middleware

cockpit
pihole forwardauth
2021-05-31 15:08:52 -04:00 · 2021-05-31 14:59:16 -04:00 · 2021-05-31 14:54:06 -04:00 · 2021-05-31 14:20:50 -04:00 · 2021-05-31 12:01:00 -04:00 · 2021-05-28 18:04:11 +00:00
75 changed files with 1439 additions and 458 deletions
@@ -17,7 +17,8 @@ include:
 docker_build:
  stage: test
  script:
+    - apk add bash
    - apk add docker-compose
-    - scripts/subinstallers/gen_prod_env.sh "$MISTBORN_DEFAULT_PASSWORD"
+    - bash scripts/subinstallers/gen_prod_env.sh "$MISTBORN_DEFAULT_PASSWORD"
    - docker-compose -f base.yml build

@@ -1,6 +1,12 @@
 # Mistborn
 A secure platform for easily standing up and managing your own cloud services: including firewall, ad-blocking, and multi-factor Wireguard VPN access

+![Mistborn Wireguard](https://gitlab.com/cyber5k/public/-/raw/master/graphics/home.mistborn_wireguard_.png)*Wireguard Management in Mistborn*
+
+As featured in [Linux Magazine](https://www.linux-magazine.com/Issues/2020/240/Mistborn/(language)/eng-US) (Linux Pro Magazine in North America) in November 2020
+
+![Mistborn Featured in Linux Magazine](https://gitlab.com/cyber5k/public/-/raw/master/graphics/linux-magazine-cover-nov-2020.jpg "Mistborn featured in Linux Magazine November 2020")
+
 # Table of Contents
 [[_TOC_]]

@@ -9,6 +15,8 @@ The term [Mistborn](http://www.brandonsanderson.com/the-mistborn-saga-the-origin

 Mistborn started as a passion project for a husband and father protecting his family. Certain family members insisted on connecting their devices to free public WiFi networks. We needed a way to secure all family devices with a solid VPN (Wireguard). Once we had that we wanted to control DNS to block ads to all devices and block malicious websites across all family devices. Then we wanted chat, file-sharing, and webchat services that we could use for ourselves without entrusting our data to some big tech company. And then... home automation. I know I'll be adding more services so I made that easy to do.

+As an [Offensive Security Certified Professional (OSCP)](https://resources.infosecinstitute.com/certification/the-oscp-certification-and-exam/), I designed Mistborn thinking about how it would be attacked by both external and internal threats. In making design trade-off decisions I tend to the paranoid. See [Technical and Security Insights](#technical-and-security-insights).
+
 Ideal for teams who:
 - hate internet ads
 - need to be protected from malicious internet domains
@@ -20,6 +28,8 @@ Ideal for teams who:
 - want to limit or stop data collecting services
 - want to prevent being detected/blocked for using a proxy or VPN service

+See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki page to see the network scan results for Mistborn.
+
 Mistborn depends on these core open source technologies:
 - [Docker](https://www.docker.com/why-docker): containerization
 - [Wireguard](https://www.wireguard.com): secure VPN access
@@ -32,6 +42,10 @@ These tools are not vital to Mistborn itself but are integrated to enhance secur
 - [DNScrypt](https://www.dnscrypt.org): prevents DNS spoofing via cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered
 - [Traefik](https://docs.traefik.io): A modern, efficient reverse-proxy

+These tools can be turned on from the Mistborn Security Operations Center:
+- [Wazuh](https://wazuh.com/): Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.
+- [Suricata](https://suricata-ids.org/): Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM) and offline pcap processing. Suricata inspects the network traffic using a powerful and extensive rules and signature language, and has powerful Lua scripting support for detection of complex threats.
+
 Within Mistborn is a panel to enable and manage these free extra services (off by default), locally hosted in Docker containers:
 - [Home Assistant](https://www.home-assistant.io): Open source home automation that puts local control and privacy first
 - [Nextcloud](https://nextcloud.com): Nextcloud offers the industry-leading, on-premises content collaboration platform. It combines the convenience and ease of use of consumer-grade solutions like Dropbox and Google Drive with the security, privacy and control business needs.
@@ -42,6 +56,8 @@ Within Mistborn is a panel to enable and manage these free extra services (off b
 - [Jellyfin](https://jellyfin.org): The Free Media Software System.
 - [Tor](https://www.torproject.org): The Onion Router. One tool in the arsenal of online security and privacy.
 - [Jitsi](https://jitsi.org): Multi-platform open-source video conferencing
+- [Guacamole](https://guacamole.apache.org): A clientless remote desktop gateway that supports standard protocols like VNC, RDP, and SSH.
+- [RaspAP](https://raspap.com/): The easiest, full-featured wireless router setup for Debian-based devices. Period. (Mistborn integration in alpha testing).

 # Quickstart
 Tested Operating Systems (in order of thoroughness):
@@ -61,17 +77,18 @@ The Mistborn docker images exist for these architectures:

 | Mistborn Docker Images (hub.docker.com)        | Architectures       |
 |------------------------------------------------|---------------------|
-| mistborn (django, celery{worker,beat}, flower) | amd64, arm64, arm/v7 |
+| mistborn (django, celery{worker,beat})         | amd64, arm64, arm/v7 |
 | dnscrypt-proxy                                 | amd64, arm64, arm/v7 |

 Recommended System Specifications:

 | Use Case               | Description                                                                   | RAM   | Hard Disk |
 |------------------------|-------------------------------------------------------------------------------|-------|-----------|
-| Bare bones             | Wireguard, Pihole (no Cockpit, no extra services)                             | 1 GB  | 15 GB     |
-| Default                | Bare bones + Cockpit                                                          | 2 GB  | 15 GB     |
-| Low-resource services  | Default + Bitwarden, Tor, Syncthing                                           | 3 GB  | 20 GB     |
-| High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 4 GB+ | 25 GB+    |
+| Bare bones             | Wireguard, Pihole (no Cockpit, no extra services)                             | 2 GB  | 15 GB     |
+| Default                | Bare bones + Cockpit                                                          | 2 GB+ | 15 GB     |
+| Low-resource services  | Default + Bitwarden, Tor, Syncthing                                           | 4 GB  | 20 GB     |
+| High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 6 GB+ | 25 GB+    |
+| SIEM                   | Default + Wazuh + Extras                                                      | 16 GB+ | 100 GB+   |

 Starting from base installation
 ```
@@ -87,7 +104,7 @@ sudo mistborn-cli getconf

 Connect via Wireguard then visit `http://home.mistborn`

-For more information, see the `Installation` section below.
+For more information, see the [Installation](#installation) section below.

 # Network Diagram
 ![Mistborn Network Diagram](https://gitlab.com/cyber5k/public/-/raw/master/graphics/mistborn_network.png)
@@ -97,6 +114,22 @@ Mistborn protects your data in a variety of ways:
 - The Mistborn firewall blocks unsolicited incoming internet packets
 - Pi-hole running on Mistborn blocks outgoing internet requests to configurable blocked domains (ads, malicious/phishing domains, etc.) 

+See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki page to see more network diagrams and the network scan results for Mistborn.
+
+# Security Information & Event Management (SIEM)
+
+![Mistborn Security Center](https://gitlab.com/cyber5k/public/-/raw/master/graphics/home.mistborn_soc.png)
+
+The Mistborn Security Operations Center provides SIEM services with Wazuh. The Wazuh Manager requires an Open Distro for Elasticsearch backend. When the Mistborn host has >8 GB RAM the provided Elasticsearch backend can be used. Just click "Start Wazuh" on the `Security Center` page and enjoy your Enterprise-grade SIEM. Wazuh agents can be installed on just about any OS and all Wazuh agent traffic is communicated over the Wireguard connections. Instructions for adding endpoint agents can be found within Wazuh itself.
+
+Mistborn's Wazuh installs and integrates with Suricata running on Mistborn with logs ingested into Wazuh.
+
+![Mistborn Security Center: Wazuh Modules](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_modules.png)
+
+The Wazuh Kibana plugin leverages the power of Elasticsearch:
+
+![Mistborn Security Center: Wazuh Dashboard](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_se_dashboard.png)
+
 # Coppercloud
 Pihole provides a way to block outgoing DNS requests for given lists of blocked domains. Coppercloud provides a way to block outgoing network calls of all types to given lists of IP addresses (IPv4 only for now). This is especially useful for blocking outgoing telemetry (data and state sharing) to owners of software running on all of your devices.

@@ -111,12 +144,26 @@ We were getting frustrated at being forced to choose between being connected to

 *Netflix blocking my connections that it sees coming from a DigitalOcean droplet*

-In Mistborn, Gateways are upstream from the VPN server so connections to third-party services (e.g. Netflix, Hulu, etc.) will appear to be coming from the public IP address of the Gateway. I setup a Gateway at home (Mistborn on DigitalOcean) then all Wireguard profiles created with this Gateway will appear to be coming from my house and are not blocked. No port-forwarding required (assuming Mistborn is publicly accessible).
+In Mistborn, Gateways are upstream from the VPN server so connections to third-party services (e.g. Netflix, Hulu, etc.) will appear to be coming from the public IP address of the Gateway. I setup a Gateway at home (Raspberry Pi with `wireguard` and `openresolv` installed) and with our Mistborn on DigitalOcean, all Wireguard profiles created with this Gateway will appear to be coming from my house and are not blocked. No port-forwarding required (assuming Mistborn is publicly accessible).

 ![Mistborn Gateway Diagram](https://gitlab.com/cyber5k/public/-/raw/master/graphics/gateway_network.png)

 The Gateway adds an extra network hop. DNS is still resolved in Mistborn so pihole is still blocking ads.

+# Remote Desktop
+Remote desktops enable multiple users to share desktop resources and data. Remote desktops also enable groups to prevent sensitive data from ever entering an endpoint devices such as a smartphone. For reference, some United States Government regulations require controls to protect Controlled Unclassified Information (CUI) that are not feasible to implement on all endpoint devices and remote desktops prevent the data from entering the device (see NIST SP 800-171 3.1.19, CMMC AC.3.022).
+
+Mistborn enables remote desktop access via the Apache Guacamole extra service, which supports VNC, RDP, SSH, and other protocols. 
+
+![Guacamole Recent Connections](https://gitlab.com/cyber5k/public/-/raw/master/graphics/guacamole_connections.png)
+
+Guacamole implements its own users and groups access controls to manage access to individual desktops. All Mistborn users must be authenticated with Mistborn (via Wireguard only or MFA) to access the Guacamole interface.
+
+# Client to client communication
+By default direct communication between network clients is blocked. Mistborn clients can all talk to Mistborn and communicate via shared services (Jitsi, Nextcloud, etc). Direct client to client communication can be enabled via the "client-to-client" toggle.
+
+![System Settings](https://gitlab.com/cyber5k/public/-/raw/master/graphics/system_settings_dropdown.png)
+
 # Installation
 Mistborn is regularly tested on Ubuntu 20.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested). Make sure to install OS updates and restart before installing Mistborn (Wireguard installs differently on recent kernels).

@@ -238,8 +285,10 @@ Internet access is blocked via iptables until authentication is completed for an

 ![Mistborn Multi Factor Authentication - Token Prompt](https://gitlab.com/cyber5k/public/-/raw/master/graphics/mfa_token_enter.png)*Mistborn Multi Factor Authentication - Token Prompt*

-### MFA Mistborn Service Access
-Mistborn service access is blocked via traefik until Mistborn authentication is complete. You will not be able to access the web pages for pihole, cockpit, or any extra services until authentication is complete for an MFA profile. Attempting to visit one of these pages will redirect you to [http://home.mistborn](http://home.mistborn) where you must complete the authentication process. Click "Sign Out" to re-block access until authentication completes again.
+### MFA Mistborn Service Access - Fixed on 4 December 2020
+Mistborn service access is blocked via traefik until Mistborn authentication is complete. You will not be able to access the web pages for pihole, cockpit, or any extra services until authentication is complete for an MFA profile. Attempting to visit one of these pages will produce a "Mistborn: Not authorized" HTTP 403. Click "Sign Out" to re-block access until authentication completes again.
+
+![Mistborn Multi Factor Authentication - Not Authorized](https://gitlab.com/cyber5k/public/-/raw/master/graphics/mfa_not_authorized.png)*Mistborn Multi Factor Authentication - Not Authorized (Login Incomplete)*

 ### Notes
 - **Sessions**: Traefik checks the authenticated sessions on the server side to determine whether to allow access to the Mistborn service web pages. If an open session exists for your Mistborn IP address then access will be granted. You may close all sessions by clicking "Sign Out" on the Mistborn home page. Expired sessions are regularly cleaned by the Mistborn system (celery periodic task).
@@ -260,6 +309,9 @@ Mistborn uses the following domains (that can be reached by all Wireguard client
 | Syncthing | syncthing.mistborn | Off |
 | OnlyOffice | onlyoffice.mistborn | Off |
 | Jitsi | jitsi.mistborn | Off |
+| Guacamole | guac.mistborn | Off |
+| RaspAP | raspap.mistborn | Off |
+| Wazuh | wazuh.mistborn | Off |

 # Default Credentials
 These are the default credentials to use in the services you choose to use:
@@ -268,7 +320,10 @@ These are the default credentials to use in the services you choose to use:
 | ------- | -------- | -------- |
 | Pihole |  | {{default mistborn password}} |
 | Cockpit | cockpit | {{default mistborn password}} |
+| Wazuh | mistborn | {{default mistborn password}} |
 | Nextcloud | mistborn | {{default mistborn password}} |
+| Guacamole | mistborn | {{default mistborn password }} |
+| RaspAP | mistborn | {{default mistborn password}} |

 You can find the credentials sent to the Docker containers in: `/opt/mistborn/.envs/.production/`

@@ -315,7 +370,7 @@ But wait, there's more! You can:
 | Jitsi Meet     | [Jitsi Meet](https://play.google.com/store/apps/details?id=org.jitsi.meet)                         | [Jitsi Meet](https://apps.apple.com/us/app/jitsi-meet/id1165103905)                |
 | Bitwarden      | [Bitwarden](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden)                     | [Bitwarden](https://apps.apple.com/us/app/bitwarden-password-manager/id1137397744) |
 | Jellyfin       | [Jellyfin](https://play.google.com/store/apps/details?id=org.jellyfin.mobile)                      | [Jellyfin](https://apps.apple.com/us/app/jellyfin-mobile/id1480192618)             |
-| Home Assistant | [Home Assistant](https://play.google.com/store/apps/details?id=io.homeassistant.companion.android) |                                                                                    |
+| Home Assistant | [Home Assistant](https://play.google.com/store/apps/details?id=io.homeassistant.companion.android) | [Home Assistant](https://apps.apple.com/us/app/home-assistant/id1099568401)                                                                                   |
 | Rocket.Chat    | [Rocket.Chat](https://play.google.com/store/apps/details?id=chat.rocket.android)                   | [Rocket.Chat](https://apps.apple.com/us/app/rocket-chat/id1148741252)              |

 ## TLS Certificate
@@ -348,17 +403,48 @@ If Mistborn is installed via SSH then an iptables rule is added allowing externa

 SSH is permitted from any device connected to Mistborn by Wireguard.

