diff --git a/.editorconfig b/.editorconfig index 2b2153d..e09c9dd 100644 --- a/.editorconfig +++ b/.editorconfig @@ -11,6 +11,9 @@ insert_final_newline = true [*.yaml] indent_size = 2 +[*.exs] +indent_size = 2 + # possibly sql dumps [*.sql] indent_size = unset diff --git a/PORT_MAP.md b/PORT_MAP.md index 1111ee5..fe5117b 100644 --- a/PORT_MAP.md +++ b/PORT_MAP.md @@ -6,11 +6,6 @@ easily find available ports for other bundles. ## TCP Rule of thumb: keep ports below 10000 free for stuff that reserves ports. -| Port range | reserved for | -| ----------- | ------------ | -| 200.. | Matrix | -| 220.. | Generic Web services | - | Port | bundle | usage | | ----------- | -------------------- | ----- | | 22 | | sshd | @@ -38,6 +33,7 @@ Rule of thumb: keep ports below 10000 free for stuff that reserves ports. | 20080 | matrix-synapse | client, federation | | 20081 | matrix-synapse | prometheus metrics | | 20090 | matrix-media-repo | media_repo | +| 21000 | pleroma | pleroma | | 22000 | gitea | gitea | | 22010 | jenkins-ci | Jenkins CI | | 22020 | travelynx | Travelynx Web | diff --git a/bundles/apt/items.py b/bundles/apt/items.py index d148891..bfc8450 100644 --- a/bundles/apt/items.py +++ b/bundles/apt/items.py @@ -94,7 +94,6 @@ pkg_apt = { 'lsof': {}, 'mailutils': {}, 'manpages': {}, - 'molly-guard': {}, 'moreutils': {}, 'mount': {}, 'mtr': {}, diff --git a/bundles/basic/files/htoprc b/bundles/basic/files/htoprc new file mode 100644 index 0000000..03e606a --- /dev/null +++ b/bundles/basic/files/htoprc @@ -0,0 +1,39 @@ +# Beware! This file is rewritten by htop when settings are changed in the interface. +# The parser is also very primitive, and not human-friendly. +fields=0 48 17 18 38 39 40 2 46 47 49 1 +sort_key=46 +sort_direction=1 +tree_sort_key=0 +tree_sort_direction=1 +hide_kernel_threads=1 +hide_userland_threads=0 +shadow_other_users=0 +show_thread_names=0 +show_program_path=1 +highlight_base_name=1 +highlight_megabytes=0 +highlight_threads=1 +highlight_changes=0 +highlight_changes_delay_secs=5 +find_comm_in_cmdline=1 +strip_exe_from_cmdline=1 +show_merged_command=0 +tree_view=0 +tree_view_always_by_pid=0 +header_margin=1 +detailed_cpu_time=1 +cpu_count_from_one=1 +show_cpu_usage=1 +show_cpu_frequency=0 +show_cpu_temperature=0 +degree_fahrenheit=0 +update_process_names=0 +account_guest_in_cpu_meter=0 +color_scheme=0 +enable_mouse=0 +delay=10 +left_meters=Tasks LoadAverage Uptime Memory CPU LeftCPUs CPU +left_meter_modes=2 2 2 1 1 1 2 +right_meters=Hostname Load RightCPUs +right_meter_modes=2 3 1 +hide_function_bar=0 diff --git a/bundles/basic/items.py b/bundles/basic/items.py index 420d695..e37b684 100644 --- a/bundles/basic/items.py +++ b/bundles/basic/items.py @@ -10,6 +10,9 @@ files = { '/etc/hosts': { 'content_type': 'mako', }, + '/etc/htoprc.global': { + 'source': 'htoprc', + }, '/etc/locale.gen': { 'content_type': 'mako', 'triggers': { diff --git a/bundles/basic/metadata.py b/bundles/basic/metadata.py index b28a554..29d666e 100644 --- a/bundles/basic/metadata.py +++ b/bundles/basic/metadata.py @@ -1,4 +1,7 @@ defaults = { + 'bash_functions': { + 'h': 'cp /etc/htoprc.global ~/.htoprc; mkdir -p ~/.config/htop; cp /etc/htoprc.global ~/.config/htop/htoprc; htop', + }, 'locale': { 'default': 'en_US.UTF-8', 'installed': { diff --git a/bundles/icinga2/metadata.py b/bundles/icinga2/metadata.py index 149f111..6434909 100644 --- a/bundles/icinga2/metadata.py +++ b/bundles/icinga2/metadata.py @@ -42,6 +42,13 @@ defaults = { 'ICINGA STATUSMONITOR': { 'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_systemd_unit icinga_statusmonitor', }, + 'IDO-PGSQL': { + 'check_command': 'ido', + 'vars.ido_type': 'IdoPgsqlConnection', + 'vars.ido_name': 'ido-pgsql', + 'vars.ido_pending_queries_warning': 25, + 'vars.ido_pending_queries_critical': 50, + }, }, }, }, diff --git a/bundles/kodi/metadata.py b/bundles/kodi/metadata.py index da35db4..c3367d3 100644 --- a/bundles/kodi/metadata.py +++ b/bundles/kodi/metadata.py @@ -3,7 +3,8 @@ defaults = { 'repos': { 'deb-multimedia': { 'items': { - 'deb https://ftp-stud.hs-esslingen.de/pub/Mirrors/debian-multimedia/ stable main', + 'deb https://ftp-stud.hs-esslingen.de/pub/Mirrors/debian-multimedia/ {os_release} main', + 'deb https://ftp-stud.hs-esslingen.de/pub/Mirrors/debian-multimedia/ {os_release}-backports main', }, }, }, @@ -12,6 +13,7 @@ defaults = { 'fonts-noto': {}, 'fonts-roboto': {}, 'kodi': {}, + 'kodi-inputstream-adaptive': {}, 'libasound2': {}, 'libcec4': {}, 'ttf-mscorefonts-installer': {}, diff --git a/bundles/letsencrypt/files/domains.txt b/bundles/letsencrypt/files/domains.txt index d9d7824..ea7e427 100644 --- a/bundles/letsencrypt/files/domains.txt +++ b/bundles/letsencrypt/files/domains.txt @@ -1,5 +1,3 @@ -${node.metadata['hostname']} - % for domain, aliases in sorted(node.metadata.get('letsencrypt/domains', {}).items()): ${domain} ${' '.join(sorted(aliases))} % endfor diff --git a/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate b/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate index 45f474a..e0248cb 100644 --- a/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate +++ b/bundles/letsencrypt/files/letsencrypt-ensure-some-certificate @@ -6,7 +6,7 @@ just_check=$2 cert_path="/var/lib/dehydrated/certs/$domain" already_exists=false -if [ -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" ] +if [ -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" -a -f "$cert_path/chain.pem" ] then already_exists=true fi @@ -23,6 +23,7 @@ fi if [ "$already_exists" != true ] then + rm -r "$cert_path" mkdir -p "$cert_path" openssl req -x509 -newkey rsa:4096 -nodes -days 3650 -subj "/CN=$domain" -keyout "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem" chmod 0600 "$cert_path/privkey.pem" diff --git a/bundles/matrix-media-repo/items.py b/bundles/matrix-media-repo/items.py index b1b6b5f..cc35b47 100644 --- a/bundles/matrix-media-repo/items.py +++ b/bundles/matrix-media-repo/items.py @@ -41,6 +41,7 @@ git_deploy = { 'rev': node.metadata['matrix-media-repo']['version'], 'triggers': { 'action:matrix-media-repo_build', + 'svc_systemd:matrix-media-repo:restart', }, }, } diff --git a/bundles/molly-guard/files/10-check-unattended-upgrades b/bundles/molly-guard/files/10-check-unattended-upgrades new file mode 100644 index 0000000..6adafdb --- /dev/null +++ b/bundles/molly-guard/files/10-check-unattended-upgrades @@ -0,0 +1,9 @@ +#!/bin/bash + +# Checks wether upgrade-and-reboot is currently running. + +if [[ -f "/var/lib/bundlewrap/soft-${node.name}/UNATTENDED" ]] +then + echo "Sorry, can't $MOLLYGUARD_CMD now, upgrade-and-reboot is running" + exit 1 +fi diff --git a/bundles/molly-guard/files/30-query-hostname b/bundles/molly-guard/files/30-query-hostname new file mode 100644 index 0000000..3e4fc4c --- /dev/null +++ b/bundles/molly-guard/files/30-query-hostname @@ -0,0 +1,29 @@ +#!/bin/sh + +# This script will ask for the bundlewrap node name. This replaces the +# original script, which will ask for the hostname, which sometimes +# is not enough to properly identify the system. + +NODE_NAME="${node.name}" + +# If this is not a terminal, do nothing +test -t 0 || exit 0 + +sigh() +{ + echo "Sorry, input does not match. Won't $MOLLYGUARD_CMD $NODE_NAME ..." >&2 + exit 1 +} + +trap 'echo;sigh' 1 2 3 9 10 12 15 + +echo -n "Please enter the bundlewrap node name of this System to $MOLLYGUARD_CMD: " +read NODE_NAME_USER || : + +NODE_NAME_USER="$(echo "$NODE_NAME_USER" | tr '[:upper:]' '[:lower:]')" + +[ "$NODE_NAME_USER" = "$NODE_NAME" ] || sigh + +trap - 1 2 3 9 10 12 15 + +exit 0 diff --git a/bundles/molly-guard/files/rc b/bundles/molly-guard/files/rc new file mode 100644 index 0000000..4b6f808 --- /dev/null +++ b/bundles/molly-guard/files/rc @@ -0,0 +1 @@ +# currently unused diff --git a/bundles/molly-guard/items.py b/bundles/molly-guard/items.py new file mode 100644 index 0000000..e8d2b04 --- /dev/null +++ b/bundles/molly-guard/items.py @@ -0,0 +1,21 @@ +directories = { + '/etc/molly-guard/messages.d': { + 'purge': True, + }, + '/etc/molly-guard/run.d': { + 'purge': True, + }, +} + +files = { + '/etc/molly-guard/rc': {}, + + '/etc/molly-guard/run.d/10-check-unattended-upgrades': { + 'content_type': 'mako', + 'mode': '0755', + }, + '/etc/molly-guard/run.d/30-query-hostname': { + 'content_type': 'mako', + 'mode': '0755', + }, +} diff --git a/bundles/molly-guard/metadata.py b/bundles/molly-guard/metadata.py new file mode 100644 index 0000000..d8571e2 --- /dev/null +++ b/bundles/molly-guard/metadata.py @@ -0,0 +1,7 @@ +defaults = { + 'apt': { + 'packages': { + 'molly-guard': {}, + }, + }, +} diff --git a/bundles/nfs-client/items.py b/bundles/nfs-client/items.py index df06881..b2d072a 100644 --- a/bundles/nfs-client/items.py +++ b/bundles/nfs-client/items.py @@ -1,3 +1,8 @@ +if node.has_bundle('pacman'): + package = 'pkg_pacman:nfs-utils' +else: + package = 'pkg_apt:nfs-common' + for mount, data in node.metadata.get('nfs-client/mounts',{}).items(): data['mount'] = mount data['mount_options'] = set(data.get('mount_options', set())) @@ -34,7 +39,7 @@ for mount, data in node.metadata.get('nfs-client/mounts',{}).items(): 'file:/etc/systemd/system/{}.mount'.format(unitname), 'file:/etc/systemd/system/{}.automount'.format(unitname), 'directory:{}'.format(data['mountpoint']), - 'pkg_apt:nfs-common', + package, }, } else: @@ -42,7 +47,7 @@ for mount, data in node.metadata.get('nfs-client/mounts',{}).items(): 'needs': { 'file:/etc/systemd/system/{}.mount'.format(unitname), 'directory:{}'.format(data['mountpoint']), - 'pkg_apt:nfs-common', + package, }, } diff --git a/bundles/nfs-client/metadata.py b/bundles/nfs-client/metadata.py index 00ffd00..13e4ed0 100644 --- a/bundles/nfs-client/metadata.py +++ b/bundles/nfs-client/metadata.py @@ -4,4 +4,9 @@ defaults = { 'nfs-common': {}, }, }, + 'pacman': { + 'packages': { + 'nfs-utils': {}, + }, + }, } diff --git a/bundles/nginx/files/nginx.conf b/bundles/nginx/files/nginx.conf index b2fcf10..5943dee 100644 --- a/bundles/nginx/files/nginx.conf +++ b/bundles/nginx/files/nginx.conf @@ -35,5 +35,24 @@ http { '' close; } + # GDPR compatible IP smashinator 5000000 + map $remote_addr $ip_anonym1 { + default 0.0.0; + "~(?P(\d+)\.(\d+))\.(\d+)\.\d+" $ip; + "~(?P[^:]+:[^:]+):" $ip; + } + map $remote_addr $ip_anonym2 { + default .0.0; + "~(?P(\d+)\.(\d+)\.(\d+))\.\d+" .0.0; + "~(?P[^:]+:[^:]+):" ::; + } + map $ip_anonym1$ip_anonym2 $ip_anonymized { + default 0.0.0.0; + "~(?P.*)" $ip; + } + log_format gdpr '$ip_anonymized - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"" "$http_user_agent"'; + include /etc/nginx/sites/*; } diff --git a/bundles/pleroma/files/pleroma.config.exs b/bundles/pleroma/files/pleroma.config.exs new file mode 100644 index 0000000..64c2c0b --- /dev/null +++ b/bundles/pleroma/files/pleroma.config.exs @@ -0,0 +1,35 @@ +import Config + +config :pleroma, + configurable_from_database: true + +config :pleroma, Pleroma.Web.Endpoint, + url: [host: "${node.metadata['pleroma']['url']}", scheme: "https", port: 443], + http: [port: 21000, ip: {127, 0, 0, 1}], + secret_key_base: "${node.metadata['pleroma']['secret_key']}", + secure_cookie_flag: true + +config :pleroma, :instance, + static_dir: "/var/pleroma/static/" + +config :pleroma, Pleroma.Upload, + uploader: Pleroma.Uploaders.Local, + filters: [Pleroma.Upload.Filter.Dedupe] + +config :pleroma, Pleroma.Uploaders.Local, + uploads: "/var/pleroma/uploads/" + +config :pleroma, :media_proxy, + enabled: false, + redirect_on_failure: true + #base_url: "https://cache.pleroma.social" + +# Configure your database +config :pleroma, Pleroma.Repo, + adapter: Ecto.Adapters.Postgres, + username: "pleroma", + password: "${node.metadata['postgresql']['roles']['pleroma']['password']}", + database: "pleroma", + hostname: "localhost", + pool_size: 10, + timeout: 60000 diff --git a/bundles/pleroma/files/pleroma.service b/bundles/pleroma/files/pleroma.service new file mode 100644 index 0000000..bca89ee --- /dev/null +++ b/bundles/pleroma/files/pleroma.service @@ -0,0 +1,22 @@ +[Unit] +Description=Pleroma social network +After=network.target +Requires=postgresql.service + +[Service] +User=pleroma +WorkingDirectory=/opt/pleroma +Environment="HOME=/opt/pleroma" +Environment="PLEROMA_CONFIG_PATH=/opt/pleroma/pleroma.config.exs" +Environment="PLUG_TMPDIR=/tmp/pleroma" +ExecStart=/opt/pleroma/release/bin/pleroma start +ExecStop=/opt/pleroma/release/bin/pleroma stop +Restart=on-failure + +PrivateTmp=true +ProtectHome=true +ProtectSystem=full +CapabilityBoundingSet=~CAP_SYS_ADMIN + +[Install] +WantedBy=multi-user.target diff --git a/bundles/pleroma/items.py b/bundles/pleroma/items.py new file mode 100644 index 0000000..a03b973 --- /dev/null +++ b/bundles/pleroma/items.py @@ -0,0 +1,88 @@ +version = node.metadata['pleroma']['version'] + +users = { + 'pleroma': { + 'home': '/opt/pleroma', + }, +} + +directories = { + '/opt/pleroma': {}, + '/var/pleroma': { + 'owner': 'pleroma', + }, + '/var/pleroma/uploads': { + 'owner': 'pleroma', + }, + '/var/pleroma/static': { + 'owner': 'pleroma', + }, + '/var/pleroma/static/emoji': { + 'owner': 'pleroma', + }, +} + +if node.has_bundle('zfs'): + directories['/var/pleroma']['needs'] = { + 'zfs_dataset:tank/pleroma-data', + } + +actions = { + 'pleroma_download_release': { + 'command': \ + 'cd /opt/pleroma/ && '\ + f'wget -O/opt/pleroma/pleroma.zip https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/release/{version}/download?job=amd64 && '\ + 'rm -rf release && '\ + 'unzip /opt/pleroma/pleroma.zip && '\ + 'chown -R pleroma:pleroma /opt/pleroma/release && '\ + f'echo -n "{version}" > /opt/pleroma/.bundlewrap_installed_version', + 'unless': f'[ "$(cat /opt/pleroma/.bundlewrap_installed_version)" = "{version}" ]', + 'needs': { + 'directory:/opt/pleroma', + }, + 'preceded_by': { + 'svc_systemd:pleroma:stop', + }, + 'triggers': { + 'action:pleroma_migrate_database', + 'svc_systemd:pleroma:restart', + }, + }, + 'pleroma_migrate_database': { + 'triggered': True, + 'command': \ + 'echo "CREATE EXTENSION IF NOT EXISTS citext;" | psql pleroma && '\ + 'echo "CREATE EXTENSION IF NOT EXISTS pg_trgm;" | psql pleroma && '\ + 'echo "CREATE EXTENSION IF NOT EXISTS \\\"uuid-ossp\\\";" | psql pleroma && '\ + 'sudo -u pleroma PLEROMA_CONFIG_PATH=/opt/pleroma/pleroma.config.exs /opt/pleroma/release/bin/pleroma_ctl create', + 'needs': { + 'postgres_db:pleroma', + }, + }, +} + +files = { + '/etc/systemd/system/pleroma.service': { + 'triggers': { + 'action:systemd-reload', + 'svc_systemd:pleroma:restart', + }, + }, + '/opt/pleroma/pleroma.config.exs': { + 'content_type': 'mako', + 'triggers': { + 'svc_systemd:pleroma:restart', + }, + }, +} + +svc_systemd = { + 'pleroma': { + 'needs': { + 'action:pleroma_download_release', + 'action:pleroma_migrate_database', + 'file:/etc/systemd/system/pleroma.service', + 'file:/opt/pleroma/pleroma.config.exs', + }, + }, +} diff --git a/bundles/pleroma/metadata.py b/bundles/pleroma/metadata.py new file mode 100644 index 0000000..0007ec2 --- /dev/null +++ b/bundles/pleroma/metadata.py @@ -0,0 +1,59 @@ +defaults = { + 'apt': { + 'packages': { + 'imagemagick': {}, + 'ffmpeg': {}, + 'libimage-exiftool-perl': {}, + }, + }, + 'backups': { + 'paths': { + '/var/pleroma', + }, + }, + 'zfs': { + 'datasets': { + 'tank/pleroma-data': { + 'mountpoint': '/var/pleroma', + }, + }, + }, + 'postgresql': { + 'roles': { + 'pleroma': { + 'password': repo.vault.password_for(f'{node.name} postgresql pleroma'), + }, + }, + 'databases': { + 'pleroma': { + 'owner': 'pleroma', + }, + }, + }, +} + + +@metadata_reactor.provides( + 'nginx/vhosts/pleroma', +) +def nginx(metadata): + if not node.has_bundle('nginx'): + raise DoNotRunAgain + + return { + 'nginx': { + 'vhosts': { + 'pleroma': { + 'domain': metadata.get('pleroma/url'), + 'proxy': { + '/': { + 'target': 'http://127.0.0.1:21000', + 'websockets': True, + }, + }, + 'website_check_path': '/main/all', + 'website_check_string': 'use Pleroma', + }, + }, + }, + } diff --git a/bundles/postfix/metadata.py b/bundles/postfix/metadata.py index 4399e3b..9899988 100644 --- a/bundles/postfix/metadata.py +++ b/bundles/postfix/metadata.py @@ -49,7 +49,7 @@ else: 'letsencrypt/reload_after', ) def letsencrypt(metadata): - if not node.has_bundle('letsencrypt'): + if not node.has_bundle('letsencrypt') or not node.has_bundle('postfixadmin'): raise DoNotRunAgain result = { @@ -58,12 +58,9 @@ def letsencrypt(metadata): }, } - myhostname = metadata.get('postfix/myhostname', None) - - if myhostname and myhostname != metadata.get('hostname'): - result['domains'] = { - myhostname: set(), - } + result['domains'] = { + metadata.get('postfix/myhostname', metadata.get('hostname')): set(), + } return { 'letsencrypt': result, diff --git a/bundles/postgresql/items.py b/bundles/postgresql/items.py index f1d2953..f48ad74 100644 --- a/bundles/postgresql/items.py +++ b/bundles/postgresql/items.py @@ -25,10 +25,10 @@ directories = { }, # This is needed so the above purge does not remove the version # currently installed. - '/etc/postgresql/{}'.format(postgresql_version): { - 'owner': None, - 'group': None, - 'mode': None, + '/etc/postgresql/{}/main'.format(postgresql_version): { + 'owner': 'postgres', + 'group': 'postgres', + 'mode': '0755', }, } diff --git a/bundles/sshmon/files/check_cpu_stats b/bundles/sshmon/files/check_cpu_stats index 95be196..d774773 100644 --- a/bundles/sshmon/files/check_cpu_stats +++ b/bundles/sshmon/files/check_cpu_stats @@ -17,10 +17,10 @@ try: print(top_output) # steal - if cpu_usage['st'] > 5: - crit.add('CPU steal is {}% (>5%)'.format(cpu_usage['st'])) - elif cpu_usage['st'] > 2: - warn.add('CPU steal is {}% (>2%)'.format(cpu_usage['st'])) + if cpu_usage['st'] > 10: + crit.add('CPU steal is {}% (>10%)'.format(cpu_usage['st'])) + elif cpu_usage['st'] > 5: + warn.add('CPU steal is {}% (>5%)'.format(cpu_usage['st'])) # iowait if cpu_usage['wa'] > 60: diff --git a/bundles/systemd-networkd/items.py b/bundles/systemd-networkd/items.py index 6d068d4..aa2084c 100644 --- a/bundles/systemd-networkd/items.py +++ b/bundles/systemd-networkd/items.py @@ -1,11 +1,5 @@ assert node.has_bundle('systemd') -pkg_apt = { - 'resolvconf': { - 'installed': False, - }, -} - files = { '/etc/network/interfaces': { 'delete': True, diff --git a/bundles/systemd-networkd/metadata.py b/bundles/systemd-networkd/metadata.py index 54579e4..e8dff0e 100644 --- a/bundles/systemd-networkd/metadata.py +++ b/bundles/systemd-networkd/metadata.py @@ -1,3 +1,14 @@ +defaults = { + 'apt': { + 'packages': { + 'resolvconf': { + 'installed': False, + }, + }, + }, +} + + @metadata_reactor.provides( 'interfaces', ) diff --git a/bundles/unbound/files/unbound.conf b/bundles/unbound/files/unbound.conf index b9cd8c4..13842a2 100644 --- a/bundles/unbound/files/unbound.conf +++ b/bundles/unbound/files/unbound.conf @@ -5,8 +5,10 @@ server: verbosity: 0 % if node.has_bundle('netdata'): - statistics-interval: 1 - extended-statistics: yes +# FIXME reenable this once debian has 1.19 +# statistics-interval: 1 +# extended-statistics: yes + statistics-interval: 300 % else: statistics-interval: 300 % endif diff --git a/bundles/zfs/items.py b/bundles/zfs/items.py index ad09841..1322250 100644 --- a/bundles/zfs/items.py +++ b/bundles/zfs/items.py @@ -19,6 +19,7 @@ actions = { 'zfs_dataset:', 'zfs_pool:', }, + 'comment': 'If this fails, do a dist-upgrade, reinstall zfs-dkms, reboot', }, } diff --git a/data/backup/keys/htz-cloud.pleroma.key.vault b/data/backup/keys/htz-cloud.pleroma.key.vault new file mode 100644 index 0000000..06e6894 --- /dev/null +++ b/data/backup/keys/htz-cloud.pleroma.key.vault @@ -0,0 +1 @@ +encrypt$gAAAAABgMXllIGiB__clFctfOC6T4qRhFDrh_WJZU745-DZef2UpKCy0gz_2FlDAIqrNceL-Ahz1AXZrsdHUKPYAZ5AW4ne0b0G6uHQENYB0xv-ZqA3MZS26gzvNM7ejhyTCM1zO1j6ePgIxfZlaalNcuLIRAphuhu7KkJA8sGaoUMjdTqVWJUjj4Le8KHcS-s7PhB1XjkyHYxb0cKFgPxs1CgHWVjfCviVnl3yFAF1aLvYsbNcpzM_RGGIIA9YsO3yPQ8Mfk4B3truuNg1mdNaunpnhoTImF2cSNoI64f2mVaSNxxRXm1NG2qUJkZN8ZQlW8k7A1w_zUwHw9-JaimZejfPWrhew7krAbPQWEqOz7Km0RkQdbzFzxWECDIOQ_Z87n_yEFLSN3sAHA0eQ-a6oqj5Ybga5p9eeNNdOYAZyU_6KfSl9U6XSKT16brAXnsZevWQHk06ObdOPhJW5SMIQwk0TZXUOMZ11T0o0-2IMGBngOjoOxqt7gjZoiLFt4c8BkFcDkpTj25asyG2iF-2jWZ1cY91F5nDkIE3CSQzD7DYANyTI7ik9qACiY25bBYOwo9HS9TEcE-wDS2_jKolFFmEx5EFdxzIpSXdWB7EznbizgqAtu2eYubASKlBKILpeVZiqKZi8 \ No newline at end of file diff --git a/data/backup/keys/htz-cloud.pleroma.pub b/data/backup/keys/htz-cloud.pleroma.pub new file mode 100644 index 0000000..a699ae1 --- /dev/null +++ b/data/backup/keys/htz-cloud.pleroma.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7vz3CMmmHmnWZs4b+Ohh4wnUgcME8PvZscjgS+91Qd kunsi@kunsi-t470.kunbox.net diff --git a/data/nginx/files/extras/htz-cloud.miniserver/webdump.sophies-kitchen.eu b/data/nginx/files/extras/htz-cloud.miniserver/webdump.sophies-kitchen.eu new file mode 100644 index 0000000..65fb5a7 --- /dev/null +++ b/data/nginx/files/extras/htz-cloud.miniserver/webdump.sophies-kitchen.eu @@ -0,0 +1,4 @@ +location / +{ + add_header Access-Control-Allow-Origin *; +} diff --git a/data/nginx/files/extras/htz-cloud.pleroma/pleroma b/data/nginx/files/extras/htz-cloud.pleroma/pleroma new file mode 100644 index 0000000..3f9e6a0 --- /dev/null +++ b/data/nginx/files/extras/htz-cloud.pleroma/pleroma @@ -0,0 +1,4 @@ + client_max_body_size 16m; + + access_log /var/log/nginx/pleroma.log gdpr; + error_log /var/log/nginx/error.log; diff --git a/data/nginx/files/extras/htz-cloud.pleroma/pleroma-www-redir b/data/nginx/files/extras/htz-cloud.pleroma/pleroma-www-redir new file mode 100644 index 0000000..eefd814 --- /dev/null +++ b/data/nginx/files/extras/htz-cloud.pleroma/pleroma-www-redir @@ -0,0 +1 @@ + return 308 https://cybert-media.net$request_uri; diff --git a/data/powerdns/files/bind-zones/cybert-media.net b/data/powerdns/files/bind-zones/cybert-media.net new file mode 100644 index 0000000..9ce2544 --- /dev/null +++ b/data/powerdns/files/bind-zones/cybert-media.net @@ -0,0 +1,9 @@ +${header} + +$ORIGIN cybert-media.net. + +@ IN A 159.69.11.231 + IN AAAA 2a01:4f8:c2c:c410::1 + IN TXT "v=spf1 a ~all" + +www IN CNAME cybert-media.net. diff --git a/data/users/files/bash/sophie.bashrc b/data/users/files/bash/sophie.bashrc new file mode 100644 index 0000000..3cd6aec --- /dev/null +++ b/data/users/files/bash/sophie.bashrc @@ -0,0 +1 @@ +export PS1='\[\e[1;34m\][\[\e[1;32m\]'"$__node_name"'\[\e[1;34m\]][\[\e[1;32m\]\u\[\e[1;34m\]@\[\e[1;32m\]\w\[\e[1;34m\]] $PRODWARNING> \[\e[0m\]' diff --git a/data/users/files/tmux/sophie.conf b/data/users/files/tmux/sophie.conf index 39d4ba8..d8c2819 100644 --- a/data/users/files/tmux/sophie.conf +++ b/data/users/files/tmux/sophie.conf @@ -32,7 +32,7 @@ set -g status-left-length 14 set -g status-right-length 140 #set -g status-left '#[default]〘 ' set -g status-left '#[fg=green,bright]#(uname -r | cut -c 1-8)#[default]〘' -set -g status-right "〙🔋 #(upower -i /org/freedesktop/UPower/devices/battery_BAT1 | grep time | awk '{print $4, $5}' | sed 's/hours/h/; s/minutes/m/; s/,/\./') #[fg=red,bg=default]⇑#(uptime -p |sed 's/\ week/w/; s/\ days/d/; s/\ day/d/; s/\ hours/h/; s/\ minutes/m/; s/\ minute/m/; s/,//g; s/up//') #[fg=green,bg=default]⎋ #(cat /proc/loadavg | awk '{print $1,$2,$3}') #[fg=blue]⌚ %Y-%m-%d #[fg=white,bg=default]⌚ %H:%M #[fg=green]⚼ #H" +set -g status-right "〙#[fg=red,bg=default]⇑#(uptime -p |sed 's/\ week/w/; s/\ days/d/; s/\ day/d/; s/\ hours/h/; s/\ minutes/m/; s/\ minute/m/; s/,//g; s/up//') #[fg=green,bg=default]⎋ #(cat /proc/loadavg | awk '{print $1,$2,$3}') #[fg=blue] %Y-%m-%d #[fg=white,bg=default] %H:%M #[fg=green] #H" # C-b is not acceptable -- Vim uses it set-option -g prefix C-a diff --git a/groups/os.py b/groups/os.py index 85f794b..729a741 100644 --- a/groups/os.py +++ b/groups/os.py @@ -21,6 +21,7 @@ groups['linux'] = { 'backup-client', 'basic', 'cron', + 'molly-guard', 'openssh', 'postfix', 'sshmon', diff --git a/nodes/home/router.py b/nodes/home/router.py index d48b4aa..ff91820 100644 --- a/nodes/home/router.py +++ b/nodes/home/router.py @@ -150,7 +150,6 @@ nodes['home.router'] = { 'kunsi': { 'ssh_pubkey': { # work laptop - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM68t1Ssf0c9dEkYOEXllUQ0aybPsW3aQAJuWpUHPlt', 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICYst1HK+gJYhNxzqJGnz4iB73pa89Xz2yH+8wufOcsA', }, }, @@ -172,7 +171,7 @@ nodes['home.router'] = { }, 'wireguard': { # TODO autogenerate? - 'my_ip': '172.19.137.2/32', + 'my_ip': '172.19.136.2/32', 'subnets': { '172.19.138.0/24', '172.19.139.0/24', diff --git a/nodes/htz-cloud/miniserver.py b/nodes/htz-cloud/miniserver.py new file mode 100644 index 0000000..a98ef77 --- /dev/null +++ b/nodes/htz-cloud/miniserver.py @@ -0,0 +1,97 @@ +# sophie's miniserver +# mostly unmanaged + +nodes['htz-cloud.miniserver'] = { + 'groups': { + 'debian-buster', + 'webserver', + }, + 'bundles': { + 'iptables', + }, + 'metadata': { + 'dummy': True, + 'interfaces': { + 'eth0': { + 'ips': { + '157.90.20.62', + '2a01:4f8:c2c:840f::1/64', + }, + 'gateway4': '172.31.1.1', + 'gateway6': 'fe80::1', + }, + }, + 'apt': { + 'packages': { + 'mosh': {}, + 'weechat': {}, + 'weechat-core': {}, + 'weechat-curses': {}, + 'weechat-perl': {}, + 'weechat-plugins': {}, + 'weechat-python': {}, + 'weechat-ruby': {}, + }, + 'repos': { + 'weechat': { + 'items': { + 'deb https://weechat.org/debian {os_release} main', + }, + }, + }, + }, + 'backups': { + 'exclude_from_backups': True, + }, + 'icinga_options': { + 'exclude_from_monitoring': True, + }, + 'iptables': { + 'custom_rules': [ + 'iptables_both -A INPUT -p udp --dport 60000:61000 -j ACCEPT', # mosh + 'iptables_both -A INPUT -p tcp --dport 9001 -j ACCEPT', # weechat + + ], + }, + 'letsencrypt': { + 'concat_and_deploy': { + 'sophie-weechat': { + 'match_domain': 'i.sophies-kitchen.eu', + 'target': '/home/sophie/.weechat/ssl/relay.pem', + 'chown': 'sophie:sophie', + 'chmod': '0440', + 'commands': [ + 'echo \'core.weechat */relay sslcertkey\' >> /home/sophie/.weechat/weechat_fifo' + ], + }, + }, + 'domains': { + 'i.sophies-kitchen.eu': set(), + 'webdump.sophies-kitchen.eu': set(), + }, + }, + 'nginx': { + 'vhosts': { + 'webdump.sophies-kitchen.eu': { + 'webroot_config': { + 'owner': 'sophie', + 'group': 'sophie', + 'mode': '0755', + }, + 'extras': True, + }, + }, + }, + 'vm': { + 'cpu': 2, + 'ram': 4, + }, + 'users': { + 'sophie': { + 'ssh_pubkey': [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDILcYrMQNRVXAm5L+7No1ZumqfCyRc1QZmTY3O7Q8hsE4+fCAvwsWm2aSMfLL3NnIl8Nm1Rixzic5jdYKYNIY3SlX1wvTB+MhGb2eyVSd7c/Y98aCLSlDkQ2sebjpdA1FoJOeGD3qxqDwj0+KckXU2ZaSSQY7CxVsjH65UxCHqVAg+6uLdNbj7j850s1B9NXVXef+sBQ5jUngXxnqQWwNh2Mn8auwumkeEG4SYf96wyFkLvmBitOng/GyLWl9YPnXXHHDnatcVipy7y34qw4CQ4P84anecbA+Bqr9IcxBW6qYmYgRKEnAcmEfjQd+BI1gCLB1BBEmb/qp+mVLd4tOh sophie@carbon" + ], + }, + }, + }, +} diff --git a/nodes/htz-cloud/pirmasens.py b/nodes/htz-cloud/pirmasens.py index 7df81de..437b009 100644 --- a/nodes/htz-cloud/pirmasens.py +++ b/nodes/htz-cloud/pirmasens.py @@ -56,7 +56,7 @@ nodes['htz-cloud.pirmasens'] = { 'message_size_limit_mb': 50, }, 'postfixadmin': { - 'version': '3.3.7', + 'version': '3.3.8', 'setup_password': vault.decrypt('encrypt$gAAAAABfpwn8NKxTztI39GzhGw66NNsWa72Wq7Sa_LoIG_L0ewCVPzhmw93xhWo3jfT8hCn9sqJgbArmPHtLMcLkSHdBPbQe0bLZMSib-mA9sEQD0wgKMyuRCPHIIMKSAoMaJaYnHSTO-mz1q7_tKzd6LkHF_AGsboS1vpQvg-CDth6e0msTwe8='), }, 'rspamd': { diff --git a/nodes/htz-cloud/pleroma.py b/nodes/htz-cloud/pleroma.py new file mode 100644 index 0000000..0d9b2ae --- /dev/null +++ b/nodes/htz-cloud/pleroma.py @@ -0,0 +1,56 @@ +nodes['htz-cloud.pleroma'] = { + 'bundles': { + 'pleroma', + 'postgresql', + 'zfs', + }, + 'groups': { + 'debian-buster', + 'webserver', + }, + 'metadata': { + 'interfaces': { + 'eth0': { + 'ips': { + '159.69.11.231', + '2a01:4f8:c2c:c410::1/64', + }, + 'gateway4': '172.31.1.1', + 'gateway6': 'fe80::1', + }, + }, + 'cron': { + 'auto-authorize-sm-users': '* * * * * root echo "UPDATE users SET approval_pending=false WHERE email LIKE \'\\%@seibert-media.net\' AND approval_pending=true;" | psql pleroma >/dev/null', + }, + 'nginx': { + 'vhosts': { + 'pleroma': { + 'extras': True, + }, + 'pleroma-www-redir': { + 'domain': 'www.cybert-media.net', + 'extras': True, + }, + }, + }, + 'pleroma': { + 'version': '2.2.2', + 'url': 'cybert-media.net', + 'secret_key': vault.decrypt('encrypt$gAAAAABgMVXXclfxVY022fM0Fdf94Oh3sxVlK0lYyBO_CsQFEbZcMua3w1oJY8_9d1JcrCJSSeBRTDnt-ZkRCQ6xKoALo8Rl7s9DPxa7J0vHdkggeZ3IHaOyXBcBPdx8vILyKDLHRXacaynOUBOjy6RIl6Qf2wH1ASbphCcjD-Njricg4PG6Rcixm87fF60rLBjAAkRoz5ZQnXlut1rhjLj-z-7UpA68fkeyPVJXbroWBJdmvCUt92dwjuGARsku2XI22mVvjtJJ'), + }, + 'postfix': { + 'myhostname': 'cybert-media.net', + }, + 'vm': { + 'cpu': 1, + 'ram': 2, + }, + 'zfs': { + 'pools': { + 'tank': { + 'device': '/dev/sdb', + }, + }, + }, + }, +} diff --git a/nodes/htz/ex42-1048908.py b/nodes/htz/ex42-1048908.py index 247534c..a53c36c 100644 --- a/nodes/htz/ex42-1048908.py +++ b/nodes/htz/ex42-1048908.py @@ -49,6 +49,7 @@ nodes['htz.ex42-1048908'] = { # No need to create a bundle just to install packages, # configs will be managed by users nevertheless. + 'mosh': {}, 'weechat': {}, 'weechat-core': {}, 'weechat-curses': {}, @@ -89,7 +90,7 @@ nodes['htz.ex42-1048908'] = { }, 'element-web': { 'url': 'chat.franzi.business', - 'version': 'v1.7.21', + 'version': 'v1.7.22', 'config': { 'default_server_config': { 'm.homeserver': { @@ -112,8 +113,8 @@ nodes['htz.ex42-1048908'] = { }, }, 'gitea': { - 'version': '1.13.2', - 'sha256': '4d7d3fc63666cc9c94e32c1e70422c30c1ee8f905004eeb7cd812051721601cc', + 'version': '1.13.4', + 'sha256': '7948a5ad2ec63d4cb1bf3f90925f444606bd00af4e242d467ae975ade4e330d7', 'domain': 'git.kunsmann.eu', # TODO find out if those secrets can be rotated without breaking stuff 'internal_token': vault.decrypt('encrypt$gAAAAABfPncYwCX-NdBr9LdxLyGqmjRJqhmwMnWsdZy6kVOWdKrScW78xaqbJ1tpL1J4qa2hcZ7TQj3l-2mkyJNJOenGzU3TsI-gYMj9vC4m8Bhur5zboxjD4dQXaJbD1WSyHJ9sPJYsWP3Gjg6I19xeq9xMlAI6xaS9vOfuoI8nZnnQPx1NjfQEj03Jxf8a0-3F20sfICst1xRa5K48bpq1PFkK_oRojg=='), @@ -147,7 +148,7 @@ nodes['htz.ex42-1048908'] = { }, }, 'matrix-media-repo': { - 'version': 'v1.2.2', + 'version': 'v1.2.4', 'homeservers': { 'franzi.business': { 'domain': 'http://[::1]:20080/', @@ -330,7 +331,7 @@ nodes['htz.ex42-1048908'] = { 'message_size_limit_mb': 50, }, 'postfixadmin': { - 'version': '3.3.7', + 'version': '3.3.8', 'setup_password': vault.decrypt('encrypt$gAAAAABfpwn8NKxTztI39GzhGw66NNsWa72Wq7Sa_LoIG_L0ewCVPzhmw93xhWo3jfT8hCn9sqJgbArmPHtLMcLkSHdBPbQe0bLZMSib-mA9sEQD0wgKMyuRCPHIIMKSAoMaJaYnHSTO-mz1q7_tKzd6LkHF_AGsboS1vpQvg-CDth6e0msTwe8='), }, 'radicale': { diff --git a/nodes/kunsi-t470.py b/nodes/kunsi-t470.py index 133130b..cc55fee 100644 --- a/nodes/kunsi-t470.py +++ b/nodes/kunsi-t470.py @@ -5,6 +5,7 @@ nodes['kunsi-t470'] = { 'bundles': { 'basic', 'lldp', + 'nfs-client', 'pacman', 'openssh', 'sudo', @@ -36,6 +37,18 @@ nodes['kunsi-t470'] = { 'locale': { 'default': 'en_DK.UTF-8', }, + 'nfs-client': { + 'mounts': { + 'nas-storage': { + 'mountpoint': '/mnt/nas', + 'serverpath': '172.19.138.20:/storage/nas', + 'mount_options': { + 'retry=0', + 'ro', + }, + }, + }, + }, 'pacman': { 'packages': { 'fish': {}, @@ -48,6 +61,8 @@ nodes['kunsi-t470'] = { 'kunsi': { 'password': vault.decrypt('encrypt$gAAAAABgLmmuQGRUStrQawoPee-758emIYn2u8-8ebrgzNAFSp7ifeFDdXXvs-zL3QogwNYlCtBHboH2xfy1rSj6OF5bbNO-tg=='), 'shell': '/usr/bin/fish', + # FIXME move qemu VMs out of /home/kunsi + 'home-mode': '0755', }, 'sophie': { 'delete': True, diff --git a/nodes/ovh/icinga2.py b/nodes/ovh/icinga2.py index d2a4ae0..3517189 100644 --- a/nodes/ovh/icinga2.py +++ b/nodes/ovh/icinga2.py @@ -114,7 +114,7 @@ nodes['ovh.icinga2'] = { 'service_filter': '"checks_with_sms" in service.groups' }, 'wireguard': { - 'my_ip': '172.19.137.3/32', + 'my_ip': '172.19.136.3/32', 'peers': { 'ovh.wireguard': {}, }, diff --git a/nodes/ovh/wireguard.py b/nodes/ovh/wireguard.py index c42b5e8..b1c9e12 100644 --- a/nodes/ovh/wireguard.py +++ b/nodes/ovh/wireguard.py @@ -25,12 +25,12 @@ nodes['ovh.wireguard'] = { }, 'wireguard': { 'network': '172.19.136.0/22', - 'my_ip': '172.19.137.1/32', + 'my_ip': '172.19.136.1/32', 'psk': vault.random_bytes_as_base64_for('ovh.icinga2 wireguard psk'), 'peers': { 'kunsi-oneplus3': { 'ips': { - '172.19.137.200/32', + '172.19.136.100/32', }, 'psk': vault.decrypt('encrypt$gAAAAABgKYeeuPfokbk7lSbbJX-52kap5Cs3tdCHpezkKcExV-yLTHPjszIcAh1T9wW1BtGElRdZea7VTikV3qEu3bupiSqEW4l2lmD5cn2ERYRfuVCoYSkOlmEGokHUX7Nja4G_A2_x'), 'pubkey': vault.decrypt('encrypt$gAAAAABgKYdTqLG3DcB13QqQadUxyzIjvSxwgZQNjorQi-ADSLsNdDbhikSAGQnSmGelLB74V175awIIir768WEnpLJUKX6nt_i2BxOP3JazvKZSQECkiK8G-IRn8wWWgKarfmtqRwh6'),