crappyrules/mistborn
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'master' into onlyoffice

Browse Source
This commit is contained in:
Steven Foerster
2020-07-30 11:51:01 -04:00
parent 61b0b43143 fe36dff1b9
commit d2c0c22e6f
20 changed files with 182 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/env/setup.sh
Vendored
+4 -4
View File
@@ -4,10 +4,10 @@ VAR_FILE=/opt/mistborn/.env
source /opt/mistborn/scripts/subinstallers/platform.sh
MISTBORN_DNS_BIND_IP="0.0.0.0"
if [ "$DISTRO" == "ubuntu" ] && [ "$VERSION_ID" == "20.04" ]; then
MISTBORN_DNS_BIND_IP="10.2.3.1"
fi
MISTBORN_DNS_BIND_IP="10.2.3.1"
#if [ "$DISTRO" == "ubuntu" ] && [ "$VERSION_ID" == "20.04" ]; then
# MISTBORN_DNS_BIND_IP="10.2.3.1"
#fi
echo "MISTBORN_DNS_BIND_IP=${MISTBORN_DNS_BIND_IP}" | sudo tee ${VAR_FILE}
sudo chown mistborn:mistborn ${VAR_FILE}
scripts/install.sh
+17 -8
View File
@@ -2,6 +2,8 @@
set -e
export DEBIAN_FRONTEND=noninteractive
## ensure run as nonroot user
#if [ "$EUID" -eq 0 ]; then
MISTBORN_USER="mistborn"
@@ -97,7 +99,7 @@ git submodule update --init --recursive
sudo apt-get update
# install figlet
sudo apt-get install -y figlet
sudo -E apt-get install -y figlet
# get os and distro
source ./scripts/subinstallers/platform.sh
@@ -114,22 +116,24 @@ fi
# SSH Server
sudo apt-get install -y openssh-server
sudo -E apt-get install -y openssh-server
sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
sudo sed -i 's/PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sudo sed -i 's/PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sudo sed -i 's/#Port.*/Port 22/' /etc/ssh/sshd_config
sudo sed -i 's/Port.*/Port 22/' /etc/ssh/sshd_config
sudo systemctl enable ssh
sudo systemctl restart ssh
# Additional tools fail2ban
sudo apt-get install -y dnsutils fail2ban
sudo -E apt-get install -y dnsutils fail2ban
# Install kernel headers
if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
sudo apt install -y linux-headers-$(uname -r)
sudo -E apt install -y linux-headers-$(uname -r)
elif [ "$DISTRO" == "raspbian" ]; then
sudo apt-get install -y raspberrypi-kernel-headers
sudo -E apt install -y raspberrypi-kernel-headers
fi
# Wireugard
@@ -141,13 +145,16 @@ sudo systemctl enable docker
sudo systemctl start docker
# Unattended upgrades
sudo apt-get install -y unattended-upgrades
sudo -E apt-get install -y unattended-upgrades
# Cockpit
if [[ "$MISTBORN_INSTALL_COCKPIT" =~ ^([yY][eE][sS]|[yY])$ ]]
then
# install cockpit
source ./scripts/subinstallers/cockpit.sh
# set variable (that will be available in environment)
MISTBORN_INSTALL_COCKPIT=Y
fi
# Mistborn-cli (pip3 installed by docker)
@@ -199,6 +206,7 @@ sudo mkdir -p ../mistborn_volumes/extra
# Traefik final setup (cockpit)
cp ./compose/production/traefik/traefik.toml.template ./compose/production/traefik/traefik.toml
# setup tls certs
source ./scripts/subinstallers/openssl.sh
sudo rm -rf ../mistborn_volumes/base/tls
@@ -225,8 +233,9 @@ sudo grep -qF "$(hostname)" /etc/hosts && echo "$(hostname) already in /etc/host
echo "address=/.mistborn/10.2.3.1" | sudo tee ../mistborn_volumes/base/pihole/etc-dnsmasqd/02-lan.conf
# ResolvConf (OpenResolv installed with Wireguard)
sudo sed -i "s/#name_servers.*/name_servers=$IPV4_PUBLIC/" /etc/resolvconf.conf
sudo sed -i "s/name_servers.*/name_servers=$IPV4_PUBLIC/" /etc/resolvconf.conf
#sudo sed -i "s/#name_servers.*/name_servers=$IPV4_PUBLIC/" /etc/resolvconf.conf
sudo sed -i "s/#name_servers.*/name_servers=10.2.3.1/" /etc/resolvconf.conf
sudo sed -i "s/name_servers.*/name_servers=10.2.3.1/" /etc/resolvconf.conf
#sudo sed -i "s/#name_servers.*/name_servers=127.0.0.1/" /etc/resolvconf.conf
sudo resolvconf -u 1>/dev/null 2>&1
scripts/noninteractive/.install_barebones
+2
View File
@@ -0,0 +1,2 @@
export MISTBORN_DEFAULT_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(20)]))")
export MISTBORN_INSTALL_COCKPIT=No
scripts/services/Mistborn-base.service
