suricata rsyslog

put off docker rules
MISTBORN-DOCKER-USER chain
2021-02-22 19:42:12 -05:00 · 2021-02-22 18:11:38 -05:00 · 2021-02-22 17:07:02 -05:00 · 2021-02-20 12:40:47 -05:00 · 2021-02-20 12:37:00 -05:00 · 2021-02-20 12:33:22 -05:00
79 changed files with 258 additions and 2461 deletions
@@ -39,7 +39,6 @@ These tools are not vital to Mistborn itself but are integrated to enhance secur
 - [Pi-hole](https://pi-hole.net): A DNS server for network-wide ad blocking, etc
 - [DNScrypt](https://www.dnscrypt.org): prevents DNS spoofing via cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered
 - [Traefik](https://docs.traefik.io): A modern, efficient reverse-proxy
- [Wazuh](https://wazuh.com/): Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.

 Within Mistborn is a panel to enable and manage these free extra services (off by default), locally hosted in Docker containers:
 - [Home Assistant](https://www.home-assistant.io): Open source home automation that puts local control and privacy first
@@ -51,8 +50,6 @@ Within Mistborn is a panel to enable and manage these free extra services (off b
 - [Jellyfin](https://jellyfin.org): The Free Media Software System.
 - [Tor](https://www.torproject.org): The Onion Router. One tool in the arsenal of online security and privacy.
 - [Jitsi](https://jitsi.org): Multi-platform open-source video conferencing
- [Guacamole](https://guacamole.apache.org): A clientless remote desktop gateway that supports standard protocols like VNC, RDP, and SSH.
- [RaspAP](https://raspap.com/): The easiest, full-featured wireless router setup for Debian-based devices. Period. (Mistborn integration in alpha testing).

 # Quickstart
 Tested Operating Systems (in order of thoroughness):
@@ -72,7 +69,7 @@ The Mistborn docker images exist for these architectures:

 | Mistborn Docker Images (hub.docker.com)        | Architectures       |
 |------------------------------------------------|---------------------|
-| mistborn (django, celery{worker,beat})         | amd64, arm64, arm/v7 |
+| mistborn (django, celery{worker,beat}, flower) | amd64, arm64, arm/v7 |
 | dnscrypt-proxy                                 | amd64, arm64, arm/v7 |

 Recommended System Specifications:
@@ -83,7 +80,6 @@ Recommended System Specifications:
 | Default                | Bare bones + Cockpit                                                          | 2 GB+ | 15 GB     |
 | Low-resource services  | Default + Bitwarden, Tor, Syncthing                                           | 4 GB  | 20 GB     |
 | High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 6 GB+ | 25 GB+    |
-| SIEM                   | Default + Wazuh + Extras                                                      | 16 GB+ | 100 GB+   |

 Starting from base installation
 ```
@@ -111,18 +107,6 @@ Mistborn protects your data in a variety of ways:

 See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki page to see more network diagrams and the network scan results for Mistborn.

-# Security Information & Event Management (SIEM)
-
-![Mistborn Security Center](https://gitlab.com/cyber5k/public/-/raw/master/graphics/home.mistborn_soc.png)
-
-The Mistborn Security Operations Center provides SIEM services with Wazuh. The Wazuh Manager requires an Open Distro for Elasticsearch backend. When the Mistborn host has >8 GB RAM the provided Elasticsearch backend can be used. Just click "Start Wazuh" on the `Security Center` page and enjoy your Enterprise-grade SIEM. Wazuh agents can be installed on just about any OS and all Wazuh agent traffic is communicated over the Wireguard connections. Instructions for adding endpoint agents can be found within Wazuh itself.
-
-![Mistborn Security Center: Wazuh Modules](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_modules.png)
-
-The Wazuh Kibana plugin leverages the power of Elasticsearch:
-
-![Mistborn Security Center: Wazuh Dashboard](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_se_dashboard.png)
-
 # Coppercloud
 Pihole provides a way to block outgoing DNS requests for given lists of blocked domains. Coppercloud provides a way to block outgoing network calls of all types to given lists of IP addresses (IPv4 only for now). This is especially useful for blocking outgoing telemetry (data and state sharing) to owners of software running on all of your devices.

@@ -143,15 +127,6 @@ In Mistborn, Gateways are upstream from the VPN server so connections to third-p

 The Gateway adds an extra network hop. DNS is still resolved in Mistborn so pihole is still blocking ads.

-# Remote Desktop
-Remote desktops enable multiple users to share desktop resources and data. Remote desktops also enable groups to prevent sensitive data from ever entering an endpoint devices such as a smartphone. For reference, some United States Government regulations require controls to protect Controlled Unclassified Information (CUI) that are not feasible to implement on all endpoint devices and remote desktops prevent the data from entering the device (see NIST SP 800-171 3.1.19, CMMC AC.3.022).
-
-Mistborn enables remote desktop access via the Apache Guacamole extra service, which supports VNC, RDP, SSH, and other protocols. 
-
-![Guacamole Recent Connections](https://gitlab.com/cyber5k/public/-/raw/master/graphics/guacamole_connections.png)
-
-Guacamole implements its own users and groups access controls to manage access to individual desktops. All Mistborn users must be authenticated with Mistborn (via Wireguard only or MFA) to access the Guacamole interface.
-
 # Client to client communication
 By default direct communication between network clients is blocked. Mistborn clients can all talk to Mistborn and communicate via shared services (Jitsi, Nextcloud, etc). Direct client to client communication can be enabled via the "client-to-client" toggle.

@@ -302,9 +277,6 @@ Mistborn uses the following domains (that can be reached by all Wireguard client
 | Syncthing | syncthing.mistborn | Off |
 | OnlyOffice | onlyoffice.mistborn | Off |
 | Jitsi | jitsi.mistborn | Off |
-| Guacamole | guac.mistborn | Off |
-| RaspAP | raspap.mistborn | Off |
-| Wazuh | wazuh.mistborn | Off |

 # Default Credentials
 These are the default credentials to use in the services you choose to use:
@@ -313,10 +285,7 @@ These are the default credentials to use in the services you choose to use:
 | ------- | -------- | -------- |
 | Pihole |  | {{default mistborn password}} |
 | Cockpit | cockpit | {{default mistborn password}} |
-| Wazuh | mistborn | {{default mistborn password}} |
 | Nextcloud | mistborn | {{default mistborn password}} |
-| Guacamole | mistborn | {{default mistborn password }} |
-| RaspAP | mistborn | {{default mistborn password}} |

 You can find the credentials sent to the Docker containers in: `/opt/mistborn/.envs/.production/`

@@ -363,7 +332,7 @@ But wait, there's more! You can:
 | Jitsi Meet     | [Jitsi Meet](https://play.google.com/store/apps/details?id=org.jitsi.meet)                         | [Jitsi Meet](https://apps.apple.com/us/app/jitsi-meet/id1165103905)                |
 | Bitwarden      | [Bitwarden](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden)                     | [Bitwarden](https://apps.apple.com/us/app/bitwarden-password-manager/id1137397744) |
 | Jellyfin       | [Jellyfin](https://play.google.com/store/apps/details?id=org.jellyfin.mobile)                      | [Jellyfin](https://apps.apple.com/us/app/jellyfin-mobile/id1480192618)             |
-| Home Assistant | [Home Assistant](https://play.google.com/store/apps/details?id=io.homeassistant.companion.android) | [Home Assistant](https://apps.apple.com/us/app/home-assistant/id1099568401)                                                                                   |
+| Home Assistant | [Home Assistant](https://play.google.com/store/apps/details?id=io.homeassistant.companion.android) |                                                                                    |
 | Rocket.Chat    | [Rocket.Chat](https://play.google.com/store/apps/details?id=chat.rocket.android)                   | [Rocket.Chat](https://apps.apple.com/us/app/rocket-chat/id1148741252)              |

 ## TLS Certificate
@@ -476,12 +445,9 @@ sudo journalctl -xfu Mistborn-syncthing
 sudo journalctl -xfu Mistborn-jellyfin
 sudo journalctl -xfu Mistborn-nextcloud
 sudo journalctl -xfu Mistborn-jitsi
-sudo journalctl -xfu Mistborn-guacamole
 sudo journalctl -xfu Mistborn-rocketchat
 sudo journalctl -xfu Mistborn-onlyoffice
 sudo journalctl -xfu Mistborn-tor
-sudo journalctl -xfu Mistborn-raspap
-sudo journalctl -xfu Mistborn-wazuh
 ```

 ## Troubleshooting Docker
@@ -539,7 +505,6 @@ See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/
 - The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 397 days. The certificate is checked daily and will regenerate when expiration is within 30 days.
 - Outbound UDP on port 53 is blocked. All DNS requests should be handled by the dnscrypt_proxy service and if any client, service, etc. tries to circumvent that it is blocked.
 - Unattended upgrades are set to automatically install operating system security updates.
- Ownership of mistborn files is set to the system mistborn user and access to environment variables is disabled for users other than the owner.

 # Roadmap (not necessarily in order)
 Many features and refinements are in the works at various stages including:
@@ -547,6 +512,8 @@ Many features and refinements are in the works at various stages including:
 - Plugins for Extra Services (enabling third-party development)
 - Plugin repository
 - IPv6 support
+- Integration with RaspAP to enable managing an Access Point for local network connections
+- Internal network scan tool and feedback
 - Anomaly detection in network traffic

 # Featured In
@@ -55,6 +55,7 @@ services:
    container_name: mistborn_production_traefik
    depends_on:
      - django
+      - redis
    volumes:
      #- production_traefik:/etc/traefik/acme
      - ./compose/production/traefik/dynamic.toml:/dynamic.toml:ro
@@ -144,7 +145,6 @@ services:
    command: /start-celerybeat
    restart: unless-stopped
    
-
  # flower:
  #   image: "cyber5k/mistborn:${MISTBORN_TAG}"
  #   container_name: mistborn_production_flower
@@ -158,9 +158,9 @@ services:
  
  pihole:
   container_name: mistborn_production_pihole
-   image: pihole/pihole:v5.7
+   image: pihole/pihole:v5.5.1
   env_file:
-     - ./.envs/.production/.pihole
+     - /opt/mistborn_volumes/base/base.txt
   ports:
     - "${MISTBORN_DNS_BIND_IP}:53:53/tcp"
     - "${MISTBORN_DNS_BIND_IP}:53:53/udp"
@@ -168,12 +168,11 @@ services:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole-http.rule=Host(`pihole.mistborn`)"
      - "traefik.http.routers.pihole-http.entrypoints=web"
-      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth@file,add-pihole-admin"
+      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.pihole-https.rule=Host(`pihole.mistborn`)"
      - "traefik.http.routers.pihole-https.entrypoints=websecure"
-      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth@file,add-pihole-admin"
+      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.pihole-https.tls.certresolver=basic"
-      - "traefik.http.middlewares.add-pihole-admin.addPrefix.prefix=/admin"
      - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
   environment:
     - ServerIP=10.2.0.3
@@ -183,6 +182,8 @@ services:
     - DNSMASQ_LISTENING=all
   #  TZ: 'America/New York'
   # Volumes store your data between container upgrades
+   env_file:
+     - ./.envs/.production/.pihole
   volumes:
     - ../mistborn_volumes/base/pihole/etc-pihole:/etc/pihole/
     - ../mistborn_volumes/base/pihole/etc-dnsmasqd:/etc/dnsmasq.d/
@@ -203,7 +204,7 @@ services:
     - DNSCRYPT_LISTEN_PORT=5054
     # resolvers: https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-resolvers.md
     #- DNSCRYPT_SERVER_NAMES=['scaleway-fr','google','yandex','cloudflare'] 
-     - DNSCRYPT_SERVER_NAMES=['cloudflare','dnswarden-doh1','dnswarden-doh2','dnswarden-doh3','adguard-dns-doh']
+     - DNSCRYPT_SERVER_NAMES=['cloudflare']
    networks:
      pihole_net:
        ipv4_address: 10.2.0.2
@@ -8,17 +8,21 @@
  [tls.options.default]
    minVersion = "VersionTLS12"

-[http.services]
-  [http.services.cockpit.loadBalancer]
-    [[http.services.cockpit.loadBalancer.servers]]
-      url = "http://10.2.3.1:9090"
+[providers.redis]
+  endpoints = ["127.0.0.1:6379"]
+  rootKey = "traefik"

-[http.routers]
-  [http.routers.cockpit]
-    rule = "Host(`cockpit.mistborn`)"
-    service = "cockpit"
-    entrypoints = ["web", "websecure"]
-    middlewares = ["mistborn_auth"]
+#[http.services]
+#  [http.services.cockpit.loadBalancer]
+#    [[http.services.cockpit.loadBalancer.servers]]
+#      url = "http://10.2.3.1:9090"
+#
+#[http.routers]
+#  [http.routers.cockpit]
+#    rule = "Host(`cockpit.mistborn`)"
+#    service = "cockpit"
+#    entrypoints = ["web", "websecure"]
+#    middlewares = ["mistborn_auth"]

