Docker

2020-03-07 19:37:10 +00:00
parent 8ac6f701b6
commit 442eb7ebba
44 changed files with 1679 additions and 0 deletions
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# Cockpit
+echo "Installing Cockpit"
+if [ "$DISTRO" == "ubuntu" ]; then
+    echo "Ubuntu backports enabled by default"
+    
+    sudo apt-get install -y cockpit cockpit-docker
+
+elif [ "$DISTRO" == "debian" ]; then
+    sudo grep -qF "buster-backports" /etc/apt/sources.list.d/backports.list \
+    && echo "buster-backports already in sources" \
+    || echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee -a /etc/apt/sources.list.d/backports.list
+    
+    sudo apt-get install -y cockpit cockpit-docker
+
+elif [ "$DISTRO" == "raspbian" ]; then
+    
+    echo "Raspbian repos contain cockpit"
+    sudo apt-get install -y cockpit cockpit-docker
+
+fi
+
+sudo cp ./scripts/conf/cockpit.conf /etc/cockpit/cockpit.conf
+sudo systemctl restart cockpit.socket
+
+# create system cockpit user
+echo "Creating cockpit user"
+sudo useradd -s /bin/bash -d /home/cockpit -m -G sudo -p $(openssl passwd -1 "$MISTBORN_DEFAULT_PASSWORD") cockpit || true
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# Docker
+# dependencies
+echo "Installing Docker dependencies"
+sudo apt-get install -y \
+    apt-transport-https \
+    ca-certificates \
+    curl \
+    gnupg-agent \
+    software-properties-common
+
+# Docker repo key
+echo "Adding docker repository key"
+if [ "$DISTRO" == "ubuntu" ]; then
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
+elif [ "$DISTRO" == "debian" ]; then
+    curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
+elif [ "$DISTRO" == "raspbian" ]; then
+    curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg | sudo apt-key add -
+fi
+
+# Docker repo to source list
+echo "Adding docker to sources list"
+if [ "$DISTRO" == "ubuntu" ]; then
+    sudo add-apt-repository -y \
+       "deb https://download.docker.com/linux/ubuntu \
+       $(lsb_release -cs) \
+       stable"
+elif [ "$DISTRO" == "debian" ]; then
+    sudo add-apt-repository -y \
+   "deb https://download.docker.com/linux/debian \
+   $(lsb_release -cs) \
+   stable"
+elif [ "$DISTRO" == "raspbian" ]; then
+    echo "deb [arch=armhf] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") \
+     $(lsb_release -cs) stable" | \
+    sudo tee /etc/apt/sources.list.d/docker.list
+fi
+
+# install Docker
+echo "Installing docker"
+sudo apt-get update
+
+if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
+    sudo apt-get install -y docker-ce docker-ce-cli containerd.io
+elif [ "$DISTRO" == "raspbian" ]; then
+    sudo apt install -y --no-install-recommends \
+    docker-ce \
+    cgroupfs-mount
+fi
+
+# Docker group
+sudo usermod -aG docker $USER
+
+# Docker Compose
+echo "Installing Docker Compose"
+#if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
+#    sudo curl -L "https://github.com/docker/compose/releases/download/1.24.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+#    sudo chmod +x /usr/local/bin/docker-compose
+#elif [ "$DISTRO" == "raspbian" ]; then
+# Install required packages
+sudo apt update
+sudo apt install -y python python3-pip libffi-dev python-backports.ssl-match-hostname
+
+# Install Docker Compose from pip
+# This might take a while
+sudo pip3 install docker-compose
+#fi
+
@@ -0,0 +1,64 @@
+#!/bin/sh
+
+# generate production .env file for Django
+mkdir -p ./.envs/.production
+DJANGO_PROD_FILE="./.envs/.production/.django"
+DJANGO_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
+#CELERY_FLOWER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+MISTBORN_DEFAULT_PASSWORD="$1"
