Merge branch '214-oracle' into 'master'

Resolve "Wireguard NO listen port and "Task dawnshard.tasks.wg_info_task" ERROR"

Closes #187, #213, and #214

See merge request cyber5k/mistborn!95

base.yml

@@ -119,7 +119,7 @@ services:
     restart: unless-stopped
   
   redis:
-    image: redis:6.2-alpine
+    image: redis:5.0
     container_name: mistborn_production_redis
     restart: unless-stopped
 
@@ -138,10 +138,8 @@ services:
       default:
       dns_net:
         ipv4_address: 10.2.1.3
-        ipv6_address: "fd0c:6164:c111:ecee::3"
     dns:
       - 10.2.1.2
-      - "fd0c:6164:c111:ecee::2"
     depends_on:
       - traefik
       - pihole
@@ -163,10 +161,8 @@ services:
       default:
       dns_net:
         ipv4_address: 10.2.1.4
-        ipv6_address: "fd0c:6164:c111:ecee::4"
     dns:
       - 10.2.1.2
-      - "fd0c:6164:c111:ecee::2"
     depends_on:
       - traefik
       - pihole
@@ -215,11 +211,10 @@ services:
       - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
    environment:
      - ServerIP=10.2.0.3
-     - PIHOLE_DNS_=10.2.0.2#5054;fdce:7a9e:13ce:d817::2#5054
-     - ServerIPv6=fdce:7a9e:13ce:d817::3
+     - PIHOLE_DNS_=10.2.0.2#5054
      #- DNS1='10.2.0.2#5054' # docs say port 5054, was 54; use network_mode: host to see which port is used
      #- DNS2=''
-     - IPv6=true
+     - IPv6='false'
      - DNSMASQ_LISTENING=all
    #  TZ: 'America/New York'
    # Volumes store your data between container upgrades
@@ -232,10 +227,8 @@ services:
      default:
      pihole_net:
        ipv4_address: 10.2.0.3
-       ipv6_address: "fdce:7a9e:13ce:d817::3"
      dns_net:
        ipv4_address: 10.2.1.2
-       ipv6_address: "fd0c:6164:c111:ecee::2"
    restart: unless-stopped
 
   dnscrypt-proxy:
@@ -249,34 +242,17 @@ services:
     networks:
       pihole_net:
         ipv4_address: 10.2.0.2
-        ipv6_address: "fdce:7a9e:13ce:d817::2"
     restart: unless-stopped
 
 
 networks:
-
-  default:
-    driver: bridge
-    driver_opts:
-      com.docker.network.enable_ipv6: "true"
-    ipam:
-      config:
-        - subnet: "fd39:4459:ffa9:a36f::/64"
-
   pihole_net:
     driver: bridge
-    driver_opts:
-      com.docker.network.enable_ipv6: "true"
     ipam:
       config:
         - subnet: 10.2.0.0/29
-        - subnet: "fdce:7a9e:13ce:d817::/64"
-  
   dns_net:
     driver: bridge
-    driver_opts:
-      com.docker.network.enable_ipv6: "true"
     ipam:
       config:
         - subnet: 10.2.1.0/24
-        - subnet: "fd0c:6164:c111:ecee::/64"

compose/production/postgres/Dockerfile

@@ -1,4 +1,4 @@
-FROM postgres:13.3-alpine
+FROM postgres:11.3
 
 COPY ./compose/production/postgres/maintenance /usr/local/bin/maintenance
 RUN chmod +x /usr/local/bin/maintenance/*

scripts/install.sh

@@ -105,13 +105,39 @@ source ./scripts/subinstallers/platform.sh
 
 # iptables
 echo "Setting up firewall (iptables)"
-if [ ! -f "/etc/iptables/rules.v4" ]; then
-    echo "Setting iptables rules..."
-    ./scripts/subinstallers/iptables.sh
+if [ -f "/etc/iptables/rules.v4" ]; then
+    echo "Caution: iptables rules exist."
+
+    read -p "Would you like to Clear (C) existing iptables rules or Add (A) to existing rules (this may cause problems)? [c/a] " MISTBORN_IPTABLES_ACTION
+    echo
+
+    if [[ "${MISTBORN_IPTABLES_ACTION}" =~ ^([cC])$ ]]; then
+    # clear
+        echo "Clearing existing iptables rules..."
+        sudo rm -rf /etc/iptables/rules.v4
+        sudo iptables -F
+        sudo iptables -t nat -F
+        sudo iptables -P INPUT ACCEPT
+        sudo iptables -P FORWARD ACCEPT
+        sudo rm -rf /etc/iptables/rules.v6 || true
+        sudo ip6tables -F || true
+        sudo ip6tables -t nat -F || true
+        sudo ip6tables -P INPUT ACCEPT || true
+        sudo ip6tables -P FORWARD ACCEPT || true
+
+    elif [[ "${MISTBORN_IPTABLES_ACTION}" =~ ^([aA])$ ]]; then
+    # do nothing
+        echo "Proceeding..."
+
     else
-    echo "iptables rules exist. Leaving alone."
+        echo "Unrecognized action: stopping"
+        exit 1;
+
+    fi
 fi
 
+echo "Setting iptables rules..."
+source ./scripts/subinstallers/iptables.sh
 
 # SSH Server
 sudo -E apt-get install -y openssh-server

scripts/subinstallers/iptables.sh

@@ -50,12 +50,8 @@ sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 if [ ! -z "${SSH_CLIENT}" ]; then
     SSH_SRC=$(echo $SSH_CLIENT | awk '{print $1}')
     SSH_PRT=$(echo $SSH_CLIENT | awk '{print $3}')
-    if [[ $SSH_SRC =~ .*:.* ]]; then
-        sudo ip6tables -A INPUT -p tcp -s $SSH_SRC --dport $SSH_PRT -j ACCEPT
-    else
     sudo iptables -A INPUT -p tcp -s $SSH_SRC --dport $SSH_PRT -j ACCEPT
 fi
-fi
 
 # docker rules
 sudo iptables -N MISTBORN_DOCKER_INPUT
@@ -95,15 +91,6 @@ echo "Setting ip6tables rules"
 sudo ip6tables -P INPUT ACCEPT
 sudo ip6tables -I INPUT -i lo -j ACCEPT
 sudo ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-# Allow as per RFC 4890
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 1   -j ACCEPT
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 2   -j ACCEPT
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3   -j ACCEPT
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 4   -j ACCEPT
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 133 -j ACCEPT
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 134 -j ACCEPT
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 135 -j ACCEPT
-sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 136 -j ACCEPT
 sudo ip6tables -A INPUT -j MISTBORN_LOG_DROP
 
 sudo ip6tables -P INPUT DROP