The well known BIOSboot partition issue - Fedora does not install
flawlessly on HDs larger 2 TB in Raid 1
by Peter Boy
I am doing some test installations to contribute some of our internal documentation for Fedora Server documentation. Thereby a problem with the BiOSboot partition occurred again.
To set up the system with RAID 1, manual partitioning must be performed during installation. I have created in the Anaconda GUI:
- BIOSboot Partition
- /boot as default partition and changed to raid 1
- /ROOT as LVM changed to raid 1 as well (and some additional LVs in that VG)
The installation aborted with the error message:
"The following error occurred while installing the boot loader. The system will not be bootable. Do you want to ignore this and continue with the installation?
Boot loader install failed"
Anaconda creates BIOSboot only on the first hard disk, but then tries to install grub also on the 2nd hard disk and fails because of the missing BIOSboot partition there.
This was already discussed a long time ago and considered to create a BIOSboot partition automatically when creating a GPT even without user action. However, concerns were raised about this and the proposal was obviously not implemented.
I have not found a way in the current Anaconda manual partition GUI to install BIOSboot on the 2nd disk as well. My simple workaround was to boot a live system, set up GPT and BIOSboot, shutdown, and then boot the Fedora Server installation image.
The installation then went without a fuss. But is this the intended way? I suspect it isn’t. I probably missed something.
Any hint appreciated.
Peter
2 years, 8 months
Topics for the next IRC meeting
by Peter Boy
Many thanks to Michel for initiating a concrete date for the next IRC meeting (although I am a bit puzzled, wasn't something else agreed?).
Regarding the agenda, I would like to propose to add the following topics:
(a) Status of the PRD Update
============================
Towards the end of next week we should have a concrete initial text proposal ready to be discussed and refined.
(b) Improving Fedora Server documentation and visibility
========================================================
Matthew has raised the prospect in an email:
> We'd set up a space specifically for Server. Click on IoT, Silverblue, or
> CoreOS on the front page https://docs.fedoraproject.org/.
>
> In fact, it might make most sense to have _two_ areas, one for the server
> _project_ (linked in the bottom half of the front page) and one for
> user-focused documents (linked in the top half).
We should discuss whether we aim at this and if so, how we start a procedure to implement this idea.
And we should increase the visibility of the documentation, e.g. on the download page for Fedora Server below the download links a bold banner something like "now you got Fedora Server, get to know Fedora Server“ linking to the documentation page.
(c) Update of the Server SIG and Working Group wiki pages
=========================================================
Server Working group wiki (https://fedoraproject.org/wiki/Server): last edited April 2018, last ’substantial’ change Sept. 2016
Server Sig Group wiki (https://fedoraproject.org/wiki/SIGs/Server): last edited May 2016, last ’substantial’ change 2012
At least we should update the Member lists, meeting dates, and meeting minutes, and some other completely outdated content that can be easily changed (or simply deleted).
2 years, 8 months
How to set up firewalld for a routing bridge (brouter) in Fedora
Server 32?
by Peter Boy
I’m working on a configuration to make multiple VMs accessible via public IPv4 and IPv6 addresses. The Internet provider routes all addresses (IPv4 and IPv6 subnets) to the MAC address of the physical adapter. So I have to route to the VMs on the server (Fedora Server 32). The more common bridge solution for direct VM access doesn’t work. I have configured the physical interface (enp3s0) accordingly and attached a virtual bridge (vbr3s0) to which the VMs connect. In addition, there is a libvirt bridge for private communication between VM's.
Everything works great as long as firewalld is *stopped*.
The goal is to configure the host firewall so that everything is forwarded by default and the VM's firewall controls the specific access. At the same time, it should be possible to restrict access for individual IPs to certain ports (these IPs provide public access for containers instead of VMs).
Unfortunately, I'm not that familiar with firewalld. I found the following solution options
(a)
Place the bridge (vbr3s0) in a zone providing target=ACCEPT, e.g. trusted or nm-shared.
In this way, routing works for IPv6, but not for IPv4.
(b)
Defining "direct rules" for forwarding. Various posts all boiled down to:
[...]# firewall-cmd --direct --get-all-rules
ipv4 filter FORWARD 0 -i enp3s0 -o vbr3s0 -j ACCEPT
ipv4 filter FORWARD 0 -i vbr3s0 -o enp3s0 -j ACCEPT
Unfortunately, IPv4 still does not work with these rules either. Obviously, I have missed something.
Unfortunately I am not getting any further and would be very appreciative of any help.
Thanks
Peter
My IP configuration
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 30:85:a9:ee:23:d4 brd ff:ff:ff:ff:ff:ff
inet 144.76.7.86/32 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
inet6 2a01:4f8:190:8255::2/128 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::3285:a9ff:feee:23d4/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: vbr3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 8e:5d:9f:58:45:4b brd ff:ff:ff:ff:ff:ff
inet 144.76.7.86/32 scope global noprefixroute vbr3s0
valid_lft forever preferred_lft forever
inet6 2a01:4f8:190:8255::2/64 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::8c5d:9fff:fe58:454b/64 scope link noprefixroute
valid_lft forever preferred_lft forever
4: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 52:54:00:c9:33:cc brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
5: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000
link/ether 52:54:00:c9:33:cc brd ff:ff:ff:ff:ff:ff
6: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master vbr3s0 state UNKNOWN group default qlen 1000
link/ether fe:54:00:80:ea:aa brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc54:ff:fe80:eaaa/64 scope link
valid_lft forever preferred_lft forever
7: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master virbr0 state UNKNOWN group default qlen 1000
link/ether fe:54:00:7f:46:50 brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc54:ff:fe7f:4650/64 scope link
valid_lft forever preferred_lft forever
My zones so far:
[...]# firewall-cmd --get-active-zones
FedoraServer
interfaces: enp3s0
libvirt
interfaces: virbr0
trusted
interfaces: vbr3s0
2 years, 8 months
PRD update - let's start get it done
by Peter Boy
At the recent Fedora Server Reboot meeting, an editorial group was set up to update our PRD: m3xboy (Eduard Lucena), langdon (Langdon White), and pboy (Peter Boy, it's me). We should start to put the work in motion. The next IRC meeting is planned for January. We should then have a first proposal.
Looking back on the discussion, the first thing we have to decide upon is the tool to use. One idea was hackMD (https://hackmd.io/pricing#), a commercial online platform and markdown editor, free for individuals and public groups.
Maybe I'm a bit old fashioned but I'd rather prefer a Fedora project resource if it exists and is available, maybe something like laverna (https://laverna.cc/)? A real OSS markdown editor available as on premise installable online tool as well as local installable (Linux, Max, Win) with online synchronization.
However, I would much rather use a tool with some professional writing functionality. For our purpose, even LibreOffice would suffice. It provides a tracking of changes within text lines, a comment and discussion function on selectable text passages directly in the margin of the page, a merging of different editing statuses, and some more. Although the final version would have to be downgraded to Markdown, thanks to pandoc it is quite feasible. We would then have to upload and download the file. Would we have a place in the Fedora infrastructure to do this?
In the next step, we should decide on a targeted table of contents, a heading and a very short abstract of the intended "message" and its content, so that we have a focus for the text.
In the discussion, the prevailing opinion was to essentially keep the structure.
The sections "Vision" and "Mission" have so far been mentioned as needing discussion (I would argue for keeping them).
The section "Featured Server Roles" was described by Stephen Gallagher as completely outdated. Who can contribute detailed information on this?
That's my ideas so far. @m3xboy and @langdon should we arrange an IRC meeting at short notice? Or do we want to continue discussing here?
2 years, 8 months