+echo "DJANGO_SETTINGS_MODULE=config.settings.production" > $DJANGO_PROD_FILE
+echo "DJANGO_SECRET_KEY=$DJANGO_SECRET_KEY" >> $DJANGO_PROD_FILE
+echo "DJANGO_ADMIN_URL=admin/" >> $DJANGO_PROD_FILE
+echo "USE_DOCKER=yes" >> $DJANGO_PROD_FILE
+echo "REDIS_URL=redis://redis:6379/0" >> $DJANGO_PROD_FILE
+echo "CELERY_FLOWER_USER=prod" >> $DJANGO_PROD_FILE
+echo "CELERY_FLOWER_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $DJANGO_PROD_FILE
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $DJANGO_PROD_FILE
+echo "#MAILGUN_API_KEY=" >> $DJANGO_PROD_FILE
+echo "#MAILGUN_API_URL=" >> $DJANGO_PROD_FILE
+echo "#SENTRY_DNS=" >> $DJANGO_PROD_FILE
+
+# generate production .env file for postgresql
+POSTGRES_PROD_FILE="./.envs/.production/.postgres"
+POSTGRES_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+echo "POSTGRES_HOST=postgres" > $POSTGRES_PROD_FILE
+echo "POSTGRES_PORT=5432" >> $POSTGRES_PROD_FILE
+echo "POSTGRES_DB=mistborn" >> $POSTGRES_PROD_FILE
+echo "POSTGRES_USER=prod" >> $POSTGRES_PROD_FILE
+echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> $POSTGRES_PROD_FILE
+
+
+# generate production .env file for pihole
+PIHOLE_PROD_FILE="./.envs/.production/.pihole"
+#WEBPASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+WEBPASSWORD="$1"
+echo "TZ=\"America/New York\"" > $PIHOLE_PROD_FILE
+echo "WEBPASSWORD=$WEBPASSWORD" >> $PIHOLE_PROD_FILE
+
+# generate rocketchat .env files
+ROCKETCHAT_PROD_FILE="./.envs/.production/.rocketchat"
+#ROCKETCHAT_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+ROCKETCHAT_PASSWORD="$1"
+echo "ROCKETCHAT_USER=bot" > $ROCKETCHAT_PROD_FILE
+echo "ROCKETCHAT_ROOM=GENERAL" >> $ROCKETCHAT_PROD_FILE
+echo "BOT_NAME=bot" >> $ROCKETCHAT_PROD_FILE
+echo "ROCKETCHAT_PASSWORD=$ROCKETCHAT_PASSWORD" >> $ROCKETCHAT_PROD_FILE
+
+# generate nextcloud .env files
+NEXTCLOUD_PROD_FILE="./.envs/.production/.nextcloud"
+#NEXTCLOUD_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+NEXTCLOUD_PASSWORD="$1"
+echo "NEXTCLOUD_ADMIN_USER=mistborn" > $NEXTCLOUD_PROD_FILE
+echo "NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_PASSWORD" >> $NEXTCLOUD_PROD_FILE
+echo "NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.mistborn" >> $NEXTCLOUD_PROD_FILE
+
+# generate onlyoffice .env files
+ONLYOFFICE_PROD_FILE="./.envs/.production/.onlyoffice"
+JWT_SECRET="$1"
+echo "JWT_ENABLED=true" > $ONLYOFFICE_PROD_FILE
+echo "JWT_SECRET=$JWT_SECRET" >> $ONLYOFFICE_PROD_FILE
+
+# generate bitwarden .env files
+BITWARDEN_PROD_FILE="./.envs/.production/.bitwarden"
+echo "WEBSOCKET_ENABLED=true" > $BITWARDEN_PROD_FILE
+echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
@@ -0,0 +1,119 @@
+#!/bin/bash
+
+set -e
+
+
+echo "stop iptables wrappers"
+if [ "$DISTRO" == "ubuntu" ]; then
+    # Disable UFW
+    sudo systemctl stop ufw || true
+    sudo systemctl disable ufw || true
+fi
+
+# default interface
+iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk '{print $2}')
+
+# real public interface
+riface=$(ip -o -4 route get 1.1.1.1 | egrep -o 'dev [^ ]*' | awk '{print $2}')
+
+# resetting iptables
+sudo iptables -F
+sudo iptables -t nat -F
+sudo iptables -X MISTBORN_LOG_DROP 2>/dev/null || true
+sudo iptables -X MISTBORN_WIREGUARD_INPUT 2>/dev/null || true
+sudo iptables -X MISTBORN_WIREGUARD_FORWARD 2>/dev/null || true
+sudo iptables -X MISTBORN_DOCKER_INPUT 2>/dev/null || true
+
+# iptables: log and drop chain
+sudo iptables -N MISTBORN_LOG_DROP
+sudo iptables -A MISTBORN_LOG_DROP -m limit --limit 2/min -j LOG --log-prefix "[IPTables-Dropped]: " --log-level 4
+sudo iptables -A MISTBORN_LOG_DROP -j DROP
+
+# wireguard rules chains
+sudo iptables -N MISTBORN_WIREGUARD_INPUT
