Compare commits
No commits in common. "main" and "feature/kunsi-ipv6-only-vlan" have entirely different histories.
main
...
feature/ku
261 changed files with 4146 additions and 3994 deletions
3
.envrc
3
.envrc
|
|
@ -1,3 +0,0 @@
|
|||
layout python3
|
||||
|
||||
source_env_if_exists .envrc.local
|
||||
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -1,5 +1,3 @@
|
|||
.secrets.cfg*
|
||||
__pycache__
|
||||
*.swp
|
||||
.direnv
|
||||
.envrc.local
|
||||
|
|
|
|||
|
|
@ -30,7 +30,6 @@ Rule of thumb: keep ports below 10000 free for stuff that reserves ports.
|
|||
| 20010 | mautrix-telegram | Bridge |
|
||||
| 20020 | mautrix-whatsapp | Bridge |
|
||||
| 20030 | matrix-dimension | Matrix Integrations Manager|
|
||||
| 20070 | matrix-synapse | sliding-sync |
|
||||
| 20080 | matrix-synapse | client, federation |
|
||||
| 20081 | matrix-synapse | prometheus metrics |
|
||||
| 20090 | matrix-media-repo | media_repo |
|
||||
|
|
|
|||
|
|
@ -6,9 +6,9 @@ apt-get update
|
|||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -q -o Dpkg::Options::=--force-confold dist-upgrade
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -q autoremove
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -q autoclean
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -q clean
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -q autoremove
|
||||
|
||||
% if clean_old_kernels:
|
||||
existing=$(dpkg --get-selections | grep -E '^linux-(image|headers)-[0-9]' || true)
|
||||
|
|
|
|||
1
bundles/apt/files/sources.list-raspbian-buster
Normal file
1
bundles/apt/files/sources.list-raspbian-buster
Normal file
|
|
@ -0,0 +1 @@
|
|||
deb http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi
|
||||
|
|
@ -7,6 +7,9 @@ supported_os = {
|
|||
12: 'bookworm',
|
||||
99: 'unstable',
|
||||
},
|
||||
'raspbian': {
|
||||
10: 'buster',
|
||||
},
|
||||
}
|
||||
|
||||
try:
|
||||
|
|
@ -24,10 +27,6 @@ actions = {
|
|||
'triggered': True,
|
||||
'cascade_skip': False,
|
||||
},
|
||||
'apt_execute_update_commands': {
|
||||
'command': ' && '.join(sorted(node.metadata.get('apt/additional_update_commands', {'true'}))),
|
||||
'triggered': True,
|
||||
},
|
||||
}
|
||||
|
||||
files = {
|
||||
|
|
|
|||
|
|
@ -21,9 +21,6 @@ defaults = {
|
|||
'cron/jobs/upgrade-and-reboot'
|
||||
)
|
||||
def patchday(metadata):
|
||||
if not node.metadata.get('apt/unattended-upgrades/enabled', True):
|
||||
return {}
|
||||
|
||||
day = metadata.get('apt/unattended-upgrades/day')
|
||||
hour = metadata.get('apt/unattended-upgrades/hour')
|
||||
|
||||
|
|
|
|||
5
bundles/arch-with-gui/files/50-network.conf
Normal file
5
bundles/arch-with-gui/files/50-network.conf
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
context.exec = [
|
||||
{ path = "pactl" args = "load-module module-native-protocol-tcp" }
|
||||
{ path = "pactl" args = "load-module module-zeroconf-discover" }
|
||||
{ path = "pactl" args = "load-module module-zeroconf-publish" }
|
||||
]
|
||||
3
bundles/arch-with-gui/files/autologin.conf
Normal file
3
bundles/arch-with-gui/files/autologin.conf
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
[Autologin]
|
||||
User=${user}
|
||||
Session=i3.desktop
|
||||
110
bundles/arch-with-gui/items.py
Normal file
110
bundles/arch-with-gui/items.py
Normal file
|
|
@ -0,0 +1,110 @@
|
|||
from os import listdir
|
||||
from os.path import join
|
||||
|
||||
actions = {
|
||||
'fc-cache_flush': {
|
||||
'command': 'fc-cache -f',
|
||||
'triggered': True,
|
||||
'needs': {
|
||||
'pkg_pacman:fontconfig',
|
||||
},
|
||||
},
|
||||
'i3pystatus_create_virtualenv': {
|
||||
'command': '/usr/bin/python3 -m virtualenv -p python3 /opt/i3pystatus/venv/',
|
||||
'unless': 'test -d /opt/i3pystatus/venv/',
|
||||
'needs': {
|
||||
'directory:/opt/i3pystatus/src',
|
||||
'pkg_pacman:python-virtualenv',
|
||||
},
|
||||
},
|
||||
'i3pystatus_install': {
|
||||
'command': ' && '.join([
|
||||
'cd /opt/i3pystatus/src',
|
||||
'/opt/i3pystatus/venv/bin/pip install --upgrade pip colour netifaces basiciw pytz',
|
||||
'/opt/i3pystatus/venv/bin/pip install --upgrade -e .',
|
||||
]),
|
||||
'needs': {
|
||||
'action:i3pystatus_create_virtualenv',
|
||||
},
|
||||
'triggered': True,
|
||||
},
|
||||
}
|
||||
|
||||
directories = {
|
||||
'/etc/sddm.conf.d': {
|
||||
'purge': True,
|
||||
},
|
||||
'/opt/i3pystatus/src': {},
|
||||
'/usr/share/fonts/bundlewrap': {
|
||||
'purge': True,
|
||||
'triggers': {
|
||||
'action:fc-cache_flush',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd = {
|
||||
'avahi-daemon': {
|
||||
'needs': {
|
||||
'pkg_pacman:avahi',
|
||||
},
|
||||
},
|
||||
'sddm': {
|
||||
'needs': {
|
||||
'pkg_pacman:sddm',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
git_deploy = {
|
||||
'/opt/i3pystatus/src': {
|
||||
'repo': 'https://github.com/enkore/i3pystatus.git',
|
||||
'rev': 'current',
|
||||
'triggers': {
|
||||
'action:i3pystatus_install',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
files['/etc/pipewire/pipewire-pulse.conf.d/50-network.conf'] = {}
|
||||
|
||||
for filename in listdir(join(repo.path, 'data', 'arch-with-gui', 'files', 'fonts')):
|
||||
if filename.startswith('.'):
|
||||
continue
|
||||
|
||||
if filename.endswith('.vault'):
|
||||
# XXX remove this once we have a new bundlewrap release
|
||||
# https://github.com/bundlewrap/bundlewrap/commit/2429b153dd1ca6781cf3812e2dec9c2b646a546b
|
||||
from os import environ
|
||||
if environ.get('BW_VAULT_DUMMY_MODE', '0') == '1':
|
||||
continue
|
||||
|
||||
font_name = filename[:-6]
|
||||
attrs = {
|
||||
'content': repo.vault.decrypt_file_as_base64(join('arch-with-gui', 'files', 'fonts', filename)),
|
||||
'content_type': 'base64',
|
||||
}
|
||||
else:
|
||||
font_name = filename
|
||||
attrs = {
|
||||
'source': join('fonts', filename),
|
||||
'content_type': 'binary',
|
||||
}
|
||||
|
||||
files[f'/usr/share/fonts/bundlewrap/{font_name}'] = {
|
||||
'triggers': {
|
||||
'action:fc-cache_flush',
|
||||
},
|
||||
**attrs,
|
||||
}
|
||||
|
||||
if node.metadata.get('arch-with-gui/autologin_as', None):
|
||||
files['/etc/sddm.conf.d/autologin.conf'] = {
|
||||
'context': {
|
||||
'user': node.metadata.get('arch-with-gui/autologin_as'),
|
||||
},
|
||||
'content_type': 'mako',
|
||||
'before': {
|
||||
'svc_systemd:sddm',
|
||||
},
|
||||
}
|
||||
124
bundles/arch-with-gui/metadata.py
Normal file
124
bundles/arch-with-gui/metadata.py
Normal file
|
|
@ -0,0 +1,124 @@
|
|||
assert node.os == 'arch'
|
||||
|
||||
defaults = {
|
||||
'backups': {
|
||||
'paths': {
|
||||
'/etc/netctl',
|
||||
},
|
||||
},
|
||||
'icinga_options': {
|
||||
'exclude_from_monitoring': True,
|
||||
},
|
||||
'nftables': {
|
||||
'input': {
|
||||
'50-avahi': {
|
||||
'udp dport 5353 accept',
|
||||
'udp sport 5353 accept',
|
||||
},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
# fonts
|
||||
'fontconfig': {},
|
||||
'ttf-dejavu': {
|
||||
'needed_by': {
|
||||
'pkg_pacman:sddm',
|
||||
},
|
||||
},
|
||||
|
||||
# login management
|
||||
'sddm': {},
|
||||
|
||||
# networking
|
||||
'avahi': {},
|
||||
'netctl': {},
|
||||
'rfkill': {},
|
||||
'wpa_supplicant': {},
|
||||
'wpa_actiond': {},
|
||||
|
||||
# shell and other gui stuff
|
||||
'dunst': {},
|
||||
'fish': {},
|
||||
'kitty': {},
|
||||
'libnotify': {}, # provides notify-send
|
||||
'light': {},
|
||||
'redshift': {},
|
||||
'rofi': {},
|
||||
|
||||
# sound
|
||||
'calf': {},
|
||||
'easyeffects': {},
|
||||
'lsp-plugins': {},
|
||||
'pavucontrol': {},
|
||||
'pipewire': {},
|
||||
'pipewire-jack': {},
|
||||
'pipewire-pulse': {},
|
||||
'pipewire-zeroconf': {},
|
||||
'qpwgraph': {},
|
||||
|
||||
# window management
|
||||
'i3-wm': {},
|
||||
'i3lock': {},
|
||||
'xss-lock': {},
|
||||
|
||||
# i3pystatus dependencies
|
||||
'iw': {},
|
||||
'wireless_tools': {},
|
||||
|
||||
# Xorg
|
||||
'xf86-input-libinput': {},
|
||||
'xf86-input-wacom': {},
|
||||
'xorg-server': {},
|
||||
'xorg-setxkbmap': {},
|
||||
'xorg-xev': {},
|
||||
'xorg-xinput': {},
|
||||
'xorg-xset': {},
|
||||
|
||||
# all them apps
|
||||
'browserpass': {},
|
||||
'browserpass-firefox': {},
|
||||
'ffmpeg': {},
|
||||
'firefox': {},
|
||||
'gimp': {},
|
||||
'imagemagick': {},
|
||||
'inkscape': {},
|
||||
'kdenlive': {},
|
||||
'maim': {},
|
||||
'mosh': {},
|
||||
'mosquitto': {},
|
||||
'mpv': {},
|
||||
'pass': {},
|
||||
'pass-otp': {},
|
||||
'pdftk': {},
|
||||
'pwgen': {},
|
||||
'qpdfview': {},
|
||||
'samba': {},
|
||||
'shotcut': {},
|
||||
'sipcalc': {},
|
||||
'the_silver_searcher': {},
|
||||
'tlp': {},
|
||||
'virt-manager': {},
|
||||
'xclip': {},
|
||||
'xdotool': {}, # needed for maim window selection
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'backups/paths',
|
||||
)
|
||||
def backup_every_user_home(metadata):
|
||||
paths = set()
|
||||
|
||||
for user, config in metadata.get('users', {}).items():
|
||||
if config.get('delete', False):
|
||||
continue
|
||||
|
||||
paths.add(config.get('home', f'/home/{user}'))
|
||||
|
||||
return {
|
||||
'backups': {
|
||||
'paths': paths,
|
||||
},
|
||||
}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
[server]
|
||||
host-name=${node.name.split('.')[-1]}
|
||||
use-ipv4=yes
|
||||
use-ipv6=${'yes' if node.metadata.get('avahi-daemon/use-ipv6') else 'no'}
|
||||
allow-interfaces=${','.join(sorted(node.metadata.get('interfaces', {}).keys()))}
|
||||
ratelimit-interval-usec=1000000
|
||||
ratelimit-burst=1000
|
||||
|
||||
[wide-area]
|
||||
enable-wide-area=yes
|
||||
|
||||
[publish]
|
||||
disable-publishing=no
|
||||
disable-user-service-publishing=no
|
||||
publish-hinfo=yes
|
||||
publish-workstation=no
|
||||
publish-aaaa-on-ipv4=no
|
||||
publish-a-on-ipv6=no
|
||||
|
||||
[reflector]
|
||||
|
||||
[rlimits]
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
directories['/etc/avahi/services'] = {
|
||||
'purge': True,
|
||||
}
|
||||
|
||||
files['/etc/avahi/avahi-daemon.conf'] = {
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:avahi-daemon:restart',
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd['avahi-daemon'] = {
|
||||
'needs': {
|
||||
'file:/etc/avahi/avahi-daemon.conf',
|
||||
'pkg_apt:avahi-daemon',
|
||||
'pkg_apt:libnss-mdns',
|
||||
},
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
defaults = {
|
||||
'apt': {
|
||||
'packages': {
|
||||
'avahi-daemon': {},
|
||||
'libnss-mdns': {},
|
||||
},
|
||||
},
|
||||
'avahi-daemon': {
|
||||
'use-ipv6': True,
|
||||
}
|
||||
}
|
||||
|
|
@ -62,13 +62,10 @@ trap "on_exit" EXIT
|
|||
|
||||
# redirect stdout and stderr to logfile
|
||||
prepare_and_cleanup_logdir
|
||||
if [[ -z "$DEBUG" ]]
|
||||
then
|
||||
logfile="$logdir/backup--$(date '+%F--%H-%M-%S')--$$.log.gz"
|
||||
echo "All log output will go to $logfile" | logger -it backup-client
|
||||
exec > >(gzip >"$logfile")
|
||||
exec 2>&1
|
||||
fi
|
||||
logfile="$logdir/backup--$(date '+%F--%H-%M-%S')--$$.log.gz"
|
||||
echo "All log output will go to $logfile" | logger -it backup-client
|
||||
exec > >(gzip >"$logfile")
|
||||
exec 2>&1
|
||||
|
||||
# this is where the real work starts
|
||||
ts_begin=$(date +%s)
|
||||
|
|
|
|||
|
|
@ -160,7 +160,7 @@ def monitoring(metadata):
|
|||
client,
|
||||
config['one_backup_every_hours'],
|
||||
),
|
||||
'vars.sshmon_timeout': 40,
|
||||
'vars.sshmon_timeout': 20,
|
||||
}
|
||||
|
||||
return {
|
||||
|
|
|
|||
|
|
@ -24,21 +24,11 @@ files = {
|
|||
'before': {
|
||||
'action:',
|
||||
'pkg_apt:',
|
||||
'pkg_pacman:',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if node.has_any_bundle([
|
||||
'dovecot',
|
||||
'nginx',
|
||||
'postfix',
|
||||
]):
|
||||
actions['generate-dhparam'] = {
|
||||
'command': 'openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048',
|
||||
'unless': 'test -f /etc/ssl/certs/dhparam.pem',
|
||||
}
|
||||
|
||||
|
||||
locale_needs = set()
|
||||
for locale in sorted(node.metadata.get('locale/installed')):
|
||||
actions[f'ensure_locale_{locale}_is_enabled'] = {
|
||||
|
|
@ -51,9 +41,11 @@ for locale in sorted(node.metadata.get('locale/installed')):
|
|||
}
|
||||
locale_needs = {f'action:ensure_locale_{locale}_is_enabled'}
|
||||
|
||||
actions['locale-gen'] = {
|
||||
'triggered': True,
|
||||
'command': 'locale-gen',
|
||||
actions = {
|
||||
'locale-gen': {
|
||||
'triggered': True,
|
||||
'command': 'locale-gen',
|
||||
},
|
||||
}
|
||||
|
||||
description = []
|
||||
|
|
|
|||
|
|
@ -1,5 +1,10 @@
|
|||
if node.os == 'arch':
|
||||
filename = '/etc/bird.conf'
|
||||
else:
|
||||
filename = '/etc/bird/bird.conf'
|
||||
|
||||
files = {
|
||||
'/etc/bird/bird.conf': {
|
||||
filename: {
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:bird:reload',
|
||||
|
|
@ -10,7 +15,7 @@ files = {
|
|||
svc_systemd = {
|
||||
'bird': {
|
||||
'needs': {
|
||||
f'file:/etc/bird/bird.conf',
|
||||
f'file:{filename}',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,9 +13,18 @@ defaults = {
|
|||
},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'bird': {
|
||||
'needed_by': {
|
||||
'svc_systemd:bird',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
'sysctl': {
|
||||
'options': {
|
||||
'net.ipv4.conf.all.forwarding': '1',
|
||||
'net.ipv4.ip_forward': '1',
|
||||
'net.ipv6.conf.all.forwarding': '1',
|
||||
},
|
||||
},
|
||||
|
|
|
|||
|
|
@ -7,6 +7,9 @@ supported_os = {
|
|||
12: 'bookworm',
|
||||
99: 'unstable',
|
||||
},
|
||||
'raspbian': {
|
||||
10: 'buster',
|
||||
},
|
||||
}
|
||||
|
||||
try:
|
||||
|
|
@ -79,10 +82,6 @@ actions = {
|
|||
'triggered': True,
|
||||
'cascade_skip': False,
|
||||
},
|
||||
'apt_execute_update_commands': {
|
||||
'command': ' && '.join(sorted(node.metadata.get('apt/additional_update_commands', {'true'}))),
|
||||
'triggered': True,
|
||||
},
|
||||
}
|
||||
|
||||
directories = {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,10 @@
|
|||
if node.os == 'arch':
|
||||
service_name = 'cronie'
|
||||
package_name = 'pkg_pacman:cronie'
|
||||
else:
|
||||
service_name = 'cron'
|
||||
package_name = 'pkg_apt:cron'
|
||||
|
||||
files = {
|
||||
'/etc/crontab': {
|
||||
'content_type': 'mako',
|
||||
|
|
@ -17,9 +24,9 @@ directories = {
|
|||
}
|
||||
|
||||
svc_systemd = {
|
||||
'cron': {
|
||||
service_name: {
|
||||
'needs': {
|
||||
'pkg_apt:cron',
|
||||
package_name,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,4 +4,9 @@ defaults = {
|
|||
'cron': {},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'cronie': {},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,39 +0,0 @@
|
|||
#!/usr/bin/env python3
|
||||
|
||||
from json import loads
|
||||
from subprocess import check_output
|
||||
from sys import argv
|
||||
|
||||
try:
|
||||
container_name = argv[1]
|
||||
|
||||
docker_ps = check_output([
|
||||
'docker',
|
||||
'container',
|
||||
'ls',
|
||||
'--all',
|
||||
'--format',
|
||||
'json',
|
||||
'--filter',
|
||||
f'name={container_name}'
|
||||
])
|
||||
|
||||
containers = loads(f"[{','.join([l for l in docker_ps.decode().splitlines() if l])}]")
|
||||
|
||||
if not containers:
|
||||
print(f'CRITICAL: container {container_name} not found!')