-Password authentication in enabled. Mistborn disables password authentication for root. Fail2ban blocks IPs with excessive failed login attempts.
+Password authentication in enabled. Fail2ban blocks IPs with excessive failed login attempts.

 You can SSH using the Mistborn domain when connected by Wireguard:
 ```
 ssh user@home.mistborn
 ```

+## How do I change the upstream DNSCrypt servers?
+The upstream servers used by dnscrypt-proxy are set in:  
+
+`base.yml`:
+```
+services:
+...
+  dnscrypt-proxy:
+  ...
+    environment:
+    ...
+      - DNSCRYPT_SERVER_NAMES=[...]
+```
+
+The available options are here: https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-resolvers.md
+
 # Troubleshooting

 Once you're connected to Wireguard you should see .mistborn domains and the internet should work as expected. Be sure to use http (http://home.mistborn). Wireguard is the encrypted channel so there's usually no need to bother with TLS certs (WebRTC functionality and some mobile apps require TLS so it is available). Here are some things to check if you have issues:

+Check if you can ping an external IP address:
+```
+ping 1.1.1.1
+```
+
+Check if you can resolve local DNS queries:
+```
+dig home.mistborn
+```
+
+Check if you can resolve external DNS queries:
+```
+dig cyber5k.com
+```
+
 See if any docker containers are stopped:
 ```
 sudo docker container ls -a
@@ -385,6 +471,9 @@ The `dev/` folder contains a script for completing a hard reset: destroying and
 sudo ./dev/rebuild.sh
 ```

+## Troubleshooting Wireguard
+Ensure that your public IP address in your client profile (e.g. `Endpoint = <Mistborn public IP address>:<random port>`) is actually publicly available (not in 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) if you are attempting to access Mistborn across the internet.
+
 ## Troubleshooting Extra Services
 Each extra service has its own systemd process which can be monitored:
 ```
@@ -394,9 +483,12 @@ sudo journalctl -xfu Mistborn-syncthing
 sudo journalctl -xfu Mistborn-jellyfin
 sudo journalctl -xfu Mistborn-nextcloud
 sudo journalctl -xfu Mistborn-jitsi
+sudo journalctl -xfu Mistborn-guacamole
 sudo journalctl -xfu Mistborn-rocketchat
 sudo journalctl -xfu Mistborn-onlyoffice
 sudo journalctl -xfu Mistborn-tor
+sudo journalctl -xfu Mistborn-raspap
+sudo journalctl -xfu Mistborn-wazuh
 ```

 ## Troubleshooting Docker
@@ -433,6 +525,9 @@ Run updates and restart before installing Mistborn (`sudo apt-get update && sudo
 These are some notes regarding the technical design and implementations of Mistborn. Feel free to contact me for additional details.

 ## Attack Surface
+
+See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki entry.
+
 - **Wireguard**: Wireguard is the only way in to Mistborn. When new Wireguard profiles are generated they are attached to a random UDP port. Wireguard does not respond to unauthenticated traffic. External probes on the active Wireguard listening ports are not logged and do not appear on the Metrics page.
 - **SSH**: If Mistborn is installed over SSH (most common) then an iptables rule is added allowing future SSH connections from the same source IP address. All other external SSH is blocked. Internal SSH (over the Wireguard tunnels) is allowed. Password authentication is allowed. The SSH key for the `mistborn` user is only accepted from internal source IP addresses. Fail2ban is also installed.
 - **Traefik**: Iptables closes web ports (TCP 80 and 443) from external access and additonally all web interfaces are behind the Traefik reverse-proxy. All web requests (e.g. home.mistborn) must be resolved by Mistborn DNS (Pihole/dnsmasq) and originate from a Wireguard tunnel.
@@ -441,7 +536,7 @@ These are some notes regarding the technical design and implementations of Mistb
 ## Firewall
 - **IPtables**: Iptables rules and chains are manipulated directly. If UFW is present it is disabled. IPtables-persistent is used to save a simple set of secure default rules (most importantly setting the INPUT and FORWARD policies to DROP and allowing ESTABLISHED and RELATED traffic) that will be effective immediately upon system startup. Additional rules and chains are created by Docker on startup. Mistborn also creates some iptables chains during installation that are saved in the persistent rules. Mistborn iptables chains and rules are designed to work with Docker's with logic that is easy to follow. A power cycle will always result in a working state.
 - **PostUp/PostDown**: Wireguard configuration files on Mistborn include PostUp and PostDown directives that set routes and iptables rules for each Wireguard client individually.
- **Wireguard**: There is a one-to-one mapping between each Wireguard client and server instance listening on Mistborn. By design Wireguard clients cannot talk directly to each other but can use shared services and resources on Mistborn (e.g. Syncthing, Nextcloud, Jitisi, etc.)
+- **Wireguard**: There is a one-to-one mapping between each Wireguard client and server instance listening on Mistborn. By default Wireguard clients cannot talk directly to each other but can use shared services and resources on Mistborn (e.g. Syncthing, Nextcloud, Jitisi, etc). Toggling the "client-to-client" option will enable direct client-to-client communication.
 - **Metrics**: In addition to the iptables INPUT policy set to DROP, an iptables chain exists that logs the packet meta data before dropping it. Mistborn redirects packets that will be dropped to this chain instead. A summary of the data about these dropped packets (unsolicited network traffic) can be found on the Metrics page.
 - **Coppercloud**: Coppercloud works by populating ipsets with the ipset module in iptables to DROP (blacklist) or ACCEPT (whitelist) a given set of IP addresses. Upon system startup a celery task will compile the IP addresses, create the ipsets, and iptables rules.

@@ -451,19 +546,22 @@ These are some notes regarding the technical design and implementations of Mistb
 - The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 397 days. The certificate is checked daily and will regenerate when expiration is within 30 days.
 - Outbound UDP on port 53 is blocked. All DNS requests should be handled by the dnscrypt_proxy service and if any client, service, etc. tries to circumvent that it is blocked.
 - Unattended upgrades are set to automatically install operating system security updates.
+- Ownership of mistborn files is set to the system mistborn user and access to environment variables is disabled for users other than the owner.

-# Roadmap
+# Roadmap (not necessarily in order)
 Many features and refinements are in the works at various stages including:

- Option to upload metrics information to Cyber5K to refine each Mistborn instance's firewall
- Option to email default admin Wireguard config file
- Adding more extra services (e.g. Gitlab, Game Servers, etc.)
- Cyber5K marketplace to share Gateway access (to fixed IP addresses or domains, and for a fixed amount of time)
- Mistborn managing wireless interfaces for local access points (stripped down RaspAP)
- Optional periodic backup of local Mistborn config files and credentials to Cyber5K
- Internal network scan tool and feedback
+- Plugins for Extra Services (enabling third-party development)
+- Plugin repository
+- IPv6 support
 - Anomaly detection in network traffic

+# Featured In
+
+- [Linux Magazine](https://www.linux-magazine.com/Issues/2020/240/Mistborn/(language)/eng-US) November 2020 (featuring Mistborn version from early May 2020)
+- [Awesome Open Source](https://www.youtube.com/watch?v=hekP0_crotw) July 2020
+- [DB Tech](https://www.youtube.com/watch?v=UE_OuAOgoZI) May 2021
+
 # Follow
 You can find recent bugfixes, functional additions, some extra documentation and more at the Cyber5K Patreon page: [https://www.patreon.com/cyber5k](https://www.patreon.com/cyber5k)

@@ -475,4 +573,5 @@ Contact me at [steven@cyber5k.com](mailto:steven@cyber5k.com)

 Please consider supporting the project via:
 - [Paypal.me](https://paypal.me/cyber5k)
+- [Buy me a drink](https://www.buymeacoffee.com/cyber5k)
 - [Patreon](https://www.patreon.com/cyber5k)
@@ -53,6 +53,13 @@ services:
    #image: mistborn_production_traefik
    image: traefik:v2.2
    container_name: mistborn_production_traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.api.rule=Host(`traefik.mistborn`)"
+      - "traefik.http.routers.api.service=api@internal"
+      - "traefik.http.routers.api.middlewares=mistborn_headers@file"
+      - "traefik.http.routers.api.entrypoints=web"
+      #- "traefik.http.services.internal.loadbalancer.server.port=5000"
    depends_on:
      - django
    volumes:
@@ -67,11 +74,11 @@ services:
    #  #- "0.0.0.0:8080:8080/tcp" # dashboard
    command:
      ## API settings
-      #- --api.insecure=true
-      #- --api.dashboard=true
-      #- --api.debug=true
+      - --api.insecure=true
+      - --api.dashboard=true
+      - --api.debug=true
      ## Logs
-      - --log.level=ERROR
+      - --log.level=INFO
      ## Providers
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
@@ -145,22 +152,22 @@ services:
    restart: unless-stopped
    

-  flower:
-    image: "cyber5k/mistborn:${MISTBORN_TAG}"
-    container_name: mistborn_production_flower
-    env_file:
-      - ./.envs/.production/.django
-      - ./.envs/.production/.postgres
-    ports:
-      - "5555:5555/tcp"
-    command: /start-flower
-    restart: unless-stopped
+  #flower:
+  #  image: "cyber5k/mistborn:${MISTBORN_TAG}"
+  #  container_name: mistborn_production_flower
+  #  env_file:
+  #    - ./.envs/.production/.django
+  #    - ./.envs/.production/.postgres
+  #  ports:
+  #    - "5555:5555/tcp"
+  #  command: /start-flower
+  #  restart: unless-stopped
  
  pihole:
   container_name: mistborn_production_pihole
-   image: pihole/pihole:latest
+   image: pihole/pihole:v5.7
   env_file:
-     - /opt/mistborn_volumes/base/base.txt
+     - ./.envs/.production/.pihole
   ports:
     - "${MISTBORN_DNS_BIND_IP}:53:53/tcp"
     - "${MISTBORN_DNS_BIND_IP}:53:53/udp"
@@ -168,12 +175,16 @@ services:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole-http.rule=Host(`pihole.mistborn`)"
      - "traefik.http.routers.pihole-http.entrypoints=web"
-      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth,add-pihole-admin"
      - "traefik.http.routers.pihole-https.rule=Host(`pihole.mistborn`)"
      - "traefik.http.routers.pihole-https.entrypoints=websecure"
-      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth,add-pihole-admin"
      - "traefik.http.routers.pihole-https.tls.certresolver=basic"
+      - "traefik.http.middlewares.add-pihole-admin.addPrefix.prefix=/admin"
      - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
+      - "traefik.http.middlewares.mistborn_auth.forwardAuth.address=http://${MISTBORN_BIND_IP}:5000/auth/"
+      - "traefik.http.middlewares.mistborn_auth.forwardAuth.trustForwardHeader=true"
+      - "traefik.http.middlewares.mistborn_auth.forwardAuth.tls.insecureSkipVerify=true"
   environment:
     - ServerIP=10.2.0.3
     - DNS1='10.2.0.2#5054' # docs say port 5054, was 54; use network_mode: host to see which port is used
@@ -182,8 +193,6 @@ services:
     - DNSMASQ_LISTENING=all
   #  TZ: 'America/New York'
   # Volumes store your data between container upgrades
-   env_file:
-     - ./.envs/.production/.pihole
   volumes:
     - ../mistborn_volumes/base/pihole/etc-pihole:/etc/pihole/
     - ../mistborn_volumes/base/pihole/etc-dnsmasqd:/etc/dnsmasq.d/
@@ -7,7 +7,7 @@ RUN apk update \

 EXPOSE 9150

-ADD ./compose/production/tor/torrc /etc/tor/torrc
+ADD ./torrc /etc/tor/torrc

 USER tor
 CMD /usr/bin/tor -f /etc/tor/torrc
@@ -11,21 +11,15 @@
 [http.services]
  [http.services.cockpit.loadBalancer]
    [[http.services.cockpit.loadBalancer.servers]]
-      url = "http://10.2.3.1:9090"
+      url = "http://127.0.0.1:9090"

 [http.routers]
  [http.routers.cockpit]
    rule = "Host(`cockpit.mistborn`)"
    service = "cockpit"
    entrypoints = ["web", "websecure"]
-    #middlewares =
+    middlewares = ["mistborn_auth@docker"]

 [http.middlewares]
-  [http.middlewares.mistborn_auth.forwardAuth]
-    address = "http://10.2.3.1:5000/auth/"
-    trustForwardHeader = true
-    [http.middlewares.mistborn_auth.forwardAuth.tls]
-      insecureSkipVerify = true
-  
  [http.middlewares.mistborn_headers.headers]
    hostsProxyHeaders = ['X-CSRFToken']
@@ -19,7 +19,7 @@ services:
      - "traefik.http.routers.bitwarden-https.tls.certresolver=basic"
      - "traefik.http.services.bitwarden-service.loadbalancer.server.port=80"
    ports:
-      - 3012:3012/tcp
+      - "${MISTBORN_BIND_IP}:3012:3012/tcp"
    restart: unless-stopped

 networks:
@@ -0,0 +1,30 @@
+version: '3.7'
+
+services:
+
+  elasticsearch:
+    image: amazon/opendistro-for-elasticsearch:1.12.0
+    hostname: elasticsearch
+    restart: unless-stopped
+    ports:
+      - "${MISTBORN_BIND_IP}:9200:9200"
+    environment:
+      - discovery.type=single-node
+      - cluster.name=mistborn-cluster
+      - network.host=0.0.0.0
+      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+      - bootstrap.memory_lock=true
+    volumes:
+      - ../../mistborn_volumes/extra/elasticsearch/init/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+
+networks:
+  default:
+    external:
+      name: mistborn_default
@@ -0,0 +1,72 @@
+version: '3'
+
+# services
+services:
+  # guacd
+  guacd:
+    container_name: mistborn_production_guacd
+    image: guacamole/guacd
+    networks:
+      guacnetwork:
+    restart: unless-stopped
+    volumes:
+    - ../../mistborn_volumes/extra/guacamole/drive:/drive:rw
+    - ../../mistborn_volumes/extra/guacamole/record:/record:rw
+
+
+  # postgres
+  guac_postgres:
+    container_name: mistborn_production_guac_postgres
+    env_file:
+    - ../.envs/.production/.guacamole
+    environment:
+      PGDATA: /var/lib/postgresql/data/guacamole
+    image: postgres
+    networks:
+      guacnetwork:
+    restart: unless-stopped
+    volumes:
+    - ../../mistborn_volumes/extra/guacamole/init:/docker-entrypoint-initdb.d:ro
+    - ../../mistborn_volumes/extra/guacamole/data:/var/lib/postgresql/data:rw
+
+
+  # guacamole
+  guacamole:
+    container_name: mistborn_production_guacamole
+    labels:
+    - "traefik.enable=true"
+    - "traefik.http.routers.guacamole-http.rule=Host(`guac.mistborn`)"
+    - "traefik.http.routers.guacamole-http.entrypoints=web"
+    - "traefik.http.routers.guacamole-http.middlewares=mistborn_auth@file,add-guacamole"
+    - "traefik.http.routers.guacamole-https.rule=Host(`guac.mistborn`)"
+    - "traefik.http.routers.guacamole-https.entrypoints=websecure"
+    - "traefik.http.routers.guacamole-https.middlewares=mistborn_auth@file,add-guacamole"
+    - "traefik.http.routers.guacamole-https.tls.certresolver=basic"
+    - "traefik.http.middlewares.add-guacamole.addPrefix.prefix=/guacamole"
+    - "traefik.http.services.guacamole-service.loadbalancer.server.port=8080"
+    depends_on:
+    - guacd
+    - guac_postgres
+    environment:
+      GUACD_HOSTNAME: guacd
+      GUACD_PORT: 4822
+      #GUACAMOLE_HOME: /config
+    env_file:
+    - ../.envs/.production/.guacamole
+    image: guacamole/guacamole
+    links:
+    - guacd
+    networks:
+      guacnetwork:
+    #ports:
+## enable next line if not using nginx
+##    - 8080:8080/tcp # Guacamole is on :8080/guacamole, not /.
