Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 DarkFeather
|
e3d5d918e8
|
+9
-18
@@ -85,12 +85,6 @@ all:
|
||||
tap: true
|
||||
active_vms:
|
||||
- TDS-Jump
|
||||
active_containers:
|
||||
- 'takserver-5.4-RELEASE-17': 'takserver:5.4-RELEASE-17'
|
||||
- 'takserver-db-5.4-RELEASE-17': 'takserver-db:5.4-RELEASE-17'
|
||||
- 'filestash': 'machines/filestash'
|
||||
- 'filestash_oods': 'onlyoffice/documentserver'
|
||||
- 'geth-rancher': 'rancher/rancher'
|
||||
Node4:
|
||||
ansible_user: depriv
|
||||
ipinterface: enp1s0
|
||||
@@ -100,31 +94,23 @@ all:
|
||||
ups: 'apc'
|
||||
active_vms:
|
||||
- Yggdrasil
|
||||
pitest:
|
||||
Geth:
|
||||
hosts:
|
||||
Geth0:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.9
|
||||
mac: b8:27:eb:09:a1:a0
|
||||
static: true
|
||||
Geth5:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.14
|
||||
mac: b8:27:eb:81:f5:4b
|
||||
static: true
|
||||
Geth:
|
||||
vars:
|
||||
geth_primary: Geth1
|
||||
hosts:
|
||||
k3s_primary: true
|
||||
Geth1:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.10
|
||||
mac: e4:5f:01:01:ff:d5
|
||||
mac: e4:5f:01:01:ff:9c
|
||||
static: true
|
||||
Geth2:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.11
|
||||
mac: e4:5f:01:01:ff:9c
|
||||
mac: e4:5f:01:01:ff:d5
|
||||
static: true
|
||||
Geth3:
|
||||
ipinterface: eth0
|
||||
@@ -136,6 +122,11 @@ all:
|
||||
ip: 10.0.1.13
|
||||
mac: e4:5f:01:01:ff:e4
|
||||
static: true
|
||||
Geth5:
|
||||
ipinterface: eth0
|
||||
ip: 10.0.1.14
|
||||
mac: b8:27:eb:81:f5:4b
|
||||
static: true
|
||||
virtual: # 10.0.1.16/28
|
||||
vars:
|
||||
hosts:
|
||||
|
||||
+11
-15
@@ -1,24 +1,20 @@
|
||||
Geth is a collective ecosystem for aggregating compute across many cheap nodes for small tasks.
|
||||
Geth is a complete automation suite for homes and interaction with the physical world. However, it is not a automatic process, and as such you will need to install it manually.
|
||||
|
||||
Thanks to NetworkChuck's [tutorial](https://www.youtube.com/watch?v=X9fSMGkjtug) for helping to get this started and the Antsle nano models for the hardware to run this.
|
||||
|
||||
# Etymology
|
||||
|
||||
The [Geth](http://masseffect.wikia.com/wiki/Geth) are a fictional race in the Mass Effect universe. Geth are individual processes running on many platforms. The more devices, the smarter the collective or gestalt consciousness of the entity becomes.
|
||||
# Etymology=The [http://masseffect.wikia.com/wiki/Geth Geth] are a fictional race in the Mass Effect universe. Geth are individual processes running on many platforms. The more devices, the smarter the collective or gestalt consciousness of the entity becomes.
|
||||
|
||||
# Relevant Files and Software
|
||||
You can install Geth with [https://aninix.net/foundation/ConfigPackages ConfigPackages]'s Geth Makefile and configuration.
|
||||
|
||||
This is a Rancher orchestration of Kubernetes. This allows us to centrally manage a lot of small processes, such as CTF images, without the weight of managing full virtual machines.
|
||||
A number of devices can be controlled under the gestalt -- see [[Geth/Hardware]] for our experiments with Geth hardware platforms. The configuration.yaml format used by the underlying home-assistant package is very simple, and as such we don't prescriptively install one over the base version. Instead, we include snippets for you to define your own structure.
|
||||
|
||||
Note: containers make it easier to isolate dependencies, especially for less-maintained apps or when we want to set up an isolated network ecosystem. However, they do introduce performance overhead. This is helpful for micro-services, but it's not helpful for heavy, oft-used or data-intensive applications. Some articles with tracking on the wasted compute using containers are below.
|
||||
* https://pythonspeed.com/articles/docker-performance-overhead/
|
||||
* https://www.torizon.io/blog/containers-in-linux-and-performance-impact
|
||||
We are also considering features such as integrating smart lights with Shadowfeed presence detection and timeslots and requiring wireless presence for RFC door unlocks.
|
||||
|
||||
[file:///var/lib/hass/ Geth configuration] can be tested with the following: <pre> hass --script check_config -c /var/lib/hass</pre>
|
||||
|
||||
# Available Clients
|
||||
This system does not have a client itself, but the containers managed in it may provide SSH or Web clients.
|
||||
See [[WebServer#Clients|this list of clients]] for tools to access this system. The Shadowfeed NAT rules will need to be updated to allow access outside the network, and make sure to follow [https://home-assistant.io/getting-started/securing/ the security checkpoints] before publishing.
|
||||
|
||||
# Equivalents or Competition
|
||||
|
||||
There are many ways to run containers other than Rancher/k3s:
|
||||
* Self-hosted: RedHat OpenShift, [Antsle antMan](https://antsle.com), and raw Docker
|
||||
* Cloud: [Containers on Azure](https://azure.microsoft.com/en-us/products/category/containers/), [AWS Containers](https://aws.amazon.com/containers/)
|
||||
Most home-automation systems are DIY at the moment, though the [https://nest.com/ NEST] system is one commercial offering.
|
||||
<!--|ref=REFERENCE-->}}
|
||||
[[Category:SSL]]
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,213 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Downloaded via `curl -sfL https://get.rancher.io`
|
||||
|
||||
set -e
|
||||
|
||||
if [ "${DEBUG}" = 1 ]; then
|
||||
set -x
|
||||
fi
|
||||
|
||||
# Usage:
|
||||
# curl ... | ENV_VAR=... sh -
|
||||
# or
|
||||
# ENV_VAR=... ./install.sh
|
||||
#
|
||||
# Environment variables:
|
||||
#
|
||||
# - INSTALL_RANCHERD_CHANNEL
|
||||
# Channel to use for fetching RANCHERD download URL.
|
||||
# Defaults to 'testing'.
|
||||
#
|
||||
# - INSTALL_RANCHERD_TYPE
|
||||
# Type of RANCHERD service. Can be either "server" or "agent".
|
||||
# Default is "server".
|
||||
#
|
||||
# - INSTALL_RANCHERD_VERSION
|
||||
# Version of RANCHERD to download from github.
|
||||
#
|
||||
# info logs the given argument at info log level.
|
||||
info() {
|
||||
echo "[INFO] " "$@"
|
||||
}
|
||||
|
||||
# warn logs the given argument at warn log level.
|
||||
warn() {
|
||||
echo "[WARN] " "$@" >&2
|
||||
}
|
||||
|
||||
# fatal logs the given argument at fatal log level.
|
||||
fatal() {
|
||||
echo "[ERROR] " "$@" >&2
|
||||
if [ -n "${SUFFIX}" ]; then
|
||||
echo "[ALT] Please visit 'https://github.com/rancher/rancher/releases' directly and download the latest rancherd-installer.${SUFFIX}.run" >&2
|
||||
fi
|
||||
exit 1
|
||||
}
|
||||
|
||||
# setup_env defines needed environment variables.
|
||||
setup_env() {
|
||||
INSTALL_RANCHERD_GITHUB_URL="https://github.com/rancher/rancher"
|
||||
# --- bail if we are not root ---
|
||||
if [ ! $(id -u) -eq 0 ]; then
|
||||
fatal "You need to be root to perform this install"
|
||||
fi
|
||||
|
||||
# --- make sure install channel has a value
|
||||
if [ -z "${INSTALL_RANCHERD_CHANNEL}" ]; then
|
||||
INSTALL_RANCHERD_CHANNEL="v2.5"
|
||||
fi
|
||||
|
||||
# --- make sure install type has a value
|
||||
if [ -z "${INSTALL_RANCHERD_TYPE}" ]; then
|
||||
INSTALL_RANCHERD_TYPE="server"
|
||||
fi
|
||||
}
|
||||
|
||||
# setup_arch set arch and suffix,
|
||||
# fatal if architecture not supported.
|
||||
setup_arch() {
|
||||
case ${ARCH:=$(uname -m)} in
|
||||
amd64)
|
||||
ARCH=amd64
|
||||
SUFFIX=${ARCH}
|
||||
;;
|
||||
x86_64)
|
||||
ARCH=amd64
|
||||
SUFFIX=${ARCH}
|
||||
;;
|
||||
*)
|
||||
fatal "unsupported architecture ${ARCH}"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# verify_downloader verifies existence of
|
||||
# network downloader executable.
|
||||
verify_downloader() {
|
||||
cmd="$(command -v "${1}")"
|
||||
if [ -z "${cmd}" ]; then
|
||||
return 1
|
||||
fi
|
||||
if [ ! -x "${cmd}" ]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Set verified executable as our downloader program and return success
|
||||
DOWNLOADER=${cmd}
|
||||
return 0
|
||||
}
|
||||
|
||||
# setup_tmp creates a temporary directory
|
||||
# and cleans up when done.
|
||||
setup_tmp() {
|
||||
TMP_DIR=$(mktemp -d -t rancherd-install.XXXXXXXXXX)
|
||||
TMP_CHECKSUMS=${TMP_DIR}/rancherd.checksums
|
||||
TMP_TARBALL=${TMP_DIR}/rancherd.tarball
|
||||
cleanup() {
|
||||
code=$?
|
||||
set +e
|
||||
trap - EXIT
|
||||
rm -rf "${TMP_DIR}"
|
||||
exit $code
|
||||
}
|
||||
trap cleanup INT EXIT
|
||||
}
|
||||
|
||||
# --- use desired rancherd version if defined or find version from channel ---
|
||||
get_release_version() {
|
||||
if [ -n "${INSTALL_RANCHERD_VERSION}" ]; then
|
||||
version=${INSTALL_RANCHERD_VERSION}
|
||||
else
|
||||
info "finding release for channel ${INSTALL_RANCHERD_CHANNEL}"
|
||||
INSTALL_RANCHERD_CHANNEL_URL=${INSTALL_RANCHERD_CHANNEL_URL:-'https://update.rancher.io/v1-release/channels'}
|
||||
version_url="${INSTALL_RANCHERD_CHANNEL_URL}/${INSTALL_RANCHERD_CHANNEL}"
|
||||
case ${DOWNLOADER} in
|
||||
*curl)
|
||||
version=$(${DOWNLOADER} -w "%{url_effective}" -L -s -S ${version_url} -o /dev/null | sed -e 's|.*/||')
|
||||
;;
|
||||
*wget)
|
||||
version=$(${DOWNLOADER} -SqO /dev/null ${version_url} 2>&1 | grep -i Location | sed -e 's|.*/||')
|
||||
;;
|
||||
*)
|
||||
fatal "Unsupported downloader executable '${DOWNLOADER}'"
|
||||
;;
|
||||
esac
|
||||
INSTALL_RANCHERD_VERSION="${version}"
|
||||
fi
|
||||
info "using ${INSTALL_RANCHERD_VERSION} as release"
|
||||
}
|
||||
|
||||
# download downloads from github url.
|
||||
download() {
|
||||
if [ $# -ne 2 ]; then
|
||||
fatal "download needs exactly 2 arguments"
|
||||
fi
|
||||
|
||||
case ${DOWNLOADER} in
|
||||
*curl)
|
||||
curl -o "$1" -fsSL "$2"
|
||||
;;
|
||||
*wget)
|
||||
wget -qO "$1" "$2"
|
||||
;;
|
||||
*)
|
||||
fatal "downloader executable not supported: '${DOWNLOADER}'"
|
||||
;;
|
||||
esac
|
||||
|
||||
# Abort if download command failed
|
||||
if [ $? -ne 0 ]; then
|
||||
fatal "download failed"
|
||||
fi
|
||||
}
|
||||
|
||||
# download_checksums downloads hash from github url.
|
||||
download_checksums() {
|
||||
|
||||
CHECKSUMS_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/sha256sum.txt
|
||||
info "downloading checksums at ${CHECKSUMS_URL}"
|
||||
download "${TMP_CHECKSUMS}" "${CHECKSUMS_URL}"
|
||||
CHECKSUM_EXPECTED=$(grep "rancherd.${SUFFIX}.tar.gz" "${TMP_CHECKSUMS}" | awk '{print $1}')
|
||||
}
|
||||
|
||||
# download_tarball downloads binary from github url.
|
||||
download_tarball() {
|
||||
TARBALL_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/rancherd-${SUFFIX}.tar.gz
|
||||
info "downloading tarball at ${TARBALL_URL}"
|
||||
download "${TMP_TARBALL}" "${TARBALL_URL}"
|
||||
}
|
||||
|
||||
# verify_tarball verifies the downloaded installer checksum.
|
||||
verify_tarball() {
|
||||
info "verifying installer"
|
||||
CHECKSUM_ACTUAL=$(sha256sum "${TMP_TARBALL}" | awk '{print $1}')
|
||||
if [ "${CHECKSUM_EXPECTED}" != "${CHECKSUM_ACTUAL}" ]; then
|
||||
fatal "download sha256 does not match ${CHECKSUM_EXPECTED}, got ${CHECKSUM_ACTUAL}"
|
||||
fi
|
||||
}
|
||||
|
||||
unpack_tarball() {
|
||||
info "unpacking tarball file"
|
||||
mkdir -p /usr/local
|
||||
tar xzf $TMP_TARBALL -C /usr/local
|
||||
}
|
||||
|
||||
do_install_tar() {
|
||||
verify_downloader curl || verify_downloader wget || fatal "can not find curl or wget for downloading files"
|
||||
setup_tmp
|
||||
get_release_version
|
||||
download_checksums
|
||||
download_tarball
|
||||
verify_tarball
|
||||
unpack_tarball
|
||||
}
|
||||
|
||||
do_install() {
|
||||
setup_env
|
||||
setup_arch
|
||||
do_install_tar
|
||||
}
|
||||
|
||||
do_install
|
||||
exit 0
|
||||
@@ -1,40 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Copy install script
|
||||
become: yes
|
||||
ansible.builtin.copy:
|
||||
src: get-k3s.sh
|
||||
dest: /usr/local/sbin/get-k3s.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0750
|
||||
|
||||
- name: Ensure cgroup
|
||||
become: yes
|
||||
register: cgroup_changed
|
||||
ignore_errors: true
|
||||
ansible.builtin.command:
|
||||
cmd: /bin/bash -c "grep 'cgroup_memory=1 cgroup_enable=memory' /boot/firmware/cmdline.txt || (sed -i 's/$/ cgroup_memory=1 cgroup_enable=memory/' /boot/firmware/cmdline.txt && /bin/false)"
|
||||
|
||||
- name: Disable swap
|
||||
become: yes
|
||||
register: swap_changed
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/rpi/swap.conf
|
||||
regex: 'Mechanism='
|
||||
line: 'Mechanism=none'
|
||||
|
||||
- name: Reboot if there was a change.
|
||||
become: yes
|
||||
ansible.builtin.command: "/usr/sbin/reboot"
|
||||
async: 1
|
||||
poll: 0
|
||||
when: cgroup_changed is failed or swap_changed is changed
|
||||
|
||||
- name: Wait for the reboot to complete if there was a change.
|
||||
wait_for_connection:
|
||||
connect_timeout: 20
|
||||
sleep: 5
|
||||
delay: 5
|
||||
timeout: 300
|
||||
when: cgroup_changed is failed or swap_changed is changed
|
||||
@@ -1,16 +1,8 @@
|
||||
---
|
||||
- name: Geth packages
|
||||
become: yes
|
||||
package:
|
||||
name:
|
||||
- openhab2
|
||||
|
||||
- name: General tasks
|
||||
include_tasks: general.yml
|
||||
|
||||
- name: Primary tasks
|
||||
include_tasks: primary.yml
|
||||
when: "inventory_hostname == geth_primary "
|
||||
|
||||
# - name: Rancher tasks
|
||||
# include_tasks: rancher.yml
|
||||
# when: "inventory_hostname == geth_primary "
|
||||
|
||||
- name: Worker tasks
|
||||
include_tasks: worker.yml
|
||||
when: "not inventory_hostname == geth_primary"
|
||||
- name:
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Set up primary
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: '/bin/bash -c "K3S_KUBECONFIG_MODE=644 /usr/local/sbin/get-k3s.sh"'
|
||||
creates: /etc/systemd/system/k3s.service
|
||||
|
||||
- name: Check the token
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: 'cat /var/lib/rancher/k3s/server/node-token'
|
||||
register: k3s_token_cat
|
||||
|
||||
- name: Ensure the token is in vault
|
||||
assert:
|
||||
that: k3s_token_cat.stdout_lines[0] is in secrets['Geth']['k3s_token']
|
||||
|
||||
- name: Enable k3s
|
||||
become: yes
|
||||
ansible.builtin.service:
|
||||
name: k3s
|
||||
state: restarted
|
||||
enabled: yes
|
||||
@@ -1,46 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Rancher directories
|
||||
become: yes
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
path: "{{ item }}"
|
||||
mode: 0750
|
||||
owner: root
|
||||
group: root
|
||||
loop:
|
||||
- '/etc/rancher'
|
||||
- '/etc/rancher/rke2'
|
||||
|
||||
- name: Rancher config
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: rancher.config.yaml.j2
|
||||
dest: /etc/rancher/rke2/config.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0750
|
||||
|
||||
- name: Copy install script
|
||||
become: yes
|
||||
ansible.builtin.copy:
|
||||
src: get-rancher.sh
|
||||
dest: /usr/local/sbin/get-rancher.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0750
|
||||
|
||||
- name: Run install script
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: /usr/local/sbin/get-rancher.sh
|
||||
|
||||
- name: Enable rancherd
|
||||
become: yes
|
||||
ansible.builtin.service:
|
||||
name: rancherd
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- debug:
|
||||
msg: 'Make sure to run `rancherd reset-admin` if this is a new cluster.'
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Set up worker
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: /bin/bash -c "K3S_TOKEN={{ secrets['Geth']['k3s_token'] }} K3S_URL=https://{{ geth_primary }}:6443 K3S_NODE_NAME=${HOSTNAME} /usr/local/sbin/get-k3s.sh"
|
||||
creates: /etc/systemd/system/k3s-agent.service
|
||||
|
||||
- name: Enable k3s-agent
|
||||
become: yes
|
||||
ansible.builtin.service:
|
||||
name: k3s-agent
|
||||
state: restarted
|
||||
enabled: yes
|
||||
@@ -1,5 +0,0 @@
|
||||
token: '{{ secrets['Geth']['rancher_token'] }}'
|
||||
tls-san:
|
||||
- {{ inventory_hostname }}
|
||||
- {{ inventory_hostname }}.{{ replica_domain }}
|
||||
- {{ ip }}
|
||||
@@ -13,8 +13,6 @@
|
||||
- qemu-base
|
||||
- qemu-emulators-full
|
||||
- ddrescue
|
||||
- docker
|
||||
- python-requests
|
||||
state: present
|
||||
|
||||
- name: Copy VM definitions
|
||||
@@ -71,11 +69,3 @@
|
||||
name: "{{ item }}-vm.service"
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Enable containers
|
||||
become: yes
|
||||
community.docker.docker_container:
|
||||
name: "{{ item.key }}"
|
||||
image: '{{ item.value }}'
|
||||
state: started
|
||||
with_dict: "{{ active_containers }}"
|
||||
|
||||
Executable
+24
@@ -0,0 +1,24 @@
|
||||
#!/bin/bash
|
||||
|
||||
cidr="$1"
|
||||
|
||||
# If no CIDR was provided, query suricata.
|
||||
if [ -z "$cidr" ]; then
|
||||
echo Top offenders last 8 hours:
|
||||
journalctl --since=-8h -xeu suricata | cut -f 2 -d '}' | cut -f 1 -d : | sort -n | uniq -c | sort -n | tail -n 10
|
||||
read -p Target: cidr
|
||||
fi
|
||||
|
||||
whois "$cidr" | grep -iE 'inet|cidr|country|address|organization'
|
||||
read -p "Sanitized CIDR: " cidr
|
||||
|
||||
set -x
|
||||
ssh shadownet iptables -A siem -s "$cidr" -j DROP
|
||||
if [ $? -ne 0 ]; then
|
||||
ssh shadownet iptables -N siem
|
||||
ssh shadownet iptables -I INPUT 3 -j siem
|
||||
ssh shadownet iptables -A siem -s "$cidr" -j DROP
|
||||
fi
|
||||
|
||||
sudo iptables -A siem -s "$cidr" -j DROP
|
||||
set +x
|
||||
Reference in New Issue
Block a user