GLPI 11 sobre Proxmox — mesa de ayuda + inventario en producción

qm clone 9000 231 \
  --name glpi-lab \
  --description "GLPI 11 · Ubuntu 24.04 · lab Harper" \
  --full 0 --pool lab

qm set 231 --cores 2 --sockets 1 --cpu host --memory 4096 --balloon 0
qm resize 231 scsi0 40G

qm set 231 \
  --ciuser rbatista \
  --sshkeys ~/.ssh/dojo_authorized_keys \
  --ipconfig0 ip=192.168.0.231/24,gw=192.168.0.1 \
  --nameserver "192.168.0.1 1.1.1.1" \
  --searchdomain lab.harper.local

qm cloudinit update 231
qm set 231 --onboot 1
qm start 231

until qm agent 231 ping 2>/dev/null; do echo "esperando cloud-init..."; sleep 5; done
qm agent 231 network-get-interfaces | jq -r '.[] | select(.name!="lo").["ip-addresses"][]?."ip-address"'

sudo hostnamectl set-hostname glpi-lab.lab.harper.local
sudo timedatectl set-timezone America/Santo_Domingo

sudo apt update
sudo DEBIAN_FRONTEND=noninteractive apt -y full-upgrade
sudo apt -y install curl wget gnupg2 lsb-release ca-certificates \
  ufw fail2ban unattended-upgrades chrony jq htop unzip

# Sudo NOPASSWD para el usuario base.
echo "rbatista ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/90-rbatista
sudo chmod 440 /etc/sudoers.d/90-rbatista

# Hardening SSH.
sudo tee /etc/ssh/sshd_config.d/50-harper.conf >/dev/null <<'EOF'
PasswordAuthentication no
PermitRootLogin no
KbdInteractiveAuthentication no
MaxAuthTries 3
LoginGraceTime 30
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
EOF
sudo sshd -t && sudo systemctl reload ssh

# UFW: solo SSH por ahora.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw --force enable

[ -f /var/run/reboot-required ] && sudo reboot

sudo apt update
sudo apt -y install nginx \
  php8.3-fpm php8.3-cli php8.3-common \
  php8.3-mysql php8.3-curl php8.3-gd php8.3-intl \
  php8.3-mbstring php8.3-xml php8.3-zip php8.3-bcmath \
  php8.3-ldap php8.3-imap php8.3-bz2 php8.3-opcache \
  php8.3-apcu

# Verificar versión y extensiones críticas.
php -v
php -m | grep -E 'bcmath|mbstring|intl|gd|zip|curl|xml|ldap|mysqli|openssl|opcache|apcu'

# --- FPM (requests HTTP a través de Nginx) ---
sudo sed -i -E \
  -e 's|^;?\s*date.timezone\s*=.*|date.timezone = America/Santo_Domingo|' \
  -e 's|^;?\s*upload_max_filesize\s*=.*|upload_max_filesize = 20M|' \
  -e 's|^;?\s*post_max_size\s*=.*|post_max_size = 20M|' \
  -e 's|^;?\s*max_execution_time\s*=.*|max_execution_time = 600|' \
  -e 's|^;?\s*max_input_vars\s*=.*|max_input_vars = 10000|' \
  -e 's|^;?\s*memory_limit\s*=.*|memory_limit = 512M|' \
  -e 's|^;?\s*session.cookie_httponly\s*=.*|session.cookie_httponly = 1|' \
  -e 's|^;?\s*session.cookie_secure\s*=.*|session.cookie_secure = 0|' \
  /etc/php/8.3/fpm/php.ini

# --- CLI (usado por los crons de GLPI) ---
sudo sed -i -E \
  -e 's|^;?\s*date.timezone\s*=.*|date.timezone = America/Santo_Domingo|' \
  -e 's|^;?\s*memory_limit\s*=.*|memory_limit = 512M|' \
  /etc/php/8.3/cli/php.ini

sudo systemctl restart php8.3-fpm
sudo systemctl enable  php8.3-fpm
sudo systemctl status  php8.3-fpm --no-pager | head -8

ls -la /run/php/php8.3-fpm.sock
sudo systemctl is-active nginx php8.3-fpm

sudo apt -y install mariadb-server mariadb-client

sudo systemctl enable --now mariadb
mariadb --version

# Lo hacemos por SQL directo — es idempotente y no interactivo.
sudo mariadb <<'EOF'
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
FLUSH PRIVILEGES;
EOF

sudo mysql_tzinfo_to_sql /usr/share/zoneinfo | sudo mariadb mysql

# Permitir al usuario glpi consultar las tablas de timezone.
sudo mariadb <<'EOF'
GRANT SELECT ON mysql.time_zone_name TO 'glpi'@'localhost';
FLUSH PRIVILEGES;
EOF