+## enable next line when using nginx
+    #- 8080/tcp
+    restart: unless-stopped
+
+# networks
+# create a network 'guacnetwork' in mode 'bridged'
+networks:
+  guacnetwork:
+    driver: bridge
@@ -3,7 +3,8 @@ version: '3'
 services:
    # Frontend
    jitsi-web:
-        image: jitsi/web
+        image: jitsi/web:latest
+        restart: unless-stopped
        #ports:
            #- '${HTTP_PORT}:80'
            #- '${HTTPS_PORT}:443'
@@ -18,59 +19,115 @@ services:
            - "traefik.http.routers.jitsi-https.tls.certresolver=basic"
            - "traefik.http.services.jitsi-service.loadbalancer.server.port=${HTTP_PORT}"
        volumes:
-            - ${CONFIG}/web:/config
-            - ${CONFIG}/web/letsencrypt:/etc/letsencrypt
-            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts
+            - ${CONFIG}/web:/config:Z
+            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
        env_file:
            - ../.envs/.production/.jitsi
        environment:
-            - ENABLE_AUTH
-            - ENABLE_GUESTS
            - ENABLE_LETSENCRYPT
            - ENABLE_HTTP_REDIRECT
-            - ENABLE_TRANSCRIPTIONS
+            - ENABLE_XMPP_WEBSOCKET
            - DISABLE_HTTPS
-            - JICOFO_AUTH_USER
            - LETSENCRYPT_DOMAIN
            - LETSENCRYPT_EMAIL
+            - LETSENCRYPT_USE_STAGING
            - PUBLIC_URL
-            - XMPP_DOMAIN
+            - TZ
+            - AMPLITUDE_ID
+            - ANALYTICS_SCRIPT_URLS
+            - ANALYTICS_WHITELISTED_EVENTS
+            - BRIDGE_CHANNEL
+            - BRANDING_DATA_URL
+            - CALLSTATS_CUSTOM_SCRIPT_URL
+            - CALLSTATS_ID
+            - CALLSTATS_SECRET
+            - CHROME_EXTENSION_BANNER_JSON
+            - CONFCODE_URL
+            - CONFIG_EXTERNAL_CONNECT
+            - DEPLOYMENTINFO_ENVIRONMENT
+            - DEPLOYMENTINFO_ENVIRONMENT_TYPE
+            - DEPLOYMENTINFO_USERREGION
+            - DIALIN_NUMBERS_URL
+            - DIALOUT_AUTH_URL
+            - DIALOUT_CODES_URL
+            - DROPBOX_APPKEY
+            - DROPBOX_REDIRECT_URI
+            - ENABLE_AUDIO_PROCESSING
+            - ENABLE_AUTH
+            - ENABLE_CALENDAR
+            - ENABLE_FILE_RECORDING_SERVICE
+            - ENABLE_FILE_RECORDING_SERVICE_SHARING
+            - ENABLE_GUESTS
+            - ENABLE_IPV6
+            - ENABLE_LIPSYNC
+            - ENABLE_NO_AUDIO_DETECTION
+            - ENABLE_P2P
+            - ENABLE_PREJOIN_PAGE
+            - ENABLE_RECORDING
+            - ENABLE_REMB
+            - ENABLE_REQUIRE_DISPLAY_NAME
+            - ENABLE_SIMULCAST
+            - ENABLE_STATS_ID
+            - ENABLE_STEREO
+            - ENABLE_SUBDOMAINS
+            - ENABLE_TALK_WHILE_MUTED
+            - ENABLE_TCC
+            - ENABLE_TRANSCRIPTIONS
+            - ETHERPAD_PUBLIC_URL
+            - ETHERPAD_URL_BASE
+            - GOOGLE_ANALYTICS_ID
+            - GOOGLE_API_APP_CLIENT_ID
+            - INVITE_SERVICE_URL
+            - JICOFO_AUTH_USER
+            - MATOMO_ENDPOINT
+            - MATOMO_SITE_ID
+            - MICROSOFT_API_APP_CLIENT_ID
+            - NGINX_RESOLVER
+            - NGINX_WORKER_PROCESSES
+            - NGINX_WORKER_CONNECTIONS
+            - PEOPLE_SEARCH_URL
+            - RESOLUTION
+            - RESOLUTION_MIN
+            - RESOLUTION_WIDTH
+            - RESOLUTION_WIDTH_MIN
+            - START_AUDIO_ONLY
+            - START_AUDIO_MUTED
+            - START_BITRATE
+            - START_VIDEO_MUTED
+            - TESTING_CAP_SCREENSHARE_BITRATE
+            - TESTING_OCTO_PROBABILITY
            - XMPP_AUTH_DOMAIN
            - XMPP_BOSH_URL_BASE
+            - XMPP_DOMAIN
            - XMPP_GUEST_DOMAIN
            - XMPP_MUC_DOMAIN
            - XMPP_RECORDER_DOMAIN
-            - ETHERPAD_URL_BASE
-            - TZ
-            - JIBRI_BREWERY_MUC
-            - JIBRI_PENDING_TIMEOUT
-            - JIBRI_XMPP_USER
-            - JIBRI_XMPP_PASSWORD
-            - JIBRI_RECORDER_USER
-            - JIBRI_RECORDER_PASSWORD
-            - ENABLE_RECORDING
+            - TOKEN_AUTH_URL
        networks:
            default:
            meet.jitsi:
                aliases:
                    - ${XMPP_DOMAIN}
-        restart: unless-stopped 

    # XMPP server
    jitsi-prosody:
-        image: jitsi/prosody
+        image: jitsi/prosody:latest
+        restart: unless-stopped
        expose:
            - '5222'
            - '5347'
            - '5280'
        volumes:
-            - ${CONFIG}/prosody:/config
+            - ${CONFIG}/prosody/config:/config:Z
+            - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
        env_file:
            - ../.envs/.production/.jitsi
        environment:
            - AUTH_TYPE
            - ENABLE_AUTH
            - ENABLE_GUESTS
+            - ENABLE_LOBBY
+            - ENABLE_XMPP_WEBSOCKET
            - GLOBAL_MODULES
            - GLOBAL_CONFIG
            - LDAP_URL
@@ -95,6 +152,7 @@ services:
            - XMPP_MUC_MODULES
            - XMPP_INTERNAL_MUC_MODULES
            - XMPP_RECORDER_DOMAIN
+            - XMPP_CROSS_DOMAIN
            - JICOFO_COMPONENT_SECRET
            - JICOFO_AUTH_USER
            - JICOFO_AUTH_PASSWORD
@@ -115,25 +173,28 @@ services:
            - JWT_AUTH_TYPE
            - JWT_TOKEN_AUTH_MODULE
            - LOG_LEVEL
+            - PUBLIC_URL
            - TZ
        networks:
            meet.jitsi:
                aliases:
                    - ${XMPP_SERVER}
-        restart: unless-stopped 

    # Focus component
    jitsi-jicofo:
-        image: jitsi/jicofo
+        image: jitsi/jicofo:latest
+        restart: unless-stopped
        volumes:
-            - ${CONFIG}/jicofo:/config
+            - ${CONFIG}/jicofo:/config:Z
        env_file:
            - ../.envs/.production/.jitsi
        environment:
+            - AUTH_TYPE
            - ENABLE_AUTH
            - XMPP_DOMAIN
            - XMPP_AUTH_DOMAIN
            - XMPP_INTERNAL_MUC_DOMAIN
+            - XMPP_MUC_DOMAIN
            - XMPP_SERVER
            - JICOFO_COMPONENT_SECRET
            - JICOFO_AUTH_USER
@@ -141,6 +202,7 @@ services:
            - JICOFO_RESERVATION_REST_BASE_URL
            - JVB_BREWERY_MUC
            - JIGASI_BREWERY_MUC
+            - JIGASI_SIP_URI
            - JIBRI_BREWERY_MUC
            - JIBRI_PENDING_TIMEOUT
            - TZ
@@ -148,16 +210,16 @@ services:
            - jitsi-prosody
        networks:
            meet.jitsi:
-        restart: unless-stopped 

    # Video bridge
    jitsi-jvb:
-        image: jitsi/jvb
+        image: jitsi/jvb:latest
+        restart: unless-stopped
        ports:
-            - '${JVB_PORT}:${JVB_PORT}/udp'
-            - '${JVB_TCP_PORT}:${JVB_TCP_PORT}'
+            - "${MISTBORN_BIND_IP}:${JVB_PORT}:${JVB_PORT}/udp"
+            - "${MISTBORN_BIND_IP}:${JVB_TCP_PORT}:${JVB_TCP_PORT}"
        volumes:
-            - ${CONFIG}/jvb:/config
+            - ${CONFIG}/jvb:/config:Z
        env_file:
            - ../.envs/.production/.jitsi
        environment:
@@ -171,14 +233,19 @@ services:
            - JVB_PORT
            - JVB_TCP_HARVESTER_DISABLED
            - JVB_TCP_PORT
+            - JVB_TCP_MAPPED_PORT
            - JVB_STUN_SERVERS
            - JVB_ENABLE_APIS
+            - JVB_WS_DOMAIN
+            - JVB_WS_SERVER_ID
+            - PUBLIC_URL
            - TZ
        depends_on:
            - jitsi-prosody
        networks:
            meet.jitsi:
-        restart: unless-stopped 
+                aliases:
+                    - jvb.meet.jitsi

 # Custom network so all services can communicate using a FQDN
 networks:
@@ -2,12 +2,9 @@ version: '3'

 services:
  raspap:
-    build:
-      context: ..
-      dockerfile: ./compose/production/raspap/Dockerfile
-    #user: root
-    image: mistborn_production_raspap
+    image: "cyber5k/raspap:${MISTBORN_TAG}"
    container_name: mistborn_production_raspap
+    #network_mode: host
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.raspap-http.rule=Host(`raspap.mistborn`)"
@@ -19,10 +16,16 @@ services:
      - "traefik.http.routers.raspap-https.tls.certresolver=basic"
      - "traefik.http.services.raspap-service.loadbalancer.server.port=80"
    env_file:
-      - ../.envs/.production/.pihole
-    command: /start
+      - ../.envs/.production/.raspap
+    cap_add:
+      #- NET_ADMIN
+      - SYS_ADMIN
+      #- CAP_FOWNER
+    privileged: true
    volumes:
-      - ../../mistborn_volumes/extra/raspap/etc-raspap:/etc/raspap
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    #command: /start
+    restart: unless-stopped

 networks:
  default:
@@ -35,8 +35,8 @@ services:
    container_name: mistborn_production_rocketchat_mongo
    restart: unless-stopped
    volumes:
-     - ../volumes/extra/rocketchat/data/db:/data/db
-     - ../volumes/extra/rocketchat/data/dump:/dump
+     - ../../mistborn_volumes/extra/rocketchat/data/db:/data/db
+     - ../../mistborn_volumes/extra/rocketchat/data/dump:/dump
    command: mongod --smallfiles --oplogSize 128 --replSet rs0 --storageEngine=mmapv1

  # this container's job is just run the command to initialize the replica set.
@@ -61,10 +61,10 @@ services:
    depends_on:
      - rocketchat
    volumes:
-      - ../volumes/extra/rocketchat/hubot/scripts:/home/hubot/scripts
+      - ../../mistborn_volumes/extra/rocketchat/hubot/scripts:/home/hubot/scripts
  # this is used to expose the hubot port for notifications on the host on port 3001, e.g. for hubot-jenkins-notifier
    ports:
-      - 3001:8080/tcp
+      - "${MISTBORN_BIND_IP}:3001:8080/tcp"

 networks:
  default:
@@ -15,8 +15,8 @@ services:
      - ../../mistborn_volumes/extra/syncthing/data2:/data2
    ports:
      #- 8384:8384
-      - 22000:22000/tcp # listening port
-      - 21027:21027/udp # protocol discovery
+      - "${MISTBORN_BIND_IP}:22000:22000/tcp" # listening port
+      - "${MISTBORN_BIND_IP}:21027:21027/udp" # protocol discovery
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.mistborn`)"
@@ -3,12 +3,12 @@ version: '3'
 services:
  tor-client:
    build:
-      context: ..