 [http.middlewares]
  [http.middlewares.mistborn_auth.forwardAuth]
@@ -1,28 +0,0 @@
-version: '3'
-
-services:  
-  bitwarden:
-    image: bitwardenrs/server:latest
-    container_name: mistborn_production_bitwarden
-    env_file:
-      - ../.envs/.production/.bitwarden
-    volumes:
-      - ../../mistborn_volumes/extra/bitwarden:/data
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.bitwarden-http.rule=Host(`bitwarden.mistborn`)"
-      - "traefik.http.routers.bitwarden-http.entrypoints=web"
-      - "traefik.http.routers.bitwarden-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.bitwarden-https.rule=Host(`bitwarden.mistborn`)"
-      - "traefik.http.routers.bitwarden-https.entrypoints=websecure"
-      - "traefik.http.routers.bitwarden-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.bitwarden-https.tls.certresolver=basic"
-      - "traefik.http.services.bitwarden-service.loadbalancer.server.port=80"
-    ports:
-      - "${MISTBORN_BIND_IP}:3012:3012/tcp"
-    restart: unless-stopped
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,30 +0,0 @@
-version: '3.7'
-
-services:
-
-  elasticsearch:
-    image: amazon/opendistro-for-elasticsearch:1.12.0
-    hostname: elasticsearch
-    restart: unless-stopped
-    ports:
-      - "${MISTBORN_BIND_IP}:9200:9200"
-    environment:
-      - discovery.type=single-node
-      - cluster.name=mistborn-cluster
-      - network.host=0.0.0.0
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
-      - bootstrap.memory_lock=true
-    volumes:
-      - ../../mistborn_volumes/extra/elasticsearch/init/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,72 +0,0 @@
-version: '3'
-
-# services
-services:
-  # guacd
-  guacd:
-    container_name: mistborn_production_guacd
-    image: guacamole/guacd
-    networks:
-      guacnetwork:
-    restart: unless-stopped
-    volumes:
-    - ../../mistborn_volumes/extra/guacamole/drive:/drive:rw
-    - ../../mistborn_volumes/extra/guacamole/record:/record:rw
-
-
-  # postgres
-  guac_postgres:
-    container_name: mistborn_production_guac_postgres
-    env_file:
-    - ../.envs/.production/.guacamole
-    environment:
-      PGDATA: /var/lib/postgresql/data/guacamole
-    image: postgres
-    networks:
-      guacnetwork:
-    restart: unless-stopped
-    volumes:
-    - ../../mistborn_volumes/extra/guacamole/init:/docker-entrypoint-initdb.d:ro
-    - ../../mistborn_volumes/extra/guacamole/data:/var/lib/postgresql/data:rw
-
-
-  # guacamole
-  guacamole:
-    container_name: mistborn_production_guacamole
-    labels:
-    - "traefik.enable=true"
-    - "traefik.http.routers.guacamole-http.rule=Host(`guac.mistborn`)"
-    - "traefik.http.routers.guacamole-http.entrypoints=web"
-    - "traefik.http.routers.guacamole-http.middlewares=mistborn_auth@file,add-guacamole"
-    - "traefik.http.routers.guacamole-https.rule=Host(`guac.mistborn`)"
-    - "traefik.http.routers.guacamole-https.entrypoints=websecure"
-    - "traefik.http.routers.guacamole-https.middlewares=mistborn_auth@file,add-guacamole"
-    - "traefik.http.routers.guacamole-https.tls.certresolver=basic"
-    - "traefik.http.middlewares.add-guacamole.addPrefix.prefix=/guacamole"
-    - "traefik.http.services.guacamole-service.loadbalancer.server.port=8080"
-    depends_on:
-    - guacd
-    - guac_postgres
-    environment:
-      GUACD_HOSTNAME: guacd
-      GUACD_PORT: 4822
-      #GUACAMOLE_HOME: /config
-    env_file:
-    - ../.envs/.production/.guacamole
-    image: guacamole/guacamole
-    links:
-    - guacd
-    networks:
-      guacnetwork:
-    #ports:
-## enable next line if not using nginx
-##    - 8080:8080/tcp # Guacamole is on :8080/guacamole, not /.
-## enable next line when using nginx
-    #- 8080/tcp
-    restart: unless-stopped
-
-# networks
-# create a network 'guacnetwork' in mode 'bridged'
-networks:
-  guacnetwork:
-    driver: bridge
@@ -1,26 +0,0 @@
-version: '3'
-
-services:
-  homeassistant:
-    container_name: mistborn_production_home_assistant 
-    image: homeassistant/home-assistant:stable
-    volumes:
-      - ../../mistborn_volumes/extra/homeassistant/config:/config
-    environment:
-      - TZ=America/New_York
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.homeassistant-http.rule=Host(`homeassistant.mistborn`)"
-      - "traefik.http.routers.homeassistant-http.entrypoints=web"
-      - "traefik.http.routers.homeassistant-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.homeassistant-https.rule=Host(`homeassistant.mistborn`)"
-      - "traefik.http.routers.homeassistant-https.entrypoints=websecure"
-      - "traefik.http.routers.homeassistant-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.homeassistant-https.tls.certresolver=basic"
-      - "traefik.http.services.homeassistant-service.loadbalancer.server.port=8123"
-    restart: unless-stopped 
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,30 +0,0 @@
-version: '3'
-
-volumes:
-  production_jellyfin_config: {}
-  production_jellyfin_cache: {}
-
-services:  
-  jellyfin:
-    image: jellyfin/jellyfin:latest
-    container_name: mistborn_production_jellyfin
-    volumes:
-      - production_jellyfin_config:/config
-      - production_jellyfin_cache:/cache
-      - ../../mistborn_volumes/extra/nextcloud:/media:ro
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.jellyfin-http.rule=Host(`jellyfin.mistborn`)"
-      - "traefik.http.routers.jellyfin-http.entrypoints=web"
-      - "traefik.http.routers.jellyfin-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.jellyfin-https.rule=Host(`jellyfin.mistborn`)"
-      - "traefik.http.routers.jellyfin-https.entrypoints=websecure"
-      - "traefik.http.routers.jellyfin-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.jellyfin-https.tls.certresolver=basic"
-      - "traefik.http.services.jellyfin-service.loadbalancer.server.port=8096"
-    restart: unless-stopped
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,255 +0,0 @@
-version: '3'
-
-services:
-    # Frontend
-    jitsi-web:
-        image: jitsi/web:latest
-        restart: unless-stopped
-        #ports:
-            #- '${HTTP_PORT}:80'
-            #- '${HTTPS_PORT}:443'
-        labels:
-            - "traefik.enable=true"
-            - "traefik.http.routers.jitsi-http.rule=Host(`jitsi.mistborn`)"
-            - "traefik.http.routers.jitsi-http.entrypoints=web"
-            - "traefik.http.routers.jitsi-http.middlewares=mistborn_auth@file"
-            - "traefik.http.routers.jitsi-https.rule=Host(`jitsi.mistborn`)"
-            - "traefik.http.routers.jitsi-https.entrypoints=websecure"
-            - "traefik.http.routers.jitsi-https.middlewares=mistborn_auth@file"
-            - "traefik.http.routers.jitsi-https.tls.certresolver=basic"
-            - "traefik.http.services.jitsi-service.loadbalancer.server.port=${HTTP_PORT}"
-        volumes:
-            - ${CONFIG}/web:/config:Z
-            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
-        env_file:
-            - ../.envs/.production/.jitsi
-        environment:
-            - ENABLE_LETSENCRYPT
-            - ENABLE_HTTP_REDIRECT
-            - ENABLE_XMPP_WEBSOCKET
-            - DISABLE_HTTPS
-            - LETSENCRYPT_DOMAIN
-            - LETSENCRYPT_EMAIL
-            - LETSENCRYPT_USE_STAGING
-            - PUBLIC_URL
-            - TZ
-            - AMPLITUDE_ID
-            - ANALYTICS_SCRIPT_URLS
-            - ANALYTICS_WHITELISTED_EVENTS
-            - BRIDGE_CHANNEL
-            - BRANDING_DATA_URL
-            - CALLSTATS_CUSTOM_SCRIPT_URL
-            - CALLSTATS_ID
-            - CALLSTATS_SECRET
-            - CHROME_EXTENSION_BANNER_JSON
-            - CONFCODE_URL
-            - CONFIG_EXTERNAL_CONNECT
-            - DEPLOYMENTINFO_ENVIRONMENT
-            - DEPLOYMENTINFO_ENVIRONMENT_TYPE
-            - DEPLOYMENTINFO_USERREGION
-            - DIALIN_NUMBERS_URL
-            - DIALOUT_AUTH_URL
-            - DIALOUT_CODES_URL
-            - DROPBOX_APPKEY
-            - DROPBOX_REDIRECT_URI
-            - ENABLE_AUDIO_PROCESSING
-            - ENABLE_AUTH
-            - ENABLE_CALENDAR
-            - ENABLE_FILE_RECORDING_SERVICE
-            - ENABLE_FILE_RECORDING_SERVICE_SHARING
-            - ENABLE_GUESTS
-            - ENABLE_IPV6
-            - ENABLE_LIPSYNC
-            - ENABLE_NO_AUDIO_DETECTION
-            - ENABLE_P2P
-            - ENABLE_PREJOIN_PAGE
-            - ENABLE_RECORDING
-            - ENABLE_REMB
-            - ENABLE_REQUIRE_DISPLAY_NAME
-            - ENABLE_SIMULCAST
-            - ENABLE_STATS_ID
-            - ENABLE_STEREO
-            - ENABLE_SUBDOMAINS
-            - ENABLE_TALK_WHILE_MUTED
-            - ENABLE_TCC
-            - ENABLE_TRANSCRIPTIONS
-            - ETHERPAD_PUBLIC_URL
-            - ETHERPAD_URL_BASE
-            - GOOGLE_ANALYTICS_ID
-            - GOOGLE_API_APP_CLIENT_ID
-            - INVITE_SERVICE_URL
-            - JICOFO_AUTH_USER
-            - MATOMO_ENDPOINT
-            - MATOMO_SITE_ID
-            - MICROSOFT_API_APP_CLIENT_ID
-            - NGINX_RESOLVER
-            - NGINX_WORKER_PROCESSES
-            - NGINX_WORKER_CONNECTIONS
-            - PEOPLE_SEARCH_URL
-            - RESOLUTION
-            - RESOLUTION_MIN
-            - RESOLUTION_WIDTH
-            - RESOLUTION_WIDTH_MIN
-            - START_AUDIO_ONLY
-            - START_AUDIO_MUTED
-            - START_BITRATE
-            - START_VIDEO_MUTED
-            - TESTING_CAP_SCREENSHARE_BITRATE
-            - TESTING_OCTO_PROBABILITY
-            - XMPP_AUTH_DOMAIN
-            - XMPP_BOSH_URL_BASE
-            - XMPP_DOMAIN
-            - XMPP_GUEST_DOMAIN
-            - XMPP_MUC_DOMAIN
-            - XMPP_RECORDER_DOMAIN
-            - TOKEN_AUTH_URL
-        networks:
-            default:
-            meet.jitsi:
-                aliases:
-                    - ${XMPP_DOMAIN}
-
-    # XMPP server
-    jitsi-prosody:
-        image: jitsi/prosody:latest
-        restart: unless-stopped
-        expose:
-            - '5222'
-            - '5347'
-            - '5280'
-        volumes:
-            - ${CONFIG}/prosody/config:/config:Z
-            - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
-        env_file:
-            - ../.envs/.production/.jitsi
-        environment:
-            - AUTH_TYPE
-            - ENABLE_AUTH
-            - ENABLE_GUESTS
-            - ENABLE_LOBBY
-            - ENABLE_XMPP_WEBSOCKET
-            - GLOBAL_MODULES
-            - GLOBAL_CONFIG
-            - LDAP_URL
-            - LDAP_BASE
-            - LDAP_BINDDN
-            - LDAP_BINDPW
-            - LDAP_FILTER
-            - LDAP_AUTH_METHOD
-            - LDAP_VERSION
-            - LDAP_USE_TLS
-            - LDAP_TLS_CIPHERS
-            - LDAP_TLS_CHECK_PEER
-            - LDAP_TLS_CACERT_FILE
-            - LDAP_TLS_CACERT_DIR
-            - LDAP_START_TLS
-            - XMPP_DOMAIN
-            - XMPP_AUTH_DOMAIN
-            - XMPP_GUEST_DOMAIN
-            - XMPP_MUC_DOMAIN
-            - XMPP_INTERNAL_MUC_DOMAIN
-            - XMPP_MODULES
-            - XMPP_MUC_MODULES
-            - XMPP_INTERNAL_MUC_MODULES
-            - XMPP_RECORDER_DOMAIN
-            - XMPP_CROSS_DOMAIN
-            - JICOFO_COMPONENT_SECRET
-            - JICOFO_AUTH_USER
-            - JICOFO_AUTH_PASSWORD
-            - JVB_AUTH_USER
-            - JVB_AUTH_PASSWORD
-            - JIGASI_XMPP_USER
-            - JIGASI_XMPP_PASSWORD
-            - JIBRI_XMPP_USER
-            - JIBRI_XMPP_PASSWORD
-            - JIBRI_RECORDER_USER
-            - JIBRI_RECORDER_PASSWORD
-            - JWT_APP_ID
-            - JWT_APP_SECRET
-            - JWT_ACCEPTED_ISSUERS
-            - JWT_ACCEPTED_AUDIENCES
-            - JWT_ASAP_KEYSERVER
-            - JWT_ALLOW_EMPTY
-            - JWT_AUTH_TYPE
-            - JWT_TOKEN_AUTH_MODULE
-            - LOG_LEVEL
-            - PUBLIC_URL
-            - TZ
-        networks:
-            meet.jitsi:
-                aliases:
-                    - ${XMPP_SERVER}
-
-    # Focus component
-    jitsi-jicofo:
-        image: jitsi/jicofo:latest
-        restart: unless-stopped
-        volumes:
-            - ${CONFIG}/jicofo:/config:Z
-        env_file:
-            - ../.envs/.production/.jitsi
-        environment:
-            - AUTH_TYPE
-            - ENABLE_AUTH
-            - XMPP_DOMAIN
-            - XMPP_AUTH_DOMAIN
-            - XMPP_INTERNAL_MUC_DOMAIN
-            - XMPP_MUC_DOMAIN
-            - XMPP_SERVER
-            - JICOFO_COMPONENT_SECRET
-            - JICOFO_AUTH_USER
-            - JICOFO_AUTH_PASSWORD
-            - JICOFO_RESERVATION_REST_BASE_URL
-            - JVB_BREWERY_MUC
-            - JIGASI_BREWERY_MUC
-            - JIGASI_SIP_URI
-            - JIBRI_BREWERY_MUC
-            - JIBRI_PENDING_TIMEOUT
-            - TZ
-        depends_on:
-            - jitsi-prosody
-        networks:
-            meet.jitsi:
-
-    # Video bridge
-    jitsi-jvb:
-        image: jitsi/jvb:latest
-        restart: unless-stopped
-        ports:
-            - "${MISTBORN_BIND_IP}:${JVB_PORT}:${JVB_PORT}/udp"
-            - "${MISTBORN_BIND_IP}:${JVB_TCP_PORT}:${JVB_TCP_PORT}"
-        volumes:
-            - ${CONFIG}/jvb:/config:Z
-        env_file:
-            - ../.envs/.production/.jitsi
-        environment:
-            - DOCKER_HOST_ADDRESS
-            - XMPP_AUTH_DOMAIN
-            - XMPP_INTERNAL_MUC_DOMAIN
-            - XMPP_SERVER
-            - JVB_AUTH_USER
-            - JVB_AUTH_PASSWORD
-            - JVB_BREWERY_MUC
-            - JVB_PORT
-            - JVB_TCP_HARVESTER_DISABLED
-            - JVB_TCP_PORT
-            - JVB_TCP_MAPPED_PORT
-            - JVB_STUN_SERVERS