# Verificar (debe haber ~600 filas).
sudo mariadb -e "SELECT COUNT(*) AS zones FROM mysql.time_zone_name;"

# Generar password fuerte y guardarlo (solo root).
GLPI_DB_PASS="$(openssl rand -base64 32 | tr -d '=+/' | cut -c1-32)"
echo "$GLPI_DB_PASS" | sudo tee /root/.glpi-db-pass >/dev/null
sudo chmod 600 /root/.glpi-db-pass

sudo mariadb <<EOF
CREATE DATABASE glpi
  CHARACTER SET utf8mb4
  COLLATE utf8mb4_unicode_ci;
CREATE USER 'glpi'@'localhost' IDENTIFIED BY '$(sudo cat /root/.glpi-db-pass)';
GRANT ALL PRIVILEGES ON glpi.* TO 'glpi'@'localhost';
GRANT SELECT ON mysql.time_zone_name TO 'glpi'@'localhost';
FLUSH PRIVILEGES;
EOF

# Test de conexión.
mariadb -u glpi -p"$(sudo cat /root/.glpi-db-pass)" -e "SHOW DATABASES;"

sudo tee /etc/mysql/mariadb.conf.d/60-harper-glpi.cnf >/dev/null <<'EOF'
[mysqld]
# --- Harper baseline para GLPI 11 (VM 4 GB RAM) ---
bind-address              = 127.0.0.1
innodb_buffer_pool_size   = 1G
innodb_log_file_size      = 128M
innodb_flush_log_at_trx_commit = 2
character-set-server      = utf8mb4
collation-server          = utf8mb4_unicode_ci
default-time-zone         = '-04:00'
max_allowed_packet        = 64M
EOF

sudo systemctl restart mariadb
sudo ss -ltnp | grep 3306

GLPI_VERSION="11.0.8"
cd /tmp
wget "https://github.com/glpi-project/glpi/releases/download/${GLPI_VERSION}/glpi-${GLPI_VERSION}.tgz"

# Verificar tamaño mínimo (~40 MB — si es mucho menor, algo se cortó).
ls -lh "glpi-${GLPI_VERSION}.tgz"

sudo tar xzf /tmp/glpi-${GLPI_VERSION}.tgz -C /var/www/
sudo chown -R www-data:www-data /var/www/glpi
ls /var/www/glpi/ | head -10

sudo install -d -o www-data -g www-data -m 750 /etc/glpi
sudo install -d -o www-data -g www-data -m 750 /var/lib/glpi
sudo install -d -o www-data -g www-data -m 750 /var/log/glpi

# Mover el contenido, no los directorios (para preservar los .htaccess que quedan).
sudo mv /var/www/glpi/config/* /etc/glpi/
sudo mv /var/www/glpi/files/*  /var/lib/glpi/
sudo rmdir /var/www/glpi/config /var/www/glpi/files

sudo tee /var/www/glpi/inc/downstream.php >/dev/null <<'EOF'
<?php
define('GLPI_CONFIG_DIR', '/etc/glpi/');
if (file_exists(GLPI_CONFIG_DIR . '/local_define.php')) {
    require_once GLPI_CONFIG_DIR . '/local_define.php';
}
EOF

# Y ahora el archivo con las rutas del resto de recursos.
sudo tee /etc/glpi/local_define.php >/dev/null <<'EOF'
<?php
define('GLPI_VAR_DIR',           '/var/lib/glpi');
define('GLPI_DOC_DIR',           GLPI_VAR_DIR);
define('GLPI_CACHE_DIR',         GLPI_VAR_DIR . '/_cache');
define('GLPI_CRON_DIR',          GLPI_VAR_DIR . '/_cron');
define('GLPI_DUMP_DIR',          GLPI_VAR_DIR . '/_dumps');
define('GLPI_GRAPH_DIR',         GLPI_VAR_DIR . '/_graphs');
define('GLPI_LOCAL_I18N_DIR',    GLPI_VAR_DIR . '/_locales');
define('GLPI_LOCK_DIR',          GLPI_VAR_DIR . '/_lock');
define('GLPI_PICTURE_DIR',       GLPI_VAR_DIR . '/_pictures');
define('GLPI_PLUGIN_DOC_DIR',    GLPI_VAR_DIR . '/_plugins');
define('GLPI_RSS_DIR',           GLPI_VAR_DIR . '/_rss');
define('GLPI_SESSION_DIR',       GLPI_VAR_DIR . '/_sessions');
define('GLPI_TMP_DIR',           GLPI_VAR_DIR . '/_tmp');
define('GLPI_UPLOAD_DIR',        GLPI_VAR_DIR . '/_uploads');
define('GLPI_LOG_DIR',           '/var/log/glpi');
EOF