-      dockerfile: ./compose/production/tor/Dockerfile
+      context: ../compose/production/tor
+      dockerfile: ./Dockerfile
    image: mistborn_production_tor
    container_name: mistborn_production_tor
    ports:
-      - 9150:9150/tcp
+      - "${MISTBORN_BIND_IP}:9150:9150/tcp"

 networks:
  default:
@@ -0,0 +1,70 @@
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+version: '3.7'
+
+services:
+  wazuh:
+    image: wazuh/wazuh-odfe:4.1.2
+    hostname: wazuh-manager
+    restart: unless-stopped
+    ports:
+      - "${MISTBORN_BIND_IP}:1514:1514"
+      - "${MISTBORN_BIND_IP}:1515:1515"
+      - "${MISTBORN_BIND_IP}:514:514/udp"
+      - "${MISTBORN_BIND_IP}:55000:55000"
+    environment:
+      - FILEBEAT_SSL_VERIFICATION_MODE=none
+    env_file:
+      - ../.envs/.production/.wazuh
+    volumes:
+      - ossec_api_configuration:/var/ossec/api/configuration
+      - ossec_etc:/var/ossec/etc
+      - ossec_logs:/var/ossec/logs
+      - ossec_queue:/var/ossec/queue
+      - ossec_var_multigroups:/var/ossec/var/multigroups
+      - ossec_integrations:/var/ossec/integrations
+      - ossec_active_response:/var/ossec/active-response/bin
+      - ossec_agentless:/var/ossec/agentless
+      - ossec_wodles:/var/ossec/wodles
+      - filebeat_etc:/etc/filebeat
+      - filebeat_var:/var/lib/filebeat
+
+  wazuh-kibana:
+    image: wazuh/wazuh-kibana-odfe:4.1.2
+    hostname: wazuh-kibana
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.wazuhk-http.rule=Host(`wazuh.mistborn`)"
+      - "traefik.http.routers.wazuhk-http.entrypoints=web"
+      - "traefik.http.routers.wazuhk-http.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.wazuhk-https.rule=Host(`wazuh.mistborn`)"
+      - "traefik.http.routers.wazuhk-https.entrypoints=websecure"
+      - "traefik.http.routers.wazuhk-https.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.wazuhk-https.tls.certresolver=basic"
+      - "traefik.http.services.wazuhk-service.loadbalancer.server.port=5601"
+    #ports:
+    #  - "${MISTBORN_BIND_IP}:5601:5601"
+    environment:
+      - SERVER_SSL_ENABLED=false
+      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
+      - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
+    env_file:
+      - ../.envs/.production/.wazuh
+
+volumes:
+  ossec_api_configuration:
+  ossec_etc:
+  ossec_logs:
+  ossec_queue:
+  ossec_var_multigroups:
+  ossec_integrations:
+  ossec_active_response:
+  ossec_agentless:
+  ossec_wodles:
+  filebeat_etc:
+  filebeat_var:
+
+networks:
+  default:
+    external:
+      name: mistborn_default
@@ -1,23 +0,0 @@
-version: '3'
-
-services:
-  wifi:
-    #user: root
-    image: "cyber5k/wifi:${MISTBORN_TAG}"
-    container_name: mistborn_production_wifi
-    #labels:
-    #  - "traefik.enable=true"
-    #  - "traefik.port=80"
-    #env_file:
-    #  - ../.envs/.production/.pihole
-    #command: /start
-    volumes:
-      - ../../mistborn_volumes/extra/wifi/hostapd.conf:/etc/hostapd/hostapd.conf
-      - ../../mistborn_volumes/extra/wifi/dnsmasq.conf:/etc/dnsmasq.conf
-    #  - ../../mistborn_volumes/extra/wifi/wificfg.json:/cfg/wificfg.json
-    network_mode: bridge #host
-    cap_add:
-      - NET_ADMIN
-      - NET_RAW
-    #privileged: true
-
@@ -0,0 +1,3 @@
+{
+    "shutdown-timeout": 60 
+}
@@ -1,61 +1,116 @@
+# shellcheck disable=SC2034
+
+# Security
+#
+# Set these to strong passwords to avoid intruders from impersonating a service account
+# The service(s) won't start unless these are specified
+# Running ./gen-passwords.sh will update .env with strong passwords
+# You may skip the Jigasi and Jibri passwords if you are not using those
+# DO NOT reuse passwords
+#
+
+# XMPP component password for Jicofo
+JICOFO_COMPONENT_SECRET=
+
+# XMPP password for Jicofo client connections
+JICOFO_AUTH_PASSWORD=
+
+# XMPP password for JVB client connections
+JVB_AUTH_PASSWORD=
+
+# XMPP password for Jigasi MUC client connections
+JIGASI_XMPP_PASSWORD=
+
+# XMPP recorder password for Jibri client connections
+JIBRI_RECORDER_PASSWORD=
+
+# XMPP password for Jibri client connections
+JIBRI_XMPP_PASSWORD=
+
+
 #
 # Basic configuration options
 #

-# Directory where all configuration will be stored.
+# Directory where all configuration will be stored
 #CONFIG=~/.jitsi-meet-cfg
 CONFIG=../.envs/.production/.jitsi-cfg

-# Exposed HTTP port.
+# Exposed HTTP port
 HTTP_PORT=80

-# Exposed HTTPS port.
-HTTPS_PORT=8443
+# Exposed HTTPS port
+HTTPS_PORT=443

-# System time zone.
-TZ=Europe/Amsterdam
+# System time zone
+TZ=UTC

-# Public URL for the web service.
-#PUBLIC_URL=https://meet.example.com
+# Public URL for the web service (required)
+PUBLIC_URL=https://jitsi.mistborn

-# IP address of the Docker host. See the "Running on a LAN environment" section
-# in the README.
+# IP address of the Docker host
+# See the "Running behind NAT or on a LAN environment" section in the Handbook:
+# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-nat-or-on-a-lan-environment
+#DOCKER_HOST_ADDRESS=192.168.1.1
 DOCKER_HOST_ADDRESS=10.2.3.1

+# Control whether the lobby feature should be enabled or not
+#ENABLE_LOBBY=1
+
+# Show a prejoin page before entering a conference
+#ENABLE_PREJOIN_PAGE=0

 #
 # Let's Encrypt configuration
 #

-# Enable Let's Encrypt certificate generation.
+# Enable Let's Encrypt certificate generation
 #ENABLE_LETSENCRYPT=1

-# Domain for which to generate the certificate.
+# Domain for which to generate the certificate
 #LETSENCRYPT_DOMAIN=meet.example.com

-# E-Mail for receiving important account notifications (mandatory).
+# E-Mail for receiving important account notifications (mandatory)
 #LETSENCRYPT_EMAIL=alice@atlanta.net

+# Use the staging server (for avoiding rate limits while testing)
+#LETSENCRYPT_USE_STAGING=1
+

 #
 # Etherpad integration (for document sharing)
 #

-# Set etherpad-lite URL (uncomment to enable).
+# Set etherpad-lite URL in docker local network (uncomment to enable)
 #ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001

+# Set etherpad-lite public URL (uncomment to enable)
+#ETHERPAD_PUBLIC_URL=https://etherpad.my.domain
+
+# Name your etherpad instance!
+ETHERPAD_TITLE="Video Chat"
+
+# The default text of a pad
+ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
+
+# Name of the skin for etherpad
+ETHERPAD_SKIN_NAME="colibris"
+
+# Skin variants for etherpad
+ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
+

 #
 # Basic Jigasi configuration options (needed for SIP gateway support)
 #

-# SIP URI for incoming / outgoing calls.
+# SIP URI for incoming / outgoing calls
 #JIGASI_SIP_URI=test@sip2sip.info

 # Password for the specified SIP account as a clear text
 #JIGASI_SIP_PASSWORD=passw0rd

-# SIP server (use the SIP account domain if in doubt).
+# SIP server (use the SIP account domain if in doubt)
 #JIGASI_SIP_SERVER=sip2sip.info

 # SIP server port
@@ -65,13 +120,13 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 #JIGASI_SIP_TRANSPORT=UDP

 #
-# Authentication configuration (see README for details)
+# Authentication configuration (see handbook for details)
 #

-# Enable authentication.
+# Enable authentication
 #ENABLE_AUTH=1

-# Enable guest access.
+# Enable guest access
 #ENABLE_GUESTS=1

 # Select authentication type: internal, jwt or ldap
@@ -80,38 +135,38 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 # JWT authentication
 #

-# Application identifier.
+# Application identifier
 #JWT_APP_ID=my_jitsi_app_id

-# Application secret known only to your token.
+# Application secret known only to your token
 #JWT_APP_SECRET=my_jitsi_app_secret

-# (Optional) Set asap_accepted_issuers as a comma separated list.
+# (Optional) Set asap_accepted_issuers as a comma separated list
 #JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client

-# (Optional) Set asap_accepted_audiences as a comma separated list.
+# (Optional) Set asap_accepted_audiences as a comma separated list
 #JWT_ACCEPTED_AUDIENCES=my_server1,my_server2


 # LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page)
 #

-# LDAP url for connection.
+# LDAP url for connection
 #LDAP_URL=ldaps://ldap.domain.com/

 # LDAP base DN. Can be empty
 #LDAP_BASE=DC=example,DC=domain,DC=com

-# LDAP user DN. Do not specify this parameter for the anonymous bind.
+# LDAP user DN. Do not specify this parameter for the anonymous bind
 #LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com

-# LDAP user password. Do not specify this parameter for the anonymous bind.
+# LDAP user password. Do not specify this parameter for the anonymous bind
 #LDAP_BINDPW=LdapUserPassw0rd

 # LDAP filter. Tokens example:
-# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail.
-# %s - %s is replaced by the complete service string.
-# %r - %r is replaced by the complete realm string.
+# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail
+# %s - %s is replaced by the complete service string
+# %r - %r is replaced by the complete realm string
 #LDAP_FILTER=(sAMAccountName=%u)

 # LDAP authentication method
@@ -123,16 +178,16 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 # LDAP TLS using
 #LDAP_USE_TLS=1

-# List of SSL/TLS ciphers to allow.
+# List of SSL/TLS ciphers to allow
 #LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC

 # Require and verify server certificate
 #LDAP_TLS_CHECK_PEER=1

-# Path to CA cert file. Used when server sertificate verify is enabled.
+# Path to CA cert file. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt

-# Path to CA certs directory. Used when server sertificate verify is enabled.
+# Path to CA certs directory. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_DIR=/etc/ssl/certs

 # Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps://
@@ -143,7 +198,7 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 # Advanced configuration options (you generally don't need to change these)
 #

-# Internal XMPP domain.
+# Internal XMPP domain
 XMPP_DOMAIN=meet.jitsi

 # Internal XMPP server
@@ -152,18 +207,22 @@ XMPP_SERVER=xmpp.meet.jitsi
 # Internal XMPP server URL
 XMPP_BOSH_URL_BASE=http://xmpp.meet.jitsi:5280

-# Internal XMPP domain for authenticated services.
+# Internal XMPP domain for authenticated services
 XMPP_AUTH_DOMAIN=auth.meet.jitsi

-# XMPP domain for the MUC.
+# XMPP domain for the MUC
 XMPP_MUC_DOMAIN=muc.meet.jitsi

-# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools.
+# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools
 XMPP_INTERNAL_MUC_DOMAIN=internal-muc.meet.jitsi

-# XMPP domain for unauthenticated users.
+# XMPP domain for unauthenticated users
 XMPP_GUEST_DOMAIN=guest.meet.jitsi

+# Comma separated list of domains for cross domain policy or "true" to allow all
+# The PUBLIC_URL is always allowed
+#XMPP_CROSS_DOMAIN=true
+
 # Custom Prosody modules for XMPP_DOMAIN (comma separated)
 XMPP_MODULES=

@@ -173,17 +232,14 @@ XMPP_MUC_MODULES=
 # Custom Prosody modules for internal MUC component (comma separated)
 XMPP_INTERNAL_MUC_MODULES=

-# MUC for the JVB pool.
+# MUC for the JVB pool
 JVB_BREWERY_MUC=jvbbrewery

-# XMPP user for JVB client connections.
+# XMPP user for JVB client connections
 JVB_AUTH_USER=jvb

-# XMPP password for JVB client connections.
-JVB_AUTH_PASSWORD=passw0rd
-
-# STUN servers used to discover the server's public IP.
-JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
+# STUN servers used to discover the server's public IP
+JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443

 # Media port for the Jitsi Videobridge
 JVB_PORT=10000
@@ -191,36 +247,32 @@ JVB_PORT=10000
 # TCP Fallback for Jitsi Videobridge for when UDP isn't available
 JVB_TCP_HARVESTER_DISABLED=true
 JVB_TCP_PORT=4443
+JVB_TCP_MAPPED_PORT=4443

-# A comma separated list of APIs to enable when the JVB is started. The default is none.
+# A comma separated list of APIs to enable when the JVB is started [default: none]
 # See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information
 #JVB_ENABLE_APIS=rest,colibri

-# XMPP component password for Jicofo.
-JICOFO_COMPONENT_SECRET=s3cr37
-
-# XMPP user for Jicofo client connections. NOTE: this option doesn't currently work due to a bug.
+# XMPP user for Jicofo client connections.
+# NOTE: this option doesn't currently work due to a bug
 JICOFO_AUTH_USER=focus

-# XMPP password for Jicofo client connections.
-JICOFO_AUTH_PASSWORD=passw0rd
-
 # Base URL of Jicofo's reservation REST API
 #JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com

-# XMPP user for Jigasi MUC client connections.
+# Enable Jicofo's health check REST API (http://<jicofo_base_url>:8888/about/health)
+#JICOFO_ENABLE_HEALTH_CHECKS=true
+
+# XMPP user for Jigasi MUC client connections
 JIGASI_XMPP_USER=jigasi

-# XMPP password for Jigasi MUC client connections.
-JIGASI_XMPP_PASSWORD=passw0rd
-
-# MUC name for the Jigasi pool.
+# MUC name for the Jigasi pool
 JIGASI_BREWERY_MUC=jigasibrewery

-# Minimum port for media used by Jigasi.
+# Minimum port for media used by Jigasi
 JIGASI_PORT_MIN=20000

-# Maximum port for media used by Jigasi.
+# Maximum port for media used by Jigasi
 JIGASI_PORT_MAX=20050

 # Enable SDES srtp
@@ -235,20 +287,21 @@ JIGASI_PORT_MAX=20050
 # Health-check interval
 #JIGASI_HEALTH_CHECK_INTERVAL=300000
 #
-# Enable Jigasi transcription.
+# Enable Jigasi transcription
 #ENABLE_TRANSCRIPTIONS=1

-# Jigasi will recordord an audio when transcriber is on. Default false.
+# Jigasi will record audio when transcriber is on [default: false]
 #JIGASI_TRANSCRIBER_RECORD_AUDIO=true

-# Jigasi will send transcribed text to the chat when transcriber is on. Default false.
+# Jigasi will send transcribed text to the chat when transcriber is on [default: false]
 #JIGASI_TRANSCRIBER_SEND_TXT=true

-# Jigasi post to the chat an url with transcription file. Default false.
+# Jigasi will post an url to the chat with transcription file [default: false]
 #JIGASI_TRANSCRIBER_ADVERTISE_URL=true

 # Credentials for connect to Cloud Google API from Jigasi
-# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol section "Before you begin" from 1 to 5 paragraph.
+# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol
+# section "Before you begin" paragraph 1 to 5
 # Copy the values from the json to the related env vars
 #GC_PROJECT_ID=
 #GC_PRIVATE_KEY_ID=
@@ -263,25 +316,19 @@ JIGASI_PORT_MAX=20050
 # XMPP domain for the jibri recorder
 XMPP_RECORDER_DOMAIN=recorder.meet.jitsi

-# XMPP recorder user for Jibri client connections.
+# XMPP recorder user for Jibri client connections
 JIBRI_RECORDER_USER=recorder

-# XMPP recorder password for Jibri client connections.
