醉酒狀態下將FreeBSD環境從Vultr遷移到ConoHa
大家好，我是個無能的人。
我快要死了，但正在從Vultr遷移到ConoHa，所以這是一個備忘錄。
-> 我在家裡喝醉了，醒來時已經睡著了，所以這篇文章是在今天，也就是幾乎第二天寫的
Vultr FreeBSD
$ pkg info | awk '{print $1}' | sed "s/^/pkg install -y /g"
pkg install -y base91-0.6.0_1
pkg install -y brotli-1.1.0,1
pkg install -y cgit-1.2.3_1
pkg install -y curl-8.12.1
pkg install -y dnsmasq-2.90_4,1
pkg install -y doas-6.3p12
pkg install -y expat-2.7.0
pkg install -y fcgi-devkit-2.4.0_6
pkg install -y fcgiwrap-1.1.0_12
pkg install -y gettext-runtime-0.23
pkg install -y git-2.49.0
pkg install -y gmp-6.3.0
pkg install -y go-1.21_5,2
pkg install -y go121-1.21.13_1
pkg install -y indexinfo-0.3.1
pkg install -y libffi-3.4.6
pkg install -y libidn2-2.3.7
pkg install -y liblz4-1.10.0,1
pkg install -y libnghttp2-1.65.0
pkg install -y libpsl-0.21.5_2
pkg install -y libssh2-1.11.1,3
pkg install -y libunistring-1.2
pkg install -y mpdecimal-4.0.0
pkg install -y nettle-3.10.1
pkg install -y nginx-1.26.3_2,3
pkg install -y p5-Authen-SASL-2.17_1
pkg install -y p5-CGI-4.67
pkg install -y p5-Clone-0.47
pkg install -y p5-Digest-HMAC-1.05
pkg install -y p5-Encode-Locale-1.05
pkg install -y p5-Error-0.17030
pkg install -y p5-HTML-Parser-3.83
pkg install -y p5-HTML-Tagset-3.24
pkg install -y p5-HTTP-Date-6.06
pkg install -y p5-HTTP-Message-7.00
pkg install -y p5-IO-HTML-1.004
pkg install -y p5-IO-Socket-IP-0.43
pkg install -y p5-IO-Socket-SSL-2.089
pkg install -y p5-LWP-MediaTypes-6.04
pkg install -y p5-Mozilla-CA-20250202
pkg install -y p5-Net-SSLeay-1.94
pkg install -y p5-TimeDate-2.33,1
pkg install -y p5-URI-5.31
pkg install -y pcre2-10.45
pkg install -y perl5-5.36.3_2
pkg install -y python311-3.11.11
pkg install -y readline-8.2.13_2
pkg install -y zstd-1.5.7
ConoHa FreeBSD
./pkg-install.sh | tee pkg-install.log
Vultr FreeBSD
$ pkg info | awk '{print $1}' | sed "s/^/pkg install -y /g"
pkg install -y base91-0.6.0_1
pkg install -y brotli-1.1.0,1
pkg install -y cgit-1.2.3_1
pkg install -y curl-8.12.1
pkg install -y dnsmasq-2.90_4,1
pkg install -y doas-6.3p12
pkg install -y expat-2.7.0
pkg install -y fcgi-devkit-2.4.0_6
pkg install -y fcgiwrap-1.1.0_12
pkg install -y gettext-runtime-0.23
pkg install -y git-2.49.0
pkg install -y gmp-6.3.0
pkg install -y go-1.21_5,2
pkg install -y go121-1.21.13_1
pkg install -y indexinfo-0.3.1
pkg install -y libffi-3.4.6
pkg install -y libidn2-2.3.7
pkg install -y liblz4-1.10.0,1
pkg install -y libnghttp2-1.65.0
pkg install -y libpsl-0.21.5_2
pkg install -y libssh2-1.11.1,3
pkg install -y libunistring-1.2
pkg install -y mpdecimal-4.0.0
