Domain 1 capstone -- provision a server end to end

capstone · 90 min · Objective 1.7

Task

Bring the System Management domain together: build a server from a template, lay out its storage with LVM, put it on the network correctly, and prove every choice. This exercises virtualisation, storage, partitioning, networking and the boot chain in one sequence, which is how they actually occur.

Steps

  1. Template. Generalise a base image with virt-sysprep, then clone it. Prove the clone has its own SSH host key and machine-id.
  2. Storage. Attach a second disk and build the full LVM stack on it -- pvcreate, vgcreate, lvcreate -- with a filesystem mounted via /etc/fstab by UUID. Prove the fstab entry with mount -a before rebooting.
  3. Grow it online. Extend the logical volume and its filesystem while mounted, and separately show that extending the volume without -r leaves the filesystem unchanged.
  4. Network. Put the guest on a bridged network with a static address or a DHCP reservation, using --model virtio. Prove the second machine can reach a service on it.
  5. Boot. Confirm the firmware mode with /sys/firmware/efi, read /proc/cmdline, and confirm the root device the bootloader named matches what findmnt / reports.
  6. Snapshot discipline. Take an external snapshot before a risky change, make the change, and revert. Then delete the snapshot and explain why leaving it degrades performance over time.
  7. Recover. Break the guest's networking and recover through virsh console, proving out-of-band access works.
  8. Write an evidence summary: for each of storage, network and boot, the command a reviewer runs and the output that proves it correct.

Verify

# clone identity is its own
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
# storage: volume and filesystem sizes agree after online grow
lvs --noheadings -o lv_size vg0/data; df -h /data | tail -1
# fstab is safe
findmnt --verify --verbose | tail -3
# network: reachable from the LAN
# (from the second machine) curl -sf -o /dev/null -w '%{http_code}' http://GUEST/
# boot: bootloader root matches the mounted root
grep -o 'root=[^ ]*' /proc/cmdline; findmnt -n -o SOURCE /

The capstone passes when the clone owns its identity, the volume and filesystem sizes agree, findmnt --verify is clean, the service is reachable from another machine, and the boot root matches the mounted root -- each demonstrated, not asserted.

Notes

The through-line of domain 1 is that every layer hands off to the next and each handoff is a place to prove rather than assume: the disk grows but the filesystem must be told; the guest gets an address but the bridge must actually carry it; the bootloader names a root that must be the one that mounts. The evidence summary is where you show the handoffs held.