+7 -7
View File
@@ -14,13 +14,13 @@ ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml down
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
ExecStartPre=-/sbin/ip address add 10.2.3.1/30 dev DIFACE
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 80 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 443 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 5555 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -A OUTPUT -o DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/ip6tables -A OUTPUT -p udp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 80 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 443 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 5555 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -A OUTPUT -o DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/ip6tables -w -A OUTPUT -p udp --dport 53 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/resolvconf -u
# Start container when unit is started
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml up
scripts/services/Mistborn-bitwarden.service
+1 -1
View File
@@ -11,7 +11,7 @@ PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml down
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml up --build
# Stop container when unit is stopped
scripts/services/Mistborn-jitsi.service
+2 -2
View File
@@ -13,8 +13,8 @@ EnvironmentFile=/opt/mistborn/.envs/.production/.jitsi
# Shutdown container (if running) when unit is stopped
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build
# Stop container when unit is stopped
scripts/services/Mistborn-rocketchat.service
+1 -1
View File
@@ -11,7 +11,7 @@ PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml down
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml up --build
# Stop container when unit is stopped
scripts/services/Mistborn-syncthing.service
+2 -2
View File
@@ -11,8 +11,8 @@ PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml down
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml up --build
# Stop container when unit is stopped
scripts/services/Mistborn-tor.service
+1 -1
View File
@@ -11,7 +11,7 @@ PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml down
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml up --build
# Stop container when unit is stopped
scripts/subinstallers/cockpit.sh
+7 -4
View File
@@ -4,22 +4,25 @@
figlet "Mistborn: Installing Cockpit"
if [ "$DISTRO" == "ubuntu" ]; then
echo "Ubuntu backports enabled by default"
sudo apt-get install -y cockpit cockpit-docker
elif [ "$DISTRO" == "debian" ]; then
sudo grep -qF "buster-backports" /etc/apt/sources.list.d/backports.list \
&& echo "buster-backports already in sources" \
|| echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee -a /etc/apt/sources.list.d/backports.list
sudo apt-get install -y cockpit cockpit-docker
elif [ "$DISTRO" == "raspbian" ]; then
echo "Raspbian repos contain cockpit"
sudo apt-get install -y cockpit cockpit-docker
fi
sudo -E apt-get install -y cockpit
if $(sudo apt-cache show cockpit-docker > /dev/null 2>&1) ; then
# no longer supported upstream in Ubuntu 20.04
sudo -E apt-get install -y cockpit-docker
fi
sudo cp ./scripts/conf/cockpit.conf /etc/cockpit/cockpit.conf
sudo systemctl restart cockpit.socket
scripts/subinstallers/docker.sh
+2 -2
View File
@@ -4,11 +4,11 @@
figlet "Mistborn: Installing Docker"
sudo apt update
sudo apt install -y python python3-pip python3-setuptools libffi-dev python3-dev libssl-dev
sudo -E apt install -y python python3-pip python3-setuptools libffi-dev python3-dev libssl-dev
if [ "$DISTRO" == "ubuntu" ] && [ "$VERSION_ID" == "20.04" ]; then
echo "Automated Docker install"
sudo apt-get install -y docker-compose
sudo -E apt-get install -y docker-compose
else
echo "Manual Docker installation"
source ./scripts/subinstallers/docker_manual.sh
scripts/subinstallers/docker_manual.sh
+4 -4
