new appliance: git (incl. letsencrypt cert management)
This commit is contained in:
Jörg Deckert
parent
ea9a44228e
commit
fcb157ad9c
|
|
@ -0,0 +1,45 @@
|
||||||
|
preinstall:
|
||||||
|
# switch to hardened, build hardened toolchain, rebuild everything
|
||||||
|
mkdir -p $(CHROOT)/etc/portage/profile
|
||||||
|
echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
|
||||||
|
$(inroot) $(EMERGE) $(USEPKG) --oneshot gcc
|
||||||
|
$(inroot) $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
|
||||||
|
-$(gcc_config)
|
||||||
|
$(inroot) $(EMERGE) $(USEPKG) --emptytree @world
|
||||||
|
$(inroot) bash -c 'yes YES | etc-update --automode -9'
|
||||||
|
|
||||||
|
postinstall: base/timesyncd.conf base/firstboot.start
|
||||||
|
# Konfigurationen anpassen
|
||||||
|
cp base/timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf
|
||||||
|
mkdir -p $(CHROOT)/etc/local.d
|
||||||
|
cp base/firstboot.start $(CHROOT)/etc/local.d/firstboot.start
|
||||||
|
touch $(CHROOT)/firstboot
|
||||||
|
sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers
|
||||||
|
sed -i 's#^auth.*$$#auth [success=2 default=ignore] pam_ssh_agent_auth.so file=~/.ssh/authorized_keys\nauth include system-auth#' $(CHROOT)/etc/pam.d/sudo
|
||||||
|
echo "Defaults env_keep += SSH_AUTH_SOCK" > $(CHROOT)/etc/sudoers.d/ssh_auth_sock
|
||||||
|
$(inroot) useradd -m -G users,wheel -s /bin/bash --comment="virtual appliance admin" --uid 2000 admin
|
||||||
|
$(inroot) passwd -d admin; $(inroot) passwd -e admin
|
||||||
|
$(inroot) systemctl enable tmux@root.service
|
||||||
|
cp base/tmux.conf $(CHROOT)/root/.tmux.conf
|
||||||
|
|
||||||
|
# Beispiel feste IP-Adresse
|
||||||
|
cp base/00-eth0.network $(CHROOT)/00-eth0.network.example
|
||||||
|
|
||||||
|
# MariaDB-Konfiguration ($$, weil make ein $ entfernt)
|
||||||
|
sed -i "s/^character-set-server.*$$/character-set-server = utf8mb4/" $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
sed -iE 's/^\(log-bin\)/#\1/' $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
echo >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
echo "# innodb tuning" >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
echo "innodb_buffer_pool_size = 2G" >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
echo "innodb_strict_mode = OFF" >> $(CHROOT)/etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
cp mariadb/my.cnf.root $(CHROOT)/root/.my.cnf
|
||||||
|
chmod 0600 $(CHROOT)/root/.my.cnf
|
||||||
|
rm -rf $(CHROOT)/var/lib/mysql/*
|
||||||
|
$(inroot) bash -c 'yes gentoo | emerge --config dev-db/mariadb'
|
||||||
|
|
||||||
|
# Apache-Konfiguration
|
||||||
|
sed -i 's/-D LANGUAGE/-D LANGUAGE -D PROXY/' $(CHROOT)/etc/conf.d/apache2
|
||||||
|
mv $(CHROOT)/etc/apache2/vhosts.d/default_vhost.include $(CHROOT)/etc/apache2/vhosts.d/default_vhost.include.orig
|
||||||
|
cp apache/default_vhost.include $(CHROOT)/etc/apache2/vhosts.d/
|
||||||
|
|
||||||
|
clean:
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
Erstkonfiguration
|
||||||
|
=================
|
||||||
|
|
||||||
|
- für variable Daten (Konfiguration) muß eine mit ext4 formatierte Datenpartition mit dem Label "DATA" vorhanden sein. Diese wird nach /DATA gemountet.