|
||||
exit(2)
|
||||
|
||||
if len(containers) > 1:
|
||||
print(f'Found more than one container matching {container_name}!')
|
||||
print(docker_ps)
|
||||
exit(3)
|
||||
|
||||
if containers[0]['State'] != 'running':
|
||||
print(f'WARNING: container {container_name} not "running"')
|
||||
exit(2)
|
||||
|
||||
print(f"OK: {containers[0]['Status']}")
|
||||
except Exception as e:
|
||||
print(repr(e))
|
||||
exit(2)
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
[[ -n "$DEBUG" ]] && set -x
|
||||
|
||||
ACTION="$1"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
if [[ -z "$ACTION" ]]
|
||||
then
|
||||
echo "Usage: $0 start|stop"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
PUID="$(id -u "docker-${name}")"
|
||||
PGID="$(id -g "docker-${name}")"
|
||||
|
||||
if [ "$ACTION" == "start" ]
|
||||
then
|
||||
docker run -d \
|
||||
--name "${name}" \
|
||||
--env "PUID=$PUID" \
|
||||
--env "PGID=$PGID" \
|
||||
--env "TZ=${timezone}" \
|
||||
% for k, v in sorted(environment.items()):
|
||||
--env "${k}=${v}" \
|
||||
% endfor
|
||||
--network host \
|
||||
% for host_port, container_port in sorted(ports.items()):
|
||||
--expose "127.0.0.1:${host_port}:${container_port}" \
|
||||
% endfor
|
||||
% for host_path, container_path in sorted(volumes.items()):
|
||||
--volume "/var/opt/docker-engine/${name}/${host_path}:${container_path}" \
|
||||
% endfor
|
||||
--restart unless-stopped \
|
||||
"${image}"
|
||||
|
||||
elif [ "$ACTION" == "stop" ]
|
||||
then
|
||||
docker stop "${name}"
|
||||
docker rm "${name}"
|
||||
|
||||
else
|
||||
echo "Unknown action $ACTION"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
% if node.has_bundle('nftables'):
|
||||
systemctl reload nftables
|
||||
% endif
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
[Unit]
|
||||
Description=docker-engine app ${name}
|
||||
After=network.target
|
||||
Requires=${' '.join(sorted(requires))}
|
||||
|
||||
[Service]
|
||||
WorkingDirectory=/var/opt/docker-engine/${name}/
|
||||
ExecStart=/opt/docker-engine/${name} start
|
||||
ExecStop=/opt/docker-engine/${name} stop
|
||||
Type=simple
|
||||
RemainAfterExit=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -1,99 +0,0 @@
|
|||
from bundlewrap.metadata import metadata_to_json
|
||||
|
||||
deps = {
|
||||
'pkg_apt:docker-ce',
|
||||
'pkg_apt:docker-ce-cli',
|
||||
}
|
||||
|
||||
directories['/opt/docker-engine'] = {
|
||||
'purge': True,
|
||||
}
|
||||
directories['/var/opt/docker-engine'] = {}
|
||||
|
||||
files['/etc/docker/daemon.json'] = {
|
||||
'content': metadata_to_json(node.metadata.get('docker-engine/config')),
|
||||
'triggers': {
|
||||
'svc_systemd:docker:restart',
|
||||
},
|
||||
# install config before installing packages to ensure the config is
|
||||
# applied to the first start as well
|
||||
'before': deps,
|
||||
}
|
||||
|
||||
svc_systemd['docker'] = {
|
||||
'needs': deps,
|
||||
}
|
||||
|
||||
files['/usr/local/share/icinga/plugins/check_docker_container'] = {
|
||||
'mode': '0755',
|
||||
}
|
||||
|
||||
for app, config in node.metadata.get('docker-engine/containers', {}).items():
|
||||
volumes = config.get('volumes', {})
|
||||
|
||||
files[f'/opt/docker-engine/{app}'] = {
|
||||
'source': 'docker-wrapper',
|
||||
'content_type': 'mako',
|
||||
'context': {
|
||||
'environment': config.get('environment', {}),
|
||||
'image': config['image'],
|
||||
'name': app,
|
||||
'ports': config.get('ports', {}),
|
||||
'timezone': node.metadata.get('timezone'),
|
||||
'volumes': volumes,
|
||||
},
|
||||
'mode': '0755',
|
||||
'triggers': {
|
||||
f'svc_systemd:docker-{app}:restart',
|
||||
},
|
||||
}
|
||||
|
||||
users[f'docker-{app}'] = {
|
||||
'home': f'/var/opt/docker-engine/{app}',
|
||||
'groups': {
|
||||
'docker',
|
||||
},
|
||||
'after': {
|
||||
# provides docker group
|
||||
'pkg_apt:docker-ce',
|
||||
},
|
||||
}
|
||||
|
||||
files[f'/usr/local/lib/systemd/system/docker-{app}.service'] = {
|
||||
'source': 'docker-wrapper.service',
|
||||
'content_type': 'mako',
|
||||
'context': {
|
||||
'name': app,
|
||||
'requires': {
|
||||
*set(config.get('requires', set())),
|
||||
'docker.service',
|
||||
}
|
||||
},
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
f'svc_systemd:docker-{app}:restart',
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd[f'docker-{app}'] = {
|
||||
'needs': {
|
||||
*deps,
|
||||
f'file:/opt/docker-engine/{app}',
|
||||
f'file:/usr/local/lib/systemd/system/docker-{app}.service',
|
||||
f'user:docker-{app}',
|
||||
'svc_systemd:docker',
|
||||
*set(config.get('needs', set())),
|
||||
},
|
||||
}
|
||||
|
||||
for volume in volumes:
|
||||
directories[f'/var/opt/docker-engine/{app}/{volume}'] = {
|
||||
'owner': f'docker-{app}',
|
||||
'group': f'docker-{app}',
|
||||
'needed_by': {
|
||||
f'svc_systemd:docker-{app}',
|
||||
},
|
||||
# don't do anything if the directory exists, docker images
|
||||
# mangle owners
|
||||
'unless': f'test -d /var/opt/docker-engine/{app}/{volume}',
|
||||
}
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
defaults = {
|
||||
'apt': {
|
||||
'packages': {
|
||||
'docker-ce': {},
|
||||
'docker-ce-cli': {},
|
||||
'docker-compose-plugin': {},
|
||||
},
|
||||
'repos': {
|
||||
'docker': {
|
||||
'items': {
|
||||
'deb https://download.docker.com/linux/debian {os_release} stable',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
'backups': {
|
||||
'paths': {
|
||||
'/var/opt/docker-engine',
|
||||
},
|
||||
},
|
||||
'hosts': {
|
||||
'entries': {
|
||||
'172.17.0.1': {
|
||||
'host.docker.internal',
|
||||
},
|
||||
},
|
||||
},
|
||||
'docker-engine': {
|
||||
'config': {
|
||||
'iptables': False,
|
||||
'no-new-privileges': True,
|
||||
},
|
||||
},
|
||||
'zfs': {
|
||||
'datasets': {
|
||||
'tank/docker-data': {
|
||||
'mountpoint': '/var/opt/docker-engine',
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'icinga2_api/docker-engine/services',
|
||||
)
|
||||
def monitoring(metadata):
|
||||
services = {
|
||||
'DOCKER PROCESS': {
|
||||
'command_on_monitored_host': '/usr/lib/nagios/plugins/check_procs -C dockerd -c 1:',
|
||||
},
|
||||
}
|
||||
|
||||
for app in metadata.get('docker-engine/containers', {}):
|
||||
services[f'DOCKER CONTAINER {app}'] = {
|
||||
'command_on_monitored_host': f'sudo /usr/local/share/icinga/plugins/check_docker_container {app}'
|
||||
}
|
||||
|
||||
return {
|
||||
'icinga2_api': {
|
||||
'docker-engine': {
|
||||
'services': services,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'zfs/datasets',
|
||||
)
|
||||
def zfs(metadata):
|
||||
datasets = {}
|
||||
|
||||
for app in metadata.get('docker-engine/containers', {}):
|
||||
datasets[f'tank/docker-data/{app}'] = {
|
||||
'mountpoint': f'/var/opt/docker-engine/{app}'
|
||||
}
|
||||
|
||||
return {
|
||||
'zfs': {
|
||||
'datasets': datasets,
|
||||
},
|
||||
}
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
assert node.has_bundle('docker-engine')
|
||||
assert node.has_bundle('redis')
|
||||
assert not node.has_bundle('postgresql') # docker container uses that port
|
||||
|
||||
defaults = {
|
||||
'docker-engine': {
|
||||
'containers': {
|
||||
'immich': {
|
||||
'image': 'ghcr.io/imagegenius/immich:latest',
|
||||
'environment': {
|
||||
'DB_DATABASE_NAME': 'immich',
|
||||
'DB_HOSTNAME': 'host.docker.internal',
|
||||
'DB_PASSWORD': repo.vault.password_for(f'{node.name} postgresql immich'),
|
||||
'DB_USERNAME': 'immich',
|
||||
'REDIS_HOSTNAME': 'host.docker.internal',
|
||||
},
|
||||
'volumes': {
|
||||
'config': '/config',
|
||||
'libraries': '/libraries',
|
||||
'photos': '/photos',
|
||||
},
|
||||
'needs': {
|
||||
'svc_systemd:docker-postgresql14',
|
||||
},
|
||||
'requires': {
|
||||
'docker-postgresql14.service',
|
||||
},
|
||||
},
|
||||
'postgresql14': {
|
||||
'image': 'tensorchord/pgvecto-rs:pg14-v0.2.0',
|
||||
'environment': {
|
||||
'POSTGRES_PASSWORD': repo.vault.password_for(f'{node.name} postgresql immich'),
|
||||
'POSTGRES_USER': 'immich',
|
||||
'POSTGRES_DB': 'immich',
|
||||
},
|
||||
'volumes': {
|
||||
'database': '/var/lib/postgresql/data',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
'nginx': {
|
||||
'vhosts': {
|
||||
'immich': {
|
||||
'locations': {
|
||||
'/': {
|
||||
'target': 'http://127.0.0.1:8080/',
|
||||
'websockets': True,
|
||||
'max_body_size': '500m',
|
||||
},
|
||||
#'/api/socket.io/': {
|
||||
# 'target': 'http://127.0.0.1:8081/',
|
||||
# 'websockets': True,
|
||||
#},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
'redis': {
|
||||
'bind': '0.0.0.0',
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -3,4 +3,3 @@ driver = pgsql
|
|||
default_pass_scheme = MD5-CRYPT
|
||||
password_query = SELECT username as user, password FROM mailbox WHERE username = '%u' AND active = true
|
||||
user_query = SELECT '/var/mail/vmail/' || maildir as home, 65534 as uid, 65534 as gid FROM mailbox WHERE username = '%u' AND active = true
|
||||
iterate_query = SELECT username as user FROM mailbox WHERE active = true
|
||||
|
|
|
|||
|
|
@ -28,19 +28,19 @@ namespace inbox {
|
|||
mail_location = maildir:/var/mail/vmail/%d/%n
|
||||
protocols = imap lmtp sieve
|
||||
|
||||
ssl = required
|
||||
ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/fullchain.pem
|
||||
ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/privkey.pem
|
||||
ssl_dh = </etc/ssl/certs/dhparam.pem
|
||||
ssl = yes
|
||||
ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/fullchain.pem
|
||||
ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/privkey.pem
|
||||
ssl_dh = </etc/dovecot/ssl/dhparam.pem
|
||||
ssl_min_protocol = TLSv1.2
|
||||
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
|
||||
ssl_prefer_server_ciphers = no
|
||||
ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM
|
||||
ssl_prefer_server_ciphers = yes
|
||||
|
||||
login_greeting = IMAPd ready
|
||||
auth_mechanisms = plain login
|
||||
first_valid_uid = 65534
|
||||
disable_plaintext_auth = yes
|
||||
mail_plugins = $mail_plugins zlib old_stats fts fts_xapian
|
||||
mail_plugins = $mail_plugins zlib old_stats
|
||||
|
||||
plugin {
|
||||
zlib_save_level = 6
|
||||
|
|
@ -56,15 +56,6 @@ plugin {
|
|||
old_stats_refresh = 30 secs
|
||||
old_stats_track_cmds = yes
|
||||
|
||||
fts = xapian
|
||||
fts_xapian = partial=3 full=20
|
||||
|
||||
fts_autoindex = yes
|
||||
fts_enforced = yes
|
||||
|
||||
# Index attachements
|
||||
fts_decoder = decode2text
|
||||
|
||||
% if node.has_bundle('rspamd'):
|
||||
sieve_before = /var/mail/vmail/sieve/global/spam-global.sieve
|
||||
|
||||
|
|
@ -95,19 +86,14 @@ service auth {
|
|||
}
|
||||
}
|
||||
|
||||
service decode2text {
|
||||
executable = script /usr/lib/dovecot/decode2text.sh
|
||||
user = dovecot
|
||||
unix_listener decode2text {
|
||||
mode = 0666
|
||||
service lmtp {
|
||||
unix_listener /var/spool/postfix/private/dovecot-lmtp {
|
||||
group = postfix
|
||||
mode = 0600
|
||||
user = postfix
|
||||
}
|
||||
}
|
||||
|
||||
service indexer-worker {
|
||||
vsz_limit = 0
|
||||
process_limit = 0
|
||||
}
|
||||
|
||||
service imap {
|
||||
executable = imap
|
||||
}
|
||||
|
|
@ -118,14 +104,6 @@ service imap-login {
|
|||
vsz_limit = 64M
|
||||
}
|
||||
|
||||
service lmtp {
|
||||
unix_listener /var/spool/postfix/private/dovecot-lmtp {
|
||||
group = postfix
|
||||
mode = 0600
|
||||
user = postfix
|
||||
}
|
||||
}