sudo chown www-data:www-data /var/www/glpi/inc/downstream.php /etc/glpi/local_define.php
sudo chmod 640 /var/www/glpi/inc/downstream.php /etc/glpi/local_define.php

sudo tee /etc/nginx/sites-available/glpi.conf >/dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name glpi-lab.lab.harper.local 192.168.0.231;

    root  /var/www/glpi/public;
    index index.php;

    client_max_body_size 20M;

    access_log /var/log/nginx/glpi-access.log;
    error_log  /var/log/nginx/glpi-error.log;

    # --- Ruteo: cualquier request cae al front controller (public/index.php) ---
    location / {
        try_files $uri /index.php$is_args$args;
    }

    # --- PHP-FPM: solo se ejecuta index.php (no otros .php arbitrarios) ---
    location = /index.php {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param HTTP_PROXY "";             # mitigación httpoxy
        fastcgi_read_timeout 600;
    }

    # --- Cache estático razonable para assets ---
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?|ttf)$ {
        expires 7d;
        access_log off;
        try_files $uri =404;
    }

    # --- Denegar acceso a archivos "peligrosos" ---
    location ~ /\.(?!well-known).* { deny all; }
    location ~ ^/(config|files|inc|vendor|src|tests)(/|$) { deny all; }
}
EOF

# Activar el vhost y desactivar el default.
sudo ln -sf /etc/nginx/sites-available/glpi.conf /etc/nginx/sites-enabled/glpi.conf
sudo rm -f /etc/nginx/sites-enabled/default

# Testear la sintaxis y recargar.
sudo nginx -t
sudo systemctl reload nginx

# Abrir el puerto 80 en UFW.
sudo ufw allow 80/tcp

sudo rm /var/www/glpi/install/install.php
# El directorio /install/ se conserva porque tiene otros helpers (upgrade.php, etc.).

# Cron cada minuto ejecutando el runner CLI de GLPI.
echo "* * * * * www-data /usr/bin/php /var/www/glpi/front/cron.php" | \
  sudo tee /etc/cron.d/glpi >/dev/null

sudo chmod 644 /etc/cron.d/glpi
sudo systemctl restart cron

sudo apt -y install certbot python3-certbot-nginx

sudo certbot --nginx \
  -d glpi.cliente-ejemplo.com \
  --agree-tos \
  --email ramces.batista@har-per.com \
  --no-eff-email \
  --redirect

# Verificar la renovación automática (systemd timer).
sudo systemctl list-timers | grep certbot

sudo mkdir -p /etc/nginx/ssl
sudo openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
  -keyout /etc/nginx/ssl/glpi-lab.key \
  -out    /etc/nginx/ssl/glpi-lab.crt \
  -subj "/C=DO/ST=SDO/L=SantoDomingo/O=Harper/OU=Infra/CN=glpi-lab.lab.harper.local"

# Reemplazar el vhost HTTP por uno que redirige a HTTPS + otro que sirve HTTPS.
sudo tee /etc/nginx/sites-available/glpi.conf >/dev/null <<'EOF'
# --- HTTP → HTTPS ---
server {
    listen 80;
    listen [::]:80;
    server_name glpi-lab.lab.harper.local 192.168.0.231;
    return 301 https://$host$request_uri;
}

