VA
/
appliances-old
Archived
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

neu: unifi (Ubiquiti UniFi Controller)

This commit is contained in:
Joerg Deckert 2020-04-15 20:02:31 +02:00
parent de024930eb
commit a9c5928d63
14 changed files with 3401 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
IDs.md
View File

@ -9,5 +9,6 @@
606 jitsi
607 jicofo
608 jvb
611 unifi
2000 admin

2
jitsi/Makefile
View File

@ -1,6 +1,6 @@
preinstall:
# hardcoded users and groups
$(inroot) useradd --system --comment="created from appliance building - jitsi user" --home-dir="/var/lib/zabbix/home" --shell="/sbin/nologin" --no-create-home --uid 606 --user-group jitsi
$(inroot) useradd --system --comment="created from appliance building - jitsi user" --home-dir="/usr/share/jitsi-videobridge" --shell="/sbin/nologin" --no-create-home --uid 606 --user-group jitsi
$(inroot) useradd --system --comment="created from appliance building - jitsi jicofo user" --home-dir="/usr/share/jicofo" --shell="/bin/bash" --no-create-home --uid 607 --gid 606 jicofo
$(inroot) useradd --system --comment="created from appliance building - jitsi videobridge user" --home-dir="/usr/share/jitsi-videobridge" --shell="/bin/bash" --no-create-home --uid 608 --gid 606 jvb
# switch to hardened, build hardened toolchain, rebuild everything

33
unifi/Makefile Normal file
View File

@ -0,0 +1,33 @@
preinstall:
# hardcoded users and groups
$(inroot) useradd --system --comment="created from appliance building - unifi user" --home-dir="/var/lib/unifi" --shell="/sbin/nologin" --no-create-home --uid 611 --user-group unifi
# switch to hardened, build hardened toolchain, rebuild everything
mkdir -p $(CHROOT)/etc/portage/profile
echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
$(inroot) $(EMERGE) $(USEPKG) --oneshot gcc
$(inroot) $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
-$(gcc_config)
$(inroot) $(EMERGE) $(USEPKG) --emptytree @world
$(inroot) bash -c 'yes YES | etc-update --automode -9'
postinstall: base/timesyncd.conf base/firstboot.start
# Konfigurationen anpassen
cp base/timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf
mkdir -p $(CHROOT)/etc/local.d
cp base/firstboot.start $(CHROOT)/etc/local.d/firstboot.start
touch $(CHROOT)/firstboot
sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers
sed -i 's#^auth.*$$#auth [success=2 default=ignore] pam_ssh_agent_auth.so file=~/.ssh/authorized_keys\nauth include system-auth#' $(CHROOT)/etc/pam.d/sudo
echo "Defaults env_keep += SSH_AUTH_SOCK" > $(CHROOT)/etc/sudoers.d/ssh_auth_sock
$(inroot) useradd -m -G users,wheel -s /bin/bash --comment="virtual appliance admin" --uid 2000 admin
$(inroot) passwd -d admin; $(inroot) passwd -e admin
$(inroot) systemctl enable tmux@root.service
cp base/tmux.conf $(CHROOT)/root/.tmux.conf
# Beispiel feste IP-Adresse
cp base/00-eth0.network $(CHROOT)/00-eth0.network.example
# Start services
$(inroot) systemctl enable unifi
clean:

7
unifi/README.md Normal file
View File

@ -0,0 +1,7 @@
Erstkonfiguration
=================
- für variable Daten (Datenbanken, Konfiguration) muß eine mit ext4 formatierte Datenpartition mit dem Label "DATA" vorhanden sein. Diese wird nach /DATA gemountet.
- feste IP-Adresse und /etc/hosts konfigurieren
- evtl. Nginx-Zertifikat neu erzeugen
- unter VMware evtl. open-vm-tools aktivieren

22
unifi/base/00-eth0.network Normal file
View File

@ -0,0 +1,22 @@
# Beispiel für feste IP-Adreß-Konfiguration:
# Anpassen und als 00-eth0.network nach /etc/systemd/network verschieben
# (s. "man systemd.network", "man systemd-resolved")
#
# NICHT VERGESSEN: entsprechende Einträge in /etc/hosts hinzufügen
# <IPv4> <FQDN> <Hostname>
# <IPv6> <FQDN> <Hostname>
[Match]
Name=eth0
[Network]
Description=1. Netzwerk-Port
Address=192.168.1.2/24
Address=fdb5:78b:64cc:0:f8c0::2/64
Gateway=192.168.1.1
Gateway=fdb5:78b:64cc:0:f8c0::1
DNS=192.168.1.3
DNS=fdb5:78b:64cc:0:f8c0::3
NTP=192.168.1.4
NTP=fdb5:78b:64cc:0:f8c0::4
Domains=privacyidea.de

36
unifi/base/firstboot.start Executable file
View File

@ -0,0 +1,36 @@
#!/bin/bash
# base settings
set -e
[ -e /firstboot ] || exit 0
echo 'Setting defaults...'
localectl --no-convert set-keymap de-latin1-nodeadkeys
echo 'Activate services...'
timedatectl set-ntp true
# variables
LABEL="DATA"
# Data partition
echo 'Mount data partition...'
mkdir -p /$LABEL
if [ ! -L "/dev/disk/by-label/$LABEL" ]; then
echo 'ERROR: Data partition not found!'
echo "Please create a data partition with ext4 filesystem and label \"$LABEL\":"
echo "# cfdisk /dev/<disk> (use GPT label, create linux partition)"
echo "# mkfs.ext4 -L $LABEL /dev/<partition>"
exit 1
fi
if ! grep -Fq "LABEL=$LABEL" /etc/fstab; then
echo "LABEL=$LABEL /$LABEL ext4 noatime 0 1" >> /etc/fstab
fi
mount -a
if ! mount | grep /$LABEL > /dev/null; then
echo "ERROR: Could not mount data partition!"
exit 1
fi
rm /firstboot

12
unifi/base/timesyncd.conf Normal file
View File

@ -0,0 +1,12 @@
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# See timesyncd.conf(5) for details.
[Time]
NTP=0.de.pool.ntp.org 1.de.pool.ntp.org 2.de.pool.ntp.org 3.de.pool.ntp.org
FallbackNTP=0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org

3
unifi/base/tmux.conf Normal file
View File

@ -0,0 +1,3 @@
set -g mouse on
set-option -g set-titles on
set-option -g set-titles-string "#S / #T"

3211
unifi/kernel.config Normal file
View File

File diff suppressed because it is too large Load Diff

8
unifi/make.conf Normal file
View File

@ -0,0 +1,8 @@
CFLAGS="-O2 -pipe"
CXXFLAGS="-O2 -pipe"
USE="hardened justify pie ssp urandom xattr -fortran -pch -pic -prelink -profile -tcc"
MAKEOPTS="-j5"
PYTHON_TARGETS="python2_7 python3_6"
PYTHON_SINGLE_TARGET="python3_6"
VIDEO_CARDS="vmware"
ACCEPT_LICENSE="*"

6
unifi/package.keywords Normal file
View File

@ -0,0 +1,6 @@
# Grundsystem
app-emulation/open-vm-tools ~amd64 ~x86
sys-auth/pam_ssh_agent_auth ~amd64 ~x86
# Mongodb (stable Version 3.6.13 compiliert nicht)
dev-db/mongodb

27
unifi/package.use Normal file
View File

@ -0,0 +1,27 @@
# base
app-admin/sudo -sendmail
app-editors/nano ncurses
app-emulation/open-vm-tools pic -modules
app-misc/mc -slang
dev-lang/python ssl threads xml
dev-libs/libpcre cxx jit
dev-libs/libpcre2 jit
dev-util/pkgconfig internal-glib
dev-vcs/git -python
net-misc/openssh ssl
net-misc/wget ssl
sys-apps/hwids udev
sys-apps/kmod tools
sys-apps/net-tools hostname
sys-apps/portage ipc
sys-auth/pambase nullok sha512
sys-devel/gcc cxx nptl
sys-kernel/gentoo-sources symlink
# Monitoring
net-analyzer/zabbix agent
# Unifi Controller
app-text/poppler -introspection -jpeg -jpeg2k
net-print/cups-filters -foomatic -postscript
dev-java/openjdk-jre-bin headless-awt

20
unifi/unifi.cfg Normal file
View File

@ -0,0 +1,20 @@
##HOSTNAME = $(APPLIANCE)
##TIMEZONE = UTC
DISK_SIZE = 8.0G
##SWAP_SIZE = 30
##SWAP_FILE = $(CHROOT)/.swap
##ARCH = amd64-hardened
##MAKEOPTS = -j10 -l10
##PRUNE_CRITICAL = NO
##CHANGE_PASSWORD = YES
##HEADLESS = NO
##SOFTWARE = 1
##PKGLIST = 0
##RSYNC_MIRROR = rsync://rsync15.de.gentoo.org/gentoo/
##KERNEL_PKG = gentoo-sources
KERNEL_CONFIG = appliances/$(APPLIANCE)/kernel.config
ENABLE_SSHD = YES
TIMEZONE=Europe/Berlin
LOCALE=de_DE.utf8
REPO_NAMES = unitas
REPO_URI_unitas = https://dev.unitas-network.de/r/Gentoo/Unitas.git

14
unifi/world Normal file
View File

@ -0,0 +1,14 @@
app-admin/logrotate
app-admin/sudo
app-emulation/open-vm-tools
app-emulation/qemu-guest-agent
app-misc/mc
app-misc/tmuxservice
net-analyzer/zabbix
sys-auth/pam_ssh_agent_auth
sys-fs/mdadm
sys-power/acpid
app-crypt/certbot-nginx
dev-java/openjdk-jre-bin:8
net-misc/unifi-controller-bin
www-servers/nginx