6.1 KiB
layout, title, date, categories, highlight
| layout | title | date | categories | highlight | |
|---|---|---|---|---|---|
| post | ThinkCentre M720q + Debian: 24/7 Server Setup Step 1 | 2025-12-31 22:00:00 -0400 |
|
true |
I recently picked up 3 refurbished Lenovo ThinkCentre M720q Tiny to migrate my Kubernetes cluster from AWS and slash my EKS costs. These machines are great for being silent and power-efficient, but out of the box, they're tuned as office desktops, not as high-availability server racks. Here's how I configured the hardware and OS settings to make this 3-node cluster production-ready.
Not the cleanest setup, no cable management, servers upside down, stickers still on, no room for ventilation, and they
have too much wiggle room in the rack, but the software is sound and that's 90% of the work done :D
The Hardware Stack
Before diving into the configuration, here is the spec sheet for each node in the cluster. These units feature Intel vPro and ThinkCentre BIOS, which is essential for the advanced BIOS settings that we are about to toggle:
- CPU: Intel(R) Core(TM) i7-7700 @ 3.60GHz (4 Cores / 8 Threads)
- RAM: 16GB DDR4
- Storage: 500GB SSD
- Network: Dedicated 5-port 1Gbps Ethernet Switch
- Wattage: 65W
For this setup, we will not take advantage of vPro's features such as accessing the BIOS over the network, but we will take advantage of features that come with ThinkCentre BIOS such as the auto-power on after a power loss.
ThinkCentre M720q: Node Configuration
1. Initial Verification
- Enter BIOS: Press repeatedly the F1 key.
- Hardware Audit: Confirm the CPU, RAM, and Storage match what is expected. Reset BIOS to default settings if it's the first time.
- Set the Standard: Set the system clock to UTC if it's not the case. This is necessary for Kubernetes because it ensures that logs from different nodes align perfectly regardless of local time zones.
2. Hardware Decoupling
We want to strip away desktop features to save power and reduce the potential attack surface.
| Menu Path | Setting | Action | Why |
|---|---|---|---|
| Devices > Audio Setup | Integrated Audio | Disabled | Servers don't need sound |
| Devices > Network Setup | Wi-Fi / BT / PXE | Disabled | Forces the node to rely on the Onboard Ethernet. |
| Devices > USB Setup | USB Legacy Support | Disabled | Prevents the use of less secure USB protocols during boot. |
| Power | After Power Loss | Power On | The Auto-Restart rule. |
| Power | Intelligent Cooling | Performance or Acoustic | Either to prevent thermal throttling or lower noise. |
3. Security Governance
| Menu Path | Setting | Action | Why |
|---|---|---|---|
| Security | Administrator Password | Set | Prevents tampering with the BIOS settings. |
| Security | Windows UEFI Update | Disabled | We are replacing Windows with Debian. |
| Security | Password for F1/F12 | Yes | Requires your admin password to boot from an unauthorized USB. |
| Security | POP Changeable by User | No | Requires your admin to change his password. |
| Security | Secure Boot | Enabled | Verifies the Debian kernel signature before allowing it to boot. |
4. Boot Sequence
Startup > Boot Sequence: Move the drive(s) to the #1 spot (prioritize the one storing the OS Bootloader). Exclude everything else. Startup > CSM: must be disabled to restrict non-UEFI operating systems.
5. Post-Install
Once Debian is running, we need to tell the OS to take ownership of the hardware management. In a better world, we prefer to take full ownership ourselves using CoreBoot. But we cannot because Intel Boot Guard is supported on the hardware level. Since Lenovo ships these with Intel Boot Guard (Verified Boot) enabled, we must work within the manufacturer's ecosystem.
Synchronize the Hardware Clock
This command tells Debian to treat the motherboard's clock as UTC (the server standard).
sudo timedatectl set-local-rtc 0
Enable Linux-Native Firmware Updates
We disabled the Windows update hook in the BIOS; now we replace it with the Linux Vendor Firmware Service (LVFS). This allows you to update your BIOS directly from the Debian terminal.
sudo apt update && sudo apt install fwupd -y
fwupd does not download and auto-install updates like Windows. To list new available firmware from Lenovo/Intel, run:
fwupdmgr refresh && fwupdmgr get-updates
Note: You should only run fwupdmgr update during a scheduled maintenance window. BIOS updates take 2–5 minutes,
during which the node is completely unresponsive and will reboot automatically.
OS Updates & Cluster Maintenance
While fwupd handles the hardware, apt handles the OS. Debian 13 point releases (e.g., 13.2 to 13.3) are
security-focused and will not auto-install by default.
For a Kubernetes cluster, you should always perform "Rolling Updates." This means you drain one node at a time to ensure your pods are rescheduled elsewhere before you perform the upgrade and reboot.
During a scheduled maintenance window:
- Drain the node:
kubectl drain <node-name> --ignore-daemonsets - Upgrade OS:
sudo apt update && sudo apt upgrade -y - Upgrade Firmware:
fwupdmgr update(if applicable) - Reboot:
sudo reboot - Bring it back:
kubectl uncordon <node-name>
Next step, we will set up the firewall, ssh rules, and a custom vpn via an ec2 proxy server with a static IP.