View File
@@ -2,7 +2,7 @@
# dependencies
echo "Installing Docker dependencies"
sudo apt-get install -y \
sudo -E apt-get install -y \
apt-transport-https \
ca-certificates \
curl \
@@ -42,9 +42,9 @@ echo "Installing docker"
sudo apt-get update
if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
sudo apt-get install -y docker-ce docker-ce-cli containerd.io
sudo -E apt-get install -y docker-ce docker-ce-cli containerd.io
elif [ "$DISTRO" == "raspbian" ]; then
sudo apt install -y --no-install-recommends \
sudo -E apt install -y --no-install-recommends \
docker-ce \
cgroupfs-mount
fi
@@ -59,7 +59,7 @@ echo "Installing Docker Compose"
# sudo chmod +x /usr/local/bin/docker-compose
#elif [ "$DISTRO" == "raspbian" ]; then
# Install required packages
sudo apt install -y python-backports.ssl-match-hostname
sudo -E apt install -y python-backports.ssl-match-hostname
# Install Docker Compose from pip
# This might take a while
scripts/subinstallers/gen_prod_env.sh
+3
View File
@@ -19,6 +19,9 @@ echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $DJANGO_PROD_FILE
echo "#MAILGUN_API_KEY=" >> $DJANGO_PROD_FILE
echo "#MAILGUN_API_URL=" >> $DJANGO_PROD_FILE
echo "#SENTRY_DNS=" >> $DJANGO_PROD_FILE
echo "MISTBORN_INSTALL_COCKPIT=$MISTBORN_INSTALL_COCKPIT" >> $DJANGO_PROD_FILE
echo "MISTBORN_PORTAL_IP=10.2.3.1" >> $DJANGO_PROD_FILE
echo "MISTBORN_PORTAL_PORT=5000" >> $DJANGO_PROD_FILE
# generate production .env file for postgresql
POSTGRES_PROD_FILE="./.envs/.production/.postgres"
scripts/subinstallers/iptables.sh
+3 -2
View File
@@ -46,7 +46,8 @@ sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# if installing over SSH, add SSH rule
if [ ! -z "${SSH_CLIENT}" ]; then
SSH_SRC=$(echo $SSH_CLIENT | awk '{print $1}')
sudo iptables -A INPUT -p tcp -s $SSH_SRC --dport 22 -j ACCEPT
SSH_PRT=$(echo $SSH_CLIENT | awk '{print $3}')
sudo iptables -A INPUT -p tcp -s $SSH_SRC --dport $SSH_PRT -j ACCEPT
fi
# docker rules
@@ -102,7 +103,7 @@ if [ ! "$(dpkg-query -l iptables-persistent)" ]; then
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections
# install
sudo apt-get install -y iptables-persistent ipset
sudo -E apt-get install -y iptables-persistent ipset
else
echo "Saving iptables rules"
sudo bash -c "iptables-save > /etc/iptables/rules.v4"
scripts/subinstallers/openssl.sh
+1 -1
View File
@@ -8,7 +8,7 @@ CRT_PATH="$KEY_FOLDER/$CRT_FILE"
KEY_PATH="$KEY_FOLDER/$KEY_FILE"
# ensure openssl installed
sudo apt-get install -y openssl
sudo -E apt-get install -y openssl
# make folder
mkdir -p $KEY_FOLDER
scripts/subinstallers/wireguard.sh
+2 -2
View File
@@ -11,7 +11,7 @@ if ! $(sudo apt-cache show wireguard > /dev/null 2>&1) ; then
# Wireguard
if [ "$DISTRO" == "raspbian" ]; then
echo "Adding Wireguard repo keys"
sudo apt-get install -y dirmngr
sudo -E apt-get install -y dirmngr
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8B48AD6246925553
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7638D0442B90D010
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC
@@ -29,4 +29,4 @@ fi
echo "Installing Wireguard"
sudo apt-get update
sudo apt-get install -y openresolv wireguard
sudo -E apt-get install -y openresolv wireguard
scripts/update.sh
+6
View File
@@ -2,17 +2,23 @@
set -e
export DEBIAN_FRONTEND=noninteractive
sudo git -C /opt/mistborn pull
sudo git -C /opt/mistborn submodule update --init --recursive
# ensure mistborn-cli is installed
sudo pip3 install -e /opt/mistborn/modules/mistborn-cli
# handle updates to Mistborn systemd scripts
iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=mistborn/"
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
# handle updates to traefik
sudo cp /opt/mistborn/compose/production/traefik/traefik.toml.template /opt/mistborn/compose/production/traefik/traefik.toml
sudo systemctl daemon-reload
sudo systemctl enable Mistborn-setup.service
sudo systemctl restart Mistborn-setup.service