Compare commits
16
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Steven Foerster
|
d2c0c22e6f | ||
|
Steven Foerster
|
61b0b43143 | ||
|
Steven Foerster
|
c069380c08 | ||
|
Steven Foerster
|
b5b0098839 | ||
|
Steven Foerster
|
f795c1adba | ||
|
Steven Foerster
|
65ba62be28 | ||
|
Steven Foerster
|
20f9a8cc47 | ||
|
Steven Foerster
|
2deb58b4f5 | ||
|
Steven Foerster
|
3466d8e874 | ||
|
Steven Foerster
|
2d6a33610b | ||
|
Steven Foerster
|
30a225cdc0 | ||
|
Steven Foerster
|
2bd302f051 | ||
|
Steven Foerster
|
ec2a978351 | ||
|
Steven Foerster
|
2ef003bac9 | ||
|
Steven Foerster
|
6eeb624829 | ||
|
Steven Foerster
|
54150a64d1 |
@@ -19,5 +19,6 @@ docker_build:
|
||||
script:
|
||||
- apk add docker-compose
|
||||
- scripts/subinstallers/gen_prod_env.sh "$MISTBORN_DEFAULT_PASSWORD"
|
||||
- cp compose/production/traefik/traefik.toml.template compose/production/traefik/traefik.toml
|
||||
- docker-compose -f base.yml build
|
||||
|
||||
|
||||
@@ -42,20 +42,13 @@ Within Mistborn is a panel to enable and manage these free extra services (off b
|
||||
- [Jellyfin](https://jellyfin.org): The Free Media Software System.
|
||||
- [Tor](https://www.torproject.org): The Onion Router. One tool in the arsenal of online security and privacy.
|
||||
- [Jitsi](https://jitsi.org): Multi-platform open-source video conferencing
|
||||
- [Mattermost](https://mattermost.com/): A flexible, open source messaging platform that enables secure team collaboration
|
||||
|
||||
|
||||
# Quickstart
|
||||
Tested Operating Systems (in order of thoroughness):
|
||||
- Ubuntu 20.04 LTS
|
||||
- Ubuntu 18.04 LTS
|
||||
- Debian 10 (Buster)
|
||||
- Raspberry Pi OS (formerly Raspbian) Buster
|
||||
|
||||
**Note:** Install operating system updates and restart. Raspberry Pi OS particularly needs to be restarted after kernel updates (kernel modules for the currently running kernel may be missing).
|
||||
|
||||
Tested Browsers:
|
||||
- Firefox
|
||||
- Raspbian Buster
|
||||
|
||||
The default tests are run on DigitalOcean Droplets: 2GB RAM, 1 CPU, 50GB hard disk.
|
||||
|
||||
@@ -63,22 +56,22 @@ The Mistborn docker images exist for these architectures:
|
||||
|
||||
| Mistborn Docker Images (hub.docker.com) | Architectures |
|
||||
|------------------------------------------------|---------------------|
|
||||
| mistborn (django, celery{worker,beat}, flower) | amd64, arm64, arm/v7 |
|
||||
| dnscrypt-proxy | amd64, arm64, arm/v7 |
|
||||
| mistborn (django, celery{worker,beat}, flower) | amd64, arm64, armv7 |
|
||||
| dnscrypt-proxy | amd64, arm64, armv7 |
|
||||
|
||||
Recommended System Specifications:
|
||||
|
||||
| Use Case | Description | RAM | Hard Disk |
|
||||
|------------------------|-------------------------------------------------------------------------------|-------|-----------|
|
||||
| Bare bones | Wireguard, Pihole (no Cockpit, no extra services) | 2 GB | 15 GB |
|
||||
| Default | Bare bones + Cockpit | 2 GB+ | 15 GB |
|
||||
| Low-resource services | Default + Bitwarden, Tor, Syncthing | 4 GB | 20 GB |
|
||||
| High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 6 GB+ | 25 GB+ |
|
||||
| Bare bones | Wireguard, Pihole (no Cockpit, no extra services) | 1 GB | 15 GB |
|
||||
| Default | Bare bones + Cockpit | 2 GB | 15 GB |
|
||||
| Low-resource services | Default + Bitwarden, Tor, Syncthing | 3 GB | 20 GB |
|
||||
| High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 4 GB+ | 25 GB+ |
|
||||
|
||||
Starting from base installation
|
||||
```
|
||||
git clone https://gitlab.com/cyber5k/mistborn.git
|
||||
sudo -E bash ./mistborn/scripts/install.sh
|
||||
sudo bash ./mistborn/scripts/install.sh
|
||||
```
|
||||
|
||||
Get default admin Wireguard profile
|
||||
@@ -113,19 +106,19 @@ We were getting frustrated at being forced to choose between being connected to
|
||||
|
||||
*Netflix blocking my connections that it sees coming from a DigitalOcean droplet*
|
||||
|
||||
In Mistborn, Gateways are upstream from the VPN server so connections to third-party services (e.g. Netflix, Hulu, etc.) will appear to be coming from the public IP address of the Gateway. I setup a Gateway at home (Raspberry Pi with `wireguard` and `openresolv` installed) and with our Mistborn on DigitalOcean, all Wireguard profiles created with this Gateway will appear to be coming from my house and are not blocked. No port-forwarding required (assuming Mistborn is publicly accessible).
|
||||
In Mistborn, Gateways are upstream from the VPN server so connections to third-party services (e.g. Netflix, Hulu, etc.) will appear to be coming from the public IP address of the Gateway. I setup a Gateway at home (Mistborn on DigitalOcean) then all Wireguard profiles created with this Gateway will appear to be coming from my house and are not blocked. No port-forwarding required (assuming Mistborn is publicly accessible).
|
||||
|
||||
|
||||
|
||||
The Gateway adds an extra network hop. DNS is still resolved in Mistborn so pihole is still blocking ads.
|
||||
|
||||
# Installation
|
||||
Mistborn is regularly tested on Ubuntu 20.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested). Make sure to install OS updates and restart before installing Mistborn (Wireguard installs differently on recent kernels).
|
||||
Mistborn is regularly tested on Ubuntu 18.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested). Additionally tested on Ubuntu 20.04 LTS.
|
||||
|
||||
Clone the git repository and run the install script:
|
||||
```
|
||||
git clone https://gitlab.com/cyber5k/mistborn.git
|
||||
sudo -E bash ./mistborn/scripts/install.sh
|
||||
sudo bash ./mistborn/scripts/install.sh
|
||||
```
|
||||
|
||||
Running `install.sh` will do the following:
|
||||
@@ -136,8 +129,8 @@ Running `install.sh` will do the following:
|
||||
- install Docker
|
||||
- install OpenSSH
|
||||
- install Wireguard
|
||||
- install Cockpit (optional)
|
||||
- create a `cockpit` system user (if Cockpit is installed)
|
||||
- install Cockpit
|
||||
- create a `cockpit` system user
|
||||
- configure unattended-upgrades
|
||||
- generate a self-signed TLS certificate/key (WebRTC functionality requires TLS)
|
||||
- create and populate traefik.toml
|
||||
@@ -159,7 +152,7 @@ See the environment variables needed in `./scripts/noninteractive/.install_bareb
|
||||
This will perform a noninteractive install with the default environment variables set in `.install_barebones`.