|
||||
|
||||
service managesieve-login {
|
||||
inet_listener sieve {
|
||||
port = 4190
|
||||
|
|
|
|||
|
|
@ -2,6 +2,10 @@
|
|||
# by this bundle
|
||||
repo.libs.tools.require_bundle(node, 'postfix')
|
||||
|
||||
directories = {
|
||||
'/etc/dovecot/ssl': {},
|
||||
}
|
||||
|
||||
files = {
|
||||
'/etc/dovecot/dovecot.conf': {
|
||||
'content_type': 'mako',
|
||||
|
|
@ -45,17 +49,25 @@ files = {
|
|||
},
|
||||
}
|
||||
|
||||
symlinks['/usr/lib/dovecot/decode2text.sh'] = {
|
||||
'target': '/usr/share/doc/dovecot-core/examples/decode2text.sh',
|
||||
'before': {
|
||||
'svc_systemd:dovecot',
|
||||
actions = {
|
||||
'dovecot_generate_dhparam': {
|
||||
'command': 'openssl dhparam -out /etc/dovecot/ssl/dhparam.pem 2048',
|
||||
'unless': 'test -f /etc/dovecot/ssl/dhparam.pem',
|
||||
'cascade_skip': False,
|
||||
'needs': {
|
||||
'directory:/etc/dovecot/ssl',
|
||||
'pkg_apt:'
|
||||
},
|
||||
'triggers': {
|
||||
'svc_systemd:dovecot:restart',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd = {
|
||||
'dovecot': {
|
||||
'needs': {
|
||||
'action:generate-dhparam',
|
||||
'action:dovecot_generate_dhparam',
|
||||
'file:/etc/dovecot/dovecot.conf',
|
||||
'file:/etc/dovecot/dovecot-sql.conf',
|
||||
},
|
||||
|
|
|
|||
|
|
@ -3,7 +3,6 @@ from bundlewrap.metadata import atomic
|
|||
defaults = {
|
||||
'apt': {
|
||||
'packages': {
|
||||
'dovecot-fts-xapian': {},
|
||||
'dovecot-imapd': {},
|
||||
'dovecot-lmtpd': {},
|
||||
'dovecot-managesieved': {},
|
||||
|
|
@ -36,16 +35,6 @@ defaults = {
|
|||
'dovecot',
|
||||
},
|
||||
},
|
||||
'systemd-timers': {
|
||||
'timers': {
|
||||
'dovecot_fts_optimize': {
|
||||
'command': [
|
||||
'/usr/bin/doveadm fts optimize -A',
|
||||
],
|
||||
'when': '02:{}:00'.format(node.magic_number % 60),
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if node.has_bundle('postfixadmin'):
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ actions = {
|
|||
'yarn build',
|
||||
]),
|
||||
'needs': {
|
||||
'action:apt_execute_update_commands',
|
||||
'action:nodejs_install_yarn',
|
||||
'pkg_apt:nodejs',
|
||||
},
|
||||
'triggered': True,
|
||||
|
|
|
|||
|
|
@ -11,26 +11,6 @@ defaults = {
|
|||
},
|
||||
}
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'nodejs/version',
|
||||
)
|
||||
def nodejs(metadata):
|
||||
version = tuple([int(i) for i in metadata.get('element-web/version')[1:].split('.')])
|
||||
|
||||
if version >= (1, 11, 71):
|
||||
return {
|
||||
'nodejs': {
|
||||
'version': 22,
|
||||
},
|
||||
}
|
||||
else:
|
||||
return {
|
||||
'nodejs': {
|
||||
'version': 18,
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'nginx/vhosts/element-web',
|
||||
)
|
||||
|
|
|
|||
|
|
@ -100,7 +100,7 @@ def nginx(metadata):
|
|||
},
|
||||
},
|
||||
'website_check_path': '/user/login',
|
||||
'website_check_string': 'Sign in',
|
||||
'website_check_string': 'Sign In',
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
|
|||
|
|
@ -43,7 +43,6 @@ def nginx(metadata):
|
|||
'locations': {
|
||||
'/': {
|
||||
'target': 'http://127.0.0.1:21010',
|
||||
'websockets': True,
|
||||
},
|
||||
'/api/ds/query': {
|
||||
'target': 'http://127.0.0.1:21010',
|
||||
|
|
|
|||
|
|
@ -72,6 +72,7 @@ actions = {
|
|||
'yarn build',
|
||||
]),
|
||||
'needs': {
|
||||
'action:nodejs_install_yarn',
|
||||
'file:/opt/hedgedoc/config.json',
|
||||
'git_deploy:/opt/hedgedoc',
|
||||
'pkg_apt:nodejs',
|
||||
|
|
|
|||
|
|
@ -2,42 +2,48 @@
|
|||
|
||||
from sys import exit
|
||||
|
||||
from packaging.version import parse
|
||||
from requests import get
|
||||
import requests
|
||||
from packaging import version
|
||||
|
||||
API_TOKEN = "${token}"
|
||||
DOMAIN = "${domain}"
|
||||
bearer = "${bearer}"
|
||||
domain = "${domain}"
|
||||
OK = 0
|
||||
WARN = 1
|
||||
CRITICAL = 2
|
||||
UNKNOWN = 3
|
||||
|
||||
status = 3
|
||||
message = "Unknown Update Status"
|
||||
|
||||
|
||||
domain = "hass.home.kunbox.net"
|
||||
|
||||
s = requests.Session()
|
||||
s.headers.update({"Content-Type": "application/json"})
|
||||
|
||||
try:
|
||||
r = get("https://version.home-assistant.io/stable.json")
|
||||
r.raise_for_status()
|
||||
stable_version = parse(r.json()["homeassistant"]["generic-x86-64"])
|
||||
except Exception as e:
|
||||
print(f"Could not get stable version information from home-assistant.io: {e!r}")
|
||||
exit(3)
|
||||
|
||||
try:
|
||||
r = get(
|
||||
f"https://{DOMAIN}/api/config",
|
||||
headers={"Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json"},
|
||||
stable_version = version.parse(
|
||||
s.get("https://version.home-assistant.io/stable.json").json()["homeassistant"][
|
||||
"generic-x86-64"
|
||||
]
|
||||
)
|
||||
r.raise_for_status()
|
||||
running_version = parse(r.json()["version"])
|
||||
except Exception as e:
|
||||
print(f"Could not get running version information from homeassistant: {e!r}")
|
||||
exit(3)
|
||||
|
||||
try:
|
||||
if stable_version > running_version:
|
||||
print(
|
||||
f"There is a newer version available: {stable_version} (currently installed: {running_version})"
|
||||
)
|
||||
exit(2)
|
||||
s.headers.update(
|
||||
{"Authorization": f"Bearer {bearer}", "Content-Type": "application/json"}
|
||||
)
|
||||
running_version = version.parse(
|
||||
s.get(f"https://{domain}/api/config").json()["version"]
|
||||
)
|
||||
if running_version == stable_version:
|
||||
status = 0
|
||||
message = f"OK - running version {running_version} equals stable version {stable_version}"
|
||||
elif running_version > stable_version:
|
||||
status = 1
|
||||
message = f"WARNING - stable version {stable_version} is lower than running version {running_version}, check if downgrade is necessary."
|
||||
else:
|
||||
print(
|
||||
f"Currently running version {running_version} matches newest release on home-assistant.io"
|
||||
)
|
||||
exit(0)
|
||||
status = 2
|
||||
message = f"CRITICAL - update necessary, running version {running_version} is lower than stable version {stable_version}"
|
||||
except Exception as e:
|
||||
print(repr(e))
|
||||
exit(3)
|
||||
message = f"{message}: {repr(e)}"
|
||||
|
||||
print(message)
|
||||
exit(status)
|
||||
|
|
|
|||
|
|
@ -5,8 +5,6 @@ After=network-online.target
|
|||
[Service]
|
||||
Type=simple
|
||||
User=homeassistant
|
||||
Environment="VIRTUAL_ENV=/opt/homeassistant/venv"
|
||||
Environment="PATH=/opt/homeassistant/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
WorkingDirectory=/var/opt/homeassistant
|
||||
ExecStart=/opt/homeassistant/venv/bin/hass -c "/var/opt/homeassistant"
|
||||
RestartForceExitStatus=100
|
||||
|
|
|
|||
|
|
@ -1,13 +1,6 @@
|
|||
if node.has_bundle('pyenv'):
|
||||
python_version = sorted(node.metadata.get('pyenv/python_versions'))[-1]
|
||||
python_path = f'/opt/pyenv/versions/{python_version}/bin/python'
|
||||
else:
|
||||
python_path = '/usr/bin/python3'
|
||||
|
||||
users = {
|
||||
'homeassistant': {
|
||||
'home': '/var/opt/homeassistant',
|
||||
"groups": ["dialout"],
|
||||
},
|
||||
}
|
||||
|
||||
|
|
@ -30,7 +23,7 @@ files = {
|
|||
'/usr/local/share/icinga/plugins/check_homeassistant_update': {
|
||||
'content_type': 'mako',
|
||||
'context': {
|
||||
'token': node.metadata.get('homeassistant/api_secret'),
|
||||
'bearer': repo.vault.decrypt(node.metadata.get('homeassistant/api_secret')),
|
||||
'domain': node.metadata.get('homeassistant/domain'),
|
||||
},
|
||||
'mode': '0755',
|
||||
|
|
@ -39,7 +32,7 @@ files = {
|
|||
|
||||
actions = {
|
||||
'homeassistant_create_virtualenv': {
|
||||
'command': f'sudo -u homeassistant virtualenv -p {python_path} /opt/homeassistant/venv/',
|
||||
'command': 'sudo -u homeassistant /usr/bin/python3 -m virtualenv -p python3 /opt/homeassistant/venv/',
|
||||
'unless': 'test -d /opt/homeassistant/venv/',
|
||||
'needs': {
|
||||
'directory:/opt/homeassistant',
|
||||
|
|
|
|||
|
|
@ -1,132 +0,0 @@
|
|||
#!/usr/bin/env python3
|
||||
|
||||
import re
|
||||
from hashlib import md5
|
||||
from sys import argv, exit
|
||||
|
||||
# Supress SSL certificate warnings for ssl_verify=False
|
||||
import urllib3
|
||||
from lxml import html
|
||||
from requests import Session
|
||||
|
||||
USERNAME_FIELD = "g2"
|
||||
PASSWORD_FIELD = "g3"
|
||||
CRSF_FIELD = "password"
|
||||
|
||||
STATUS_OK = 0
|
||||
STATUS_WARNING = 1
|
||||
STATUS_CRITICAL = 2
|
||||
STATUS_UNKNOWN = 3
|
||||
|
||||
|
||||
class OMMCrawler:
|
||||
def __init__(self, hostname, username, password):
|
||||
self.session = Session()
|
||||
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
||||
self.session.verify = False
|
||||
|
||||
self.url = f"https://{hostname}"
|
||||
self.login_data = {
|
||||
USERNAME_FIELD: username,
|
||||
PASSWORD_FIELD: password,
|
||||
CRSF_FIELD: md5(password.encode()).hexdigest(),
|
||||
}
|
||||
self.logged_in = False
|
||||
|
||||
def login(self):
|
||||
# if we have multiple dect masters, find out which one is the current master
|
||||
current_master_url = self.session.get(self.url, verify=False).url
|
||||
self.hostname = re.search(r"^(.*[\\\/])", current_master_url).group(0)[:-1]
|
||||
|
||||
response = self.session.post(f"{self.url}/login_set.html", data=self.login_data)
|
||||
response.raise_for_status()
|
||||
|
||||
# set cookie
|
||||
pass_value = re.search(r"(?<=pass=)\d+(?=;)", response.text).group(0)
|
||||
self.session.cookies.set("pass", pass_value)
|
||||
self.logged_in = True
|
||||
|
||||
def get_station_status(self):
|
||||
if not self.logged_in:
|
||||
self.login()
|
||||
|
||||
data = {}
|
||||
response = self.session.get(f"{self.url}/fp_pnp_status.html")
|
||||
response.raise_for_status()
|
||||
tree = html.fromstring(response.text)
|
||||
xpath_results = tree.xpath('//tr[@class="l0" or @class="l1"]')
|
||||
|
||||
for result in xpath_results:
|
||||
bubble_is_in_inactive_cluster = False
|
||||
bubble_is_connected = False
|
||||
bubble_is_active = False
|
||||
|
||||
bubble_name = result.xpath("td[4]/text()")[0]
|
||||
try:
|
||||
bubble_is_connected = result.xpath("td[11]/img/@alt")[0] == "yes"
|
||||
|
||||
if bubble_is_connected:
|
||||
try:
|
||||
bubble_is_active = result.xpath("td[12]/img/@alt")[0] == "yes"
|
||||
except IndexError:
|
||||
# If an IndexError occurs, there is no image in the
|
||||
# 12th td. This means this bubble is in the not inside
|
||||
# an active DECT cluster, but is a backup bubble.
|
||||
# This is probably fine.
|
||||
bubble_is_active = False
|
||||
bubble_is_in_inactive_cluster = True
|
||||
else:
|
||||
bubble_is_active = False
|
||||
except:
|
||||
# There is no Image in the 11th td. This usually means there
|
||||
# is a warning message in the 10th td. We do not care about
|
||||
# that, currently.
|
||||
pass
|
||||
|
||||
data[bubble_name] = {
|
||||
"is_connected": bubble_is_connected,
|
||||
"is_active": bubble_is_active,
|
||||
"is_in_inactive_cluster": bubble_is_in_inactive_cluster,
|
||||
}
|
||||
return data
|
||||
|
||||
def handle_station_data(self):
|
||||
try:
|
||||
data = self.get_station_status()
|
||||
except Exception as e:
|
||||
print(f"Something went wrong. You should take a look at {self.url}")
|
||||
print(repr(e))
|
||||
exit(STATUS_UNKNOWN)
|
||||
|
||||
critical = False
|
||||
for name, status in data.items():
|
||||
if not status["is_active"] and not status["is_connected"]:
|
||||
print(
|
||||
f"Base station {name} is not active or connected! Check manually!"
