Monitor Fox BMC with ICMP probes too

Restrict DAC VPN to fox-ipmi machine only
Monitor fox via VPN
2025-07-02 15:28:20 +02:00 · 2025-07-02 15:28:20 +02:00 · 2025-07-02 15:28:20 +02:00 · 2025-07-02 15:28:20 +02:00 · 2025-07-02 15:28:20 +02:00 · 2025-07-02 15:24:51 +02:00
2 changed files with 12 additions and 10 deletions
--- a/m/fox/configuration.nix
+++ b/m/fox/configuration.nix
@@ -14,7 +14,7 @@
  swapDevices = lib.mkForce [];

  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ "kvm-amd" "amd_uncore" ];

  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
  hardware.cpu.intel.updateMicrocode = lib.mkForce false;
@@ -22,6 +22,14 @@
  # Use performance for benchmarks
  powerManagement.cpuFreqGovernor = "performance";

+  # Disable NUMA balancing
+  boot.kernel.sysctl."kernel.numa_balancing" = 0;
+
+  # Expose kernel addresses
+  boot.kernel.sysctl."kernel.kptr_restrict" = 0;
+
+  services.openssh.settings.X11Forwarding = true;
+
  networking = {
    timeServers = [ "ntp1.upc.edu" "ntp2.upc.edu" ];
    hostName = "fox";
--- a/web/content/access/index.md
+++ b/web/content/access/index.md
@@ -5,18 +5,12 @@ description: "Request access to the machines"

 ![Cave](./cave.jpg)

-Before requesting access to the jungle machines, you must be able to access the
-`ssfhead.bsc.es` node (only available via the intranet or VPN). You can request
-access to the login machine using a resource petition in the BSC intranet.
-
-Then, to request access to the machines we will need some information about you:
+To request access to the machines we will need some information:

 1. Which machines you want access to ([hut](/hut), [fox](/fox), owl1, owl2, eudy, koro...)
-1. Your user name and user id (to match the NFS permissions)
+1. Your user name (make sure it matches the one you use for the BSC intranet)
 1. Your real name and surname (for identification purposes)
 1. The salted hash of your login password, generated with `mkpasswd -m sha-512`
 1. An SSH public key of type Ed25519 (can be generated with `ssh-keygen -t ed25519`)

-Send an email to <jungle@bsc.es> with the details, or directly open a
-merge request in the [jungle
-repository](https://pm.bsc.es/gitlab/rarias/jungle/).
+Send an email to <jungle@bsc.es> with the details.
Author	SHA1	Message	Date
Rodrigo Arias Mallo	d40e9197f4	Monitor Fox BMC with ICMP probes too	2025-07-02 15:28:20 +02:00
Rodrigo Arias Mallo	ec4f72183c	Restrict DAC VPN to fox-ipmi machine only	2025-07-02 15:28:20 +02:00
Rodrigo Arias Mallo	5095172973	Monitor fox via VPN	2025-07-02 15:28:20 +02:00
Rodrigo Arias Mallo	f096355e14	Add OpenVPN service to connect to fox BMC	2025-07-02 15:28:20 +02:00
Rodrigo Arias Mallo	c1f17cad85	Add ac.upc.edu as name search server Allows referring to fox.ac.upc.edu directly as fox.	2025-07-02 15:28:20 +02:00
Rodrigo Arias Mallo	cb05482b4f	Update access instructions We no longer need to request a petition through BSC, as we will be in charge of the login. Remove link to the old repository as well and prefer only email. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-07-02 15:24:51 +02:00
Rodrigo Arias Mallo	e660268661	Disable kptr_restrict in fox Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-07-02 15:08:42 +02:00
Rodrigo Arias Mallo	d45b7ea717	Disable NUMA balancing in fox See: https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html#numa-balancing Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-07-02 15:08:02 +02:00
Rodrigo Arias Mallo	c205fa4e34	Load amd_uncore module in fox Needed for L3 events in perf. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-07-02 15:07:58 +02:00
Rodrigo Arias Mallo	5f055388a5	Enable SSH X11 forwarding Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-07-02 15:07:54 +02:00