|
||||
```
|
||||
git clone https://gitlab.com/cyber5k/mistborn.git
|
||||
sudo -E bash -c "source ./mistborn/scripts/noninteractive/.install_barebones && ./mistborn/scripts/install.sh"
|
||||
sudo bash -c "source ./mistborn/scripts/noninteractive/.install_barebones && ./mistborn/scripts/install.sh"
|
||||
```
|
||||
|
||||
# Post-Installation
|
||||
@@ -262,7 +255,6 @@ Mistborn uses the following domains (that can be reached by all Wireguard client
|
||||
| Syncthing | syncthing.mistborn | Off |
|
||||
| OnlyOffice | onlyoffice.mistborn | Off |
|
||||
| Jitsi | jitsi.mistborn | Off |
|
||||
| Mattermost | mattermost.mistborn | Off |
|
||||
|
||||
# Default Credentials
|
||||
These are the default credentials to use in the services you choose to use:
|
||||
@@ -273,8 +265,6 @@ These are the default credentials to use in the services you choose to use:
|
||||
| Cockpit | cockpit | {{default mistborn password}} |
|
||||
| Nextcloud | mistborn | {{default mistborn password}} |
|
||||
|
||||
You can find the credentials sent to the Docker containers in: `/opt/mistborn/.envs/.production/`
|
||||
|
||||
# Gateway Setup
|
||||
Mistborn will generate the Wireguard configuration script for the Gateway. From a base Ubuntu/Debian/Raspbian operating system the following packages are recommended to be installed beforehand:
|
||||
|
||||
@@ -320,10 +310,9 @@ But wait, there's more! You can:
|
||||
| Jellyfin | [Jellyfin](https://play.google.com/store/apps/details?id=org.jellyfin.mobile) | [Jellyfin](https://apps.apple.com/us/app/jellyfin-mobile/id1480192618) |
|
||||
| Home Assistant | [Home Assistant](https://play.google.com/store/apps/details?id=io.homeassistant.companion.android) | |
|
||||
| Rocket.Chat | [Rocket.Chat](https://play.google.com/store/apps/details?id=chat.rocket.android) | [Rocket.Chat](https://apps.apple.com/us/app/rocket-chat/id1148741252) |
|
||||
| Mattermost | [Mattermost](https://play.google.com/store/apps/details?id=com.mattermost.rn) | [Mattermost](https://apps.apple.com/us/app/mattermost/id1257222717) |
|
||||
|
||||
## TLS Certificate
|
||||
Some apps require TLS (HTTPS). All traffic to Mistborn domains already occurs over Wireguard but to keep apps running, a TLS certificate exists for Mistborn and can be imported into your device's trusted credentials in the security settings. This certificate is checked every day and will be re-generated when expiration is less than 30 days away.
|
||||
Some apps require TLS (HTTPS). All traffic to Mistborn domains already occurs over Wireguard but to keep apps running, a TLS certificate exists for Mistborn and can be imported into your device's trusted credentials in the security settings.
|
||||
|
||||
The TLS certificate can be found here:
|
||||
```
|
||||
@@ -359,41 +348,10 @@ You can SSH using the Mistborn domain when connected by Wireguard:
|
||||
ssh user@home.mistborn
|
||||
```
|
||||
|
||||
## How do I change the upstream DNSCrypt servers?
|
||||
The upstream servers used by dnscrypt-proxy are set in:
|
||||
|
||||
`base.yml`:
|
||||
```
|
||||
services:
|
||||
...
|
||||
dnscrypt-proxy:
|
||||
...
|
||||
environment:
|
||||
...
|
||||
- DNSCRYPT_SERVER_NAMES=[...]
|
||||
```
|
||||
|
||||
The available options are here: https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-resolvers.md
|
||||
|
||||
# Troubleshooting
|
||||
|
||||
Once you're connected to Wireguard you should see .mistborn domains and the internet should work as expected. Be sure to use http (http://home.mistborn). Wireguard is the encrypted channel so there's usually no need to bother with TLS certs (WebRTC functionality and some mobile apps require TLS so it is available). Here are some things to check if you have issues:
|
||||
|
||||
Check if you can ping an external IP address:
|
||||
```
|
||||
ping 1.1.1.1
|
||||
```
|
||||
|
||||
Check if you can resolve local DNS queries:
|
||||
```
|
||||
dig home.mistborn
|
||||
```
|
||||
|
||||
Check if you can resolve external DNS queries:
|
||||
```
|
||||
dig cyber5k.com
|
||||
```
|
||||
|
||||
See if any docker containers are stopped:
|
||||
```
|
||||
sudo docker container ls -a
|
||||
@@ -420,9 +378,6 @@ The `dev/` folder contains a script for completing a hard reset: destroying and
|
||||
sudo ./dev/rebuild.sh
|
||||
```
|
||||
|
||||
## Troubleshooting Wireguard
|
||||
Ensure that your public IP address in your client profile (e.g. `Endpoint = <Mistborn public IP address>:<random port>`) is actually publicly available (not in 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) if you are attempting to access Mistborn across the internet.
|
||||
|
||||
## Troubleshooting Extra Services
|
||||
Each extra service has its own systemd process which can be monitored:
|
||||
```
|
||||
@@ -486,7 +441,7 @@ These are some notes regarding the technical design and implementations of Mistb
|
||||
## Additonal Notes
|
||||
- Interface names are not hardcoded anywhere in Mistborn. Two commands that are used in different circumstances to determine the default network interface and the interface that would route a public IP address are: `ip -o -4 route show to default` and `ip -o -4 route get 1.1.1.1`.
|
||||
- The "Update" button will pull updated Docker images for mistborn, postgresql, redis, pihole, and dnscrypt. Those services will then be restarted.
|
||||
- The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 397 days. The certificate is checked daily and will regenerate when expiration is within 30 days.
|
||||
- The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 10 years. The nanny at Apple has decided to restrict the kinds of certificates iOS users may choose to manually trust and so you may have issues with TLS on an Apple device for now.
|
||||
- Outbound UDP on port 53 is blocked. All DNS requests should be handled by the dnscrypt_proxy service and if any client, service, etc. tries to circumvent that it is blocked.
|
||||
- Unattended upgrades are set to automatically install operating system security updates.
|
||||
|
||||
@@ -502,9 +457,6 @@ Many features and refinements are in the works at various stages including:
|
||||
- Internal network scan tool and feedback
|
||||
- Anomaly detection in network traffic
|
||||
|
||||
# Follow
|
||||
You can find recent bugfixes, functional additions, some extra documentation and more at the Cyber5K Patreon page: [https://www.patreon.com/cyber5k](https://www.patreon.com/cyber5k)
|
||||
|
||||
# Contact
|
||||
|
||||
Contact me at [steven@cyber5k.com](mailto:steven@cyber5k.com)
|
||||
@@ -513,5 +465,4 @@ Contact me at [steven@cyber5k.com](mailto:steven@cyber5k.com)
|
||||
|
||||
Please consider supporting the project via:
|
||||
- [Paypal.me](https://paypal.me/cyber5k)
|
||||
- [Buy me a drink](https://www.buymeacoffee.com/cyber5k)
|
||||
- [Patreon](https://www.patreon.com/cyber5k)
|
||||
|
||||
@@ -12,18 +12,9 @@ services:
|
||||
depends_on:
|
||||
- postgres
|
||||
- redis
|
||||
ports:
|
||||
- "10.2.3.1:5000:5000/tcp" # auth access
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.django-http.rule=Host(`home.mistborn`)"
|
||||
- "traefik.http.routers.django-http.entrypoints=web"
|
||||
- "traefik.http.routers.django-http.middlewares=mistborn_headers@file"
|
||||
- "traefik.http.routers.django-https.rule=Host(`home.mistborn`)"
|
||||
- "traefik.http.routers.django-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.django-https.middlewares=mistborn_headers@file"
|
||||
- "traefik.http.routers.django-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.django-service.loadbalancer.server.port=5000"
|
||||
- "traefik.port=5000"
|
||||
env_file:
|
||||
- ./.envs/.production/.django
|
||||
- ./.envs/.production/.postgres
|
||||
@@ -47,41 +38,20 @@ services:
|
||||
restart: unless-stopped
|
||||
|
||||
traefik:
|
||||
#build:
|
||||
# context: .
|
||||
# dockerfile: ./compose/production/traefik/Dockerfile
|
||||
#image: mistborn_production_traefik
|
||||
image: traefik:v2.2
|
||||
build:
|
||||
context: .
