Merge branch 'master' into onlyoffice

overlay network
2020-07-30 11:51:01 -04:00 · 2020-04-29 17:18:03 -04:00 · 2020-04-16 08:42:28 -04:00 · 2020-04-15 17:39:40 -04:00 · 2020-04-15 17:36:05 -04:00 · 2020-04-15 17:06:11 -04:00
33 changed files with 430 additions and 386 deletions
@@ -19,5 +19,6 @@ docker_build:
  script:
    - apk add docker-compose
    - scripts/subinstallers/gen_prod_env.sh "$MISTBORN_DEFAULT_PASSWORD"
+    - cp compose/production/traefik/traefik.toml.template compose/production/traefik/traefik.toml
    - docker-compose -f base.yml build

@@ -48,12 +48,7 @@ Tested Operating Systems (in order of thoroughness):
 - Ubuntu 20.04 LTS
 - Ubuntu 18.04 LTS
 - Debian 10 (Buster)
- Raspberry Pi OS (formerly Raspbian) Buster
-
-**Note:** Install operating system updates and restart. Raspberry Pi OS particularly needs to be restarted after kernel updates (kernel modules for the currently running kernel may be missing).
-
-Tested Browsers:
- Firefox
+- Raspbian Buster

 The default tests are run on DigitalOcean Droplets: 2GB RAM, 1 CPU, 50GB hard disk.

@@ -61,8 +56,8 @@ The Mistborn docker images exist for these architectures:

 | Mistborn Docker Images (hub.docker.com)        | Architectures       |
 |------------------------------------------------|---------------------|
-| mistborn (django, celery{worker,beat}, flower) | amd64, arm64, arm/v7 |
-| dnscrypt-proxy                                 | amd64, arm64, arm/v7 |
+| mistborn (django, celery{worker,beat}, flower) | amd64, arm64, armv7 |
+| dnscrypt-proxy                                 | amd64, arm64, armv7 |

 Recommended System Specifications:

@@ -76,7 +71,7 @@ Recommended System Specifications:
 Starting from base installation
 ```
 git clone https://gitlab.com/cyber5k/mistborn.git
-sudo -E bash ./mistborn/scripts/install.sh
+sudo bash ./mistborn/scripts/install.sh
 ```

 Get default admin Wireguard profile
@@ -118,12 +113,12 @@ In Mistborn, Gateways are upstream from the VPN server so connections to third-p
 The Gateway adds an extra network hop. DNS is still resolved in Mistborn so pihole is still blocking ads.

 # Installation
-Mistborn is regularly tested on Ubuntu 20.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested). Make sure to install OS updates and restart before installing Mistborn (Wireguard installs differently on recent kernels).
+Mistborn is regularly tested on Ubuntu 18.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested). Additionally tested on Ubuntu 20.04 LTS.

 Clone the git repository and run the install script:
 ```
 git clone https://gitlab.com/cyber5k/mistborn.git
-sudo -E bash ./mistborn/scripts/install.sh
+sudo bash ./mistborn/scripts/install.sh
 ```

 Running `install.sh` will do the following:
@@ -134,8 +129,8 @@ Running `install.sh` will do the following:
 - install Docker
 - install OpenSSH
 - install Wireguard
- install Cockpit (optional)
- create a `cockpit` system user (if Cockpit is installed)
+- install Cockpit
+- create a `cockpit` system user
 - configure unattended-upgrades
 - generate a self-signed TLS certificate/key (WebRTC functionality requires TLS)
 - create and populate traefik.toml
@@ -157,7 +152,7 @@ See the environment variables needed in `./scripts/noninteractive/.install_bareb
 This will perform a noninteractive install with the default environment variables set in `.install_barebones`.
 ```
 git clone https://gitlab.com/cyber5k/mistborn.git
-sudo -E bash -c "source ./mistborn/scripts/noninteractive/.install_barebones && ./mistborn/scripts/install.sh"
+sudo bash -c "source ./mistborn/scripts/noninteractive/.install_barebones && ./mistborn/scripts/install.sh"
 ```

 # Post-Installation
@@ -270,8 +265,6 @@ These are the default credentials to use in the services you choose to use:
 | Cockpit | cockpit | {{default mistborn password}} |
 | Nextcloud | mistborn | {{default mistborn password}} |

-You can find the credentials sent to the Docker containers in: `/opt/mistborn/.envs/.production/`
-
 # Gateway Setup
 Mistborn will generate the Wireguard configuration script for the Gateway. From a base Ubuntu/Debian/Raspbian operating system the following packages are recommended to be installed beforehand:

@@ -319,7 +312,7 @@ But wait, there's more! You can:
 | Rocket.Chat    | [Rocket.Chat](https://play.google.com/store/apps/details?id=chat.rocket.android)                   | [Rocket.Chat](https://apps.apple.com/us/app/rocket-chat/id1148741252)              |

 ## TLS Certificate
-Some apps require TLS (HTTPS). All traffic to Mistborn domains already occurs over Wireguard but to keep apps running, a TLS certificate exists for Mistborn and can be imported into your device's trusted credentials in the security settings. This certificate is checked every day and will be re-generated when expiration is less than 30 days away.
+Some apps require TLS (HTTPS). All traffic to Mistborn domains already occurs over Wireguard but to keep apps running, a TLS certificate exists for Mistborn and can be imported into your device's trusted credentials in the security settings.