-            - JVB_ENABLE_APIS
-            - JVB_WS_DOMAIN
-            - JVB_WS_SERVER_ID
-            - PUBLIC_URL
-            - TZ
-        depends_on:
-            - jitsi-prosody
-        networks:
-            meet.jitsi:
-                aliases:
-                    - jvb.meet.jitsi
-
-# Custom network so all services can communicate using a FQDN
-networks:
-    default:
-      external:
-        name: mistborn_default
-    meet.jitsi:
@@ -1,29 +0,0 @@
-version: '3'
-
-services:  
-  nextcloud:
-    image: nextcloud
-    container_name: mistborn_production_nextcloud
-    env_file:
-      - ../.envs/.production/.postgres
-      - ../.envs/.production/.nextcloud
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.nextcloud-http.rule=Host(`nextcloud.mistborn`)"
-      - "traefik.http.routers.nextcloud-http.entrypoints=web"
-      - "traefik.http.routers.nextcloud-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.nextcloud-https.rule=Host(`nextcloud.mistborn`)"
-      - "traefik.http.routers.nextcloud-https.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.nextcloud-https.tls.certresolver=basic"
-      - "traefik.http.services.nextcloud-service.loadbalancer.server.port=80"
-    volumes:
-      - ../../mistborn_volumes/extra/nextcloud:/var/www/html
-    environment:
-      - VIRTUAL_HOST=nextcloud.mistborn
-    restart: unless-stopped
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,27 +0,0 @@
-version: '3'
-
-services:
-  onlyoffice:
-    container_name: mistborn_production_onlyoffice
-    image: onlyoffice/documentserver:latest
-    volumes:
-      - ../../mistborn_volumes/extra/onlyoffice/logs:/var/log/onlyoffice
-      - ../../mistborn_volumes/extra/onlyoffice/cache:/var/lib/onlyoffice
-    env_file:
-      - ../.envs/.production/.onlyoffice
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.onlyoffice-http.rule=Host(`onlyoffice.mistborn`)"
-      - "traefik.http.routers.onlyoffice-http.entrypoints=web"
-      - "traefik.http.routers.onlyoffice-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.onlyoffice-https.rule=Host(`onlyoffice.mistborn`)"
-      - "traefik.http.routers.onlyoffice-https.entrypoints=websecure"
-      - "traefik.http.routers.onlyoffice-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.onlyoffice-https.tls.certresolver=basic"
-      - "traefik.http.services.onlyoffice-service.loadbalancer.server.port=80"
-    restart: unless-stopped 
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,33 +0,0 @@
-version: '3'
-
-services:
-  raspap:
-    image: "cyber5k/raspap:${MISTBORN_TAG}"
-    container_name: mistborn_production_raspap
-    #network_mode: host
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.raspap-http.rule=Host(`raspap.mistborn`)"
-      - "traefik.http.routers.raspap-http.entrypoints=web"
-      - "traefik.http.routers.raspap-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.raspap-https.rule=Host(`raspap.mistborn`)"
-      - "traefik.http.routers.raspap-https.entrypoints=websecure"
-      - "traefik.http.routers.raspap-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.raspap-https.tls.certresolver=basic"
-      - "traefik.http.services.raspap-service.loadbalancer.server.port=80"
-    env_file:
-      - ../.envs/.production/.raspap
-    cap_add:
-      #- NET_ADMIN
-      - SYS_ADMIN
-      #- CAP_FOWNER
-    privileged: true
-    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
-    #command: /start
-    restart: unless-stopped
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,72 +0,0 @@
-version: '3'
-
-services:
-  # rocketchat
-  rocketchat:
-    image: rocket.chat:latest
-    container_name: mistborn_production_rocketchat
-    command: bash -c 'for i in `seq 1 30`; do node main.js && s=$$? && break || s=$$?; echo "Tried $$i times. Waiting 5 secs..."; sleep 5; done; (exit $$s)'
-    restart: unless-stopped
-    volumes:
-      - ../../mistborn_volumes/extra/rocketchat/uploads:/app/uploads
-    environment:
-      - PORT=3000
-      - ROOT_URL=http://chat.mistborn
-      - MONGO_URL=mongodb://mongo:27017/rocketchat
-      - MONGO_OPLOG_URL=mongodb://mongo:27017/local
-      - Accounts_UseDNSDomainCheck=False
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.chat-http.rule=Host(`chat.mistborn`)"
-      - "traefik.http.routers.chat-http.entrypoints=web"
-      - "traefik.http.routers.chat-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.chat-https.rule=Host(`chat.mistborn`)"
-      - "traefik.http.routers.chat-https.entrypoints=websecure"
-      - "traefik.http.routers.chat-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.chat-https.tls.certresolver=basic"
-      - "traefik.http.services.chat-service.loadbalancer.server.port=3000"
-    depends_on:
-      - mongo
-    #ports:
-    #  - 3000:3000
-
-  mongo:
-    image: mongo:4.0
-    container_name: mistborn_production_rocketchat_mongo
-    restart: unless-stopped
-    volumes:
-     - ../../mistborn_volumes/extra/rocketchat/data/db:/data/db
-     - ../../mistborn_volumes/extra/rocketchat/data/dump:/dump
-    command: mongod --smallfiles --oplogSize 128 --replSet rs0 --storageEngine=mmapv1
-
-  # this container's job is just run the command to initialize the replica set.
-  # it will run the command and remove himself (it will not stay running)
-  mongo-init-replica:
-    image: mongo
-    command: 'bash -c "for i in `seq 1 30`; do mongo mongo/rocketchat --eval \"rs.initiate({ _id: ''rs0'', members: [ { _id: 0, host: ''localhost:27017'' } ]})\" && s=$$? && break || s=$$?; echo \"Tried $$i times. Waiting 5 secs...\"; sleep 5; done; (exit $$s)"'
-    depends_on:
-      - mongo
-
-  # hubot, the popular chatbot (add the bot user first and change the password before starting this image)
-  hubot:
-    image: rocketchat/hubot-rocketchat:latest
-    container_name: mistborn_production_rocketchat_hubot
-    restart: unless-stopped
-    environment:
-      - ROCKETCHAT_URL=chat.mistborn #:3000
-      # you can add more scripts as you'd like here, they need to be installable by npm
-      - EXTERNAL_SCRIPTS=hubot-help,hubot-seen,hubot-links,hubot-diagnostics
-    env_file:
-      - ../.envs/.production/.rocketchat
-    depends_on:
-      - rocketchat
-    volumes:
-      - ../../mistborn_volumes/extra/rocketchat/hubot/scripts:/home/hubot/scripts
-  # this is used to expose the hubot port for notifications on the host on port 3001, e.g. for hubot-jenkins-notifier
-    ports:
-      - "${MISTBORN_BIND_IP}:3001:8080/tcp"
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,72 +0,0 @@
-version: '3'
-
-services:
-  scirius:
-    container_name: mistborn_production_scirius
-    image: "cyber5k/scirius:${MISTBORN_TAG}"
-    #environment:
-    #  - SECRET_KEY: <SECRET KEY>
-    env_file:
-      - ../.envs/.production/.wazuh
-      - ../.envs/.production/.scirius
-    volumes:
-      - /var/log/suricata:/logs
-      - /etc/suricata/rules:/etc/suricata/rules
-      - ../../mistborn_volumes/extra/scirius/static:/static
-      - ../../mistborn_volumes/extra/scirius/data:/data
-      - /var/run:/var/run:ro
-      - /var/run/suricata/suricata-command.socket:/var/run/suricata/suricata-command.socket:ro
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.scirius-http.rule=Host(`scirius.mistborn`)"
-      - "traefik.http.routers.scirius-http.entrypoints=web"
-      - "traefik.http.routers.scirius-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.scirius-https.rule=Host(`scirius.mistborn`)"
-      - "traefik.http.routers.scirius-https.entrypoints=websecure"
-      - "traefik.http.routers.scirius-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.scirius-https.tls.certresolver=basic"
-      - "traefik.http.services.scirius-service.loadbalancer.server.port=8000"
-    restart: unless-stopped 
-
-#   filebeat:
-#     image: docker.elastic.co/beats/filebeat:${ELASTIC_VERSION:-7.9.1}
-#     # https://github.com/docker/swarmkit/issues/1951
-#     hostname: "{{.Node.Hostname}}-filebeat"
-#     # Need to override user so we can access the log files, and docker.sock
-#     user: root
-#     configs:
-#       - source: fb_config
-#         target: /usr/share/filebeat/filebeat.yml
-#     volumes:
-#       - filebeat:/usr/share/filebeat/data
-#       - /var/run/docker.sock:/var/run/docker.sock
-#       # This is needed for filebeat to load container log path as specified in filebeat.yml
-#       - /var/lib/docker/containers/:/var/lib/docker/containers/:ro
-
-#       # # This is needed for filebeat to load jenkins build log path as specified in filebeat.yml
-#       # - /var/lib/docker/volumes/jenkins_home/_data/jobs/:/var/lib/docker/volumes/jenkins_home/_data/jobs/:ro
-
-#       # This is needed for filebeat to load logs for system and auth modules
-#       - /var/log/:/var/log/:ro
-#       # This is needed for filebeat to load logs for auditd module. you might have to install audit system
-#       # on ubuntu first (sudo apt-get install -y auditd audispd-plugins)
-#       - /var/log/audit/:/var/log/audit/:ro
-#     environment:
-#       - ELASTICSEARCH_HOST=${ELASTICSEARCH_HOST}
-#       - KIBANA_HOST=${KIBANA_HOST}
-#       - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME}
-#       - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
-#     # disable strict permission checks
-#     command: ["--strict.perms=false"]
-
-# volumes:
-#   filebeat:
-
-networks:
-  default:
-    external:
-      name: mistborn_default
-
-# configs:
-#   fb_config:
-#     file: /opt/mistborn_volumes/scirius/init/filebeat.docker.yml
@@ -1,35 +0,0 @@
-version: '3'
-
-services:
-  syncthing:
-    image: linuxserver/syncthing
-    container_name: mistborn_production_syncthing
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Amereica/New_York
-      - UMASK_SET=022
-    volumes:
-      - ../../mistborn_volumes/extra/syncthing/config:/config
-      - ../../mistborn_volumes/extra/syncthing/data1:/data1
-      - ../../mistborn_volumes/extra/syncthing/data2:/data2
-    ports:
-      #- 8384:8384
-      - "${MISTBORN_BIND_IP}:22000:22000/tcp" # listening port
-      - "${MISTBORN_BIND_IP}:21027:21027/udp" # protocol discovery
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.mistborn`)"
-      - "traefik.http.routers.syncthing-http.entrypoints=web"
-      - "traefik.http.routers.syncthing-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.mistborn`)"
-      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
-      - "traefik.http.routers.syncthing-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.syncthing-https.tls.certresolver=basic"
-      - "traefik.http.services.syncthing-service.loadbalancer.server.port=8384"
-    restart: unless-stopped
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,16 +0,0 @@
-version: '3'
-
-services:
-  tor-client:
-    build:
-      context: ../compose/production/tor
-      dockerfile: ./Dockerfile
-    image: mistborn_production_tor
-    container_name: mistborn_production_tor
-    ports:
-      - "${MISTBORN_BIND_IP}:9150:9150/tcp"
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,70 +0,0 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-version: '3.7'
-
-services:
-  wazuh:
-    image: wazuh/wazuh-odfe:4.1.2
-    hostname: wazuh-manager
-    restart: unless-stopped
-    ports:
-      - "${MISTBORN_BIND_IP}:1514:1514"
-      - "${MISTBORN_BIND_IP}:1515:1515"
-      - "${MISTBORN_BIND_IP}:514:514/udp"
-      - "${MISTBORN_BIND_IP}:55000:55000"
-    environment:
-      - FILEBEAT_SSL_VERIFICATION_MODE=none
-    env_file:
-      - ../.envs/.production/.wazuh
-    volumes:
-      - ossec_api_configuration:/var/ossec/api/configuration
-      - ossec_etc:/var/ossec/etc
-      - ossec_logs:/var/ossec/logs
-      - ossec_queue:/var/ossec/queue
-      - ossec_var_multigroups:/var/ossec/var/multigroups
-      - ossec_integrations:/var/ossec/integrations
-      - ossec_active_response:/var/ossec/active-response/bin
-      - ossec_agentless:/var/ossec/agentless
-      - ossec_wodles:/var/ossec/wodles
-      - filebeat_etc:/etc/filebeat
-      - filebeat_var:/var/lib/filebeat
-
-  wazuh-kibana:
-    image: wazuh/wazuh-kibana-odfe:4.1.2
-    hostname: wazuh-kibana
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.wazuhk-http.rule=Host(`wazuh.mistborn`)"
-      - "traefik.http.routers.wazuhk-http.entrypoints=web"
-      - "traefik.http.routers.wazuhk-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.wazuhk-https.rule=Host(`wazuh.mistborn`)"
-      - "traefik.http.routers.wazuhk-https.entrypoints=websecure"
-      - "traefik.http.routers.wazuhk-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.wazuhk-https.tls.certresolver=basic"
-      - "traefik.http.services.wazuhk-service.loadbalancer.server.port=5601"
-    #ports:
-    #  - "${MISTBORN_BIND_IP}:5601:5601"
-    environment:
-      - SERVER_SSL_ENABLED=false
-      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
-      - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
-    env_file:
-      - ../.envs/.production/.wazuh
-
-volumes:
-  ossec_api_configuration:
-  ossec_etc:
-  ossec_logs:
-  ossec_queue:
-  ossec_var_multigroups:
-  ossec_integrations:
-  ossec_active_response:
-  ossec_agentless:
-  ossec_wodles:
-  filebeat_etc:
-  filebeat_var:
-
-networks:
-  default:
-    external:
-      name: mistborn_default
@@ -1,6 +1,6 @@
 # Log kernel iptables dropped messages to iptables.log
 $template MyTemplate,"%$day%-%timegenerated:1:3:date-rfc3164%-%$year% %timegenerated:12:19:date-rfc3339% %HOSTNAME% %syslogtag% %msg%\n"
-:msg,contains,"[IPTables-Dropped]:" /var/log/iptables.log;MyTemplate #RSYSLOG_FileFormat
+:msg,contains,"[Mistborn-IPTables-Dropped]:" /var/log/iptables.log;MyTemplate #RSYSLOG_FileFormat