|
||||
dockerfile: ./compose/production/traefik/Dockerfile
|
||||
image: mistborn_production_traefik
|
||||
container_name: mistborn_production_traefik
|
||||
depends_on:
|
||||
- django
|
||||
volumes:
|
||||
#- production_traefik:/etc/traefik/acme
|
||||
- ./compose/production/traefik/dynamic.toml:/dynamic.toml:ro
|
||||
- production_traefik:/etc/traefik/acme
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ../mistborn_volumes/base/tls:/tls:ro
|
||||
network_mode: host
|
||||
#ports:
|
||||
# - "0.0.0.0:80:80/tcp"
|
||||
# - "0.0.0.0:443:443/tcp"
|
||||
# #- "0.0.0.0:8080:8080/tcp" # dashboard
|
||||
command:
|
||||
## API settings
|
||||
#- --api.insecure=true
|
||||
#- --api.dashboard=true
|
||||
#- --api.debug=true
|
||||
## Logs
|
||||
- --log.level=ERROR
|
||||
## Providers
|
||||
- --providers.docker=true
|
||||
- --providers.docker.exposedbydefault=false
|
||||
- --providers.file.filename=/dynamic.toml
|
||||
#- --providers.docker.network=default
|
||||
## Entrypoints
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
## Certificates
|
||||
#- --serversTransport.insecureSkipVerify=true
|
||||
- ../mistborn_volumes/base/tls:/tls
|
||||
ports:
|
||||
- "0.0.0.0:80:80/tcp"
|
||||
- "0.0.0.0:443:443/tcp"
|
||||
restart: unless-stopped
|
||||
|
||||
redis:
|
||||
@@ -166,14 +136,6 @@ services:
|
||||
- "${MISTBORN_DNS_BIND_IP}:53:53/udp"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.pihole-http.rule=Host(`pihole.mistborn`)"
|
||||
- "traefik.http.routers.pihole-http.entrypoints=web"
|
||||
- "traefik.http.routers.pihole-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.pihole-https.rule=Host(`pihole.mistborn`)"
|
||||
- "traefik.http.routers.pihole-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.pihole-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.pihole-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.pihole-service.loadbalancer.server.port=80"
|
||||
environment:
|
||||
- ServerIP=10.2.0.3
|
||||
- DNS1='10.2.0.2#5054' # docs say port 5054, was 54; use network_mode: host to see which port is used
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
FROM traefik:v2.2
|
||||
FROM traefik:alpine
|
||||
RUN mkdir -p /etc/traefik/acme
|
||||
RUN touch /etc/traefik/acme/acme.json
|
||||
RUN chmod 600 /etc/traefik/acme/acme.json
|
||||
#COPY ./compose/production/traefik/dynamic.toml /etc/traefik
|
||||
COPY ./compose/production/traefik/traefik.toml /etc/traefik
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
[tls.stores]
|
||||
[tls.stores.default]
|
||||
[tls.stores.default.defaultCertificate]
|
||||
certFile = "/tls/cert.crt"
|
||||
keyFile = "/tls/cert.key"
|
||||
|
||||
[tls.options]
|
||||
[tls.options.default]
|
||||
minVersion = "VersionTLS12"
|
||||
|
||||
[http.services]
|
||||
[http.services.cockpit.loadBalancer]
|
||||
[[http.services.cockpit.loadBalancer.servers]]
|
||||
url = "http://10.2.3.1:9090"
|
||||
|
||||
[http.routers]
|
||||
[http.routers.cockpit]
|
||||
rule = "Host(`cockpit.mistborn`)"
|
||||
service = "cockpit"
|
||||
entrypoints = ["web", "websecure"]
|
||||
#middlewares =
|
||||
|
||||
[http.middlewares]
|
||||
[http.middlewares.mistborn_auth.forwardAuth]
|
||||
address = "http://10.2.3.1:5000/auth/"
|
||||
trustForwardHeader = true
|
||||
[http.middlewares.mistborn_auth.forwardAuth.tls]
|
||||
insecureSkipVerify = true
|
||||
|
||||
[http.middlewares.mistborn_headers.headers]
|
||||
hostsProxyHeaders = ['X-CSRFToken']
|
||||
@@ -0,0 +1,257 @@
|
||||
#debug = true
|
||||
|
||||
logLevel = "ERROR" #DEBUG, INFO, WARN, ERROR, FATAL, PANIC
|
||||
InsecureSkipVerify = true
|
||||
|
||||
defaultEntryPoints = ["http", "https"]
|
||||
#defaultEntryPoints = ["http"]
|
||||
|
||||
# Entrypoints, http and https
|
||||
[entryPoints]
|
||||
# http should be redirected to https
|
||||
[entryPoints.http]
|
||||
address = ":80"
|
||||
#[entryPoints.http.redirect]
|
||||
#entryPoint = "https"
|
||||
# https is the default
|
||||
[entryPoints.https]
|
||||
address = ":443"
|
||||
[entryPoints.https.tls]
|
||||
[entryPoints.https.tls.defaultCertificate]
|
||||
certFile = "/tls/cert.crt"
|
||||
keyFile = "/tls/cert.key"
|
||||
|
||||
## Enable ACME (Let's Encrypt): automatic SSL
|
||||
#[acme]
|
||||
## Email address used for registration
|
||||
#email = "steven@cyber5k.com"
|
||||
#storage = "/etc/traefik/acme/acme.json"
|
||||
#entryPoint = "https"
|
||||
#onDemand = false
|
||||
#OnHostRule = true
|
||||
# # Use a HTTP-01 acme challenge rather than TLS-SNI-01 challenge
|
||||
# [acme.httpChallenge]
|
||||
# entryPoint = "http"
|
||||
|
||||
[file]
|
||||
[backends]
|
||||
[backends.django]
|
||||
[backends.django.servers.server1]
|
||||
url = "http://django:5000"
|
||||
|
||||
[backends.pihole]
|
||||
[backends.pihole.servers.server1]
|
||||
url = "http://pihole:80"
|
||||
|
||||
[backends.homeassistant]
|
||||
[backends.homeassistant.servers.server1]
|
||||
url = "http://homeassistant:8123"
|
||||
|
||||
[backends.syncthing]
|
||||
[backends.syncthing.servers.server1]
|
||||
url = "http://syncthing:8384"
|
||||
|
||||
[backends.rocketchat]
|
||||
[backends.rocketchat.servers.server1]
|
||||
url = "http://rocketchat:3000"
|
||||
|
||||
[backends.nextcloud]
|
||||
[backends.nextcloud.servers.server1]
|
||||
url = "http://nextcloud:80"
|
||||
|
||||
[backends.onlyoffice]
|
||||
[backends.onlyoffice.servers.server1]
|
||||
url = "http://onlyoffice-community-server:80"
|
||||
|
||||
[backends.bitwarden]
|
||||
[backends.bitwarden.servers.server1]
|
||||
url = "http://bitwarden:80"
|
||||
|
||||
[backends.jellyfin]
|
||||
[backends.jellyfin.servers.server1]
|
||||
url = "http://jellyfin:8096"
|
||||
|
||||
[backends.jitsi]
|
||||
[backends.jitsi.servers.server1]
|
||||
url = "http://jitsi-web:80"
|
||||
|
||||
[backends.raspap]
|
||||
[backends.raspap.servers.server1]
|
||||
url = "http://raspap:80"
|
||||
|
||||
[backends.cockpit]
|
||||
[backends.cockpit.servers.server1]
|
||||
url = "http://10.2.3.1:9090"
|
||||
|
||||
[frontends]
|
||||
[frontends.django]
|
||||
backend = "django"
|
||||
passHostHeader = true
|
||||
[frontends.django.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.django.routes.dr1]
|
||||
#rule = "Host:mistborn.cyber5k.com"
|
||||
rule = "Host:home.mistborn"
|
||||
|
||||
[frontends.pihole]
|
||||
backend = "pihole"
|
||||
passHostHeader = true
|
||||
[frontends.pihole.auth]
|
||||
[frontends.pihole.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.pihole.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.pihole.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.pihole.routes.dr1]