|
||||||
|
- feste IP-Adresse und /etc/hosts konfigurieren
|
||||||
|
- unter VMware evtl. open-vm-tools aktivieren
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
ServerAlias letsencrypt
|
||||||
|
ServerAlias gitea
|
||||||
|
|
||||||
|
ServerAdmin root@localhost
|
||||||
|
|
||||||
|
DocumentRoot "/var/www/localhost/htdocs"
|
||||||
|
<Directory "/var/www/localhost/htdocs">
|
||||||
|
Options Indexes FollowSymLinks
|
||||||
|
AllowOverride All
|
||||||
|
Require all granted
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
ProxyPreserveHost On
|
||||||
|
ProxyRequests off
|
||||||
|
AllowEncodedSlashes NoDecode
|
||||||
|
ProxyPass / http://localhost:3000/ nocanon
|
||||||
|
ProxyPassReverse / http://localhost:3000/
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# Beispiel für feste IP-Adreß-Konfiguration:
|
||||||
|
# Anpassen und als 00-eth0.network nach /etc/systemd/network verschieben
|
||||||
|
# (s. "man systemd.network", "man systemd-resolved")
|
||||||
|
#
|
||||||
|
# NICHT VERGESSEN: entsprechende Einträge in /etc/hosts hinzufügen
|
||||||
|
# <IPv4> <FQDN> <Hostname>
|
||||||
|
# <IPv6> <FQDN> <Hostname>
|
||||||
|
|
||||||
|
[Match]
|
||||||
|
Name=eth0
|
||||||
|
|
||||||
|
[Network]
|
||||||
|
Description=1. Netzwerk-Port
|
||||||
|
Address=192.168.1.2/24
|
||||||
|
Address=fdb5:78b:64cc:0:f8c0::2/64
|
||||||
|
Gateway=192.168.1.1
|
||||||
|
Gateway=fdb5:78b:64cc:0:f8c0::1
|
||||||
|
DNS=192.168.1.3
|
||||||
|
DNS=fdb5:78b:64cc:0:f8c0::3
|
||||||
|
NTP=192.168.1.4
|
||||||
|
NTP=fdb5:78b:64cc:0:f8c0::4
|
||||||
|
Domains=unitas-network.de
|
||||||
|
|
@ -0,0 +1,88 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# base settings
|
||||||
|
set -e
|
||||||
|
|
||||||
|
[ -e /firstboot ] || exit 0
|
||||||
|
|
||||||
|
echo 'Setting defaults...'
|
||||||
|
localectl --no-convert set-keymap de-latin1-nodeadkeys
|
||||||
|
|
||||||
|
echo 'Activate services...'
|
||||||
|
timedatectl set-ntp true
|
||||||
|
|
||||||
|
# variables
|
||||||
|
LABEL="DATA"
|
||||||
|
DATABASE_PASS="Di1sgMySQLPwd."
|
||||||
|
|
||||||
|
# Data partition
|
||||||
|
echo 'Mount data partition...'
|
||||||
|
mkdir -p /$LABEL
|
||||||
|
if [ ! -L "/dev/disk/by-label/$LABEL" ]; then
|
||||||
|
echo 'ERROR: Data partition not found!'
|
||||||
|
echo "Please create a data partition with ext4 filesystem and label \"$LABEL\":"
|
||||||
|
echo "# cfdisk /dev/<disk> (use GPT label, create linux partition)"
|
||||||
|
echo "# mkfs.ext4 -L $LABEL /dev/<partition>"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if ! grep -Fq "LABEL=$LABEL" /etc/fstab; then
|
||||||
|
echo "LABEL=$LABEL /$LABEL ext4 noatime 0 1" >> /etc/fstab
|
||||||
|
fi
|
||||||
|
mount -a
|
||||||
|
if ! mount | grep /$LABEL > /dev/null; then
|
||||||
|
echo "ERROR: Could not mount data partition!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -d "/$LABEL/var/lib/mysql/giteadb" ]; then
|
||||||
|
echo 'Initialize MariaDB...'
|
||||||
|
systemctl stop mariadb
|
||||||
|
mkdir -p /$LABEL/var/lib/mysql
|
||||||
|
rm -rf /$LABEL/var/lib/mysql/*
|
||||||
|
cp -a /var/lib/mysql/. /$LABEL/var/lib/mysql
|
||||||
|
sed -i "s:^datadir.*:datadir = /$LABEL/var/lib/mysql:" /etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
systemctl start mariadb
|
||||||
|
|
||||||
|
echo 'Create Gitea database...'
|
||||||
|
mysql -u root -e "CREATE DATABASE giteadb CHARACTER SET 'utf8mb4' COLLATE 'utf8mb4_unicode_ci';"
|
||||||
|
mysql -u root -e "CREATE USER 'gitea'@'localhost' IDENTIFIED BY '$DATABASE_PASS';"
|
||||||
|
mysql -u root -e "GRANT ALL PRIVILEGES ON giteadb.* TO 'gitea'@'localhost' IDENTIFIED by '$DATABASE_PASS';"
|
||||||
|
mysql -u root -e "FLUSH PRIVILEGES;"
|
||||||
|
else
|
||||||
|
echo 'Start MariaDB...'