 The TLS certificate can be found here:
 ```
@@ -448,7 +441,7 @@ These are some notes regarding the technical design and implementations of Mistb
 ## Additonal Notes
 - Interface names are not hardcoded anywhere in Mistborn. Two commands that are used in different circumstances to determine the default network interface and the interface that would route a public IP address are: `ip -o -4 route show to default` and `ip -o -4 route get 1.1.1.1`.
 - The "Update" button will pull updated Docker images for mistborn, postgresql, redis, pihole, and dnscrypt. Those services will then be restarted.
- The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 397 days. The certificate is checked daily and will regenerate when expiration is within 30 days.
+- The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 10 years. The nanny at Apple has decided to restrict the kinds of certificates iOS users may choose to manually trust and so you may have issues with TLS on an Apple device for now.
 - Outbound UDP on port 53 is blocked. All DNS requests should be handled by the dnscrypt_proxy service and if any client, service, etc. tries to circumvent that it is blocked.
 - Unattended upgrades are set to automatically install operating system security updates.

@@ -464,9 +457,6 @@ Many features and refinements are in the works at various stages including:
 - Internal network scan tool and feedback
 - Anomaly detection in network traffic

-# Follow
-You can find recent bugfixes, functional additions, some extra documentation and more at the Cyber5K Patreon page: [https://www.patreon.com/cyber5k](https://www.patreon.com/cyber5k)
-
 # Contact

 Contact me at [steven@cyber5k.com](mailto:steven@cyber5k.com)
@@ -12,18 +12,9 @@ services:
    depends_on:
      - postgres
      - redis
-    ports:
-      - "10.2.3.1:5000:5000/tcp" # auth access
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.django-http.rule=Host(`home.mistborn`)"
-      - "traefik.http.routers.django-http.entrypoints=web"
-      - "traefik.http.routers.django-http.middlewares=mistborn_headers@file"
-      - "traefik.http.routers.django-https.rule=Host(`home.mistborn`)"
-      - "traefik.http.routers.django-https.entrypoints=websecure"
-      - "traefik.http.routers.django-https.middlewares=mistborn_headers@file"
-      - "traefik.http.routers.django-https.tls.certresolver=basic"
-      - "traefik.http.services.django-service.loadbalancer.server.port=5000"
+      - "traefik.port=5000"
    env_file:
      - ./.envs/.production/.django
      - ./.envs/.production/.postgres
@@ -47,41 +38,20 @@ services:
    restart: unless-stopped

  traefik:
-    #build:
-    #  context: .
-    #  dockerfile: ./compose/production/traefik/Dockerfile
-    #image: mistborn_production_traefik
-    image: traefik:v2.2
+    build:
+      context: .
+      dockerfile: ./compose/production/traefik/Dockerfile
+    image: mistborn_production_traefik
    container_name: mistborn_production_traefik
    depends_on:
      - django
    volumes:
-      #- production_traefik:/etc/traefik/acme
-      - ./compose/production/traefik/dynamic.toml:/dynamic.toml:ro
+      - production_traefik:/etc/traefik/acme
      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ../mistborn_volumes/base/tls:/tls:ro
-    network_mode: host
-      #ports:
-    #  - "0.0.0.0:80:80/tcp"
-    #  - "0.0.0.0:443:443/tcp"
-    #  #- "0.0.0.0:8080:8080/tcp" # dashboard
-    command:
-      ## API settings
-      #- --api.insecure=true
-      #- --api.dashboard=true
-      #- --api.debug=true
-      ## Logs
-      - --log.level=ERROR
-      ## Providers
-      - --providers.docker=true
-      - --providers.docker.exposedbydefault=false
-      - --providers.file.filename=/dynamic.toml
-      #- --providers.docker.network=default
-      ## Entrypoints
-      - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      ## Certificates
-      #- --serversTransport.insecureSkipVerify=true
+      - ../mistborn_volumes/base/tls:/tls
+    ports:
+      - "0.0.0.0:80:80/tcp"
+      - "0.0.0.0:443:443/tcp"
    restart: unless-stopped

  redis:
@@ -166,14 +136,6 @@ services:
     - "${MISTBORN_DNS_BIND_IP}:53:53/udp"
   labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.pihole-http.rule=Host(`pihole.mistborn`)"
-      - "traefik.http.routers.pihole-http.entrypoints=web"
-      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.pihole-https.rule=Host(`pihole.mistborn`)"
-      - "traefik.http.routers.pihole-https.entrypoints=websecure"
-      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.pihole-https.tls.certresolver=basic"
-      - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
   environment:
     - ServerIP=10.2.0.3
     - DNS1='10.2.0.2#5054' # docs say port 5054, was 54; use network_mode: host to see which port is used
@@ -1,5 +1,5 @@
-FROM traefik:v2.2
+FROM traefik:alpine
 RUN mkdir -p /etc/traefik/acme
 RUN touch /etc/traefik/acme/acme.json
 RUN chmod 600 /etc/traefik/acme/acme.json
-#COPY ./compose/production/traefik/dynamic.toml /etc/traefik
+COPY ./compose/production/traefik/traefik.toml /etc/traefik
@@ -1,31 +0,0 @@
-[tls.stores]
-  [tls.stores.default]
-    [tls.stores.default.defaultCertificate]
-      certFile = "/tls/cert.crt"
-      keyFile = "/tls/cert.key"
-
-[tls.options]
-  [tls.options.default]
-    minVersion = "VersionTLS12"
-
-[http.services]
-  [http.services.cockpit.loadBalancer]
-    [[http.services.cockpit.loadBalancer.servers]]
-      url = "http://10.2.3.1:9090"
-
-[http.routers]
-  [http.routers.cockpit]
-    rule = "Host(`cockpit.mistborn`)"
-    service = "cockpit"
-    entrypoints = ["web", "websecure"]