 # Uncomment the following to stop logging anything that matches the last rule.
 # Doing this will stop logging kernel generated UFW log messages to the file
@@ -0,0 +1,2 @@
+$template SuricataTemplate, "<%PRI%>%syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
+user.alert /var/log/suricata.log;SuricataTemplate
@@ -1,3 +0,0 @@
-[WebService]
-ProtocolHeader = X-Forwarded-Proto
-AllowUnencrypted=true
@@ -1,3 +0,0 @@
-{
-    "shutdown-timeout": 60 
-}
@@ -1,366 +0,0 @@
-# shellcheck disable=SC2034
-
-# Security
-#
-# Set these to strong passwords to avoid intruders from impersonating a service account
-# The service(s) won't start unless these are specified
-# Running ./gen-passwords.sh will update .env with strong passwords
-# You may skip the Jigasi and Jibri passwords if you are not using those
-# DO NOT reuse passwords
-#
-
-# XMPP component password for Jicofo
-JICOFO_COMPONENT_SECRET=
-
-# XMPP password for Jicofo client connections
-JICOFO_AUTH_PASSWORD=
-
-# XMPP password for JVB client connections
-JVB_AUTH_PASSWORD=
-
-# XMPP password for Jigasi MUC client connections
-JIGASI_XMPP_PASSWORD=
-
-# XMPP recorder password for Jibri client connections
-JIBRI_RECORDER_PASSWORD=
-
-# XMPP password for Jibri client connections
-JIBRI_XMPP_PASSWORD=
-
-
-#
-# Basic configuration options
-#
-
-# Directory where all configuration will be stored
-#CONFIG=~/.jitsi-meet-cfg
-CONFIG=../.envs/.production/.jitsi-cfg
-
-# Exposed HTTP port
-HTTP_PORT=80
-
-# Exposed HTTPS port
-HTTPS_PORT=443
-
-# System time zone
-TZ=UTC
-
-# Public URL for the web service (required)
-PUBLIC_URL=https://jitsi.mistborn
-
-# IP address of the Docker host
-# See the "Running behind NAT or on a LAN environment" section in the Handbook:
-# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-nat-or-on-a-lan-environment
-#DOCKER_HOST_ADDRESS=192.168.1.1
-DOCKER_HOST_ADDRESS=10.2.3.1
-
-# Control whether the lobby feature should be enabled or not
-#ENABLE_LOBBY=1
-
-# Show a prejoin page before entering a conference
-#ENABLE_PREJOIN_PAGE=0
-
-#
-# Let's Encrypt configuration
-#
-
-# Enable Let's Encrypt certificate generation
-#ENABLE_LETSENCRYPT=1
-
-# Domain for which to generate the certificate
-#LETSENCRYPT_DOMAIN=meet.example.com
-
-# E-Mail for receiving important account notifications (mandatory)
-#LETSENCRYPT_EMAIL=alice@atlanta.net
-
-# Use the staging server (for avoiding rate limits while testing)
-#LETSENCRYPT_USE_STAGING=1
-
-
-#
-# Etherpad integration (for document sharing)
-#
-
-# Set etherpad-lite URL in docker local network (uncomment to enable)
-#ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001
-
-# Set etherpad-lite public URL (uncomment to enable)
-#ETHERPAD_PUBLIC_URL=https://etherpad.my.domain
-
-# Name your etherpad instance!
-ETHERPAD_TITLE="Video Chat"
-
-# The default text of a pad
-ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
-
-# Name of the skin for etherpad
-ETHERPAD_SKIN_NAME="colibris"
-
-# Skin variants for etherpad
-ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
-
-
-#
-# Basic Jigasi configuration options (needed for SIP gateway support)
-#
-
-# SIP URI for incoming / outgoing calls
-#JIGASI_SIP_URI=test@sip2sip.info
-
-# Password for the specified SIP account as a clear text
-#JIGASI_SIP_PASSWORD=passw0rd
-
-# SIP server (use the SIP account domain if in doubt)
-#JIGASI_SIP_SERVER=sip2sip.info
-
-# SIP server port
-#JIGASI_SIP_PORT=5060
-
-# SIP server transport
-#JIGASI_SIP_TRANSPORT=UDP
-
-#
-# Authentication configuration (see handbook for details)
-#
-
-# Enable authentication
-#ENABLE_AUTH=1
-
-# Enable guest access
-#ENABLE_GUESTS=1
-
-# Select authentication type: internal, jwt or ldap
-#AUTH_TYPE=internal
-
-# JWT authentication
-#
-
-# Application identifier
-#JWT_APP_ID=my_jitsi_app_id
-
-# Application secret known only to your token
-#JWT_APP_SECRET=my_jitsi_app_secret
-
-# (Optional) Set asap_accepted_issuers as a comma separated list
-#JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client
-
-# (Optional) Set asap_accepted_audiences as a comma separated list
-#JWT_ACCEPTED_AUDIENCES=my_server1,my_server2
-
-
-# LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page)
-#
-
-# LDAP url for connection
-#LDAP_URL=ldaps://ldap.domain.com/
-
-# LDAP base DN. Can be empty
-#LDAP_BASE=DC=example,DC=domain,DC=com
-
-# LDAP user DN. Do not specify this parameter for the anonymous bind
-#LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com
-
-# LDAP user password. Do not specify this parameter for the anonymous bind
-#LDAP_BINDPW=LdapUserPassw0rd
-
-# LDAP filter. Tokens example:
-# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail
-# %s - %s is replaced by the complete service string
-# %r - %r is replaced by the complete realm string
-#LDAP_FILTER=(sAMAccountName=%u)
-
-# LDAP authentication method
-#LDAP_AUTH_METHOD=bind
-
-# LDAP version
-#LDAP_VERSION=3
-
-# LDAP TLS using
-#LDAP_USE_TLS=1
-
-# List of SSL/TLS ciphers to allow
-#LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC
-
-# Require and verify server certificate
-#LDAP_TLS_CHECK_PEER=1
-
-# Path to CA cert file. Used when server certificate verify is enabled
-#LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt
-
-# Path to CA certs directory. Used when server certificate verify is enabled
-#LDAP_TLS_CACERT_DIR=/etc/ssl/certs
-
-# Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps://
-# LDAP_START_TLS=1
-
-
-#
-# Advanced configuration options (you generally don't need to change these)
-#
-
-# Internal XMPP domain
-XMPP_DOMAIN=meet.jitsi
-
-# Internal XMPP server
-XMPP_SERVER=xmpp.meet.jitsi
-
-# Internal XMPP server URL
-XMPP_BOSH_URL_BASE=http://xmpp.meet.jitsi:5280
-
-# Internal XMPP domain for authenticated services
-XMPP_AUTH_DOMAIN=auth.meet.jitsi
-
-# XMPP domain for the MUC
-XMPP_MUC_DOMAIN=muc.meet.jitsi
-
-# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools
-XMPP_INTERNAL_MUC_DOMAIN=internal-muc.meet.jitsi
-
-# XMPP domain for unauthenticated users
-XMPP_GUEST_DOMAIN=guest.meet.jitsi
-
-# Comma separated list of domains for cross domain policy or "true" to allow all
-# The PUBLIC_URL is always allowed
-#XMPP_CROSS_DOMAIN=true
-
-# Custom Prosody modules for XMPP_DOMAIN (comma separated)
-XMPP_MODULES=
-
-# Custom Prosody modules for MUC component (comma separated)
-XMPP_MUC_MODULES=
-
-# Custom Prosody modules for internal MUC component (comma separated)
-XMPP_INTERNAL_MUC_MODULES=
-
-# MUC for the JVB pool
-JVB_BREWERY_MUC=jvbbrewery
-
-# XMPP user for JVB client connections
-JVB_AUTH_USER=jvb
-
-# STUN servers used to discover the server's public IP
-JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443
-
-# Media port for the Jitsi Videobridge
-JVB_PORT=10000
-
-# TCP Fallback for Jitsi Videobridge for when UDP isn't available
-JVB_TCP_HARVESTER_DISABLED=true
-JVB_TCP_PORT=4443
-JVB_TCP_MAPPED_PORT=4443
-
-# A comma separated list of APIs to enable when the JVB is started [default: none]
-# See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information
-#JVB_ENABLE_APIS=rest,colibri
-
-# XMPP user for Jicofo client connections.
-# NOTE: this option doesn't currently work due to a bug
-JICOFO_AUTH_USER=focus
-
-# Base URL of Jicofo's reservation REST API
-#JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com
-
-# Enable Jicofo's health check REST API (http://<jicofo_base_url>:8888/about/health)
-#JICOFO_ENABLE_HEALTH_CHECKS=true
-
-# XMPP user for Jigasi MUC client connections
-JIGASI_XMPP_USER=jigasi
-
-# MUC name for the Jigasi pool
-JIGASI_BREWERY_MUC=jigasibrewery
-
-# Minimum port for media used by Jigasi
-JIGASI_PORT_MIN=20000
-
-# Maximum port for media used by Jigasi
-JIGASI_PORT_MAX=20050
-
-# Enable SDES srtp
-#JIGASI_ENABLE_SDES_SRTP=1
-
-# Keepalive method
-#JIGASI_SIP_KEEP_ALIVE_METHOD=OPTIONS
-
-# Health-check extension
-#JIGASI_HEALTH_CHECK_SIP_URI=keepalive
-
-# Health-check interval
-#JIGASI_HEALTH_CHECK_INTERVAL=300000
-#
-# Enable Jigasi transcription
-#ENABLE_TRANSCRIPTIONS=1
-
-# Jigasi will record audio when transcriber is on [default: false]
-#JIGASI_TRANSCRIBER_RECORD_AUDIO=true
-
-# Jigasi will send transcribed text to the chat when transcriber is on [default: false]
-#JIGASI_TRANSCRIBER_SEND_TXT=true
-
-# Jigasi will post an url to the chat with transcription file [default: false]
-#JIGASI_TRANSCRIBER_ADVERTISE_URL=true
-
-# Credentials for connect to Cloud Google API from Jigasi
-# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol
-# section "Before you begin" paragraph 1 to 5
-# Copy the values from the json to the related env vars
-#GC_PROJECT_ID=
-#GC_PRIVATE_KEY_ID=
-#GC_PRIVATE_KEY=
-#GC_CLIENT_EMAIL=
-#GC_CLIENT_ID=
-#GC_CLIENT_CERT_URL=
-
-# Enable recording
-#ENABLE_RECORDING=1
-
-# XMPP domain for the jibri recorder
-XMPP_RECORDER_DOMAIN=recorder.meet.jitsi
-
-# XMPP recorder user for Jibri client connections
-JIBRI_RECORDER_USER=recorder
-
-# Directory for recordings inside Jibri container
-JIBRI_RECORDING_DIR=/config/recordings
-
-# The finalizing script. Will run after recording is complete
-JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh
-
-# XMPP user for Jibri client connections
-JIBRI_XMPP_USER=jibri
-
-# MUC name for the Jibri pool
-JIBRI_BREWERY_MUC=jibribrewery
-
-# MUC connection timeout
-JIBRI_PENDING_TIMEOUT=90
-
-# When jibri gets a request to start a service for a room, the room
-# jid will look like: roomName@optional.prefixes.subdomain.xmpp_domain
-# We'll build the url for the call by transforming that into:
-# https://xmpp_domain/subdomain/roomName
-# So if there are any prefixes in the jid (like jitsi meet, which
-# has its participants join a muc at conference.xmpp_domain) then
-# list that prefix here so it can be stripped out to generate
-# the call url correctly
-JIBRI_STRIP_DOMAIN_JID=muc
-
-# Directory for logs inside Jibri container
-JIBRI_LOGS_DIR=/config/logs
-
-# Disable HTTPS: handle TLS connections outside of this setup
-DISABLE_HTTPS=1
-
-# Redirect HTTP traffic to HTTPS
-# Necessary for Let's Encrypt, relies on standard HTTPS port (443)
-#ENABLE_HTTP_REDIRECT=1
-
-# Enable IPv6
-# Provides means to disable IPv6 in environments that don't support it (get with the times, people!)
-#ENABLE_IPV6=1
-
-# Container restart policy
-# Defaults to unless-stopped
-RESTART_POLICY=unless-stopped
-
-# Authenticate using external service or just focus external auth window if there is one already.
-# TOKEN_AUTH_URL=https://auth.meet.example.com/{room}
@@ -1,35 +0,0 @@
-#!/bin/bash
-
-set -e
-
-SERVICE="$1"
-
-export MISTBORN_HOME=/opt/mistborn
-export SERVICE_ENV_INSTALLER="${MISTBORN_HOME}/scripts/subinstallers/extra/${SERVICE}.sh"
-export SERVICE_ENV_FILE="${MISTBORN_HOME}/.envs/.production/.${SERVICE}"
-
-# read in global variables
-set -a
-source ${MISTBORN_HOME}/.env
-source ${MISTBORN_HOME}/.envs/.production/.django
-source ${MISTBORN_HOME}/.envs/.production/.postgres
-source ${MISTBORN_HOME}/.envs/.production/.pihole
-set +a
-
-if [[ -f "${SERVICE_ENV_INSTALLER}" ]]; then
-
-    if [[ -f "${SERVICE_ENV_FILE}" ]]; then
-        echo "Environment file already exists."
-    else
-
-        # create env file for service
-        echo "Creating environment file"
-        source $SERVICE_ENV_INSTALLER $SERVICE_ENV_FILE
-        chown mistborn:mistborn $SERVICE_ENV_FILE
-        chmod 600 $SERVICE_ENV_FILE
-
-    fi
-
-else
-    echo "No subinstaller found."
-fi
@@ -1,5 +1,10 @@
 #!/bin/bash

