Compare commits
6 Commits
323b4dd306
...
33cf371a0d
Author | SHA1 | Date |
---|---|---|
DarkFeather | 33cf371a0d | |
DarkFeather | 9aa0a89b79 | |
DarkFeather | 3a01543c8b | |
DarkFeather | 87973dfb6e | |
DarkFeather | 85286b5412 | |
DarkFeather | 6f36d515e3 |
|
@ -1,7 +1,7 @@
|
|||
# Generated files
|
||||
roles/Node/files/*-vm.service
|
||||
roles/Nazara/files/dns
|
||||
roles/Nazara/files/dhcp
|
||||
roles/Chappaai/files/dns
|
||||
roles/Chappaai/files/dhcp
|
||||
roles/Node/files/vm-definitions/**
|
||||
roles/ShadowArch/files/mirrorlist
|
||||
roles/Sharingan/files/monit/checks/availability
|
||||
|
|
|
@ -11,6 +11,7 @@
|
|||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
import re
|
||||
import yaml
|
||||
|
||||
rolepath='../roles/Sharingan/files'
|
||||
|
|
|
@ -2,6 +2,7 @@
|
|||
# File: generate-pihole-dns-dhcp.py
|
||||
#
|
||||
# Description: This file generates the DNS and DHCP files for pihole.
|
||||
# It expects that the inventory has two levels of grouping.
|
||||
#
|
||||
# Package: AniNIX/Ubiqtorate
|
||||
# Copyright: WTFPL
|
||||
|
@ -9,43 +10,37 @@
|
|||
# Author: DarkFeather <darkfeather@aninix.net>
|
||||
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import yaml
|
||||
from kapisi_lib import *
|
||||
|
||||
rolepath='../roles/Nazara/files'
|
||||
rolepath='../roles/Chappaai/files'
|
||||
dnsfilepath=rolepath+"/dns"
|
||||
dhcpfilepath=rolepath+"/dhcp"
|
||||
entryset={}
|
||||
|
||||
def WriteDHCPEntry(content,hosttype,hostclass):
|
||||
def WriteDHCPEntries(replica_domain,dhcpfile):
|
||||
### Create the DHCP entry
|
||||
# param content: the yaml content to parse
|
||||
# param hosttype: managed or unmanaged
|
||||
# param hostclass: the type of host as classified in the yaml
|
||||
global dhcpfile
|
||||
global entryset
|
||||
for host in entryset:
|
||||
# Entries should be:
|
||||
# dhcp-host=mac,ip,fqdn
|
||||
dhcpfile.write('dhcp-host=' + entryset[host][1] + ',' + entryset[host][0] + ',' + host + '.' + replica_domain + '\n')
|
||||
|
||||
with open(dhcpfilepath,'a') as dhcpfile:
|
||||
for host in content['all']['children'][hosttype]['children'][hostclass]['hosts']:
|
||||
try:
|
||||
dhcpfile.write('dhcp-host=' + content['all']['children'][hosttype]['children'][hostclass]['hosts'][host]['mac'] + ',' + content['all']['children'][hosttype]['children'][hostclass]['hosts'][host]['ip'] + ',' + host + '.' + content['all']['vars']['replica_domain'] + '\n')
|
||||
except:
|
||||
print(host + ' is not complete for DHCP.')
|
||||
|
||||
def WriteDNSEntry(content,hosttype,hostclass):
|
||||
def WriteDNSEntries(replica_domain,dnsfile):
|
||||
### Create the DNS entry
|
||||
# param content: the yaml content to parse
|
||||
# param hosttype: managed or unmanaged
|
||||
# param hostclass: the type of host as classified in the yaml
|
||||
global dnsfile
|
||||
|
||||
with open(dnsfilepath,'a') as dnsfile:
|
||||
|
||||
# Write host entries
|
||||
for host in content['all']['children'][hosttype]['children'][hostclass]['hosts']:
|
||||
try:
|
||||
dnsfile.write(content['all']['children'][hosttype]['children'][hostclass]['hosts'][host]['ip'] + ' ' + host + '.' + content['all']['vars']['replica_domain'] + ' ' + host + '\n')
|
||||
except:
|
||||
print(host + ' is not complete for DNS.')
|
||||
global entryset
|
||||
for host in entryset:
|
||||
# Entries should be:
|
||||
# ip host fqdn
|
||||
dnsfile.write(entryset[host][0] + ' ' + host + '.' + replica_domain + ' ' + host + '\n')
|
||||
|
||||
def GenerateFiles(file):
|
||||
### Open the file and parse it
|
||||
|
@ -58,29 +53,30 @@ def GenerateFiles(file):
|
|||
# Parse the yaml
|
||||
with open(file, 'r') as stream:
|
||||
content = yaml.safe_load(stream)
|
||||
replica_domain = content['all']['vars']['replica_domain']
|
||||
external_domain = content['all']['vars']['external_domain']
|
||||
|
||||
# Clear the DNS file
|
||||
with open(dhcpfilepath,'w') as dhcpfile:
|
||||
dhcpfile.write('dhcp-range='+content['all']['vars']['dhcprange']+'\n')
|
||||
dhcpfile.write('dhcp-option=option:dns-server,'+content['all']['vars']['dns']+'\n\n')
|
||||
dhcpfile.write('dhcp-range='+content['all']['vars']['staticrange']+'\n')
|
||||
WriteDHCPEntries(replica_domain,dhcpfile)
|
||||
with open(dnsfilepath,'w') as dnsfile:
|
||||
vips=subprocess.run(["/bin/bash", "-c", "echo | openssl s_client -connect "+content['all']['vars']['external_domain']+":443 | openssl x509 -text -noout | grep DNS: | tr ',' '\n' | sed 's/\s\+DNS://' | grep -ivE ^"+content['all']['vars']['external_domain']+" | tr '\n' ' '"], capture_output=True).stdout.decode("utf-8")
|
||||
dnsfile.write(content['all']['vars']['webfront']+' '+content['all']['vars']['external_domain']+' '+vips+"\n")
|
||||
|
||||
# Add DNS entries for each host
|
||||
hosttype = 'managed'
|
||||
for hostclass in ['physical','virtual','geth_hubs']:
|
||||
WriteDNSEntry(content,hosttype,hostclass)
|
||||
WriteDHCPEntry(content,hosttype,hostclass)
|
||||
hosttype = 'unmanaged'
|
||||
for hostclass in ['ovas','test_ovas','appliances','adhoc_appliances','iot']:
|
||||
WriteDNSEntry(content,hosttype,hostclass)
|
||||
WriteDHCPEntry(content,hosttype,hostclass)
|
||||
dnsfile.write(content['all']['vars']['webfront']+' '+external_domain+' '+content['all']['vars']['external_subdomains'].replace(' ','.'+external_domain+' ')+'.'+external_domain+' '+content['all']['vars']['hosted_domains']+"\n")
|
||||
WriteDNSEntries(replica_domain,dnsfile)
|
||||
print('Files should be in '+rolepath);
|
||||
|
||||
### Main function
|
||||
# param sys.argv: Input arguments
|
||||
if __name__ == '__main__':
|
||||
if len(sys.argv) != 2:
|
||||
if len(sys.argv) < 2:
|
||||
print("You need to supply an inventory file.")
|
||||
sys.exit(1)
|
||||
if len(sys.argv) == 3:
|
||||
entryset = TrackIPEntries(sys.argv[1],sys.argv[2])
|
||||
else:
|
||||
entryset = TrackIPEntries(sys.argv[1])
|
||||
GenerateFiles(sys.argv[1])
|
||||
#dumper.dump(entryset)
|
||||
sys.exit(0)
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
#!/bin/bash
|
||||
|
||||
# File: gen-ssh-keyscan
|
||||
# File: ./generate-ssh-keyscan
|
||||
#
|
||||
# Description: This file generates a known_host block for the inventory.
|
||||
#
|
||||
|
|
|
@ -0,0 +1,63 @@
|
|||
import re
|
||||
import yaml
|
||||
from types import SimpleNamespace
|
||||
from yamlpath.common import Parsers
|
||||
from yamlpath.wrappers import ConsolePrinter
|
||||
from yamlpath import Processor
|
||||
from yamlpath import YAMLPath
|
||||
from yamlpath.exceptions import YAMLPathException
|
||||
|
||||
def TrackIPEntries(yaml_file,searchstring='all.children.**.ip'):
|
||||
### Try to parse an Ansible inventory for hosts with the 'ip' attribute.
|
||||
# param file: the file to parse
|
||||
# return: a populated entry set in form [{Host,[ip,mac]},...]
|
||||
|
||||
# Borrowing from upstream author's example at https://pypi.org/project/yamlpath/
|
||||
|
||||
entryset = {}
|
||||
|
||||
# The various classes of this library must be able to write messages somewhere
|
||||
# when things go bad.
|
||||
#logging_args = SimpleNamespace(quiet=True, verbose=False, debug=False)
|
||||
logging_args = SimpleNamespace(quiet=True, verbose=True, debug=True)
|
||||
log = ConsolePrinter(logging_args)
|
||||
|
||||
# Prep the YAML parser
|
||||
yaml = Parsers.get_yaml_editor()
|
||||
(yaml_data, doc_loaded) = Parsers.get_yaml_data(yaml, log, yaml_file)
|
||||
if not doc_loaded:
|
||||
exit(1)
|
||||
processor = Processor(log, yaml_data)
|
||||
|
||||
yaml_path = YAMLPath(searchstring)
|
||||
|
||||
# Create a regex pattern to remove the end of the path
|
||||
ippattern = re.compile('\.ip$')
|
||||
try:
|
||||
for node_coordinate in processor.get_nodes(yaml_path, mustexist=True):
|
||||
# Strip the path to the host entry.
|
||||
path = ippattern.sub("",str(node_coordinate.path))
|
||||
# Pull the IP
|
||||
ip = str(node_coordinate.node)
|
||||
# Pull the hosname
|
||||
splitpath = path.split('.')
