Domain 1 capstone -- provision a server end to end

capstone · 90 min · Objective 1.7

Task

Bring the System Management domain together: build a server from a template, lay out its storage with LVM, put it on the network correctly, and prove every choice. This exercises virtualisation, storage, partitioning, networking and the boot chain in one sequence, which is how they actually occur.

Steps

  1. Template. Generalise a base image with virt-sysprep, then clone it. Prove the clone has its own SSH host key and machine-id.
  2. Storage. Attach a second disk and build the full LVM stack on it -- pvcreate, vgcreate vg0, lvcreate -n data -- with a filesystem mounted at /data via /etc/fstab by UUID (the names the Verify uses). Prove the fstab entry with mount -a before rebooting.
  3. Grow it online. Extend the logical volume and its filesystem while mounted, and separately show that extending the volume without -r leaves the filesystem unchanged.
  4. Network. Put the guest on a bridged network with a static address or a DHCP reservation, using --model virtio. Prove the second machine can reach a service on it.
  5. Boot. Confirm the firmware mode with /sys/firmware/efi, read /proc/cmdline, and confirm the root device the bootloader named matches what findmnt / reports.
  6. Snapshot discipline. Take an external snapshot before a risky change (virsh snapshot-create-as GUEST pre-change --disk-only), make the change, and revert. Then delete the snapshot and explain why leaving it degrades performance over time. Check virsh --version first: reverting to an external snapshot needs libvirt 9.9 or later, and deleting one 9.0 or later; older versions refuse with "unsupported". On an older host, revert by hand instead -- shut the guest down, virsh edit the disk source back to the base image, and discard the overlay -- which is exactly the bookkeeping the newer commands do for you.
  7. Recover. Break the guest's networking and recover through virsh console, proving out-of-band access works.
  8. Write an evidence summary: for each of storage, network and boot, the command a reviewer runs and the output that proves it correct.

Verify

# clone identity is its own
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
# storage: volume and filesystem sizes agree after online grow
lvs --noheadings -o lv_size vg0/data; df -h /data | tail -1
# fstab is safe
findmnt --verify --verbose | tail -3
# network: reachable from the LAN
# (from the second machine) curl -sf -o /dev/null -w '%{http_code}' http://GUEST/
# boot: bootloader root matches the mounted root
grep -o 'root=[^ ]*' /proc/cmdline; findmnt -n -o SOURCE /

The capstone passes when the clone owns its identity, the volume and filesystem sizes agree, findmnt --verify is clean, the service is reachable from another machine, and the boot root matches the mounted root -- each demonstrated, not asserted.

Notes

The through-line of domain 1 is that every layer hands off to the next and each handoff is a place to prove rather than assume: the disk grows but the filesystem must be told; the guest gets an address but the bridge must actually carry it; the bootloader names a root that must be the one that mounts. The evidence summary is where you show the handoffs held.

This is an independent study companion for CompTIA Linux+ and is not produced by or endorsed by CompTIA.