Final project

---

Table of contents

1. Project objectives
2. Target architecture
3. Step 1: Infrastructure
4. Step 2: Hardening
5. Step 3: High availability
6. Step 4: Monitoring
7. Validation and certification

---

1 - Project objectives

Context

You must set up a highly available web infrastructure for an e-commerce application.

Requirements

Requirement	Specification
Availability	99.9% SLA
Security	Full hardening
Monitoring	Real-time alerts
Backup	RPO 1h, RTO 4h
Logs	Centralized

Skills assessed

• ✅ Advanced system administration
• ✅ Security and hardening
• ✅ High availability
• ✅ Monitoring and alerting
• ✅ Automation
• ✅ Troubleshooting

🔝 Back to table of contents

---

2 - Target architecture

Diagram

Components

Component	Technology	Quantity
Load Balancer	HAProxy + Keepalived	2
Web Server	Nginx + PHP-FPM	2
Database	PostgreSQL	2
Monitoring	Prometheus + Grafana	1
Logs	Loki	1

🔝 Back to table of contents

---

3 - Step 1: Infrastructure

Tasks

1. Provisioning: Create the VMs (KVM or LXD)
2. Network: Configure the internal network
3. Installation: Install the base services

LXD creation script

#!/bin/bash
# create-infra.sh

set -euo pipefail

# Créer le réseau
lxc network create infra-net ipv4.address=10.0.0.1/24 ipv4.nat=true

# Load Balancers
lxc launch ubuntu:22.04 lb1 --network infra-net
lxc launch ubuntu:22.04 lb2 --network infra-net

# Web Servers
lxc launch ubuntu:22.04 web1 --network infra-net
lxc launch ubuntu:22.04 web2 --network infra-net

# Database
lxc launch ubuntu:22.04 db1 --network infra-net
lxc launch ubuntu:22.04 db2 --network infra-net

# Monitoring
lxc launch ubuntu:22.04 monitor --network infra-net

echo "Infrastructure créée"
lxc list

Step 1 checklist

• VMs/containers created
• Network configured
• SSH connectivity
• Hostnames configured
• /etc/hosts synchronized

🔝 Back to table of contents

---

4 - Step 2: Hardening

Tasks

1. Hardening: Apply security measures
2. Firewall: Configure iptables/ufw
3. SSH: Secure access

Hardening script

#!/bin/bash
# hardening.sh

set -euo pipefail

echo "=== Hardening du système ==="

# Mises à jour
apt update && apt upgrade -y

# SSH Hardening
cat >> /etc/ssh/sshd_config << 'EOF'
PermitRootLogin no
PasswordAuthentication no
X11Forwarding no
MaxAuthTries 3
EOF
systemctl restart sshd

# Sysctl hardening
cat > /etc/sysctl.d/99-hardening.conf << 'EOF'
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.tcp_syncookies = 1
kernel.randomize_va_space = 2
EOF
sysctl -p /etc/sysctl.d/99-hardening.conf

# Firewall de base
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw --force enable

# Fail2ban
apt install -y fail2ban
systemctl enable fail2ban

echo "=== Hardening terminé ==="

Step 2 checklist

• SSH secured (keys only, no root)
• Firewall configured
• Fail2ban active
• Sysctl hardening applied
• Automatic updates

🔝 Back to table of contents

---

5 - Step 3: High availability

HAProxy + Keepalived

# /etc/haproxy/haproxy.cfg (sur lb1 et lb2)
global
    daemon
    maxconn 4096

defaults
    mode http
    timeout connect 5s
    timeout client 50s
    timeout server 50s
    option httplog
    option httpchk GET /health

frontend http_front
    bind *:80
    default_backend web_back

backend web_back
    balance roundrobin
    server web1 10.0.0.11:80 check
    server web2 10.0.0.12:80 check

listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats auth admin:secure_password

