Proxmox : optimisation (script xshok)
Ma déception passée concernant TrueNAS Scale, j'en reviens à mon couteau-suisse préféré : Proxmox + Docker :)
Si installer Proxmox est très simple, l'optimiser (et Debian avec) est un peu plus sportif quand on n'a pas beaucoup de temps ou d'envie de lire. J'ai donc fait le choix de la simplicité avec le script d'eXtreme-Shock.
Disable the enterprise repo, enable the public repo, Add non-free sources
Fixes known bugs (public key missing, max user watches, etc)
Update the system
Detect AMD EPYC CPU and Apply Fixes
Force APT to use IPv4
Update proxmox and install various system utils
Customise bashrc
add the latest ceph provided by proxmox
Disable portmapper / rpcbind (security)
Ensure Entropy Pools are Populated, prevents slowdowns whilst waiting for entropy
Protect the web interface with fail2ban
Detect if is running in a virtual machine and install the relavant guest agent
Install ifupdown2 for a virtual internal network allows rebootless networking changes (not compatible with openvswitch-switch)
Limit the size and optimise journald
Install kernel source headers
Install kexec, allows for quick reboots into the latest updated kernel set as primary in the boot-loader.
Ensure ksmtuned (ksm-control-daemon) is enabled and optimise according to ram size
Set language, if chnaged will disable XS_NOAPTLANG
Increase max user watches, FD limit, FD ulimit, max key limit, ulimits
Optimise logrotate
Lynis security scan tool by Cisofy
Increase Max FS open files
Optimise Memory
Pretty MOTD BANNER
Enable Network optimising
Save bandwidth and skip downloading additional languages, requires XS_LANG="en_US.UTF-8"
Disable enterprise proxmox repo
Remove subscription banner
Install openvswitch for a virtual internal network
Detect if this is an OVH server and install OVH Real Time Monitoring
Set pigz to replace gzip, 2x faster gzip compression
Bugfix: high swap usage with low memory usage
Enable TCP BBR congestion control
Enable TCP fastopen
Enable testing proxmox repo
Automatically Synchronize the time
Set Timezone, empty = set automatically by IP
Install common system utilities
Increase vzdump backup speed
Optimise ZFS arc size accoring to memory size
Install zfs-auto-snapshotAu menu, forçage IPv4 pour apt, décongestion TCP, optimisation ZFS, ksmtuned, MàJ de la time-zone et de la langue, outil de sécurité Lynis, Fail2Ban...
Très complet, le script s'installe en suivant leur préconisation et on peut l'éditer pour désactiver ("no") des fonctionnalités.
Sur mon serveur j'ai désactivé ce qui suit
# Disable portmapper / rpcbind (security)
XS_DISABLERPC="no"
# Protect the web interface with fail2ban
XS_FAIL2BAN="no"
# Install ifupdown2 for a virtual internal network allows rebootless networking changes (not compatible with openvswitch-switch)
XS_IFUPDOWN2="no"
# Lynis security scan tool by Cisofy
XS_LYNIS="no"
# Install openvswitch for a virtual internal network
XS_OPENVSWITCH="no"
# Enable testing proxmox repo
XS_TESTREPO="no"
# Install zfs-auto-snapshot
XS_ZFSAUTOSNAPSHOT="no"La machine étant hébergée chez moi, derrière "du matériel", je n'ai pas besoin de la blinder niveau sécurité. Une clé SSH suffit amplement. Donc je conserve portmapper et ne veux ni de fail2ban ni de Lynis.
Si j'ai bloqué le dépôt Entreprise Proxmox je ne veux pas celui de test. Non plus besoin de tweaker les outils de réseau Proxmox.
Pas non plus besoin, enfin pour l'instant, du script de snapshot automatisé pour ZFS.
On édite donc nos options -ou pas-, on lance le script et on reboot la bête. Et si on n'a pas bloqué l'option, on a un beau MOTD :)
Linux pve 5.13.19-2-pve #1 SMP PVE 5.13.19-4 (Mon, 29 Nov 2021 12:10:09 +0100) x86_64
This system is optimised by: https://eXtremeSHOK.com
__ ___ _____ _ _ ____ _ __
\ \ / / | / ____| | | |/ __ \| |/ /
___ \ V /| |_ _ __ ___ _ __ ___ ___| (___ | |__| | | | | ' /
/ _ \ > < | __| '__/ _ \ '_ ` _ \ / _ \\___ \| __ | | | | <
| __// . \| |_| | | __/ | | | | | __/____) | | | | |__| | . \
\___/_/ \_\\__|_| \___|_| |_| |_|\___|_____/|_| |_|\____/|_|\_\
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Dec 27 22:18:46 2021 from 10.0.4.65
[root@pve ~]$ df -H
Filesystem Size Used Avail Use% Mounted on
udev 13G 0 13G 0% /dev
tmpfs 2.6G 1.3M 2.6G 1% /run
rpool/ROOT/pve-1 2.0T 2.0G 2.0T 1% /
tmpfs 13G 36M 13G 1% /dev/shm
tmpfs 5.3M 0 5.3M 0% /run/lock
Cache 124G 132k 124G 1% /Cache
rpool 2.0T 132k 2.0T 1% /rpool
Data 12T 263k 12T 1% /Data
rpool/ROOT 2.0T 132k 2.0T 1% /rpool/ROOT
rpool/data 2.0T 132k 2.0T 1% /rpool/data
/dev/fuse 135M 17k 135M 1% /etc/pve
tmpfs 2.6G 0 2.6G 0% /run/user/0