-    #middlewares =
-
-[http.middlewares]
-  [http.middlewares.mistborn_auth.forwardAuth]
-    address = "http://10.2.3.1:5000/auth/"
-    trustForwardHeader = true
-    [http.middlewares.mistborn_auth.forwardAuth.tls]
-      insecureSkipVerify = true
-  
-  [http.middlewares.mistborn_headers.headers]
-    hostsProxyHeaders = ['X-CSRFToken']
@@ -0,0 +1,257 @@
+#debug = true
+
+logLevel = "ERROR" #DEBUG, INFO, WARN, ERROR, FATAL, PANIC
+InsecureSkipVerify = true 
+
+defaultEntryPoints = ["http", "https"]
+#defaultEntryPoints = ["http"]
+
+# Entrypoints, http and https
+[entryPoints]
+  # http should be redirected to https
+  [entryPoints.http]
+  address = ":80"
+    #[entryPoints.http.redirect]
+    #entryPoint = "https"
+  # https is the default
+  [entryPoints.https]
+  address = ":443"
+    [entryPoints.https.tls]
+    [entryPoints.https.tls.defaultCertificate]
+      certFile = "/tls/cert.crt"
+      keyFile = "/tls/cert.key"
+
+## Enable ACME (Let's Encrypt): automatic SSL
+#[acme]
+## Email address used for registration
+#email = "steven@cyber5k.com"
+#storage = "/etc/traefik/acme/acme.json"
+#entryPoint = "https"
+#onDemand = false
+#OnHostRule = true
+#  # Use a HTTP-01 acme challenge rather than TLS-SNI-01 challenge
+#  [acme.httpChallenge]
+#  entryPoint = "http"
+
+[file]
+[backends]
+  [backends.django]
+    [backends.django.servers.server1]
+      url = "http://django:5000"
+  
+  [backends.pihole]
+    [backends.pihole.servers.server1]
+      url = "http://pihole:80"
+
+  [backends.homeassistant]
+    [backends.homeassistant.servers.server1]
+      url = "http://homeassistant:8123"
+
+  [backends.syncthing]
+    [backends.syncthing.servers.server1]
+      url = "http://syncthing:8384"
+
+  [backends.rocketchat]
+    [backends.rocketchat.servers.server1]
+      url = "http://rocketchat:3000"
+  
+  [backends.nextcloud]
+    [backends.nextcloud.servers.server1]
+      url = "http://nextcloud:80"
+  
+  [backends.onlyoffice]
+    [backends.onlyoffice.servers.server1]
+      url = "http://onlyoffice-community-server:80"
+  
+  [backends.bitwarden]
+    [backends.bitwarden.servers.server1]
+      url = "http://bitwarden:80"
+  
+  [backends.jellyfin]
+    [backends.jellyfin.servers.server1]
+      url = "http://jellyfin:8096"
+  
+  [backends.jitsi]
+    [backends.jitsi.servers.server1]
+      url = "http://jitsi-web:80"
+  
+  [backends.raspap]
+    [backends.raspap.servers.server1]
+      url = "http://raspap:80"
+  
+  [backends.cockpit]
+    [backends.cockpit.servers.server1]
+      url = "http://10.2.3.1:9090"
+  
+[frontends]
+  [frontends.django]
+    backend = "django"
+    passHostHeader = true
+    [frontends.django.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.django.routes.dr1]
+      #rule = "Host:mistborn.cyber5k.com"
+      rule = "Host:home.mistborn"
+  
+  [frontends.pihole]
+    backend = "pihole"
+    passHostHeader = true
+    [frontends.pihole.auth]
+      [frontends.pihole.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.pihole.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.pihole.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.pihole.routes.dr1]
+      rule = "Host:pihole.mistborn"
+  
+  [frontends.homeassistant]
+    backend = "homeassistant"
+    passHostHeader = true
+    [frontends.homeassistant.auth]
+      [frontends.homeassistant.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.homeassistant.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.homeassistant.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.homeassistant.routes.dr1]
+      rule = "Host:homeassistant.mistborn"
+
+  [frontends.syncthing]
+    backend = "syncthing"
+    passHostHeader = true
+    [frontends.syncthing.auth]
+      [frontends.syncthing.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.syncthing.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.syncthing.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.syncthing.routes.dr1]
+      rule = "Host:syncthing.mistborn"
+
+  [frontends.rocketchat]
+    backend = "rocketchat"
+    passHostHeader = true
+    [frontends.rocketchat.auth]
+      [frontends.rocketchat.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.rocketchat.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.rocketchat.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.rocketchat.routes.dr1]
+      rule = "Host:chat.mistborn"
+  
+  [frontends.nextcloud]
+    backend = "nextcloud"
+    passHostHeader = true
+    [frontends.nextcloud.auth]
+      [frontends.nextcloud.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.nextcloud.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.nextcloud.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.nextcloud.routes.dr1]
+      rule = "Host:nextcloud.mistborn"
+  
+  [frontends.onlyoffice]
+    backend = "onlyoffice"
+    passHostHeader = true
+    [frontends.onlyoffice.auth]
+      [frontends.onlyoffice.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.onlyoffice.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.onlyoffice.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.onlyoffice.routes.dr1]
+      rule = "Host:onlyoffice.mistborn"
+  
+  [frontends.bitwarden]
+    backend = "bitwarden"
+    passHostHeader = true
+    [frontends.bitwarden.auth]
+      [frontends.bitwarden.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.bitwarden.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.bitwarden.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.bitwarden.routes.dr1]
+      rule = "Host:bitwarden.mistborn"
+  
+  [frontends.jellyfin]
+    backend = "jellyfin"
+    passHostHeader = true