+# Version
+MISTBORN_MAJOR_VERSION="0"
+MISTBORN_MINOR_VERSION="1"
+MISTBORN_PATCH_NUMBER="1"
+
 #### ENV file

 VAR_FILE=/opt/mistborn/.env
@@ -11,7 +16,12 @@ source /opt/mistborn/scripts/subinstallers/platform.sh
 # setup env file
 echo "" | sudo tee ${VAR_FILE}
 sudo chown mistborn:mistborn ${VAR_FILE}
-sudo chmod 600 ${VAR_FILE}
+
+# Version env variables
+echo "MISTBORN_VERSION=${MISTBORN_MAJOR_VERSION}.${MISTBORN_MINOR_VERSION}.${MISTBORN_PATCH_NUMBER}" | sudo tee -a ${VAR_FILE}
+echo "MISTBORN_MAJOR_VERSION=${MISTBORN_MAJOR_VERSION}" | sudo tee -a ${VAR_FILE}
+echo "MISTBORN_MINOR_VERSION=${MISTBORN_MINOR_VERSION}" | sudo tee -a ${VAR_FILE}
+echo "MISTBORN_PATCH_NUMBER=${MISTBORN_PATCH_NUMBER}" | sudo tee -a ${VAR_FILE}

 # MISTBORN_DNS_BIND_IP

@@ -29,9 +39,11 @@ echo "MISTBORN_BIND_IP=10.2.3.1" | sudo tee -a ${VAR_FILE}
 # MISTBORN_TAG

 GIT_BRANCH=$(git -C /opt/mistborn symbolic-ref --short HEAD || echo "master")
+MISTBORN_TAG="${MISTBORN_MAJOR_VERSION}.${MISTBORN_MINOR_VERSION}"
+if [ ! -z "$MISTBORN_TEST_CONTAINER" ]; then
+    MISTBORN_TAG="$MISTBORN_TEST_CONTAINER"
+elif [ "$GIT_BRANCH" == "master" ]; then
    MISTBORN_TAG="latest"
-if [ "$GIT_BRANCH" != "master" ]; then
-    MISTBORN_TAG="test"
 fi

 echo "MISTBORN_TAG=$MISTBORN_TAG" | sudo tee -a ${VAR_FILE}
@@ -41,9 +53,9 @@ echo "MISTBORN_TAG=$MISTBORN_TAG" | sudo tee -a ${VAR_FILE}
 # copy current service files to systemd (overwriting as needed)
 sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/

-# set script user and owner
-sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
-#sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
+## set script user and owner
+#sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
+##sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"

 # reload in case the iface is not immediately set
 sudo systemctl daemon-reload
@@ -56,9 +68,13 @@ while [[ -z "$iface" ]]; do
    iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}' | tr -d '[:space:]')
 done

-# default interface
-sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
+GLOBAL_ENV=/opt/mistborn/.envs/.production/.global
+install -Dv /dev/null $GLOBAL_ENV
+echo "DIFACE=$iface" >> $GLOBAL_ENV
+echo "MISTBORN_ENV_PATH=../../.envs/.production/" >> $GLOBAL_ENV
+echo "MISTBORN_VOL_PATH=../../../mistborn_volumes/extra/" >> $GLOBAL_ENV

-echo "DIFACE=${iface}" | sudo tee -a ${VAR_FILE}
+# default interface
+#sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"

 sudo systemctl daemon-reload
@@ -39,7 +39,7 @@ if [ $(whoami) != "$MISTBORN_USER" ]; then

        sudo cp $FULLPATH /home/$MISTBORN_USER
        sudo chown $MISTBORN_USER:$MISTBORN_USER /home/$MISTBORN_USER/$FILENAME
-        sudo SSH_CLIENT="$SSH_CLIENT" MISTBORN_DEFAULT_PASSWORD="$MISTBORN_DEFAULT_PASSWORD" GIT_BRANCH="$GIT_BRANCH" MISTBORN_INSTALL_COCKPIT="$MISTBORN_INSTALL_COCKPIT" -i -u $MISTBORN_USER bash -c "/home/$MISTBORN_USER/$FILENAME" # self-referential call
+        sudo SSH_CLIENT="$SSH_CLIENT" MISTBORN_DEFAULT_PASSWORD="$MISTBORN_DEFAULT_PASSWORD" GIT_BRANCH="$GIT_BRANCH" -i -u $MISTBORN_USER bash -c "/home/$MISTBORN_USER/$FILENAME" # self-referential call
        exit 0
 fi

@@ -59,28 +59,12 @@ echo -e "| |  | | \__ \ |_| |_) | (_) | |  | | | |"
 echo -e "|_|  |_|_|___/\__|_.__/ \___/|_|  |_| |_|"
 echo -e ""

-sudo rm -rf /opt/mistborn 2>/dev/null || true
-
-# clone to /opt and change directory
-echo "Cloning $GIT_BRANCH branch from mistborn repo"
-sudo git clone https://gitlab.com/cyber5k/mistborn.git -b $GIT_BRANCH /opt/mistborn
-sudo chown -R $USER:$USER /opt/mistborn
-pushd .
-cd /opt/mistborn
-git submodule update --init --recursive
-
-# Check updates
-echo "Checking updates"
-source ./scripts/subinstallers/check_updates.sh
-
-# MISTBORN_DEFAULT_PASSWORD
-source ./scripts/subinstallers/passwd.sh
-
-# Install Cockpit?
-if [ -z "${MISTBORN_INSTALL_COCKPIT}" ]; then
-    read -p "Install Cockpit (a somewhat resource-heavy system management graphical user interface -- NOT RECOMMENDED on Raspberry Pi)? [y/N]: " MISTBORN_INSTALL_COCKPIT
+# INPUT default admin password
+if [ -z "${MISTBORN_DEFAULT_PASSWORD}" ]; then
+    read -p "(Mistborn) Set default admin password: " -s MISTBORN_DEFAULT_PASSWORD
    echo
-    MISTBORN_INSTALL_COCKPIT=${MISTBORN_INSTALL_COCKPIT:-N}
+else
+    echo "MISTBORN_DEFAULT_PASSWORD is already set"
 fi

 # SSH keys
@@ -94,7 +78,18 @@ else
    echo "SSH key exists for $USER"
 fi

-# initial load update package list during check_updates.sh
+sudo rm -rf /opt/mistborn 2>/dev/null || true
+
+# clone to /opt and change directory
+echo "Cloning $GIT_BRANCH branch from mistborn repo"
+sudo git clone https://gitlab.com/cyber5k/mistborn.git -b $GIT_BRANCH /opt/mistborn
+sudo chown -R $USER:$USER /opt/mistborn
+pushd .
+cd /opt/mistborn
+git submodule update --init --recursive
+
+# initial load update package list
+sudo apt-get update

 # install figlet
 sudo -E apt-get install -y figlet
@@ -107,7 +102,11 @@ source ./scripts/subinstallers/platform.sh
 echo "Setting up firewall (iptables)"
 if [ ! -f "/etc/iptables/rules.v4" ]; then
    echo "Setting iptables rules..."
-    ./scripts/subinstallers/iptables.sh
+    source ./scripts/subinstallers/suricata.sh
+    source ./scripts/subinstallers/iptables.sh
+    source ./scripts/subinstallers/ip6tables.sh
+    #source ./scripts/subinstallers/iptables_docker.sh
+    source ./scripts/subinstallers/iptables_cleanup.sh
 else
    echo "iptables rules exist. Leaving alone."
 fi
@@ -148,16 +147,6 @@ sudo systemctl start docker
 # Unattended upgrades
 sudo -E apt-get install -y unattended-upgrades

-# Cockpit
-if [[ "$MISTBORN_INSTALL_COCKPIT" =~ ^([yY][eE][sS]|[yY])$ ]]
-then
-    # install cockpit
-    source ./scripts/subinstallers/cockpit.sh
-    
-    # set variable (that will be available in environment)
-    MISTBORN_INSTALL_COCKPIT=Y
-fi
-
 # Mistborn-cli (pip3 installed by docker)
 figlet "Mistborn: Installing mistborn-cli"
 sudo pip3 install -e ./modules/mistborn-cli
@@ -198,9 +187,6 @@ sudo mkdir -p ../mistborn_volumes/base/pihole/etc-pihole
 sudo mkdir -p ../mistborn_volumes/base/pihole/etc-dnsmasqd
 sudo mkdir -p ../mistborn_volumes/extra

-# Traefik final setup (cockpit)
-#cp ./compose/production/traefik/traefikv2.toml.template ./compose/production/traefik/traefik.toml
-
 # setup tls certs 
 source ./scripts/subinstallers/openssl.sh
 #sudo rm -rf ../mistborn_volumes/base/tls
@@ -246,7 +232,6 @@ sudo resolvconf -u 1>/dev/null 2>&1

 echo "backup up original volumes folder"
 sudo mkdir -p ../mistborn_backup
-sudo chmod 700 ../mistborn_backup
 sudo tar -czf ../mistborn_backup/mistborn_volumes_backup.tar.gz ../mistborn_volumes 1>/dev/null 2>&1

 # clean docker
@@ -6,28 +6,23 @@ After=docker.service
 After=netfilter-persistent.service

 [Service]
+EnvironmentFile=/opt/mistborn/.envs/.production/.global
+EnvironmentFile=/opt/mistborn/.env
 Restart=always
-RestartSec=15
-User=root
+User=mistborn
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-EnvironmentFile=/opt/mistborn/.env
-
-# stop all containers joined to mistborn_default network
-ExecStartPre=-/usr/bin/bash -c "docker container stop $(docker network inspect mistborn_default | grep Name | tail -n +2 | cut -d':' -f2 | tr -d ',\"') 2>/dev/null"
-
-# bring down the base service
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml down

 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
-ExecStartPre=-/sbin/ip address add 10.2.3.1/30 dev DIFACE
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 53 -j MISTBORN_LOG_DROP
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 80 -j MISTBORN_LOG_DROP
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 443 -j MISTBORN_LOG_DROP
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 5555 -j MISTBORN_LOG_DROP
-ExecStartPre=/sbin/iptables -w -A OUTPUT -o DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
+ExecStartPre=-/sbin/ip address add 10.2.3.1/30 dev $DIFACE
+ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i $DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
+ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport 53 -j MISTBORN_LOG_DROP
+ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport 80 -j MISTBORN_LOG_DROP
+ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport 443 -j MISTBORN_LOG_DROP
+#ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport 5555 -j MISTBORN_LOG_DROP
+ExecStartPre=/sbin/iptables -w -A OUTPUT -o $DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
 ExecStartPre=/sbin/ip6tables -w -A OUTPUT -p udp --dport 53 -j MISTBORN_LOG_DROP
 ExecStartPre=/sbin/resolvconf -u
 # Start container when unit is started
@@ -35,12 +30,12 @@ ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml up
 # Stop container when unit is stopped
 ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml down
 # Post stop
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 53 -j MISTBORN_LOG_DROP
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 80 -j MISTBORN_LOG_DROP
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 443 -j MISTBORN_LOG_DROP
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 5555 -j MISTBORN_LOG_DROP
-ExecStopPost=-/sbin/iptables -D OUTPUT -o DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
+ExecStopPost=-/sbin/iptables -D DOCKER-USER -i $DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
+ExecStopPost=-/sbin/iptables -D DOCKER-USER -i $DIFACE -p tcp --dport 53 -j MISTBORN_LOG_DROP
+ExecStopPost=-/sbin/iptables -D DOCKER-USER -i $DIFACE -p tcp --dport 80 -j MISTBORN_LOG_DROP
+ExecStopPost=-/sbin/iptables -D DOCKER-USER -i $DIFACE -p tcp --dport 443 -j MISTBORN_LOG_DROP
+#ExecStopPost=-/sbin/iptables -D DOCKER-USER -i $DIFACE -p tcp --dport 5555 -j MISTBORN_LOG_DROP
+ExecStopPost=-/sbin/iptables -D OUTPUT -o $DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
 ExecStopPost=-/sbin/ip6tables -D OUTPUT -p udp --dport 53 -j MISTBORN_LOG_DROP