|
||||
rule = "Host:pihole.mistborn"
|
||||
|
||||
[frontends.homeassistant]
|
||||
backend = "homeassistant"
|
||||
passHostHeader = true
|
||||
[frontends.homeassistant.auth]
|
||||
[frontends.homeassistant.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.homeassistant.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.homeassistant.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.homeassistant.routes.dr1]
|
||||
rule = "Host:homeassistant.mistborn"
|
||||
|
||||
[frontends.syncthing]
|
||||
backend = "syncthing"
|
||||
passHostHeader = true
|
||||
[frontends.syncthing.auth]
|
||||
[frontends.syncthing.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.syncthing.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.syncthing.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.syncthing.routes.dr1]
|
||||
rule = "Host:syncthing.mistborn"
|
||||
|
||||
[frontends.rocketchat]
|
||||
backend = "rocketchat"
|
||||
passHostHeader = true
|
||||
[frontends.rocketchat.auth]
|
||||
[frontends.rocketchat.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.rocketchat.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.rocketchat.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.rocketchat.routes.dr1]
|
||||
rule = "Host:chat.mistborn"
|
||||
|
||||
[frontends.nextcloud]
|
||||
backend = "nextcloud"
|
||||
passHostHeader = true
|
||||
[frontends.nextcloud.auth]
|
||||
[frontends.nextcloud.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.nextcloud.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.nextcloud.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.nextcloud.routes.dr1]
|
||||
rule = "Host:nextcloud.mistborn"
|
||||
|
||||
[frontends.onlyoffice]
|
||||
backend = "onlyoffice"
|
||||
passHostHeader = true
|
||||
[frontends.onlyoffice.auth]
|
||||
[frontends.onlyoffice.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.onlyoffice.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.onlyoffice.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.onlyoffice.routes.dr1]
|
||||
rule = "Host:onlyoffice.mistborn"
|
||||
|
||||
[frontends.bitwarden]
|
||||
backend = "bitwarden"
|
||||
passHostHeader = true
|
||||
[frontends.bitwarden.auth]
|
||||
[frontends.bitwarden.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.bitwarden.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.bitwarden.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.bitwarden.routes.dr1]
|
||||
rule = "Host:bitwarden.mistborn"
|
||||
|
||||
[frontends.jellyfin]
|
||||
backend = "jellyfin"
|
||||
passHostHeader = true
|
||||
[frontends.jellyfin.auth]
|
||||
[frontends.jellyfin.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.jellyfin.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.jellyfin.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.jellyfin.routes.dr1]
|
||||
rule = "Host:jellyfin.mistborn"
|
||||
|
||||
[frontends.jitsi]
|
||||
backend = "jitsi"
|
||||
passHostHeader = true
|
||||
[frontends.jitsi.auth]
|
||||
[frontends.jitsi.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.jitsi.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.jitsi.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.jitsi.routes.dr1]
|
||||
rule = "Host:jitsi.mistborn"
|
||||
|
||||
[frontends.raspap]
|
||||
backend = "raspap"
|
||||
passHostHeader = true
|
||||
[frontends.raspap.auth]
|
||||
[frontends.raspap.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.raspap.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.raspap.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.raspap.routes.dr1]
|
||||
rule = "Host:raspap.mistborn"
|
||||
|
||||
[frontends.cockpit]
|
||||
backend = "cockpit"
|
||||
passHostHeader = true
|
||||
[frontends.cockpit.auth]
|
||||
[frontends.cockpit.auth.forward]
|
||||
address = "https://home.mistborn/auth/"
|
||||
trustForwardHeader = false
|
||||
[frontends.cockpit.auth.forward.tls]
|
||||
insecureSkipVerify = true
|
||||
[frontends.cockpit.headers]
|
||||
HostsProxyHeaders = ['X-CSRFToken']
|
||||
[frontends.cockpit.routes.dr1]
|
||||
rule = "Host:cockpit.mistborn"
|
||||
|
||||
## Connection to docker host system (docker.sock)
|
||||
#[docker]
|
||||
#endpoint = "unix:///var/run/docker.sock"
|
||||
#domain = "localhost"
|
||||
#watch = true
|
||||
## This will hide all docker containers that don't have explicitly
|
||||
## set label to "enable"
|
||||
#exposedbydefault = false
|
||||
+1
-8
@@ -10,14 +10,7 @@ services:
|
||||
- ../../mistborn_volumes/extra/bitwarden:/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bitwarden-http.rule=Host(`bitwarden.mistborn`)"
|
||||
- "traefik.http.routers.bitwarden-http.entrypoints=web"
|
||||
- "traefik.http.routers.bitwarden-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.bitwarden-https.rule=Host(`bitwarden.mistborn`)"
|
||||
- "traefik.http.routers.bitwarden-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.bitwarden-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.bitwarden-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.bitwarden-service.loadbalancer.server.port=80"
|
||||
- "traefik.port=80"
|
||||
ports:
|
||||
- 3012:3012/tcp
|
||||
restart: unless-stopped
|
||||
|
||||
@@ -10,14 +10,7 @@ services:
|
||||
- TZ=America/New_York
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.homeassistant-http.rule=Host(`homeassistant.mistborn`)"
|
||||
- "traefik.http.routers.homeassistant-http.entrypoints=web"
|
||||
- "traefik.http.routers.homeassistant-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.homeassistant-https.rule=Host(`homeassistant.mistborn`)"
|
||||
- "traefik.http.routers.homeassistant-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.homeassistant-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.homeassistant-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.homeassistant-service.loadbalancer.server.port=8123"
|
||||
- "traefik.port=8123"
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
|
||||
+1
-8
@@ -14,14 +14,7 @@ services:
|
||||
- ../../mistborn_volumes/extra/nextcloud:/media:ro
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.jellyfin-http.rule=Host(`jellyfin.mistborn`)"
|
||||
- "traefik.http.routers.jellyfin-http.entrypoints=web"
|
||||
- "traefik.http.routers.jellyfin-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.jellyfin-https.rule=Host(`jellyfin.mistborn`)"
|
||||
- "traefik.http.routers.jellyfin-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.jellyfin-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.jellyfin-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.jellyfin-service.loadbalancer.server.port=8096"