+    [frontends.jellyfin.auth]
+      [frontends.jellyfin.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.jellyfin.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.jellyfin.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.jellyfin.routes.dr1]
+      rule = "Host:jellyfin.mistborn"
+  
+  [frontends.jitsi]
+    backend = "jitsi"
+    passHostHeader = true
+    [frontends.jitsi.auth]
+      [frontends.jitsi.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.jitsi.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.jitsi.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.jitsi.routes.dr1]
+      rule = "Host:jitsi.mistborn"
+
+  [frontends.raspap]
+    backend = "raspap"
+    passHostHeader = true
+    [frontends.raspap.auth]
+      [frontends.raspap.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.raspap.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.raspap.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.raspap.routes.dr1]
+      rule = "Host:raspap.mistborn"
+  
+  [frontends.cockpit]
+    backend = "cockpit"
+    passHostHeader = true
+    [frontends.cockpit.auth]
+      [frontends.cockpit.auth.forward]
+        address = "https://home.mistborn/auth/"
+        trustForwardHeader = false
+        [frontends.cockpit.auth.forward.tls]
+          insecureSkipVerify = true
+    [frontends.cockpit.headers]
+      HostsProxyHeaders = ['X-CSRFToken']
+    [frontends.cockpit.routes.dr1]
+      rule = "Host:cockpit.mistborn"
+  
+## Connection to docker host system (docker.sock)
+#[docker]
+#endpoint = "unix:///var/run/docker.sock"
+#domain = "localhost"
+#watch = true
+## This will hide all docker containers that don't have explicitly  
+## set label to "enable"
+#exposedbydefault = false
@@ -10,14 +10,7 @@ services:
      - ../../mistborn_volumes/extra/bitwarden:/data
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.bitwarden-http.rule=Host(`bitwarden.mistborn`)"
-      - "traefik.http.routers.bitwarden-http.entrypoints=web"
-      - "traefik.http.routers.bitwarden-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.bitwarden-https.rule=Host(`bitwarden.mistborn`)"
-      - "traefik.http.routers.bitwarden-https.entrypoints=websecure"
-      - "traefik.http.routers.bitwarden-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.bitwarden-https.tls.certresolver=basic"
-      - "traefik.http.services.bitwarden-service.loadbalancer.server.port=80"
+      - "traefik.port=80"
    ports:
      - 3012:3012/tcp
    restart: unless-stopped
@@ -10,14 +10,7 @@ services:
      - TZ=America/New_York
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.homeassistant-http.rule=Host(`homeassistant.mistborn`)"
-      - "traefik.http.routers.homeassistant-http.entrypoints=web"
-      - "traefik.http.routers.homeassistant-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.homeassistant-https.rule=Host(`homeassistant.mistborn`)"
-      - "traefik.http.routers.homeassistant-https.entrypoints=websecure"
-      - "traefik.http.routers.homeassistant-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.homeassistant-https.tls.certresolver=basic"
-      - "traefik.http.services.homeassistant-service.loadbalancer.server.port=8123"
+      - "traefik.port=8123"
    restart: unless-stopped 

 networks:
@@ -14,14 +14,7 @@ services:
      - ../../mistborn_volumes/extra/nextcloud:/media:ro
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.jellyfin-http.rule=Host(`jellyfin.mistborn`)"
-      - "traefik.http.routers.jellyfin-http.entrypoints=web"
-      - "traefik.http.routers.jellyfin-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.jellyfin-https.rule=Host(`jellyfin.mistborn`)"
-      - "traefik.http.routers.jellyfin-https.entrypoints=websecure"
-      - "traefik.http.routers.jellyfin-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.jellyfin-https.tls.certresolver=basic"
-      - "traefik.http.services.jellyfin-service.loadbalancer.server.port=8096"
+      - "traefik.port=8096"
    restart: unless-stopped

 networks:
@@ -9,14 +9,7 @@ services:
            #- '${HTTPS_PORT}:443'
        labels:
            - "traefik.enable=true"
-            - "traefik.http.routers.jitsi-http.rule=Host(`jitsi.mistborn`)"
-            - "traefik.http.routers.jitsi-http.entrypoints=web"
-            - "traefik.http.routers.jitsi-http.middlewares=mistborn_auth@file"
-            - "traefik.http.routers.jitsi-https.rule=Host(`jitsi.mistborn`)"
-            - "traefik.http.routers.jitsi-https.entrypoints=websecure"
-            - "traefik.http.routers.jitsi-https.middlewares=mistborn_auth@file"
-            - "traefik.http.routers.jitsi-https.tls.certresolver=basic"
-            - "traefik.http.services.jitsi-service.loadbalancer.server.port=${HTTP_PORT}"
+            - "traefik.port=${HTTP_PORT}"
        volumes:
            - ${CONFIG}/web:/config
            - ${CONFIG}/web/letsencrypt:/etc/letsencrypt
@@ -9,14 +9,7 @@ services:
      - ../.envs/.production/.nextcloud
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.nextcloud-http.rule=Host(`nextcloud.mistborn`)"
-      - "traefik.http.routers.nextcloud-http.entrypoints=web"
-      - "traefik.http.routers.nextcloud-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.nextcloud-https.rule=Host(`nextcloud.mistborn`)"
-      - "traefik.http.routers.nextcloud-https.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.nextcloud-https.tls.certresolver=basic"
-      - "traefik.http.services.nextcloud-service.loadbalancer.server.port=80"
+      - "traefik.port=80"
    volumes:
      - ../../mistborn_volumes/extra/nextcloud:/var/www/html
    environment:
@@ -1,27 +1,102 @@
 version: '3'