-JIBRI_RECORDER_PASSWORD=passw0rd
-
-# Directory for recordings inside Jibri container.
+# Directory for recordings inside Jibri container
 JIBRI_RECORDING_DIR=/config/recordings

-# The finalizing script. Will run after recording is complete.
+# The finalizing script. Will run after recording is complete
 JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh

-# XMPP user for Jibri client connections.
+# XMPP user for Jibri client connections
 JIBRI_XMPP_USER=jibri

-# XMPP password for Jibri client connections.
-JIBRI_XMPP_PASSWORD=passw0rd
-
-# MUC name for the Jibri pool.
+# MUC name for the Jibri pool
 JIBRI_BREWERY_MUC=jibribrewery

 # MUC connection timeout
@@ -294,14 +341,26 @@ JIBRI_PENDING_TIMEOUT=90
 # So if there are any prefixes in the jid (like jitsi meet, which
 # has its participants join a muc at conference.xmpp_domain) then
 # list that prefix here so it can be stripped out to generate
-# the call url correctly.
+# the call url correctly
 JIBRI_STRIP_DOMAIN_JID=muc

-# Directory for logs inside Jibri container.
+# Directory for logs inside Jibri container
 JIBRI_LOGS_DIR=/config/logs

-# Disable HTTPS. This can be useful if TLS connections are going to be handled outside of this setup.
+# Disable HTTPS: handle TLS connections outside of this setup
 DISABLE_HTTPS=1

-# Redirects HTTP traffic to HTTPS. Only works with the standard HTTPS port (443).
+# Redirect HTTP traffic to HTTPS
+# Necessary for Let's Encrypt, relies on standard HTTPS port (443)
 #ENABLE_HTTP_REDIRECT=1
+
+# Enable IPv6
+# Provides means to disable IPv6 in environments that don't support it (get with the times, people!)
+#ENABLE_IPV6=1
+
+# Container restart policy
+# Defaults to unless-stopped
+RESTART_POLICY=unless-stopped
+
+# Authenticate using external service or just focus external auth window if there is one already.
+# TOKEN_AUTH_URL=https://auth.meet.example.com/{room}
@@ -1,18 +0,0 @@
-{
-    "wifi_iface": "wlan0",
-    "dnsmasq_cfg": {
-	"address": "/#/192.168.27.1",
-	"dhcp_range": "192.168.27.100,192.168.27.150,1h",
-    "dhcp_option": "6,10.2.3.1",
-	"vendor_class": "set:device,IoT"
-    },
-    "host_apd_cfg": {
-	"ip": "192.168.27.1",
-	"ssid": "mistborn",
-	"wpa_passphrase":"iotwifipass",
-	"channel": "6"
-    },
-    "wpa_supplicant_cfg": {
-	"cfg_file": "/etc/wpa_supplicant/wpa_supplicant.conf"
-    }
-}
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+set -e
+
+SERVICE="$1"
+
+export MISTBORN_HOME=/opt/mistborn
+export SERVICE_ENV_INSTALLER="${MISTBORN_HOME}/scripts/subinstallers/extra/${SERVICE}.sh"
+export SERVICE_ENV_FILE="${MISTBORN_HOME}/.envs/.production/.${SERVICE}"
+
+# read in global variables
+set -a
+source ${MISTBORN_HOME}/.env
+source ${MISTBORN_HOME}/.envs/.production/.django
+source ${MISTBORN_HOME}/.envs/.production/.postgres
+source ${MISTBORN_HOME}/.envs/.production/.pihole
+set +a
+
+if [[ -f "${SERVICE_ENV_INSTALLER}" ]]; then
+
+    if [[ -f "${SERVICE_ENV_FILE}" ]]; then
+        echo "Environment file already exists."
+    else
+
+        # create env file for service
+        echo "Creating environment file"
+        source $SERVICE_ENV_INSTALLER $SERVICE_ENV_FILE
+        chown mistborn:mistborn $SERVICE_ENV_FILE
+        chmod 600 $SERVICE_ENV_FILE
+
+    fi
+
+else
+    echo "No subinstaller found."
+fi
@@ -4,15 +4,29 @@

 VAR_FILE=/opt/mistborn/.env

+# load env variables
+
 source /opt/mistborn/scripts/subinstallers/platform.sh

+# setup env file
+echo "" | sudo tee ${VAR_FILE}
+sudo chown mistborn:mistborn ${VAR_FILE}
+sudo chmod 600 ${VAR_FILE}
+
+# MISTBORN_DNS_BIND_IP
+
 MISTBORN_DNS_BIND_IP="10.2.3.1"
 #if [ "$DISTRO" == "ubuntu" ] && [ "$VERSION_ID" == "20.04" ]; then
 #    MISTBORN_DNS_BIND_IP="10.2.3.1"
 #fi

-echo "MISTBORN_DNS_BIND_IP=${MISTBORN_DNS_BIND_IP}" | sudo tee ${VAR_FILE}
-sudo chown mistborn:mistborn ${VAR_FILE}
+echo "MISTBORN_DNS_BIND_IP=${MISTBORN_DNS_BIND_IP}" | sudo tee -a ${VAR_FILE}
+
+# MISTBORN_BIND_IP
+
+echo "MISTBORN_BIND_IP=10.2.3.1" | sudo tee -a ${VAR_FILE}
+
+# MISTBORN_TAG

 GIT_BRANCH=$(git -C /opt/mistborn symbolic-ref --short HEAD || echo "master")
 MISTBORN_TAG="latest"
@@ -22,13 +36,29 @@ fi

 echo "MISTBORN_TAG=$MISTBORN_TAG" | sudo tee -a ${VAR_FILE}

-#### install and base services
-iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
+#### SERVICE files

-# default interface
+# copy current service files to systemd (overwriting as needed)
 sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
+
+# set script user and owner
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
 #sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
+
+# reload in case the iface is not immediately set
+sudo systemctl daemon-reload
+
+#### install and base services
+iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}' | tr -d '[:space:]')
+## cannot be empty
+while [[ -z "$iface" ]]; do
+    sleep 2
+    iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}' | tr -d '[:space:]')
+done
+
+# default interface
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"

-sudo systemctl daemon-reload
+echo "DIFACE=${iface}" | sudo tee -a ${VAR_FILE}
+
+sudo systemctl daemon-reload
@@ -59,13 +59,22 @@ echo -e "| |  | | \__ \ |_| |_) | (_) | |  | | | |"
 echo -e "|_|  |_|_|___/\__|_.__/ \___/|_|  |_| |_|"
 echo -e ""

-# INPUT default admin password
-if [ -z "${MISTBORN_DEFAULT_PASSWORD}" ]; then
-    read -p "(Mistborn) Set default admin password: " -s MISTBORN_DEFAULT_PASSWORD
-    echo
-else
-    echo "MISTBORN_DEFAULT_PASSWORD is already set"
-fi
+sudo rm -rf /opt/mistborn 2>/dev/null || true
+
+# clone to /opt and change directory
+echo "Cloning $GIT_BRANCH branch from mistborn repo"
+sudo git clone https://gitlab.com/cyber5k/mistborn.git -b $GIT_BRANCH /opt/mistborn
+sudo chown -R $USER:$USER /opt/mistborn
+pushd .
+cd /opt/mistborn
+git submodule update --init --recursive
+
+# Check updates
+echo "Checking updates"
+source ./scripts/subinstallers/check_updates.sh
+
+# MISTBORN_DEFAULT_PASSWORD
+source ./scripts/subinstallers/passwd.sh

 # Install Cockpit?
 if [ -z "${MISTBORN_INSTALL_COCKPIT}" ]; then
@@ -85,18 +94,7 @@ else
    echo "SSH key exists for $USER"
 fi

-sudo rm -rf /opt/mistborn 2>/dev/null || true
-
-# clone to /opt and change directory
-echo "Cloning $GIT_BRANCH branch from mistborn repo"
-sudo git clone https://gitlab.com/cyber5k/mistborn.git -b $GIT_BRANCH /opt/mistborn
-sudo chown -R $USER:$USER /opt/mistborn
-pushd .
-cd /opt/mistborn
-git submodule update --init --recursive
-
-# initial load update package list
-sudo apt-get update
+# initial load update package list during check_updates.sh

 # install figlet
 sudo -E apt-get install -y figlet
@@ -216,6 +214,17 @@ sudo systemctl start Mistborn-setup.service
 sudo docker-compose -f base.yml pull || true
 sudo docker-compose -f base.yml build

+## disable systemd-resolved stub listener (creates symbolic link to /etc/resolv.conf)
+if [ -f /etc/systemd/resolved.conf ]; then
+    sudo sed -i 's/#DNSStubListener.*/DNSStubListener=no/' /etc/systemd/resolved.conf
+    sudo sed -i 's/DNSStubListener.*/DNSStubListener=no/' /etc/systemd/resolved.conf
+fi
+
+## delete symlink if exists
+if [ -L /etc/resolv.conf ]; then
+    sudo rm /etc/resolv.conf
+fi
+
 ## disable other DNS services
 sudo systemctl stop systemd-resolved 2>/dev/null || true
 sudo systemctl disable systemd-resolved 2>/dev/null || true
@@ -237,6 +246,7 @@ sudo resolvconf -u 1>/dev/null 2>&1

 echo "backup up original volumes folder"
 sudo mkdir -p ../mistborn_backup
+sudo chmod 700 ../mistborn_backup
 sudo tar -czf ../mistborn_backup/mistborn_volumes_backup.tar.gz ../mistborn_volumes 1>/dev/null 2>&1

 # clean docker
@@ -1,15 +1,23 @@
 [Unit]
 Description=Mistborn Base
 Requires=docker.service
+Requires=netfilter-persistent.service
 After=docker.service
+After=netfilter-persistent.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 EnvironmentFile=/opt/mistborn/.env
+
+# stop all containers joined to mistborn_default network
+ExecStartPre=-/usr/bin/bash -c "docker container stop $(docker network inspect mistborn_default | grep Name | tail -n +2 | cut -d':' -f2 | tr -d ',\"') 2>/dev/null"
+
+# bring down the base service
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml down

 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
@@ -2,22 +2,24 @@
 Description=Mistborn Bitwarden Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down

 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=Mistborn Elasticsearch Service
+Requires=Mistborn-base.service
+After=Mistborn-base.service
+PartOf=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/usr/sbin/sysctl -w vm.max_map_count=262144
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml up --build
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
+
+[Install]
+WantedBy=Mistborn-base.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=Mistborn Guacamole
+Requires=Mistborn-base.service
+After=Mistborn-base.service
+PartOf=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
+
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml up --build
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
+# Post stop
+
+[Install]
+WantedBy=Mistborn-base.service
@@ -2,20 +2,22 @@
 Description=Mistborn Home Assistant 
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/homeassistant.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down

 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/homeassistant.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/homeassistant.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down
 # Post stop

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -2,20 +2,22 @@
 Description=Mistborn Jellyfin Service
 Requires=Mistborn-nextcloud.service
 After=Mistborn-nextcloud.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jellyfin.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down

 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jellyfin.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jellyfin.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down
 # Post stop

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -2,26 +2,26 @@
 Description=Mistborn Jitsi Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
-EnvironmentFile=/opt/mistborn/.envs/.production/.jitsi

 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_up.sh

-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
-ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build
+
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
 # Post stop
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
-ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
+ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_down.sh

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -2,20 +2,22 @@
 Description=Mistborn Nextcloud Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
-User=www-data
+RestartSec=15
+User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/nextcloud.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down

 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/nextcloud.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/nextcloud.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down
 # Post stop

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -2,20 +2,22 @@
 Description=Mistborn OnlyOffice Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down

 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
 # Post stop

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=Mistborn RaspAP Service 
+Requires=Mistborn-base.service
+After=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
+#ExecStartPre=/bin/bash /opt/mistborn_volumes/extra/raspap/etc-raspap/hostapd/servicestart.sh --interface uap0 --seconds 3
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
+
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml up --build
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
+ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
+# Post stop
+
+[Install]
+WantedBy=Mistborn-base.service
@@ -2,22 +2,24 @@
 Description=Mistborn Rocket Chat Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down

 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -2,24 +2,26 @@
 Description=Mistborn Syncthing Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down

 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -2,22 +2,24 @@
 Description=Mistborn Tor Service 
 Requires=Mistborn-base.service
 After=Mistborn-base.service
+PartOf=Mistborn-base.service

 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml down
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down

 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml up --build
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml up --build
 # Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml down
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP

 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service
@@ -0,0 +1,30 @@
+[Unit]
+Description=Mistborn Wazuh Service
+Requires=Mistborn-elasticsearch.service
+After=Mistborn-elasticsearch.service
+PartOf=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+TimeoutStartSec=600
+User=root
+Group=docker
+PermissionsStartOnly=true
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build
+# Agent install
+ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
+ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
+# Suricata
+ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_init.sh
+ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_start.sh
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
+ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_stop.sh
+ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
+
+[Install]
+WantedBy=Mistborn-base.service
@@ -1,28 +0,0 @@
-[Unit]
-Description=Mistborn Wifi Service 
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-
-[Service]
-Restart=always
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-EnvironmentFile=/opt/mistborn/.env
-
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml down
-ExecStartPre=/opt/mistborn/scripts/services/wifi/init.sh
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml build
-# Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml up
-
-ExecStartPost=/opt/mistborn/scripts/services/wifi/start.sh
-
-# Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml down
-# Post stop
-ExecStopPost=/opt/mistborn/scripts/services/wifi/stop.sh
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,17 @@
+---
+# This is the internal user database
+# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
+
+_meta:
+  type: "internalusers"
+  config_version: 2
+
+# Define your internal users here
+
+mistborn:
+  hash: "__MISTBORN_HASH__"
+  reserved: true
+  backend_roles:
+  - "admin"
+  description: "Mistborn user"
+
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+if [[ -f "/opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml" ]]; then
+    echo "internal_users.yml exists. Proceeding."
+    exit 0
+fi
+
+mkdir -p /opt/mistborn_volumes/extra/elasticsearch/init/ >/dev/null 2>&1
+chmod -R +x /opt/mistborn_volumes/extra/elasticsearch/init/
+cp /opt/mistborn/scripts/services/elasticsearch/files/internal_users.yml /opt/mistborn_volumes/extra/elasticsearch/init/
+
+ELASTICSEARCH_MISTBORN_HASHED=$(docker run --rm amazon/opendistro-for-elasticsearch:1.12.0 bash /usr/share/elasticsearch/plugins/opendistro_security/tools/hash.sh -p ${MISTBORN_DEFAULT_PASSWORD} | tr -d '\n')
+
+sed -i "s|__MISTBORN_HASH__|${ELASTICSEARCH_MISTBORN_HASHED}|" /opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+if [[ -f "/opt/mistborn_volumes/extra/guacamole/init/initdb.sql" ]]; then
+    echo "initdb.sql exists. Proceeding."
