Iseva eyodwa yaselabhorethri, izindima ezintathu zokuthembela, isizinda esisodwa sokwehluleka

Konke kuyasebenza kuze kube yilapho umgijimi wokwakha edinga isokhethi yomsingathi efanayo esetshenziswa isivakashi se-VPN, bese kungekho muntu ongachaza ukuthi kungani umsebenzi ungafunda izikhiye zesango. Konke kwafakwa emshinini owodwa ngoba kwakulingana, futhi isivakashi ngasinye sanikezwa ukufinyelela okubanzi ngoba kwakuyindlela eshesha kakhulu yokwenza kusebenze. Umphumela umsingathi onomngcele wokuthembela okukhona kube yintambo yamandla. Ukuhlukanisa izindima kudinga umsebenzi omncane kunalokho okuzwakalayo, futhi kuqala ngokuzinika amagama.

Izindima ezintathu ezabelana ngakho konke njengamanje

Umnyango we-VPN, iqoqo lezinsizakalo ezizimele kanye nomgijimi wokwakha afuna izinto ezahlukene. Owokuqala udinga imbobo yomphakathi kanye nenethiwekhi encane ohlangothini oluzimele. Owesibili udinga isitoreji esihlala njalo kanye nezimfihlo zohlelo lokusebenza. Owesithathu ugijima ikhodi eyabhalwa omunye umuntu.

Ukunikeza bobathathu ukufinyelela okufanayo yikho okwenza uphawu lube nokudideka, ngoba lapho-ke noma yimuphi wabo angathinta abanye. Umsebenzi wokwakha ongafinyelela isokhethi ye-hypervisor umsebenzi ongamisa i-VPN. Isivakashi sezinsizakalo esinomzila oya kunethiwekhi yokuphatha singashintsha ukucushwa kweswishi. Inkinga yizimvume, futhi uhlu lwezinqubo yindawo kuphela lapho kugqama khona. Ukuqamba izindima kuqala kunikeza imvume ngayinye indawo yokuhlala.

Umdwebo ongezansi uyindawo yokuqala yalokho kwehlukanisa, hhayi isethembiso sokusebenza okuphezulu. Kubheke njengombono okufanele uqinisekiswe, hhayi njengomklamo ophelile.

Hlukanisa izindima ezintathu, hhayi izinqubo ezintathu

Izivakashi ezintathu kumsingathi owodwa zinikeza amaqoqo amathathu ezimvume kanye nezikhundla ezintathu zenethiwekhi. Azinikezi izizinda ezintathu zokwehluleka, futhi umklamo kufanele akusho lokho ngokuzwakalayo.

Ukuhlukanisa kusiza kuphela uma ukuhlaselwa kwesivakashi esisodwa kunganikezi ezinye imvume ngokuzenzakalela, futhi lokho kuwukucushwa kwe-hypervisor, hhayi umkhuba wokuqamba amagama. Ukubiza i-VM ngokuthi isango akukuvimbeli esinye isivakashi ukufinyelela kumsingathi. Funda ukucushwa kweswishi ebonakalayo esikhundleni segama lomsingathi, bese uqinisekisa ukuthi isivakashi ngasinye sikhona lapho ocabanga khona.

host
├─ vpn-gw      10.60.10.2/24   public 51820/udp only
├─ services    10.60.0.10/24   no route to the management network
└─ ci-runner   10.60.20.2/24   outbound only, no host socket

Bhala i-topology bese uyiqinisekisa ngamathuluzi ayiphethe. Isivakashi esivela ebhulohweni elingalungile kuwukutholakala, hhayi imininingwane. Lungisa inethiwekhi ngaphambi kokushintsha noma yikuphi ukucushwa kwensizakalo.

Vumela isivakashi se-VPN sivule kuphela iminyango esinayo

Shicilela imbobo yomhubhe kusiphathi semizila futhi akukho okunye. Izimbobo zokuphatha zezivakashi zingezomzila wokuphatha, hhayi i-inthanethi, futhi isixhumanisi se-hypervisor ngokwayo sikulowo mzila.