|
||||
- "traefik.port=8096"
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
|
||||
@@ -9,14 +9,7 @@ services:
|
||||
#- '${HTTPS_PORT}:443'
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.jitsi-http.rule=Host(`jitsi.mistborn`)"
|
||||
- "traefik.http.routers.jitsi-http.entrypoints=web"
|
||||
- "traefik.http.routers.jitsi-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.jitsi-https.rule=Host(`jitsi.mistborn`)"
|
||||
- "traefik.http.routers.jitsi-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.jitsi-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.jitsi-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.jitsi-service.loadbalancer.server.port=${HTTP_PORT}"
|
||||
- "traefik.port=${HTTP_PORT}"
|
||||
volumes:
|
||||
- ${CONFIG}/web:/config
|
||||
- ${CONFIG}/web/letsencrypt:/etc/letsencrypt
|
||||
|
||||
@@ -1,88 +0,0 @@
|
||||
version: "3"
|
||||
|
||||
services:
|
||||
|
||||
db:
|
||||
#build:
|
||||
# context: ../compose/production/mattermost/db
|
||||
image: mattermost/mattermost-prod-db
|
||||
read_only: true
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/mattermost/db/var/lib/postgresql/data:/var/lib/postgresql/data
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
#environment:
|
||||
# - POSTGRES_USER=mmuser
|
||||
# - POSTGRES_PASSWORD=mmuser_password
|
||||
# - POSTGRES_DB=mattermost
|
||||
# uncomment the following to enable backup
|
||||
# - AWS_ACCESS_KEY_ID=XXXX
|
||||
# - AWS_SECRET_ACCESS_KEY=XXXX
|
||||
# - WALE_S3_PREFIX=s3://BUCKET_NAME/PATH
|
||||
# - AWS_REGION=us-east-1
|
||||
|
||||
app:
|
||||
#build:
|
||||
# context: ../compose/production/mattermost/app
|
||||
# # uncomment following lines for team edition or change UID/GID
|
||||
# args:
|
||||
# - edition=team
|
||||
# - PUID=1000
|
||||
# - PGID=1000
|
||||
image: mattermost/mattermost-team-edition
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/mattermost/app/mattermost/config:/mattermost/config:rw
|
||||
- ../../mistborn_volumes/extra/mattermost/app/mattermost/data:/mattermost/data:rw
|
||||
- ../../mistborn_volumes/extra/mattermost/app/mattermost/logs:/mattermost/logs:rw
|
||||
- ../../mistborn_volumes/extra/mattermost/app/mattermost/plugins:/mattermost/plugins:rw
|
||||
- ../../mistborn_volumes/extra/mattermost/app/mattermost/client-plugins:/mattermost/client/plugins:rw
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
# When you want to use SSO with GitLab, you have to add the cert pki chain of GitLab inside Alpine
|
||||
# to avoid Token request failed: certificate signed by unknown authority (link: https://github.com/mattermost/mattermost-server/issues/13059)
|
||||
# - <path_to_your_gitlab_pki>/pki_chain.pem:/etc/ssl/certs/pki_chain.pem:ro
|
||||
environment:
|
||||
# # set same as db credentials and dbname
|
||||
# #- MM_USERNAME=mmuser
|
||||
# #- MM_PASSWORD=mmuser_password
|
||||
# #- MM_DBNAME=mattermost
|
||||
|
||||
# # use the credentials you've set above, in the format:
|
||||
# # MM_SQLSETTINGS_DATASOURCE=postgres://${MM_USERNAME}:${MM_PASSWORD}@db:5432/${MM_DBNAME}?sslmode=disable&connect_timeout=10
|
||||
# #- MM_SQLSETTINGS_DATASOURCE=postgres://mmuser:mmuser_password@db:5432/mattermost?sslmode=disable&connect_timeout=10
|
||||
- MM_SQLSETTINGS_DATASOURCE=postgres://${MM_USERNAME}:${MM_PASSWORD}@db:5432/${MM_DBNAME}?sslmode=disable&connect_timeout=10
|
||||
- PUID=2000
|
||||
- GUID=2000
|
||||
|
||||
# # in case your config is not in default location
|
||||
# #- MM_CONFIG=/mattermost/config/config.json
|
||||
|
||||
web:
|
||||
#build:
|
||||
# context: ../compose/production/mattermost/web
|
||||
image: mattermost/mattermost-prod-web
|
||||
#ports:
|
||||
# - "80:80"
|
||||
# - "443:443"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.mattermost-http.rule=Host(`mattermost.mistborn`)"
|
||||
- "traefik.http.routers.mattermost-http.entrypoints=web"
|
||||
- "traefik.http.routers.mattermost-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.mattermost-https.rule=Host(`mattermost.mistborn`)"
|
||||
- "traefik.http.routers.mattermost-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.mattermost-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.mattermost-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.mattermost-service.loadbalancer.server.port=80"
|
||||
read_only: true
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
# This directory must have cert files if you want to enable SSL
|
||||
#- ./volumes/web/cert:/cert:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
|
||||
networks:
|
||||
default:
|
||||
external:
|
||||
name: mistborn_default
|
||||
|
||||
+1
-8
@@ -9,14 +9,7 @@ services:
|
||||
- ../.envs/.production/.nextcloud
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.nextcloud-http.rule=Host(`nextcloud.mistborn`)"
|
||||
- "traefik.http.routers.nextcloud-http.entrypoints=web"
|
||||
- "traefik.http.routers.nextcloud-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.nextcloud-https.rule=Host(`nextcloud.mistborn`)"
|
||||
- "traefik.http.routers.nextcloud-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.nextcloud-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.nextcloud-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.nextcloud-service.loadbalancer.server.port=80"
|
||||
- "traefik.port=80"
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/nextcloud:/var/www/html
|
||||
environment:
|
||||
|
||||
+87
-12
@@ -1,27 +1,102 @@
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
onlyoffice:
|
||||
container_name: mistborn_production_onlyoffice
|
||||
onlyoffice-mysql-server:
|
||||
container_name: mistborn_onlyoffice_mysql_server
|
||||
image: mysql:5.7.21
|
||||
environment:
|
||||
- MYSQL_ROOT_PASSWORD=my-secret-pw
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/onlyoffice/mysql-conf:/etc/mysql/conf.d
|
||||
- ../../mistborn_volumes/extra/onlyoffice/mysql-entrypoint:/docker-entrypoint-initdb.d
|
||||
- ../../mistborn_volumes/extra/onlyoffice/mysql-data:/var/lib/mysql
|
||||
networks:
|
||||
onlyoffice_net:
|
||||
ipv4_address: 10.2.2.2
|
||||
restart: unless-stopped
|
||||
|
||||
onlyoffice-document-server:
|
||||
container_name: mistborn_onlyoffice_document_server
|
||||
image: onlyoffice/documentserver:latest
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/onlyoffice/logs:/var/log/onlyoffice
|
||||
- ../../mistborn_volumes/extra/onlyoffice/cache:/var/lib/onlyoffice
|
||||
- ../../mistborn_volumes/extra/onlyoffice/documentserver-data:/var/www/onlyoffice/Data
|
||||
- ../../mistborn_volumes/extra/onlyoffice/documentserver-logs:/var/log/onlyoffice
|
||||
env_file:
|
||||
- ../.envs/.production/.onlyoffice
|
||||
ports:
|
||||
- "80:80/tcp"
|
||||
networks:
|
||||
onlyoffice_net:
|
||||
ipv4_address: 10.2.2.3
|
||||
restart: unless-stopped
|
||||
|
||||
#onlyoffice-mail-server:
|
||||
# container_name: mistborn_onlyoffice_mail_server
|
||||
# privileged: true
|
||||
# image: onlyoffice/mailserver:latest
|
||||
# volumes:
|
||||
# - ../../mistborn_volumes/extra/onlyoffice/mailserver-data:/var/vmail
|
||||
# - ../../mistborn_volumes/extra/onlyoffice/mailserver-certs:/etc/pki/tls/mailserver
|
||||
# - ../../mistborn_volumes/extra/onlyoffice/mailserver-logs:/var/log
|
||||
# - ../../mistborn_volumes/extra/onlyoffice/mailserver-mysql:/var/lib/mysql
|
||||
# hostname: mistborn
|
||||
# networks:
|
||||
# onlyoffice_net:
|
||||
# ipv4_address: 10.2.2.4
|
||||
# ports:
|
||||
# - "25:25/tcp"
|
||||
# - "143:143/tcp"
|
||||
# - "587:587/tcp"
|
||||
# restart: unless-stopped
|
||||
|
||||
onlyoffice-community-server:
|
||||
container_name: mistborn_onlyoffice_community_server
|
||||
image: onlyoffice/communityserver:latest
|
||||
environment:
|
||||
- DOCUMENT_SERVER_PORT_80_TCP_ADDR=mistborn_onlyoffice_document_server
|
||||
# - MAIL_SERVER_DB_HOST=mistborn_onlyoffice_mail_server
|
||||
- ONLYOFFICE_CORE_MACHINEKEY=core_secret
|
||||
- MYSQL_SERVER_ROOT_PASSWORD=my-secret-pw
|
||||
- MYSQL_SERVER_DB_NAME=onlyoffice
|
||||
- MYSQL_SERVER_HOST=mistborn_onlyoffice_mysql_server
|
||||
- MYSQL_SERVER_USER=onlyoffice_user
|
||||
- MYSQL_SERVER_PASS=onlyoffice_pass
|
||||
# - MAIL_SERVER_API_PORT=8081
|
||||
# - MAIL_SERVER_API_HOST=onlyoffice-mail-server
|
||||
# - MAIL_SERVER_DB_HOST=onlyoffice-mysql-server
|
||||
# - MAIL_SERVER_DB_PORT=3306
|
||||
# - MAIL_SERVER_DB_NAME=onlyoffice_mailserver
|
||||
# - MAIL_SERVER_DB_USER=onlyoffice_mailserver_user
|
||||
# - MAIL_SERVER_DB_PASS=onlyoffice_mailserver_user_pass
|
||||
depends_on:
|
||||
- onlyoffice-mysql-server
|
||||
- onlyoffice-document-server
|
||||
# - onlyoffice-mail-server
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/onlyoffice/communityserver-data:/var/www/onlyoffice/Data
|
||||
- ../../mistborn_volumes/extra/onlyoffice/communityserver-mysql:/var/lib/mysql
|
||||
- ../../mistborn_volumes/extra/onlyoffice/communityserver-logs:/var/log/onlyoffice
|
||||
- ../../mistborn_volumes/extra/onlyoffice/documentserver-data:/var/www/onlyoffice/DocumentServerData
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.onlyoffice-http.rule=Host(`onlyoffice.mistborn`)"
|
||||
- "traefik.http.routers.onlyoffice-http.entrypoints=web"
|
||||
- "traefik.http.routers.onlyoffice-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.onlyoffice-https.rule=Host(`onlyoffice.mistborn`)"
|
||||
- "traefik.http.routers.onlyoffice-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.onlyoffice-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.onlyoffice-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.onlyoffice-service.loadbalancer.server.port=80"
|
||||
- "traefik.port=80"
|
||||
networks:
|
||||
default:
|
||||
onlyoffice_net:
|
||||
ipv4_address: 10.2.2.5
|
||||
ports:
|
||||
#- "10.2.2.5:80:80/tcp"
|
||||
- "5222:5222/tcp"
|
||||
restart: unless-stopped
|
||||
|
||||
|
||||
networks:
|
||||
default:
|
||||
external:
|
||||
name: mistborn_default
|
||||
|
||||
onlyoffice_net:
|
||||
driver: overlay
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 10.2.2.0/24
|
||||
|
||||
+1
-8
@@ -10,14 +10,7 @@ services:
|
||||
container_name: mistborn_production_raspap
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.raspap-http.rule=Host(`raspap.mistborn`)"
|
||||
- "traefik.http.routers.raspap-http.entrypoints=web"
|
||||
- "traefik.http.routers.raspap-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.raspap-https.rule=Host(`raspap.mistborn`)"
|
||||
- "traefik.http.routers.raspap-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.raspap-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.raspap-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.raspap-service.loadbalancer.server.port=80"
|
||||
- "traefik.port=80"
|
||||
env_file:
|
||||
- ../.envs/.production/.pihole
|
||||
command: /start
|
||||
|
||||
+4
-11
@@ -17,14 +17,7 @@ services:
|
||||
- Accounts_UseDNSDomainCheck=False
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.chat-http.rule=Host(`chat.mistborn`)"
|
||||
- "traefik.http.routers.chat-http.entrypoints=web"
|
||||
- "traefik.http.routers.chat-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.chat-https.rule=Host(`chat.mistborn`)"
|
||||
- "traefik.http.routers.chat-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.chat-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.chat-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.chat-service.loadbalancer.server.port=3000"
|
||||
- "traefik.port=3000"
|
||||
depends_on:
|
||||
- mongo
|
||||
#ports:
|
||||
@@ -35,8 +28,8 @@ services:
|
||||
container_name: mistborn_production_rocketchat_mongo
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/rocketchat/data/db:/data/db
|
||||
- ../../mistborn_volumes/extra/rocketchat/data/dump:/dump
|
||||
- ../volumes/extra/rocketchat/data/db:/data/db
|
||||
- ../volumes/extra/rocketchat/data/dump:/dump
|
||||
command: mongod --smallfiles --oplogSize 128 --replSet rs0 --storageEngine=mmapv1
|
||||
|
||||
# this container's job is just run the command to initialize the replica set.
|
||||
@@ -61,7 +54,7 @@ services:
|
||||
depends_on:
|
||||
- rocketchat
|
||||
volumes:
|
||||
- ../../mistborn_volumes/extra/rocketchat/hubot/scripts:/home/hubot/scripts
|
||||
- ../volumes/extra/rocketchat/hubot/scripts:/home/hubot/scripts
|
||||
# this is used to expose the hubot port for notifications on the host on port 3001, e.g. for hubot-jenkins-notifier
|
||||
ports:
|
||||
- 3001:8080/tcp
|
||||
|
||||
+1
-8
@@ -19,14 +19,7 @@ services:
|
||||
- 21027:21027/udp # protocol discovery
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.syncthing-http.rule=Host(`syncthing.mistborn`)"
|
||||
- "traefik.http.routers.syncthing-http.entrypoints=web"
|
||||
- "traefik.http.routers.syncthing-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.syncthing-https.rule=Host(`syncthing.mistborn`)"
|
||||
- "traefik.http.routers.syncthing-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.syncthing-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.syncthing-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.syncthing-service.loadbalancer.server.port=8384"
|
||||
- "traefik.port=8384"