|
||||
hostname = splitpath[len(splitpath)-1]
|
||||
#print("Got {} from '{}''.".format(ip,path))
|
||||
|
||||
# Path the MAC
|
||||
mac_yaml_path = YAMLPath(path+".mac")
|
||||
mac=""
|
||||
try:
|
||||
for node_coordinate in processor.get_nodes(mac_yaml_path, mustexist=True):
|
||||
mac = str(node_coordinate.node)
|
||||
except YAMLPathException as ex:
|
||||
log.error(ex)
|
||||
|
||||
# Add the host to the entryset.
|
||||
entryset.update({ hostname : [ip,mac] })
|
||||
|
||||
except YAMLPathException as ex:
|
||||
log.error(ex)
|
||||
|
||||
finally:
|
||||
return entryset
|
|
@ -21,7 +21,7 @@ function usage() {
|
|||
# Show helptext
|
||||
# param retcode: what to exit
|
||||
retcode="$1"
|
||||
echo "Usage: $0 [ -o offset ] [-g group ] -i inventory.yml"
|
||||
echo "Usage: $0 [ -o offset ] [-g group ] [-i inventory.yml]"
|
||||
echo " $0 -h"
|
||||
echo "Group is optional -- add it if you only want to look at a specific subset."
|
||||
echo "Add -v for verbosity."
|
||||
|
@ -78,8 +78,7 @@ if [ "$(basename $0)" == "tmux-hosts" ]; then
|
|||
done
|
||||
|
||||
if [ -z "$inventory" ]; then
|
||||
echo Need an inventory.
|
||||
usage 2;
|
||||
inventory=$(grep -E ^inventory ~/.ansible.cfg | cut -f 2 -d '=')
|
||||
fi
|
||||
|
||||
tmuxHosts $(ansible -i "$inventory" --list-hosts "$group"\
|
||||
|
|
|
@ -1,7 +1,9 @@
|
|||
all:
|
||||
vars:
|
||||
# Environment-wide data
|
||||
external_domain: aninix.net
|
||||
external_domain: "aninix.net"
|
||||
external_subdomains: "cyberbrain foundation irc lykos maat password sharingan singularity superintendent www yggdrasil"
|
||||
hosted_domains: "travelpawscvt.com"
|
||||
replica_domain: "MSN0.AniNIX.net"
|
||||
time_zone: "America/Chicago"
|
||||
# Services used by all
|
||||
|
@ -19,7 +21,7 @@ all:
|
|||
ansible_become_method: sudo
|
||||
ansible_become_user: root
|
||||
static: false
|
||||
wireless_ssid: 'Shadowfeed'
|
||||
wireless_ssid: 'Shadownet'
|
||||
ansible_python_interpreter: auto_silent
|
||||
ldap:
|
||||
server: "10.0.1.3"
|
||||
|
@ -32,57 +34,75 @@ all:
|
|||
displayname: 'AniNIX'
|
||||
gpgkey: '904DE6275579CB589D85720C1CC1E3F4ED06F296'
|
||||
ssl: # Standard SSL cryptographic standards
|
||||
identity: 'aninix.net-0001' # The Let's Encrypt identity to use
|
||||
identity: 'aninix.net-0002' # The Let's Encrypt identity to use
|
||||
ciphersuite: "!NULL:!SSLv2:!SSLv3:!TLSv1:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
|
||||
children:
|
||||
managed:
|
||||
children:
|
||||
physical: # 10.0.1.0/28
|
||||
hosts:
|
||||
Nazara:
|
||||
Chappaai:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.2
|
||||
mac: B8:27:EB:B6:AA:0C
|
||||
static: true
|
||||
Maker:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.14
|
||||
mac: B8:27:EB:B6:AA:0D
|
||||
static: true
|
||||
children:
|
||||
Node:
|
||||
hosts:
|
||||
Node1:
|
||||
ipinterface: enp1s0
|
||||
ip: 10.0.1.5
|
||||
mac: FA:EC:43:87:4D:2D
|
||||
tap: true
|
||||
ups: 'aps'
|
||||
active_vms:
|
||||
- Yggdrasil
|
||||
Node2:
|
||||
ipinterface: enp1s0
|
||||
ip: 10.0.1.7
|
||||
mac: 56:02:ef:2c:1f:7c
|
||||
tap: true
|
||||
ups: 'cyberpower'
|
||||
active_vms:
|
||||
- DarkNet
|
||||
- Maat
|
||||
- Sharingan
|
||||
- Superintendent
|
||||
Node3:
|
||||
ipinterface: enp1s0
|
||||
ip: 10.0.1.8
|
||||
mac: B2:C6:2C:02:B2:6E
|
||||
tap: true
|
||||
Nodelet0:
|
||||
active_vms:
|
||||
- TDS-Jump
|
||||
Geth:
|
||||
hosts:
|
||||
Geth0:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.9
|
||||
mac: b8:27:eb:9a:73:dd
|
||||
mac: 84:16:F9:14:15:C5
|
||||
static: true
|
||||
k3s_primary: true
|
||||
Nodelet1:
|
||||
Geth1:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.10
|
||||
mac: E4:5F:01:01:FF:9C
|
||||
static: true
|
||||
Nodelet2:
|
||||
Geth2:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.11
|
||||
mac: E4:5F:01:01:FF:D5
|
||||
static: true
|
||||
Nodelet3:
|
||||
Geth3:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.12
|
||||
mac: E4:5F:01:01:FF:96
|
||||
static: true
|
||||
Nodelet4:
|
||||
Geth4:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.13
|
||||
mac: E4:5F:01:01:FF:E4
|
||||
|
@ -91,7 +111,6 @@ all:
|
|||
vars:
|
||||
hosts:
|
||||
Sharingan:
|
||||
node: Node2
|
||||
ip: 10.0.1.16
|
||||
ipinterface: ens3
|
||||
mac: 00:15:5D:01:02:10
|
||||
|
@ -106,7 +125,6 @@ all:
|
|||
# On hold because of https://aninix.net/DarkFeather/MSN0/issues/6
|
||||
holdpkg: "elasticsearch graylog mongodb44-bin mongodb-tools-bin"
|
||||
DarkNet:
|
||||
node: Node2
|
||||
ipinterface: ens3
|
||||
ip: 10.0.1.17
|
||||
mac: 00:15:5D:01:02:05
|
||||
|
@ -118,19 +136,18 @@ all:
|
|||
- '-drive format=raw,index=0,media=disk,file=/dev/sdb'
|
||||
wolfpack_config: 'gitea@foundation.aninix.net:DarkFeather/WolfPack-Config.git'
|
||||
Maat:
|
||||
node: Node2
|
||||
ip: 10.0.1.18
|
||||
ipinterface: ens3
|
||||
mac: 00:15:5d:01:02:07
|
||||
cores: 2
|
||||
memory: 2
|
||||
bridge: br0
|
||||
vscan_enabled: true
|
||||
vnc: 7
|
||||
disks:
|
||||
- '-drive format=qcow2,l2-cache-size=8M,file=/mnt/cage2/vm/Maat.qcow2'
|
||||
Yggdrasil:
|
||||
node: Node1
|
||||
ipinterface: enp1s0f0
|
||||
ipinterface: ens3
|
||||
ip: 10.0.1.3
|
||||
mac: 00:25:90:0d:6e:86
|
||||
static: true
|
||||
|
@ -142,6 +159,7 @@ all:
|
|||
memory: 16
|
||||
bridge: br0
|
||||
vnc: 1
|
||||
vscan_enabled: true
|
||||
disks:
|
||||
- '-drive format=raw,index=0,media=disk,file=/dev/sda'
|
||||
- '-drive format=raw,index=0,media=disk,file=/dev/sdb'
|
||||
|
@ -151,18 +169,18 @@ all:
|
|||
vars:
|
||||
motion_enabled: yes
|
||||
hosts:
|
||||
Geth-Hub-1:
|
||||
Vergil1:
|
||||
ip: 10.0.1.32
|
||||
mac: 84:16:F9:14:15:C5
|
||||
mac: b8:27:eb:9a:73:dd
|
||||
rotate: 0
|
||||
remote: NS-RC4NA-14
|
||||
Geth-Hub-2:
|
||||
Vergil2:
|
||||
ip: 10.0.1.33
|
||||
mac: 84:16:F9:13:B6:E6
|
||||
motion_enabled: no
|
||||
rotate: 180
|
||||
remote: NS-RC4NA-14
|
||||
Geth-Hub-3:
|
||||
Vergil3:
|
||||
ip: 10.0.1.34
|
||||
mac: b8:27:eb:60:73:68
|
||||
rotate: 90
|
||||
|
@ -172,8 +190,7 @@ all:
|
|||
# Both OVA groups are in the same subnet -- test_ovas aren't monitored
|
||||
ovas: # 10.0.1.48/28
|
||||
hosts:
|
||||
Geth:
|
||||
node: Node2
|
||||
Superintendent:
|
||||
ip: 10.0.1.49
|
||||
mac: DE:8B:9E:19:55:1E
|
||||
cores: 2
|
||||
|
@ -186,7 +203,6 @@ all:
|
|||
test_ovas: # 10.0.1.48/28
|
||||
hosts:
|
||||
TDS-Jump:
|
||||
node: Node2
|
||||
ip: 10.0.1.48
|
||||
mac: 00:15:5d:01:02:08
|
||||
cores: 2
|
||||
|
@ -194,7 +210,7 @@ all:
|
|||
vnc: 4
|
||||
bridge: br0
|
||||
disks:
|
||||
- '-drive format=qcow2,l2-cache-size=8M,file=/mnt/cage2/vm/TDSJump.qcow2'
|
||||
- '-drive format=qcow2,l2-cache-size=8M,file=/srv/node/vm/TDSJump.qcow2'
|
||||
DedNet:
|
||||
ip: 10.0.1.50
|
||||
mac: 00:15:5d:01:02:09
|
||||
|
@ -248,7 +264,7 @@ all:
|
|||
# appliances are monitored -- adhoc_appliances are convenience only and not monitored.
|
||||
appliances:
|
||||
hosts: # 10.0.1.64/27
|
||||
Shadowfeed: # Router must be at root
|
||||
Shadownet: # Router must be at root
|
||||
ip: 10.0.1.1
|
||||
mac: 2c:30:33:64:f4:03
|
||||
Print: # Print is excepted for legacy setup reasons before we laid out subnets.
|
||||
|
@ -267,11 +283,11 @@ all:
|
|||
hosts: # 10.0.1.64/27
|
||||
DarkFeather:
|
||||
ip: 10.0.1.64
|
||||
mac: D0:40:EF:D4:14:CF
|
||||
mac: f4:2b:8c:10:31:44
|
||||
Lykos:
|
||||
ip: 10.0.1.65
|
||||
mac: 70:74:14:4F:8E:42
|
||||
Games:
|
||||
Node0:
|
||||
ip: 10.0.1.66
|
||||
mac: E0:BE:03:77:0E:88
|
||||
LivingRoomTV:
|
||||
|
@ -283,25 +299,25 @@ all:
|
|||
TrainingRoomTV:
|
||||
ip: 10.0.1.71
|
||||
mac: 80:D2:1D:17:63:10
|
||||
Tachikoma:
|
||||
BT:
|
||||
ip: 10.0.1.72
|
||||
mac: 90:0f:0c:1a:d3:23
|
||||
mac: 8A:00:AA:7F:DF:D1
|
||||
DedSec:
|
||||
ip: 10.0.1.73
|
||||
mac: 34:F6:4B:36:12:8F
|
||||
# dhcp build space: 10.0.1.224/27
|
||||
iot: # 10.0.2.0/24
|
||||
hosts:
|
||||
LinKeuei:
|
||||
LivingRoomRegulator:
|
||||
ip: 10.0.2.2
|
||||
mac: 64:16:66:08:57:F5
|
||||
Canary:
|
||||
Monitor:
|
||||
ip: 10.0.2.3
|
||||
mac: 18:B4:30:2F:F1:37
|
||||
Charon:
|
||||
Gatekeeper:
|
||||
ip: 10.0.2.4
|
||||
mac: 64:52:99:14:28:2B
|
||||
# CanoptekAleph: physical, no network
|
||||
CanoptekBek:
|
||||
# CaretakerAlpha has no network
|
||||
CaretakerBravo:
|
||||
ip: 10.0.2.5
|
||||
mac: 40:9F:38:95:06:34
|
||||
|
|
|
@ -9,36 +9,23 @@
|
|||
# Patch then restart a node
|
||||
#
|
||||
#
|
||||
- hosts: physical,virtual
|
||||
- hosts: "{{ targets | default('virtual') }}"
|
||||
order: sorted
|
||||
serial: 4
|
||||
vars:
|
||||
ansible_become: yes
|
||||
ansible_become_method: sudo
|
||||
roles:
|
||||
- patching
|
||||
|
||||
- hosts: physical
|
||||
order: sorted
|
||||
serial: 4
|
||||
vars:
|
||||
ansible_become: yes
|
||||
ansible_become_method: sudo
|
||||
tasks:
|
||||
- package:
|
||||
name: archlinux-keyring
|
||||
state: latest
|
||||
|
||||
- hosts: virtual,geth-hubs
|
||||
order: sorted
|
||||
serial: 4
|
||||
vars:
|
||||
ansible_become: yes
|
||||
ansible_become_method: sudo
|
||||
vars_files:
|
||||
- "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
|
||||
roles:
|
||||
- patching
|
||||
|
||||
- hosts: physical
|
||||
order: sorted
|
||||
ignore_unreachable: true
|
||||
serial: 4
|
||||
vars:
|
||||
ansible_become: yes
|
||||
ansible_become_method: sudo
|
||||
vars_files:
|
||||
- "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
|
||||
roles:
|
||||
- patching
|
||||
- include_role:
|
||||
name: patching
|
||||
when: targets is unset
|
||||
|
|
|
@ -0,0 +1,7 @@
|
|||
See [AniNIX/Aether](/AniNIX/Aether) for complete details of the tool.
|
||||
|
||||
Role requirements:
|
||||
* `secrets['Aether']` in Vault
|
||||
* A YAML list of nodes under the key `Aether_nodes` in Vault
|
||||
* A host called 'Core' to act as the source
|
||||
* 22/tcp/sftp access through firewalls to the Core host from any clients
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
### Gitea ###
|
||||
tar cvzf "$BACKUPDIR"/gitea.tgz /var/lib/gitea/data
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
### Grimoire ###
|
||||
sudo -u postgres pg_dumpall > "$BACKUPDIR"/grimoire.sql
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
### IRC Services ###
|
||||
cp /opt/anope/data/anope.db "$BACKUPDIR"
|
|
@ -0,0 +1,9 @@
|
|||
#!/bin/bash
|
||||
### Wiki ###
|
||||
mkdir "$BACKUPDIR"/wiki/
|
||||
for i in `find /usr/share/webapps/ -maxdepth 1 -type d | grep mediawiki`; do
|
||||
foldername="$(echo "$i" | rev | cut -f 1 -d '/' | rev)"
|
||||
dbname="$(grep '^\$wgDBname' "$i"/LocalSettings.php | cut -f 2 -d \")"
|
||||
$BACKUPCMD "${i}"/LocalSettings.php "$BACKUPDIR"/wiki/"$foldername"-localsettings.php
|
||||
sudo -u postgres pg_dump "$dbname" > "$BACKUPDIR"/wiki/"$dbname".psql
|
||||
done
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
### Yggdrasil -- File & SHA list only for space reasons ###
|
||||
cp /srv/yggdrasil/library.sha256 "$BACKUPDIR"/yggdrasil.library.sha256
|
|
@ -0,0 +1,146 @@
|
|||
# Example configuration file for AIDE.
|
||||
# More information about configuration options available in the aide.conf manpage.
|
||||
@@define DBDIR /var/lib/aide
|
||||
@@define LOGDIR /var/log/aide
|
||||
|
||||
# The location of the database to be read.
|
||||
database_in=file:@@{DBDIR}/aide.db.gz
|
||||
|
||||
# The location of the database to be written.
|
||||
#database_out=sql:host:port:database:login_name:passwd:table
|
||||
#database_out=file:aide.db.new
|
||||
database_out=file:@@{DBDIR}/aide.db.new.gz
|
||||
|
||||
# Whether to gzip the output to database
|
||||
gzip_dbout=yes
|
||||
|
||||
# Default.
|
||||
log_level=warning
|
||||
report_level=changed_attributes
|
||||
|
||||
report_url=file:@@{LOGDIR}/aide.log
|
||||
report_url=stdout
|
||||
#report_url=stderr
|
||||
#
|
||||
# Here are all the attributes we can check
|
||||
#p: permissions
|
||||
#i: inode
|
||||
#n: number of links
|
||||
#l: link name
|
||||
#u: user
|
||||
#g: group
|
||||
#s: size
|
||||
###b: block count
|
||||
#m: mtime
|
||||
#a: atime
|
||||
#c: ctime
|
||||
#S: check for growing size
|
||||
#I: ignore changed filename
|
||||
#ANF: allow new files
|
||||
#ARF: allow removed files
|
||||
#
|
||||
|
||||
# Here are all the digests we can use
|
||||
#md5: md5 checksum
|
||||
#sha1: sha1 checksum
|
||||
#sha256: sha256 checksum
|
||||
#sha512: sha512 checksum
|
||||
#rmd160: rmd160 checksum
|
||||
#tiger: tiger checksum
|
||||
#haval: haval checksum
|
||||
#crc32: crc32 checksum
|
||||
#gost: gost checksum
|
||||
#whirlpool: whirlpool checksum
|
||||
|
||||
# These are the default rules
|
||||
#R: p+i+l+n+u+g+s+m+c+md5
|
||||
#L: p+i+l+n+u+g
|
||||
#E: Empty group
|
||||
#>: Growing logfile p+l+u+g+i+n+S
|
||||
|
||||
# You can create custom rules - my home made rule definition goes like this
|
||||
ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
|
||||
ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
|
||||
# Everything but access time (Ie. all changes)
|
||||
EVERYTHING = R+ALLXTRAHASHES
|
||||
|
||||
# Sane, with multiple hashes
|
||||
# NORMAL = R+rmd160+sha256+whirlpool
|
||||
NORMAL = R+rmd160+sha256
|
||||
|
||||
# For directories, don't bother doing hashes
|
||||
DIR = p+i+n+u+g+acl+xattrs
|
||||
|
||||
# Access control only
|
||||
PERMS = p+i+u+g+acl
|
||||
|
||||
# Logfile are special, in that they often change
|
||||
LOG = >
|
||||
|
||||
# Just do md5 and sha256 hashes
|
||||
LSPP = R+sha256
|
||||
|
||||
# Some files get updated automatically, so the inode/ctime/mtime change
|
||||
# but we want to know when the data inside them changes
|
||||
DATAONLY = p+n+u+g+s+acl+xattrs+md5+sha256+rmd160+tiger
|
||||
|
||||
|
||||
# Next decide what directories/files you want in the database.
|
||||
|
||||
/boot NORMAL
|
||||
/bin NORMAL
|
||||
/sbin NORMAL
|
||||
/lib NORMAL
|
||||
/lib64 NORMAL
|
||||
/opt NORMAL
|
||||
/usr NORMAL
|
||||
/root NORMAL
|
||||
# These are too volatile
|
||||
!/usr/src
|
||||
!/usr/tmp
|
||||
|
||||
# Check only permissions, inode, user and group for /etc, but
|
||||
# cover some important files closely.
|
||||
/etc PERMS
|
||||
!/etc/mtab
|
||||
# Ignore backup files
|
||||
!/etc/.*~
|
||||
/etc/exports NORMAL
|
||||
/etc/fstab NORMAL
|
||||
/etc/passwd NORMAL
|
||||
/etc/group NORMAL
|
||||
/etc/gshadow NORMAL
|
||||
/etc/shadow NORMAL
|
||||
/etc/security/opasswd NORMAL
|
||||
|
||||
/etc/hosts.allow NORMAL
|
||||
/etc/hosts.deny NORMAL
|
||||
|
||||
/etc/sudoers NORMAL
|
||||
/etc/skel NORMAL
|
||||
|
||||
/etc/logrotate.d NORMAL
|
||||
|
||||
/etc/resolv.conf DATAONLY
|
||||
|
||||
/etc/nscd.conf NORMAL
|
||||
/etc/securetty NORMAL
|
||||
|
||||
# Shell/X starting files
|
||||
/etc/profile NORMAL
|
||||
/etc/bashrc NORMAL
|
||||
/etc/bash_completion.d/ NORMAL
|
||||
/etc/login.defs NORMAL
|
||||
/etc/zprofile NORMAL
|
||||
/etc/zshrc NORMAL
|
||||
/etc/zlogin NORMAL
|
||||
/etc/zlogout NORMAL
|
||||
/etc/profile.d/ NORMAL
|
||||
/etc/X11/ NORMAL
|
||||
|
||||
# Ignore logs
|
||||
!/var/lib/pacman/.*
|
||||
!/var/cache/.*
|
||||
!/var/log/.*
|
||||
!/var/run/.*
|
||||
!/var/spool/.*
|
|
@ -0,0 +1,27 @@
|
|||
---
|
||||
|
||||
- name: Copy the key
|
||||
become: true
|
||||
copy:
|
||||
dest: /home/aether/.ssh/aether
|
||||
content: "{{ aether_key.stdout }}"
|
||||
|
||||
- name: Copy the public key
|
||||
become: true
|
||||
copy:
|
||||
dest: /home/aether/.ssh/aether.pub
|
||||
content: "{{ aether_key.stdout }}"
|
||||
|
||||
- name: Enable the service
|
||||
become: yes
|
||||
service:
|
||||
name: aether.timer
|
||||
state: enabled
|
||||
running: yes
|
||||
|
||||
- name: Enable the service - 2
|
||||
become: yes
|
||||
service:
|
||||
name: aether-gen.timer
|
||||
state: disabled
|
||||
running: no
|
|
@ -0,0 +1,64 @@
|
|||
---
|
||||
|
||||
- name: Install the package
|
||||
become: true
|
||||
ignore_errors: true
|
||||
package:
|
||||
name: Aether
|
||||
state: present
|
||||
|
||||
- name: Validate the user
|
||||
vars:
|
||||
service_account: aether
|
||||
include_tasks: ../roles/common/service_account.yml
|
||||
|
||||
- name: Ensure the Aether identity is protected.
|
||||
become: true
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: aether
|
||||
group: aether
|
||||
mode: 0700
|
||||
loop:
|
||||
- /home/aether/.ssh
|
||||
- /usr/local/etc/Aether
|
||||
- /usr/local/etc/Aether/backup-entries
|
||||
- /usr/local/backup
|
||||
|
||||
- name: Ensure the Aether identity exists
|
||||
delegate_to: Core # Core will track the identity that will then be shared to everyone else.
|
||||
become: true
|
||||
command:
|
||||
creates: /home/aether/.ssh/aether
|
||||
chdir: /home/aether/.ssh/
|
||||
cmd: ssh-keygen -t ed25519 -N "" -f ./aether
|
||||
|
||||
- name: Read the Aether identity
|
||||
become: true
|
||||
delegate_to: Core
|
||||
command: cat /home/aether/.ssh/aether
|
||||
register: aether_key
|
||||
|
||||
- name: Read the Aether public identity
|
||||
become: true
|
||||
delegate_to: Core
|
||||
command: cat /home/aether/.ssh/aether.pub
|
||||
register: aether_pubkey
|
||||
|
||||
- include_tasks: source.yml
|
||||
when: "{{ inventory_hostname }} is 'Core'"
|
||||
|
||||
- include_tasks: client.yml
|
||||
when: "{{ inventory_hostname }} is 'Core'"
|
||||
|
||||
- name: Ensure the Aether identity files are protected.
|
||||
become: true
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
owner: aether
|
||||
group: aether
|
||||
mode: 0600
|
||||
loop:
|
||||
- /home/aether/.ssh/aether
|
||||
- /home/aether/.ssh/aether.pub
|
|
@ -0,0 +1,42 @@
|
|||
---
|
||||
|
||||
- name: Copy the backup scripts
|
||||
become: yes
|
||||
copy:
|
||||
src: "backup-entries/{{ inventory_hostname }}"
|
||||
dest: "/usr/local/etc/Aether/backup-entries"
|
||||
owner: aether
|
||||
group: aether
|
||||
|
||||
- name: Seed the backup passphrase
|
||||
become: yes
|
||||
copy:
|
||||
content: "{{ passwords['Aether'] }}"
|
||||
dest: "/usr/local/etc/Aether/pass.txt"
|
||||
owner: aether
|
||||
group: aether
|
||||
mode: 0600
|
||||
|
||||
- name: Enable the generation service
|
||||
become: yes
|
||||
when: "{{ inventory_hostname }} == 'Core'"
|
||||
service:
|
||||
name: aether-gen.timer
|
||||
state: enabled
|
||||
running: yes
|
||||
|
||||
- name: Enable the generation service - 2
|
||||
become: yes
|
||||
when: "{{ inventory_hostname }} == 'Core'"
|
||||
service:
|
||||
name: aether.timer
|
||||
state: disabled
|
||||
running: no
|
||||
|
||||
- name: Set up the authorized_keys
|
||||
template:
|
||||
src: authorized_keys.j2
|
||||
dest: /home/aether/.ssh/authorized_keys
|
||||
mode: 0600
|
||||
owner: aether
|
||||
group: aether
|
|
@ -0,0 +1,18 @@
|
|||
A Chappaai host is a gateway to accessing other hosts. It is a safeguard against admin error.
|
||||
|
||||
## Etymology
|
||||
Chappaai hosts are named to follow the non-English naming of the Stargate network by the other denizens of the galaxy.
|
||||
|
||||
They are the first line of defense against administrative error -- similar to the way that [Stargate Command](https://stargate.fandom.com/wiki/Stargate_Command) was for Earth. They prevent admins from being locked out of correcting their changes and are connected to everything in the ecosystem. They also control DNS, which allows a sort of subliminal control of the entire ecosystem. This prevents infiltration by infections (similar to Goauld) and in fact can be the extinction of any DNS-enabled malware in the ecosystem by sinkholing the Command-and-Control.
|
||||
|
||||
## Capacity and Components
|
||||
A Chappaai host needs minimal CPU or memory.
|
||||
|
||||
## Hosted Services and Entities
|
||||
Chappaai should host a Pihole installation and [SSH](../Services/SSH.md). It should be linked by NAT to an obscure port to the outside world.
|
||||
|
||||
## Connections
|
||||
Any host should be able to connect to a Chappaai with SSH and X11, and it should be able to dial to any service provider.
|
||||
|
||||
## Additional Reference
|
||||
Chappaai hosts should be deployed alongside any Hypervisor. They can be as simple as a Pi-hole with SSH access, and they should be allowed to receive SSH connections from a non-tcp/22/ssh port.
|
|
@ -17,7 +17,7 @@
|
|||
|
||||
- name: Ensure pihole web admin password
|
||||
become: yes
|
||||
command: "pihole -a -p {{ passwords['Nazara'] }}"
|
||||
command: "pihole -a -p {{ passwords['Chappaai'] }}"
|
||||
# when: pihole_install.changed
|
||||
|
||||
- name: Generate DNS/DHCP from inventory
|
||||
|
@ -25,7 +25,7 @@
|
|||
run_once: true
|
||||
command: "python3 ../bin/generate-pihole-dns-dhcp.py {{ inventory_file }}"
|
||||
|
||||
- name: Nazara DNS
|
||||
- name: Chappaai DNS
|
||||
become: yes
|
||||
register: dns_updated
|
||||
copy:
|
||||
|
@ -35,7 +35,7 @@
|
|||
group: pihole
|
||||
mode: 0644
|
||||
|
||||
- name: Nazara DHCP
|
||||
- name: Chappaai DHCP
|
||||
become: yes
|
||||
register: dhcp_updated
|
||||
copy:
|
||||
|
@ -45,7 +45,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
|
||||
- name: Nazara Configuration
|
||||
- name: Chappaai Configuration
|
||||
become: yes
|
||||
register: conf_updated
|
||||
copy:
|
||||
|
@ -56,7 +56,7 @@
|
|||
mode: 0644
|
||||
|
||||
|
||||
- name: Nazara DHCP Leases dir
|
||||
- name: Chappaai DHCP Leases dir
|
||||
become: yes
|
||||
file:
|
||||
path: /var/lib/misc/
|
||||
|
@ -65,7 +65,7 @@
|
|||
group: root
|
||||
mode: 0777
|
||||
|
||||
- name: Nazara DHCP Leases
|
||||
- name: Chappaai DHCP Leases
|
||||
become: yes
|
||||
file:
|
||||
path: /var/lib/misc/dnsmasq.leases
|
|
@ -1,107 +1,82 @@
|
|||
<div class="ui stackable middle very relaxed page grid">
|
||||
<script src="https://js.stripe.com/v3"></script>
|
||||
<div class="sixteen wide center aligned centered column">
|
||||
<!--<div class="ui negative message"><p>We are open despite COVID-19 -- those attending in person will need to sign a waiver of health and follow all state requirements, including wearing a mask.</p></div>-->
|
||||
<div>
|
||||
<img class="logo" src="/assets/img/icons/MartialArtsIcon.png" />
|
||||
</div>
|
||||
<div class="hero">
|
||||
<h1 class="ui icon header title">
|
||||
AniNIX
|
||||
AniNIX Martial Arts
|
||||
</h1>
|
||||
<h2>Our Storefront</h2>
|
||||
<p>We have limited service offerings available. Please contact an admin on IRC first to arrange the contract, then use the item below to pay the invoice.</p>
|
||||
<h2>Open-source, research-driven self-defense and personal health</h2>
|
||||
<p>AniNIX Martial Arts is a small martial arts collective focusing on research-driven martial arts. Our core style is USHF HapKiDo, but we are influenced by HEMA, Razmafzar, Kali, Shaolin, Silat, JKD, BJJ, and many other systems. We are a research-driven group -- we encourage cross-training with other systems and will bring in new concepts regularly. The class is open to all experience levels, gender identity, gender expression, sexual orientation, religious or cultural identity, socioecomic status, or age (above 14), in Southcentral Wisconsin -- we will fit your training to your needs and goals.</p><p>Drop-ins are welcome, and registration is cheap. We hope you'll give us a chance to show you what we can do.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="ui stackable middle very relaxed page grid">
|
||||
<div class="sixteen wide center column" >
|
||||
<div class="eight wide center column">
|
||||
<h1 class="hero ui icon header">
|
||||
<img width=20px height=20px src='/assets/img/icons/CoreIcon.png'/>
|
||||
Cybersecurity Consulting
|
||||
<img width=20px height=20px src='/assets/img/icons/FoundationIcon.png'/>
|
||||
<a href="/mawiki">Open-source</a>
|
||||
</h1>
|
||||
<p class="large">The AniNIX offers cybersecurity consulting and advice services on a limited basis. We bill at $20 an hour -- please select your need below after negotiating with an admin.</p>
|
||||
<p class="large">
|
||||
<form action="./storefront.html" id="hours">
|
||||
<label for="hourcount">Hours required</label>
|
||||
<select name="hourcount" id="hourscount">
|
||||
<option value="1">1</option>
|
||||
<option value="2">2</option>
|
||||
<option value="3">3</option>
|
||||
<option value="4">4</option>
|
||||
<option value="5">5</option>
|
||||
<option value="6">6</option>
|
||||
<option value="7">7</option>
|
||||
<option value="8">8</option>
|
||||
<option value="9">9</option>
|
||||
<option value="10">10</option>
|
||||
<option value="11">11</option>
|
||||
<option value="12">12</option>
|
||||
<option value="13">13</option>
|
||||
<option value="14">14</option>
|
||||
<option value="15">15</option>
|
||||
<option value="16">16</option>
|
||||
<option value="17">17</option>
|
||||
<option value="18">18</option>
|
||||
<option value="19">19</option>
|
||||
<option value="20">20</option>
|
||||
</select>
|
||||
<br/>
|
||||
</form>
|
||||
<!-- START STRIPE CODE -->
|
||||
|
||||
<!-- Create a button that your customers click to complete their purchase. Customize the styling to suit your branding. -->
|
||||
<button
|
||||
style="background-color:#6772E5;color:#FFF;padding:8px 12px;border:0;border-radius:4px;font-size:1em"
|
||||
id="checkout-button-price_1HTuehI49P1uFPoXCW9pJg5E"
|
||||
role="link"
|
||||
type="button"
|
||||
>
|
||||
Checkout
|
||||
</button>
|
||||
|
||||
<div id="error-message"></div>
|
||||
|
||||
<script>
|
||||
(function() {
|
||||
var stripe = Stripe('pk_live_51HThYnI49P1uFPoX5ARnHSpT9D08Gbfux6O25waFLpPBsnZoLDuqopFAZeLfu0CbbICxEnPZOOLkDLTlcNjkazs100ElKcF2QX');
|
||||
|
||||
var checkoutButton = document.getElementById('checkout-button-price_1HTuehI49P1uFPoXCW9pJg5E');
|
||||
checkoutButton.addEventListener('click', function () {
|
||||
// When the customer clicks on the button, redirect
|
||||
// them to Checkout.
|
||||
stripe.redirectToCheckout({
|
||||
lineItems: [{price: 'price_1HTuehI49P1uFPoXCW9pJg5E', quantity: parseInt(document.getElementById('hourscount').value)}],
|
||||
mode: 'payment',
|
||||
// Do not rely on the redirect to the successUrl for fulfilling
|
||||
// purchases, customers may not always reach the success_url after
|
||||
// a successful payment.
|
||||
// Instead use one of the strategies described in
|
||||
// https://stripe.com/docs/payments/checkout/fulfill-orders
|
||||
successUrl: window.location.protocol + '//aninix.net/pay/thank-you.html',
|
||||
cancelUrl: window.location.protocol + '//aninix.net/pay/storefront.html',
|
||||
})
|
||||
.then(function (result) {
|
||||
if (result.error) {
|
||||
// If `redirectToCheckout` fails due to a browser or network
|
||||
// error, display the localized error message to your customer.
|
||||
var displayError = document.getElementById('error-message');
|
||||
displayError.textContent = result.error.message;
|
||||
}
|
||||
});
|
||||
});
|
||||
})();
|
||||
</script>
|
||||
<! -- END STRIPE CODE -->
|
||||
We want your training with our system to become a part of your life. This means that we provide access to a revision-controlled copy of our notes that all our students can download, keep, and contribute to. We're tired of the old era where how the system works is kept hidden from students and piecemealed out as a marketing ploy -- we want to be as trasparent as possible in how our program and our martial art function. Transparency keeps our instructors honest and our students engaged -- this means a better martial arts experience for everyone.
|
||||
</p>
|
||||
</div>
|
||||
<div class="eight wide center column">
|
||||
<h1 class="hero ui icon header">
|
||||
<img width=20px height=20px src='/assets/img/ushf.jpg'/>
|
||||
<a href='https://ushapkidofederation.wordpress.com/'>Research-driven</a>
|
||||
</h1>
|
||||
<p class="large">
|
||||
Our system is always growing. We are a United States HapKiDo Federation (USHF) school, and that gives us access to high-quality instructors and seminar material each year from across the US. We also maintain good relationships with other schools in our area -- we want our students to examine what they're learing and make sure that it works, and that means looking at different perspectives.
|
||||
</p> </div>
|
||||
</div>
|
||||
<div class="ui stackable middle very relaxed page grid">
|
||||
<div class="eight wide center column">
|
||||
<h1 class="hero ui icon header">
|
||||
<img width=20px height=20px src="/assets/img/icons/MartialArtsIcon.png"/>
|
||||
<a href="/martialarts/index.html#storefront">Low-cost</a>
|
||||
</h1>
|
||||
<p class="large">We are non-profit group -- we train because we feel like it makes life better, not to make money. As such, our costs are publicly documented and our rates match the same. Classes will be informed of potential changes to costs well in advance, and we use recurring payments. We want you thinking about your training, not how you're going to pay for it.</p>
|
||||
<p class="large">
|
||||
<ul style="text-align: left;">
|
||||
<li><b>Cost:</b> $10 per month in-person; $5 per month livestream -- pay below.</li>
|
||||
<li><b>Lessons:</b>Tuesdays 7-8:30 p.m.</li>
|
||||
<li><b>Sparring:</b>Tuesdays 6-7 p.m.</li>
|
||||
<li><b>Shaolin Workouts:</b> Saturday mornings at 8 a.m. </li>
|
||||
<li><b>Location:</b> <a href="https://g.page/aninix-martial-arts?share">225 Blaser Drive, Belleville, WI</a></li>
|
||||
<li><b>What to bring:</b> Exercise clothes and water</li>
|
||||
</ul></p>
|
||||
</div>
|
||||
<div class="eight wide center column">
|
||||
<h1 class="hero ui icon header">
|
||||
<img width=20px height=20x src="/assets/img/icons/IRCIcon.png"/>
|
||||
<a href="/martialarts/index.html#social">Real-life First</a>
|
||||
</h1>
|
||||
<p class="large">
|
||||
Everyone is welcome! Class attendance is not mandated and belt-testing is not required to train. As a courtesy, please inform the class of your absence or intended late arrival -- real-life comes first, and we're happy to work with your needs. As long as one person shows, we'll have class -- the smaller the class, the more tailored it is, but the bigger classes mean more partners and body types.</p>
|
||||
<p class="large">
|
||||
Our focus is also on what you will actually use. While we appreciate traditional and esoteric training for self-development, our weekly classes are focused on modern techniques and training methods so that you get the most out of your time. Our goal is to help create a community of prepared and healthy citizens, and we believe martial arts helps build that in a way no other activity can.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="ui stackable middle very relaxed page grid">
|
||||
<div class="sixteen wide center column" >
|
||||
<hr style="margin-top: 50px;" />
|
||||
<h2>Donate</h2>
|
||||
<p>If you like what we do, you can also donate on one of these platforms:</p>
|
||||
<ul style="width:500px;text-align: left;margin:auto;">
|
||||
<li><a href="https://store.steampowered.com/wishlist/id/darkfeather664/#sort=order">Steam (games)</a></li>
|
||||
<li><a href="https://www.amazon.com/hz/wishlist/ls/3CORZU03RNWST?ref_=wl_share">Amazon (hardware)</a></li>
|
||||
<li>BTC 38Nd3SgytdvSmcX3gfHeNAE2B6aPyYbS7s</li>
|
||||
<li>Coinbase USDC 0x21a05e628Ed622F7594f62Ea3C764bAEF7fE3Bf3</li>
|
||||
</ul>
|
||||
<div class="ui stackable middle very relaxed page grid" id="social">
|
||||
<div class="sixteen wide center aligned centered column">
|
||||
<div class="hero">
|
||||
<h2 id=social>Follow us on social media</h2>
|
||||
<p class=large>We want to stay in touch with you, so we are present on the social media platforms we find applicable.<br/> Have one you want us on? Contact us and let us know!</p>
|
||||
</div>
|
||||
<div class="ui stackable middle very relaxed page grid" id="social">
|
||||
<div class="two wide center column"><p> </p></div>
|
||||
<div class="two wide center column"><a title=RSS href="/martialarts/maqotw.xml"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" alt=RSS src="/assets/img/social/rss.png" /></a></div>
|
||||
<div class="two wide center column"><a title=Discord href="https://discord.gg/2bmggfR"><img alt=Discord style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/discord.ico" /></a></div>
|
||||
<div class="two wide center column"><a title=NextDoor href="https://nextdoor.com/news_feed/?post=112835813"><img alt=NextDoor src="/assets/img/social/nextdoor.png" style="width: 50px; height:auto; margin: 0; padding: 0 auto;" /></a></div>
|
||||
<div class="two wide center column"><a title=YouTube href="https://www.youtube.com/channel/UCVAkee-WaInnZbPn16bqzrw/about?view_as=subscriber"><img src="/assets/img/social/youtube.png" style="width: 50px; height:auto; margin: 0; padding: 0 auto;" /></a></div>
|
||||
<div class="two wide center column"><a title=Strava href="https://www.strava.com/clubs/aninixmartialarts"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/strava.png" /></a></div>
|
||||
<div class="two wide center column"><a title=Facebook href="https://www.facebook.com/groups/aninixmartialarts/"><img style="width: 50px; height:auto; margin: 0; padding: 0 auto;" src="/assets/img/social/facebook.png" /></a></div>
|
||||
<div class="two wide center column"><p> </p></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
<div class="ui stackable middle very relaxed page grid">
|
||||
<div class="sixteen wide center aligned centered column">
|
||||
<div>
|
||||
<img class="logo" src="/assets/img/icons/CoreIcon.png" />
|
||||
</div>
|
||||
<div class="hero">
|
||||
<h2 class="ui icon header title">
|
||||
Thank you for your purchase!
|
||||
</h2>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
|
@ -95,13 +95,14 @@ https://aur.archlinux.org/suricata.git
|
|||
https://aur.archlinux.org/swfdec.git
|
||||
https://aur.archlinux.org/swfdec-gnome.git
|
||||
https://aur.archlinux.org/systemdjournal2gelf.git
|
||||
https://aur.archlinux.org/tor-browser-en.git
|
||||
https://aur.archlinux.org/tor-browser-bin.git
|
||||
https://aur.archlinux.org/trid.git
|
||||
https://aur.archlinux.org/tt-rss-auth-ldap-git.git
|
||||
https://aur.archlinux.org/udisks.git
|
||||
https://aur.archlinux.org/undvd.git
|
||||
https://aur.archlinux.org/uniglot.git
|
||||
https://aur.archlinux.org/unvanquished.git
|
||||
https://aur.archlinux.org/unvanquished-data.git
|
||||
https://aur.archlinux.org/vbam-gtk.git
|
||||
https://aur.archlinux.org/xfce4-mixer.git
|
||||
https://aur.archlinux.org/xorg-server-utils.git
|
||||
|
|
|
@ -6,9 +6,9 @@ repos:
|
|||
archlinux:
|
||||
urls:
|
||||
- http://mirrors.gigenet.com/archlinux/
|
||||
- https://mnvoip.mm.fcix.net/archlinux/
|
||||
- http://mnvoip.mm.fcix.net/archlinux/
|
||||
- http://mirrors.kernel.org/archlinux/
|
||||
- https://southfront.mm.fcix.net/archlinux/
|
||||
- http://ftp.osuosl.org/pub/archlinux/
|
||||
- https://mnvoip.mm.fcix.net/archlinux/
|
||||
- http://southfront.mm.fcix.net/archlinux/
|
||||
user_agent: Pacoloco
|
||||
|
|
|
@ -1,16 +0,0 @@
|
|||
A Nazara host is a gateway to accessing other hosts. It is a safeguard against admin error.
|
||||
|
||||
## Etymology
|
||||
Nazara hosts are named because they are the first line of defense against administrative error -- they prevent admins from being locked out of correcting their changes and are connected to everything in the ecosystem. They also control DNS, which allows a sort of subliminal control of the entire ecosystem. This is akin to the mastermind [Reaper AI](https://masseffect.fandom.com/wiki/Sovereign) from the Mass Effect franchise, and in fact can be the extinction of any DNS-enabled malware in the ecosystem by sinkholing the Command-and-Control.
|
||||
|
||||
## Capacity and Components
|
||||
A Nazara host needs minimal CPU or memory.
|
||||
|
||||
## Hosted Services and Entities
|
||||
Nazara should host a Pihole installation and [SSH](../Services/SSH.md). It should be NAT'ed to an obscure port to the outside world.
|
||||
|
||||
## Connections
|
||||
Any host should be able to connect to a Nazara with SSH and X11, and it should be able to dial to any service provider.
|
||||
|
||||
## Additional Reference
|
||||
Nazara hosts should be deployed alongside any Hypervisor. They can be as simple as a Pi-hole with SSH access, and they should be allowed to receive SSH connections from a non-tcp/22/ssh port.
|
|
@ -61,3 +61,11 @@
|
|||
when: qemubr.changed or br0.changed
|
||||
debug:
|
||||
msg: You may need to restart VMs on the Node.
|
||||
|
||||
- name: Enable VMs
|
||||
become: yes
|
||||
with_items: "{{ active_vms }}"
|
||||
service:
|
||||
name: "{{ item }}-vm.service"
|
||||
state: started
|
||||
enabled: yes
|
||||
|
|
|
@ -46,12 +46,14 @@ if [ "$?" -eq 0 ]; then
|
|||
cp /opt/aninix/Password/sample-user.ldif "$file"
|
||||
line="$(grep -E '^uid: ' "$file")"; sed -i "s/$line/uid: $username/" "$file"
|
||||
line="$(grep -E '^dn: ' "$file" | cut -f 2 -d ' ' | cut -f 1 -d ',')"; sed -i "s/$line/uid=$username/" "$file"
|
||||
line="$(grep -E '^homeDirectory: ' "$file")"; sed -i "s#$line#homeDirectory: /home/$username/#" "$file"
|
||||
line="$(grep -E '^homeDirectory: ' "$file")"; sed -i "s#$line#homeDirectory: /$username/#" "$file"
|
||||
line="$(grep -E '^cn: ' "$file")"; sed -i "s/$line/cn: $username/" "$file"
|
||||
line="$(grep -E '^mail: ' "$file")"; sed -i "s#$line#mail: ircs://aninix.net:6697/$username#" "$file"
|
||||
line="$(grep -E '^uidNumber: ' "$file")"; sed -i "s/$line/uidNumber: $newuserid/" "$file"
|
||||
ldapadd -D 'cn=root,dc=aninix,dc=net' -W -f "$file"
|
||||
ldap-resetpass "$username"
|
||||
# Create default home
|
||||
cp -r /etc/skel "/home/$username"; chmod 0027 "/home/$username"; chown -R "$username": "/home/$username"
|
||||
fi
|
||||
rmdir "$lockfile"
|
||||
exit 0;
|
||||
|
|
|
@ -41,21 +41,23 @@ ChallengeResponseAuthentication no
|
|||
HostbasedAuthentication no
|
||||
KerberosAuthentication no
|
||||
GSSAPIAuthentication no
|
||||
DenyGroups [^ssh-allow]
|
||||
AllowGroups ssh-allow
|
||||
PermitRootLogin no
|
||||
PermitEmptyPasswords no
|
||||
|
||||
## Access Controls
|
||||
Match Group ssh-forward
|
||||
## By default, only ssh-allow or ldapusers are allowed to sftp
|
||||
AllowGroups ssh sftp ldapuser
|
||||
Match Group ldapuser,sftp
|
||||
ForceCommand internal-sftp
|
||||
ChrootDirectory /home
|
||||
|
||||
## Special groups are allowed shell
|
||||
Match Group wheel,ssh-allow
|
||||
AllowTcpForwarding yes
|
||||
PermitTunnel yes
|
||||
AllowAgentForwarding yes
|
||||
X11Forwarding yes
|
||||
|
||||
Match Group sftp-home-jail
|
||||
ForceCommand internal-sftp
|
||||
ChrootDirectory /home
|
||||
ForceCommand none
|
||||
ChrootDirectory none
|
||||
|
||||
# Allow other packages to ship snippets
|
||||
Include /etc/ssh/includes/*
|
||||
|
|
|
@ -34,15 +34,14 @@
|
|||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- ssh-allow
|
||||
- ssh-forward
|
||||
- sftp-home-jail
|
||||
- ssh
|
||||
- sftp
|
||||
|
||||
- name: Add SSH user to ssh-allow
|
||||
- name: Add SSH user to ssh group
|
||||
become: yes
|
||||
user:
|
||||
name: "{{ ansible_user_id }}"
|
||||
groups: ssh-allow
|
||||
groups: ssh
|
||||
append: yes
|
||||
|
||||
- name: Copy the SSH key
|
||||
|
@ -75,7 +74,7 @@
|
|||
file:
|
||||
path: /etc/ssh/includes
|
||||
state: directory
|
||||
user: root
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
|
|
|
@ -37,30 +37,20 @@
|
|||
group: http
|
||||
mode: 2755
|
||||
|
||||
- name: Copy TLSA script
|
||||
- name: Remove old TLSA script
|
||||
become: yes
|
||||
file:
|
||||
path: /usr/local/sbin/tlsa-generation.bash
|
||||
state: absent
|
||||
|
||||
- name: Copy record generator script
|
||||
become: yes
|
||||
template:
|
||||
src: tlsa-generation.bash.j2
|
||||
dest: /usr/local/sbin/tlsa-generation.bash
|
||||
src: record-generation.bash.j2
|
||||
dest: /usr/local/sbin/record-generation.bash
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0700
|
||||
|
||||
- name: Get proposed TLSA records
|
||||
become: yes
|
||||
command: /usr/local/sbin/tlsa-generation.bash
|
||||
register: tlsa_records
|
||||
|
||||
- name: Show proposed TLSA records
|
||||
debug:
|
||||
msg: "{{ tlsa_records.stdout_lines }}"
|
||||
|
||||
- name: Get TLSA records
|
||||
delegate_to: localhost
|
||||
run_once: yes
|
||||
command: "/bin/bash -c 'printf _443._tcp\\ ; dig _443._tcp.{{ external_domain }} TLSA +short; printf _6697._tcp\\ ; dig _6697._tcp.{{ external_domain }} TLSA +short'"
|
||||
register: ext_tlsa_records
|
||||
|
||||
- name: Show TLSA records
|
||||
debug:
|
||||
msg: "{{ ext_tlsa_records.stdout_lines }}"
|
||||
- debug:
|
||||
msg: 'Run `sudo /usr/local/sbin/record-generation.bash` to generate a zonefile for import into a DNS provider.'
|
||||
|
|
|
@ -0,0 +1,44 @@
|
|||
#!/bin/bash
|
||||
|
||||
ttl=86400
|
||||
|
||||
externalip="$(curl -s ident.me)"
|
||||
|
||||
for domain in {{ hosted_domains }} {{ external_domain }}; do
|
||||
|
||||
echo
|
||||
|
||||
# NS/MX/A -- basic orientation to the world for names, mail, and address
|
||||
cat <<EOM
|
||||
\$ORIGIN ${domain}.
|
||||
@ $ttl IN SOA ns51.cloudns.net. support.cloudns.net. 2024040128 7200 1800 1209600 86400
|
||||
@ $ttl IN NS ns51.cloudns.net.
|
||||
@ $ttl IN NS ns52.cloudns.net.
|
||||
@ $ttl IN NS ns53.cloudns.net.
|
||||
@ $ttl IN NS ns54.cloudns.net.
|
||||
@ $ttl IN MX 10 mailforward51.cloudns.net.
|
||||
@ $ttl IN MX 10 mailforward52.cloudns.net.
|
||||
@ $ttl IN A ${externalip}
|
||||
EOM
|
||||
|
||||
# CAA -- who can issue certs for this domain
|
||||
# https://letsencrypt.org/docs/caa/
|
||||
echo 'CAA 128 issue "letsencrypt.org"'
|
||||
|
||||
# TLSA -- TLS fingerprints for certs & chain
|
||||
for i in _443._tcp _6697._tcp; do
|
||||
printf "$i $ttl IN ";
|
||||
openssl x509 -in /etc/letsencrypt/live/{{ sslidentity }}/chain.pem -noout -pubkey 2>/dev/null | openssl rsa -pubin -outform DER 2>/dev/null | openssl dgst -sha256 -hex 2>/dev/null | awk '{print "TLSA 2 1 1", $NF}'
|
||||
printf "$i $ttl IN ";
|
||||
openssl x509 -in /etc/letsencrypt/live/{{ sslidentity }}/cert.pem -noout -pubkey 2>/dev/null | openssl rsa -pubin -outform DER 2>/dev/null | openssl dgst -sha256 -hex 2>/dev/null | awk '{print "TLSA 3 1 1", $NF}'
|
||||
done
|
||||
|
||||
# SSHFP -- SFTP/SSH fingerprints
|
||||
ssh-keygen -r '@ $ttl' | grep -E '4 2|1 2' # Only take RSA & Ed25519 keys
|
||||
|
||||
done
|
||||
|
||||
# CNAME -- Add CNAMES for various subdomains
|
||||
for i in {{ external_subdomains }}; do
|
||||
printf "%-20s %-10s %-10s %-10s %s\n" "$i" "$ttl" IN CNAME {{ external_domain }}.
|
||||
done
|
|
@ -1,4 +0,0 @@
|
|||
#!/bin/bash
|
||||
openssl x509 -in /etc/letsencrypt/live/{{ sslidentity }}/chain.pem -noout -pubkey | openssl rsa -pubin -outform DER | openssl dgst -sha256 -hex | awk '{print "le-ca TLSA 2 1 1", $NF}'
|
||||
openssl x509 -in /etc/letsencrypt/live/{{ sslidentity}}/cert.pem -noout -pubkey | openssl rsa -pubin -outform DER | openssl dgst -sha256 -hex | awk '{print "cert TLSA 3 1 1", $NF}'
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
################################################################################
|
||||
# AniNIX/Node0 #
|
||||
# #
|
||||
# This is the network virtualization platform. VMs can be found with this: #
|
||||
# cd /usr/lib/systemd/system; ls -1 *vm.service | xargs -n 1 systemctl status #
|
||||
################################################################################
|
|
@ -0,0 +1,6 @@
|
|||
################################################################################
|
||||
# AniNIX/Node0 #
|
||||
# #
|
||||
# This is the network virtualization platform. VMs can be found with this: #
|
||||
# cd /usr/lib/systemd/system; ls -1 *vm.service | xargs -n 1 systemctl status #
|
||||
################################################################################
|
|
@ -0,0 +1,6 @@
|
|||
################################################################################
|
||||
# AniNIX/Node0 #
|
||||
# #
|
||||
# This is the network virtualization platform. VMs can be found with this: #
|
||||
# cd /usr/lib/systemd/system; ls -1 *vm.service | xargs -n 1 systemctl status #
|
||||
################################################################################
|
|
@ -0,0 +1,6 @@
|
|||
################################################################################
|
||||
# AniNIX/Node0 #
|
||||
# #
|
||||
# This is the network virtualization platform. VMs can be found with this: #
|
||||
# cd /usr/lib/systemd/system; ls -1 *vm.service | xargs -n 1 systemctl status #
|
||||
################################################################################
|
|
@ -0,0 +1,6 @@
|
|||
################################################################################
|
||||
# AniNIX/Node0 #
|
||||
# #
|
||||
# This is the network virtualization platform. VMs can be found with this: #
|
||||
# cd /usr/lib/systemd/system; ls -1 *vm.service | xargs -n 1 systemctl status #
|
||||
################################################################################
|
|
@ -0,0 +1,5 @@
|
|||
################################################################################
|
||||
# AniNIX/Nazara #
|
||||
# #
|
||||
# This is the network DNS/DHCP service, using Raspberry Pi pihole, and bastion #
|
||||
################################################################################
|
|
@ -1,3 +1 @@
|
|||
|
||||
# AniNIX/Geth Hardware Platform (Raspbian Rpi 1 B+) #
|
||||
|
|
@ -1,3 +1 @@
|
|||
|
||||
# AniNIX/Geth Hardware Platform (Raspbian Rpi 1 B+) #
|
||||
|
|
@ -1,3 +1 @@
|
|||
|
||||
# AniNIX/Geth Hardware Platform (Raspberry Pi 3 Model B Plus Rev 1.3) #
|
||||
|
|
@ -16,21 +16,21 @@
|
|||
|
||||
- name: Tap ArchLinux network config
|
||||
become: yes
|
||||
#when: tap is defined and not static is defined
|
||||
when: tap is defined
|
||||
template:
|
||||
src: netctl-tap.j2
|
||||
dest: "/etc/netctl/{{ ipinterface }}"
|
||||
|
||||
- name: Bridge ArchLinux network config
|
||||
become: yes
|
||||
#when: tap is defined and not static is defined
|
||||
when: tap is defined
|
||||
template:
|
||||
src: netctl-bond.j2
|
||||
dest: "/etc/netctl/br0"
|
||||
|
||||
- name: Tunnel ArchLinux network config
|
||||
become: yes
|
||||
#when: tap is defined and not static is defined
|
||||
when: tap is defined
|
||||
copy:
|
||||
src: netctl-tun
|
||||
dest: "/etc/netctl/tun0"
|
||||
|
|
|
@ -0,0 +1,57 @@
|
|||
---
|
||||
- name: Test root password
|
||||
ignore_errors: yes
|
||||
register: root_password_test
|
||||
vars:
|
||||
ansible_become_user: "{{ item }}"
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
command: id
|
||||
loop:
|
||||
- root
|
||||
- "{{ ansible_user_id }}"
|
||||
|
||||
- name: Define passwords
|
||||
ignore_errors: yes
|
||||
vars:
|
||||
ansible_become_user: "root"
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
when: root_password_test.rc is not defined or root_password_test.rc != 0
|
||||
command:
|
||||
cmd: /bin/bash -l -c "echo '{{item}}:{{ passwords[inventory_hostname] }}' | chpasswd {{ item }}"
|
||||
loop:
|
||||
- root
|
||||
- "{{ ansible_user_id }}"
|
||||
|
||||
- name: Ensure deploy user has sudo permissions.
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
copy:
|
||||
dest: /etc/sudoers.d/basics
|
||||
content: "{{ ansible_user_id }} ALL=(ALL) NOPASSWD: ALL\n"
|
||||
|
||||
- name: Ensure we include /etc/sudoers.d (Current)
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
when: ansible_architecture != "armv6l"
|
||||
lineinfile:
|
||||
path: /etc/sudoers
|
||||
regexp: "includedir /etc/sudoers.d"
|
||||
line: "@includedir /etc/sudoers.d"
|
||||
|
||||
- name: Ensure we include /etc/sudoers.d (Legacy)
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
when: ansible_architecture == "armv6l"
|
||||
lineinfile:
|
||||
path: /etc/sudoers
|
||||
regexp: "includedir /etc/sudoers.d"
|
||||
line: "#includedir /etc/sudoers.d"
|
|
@ -4,169 +4,7 @@
|
|||
|
||||
# This is an AniNIX convention to allow password management by Ansible.
|
||||
|
||||
- name: Test root password
|
||||
ignore_errors: yes
|
||||
register: root_password_test
|
||||
vars:
|
||||
ansible_become_user: "{{ item }}"
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
command: id
|
||||
loop:
|
||||
- root
|
||||
- "{{ ansible_user_id }}"
|
||||
|
||||
- name: Define passwords
|
||||
ignore_errors: yes
|
||||
vars:
|
||||
ansible_become_user: "root"
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
when: root_password_test.rc is not defined or root_password_test.rc != 0
|
||||
command:
|
||||
cmd: /bin/bash -l -c "echo '{{item}}:{{ passwords[inventory_hostname] }}' | chpasswd {{ item }}"
|
||||
loop:
|
||||
- root
|
||||
- "{{ ansible_user_id }}"
|
||||
|
||||
- name: Ensure deploy user has sudo permissions.
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
copy:
|
||||
dest: /etc/sudoers.d/basics
|
||||
content: "{{ ansible_user_id }} ALL=(ALL) NOPASSWD: ALL\n"
|
||||
|
||||
- name: Ensure we include /etc/sudoers.d (Current)
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
when: ansible_architecture != "armv6l"
|
||||
lineinfile:
|
||||
path: /etc/sudoers
|
||||
regexp: "includedir /etc/sudoers.d"
|
||||
line: "@includedir /etc/sudoers.d"
|
||||
|
||||
- name: Ensure we include /etc/sudoers.d (Legacy)
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
when: ansible_architecture == "armv6l"
|
||||
lineinfile:
|
||||
path: /etc/sudoers
|
||||
regexp: "includedir /etc/sudoers.d"
|
||||
line: "#includedir /etc/sudoers.d"
|
||||
|
||||
- name: Set up pacman.conf
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
ignorepkg: "{{ holdpackages | default('') }}"
|
||||
become: yes
|
||||
template:
|
||||
src: pacman.conf.j2
|
||||
dest: /etc/pacman.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family == "Archlinux"
|
||||
|
||||
- name: Set mirror
|
||||
become: yes
|
||||
when: ansible_os_family == "Archlinux"
|
||||
copy:
|
||||
content: |
|
||||
Server = {{ mirroruri }}
|
||||
dest: /etc/pacman.d/mirrorlist.shadowarch
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
|
||||
- name: Import AniNIX GPG key
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
command: /bin/bash -c 'if [ ! -f /usr/share/pacman/keyrings/aninix.gpg ]; then mkdir /tmp/aninix; curl -s https://aninix.net/AniNIX/ShadowArch/raw/branch/main/EtcFiles/aninix.gpg > /tmp/aninix/pubring.gpg; pacman-key --import /tmp/aninix; pacman-key --lsign 904DE6275579CB589D85720C1CC1E3F4ED06F296; fi'
|
||||
when: ansible_os_family == "Archlinux"
|
||||
|
||||
- name: Set up apt sources.list
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
copy:
|
||||
content: |
|
||||
deb http://archive.raspberrypi.org/debian/ bullseye main
|
||||
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
|
||||
#deb-src http://archive.raspberrypi.org/debian/ bullseye main
|
||||
dest: /etc/apt/sources.list.d/raspi.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Base packages
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
package:
|
||||
name:
|
||||
- bash
|
||||
- sudo
|
||||
- git
|
||||
- tmux
|
||||
- vim
|
||||
- sysstat
|
||||
- iotop
|
||||
- lsof
|
||||
- rsync
|
||||
- xfsprogs
|
||||
- man-db
|
||||
- man-pages
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Install ShadowArch (ArchLinux)
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
pacman:
|
||||
name: ShadowArch
|
||||
state: present
|
||||
update_cache: yes
|
||||
when: ansible_os_family == "Archlinux"
|
||||
|
||||
- name: Set up AniNIX-specific repository location (Other)
|
||||
when: ansible_os_family != "Archlinux"
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
file:
|
||||
path: /opt/aninix
|
||||
state: directory
|
||||
|
||||
- name: Download ShadowArch (Other)
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
ignore_errors: yes
|
||||
git:
|
||||
repo: 'https://foundation.aninix.net/AniNIX/ShadowArch'
|
||||
dest: '/opt/aninix/ShadowArch'
|
||||
update: yes
|
||||
when: ansible_os_family != "Archlinux"
|
||||
|
||||
- name: Install ShadowArch (Other)
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
command:
|
||||
chdir: '/opt/aninix/ShadowArch'
|
||||
cmd: '/bin/bash -c "make install"'
|
||||
when: ansible_os_family != "Archlinux"
|
||||
- include_tasks: authentication.yml
|
||||
|
||||
- name: Set up hostname
|
||||
vars:
|
||||
|
@ -175,14 +13,18 @@
|
|||
hostname:
|
||||
name: "{{ inventory_hostname }}.{{ replica_domain }}"
|
||||
|
||||
- include: archlinux-network.yml
|
||||
- include_tasks: archlinux-network.yml
|
||||
when: ansible_os_family == "Archlinux"
|
||||
|
||||
- include: raspbian-network.yml
|
||||
- include_tasks: raspbian-network.yml
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- include: dns.yml
|
||||
- include_tasks: dns.yml
|
||||
|
||||
- include: ntp.yml
|
||||
- include_tasks: ntp.yml
|
||||
|
||||
- include: bash.yml
|
||||
- include_tasks: repositories.yml
|
||||
|
||||
- include_tasks: bash.yml
|
||||
|
||||
- include_tasks: shadowarch.yml
|
||||
|
|
|
@ -0,0 +1,67 @@
|
|||
---
|
||||
- name: Set up pacman.conf
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
ignorepkg: "{{ holdpackages | default('') }}"
|
||||
become: yes
|
||||
template:
|
||||
src: pacman.conf.j2
|
||||
dest: /etc/pacman.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family == "Archlinux"
|
||||
|
||||
- name: Set mirror
|
||||
become: yes
|
||||
when: ansible_os_family == "Archlinux"
|
||||
copy:
|
||||
content: |
|
||||
Server = {{ mirroruri }}
|
||||
dest: /etc/pacman.d/mirrorlist.shadowarch
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
|
||||
- name: Import AniNIX GPG key
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
command: /bin/bash -c 'if [ ! -f /usr/share/pacman/keyrings/aninix.gpg ]; then mkdir /tmp/aninix; curl -s https://aninix.net/AniNIX/ShadowArch/raw/branch/main/EtcFiles/aninix.gpg > /tmp/aninix/pubring.gpg; pacman-key --import /tmp/aninix; pacman-key --lsign 904DE6275579CB589D85720C1CC1E3F4ED06F296; fi'
|
||||
when: ansible_os_family == "Archlinux"
|
||||
|
||||
- name: Set up apt sources.list
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
copy:
|
||||
content: |
|
||||
deb http://archive.raspberrypi.org/debian/ bullseye main
|
||||
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
|
||||
#deb-src http://archive.raspberrypi.org/debian/ bullseye main
|
||||
dest: /etc/apt/sources.list.d/raspi.list
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Base packages
|
||||
vars:
|
||||
ansible_become_method: su
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
package:
|
||||
name:
|
||||
- bash
|
||||
- sudo
|
||||
- git
|
||||
- tmux
|
||||
- vim
|
||||
- sysstat
|
||||
- iotop
|
||||
- lsof
|
||||
- rsync
|
||||
- xfsprogs
|
||||
- man
|
||||
state: present
|
||||
update_cache: yes
|
|
@ -0,0 +1,39 @@
|
|||
---
|
||||
- name: Install ShadowArch (ArchLinux)
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
pacman:
|
||||
name: ShadowArch
|
||||
state: present
|
||||
update_cache: yes
|
||||
when: ansible_os_family == "Archlinux"
|
||||
|
||||
- name: Set up AniNIX-specific repository location (Other)
|
||||
when: ansible_os_family != "Archlinux"
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
file:
|
||||
path: /opt/aninix
|
||||
state: directory
|
||||
|
||||
- name: Download ShadowArch (Other)
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
ignore_errors: yes
|
||||
git:
|
||||
repo: 'https://foundation.aninix.net/AniNIX/ShadowArch'
|
||||
dest: '/opt/aninix/ShadowArch'
|
||||
update: yes
|
||||
when: ansible_os_family != "Archlinux"
|
||||
|
||||
- name: Install ShadowArch (Other)
|
||||
vars:
|
||||
ansible_become_password: "{{ passwords[inventory_hostname] }}"
|
||||
become: yes
|
||||
command:
|
||||
chdir: '/opt/aninix/ShadowArch'
|
||||
cmd: '/bin/bash -c "make install"'
|
||||
when: ansible_os_family != "Archlinux"
|
|
@ -2,4 +2,7 @@ Description="Bridge connection"
|
|||
Interface=br0
|
||||
Connection=bridge
|
||||
BindsToInterfaces=({{ ipinterface }} tun0)
|
||||
IP=dhcp
|
||||
IP=static
|
||||
Address=('{{ ip }}/24')
|
||||
Gateway='{{ router }}'
|
||||
DNS=('{{ dns }}')
|
||||
|
|
|
@ -102,8 +102,8 @@ Include = /etc/pacman.d/mirrorlist.shadowarch
|
|||
|
||||
[AniNIX]
|
||||
SigLevel = Required DatabaseOptional
|
||||
Server = https://maat.aninix.net/
|
||||
Server = http://maat.msn0.aninix.net/
|
||||
|
||||
[aur]
|
||||
SigLevel = Required DatabaseOptional
|
||||
Server = https://maat.aninix.net/aur/
|
||||
Server = http://maat.msn0.aninix.net/aur/
|
||||
|
|
|
@ -10,7 +10,7 @@ auto lo
|
|||
iface lo inet loopback
|
||||
|
||||
iface {{ ipinterface }} inet static
|
||||
address {{ ansible_host }}/{{ netmask }}
|
||||
address {{ ip }}/{{ netmask }}
|
||||
gateway {{ router }}
|
||||
|
||||
auto wlan0
|
||||
|
|
|
@ -0,0 +1 @@
|
|||
include "/etc/monit.d/checks/system"
|
|
@ -10,6 +10,7 @@ server {
|
|||
location / {
|
||||
|
||||
rewrite ^/martialarts(\/)*(\/index.html)*$ /assets/martialarts/index.html;
|
||||
rewrite ^/hire(\/)*(\/index.html)*$ /assets/hire/index.html;
|
||||
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
|
@ -34,6 +35,15 @@ server {
|
|||
rewrite /martialarts/maqotw.xml /MartialArts/Wiki/raw/branch/main/rss/maqotw.xml;
|
||||
}
|
||||
|
||||
location /25u {
|
||||
include conf.d/fastcgi.config;
|
||||
root /usr/share/webapps/aninix/;
|
||||
location ~* 25u {
|
||||
try_files $uri /25u_subnetting.php;
|
||||
expires max;
|
||||
}
|
||||
}
|
||||
|
||||
location /whatismyip {
|
||||
include conf.d/fastcgi.config;
|
||||
root /usr/share/webapps/aninix/;
|
||||
|
@ -52,8 +62,6 @@ server {
|
|||
root /usr/share/webapps/aninix/;
|
||||
try_files $uri /scratch.html;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
|
|
|
@ -6,7 +6,7 @@ map $http_upgrade $connection_upgrade {
|
|||
server {
|
||||
#listen 443 ssl http2;
|
||||
listen 443 ssl;
|
||||
server_name geth.aninix.net;
|
||||
server_name superintendent.aninix.net;
|
||||
|
||||
include conf/sec.conf;
|
||||
# include conf/default.csp.conf;
|
||||
|
@ -19,7 +19,7 @@ server {
|
|||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_pass http://geth.msn0.aninix.net:8123;
|
||||
proxy_pass http://superintendent.msn0.aninix.net:8123;
|
||||
proxy_redirect http:// https://;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
|
@ -22,6 +22,7 @@
|
|||
mode: 0750
|
||||
loop:
|
||||
- /usr/share/webapps/aninix
|
||||
- /var/lib/letsencrypt
|
||||
- /etc/nginx/conf
|
||||
- /etc/nginx/conf.d
|
||||
- /etc/modsecurity
|
||||
|
@ -78,7 +79,7 @@
|
|||
ignore_errors: true
|
||||
file:
|
||||
path: /run/nginx.pid
|
||||
state: file
|
||||
state: touch
|
||||
owner: http
|
||||
group: http
|
||||
mode: 0640
|
||||
|
|
|
@ -0,0 +1,14 @@
|
|||
---
|
||||
|
||||
- name: Install APC software
|
||||
become: yes
|
||||
package:
|
||||
name: apcupsd
|
||||
state: present
|
||||
|
||||
- name: Start APC service
|
||||
become: yes
|
||||
service:
|
||||
name: apcupsd.service
|
||||
state: started
|
||||
enabled: yes
|
|
@ -36,7 +36,6 @@
|
|||
- include_tasks: intel.yml
|
||||
when: "'Intel' in ansible_processor"
|
||||
|
||||
|
||||
- include_tasks: cyberpower.yml
|
||||
when: "ups == 'cyberpower'"
|
||||
|
||||
|
|
|
@ -1,12 +1,12 @@
|
|||
- name: Check /var free percentage
|
||||
command: /bin/bash -c "df -m /var | tail -n 1 | awk '{ print $5; }' | sed 's/%//' "
|
||||
command: /bin/bash -c "df -m /var | tail -n 1 | awk '{ print \$5; }' | sed 's/%//'"
|
||||
become: no
|
||||
register: df_output
|
||||
|
||||
- name: Verify /var space
|
||||
assert:
|
||||
that:
|
||||
- 90 > {{ df_output.stdout }}
|
||||
- 90 > df_output.stdout|int
|
||||
fail_msg: "Not enough free space"
|
||||
|
||||
- name: Update Archlinux Keyring
|
||||
|
@ -31,4 +31,3 @@
|
|||
when: '"linux" in updates.stdout or "kernel" in updates.stdout'
|
||||
reboot:
|
||||
reboot_timeout: 2
|
||||
|
||||
|
|
Loading…
Reference in New Issue