 [Install]
@@ -1,25 +0,0 @@
-[Unit]
-Description=Mistborn Bitwarden Service
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down
-
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down
-# Post stop
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,22 +0,0 @@
-[Unit]
-Description=Mistborn Elasticsearch Service
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/sbin/sysctl -w vm.max_map_count=262144
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,23 +0,0 @@
-[Unit]
-Description=Mistborn Guacamole
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
-# Post stop
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,23 +0,0 @@
-[Unit]
-Description=Mistborn Home Assistant 
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down
-# Post stop
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,23 +0,0 @@
-[Unit]
-Description=Mistborn Jellyfin Service
-Requires=Mistborn-nextcloud.service
-After=Mistborn-nextcloud.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down
-# Post stop
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,27 +0,0 @@
-[Unit]
-Description=Mistborn Jitsi Service
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_up.sh
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build
-
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
-# Post stop
-ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_down.sh
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,23 +0,0 @@
-[Unit]
-Description=Mistborn Nextcloud Service
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down
-# Post stop
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,23 +0,0 @@
-[Unit]
-Description=Mistborn OnlyOffice Service
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
-# Post stop
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,25 +0,0 @@
-[Unit]
-Description=Mistborn RaspAP Service 
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
-#ExecStartPre=/bin/bash /opt/mistborn_volumes/extra/raspap/etc-raspap/hostapd/servicestart.sh --interface uap0 --seconds 3
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
-# Post stop
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,25 +0,0 @@
-[Unit]
-Description=Mistborn Rocket Chat Service
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down
-
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down
-# Post stop
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,27 +0,0 @@
-[Unit]
-Description=Mistborn Scirius Service
-Requires=Mistborn-wazuh.service
-After=Mistborn-wazuh.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
-
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml up --build
-# Suricata
-ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_start.sh
-
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
-# Post stop
-ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_stop.sh
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,27 +0,0 @@
-[Unit]
-Description=Mistborn Syncthing Service
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down
-
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down
-# Post stop
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,25 +0,0 @@
-[Unit]
-Description=Mistborn Tor Service 
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down
-
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml up --build
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down
-# Post stop
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,25 +0,0 @@
-[Unit]
-Description=Mistborn Wazuh Service
-Requires=Mistborn-elasticsearch.service
-After=Mistborn-elasticsearch.service
-PartOf=Mistborn-base.service
-
-[Service]
-Restart=always
-RestartSec=15
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
-# Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build
-# Agent install
-ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
-ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
-# Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
-ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
-
-[Install]
-WantedBy=Mistborn-base.service
@@ -1,17 +0,0 @@
---
-# This is the internal user database
-# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
-
-_meta:
-  type: "internalusers"
-  config_version: 2
-
-# Define your internal users here
-
-mistborn:
-  hash: "__MISTBORN_HASH__"
-  reserved: true
-  backend_roles:
-  - "admin"
-  description: "Mistborn user"
-
@@ -1,16 +0,0 @@
-#!/bin/bash
-
-set -e
-
-if [[ -f "/opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml" ]]; then
-    echo "internal_users.yml exists. Proceeding."
-    exit 0
-fi
-
-mkdir -p /opt/mistborn_volumes/extra/elasticsearch/init/ >/dev/null 2>&1
-chmod -R +x /opt/mistborn_volumes/extra/elasticsearch/init/
-cp /opt/mistborn/scripts/services/elasticsearch/files/internal_users.yml /opt/mistborn_volumes/extra/elasticsearch/init/
-
-ELASTICSEARCH_MISTBORN_HASHED=$(docker run --rm amazon/opendistro-for-elasticsearch:1.12.0 bash /usr/share/elasticsearch/plugins/opendistro_security/tools/hash.sh -p ${MISTBORN_DEFAULT_PASSWORD} | tr -d '\n')
-
-sed -i "s|__MISTBORN_HASH__|${ELASTICSEARCH_MISTBORN_HASHED}|" /opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml
@@ -1,21 +0,0 @@
-#!/bin/bash
-
-if [[ -f "/opt/mistborn_volumes/extra/guacamole/init/initdb.sql" ]]; then
-    echo "initdb.sql exists. Proceeding."
-    exit 0
-fi
-
-mkdir -p /opt/mistborn_volumes/extra/guacamole/init/ >/dev/null 2>&1
-chmod -R +x /opt/mistborn_volumes/extra/guacamole/init/
-docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgres > /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
-
-# grab values in initdb.sql to replace
-HEXSTRINGS=($(egrep -o [0-9a-fA-F]{64} /opt/mistborn_volumes/extra/guacamole/init/initdb.sql))
-
-# reset default password in init.db
-SALT=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice('0123456789ABCDEF') for x in range(64)]))")
-GUAC_PASSWORD_HASHED=$(echo -n "${MISTBORN_DEFAULT_PASSWORD}${SALT}" | sha256sum | awk '{print $1}' | tr a-z A-Z)
-
-sed -i "s/${HEXSTRINGS[1]}/$SALT/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
-sed -i "s/${HEXSTRINGS[0]}/$GUAC_PASSWORD_HASHED/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
-sed -i "s/guacadmin/mistborn/g" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-iptables -w -D DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
-iptables -w -D DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-iptables -w -I DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
-iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
@@ -1,6 +0,0 @@
-<agent_config>
-    <localfile>
-        <log_format>json</log_format>
-        <location>/var/log/suricata/eve.json</location>
-    </localfile>
-</agent_config>
@@ -1,62 +0,0 @@
-filebeat.modules:
- module: suricata 
-  eve:
-    enabled: true
-    var.paths: ["/var/log/suricata/eve.json"]
-# - module: system
-#   syslog:
-#     enabled: true
-#   auth:
-#     enabled: true
-# - module: auditd
-#   log:
-#     # - Does not look like Auditd is supported in Alpine linux: https://github.com/linuxkit/linuxkit/issues/52
-#     # - CentOS does not need us to install the audit system, it ships as standard. If you are using Ubuntu, though,
-#     # this is probably something you would want to install. (sudo apt-get install -y auditd audispd-plugins)
-#     enabled: true
-
-#filebeat.inputs:
-#- type: container
-#  enabled: true
-#  paths:
-#    -/var/lib/docker/containers/*/*.log
-#  stream: all # can be all, stdout or stderr
-
-#========================== Filebeat autodiscover ==============================
-# See this URL on how to run Apache2 Filebeat module: # https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html
-filebeat.autodiscover:
-  providers:
-    - type: docker
-      # https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html
-      # This URL alos contains instructions on multi-line logs
-      hints.enabled: true
-
-#================================ Processors ===================================
-processors:
-#- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_locale:
-    format: offset
- add_host_metadata:
-    netinfo.enabled: true
-
-#========================== Elasticsearch output ===============================
-output.elasticsearch:
-  hosts: ["${ELASTICSEARCH_HOST}:9200"]
-  username: ${ELASTICSEARCH_USERNAME}
-  password: ${ELASTICSEARCH_PASSWORD}
-
-#============================== Dashboards =====================================
-setup.dashboards:
-  enabled: true
-
-#============================== Kibana =========================================
-setup.kibana:
-  host: "${KIBANA_HOST}:80"
-  username: ${ELASTICSEARCH_USERNAME}
-  password: ${ELASTICSEARCH_PASSWORD}
-
-#============================== Xpack Monitoring ===============================
-xpack.monitoring:
-  enabled: true
-  elasticsearch:
@@ -1,101 +0,0 @@
-#!/bin/bash
-
-set -e
-
-# detect if suricata is installed
-if [[ $(dpkg-query -W -f='${Status}' suricata 2>/dev/null | grep -c "ok installed") -eq 1 ]]; then
-    echo "Suricata Installed"
-    exit 0
-fi
-
-source /opt/mistborn/scripts/subinstallers/platform.sh
-
-# minimal dependencies
-sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
-                libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
-                make libmagic-dev libjansson-dev
-
-## recommended dependencies
-#sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
-#                libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
-#                libcap-ng-dev libcap-ng0 make libmagic-dev         \
-#                libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
-#                python-yaml rustc cargo
-
-# iptables/nftables integration
-sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1  \
-                libnetfilter-log-dev libnetfilter-log1      \
-                libnfnetlink-dev libnfnetlink0
-
-
-if [ "$DISTRO" == "ubuntu" ]; then
-    echo "Installing Suricata Ubuntu PPA"
-    sudo -E add-apt-repository -y ppa:oisf/suricata-stable
-    sudo -E apt-get update
-    sudo -E apt-get install -y suricata
-elif [ "$DISTRO" == "debian" ]; then
-    # retrieve version codename
-    source /etc/os-release
-    echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \
-        sudo -E tee /etc/apt/sources.list.d/backports.list
-    sudo -E apt-get update
-    sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports
-else
-    echo "Basic Suricata installation"
-    sudo -E apt-get install -y suricata
-fi
-
-# # iptables
-# sudo iptables -A INPUT -j NFQUEUE
-# sudo iptables -I FORWARD -j NFQUEUE
-# sudo iptables -I OUTPUT -j NFQUEUE
-
-# # rsyslog to create /var/log/suricata.log
-# sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
-# sudo chown root:root /etc/rsyslog.d/20-suricata.conf
-# sudo systemctl restart rsyslog
-
-IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
-sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml
-sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata
-
-systemctl restart suricata
-
-# wait for service to be listening
-while ! nc -z 10.2.3.1 55000; do
-    WAIT_TIME=10
-    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
-    sleep ${WAIT_TIME}
-done
-
-# set working directory to mistborn for docker-compose
-pushd .
-cd /opt/mistborn
-
-# ensure group exists
-sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
-
-# add this host to group
-WAZUH_ID=$(sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
-sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
-
-# write agent.conf
-sudo docker-compose -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
-<agent_config>
-    <localfile>
-        <log_format>json</log_format>
-        <location>/var/log/suricata/eve.json</location>
-    </localfile>
-</agent_config>
-EOF
-"
-
-# restart manager
-sudo docker-compose -f extra/wazuh.yml restart wazuh
-
-popd
-
-
-mkdir -p /opt/mistborn_volumes/extra/scirius/init/ >/dev/null 2>&1
-chmod -R +x /opt/mistborn_volumes/extra/scirius/init/
-cp /opt/mistborn/scripts/services/scirius/files/filebeat.docker.yml /opt/mistborn_volumes/extra/scirius/init/
@@ -1,117 +0,0 @@
-#!/usr/bin/python3
-"""
-Copyright(C) 2014-2020, Stamus Networks
-Written by Eric Leblond <eleblond@stamus-networks.com>
-
-This file is part of Scirius.
-
-Scirius is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-Scirius is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with Scirius.  If not, see <http://www.gnu.org/licenses/>.
-"""
-
-import pyinotify
-import argparse
-import subprocess
-import logging
-import os
-
-have_daemon = True
-try:
-    import daemon
-    import daemon.pidfile as pidlockfile
-except:
-    logging.warning("No daemon support available, install python-daemon if feature is needed")
-    have_daemon = False
-
-RELOAD_FILE = "scirius.reload"
-
-parser = argparse.ArgumentParser(description='Suricata reloader')
-parser.add_argument('-r', '--reload', default=False, action="store_true", help="If set reload Suricata instead of restarting")
-parser.add_argument('-p', '--path', default='/etc/suricata/rules', help='Directory to monitor for scirius.reload file')
-parser.add_argument('-l', '--log', default=None, help='File to log output to (default to stdout)')
-parser.add_argument('-v', '--verbose', default=False, action="count", help="Show verbose output, use multiple times increase verbosity")
-if have_daemon:
-    parser.add_argument('-D', '--daemon', default=False, action="store_true", help="Run as unix daemon")
-    parser.add_argument('-P', '--pidfile', default='/var/run/suri-reloader.pid', help='PID file for suri-reloader')
-
-args = parser.parse_args()
-
-if args.verbose >= 3:
-    loglevel=logging.DEBUG
-elif args.verbose >= 2:
-    loglevel=logging.INFO
-elif args.verbose >= 1:
-    loglevel=logging.WARNING
-else:
-    loglevel=logging.ERROR
-
-def SuriReload(reload = False):
-    if reload:
-        if subprocess.call(['service', 'suricata', 'reload']):
-            logging.error("Unable to reload suricata")
-        else:
-            logging.info("Reloaded suricata")
-    else:
-        if subprocess.call(['service', 'suricata', 'restart']):
-            logging.error("Unable to restart suricata")
-        else:
-            logging.info("Restarted suricata")
-
-class EventHandler(pyinotify.ProcessEvent):
-    def process_IN_CLOSE_WRITE(self, event):
-        if not RELOAD_FILE in event.pathname:
-            return
-        SuriReload(self.reload)
-        os.unlink(event.pathname)
-
-    def set_mode(self, mode):
-        if mode == "reload":
-            self.reload = True
-        else:
-            self.reload = False
-
-def setup_logging(args):
-    if args.log:
-        logging.basicConfig(filename=args.log,
-                            format='%(asctime)s %(name)-12s %(levelname)-8s %(message)s',
-                            level=loglevel)
-    else:
-        logging.basicConfig(level=loglevel)
-
-def main_task(args):
-    setup_logging(args)
-
-    reload_file = os.path.join(args.path, RELOAD_FILE)
-    if os.path.isfile(reload_file):
-        SuriReload(args.reload)
-        os.unlink(reload_file)
-
-    handler = EventHandler()
-    if args.reload:
-        handler.set_mode("reload")
-    else:
-        handler.set_mode("restart")
-
-    wm = pyinotify.WatchManager()  # Watch Manager
-    mask = pyinotify.IN_CLOSE_WRITE
-    notifier = pyinotify.Notifier(wm, handler)
-    wdd = wm.add_watch(args.path, mask, rec=True)
-    logging.info("Starting filesystem monitoring")
-    notifier.loop()
-
-if have_daemon and args.daemon:
-    pidfile = pidlockfile.TimeoutPIDLockFile(args.pidfile)
-    with daemon.DaemonContext(pidfile=pidfile):
-        main_task(args)
-else:
-    main_task(args)
@@ -1,7 +0,0 @@
-#!/bin/bash
-
-systemctl start suricata
-systemctl enable suricata
-
-apt-get install -y python-pyinotify
-python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &
@@ -1,6 +0,0 @@
-#!/bin/bash
-
-systemctl stop suricata
-systemctl disable suricata
-
-kill $(pgrep -f suri_reloader) 2>/dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-
-# detect if already installed
-if dpkg -s wazuh-agent &> /dev/null; then
-    echo "Wazuh agent already installed"
-    exit 0
-fi
-
-# install curl
-echo "install curl"
-sudo -E apt-get install -y curl
-
-# prepare repo
-echo "Adding Wazuh Repository"
-curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo -E apt-key add -
-echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo -E tee /etc/apt/sources.list.d/wazuh.list
-
-apt-get update
-
-# wait for service to be listening
-while ! nc -z 10.2.3.1 55000; do
-    WAIT_TIME=10
-    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
-    sleep ${WAIT_TIME}
-done
-
-# install
-echo "Installing Wazuh agent"
-WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent
-
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-systemctl start wazuh-agent
-systemctl enable wazuh-agent
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-systemctl stop wazuh-agent
-systemctl disable wazuh-agent
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-sudo apt-get update
-
-UPDATES=$(sudo apt-get dist-upgrade -s --quiet=2 | grep ^Inst | wc -l)
-
-if [[ "$UPDATES" -ne "0" ]]; then
-    echo "Please run updates and reboot before installing Mistborn: sudo apt-get update && sudo apt-get -y dist-upgrade"
-    exit 1;
-fi
@@ -1,31 +0,0 @@
-#!/bin/bash
-
-# Cockpit
-figlet "Mistborn: Installing Cockpit"
-if [ "$DISTRO" == "ubuntu" ]; then
-    echo "Ubuntu backports enabled by default"
-
-elif [ "$DISTRO" == "debian" ]; then
-    sudo grep -qF "buster-backports" /etc/apt/sources.list.d/backports.list \
-    && echo "buster-backports already in sources" \
-    || echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee -a /etc/apt/sources.list.d/backports.list
-    
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
-    echo "Raspbian repos contain cockpit"
-fi
-    
-sudo -E apt-get install -y cockpit
-
-if [ $(sudo apt-cache show cockpit-docker > /dev/null 2>&1) ]; then
-    # no longer supported upstream in Ubuntu 20.04
-    sudo -E apt-get install -y cockpit-docker
-elif [ $(sudo apt-cache show cockpit-podman > /dev/null 2>&1) ]; then
-    sudo -E apt-get install -y cockpit-podman
-fi
-
-sudo cp ./scripts/conf/cockpit.conf /etc/cockpit/cockpit.conf
-sudo systemctl restart cockpit.socket
-
-# create system cockpit user
-echo "Creating cockpit user"
-sudo useradd -s /bin/bash -d /home/cockpit -m -G sudo -p $(openssl passwd -1 "$MISTBORN_DEFAULT_PASSWORD") cockpit || true
@@ -18,6 +18,3 @@ fi
 if [ ! -f /usr/local/bin/docker-compose ]; then
    sudo -E ln -s $(which docker-compose) /usr/local/bin/docker-compose
 fi
-
-# daemon.json
-#source ./scripts/subinstallers/docker_daemon.sh
@@ -1,7 +0,0 @@
-#!/bin/bash
-
-# daemon.json
-if [ ! -f /etc/docker/daemon.json ]; then
-    sudo -E cp ./scripts/conf/docker-daemon.json /etc/docker/daemon.json
-    sudo -E systemctl restart docker
-fi
@@ -1,7 +0,0 @@
-#!/bin/bash
-
-# generate bitwarden .env files
-BITWARDEN_PROD_FILE="$1"
-echo "WEBSOCKET_ENABLED=true" > $BITWARDEN_PROD_FILE
-echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
-chmod 600 $BITWARDEN_PROD_FILE
@@ -1,6 +0,0 @@
-#!/bin/bash
-
-# Elasticsearch
-ELASTICSEARCH_PROD_FILE="$1"
-echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $ELASTICSEARCH_PROD_FILE
-chmod 600 $ELASTICSEARCH_PROD_FILE
@@ -1,14 +0,0 @@
-#!/bin/bash
-
-# Guacamole
-GUAC_PROD_FILE="$1"
-GUAC_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
-echo "POSTGRES_HOST=guac_postgres" > $GUAC_PROD_FILE
-echo "POSTGRES_HOSTNAME=guac_postgres" > $GUAC_PROD_FILE
-echo "POSTGRES_PORT=5432" >> $GUAC_PROD_FILE
-echo "POSTGRES_DB=guacamole_db" >> $GUAC_PROD_FILE
-echo "POSTGRES_DATABASE=guacamole_db" >> $GUAC_PROD_FILE
-echo "POSTGRES_USER=guac_user" >> $GUAC_PROD_FILE
-echo "POSTGRES_PASSWORD=$GUAC_PASSWORD" >> $GUAC_PROD_FILE
-echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $GUAC_PROD_FILE
-chmod 600 $GUAC_PROD_FILE
@@ -1,13 +0,0 @@
-#!/bin/bash
-
-# JITSI
-JITSI_PROD_FILE="$1"
-cp ${MISTBORN_HOME}/scripts/conf/jitsi.env $JITSI_PROD_FILE
-mkdir -p ${MISTBORN_HOME}/.envs/.production/.jitsi-cfg/{web/letsencrypt,transcripts,prosody,jicofo,jvb}
-sed -i "s/JICOFO_COMPONENT_SECRET.*/JICOFO_COMPONENT_SECRET=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
-sed -i "s/JICOFO_AUTH_PASSWORD.*/JICOFO_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
-sed -i "s/JVB_AUTH_PASSWORD.*/JVB_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
-sed -i "s/JIGASI_XMPP_PASSWORD.*/JIGASI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
-sed -i "s/JIBRI_RECORDER_PASSWORD.*/JIBRI_RECORDER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
-sed -i "s/JIBRI_XMPP_PASSWORD.*/JIBRI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
-chmod 600 $JITSI_PROD_FILE
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# generate nextcloud .env files
-NEXTCLOUD_PROD_FILE="$1"
-#NEXTCLOUD_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
-NEXTCLOUD_PASSWORD="${MISTBORN_DEFAULT_PASSWORD}"
-echo "NEXTCLOUD_ADMIN_USER=mistborn" > $NEXTCLOUD_PROD_FILE
-echo "NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_PASSWORD" >> $NEXTCLOUD_PROD_FILE
-echo "NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.mistborn" >> $NEXTCLOUD_PROD_FILE
-chmod 600 $NEXTCLOUD_PROD_FILE
@@ -1,8 +0,0 @@
-#!/bin/bash
-
-# generate onlyoffice .env files
-ONLYOFFICE_PROD_FILE="$1"
-JWT_SECRET="${MISTBORN_DEFAULT_PASSWORD}"
-echo "JWT_ENABLED=true" > $ONLYOFFICE_PROD_FILE
-echo "JWT_SECRET=$JWT_SECRET" >> $ONLYOFFICE_PROD_FILE
-chmod 600 $ONLYOFFICE_PROD_FILE
@@ -1,6 +0,0 @@
-#!/bin/bash
-
-# RaspAP
-RASPAP_PROD_FILE="$1"
-echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" > $RASPAP_PROD_FILE
-chmod 600 $RASPAP_PROD_FILE
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-# generate rocketchat .env files
-ROCKETCHAT_PROD_FILE="$1"
-#ROCKETCHAT_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
-ROCKETCHAT_PASSWORD="${MISTBORN_DEFAULT_PASSWORD}"
-echo "ROCKETCHAT_USER=bot" > $ROCKETCHAT_PROD_FILE
-echo "ROCKETCHAT_ROOM=GENERAL" >> $ROCKETCHAT_PROD_FILE
-echo "BOT_NAME=bot" >> $ROCKETCHAT_PROD_FILE
-echo "ROCKETCHAT_PASSWORD=$ROCKETCHAT_PASSWORD" >> $ROCKETCHAT_PROD_FILE
-
-# docker environment
-echo "MISTBORN_BIND_IP=${MISTBORN_BIND_IP}" >> $ROCKETCHAT_PROD_FILE
-
-chmod 600 $ROCKETCHAT_PROD_FILE
@@ -1,16 +0,0 @@
-#!/bin/bash
-
-# Scirius
-SCIRIUS_PROD_FILE="$1"
-SCIRIUS_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
-echo "SECRET_KEY=$SCIRIUS_SECRET_KEY" > $SCIRIUS_PROD_FILE
-echo "ALLOWED_HOSTS=scirius.mistborn" >> $SCIRIUS_PROD_FILE
-echo "DJANGO_SUPERUSER_USERNAME=mistborn" >> $SCIRIUS_PROD_FILE
-echo "DJANGO_SUPERUSER_EMAIL=mistborn@email.mistborn" >> $SCIRIUS_PROD_FILE
-
-echo "ELASTICSEARCH_HOST=10.2.3.1" >> $SCIRIUS_PROD_FILE
-echo "KIBANA_HOST=wazuh.mistborn" >> $SCIRIUS_PROD_FILE
-
-echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $SCIRIUS_PROD_FILE
-
-chmod 600 $SCIRIUS_PROD_FILE
@@ -1,92 +0,0 @@
-#!/bin/bash
-
-# Wazuh
-WAZUH_PROD_FILE="$1"
-echo "ELASTIC_USERNAME=mistborn" > $WAZUH_PROD_FILE
-echo "ELASTIC_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
-
-echo "ELASTICSEARCH_USERNAME=mistborn" >> $WAZUH_PROD_FILE
-echo "ELASTICSEARCH_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
-
-# kibana odfe
-# kibana-odfe/config/wazuh_app_config.sh
-# https://wazuh
-echo "WAZUH_API_URL=https://10.2.3.1" >> $WAZUH_PROD_FILE
-echo "API_PORT=55000" >> $WAZUH_PROD_FILE
-echo "API_USERNAME=wazuh-wui" >> $WAZUH_PROD_FILE
-
-#API_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
-
-API_PASSWORD_PYTHON=$(cat << EOF
-
-import secrets
-import random
-import string
-
-random_pass = ([secrets.choice("@$!*?-"),
-                           secrets.choice(string.digits),
-                           secrets.choice(string.ascii_lowercase),
-                           secrets.choice(string.ascii_uppercase),
-                           ]
-                          + [secrets.choice(string.ascii_lowercase
-                                           + string.ascii_uppercase
-                                           + "@$!*?-"
-                                           + string.digits) for i in range(12)])
-
-random.shuffle(random_pass)
-random_pass = ''.join(random_pass)
-print(random_pass)
-
-EOF
-)
-
-API_PASSWORD=$(python3 -c "${API_PASSWORD_PYTHON}")
-
-echo "API_PASSWORD=${API_PASSWORD}" >> $WAZUH_PROD_FILE
-
-# kibana-odfe/config/entrypoint.sh:
-# https://elasticsearch:9200
-echo "ELASTICSEARCH_URL=https://10.2.3.1:9200" >> $WAZUH_PROD_FILE
-
-
-cat >> ${WAZUH_PROD_FILE}<< EOF
-
-PATTERN="wazuh-alerts-*"
-
-CHECKS_PATTERN=true
-CHECKS_TEMPLATE=true
-CHECKS_API=true
-CHECKS_SETUP=true
-
-EXTENSIONS_PCI=true
-EXTENSIONS_GDPR=true
-EXTENSIONS_HIPAA=true
-EXTENSIONS_NIST=true
-EXTENSIONS_TSC=true
-EXTENSIONS_AUDIT=true
-EXTENSIONS_OSCAP=false
-EXTENSIONS_CISCAT=false
-EXTENSIONS_AWS=false
-EXTENSIONS_GCP=false
-EXTENSIONS_VIRUSTOTAL=true
-EXTENSIONS_OSQUERY=true
-EXTENSIONS_DOCKER=true
-
-APP_TIMEOUT=20000
-
-API_SELECTOR=true
-IP_SELECTOR=true
-IP_IGNORE="[]"
-
-WAZUH_MONITORING_ENABLED=true
-WAZUH_MONITORING_FREQUENCY=900
-WAZUH_MONITORING_SHARDS=2
-WAZUH_MONITORING_REPLICAS=0
-
-ADMIN_PRIVILEGES=true
-
-EOF
-
-echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
-
-chmod 600 $WAZUH_PROD_FILE
@@ -4,7 +4,6 @@ figlet "Mistborn: Container Credentials"