 services:
-  onlyoffice:
-    container_name: mistborn_production_onlyoffice
+  onlyoffice-mysql-server:
+    container_name: mistborn_onlyoffice_mysql_server
+    image: mysql:5.7.21
+    environment:
+      - MYSQL_ROOT_PASSWORD=my-secret-pw
+    volumes:
+      - ../../mistborn_volumes/extra/onlyoffice/mysql-conf:/etc/mysql/conf.d
+      - ../../mistborn_volumes/extra/onlyoffice/mysql-entrypoint:/docker-entrypoint-initdb.d
+      - ../../mistborn_volumes/extra/onlyoffice/mysql-data:/var/lib/mysql
+    networks:
+      onlyoffice_net:
+        ipv4_address: 10.2.2.2
+    restart: unless-stopped
+
+  onlyoffice-document-server:
+    container_name: mistborn_onlyoffice_document_server
    image: onlyoffice/documentserver:latest
    volumes:
-      - ../../mistborn_volumes/extra/onlyoffice/logs:/var/log/onlyoffice
-      - ../../mistborn_volumes/extra/onlyoffice/cache:/var/lib/onlyoffice
+      - ../../mistborn_volumes/extra/onlyoffice/documentserver-data:/var/www/onlyoffice/Data
+      - ../../mistborn_volumes/extra/onlyoffice/documentserver-logs:/var/log/onlyoffice
    env_file:
      - ../.envs/.production/.onlyoffice
+    ports:
+      - "80:80/tcp"
+    networks:
+      onlyoffice_net:
+        ipv4_address: 10.2.2.3
+    restart: unless-stopped 
+
+  #onlyoffice-mail-server:
+  #  container_name: mistborn_onlyoffice_mail_server
+  #  privileged: true
+  #  image: onlyoffice/mailserver:latest
+  #  volumes:
+  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-data:/var/vmail
+  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-certs:/etc/pki/tls/mailserver
+  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-logs:/var/log
+  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-mysql:/var/lib/mysql
+  #  hostname: mistborn
+  #  networks:
+  #    onlyoffice_net:
+  #      ipv4_address: 10.2.2.4
+  #  ports:
+  #    - "25:25/tcp"
+  #    - "143:143/tcp"
+  #    - "587:587/tcp"
+  #  restart: unless-stopped 
+
+  onlyoffice-community-server:
+    container_name: mistborn_onlyoffice_community_server
+    image: onlyoffice/communityserver:latest
+    environment:
+      - DOCUMENT_SERVER_PORT_80_TCP_ADDR=mistborn_onlyoffice_document_server
+  #    - MAIL_SERVER_DB_HOST=mistborn_onlyoffice_mail_server
+      - ONLYOFFICE_CORE_MACHINEKEY=core_secret
+      - MYSQL_SERVER_ROOT_PASSWORD=my-secret-pw
+      - MYSQL_SERVER_DB_NAME=onlyoffice 
+      - MYSQL_SERVER_HOST=mistborn_onlyoffice_mysql_server 
+      - MYSQL_SERVER_USER=onlyoffice_user
+      - MYSQL_SERVER_PASS=onlyoffice_pass 
+  #    - MAIL_SERVER_API_PORT=8081
+  #    - MAIL_SERVER_API_HOST=onlyoffice-mail-server
+  #    - MAIL_SERVER_DB_HOST=onlyoffice-mysql-server
+  #    - MAIL_SERVER_DB_PORT=3306
+  #    - MAIL_SERVER_DB_NAME=onlyoffice_mailserver
+  #    - MAIL_SERVER_DB_USER=onlyoffice_mailserver_user
+  #    - MAIL_SERVER_DB_PASS=onlyoffice_mailserver_user_pass
+    depends_on:
+      - onlyoffice-mysql-server
+      - onlyoffice-document-server 
+  #    - onlyoffice-mail-server 
+    volumes:
+      - ../../mistborn_volumes/extra/onlyoffice/communityserver-data:/var/www/onlyoffice/Data
+      - ../../mistborn_volumes/extra/onlyoffice/communityserver-mysql:/var/lib/mysql
+      - ../../mistborn_volumes/extra/onlyoffice/communityserver-logs:/var/log/onlyoffice
+      - ../../mistborn_volumes/extra/onlyoffice/documentserver-data:/var/www/onlyoffice/DocumentServerData
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.onlyoffice-http.rule=Host(`onlyoffice.mistborn`)"
-      - "traefik.http.routers.onlyoffice-http.entrypoints=web"
-      - "traefik.http.routers.onlyoffice-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.onlyoffice-https.rule=Host(`onlyoffice.mistborn`)"
-      - "traefik.http.routers.onlyoffice-https.entrypoints=websecure"
-      - "traefik.http.routers.onlyoffice-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.onlyoffice-https.tls.certresolver=basic"
-      - "traefik.http.services.onlyoffice-service.loadbalancer.server.port=80"
+      - "traefik.port=80"
+    networks:
+      default:
+      onlyoffice_net:
+        ipv4_address: 10.2.2.5
+    ports:
+      #- "10.2.2.5:80:80/tcp"
+      - "5222:5222/tcp"
    restart: unless-stopped 

+
 networks:
  default:
    external:
      name: mistborn_default
+
+  onlyoffice_net:
+    driver: overlay
+    ipam:
+      config:
+        - subnet: 10.2.2.0/24
@@ -10,14 +10,7 @@ services:
    container_name: mistborn_production_raspap
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.raspap-http.rule=Host(`raspap.mistborn`)"
-      - "traefik.http.routers.raspap-http.entrypoints=web"
-      - "traefik.http.routers.raspap-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.raspap-https.rule=Host(`raspap.mistborn`)"
-      - "traefik.http.routers.raspap-https.entrypoints=websecure"
-      - "traefik.http.routers.raspap-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.raspap-https.tls.certresolver=basic"
-      - "traefik.http.services.raspap-service.loadbalancer.server.port=80"
+      - "traefik.port=80"
    env_file:
      - ../.envs/.production/.pihole
    command: /start
@@ -17,14 +17,7 @@ services:
      - Accounts_UseDNSDomainCheck=False
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.chat-http.rule=Host(`chat.mistborn`)"
-      - "traefik.http.routers.chat-http.entrypoints=web"
-      - "traefik.http.routers.chat-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.chat-https.rule=Host(`chat.mistborn`)"
-      - "traefik.http.routers.chat-https.entrypoints=websecure"
-      - "traefik.http.routers.chat-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.chat-https.tls.certresolver=basic"