# /etc/keepalived/keepalived.conf (lb1 - MASTER)
vrrp_script check_haproxy {
    script "/usr/bin/killall -0 haproxy"
    interval 2
    weight 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 101
    
    authentication {
        auth_type PASS
        auth_pass secure_pass
    }
    
    virtual_ipaddress {
        10.0.0.100/24
    }
    
    track_script {
        check_haproxy
    }
}

PostgreSQL Replication

# Sur db1 (Primary)
# postgresql.conf
wal_level = replica
max_wal_senders = 3
wal_keep_size = 64MB

# pg_hba.conf
host replication replicator 10.0.0.0/24 md5

# Créer l'utilisateur
sudo -u postgres psql -c "CREATE USER replicator REPLICATION LOGIN PASSWORD 'secure';"

# Sur db2 (Replica)
pg_basebackup -h db1 -D /var/lib/postgresql/14/main -U replicator -P

# postgresql.conf
primary_conninfo = 'host=db1 user=replicator password=secure'

Step 3 checklist

• HAProxy configured on lb1 and lb2
• Keepalived VIP working
• LB failover tested
• PostgreSQL replication active
• Application deployed on web1 and web2

🔝 Back to table of contents

---

6 - Step 4: Monitoring

Prometheus

# /etc/prometheus/prometheus.yml
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']
  
  - job_name: 'nodes'
    static_configs:
      - targets:
        - 'lb1:9100'
        - 'lb2:9100'
        - 'web1:9100'
        - 'web2:9100'
        - 'db1:9100'
        - 'db2:9100'
  
  - job_name: 'haproxy'
    static_configs:
      - targets: ['lb1:8404', 'lb2:8404']

Alerts

# /etc/prometheus/alerts.yml
groups:
  - name: infra
    rules:
      - alert: InstanceDown
        expr: up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Instance {{ $labels.instance }} down"
      
      - alert: HighCPU
        expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High CPU on {{ $labels.instance }}"
      
      - alert: DiskSpaceLow
        expr: (node_filesystem_avail_bytes / node_filesystem_size_bytes) * 100 < 20
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Low disk space on {{ $labels.instance }}"

Step 4 checklist

• Node exporter on all servers
• Prometheus collects the metrics
• Grafana dashboards configured
• Alerts working
• Centralized logs

🔝 Back to table of contents

---

7 - Validation and certification

Validation tests

Test	Command/Action	Expected result
LB failover	Stop HAProxy on lb1	VIP fails over to lb2
Web failover	Stop web1	Traffic continues on web2
DB failover	Stop db1	Application continues (read)
Backup	Restore a backup	Data intact
Monitoring	Create an incident	Alert received

Validation script

#!/bin/bash
# validate.sh

echo "=== Tests de validation ==="

# Test connectivité VIP
echo -n "VIP accessible: "
curl -sf http://10.0.0.100/health && echo "OK" || echo "FAIL"

# Test HAProxy stats
echo -n "HAProxy stats: "
curl -sf http://lb1:8404/stats > /dev/null && echo "OK" || echo "FAIL"

# Test réplication DB
echo -n "DB Replication: "
lxc exec db2 -- sudo -u postgres psql -c "SELECT pg_is_in_recovery();" | grep -q "t" && echo "OK" || echo "FAIL"

# Test Prometheus
echo -n "Prometheus UP: "
curl -sf http://monitor:9090/-/healthy && echo "OK" || echo "FAIL"

echo "=== Tests terminés ==="

Certification criteria

To validate this project, you must have:

1. ✅ A working infrastructure
2. ✅ Hardening applied
3. ✅ HA tested and working
4. ✅ Monitoring with alerts
5. ✅ Complete documentation
6. ✅ Tested backup/restore procedures

---

Congratulations!

You have completed the Linux 5 - Advanced Administration track! 🎉

You are now able to:

• Administer Linux systems in production
• Secure and harden servers
• Set up high availability
• Monitor and diagnose complex problems
• Automate advanced tasks

Next steps

• Practice on real-world projects
• Take a certification (RHCSA, LFCS)
• Explore Kubernetes and the cloud

---

← Back to the course table of contents