 # generate production .env file for Django
 mkdir -p ./.envs/.production
-chmod 700 ./.envs
 DJANGO_PROD_FILE="./.envs/.production/.django"
 DJANGO_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
 #CELERY_FLOWER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
@@ -23,7 +22,6 @@ echo "#SENTRY_DNS=" >> $DJANGO_PROD_FILE
 echo "MISTBORN_INSTALL_COCKPIT=$MISTBORN_INSTALL_COCKPIT" >> $DJANGO_PROD_FILE
 echo "MISTBORN_PORTAL_IP=10.2.3.1" >> $DJANGO_PROD_FILE
 echo "MISTBORN_PORTAL_PORT=5000" >> $DJANGO_PROD_FILE
-chmod 600 $DJANGO_PROD_FILE

 # generate production .env file for postgresql
 POSTGRES_PROD_FILE="./.envs/.production/.postgres"
@@ -33,7 +31,6 @@ echo "POSTGRES_PORT=5432" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_DB=mistborn" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_USER=prod" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> $POSTGRES_PROD_FILE
-chmod 600 $POSTGRES_PROD_FILE


 # generate production .env file for pihole
@@ -42,4 +39,4 @@ PIHOLE_PROD_FILE="./.envs/.production/.pihole"
 WEBPASSWORD="$1"
 echo "TZ=\"America/New York\"" > $PIHOLE_PROD_FILE
 echo "WEBPASSWORD=$WEBPASSWORD" >> $PIHOLE_PROD_FILE
-chmod 600 $PIHOLE_PROD_FILE
+
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+# resetting ip6tables rules
+sudo ip6tables -F
+sudo ip6tables -t nat -F
+sudo ip6tables -X MISTBORN_LOG_DROP 2>/dev/null || true
+sudo ip6tables -X MISTBORN_INT_LOG_DROP 2>/dev/null || true
+
+# ip6tables: log and drop chain (external threats)
+sudo ip6tables -N MISTBORN_LOG_DROP
+sudo ip6tables -A MISTBORN_LOG_DROP -m limit --limit 6/min -j LOG --log-prefix "[Mistborn-IPTables-Dropped]: " --log-level 4
+sudo ip6tables -A MISTBORN_LOG_DROP -j DROP
+
+# ip6tables: log and drop chain (internal threats)
+sudo ip6tables -N MISTBORN_INT_LOG_DROP
+sudo ip6tables -A MISTBORN_INT_LOG_DROP -m limit --limit 6/min -j LOG --log-prefix "[Mistborn-IPTables-Internal-Dropped]: " --log-level 4
+sudo ip6tables -A MISTBORN_INT_LOG_DROP -j DROP
+
+# ip6tables
+echo "Setting ip6tables rules"
+sudo ip6tables -P INPUT ACCEPT
+sudo ip6tables -I INPUT -i lo -j ACCEPT
+sudo ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+sudo ip6tables -A INPUT -j MISTBORN_LOG_DROP
+
+sudo ip6tables -P INPUT DROP
+sudo ip6tables -P FORWARD DROP
+sudo ip6tables -P OUTPUT ACCEPT
+
@@ -4,34 +4,36 @@ set -e

 figlet "Mistborn: Configuring Firewall"

+source ./scripts/subinstallers/vars.sh
+
 echo "stop iptables wrappers"
 if [ "$DISTRO" == "ubuntu" ]; then
-    echo "Disabling UFW"
+    # Disable UFW
    sudo systemctl stop ufw || true
    sudo systemctl disable ufw || true
 fi

-# default interface
-iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
-
-# real public interface
-riface=$(ip -o -4 route get 1.1.1.1 | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
-
 # resetting iptables
 sudo iptables -F
 sudo iptables -t nat -F
 sudo iptables -X MISTBORN_LOG_DROP 2>/dev/null || true
+sudo iptables -X MISTBORN_INT_LOG_DROP 2>/dev/null || true
 sudo iptables -X MISTBORN_WIREGUARD_INPUT 2>/dev/null || true
 sudo iptables -X MISTBORN_WIREGUARD_FORWARD 2>/dev/null || true
 sudo iptables -X MISTBORN_WIREGUARD_OUTPUT 2>/dev/null || true
 sudo iptables -X MISTBORN_DOCKER_OUTPUT 2>/dev/null || true
 sudo iptables -X MISTBORN_DOCKER_INPUT 2>/dev/null || true

-# iptables: log and drop chain
+# iptables: log and drop chain (external threats)
 sudo iptables -N MISTBORN_LOG_DROP
-sudo iptables -A MISTBORN_LOG_DROP -m limit --limit 6/min -j LOG --log-prefix "[IPTables-Dropped]: " --log-level 4
+sudo iptables -A MISTBORN_LOG_DROP -m limit --limit 6/min -j LOG --log-prefix "[Mistborn-IPTables-Dropped]: " --log-level 4
 sudo iptables -A MISTBORN_LOG_DROP -j DROP

+# iptables: log and drop chain (internal threats)
+sudo iptables -N MISTBORN_INT_LOG_DROP
+sudo iptables -A MISTBORN_INT_LOG_DROP -m limit --limit 6/min -j LOG --log-prefix "[Mistborn-IPTables-Internal-Dropped]: " --log-level 4
+sudo iptables -A MISTBORN_INT_LOG_DROP -j DROP
+
 # wireguard rules chains
 sudo iptables -N MISTBORN_WIREGUARD_INPUT
 sudo iptables -N MISTBORN_WIREGUARD_FORWARD
@@ -73,54 +75,3 @@ sudo iptables -t nat -I POSTROUTING -o $iface -j MASQUERADE
 #    sudo iptables -t nat -I POSTROUTING -o $riface -j MASQUERADE
 #fi