-      - "traefik.http.services.chat-service.loadbalancer.server.port=3000"
+      - "traefik.port=3000"
    depends_on:
      - mongo
    #ports:
@@ -19,14 +19,7 @@ services:
      - 21027:21027/udp # protocol discovery
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.mistborn`)"
-      - "traefik.http.routers.syncthing-http.entrypoints=web"
-      - "traefik.http.routers.syncthing-http.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.mistborn`)"
-      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
-      - "traefik.http.routers.syncthing-https.middlewares=mistborn_auth@file"
-      - "traefik.http.routers.syncthing-https.tls.certresolver=basic"
-      - "traefik.http.services.syncthing-service.loadbalancer.server.port=8384"
+      - "traefik.port=8384"
    restart: unless-stopped

 networks:
@@ -1,23 +0,0 @@
-version: '3'
-
-services:
-  wifi:
-    #user: root
-    image: "cyber5k/wifi:${MISTBORN_TAG}"
-    container_name: mistborn_production_wifi
-    #labels:
-    #  - "traefik.enable=true"
-    #  - "traefik.port=80"
-    #env_file:
-    #  - ../.envs/.production/.pihole
-    #command: /start
-    volumes:
-      - ../../mistborn_volumes/extra/wifi/hostapd.conf:/etc/hostapd/hostapd.conf
-      - ../../mistborn_volumes/extra/wifi/dnsmasq.conf:/etc/dnsmasq.conf
-    #  - ../../mistborn_volumes/extra/wifi/wificfg.json:/cfg/wificfg.json
-    network_mode: bridge #host
-    cap_add:
-      - NET_ADMIN
-      - NET_RAW
-    #privileged: true
-
@@ -1,18 +0,0 @@
-{
-    "wifi_iface": "wlan0",
-    "dnsmasq_cfg": {
-	"address": "/#/192.168.27.1",
-	"dhcp_range": "192.168.27.100,192.168.27.150,1h",
-    "dhcp_option": "6,10.2.3.1",
-	"vendor_class": "set:device,IoT"
-    },
-    "host_apd_cfg": {
-	"ip": "192.168.27.1",
-	"ssid": "mistborn",
-	"wpa_passphrase":"iotwifipass",
-	"channel": "6"
-    },
-    "wpa_supplicant_cfg": {
-	"cfg_file": "/etc/wpa_supplicant/wpa_supplicant.conf"
-    }
-}
@@ -1,7 +1,5 @@
 #!/bin/bash

-#### ENV file
-
 VAR_FILE=/opt/mistborn/.env

 source /opt/mistborn/scripts/subinstallers/platform.sh
@@ -21,14 +19,3 @@ if [ "$GIT_BRANCH" != "master" ]; then
 fi

 echo "MISTBORN_TAG=$MISTBORN_TAG" | sudo tee -a ${VAR_FILE}
-
-#### install and base services
-iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
-
-# default interface
-sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
-sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
-#sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
-sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
-
-sudo systemctl daemon-reload
@@ -69,9 +69,9 @@ fi

 # Install Cockpit?
 if [ -z "${MISTBORN_INSTALL_COCKPIT}" ]; then
-    read -p "Install Cockpit (a somewhat resource-heavy system management graphical user interface -- NOT RECOMMENDED on Raspberry Pi)? [y/N]: " MISTBORN_INSTALL_COCKPIT
+    read -p "Install Cockpit (a somewhat resource-heavy system management graphical user interface)? [Y/n]: " MISTBORN_INSTALL_COCKPIT
    echo
-    MISTBORN_INSTALL_COCKPIT=${MISTBORN_INSTALL_COCKPIT:-N}
+    MISTBORN_INSTALL_COCKPIT=${MISTBORN_INSTALL_COCKPIT:-Y}
 fi

 # SSH keys
@@ -117,10 +117,10 @@ fi

 # SSH Server
 sudo -E apt-get install -y openssh-server
-#sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
-#sudo sed -i 's/PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
-#sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
-#sudo sed -i 's/PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
+sudo sed -i 's/PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
+sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sudo sed -i 's/PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
 sudo sed -i 's/#Port.*/Port 22/' /etc/ssh/sshd_config
 sudo sed -i 's/Port.*/Port 22/' /etc/ssh/sshd_config
 sudo systemctl enable ssh
@@ -132,11 +132,8 @@ sudo -E apt-get install -y dnsutils fail2ban
 # Install kernel headers
 if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
    sudo -E apt install -y linux-headers-$(uname -r)
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    sudo -E apt install -y raspberrypi-kernel-headers
-else
-    echo "Unsupported OS: $DISTRO"
-    exit 1
 fi

 # Wireugard
@@ -166,6 +163,8 @@ sudo pip3 install -e ./modules/mistborn-cli

 # Mistborn
 # final setup vars
+iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
+figlet "Mistborn default NIC: $iface"

 #IPV4_PUBLIC=$(ip -o -4 route show default | egrep -o 'dev [^ ]*' | awk '{print $2}' | xargs ip -4 addr show | grep 'inet ' | awk '{print $2}' | grep -o "^[0-9.]*"  | tr -cd '\11\12\15\40-\176' | head -1) # tail -1 to get last
 IPV4_PUBLIC="10.2.3.1"
@@ -186,13 +185,18 @@ sudo systemctl restart unattended-upgrades

 # setup Mistborn services

+# install and start base services
+# default interface
+sudo cp ./scripts/services/Mistborn* /etc/systemd/system/
+sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
+#sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
+sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
+
 #if [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ]; then
 #    # remove systemd-resolved lines
 #    sudo sed -i '/.*systemd-resolved/d' /etc/systemd/system/Mistborn-base.service
 #fi

-sudo cp ./scripts/services/Mistborn-setup.service /etc/systemd/system/
-
 # setup local volumes for pihole
 sudo mkdir -p ../mistborn_volumes/
 sudo chown -R root:root ../mistborn_volumes/
@@ -201,12 +205,12 @@ sudo mkdir -p ../mistborn_volumes/base/pihole/etc-dnsmasqd
 sudo mkdir -p ../mistborn_volumes/extra

 # Traefik final setup (cockpit)
-#cp ./compose/production/traefik/traefikv2.toml.template ./compose/production/traefik/traefik.toml
