Working Group IT

Group that focus on the IT infrastructure of the lab like the Web Infrastructure

Channel Slack: #IT-Infrastructure

The following people currently have admin access to the infrastructure:

• Milian
• Phier
• tiefpunkt
• Adrian

Migration and Optimization 2024/2025

We're planning to consolidate services into a standard deployment model, consolidate external services, and maybe add some new ones.

Next Milestones

• Get server stable
• Setup useable pretix + authentik + nextcloud calender

ToDos

Topic	Prio	Tasks	Who is on it/wants to do it?	Notes
SSO - Keycloak		Test if it's easier to use than authentik	Phier
SSO - Authentik	1	IT group in authentic test connecting wiki to authentik check security warnings: https://nextcloud.munichmakerlab.de/settings/admin/overview IaC configuration of nextcloud e.g. https://docs.goauthentik.io/integrations/services/nextcloud/#nextcloud-1 => setup, testing needed Checkout backup database and storage location of data check best practice and hardening advices check, how we handle groups and how you register: challenge? check how to handle unique usernames across multiple tools => https://docs.goauthentik.io/docs/customize/policies/expression/unique_email => open double check integration e.g. it seems like you can be added to authentik admin group from nextcloud check privacy of user (which emails shown etc.)	Phier, Milian
Wiki	1	containerize wiki and migrate to saturn => done fix theme plugin for categories (sometimes shows error message) fix request account plugin => done (issue did not pop up on manual testing) update wiki and check how to handle better plugins e.g. with composer add integration with SSO check best practices and performance	Severin, Milian
Lightburn Remote VM	2	Setup second lightburn licence on VM Expose VM with some secure remote connection	Phier
Migrate Node Red	2	- Remove unused flows	Milian	https://hub.docker.com/r/nodered/node-red
Migrate Mailsetup	2	Old setup is on mars with Postfix and Mailman 2 (prevents Debian update): Check for details and related services Mars Discuss what to use: Maybe https://mailcow.email/de/ or https://docker-mailserver.github.io/docker-mailserver/latest/ (less documentation, no UI?) or https://mailinabox.email/ Setup on saturn some mail tool with Mailman 3 => test with Mailcow and test mail domain Migrate all data to saturn: how? Lists: https://docs.mailman3.org/en/latest/migration.html Update Authentik and pretix mail config Migrate existing stuff check best practice and hardening advices Check how to better handle spam => should we remove the plain mail links on the homepage and the wiki e.g. basic [at...] or better with javascript hacks or similar: https://www.matthewthom.as/blog/stop-email-scraping/ https://munichmakerlab.de/contact.html	Severin
Migrate Ticket System	2	Replace external https://tickets.mumalab.org/courses/ with Pretix instance on our server with ticket.munichmakerlab.de Connect to SSO => TODO Setup for production => TODO Setup Email list/group Setup Event Mails Deprecate old ticket system	Milian/Phier	Setup new, without migration
Migrate Token DB	2	Deploy ToolJet on our server (might be obsolete and using other approach) Existing setup https://github.com/homeofmaking/OpenUnitState/tree/master Migrate existing token from TBD Adjust Lasercutter and door(?) to this DB Setup FQDN tooljet.munichmakerlab.de => Done Check how existing setup is working ...	open	Contact German for old DB/Automation setup
Setup Nextcloud	2	Check out cards feature for IT Working group? Create shared folders e.g. for password safe Check limitation of storage or how to add external storage => set quota for user Create partition for the user files and configure owncloud to use this partition Create calender and integrate into website Replace google calender with next cloud calender integrate new calender on homepage, kreativquartier, ticket system etc.	Phier, Milian
Security and stability	1	Setup Firewall => Done Add fail2ban => https://blog.lrvt.de/configuring-fail2ban-with-traefik/ or https://plugins.traefik.io/plugins/628c9ebcffc0cd18356a979f/fail2-ban Add firewall to ansible = done Check Firewall together with docker: https://www.reddit.com/r/docker/s/RyUl8Akhy2 => https://github.com/chaifeng/ufw-docker?tab=readme-ov-file Test manually with nmap before update docker networks for better separation? limit docker daemon with systemd slices to 90% RAM and CPU: https://unix.stackexchange.com/questions/537645/how-to-limit-docker-total-resources => done Add dynamic blocking mechanism to traefik => check out fail2ban https://blog.lrvt.de/configuring-fail2ban-with-traefik/, https://plugins.traefik.io/plugins/628c9ebcffc0cd18356a979f/fail2-ban or crowdsec: https://www.crowdsec.net/blog/enhance-docker-compose-security => open add docker log rotation => done Limit all containers e.g. via Docker compose => in progress Check, that no container are exposed without reason (e.g. Authentik and pretix might miss) => done Check Log rotation for pretix and authentik => in progress Adjust log rotation for mosquitto or disable persistent logs => configured to stdout, so it will be handled with docker daemon => done Check backups Check logs and metrics	Milian
Logging and Monitoring	1	Setup Elastic Stack for Logging and Grafana + Prometheus for Metrics Metrics: Setup docker compose for Grafana + Prometheus: https://grafana.com/docs/grafana-cloud/send-data/metrics/metrics-prometheus/prometheus-config-examples/docker-compose-linux/ => done Limit Prometheus Storage: https://prometheus.io/docs/prometheus/latest/storage/#right-sizing-retention-size => prometheus Setup useful alerts and fix not proplery showing up ones => in progress Authentication via Authentik Fetch metrics: influx-db sensors, docker, traefik, system Logs: ELK Stack: https://www.elastic.co/blog/getting-started-with-the-elastic-stack-and-docker-compose Grafana Loki Authentication via Authentik Create useful alerts Fetch Logs: Traefik, docker, Server Data: Setup Influx DB: https://docs.influxdata.com/influxdb/v2/install/use-docker-compose/=> done Send Particular Sensor Data to influx DB Send Spacestatus to Influx DB Create Grafana Dashboards for Data	Milian
IaC	2	Add adaption for nextcloud OIDC?	Milian
Cleanup	2	Check MQTT and other IT devices. Which are still up to date, which can be fixed and which are not existent anymore. Compare Network and MuMaBus check remaining stuff in the lab, if something depends on old ports: MuMaBus ; Cleanup also acl.conf	Adrian	ongoing
Status	2	Fix status page Temperature: https://status.munichmakerlab.de/ Migrate the device status php script to saturn	Milian
Orga	2	shared password safe it group email => done cleanup old accounts	Milian