-# resetting ip6tables rules
-sudo ip6tables -F
-sudo ip6tables -t nat -F
-sudo ip6tables -X MISTBORN_LOG_DROP 2>/dev/null || true
-
-# ip6tables: log and drop chain
-sudo ip6tables -N MISTBORN_LOG_DROP
-sudo ip6tables -A MISTBORN_LOG_DROP -m limit --limit 6/min -j LOG --log-prefix "[IPTables-Dropped]: " --log-level 4
-sudo ip6tables -A MISTBORN_LOG_DROP -j DROP
-
-# ip6tables
-echo "Setting ip6tables rules"
-sudo ip6tables -P INPUT ACCEPT
-sudo ip6tables -I INPUT -i lo -j ACCEPT
-sudo ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-sudo ip6tables -A INPUT -j MISTBORN_LOG_DROP
-
-sudo ip6tables -P INPUT DROP
-sudo ip6tables -P FORWARD DROP
-sudo ip6tables -P OUTPUT ACCEPT
-
-# iptables-persistent
-if [ ! "$(dpkg-query -l iptables-persistent)" ]; then
-    echo "Installing iptables-persistent"
-    
-    # answer variables
-    echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections
-    echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections
-    
-    # install
-    sudo -E apt-get install -y iptables-persistent ipset
-else
-    echo "Saving iptables rules"
-    sudo bash -c "iptables-save > /etc/iptables/rules.v4"
-    echo "Saving ip6tables rules"
-    sudo bash -c "ip6tables-save > /etc/iptables/rules.v6"
-fi
-
-# IP forwarding
-sudo sed -i 's/.*net.ipv4.ip_forward.*/net.ipv4.ip_forward=1/' /etc/sysctl.conf
-
-# VM Overcommit Memory
-sudo grep -i "vm.overcommit_memory" /etc/sysctl.conf && sudo sed -i 's/.*vm.overcommit_memory.*/vm.overcommit_memory=1/' /etc/sysctl.conf || echo "vm.overcommit_memory=1" | sudo tee -a /etc/sysctl.conf
-
-# Force re-read of sysctl.conf
-sudo sysctl -p /etc/sysctl.conf
-
-# rsyslog to create /var/log/iptables.log
-sudo cp ./scripts/conf/15-iptables.conf /etc/rsyslog.d/
-sudo chown root:root /etc/rsyslog.d/15-iptables.conf
-sudo systemctl restart rsyslog
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+set -e
+
+# iptables-persistent
+if [ ! "$(dpkg-query -l iptables-persistent)" ]; then
+    echo "Installing iptables-persistent"
+    
+    # answer variables
+    echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections
+    echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections
+    
+    # install
+    sudo -E apt-get install -y iptables-persistent ipset
+else
+    echo "Saving iptables rules"
+    sudo bash -c "iptables-save > /etc/iptables/rules.v4"
+    echo "Saving ip6tables rules"
+    sudo bash -c "ip6tables-save > /etc/iptables/rules.v6"
+fi
+
+# IP forwarding
+sudo sed -i 's/.*net.ipv4.ip_forward.*/net.ipv4.ip_forward=1/' /etc/sysctl.conf
+
+# VM Overcommit Memory
+sudo grep -i "vm.overcommit_memory" /etc/sysctl.conf && sudo sed -i 's/.*vm.overcommit_memory.*/vm.overcommit_memory=1/' /etc/sysctl.conf || echo "vm.overcommit_memory=1" | sudo tee -a /etc/sysctl.conf
+
+# Force re-read of sysctl.conf
+sudo sysctl -p /etc/sysctl.conf
+
+# rsyslog to create /var/log/iptables.log
+sudo cp ./scripts/conf/15-iptables.conf /etc/rsyslog.d/
+sudo chown root:root /etc/rsyslog.d/15-iptables.conf
+sudo systemctl restart rsyslog
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -e
+
+source ./scripts/subinstallers/vars.sh
+
+# start from scratch
+sudo iptables -X MISTBORN-DOCKER-USER 2>/dev/null || true
+
+sudo iptables -N DOCKER-USER || true
+sudo iptables -N MISTBORN-DOCKER-USER || true
+
+# default Mistborn Docker User chain
+sudo iptables -A MISTBORN-DOCKER-USER -i $iface -s 10.0.0.0/8 -j RETURN
+sudo iptables -A MISTBORN-DOCKER-USER -i $iface -s 172.16.0.0/12 -j RETURN
+sudo iptables -A MISTBORN-DOCKER-USER -i $iface -s 192.168.0.0/16 -j RETURN
+sudo iptables -A MISTBORN-DOCKER-USER -i $iface -j MISTBORN_INT_LOG_DROP
+
+# add chain to DOCKER-USER
+sudo iptables -I DOCKER-USER -j MISTBORN-DOCKER-USER
@@ -1,22 +0,0 @@
-#!/bin/bash
-
-# INPUT default admin password
-while [ -z "${MISTBORN_DEFAULT_PASSWORD}" ]; do
-    echo
-    echo "(Mistborn) The default admin password may only container alphanumeric characters and _"
-    read -p "(Mistborn) Set default admin password: " -s MISTBORN_DEFAULT_PASSWORD
-    echo
-
-    if [[ ${MISTBORN_DEFAULT_PASSWORD} =~ ^[A-Za-z0-9_]+$ ]]; then
-    # it matches
-        echo "(Mistborn) Password is accepted"
-    else
-        unset MISTBORN_DEFAULT_PASSWORD
-        echo "(Mistborn) Try again"
-    fi
-
-done
-
-echo
-echo "MISTBORN_DEFAULT_PASSWORD is set"
-echo
@@ -5,13 +5,16 @@
 UNAME=$(uname | tr "[:upper:]" "[:lower:]")
 DISTRO=""
 VERSION_ID=""
+VERSION_CODENAME=""
 # If Linux, try to determine specific distribution
 if [ "$UNAME" == "linux" ]; then
    # use /etc/os-release to get distro 
    DISTRO=$(cat /etc/os-release | awk -F= '/^ID=/{print $2}')
    VERSION_ID=$(cat /etc/os-release | awk -F= '/^VERSION_ID=/{print $2}' | tr -d '"')
+    VERSION_CODENAME=$(cat /etc/os-release | awk -F= '/^VERSION_CODENAME=/{print $2}' | tr -d '"')
 fi

 figlet "UNAME: $UNAME"
 figlet "DISTRO: $DISTRO"
 figlet "VERSION: $VERSION_ID"
+figlet "CODENAME: $VERSION_CODENAME"
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -e
+
+# minimal dependencies
+sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
+                libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
+                make libmagic-dev libjansson-dev
+
+## recommended dependencies
+#sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
+#                libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
+#                libcap-ng-dev libcap-ng0 make libmagic-dev         \
+#                libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
+#                python-yaml rustc cargo
+
+# iptables/nftables integration
+sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1  \
+                libnetfilter-log-dev libnetfilter-log1      \
+                libnfnetlink-dev libnfnetlink0
+
+
+if [ "$DISTRO" == "ubuntu" ]; then
+    echo "Installing Suricata Ubuntu PPA"
+    sudo -E add-apt-repository -y ppa:oisf/suricata-stable
+    sudo -E apt-get update
+    sudo -E apt-get install -y suricata
+elif [ "$DISTRO" == "debian" ]; then
+    echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \
+        sudo -E tee -a /etc/apt/sources.list.d/backports.list
+    sudo -E apt-get update
+    sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports
+else
+    echo "Basic Suricata installation"
+    sudo -E apt-get install -y suricata
+fi
+
+# iptables
+sudo iptables -A INPUT -j NFQUEUE
+sudo iptables -I FORWARD -j NFQUEUE
+sudo iptables -I OUTPUT -j NFQUEUE
+
+# rsyslog to create /var/log/suricata.log
+sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
+sudo chown root:root /etc/rsyslog.d/20-suricata.conf
+sudo systemctl restart rsyslog
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# default interface
+iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
+
+# real public interface
+riface=$(ip -o -4 route get 1.1.1.1 | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
@@ -18,13 +18,6 @@ sudo mistborn-cli pullbuild
 sudo docker container prune -f
 sudo docker image prune -f

-
-# RESTART
-
 sudo systemctl stop Mistborn-base
-
-# docker daemon
-#source ./scripts/subinstallers/docker_daemon.sh
-
 sudo systemctl restart Mistborn-setup
 sudo systemctl restart Mistborn-base
@@ -1,51 +0,0 @@
-#!/bin/bash
-
-set -e
-
-MISTBORN_HOME="/opt/mistborn"
-
-SERVICES="$1"
-shift
-
-IFS=','
-read -ra SERVICES_ARRAY <<< "${SERVICES}"
-for SERVICE in "${SERVICES_ARRAY[@]}"; do
-    MISTBORN_SERVICE_FILE=${MISTBORN_HOME}/.envs/.production/.${SERVICE}
-    MISTBORN_SERVICE_INIT=${MISTBORN_HOME}/scripts/services/${SERVICE}/init.sh
-
-    # check and create file if needed
-    ${MISTBORN_HOME}/scripts/env/check_env_file.sh ${SERVICE}
-
-    # read in variables
-    set -a
-    source ${MISTBORN_HOME}/.env
-
-    if [[ -f "${MISTBORN_SERVICE_FILE}" ]]; then
-        echo "Loading service variables"
-        source ${MISTBORN_SERVICE_FILE}
-    else
-        echo "No service variables to load. Proceeding."
-    fi
-    set +a
-
-    # init script
-    if [[ -f "${MISTBORN_SERVICE_INIT}" ]]; then
-        echo "Running init script"
-        ${MISTBORN_SERVICE_INIT}
-    else
-        echo "No init script. Proceeding."
-    fi
-done
-
-# ensure base is up and listening
-echo "Checking that Mistborn-base has finished starting up..."
-
-while ! nc -z 10.2.3.1 5000; do
-    WAIT_TIME=$((5 + $RANDOM % 15))
-    echo "Waiting ${WAIT_TIME} seconds for Mistborn-base..."
-    sleep ${WAIT_TIME}
-done
-
-echo "Mistborn-base is running"
-
-exec "$@"
Author	SHA1	Message	Date
Steven Foerster	cb2be0a7b0	suricata rsyslog	2021-02-22 19:42:12 -05:00
Steven Foerster	f1f06910b1	put off docker rules	2021-02-22 18:11:38 -05:00
Steven Foerster	259befc961	MISTBORN-DOCKER-USER chain	2021-02-22 17:07:02 -05:00
Steven Foerster	f8d09291e1	set -e	2021-02-20 12:40:47 -05:00
Steven Foerster	b1ffc5bc1d	source	2021-02-20 12:37:00 -05:00
Steven Foerster	8287d7bc15	libjansson	2021-02-20 12:33:22 -05:00
Steven Foerster	f35dc04942	suricata first	2021-02-20 12:13:03 -05:00
Steven Foerster	f99184b199	basic iptables suricata rules	2021-02-20 11:09:18 -05:00
Steven Foerster	379567aca0	install -y	2021-02-20 10:30:45 -05:00
Steven Foerster	66dfe7cb1b	MISTBORN_INT_LOG_DROP	2021-02-20 10:28:25 -05:00
Steven Foerster	d069d53a27	executable	2021-02-20 10:21:48 -05:00
Steven Foerster	ac14b5f242	suricata iptables rules	2021-02-20 10:16:26 -05:00
Steven Foerster	7badb6ea19	splitting iptables scripts	2021-02-19 22:53:24 -05:00
Steven Foerster	1036ca8808	Merge branch 'v1' into 135-suricata	2021-02-16 23:30:55 -05:00
Steven Foerster	cd36347210	Merge branch 'master' into v1	2021-02-16 23:30:10 -05:00
Steven Foerster	b02aa61b2d	suricata script	2021-02-15 07:35:27 -05:00
Steven Foerster	7a5c9c71c2	Merge branch 'v1' of gitlab.com:cyber5k/mistborn into v1	2021-01-25 22:11:58 -05:00
Steven Foerster	01143fa791	mistborn iptables comment	2021-01-25 22:11:46 -05:00
Steven Foerster	b2d29d79c8	Merge branch 'master' into v1	2021-01-20 20:04:41 -05:00
Steven Foerster	3fb6c396d2	merge master	2021-01-18 10:24:03 -05:00
Steven Foerster	ca1701156c	Merge branch 'master' into v1	2021-01-16 16:08:30 -05:00
Steven Foerster	55171b255c	paths in setup	2021-01-16 11:13:10 -05:00
Steven Foerster	959e9fef1d	upstream dns	2021-01-02 12:55:12 -05:00
Steven Foerster	4d61374ebf	merge master	2020-12-31 22:43:06 -05:00
Steven Foerster	4ad96494f7	systemd	2020-12-29 14:58:06 -05:00
Steven Foerster	ccf9b61fd2	tweaks	2020-12-28 23:07:44 -05:00
Steven Foerster	18902b4be9	strip out flower	2020-12-28 21:09:11 -05:00
Steven Foerster	202f2658c4	mistborn user	2020-12-28 20:49:20 -05:00
Steven Foerster	021051a45f	Merge branch 'v1' of gitlab.com:cyber5k/mistborn into v1	2020-12-28 19:29:38 -05:00
Steven Foerster	0f6e9463e4	global environment variables	2020-12-28 19:29:30 -05:00
Steven Foerster	059c55c64b	sudo	2020-12-24 15:32:53 -05:00
Steven Foerster	b9dfb30084	mistborn install preserve env	2020-12-21 13:14:25 -05:00
Steven Foerster	fd1f3cc5cb	syntax	2020-12-21 12:35:58 -05:00
Steven Foerster	074a264bed	redis provider	2020-12-19 11:14:20 -05:00
Steven Foerster	682c620ee2	shell	2020-12-19 11:08:31 -05:00
Steven Foerster	a70feca44c	bash gitlab-ci	2020-12-19 11:01:29 -05:00
Steven Foerster	a6a641679d	removing extras to other repos	2020-12-18 23:27:54 -05:00