+    exit 0
+fi
+
+mkdir -p /opt/mistborn_volumes/extra/guacamole/init/ >/dev/null 2>&1
+chmod -R +x /opt/mistborn_volumes/extra/guacamole/init/
+docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgres > /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
+
+# grab values in initdb.sql to replace
+HEXSTRINGS=($(egrep -o [0-9a-fA-F]{64} /opt/mistborn_volumes/extra/guacamole/init/initdb.sql))
+
+# reset default password in init.db
+SALT=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice('0123456789ABCDEF') for x in range(64)]))")
+GUAC_PASSWORD_HASHED=$(echo -n "${MISTBORN_DEFAULT_PASSWORD}${SALT}" | sha256sum | awk '{print $1}' | tr a-z A-Z)
+
+sed -i "s/${HEXSTRINGS[1]}/$SALT/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
+sed -i "s/${HEXSTRINGS[0]}/$GUAC_PASSWORD_HASHED/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
+sed -i "s/guacadmin/mistborn/g" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+iptables -w -D DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
+iptables -w -D DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+iptables -w -I DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
+iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
@@ -1,21 +0,0 @@
-[Unit]
-Description=Mistborn RaspAP Service 
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-
-[Service]
-Restart=always
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml down
-
-# Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml up --build
-# Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml down
-# Post stop
-
-[Install]
-WantedBy=multi-user.target
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-# install on gateway
-sudo apt-get install -y hostapd vnstat
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# detect if already installed
+if dpkg -s wazuh-agent &> /dev/null; then
+    echo "Wazuh agent already installed"
+    exit 0
+fi
+
+# install curl
+echo "install curl"
+sudo -E apt-get install -y curl
+
+# prepare repo
+echo "Adding Wazuh Repository"
+curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo -E apt-key add -
+echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo -E tee /etc/apt/sources.list.d/wazuh.list
+
+apt-get update
+
+# wait for service to be listening
+while ! nc -z 10.2.3.1 55000; do
+    WAIT_TIME=10
+    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
+    sleep ${WAIT_TIME}
+done
+
+# install
+echo "Installing Wazuh agent"
+WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent
+
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+systemctl start wazuh-agent
+systemctl enable wazuh-agent
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+systemctl stop wazuh-agent
+systemctl disable wazuh-agent
@@ -0,0 +1,129 @@
+#!/bin/bash
+
+set -e
+
+# detect if suricata is installed
+if [[ $(dpkg-query -W -f='${Status}' suricata 2>/dev/null | grep -c "ok installed") -eq 1 ]]; then
+    echo "Suricata Installed"
+    exit 0
+fi
+
+source /opt/mistborn/scripts/subinstallers/platform.sh
+
+# minimal dependencies
+sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
+                libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
+                make libmagic-dev libjansson-dev jq wget
+
+## recommended dependencies
+#sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
+#                libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
+#                libcap-ng-dev libcap-ng0 make libmagic-dev         \
+#                libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
+#                python-yaml rustc cargo
+
+# iptables/nftables integration
+sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1  \
+                libnetfilter-log-dev libnetfilter-log1      \
+                libnfnetlink-dev libnfnetlink0
+
+
+if [ "$DISTRO" == "ubuntu" ]; then
+    echo "Installing Suricata Ubuntu PPA"
+    sudo -E add-apt-repository -y ppa:oisf/suricata-stable
+    sudo -E apt-get update
+    sudo -E apt-get install -y suricata
+elif [ "$DISTRO" == "debian" ]; then
+    # retrieve version codename
+    source /etc/os-release
+    echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \
+        sudo -E tee /etc/apt/sources.list.d/backports.list
+    sudo -E apt-get update
+    sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports
+else
+    echo "Basic Suricata installation"
+    sudo -E apt-get install -y suricata
+fi
+
+# # iptables
+# sudo iptables -A INPUT -j NFQUEUE
+# sudo iptables -I FORWARD -j NFQUEUE
+# sudo iptables -I OUTPUT -j NFQUEUE
+
+# # rsyslog to create /var/log/suricata.log
+# sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
+# sudo chown root:root /etc/rsyslog.d/20-suricata.conf
+# sudo systemctl restart rsyslog
+
+# rules
+pushd .
+cd /tmp
+wget https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz
+tar zxvf emerging.rules.tar.gz
+sudo -E rm /etc/suricata/rules/* -f
+sudo -E mv rules/*.rules /etc/suricata/rules/
+popd
+
+# suricata yaml
+sudo -E rm -f /etc/suricata/suricata.yaml
+sudo -E wget -O /etc/suricata/suricata.yaml http://www.branchnetconsulting.com/wazuh/suricata.yaml
+
+IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
+sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml
+sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata
+
+#systemctl restart suricata
+
+# wait for service to be listening
+while ! nc -z 10.2.3.1 55000; do
+    WAIT_TIME=10
+    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
+    sleep ${WAIT_TIME}
+done
+
+# set working directory to mistborn for docker-compose
+pushd .
+cd /opt/mistborn
+
+# ensure group exists
+sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
+
+# add this host to group
+WAZUH_ID=$(sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
+sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
+
+# write agent.conf
+sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
+<agent_config>
+    <localfile>
+        <log_format>json</log_format>
+        <location>/var/log/suricata/eve.json</location>
+    </localfile>
+</agent_config>
+EOF
+"
+
+# restart manager
+sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml restart wazuh
+
+popd
+
+# suricata-update
+sudo -E apt install python3-pip
+sudo -E pip3 install pyyaml
+sudo -E pip3 install https://github.com/OISF/suricata-update/archive/master.zip
+
+sudo -E pip3 install --pre --upgrade suricata-update
+
+# sudo -E suricata-update enable-source oisf/trafficid
+# sudo -E suricata-update enable-source etnetera/aggressive
+# sudo -E suricata-update enable-source sslbl/ssl-fp-blacklist
+# sudo -E suricata-update enable-source et/open
+# sudo -E suricata-update enable-source tgreen/hunting
+# sudo -E suricata-update enable-source sslbl/ja3-fingerprints
+# sudo -E suricata-update enable-source ptresearch/attackdetection
+
+sudo -E suricata-update
+
+sudo systemctl daemon-reload
+sudo systemctl restart suricata
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+systemctl start suricata
+systemctl enable suricata
+
+#apt-get install -y python-pyinotify
+#python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+systemctl stop suricata
+systemctl disable suricata
+
+#kill $(pgrep -f suri_reloader) 2>/dev/null
@@ -1,75 +0,0 @@
-#!/bin/bash
-
-# Colors
-MAGENTA='\e[0;35m'
-RED='\e[0;31m'
-GREEN='\e[0;32m'
-BLUE='\e[0;34m'
-NC='\e[0m'
-
-# Check that the interface exists and its not in use. Returns iface phy
-iface_check (){
-    IFACE="$1"
-    
-    # Check that the requested iface is available
-    if ! [ -e /sys/class/net/"$IFACE" ]
-    then
-        echo -e "${RED}[ERROR]${NC} The interface provided does not exist. Exiting..."
-        exit 1
-    fi
-   
-    # Check that the given interface is not used by the host as the default route
-    if [[ $(ip r | grep default | cut -d " " -f5) == "$IFACE" ]]
-    then
-        echo -e "${BLUE}[INFO]${NC} The selected interface is configured as the default route, if you use it you will lose internet connectivity"
-        exit 1;
-	fi
-
-    # Find the physical interface for the given wireless interface
-    PHY=$(cat /sys/class/net/"$IFACE"/phy80211/name)
-    echo $PHY
-}
-
-hostapd_setup() {
-    ### Check if hostapd is running in the host
-    hostapd_pid=$(pgrep hostapd)
-    if [ ! "$hostapd_pid" == "" ] 
-    then
-       echo -e "${BLUE}[INFO]${NC} hostapd service is already running in the system, make sure you use a different wireless interface..."
-       #kill -9 "$hostapd_pid"
-    fi
-
-    # Unblock wifi and bring the wireless interface up
-    echo -e "${BLUE}[INFO]${NC} Unblocking wifi and setting ${IFACE} up"
-    rfkill unblock wifi
-    ip link set "$IFACE" up
-
-    # Check if a wlan config file exists, else take wlan parameters by default
-    if [ -e "$PATHSCRIPT"/"$CONF_FILE" ]
-    then
-        echo -e "${BLUE}[INFO]${NC} Found WLAN config file"
-	    # Parse the wlan config file
-		IFS="="
-		while read -r name value
-		do
-                    case $name in
-                        ''|\#* ) continue;; # Skip blank lines and lines starting with #
-                        "SSID" )
-                            SSID=${value//\"/}
-                            echo -e "${BLUE}"[INFO]"${NC}" SSID: "${MAGENTA}""$SSID""${NC}";;
-                        "PASSPHRASE" )
-                            PASSPHRASE=${value//\"/};;
-                        "HW_MODE" )
-                            HW_MODE=${value//\"/};;
-                        "CHANNEL" )
-                            CHANNEL=${value//\"/};;
-                        * )
-                            echo Parameter "$name" in "$PATHSCRIPT"/"$CONF_FILE" not recognized
-		    esac
-		done < "$PATHSCRIPT"/"$CONF_FILE"
-    else
-        echo -e "${BLUE}[INFO]${NC} WLAN config file not found. Setting default WLAN parameters"
-        echo -e "${BLUE}"[INFO]"${NC}" SSID: "${MAGENTA}""$SSID""${NC}"
-    fi
-
-}
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+sudo apt-get update
+
+UPDATES=$(sudo apt-get dist-upgrade -s --quiet=2 | grep ^Inst | wc -l)
+
+if [[ "$UPDATES" -ne "0" ]]; then
+    echo "Please run updates and reboot before installing Mistborn: sudo apt-get update && sudo apt-get -y dist-upgrade"
+    exit 1;
+fi
@@ -16,9 +16,11 @@ fi
    
 sudo -E apt-get install -y cockpit

-if $(sudo apt-cache show cockpit-docker > /dev/null 2>&1) ; then
+if [ $(sudo apt-cache show cockpit-docker > /dev/null 2>&1) ]; then
    # no longer supported upstream in Ubuntu 20.04
    sudo -E apt-get install -y cockpit-docker
+elif [ $(sudo apt-cache show cockpit-podman > /dev/null 2>&1) ]; then
+    sudo -E apt-get install -y cockpit-podman
 fi

 sudo cp ./scripts/conf/cockpit.conf /etc/cockpit/cockpit.conf
@@ -18,3 +18,6 @@ fi
 if [ ! -f /usr/local/bin/docker-compose ]; then
    sudo -E ln -s $(which docker-compose) /usr/local/bin/docker-compose
 fi
+
+# daemon.json
+#source ./scripts/subinstallers/docker_daemon.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# daemon.json
+if [ ! -f /etc/docker/daemon.json ]; then
+    sudo -E cp ./scripts/conf/docker-daemon.json /etc/docker/daemon.json
+    sudo -E systemctl restart docker
+fi
@@ -63,6 +63,12 @@ echo "Installing Docker Compose"

 # Install Docker Compose from pip
 # This might take a while
-sudo pip3 install docker-compose
+# cryptography >=3.4 requires rust to compile, and no rust compiler is readily available for ARM
+sudo pip3 install cryptography==3.3.2 docker-compose
 #fi

+
+# check raspbian fixes
+if [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+    source ./scripts/subinstallers/docker_raspbian.sh 
+fi
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+set +e
+
+compare_version() {
+  local versionOne="${1}"
+  local comparision="${2}"
+  local versionTwo="${3}"
+  local result=
+  local sortOpt=
+  local returncode=1
+ 
+  if [[ "${versionOne}" == "${versionTwo}" ]] ; then
+    return 3
+  fi
+ 
+  case ${comparision} in
+    lower|smaller|older|lt|"<" ) sortOpt= ;;
+    higher|bigger|newer|bt|">" ) sortOpt='r' ;;
+    * ) return 2 ;;
+  esac
+ 
+  result=($(printf "%s\n" "${versionOne}" "${versionTwo}" | sort -${sortOpt}V ))
+  if [[ "${versionOne}" == "${result[0]}" ]] ; then
+    returncode=0
+  fi
+ 
+  return ${returncode}
+} # end of function compare_version
+
+# libseccomp2
+LIBSECCOMP2_VERSION=$(sudo -E apt-cache policy libseccomp2 | egrep ^\ *Inst | awk '{print $2}')
+
+compare_version $LIBSECCOMP2_VERSION '<' '2.5.1-1'
+
+if [ $? -eq 0 ]; then
+    # this is dumb but the raspbian repo managers aren't impressive
+    echo "Installing newer libseccomp2"
+    pushd .
