey-front/files/certbot_hook
#!/bin/bash
-systemctl reload dovecot
+roles_t/abbey-front/files/certbot_hook
#!/bin/bash
+systemctl reload dovecot
-
-

3.12. Rotate Let's Encrypt Log

-
+
+

3.13. Rotate Let's Encrypt Log

+

The following task arranges to rotate Certbot's logs files.

-roles_t/abbey-front/tasks/main.yml

-- name: Install Certbot logrotate configuration.
+roles_t/abbey-front/tasks/main.yml
- name: Install Certbot logrotate configuration.
   become: yes
   copy:
     src: certbot_logrotate
@@ -1002,9 +1035,9 @@ The following task arranges to rotate Certbot's logs files.
-
-

3.13. Archive Let's Encrypt Data

-
+
+

3.14. Archive Let's Encrypt Data

+

A backup copy of Let's Encrypt's data (/etc/letsencrypt/) is sent to root@core in OpenPGP encrypted email every time it changes. Changes @@ -1012,8 +1045,7 @@ are detected by keeping a copy in /etc/letsencrypt~/ for comparison.

-roles_t/abbey-front/tasks/main.yml

-- name: "Install Let's Encrypt archive script."
+roles_t/abbey-front/tasks/main.yml
- name: "Install Let's Encrypt archive script."
   become: yes
   copy:
     src: cron.daily_letsencrypt
@@ -1023,8 +1055,8 @@ are detected by keeping a copy in /etc/letsencrypt~/ for comparison.
-roles_t/abbey-front/files/cron.daily_letsencrypt
#!/bin/bash -e
-
+roles_t/abbey-front/files/cron.daily_letsencrypt
#!/bin/bash -e
+
 cd /etc/
 
 [ -d letsencrypt~ ] \
@@ -1061,29 +1093,27 @@ imported into root@front's GnuPG key file.
 

 
 

-roles_t/abbey-front/tasks/main.yml

-- name: Copy root@core's public key.
-  become: yes
-  copy:
-    src: ../Secret/root-pub.pem
-    dest: /root/.gnupg-root-pub.pem
-    mode: u=r,g=r,o=r
-  notify: Import root@core's public key.
+roles_t/abbey-front/tasks/main.yml
- name: Copy root@core's public key.
+  become: yes
+  copy:
+    src: ../Secret/root-pub.pem
+    dest: /root/.gnupg-root-pub.pem
+    mode: u=r,g=r,o=r
+  notify: Import root@core's public key.
 

 

 
 

-roles_t/abbey-front/handlers/main.yml

-- name: Import root@core's public key.
-  become: yes
-  command: gpg --import ~/.gnupg-root-pub.pem
+roles_t/abbey-front/handlers/main.yml
- name: Import root@core's public key.
+  become: yes
+  command: gpg --import ~/.gnupg-root-pub.pem
-
-

4. The Abbey Core Role

+
+

4. The Abbey Core Role

Birchwood Abbey's core is a mini-PC (System76 Meerkat) configured as A @@ -1093,8 +1123,8 @@ with Postfix and Dovecot, and providing essential localnet services: NTP, DNS and DHCP.

-
-

4.1. Include Abbey Variables

+
+

4.1. Include Abbey Variables

In this abbey specific document, most abbey particulars are not @@ -1113,8 +1143,8 @@ directory, playbooks/.

-
-

4.2. Install Additional Packages

+
+

4.2. Install Additional Packages

The scripts that maintain the abbey's web site use a number of @@ -1124,8 +1154,7 @@ The house task list uses JQuery.

-roles_t/abbey-core/tasks/main.yml

-- name: Install additional packages.
+roles_t/abbey-core/tasks/main.yml
- name: Install additional packages.
   become: yes
   apt:
     pkg: [ procmail, libhtml-tree-perl, libjs-jquery,
@@ -1134,8 +1163,8 @@ The house task list uses JQuery.
-
-

4.3. Configure Private Email Aliases

+
+

4.3. Configure Private Email Aliases

The abbey uses several additional email aliases. These are the campus @@ -1151,8 +1180,7 @@ e.g. mythtv@mythtv.birchwood.private, locally.)

-roles_t/abbey-core/tasks/main.yml

-- name: Install abbey email aliases.
+roles_t/abbey-core/tasks/main.yml
- name: Install abbey email aliases.
   become: yes
   blockinfile:
     block: |
@@ -1176,81 +1204,76 @@ e.g. mythtv@mythtv.birchwood.private, locally.)
-
-

4.4. Configure Git Daemon on Core

+
+

4.4. Configure Git Daemon on Core

These tasks are identical to those executed on Front, for similar Git services on Front and Core. This allows changes to be tested on Core -before they are pushed to Front. See 3.3 +before they are pushed to Front. See 3.3 for more information.

-roles_t/abbey-core/tasks/main.yml

-<<gitd-tasks>>
+roles_t/abbey-core/tasks/main.yml
<<gitd-tasks>>
-roles_t/abbey-core/handlers/main.yml

-<<gitd-handlers>>
+roles_t/abbey-core/handlers/main.yml
<<gitd-handlers>>
-
-

4.5. Configure Gitweb on Core

+
+

4.5. Configure Gitweb on Core

These tasks are identical to those executed on Front, for similar Gitweb services on Front and Core. This allows changes to be tested -on Core before they are pushed to Front. See Configure Gitweb on +on Core before they are pushed to Front. See Configure Gitweb on Front for more information.

-roles_t/abbey-core/tasks/main.yml

-<<gitweb-tasks>>
+roles_t/abbey-core/tasks/main.yml
<<gitweb-tasks>>
-roles_t/abbey-core/handlers/main.yml

-<<gitweb-handlers>>
+roles_t/abbey-core/handlers/main.yml
<<gitweb-handlers>>
-
-

4.6. Configure Tellurion Expiration on Core

+
+

4.6. Configure Tellurion Expiration on Core

-The apache-tellurion directives are defined here and included in the -Apache configuration below. The tellurion-tasks are defined here +The apache-tellurion directives are defined here and included in the +Apache configuration below. The tellurion-tasks are defined here and included by the following code block.

-=roles_t/abbey-core/tasks/main.yml

-<<tellurion-tasks>>
+=roles_t/abbey-core/tasks/main.yml
<<tellurion-tasks>>
-
-

4.7. Configure Apache on Core

+
+

4.7. Configure Apache on Core

The Apache2 configuration on Core specifies three web sites (live, test, and campus). The live and test sites must operate just like the -site on Front. Their configurations include the same apache-gitweb, -apache-abbey, apache-photos, and apache-tellurion used on Front. +site on Front. Their configurations include the same apache-gitweb, +apache-abbey, apache-photos, apache-pucked and +apache-tellurion directives used on Front.

-roles_t/abbey-core/tasks/main.yml

-- name: Configure live website.
+roles_t/abbey-core/tasks/main.yml
- name: Configure live website.
   become: yes
   vars:
     docroot: /WWW/live
@@ -1262,6 +1285,8 @@ site on Front.  Their configurations include the same mode: u=rw,g=r,o=r
@@ -1279,6 +1304,8 @@ site on Front.  Their configurations include the same mode: u=rw,g=r,o=r
@@ -1287,20 +1314,19 @@ site on Front.  Their configurations include the same
-
-

4.8. Configure Documentation URLs

+
+

4.8. Configure Documentation URLs

The institute serves its /usr/share/doc/ on the house (campus) web site. This is a debugging convenience, making some HTML documentation more accessible, especially the documentation of software installed on Core and not on typical desktop clients. Also included: the Apache2 -directives that enable user Git publishing with Gitweb (defined here). +directives that enable user Git publishing with Gitweb (defined here).

-roles_t/abbey-core/tasks/main.yml

-- name: Configure house website.
+roles_t/abbey-core/tasks/main.yml
- name: Configure house website.
   become: yes
   copy:
     content: |
@@ -1317,8 +1343,8 @@ directives that enable user Git publishing with Gitweb (defined 
-
4.9. Install Apt Cacher

+
-

-
4.10. Use Cloister Apt Cache

+

+
4.10. Use Cloister Apt Cache

 

 

 Core itself will benefit from using the package cache, but should
@@ -1344,8 +1369,7 @@ so caching their packages is not a priority.)
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Use the local Apt package cache.
+roles_t/abbey-core/tasks/main.yml
- name: Use the local Apt package cache.
   become: yes
   copy:
     content: |
@@ -1357,8 +1381,8 @@ so caching their packages is not a priority.)
 

 

 

-

-
4.11. Configure NAGIOS

+

+
4.11. Configure NAGIOS

 

 

 A small institute uses nagios4 to monitor the health of its network,
@@ -1372,8 +1396,8 @@ another customized check_sensors plugin (abbey_pisensors
 

-

-
4.11.1. Monitoring The Home Disk

+

+
4.11.1. Monitoring The Home Disk

 

 

 The abbey adds monitoring of the space remaining on the volume at
@@ -1383,8 +1407,7 @@ RAID-5 array under /home/.
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Configure NAGIOS monitoring for Core /home/.
+roles_t/abbey-core/tasks/main.yml
- name: Configure NAGIOS monitoring for Core /home/.
   become: yes
   copy:
     content: |
@@ -1417,8 +1440,7 @@ RAID-5 array under /home/.
 

 
 

-roles_t/abbey-core/handlers/main.yml

-- name: Reload NAGIOS4.
+roles_t/abbey-core/handlers/main.yml
- name: Reload NAGIOS4.
   become: yes
   systemd:
     service: nagios4
@@ -1428,8 +1450,8 @@ RAID-5 array under /home/.
 

 

 

-

-
4.11.2. Custom NAGIOS Monitor abbey_pisensors

+

+
4.11.2. Custom NAGIOS Monitor abbey_pisensors

 

 

 The check_sensors plugin is included in the package
@@ -1442,8 +1464,8 @@ recognizable temperature in the sensors output.
 

 
 

-roles_t/abbey-core/files/abbey_pisensors
#!/bin/sh
-
+roles_t/abbey-core/files/abbey_pisensors
#!/bin/sh
+
 PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
 export PATH
 PROGNAME=`basename $0`
@@ -1468,10 +1490,10 @@ recognizable temperature in the sensors output.
 }
 
 brief_data() {
-    echo "$1" | sed -n -E -e '
-  /^temp[0-9]+: +[-+][0-9.]+.?C/ {
-    s/^temp[0-9]+: +([-+][0-9.]+).?C.*/ \1/; H }
-  $ { x; s/\n//g; p }'
+    echo "$1" | sed -n -E -e '
+  /^temp[0-9]+: +[-+][0-9.]+.?C/ {
+    s/^temp[0-9]+: +([-+][0-9.]+).?C.*/ \1/; H }
+  $ { x; s/\n//g; p }'
 }
 
 case "$1" in
@@ -1524,8 +1546,8 @@ recognizable temperature in the sensors output.
 

 

 

-

-
4.11.3. Stolen NAGIOS Monitor check_mdstat

+

+
4.11.3. Stolen NAGIOS Monitor check_mdstat

 

 

 This check_mdstat plugin was copied from the NAGIOS Exchange (here).
@@ -1533,12 +1555,12 @@ It detects a failing disk in a multi-disk array.
 

 
 

-roles_t/abbey-core/files/check_mdstat
#!/usr/bin/env bash
-
-# nagios script checks for failed raid device
-# linux software raid /proc/mdstat
-# karl@webmedianow.com 2013-10-01
-
+roles_t/abbey-core/files/check_mdstat
#!/usr/bin/env bash
+
+# nagios script checks for failed raid device
+# linux software raid /proc/mdstat
+# karl@webmedianow.com 2013-10-01
+
 STATE_OK=0
 STATE_WARNING=1
 STATE_CRITICAL=2
@@ -1549,22 +1571,22 @@ It detects a failing disk in a multi-disk array.
 export PATH
 
 usage() {
-cat <<-EOE
-Usage: $0 mdadm_device total_drives
+cat <<-EOE
+Usage: $0 mdadm_device total_drives
 
-  mdadm_device is md0, md1, etc...
-  total_drives is 2 for mirror, or 3, 4 etc...
+  mdadm_device is md0, md1, etc...
+  total_drives is 2 for mirror, or 3, 4 etc...
 
-Nagios script to check if failed drive in /proc/mdstat
+Nagios script to check if failed drive in /proc/mdstat
 
-Example: raid 2 (2 disk mirror)
-  /opt/nagios/libexec/check_mdstat.sh md0 2
+Example: raid 2 (2 disk mirror)
+  /opt/nagios/libexec/check_mdstat.sh md0 2
 
-Example: raid 5 with 8 disks
-  /opt/nagios/libexec/check_mdstat.sh md0 8
+Example: raid 5 with 8 disks
+  /opt/nagios/libexec/check_mdstat.sh md0 8
 
-EOE
-exit $STATE_UNKNOWN
+EOE
+exit $STATE_UNKNOWN
 }
 
 if [ $# -lt 2 ]; then
@@ -1583,12 +1605,12 @@ EOE
 uu="[${U}]"
 nn="[${drive_num}/${drive_num}]"
 
-#cat /proc/mdstat | grep -A 1 ^md1 | tail -1 | awk '{print ($(NF))}'
-# [UUUUUUUU] is OK raid
-# [_U] is Failed Drive
-
-# check if we have correct device...
-if cat /proc/mdstat | grep ^${cmd_device} | awk '{print $1}' | grep ^${cmd_device}$ >/dev/null 2>&1
+#cat /proc/mdstat | grep -A 1 ^md1 | tail -1 | awk '{print ($(NF))}'
+# [UUUUUUUU] is OK raid
+# [_U] is Failed Drive
+
+# check if we have correct device...
+if cat /proc/mdstat | grep ^${cmd_device} | awk '{print $1}' | grep ^${cmd_device}$ >/dev/null 2>&1
 then
   device=$cmd_device
 else
@@ -1606,14 +1628,12 @@ EOE
   echo "FAIL:  $device $n_status $u_status"
   exit $STATE_CRITICAL
 fi
-
-
 

 

 

 

-

-
4.11.4. Configure NAGIOS Monitoring of The Cloister

+

+
4.11.4. Configure NAGIOS Monitoring of The Cloister

 

 

 The abbey adds monitoring for more servers: Dantooine, Kessel and Ord
@@ -1628,8 +1648,8 @@ The configurations for these servers are very similar to Gate's, but
 are idiosyncratically in flux.
 

 

-

-
4.11.4.1. Cloister Network Addresses

+

+
4.11.4.1. Cloister Network Addresses

 

 

 The IP addresses of all three hosts are nice to use in the NAGIOS
@@ -1646,16 +1666,15 @@ ord_mantell_addr:           10.84.138.12
 

 

 

-

-
4.11.4.2. Install NAGIOS Configurations

+

+
4.11.4.2. Install NAGIOS Configurations

 

 

 The following task installs each host's NAGIOS configuration.
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Configure cloister NAGIOS monitoring.
+roles_t/abbey-core/tasks/main.yml
- name: Configure cloister NAGIOS monitoring.
   become: yes
   template:
     src: nagios-{{ item }}.cfg
@@ -1666,8 +1685,8 @@ The following task installs each host's NAGIOS configuration.
 

 

 

-

-
4.11.4.3. NAGIOS Monitoring of Dantooine

+

+
4.11.4.3. NAGIOS Monitoring of Dantooine

 

 

 roles_t/abbey-core/templates/nagios-dantooine.cfg
define host {
@@ -1690,13 +1709,13 @@ The following task installs each host's NAGIOS configuration.
     check_command           check_nrpe!abbey_dvr
 }
 
-# define service {
-#     use                     generic-service
-#     host_name               dantooine
-#     service_description     Current Load
-#     check_command           check_nrpe!check_load
-# }
-
+# define service {
+#     use                     generic-service
+#     host_name               dantooine
+#     service_description     Current Load
+#     check_command           check_nrpe!check_load
+# }
+
 define service {
     use                     generic-service
     host_name               dantooine
@@ -1704,13 +1723,13 @@ The following task installs each host's NAGIOS configuration.
     check_command           check_nrpe!check_zombie_procs
 }
 
-# define service {
-#     use                     generic-service
-#     host_name               dantooine
-#     service_description     Total Processes
-#     check_command           check_nrpe!check_total_procs
-# }
-
+# define service {
+#     use                     generic-service
+#     host_name               dantooine
+#     service_description     Total Processes
+#     check_command           check_nrpe!check_total_procs
+# }
+
 define service {
     use                     generic-service
     host_name               dantooine
@@ -1728,8 +1747,8 @@ The following task installs each host's NAGIOS configuration.
 

 

 

-

-
4.11.4.4. NAGIOS Monitoring of Kessel

+

+
4.11.4.4. NAGIOS Monitoring of Kessel

 

 

 roles_t/abbey-core/templates/nagios-kessel.cfg
define host {
@@ -1745,13 +1764,13 @@ The following task installs each host's NAGIOS configuration.
     check_command           check_nrpe!inst_root
 }
 
-# define service {
-#     use                     generic-service
-#     host_name               kessel
-#     service_description     Current Load
-#     check_command           check_nrpe!check_load
-# }
-
+# define service {
+#     use                     generic-service
+#     host_name               kessel
+#     service_description     Current Load
+#     check_command           check_nrpe!check_load
+# }
+
 define service {
     use                     generic-service
     host_name               kessel
@@ -1759,13 +1778,13 @@ The following task installs each host's NAGIOS configuration.
     check_command           check_nrpe!check_zombie_procs
 }
 
-# define service {
-#     use                     generic-service
-#     host_name               kessel
-#     service_description     Total Processes
-#     check_command           check_nrpe!check_total_procs
-# }
-
+# define service {
+#     use                     generic-service
+#     host_name               kessel
+#     service_description     Total Processes
+#     check_command           check_nrpe!check_total_procs
+# }
+
 define service {
     use                     generic-service
     host_name               kessel
@@ -1783,8 +1802,8 @@ The following task installs each host's NAGIOS configuration.
 

 

 

-

-
4.11.4.5. NAGIOS Monitoring of Ord-Mantell

+

+
4.11.4.5. NAGIOS Monitoring of Ord-Mantell

 

 

 roles_t/abbey-core/templates/nagios-ord-mantell.cfg
define host {
@@ -1800,13 +1819,13 @@ The following task installs each host's NAGIOS configuration.
     check_command           check_nrpe!inst_root
 }
 
-# define service {
-#     use                     generic-service
-#     host_name               ord-mantell
-#     service_description     Current Load
-#     check_command           check_nrpe!check_load
-# }
-
+# define service {
+#     use                     generic-service
+#     host_name               ord-mantell
+#     service_description     Current Load
+#     check_command           check_nrpe!check_load
+# }
+
 define service {
     use                     generic-service
     host_name               ord-mantell
@@ -1814,13 +1833,13 @@ The following task installs each host's NAGIOS configuration.
     check_command           check_nrpe!check_zombie_procs
 }
 
-# define service {
-#     use                     generic-service
-#     host_name               ord-mantell
-#     service_description     Total Processes
-#     check_command           check_nrpe!check_total_procs
-# }
-
+# define service {
+#     use                     generic-service
+#     host_name               ord-mantell
+#     service_description     Total Processes
+#     check_command           check_nrpe!check_total_procs
+# }
+
 define service {
     use                     generic-service
     host_name               ord-mantell
@@ -1840,8 +1859,8 @@ The following task installs each host's NAGIOS configuration.
 

 

 

-

-
4.12. Install Munin

+

+
4.12. Install Munin

 

 

 The abbey is experimenting with Munin.  NAGIOS is all about notifying
@@ -1850,8 +1869,7 @@ trends in resource usage.
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Install Munin.
+roles_t/abbey-core/tasks/main.yml
- name: Install Munin.
   become: yes
   apt: pkg=munin
 
@@ -1922,8 +1940,7 @@ next task configures libsensors to ignore them.
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Configure core sensors(1).
+roles_t/abbey-core/tasks/main.yml
- name: Configure core sensors(1).
   become: yes
   copy:
     content: |
@@ -1937,8 +1954,7 @@ next task configures libsensors to ignore them.
 

 
 

-roles_t/abbey-core/handlers/main.yml

-- name: Restart Munin.
+roles_t/abbey-core/handlers/main.yml
- name: Restart Munin.
   become: yes
   systemd:
     service: munin
@@ -1948,8 +1964,8 @@ next task configures libsensors to ignore them.
 

 

 

-

-
4.13. Install Analog

+

+
4.13. Install Analog

 

 

 The abbey's public web site's access and error logs are emailed
@@ -1969,8 +1985,7 @@ at http://www/doc/analog/.
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Install Analog.
+roles_t/abbey-core/tasks/main.yml
- name: Install Analog.
   become: yes
   apt: pkg=analog
 
@@ -2025,8 +2040,8 @@ at http://www/doc/analog/.
 

 

 

-

-
4.14. Add Monkey to Web Server Group

+

+
4.14. Add Monkey to Web Server Group

 

 

 Monkey needs to be in www-data so that it can run
@@ -2037,8 +2052,7 @@ user cloud accounts, found in files owned by www-data, files like
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Add Monkey to Nextcloud group.
+roles_t/abbey-core/tasks/main.yml
- name: Add Monkey to Nextcloud group.
   become: yes
   user:
     name: monkey
@@ -2048,8 +2062,8 @@ user cloud accounts, found in files owned by www-data, files like
 

 

 

-

-
4.15. Install netpbm For Photo Processing

+

+
4.15. Install netpbm For Photo Processing

 

 

 Monkey's photo processing scripts use netpbm commands like
@@ -2057,8 +2071,7 @@ Monkey's photo processing scripts use netpbm commands like
 

 
 

-roles_t/abbey-core/tasks/main.yml

-- name: Install netpbm.
+roles_t/abbey-core/tasks/main.yml
- name: Install netpbm.
   become: yes
   apt: pkg=netpbm
 

@@ -2066,8 +2079,8 @@ Monkey's photo processing scripts use netpbm commands like
 

 

 

-

-
5. The Abbey Gate Role

+

+
5. The Abbey Gate Role

 

 

 Birchwood Abbey's gate is a $110 µPC configured as A Small Institute
@@ -2079,8 +2092,8 @@ allows access to the Abbey's IoT appliances: a HomeAssistant and an
 Ecowitt hub.
 

 

-

-
5.1. The Abbey Gate's Network Interfaces

+

+
5.1. The Abbey Gate's Network Interfaces

 

 

 The abbey gate's lan interface is the PC's built-in Ethernet
@@ -2101,27 +2114,27 @@ The MAC address of each interface is set in private/vars.yml (see
 

 

 

-

-
5.2. The Abbey's IoT Network

+

+
5.2. The Abbey's IoT Network

 

 

 To allow masquerading between the private subnets and wild, the
 following iptables(8) rules are added.  They are very similar to the
 nat and filter table rules used by a small institute to masquerade
-its lan to its isp (see the UFW Rules of a Small Institute).
+its lan to its isp (see the UFW Rules of a Small Institute).
 The campus WireGuard™ subnet is not included because the campus Wi-Fi
 hosts should be routing to the wild subnet directly and are assumed to
 be masquerading as their access point(s).
 

 
 

-iot-nat
-A POSTROUTING -s {{   private_net_cidr }} -o wild -j MASQUERADE
+iot-nat
-A POSTROUTING -s {{   private_net_cidr }} -o wild -j MASQUERADE
 -A POSTROUTING -s {{ public_wg_net_cidr }} -o wild -j MASQUERADE
 

 

 
 

-iot-forward
-A ufw-before-forward -i lan -o wild -j ACCEPT
+iot-forward
-A ufw-before-forward -i lan -o wild -j ACCEPT
 -A ufw-before-forward -i wg0 -o wild -j ACCEPT
 

 

@@ -2132,12 +2145,12 @@ The second rule includes the campus VPN.
 

 

 

-

-
5.3. Configure UFW for IoT

+

+
5.3. Configure UFW for IoT

 

 

 The following task installs the additional rules in before.rules (as
-in Configure UFW).
+in Configure UFW).
 

 
 

@@ -2160,8 +2173,8 @@ in Configure UFW).
 

 

 

-

-
5.4. The Abbey's Starlink Configuration

+

+
5.4. The Abbey's Starlink Configuration

 

 

 The abbey connects to Starlink via Ethernet, and disables Starlink's
@@ -2209,8 +2222,8 @@ at least our local network traffic out of view of our ISPs.
 

 

 

-

-
5.5. Alternate ISPs

+

+
5.5. Alternate ISPs

 

 

 The abbey used to use a cell phone on a USB tether to get Internet
@@ -2255,8 +2268,8 @@ service, using a 60-isp.yaml file similar to the lines below.
 

 

 

-

-
6. The Abbey Cloister Role

+

+
6. The Abbey Cloister Role

 

 

 Birchwood Abbey's cloister is a small institute campus.  The campus
@@ -2271,7 +2284,7 @@ tasks, namely configuration required on Raspberry Pi OS machines.
 

 Wireless clients are issued keys for the cloister VPN by the ./abbey
 client command which is currently identical to the ./inst client
-command (described in The Client Command).  The wireless, cloistered
+command (described in The Client Command).  The wireless, cloistered
 hosts never roam, are not associated with a member, and so are
 "campus" clients, issued keys with commands like this:
 

@@ -2281,8 +2294,8 @@ hosts never roam, are not associated with a member, and so are
                S+6HaTnOwwhWgUGXjSBcPAvifKw+j8BDTRfq534gNW4=
-
-

6.1. Use Cloister Apt Cache

+
+

6.1. Use Cloister Apt Cache

The Apt-Cacher:TNG program does not work well on the frontier, so is @@ -2314,21 +2327,20 @@ local host.

-
-

6.2. Configure Cloister NRPE

+
+

6.2. Configure Cloister NRPE

Each cloistered host is a small institute campus host and thus is already running an NRPE server (a NAGIOS Remote Plugin Executor -server) with a custom inst_sensors monitor (described in Configure +server) with a custom inst_sensors monitor (described in Configure NRPE of A Small Institute). The abbey adds one complication: yet another check_sensors variant, abbey_pisensors, installed on Raspberry Pis (architecture aarch64) only.

-roles_t/abbey-cloister/tasks/main.yml

-- name: Install abbey_pisensors NAGIOS plugin.
+roles_t/abbey-cloister/tasks/main.yml
- name: Install abbey_pisensors NAGIOS plugin.
   become: yes
   copy:
     src: ../abbey-core/files/abbey_pisensors
@@ -2359,16 +2371,15 @@ Raspberry Pis (architecture aarch64) only.
-
-

6.3. Install Munin Node

+
+

6.3. Install Munin Node

Each cloistered host is a Munin node.

-roles_t/abbey-cloister/tasks/main.yml

-- name: Install Munin Node.
+roles_t/abbey-cloister/tasks/main.yml
- name: Install Munin Node.
   become: yes
   apt: pkg=munin-node
 
@@ -2403,8 +2414,7 @@ Each cloistered host is a Munin node.
-roles_t/abbey-cloister/handlers/main.yml

-- name: Restart Munin Node.
+roles_t/abbey-cloister/handlers/main.yml
- name: Restart Munin Node.
   become: yes
   systemd:
     service: munin-node
@@ -2420,8 +2430,7 @@ them.
 

 
 

-roles_t/abbey-cloister/tasks/main.yml

-- name: Configure {{ inventory_hostname }} sensors(1).
+roles_t/abbey-cloister/tasks/main.yml
- name: Configure {{ inventory_hostname }} sensors(1).
   copy:
     content: |
       chip "iwlwifi_1-virtual-0"
@@ -2435,16 +2444,15 @@ them.
-
-

6.4. Install Emacs

+
+

6.4. Install Emacs

The monks of the abbey are masters of the staff and Emacs.

-roles_t/abbey-cloister/tasks/main.yml

-- name: Install monastic software.
+roles_t/abbey-cloister/tasks/main.yml
- name: Install monastic software.
   become: yes
   apt: pkg=emacs
 

@@ -2452,8 +2460,8 @@ The monks of the abbey are masters of the staff and Emacs.
-
-

7. The Abbey Weather Role

+
+

7. The Abbey Weather Role

Birchwood Abbey now uses Home Assistant to record and display weather @@ -2480,8 +2488,8 @@ entities. These were labeled and organized on an "Abbey" dashboard.

-
-

8. The Abbey DVR Role

+
+

8. The Abbey DVR Role

The abbey uses AgentDVR to record video from PoE IP HD security @@ -2489,8 +2497,8 @@ cameras. It runs as user agentdvr and keeps all of its configuration and recordings in /home/agentdvr/.

-
-

8.1. Install AgentDVR

+
+

8.1. Install AgentDVR

AgentDVR is installed according to the iSpy web site's latest @@ -2502,9 +2510,9 @@ second of which is broken across three lines). 

sudo apt-get install curl
-bash <(curl -s "https://raw.githubusercontent.com/\
-ispysoftware/agent-install-scripts/main/v2/\
-install.sh")
+bash <(curl -s "https://raw.githubusercontent.com/\
+ispysoftware/agent-install-scripts/main/v2/\
+install.sh")
@@ -2514,8 +2522,8 @@ executes several sudo commands. These commands can be run by the agentdvr account if it has (temporary) authorization.

-
-

8.1.1. Prepare for AgentDVR Installation

+
+

8.1.1. Prepare for AgentDVR Installation

The following commands are manually executed to create the agentdvr @@ -2533,8 +2541,8 @@ cutting off access to all elevated privileges until a "rescue" 

sudo adduser --disabled-password agentdvr
-echo "ALL ALL=(agentdvr) NOPASSWD: /bin/systemctl,/bin/apt-get,\
-     /sbin/adduser,/sbin/usermod" >~/01agentdvr
+echo "ALL ALL=(agentdvr) NOPASSWD: /bin/systemctl,/bin/apt-get,\
+     /sbin/adduser,/sbin/usermod" >~/01agentdvr
 sudo chown root:root ~/01agentdvr
 sudo chmod 440 ~/01agentdvr
 visudo --check --owner --perms ~/01agentdvr
@@ -2543,8 +2551,8 @@ sudo mv ~/01agentdvr /etc/sudoers.d/
-
-

8.1.2. Execute AgentDVR Installation

+
+

8.1.2. Execute AgentDVR Installation

With the above preparations, the system administrator can get a shell @@ -2565,8 +2573,8 @@ Ansible is run again.

-
-

8.1.3. Complete AgentDVR Installation

+
+

8.1.3. Complete AgentDVR Installation

When Ansible is run a second time, after the installation script, it @@ -2589,8 +2597,8 @@ sudo rm /etc/sudoers.d/01agentdvr

-
-

8.2. Configure User agentdvr

+
+

8.2. Configure User agentdvr

AgentDVR runs as the system user agentdvr, which is configured here. @@ -2629,8 +2637,8 @@ restoration of AgentDVR.)

-
-

8.3. Test For AgentDVR/

+
+

8.3. Test For AgentDVR/

The following task probes for the /home/agentdvr/AgentDVR/ @@ -2641,8 +2649,7 @@ remaining installation steps are skipped unless

-roles_t/abbey-dvr/tasks/main.yml

-- name: Test for AgentDVR directory.
+roles_t/abbey-dvr/tasks/main.yml
- name: Test for AgentDVR directory.
   stat:
     path: /home/agentdvr/AgentDVR
   register: agentdvr
@@ -2653,8 +2660,8 @@ remaining installation steps are skipped unless
-
-

8.4. Create AgentDVR Service

+
+

8.4. Create AgentDVR Service

This service definition came from the template downloaded (from here) @@ -2663,8 +2670,7 @@ by install.sh.

-roles_t/abbey-dvr/tasks/main.yml

-- name: Install AgentDVR.service.
+roles_t/abbey-dvr/tasks/main.yml
- name: Install AgentDVR.service.
   become: yes
   copy:
     content: |
@@ -2675,18 +2681,18 @@ by install.sh.
       WorkingDirectory=/home/agentdvr/AgentDVR
       ExecStart=/home/agentdvr/AgentDVR/Agent
 
-      # fix memory management issue with dotnet core
-      Environment="MALLOC_TRIM_THRESHOLD_=100000"
+      # fix memory management issue with dotnet core
+      Environment="MALLOC_TRIM_THRESHOLD_=100000"
 
-      # to query logs using journalctl, set a logical name here
-      SyslogIdentifier=AgentDVR
+      # to query logs using journalctl, set a logical name here
+      SyslogIdentifier=AgentDVR
 
       User=agentdvr
 
-      # ensure the service automatically restarts
-      Restart=always
-      # amount of time to wait before restarting the service
-      RestartSec=5
+      # ensure the service automatically restarts
+      Restart=always
+      # amount of time to wait before restarting the service
+      RestartSec=5
 
       [Install]
       WantedBy=multi-user.target
@@ -2705,8 +2711,7 @@ by install.sh.
-roles_t/abbey-front/handlers/main.yml

-- name: Restart AgentDVR.
+roles_t/abbey-front/handlers/main.yml
- name: Restart AgentDVR.
   become: yes
   systemd:
     service: AgentDVR
@@ -2717,8 +2722,8 @@ by install.sh.
-
-

8.5. Create AgentDVR Storage

+
+

8.5. Create AgentDVR Storage

The abbey uses a separate volume to store surveillance recordings, @@ -2730,8 +2735,7 @@ location do not fail.

-roles_t/abbey-dvr/tasks/main.yml

-- name: Create /DVR/AgentDVR/.
+roles_t/abbey-dvr/tasks/main.yml
- name: Create /DVR/AgentDVR/.
   become: yes
   file:
     state: directory
@@ -2752,8 +2756,8 @@ location do not fail.
-
-

8.6. Install Custom NAGIOS Monitor abbey_dvr

+
+

8.6. Install Custom NAGIOS Monitor abbey_dvr

DVR hosts install a custom NRPE plugin named abbey_dvr to monitor @@ -2761,8 +2765,7 @@ the storage available on /DVR/.

-roles_t/abbey-dvr/tasks/main.yml

-- name: Configure NAGIOS command abbey_dvr.
+roles_t/abbey-dvr/tasks/main.yml
- name: Configure NAGIOS command abbey_dvr.
   become: yes
   vars:
     lib: /usr/lib/nagios/plugins
@@ -2786,11 +2789,11 @@ the storage available on /DVR/.
-
-

8.7. Configure IP Cameras

+
+

8.7. Configure IP Cameras

-A new security camera is setup as described in Cloistering, after +A new security camera is setup as described in Cloistering, after which the camera should be accessible by name on the abbey networks. Assuming ping -c1 new works, the camera's web interface will be accessible at http://new/. @@ -2813,8 +2816,8 @@ protocol) is nice but optional.

-
-

8.8. Configure AgentDVR's Cameras

+
+

8.8. Configure AgentDVR's Cameras

After Ansible has configured and started the AgentDVR service, its web @@ -2853,8 +2856,8 @@ AgentDVR's Live View.

-
-

8.9. Configure AgentDVR's Default Storage

+
+

8.9. Configure AgentDVR's Default Storage

AgentDVR's web interface is also used to configure a default storage @@ -2866,8 +2869,8 @@ pressed before the task is complete.

-
-

8.10. Configure AgentDVR's Recordings

+
+

8.10. Configure AgentDVR's Recordings

After a default storage location has been configured, AgentDVR's @@ -2898,8 +2901,8 @@ parameters are set (in the Recording and Storage tabs).

-
-

8.11. Restore AgentDVR

+
+

8.11. Restore AgentDVR

When restoring /home/ from a backup copy, the user accounts are @@ -2915,8 +2918,8 @@ installs the system service configuration file and starts the service.

-
-

9. The Abbey TVR Role

+
+

9. The Abbey TVR Role

The abbey has a few TV tuners and a subscription to Schedules Direct @@ -2931,14 +2934,14 @@ configured to serve MythTV pages at e.g. http://new/mythweb/.

-A new TVR machine needs only Cloistering to prepare it for +A new TVR machine needs only Cloistering to prepare it for Ansible. As part of that process, it should be added to the tvrs group in the hosts file. An existing server can become a TVR machine by adding it to the tvrs group.

-
-

9.1. Include Abbey Variables

+
+

9.1. Include Abbey Variables

Private variables in private/vars-abbey.yml are needed, as in the @@ -2954,8 +2957,8 @@ directory, playbooks/.

-
-

9.2. Manually Build and Install MythTV

+
+

9.2. Manually Build and Install MythTV

Neither Debian nor the MythTV project provide binary packages of @@ -2984,8 +2987,8 @@ sudo apt install mythtv-backend

-
-

9.3. Restore MythTV

+
+

9.3. Restore MythTV

Restoring MythTV from a backup copy to a fresh TVR host: @@ -3013,8 +3016,8 @@ The .mythtv/config.xml file should provide the DB particulars

-
-

9.4. Manually Load DB Timezone Info

+
+

9.4. Manually Load DB Timezone Info

Starting with MythTV version 0.26, the time zone tables must be loaded @@ -3038,8 +3041,8 @@ e.g. 2022-09-13 20:15:41.

-
-

9.5. Create MythTV Storage Area

+
+

9.5. Create MythTV Storage Area

The backend does not have a default storage area for its recordings. @@ -3050,8 +3053,7 @@ creates that directory and ensures it has appropriate permissions.

-roles_t/abbey-tvr/tasks/main.yml

-- name: Create MythTV storage area.
+roles_t/abbey-tvr/tasks/main.yml
- name: Create MythTV storage area.
   become: yes
   file:
     state: directory
@@ -3063,8 +3065,8 @@ creates that directory and ensures it has appropriate permissions.
-
-

9.6. Configure MythTV Backend

+
+

9.6. Configure MythTV Backend

With MythTV built and installed, the post-installation tasks @@ -3080,12 +3082,12 @@ at http://new:6544 and make the following selections.

-
-

9.7. Configure Tuner

+
+

9.7. Configure Tuner

The abbey has a Silicon Dust Homerun HDTV Duo (with two tuners). It -is setup as described in Cloistering, after which the tuner is +is setup as described in Cloistering, after which the tuner is accessible by name (e.g. new) on the cloister network. Assuming ping -c1 new works, the tuner should be accessible via the hdhomerun_config_gui command, a graphical interface contributed to @@ -3096,8 +3098,8 @@ tuner's domain name or IP address can also be entered.

-
-

9.8. Add HDHomerun and Mr.Antenna

+
+

9.8. Add HDHomerun and Mr.Antenna

In MythTV Setup: @@ -3140,8 +3142,8 @@ any case, do not run mythfilldatabase.

-
-

9.9. Scan for New Channels

+
+

9.9. Scan for New Channels

In MythTV Backend, the website on Core's port 6544, e.g. @@ -3155,15 +3157,16 @@ In MythTV Backend, the website on Core's port 6544, e.g.

  • Press "Delete".
  • Choose "Input Connections" from the top tab bar.
  • Choose (unfold) "HDHomeRun => Mr.Antenna".
    • -
  • Press "+ Scan for Channels".
    • -
  • Choose options? Eventually press "Scan"? And wait.
    • -
  • Choose to import all.
    • +
  • Press (unfold) "+ Scan for Channels".
    • +
  • Choose Scan Type: Full Scan
    • +
  • Press "Start Scan" and wait.
    • +
  • Choose to "Insert All".
  • Choose "Restart Backend Full Operation".
    • -
    -

    9.10. Configure XMLTV

    +
    +

    9.10. Configure XMLTV

    The xmltv package, specifically its tv_grab_zz_sdjson program, is @@ -3198,7 +3201,7 @@ the list of "inputs" available in a postal code typically ends with the OTA (over the air) broadcasts.

    -
    +
     $ tv_grab_zz_sdjson --configure --config-file .mythtv/Mr.Antenna.xml
 Cache file for lineups, schedules and programs.
 Cache file: [/home/mythtv/.xmltv/tv_grab_zz_sdjson.cache]
@@ -3248,8 +3251,8 @@ backend is running, so it is not run until then.
    -
    -

    9.11. Debug XMLTV

    +
    +

    9.11. Debug XMLTV

    If the mythfilldatabase command fails or expected listings do not @@ -3288,14 +3291,14 @@ Running a similar command (without --quiet) might be more revealing

    -
    -

    9.12. Change Broadcast Area

    +
    +

    9.12. Change Broadcast Area

    The abbey changes location almost weekly, so its HDTV broadcast area changes frequently. At the start of a long stay the administrator uses the MythTV Setup program to scan for the new area's channels, as -described in Scan for New Channels. +described in Scan for New Channels.

    @@ -3313,7 +3316,7 @@ program as user mythtv.

    The program will prompt for the zip code and offer a list of "inputs" -available in that area, as described in Configure XMLTV. +available in that area, as described in Configure XMLTV.

    @@ -3327,14 +3330,14 @@ Lastly, the administrator runs an immediate update (again as the

    -If the command fails, consult Debug XMLTV. Else, the listings appear +If the command fails, consult Debug XMLTV. Else, the listings appear in MythTV Backend's "Program Guide" page.

    -
    -

    10. The Ansible Configuration

    +
    +

    10. The Ansible Configuration

    The abbey's Ansible configuration, like that of A Small Institute, is @@ -3361,7 +3364,7 @@ specific versions.

    -NOTE: if you have not read at least the Overview of A Small Institute +NOTE: if you have not read at least the Overview of A Small Institute you are lost.

    @@ -3391,8 +3394,8 @@ rest are built up piecemeal by (tangled from) this document, README.org, and Institute/README.org.

    -
    -

    10.1. ansible.cfg

    +
    +

    10.1. ansible.cfg

    This is much like the example (test) institutional configuration file, @@ -3409,17 +3412,17 @@ except the roles are found in Institute/roles/ as well as roles/.

    -
    -

    10.2. hosts

    +
    +

    10.2. hosts

    -hosts
    all:
+hosts
    all:
   vars:
     ansible_user: sysadm
     ansible_ssh_extra_args: -i Secret/ssh_admin/id_rsa
   hosts:
-    # The Main Servers: Front, Gate and Core.
-    droplet:
+    # The Main Servers: Front, Gate and Core.
+    droplet:
       ansible_host: 138.68.252.171
       ansible_become_password: "{{ become_droplet }}"
     anoat:
@@ -3428,8 +3431,8 @@ except the roles are found in Institute/roles/ as well as roles/.
     malastare:
       ansible_host: malastare.birchwood.private
       ansible_become_password: "{{ become_malastare }}"
-    # Campus
-    kessel:
+    # Campus
+    kessel:
       ansible_host: kessel.birchwood.private
       ansible_become_password: "{{ become_kessel }}"
     dantooine:
@@ -3438,8 +3441,8 @@ except the roles are found in Institute/roles/ as well as roles/.
     ord-mantell:
       ansible_host: ord-mantell.birchwood.private
       ansible_become_password: "{{ become_ord_mantell }}"
-    # Notebooks
-    felucia:
+    # Notebooks
+    felucia:
       ansible_host: felucia.birchwood.private
       ansible_become_password: "{{ become_felucia }}"
     sullust:
@@ -3493,8 +3496,8 @@ except the roles are found in Institute/roles/ as well as roles/.
    -
    -

    10.3. playbooks/site.yml

    +
    +

    10.3. playbooks/site.yml

    This playbook provisions the entire network by applying first the @@ -3535,17 +3538,17 @@ institutional roles, then the liturgical roles.

    -
    -

    11. The Abbey Commands

    +
    +

    11. The Abbey Commands

    The ./abbey script encodes the abbey's canonical procedures. It -includes The Institute Commands and adds a few abbey-specific +includes The Institute Commands and adds a few abbey-specific sub-commands.

    -
    -

    11.1. Abbey Command Overview

    +
    +

    11.1. Abbey Command Overview

    Institutional sub-commands: @@ -3574,18 +3577,18 @@ and _architecture for all hosts.

    -
    -

    11.2. Abbey Command Script

    +
    +

    11.2. Abbey Command Script

    The script begins with the following prefix and trampolines.

    -abbey
    #!/usr/bin/perl -w
-#
-# DO NOT EDIT.  This file was tangled from README.org.
-
+abbey
    #!/usr/bin/perl -w
+#
+# DO NOT EDIT.  This file was tangled from README.org.
+
 use strict;
 
 if (defined $ARGV[0]
@@ -3599,7 +3602,7 @@ The script begins with the following prefix and trampolines.
 The small institute's ./inst command expects to be running in
 Institute/, not ./, but it only references public/, private/,
 Secret/ and playbooks/check-inst-vars.yml, and will find the abbey
-specific versions of these.  The roles_path setting in ansible.cfg
+specific versions of these.  The roles_path setting in ansible.cfg
 effectively merges the institutional roles into the distinctly named
 abbey specific roles.  The roles likewise reference files with
 relative names, and will find the abbey specific private/
@@ -3622,8 +3625,8 @@ code block "duplicates" the action of the institute's
    -
    -

    11.3. The Upgrade Command

    +
    +

    11.3. The Upgrade Command

    The script implements an upgrade sub-command that runs apt update @@ -3642,8 +3645,7 @@ a limit pattern. For example:

    -abbey
    
-if (defined $ARGV[0] && $ARGV[0] eq "upgrade") {
+abbey
    if (defined $ARGV[0] && $ARGV[0] eq "upgrade") {
   shift;
   my @args = ( "-e", "\@Secret/become.yml" );
   if (defined $ARGV[0] && $ARGV[0] eq "-n") {
@@ -3688,8 +3690,8 @@ a limit pattern.  For example:
    -
    -

    11.4. The Reboots Command

    +
    +

    11.4. The Reboots Command

    The script implements a reboots sub-command that looks for @@ -3720,8 +3722,8 @@ The script implements a reboots sub-command that looks for

    -
    -

    11.5. The Versions Command

    +
    +

    11.5. The Versions Command

    The script implements a versions sub-command that reports the @@ -3748,8 +3750,8 @@ operating system version of all abbey managed machines.

    -
    -

    11.6. The Facts Command

    +
    +

    11.6. The Facts Command

    The script implements a facts sub-command to collect the Ansible @@ -3769,8 +3771,8 @@ The script implements a facts sub-command to collect the Ansible

    -
    -

    11.7. The TZ Command

    +
    +

    11.7. The TZ Command

    The abbey changes location almost weekly, so its timezone changes @@ -3805,7 +3807,7 @@ last host in the previous play.

    playbooks/timezone.yml
    ---
-- hosts: core, dvrs, tvrs, webtvs
+- hosts: core, dvrs, tvrs, webtvs, notebooks
   tasks:
   - name: Get timezone.
     command: date '+%Z'
@@ -3827,6 +3829,13 @@ last host in the previous play.
     when: ansible_date_time.tz != zone.stdout
     register: new_tz
 
+  - name: Restart CronD.
+    become: yes
+    systemd:
+      service: cron
+      status: restarted
+    when: new_tz.changed
+
 - hosts: dvrs
   tasks:
   - name: Restart AgentDVR.
@@ -3849,8 +3858,8 @@ last host in the previous play.
    -
    -

    11.8. Abbey Command Help

    +
    +

    11.8. Abbey Command Help

    abbey
    my $ops = ("config,new,old,pass,client,"
@@ -3861,8 +3870,8 @@ last host in the previous play.
    -
    -

    12. Cloistering

    +
    +

    12. Cloistering

    This is how a new machine is brought into the cloister. The process @@ -3871,8 +3880,8 @@ narrows down to the common preparation of all machines administered by Ansible.

    -
    -

    12.1. IoT Devices

    +
    +

    12.1. IoT Devices

    A wireless IoT device (smart TV, Blu-ray deck, etc.) cannot install @@ -3888,8 +3897,8 @@ given a private domain name as described in the following steps.

    @@ -3899,12 +3908,12 @@ last step:

    -
    -

    12.2. Raspberry Pis

    +
    +

    12.2. Raspberry Pis

    The abbey's Raspberry Pi runs the Raspberry Pi OS desktop off an NVMe @@ -3925,8 +3934,8 @@ Ethernet, and power up.

  • new username: sysadm
  • new password: <password>
    • -
  • Add to Core DHCP
    • -
  • Create Wired Domain Name
    • +
  • Add to Core DHCP
    • +
  • Create Wired Domain Name
  • Launch the desktop.
  • If the desktop is running on a USB HD (thumb drive) or μSD card, use the Raspberry Pi Imager app in Accessories in the main menu. Choose @@ -3936,9 +3945,9 @@ installation questions again.
  • Right click on the desktop (background) and choose Preferences. In the Control Centre choose Interfaces in the left side bar and toggle SSH on.
    • -
  • Update From Cloister Apt Cache
    • -
  • Authorize Remote Administration
    • -
  • Configure with Ansible
    • +
  • Update From Cloister Apt Cache
    • +
  • Authorize Remote Administration
    • +
  • Configure with Ansible

    • @@ -3947,14 +3956,14 @@ steps are taken.

    -
    -

    12.3. PCs

    +
    +

    12.3. PCs

    Most of the abbey's machines, like Core and Gate, are general-purpose @@ -3967,12 +3976,12 @@ follows. to a USB drive and connect it to the PC.

  • Connect an HDMI monitor, a USB keyboard/mouse, and the cloister Ethernet, and power up. Choose to boot from the USB drive.
    • -
  • Add to Core DHCP
    • -
  • Create Wired Domain Name
    • +
  • Add to Core DHCP
    • +
  • Create Wired Domain Name
  • Answer first-boot installation questions as detailed in the preparation of A Test Machine for a Small Institute.
  • Log in as sysadm on the console.
    • -
  • Update From Cloister Apt Cache
    • +
  • Update From Cloister Apt Cache

  • Install openssh-server, unless it was included in the distribution. Run the following if unsure. @@ -3980,8 +3989,8 @@ distribution. Run the following if unsure. 

     sudo apt install openssh-server
    • -
  • Authorize Remote Administration
    • -
  • Configure with Ansible
    • +
  • Authorize Remote Administration
    • +
  • Configure with Ansible

    • @@ -3990,14 +3999,14 @@ steps are taken.

    -
    -

    12.4. Add to Core DHCP

    +
    +

    12.4. Add to Core DHCP

    When a new machine is connected to the cloister Ethernet, its MAC @@ -4057,12 +4066,12 @@ reporting 1 packets transmitted, 1 received, 0% packet loss....

    -
    -

    12.5. Create Wired Domain Name

    +
    +

    12.5. Create Wired Domain Name

    A wired device is assigned an IP address when it is added to Core's -DHCP configuration (as in Add to Core DHCP). A private domain name is +DHCP configuration (as in Add to Core DHCP). A private domain name is then associated with this address. If the device is intended to operate wirelessly, the name for its address is modified with a -w suffix. Thus new-w.small.private would be the name of the new @@ -4105,8 +4114,8 @@ resolvectl query 192.168.56.4

    -
    -

    12.6. Update From Cloister Apt Cache

    +
    +

    12.6. Update From Cloister Apt Cache

    • Log in as sysadm on the console.
      • @@ -4128,8 +4137,8 @@ sudo reboot
    -
    -

    12.7. Authorize Remote Administration

    +
    +

    12.7. Authorize Remote Administration

    To remotely administer new-w, Ansible must be authorized to login as @@ -4163,11 +4172,11 @@ key.

    -
    -

    12.8. Configure with Ansible

    +
    +

    12.8. Configure with Ansible

    -With remote administration authorized and tested (as in Authorize +With remote administration authorized and tested (as in Authorize Remote Administration), and the machine connected to the cloister Ethernet, the configuration of new-w can be completed by Ansible. Note that if the machine is staying on the cloister Ethernet, its @@ -4175,7 +4184,7 @@ domain name will be new (having had no -w suffix added

    -First new-w is added to Ansible's inventory in hosts. A new-w +First new-w is added to Ansible's inventory in hosts. A new-w section is added to the list of all hosts, and an empty section of the same name is added to the list of campus hosts. If the machine uses the usual privileged account name, sysadm, the ansible_user key is @@ -4223,8 +4232,8 @@ configuration files.

    -
    -

    12.9. Connect to Cloister Wi-Fi

    +
    +

    12.9. Connect to Cloister Wi-Fi

    On an IoT device, or a Debian or Android "desktop", the cloister Wi-Fi @@ -4265,8 +4274,8 @@ desktop connected to the Wi-Fi using the following ping command.

    -
    -

    12.10. Connect to Cloister VPN

    +
    +

    12.10. Connect to Cloister VPN

    Wireless devices (with the cloister Wi-Fi password) can get an IP @@ -4279,14 +4288,14 @@ however, are not accessible except via the cloister VPN.

    Connections to the cloister VPN are authorized by the ./abbey -client... command (aka The Client Command), which registers a new +client... command (aka The Client Command), which registers a new client's public key and installs new WireGuard™ configurations on the servers. Private keys are kept on the clients (e.g. in /etc/wireguard/private-key).

    -
    -

    12.10.1. Campus Desktops and Servers

    +
    +

    12.10.1. Campus Desktops and Servers

    Wireless Debian desktops (with NetworkManager) as well as servers @@ -4372,8 +4381,8 @@ sudo systemctl enable wg-quick@wg0

    -
    -

    12.10.2. Private Desktops

    +
    +

    12.10.2. Private Desktops

    Member notebooks are private machines not remotely administered by the @@ -4485,8 +4494,8 @@ password is included in Secret/become.yml.

    -
    -

    12.10.3. Android

    +
    +

    12.10.3. Android

    Android phones and tablets are authorized to connect to the cloister @@ -4523,8 +4532,8 @@ public VPN.

    -
    -

    12.11. Create Wireless Domain Name

    +
    +

    12.11. Create Wireless Domain Name

    A wireless machine is assigned a Wi-Fi address when it connects to the @@ -4579,7 +4588,7 @@ be added to private/db.campus_vpn.)

    Author: Matt Birkholz

    -

    Created: 2026-01-18 Sun 16:36

    +

    Created: 2026-05-09 Sat 15:42

    Validate

    -- 2.47.3