pkg install -y nettle-3.10.1
pkg install -y nginx-1.26.3_2,3
pkg install -y p5-Authen-SASL-2.17_1
pkg install -y p5-CGI-4.67
pkg install -y p5-Clone-0.47
pkg install -y p5-Digest-HMAC-1.05
pkg install -y p5-Encode-Locale-1.05
pkg install -y p5-Error-0.17030
pkg install -y p5-HTML-Parser-3.83
pkg install -y p5-HTML-Tagset-3.24
pkg install -y p5-HTTP-Date-6.06
pkg install -y p5-HTTP-Message-7.00
pkg install -y p5-IO-HTML-1.004
pkg install -y p5-IO-Socket-IP-0.43
pkg install -y p5-IO-Socket-SSL-2.089
pkg install -y p5-LWP-MediaTypes-6.04
pkg install -y p5-Mozilla-CA-20250202
pkg install -y p5-Net-SSLeay-1.94
pkg install -y p5-TimeDate-2.33,1
pkg install -y p5-URI-5.31
pkg install -y pcre2-10.45
pkg install -y perl5-5.36.3_2
pkg install -y python311-3.11.11
pkg install -y readline-8.2.13_2
pkg install -y zstd-1.5.7
ConoHa FreeBSD
安裝上面輸出的內容。
我會用tee輸出，以便稍後檢查內容。
./pkg-install.sh | tee pkg-install.log
pf
我已經配置了pf設定，所以
root@localhost:~ # pfctl -nf /etc/pf.conf
root@localhost:~ # pfctl -f /etc/pf.conf
pfctl: /dev/pf: No such file or directory
哦，看來預設是沒有啟用的。
root@localhost:~ # kldload pf
root@localhost:~ # pfctl -f /etc/pf.conf
root@localhost:~ #
重啟後也沒有啟用，所以我要明確設定它在啟動時載入。
echo 'pf_load="YES"' >> /boot/loader.conf
echo 'pflog_load="YES"' >> /boot/loader.conf
WireGuard
我會直接使用Vultr端的輸出，建立相同的conf。
vim /usr/local/etc/wireguad/wg0.conf
chmod 600 /usr/local/etc/wireguard/wg0.conf
chmod 700 /usr/local/etc/wireguard
wg-quick up wg0
這樣，在ConoHa的安全組中啟用51820/UDP後，客戶端也能正常連線了。
為了自動啟動，在/etc/rc.conf中追加以下內容
wireguard_enable="YES"
wireguard_interfaces="wg0"
然後，我會確保openai.com不被路由。
即使在VPN環境下也能使用ChatGPT - SOULMINIGRIG
dnsmasq
檢查Vultr端的設定
# cd /usr/local/etc
# grep -v '^#' dnsmasq.conf | grep -v '^$'
no-resolv
server=1.1.1.1
interface=wg0
listen-address=10.0.0.1
log-queries
conf-dir=/usr/local/etc/dnsmasq.d
將此設定應用到ConoHa端，並拉取以下adblock.conf
GitHub - haturatu/dnsmasq-blockdns
# curl -o adblock.conf https://raw.githubusercontent.com/haturatu/dnsmasq-blockdns/refs/heads/main/adblock.conf
-sh: curl: not found
root@localhost:/usr/local/etc/dnsmasq.d # pkg install curl
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
curl: 8.14.1
Number of packages to be installed: 1
The process will require 5 MiB more space.
2 MiB to be downloaded.
Proceed with this action? [y/N]: y
原來我根本沒安裝curl^^;
# service dnsmasq restart
Performing sanity check on dnsmasq configuration.
dnsmasq: syntax check OK.
Performing sanity check on dnsmasq configuration.
dnsmasq: syntax check OK.
Stopping dnsmasq.
Starting dnsmasq.