+    cd /tmp
+    wget http://ftp.us.debian.org/debian/pool/main/libs/libseccomp/libseccomp2_2.5.1-1_$(dpkg --print-architecture).deb
+    sudo dpkg -i libseccomp2_2.5.1-1_$(dpkg --print-architecture).deb
+    popd
+fi
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# generate bitwarden .env files
+BITWARDEN_PROD_FILE="$1"
+echo "WEBSOCKET_ENABLED=true" > $BITWARDEN_PROD_FILE
+echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
+chmod 600 $BITWARDEN_PROD_FILE
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Elasticsearch
+ELASTICSEARCH_PROD_FILE="$1"
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $ELASTICSEARCH_PROD_FILE
+chmod 600 $ELASTICSEARCH_PROD_FILE
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Guacamole
+GUAC_PROD_FILE="$1"
+GUAC_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+echo "POSTGRES_HOST=guac_postgres" > $GUAC_PROD_FILE
+echo "POSTGRES_HOSTNAME=guac_postgres" > $GUAC_PROD_FILE
+echo "POSTGRES_PORT=5432" >> $GUAC_PROD_FILE
+echo "POSTGRES_DB=guacamole_db" >> $GUAC_PROD_FILE
+echo "POSTGRES_DATABASE=guacamole_db" >> $GUAC_PROD_FILE
+echo "POSTGRES_USER=guac_user" >> $GUAC_PROD_FILE
+echo "POSTGRES_PASSWORD=$GUAC_PASSWORD" >> $GUAC_PROD_FILE
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $GUAC_PROD_FILE
+chmod 600 $GUAC_PROD_FILE
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# JITSI
+JITSI_PROD_FILE="$1"
+cp ${MISTBORN_HOME}/scripts/conf/jitsi.env $JITSI_PROD_FILE
+mkdir -p ${MISTBORN_HOME}/.envs/.production/.jitsi-cfg/{web/letsencrypt,transcripts,prosody,jicofo,jvb}
+sed -i "s/JICOFO_COMPONENT_SECRET.*/JICOFO_COMPONENT_SECRET=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
+sed -i "s/JICOFO_AUTH_PASSWORD.*/JICOFO_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
+sed -i "s/JVB_AUTH_PASSWORD.*/JVB_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
+sed -i "s/JIGASI_XMPP_PASSWORD.*/JIGASI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
+sed -i "s/JIBRI_RECORDER_PASSWORD.*/JIBRI_RECORDER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
+sed -i "s/JIBRI_XMPP_PASSWORD.*/JIBRI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
+chmod 600 $JITSI_PROD_FILE
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# generate nextcloud .env files
+NEXTCLOUD_PROD_FILE="$1"
+#NEXTCLOUD_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+NEXTCLOUD_PASSWORD="${MISTBORN_DEFAULT_PASSWORD}"
+echo "NEXTCLOUD_ADMIN_USER=mistborn" > $NEXTCLOUD_PROD_FILE
+echo "NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_PASSWORD" >> $NEXTCLOUD_PROD_FILE
+echo "NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.mistborn" >> $NEXTCLOUD_PROD_FILE
+chmod 600 $NEXTCLOUD_PROD_FILE
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# generate onlyoffice .env files
+ONLYOFFICE_PROD_FILE="$1"
+JWT_SECRET="${MISTBORN_DEFAULT_PASSWORD}"
+echo "JWT_ENABLED=true" > $ONLYOFFICE_PROD_FILE
+echo "JWT_SECRET=$JWT_SECRET" >> $ONLYOFFICE_PROD_FILE
+chmod 600 $ONLYOFFICE_PROD_FILE
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# RaspAP
+RASPAP_PROD_FILE="$1"
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" > $RASPAP_PROD_FILE
+chmod 600 $RASPAP_PROD_FILE
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# generate rocketchat .env files
+ROCKETCHAT_PROD_FILE="$1"
+#ROCKETCHAT_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+ROCKETCHAT_PASSWORD="${MISTBORN_DEFAULT_PASSWORD}"
+echo "ROCKETCHAT_USER=bot" > $ROCKETCHAT_PROD_FILE
+echo "ROCKETCHAT_ROOM=GENERAL" >> $ROCKETCHAT_PROD_FILE
+echo "BOT_NAME=bot" >> $ROCKETCHAT_PROD_FILE
+echo "ROCKETCHAT_PASSWORD=$ROCKETCHAT_PASSWORD" >> $ROCKETCHAT_PROD_FILE
+
+# docker environment
+echo "MISTBORN_BIND_IP=${MISTBORN_BIND_IP}" >> $ROCKETCHAT_PROD_FILE
+
+chmod 600 $ROCKETCHAT_PROD_FILE
@@ -0,0 +1,92 @@
+#!/bin/bash
+
+# Wazuh
+WAZUH_PROD_FILE="$1"
+echo "ELASTIC_USERNAME=mistborn" > $WAZUH_PROD_FILE
+echo "ELASTIC_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
+
+echo "ELASTICSEARCH_USERNAME=mistborn" >> $WAZUH_PROD_FILE
+echo "ELASTICSEARCH_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
+
+# kibana odfe
+# kibana-odfe/config/wazuh_app_config.sh
+# https://wazuh
+echo "WAZUH_API_URL=https://10.2.3.1" >> $WAZUH_PROD_FILE
+echo "API_PORT=55000" >> $WAZUH_PROD_FILE
+echo "API_USERNAME=wazuh-wui" >> $WAZUH_PROD_FILE
+
+#API_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+
+API_PASSWORD_PYTHON=$(cat << EOF
+
+import secrets
+import random
+import string
+
+random_pass = ([secrets.choice("@$!*?-"),
+                           secrets.choice(string.digits),
+                           secrets.choice(string.ascii_lowercase),
+                           secrets.choice(string.ascii_uppercase),
+                           ]
+                          + [secrets.choice(string.ascii_lowercase
+                                           + string.ascii_uppercase
+                                           + "@$!*?-"
+                                           + string.digits) for i in range(12)])
+
+random.shuffle(random_pass)
+random_pass = ''.join(random_pass)
+print(random_pass)
+
+EOF
+)
+
+API_PASSWORD=$(python3 -c "${API_PASSWORD_PYTHON}")
+
+echo "API_PASSWORD=${API_PASSWORD}" >> $WAZUH_PROD_FILE
+
+# kibana-odfe/config/entrypoint.sh:
+# https://elasticsearch:9200
+echo "ELASTICSEARCH_URL=https://10.2.3.1:9200" >> $WAZUH_PROD_FILE
+
+
+cat >> ${WAZUH_PROD_FILE}<< EOF
+
+PATTERN="wazuh-alerts-*"
+
+CHECKS_PATTERN=true
+CHECKS_TEMPLATE=true
+CHECKS_API=true
+CHECKS_SETUP=true
+
+EXTENSIONS_PCI=true
+EXTENSIONS_GDPR=true
+EXTENSIONS_HIPAA=true
+EXTENSIONS_NIST=true
+EXTENSIONS_TSC=true
+EXTENSIONS_AUDIT=true
+EXTENSIONS_OSCAP=false
+EXTENSIONS_CISCAT=false
+EXTENSIONS_AWS=false
+EXTENSIONS_GCP=false
+EXTENSIONS_VIRUSTOTAL=true
+EXTENSIONS_OSQUERY=true
+EXTENSIONS_DOCKER=true
+
+APP_TIMEOUT=20000
+
+API_SELECTOR=true
+IP_SELECTOR=true
+IP_IGNORE="[]"
+
+WAZUH_MONITORING_ENABLED=true
+WAZUH_MONITORING_FREQUENCY=900
+WAZUH_MONITORING_SHARDS=2
+WAZUH_MONITORING_REPLICAS=0
+
+ADMIN_PRIVILEGES=true
+
+EOF
+
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
+
+chmod 600 $WAZUH_PROD_FILE
@@ -1,9 +1,10 @@
-#!/bin/sh
+#!/bin/bash

 figlet "Mistborn: Container Credentials"

 # generate production .env file for Django
 mkdir -p ./.envs/.production
+chmod 700 ./.envs
 DJANGO_PROD_FILE="./.envs/.production/.django"
 DJANGO_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
 #CELERY_FLOWER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
@@ -22,6 +23,7 @@ echo "#SENTRY_DNS=" >> $DJANGO_PROD_FILE
 echo "MISTBORN_INSTALL_COCKPIT=$MISTBORN_INSTALL_COCKPIT" >> $DJANGO_PROD_FILE
 echo "MISTBORN_PORTAL_IP=10.2.3.1" >> $DJANGO_PROD_FILE
 echo "MISTBORN_PORTAL_PORT=5000" >> $DJANGO_PROD_FILE
+chmod 600 $DJANGO_PROD_FILE

 # generate production .env file for postgresql
 POSTGRES_PROD_FILE="./.envs/.production/.postgres"
@@ -31,6 +33,7 @@ echo "POSTGRES_PORT=5432" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_DB=mistborn" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_USER=prod" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> $POSTGRES_PROD_FILE
+chmod 600 $POSTGRES_PROD_FILE


 # generate production .env file for pihole
@@ -39,36 +42,4 @@ PIHOLE_PROD_FILE="./.envs/.production/.pihole"
 WEBPASSWORD="$1"
 echo "TZ=\"America/New York\"" > $PIHOLE_PROD_FILE
 echo "WEBPASSWORD=$WEBPASSWORD" >> $PIHOLE_PROD_FILE
-
-# generate rocketchat .env files
-ROCKETCHAT_PROD_FILE="./.envs/.production/.rocketchat"
-#ROCKETCHAT_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
-ROCKETCHAT_PASSWORD="$1"
-echo "ROCKETCHAT_USER=bot" > $ROCKETCHAT_PROD_FILE
-echo "ROCKETCHAT_ROOM=GENERAL" >> $ROCKETCHAT_PROD_FILE
-echo "BOT_NAME=bot" >> $ROCKETCHAT_PROD_FILE
-echo "ROCKETCHAT_PASSWORD=$ROCKETCHAT_PASSWORD" >> $ROCKETCHAT_PROD_FILE
-
-# generate nextcloud .env files
-NEXTCLOUD_PROD_FILE="./.envs/.production/.nextcloud"
-#NEXTCLOUD_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
-NEXTCLOUD_PASSWORD="$1"
-echo "NEXTCLOUD_ADMIN_USER=mistborn" > $NEXTCLOUD_PROD_FILE
-echo "NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_PASSWORD" >> $NEXTCLOUD_PROD_FILE
-echo "NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.mistborn" >> $NEXTCLOUD_PROD_FILE
-
-# generate onlyoffice .env files
-ONLYOFFICE_PROD_FILE="./.envs/.production/.onlyoffice"
-JWT_SECRET="$1"
-echo "JWT_ENABLED=true" > $ONLYOFFICE_PROD_FILE
-echo "JWT_SECRET=$JWT_SECRET" >> $ONLYOFFICE_PROD_FILE
-
-# generate bitwarden .env files
-BITWARDEN_PROD_FILE="./.envs/.production/.bitwarden"
-echo "WEBSOCKET_ENABLED=true" > $BITWARDEN_PROD_FILE
-echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
-
-# JITSI
-JITSI_PROD_FILE="./.envs/.production/.jitsi"
-cp ./scripts/conf/jitsi.env $JITSI_PROD_FILE
-mkdir -p ./.envs/.production/.jitsi-cfg/{web/letsencrypt,transcripts,prosody,jicofo,jvb}
+chmod 600 $PIHOLE_PROD_FILE
@@ -6,7 +6,7 @@ figlet "Mistborn: Configuring Firewall"

 echo "stop iptables wrappers"
 if [ "$DISTRO" == "ubuntu" ]; then
-    # Disable UFW
+    echo "Disabling UFW"
    sudo systemctl stop ufw || true
    sudo systemctl disable ufw || true
 fi
@@ -113,6 +113,11 @@ fi

 # IP forwarding
 sudo sed -i 's/.*net.ipv4.ip_forward.*/net.ipv4.ip_forward=1/' /etc/sysctl.conf
+
+# VM Overcommit Memory
+sudo grep -i "vm.overcommit_memory" /etc/sysctl.conf && sudo sed -i 's/.*vm.overcommit_memory.*/vm.overcommit_memory=1/' /etc/sysctl.conf || echo "vm.overcommit_memory=1" | sudo tee -a /etc/sysctl.conf
+
+# Force re-read of sysctl.conf
 sudo sysctl -p /etc/sysctl.conf

 # rsyslog to create /var/log/iptables.log
@@ -17,7 +17,7 @@ sudo -E mkdir -p $KEY_FOLDER
 sudo -E rm -f ${KEY_FOLDER}/*

 # generate crt and key
-sudo -E openssl req -x509 -sha256 -nodes -days 397 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -addext "subjectAltName = DNS:*.mistborn" -addext extendedKeyUsage=serverAuth -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"
+sudo -E openssl req -x509 -sha256 -nodes -days 397 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -addext "subjectAltName=DNS:*.mistborn,DNS:home.mistborn,DNS:jitsi.mistborn,DNS:bitwarden.mistborn,DNS:chat.mistborn,DNS:homeassistant.mistborn,DNS:jellyfin.mistborn,DNS:syncthing.mistborn,DNS:nextcloud.mistborn,DNS:onlyoffice.mistborn" -addext extendedKeyUsage=serverAuth -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"

 # set permissions
 sudo -E chown -R mistborn:mistborn ${KEY_FOLDER}
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# INPUT default admin password
+while [ -z "${MISTBORN_DEFAULT_PASSWORD}" ]; do
+    echo
+    echo "(Mistborn) The default admin password may only container alphanumeric characters and _"
+    read -p "(Mistborn) Set default admin password: " -s MISTBORN_DEFAULT_PASSWORD
+    echo
+
+    if [[ ${MISTBORN_DEFAULT_PASSWORD} =~ ^[A-Za-z0-9_]+$ ]]; then
+    # it matches
+        echo "(Mistborn) Password is accepted"
+    else
+        unset MISTBORN_DEFAULT_PASSWORD
+        echo "(Mistborn) Try again"
+    fi
+
+done
+
+echo
+echo "MISTBORN_DEFAULT_PASSWORD is set"
+echo
@@ -1,3 +0,0 @@
-#!/bin/bash
-
-sudo apt-get install -y bridge-utils iw rfkill
@@ -12,10 +12,10 @@ if ! $(sudo apt-cache show wireguard > /dev/null 2>&1) ; then
    if [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
        echo "Adding Wireguard repo keys"
        sudo -E apt-get install -y dirmngr
-        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8B48AD6246925553
-        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7638D0442B90D010
-        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC
-        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 648ACFD622F3D138 
+        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 8B48AD6246925553
+        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 7638D0442B90D010
+        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 04EE7237B7D453EC
+        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 648ACFD622F3D138 
    fi

    if [ "$DISTRO" == "ubuntu" ]; then
@@ -18,6 +18,13 @@ sudo mistborn-cli pullbuild
 sudo docker container prune -f
 sudo docker image prune -f

+
+# RESTART
+
 sudo systemctl stop Mistborn-base
+
+# docker daemon
+#source ./scripts/subinstallers/docker_daemon.sh
+
 sudo systemctl restart Mistborn-setup
 sudo systemctl restart Mistborn-base
@@ -0,0 +1,57 @@
+#!/bin/bash
+
+set -e
+
+MISTBORN_HOME="/opt/mistborn"
+
+SERVICES="$1"
+shift
+
+IFS=','
+read -ra SERVICES_ARRAY <<< "${SERVICES}"
+for SERVICE in "${SERVICES_ARRAY[@]}"; do
+    MISTBORN_SERVICE_FILE=${MISTBORN_HOME}/.envs/.production/.${SERVICE}
+    MISTBORN_SERVICE_INIT=${MISTBORN_HOME}/scripts/services/${SERVICE}/init.sh
+
+    # check and create file if needed
+    ${MISTBORN_HOME}/scripts/env/check_env_file.sh ${SERVICE}
+
+    # read in variables
+    set -a
+    source ${MISTBORN_HOME}/.env
+
+    if [[ -f "${MISTBORN_SERVICE_FILE}" ]]; then
+        echo "Loading service variables"
+        source ${MISTBORN_SERVICE_FILE}
+    else
+        echo "No service variables to load. Proceeding."
+    fi
+    set +a
+
+    # init script
+    if [[ -f "${MISTBORN_SERVICE_INIT}" ]]; then
+        echo "Running init script"
+        ${MISTBORN_SERVICE_INIT}
+    else
+        echo "No init script. Proceeding."
+    fi
+done
+
+# check that netcat exists
+if ! [ -x "$(command -v nc)" ]; then
+    echo "Installing netcat"
+    sudo apt-get install -y netcat
+fi
+
+# ensure base is up and listening
+echo "Checking that Mistborn-base has finished starting up..."
+
+while ! nc -z 10.2.3.1 5000; do
+    WAIT_TIME=$((5 + $RANDOM % 15))
+    echo "Waiting ${WAIT_TIME} seconds for Mistborn-base..."