+sudo iptables -N MISTBORN_WIREGUARD_FORWARD
+
+# iptables
+echo "Setting iptables rules"
+sudo iptables -P INPUT ACCEPT
+sudo iptables -I INPUT -i lo -j ACCEPT
+sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# if installing over SSH, add SSH rule
+if [ ! -z "${SSH_CLIENT}" ]; then
+    SSH_SRC=$(echo $SSH_CLIENT | awk '{print $1}')
+    sudo iptables -A INPUT -p tcp -s $SSH_SRC --dport 22 -j ACCEPT
+fi
+
+# docker rules
+sudo iptables -N MISTBORN_DOCKER_INPUT
+sudo iptables -A MISTBORN_DOCKER_INPUT -i br-+ -j ACCEPT
+#sudo iptables -A INPUT ! -i $iface -s 172.16.0.0/12 -j ACCEPT
+
+# last rules
+sudo iptables -A INPUT -j MISTBORN_DOCKER_INPUT
+sudo iptables -A INPUT -j MISTBORN_WIREGUARD_INPUT
+sudo iptables -A INPUT -j MISTBORN_LOG_DROP
+sudo iptables -A FORWARD -j MISTBORN_WIREGUARD_FORWARD
+
+sudo iptables -P INPUT DROP
+sudo iptables -P FORWARD DROP
+sudo iptables -P OUTPUT ACCEPT
+
+#if [ "$iface" == "$riface" ]; then
+sudo iptables -t nat -I POSTROUTING -o $iface -j MASQUERADE
+#else
+#    sudo iptables -t nat -I POSTROUTING -o $iface -j MASQUERADE
+#    sudo iptables -t nat -I POSTROUTING -o $riface -j MASQUERADE
+#fi
+
+# resetting ip6tables rules
+sudo ip6tables -F
+sudo ip6tables -t nat -F
+sudo ip6tables -X MISTBORN_LOG_DROP 2>/dev/null || true
+
+# ip6tables: log and drop chain
+sudo ip6tables -N MISTBORN_LOG_DROP
+sudo ip6tables -A MISTBORN_LOG_DROP -m limit --limit 6/min -j LOG --log-prefix "[IPTables-Dropped]: " --log-level 4
+sudo ip6tables -A MISTBORN_LOG_DROP -j DROP
+
+# ip6tables
+echo "Setting ip6tables rules"
+sudo ip6tables -P INPUT ACCEPT
+sudo ip6tables -I INPUT -i lo -j ACCEPT
+sudo ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+sudo ip6tables -A INPUT -j MISTBORN_LOG_DROP
+
+sudo ip6tables -P INPUT DROP
+sudo ip6tables -P FORWARD DROP
+sudo ip6tables -P OUTPUT ACCEPT
+
+
+# initial load update package list
+sudo apt-get update
+
+# iptables-persistent
+if [ ! "$(dpkg-query -l iptables-persistent)" ]; then
+    echo "Installing iptables-persistent"
+    
+    # answer variables
+    echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections
+    echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections
+    
+    # install
+    sudo apt-get install -y iptables-persistent ipset
+else
+    echo "Saving iptables rules"
+    sudo bash -c "iptables-save > /etc/iptables/rules.v4"
+    echo "Saving ip6tables rules"
+    sudo bash -c "ip6tables-save > /etc/iptables/rules.v6"
+fi
+
+# IP forwarding
+sudo sed -i 's/.*net.ipv4.ip_forward.*/net.ipv4.ip_forward=1/' /etc/sysctl.conf
+sudo sysctl -p /etc/sysctl.conf
+
+# rsyslog to create /var/log/iptables.log
+sudo cp ./scripts/conf/15-iptables.conf /etc/rsyslog.d/
+sudo chown root:root /etc/rsyslog.d/15-iptables.conf
+sudo systemctl restart rsyslog
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Wireguard
+if [ "$DISTRO" == "raspbian" ]; then
+    echo "Adding Wireguard repo keys"
+    sudo apt-get install -y dirmngr
+    sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8B48AD6246925553
+    sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7638D0442B90D010
+    sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC
+fi
+
+echo "Installing Wireguard"
+if [ "$DISTRO" == "ubuntu" ]; then
+    # Ubuntu	
+    sudo add-apt-repository -y ppa:wireguard/wireguard
+elif [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ]; then
+    # Debian
+    sudo bash -c 'echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list'
+    sudo bash -c "printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable"
+fi
+sudo apt-get update
+sudo apt-get install -y openresolv wireguard