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
|
||||
Vendored
-13
@@ -1,7 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
#### ENV file
|
||||
|
||||
VAR_FILE=/opt/mistborn/.env
|
||||
|
||||
source /opt/mistborn/scripts/subinstallers/platform.sh
|
||||
@@ -21,14 +19,3 @@ if [ "$GIT_BRANCH" != "master" ]; then
|
||||
fi
|
||||
|
||||
echo "MISTBORN_TAG=$MISTBORN_TAG" | sudo tee -a ${VAR_FILE}
|
||||
|
||||
#### install and base services
|
||||
iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
|
||||
|
||||
# default interface
|
||||
sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
|
||||
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
|
||||
#sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
|
||||
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
|
||||
|
||||
sudo systemctl daemon-reload
|
||||
+19
-15
@@ -69,9 +69,9 @@ fi
|
||||
|
||||
# Install Cockpit?
|
||||
if [ -z "${MISTBORN_INSTALL_COCKPIT}" ]; then
|
||||
read -p "Install Cockpit (a somewhat resource-heavy system management graphical user interface -- NOT RECOMMENDED on Raspberry Pi)? [y/N]: " MISTBORN_INSTALL_COCKPIT
|
||||
read -p "Install Cockpit (a somewhat resource-heavy system management graphical user interface)? [Y/n]: " MISTBORN_INSTALL_COCKPIT
|
||||
echo
|
||||
MISTBORN_INSTALL_COCKPIT=${MISTBORN_INSTALL_COCKPIT:-N}
|
||||
MISTBORN_INSTALL_COCKPIT=${MISTBORN_INSTALL_COCKPIT:-Y}
|
||||
fi
|
||||
|
||||
# SSH keys
|
||||
@@ -117,10 +117,10 @@ fi
|
||||
|
||||
# SSH Server
|
||||
sudo -E apt-get install -y openssh-server
|
||||
#sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
|
||||
#sudo sed -i 's/PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
|
||||
#sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
||||
#sudo sed -i 's/PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/#Port.*/Port 22/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/Port.*/Port 22/' /etc/ssh/sshd_config
|
||||
sudo systemctl enable ssh
|
||||
@@ -132,11 +132,8 @@ sudo -E apt-get install -y dnsutils fail2ban
|
||||
# Install kernel headers
|
||||
if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
|
||||
sudo -E apt install -y linux-headers-$(uname -r)
|
||||
elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
|
||||
elif [ "$DISTRO" == "raspbian" ]; then
|
||||
sudo -E apt install -y raspberrypi-kernel-headers
|
||||
else
|
||||
echo "Unsupported OS: $DISTRO"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Wireugard
|
||||
@@ -166,6 +163,8 @@ sudo pip3 install -e ./modules/mistborn-cli
|
||||
|
||||
# Mistborn
|
||||
# final setup vars
|
||||
iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
|
||||
figlet "Mistborn default NIC: $iface"
|
||||
|
||||
#IPV4_PUBLIC=$(ip -o -4 route show default | egrep -o 'dev [^ ]*' | awk '{print $2}' | xargs ip -4 addr show | grep 'inet ' | awk '{print $2}' | grep -o "^[0-9.]*" | tr -cd '\11\12\15\40-\176' | head -1) # tail -1 to get last
|
||||
IPV4_PUBLIC="10.2.3.1"
|
||||
@@ -186,13 +185,18 @@ sudo systemctl restart unattended-upgrades
|
||||
|
||||
# setup Mistborn services
|
||||
|
||||
# install and start base services
|
||||
# default interface
|
||||
sudo cp ./scripts/services/Mistborn* /etc/systemd/system/
|
||||
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
|
||||
#sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
|
||||
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
|
||||
|
||||
#if [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ]; then
|
||||
# # remove systemd-resolved lines
|
||||
# sudo sed -i '/.*systemd-resolved/d' /etc/systemd/system/Mistborn-base.service
|
||||
#fi
|
||||
|
||||
sudo cp ./scripts/services/Mistborn-setup.service /etc/systemd/system/
|
||||
|
||||
# setup local volumes for pihole
|
||||
sudo mkdir -p ../mistborn_volumes/
|
||||
sudo chown -R root:root ../mistborn_volumes/
|
||||
@@ -201,12 +205,12 @@ sudo mkdir -p ../mistborn_volumes/base/pihole/etc-dnsmasqd
|
||||
sudo mkdir -p ../mistborn_volumes/extra
|
||||
|
||||
# Traefik final setup (cockpit)
|
||||
#cp ./compose/production/traefik/traefikv2.toml.template ./compose/production/traefik/traefik.toml
|
||||
cp ./compose/production/traefik/traefik.toml.template ./compose/production/traefik/traefik.toml
|
||||
|
||||
# setup tls certs
|
||||
source ./scripts/subinstallers/openssl.sh
|
||||
#sudo rm -rf ../mistborn_volumes/base/tls
|
||||
#sudo mv ./tls ../mistborn_volumes/base/
|
||||
sudo rm -rf ../mistborn_volumes/base/tls
|
||||
sudo mv ./tls ../mistborn_volumes/base/
|
||||
|
||||
# enable and run setup to generate .env
|
||||
sudo systemctl enable Mistborn-setup.service
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
sudo systemctl stop Mistborn-base
|
||||
sudo systemctl restart Mistborn-setup
|
||||
sudo systemctl restart Mistborn-base
|
||||
@@ -12,7 +12,7 @@ PermissionsStartOnly=true
|
||||
EnvironmentFile=/opt/mistborn/.env
|
||||
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml down
|
||||
|
||||
#ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
|
||||
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
|
||||
ExecStartPre=-/sbin/ip address add 10.2.3.1/30 dev DIFACE
|
||||
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 53 -j MISTBORN_LOG_DROP
|
||||
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 53 -j MISTBORN_LOG_DROP
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
[Unit]
|
||||
Description=Mistborn Mattermost Service
|
||||
Requires=Mistborn-base.service
|
||||
After=Mistborn-base.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
User=root
|
||||
Group=docker
|
||||
PermissionsStartOnly=true
|
||||
# Shutdown container (if running) when unit is stopped
|
||||
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/mattermost.yml down
|
||||
|
||||
# Start container when unit is started
|
||||
ExecStart=/usr/local/bin/docker-compose --env-file /opt/mistborn/.envs/.production/.mattermost -f /opt/mistborn/extra/mattermost.yml up --build
|
||||
# Stop container when unit is stopped
|
||||
ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/mattermost.yml down
|
||||
# Post stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -10,12 +10,21 @@ Group=docker
|
||||
PermissionsStartOnly=true
|
||||
# Shutdown container (if running) when unit is stopped
|
||||
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
|
||||
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
|
||||
#ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 25 -j MISTBORN_LOG_DROP
|
||||
#ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 143 -j MISTBORN_LOG_DROP
|
||||
#ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 587 -j MISTBORN_LOG_DROP
|
||||
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 5222 -j MISTBORN_LOG_DROP
|
||||
|
||||
# Start container when unit is started
|
||||
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml up --build
|
||||
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml up
|
||||
# Stop container when unit is stopped
|
||||
ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
|
||||
# Post stop
|
||||
#ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 25 -j MISTBORN_LOG_DROP
|
||||
#ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 143 -j MISTBORN_LOG_DROP
|
||||
#ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 587 -j MISTBORN_LOG_DROP
|
||||
ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 5222 -j MISTBORN_LOG_DROP