|
||||
)
|
||||
critical = True
|
||||
elif not status["is_active"] and not status["is_in_inactive_cluster"]:
|
||||
# Bubble is part of an active DECT cluster, but not active.
|
||||
# This shouldn't happen.
|
||||
print(
|
||||
f"Base station {name} is not active but connected! Check manually!"
|
||||
)
|
||||
critical = True
|
||||
elif not status["is_connected"]:
|
||||
# This should never happen. Seeing this state means OMM
|
||||
# itself is broken.
|
||||
print(
|
||||
f"Base station {name} is not connected but active! Check manually!"
|
||||
)
|
||||
critical = True
|
||||
|
||||
if critical:
|
||||
exit(STATUS_CRITICAL)
|
||||
else:
|
||||
print(f"OK - {len(data)} base stations connected")
|
||||
exit(STATUS_OK)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
omm = OMMCrawler(argv[1], argv[2], argv[3])
|
||||
omm.handle_station_data()
|
||||
|
|
@ -50,13 +50,17 @@ def check_list(ip_list, blocklist, warn_ips):
|
|||
]).decode().splitlines()
|
||||
for item in result:
|
||||
if item.startswith(';;'):
|
||||
continue
|
||||
msgs.append('{} listed in {} as {}'.format(
|
||||
ip,
|
||||
blocklist,
|
||||
item,
|
||||
))
|
||||
if item in warn_ips and returncode < 2:
|
||||
msgs.append('{} - {}'.format(
|
||||
blocklist,
|
||||
item,
|
||||
))
|
||||
else:
|
||||
msgs.append('{} listed in {} as {}'.format(
|
||||
ip,
|
||||
blocklist,
|
||||
item,
|
||||
))
|
||||
if (item in warn_ips or item.startswith(';;')) and returncode < 2:
|
||||
returncode = 1
|
||||
else:
|
||||
returncode = 2
|
||||
|
|
|
|||
|
|
@ -9,11 +9,6 @@ app = Flask(__name__)
|
|||
@app.route('/status')
|
||||
def statuspage():
|
||||
everything_fine = True
|
||||
try:
|
||||
check_output(['/usr/local/share/icinga/plugins/check_mounts'])
|
||||
except:
|
||||
everything_fine = False
|
||||
|
||||
try:
|
||||
check_output(['/usr/lib/nagios/plugins/check_procs', '-C', 'icinga2', '-c', '1:'])
|
||||
except:
|
||||
|
|
|
|||
|
|
@ -3,6 +3,8 @@ Description=Icinga2 Statusmonitor
|
|||
After=network.target
|
||||
|
||||
[Service]
|
||||
User=nagios
|
||||
Group=nagios
|
||||
Environment="FLASK_APP=/etc/icinga2/icinga_statusmonitor.py"
|
||||
ExecStart=/usr/bin/python3 -m flask run
|
||||
WorkingDirectory=/tmp
|
||||
|
|
|
|||
|
|
@ -113,14 +113,9 @@ def notify_per_ntfy():
|
|||
else:
|
||||
subject = '[ICINGA] {}'.format(args.host_name)
|
||||
|
||||
if args.notification_type.lower() == 'recovery':
|
||||
priority = 'default'
|
||||
else:
|
||||
priority = 'urgent'
|
||||
|
||||
headers = {
|
||||
'Title': subject,
|
||||
'Priority': priority,
|
||||
'Priority': 'urgent',
|
||||
}
|
||||
|
||||
try:
|
||||
|
|
@ -129,14 +124,11 @@ def notify_per_ntfy():
|
|||
data=message_text,
|
||||
headers=headers,
|
||||
auth=(CONFIG['ntfy']['user'], CONFIG['ntfy']['password']),
|
||||
timeout=10,
|
||||
)
|
||||
|
||||
r.raise_for_status()
|
||||
except Exception as e:
|
||||
log_to_syslog('Sending a Notification failed: {}'.format(repr(e)))
|
||||
return False
|
||||
return True
|
||||
|
||||
|
||||
def notify_per_mail():
|
||||
|
|
@ -202,8 +194,7 @@ if __name__ == '__main__':
|
|||
notify_per_mail()
|
||||
|
||||
if args.sms:
|
||||
ntfy_worked = False
|
||||
if CONFIG['ntfy']['user']:
|
||||
ntfy_worked = notify_per_ntfy()
|
||||
if not args.service_name or not ntfy_worked:
|
||||
if args.service_name:
|
||||
notify_per_sms()
|
||||
if CONFIG['ntfy']['user']:
|
||||
notify_per_ntfy()
|
||||
|
|
|
|||
|
|
@ -275,27 +275,6 @@ files = {
|
|||
'mode': '0660',
|
||||
'group': 'icingaweb2',
|
||||
},
|
||||
|
||||
# monitoring
|
||||
'/etc/icinga2/icinga_statusmonitor.py': {
|
||||
'triggers': {
|
||||
'svc_systemd:icinga_statusmonitor:restart',
|
||||
},
|
||||
},
|
||||
'/usr/local/lib/systemd/system/icinga_statusmonitor.service': {
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
'svc_systemd:icinga_statusmonitor:restart',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd['icinga_statusmonitor'] = {
|
||||
'needs': {
|
||||
'file:/etc/icinga2/icinga_statusmonitor.py',
|
||||
'file:/usr/local/lib/systemd/system/icinga_statusmonitor.service',
|
||||
'pkg_apt:python3-flask',
|
||||
},
|
||||
}
|
||||
|
||||
actions = {
|
||||
|
|
@ -337,12 +316,15 @@ for name in files:
|
|||
for name in symlinks:
|
||||
icinga_run_deps.add(f'symlink:{name}')
|
||||
|
||||
svc_systemd['icinga2'] = {
|
||||
'needs': icinga_run_deps,
|
||||
svc_systemd = {
|
||||
'icinga2': {
|
||||
'needs': icinga_run_deps,
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
# The actual hosts and services management starts here
|
||||
bundles = set()
|
||||
downtimes = []
|
||||
|
|
@ -401,6 +383,22 @@ for rnode in sorted(repo.nodes):
|
|||
DAYS_TO_STRING[day%7]: f'{hour}:{minute}-{hour}:{minute+15}',
|
||||
},
|
||||
})
|
||||
elif (
|
||||
rnode.has_bundle('pacman')
|
||||
and rnode.metadata.get('pacman/unattended-upgrades/is_enabled', False)
|
||||
):
|
||||
day = rnode.metadata.get('pacman/unattended-upgrades/day')
|
||||
hour = rnode.metadata.get('pacman/unattended-upgrades/hour')
|
||||
minute = rnode.magic_number%30
|
||||
|
||||
downtimes.append({
|
||||
'name': 'unattended-upgrades',
|
||||
'host': rnode.name,
|
||||
'comment': f'Downtime for upgrade-and-reboot of node {rnode.name}',
|
||||
'times': {
|
||||
DAYS_TO_STRING[day%7]: f'{hour}:{minute}-{hour}:{minute+15}',
|
||||
},
|
||||
})
|
||||
|
||||
files['/etc/icinga2/conf.d/groups.conf'] = {
|
||||
'source': 'icinga2/groups.conf',
|
||||
|
|
|
|||
|
|
@ -17,8 +17,8 @@ defaults = {
|
|||
'icinga2': {},
|
||||
'icinga2-ido-pgsql': {},
|
||||
'icingaweb2': {},
|
||||
'icingaweb2-module-monitoring': {},
|
||||
'python3-easysnmp': {},
|
||||
'python3-flask': {},
|
||||
'snmp': {},
|
||||
}
|
||||
},
|
||||
|
|
@ -131,9 +131,6 @@ def nginx(metadata):
|
|||
'/api/': {
|
||||
'target': 'https://127.0.0.1:5665/',
|
||||
},
|
||||
'/statusmonitor/': {
|
||||
'target': 'http://127.0.0.1:5000/',
|
||||
},
|
||||
},
|
||||
'extras': True,
|
||||
},
|
||||
|
|
|
|||
4
bundles/infobeamer-cms/files/settings.toml
Normal file
4
bundles/infobeamer-cms/files/settings.toml
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
<%
|
||||
from tomlkit import dumps as toml_dumps
|
||||
from bundlewrap.utils.text import toml_clean
|
||||
%>${toml_clean(toml_dumps(repo.libs.faults.resolve_faults(config), sort_keys=True))}
|
||||
|
|
@ -23,7 +23,7 @@ actions = {
|
|||
git_deploy = {
|
||||
'/opt/infobeamer-cms/src': {
|
||||
'rev': 'master',
|
||||
'repo': 'https://github.com/voc/infobeamer-cms.git',
|
||||
'repo': 'https://github.com/sophieschi/36c3-cms.git',
|
||||
'needs': {
|
||||
'directory:/opt/infobeamer-cms/src',
|
||||
},
|
||||
|
|
@ -68,7 +68,10 @@ for room, device_id in sorted(node.metadata.get('infobeamer-cms/rooms', {}).item
|
|||
|
||||
files = {
|
||||
'/opt/infobeamer-cms/settings.toml': {
|
||||
'content': repo.libs.faults.dict_as_toml(config),
|
||||
'content_type': 'mako',
|
||||
'context': {
|
||||
'config': config,
|
||||
},
|
||||
'triggers': {
|
||||
'svc_systemd:infobeamer-cms:restart',
|
||||
},
|
||||
|
|
@ -96,6 +99,14 @@ files = {
|
|||
},
|
||||
}
|
||||
|
||||
pkg_pip = {
|
||||
'github-flask': {
|
||||
'needed_by': {
|
||||
'svc_systemd:infobeamer-cms',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd = {
|
||||
'infobeamer-cms': {
|
||||
'needs': {
|
||||
|
|
|
|||
|
|
@ -1,13 +1,10 @@
|
|||
from datetime import datetime, timedelta, timezone
|
||||
|
||||
assert node.has_bundle('redis')
|
||||
from datetime import datetime, timedelta
|
||||
|
||||
defaults = {
|
||||
'infobeamer-cms': {
|
||||
'config': {
|
||||
'MAX_UPLOADS': 5,
|
||||
'PREFERRED_URL_SCHEME': 'https',
|
||||
'REDIS_HOST': '127.0.0.1',
|
||||
'SESSION_COOKIE_NAME': '__Host-sess',
|
||||
'STATIC_PATH': '/opt/infobeamer-cms/static',
|
||||
'URL_KEY': repo.vault.password_for(f'{node.name} infobeamer-cms url key'),
|
||||
|
|
@ -52,7 +49,7 @@ def nginx(metadata):
|
|||
'infobeamer-cms/config/TIME_MIN',
|
||||
)
|
||||
def event_times(metadata):
|
||||
event_start = datetime.strptime(metadata.get('infobeamer-cms/event_start_date'), '%Y-%m-%d').replace(tzinfo=timezone.utc)
|
||||
event_start = datetime.strptime(metadata.get('infobeamer-cms/event_start_date'), '%Y-%m-%d')
|
||||
event_duration = metadata.get('infobeamer-cms/event_duration_days', 4)
|
||||
|
||||
event_end = event_start + timedelta(days=event_duration)
|
||||
|
|
|
|||
4
bundles/infobeamer-monitor/files/config.toml
Normal file
4
bundles/infobeamer-monitor/files/config.toml
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
<%
|
||||
from tomlkit import dumps as toml_dumps
|
||||
from bundlewrap.utils.text import toml_clean
|
||||
%>${toml_clean(toml_dumps(repo.libs.faults.resolve_faults(config), sort_keys=True))}
|
||||
|
|
@ -1,10 +1,9 @@
|
|||
#!/usr/bin/env python3
|
||||
|
||||
import logging
|
||||
from datetime import datetime
|
||||
from datetime import datetime, timezone
|
||||
from json import dumps
|
||||
from time import sleep
|
||||
from zoneinfo import ZoneInfo
|
||||
|
||||
import paho.mqtt.client as mqtt
|
||||
from requests import RequestException, get
|
||||
|
|
@ -25,8 +24,7 @@ logging.basicConfig(
|
|||
)
|
||||
|
||||
LOG = logging.getLogger("main")
|
||||
TZ = ZoneInfo("Europe/Berlin")
|
||||
DUMP_TIME = "0900"
|
||||
MLOG = logging.getLogger("mqtt")
|
||||
|
||||
state = None
|
||||
|
||||
|
|
@ -40,10 +38,7 @@ def mqtt_out(message, level="INFO", device=None):
|
|||
key = "infobeamer"
|
||||
if device:
|
||||
key += f"/{device['id']}"
|
||||
if device["description"]:
|
||||
message = f"[{device['description']}] {message}"
|
||||
else:
|
||||
message = f"[{device['serial']}] {message}"
|
||||
message = f"[{device['description']}] {message}"
|
||||
|
||||
client.publish(
|
||||
CONFIG["mqtt"]["topic"],
|
||||
|
|
@ -60,20 +55,17 @@ def mqtt_out(message, level="INFO", device=None):
|
|||
def mqtt_dump_state(device):
|
||||
if not device["is_online"]:
|
||||
return
|
||||
|
||||
out = []
|
||||
if device["location"]:
|
||||
out.append("Location: {}".format(device["location"]))
|
||||
out.append("Setup: {} ({})".format(device["setup"]["name"], device["setup"]["id"]))
|
||||
out.append("Resolution: {}".format(device["run"].get("resolution", "unknown")))
|
||||
|
||||
mqtt_out(
|
||||
" - ".join(out),
|
||||
"Sync status: {} - Location: {} - Running Setup: {} ({}) - Resolution: {}".format(
|
||||
"yes" if device["is_synced"] else "syncing",
|
||||
device["location"],
|
||||
device["setup"]["name"],
|
||||
device["setup"]["id"],
|
||||
device["run"].get("resolution", "unknown"),
|
||||
),
|
||||
device=device,
|
||||
)
|
||||
|
||||
def is_dump_time():
|
||||
return datetime.now(TZ).strftime("%H%M") == DUMP_TIME
|
||||
|
||||
mqtt_out("Monitor starting up")
|
||||
while True:
|
||||
|
|
@ -86,14 +78,15 @@ while True:
|
|||
r.raise_for_status()
|
||||
ib_state = r.json()["devices"]
|
||||
except RequestException as e:
|
||||
LOG.exception("Could not get device data from info-beamer")
|
||||
LOG.exception("Could not get data from info-beamer")
|
||||
mqtt_out(
|
||||
f"Could not get device data from info-beamer: {e!r}",
|
||||
f"Could not get data from info-beamer: {e!r}",
|
||||
level="WARN",
|
||||
)
|
||||
else:
|
||||
new_state = {}
|
||||
for device in sorted(ib_state, key=lambda x: x["id"]):
|
||||
online_devices = set()
|
||||
for device in ib_state:
|
||||
did = str(device["id"])
|
||||
|
||||
if did in new_state:
|
||||
|
|
@ -101,8 +94,7 @@ while True:
|
|||
continue
|
||||
|
||||
new_state[did] = device
|
||||
# force information output for every online device at 09:00 CE(S)T
|
||||
must_dump_state = is_dump_time()
|
||||
must_dump_state = False
|
||||
|
||||
if state is not None:
|
||||
if did not in state:
|
||||
|
|
@ -145,15 +137,17 @@ while True:
|
|||
if device["is_online"]:
|
||||
if device["maintenance"]:
|
||||
mqtt_out(
|
||||
"maintenance required: {}".format(
|
||||
" ".join(sorted(device["maintenance"]))
|
||||
"maintenance required: {}".join(
|
||||
sorted(device["maintenance"])
|
||||
),
|
||||
level="WARN",
|
||||