+    sleep ${WAIT_TIME}
+done
+
+echo "Mistborn-base is running"
+
+exec "$@"
Author	SHA1	Message	Date
Steven Foerster	3267aaf3de	middleware	2021-05-31 15:08:52 -04:00
Steven Foerster	86c2526512	cockpit	2021-05-31 14:59:16 -04:00
Steven Foerster	bfd44f504f	pihole forwardauth	2021-05-31 14:54:06 -04:00
Steven Foerster	906205aa8e	mistborn auth	2021-05-31 14:20:50 -04:00
Steven Foerster	7a1dab435f	traefik dashboard	2021-05-31 12:01:00 -04:00
Steven Foerster	980432dc43	Merge branch '181-pihole' into 'master' Resolve "Update README" Closes #181 See merge request cyber5k/mistborn!84	2021-05-28 18:04:11 +00:00
Steven Foerster	71b538bdb7	Resolve "Update README"	2021-05-28 18:04:11 +00:00
Steven Foerster	c6b5295aca	Merge branch '161-libseccomp2-raspbian' into 'master' Resolve "PostgresSQL not avaiable" Closes #161 See merge request cyber5k/mistborn!83	2021-05-08 16:35:30 +00:00
Steven Foerster	e655a71db3	Resolve "PostgresSQL not avaiable"	2021-05-08 16:35:30 +00:00
Steven Foerster	d289abaa4b	Merge branch '135-wazuh-ids' into 'master' Resolve "Adding Suricata" Closes #135 See merge request cyber5k/mistborn!82	2021-05-07 17:14:49 +00:00
Steven Foerster	b83227e39d	Resolve "Adding Suricata"	2021-05-07 17:14:49 +00:00
Steven Foerster	5f825ff831	Merge branch '170-restart' into 'master' handle ungraceful restarts Closes #170 See merge request cyber5k/mistborn!81	2021-05-04 20:44:27 +00:00
Steven Foerster	75da49eeab	handle ungraceful restarts	2021-05-04 16:29:22 -04:00
Steven Foerster	97d25bbce4	Merge branch '173-security' into 'master' Resolve "Wazuh is not Starting" Closes #173 See merge request cyber5k/mistborn!80	2021-05-03 02:56:06 +00:00
Steven Foerster	5b9e07fb24	Resolve "Wazuh is not Starting"	2021-05-03 02:56:05 +00:00
Steven Foerster	1ca2a80da3	Merge branch '172-binds' into 'master' Resolve "Dependent Service Restart Handling" Closes #172 See merge request cyber5k/mistborn!79	2021-04-27 02:31:55 +00:00
Steven Foerster	b9b0eebf1e	Resolve "Dependent Service Restart Handling"	2021-04-27 02:31:55 +00:00
Steven Foerster	6fe1abc57f	Merge branch '169-soc' into 'master' Resolve "Security Center Bugfixes" Closes #169 See merge request cyber5k/mistborn!78	2021-04-23 02:21:41 +00:00
Steven Foerster	10568bc684	Resolve "Security Center Bugfixes"	2021-04-23 02:21:41 +00:00
Steven Foerster	7bce97479f	Merge branch '168-parsing' into 'master' Wazuh API Password Closes #168 See merge request cyber5k/mistborn!77	2021-04-22 03:18:49 +00:00
Steven Foerster	8de1dafcad	ampersand	2021-04-21 23:00:09 -04:00
Steven Foerster	ae1461abba	Merge branch '165-wazuh' into 'master' Resolve "Wazuh" Closes #165 See merge request cyber5k/mistborn!75	2021-04-22 02:40:27 +00:00
Steven Foerster	42bd766346	Resolve "Wazuh"	2021-04-22 02:40:26 +00:00
Steven Foerster	ed37b142ba	Merge branch '166-pihole' into 'master' pihole v5.7 Closes #166 See merge request cyber5k/mistborn!74	2021-04-15 12:18:31 +00:00
Steven Foerster	3675e3d0d2	pihole v5.7	2021-04-15 08:01:09 -04:00
Steven Foerster	e935b95285	Merge branch '28-raspap' into 'master' Resolve "Integrate RaspAP as extra service" Closes #28 See merge request cyber5k/mistborn!73	2021-03-31 02:40:04 +00:00
Steven Foerster	9e7f85b6f9	Resolve "Integrate RaspAP as extra service"	2021-03-31 02:40:04 +00:00
Steven Foerster	72ba1769aa	Merge branch '156-docker' into 'master' Resolve "Started Extra Services restart on OS reboot" Closes #156 See merge request cyber5k/mistborn!72	2021-03-21 16:09:59 +00:00
Steven Foerster	d65e5434a0	Resolve "Started Extra Services restart on OS reboot"	2021-03-21 16:09:58 +00:00
Steven Foerster	445cf2678e	Merge branch '150-passwd' into 'master' Resolve "Mistborn default password parsing" Closes #150 See merge request cyber5k/mistborn!70	2021-03-12 18:04:21 +00:00
Steven Foerster	ce5dfb10fa	Resolve "Mistborn default password parsing"	2021-03-12 18:04:21 +00:00
Steven Foerster	d0a70d60a6	Merge branch '144-parsing' into 'master' parsing Closes #144 See merge request cyber5k/mistborn!69	2021-03-06 02:12:33 +00:00
Steven Foerster	84961c793f	parsing	2021-03-05 20:36:13 -05:00
Steven Foerster	9cb037d27f	Merge branch '142-updates' into 'master' Resolve "Updates - handle added extra services" Closes #142 See merge request cyber5k/mistborn!68	2021-03-03 17:21:46 +00:00
Steven Foerster	49bad9c7ba	Resolve "Updates - handle added extra services"	2021-03-03 17:21:45 +00:00
Steven Foerster	65ecd7ae7b	Merge branch '140-updates' into 'master' updates Closes #140 See merge request cyber5k/mistborn!67	2021-02-28 05:51:18 +00:00
Steven Foerster	b44a543172	updates	2021-02-28 00:33:15 -05:00
Steven Foerster	1669161d5d	Merge branch '139-guac' into 'master' Resolve "Guacamole details and prefix" Closes #139 See merge request cyber5k/mistborn!65	2021-02-27 17:48:43 +00:00
Steven Foerster	c2f42d6794	Resolve "Guacamole details and prefix"	2021-02-27 17:48:43 +00:00
Steven Foerster	53b5381150	Merge branch '137-guac' into 'master' Resolve "Add Apache Guacamole service" Closes #137 See merge request cyber5k/mistborn!64	2021-02-27 00:50:22 +00:00
Steven Foerster	442b43f472	Resolve "Add Apache Guacamole service"	2021-02-27 00:50:21 +00:00
Steven Foerster	c7d81b6ad3	Merge branch '136-cryptography' into 'master' Resolve "Error while installing Mistborn" Closes #136 See merge request cyber5k/mistborn!63	2021-02-17 04:26:58 +00:00
Steven Foerster	35b7a2f335	Resolve "Error while installing Mistborn"	2021-02-17 04:26:58 +00:00
Steven Foerster	a9771130ef	Merge branch '125-pihole-dnspooq' into 'master' Resolve "Update pihole: dnspooq" Closes #125 See merge request cyber5k/mistborn!62	2021-01-21 00:23:16 +00:00
Steven Foerster	d311c45ef5	Resolve "Update pihole: dnspooq"	2021-01-21 00:23:16 +00:00
Steven Foerster	fe9ba2714e	Merge branch '124-gpg' into 'master' use port 80 Closes #124 See merge request cyber5k/mistborn!61	2021-01-21 00:17:04 +00:00
Steven Foerster	5980955cc5	use port 80	2021-01-19 19:23:38 -05:00
Steven Foerster	6f9bada0dd	Merge branch '116-cockpit' into 'master' Resolve "E: Package 'cockpit-docker' has no installation candidate" Closes #116 See merge request cyber5k/mistborn!60	2021-01-18 15:14:44 +00:00
Steven Foerster	78c3ccf9de	Resolve "E: Package 'cockpit-docker' has no installation candidate"	2021-01-18 15:14:44 +00:00
Steven Foerster	434472d2fe	Merge branch '119-tls-ios' into 'master' Resolve "Jitsi - "You have beend disconnected" - Only on iOS devices, PC's fine" Closes #119 See merge request cyber5k/mistborn!59	2021-01-18 13:51:30 +00:00
Steven Foerster	a6f3430fc7	Resolve "Jitsi - "You have beend disconnected" - Only on iOS devices, PC's fine"	2021-01-18 13:51:30 +00:00
Steven Foerster	19c8a08308	Merge branch '122-pihole-version' into 'master' pihole version v5.3.4 Closes #122 See merge request cyber5k/mistborn!58	2021-01-16 21:06:42 +00:00
Steven Foerster	4a78fe1122	pihole version v5.3.4	2021-01-16 15:56:14 -05:00
Steven Foerster	06eff60808	Merge branch '112-service-restarts' into 'master' Resolve "Service Restarts" Closes #112 See merge request cyber5k/mistborn!57	2021-01-01 03:31:48 +00:00
Steven Foerster	edaff5575b	Resolve "Service Restarts"	2021-01-01 03:31:48 +00:00
Steven Foerster	2e82a1b805	Merge branch '107-jitsi' into 'master' Resolve "version control jitsi containers" Closes #107 See merge request cyber5k/mistborn!56	2020-12-11 02:25:46 +00:00
Steven Foerster	e958b64283	Resolve "version control jitsi containers"	2020-12-11 02:25:45 +00:00
Steven Foerster	480f62bc0d	Merge branch '105-jitsi' into 'master' Resolve "Jitsi Bouncing Error" Closes #105 See merge request cyber5k/mistborn!55	2020-12-10 00:31:55 +00:00
Steven Foerster	649b88977b	Resolve "Jitsi Bouncing Error"	2020-12-10 00:31:55 +00:00
Steven Foerster	09c3932e8d	Merge branch '104-security-scan' into 'master' security scan links Closes #104 See merge request cyber5k/mistborn!54	2020-12-06 03:33:30 +00:00
Steven Foerster	d3450f5ab3	security scan links	2020-12-05 22:28:22 -05:00
Steven Foerster	7b099f4069	Merge branch '103-tor-jitsi' into 'master' Resolve "Bug: Tor unable to start after Jitsi starts" Closes #103 See merge request cyber5k/mistborn!53	2020-12-06 00:41:15 +00:00
Steven Foerster	5596024be3	Resolve "Bug: Tor unable to start after Jitsi starts"	2020-12-06 00:41:15 +00:00
Steven Foerster	455bf6787c	Merge branch '102-bind-ip-chat' into 'master' Resolve "Defense in depth: bind IPs" Closes #102 See merge request cyber5k/mistborn!52	2020-12-06 00:35:21 +00:00
Steven Foerster	0a7644827e	Resolve "Defense in depth: bind IPs"	2020-12-06 00:35:21 +00:00
Steven Foerster	07f0b07d83	Merge branch '101-MFA-cockpit' into 'master' Resolve "Bugfix: MFA authentication routing for cockpit" Closes #101 See merge request cyber5k/mistborn!51	2020-12-05 04:14:50 +00:00
Steven Foerster	92e62620ee	Resolve "Bugfix: MFA authentication routing for cockpit"	2020-12-05 04:14:50 +00:00
Steven Foerster	de0d5747a3	Merge branch '100-MFA-traefik' into 'master' Resolve "Multi-Factor Authentication integration with Traefik" Closes #100 See merge request cyber5k/mistborn!50	2020-12-05 03:21:45 +00:00
Steven Foerster	51af2bbed9	Resolve "Multi-Factor Authentication integration with Traefik"	2020-12-05 03:21:44 +00:00
Steven Foerster	5e77276727	Merge branch '99-docs' into 'master' Resolve "Documentation: Linux Magazine" Closes #99 See merge request cyber5k/mistborn!49	2020-12-04 16:05:09 +00:00
Steven Foerster	d832a6821a	Resolve "Documentation: Linux Magazine"	2020-12-04 16:05:09 +00:00
Steven Foerster	35618623a9	Merge branch '98-diface' into 'master' Resolve "Bugfix: handling empty DIFACE" Closes #98 See merge request cyber5k/mistborn!48	2020-11-23 03:59:34 +00:00
Steven Foerster	c7c7a897d9	Resolve "Bugfix: handling empty DIFACE"	2020-11-23 03:59:34 +00:00
Steven Foerster	c632385ab5	Merge branch '94-docs' into 'master' Resolve "Some Bugs: Root PasswordLogin not disabled as espected, unable to resolve hostnames" Closes #94 See merge request cyber5k/mistborn!47	2020-11-10 20:25:44 +00:00
Steven Foerster	b7c63cb3a7	Resolve "Some Bugs: Root PasswordLogin not disabled as espected, unable to resolve hostnames"	2020-11-10 20:25:44 +00:00
Steven Foerster	d401a1137c	Merge branch '95-dns-stub' into 'master' Resolve "DNS not resolving after reboot" Closes #95 See merge request cyber5k/mistborn!46	2020-11-08 01:12:57 +00:00
Steven Foerster	5a306d91ee	Resolve "DNS not resolving after reboot"	2020-11-08 01:12:57 +00:00
Steven Foerster	e6de9a1e90	Merge branch '93-netfilter-persistent' into 'master' systemd require netfilter-persistent Closes #93 See merge request cyber5k/mistborn!44	2020-10-22 01:54:51 +00:00
Steven Foerster	fe26bcbd16	systemd require netfilter-persistent	2020-10-21 21:34:02 -04:00
Steven Foerster	1fa3a6d9e3	adding project support link	2020-09-23 10:23:24 -04:00
Steven Foerster	a80a52f0fd	Merge branch '82-public-ip' into 'master' syncing with docker image: public IP selection Closes #82 See merge request cyber5k/mistborn!43	2020-09-20 02:05:58 +00:00
Steven Foerster	4b8f82a93f	syncing with docker image: public IP selection	2020-09-19 11:31:47 -04:00
Steven Foerster	3fefb5b10c	Merge branch '84-docs' into 'master' Resolve "Unable to create wireguard config after successful installation on Azure" Closes #84 See merge request cyber5k/mistborn!42	2020-09-16 21:27:55 +00:00
Steven Foerster	221377c01f	Resolve "Unable to create wireguard config after successful installation on Azure"	2020-09-16 21:27:55 +00:00
Steven Foerster	bb2b4ffdcc	Merge branch '83-rocketchat-volumes' into 'master' rocketchat: mounting correct volumes Closes #83 See merge request cyber5k/mistborn!41	2020-09-15 19:47:56 +00:00
Steven Foerster	a29f77b34e	rocketchat: mounting correct volumes	2020-09-15 14:50:22 -04:00
Steven Foerster	4f5127fabc	Merge branch '79-jitsi-auth' into 'master' generate random passwords for jitsi internal use Closes #79 See merge request cyber5k/mistborn!40	2020-09-15 12:42:35 +00:00
Steven Foerster	083dcccdf5	mimic behavior of gen_passwords	2020-09-15 08:26:16 -04:00