|
||||||
|
sed -i "s:^datadir.*:datadir = /$LABEL/var/lib/mysql:" /etc/mysql/mariadb.d/50-distro-server.cnf
|
||||||
|
systemctl start mariadb
|
||||||
|
fi
|
||||||
|
echo 'Enable database...'
|
||||||
|
systemctl enable mariadb
|
||||||
|
|
||||||
|
echo 'Start and enable Gitea...'
|
||||||
|
sed -i 's#^HOST = 127.0.0.1:3306#HOST = /run/mysqld/mysqld.sock#' /etc/gitea/app.ini
|
||||||
|
sed -i 's/^NAME = gitea/NAME = giteadb/' /etc/gitea/app.ini
|
||||||
|
sed -i 's/^USER = root/USER = gitea/' /etc/gitea/app.ini
|
||||||
|
sed -i 's/^PASSWD =/PASSWD = `$DATABASE_PASS`/' /etc/gitea/app.ini
|
||||||
|
sed -i 's/^CHARSET = utf8/CHARSET = utf8mb4/' /etc/gitea/app.ini
|
||||||
|
sed -i 's/^JWT_SECRET.*=.*$/JWT_SECRET = '`gitea generate secret JWT_SECRET`'/g' /etc/gitea/app.ini
|
||||||
|
sed -i 's/^INTERNAL_TOKEN.*=.*$/INTERNAL_TOKEN = '`gitea generate secret INTERNAL_TOKEN`'/g' /etc/gitea/app.ini
|
||||||
|
sed -i 's/^SECRET_KEY.*=.*$/SECRET_KEY = '`gitea generate secret SECRET_KEY`'/g' /etc/gitea/app.ini
|
||||||
|
if [ ! -d "/$LABEL/var/lib/gitea" ]; then
|
||||||
|
mkdir -p /$LABEL/var/lib/gitea
|
||||||
|
chown git:git /$LABEL/var/lib/gitea
|
||||||
|
cp -a /var/lib/gitea/. /$LABEL/var/lib/gitea
|
||||||
|
fi
|
||||||
|
mv /var/lib/gitea /var/lib/gitea.orig
|
||||||
|
ln -s /$LABEL/var/lib/gitea /var/lib/gitea
|
||||||
|
systemctl start gitea
|
||||||
|
systemctl enable gitea
|
||||||
|
|
||||||
|
echo 'Start and enable Apache...'
|
||||||
|
if [ ! -d "/$LABEL/etc/ssl/apache2" ]; then
|
||||||
|
mkdir -p /$LABEL/etc/ssl/apache2
|
||||||
|
openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 -subj "/C=DE/ST=TH/L=Virtual/O=Appliance/CN=letsencrypt" -keyout /$LABEL/etc/ssl/apache2/server.key -out /$LABEL/etc/ssl/apache2/server.crt
|
||||||
|
fi
|
||||||
|
rm -rf /etc/ssl/apache2
|
||||||
|
ln -s /$LABEL/etc/ssl/apache2 /etc/ssl/apache2
|
||||||
|
systemctl start apache2
|
||||||
|
systemctl enable apache2
|
||||||
|
|
||||||
|
rm /firstboot
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
# This file is part of systemd.
|
||||||
|
#
|
||||||
|
# systemd is free software; you can redistribute it and/or modify it
|
||||||
|
# under the terms of the GNU Lesser General Public License as published by
|
||||||
|
# the Free Software Foundation; either version 2.1 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# See timesyncd.conf(5) for details.
|
||||||
|
|
||||||
|
[Time]
|
||||||
|
NTP=0.de.pool.ntp.org 1.de.pool.ntp.org 2.de.pool.ntp.org 3.de.pool.ntp.org
|
||||||
|
FallbackNTP=0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
set -g mouse on
|
||||||
|
set-option -g set-titles on
|
||||||
|
set-option -g set-titles-string "#S / #T"
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
##HOSTNAME = $(APPLIANCE)
|
||||||
|
##TIMEZONE = UTC
|
||||||
|
DISK_SIZE = 8.0G
|
||||||
|
##SWAP_SIZE = 30
|
||||||
|
##SWAP_FILE = $(CHROOT)/.swap
|
||||||
|
##ARCH = amd64-hardened
|
||||||
|
##MAKEOPTS = -j10 -l10
|
||||||
|
##PRUNE_CRITICAL = NO
|
||||||
|
##CHANGE_PASSWORD = YES
|
||||||
|
##HEADLESS = NO
|
||||||
|
##SOFTWARE = 1
|
||||||
|
##PKGLIST = 0
|
||||||
|
##RSYNC_MIRROR = rsync://rsync15.de.gentoo.org/gentoo/
|
||||||
|
##KERNEL_PKG = gentoo-sources
|
||||||
|
KERNEL_CONFIG = appliances/$(APPLIANCE)/kernel.config
|
||||||
|
ENABLE_SSHD = YES
|
||||||
|
TIMEZONE=Europe/Berlin
|
||||||
|
LOCALE=de_DE.utf8
|
||||||
|
REPO_NAMES = unitas-misc unitas-letsencrypt
|
||||||
|
REPO_URI_unitas-misc = https://dev.unitas-network.de/r/Gentoo/unitas-misc.git
|
||||||
|
REPO_URI_unitas-letsencrypt = https://dev.unitas-network.de/r/Gentoo/unitas-letsencrypt.git
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,8 @@
|
||||||
|
CFLAGS="-O2 -pipe"
|
||||||
|
CXXFLAGS="-O2 -pipe"
|
||||||
|
USE="hardened justify pie ssp urandom xattr -fortran -pch -pic -prelink -profile -tcc"
|
||||||
|
MAKEOPTS="-j5"
|
||||||
|
ACCEPT_LICENSE="*"
|
||||||
|
PYTHON_TARGETS="python3_7"
|
||||||
|
PYTHON_SINGLE_TARGET="python3_7"
|
||||||
|
VIDEO_CARDS="vmware"
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
[mysqladmin]
|
||||||
|
user = root
|
||||||
|
password = gentoo
|
||||||
|
|
||||||
|
[mysql]
|
||||||
|
user = root
|
||||||
|
password = gentoo
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
# Grundsystem
|
||||||
|
app-emulation/open-vm-tools
|
||||||
|
sys-auth/pam_ssh_agent_auth
|
||||||
|
|
||||||
|
# Gitea
|
||||||
|
dev-vcs/git-crypt
|
||||||
|
www-apps/gitea
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
app-admin/sudo -sendmail
|
||||||
|
app-editors/nano ncurses
|
||||||
|
app-emulation/open-vm-tools pic -modules
|
||||||
|
app-misc/mc -slang
|
||||||
|
dev-lang/python ssl threads xml
|
||||||
|
dev-libs/libpcre cxx jit
|
||||||
|
dev-libs/libpcre2 jit
|
||||||
|
dev-util/pkgconfig internal-glib
|
||||||
|
dev-vcs/git -python
|
||||||
|
net-misc/openssh ssl
|
||||||
|
net-misc/wget ssl
|
||||||
|
sys-apps/hwids udev
|
||||||
|
sys-apps/kmod tools
|
||||||
|
sys-apps/net-tools hostname
|
||||||
|
sys-apps/portage ipc
|
||||||
|
sys-auth/pambase nullok sha512
|
||||||
|
sys-devel/gcc cxx nptl
|
||||||
|
sys-kernel/gentoo-sources symlink
|
||||||
|
|
||||||
|
# Monitoring
|
||||||
|
net-analyzer/zabbix agent
|
||||||
|
|
||||||
|
# Apache
|
||||||
|
www-servers/apache apache2_modules_proxy apache2_modules_proxy_ajp apache2_modules_proxy_connect apache2_modules_proxy_http apache2_modules_proxy_wstunnel
|
||||||
|
|
||||||
|
# Gitea
|
||||||
|
acct-user/git gitea
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
app-admin/logrotate
|
||||||
|
app-admin/sudo
|
||||||
|
app-emulation/open-vm-tools
|
||||||
|
app-emulation/qemu-guest-agent
|
||||||
|
app-misc/mc
|
||||||
|
app-misc/tmuxservice
|
||||||
|
net-analyzer/zabbix
|
||||||
|
sys-auth/pam_ssh_agent_auth
|
||||||
|
sys-fs/mdadm
|
||||||
|
sys-power/acpid
|
||||||
|
app-crypt/certbot
|
||||||
|
app-crypt/certbot-apache
|
||||||
|
app-crypt/certbot-dns-hetzner
|
||||||
|
dev-db/mariadb
|
||||||
|
dev-python/requests-mock
|
||||||
|
dev-vcs/git-crypt
|
||||||
|
www-servers/apache
|
||||||
|
www-apps/gitea
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
# certbot braucht das (fehlendes DEP im ebuild)
|
||||||
|
dev-python/requests-mock
|
||||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue