Testing FUSS with LXD

On the server (ubuntu:22.04) I have installed LXD with snap, like this:

Somehow, firewalld and docker interfere with the network communication in the virtual environment that we are creating, so that they cannot get an IP from DHCP, and cannot ping to the internet. The problem is that by default, an interface that is not added to any zone will be handled by the public zone of firewalld. This zone is meant for the interfaces that are connected to the internet, and is restricted by default. For example DHCP connections are not allowed.

We can fix this by adding the LXD interfaces to the zone trusted, which allows everything:

Besides this, forwarding from and to these interfaces needs to be enabled in the firewall, but sometimes it might be blocked (for example if you install Docker, it will set the policy of the FORWARD chain to DROP). This can be fixed by adding a direct rule with firewall-cmd, like this:

This will enable forwarding for all the interfaces, lxdbr0 and the ones that we will create later.

We need Xpra to access the graphical displays (VGA consoles) of the virtual machines remotely (for example from a laptop).

To start Xpra we run the script xpra-start.sh on the server:

To connect to it we run the script xpra-attach.sh from the client (laptop). We should get a tilix terminal by default, but if not, we can start it from the Xpra icon (click it and keep it pressed, then go to "Server", then to "Run a command" and release the mouse button, type "tilix" and press Enter). From this terminal we can type LXC commands, and when we try to access the display of a virtual machine it will be shown on the laptop.

By default, the VM is connected to the network lxdbr0, which also allows it to access the internet. We also attach fuss-server to LAN1 and LAN2, so it is going to have two more network interfaces connected to these LANs.

With the last command we also make the size of the disk bigger than the default one.

Notice (on the first command) that instead of providing an image for the VM, we have used the option --empty, which means that nothing will be installed by default on the disk. We need to download the installation iso of Debian 12 ("bookworm") and attach it to the VM like a CDROM:

The options boot.priority=1 and security.secureboot=false are needed to make sure that we actually boot the system from this iso.

Append these lines to /etc/network/interfaces:

Then activate this interface:

The custom package fuss-server contains the scripts that are needed to do the installation and configuration of the server.

First of all, append these line to /etc/apt/sources.list:

Then add the key:

Finally install the package:

The create command will run the Ansible scripts that are needed to install and configure the rest of the system.

For more explanations and details see: https://fuss-tech-guide.readthedocs.io/it/latest/server/configurazione_server.html#configurazione-fuss-server

Create an empty VM, connected to LAN1:

Attach the iso file as a device of type disk, and make it the first boot option. Disable also secureboot:

Check its config:

Start it with a VGA console:

Complete the installation.

Stop the client, remove the iso device, and start it again:

Login as root and install the LXD agent:

Configuration of the client is done with the command fuss-client:

However, before starting the configuration, we need to know in which cluster/group of computers this client belongs to. Actually we haven’t defined yet any clusters. One way for doing it is through the Octonet web interface. Open in browser http://proxy:13402 and login with username root and the master password defined on the configuration of the server (it is not the password of the root account on the server). Then click on "Managed Hosts" on the right, click on "Managed Hosts" on the top, and select "Create new cluster" from the menu.

Let’s say that the name of this cluster is lab1. Now we can setup the client like this:

The option -a is for adding a new client. The option -g is for the group/cluster of computers where this client belongs to. The option -H sets the hostname. The option --light will make a basic installation; without this option lots of educationsl programs will be installed (and right now we don’t want to do it, since we are just testing).

Let’s also fix the screen resolution of the client (because it gets automatically a very big resolution):

Open the OctoNet interface (on http://proxy:13402/) and add a couple of new users, for example user1 and user2.

Now restart the client and try to login with each of them:

Note that when you try to open a web site, the proxy asks you to authenticate with a username and password. Use the same username and password that you used to login to your account.

Create a CSV file like this:

In this example, the first column is the full name, the second one is the username, the third one is the password, and the last column is the primary group. The order of the columns does not matter because it can be fixed during the import.

There is an option in the menu for checking the file before importing it. After the check you can start importing.

For more details about creating accounts from CSV files, look at the corresponding docs.

To start Clonezilla on client1, we have to boot it from the LAN. We need to disable secure boot and to set the network interface as the first boot device:

Now it will show the Clonezilla menu and you can save the image of the client on the server. For more details see this page.

After the image is saved, we can stop client1, remove the boot priority (that makes it boot from network), and start it again:

Unfortunately, when a new interface is attached to the virtual machine, the names of the existing interfaces change, so we need to fix the configuration of the server again.

Edit /etc/network/interfaces so that it looks like this:

Here enp5s0 is the new interface that will be used for the captive portal.

We should also edit /etc/fuss-server/fuss-server.yaml and correct the interfaces, like this:

Let’s restart the server:

Finally, let’s also re-run the configuration scripts and restart again:

Let’s create a VM that is connected to LAN2:

We can connect to the LXD from a local machine, for example a laptop, and manage it remotely.

We can use Xpra in order to access the VGA console of a virtual machine remotely. We need to install it both on the server and on the client (on the laptop):

On the server we also need to install the package virt-viewer (which provides remote-viewer) and some other required packages:

Then we can start Xpra on the server, like this:

From the client, we can attach to the Xpra server like this:

Now, from the tmux on the server we can start any GUI application, and it will be displayed on the local machine.

Instead of installing debian from iso, we can start from a debian base image, which is quicker and more convenient.

The "Quick installation guide" describes how to install a FUSS server inside a proxmox machine, starting from a preprocessed image. So, let’s try first to install proxmox on virtual machine.