這樣，只要將客戶端WireGuard的DNS伺服器設定為查詢10.1.0.1就完成了。
Nginx
在ConoHa的安全規則中，將80/tcp和443/tcp設定為公開允許。
這樣，透過pkg安裝的Nginx會自動在/etc/rc.conf中追加nginx_enable="YES"，所以沒問題。
我會先完成所有其他設定，然後再處理conf，所以暫時擱置。我只確認了Nginx的預設頁面在80埠顯示正常。
Postfix
這很麻煩。所以，我打算直接將cat main.cf | grep -v '^#' | grep -v '^$'的輸出傳給ChatGPT，讓它生成複製所有必要檔案的scp指令... 但當我嘗試ssh時，卻無法連線。
其實我在Vultr使用WireGuard時也注意到了，ConoHa似乎在高層級阻擋了部分海外IP，即使是ConoHa上託管的伺服器也無法連線到相應的全球IP。即使對Vultr端的auth.log執行tail -f，也看不到任何日誌。
我曾想過如果能建立WireGuard隧道或許可以，但用Vultr相同的設定重新配置太麻煩了...。
所以，我將透過舊伺服器 → 我的機器 → 新伺服器的路徑進行複製。
$ cat scp-postfix.sh
#!/bin/bash
scp darkstar@vultr-freebsd:/usr/local/etc/postfix/main.cf main.cf.old
scp darkstar@vultr-freebsd:/usr/local/etc/postfix/recipient_access recipient_access.old
scp darkstar@vultr-freebsd:/usr/local/etc/postfix/client_access client_access.old
scp darkstar@vultr-freebsd:/usr/local/etc/postfix/sender_access sender_access.old
scp darkstar@vultr-freebsd:/etc/mail/aliases aliases.old
sed 's/old-ipv4/new-ipv4/g' main.cf.old > main.cf.new
scp main.cf.new root@conoha-freebsd:/usr/local/etc/postfix/main.cf
scp recipient_access.old root@conoha-freebsd:/usr/local/etc/postfix/recipient_access
scp client_access.old root@conoha-freebsd:/usr/local/etc/postfix/client_access
scp sender_access.old root@conoha-freebsd:/usr/local/etc/postfix/sender_access
scp aliases.old root@conoha-freebsd:/etc/mail/aliases
憑證會先用tar打包，放在ssh用戶的目錄下，然後用scp傳輸。
Vultr端
tar czvf letsencrypt.tar.gz /usr/local/etc/letsencrypt
cp letsencrypt.tar.gz /home/hoge/
chown hoge:hoge /home/darkstar/letsencrypt.tar.gz
順帶一提，當使用scp時，用realpath輸出完整路徑並確認src路徑，可以直接複製貼上，很方便。然後，我發現certbot沒有安裝...
pkg install -y py311-certbot-nginx-4.0.0
echo 'weekly_certbot_enable="YES"' >> /etc/periodic.conf
這樣，將其放置在ConoHa端的/usr/local/etc/letsencrypt就完成了。
正確管理權限
cd /usr/local/etc/letsencrypt
find /usr/local/etc/letsencrypt -type d -exec chmod 700 {} \;
find /usr/local/etc/letsencrypt -type f -exec chmod 600 {} \;
在ConoHa上再次哈希
# which postmap
/usr/local/sbin/postmap
cd /usr/local/etc/postfix
postmap recipient_access
postmap client_access
postmap sender_access
newaliases
# postfix check
/usr/local/sbin/postconf: warning: /usr/local/etc/postfix/main.cf: support for parameter "smtp_use_tls" will be removed; instead, specify "smtp_tls_security_level"