DONE

Topic		Tasks	Who is on it/wants to do it?	Notes
Social Media		Update homepage => done Move homepage to mastodon => done Update Homepage content for better information (what is the makerlab, open Thursday) => done Add FAQ Content: Frequently Asked Questions => done	Adrian, Milian
IaC		Setup Ansible in Repo => Done Playbook for Server => Done Playbook for Docker => done Add swap file => done Add docker resource limit => done Add docker prune job => done	Milian
Setup Nextcloud		Check out cards feature for IT Working group? Create shared folders e.g. for password safe Check limitation of storage or how to add external storage => set quota for user Create partition for the user files and configure owncloud to use this partition Create calender and integrate into website Replace google calender with next cloud calender integrate new calender on homepage, kreativquartier, ticket system etc.	Phier, Severin
Migrate Ticket System		Replace external https://tickets.mumalab.org/courses/ with Pretix instance on our server with ticket.munichmakerlab.de Setup DNS => Done Setup Pretix => Done files and config copied over. Execute "docker compose up --build" in /data/pretix => issues: connection to redis and database seems not to work. => connection issue with docker network? issue with traefik? => redis was deactivated via config, but also database connections does not work => TODO remove treafik from docker compose; debug docker networking e.g. by connecting to the server and double check. Setup Email ticket@munichmakerlab.de => done	Milian/Phier	Setup new, without migration
Migrate Node Red		Old version 2.0.6 Latest: 4.0.5 - Open firewall (ufw) for 1880 => done - Migrate data to saturn and adjust settings for new version => done - Create systemd for node red for version 4.0.5 => done - Test container with new version - fix broken stuff => done	Milian	https://hub.docker.com/r/nodered/node-red
Wiki		containerize wiki and migrate to saturn => done fix request account plugin => done (issue did not pop up on manual testing)	Severin
SSO		test authentik on saturn => done test connecting authentik and nextcloud => done authentic password reset => done migrate docker compose to /data/sso => done	Phier, Milian
Update Apps		e.g. Etherpad	Severin	Done
MQTT		Migrate to saturn and update to latest version. Connect with Adrian => https://munichmakerlab.slack.com/archives/C79T8NFU7/p1731197933279969 migrate /etc/system/systemd/docker-traefik.service to use config file => done adjust new /data/traefik/config/traefik.yml to integrate MQTT => done create mosquito config /data/mqtt/ with old config and new requirements => done migrate db /var/lib/mosquitto/mosquitto.db => done create /etc/system/systemd/docker-mosquitto.service => done test to start new mqqt service and restart traefik => done add new ports to ufw => done add new ports to ansible ufw: https://github.com/munichmakerlab/infrastructure/tree/debian-security-ansible=> done change FQDN to saturn and test => Done Test migrated Broker => Done	Mili	DONE
IoT Setup Lab		Local https://www.home-assistant.io/ setup to have a plattform for additional functions like power monitoring or controlling of the devices in the lab wipe and re-install local server with proxmox => vulpix.intern.munichmakerlab.de setup home-assistant	Adrian	Initial setup done
Backup		Check Backup of Doorlok DB => old local server was removed	Severin	Done, was setup on proxmox

Ideas and Notes

Consolidate:

• Wiki: Containerize => Challenges: php modules; updating php/wiki; ggf. make it easier to include the plugins (maybe php compose module handling)
• Mailsystem: ??

Externally hosted, and to be transfered into MuMaLab Infrastructure

• Tickets (https://tickets.mumalab.org/courses/)
• Calendar -> Google Calendar -> NextCloud
• ToolJet (via OpenUnitState)

Planned Services

• NextCloud
• evtl Ticket System
• Single Sign On: e.g. login to wiki either locally or via SSO. Later only SSO. Can be used e.g. for nextcloud or other services as well

Details unclear

• InfoBeamer

Mailsystem

Should support migrating of existing data and maillinglists

• https://docs.mailcow.email/#what-is-mailcow-dockerized => seems to work with postfix and integration with mailman 3 seems to be possible
• Docker Mailserver

 * Mailman supported via addon container, but very very old - docker-mailman3

• poste.io
• Mailu
• MailInABox - not dockerized

Lightburn VM

2. Licence for lightburn is already available. Would be nice to give members the chance to prepare Laser stuff remote and just come to the lab to laser.

Challenges: No Linux support https://forum.lightburnsoftware.com/t/linux-support-to-end-after-v1-7/144605; exposing remote desktop in secure way

Remote Systems?

https://guacamole.apache.org/

SSO

IDPs

1. Option: Authentik
2. Option: https://git.cccv.de/uffd/uffd
3. Option: ...?

Auth:

Complete guide to Nextcloud OIDC authentication with Authentik

Integrate Authentik and Nextcloud

Wiki Plugins for OIDC etc.: Plugable Auth