I’ve been working on improving Nim’s BSD support for a little while now, first by adding continuous integration running on FreeBSD and then on OpenBSD. The next step was obvious: running CI on NetBSD. Unfortunately, I couldn’t find any CI services currently offering NetBSD as an option, so off I went down the rabbit hole of setting up a Jenkins install myself on NetBSD. In this post, I’ll run through the process of doing so, as it’s not as obvious as it may be on other platforms.
The first step is obvious: get NetBSD installed. I wanted to run it on a VPS rather than dedicating some local hardware to the cause, so my first step was actually finding a host that supported either installing NetBSD from a pre-built image or installing from an ISO. Fortunately, BuyVM KVM slices support custom ISOs and have a NetBSD 9.0 ISO readily available. I installed a clean copy of NetBSD 9.0 using the standard installation procedure.
During the install, I went for a full installation rather than a minimal install. I also took the chance to use some of the final optional steps such as setting up networking, setting up binary package installation, setting up pkgsrc, adding a user, etc. It’s worth doing these at install time just to save some effort at a later date.
Initial set up
There are a few initial set up steps I like to do on any system before we even get to installing Jenkins or anything else. These are mostly for convenience, and are entirely up to you.
The first steps should be ran in a root shell:
- Install some standard packages that are useful:
pkgin install sudo nano htop git fish mozilla-rootcerts
- Set up Mozilla’s root cetificate bundle, which is used for SSL certificate verification:
mozilla-rootcerts install
- Configure
sudoto allow members of thewheelgroup to execute commands:
visudo
# find the line `# %wheel ALL=(ALL) ALL` and un-comment it
Now that I had sudo set up I dropped back to my standard user’s shell, which was added to the wheel group during install, and ran some further steps:
- Configure fish with some standard variables and functions:
mkdir -p $HOME/.config/fish
echo 'set fish_greeting ""
set -gx EDITOR (which nano)
set -gx VISUAL $EDITOR
function sudo!
set -l cmd $history[1]
echo "sudo $cmd" 1>&2
eval sudo $cmd
end' > $HOME/.config/fish/config.fish
- Set my shell to fish:
chsh -s $(which fish)
- Set up my SSH public key:
mkdir -p $HOME/.ssh
chmod 0700 $HOME/.ssh
echo 'my-ssh-public-key' > $HOME/.ssh/authorized_keys
chmod 0600 $HOME/.ssh/authorized_keys
- Configure SSH to deny root login, disallow password authentication, disable X11 forwarding and a few other tweaks:
sudo sed -i 's/^LoginGraceTime .*/LoginGraceTime 60/g' /etc/ssh/sshd_config
sudo sed -i 's/^#PermitRootLogin prohibit-password/PermitRootLogin no/g' /etc/ssh/sshd_config
sudo sed -i 's/^#MaxAuthTries 6/MaxAuthTries 3/g' /etc/ssh/sshd_config
sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
sudo sed -i 's/^#ChallengeResponseAuthentication yes/ChallengeResponseAuthentication no/g' /etc/ssh/sshd_config
sudo sed -i 's/^#X11Forwarding no/X11Forwarding no/g' /etc/ssh/sshd_config
sudo sed -i 's/^#UseDNS no/UseDNS no/g' /etc/ssh/sshd_config
sudo service sshd restart
- Configure some basic firewall rules for NPF to block all incoming traffic except SSH, HTTP and HTTPS. Note that the network interface here may be different:
sudo touch /etc/npf_blacklist
echo '# NOTE: change the `wm0` to the name of your external network interface
$public_if = ifaddrs(wm0)
# create 2 tables - one for blacklisted IPs, the other for suspicious traffic
table <blacklist> type ipset file "/etc/npf_blacklist"
table <suspicious> type lpm
# create a variable for the TCP services we wish to allow
$tcp_services = { http, https }
alg "icmp"
procedure "log" {
log: npflog0
}
procedure "normalize" {
normalize: "random-id", "min-ttl" 64, "max-mss" 1432, "no-df"
}
group default {
# pass everything on loopback
pass final on lo0 all
# block blacklisted IPs
block in final from <blacklist>
# block suspicious IPs
block in final from <suspicious>
# allow all outgoing
pass stateful out final all
# allow ICMP
pass in final proto icmp all
# allow and log ssh
pass stateful in final proto tcp from any to $public_if port ssh apply "log"
# allow incoming TCP
pass stateful in final proto tcp to $public_if port $tcp_services apply "normalize"
# reject everything else
block return in final all apply "log"
}' | sudo tee /etc/npf.conf
echo 'npf=YES' | sudo tee -a /etc/rc.conf
sudo /etc/rc.d/npf reload
sudo /etc/rc.d/npf start
Install and configure Nginx
We’re going to use Nginx as a reverse proxy to Jenkins, so let’s install that. Luckily, there’s a relatively up to date binary package available:
sudo pkgin install nginx
Now let’s configure Nginx to start at boot:
# copy the RC script into place
sudo cp /usr/pkg/share/examples/rc.d/nginx /etc/rc.d/nginx
echo 'nginx=YES' | sudo tee -a /etc/rc.conf
echo '/var/log/nginx/access.log nginx:nginx 640 7 * 24 Z /var/run/nginx.pid SIGUSR1
/var/log/nginx/error.log nginx:nginx 640 7 * 24 Z /var/run/nginx.pid SIGUSR1' | sudo tee -a /etc/newsyslog.conf
sudo /etc/rc.d/syslogd restart
Then let’s do some Nginx configuration to point to where Jenkins will eventually be running:
# take a backup of the existing configuration
sudo tar -czvf /usr/pkg/etc/nginx.tar.gz /usr/pkg/etc/nginx
sudo mkdir -p /usr/pkg/etc/nginx/conf.d
echo 'user nginx nginx;
worker_processes auto;
worker_rlimit_nofile 8192;
events {
worker_connections 8000;
}
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
http {
server_tokens off;
include mime.types;
default_type application/octet-stream;
charset utf-8;
charset_types
text/css
text/plain
text/vnd.wap.wml
text/javascript
text/markdown
text/calendar
text/x-component
text/vcard
text/cache-manifest
text/vtt
application/json
application/manifest+json;
log_format main '\''$remote_addr - $remote_user [$time_local] "$request" '\''
'\''$status $body_bytes_sent "$http_referer" '\''
'\''"$http_user_agent" "$http_x_forwarded_for"'\'';
access_log /var/log/nginx/access.log main;
keepalive_timeout 20s;
sendfile on;
tcp_nopush on;
gzip on;
gzip_comp_level 5;
gzip_min_length 256;
gzip_proxied any;
gzip_vary on;
gzip_types
application/atom+xml
application/geo+json
application/javascript
application/x-javascript
application/json
application/ld+json
application/manifest+json
application/rdf+xml
application/rss+xml
application/vnd.ms-fontobject
application/wasm
application/x-web-app-manifest+json
application/xhtml+xml
application/xml
font/eot
font/otf
font/ttf
image/bmp
image/svg+xml
text/cache-manifest
text/calendar
text/css
text/javascript
text/markdown
text/plain
text/xml
text/vcard
text/vnd.rim.location.xloc
text/vtt
text/x-component
text/x-cross-domain-policy;
include conf.d/*.conf;
}' | sudo tee /usr/pkg/etc/nginx/nginx.conf
echo 'server {
listen [::]:80 default_server;
listen 80 default_server;
server_name _;
return 444;
}' | sudo tee /usr/pkg/etc/nginx/conf.d/no-default.conf
echo 'server {
listen [::]:80;
listen 80;
# change this to your actual domain name
server_name jenkins.euantorano.co.uk;
location / {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8080;
proxy_read_timeout 90s;
# change this to your actual domain name
proxy_redirect http://127.0.0.1:8080 http://jenkins.euantorano.co.uk;
proxy_http_version 1.1;
proxy_request_buffering off;
}
}' | sudo tee /usr/pkg/etc/nginx/conf.d/jenkins.conf
And now let’s start nginx:
sudo /etc/rc.d/nginx start
Install Java
Jenkins uses Java, which we must install. We’ll use the binary package for OpenJDK 8, as OpenJDK 11 on NetBSD currently (at the time of writing) has a bug related to network connections.
sudo pkgin install openjdk8
Install Jenkins
Jenkins is available as a package on NetBSD, but unfortunately the version available is well out of date as of the time of writing (the package version 2.73, while the current version is version 2.259). As such, we’ll download the current version from the Jenkins website and use that instead:
sudo mkdir -p /usr/lib/jenkins
sudo mkdir -p /var/lib/jenkins
sudo mkdir -p /var/log/jenkins
sudo chown jenkin:jenkins /var/log/jenkins
sudo ftp -o /usr/lib/jenkins/jenkins.war https://get.jenkins.io/war/latest/jenkins.war
# create a group for jenkins to run under
sudo groupadd jenkins
# create a user for jenkins to run under
sudo useradd -s /sbin/nologin -g jenkins -m -d /home/jenkins jenkins
# Create an RC script for Jenkins
echo '#!/bin/sh
# PROVIDE: jenkins
# REQUIRE: DAEMON
. /etc/rc.subr
JENKINS_USER=jenkins
JENKINS_GROUP=jenkins
JENKINS_HOME=/home/jenkins
export JENKINS_HOME
name="jenkins"
rcvar=$name
pidfile="/var/run/jenkins.pid"
start_cmd="jenkins_start"
stop_cmd="jenkins_stop"
status_cmd="jenkins_status"
version_cmd="jenkins_version"
extra_commands="status version"
jenkins_start()
{
su -m jenkins:jenkins -c '\''nohup \
/usr/pkg/java/openjdk8/bin/java -jar /usr/lib/jenkins/jenkins.war \
--httpPort=8080 --httpListenAddress=127.0.0.1 \
</dev/null >> /var/log/jenkins/jenkins.log 2>&1 &'\''
pid=$!
echo "$pid" > $pidfile
}
jenkins_stop()
{
if [! -f "$pidfile"]; then
echo "Jenkins is not running"
exit 1
fi
pid=$(cat "$pidfile")
kill -15 "$pid"
rm "$pidfile"
}
jenkins_status()
{
if [! -f "$pidfile"]; then
echo "Jenkins is not running"
exit 1
fi
pid=$(cat "$pidfile")
kill -0 "$pid"
if [$? -eq 0]; then
echo "Jenkins is running (PID $pid)"
exit 0
else
echo "Jenkins is not running"
rm "$pidfile"
exit 1
fi
}
jenkins_version()
{
/usr/pkg/java/openjdk8/bin/java -jar /usr/lib/jenkins/jenkins.war --version
}
load_rc_config "$name"
run_rc_command "$1"' | sudo tee /etc/rc.d/jenkins
sudo chmod +x /etc/rc.d/jenkins
And now let’s start Jenkins:
sudo /etc/rc.d/jenkins start
Finishing up
Jenkins is now running behind Nginx as a reverse proxy, but there are still a few tasks to do, including running through the Jenkins install web UI and setitng up build jobs. It’s probably a good idea to set up HTTPS too. I’m afraid these are left to the reader for the time being!
First is my first time really using NetBSD, as I usually use either FreeBSD or OpenBSD, so if there's anything that can be done in a more concise or better way please let me know!
Top comments (0)