👀
我會更改設定
# smtp_use_tls = yes
smtp_tls_security_level = may
再次
# postfix check
重啟
# service postfix restart
postfix/postfix-script: stopping the Postfix mail system
postfix/postfix-script: starting the Postfix mail system
Dovecot
我還沒有創建用戶，所以現在創建
pw useradd taro -u 1002 -g mail -d /home/taro -s /usr/sbin/nologin -m
passwd taro
將Vultr端的設定輸出，然後直接在ConoHa端創建/usr/local/etc/dovecot/dovecot.conf
dovecot -n
rehash
cd /usr/local/etc/postfix
postmap recipient_access
postmap client_access
postmap sender_access
newaliases
暫時到這裡，接下來是OpenDKIM
OpenDKIM
我完全忘了，OpenDKIM的設定在mail目錄下... 我忘了。
# realpath opendkim.conf
/usr/local/etc/mail/opendkim.conf
我把它設定得相當簡單
root@vultr:/usr/local/etc/mail # cat TrustedHosts
eyes4you.org
mail.eyes4you.org
root@vultr:/usr/local/etc/mail # cat SigningTable
eyes4you.org default._domainkey.eyes4you.org
mail.eyes4you.org default._domainkey.eyes4you.org
root@vultr:/usr/local/etc/mail # cat opend
cat: opend: No such file or directory
root@vultr:/usr/local/etc/mail # cat opendkim.conf
##
## opendkim.conf -- configuration file for OpenDKIM filter
##
## Copyright (c) 2010-2015, The Trusted Domain Project. All rights reserved.
##
Canonicalization simple/simple
Domain eyes4you.org
KeyFile /var/db/dkim/eyes4you.org.private
LogWhy yes
Mode sv
ReportAddress "DKIM Error Postmaster" <postmaster@eyes4you.org>
Selector default
SendReports yes
Socket inet:8891@localhost
SubDomains yes
Syslog Yes
SyslogSuccess yes
UMask 002
InternalHosts /usr/local/etc/mail/TrustedHosts
SigningTable /usr/local/etc/mail/SigningTable
KeyTable /usr/local/etc/mail/KeyTable
root@vultr:/usr/local/etc/mail # ls -lrta
total 108
-rw-r--r-- 1 root wheel 56 Aug 21 2023 opendmarc_ignore.hosts
-rw-r--r-- 1 root wheel 15502 Aug 21 2023 opendmarc.conf
-rw-r--r-- 1 root wheel 21800 Jan 7 2024 opendkim.conf.samplea
-rw-r--r-- 1 root wheel 32 Feb 4 2024 TrustedHosts
-rw-r--r-- 1 root wheel 88 Feb 4 2024 KeyTable
-rw-r--r-- 1 root wheel 95 Feb 4 2024 SigningTable
-rw-r--r-- 1 root wheel 765 Feb 4 2024 opendkim.conf
-rw-r--r-- 1 root wheel 21800 Jul 6 2024 opendkim.conf.sample
-rw-r--r-- 1 root wheel 15475 Jul 6 2024 opendmarc.conf.sample
drwxr-xr-x 2 root wheel 512 Jul 20 2024 .
drwxr-xr-x 21 root wheel 1024 Apr 18 07:11 ..
root@vultr:/usr/local/etc/mail #
帶入私鑰並授予權限
本來應該不是mailnull比較好...。
chown mailnull:mailnull /var/db/dkim/*.private
chmod 600 /var/db/dkim/*.private
現在我想起來了，我之前在名稱中放了兩個TXT記錄，但其實只需要default...。
此外，刪除未使用的私鑰和公鑰。
現有郵件目錄搬遷
用tar打包，然後用scp直接移動。
將郵件目錄放置在相同目的地並授予權限
# chown -R taro:mail /home/taro/Maildir
# chmod -R 700 /home/taro/Maildir
# doveadm mailbox list -u taro
Junk
Drafts
Sent
Trash
INBOX
重啟後，我設定了Socket inet:8891@localhost，所以檢查守護進程是否啟動
# lsof | grep 8891
opendkim 975 mailnull 3u IPv4 0xfffff80010f24a80 0 TCP localhost:8891->*:* (LISTEN)
郵件伺服器NS移轉
從Onamae移轉到ConoHa
網域 -> 網域功能列表 -> 名稱伺服器設定
從2.選擇名稱伺服器中選擇其他，並註冊ConoHa的DNS a.conoha-dns.com和b.conoha-dns.com
這樣，DNS記錄的查詢將會參考ConoHa的DNS。
~~ 閒話休題 ~~
For slaves of Google
確認是否能用dig查詢到
Google的DNS完全不行...
thepassenger:[haturatu]:~$ dig eyes4you.org NS @1.1.1.1 +short
a.conoha-dns.com.
b.conoha-dns.org.
thepassenger:[haturatu]:~$ dig eyes4you.org NS @8.8.8.8 +short
02.dnsv.jp.
04.dnsv.jp.
01.dnsv.jp.
03.dnsv.jp.
thepassenger:[haturatu]:~$ dig eyes4you.org NS @8.8.4.4 +short
03.dnsv.jp.
02.dnsv.jp.
04.dnsv.jp.
01.dnsv.jp.
順帶一提，我曾經忘記添加MX記錄^^;
thepassenger:[haturatu]:~$ dig eyes4you.org TXT @1.1.1.1 +short
"v=spf1 ip4:163.44.113.145 include:_spf.eyes4you.org ~all"
thepassenger:[haturatu]:~$ dig eyes4you.org MX @1.1.1.1 +short
10 mail.eyes4you.org.](thepassenger:[haturatu]:~$ dig _dmarc.mail.eyes4you.org TXT @1.1.1.1 +short
"v=DMARC1; p=none; pct=100; adkim=r; aspf=r"
thepassenger:[haturatu]:~$ dig default._domainkey.mail.eyes4you.org TXT @1.1.1.1 +short
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgNNPi+LvBGPAu/J4ze0LWJyCHv1UJqS/ZJBg3mY2W6bQyr6Ele1x2KDYWspglyeXuP/gJB/RhXric+73/AImw5ggbT4LGtxcywxeYPNQaHvXiIKfq8sdFR2L80I3E2qamQEKYGJHJuCVw0w3zS22bq+YFq5n9kEQW2iC7k5EGlwIDAQAB"
thepassenger:[haturatu]:~$ dig mail.eyes4you.org A @1.1.1.1 +short
163.44.113.145
thepassenger:[haturatu]:~$ dig eyes4you.org MX @1.1.1.1 +short
10 mail.
thepassenger:[haturatu]:~$ dig eyes4you.org MX @1.1.1.1 +short
10 mail.eyes4you.org.
