xenobyte/sukaato-ansible
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new major update

Browse Source
This commit is contained in:
Alex Tavarez committed 2026-09-26 14:18:27 -04:00
1 parent 161f8fc94e
commit 3f69aa6af1
60 files changed
+2228 -615
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/init-server/files/systemd/system/thrunet.service
+2 -2
View File
@@ -5,8 +5,8 @@ Wants=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/local/bin/dsnet-forward.sh start
ExecStop=/usr/local/bin/dsnet-forward.sh stop
ExecStart=/usr/local/bin/dsnet-routing.sh up
ExecStop=/usr/local/bin/dsnet-routing.sh down
RemainAfterExit=yes
# ExecReload=/usr/bin/dsnet sync
roles/init-server/handlers/core.yml
+20
View File
@@ -9,6 +9,26 @@
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/git.yml
listen: git
- name: Setting up TOTP
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/libpam-google-authenticator.yml
listen: "libpam-google-authenticator"
- name: Setting up IPTables
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/iptables.yml
listen: iptables
- name: Setting up IPTables
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/ufw.yml
listen: ufw
- name: Setting up Podman
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/podman.yml
listen: podman
- name: Setting up Avahi
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/avahi-daemon.yml
listen: "avahi-daemon"
- name: Setting up Certbot
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/certbot.yml
roles/init-server/handlers/userspace.yml
+32 -20
View File
@@ -37,18 +37,46 @@
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/uv.yml
listen: uv
- name: Setting up TOTP
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/libpam-google-authenticator.yml
listen: libpam-google-authenticator
- name: Setting up IPTables
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/iptables.yml
listen: iptables
- name: Setting up UFW
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/ufw.yml
listen: ufw
- name: Setting up Certbot
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/certbot.yml
listen: certbot
- name: Setting up Surge
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/surge.yml
listen: surge
- name: Setting up Aria2
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/aria.yml
listen: aria
- name: Setting up Radicle
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/radicle.yml
listen: radicle
- name: Setting up Podman
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/podman.yml
listen: podman
- name: Setting up Podman Compose sources
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/skato_compose.yml
listen: skato_compose
- name: Setting up Quartz
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/quartz.yml
listen: quartz
- name: Setting up Podman Compose sources
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/skato_compose.yml
listen: skato_compose
- name: Setting up native CLI tools sources
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/skato_cli.yml
@@ -65,19 +93,3 @@
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/sukaato.yml
listen: sukaato
- name: Setting up Surge
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/surge.yml
listen: surge
- name: Setting up Aria2
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/aria.yml
listen: aria
- name: Setting up Radicle
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/radicle.yml
listen: radicle
- name: Setting up TOTP
ansible.builtin.include_tasks:
file: tasks/contingent/pkg/libpam-google-authenticator.yml
listen: libpam-google-authenticator
roles/init-server/tasks/contingent/pkg/avahi-daemon.yml
+7
View File
@@ -0,0 +1,7 @@
- name: Starting and enabling SystemD service
become: true
ansible.builtin.systemd_service:
name: "avahi-daemon"
scope: system
enabled: true
state: started
roles/init-server/tasks/contingent/pkg/certbot.yml
+50 -21
View File
@@ -18,22 +18,19 @@
- name: Creating domain arguments for certbot
ansible.builtin.set_fact:
certbot_domains: "{{ ['-d'] | product(web_fqdns) | map('join', '=') | list }}"
- name: Getting public IP
- name: Getting public IPv4 address
community.general.ipify_facts:
validate_certs: false
timeout: 20
- name: Getting public IPv6 address
when: ipv6_enabled
ansible.builtin.shell:
cmd: curl -6 icanhazip.com
register: ipify_public_ip6
- name: Starting domain name registration with standalone DNS
when: "certbot.auth_method == 'dns' and not certbot.containerized"
ignore_errors: true
block:
- name: Opening port 53
become: true
ansible.builtin.iptables:
chain: INPUT
protocol: tcp
destination_port: 53
jump: ACCEPT
comment: Opening up port 53
# @NOTE https://github.com/siilike/certbot-dns-standalone
- name: Exemplifying needed ACME record
ansible.builtin.set_fact:
@@ -42,6 +39,14 @@
_acme-challenge.{{ fqdn | default(inventory_hostname) }} IN CNAME {{ fqdn | default(inventory_hostname) }}.acme.{{ fqdn | default(inventory_hostname) }}.
acme.{{ fqdn | default(inventory_hostname) }} IN NS ns.acme.{{ fqdn | default(inventory_hostname) }}.
ns.acme.{{ fqdn | default(inventory_hostname) }} IN A {{ ipify_public_ip }}
- name: Exemplifying needed ACME record
when: ipv6_enabled
ansible.builtin.set_fact:
acme_record: |
{{ fqdn | default(inventory_hostname) }} IN A {{ ipify_public_ip6.stdout }}
_acme-challenge.{{ fqdn | default(inventory_hostname) }} IN CNAME {{ fqdn | default(inventory_hostname) }}.acme.{{ fqdn | default(inventory_hostname) }}.
acme.{{ fqdn | default(inventory_hostname) }} IN NS ns.acme.{{ fqdn | default(inventory_hostname) }}.
ns.acme.{{ fqdn | default(inventory_hostname) }} IN A {{ ipify_public_ip6.stdout }}
- name: Informing user of need to set up ACME record
ansible.builtin.debug:
msg: "Please set ACME record in domain name provider:\n {{ acme_record }}"
@@ -49,7 +54,7 @@
ansible.builtin.pause:
- name: Running certbot to authenticate and acquire domain name certificates
become: true
when: "certbot.mode == 'dev'"
when: "certbot.mode == 'dev' and not ipv6_enabled"
ansible.builtin.command:
argv:
- certbot
@@ -61,13 +66,30 @@
- "--agree-tos"
- "--non-interactive"
- "--dns-standalone-address={{ ipify_public_ip }}"
# - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
- "--dns-standalone-port={{ certbot.port }}"
- "{{ certbot_domains[0] }}"
- "{{ certbot_domains[1] }}"
- name: Running certbot to authenticate and acquire domain name certificates
become: true
when: "certbot.mode == 'prod'"
when: "certbot.mode == 'dev' and ipv6_enabled"
ansible.builtin.command:
argv:
- certbot
- certonly
- "--staging"
- "--debug"
- "--authenticator=dns-standalone"
- "--email={{ certbot.email }}"
- "--agree-tos"
- "--non-interactive"
- "--dns-standalone-address={{ ipify_public_ip }}"
- "--dns-standalone-ipv6-address={{ ipify_public_ip6.stdout }}"
- "--dns-standalone-port={{ certbot.port }}"
- "{{ certbot_domains[0] }}"
- "{{ certbot_domains[1] }}"
- name: Running certbot to authenticate and acquire domain name certificates
become: true
when: "certbot.mode == 'prod' and not ipv6_enabled"
ansible.builtin.command:
argv:
- certbot
@@ -77,7 +99,22 @@
- "--agree-tos"
- "--non-interactive"
- "--dns-standalone-address={{ ipify_public_ip }}"
# - "--dns-standalone-ipv6-address={{ ansible_default_ipv6.address | default(ansible_all_ipv6_addresses[0]) }}"
- "--dns-standalone-port={{ certbot.port }}"
- "{{ certbot_domains[0] }}"
- "{{ certbot_domains[1] }}"
- name: Running certbot to authenticate and acquire domain name certificates
become: true
when: "certbot.mode == 'prod' and ipv6_enabled"
ansible.builtin.command:
argv:
- certbot
- certonly
- "--authenticator=dns-standalone"
- "--email={{ certbot.email }}"
- "--agree-tos"
- "--non-interactive"
- "--dns-standalone-address={{ ipify_public_ip }}"
- "--dns-standalone-ipv6-address={{ ipify_public_ip6.stdout }}"
- "--dns-standalone-port={{ certbot.port }}"
- "{{ certbot_domains[0] }}"
- "{{ certbot_domains[1] }}"
@@ -85,14 +122,6 @@
when: "certbot.auth_method == 'standalone' and not certbot.containerized"
ignore_errors: true
block:
- name: Opening port 80
become: true
ansible.builtin.iptables:
chain: INPUT
protocol: tcp
destination_port: 80
jump: ACCEPT
comment: Open up port 80
- name: Acquiring domain certificates
become: true
when: "certbot.mode == 'dev'"
roles/init-server/tasks/contingent/pkg/crowdsec.yml
+1
View File
@@ -37,6 +37,7 @@
name: crowdsec
scope: system
state: restarted
enabled: true
- name: Adding remediation component or bouncer
ansible.builtin.command:
cmd: "cscli bouncers add {{ item }}"
roles/init-server/tasks/contingent/pkg/dsnet.yml
+110 -20
View File
@@ -8,6 +8,32 @@
ansible.builtin.shell:
cmd: "echo {{ ansible_user }}"
register: current_user
- name: Checking if ZFS filesystem is present
ansible.builtin.shell:
cmd: "findmnt -D | awk '{ print $2 }' | tail -n +2"
register: fs_result
- name: Logging presence of ZFS filesystem
when: "'zfs' in fs_result.stdout"
ansible.builtin.set_fact:
zfs_present: true
- name: Logging absence of ZFS filesystem
when: "'zfs' not in fs_result.stdout"
ansible.builtin.set_fact:
zfs_present: false
- name: Configuring ZFS support
when: zfs_present
block:
- name: Getting available pools
ansible.builtin.shell:
cmd: "zpool list | awk '{ print $1 }' | tail -n +2"
register: zpools
- name: Turning available pools into list
ansible.builtin.set_fact:
zpool_list: "{{ zpools | replace('\n', ' ') | split(' ') }}"
- name: Allowing choice of zpool
ansible.builtin.pause:
prompt: "Type preferred zpool from available (i.e., {{ zpool_list | join(', ') }})"
register: preferred_zpool
- name: Initializing DSNet
become: true
ansible.builtin.command:
@@ -16,16 +42,35 @@
become: true
ansible.builtin.command:
cmd: dsnet up
- name: Creating a ZFS dataset for DSNet configuration
when: zfs_present
become: true
community.general.zfs:
name: "{{ preferred_zpool.user_input }}/wireguard_clients"
state: present
extra_zfs_properties:
canmount: "on"
mountpoint: "{{ ansible_user_home.stdout }}/.wg"
- name: Creating a directory to house VPN service client configurations
become: true
ansible.builtin.file:
path: "{{ ansible_user_home.stdout }}/.wg"
recurse: true
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: "700"
state: directory
- name: Creating a directory to house VPN service client configurations
ansible.builtin.file:
path: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d"
recurse: true
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: "755"
mode: "700"
state: directory
- name: Adding peer device for DSNet VPN service interface
become: true
when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
ansible.builtin.shell:
cmd: "dsnet add {{ item.name }}{{ idx }} --owner {{ current_user.stdout }} --description 'For {{ item.name }}--{{ item.desc }}' --confirm > {{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
creates: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ idx }}.conf"
@@ -33,6 +78,7 @@
loop_control:
index_var: idx
- name: Changing ownership of consequent DSNet VPN service client configurations
when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
ansible.builtin.file:
path: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
owner: "{{ ansible_user }}"
@@ -42,6 +88,39 @@
loop: "{{ vpn.clients }}"
loop_control:
index_var: idx
- name: Acquiring VPN server subnet
block:
- name: Acquiring VPN server IPv4 subnet
ansible.builtin.shell:
cmd: echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*/\/24/g'
register: masq_target_net_ip
- name: Acquiring VPN server IPv6 subnet
when: ipv6_enabled
ansible.builtin.shell:
cmd: echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network6":/ { print $2 }' | sed 's/[",]//g'
register: masq_target_net_ip6
- name: Getting public IP addresses
block:
- name: Getting public IPv4 address
community.general.ipify_facts:
validate_certs: false
timeout: 20
- name: Getting public IPv6 address
when: ipv6_enabled
ansible.builtin.shell:
cmd: curl -6 icanhazip.com
register: ipify_public_ip6
- name: Getting VPN client IP addresses
block:
- name: Getting VPN client IPv4 address
ansible.builtin.shell:
cmd: wg showconf dsnet | awk -F ' = |, ' '/^AllowedIPs/ { print $2 }' | sed 's/\/[0-9]*//g'
register: vpn_client_ip
- name: Getting VPN client IPv4 address
when: ipv6_enabled
ansible.builtin.shell:
cmd: wg showconf dsnet | awk -F ' = |, ' '/^AllowedIPs/ { print $3 }' | sed 's/\/[0-9]*//g'
register: vpn_client_ip6
- name: Pausing to inquire about how to proceed
ansible.builtin.pause:
prompt: "Type \"fetch\" to get the DSNet VPN service client configuration files, or \"show\" to see their contents for manual copying instead"
@@ -51,6 +130,7 @@
when: data_method.user_input == "show"
block:
- name: Acquiring contents of DSNet VPN service client configuration files
when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
ansible.builtin.slurp:
src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
loop: "{{ vpn.clients }}"
@@ -58,6 +138,7 @@
index_var: idx
register: vpn_client_configs
- name: Presenting contents of DSNet VPN service client configurations to control node