+cp ./compose/production/traefik/traefik.toml.template ./compose/production/traefik/traefik.toml

 # setup tls certs 
 source ./scripts/subinstallers/openssl.sh
-#sudo rm -rf ../mistborn_volumes/base/tls
-#sudo mv ./tls ../mistborn_volumes/base/
+sudo rm -rf ../mistborn_volumes/base/tls
+sudo mv ./tls ../mistborn_volumes/base/

 # enable and run setup to generate .env
 sudo systemctl enable Mistborn-setup.service
@@ -1,9 +0,0 @@
-#!/bin/bash 
-
-set -e
-
-export DEBIAN_FRONTEND=noninteractive
-
-sudo systemctl stop Mistborn-base
-sudo systemctl restart Mistborn-setup
-sudo systemctl restart Mistborn-base
@@ -10,12 +10,21 @@ Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
+#ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 25 -j MISTBORN_LOG_DROP
+#ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 143 -j MISTBORN_LOG_DROP
+#ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 587 -j MISTBORN_LOG_DROP
+ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 5222 -j MISTBORN_LOG_DROP

 # Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml up
 # Stop container when unit is stopped
 ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
 # Post stop
+#ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 25 -j MISTBORN_LOG_DROP
+#ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 143 -j MISTBORN_LOG_DROP
+#ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 587 -j MISTBORN_LOG_DROP
+ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 5222 -j MISTBORN_LOG_DROP

 [Install]
 WantedBy=multi-user.target
@@ -4,7 +4,6 @@ Before=Mistborn-base.service

 [Service]
 Type=oneshot
-User=mistborn
 ExecStart=/opt/mistborn/scripts/env/setup.sh

 [Install]
@@ -1,28 +0,0 @@
-[Unit]
-Description=Mistborn Wifi Service 
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-
-[Service]
-Restart=always
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-EnvironmentFile=/opt/mistborn/.env
-
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml down
-ExecStartPre=/opt/mistborn/scripts/services/wifi/init.sh
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml build
-# Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml up
-
-ExecStartPost=/opt/mistborn/scripts/services/wifi/start.sh
-
-# Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/wifi.yml down
-# Post stop
-ExecStopPost=/opt/mistborn/scripts/services/wifi/stop.sh
-
-[Install]
-WantedBy=multi-user.target
@@ -1,75 +0,0 @@
-#!/bin/bash
-
-# Colors
-MAGENTA='\e[0;35m'
-RED='\e[0;31m'
-GREEN='\e[0;32m'
-BLUE='\e[0;34m'
-NC='\e[0m'
-
-# Check that the interface exists and its not in use. Returns iface phy
-iface_check (){
-    IFACE="$1"
-    
-    # Check that the requested iface is available
-    if ! [ -e /sys/class/net/"$IFACE" ]
-    then
-        echo -e "${RED}[ERROR]${NC} The interface provided does not exist. Exiting..."
-        exit 1
-    fi
-   
-    # Check that the given interface is not used by the host as the default route
-    if [[ $(ip r | grep default | cut -d " " -f5) == "$IFACE" ]]
-    then
-        echo -e "${BLUE}[INFO]${NC} The selected interface is configured as the default route, if you use it you will lose internet connectivity"
-        exit 1;
-	fi
-
-    # Find the physical interface for the given wireless interface
-    PHY=$(cat /sys/class/net/"$IFACE"/phy80211/name)
-    echo $PHY
-}
-
-hostapd_setup() {
-    ### Check if hostapd is running in the host
-    hostapd_pid=$(pgrep hostapd)
-    if [ ! "$hostapd_pid" == "" ] 
-    then
-       echo -e "${BLUE}[INFO]${NC} hostapd service is already running in the system, make sure you use a different wireless interface..."
-       #kill -9 "$hostapd_pid"
-    fi
-
-    # Unblock wifi and bring the wireless interface up
-    echo -e "${BLUE}[INFO]${NC} Unblocking wifi and setting ${IFACE} up"
-    rfkill unblock wifi
-    ip link set "$IFACE" up
-
-    # Check if a wlan config file exists, else take wlan parameters by default
-    if [ -e "$PATHSCRIPT"/"$CONF_FILE" ]
-    then
-        echo -e "${BLUE}[INFO]${NC} Found WLAN config file"
-	    # Parse the wlan config file
-		IFS="="
-		while read -r name value
-		do
-                    case $name in
-                        ''|\#* ) continue;; # Skip blank lines and lines starting with #
-                        "SSID" )
-                            SSID=${value//\"/}
-                            echo -e "${BLUE}"[INFO]"${NC}" SSID: "${MAGENTA}""$SSID""${NC}";;
-                        "PASSPHRASE" )
-                            PASSPHRASE=${value//\"/};;
-                        "HW_MODE" )
-                            HW_MODE=${value//\"/};;
-                        "CHANNEL" )
-                            CHANNEL=${value//\"/};;
-                        * )
-                            echo Parameter "$name" in "$PATHSCRIPT"/"$CONF_FILE" not recognized
-		    esac
-		done < "$PATHSCRIPT"/"$CONF_FILE"
-    else
-        echo -e "${BLUE}[INFO]${NC} WLAN config file not found. Setting default WLAN parameters"
-        echo -e "${BLUE}"[INFO]"${NC}" SSID: "${MAGENTA}""$SSID""${NC}"
-    fi
-
-}
@@ -10,8 +10,11 @@ elif [ "$DISTRO" == "debian" ]; then
    && echo "buster-backports already in sources" \
    || echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee -a /etc/apt/sources.list.d/backports.list
    
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+
+elif [ "$DISTRO" == "raspbian" ]; then
+    
    echo "Raspbian repos contain cockpit"
+
 fi
    
 sudo -E apt-get install -y cockpit
@@ -16,5 +16,5 @@ fi

 # set docker-compose path used in Mistborn
 if [ ! -f /usr/local/bin/docker-compose ]; then
-    sudo -E ln -s $(which docker-compose) /usr/local/bin/docker-compose