是時候測試了！
然後，當我嘗試登入時卻被拒絕了...。用tail -f查看時
# tail -f /var/log/dovecot.log
Sep 14 10:00:31 imap-login: Error: Failed to initialize SSL server context: Couldn't parse private SSL key (ssl_key setting) (maybe ssl_key_password is wrong?): error:1E08010C:DECODER routines::unsupported: No supported data to decode. Input type: PEM: user=<>, rip=hogeip, lip=hogeip, session=<EmHcabg+6cfOU23o>
Sep 14 10:00:31 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth
Sep 14 10:00:31 auth: Debug: Module loaded: /usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so
Sep 14 10:00:31 auth: Debug: Wrote new auth token secret to /var/run/dovecot/auth-token-secret.dat
Sep 14 10:00:31 auth: Debug: auth client connected (pid=1559)
Sep 14 10:00:31 imap-login: Error: Failed to initialize SSL server context: Couldn't parse private SSL key (ssl_key setting) (maybe ssl_key_password is wrong?): error:1E08010C:DECODER routines::unsupported: No supported data to decode. Input type: PEM: user=<>, rip=hogeip, lip=hogeip, session=</2rnabg+aUzOU23o>
Sep 14 10:00:34 auth: Debug: auth client connected (pid=1560)
Sep 14 10:00:34 imap-login: Error: Failed to initialize SSL server context: Couldn't parse private SSL key (ssl_key setting) (maybe ssl_key_password is wrong?): error:1E08010C:DECODER routines::unsupported: No supported data to decode. Input type: PEM: user=<>, rip=hogeip, lip=hogeip, session=<scwJarg+ZnfOU23o>
Sep 14 10:00:34 auth: Debug: auth client connected (pid=1561)
Sep 14 10:00:34 imap-login: Error: Failed to initialize SSL server context: Couldn't parse private SSL key (ssl_key setting) (maybe ssl_key_password is wrong?): error:1E08010C:DECODER routines::unsupported: No supported data to decode. Input type: PEM: user=<>, rip=hogeip, lip=hogeip, session=<w0cVarg+IujOU23o>
嗯，我以為是這樣... 結果發現dovecot -n的輸出中，部分私鑰路徑似乎被隱藏了。
ssl = required
ssl_cert = </usr/local/etc/letsencrypt/live/mail.eyes4you.org/fullchain.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
userdb {
driver = passwd
}
這樣，接收伺服器就連線成功了。
接下來是發送用的Postfix
...也無法連線，所以我進行了調查
Vultr端
root@vultr:/usr/local/etc/postfix # grep -r submission | grep -v "\#"
./main.cf.default:known_tcp_ports = lmtp=24, smtp=25, smtps=submissions=465, submission=587
./master.cf:submission inet n - n - - smtpd
root@vultr:/usr/local/etc/postfix # grep -r 587
./main.cf.default:known_tcp_ports = lmtp=24, smtp=25, smtps=submissions=465, submission=587
./master.cf:#587 inet n - n - - smtpd
root@vultr:/usr/local/etc/postfix # sockstat -4 -l | grep 587
postfix smtpd 97537 6 tcp4 *:587 *:*
root master 1221 18 tcp4 *:587 *:*
既然它正在接受連線，應該沒問題，而且我以為所有東西都用scp帶過來了，結果卻忘了複製腳本中的master.cf！
ConoHa端
root@localhost:/usr/local/etc/postfix # service postfix restart
postfix/postfix-script: stopping the Postfix mail system
postfix/postfix-script: starting the Postfix mail system
root@localhost:/usr/local/etc/postfix # sockstat -4 -l | grep 25
root master 1912 13 tcp4 *:25 *:*
root@localhost:/usr/local/etc/postfix # sockstat -4 -l | grep 587
root master 1912 18 tcp4 *:587 *:*
root@localhost:/usr/local/etc/postfix #
OK~
現在已經成功連線了！由於內容很長，我會直接繼續。那麼，再見。