Inethiwekhi ohlangothini oluzimele kufanele ifinyelele izinsizakalo ezidingwa abasebenzisi bakude bese iyama lapho. Ukuqinisekiswa kohlelo lokusebenza kuhlala kuvuliwe, ngoba umhubhe uwukuthutha hhayi ukungena. Gcina ithebula lemizila yesivakashi se-VPN lincane ngokwanele ukuba ulichaze ngomusho owodwa. Uma ungeke ulichaze ngokulula kangako, umngcele usuqale wafiphalala.

virsh net-list --all
virsh net-dumpxml lab-private
sudo nft list ruleset | grep -n -E '51820|10.60'

Noma yini elalela kumsingathi engadingeki ekuphatheni akufanele ilalele nakanye. Lokho kufaka i-API ye-hypervisor, okulula ukuyishiya iveziwe kusixhumanisi somphakathi.

Imisebenzi yokwakha idinga uhlobo oluhlukile lomngcele

Umsebenzi we-CI ugijima imiyalo elawulwa indawo yokugcina ikhodi, ngakho ukwethembeka kwawo kuncike ekutheni ubani ongathumela ikhodi. Isigijimi se-shell sigijima leyo miyalo njengomsebenzisi womgijimi kumsingathi, futhi lowo umngcele obanzi kunayo yonke etholakalayo.

Izigijimi zekhontheyna zincane, futhi ikhontheyna enelungelo elikhethekile akusiyo enye yalezo ezincane. Gcina umgijimi esivakashini sakhe ngokwaso enomkhakha wayo wenethiwekhi, bese umnikeza kuphela ukufinyelela kwama-artefact nokuthunyelwa okudingwa imisebenzi. Izisebenzi ezisetshenziswa kanye zinciphisa isimo esigciniwe; azinciphisi ukufinyeleleka noma ukuchayeka kwezimfihlo. Kokubili kusadinga imingcele ecacile.

Isivakashi sezinsizakalo siphethe idatha, ngakho uhlelo lwaso lokulondoloza kuyilo okufanele lusebenze. Gcina izindawo zokugcina ikhodi, okulayishiwe kanye nedathabhesi kuhlelo olulodwa lwezikhathi. Hlola ukubuyiselwa esikhundleni sokufunda isimo somsebenzi.

Hlela ukwehluleka okwabiwayo yizindima ezintathu

Umsingathi owodwa yisizinda esisodwa sokwehluleka. Ukuqalisa kabusha kususa umhubhe kanye nayo yonke insizakalo ezimele ngasikhathi sinye, futhi yilapho-ke umzila wokungena ubaluleka kakhulu.

Gcina ukufinyelela kwekhonsoli okunganciki esivakashini se-VPN, kungaba ikhonsoli yomzimba, isixhumanisi sokuphatha esingaphandle kwebhendi noma ikhonsoli yomhlinzeki. Isithombe esigcinwe kuyo leyo diski asisona ikhophi ezimele, futhi akusiyo nekhophi yokulondoloza egijima ngaphakathi kwesivakashi esiyivikelayo. Bese uhlola ukuqalisa okubandayo njengokulandelana, hhayi njengohlu lokuhlola: umsingathi, amanethiwekhi abonakalayo, umzila womhubhe kanye nohlelo olulodwa olubiziwe ngaphansi kwe-akhawunti evamile.

virsh list --all
systemctl is-active libvirtd
curl -sS -m 5 -o /dev/null -w '%{http_code}\n' https://10.60.0.10/
ss -ltnp | grep -E ':51820|:443'

Ukulandelana kokuqalisa kwezinqubo akufakazi lutho ngemizila ne-DNS, ngakho hlola umzila esikhundleni sezimo zamayunithi. Umzila yiwona umsebenzisi wakude awudinga ngempela.