device=device,
|
||||
)
|
||||
must_dump_state = True
|
||||
|
||||
if (
|
||||
device["location"] != state[did]["location"]
|
||||
device["is_synced"] != state[did]["is_synced"]
|
||||
or device["location"] != state[did]["location"]
|
||||
or device["setup"]["id"] != state[did]["setup"]["id"]
|
||||
or device["run"].get("resolution")
|
||||
!= state[did]["run"].get("resolution")
|
||||
|
|
@ -165,52 +159,23 @@ while True:
|
|||
else:
|
||||
LOG.info("adding device {} to empty state".format(device["id"]))
|
||||
|
||||
if device["is_online"]:
|
||||
online_devices.add(
|
||||
"{} ({})".format(
|
||||
device["id"],
|
||||
device["description"],
|
||||
)
|
||||
)
|
||||
|
||||
state = new_state
|
||||
|
||||
try:
|
||||
r = get(
|
||||
"https://info-beamer.com/api/v1/account",
|
||||
auth=("", CONFIG["api_key"]),
|
||||
)
|
||||
r.raise_for_status()
|
||||
ib_account = r.json()
|
||||
except RequestException as e:
|
||||
LOG.exception("Could not get account data from info-beamer")
|
||||
mqtt_out(
|
||||
f"Could not get account data from info-beamer: {e!r}",
|
||||
level="WARN",
|
||||
)
|
||||
else:
|
||||
available_credits = ib_account["balance"]
|
||||
if is_dump_time():
|
||||
mqtt_out(f"Available Credits: {available_credits}")
|
||||
|
||||
if available_credits < 50:
|
||||
mqtt_out(
|
||||
f"balance has dropped below 50 credits! (available: {available_credits})",
|
||||
level="ERROR",
|
||||
)
|
||||
elif available_credits < 100:
|
||||
mqtt_out(
|
||||
f"balance has dropped below 100 credits! (available: {available_credits})",
|
||||
level="WARN",
|
||||
)
|
||||
|
||||
for quota_name, quota_config in sorted(ib_account["quotas"].items()):
|
||||
value = quota_config["count"]["value"]
|
||||
limit = quota_config["count"]["limit"]
|
||||
if value > limit * 0.9:
|
||||
mqtt_out(
|
||||
f"quota {quota_name} is over 90% (limit {limit}, value {value})",
|
||||
level="ERROR",
|
||||
)
|
||||
elif value > limit * 0.8:
|
||||
mqtt_out(
|
||||
f"quota {quota_name} is over 80% (limit {limit}, value {value})",
|
||||
level="WARN",
|
||||
)
|
||||
|
||||
sleep(60)
|
||||
if (
|
||||
datetime.now(timezone.utc).strftime("%H%M") == "1312"
|
||||
and online_devices
|
||||
and int(datetime.now(timezone.utc).strftime("%S")) < 30
|
||||
):
|
||||
mqtt_out("Online Devices: {}".format(", ".join(sorted(online_devices))))
|
||||
sleep(30)
|
||||
except KeyboardInterrupt:
|
||||
break
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,10 @@
|
|||
assert node.has_bundle('infobeamer-cms') # uses same venv
|
||||
|
||||
files['/opt/infobeamer-monitor/config.toml'] = {
|
||||
'content': repo.libs.faults.dict_as_toml(node.metadata.get('infobeamer-monitor')),
|
||||
'content_type': 'mako',
|
||||
'context': {
|
||||
'config': node.metadata.get('infobeamer-monitor'),
|
||||
},
|
||||
'triggers': {
|
||||
'svc_systemd:infobeamer-monitor:restart',
|
||||
},
|
||||
|
|
|
|||
|
|
@ -19,4 +19,9 @@ defaults = {
|
|||
'/usr/bin/ipmitool *',
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'ipmitool': {},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -63,7 +63,7 @@ def firewall(metadata):
|
|||
return {
|
||||
'firewall': {
|
||||
'port_rules': {
|
||||
'8096/tcp': atomic(metadata.get('jellyfin/restrict-to', set())),
|
||||
'8096/tcp': atomic(metadata.get('jellyfin/restrict-to', {'*'})),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
actions['modprobe_jool'] = {
|
||||
'command': 'modprobe jool',
|
||||
'unless': 'lsmod | grep -F jool',
|
||||
}
|
||||
|
||||
actions['jool_add_nat64_instance'] = {
|
||||
'command': 'jool instance add "nat64" --netfilter --pool6 64:ff9b::/96',
|
||||
'unless': 'jool instance display --no-headers --csv | grep -E ",nat64,netfilter$"',
|
||||
'needs': {
|
||||
'action:modprobe_jool',
|
||||
'pkg_apt:jool-dkms',
|
||||
'pkg_apt:jool-tools',
|
||||
'pkg_apt:linux-headers-amd64',
|
||||
},
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
defaults = {
|
||||
'apt': {
|
||||
'packages': {
|
||||
'jool-dkms': {},
|
||||
'jool-tools': {},
|
||||
'linux-headers-amd64': {},
|
||||
},
|
||||
},
|
||||
'modules': {
|
||||
'jool': [
|
||||
'jool',
|
||||
],
|
||||
},
|
||||
}
|
||||
4
bundles/jugendhackt_tools/files/config.toml
Normal file
4
bundles/jugendhackt_tools/files/config.toml
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
<%
|
||||
from tomlkit import dumps as toml_dumps
|
||||
from bundlewrap.utils.text import toml_clean
|
||||
%>${toml_clean(toml_dumps(repo.libs.faults.resolve_faults(node.metadata.get('jugendhackt_tools')), sort_keys=True))}
|
||||
|
|
@ -47,7 +47,7 @@ actions['jugendhackt_tools_migrate'] = {
|
|||
}
|
||||
|
||||
files['/opt/jugendhackt_tools/config.toml'] = {
|
||||
'content': repo.libs.faults.dict_as_toml(node.metadata.get('jugendhackt_tools')),
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:jugendhackt_tools:restart',
|
||||
},
|
||||
|
|
|
|||
|
|
@ -1,8 +0,0 @@
|
|||
# This file is managed using bundlewrap
|
||||
% for identifier, modules in sorted(node.metadata.get('modules', {}).items()):
|
||||
|
||||
# ${identifier}
|
||||
% for module in modules:
|
||||
${module}
|
||||
% endfor
|
||||
% endfor
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
files['/etc/modules'] = {
|
||||
'content_type': 'mako',
|
||||
}
|
||||
|
|
@ -13,6 +13,15 @@ defaults = {
|
|||
},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'dehydrated': {
|
||||
'needed_by': {
|
||||
'action:letsencrypt_update_certificates',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -30,7 +39,6 @@ def cron(metadata):
|
|||
'/usr/bin/dehydrated --cleanup',
|
||||
],
|
||||
'when': '04:{}:00'.format(node.magic_number % 60),
|
||||
'exclude_from_monitoring': True,
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
|
|||
|
|
@ -10,4 +10,15 @@ defaults = {
|
|||
},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'lldpd': {
|
||||
'needed_by': {
|
||||
'directory:/etc/lldpd.d',
|
||||
'file:/etc/lldpd.conf',
|
||||
'svc_systemd:lldpd',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,6 +4,11 @@ defaults = {
|
|||
'lm-sensors': {},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'lm_sensors': {},
|
||||
},
|
||||
},
|
||||
'telegraf': {
|
||||
'input_plugins': {
|
||||
'builtin': {
|
||||
|
|
|
|||
|
|
@ -3,9 +3,6 @@ repo:
|
|||
bindAddress: '${node.metadata.get('matrix-media-repo/listen-addr', '127.0.0.1')}'
|
||||
port: ${node.metadata.get('matrix-media-repo/port', 20090)}
|
||||
logDirectory: '-'
|
||||
logColors: false
|
||||
jsonLogs: false
|
||||
logLevel: 'info'
|
||||
trustAnyForwardedAddress: false
|
||||
useForwardedHost: true
|
||||
|
||||
|
|
@ -25,13 +22,10 @@ homeservers:
|
|||
csApi: "${config['domain']}"
|
||||
backoffAt: ${config.get('backoff_at', 10)}
|
||||
adminApiKind: "${config.get('api', 'matrix')}"
|
||||
% if config.get('signing_key_path'):
|
||||
signingKeyPath: "${config['signing_key_path']}"
|
||||
% endif
|
||||
% endfor
|
||||
|
||||
accessTokens:
|
||||
maxCacheTimeSeconds: 10
|
||||
maxCacheTimeSeconds: 0
|
||||
useLocalAppserviceConfig: false
|
||||
|
||||
admins:
|
||||
|
|
@ -59,9 +53,7 @@ archiving:
|
|||
uploads:
|
||||
maxBytes: ${node.metadata.get('matrix-media-repo/upload_max_mb')*1024*1024}
|
||||
minBytes: 100
|
||||
#reportedMaxBytes: 0
|
||||
maxPending: 5
|
||||
maxAgeSeconds: 1800
|
||||
reportedMaxBytes: 0
|
||||
quotas:
|
||||
enabled: false
|
||||
|
||||
|
|
@ -69,6 +61,14 @@ downloads:
|
|||
maxBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*1024*1024}
|
||||
numWorkers: ${node.metadata.get('matrix-media-repo/workers')}
|
||||
failureCacheMinutes: 5
|
||||
cache:
|
||||
enabled: true
|
||||
maxSizeBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*10*1024*1024}
|
||||
maxFileSizeBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*1024*1024}
|
||||
trackedMinutes: 30
|
||||
minDownloads: 5
|
||||
minCacheTimeSeconds: 300
|
||||
minEvictedTimeSeconds: 60
|
||||
expireAfterDays: 0
|
||||
|
||||
urlPreviews:
|
||||
|
|
@ -137,8 +137,8 @@ thumbnails:
|
|||
|
||||
rateLimit:
|
||||
enabled: true
|
||||
requestsPerSecond: 100
|
||||
burst: 5000
|
||||
requestsPerSecond: 10
|
||||
burst: 50
|
||||
|
||||
identicons:
|
||||
enabled: true
|
||||
|
|
|
|||
|
|
@ -19,6 +19,9 @@ files = {
|
|||
'/opt/matrix-media-repo/config.yaml': {
|
||||
'owner': 'matrix-media-repo',
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:matrix-media-repo:restart',
|
||||
},
|
||||
},
|
||||
'/etc/systemd/system/matrix-media-repo.service': {
|
||||
'triggers': {
|
||||
|
|
|
|||
|
|
@ -1,27 +0,0 @@
|
|||
<%
|
||||
database = node.metadata.get('matrix-synapse/database')
|
||||
db_string = 'postgresql://{}:{}@{}/{}?sslmode=disable'.format(
|
||||
database['user'],
|
||||
database['password'],
|
||||
database.get('host', 'localhost'),
|
||||
database['database'],
|
||||
)
|
||||
%>\
|
||||
[Unit]
|
||||
Description=matrix-org sliding-sync proxy
|
||||
After=network.target
|
||||
Requires=postgresql.service
|
||||
|
||||
[Service]
|
||||
User=matrix-synapse
|
||||
Group=matrix-synapse
|
||||
Environment=SYNCV3_SERVER=https://${node.metadata.get('matrix-synapse/baseurl')}
|
||||
Environment=SYNCV3_DB=${db_string}
|
||||
Environment=SYNCV3_SECRET=${node.metadata.get('matrix-synapse/sliding_sync/secret')}
|
||||
Environment=SYNCV3_BINDADDR=127.0.0.1:20070
|
||||
ExecStart=/usr/local/bin/matrix-sliding-sync
|
||||
Restart=always
|
||||
RestartSec=10s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -57,32 +57,3 @@ svc_systemd = {
|
|||
},
|
||||
},
|
||||
}
|
||||
|
||||
if node.metadata.get('matrix-synapse/sliding_sync/version', None):
|
||||
files['/usr/local/bin/matrix-sliding-sync'] = {
|
||||
'content_type': 'download',
|
||||
'source': 'https://github.com/matrix-org/sliding-sync/releases/download/{}/syncv3_linux_amd64'.format(
|
||||
node.metadata.get('matrix-synapse/sliding_sync/version'),
|
||||
),
|
||||
'content_hash': node.metadata.get('matrix-synapse/sliding_sync/sha1', None),
|
||||
'mode': '0755',
|
||||
'triggers': {
|
||||
'svc_systemd:matrix-sliding-sync:restart',
|
||||
},
|
||||
}
|
||||
|
||||
files['/usr/local/lib/systemd/system/matrix-sliding-sync.service'] = {
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
'svc_systemd:matrix-sliding-sync:restart',
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd['matrix-sliding-sync'] = {
|
||||
'needs': {
|
||||
'file:/usr/local/bin/matrix-sliding-sync',
|
||||
'file:/usr/local/lib/systemd/system/matrix-sliding-sync.service',
|
||||
'postgres_db:synapse',
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -88,14 +88,6 @@ def nginx(metadata):
|
|||
if not node.has_bundle('nginx'):
|
||||
raise DoNotRunAgain
|
||||
|
||||
wellknown_client_sliding_sync = {}
|
||||
if metadata.get('matrix-synapse/sliding_sync/version', None):
|
||||
wellknown_client_sliding_sync = {
|
||||
'org.matrix.msc3575.proxy': {
|
||||
'url': 'https://{}'.format(metadata.get('matrix-synapse/baseurl')),
|
||||
},
|
||||
}
|
||||
|
||||
wellknown = {
|
||||
'/.well-known/matrix/client': {
|
||||
'content': dumps({
|
||||
|
|
@ -105,7 +97,6 @@ def nginx(metadata):
|
|||
'm.identity_server': {
|
||||
'base_url': metadata.get('matrix-synapse/identity_server', 'https://matrix.org'),
|
||||
},
|
||||
**wellknown_client_sliding_sync,
|
||||
**metadata.get('matrix-synapse/additional_client_config', {}),
|
||||
}, sort_keys=True),
|
||||
'return': 200,
|
||||
|
|
@ -127,16 +118,10 @@ def nginx(metadata):
|
|||
}
|
||||
|
||||
locations = {
|
||||
'/_client/': {
|
||||
'target': 'http://127.0.0.1:20070',
|
||||
},
|
||||
'/_matrix': {
|
||||
'target': 'http://[::1]:20080',
|
||||
'max_body_size': '50M',
|
||||
},
|
||||
'/_matrix/client/unstable/org.matrix.msc3575/sync': {
|
||||
'target': 'http://127.0.0.1:20070',
|
||||
},
|
||||
'/_synapse': {
|
||||
'target': 'http://[::1]:20080',
|
||||
},
|
||||
|
|
@ -144,14 +129,13 @@ def nginx(metadata):
|
|||
}
|
||||
|
||||
if node.has_bundle('matrix-media-repo'):
|
||||
for path in ('/_matrix/media', '/_matrix/client/v1/media', '/_matrix/federation/v1/media'):
|
||||
locations[path] = {
|
||||
'target': 'http://localhost:20090',
|
||||
'max_body_size': '{}M'.format(metadata.get('matrix-media-repo/upload_max_mb')),
|
||||
# matrix-media-repo needs this to be the
|
||||
# homeserver address.
|
||||
'x_forwarded_host': metadata.get('matrix-synapse/server_name'),
|
||||
}
|
||||
locations['/_matrix/media'] = {
|
||||
'target': 'http://localhost:20090',
|
||||
'max_body_size': '{}M'.format(metadata.get('matrix-media-repo/upload_max_mb')),
|
||||
# matrix-media-repo needs this to be the
|
||||
# homeserver address.
|
||||
'x_forwarded_host': metadata.get('matrix-synapse/server_name'),
|
||||
}
|
||||
|
||||
vhosts = {
|
||||
'matrix-synapse': {
|
||||
|
|
|
|||
|
|
@ -1,15 +1,11 @@
|
|||
#!/bin/bash
|
||||
|
||||
OPTS="--netrc"
|
||||
OPTS="$OPTS --netrc-location /opt/mixcloud-downloader/netrc"
|
||||
OPTS="$OPTS --retry-sleep linear=1::2"
|
||||
OPTS="$OPTS --retry-sleep fragment:exp=1:60"
|
||||
OPTS="$OPTS --extractor-retries 5"
|
||||
OPTS=""
|
||||
if [[ -n "$DEBUG" ]]
|
||||
then
|
||||
set -x
|
||||
else
|
||||
OPTS="$OPTS -q"
|
||||
OPTS="-q"
|
||||
fi
|
||||
|
||||
set -euo pipefail
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
% for domain, data in sorted(node.metadata.get('mixcloud-downloader/netrc', {}).items()):
|
||||
machine ${domain} login ${data['username']} password ${data['password']}
|
||||
% endfor
|
||||
|
|
@ -6,9 +6,3 @@ files['/opt/mixcloud-downloader/download.sh'] = {
|
|||
directories['/opt/mixcloud-downloader'] = {
|
||||
'owner': 'kunsi',
|
||||
}
|
||||
|
||||
files['/opt/mixcloud-downloader/netrc'] = {
|
||||
'content_type': 'mako',
|
||||
'mode': '0400',
|
||||
'owner': 'kunsi',
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,6 +5,12 @@ files = {
|
|||
'svc_systemd:mosquitto:restart',
|
||||
},
|
||||
},
|
||||
'/usr/local/bin/tasmota-telegraf-plugin': {
|
||||
'mode': '0755',
|
||||
'needs': {
|
||||
'pkg_apt:python3-paho-mqtt',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd = {
|
||||
|
|
@ -17,12 +23,6 @@ svc_systemd = {
|
|||
}
|
||||
|
||||
if node.has_bundle('telegraf'):
|
||||
files['/usr/local/bin/tasmota-telegraf-plugin'] = {
|
||||
'mode': '0755',
|
||||
'needs': {
|
||||
'pkg_apt:python3-paho-mqtt',
|
||||
},
|
||||
'triggers': {
|
||||
'svc_systemd:telegraf:restart',
|
||||
},
|
||||
files['/usr/local/bin/tasmota-telegraf-plugin']['triggers'] = {
|
||||
'svc_systemd:telegraf:restart',
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@ defaults = {
|
|||
'packages': {
|
||||
'mosquitto': {},
|
||||
'mosquitto-clients': {},
|
||||
'python3-paho-mqtt': {}, # for telegraf plugin
|
||||
},
|
||||
},
|
||||
'icinga2_api': {
|
||||
|
|
@ -23,9 +24,6 @@ defaults = {
|
|||
},
|
||||
}
|
||||
|
||||
if node.has_bundle('telegraf'):
|
||||
defaults['apt']['packages']['python3-paho-mqtt'] = {}
|
||||
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'firewall/port_rules',
|
||||
|
|
|
|||
|
|
@ -1,138 +1,124 @@
|
|||
users['netbox'] = {
|
||||
'home': '/opt/netbox',
|
||||
}
|
||||
|
||||
directories['/opt/netbox/src'] = {}
|
||||
|
||||
directories['/opt/netbox/media'] = {
|
||||
'owner': 'netbox',
|
||||
}
|
||||
|
||||
directories['/opt/netbox/scripts'] = {
|
||||
'owner': 'netbox',
|
||||
}
|
||||
|
||||
git_deploy['/opt/netbox/src'] = {
|
||||
'repo': 'https://github.com/netbox-community/netbox.git',
|
||||
'rev': node.metadata.get('netbox/version'),
|
||||
'triggers': {
|
||||
'action:netbox_install',
|
||||
'svc_systemd:netbox-web:restart',
|
||||
'svc_systemd:netbox-worker:restart',
|
||||
users = {
|
||||
'netbox': {
|
||||
'home': '/opt/netbox',
|
||||
},
|
||||
'tags': {
|
||||
'netbox-install',
|
||||
}
|
||||
|
||||
directories = {
|
||||
'/opt/netbox/src': {},
|
||||
'/opt/netbox/media': {
|
||||
'owner': 'netbox',
|
||||
},
|
||||
'/opt/netbox/scripts': {
|
||||
'owner': 'netbox',
|
||||
},
|
||||
}
|
||||
|
||||
git_deploy = {
|
||||
'/opt/netbox/src': {
|
||||
'repo': 'https://github.com/netbox-community/netbox.git',
|
||||
'rev': node.metadata.get('netbox/version'),
|
||||
'triggers': {
|
||||
'action:netbox_install',
|
||||
'action:netbox_upgrade',
|
||||
'svc_systemd:netbox-web:restart',
|
||||
'svc_systemd:netbox-worker:restart',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
# This is a recreation of https://github.com/netbox-community/netbox/blob/develop/upgrade.sh
|
||||
actions['netbox_create_virtualenv'] = {
|
||||
'command': '/usr/bin/python3 -m virtualenv -p python3 /opt/netbox/venv',
|
||||
'unless': 'test -d /opt/netbox/venv/',
|
||||
'needed_by': {
|
||||
'action:netbox_install',
|
||||
actions = {
|
||||
'netbox_create_virtualenv': {
|
||||
'command': '/usr/bin/python3 -m virtualenv -p python3 /opt/netbox/venv',
|
||||
'unless': 'test -d /opt/netbox/venv/',
|
||||
'needed_by': {
|
||||
'action:netbox_install',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
actions['netbox_install'] = {
|
||||
'triggered': True,
|
||||
'command': ' && '.join([
|
||||
'cd /opt/netbox/src',
|
||||
'/opt/netbox/venv/bin/pip install --upgrade pip wheel setuptools django-auth-ldap gunicorn',
|
||||
'/opt/netbox/venv/bin/pip install --upgrade -r requirements.txt',
|
||||
]),
|
||||
'needs': {
|
||||
'pkg_apt:build-essential',
|
||||
'pkg_apt:graphviz',
|
||||
'pkg_apt:libffi-dev',
|
||||
'pkg_apt:libldap2-dev',
|
||||
'pkg_apt:libpq-dev',
|
||||
'pkg_apt:libsasl2-dev',
|
||||
'pkg_apt:libssl-dev',
|
||||
'pkg_apt:libxml2-dev',
|
||||
'pkg_apt:libxslt1-dev',
|
||||
'pkg_apt:python3-dev',
|
||||
'pkg_apt:zlib1g-dev',
|
||||
},
|
||||
'tags': {
|
||||
'netbox-install',
|
||||
},
|
||||
}
|
||||
|
||||
last_action = 'netbox_install'
|
||||
for upgrade_command in (
|
||||
'migrate',
|
||||
'trace_paths --no-input',
|
||||
'collectstatic --no-input',
|
||||
'remove_stale_contenttypes --no-input',
|
||||
'reindex --lazy',
|
||||
'clearsessions',
|
||||
):
|
||||
actions[f'netbox_upgrade_{upgrade_command.split()[0]}'] = {
|
||||
'netbox_install': {
|
||||
'triggered': True,
|
||||
'command': f'/opt/netbox/venv/bin/python /opt/netbox/src/netbox/manage.py {upgrade_command}',
|
||||
'command': ' && '.join([
|
||||
'cd /opt/netbox/src',
|
||||
'/opt/netbox/venv/bin/pip install --upgrade pip wheel setuptools django-auth-ldap gunicorn',
|
||||
'/opt/netbox/venv/bin/pip install --upgrade -r requirements.txt',
|
||||
]),
|
||||
'needs': {
|
||||
f'action:{last_action}',
|
||||
'pkg_apt:build-essential',
|
||||
'pkg_apt:graphviz',
|
||||
'pkg_apt:libffi-dev',
|
||||
'pkg_apt:libldap2-dev',
|
||||
'pkg_apt:libpq-dev',
|
||||
'pkg_apt:libsasl2-dev',
|
||||
'pkg_apt:libssl-dev',
|
||||
'pkg_apt:libxml2-dev',
|
||||
'pkg_apt:libxslt1-dev',
|
||||
'pkg_apt:python3-dev',
|
||||
'pkg_apt:zlib1g-dev',
|
||||
}
|
||||
},
|
||||
'netbox_upgrade': {
|
||||
'triggered': True,
|
||||
'command': ' && '.join([
|
||||
'/opt/netbox/venv/bin/python /opt/netbox/src/netbox/manage.py migrate',
|
||||
'/opt/netbox/venv/bin/python /opt/netbox/src/netbox/manage.py collectstatic --no-input',
|
||||
'/opt/netbox/venv/bin/python /opt/netbox/src/netbox/manage.py remove_stale_contenttypes --no-input',
|
||||
'/opt/netbox/venv/bin/python /opt/netbox/src/netbox/manage.py clearsessions',
|
||||
]),
|
||||
'needs': {
|
||||
'action:netbox_install',
|
||||
'file:/opt/netbox/src/netbox/netbox/configuration.py',
|
||||
},
|
||||
'tags': {
|
||||
'netbox-upgrade',
|
||||
},
|
||||
}
|
||||
|
||||
files = {
|
||||
'/usr/local/lib/systemd/system/netbox-web.service': {
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
'svc_systemd:netbox-web:restart',
|
||||
},
|
||||
'triggered_by': {
|
||||
'tag:netbox-install',
|
||||
},
|
||||
'/usr/local/lib/systemd/system/netbox-worker.service': {
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
'svc_systemd:netbox-worker:restart',
|
||||
},
|
||||
},
|
||||
'/opt/netbox/src/netbox/netbox/configuration.py': {
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:netbox-web:restart',
|
||||
'svc_systemd:netbox-worker:restart',
|
||||
},
|
||||
'needs': {
|
||||
'git_deploy:/opt/netbox/src',
|
||||
},
|
||||
},
|
||||
'/opt/netbox/gunicorn_config.py': {
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:netbox-web:restart',
|
||||
},
|
||||
}
|
||||
last_action = f'netbox_upgrade_{upgrade_command.split()[0]}'
|
||||
|
||||
files['/usr/local/lib/systemd/system/netbox-web.service'] = {
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
'svc_systemd:netbox-web:restart',
|
||||
},
|
||||
}
|
||||
|
||||
files['/usr/local/lib/systemd/system/netbox-worker.service'] = {
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
'svc_systemd:netbox-worker:restart',
|
||||
},
|
||||
}
|
||||
|
||||
files['/opt/netbox/src/netbox/netbox/configuration.py'] = {
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:netbox-web:restart',
|
||||
'svc_systemd:netbox-worker:restart',
|
||||
},
|
||||
'needs': {
|
||||
'git_deploy:/opt/netbox/src',
|
||||
},
|
||||
'tags': {
|
||||
'netbox-install',
|
||||
},
|
||||
}
|
||||
|
||||
files['/opt/netbox/gunicorn_config.py'] = {
|
||||
'content_type': 'mako',
|
||||
'triggers': {
|
||||
'svc_systemd:netbox-web:restart',
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd['netbox-web'] = {
|
||||
'needs': {
|
||||
'file:/usr/local/lib/systemd/system/netbox-web.service',
|
||||
'file:/opt/netbox/gunicorn_config.py',
|
||||
'file:/opt/netbox/src/netbox/netbox/configuration.py',
|
||||
'tag:netbox-install',
|
||||
'tag:netbox-upgrade',
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd['netbox-worker'] = {
|
||||
'needs': {
|
||||
'file:/usr/local/lib/systemd/system/netbox-worker.service',
|
||||
'file:/opt/netbox/src/netbox/netbox/configuration.py',
|
||||
'tag:netbox-install',
|
||||
'tag:netbox-upgrade',
|
||||
svc_systemd = {
|
||||
'netbox-web': {
|
||||
'needs': {
|
||||
'action:netbox_install',
|
||||
'action:netbox_upgrade',
|
||||
'file:/usr/local/lib/systemd/system/netbox-web.service',
|
||||
'file:/opt/netbox/gunicorn_config.py',
|
||||
'file:/opt/netbox/src/netbox/netbox/configuration.py',
|
||||
},
|
||||
},
|
||||
'netbox-worker': {
|
||||
'needs': {
|
||||
'action:netbox_install',
|
||||
'action:netbox_upgrade',
|
||||
'file:/usr/local/lib/systemd/system/netbox-worker.service',
|
||||
'file:/opt/netbox/src/netbox/netbox/configuration.py',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,8 @@
|
|||
if node.has_bundle('pacman'):
|
||||
package = 'pkg_pacman:nfs-utils'
|
||||
else:
|
||||
package = 'pkg_apt:nfs-common'
|
||||
|
||||
for mount, data in node.metadata.get('nfs-client/mounts',{}).items():
|
||||
data['mount'] = mount
|
||||
data['mount_options'] = set(data.get('mount_options', set()))
|
||||
|
|
@ -37,7 +42,7 @@ for mount, data in node.metadata.get('nfs-client/mounts',{}).items():
|
|||
'file:/etc/systemd/system/{}.automount'.format(unitname),
|
||||
'directory:{}'.format(data['mountpoint']),
|
||||
'svc_systemd:systemd-networkd',
|
||||
'pkg_apt:nfs-common',
|
||||
package,
|
||||
},
|
||||
}
|
||||
else:
|
||||
|
|
@ -53,7 +58,7 @@ for mount, data in node.metadata.get('nfs-client/mounts',{}).items():
|
|||
'file:/etc/systemd/system/{}.mount'.format(unitname),
|
||||
'directory:{}'.format(data['mountpoint']),
|
||||
'svc_systemd:systemd-networkd',
|
||||
'pkg_apt:nfs-common',
|
||||
package,
|
||||
},
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -4,6 +4,11 @@ defaults = {
|
|||
'nfs-common': {},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'nfs-utils': {},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if node.has_bundle('telegraf'):
|
||||
|
|
|
|||
|
|
@ -23,8 +23,9 @@ table inet filter {
|
|||
|
||||
icmp type timestamp-request drop
|
||||
icmp type timestamp-reply drop
|
||||
meta l4proto {icmp, ipv6-icmp} accept
|
||||
ip protocol icmp accept
|
||||
|
||||
ip6 nexthdr ipv6-icmp accept
|
||||
% for ruleset, rules in sorted(input.items()):
|
||||
|
||||
# ${ruleset}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,8 @@
|
|||
if node.has_bundle('pacman'):
|
||||
package = 'pkg_pacman:nftables'
|
||||
else:
|
||||
package = 'pkg_apt:nftables'
|
||||
|
||||
directories = {
|
||||
# used by other bundles
|
||||
'/etc/nftables-rules.d': {
|
||||
|
|
@ -37,7 +42,7 @@ svc_systemd = {
|
|||
'nftables': {
|
||||
'needs': {
|
||||
'file:/etc/nftables.conf',
|
||||
'pkg_apt:nftables',
|
||||
package,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,9 +10,26 @@ defaults = {
|
|||
'blocked_v4': repo.libs.firewall.global_ip4_blocklist,
|
||||
'blocked_v6': repo.libs.firewall.global_ip6_blocklist,
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'nftables': {},
|
||||
# https://github.com/bundlewrap/bundlewrap/issues/688
|
||||
# 'iptables': {
|
||||
# 'installed': False,
|
||||
# 'needed_by': {
|
||||
# 'pkg_pacman:iptables-nft',
|
||||
# },
|
||||
# },
|
||||
'iptables-nft': {
|
||||
'needed_by': {
|
||||
'pkg_pacman:nftables',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if not node.has_bundle('vmhost') and not node.has_bundle('docker-engine'):
|
||||
if not node.has_bundle('vmhost'):
|
||||
# see comment in bundles/vmhost/items.py
|
||||
defaults['apt']['packages']['iptables'] = {
|
||||
'installed': False,
|
||||
|
|
|
|||
9
bundles/nginx/files/arch-override.conf
Normal file
9
bundles/nginx/files/arch-override.conf
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
|
||||
|
||||
ExecReload=
|
||||
ExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /var/run/nginx.pid)"
|
||||
|
||||
ExecStop=
|
||||
ExecStop=/bin/sh -c "/bin/kill -s TERM $(/bin/cat /var/run/nginx.pid)"
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
user www-data;
|
||||
user ${username};
|
||||
worker_processes ${worker_processes};
|
||||
|
||||
pid /var/run/nginx.pid;
|
||||
|
|
@ -10,9 +10,6 @@ events {
|
|||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
types {
|
||||
application/javascript mjs;
|
||||
}
|
||||
default_type application/octet-stream;
|
||||
charset UTF-8;
|
||||
override_charset on;
|
||||
|
|
|
|||
|
|
@ -29,9 +29,8 @@ server {
|
|||
root ${webroot if webroot else '/var/www/{}/'.format(vhost)};
|
||||
index ${' '.join(index)};
|
||||
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
http2 on;
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
% if ssl == 'letsencrypt':
|
||||
ssl_certificate /var/lib/dehydrated/certs/${domain}/fullchain.pem;
|
||||
|
|
@ -71,9 +70,8 @@ server {
|
|||
root ${webroot if webroot else '/var/www/{}/'.format(vhost)};
|
||||
index ${' '.join(index)};
|
||||
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
http2 on;
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
% if ssl == 'letsencrypt':
|
||||
ssl_certificate /var/lib/dehydrated/certs/${domain}/fullchain.pem;
|
||||
|
|
@ -82,13 +80,12 @@ server {
|
|||
ssl_certificate /etc/nginx/ssl/${vhost}.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/${vhost}.key;
|
||||
% endif
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
|
||||
ssl_dhparam /etc/ssl/certs/dhparam.pem;
|
||||
ssl_prefer_server_ciphers off;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_tickets off;
|
||||
ssl_session_timeout 1d;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
% endif
|
||||
|
|
@ -149,18 +146,18 @@ server {
|
|||
% if 'target' in options:
|
||||
proxy_pass ${options['target']};
|
||||
proxy_http_version ${options.get('http_version', '1.1')};
|
||||
proxy_set_header Host ${options.get('proxy_pass_host', domain)};
|
||||
proxy_set_header Host ${domain};
|
||||
% if options.get('websockets', False):
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
% endif
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host ${options.get('x_forwarded_host', options.get('proxy_pass_host', domain))};
|
||||
proxy_set_header X-Forwarded-Host ${options.get('x_forwarded_host', domain)};
|
||||
% for option, value in options.get('proxy_set_header', {}).items():
|
||||
proxy_set_header ${option} ${value};
|
||||
% endfor
|
||||
% if location != '/' and location != '= /':
|
||||
% if location != '/':
|
||||
proxy_set_header X-Script-Name ${location};
|
||||
% endif
|
||||
proxy_buffering off;
|
||||
|
|
@ -201,8 +198,6 @@ server {
|
|||
fastcgi_hide_header X-XSS-Protection;
|
||||
% endif
|
||||
fastcgi_hide_header Permissions-Policy;
|
||||
fastcgi_request_buffering off;
|
||||
proxy_buffering off;
|
||||
}
|
||||
% if not max_body_size:
|
||||
client_max_body_size 5M;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,12 @@
|
|||
from datetime import datetime, timedelta
|
||||
|
||||
if node.has_bundle('pacman'):
|
||||
package = 'pkg_pacman:nginx'
|
||||
username = 'http'
|
||||
else:
|
||||
package = 'pkg_apt:nginx'
|
||||
username = 'www-data'
|
||||
|
||||
directories = {
|
||||
'/etc/nginx/sites': {
|
||||
'purge': True,
|
||||
|
|
@ -17,9 +24,9 @@ directories = {
|
|||
},
|
||||
},
|
||||
'/var/log/nginx-timing': {
|
||||
'owner': 'www-data',
|
||||
'owner': username,
|
||||
'needs': {
|
||||
'pkg_apt:nginx',
|
||||
package,
|
||||
},
|
||||
},
|
||||
'/var/www': {},
|
||||
|
|
@ -33,6 +40,7 @@ files = {
|
|||
'/etc/nginx/nginx.conf': {
|
||||
'content_type': 'mako',
|
||||
'context': {
|
||||
'username': username,
|
||||
**node.metadata['nginx'],
|
||||
},
|
||||
'triggers': {
|
||||
|
|
@ -61,13 +69,28 @@ files = {
|
|||
'/var/www/error.html': {},
|
||||
'/var/www/not_found.html': {},
|
||||
}
|
||||
if node.has_bundle('pacman'):
|
||||
files['/etc/systemd/system/nginx.service.d/bundlewrap.conf'] = {
|
||||
'source': 'arch-override.conf',
|
||||
'triggers': {
|
||||
'action:systemd-reload',
|
||||
'svc_systemd:nginx:restart',
|
||||
},
|
||||
}
|
||||
|
||||
actions = {
|
||||
'nginx-generate-dhparam': {
|
||||
'command': 'openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048',
|
||||
'unless': 'test -f /etc/ssl/certs/dhparam.pem',
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd = {
|
||||
'nginx': {
|
||||
'needs': {
|
||||
'action:generate-dhparam',
|
||||
'action:nginx-generate-dhparam',
|
||||
'directory:/var/log/nginx-timing',
|
||||
'pkg_apt:nginx',
|
||||
package,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -33,6 +33,11 @@ defaults = {
|
|||
'nginx': {
|
||||
'worker_connections': 768,
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'nginx': {},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if node.has_bundle('telegraf'):
|
||||
|
|
@ -195,8 +200,8 @@ def telegraf_anon_timing(metadata):
|
|||
result[f'nginx-{vname}'] = {
|
||||
'files': [f'/var/log/nginx-timing/{vname}.log'],
|
||||
'from_beginning': False,
|
||||
'grok_patterns': [r'%{LOGPATTERN}'],
|
||||
'grok_custom_patterns': r'LOGPATTERN \[%{HTTPDATE:ts:ts-httpd}\] %{NUMBER:request_time:float} (?:%{NUMBER:upstream_response_time:float}|-) "%{WORD:verb:tag} %{NOTSPACE:request} HTTP/%{NUMBER:http_version:float}" %{NUMBER:resp_code:tag}',
|
||||
'grok_patterns': ['%{LOGPATTERN}'],
|
||||
'grok_custom_patterns': 'LOGPATTERN \[%{HTTPDATE:ts:ts-httpd}\] %{NUMBER:request_time:float} (?:%{NUMBER:upstream_response_time:float}|-) "%{WORD:verb:tag} %{NOTSPACE:request} HTTP/%{NUMBER:http_version:float}" %{NUMBER:resp_code:tag}',
|
||||
'data_format': 'grok',
|
||||
'name_override': 'nginx_timing',
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,9 @@
|
|||
actions = {
|
||||
'nodejs_install_yarn': {
|
||||
'command': 'npm install -g yarn@latest',
|
||||
'unless': 'test -e /usr/lib/node_modules/yarn',
|
||||
'after': {
|
||||
'pkg_apt:',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
@ -1,24 +1,23 @@
|
|||
defaults = {
|
||||
'apt': {
|
||||
'additional_update_commands': {
|
||||
# update npm and yarn to latest version
|
||||
'npm install -g npm@latest',
|
||||
# update npm to latest version
|
||||
'npm install -g yarn@latest',
|
||||
},
|
||||
'packages': {
|
||||
'nodejs': {
|
||||
'triggers': {
|
||||
'action:apt_execute_update_commands',
|
||||
},
|
||||
},
|
||||
'npm': {
|
||||
'installed': False,
|
||||
'triggers': {
|
||||
'action:apt_execute_update_commands',
|
||||
},
|
||||
},
|
||||
'nodejs': {},
|
||||
},
|
||||
},
|
||||
'nodejs': {
|
||||
'version': 18,
|
||||
},
|
||||
}
|
||||
|
||||
VERSIONS_SHIPPED_BY_DEBIAN = {
|
||||
10: 10,
|
||||
11: 12,
|
||||
12: 18,
|
||||
13: 18,
|
||||
}
|
||||
|
||||
@metadata_reactor.provides(
|
||||
|
|
@ -27,14 +26,28 @@ defaults = {
|
|||
def nodejs_from_version(metadata):
|
||||
version = metadata.get('nodejs/version')
|
||||
|
||||
return {
|
||||
'apt': {
|
||||
'repos': {
|
||||
'nodejs': {
|
||||
'items': {
|
||||
f'deb https://deb.nodesource.com/node_{version}.x nodistro main',
|
||||
if version != VERSIONS_SHIPPED_BY_DEBIAN[node.os_version[0]]:
|
||||
return {
|
||||
'apt': {
|
||||
'additional_update_commands': {
|
||||
# update npm to latest version
|
||||
'npm install -g npm@latest',
|
||||
},
|
||||
'repos': {
|
||||
'nodejs': {
|
||||
'items': {
|
||||
f'deb https://deb.nodesource.com/node_{version}.x {{os_release}} main',
|
||||
f'deb-src https://deb.nodesource.com/node_{version}.x {{os_release}} main',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
else:
|
||||
return {
|
||||
'apt': {
|
||||
'packages': {
|
||||
'npm': {},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -27,22 +27,29 @@ files = {
|
|||
},
|
||||
}
|
||||
|
||||
if node.has_bundle('pacman'):
|
||||
package = 'pkg_pacman:openssh'
|
||||
service = 'sshd'
|
||||
else:
|
||||
package = 'pkg_apt:openssh-server'
|
||||
service = 'ssh'
|
||||
|
||||
actions = {
|
||||
'sshd_check_config': {
|
||||
'command': 'sshd -T -C user=root -C host=localhost -C addr=localhost',
|
||||
'triggered': True,
|
||||
'triggers': {
|
||||
'svc_systemd:ssh:restart',
|
||||
'svc_systemd:{}:restart'.format(service),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd = {
|
||||
'ssh': {
|
||||
service: {
|
||||
'needs': {
|
||||
'file:/etc/systemd/system/ssh.service.d/bundlewrap.conf',
|
||||
'file:/etc/ssh/sshd_config',
|
||||
'pkg_apt:openssh-server',
|
||||
package,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,6 +8,11 @@ defaults = {
|
|||
'openssh-sftp-server': {},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'openssh': {},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
@metadata_reactor.provides(
|
||||
|
|
|
|||
25
bundles/openvpn-client/items.py
Normal file
25
bundles/openvpn-client/items.py
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
from os.path import join
|
||||
|
||||
directories = {
|
||||
'/etc/openvpn/client': {
|
||||
'mode': '0750',
|
||||
'owner': 'openvpn',
|
||||
'group': None,
|
||||
'purge': True,
|
||||
},
|
||||
}
|
||||
|
||||
for fname, config in node.metadata.get('openvpn-client/configs', {}).items():
|
||||
files[f'/etc/openvpn/client/{fname}.conf'] = {
|
||||
'content': repo.vault.decrypt_file(join('openvpn-client', f'{fname}.conf.vault')),
|
||||
'triggers': {
|
||||
f'svc_systemd:openvpn-client@{config}:restart',
|
||||
} if config.get('running', True) else set(),
|
||||
}
|
||||
|
||||
svc_systemd[f'openvpn-client@{fname}'] = {
|
||||
'needs': {
|
||||
f'file:/etc/openvpn/client/{fname}.conf',
|
||||
},
|
||||
**config,
|
||||
}
|
||||
20
bundles/openvpn-client/metadata.py
Normal file
20
bundles/openvpn-client/metadata.py
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
defaults = {
|
||||
'apt': {
|
||||
'packages': {
|
||||
'openvpn': {
|
||||
'needed_by': {
|
||||
'directory:/etc/openvpn/client',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
'pacman': {
|
||||
'packages': {
|
||||
'openvpn': {
|
||||
'needed_by': {
|
||||
'directory:/etc/openvpn/client',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
38
bundles/pacman/files/check_unattended_upgrades
Normal file
38
bundles/pacman/files/check_unattended_upgrades
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
#!/bin/bash
|
||||
|
||||
statusfile="/var/tmp/unattended_upgrades.status"
|
||||
if ! [[ -f "$statusfile" ]]
|
||||
then
|
||||
echo "Status file not found"
|
||||
exit 3
|
||||
fi
|
||||
|
||||
mtime=$(stat -c %Y $statusfile)
|
||||
now=$(date +%s)
|
||||
if (( $now - $mtime > 60*60*24*8 ))
|
||||
then
|
||||
echo "Status file is older than 8 days!"
|
||||
exit 3
|
||||
fi
|
||||
|
||||
exitcode=$(cat $statusfile)
|
||||
case "$exitcode" in
|
||||
abort_ssh)
|
||||
echo "Upgrades skipped due to active SSH login"
|
||||
exit 1
|
||||
;;
|
||||
0)
|
||||
if [[ -f /var/run/reboot-required ]]
|
||||
then
|
||||
echo "OK, but updates require a reboot"
|
||||
exit 1
|
||||
else
|
||||
echo "OK"
|
||||
exit 0
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "Last exitcode was $exitcode"
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
18
bundles/pacman/files/do-unattended-upgrades
Normal file
18
bundles/pacman/files/do-unattended-upgrades
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
#!/bin/bash
|
||||
|
||||
set -xeuo pipefail
|
||||
|
||||
pacman -Syu --noconfirm --noprogressbar
|
||||
|
||||
% for affected, restarts in sorted(restart_triggers.items()):
|
||||
up_since=$(systemctl show "${affected}" | sed -n 's/^ActiveEnterTimestamp=//p' || echo 0)
|
||||
up_since_ts=$(date -d "$up_since" +%s || echo 0)
|
||||
now=$(date +%s)
|
||||
|
||||
if [ $((now - up_since_ts)) -lt 3600 ]
|
||||
then
|
||||
% for restart in sorted(restarts):
|
||||
systemctl restart "${restart}" || true
|
||||
% endfor
|
||||
fi
|
||||
% endfor
|
||||
2
bundles/pacman/files/faillock.conf
Normal file
2
bundles/pacman/files/faillock.conf
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# just disable faillock.
|
||||
deny = 0
|
||||
52
bundles/pacman/files/pacman.conf
Normal file
52
bundles/pacman/files/pacman.conf
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
[options]
|
||||
Architecture = auto
|
||||
CheckSpace
|
||||
Color
|
||||
HoldPkg = ${' '.join(sorted(node.metadata.get('pacman/ask_before_removal')))}
|
||||
ILoveCandy
|
||||
IgnorePkg = ${' '.join(sorted(node.metadata.get('pacman/ignore_packages', set())))}
|
||||
LocalFileSigLevel = Optional
|
||||
NoExtract=${' '.join(sorted(node.metadata.get('pacman/no_extract', set())))}
|
||||
ParallelDownloads = ${node.metadata.get('pacman/parallel_downloads')}
|
||||
SigLevel = Required DatabaseOptional
|
||||
VerbosePkgLists
|
||||
|
||||
% for line in sorted(node.metadata.get('pacman/additional_config', set())):
|
||||
${line}
|
||||
% endfor
|
||||
|
||||
[core]
|
||||
Server = ${node.metadata.get('pacman/repository')}
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
|
||||
[extra]
|
||||
Server = ${node.metadata.get('pacman/repository')}
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
|
||||
[community]
|
||||
Server = ${node.metadata.get('pacman/repository')}
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
% if node.metadata.get('pacman/enable_multilib', False):
|
||||
|
||||
[multilib]
|
||||
Server = ${node.metadata.get('pacman/repository')}
|
||||
Include = /etc/pacman.d/mirrorlist
|
||||
% endif
|
||||
% if node.metadata.get('pacman/enable_aurto', True):
|
||||
|
||||
[aurto]
|
||||
Server = https://aurto.kunbox.net/
|
||||
SigLevel = Optional TrustAll
|
||||
% endif
|
||||
% if node.has_bundle('zfs'):
|
||||
|
||||
[archzfs]
|
||||
Server = http://archzfs.com/archzfs/x86_64
|
||||
|
||||
% if node.metadata.get('pacman/linux-lts', False):
|
||||
[zfs-linux-lts]
|
||||
% else:
|
||||
[zfs-linux]
|
||||
% endif
|
||||
Server = http://kernels.archzfs.com/$repo/
|
||||
% endif
|
||||
49
bundles/pacman/files/upgrade-and-reboot
Normal file
49
bundles/pacman/files/upgrade-and-reboot
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
#!/bin/bash
|
||||
|
||||
# With systemd, we can force logging to the journal. This is better than
|
||||
# spamming the world with cron mails. You can then view these logs using
|
||||
# "journalctl -rat upgrade-and-reboot".
|
||||
if which logger >/dev/null 2>&1
|
||||
then
|
||||
# Dump stdout and stderr to logger, which will then put everything
|
||||
# into the journal.
|
||||
exec 1> >(logger -t upgrade-and-reboot -p user.info)
|
||||
exec 2> >(logger -t upgrade-and-reboot -p user.error)
|
||||
fi
|
||||
|
||||
. /etc/upgrade-and-reboot.conf
|
||||
|
||||
echo "Starting upgrade-and-reboot for node $nodename ..."
|
||||
|
||||
statusfile="/var/tmp/unattended_upgrades.status"
|
||||
# Workaround, because /var/tmp is usually 1777
|
||||
[[ "$UID" == 0 ]] && chown root:root "$statusfile"
|
||||
|
||||
logins=$(ps h -C sshd -o euser | awk '$1 != "root" && $1 != "sshd" && $1 != "sshmon" && $1 != "nobody"')
|
||||
if [[ -n "$logins" ]]
|
||||
then
|
||||
echo "Will abort now, there are active SSH logins: $logins"
|
||||
echo "abort_ssh" > "$statusfile"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
softlockdir=/var/lib/bundlewrap/soft-$nodename
|
||||
mkdir -p "$softlockdir"
|
||||
printf '{"comment": "UPDATE", "date": %s, "expiry": %s, "id": "UNATTENDED", "items": ["*"], "user": "root@localhost"}\n' \
|
||||
$(date +%s) \
|
||||
$(date -d 'now + 30 mins' +%s) \
|
||||
>"$softlockdir"/UNATTENDED
|
||||
trap 'rm -f "$softlockdir"/UNATTENDED' EXIT
|
||||
|
||||
do-unattended-upgrades
|
||||
ret=$?
|
||||
|
||||
echo "$ret" > "$statusfile"
|
||||
if (( $ret != 0 ))
|
||||
then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
systemctl reboot
|
||||
|
||||
echo "upgrade-and-reboot for node $nodename is DONE"
|
||||
3
bundles/pacman/files/upgrade-and-reboot.conf
Normal file
3
bundles/pacman/files/upgrade-and-reboot.conf
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
nodename="${node.name}"
|
||||
reboot_mail_to="${node.metadata.get('apt/unattended-upgrades/reboot_mail_to', '')}"
|
||||
auto_reboot_enabled="${node.metadata.get('apt/unattended-upgrades/reboot_enabled', True)}"
|
||||
113
bundles/pacman/items.py
Normal file
113
bundles/pacman/items.py
Normal file
|
|
@ -0,0 +1,113 @@
|
|||
from bundlewrap.exceptions import BundleError
|
||||
|
||||
if not node.os == 'arch':
|
||||
raise BundleError(f'{node.name}: bundle:pacman requires arch linux')
|
||||
|
||||
files = {
|
||||
'/etc/pacman.conf': {
|
||||
'content_type': 'mako',
|
||||
},
|
||||
'/etc/upgrade-and-reboot.conf': {
|
||||
'content_type': 'mako',
|
||||
},
|
||||
'/etc/security/faillock.conf': {},
|
||||
'/usr/local/sbin/upgrade-and-reboot': {
|
||||
'mode': '0700',
|
||||
},
|
||||
'/usr/local/sbin/do-unattended-upgrades': {
|
||||
'content_type': 'mako',
|
||||
'mode': '0700',
|
||||
'context': {
|
||||
'restart_triggers': node.metadata.get('pacman/restart_triggers', {}),
|
||||
}
|
||||
},
|
||||
'/usr/local/share/icinga/plugins/check_unattended_upgrades': {
|
||||
'mode': '0755',
|
||||
},
|
||||
}
|
||||
|
||||
svc_systemd['paccache.timer'] = {
|
||||
'needs': {
|
||||
'pkg_pacman:pacman-contrib',
|
||||
},
|
||||
}
|
||||
|
||||
pkg_pacman = {
|
||||
'at': {},
|
||||
'autoconf': {},
|
||||
'automake': {},
|
||||
'binutils': {},
|
||||
'bison': {},
|
||||
'bzip2': {},
|
||||
'curl': {},
|
||||
'dialog': {},
|
||||
'diffutils': {},
|
||||
'dnsutils': {},
|
||||
'fakeroot': {},
|
||||
'file': {},
|
||||
'findutils': {},
|
||||
'flex': {},
|
||||
'fwupd': {},
|
||||
'gawk': {},
|
||||
'gcc': {},
|
||||
'gettext': {},
|
||||
'git': {},
|
||||
'gnu-netcat': {},
|
||||
'grep': {},
|
||||
'groff': {},
|
||||
'gzip': {},
|
||||
'htop': {},
|
||||
'jq': {},
|
||||
'ldns': {},
|
||||
'less': {},
|
||||
'libtool': {},
|
||||
'logrotate': {},
|
||||
'lsof': {},
|
||||
'm4': {},
|
||||
'mailutils': {},
|
||||
'make': {},
|
||||
'man-db': {},
|
||||
'man-pages': {},
|
||||
'moreutils': {},
|
||||
'mtr': {},
|
||||
'ncdu': {},
|
||||
'nmap': {},
|
||||
'pacman-contrib': {},
|
||||
'patch': {},
|
||||
'pkgconf': {},
|
||||
'python': {},
|
||||
'python-setuptools': {
|
||||
'needed_by': {
|
||||
'pkg_pip:',
|
||||
},
|
||||
},
|
||||
'python-pip': {
|
||||
'needed_by': {
|
||||
'pkg_pip:',
|
||||
},
|
||||
},
|
||||
'python-virtualenv': {},
|
||||
'rsync': {},
|
||||
'run-parts': {},
|
||||
'sed': {},
|
||||
'tar': {},
|
||||
'texinfo': {},
|
||||
'tmux': {},
|
||||
'tree': {},
|
||||
'unzip': {},
|
||||
'vim': {},
|
||||
'wget': {},
|
||||
'which': {},
|
||||
'whois': {},
|
||||
'zip': {},
|
||||
}
|
||||
|
||||
if node.metadata.get('pacman/linux-lts', False):
|
||||
pkg_pacman['linux-lts'] = {}
|
||||
pkg_pacman['acpi_call-lts'] = {}
|
||||
else:
|
||||
pkg_pacman['linux'] = {}
|
||||
pkg_pacman['acpi_call'] = {}
|
||||
|
||||
for pkg, config in node.metadata.get('pacman/packages', {}).items():
|
||||
pkg_pacman[pkg] = config
|
||||
54
bundles/pacman/metadata.py
Normal file
54
bundles/pacman/metadata.py
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
defaults = {
|
||||
'pacman': {
|
||||
'ask_before_removal': {
|
||||
'glibc',
|
||||
'pacman',
|
||||
},
|
||||
'no_extract': {
|
||||
'etc/cron.d/0hourly',
|
||||
# don't install systemd-homed pam module. It produces a lot of spam in
|
||||
# journal about systemd-homed not being active, so just get rid of it.
|
||||
# Requires reinstall of systemd package, though
|
||||
'usr/lib/security/pam_systemd_home.so',
|
||||
},
|
||||
'parallel_downloads': 4,
|
||||
'repository': 'http://ftp.uni-kl.de/pub/linux/archlinux/$repo/os/$arch',
|
||||
'unattended-upgrades': {
|
||||
'day': 5,
|
||||
'hour': 21,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@metadata_reactor.provides(
|
||||
'cron/jobs/upgrade-and-reboot',
|
||||
'icinga2_api/pacman/services',
|
||||
)
|
||||
def patchday(metadata):
|
||||
if not metadata.get('pacman/unattended-upgrades/is_enabled', False):
|
||||
return {}
|
||||
|
||||
day = metadata.get('pacman/unattended-upgrades/day')
|
||||
hour = metadata.get('pacman/unattended-upgrades/hour')
|
||||
|
||||
return {
|
||||
'cron': {
|
||||
'jobs': {
|
||||
'upgrade-and-reboot': '{minute} {hour} * * {day} root /usr/local/sbin/upgrade-and-reboot'.format(
|
||||
minute=node.magic_number % 30,
|
||||
hour=hour,
|
||||
day=day,
|
||||
),
|
||||
},
|
||||
},
|
||||
'icinga2_api': {
|
||||
'pacman': {
|
||||
'services': {
|
||||
'UNATTENDED UPGRADES': {
|
||||
'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_unattended_upgrades',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
@ -8,9 +8,6 @@ Group=paperless
|
|||
Environment=PAPERLESS_CONFIGURATION_PATH=/opt/paperless/paperless.conf
|
||||
WorkingDirectory=/opt/paperless/src/paperless-ngx/src
|
||||
ExecStart=/opt/paperless/venv/bin/python manage.py document_consumer
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
SyslogIdentifier=paperless-consumer
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue