Concluding the testing of the Geth role

examples/msn0.yml

@@ -85,6 +85,12 @@ all:
                                     tap: true
                                     active_vms:
                                       - TDS-Jump
+                                    active_containers:
+                                      - 'takserver-5.4-RELEASE-17': 'takserver:5.4-RELEASE-17'
+                                      - 'takserver-db-5.4-RELEASE-17': 'takserver-db:5.4-RELEASE-17'
+                                      - 'filestash': 'machines/filestash'
+                                      - 'filestash_oods': 'onlyoffice/documentserver'
+                                      - 'geth-rancher': 'rancher/rancher'
                                 Node4:
                                     ansible_user: depriv
                                     ipinterface: enp1s0
@@ -94,23 +100,31 @@ all:
                                     ups: 'apc'
                                     active_vms:
                                       - Yggdrasil
-                        Geth:
+                        pitest:
                             hosts:
                                 Geth0:
                                     ipinterface: eth0
                                     ip: 10.0.1.9
                                     mac: b8:27:eb:09:a1:a0
                                     static: true
-                                    k3s_primary: true
+                                Geth5:
+                                    ipinterface: eth0
+                                    ip: 10.0.1.14
+                                    mac: b8:27:eb:81:f5:4b
+                                    static: true
+                        Geth:
+                            vars:
+                              geth_primary: Geth1
+                            hosts:
                                 Geth1:
                                     ipinterface: eth0
                                     ip: 10.0.1.10
-                                    mac: e4:5f:01:01:ff:9c
+                                    mac: e4:5f:01:01:ff:d5
                                     static: true
                                 Geth2:
                                     ipinterface: eth0
                                     ip: 10.0.1.11
-                                    mac: e4:5f:01:01:ff:d5
+                                    mac: e4:5f:01:01:ff:9c
                                     static: true
                                 Geth3:
                                     ipinterface: eth0
@@ -122,11 +136,6 @@ all:
                                     ip: 10.0.1.13
                                     mac: e4:5f:01:01:ff:e4
                                     static: true
-                                Geth5:
-                                    ipinterface: eth0
-                                    ip: 10.0.1.14
-                                    mac: b8:27:eb:81:f5:4b
-                                    static: true
                 virtual: # 10.0.1.16/28
                     vars:
                     hosts:

roles/Geth/README.md

@@ -1,20 +1,24 @@
-Geth is a complete automation suite for homes and interaction with the physical world. However, it is not a automatic process, and as such you will need to install it manually.
+Geth is a collective ecosystem for aggregating compute across many cheap nodes for small tasks.
 
-# Etymology=The [http://masseffect.wikia.com/wiki/Geth Geth] are a fictional race in the Mass Effect universe. Geth are individual processes running on many platforms. The more devices, the smarter the collective or gestalt consciousness of the entity becomes.
+Thanks to NetworkChuck's [tutorial](https://www.youtube.com/watch?v=X9fSMGkjtug) for helping to get this started and the Antsle nano models for the hardware to run this.
+
+# Etymology
+
+The [Geth](http://masseffect.wikia.com/wiki/Geth) are a fictional race in the Mass Effect universe. Geth are individual processes running on many platforms. The more devices, the smarter the collective or gestalt consciousness of the entity becomes.
 
 # Relevant Files and Software
-You can install Geth with [https://aninix.net/foundation/ConfigPackages ConfigPackages]'s Geth Makefile and configuration.
 
-A number of devices can be controlled under the gestalt -- see [[Geth/Hardware]] for our experiments with Geth hardware platforms. The configuration.yaml format used by the underlying home-assistant package is very simple, and as such we don't prescriptively install one over the base version. Instead, we include snippets for you to define your own structure.
+This is a Rancher orchestration of Kubernetes. This allows us to centrally manage a lot of small processes, such as CTF images, without the weight of managing full virtual machines.
 
-We are also considering features such as integrating smart lights with Shadowfeed presence detection and timeslots and requiring wireless presence for RFC door unlocks.
-
-[file:///var/lib/hass/ Geth configuration] can be tested with the following: <pre> hass --script check_config -c /var/lib/hass</pre>
+Note: containers make it easier to isolate dependencies, especially for less-maintained apps or when we want to set up an isolated network ecosystem. However, they do introduce performance overhead. This is helpful for micro-services, but it's not helpful for heavy, oft-used or data-intensive applications. Some articles with tracking on the wasted compute using containers are below.
+* https://pythonspeed.com/articles/docker-performance-overhead/
+* https://www.torizon.io/blog/containers-in-linux-and-performance-impact
 
 # Available Clients
-See [[WebServer#Clients|this list of clients]] for tools to access this system. The Shadowfeed NAT rules will need to be updated to allow access outside the network, and make sure to follow [https://home-assistant.io/getting-started/securing/ the security checkpoints] before publishing.
+This system does not have a client itself, but the containers managed in it may provide SSH or Web clients.
 
 # Equivalents or Competition
-Most home-automation systems are DIY at the moment, though the [https://nest.com/ NEST] system is one commercial offering.
-<!--|ref=REFERENCE-->}}
-[[Category:SSL]]
+
+There are many ways to run containers other than Rancher/k3s:
+* Self-hosted: RedHat OpenShift, [Antsle antMan](https://antsle.com), and raw Docker
+* Cloud: [Containers on Azure](https://azure.microsoft.com/en-us/products/category/containers/), [AWS Containers](https://aws.amazon.com/containers/)

roles/Geth/files/get-rancher.sh

@@ -0,0 +1,213 @@
+#!/bin/bash
+
+# Downloaded via `curl -sfL https://get.rancher.io`
+
+set -e
+
+if [ "${DEBUG}" = 1 ]; then
+    set -x
+fi
+
+# Usage:
+#   curl ... | ENV_VAR=... sh -
+#       or
+#   ENV_VAR=... ./install.sh
+#
+# Environment variables:
+#
+#   - INSTALL_RANCHERD_CHANNEL
+#     Channel to use for fetching RANCHERD download URL.
+#     Defaults to 'testing'.
+#
+#   - INSTALL_RANCHERD_TYPE
+#     Type of RANCHERD service. Can be either "server" or "agent".
+#     Default is "server".
+#
+#   - INSTALL_RANCHERD_VERSION
+#     Version of RANCHERD to download from github.
+#
+# info logs the given argument at info log level.
+info() {
+    echo "[INFO] " "$@"
+}
+
+# warn logs the given argument at warn log level.
+warn() {
+    echo "[WARN] " "$@" >&2
+}
+
+# fatal logs the given argument at fatal log level.
+fatal() {
+    echo "[ERROR] " "$@" >&2
+    if [ -n "${SUFFIX}" ]; then
+        echo "[ALT] Please visit 'https://github.com/rancher/rancher/releases' directly and download the latest rancherd-installer.${SUFFIX}.run" >&2
+    fi
+    exit 1
+}
+
+# setup_env defines needed environment variables.
+setup_env() {
+    INSTALL_RANCHERD_GITHUB_URL="https://github.com/rancher/rancher"
+    # --- bail if we are not root ---
+    if [ ! $(id -u) -eq 0 ]; then
+        fatal "You need to be root to perform this install"
+    fi
+
+    # --- make sure install channel has a value
+    if [ -z "${INSTALL_RANCHERD_CHANNEL}" ]; then
+        INSTALL_RANCHERD_CHANNEL="v2.5"
+    fi
+
+    # --- make sure install type has a value
+    if [ -z "${INSTALL_RANCHERD_TYPE}" ]; then
+        INSTALL_RANCHERD_TYPE="server"
+    fi
+}
+
+# setup_arch set arch and suffix,
+# fatal if architecture not supported.
+setup_arch() {
+    case ${ARCH:=$(uname -m)} in
+    amd64)
+        ARCH=amd64
+        SUFFIX=${ARCH}
+        ;;
+    x86_64)
+        ARCH=amd64
+        SUFFIX=${ARCH}
+        ;;
+    *)
+        fatal "unsupported architecture ${ARCH}"
+        ;;
+    esac
+}
+
+# verify_downloader verifies existence of
+# network downloader executable.
+verify_downloader() {
+    cmd="$(command -v "${1}")"
+    if [ -z "${cmd}" ]; then
+        return 1
+    fi
+    if [ ! -x "${cmd}" ]; then
+        return 1
+    fi
+
+    # Set verified executable as our downloader program and return success
+    DOWNLOADER=${cmd}
+    return 0
+}
+
+# setup_tmp creates a temporary directory
+# and cleans up when done.
+setup_tmp() {
+    TMP_DIR=$(mktemp -d -t rancherd-install.XXXXXXXXXX)
+    TMP_CHECKSUMS=${TMP_DIR}/rancherd.checksums
+    TMP_TARBALL=${TMP_DIR}/rancherd.tarball
+    cleanup() {
+        code=$?
+        set +e
+        trap - EXIT
+        rm -rf "${TMP_DIR}"
+        exit $code
+    }
+    trap cleanup INT EXIT
+}
+
+# --- use desired rancherd version if defined or find version from channel ---
+get_release_version() {
+    if [ -n "${INSTALL_RANCHERD_VERSION}" ]; then
+        version=${INSTALL_RANCHERD_VERSION}
+    else
+        info "finding release for channel ${INSTALL_RANCHERD_CHANNEL}"
+        INSTALL_RANCHERD_CHANNEL_URL=${INSTALL_RANCHERD_CHANNEL_URL:-'https://update.rancher.io/v1-release/channels'}
+        version_url="${INSTALL_RANCHERD_CHANNEL_URL}/${INSTALL_RANCHERD_CHANNEL}"
+        case ${DOWNLOADER} in
+        *curl)
+            version=$(${DOWNLOADER} -w "%{url_effective}" -L -s -S ${version_url} -o /dev/null | sed -e 's|.*/||')
+            ;;
+        *wget)
+            version=$(${DOWNLOADER} -SqO /dev/null ${version_url} 2>&1 | grep -i Location | sed -e 's|.*/||')
+            ;;
+        *)
+            fatal "Unsupported downloader executable '${DOWNLOADER}'"
+            ;;
+        esac
+        INSTALL_RANCHERD_VERSION="${version}"
+    fi
+    info "using ${INSTALL_RANCHERD_VERSION} as release"
+}
+
+# download downloads from github url.
+download() {
+    if [ $# -ne 2 ]; then
+        fatal "download needs exactly 2 arguments"
+    fi
+
+    case ${DOWNLOADER} in
+    *curl)
+        curl -o "$1" -fsSL "$2"
+        ;;
+    *wget)
+        wget -qO "$1" "$2"
+        ;;
+    *)
+        fatal "downloader executable not supported: '${DOWNLOADER}'"
+        ;;
+    esac
+
+    # Abort if download command failed
+    if [ $? -ne 0 ]; then
+        fatal "download failed"
+    fi
+}
+
+# download_checksums downloads hash from github url.
+download_checksums() {
+
+    CHECKSUMS_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/sha256sum.txt
+    info "downloading checksums at ${CHECKSUMS_URL}"
+    download "${TMP_CHECKSUMS}" "${CHECKSUMS_URL}"
+    CHECKSUM_EXPECTED=$(grep "rancherd.${SUFFIX}.tar.gz" "${TMP_CHECKSUMS}" | awk '{print $1}')
+}
+
+# download_tarball downloads binary from github url.
+download_tarball() {
+    TARBALL_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/rancherd-${SUFFIX}.tar.gz
+    info "downloading tarball at ${TARBALL_URL}"
+    download "${TMP_TARBALL}" "${TARBALL_URL}"
+}
+
+# verify_tarball verifies the downloaded installer checksum.
+verify_tarball() {
+    info "verifying installer"
+    CHECKSUM_ACTUAL=$(sha256sum "${TMP_TARBALL}" | awk '{print $1}')
+    if [ "${CHECKSUM_EXPECTED}" != "${CHECKSUM_ACTUAL}" ]; then
+        fatal "download sha256 does not match ${CHECKSUM_EXPECTED}, got ${CHECKSUM_ACTUAL}"
+    fi
+}
+
+unpack_tarball() {
+    info "unpacking tarball file"
+    mkdir -p /usr/local
+    tar xzf $TMP_TARBALL -C /usr/local
+}
+
+do_install_tar() {
+    verify_downloader curl || verify_downloader wget || fatal "can not find curl or wget for downloading files"
+    setup_tmp
+    get_release_version
+    download_checksums
+    download_tarball
+    verify_tarball
+    unpack_tarball
+}
+
+do_install() {
+    setup_env
+    setup_arch
+    do_install_tar
+}
+
+do_install
+exit 0

roles/Geth/tasks/general.yml

@@ -0,0 +1,40 @@
+---
+
+ - name: Copy install script
+   become: yes
+   ansible.builtin.copy:
+     src: get-k3s.sh
+     dest: /usr/local/sbin/get-k3s.sh
+     owner: root
+     group: root
+     mode: 0750
+
+ - name: Ensure cgroup
+   become: yes
+   register: cgroup_changed
+   ignore_errors: true
+   ansible.builtin.command:
+     cmd: /bin/bash -c "grep 'cgroup_memory=1 cgroup_enable=memory' /boot/firmware/cmdline.txt || (sed -i 's/$/ cgroup_memory=1 cgroup_enable=memory/' /boot/firmware/cmdline.txt && /bin/false)"
+
+ - name: Disable swap
+   become: yes
+   register: swap_changed
+   ansible.builtin.lineinfile:
+     path: /etc/rpi/swap.conf
+     regex: 'Mechanism='
+     line: 'Mechanism=none'
+
+ - name: Reboot if there was a change.
+   become: yes
+   ansible.builtin.command: "/usr/sbin/reboot"
+   async: 1
+   poll: 0
+   when: cgroup_changed is failed or swap_changed is changed
+
+ - name: Wait for the reboot to complete if there was a change.
+   wait_for_connection:
+     connect_timeout: 20
+     sleep: 5
+     delay: 5
+     timeout: 300
+   when: cgroup_changed is failed or swap_changed is changed

roles/Geth/tasks/main.yml

@@ -1,8 +1,16 @@
 ---
- - name: Geth packages
-   become: yes
-   package:
-     name:
-       - openhab2
 
- - name:
+ - name: General tasks
+   include_tasks: general.yml
+
+ - name: Primary tasks
+   include_tasks: primary.yml
+   when: "inventory_hostname == geth_primary "
+
+ #  - name: Rancher tasks
+ #    include_tasks: rancher.yml
+ #    when: "inventory_hostname == geth_primary "
+
+ - name: Worker tasks
+   include_tasks: worker.yml
+   when: "not inventory_hostname == geth_primary"

roles/Geth/tasks/primary.yml

@@ -0,0 +1,24 @@
+---
+
+- name: Set up primary
+  become: yes
+  ansible.builtin.command:
+    cmd: '/bin/bash -c "K3S_KUBECONFIG_MODE=644 /usr/local/sbin/get-k3s.sh"'
+    creates: /etc/systemd/system/k3s.service
+
+- name: Check the token
+  become: yes
+  ansible.builtin.command:
+    cmd: 'cat /var/lib/rancher/k3s/server/node-token'
+  register: k3s_token_cat
+
+- name: Ensure the token is in vault
+  assert:
+    that: k3s_token_cat.stdout_lines[0] is in secrets['Geth']['k3s_token']
+
+- name: Enable k3s
+  become: yes
+  ansible.builtin.service:
+    name: k3s
+    state: restarted
+    enabled: yes

roles/Geth/tasks/rancher.yml

@@ -0,0 +1,46 @@
+---
+
+- name: Rancher directories
+  become: yes
+  ansible.builtin.file:
+    state: directory
+    path: "{{ item }}"
+    mode: 0750
+    owner: root
+    group: root
+  loop:
+    - '/etc/rancher'
+    - '/etc/rancher/rke2'
+
+- name: Rancher config
+  become: true
+  ansible.builtin.template:
+    src: rancher.config.yaml.j2
+    dest: /etc/rancher/rke2/config.yaml
+    owner: root
+    group: root
+    mode: 0750
+
+- name: Copy install script
+  become: yes
+  ansible.builtin.copy:
+    src: get-rancher.sh
+    dest: /usr/local/sbin/get-rancher.sh
+    owner: root
+    group: root
+    mode: 0750
+
+- name: Run install script
+  become: yes
+  ansible.builtin.command:
+    cmd: /usr/local/sbin/get-rancher.sh
+
+- name: Enable rancherd
+  become: yes
+  ansible.builtin.service:
+    name: rancherd
+    state: restarted
+    enabled: yes
+
+- debug:
+    msg: 'Make sure to run `rancherd reset-admin` if this is a new cluster.'

roles/Geth/tasks/worker.yml

@@ -0,0 +1,14 @@
+---
+
+ - name: Set up worker
+   become: yes
+   ansible.builtin.command:
+     cmd: /bin/bash -c "K3S_TOKEN={{ secrets['Geth']['k3s_token'] }} K3S_URL=https://{{ geth_primary }}:6443 K3S_NODE_NAME=${HOSTNAME} /usr/local/sbin/get-k3s.sh"
+     creates: /etc/systemd/system/k3s-agent.service
+
+ - name: Enable k3s-agent
+   become: yes
+   ansible.builtin.service:
+     name: k3s-agent
+     state: restarted
+     enabled: yes

roles/Geth/templates/rancher.config.yaml.j2

@@ -0,0 +1,5 @@
+token: '{{ secrets['Geth']['rancher_token'] }}'
+tls-san:
+    - {{ inventory_hostname }}
+    - {{ inventory_hostname }}.{{ replica_domain }}
+    - {{ ip }}

roles/Node/tasks/main.yml

@@ -13,6 +13,8 @@
        - qemu-base
        - qemu-emulators-full
        - ddrescue
+       - docker
+       - python-requests
      state: present
 
  - name: Copy VM definitions
@@ -69,3 +71,11 @@
      name: "{{ item }}-vm.service"
      state: started
      enabled: yes
+
+ - name: Enable containers
+   become: yes
+   community.docker.docker_container:
+      name: "{{ item.key }}"
+      image: '{{ item.value }}'
+      state: started
+   with_dict: "{{ active_containers }}"

roles/Sharingan/files/suricata/siem-block

@@ -1,24 +0,0 @@
-#!/bin/bash
-
-cidr="$1"
-
-# If no CIDR was provided, query suricata.
-if [ -z "$cidr" ]; then
-    echo Top offenders last 8 hours:
-    journalctl --since=-8h -xeu suricata | cut -f 2 -d '}' | cut -f 1 -d : | sort -n | uniq -c | sort -n | tail -n 10
-    read -p Target: cidr
-fi
-
-whois "$cidr" | grep -iE 'inet|cidr|country|address|organization'
-read -p "Sanitized CIDR: " cidr
-
-set -x
-ssh shadownet iptables -A siem -s "$cidr" -j DROP
-if [ $? -ne 0 ]; then
-    ssh shadownet iptables -N siem
-    ssh shadownet iptables -I INPUT 3 -j siem
-    ssh shadownet iptables -A siem -s "$cidr" -j DROP
-fi
-
-sudo iptables -A siem -s "$cidr" -j DROP
-set +x