new appliance: git (incl. letsencrypt cert management)

git/Makefile

@@ -0,0 +1,45 @@
+preinstall:
+	# switch to hardened, build hardened toolchain, rebuild everything
+	mkdir -p $(CHROOT)/etc/portage/profile
+	echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
+	$(inroot) $(EMERGE) $(USEPKG) --oneshot gcc
+	$(inroot) $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
+	-$(gcc_config)
+	$(inroot) $(EMERGE) $(USEPKG) --emptytree @world
+	$(inroot) bash -c 'yes YES | etc-update --automode -9'
+
+postinstall: base/timesyncd.conf base/firstboot.start
+	# Konfigurationen anpassen
+	cp base/timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf
+	mkdir -p $(CHROOT)/etc/local.d
+	cp base/firstboot.start $(CHROOT)/etc/local.d/firstboot.start
+	touch $(CHROOT)/firstboot
+	sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers
+	sed -i 's#^auth.*$$#auth [success=2 default=ignore] pam_ssh_agent_auth.so file=~/.ssh/authorized_keys\nauth    include         system-auth#' $(CHROOT)/etc/pam.d/sudo
+	echo "Defaults   env_keep += SSH_AUTH_SOCK" > $(CHROOT)/etc/sudoers.d/ssh_auth_sock
+	$(inroot) useradd -m -G users,wheel -s /bin/bash --comment="virtual appliance admin" --uid 2000 admin
+	$(inroot) passwd -d admin; $(inroot) passwd -e admin
+	$(inroot) systemctl enable tmux@root.service
+	cp base/tmux.conf $(CHROOT)/root/.tmux.conf
+
+	# Beispiel feste IP-Adresse
+	cp base/00-eth0.network $(CHROOT)/00-eth0.network.example
+
+	# MariaDB-Konfiguration ($$, weil make ein $ entfernt)
+	sed -i "s/^character-set-server.*$$/character-set-server = utf8mb4/" $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
+	sed -iE 's/^\(log-bin\)/#\1/' $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
+	echo >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
+	echo "# innodb tuning" >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
+	echo "innodb_buffer_pool_size = 2G" >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
+	echo "innodb_strict_mode = OFF" >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
+	cp mariadb/my.cnf.root $(CHROOT)/root/.my.cnf
+	chmod 0600 $(CHROOT)/root/.my.cnf
+	rm -rf $(CHROOT)/var/lib/mysql/*
+	$(inroot) bash -c 'yes gentoo | emerge --config dev-db/mariadb'
+
+	# Apache-Konfiguration
+	sed -i 's/-D LANGUAGE/-D LANGUAGE -D PROXY/' $(CHROOT)/etc/conf.d/apache2
+	mv $(CHROOT)/etc/apache2/vhosts.d/default_vhost.include $(CHROOT)/etc/apache2/vhosts.d/default_vhost.include.orig
+	cp apache/default_vhost.include $(CHROOT)/etc/apache2/vhosts.d/
+
+clean:

git/README.md

@@ -0,0 +1,6 @@
+Erstkonfiguration
+=================
+
+- für variable Daten (Konfiguration) muß eine mit ext4 formatierte Datenpartition mit dem Label "DATA" vorhanden sein. Diese wird nach /DATA gemountet.
+- feste IP-Adresse und /etc/hosts konfigurieren
+- unter VMware evtl. open-vm-tools aktivieren

git/apache/default_vhost.include

@@ -0,0 +1,17 @@
+ServerAlias letsencrypt
+ServerAlias gitea
+
+ServerAdmin root@localhost
+
+DocumentRoot "/var/www/localhost/htdocs"
+<Directory "/var/www/localhost/htdocs">
+	Options Indexes FollowSymLinks
+	AllowOverride All
+	Require all granted
+</Directory>
+
+ProxyPreserveHost On
+ProxyRequests off
+AllowEncodedSlashes NoDecode
+ProxyPass / http://localhost:3000/ nocanon
+ProxyPassReverse / http://localhost:3000/

git/base/00-eth0.network

@@ -0,0 +1,22 @@
+# Beispiel für feste IP-Adreß-Konfiguration:
+# Anpassen und als 00-eth0.network nach /etc/systemd/network verschieben
+# (s. "man systemd.network", "man systemd-resolved")
+#
+# NICHT VERGESSEN: entsprechende Einträge in /etc/hosts hinzufügen
+#  <IPv4> <FQDN> <Hostname>
+#  <IPv6> <FQDN> <Hostname>
+
+[Match]
+Name=eth0
+
+[Network]
+Description=1. Netzwerk-Port
+Address=192.168.1.2/24
+Address=fdb5:78b:64cc:0:f8c0::2/64
+Gateway=192.168.1.1
+Gateway=fdb5:78b:64cc:0:f8c0::1
+DNS=192.168.1.3
+DNS=fdb5:78b:64cc:0:f8c0::3
+NTP=192.168.1.4
+NTP=fdb5:78b:64cc:0:f8c0::4
+Domains=unitas-network.de

git/base/firstboot.start

@@ -0,0 +1,88 @@
+#!/bin/bash
+
+# base settings
+set -e
+
+[ -e /firstboot ] || exit 0
+
+echo 'Setting defaults...'
+localectl --no-convert set-keymap de-latin1-nodeadkeys
+
+echo 'Activate services...'
+timedatectl set-ntp true
+
+# variables
+LABEL="DATA"
+DATABASE_PASS="Di1sgMySQLPwd."
+
+# Data partition
+echo 'Mount data partition...'
+mkdir -p /$LABEL
+if [ ! -L "/dev/disk/by-label/$LABEL" ]; then
+    echo 'ERROR: Data partition not found!'
+    echo "Please create a data partition with ext4 filesystem and label \"$LABEL\":"
+    echo "# cfdisk /dev/<disk> (use GPT label, create linux partition)"
+    echo "# mkfs.ext4 -L $LABEL /dev/<partition>"
+    exit 1
+fi
+if ! grep -Fq "LABEL=$LABEL" /etc/fstab; then
+    echo "LABEL=$LABEL  /$LABEL  ext4  noatime  0 1" >> /etc/fstab
+fi
+mount -a
+if ! mount | grep /$LABEL > /dev/null; then
+    echo "ERROR: Could not mount data partition!"
+    exit 1
+fi
+
+if [ ! -d "/$LABEL/var/lib/mysql/giteadb" ]; then
+    echo 'Initialize MariaDB...'
+    systemctl stop mariadb
+    mkdir -p /$LABEL/var/lib/mysql
+    rm -rf /$LABEL/var/lib/mysql/*
+    cp -a /var/lib/mysql/. /$LABEL/var/lib/mysql
+    sed -i "s:^datadir.*:datadir                                    = /$LABEL/var/lib/mysql:" /etc/mysql/mariadb.d/50-distro-server.cnf
+    systemctl start mariadb
+
+    echo 'Create Gitea database...'
+    mysql -u root -e "CREATE DATABASE giteadb CHARACTER SET 'utf8mb4' COLLATE 'utf8mb4_unicode_ci';"
+    mysql -u root -e "CREATE USER 'gitea'@'localhost' IDENTIFIED BY '$DATABASE_PASS';"
+    mysql -u root -e "GRANT ALL PRIVILEGES ON giteadb.* TO 'gitea'@'localhost' IDENTIFIED by '$DATABASE_PASS';"
+    mysql -u root -e "FLUSH PRIVILEGES;"
+else
+    echo 'Start MariaDB...'
+    sed -i "s:^datadir.*:datadir                                    = /$LABEL/var/lib/mysql:" /etc/mysql/mariadb.d/50-distro-server.cnf
+    systemctl start mariadb
+fi
+echo 'Enable database...'
+systemctl enable mariadb
+
+echo 'Start and enable Gitea...'
+sed -i 's#^HOST = 127.0.0.1:3306#HOST = /run/mysqld/mysqld.sock#' /etc/gitea/app.ini
+sed -i 's/^NAME = gitea/NAME = giteadb/' /etc/gitea/app.ini
+sed -i 's/^USER = root/USER = gitea/' /etc/gitea/app.ini
+sed -i 's/^PASSWD =/PASSWD = `$DATABASE_PASS`/' /etc/gitea/app.ini
+sed -i 's/^CHARSET = utf8/CHARSET = utf8mb4/' /etc/gitea/app.ini
+sed -i 's/^JWT_SECRET.*=.*$/JWT_SECRET = '`gitea generate secret JWT_SECRET`'/g' /etc/gitea/app.ini
+sed -i 's/^INTERNAL_TOKEN.*=.*$/INTERNAL_TOKEN = '`gitea generate secret INTERNAL_TOKEN`'/g' /etc/gitea/app.ini
+sed -i 's/^SECRET_KEY.*=.*$/SECRET_KEY = '`gitea generate secret SECRET_KEY`'/g' /etc/gitea/app.ini
+if [ ! -d "/$LABEL/var/lib/gitea" ]; then
+    mkdir -p /$LABEL/var/lib/gitea
+    chown git:git /$LABEL/var/lib/gitea
+    cp -a /var/lib/gitea/. /$LABEL/var/lib/gitea
+fi
+mv /var/lib/gitea /var/lib/gitea.orig
+ln -s /$LABEL/var/lib/gitea /var/lib/gitea
+systemctl start gitea
+systemctl enable gitea
+
+echo 'Start and enable Apache...'
+if [ ! -d "/$LABEL/etc/ssl/apache2" ]; then
+    mkdir -p /$LABEL/etc/ssl/apache2
+    openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 -subj "/C=DE/ST=TH/L=Virtual/O=Appliance/CN=letsencrypt" -keyout /$LABEL/etc/ssl/apache2/server.key  -out /$LABEL/etc/ssl/apache2/server.crt
+fi
+rm -rf /etc/ssl/apache2
+ln -s /$LABEL/etc/ssl/apache2 /etc/ssl/apache2
+systemctl start apache2
+systemctl enable apache2
+
+rm /firstboot

git/base/timesyncd.conf

@@ -0,0 +1,12 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+#
+# See timesyncd.conf(5) for details.
+
+[Time]
+NTP=0.de.pool.ntp.org 1.de.pool.ntp.org 2.de.pool.ntp.org 3.de.pool.ntp.org
+FallbackNTP=0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org

git/base/tmux.conf

@@ -0,0 +1,3 @@
+set -g mouse on
+set-option -g set-titles on
+set-option -g set-titles-string "#S / #T"

git/git.cfg

@@ -0,0 +1,21 @@
+##HOSTNAME = $(APPLIANCE)
+##TIMEZONE = UTC
+DISK_SIZE = 8.0G
+##SWAP_SIZE = 30
+##SWAP_FILE = $(CHROOT)/.swap
+##ARCH = amd64-hardened
+##MAKEOPTS = -j10 -l10
+##PRUNE_CRITICAL = NO
+##CHANGE_PASSWORD = YES
+##HEADLESS = NO
+##SOFTWARE = 1
+##PKGLIST = 0
+##RSYNC_MIRROR = rsync://rsync15.de.gentoo.org/gentoo/
+##KERNEL_PKG = gentoo-sources
+KERNEL_CONFIG = appliances/$(APPLIANCE)/kernel.config
+ENABLE_SSHD = YES
+TIMEZONE=Europe/Berlin
+LOCALE=de_DE.utf8
+REPO_NAMES = unitas-misc unitas-letsencrypt
+REPO_URI_unitas-misc = https://dev.unitas-network.de/r/Gentoo/unitas-misc.git
+REPO_URI_unitas-letsencrypt = https://dev.unitas-network.de/r/Gentoo/unitas-letsencrypt.git

git/make.conf

@@ -0,0 +1,8 @@
+CFLAGS="-O2 -pipe"
+CXXFLAGS="-O2 -pipe"
+USE="hardened justify pie ssp urandom xattr -fortran -pch -pic -prelink -profile -tcc"
+MAKEOPTS="-j5"
+ACCEPT_LICENSE="*"
+PYTHON_TARGETS="python3_7"
+PYTHON_SINGLE_TARGET="python3_7"
+VIDEO_CARDS="vmware"

git/mariadb/my.cnf.root

@@ -0,0 +1,7 @@
+[mysqladmin]
+user        = root
+password    = gentoo
+
+[mysql]
+user        = root
+password    = gentoo

git/package.keywords

@@ -0,0 +1,7 @@
+# Grundsystem
+app-emulation/open-vm-tools
+sys-auth/pam_ssh_agent_auth
+
+# Gitea
+dev-vcs/git-crypt
+www-apps/gitea

git/package.use

@@ -0,0 +1,27 @@
+app-admin/sudo -sendmail
+app-editors/nano ncurses
+app-emulation/open-vm-tools pic -modules
+app-misc/mc -slang
+dev-lang/python ssl threads xml
+dev-libs/libpcre cxx jit
+dev-libs/libpcre2 jit
+dev-util/pkgconfig internal-glib
+dev-vcs/git -python
+net-misc/openssh ssl
+net-misc/wget ssl
+sys-apps/hwids udev
+sys-apps/kmod tools
+sys-apps/net-tools hostname
+sys-apps/portage ipc
+sys-auth/pambase nullok sha512
+sys-devel/gcc cxx nptl
+sys-kernel/gentoo-sources symlink
+
+# Monitoring
+net-analyzer/zabbix agent
+
+# Apache
+www-servers/apache apache2_modules_proxy apache2_modules_proxy_ajp apache2_modules_proxy_connect apache2_modules_proxy_http apache2_modules_proxy_wstunnel
+
+# Gitea
+acct-user/git gitea

git/world

@@ -0,0 +1,18 @@
+app-admin/logrotate
+app-admin/sudo
+app-emulation/open-vm-tools
+app-emulation/qemu-guest-agent
+app-misc/mc
+app-misc/tmuxservice
+net-analyzer/zabbix
+sys-auth/pam_ssh_agent_auth
+sys-fs/mdadm
+sys-power/acpid
+app-crypt/certbot
+app-crypt/certbot-apache
+app-crypt/certbot-dns-hetzner
+dev-db/mariadb
+dev-python/requests-mock
+dev-vcs/git-crypt
+www-servers/apache
+www-apps/gitea

git/world.README.md

@@ -0,0 +1,2 @@
+# certbot braucht das (fehlendes DEP im ebuild)
+dev-python/requests-mock