You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
59 lines
2.3 KiB
59 lines
2.3 KiB
--- |
|
description: SSH, Mikrotik, deploy scripts, dan konfigurasi server |
|
globs: scripts/**/*,server/**/* |
|
alwaysApply: false |
|
--- |
|
|
|
# Infrastructure & Scripts |
|
|
|
## PowerShell scripts (`scripts/`) |
|
|
|
| Script | Fungsi | |
|
|--------|--------| |
|
| `setup-ssh-mikrotik.ps1` | Daftar SSH key ke Mikrotik (default RSA) | |
|
| `ssh-mikrotik.ps1` | Login Mikrotik tanpa password | |
|
| `ssh-remote.ps1` | SSH ke reverse proxy 10.100.1.24 | |
|
| `deploy-geonet-console.ps1` | Build + deploy geonet-console | |
|
| `deploy-databaselist.ps1` | Build + deploy databaselist | |
|
| `apply-*-mikrotik.ps1` | Terapkan konfig RouterOS | |
|
|
|
## Mikrotik |
|
|
|
- Port SSH: **255**, MAC: `hmac-sha1` |
|
- RouterOS 7.5: user key **RSA** (`id_rsa_mikrotik`), ed25519 butuh 7.12+ |
|
- Import key: upload `.pub` via SCP lalu `/user ssh-keys import` |
|
- Konfig: `server/mikrotik-*.rsc`, checklist: `server/mikrotik-*-checklist.txt` |
|
- Backup sebelum apply: simpan di `server/` |
|
|
|
## SSH Key-based Access (tanpa password) |
|
|
|
SSH private key sudah dikonfigurasi di laptop user. Agent BOLEH propose SSH command untuk setup/deploy — WAJIB minta persetujuan user, tidak boleh auto-run SSH yang bersifat destructive. |
|
|
|
| Server | SSH Command | |
|
|--------|-------------| |
|
| Reverse proxy `10.100.1.24` | `ssh -m hmac-sha1 root@10.100.1.24 -p 22` | |
|
| Main Database `10.100.1.25` | `ssh -m hmac-sha1 root@10.100.1.25 -p 22` | |
|
| AD-LDAP `10.100.1.40` | `ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22` | |
|
| Zabbix `10.100.1.42` | `ssh -m hmac-sha1 root@10.100.1.42 -p 22` | |
|
| Ollama `10.100.1.26` | `ssh -i "$env:USERPROFILE\.ssh\id_rsa_geonet_laptop" -o IdentitiesOnly=yes -m hmac-sha1 root@10.100.1.26 -p 22` | |
|
| NAS QNAP `10.100.1.10` | `ssh -i "$env:USERPROFILE\.ssh\id_ed25519" -o IdentitiesOnly=yes admin@10.100.1.10 -p 22` | |
|
|
|
> Ollama & QNAP: Wajib PowerShell (bukan CMD). |
|
> Remote command: `ssh -m hmac-sha1 root@10.100.1.24 -p 22 "perintah"` — single line. |
|
|
|
## Server audit |
|
|
|
- Simpan hasil audit ke `server/<hostname>_audit.txt` |
|
- Referensi host: `server/host.txt`, `readme.txt` |
|
|
|
## Deploy remote |
|
|
|
1. Sync kode ke server (tanpa `.env`) |
|
2. `docker compose build` + `up -d` di `/opt/stacks/<app>/` |
|
3. Verifikasi: `docker ps`, curl URL produksi |
|
|
|
## Safety |
|
|
|
- Backup `.rsc` sebelum ubah Mikrotik |
|
- Rollback script tersedia: `rollback-single-wan-mikrotik.ps1`, `restore-failover-phase1-mikrotik.ps1` |
|
- Jangan commit secret, key private, atau password
|
|
|