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
@@ -4,7 +4,6 @@ Before=Mistborn-base.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
User=mistborn
|
||||
ExecStart=/opt/mistborn/scripts/env/setup.sh
|
||||
|
||||
[Install]
|
||||
|
||||
@@ -10,8 +10,11 @@ elif [ "$DISTRO" == "debian" ]; then
|
||||
&& echo "buster-backports already in sources" \
|
||||
|| echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee -a /etc/apt/sources.list.d/backports.list
|
||||
|
||||
elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
|
||||
|
||||
elif [ "$DISTRO" == "raspbian" ]; then
|
||||
|
||||
echo "Raspbian repos contain cockpit"
|
||||
|
||||
fi
|
||||
|
||||
sudo -E apt-get install -y cockpit
|
||||
|
||||
@@ -16,5 +16,5 @@ fi
|
||||
|
||||
# set docker-compose path used in Mistborn
|
||||
if [ ! -f /usr/local/bin/docker-compose ]; then
|
||||
sudo -E ln -s $(which docker-compose) /usr/local/bin/docker-compose
|
||||
sudo ln -s $(which docker-compose) /usr/local/bin/docker-compose
|
||||
fi
|
||||
|
||||
@@ -15,7 +15,7 @@ if [ "$DISTRO" == "ubuntu" ]; then
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
elif [ "$DISTRO" == "debian" ]; then
|
||||
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
|
||||
elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
|
||||
elif [ "$DISTRO" == "raspbian" ]; then
|
||||
curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg | sudo apt-key add -
|
||||
fi
|
||||
|
||||
@@ -31,7 +31,7 @@ elif [ "$DISTRO" == "debian" ]; then
|
||||
"deb https://download.docker.com/linux/debian \
|
||||
$(lsb_release -cs) \
|
||||
stable"
|
||||
elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
|
||||
elif [ "$DISTRO" == "raspbian" ]; then
|
||||
echo "deb [arch=armhf] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") \
|
||||
$(lsb_release -cs) stable" | \
|
||||
sudo tee /etc/apt/sources.list.d/docker.list
|
||||
@@ -43,7 +43,7 @@ sudo apt-get update
|
||||
|
||||
if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
|
||||
sudo -E apt-get install -y docker-ce docker-ce-cli containerd.io
|
||||
elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
|
||||
elif [ "$DISTRO" == "raspbian" ]; then
|
||||
sudo -E apt install -y --no-install-recommends \
|
||||
docker-ce \
|
||||
cgroupfs-mount
|
||||
@@ -59,7 +59,7 @@ echo "Installing Docker Compose"
|
||||
# sudo chmod +x /usr/local/bin/docker-compose
|
||||
#elif [ "$DISTRO" == "raspbian" ]; then
|
||||
# Install required packages
|
||||
#sudo -E apt install -y python-backports.ssl-match-hostname
|
||||
sudo -E apt install -y python-backports.ssl-match-hostname
|
||||
|
||||
# Install Docker Compose from pip
|
||||
# This might take a while
|
||||
|
||||
@@ -72,17 +72,3 @@ echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
|
||||
JITSI_PROD_FILE="./.envs/.production/.jitsi"
|
||||
cp ./scripts/conf/jitsi.env $JITSI_PROD_FILE
|
||||
mkdir -p ./.envs/.production/.jitsi-cfg/{web/letsencrypt,transcripts,prosody,jicofo,jvb}
|
||||
sed -i "s/JICOFO_COMPONENT_SECRET.*/JICOFO_COMPONENT_SECRET=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
|
||||
sed -i "s/JICOFO_AUTH_PASSWORD.*/JICOFO_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
|
||||
sed -i "s/JVB_AUTH_PASSWORD.*/JVB_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
|
||||
sed -i "s/JIGASI_XMPP_PASSWORD.*/JIGASI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
|
||||
sed -i "s/JIBRI_RECORDER_PASSWORD.*/JIBRI_RECORDER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
|
||||
sed -i "s/JIBRI_XMPP_PASSWORD.*/JIBRI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
|
||||
|
||||
# Mattermost
|
||||
MATTERMOST_PROD_FILE="./.envs/.production/.mattermost"
|
||||
echo "MM_USERNAME=mmuser" > $MATTERMOST_PROD_FILE
|
||||
echo "MM_PASSWORD=$1" >> $MATTERMOST_PROD_FILE
|
||||
echo "MM_DBNAME=mattermost" >> $MATTERMOST_PROD_FILE
|
||||
POSTGRES_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
|
||||
echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> $MATTERMOST_PROD_FILE
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
KEY_FOLDER="/opt/mistborn_volumes/base/tls/"
|
||||
KEY_FOLDER="./tls/"
|
||||
CRT_FILE="cert.crt"
|
||||
KEY_FILE="cert.key"
|
||||
|
||||
@@ -11,15 +11,11 @@ KEY_PATH="$KEY_FOLDER/$KEY_FILE"
|
||||
sudo -E apt-get install -y openssl
|
||||
|
||||
# make folder
|
||||
sudo -E mkdir -p $KEY_FOLDER
|
||||
|
||||
# clean old crt and key
|
||||
sudo -E rm -f ${KEY_FOLDER}/*
|
||||
mkdir -p $KEY_FOLDER
|
||||
|
||||
# generate crt and key
|
||||
sudo -E openssl req -x509 -sha256 -nodes -days 397 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -addext "subjectAltName = DNS:*.mistborn" -addext extendedKeyUsage=serverAuth -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"
|
||||
openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"
|
||||
|
||||
# set permissions
|
||||
sudo -E chown -R mistborn:mistborn ${KEY_FOLDER}
|
||||
chmod 644 $CRT_PATH
|
||||
chmod 600 $KEY_PATH
|
||||
|
||||
@@ -9,19 +9,18 @@ if ! $(sudo apt-cache show wireguard > /dev/null 2>&1) ; then
|
||||
echo "Adding Wireguard PPAs"
|
||||
|
||||
# Wireguard
|
||||
if [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
|
||||
if [ "$DISTRO" == "raspbian" ]; then
|
||||
echo "Adding Wireguard repo keys"
|
||||
sudo -E apt-get install -y dirmngr
|
||||
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8B48AD6246925553
|
||||
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7638D0442B90D010
|
||||
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC
|
||||
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 648ACFD622F3D138
|
||||
fi
|
||||
|
||||
if [ "$DISTRO" == "ubuntu" ]; then
|
||||
# Ubuntu
|
||||
sudo add-apt-repository -y ppa:wireguard/wireguard
|
||||
elif [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
|
||||
elif [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ]; then
|
||||
# Debian
|
||||
sudo bash -c 'echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list'
|
||||
sudo bash -c "printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable"
|
||||
|
||||
+11
-6
@@ -10,14 +10,19 @@ sudo git -C /opt/mistborn submodule update --init --recursive
|
||||
# ensure mistborn-cli is installed
|
||||
sudo pip3 install -e /opt/mistborn/modules/mistborn-cli
|
||||
|
||||
# handle updates to Mistborn systemd scripts
|
||||
iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
|
||||
sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
|
||||
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=mistborn/"
|
||||
sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
|
||||
|
||||
# handle updates to traefik
|
||||
#sudo cp /opt/mistborn/compose/production/traefik/traefik.toml.template /opt/mistborn/compose/production/traefik/traefik.toml
|
||||
sudo cp /opt/mistborn/compose/production/traefik/traefik.toml.template /opt/mistborn/compose/production/traefik/traefik.toml
|
||||
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable Mistborn-setup.service
|
||||
sudo systemctl restart Mistborn-setup.service
|
||||
|
||||
sudo mistborn-cli pullbuild
|
||||
|
||||
sudo docker container prune -f
|
||||
sudo docker image prune -f
|
||||
|
||||
sudo systemctl stop Mistborn-base
|
||||
sudo systemctl restart Mistborn-setup
|
||||
sudo systemctl restart Mistborn-base
|
||||
|
||||
Reference in New Issue
Block a user