# --- HTTPS ---
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name glpi-lab.lab.harper.local 192.168.0.231;

    ssl_certificate     /etc/nginx/ssl/glpi-lab.crt;
    ssl_certificate_key /etc/nginx/ssl/glpi-lab.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header X-Frame-Options           "SAMEORIGIN" always;
    add_header Referrer-Policy           "strict-origin-when-cross-origin" always;

    root  /var/www/glpi/public;
    index index.php;

    client_max_body_size 20M;

    access_log /var/log/nginx/glpi-ssl-access.log;
    error_log  /var/log/nginx/glpi-ssl-error.log;

    location / {
        try_files $uri /index.php$is_args$args;
    }

    location = /index.php {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param HTTP_PROXY "";
        fastcgi_read_timeout 600;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?|ttf)$ {
        expires 7d;
        access_log off;
        try_files $uri =404;
    }

    location ~ /\.(?!well-known).* { deny all; }
    location ~ ^/(config|files|inc|vendor|src|tests)(/|$) { deny all; }
}
EOF

sudo nginx -t && sudo systemctl reload nginx
sudo ufw allow 443/tcp

sudo sed -i -E 's|^;?\s*session.cookie_secure\s*=.*|session.cookie_secure = 1|' \
  /etc/php/8.3/fpm/php.ini
sudo systemctl restart php8.3-fpm

AGENT_VER="1.15"
cd /tmp
wget "https://github.com/glpi-project/glpi-agent/releases/download/${AGENT_VER}/glpi-agent_${AGENT_VER}-1_all.deb"
sudo apt -y install "./glpi-agent_${AGENT_VER}-1_all.deb"

# Configurar target = GLPI server.
sudo sed -i -E \
  -e 's|^\s*#?\s*server\s*=.*|server = https://glpi-lab.lab.harper.local/front/inventory.php|' \
  -e 's|^\s*#?\s*tag\s*=.*|tag = lab-harper|' \
  -e 's|^\s*#?\s*no-ssl-check\s*=.*|no-ssl-check = 1|' \
  /etc/glpi-agent/agent.cfg

# El "no-ssl-check = 1" es SOLO porque el lab usa cert auto-firmado.
# En cliente con Certbot, quitarlo o dejarlo en 0.

sudo systemctl enable --now glpi-agent
sudo systemctl status glpi-agent --no-pager | head -8

# Forzar un inventario manual la primera vez.
sudo glpi-agent --server=https://glpi-lab.lab.harper.local/front/inventory.php --no-ssl-check

sudo tee /usr/local/sbin/glpi-backup.sh >/dev/null <<'EOF'
#!/usr/bin/env bash
# Backup nocturno de GLPI — Harper.
# - Dump comprimido de la DB MariaDB.
# - Tar de /var/lib/glpi (files, cache, uploads).
# - Tar de /etc/glpi + /var/www/glpi/inc/downstream.php (config).
# - Retención: 14 más recientes.
set -euo pipefail

BACKUP_DIR=/var/backups/glpi
STAMP=$(date +%F_%H%M)
mkdir -p "$BACKUP_DIR"

GLPI_DB_PASS="$(cat /root/.glpi-db-pass)"

# 1) DB
mariadb-dump -u glpi -p"$GLPI_DB_PASS" \
  --single-transaction --routines --triggers --events \
  --default-character-set=utf8mb4 \
  glpi | gzip -9 > "$BACKUP_DIR/glpi-db-$STAMP.sql.gz"

# 2) Files (excluye caches efímeros)
tar -C / --exclude='var/lib/glpi/_cache' --exclude='var/lib/glpi/_tmp' \
  -czf "$BACKUP_DIR/glpi-files-$STAMP.tar.gz" var/lib/glpi 2>/dev/null

# 3) Configs (chicos, no vale la pena excluir nada)
tar -C / -czf "$BACKUP_DIR/glpi-etc-$STAMP.tar.gz" \
  etc/glpi \
  etc/nginx/sites-available/glpi.conf \
  etc/nginx/ssl 2>/dev/null || true

# 4) Retención
for pattern in glpi-db glpi-files glpi-etc; do
  ls -1t "$BACKUP_DIR"/${pattern}-*.gz 2>/dev/null | tail -n +15 | xargs -r rm --
done

logger -t glpi-backup "backup OK · $STAMP · $(du -sh $BACKUP_DIR | cut -f1)"
EOF

sudo chmod 700 /usr/local/sbin/glpi-backup.sh
sudo /usr/local/sbin/glpi-backup.sh    # test manual
ls -lh /var/backups/glpi/

sudo tee /etc/systemd/system/glpi-backup.service >/dev/null <<'EOF'
[Unit]
Description=GLPI nightly backup (DB + files + configs)
After=mariadb.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/glpi-backup.sh
EOF

sudo tee /etc/systemd/system/glpi-backup.timer >/dev/null <<'EOF'
[Unit]
Description=Trigger glpi-backup.service cada noche a las 03:00

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true
RandomizedDelaySec=5m

[Install]
WantedBy=timers.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now glpi-backup.timer
sudo systemctl list-timers glpi-backup.timer