+    sudo ln -s $(which docker-compose) /usr/local/bin/docker-compose
 fi
@@ -15,7 +15,7 @@ if [ "$DISTRO" == "ubuntu" ]; then
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
 elif [ "$DISTRO" == "debian" ]; then
    curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg | sudo apt-key add -
 fi

@@ -31,7 +31,7 @@ elif [ "$DISTRO" == "debian" ]; then
   "deb https://download.docker.com/linux/debian \
   $(lsb_release -cs) \
   stable"
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    echo "deb [arch=armhf] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") \
     $(lsb_release -cs) stable" | \
    sudo tee /etc/apt/sources.list.d/docker.list
@@ -43,7 +43,7 @@ sudo apt-get update

 if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
    sudo -E apt-get install -y docker-ce docker-ce-cli containerd.io
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    sudo -E apt install -y --no-install-recommends \
    docker-ce \
    cgroupfs-mount
@@ -59,7 +59,7 @@ echo "Installing Docker Compose"
 #    sudo chmod +x /usr/local/bin/docker-compose
 #elif [ "$DISTRO" == "raspbian" ]; then
 # Install required packages
-#sudo -E apt install -y python-backports.ssl-match-hostname
+sudo -E apt install -y python-backports.ssl-match-hostname

 # Install Docker Compose from pip
 # This might take a while
@@ -1,6 +1,6 @@
 #!/bin/bash

-KEY_FOLDER="/opt/mistborn_volumes/base/tls/"
+KEY_FOLDER="./tls/"
 CRT_FILE="cert.crt"
 KEY_FILE="cert.key"

@@ -11,15 +11,11 @@ KEY_PATH="$KEY_FOLDER/$KEY_FILE"
 sudo -E apt-get install -y openssl

 # make folder
-sudo -E mkdir -p $KEY_FOLDER
-
-# clean old crt and key
-sudo -E rm -f ${KEY_FOLDER}/*
+mkdir -p $KEY_FOLDER

 # generate crt and key
-sudo -E openssl req -x509 -sha256 -nodes -days 397 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -addext "subjectAltName = DNS:*.mistborn" -addext extendedKeyUsage=serverAuth -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"
+openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"

 # set permissions
-sudo -E chown -R mistborn:mistborn ${KEY_FOLDER}
 chmod 644 $CRT_PATH
 chmod 600 $KEY_PATH
@@ -1,3 +0,0 @@
-#!/bin/bash
-
-sudo apt-get install -y bridge-utils iw rfkill
@@ -9,19 +9,18 @@ if ! $(sudo apt-cache show wireguard > /dev/null 2>&1) ; then
    echo "Adding Wireguard PPAs"

    # Wireguard
-    if [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+    if [ "$DISTRO" == "raspbian" ]; then
        echo "Adding Wireguard repo keys"
        sudo -E apt-get install -y dirmngr
        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8B48AD6246925553
        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7638D0442B90D010
        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC
-        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 648ACFD622F3D138 
    fi

    if [ "$DISTRO" == "ubuntu" ]; then
        # Ubuntu	
        sudo add-apt-repository -y ppa:wireguard/wireguard
-    elif [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+    elif [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ]; then
        # Debian
        sudo bash -c 'echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list'
        sudo bash -c "printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable"
@@ -10,14 +10,19 @@ sudo git -C /opt/mistborn submodule update --init --recursive
 # ensure mistborn-cli is installed
 sudo pip3 install -e /opt/mistborn/modules/mistborn-cli

+# handle updates to Mistborn systemd scripts
+iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
+sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
+sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=mistborn/"
+sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
+
 # handle updates to traefik
-#sudo cp /opt/mistborn/compose/production/traefik/traefik.toml.template /opt/mistborn/compose/production/traefik/traefik.toml
+sudo cp /opt/mistborn/compose/production/traefik/traefik.toml.template /opt/mistborn/compose/production/traefik/traefik.toml
+
+sudo systemctl daemon-reload
+sudo systemctl enable Mistborn-setup.service
+sudo systemctl restart Mistborn-setup.service

 sudo mistborn-cli pullbuild

-sudo docker container prune -f
-sudo docker image prune -f
-
-sudo systemctl stop Mistborn-base
-sudo systemctl restart Mistborn-setup
 sudo systemctl restart Mistborn-base
Author	SHA1	Message	Date
Steven Foerster	d2c0c22e6f	Merge branch 'master' into onlyoffice	2020-07-30 11:51:01 -04:00
Steven Foerster	61b0b43143	Merge branch 'master' into onlyoffice	2020-04-29 17:18:03 -04:00
Steven Foerster	c069380c08	overlay network	2020-04-16 08:42:28 -04:00
Steven Foerster	b5b0098839	ports open on host network	2020-04-15 17:39:40 -04:00
Steven Foerster	f795c1adba	host network	2020-04-15 17:36:05 -04:00
Steven Foerster	65ba62be28	onlyoffice ip address	2020-04-15 17:06:11 -04:00
Steven Foerster	20f9a8cc47	Merge branch 'master' into onlyoffice	2020-04-15 15:41:56 -04:00
Steven Foerster	2deb58b4f5	Merge branch 'master' into onlyoffice	2020-03-19 09:36:58 -04:00
Steven Foerster	3466d8e874	fixed network address space	2020-03-11 19:02:07 -04:00
Steven Foerster	2d6a33610b	tweaks	2020-03-11 17:11:07 -04:00
Steven Foerster	30a225cdc0	depends on	2020-03-11 16:35:57 -04:00
Steven Foerster	2bd302f051	depends on	2020-03-11 13:36:59 -04:00
Steven Foerster	ec2a978351	default network	2020-03-11 13:34:42 -04:00
Steven Foerster	2ef003bac9	mysql server	2020-03-11 13:33:34 -04:00
Steven Foerster	6eeb624829	latest community server image	2020-03-11 12:50:08 -04:00
Steven Foerster	54150a64d1	onlyoffice mail server and community server	2020-03-11 12:36:06 -04:00