when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
ansible.builtin.debug:
msg: "Copy this client configuration of the DSNet VPN service:\n {{ item.content | b64decode }}"
loop: "{{ vpn_client_configs.results }}"
@@ -67,12 +148,12 @@
when: data_method.user_input == "fetch"
block:
- name: Informing user of inventory requirements for VPN clients
when: ((fqdn is undefined or fqdn == None) and item.name != fqdn) or not item.name in groups.homeserver
when: ((fqdn is undefined or fqdn == None) or fqdn not in item.name) and (item.name not in groups.homeserver and item.name not in groups['homeserver.test'])
ansible.builtin.fail:
msg: The VPN client must be the name of an inventory host in a homeserver group
loop: "{{ vpn.clients }}"
- name: Dupliciating DSNet VPN service client configuration files to control node
when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name in groups.homeserver
when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
ansible.builtin.fetch:
src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
dest: "./.tmp/{{ inventory_hostname }}-dsnet/"
@@ -100,13 +181,16 @@
- name: Ensuring IP forwarding is allowed
become: true
ansible.posix.sysctl:
name: "net.{{ item }}.ip_forward"
name: "{{ item }}"
value: "1"
sysctl_file: /etc/sysctl.d/10-security.conf
sysctl_set: true
reload: true
state: present
loop:
- ipv4
# - ipv6
- net.ipv4.ip_forward
- net.ipv6.conf.all.forwarding
- net.ipv4.conf.all.src_valid_mark
- name: Creating SystemD unit for placing up DSNet interface
become: true
ansible.builtin.copy:
@@ -120,13 +204,30 @@
become: true
ansible.builtin.systemd_service:
name: dsnet
scope: system
enabled: true
daemon_reload: true
- name: Copying script for DSNet iptables rules
become: true
when: ipv6_enabled
ansible.builtin.template:
src: usr/local/bin/dsnet-forward.sh.j2
dest: /usr/local/bin/dsnet-forward.sh
src: usr/local/bin/dsnet-routing6.sh.j2
dest: /usr/local/bin/dsnet-routing.sh
variable_start_string: "<%"
variable_end_string: "%>"
owner: root
group: root
mode: "755"
force: true
backup: true
- name: Copying script for DSNet iptables rules
become: true
when: not ipv6_enabled
ansible.builtin.template:
src: usr/local/bin/dsnet-routing.sh.j2
dest: /usr/local/bin/dsnet-routing.sh
variable_start_string: "<%"
variable_end_string: "%>"
owner: root
group: root
mode: "755"
@@ -144,16 +245,5 @@
- name: Reloading SystemD
become: true
ansible.builtin.systemd_service:
name: thrunet
scope: system
daemon_reload: true
- name: Opening port 51820
become: true
ansible.builtin.iptables:
chain: INPUT
protocol: "{{ item }}"
destination_port: 51820
jump: ACCEPT
comment: Open up port 51820
loop:
- udp
- tcp
roles/init-server/tasks/contingent/pkg/headscale.yml
+9 -2
View File
@@ -82,9 +82,13 @@
- name: Placing Headscale authentication key into file on control node
ansible.builtin.fetch:
src: "{{ tailscale_admin_authkey_file.dest }}"
dest: "./.tmp/{{ inventory_hostname }}-{{ headscale.users.admin.username }}@headscale/headscale.key"
dest: "./.tmp/{{ item.name }}-{{ headscale.users.admin.username }}@headscale/headscale{{ (idx | string) }}.key"
flat: true
loop: "{{ headscale.clients }}"
loop_control:
index_var: idx
- name: Placing Headscale authentication key into file on control node
when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
ansible.builtin.fetch:
src: "{{ tailscale_admin_authkey_file.dest }}"
dest: "./roles/init-server/files/{{ item.name }}-{{ headscale.users.admin.username }}@headscale/headscale{{ (idx | string) }}.key"
@@ -94,7 +98,10 @@
index_var: idx
- name: Informing control node of acquired files
ansible.builtin.debug:
msg: "The Headscale authentication key files have been duplicated to './.tmp/{{ inventory_hostname }}-{{ headscale.users.admin.username }}@headscale/headscale.key' at the control node."
msg: "The Headscale authentication key files have been duplicated to {{ item }} at the control node."
loop:
- "./roles/init-server/files/"
- "./.tmp/"
- name: Giving control node user time to read the aforementiioned message
ansible.builtin.pause:
seconds: 30
roles/init-server/tasks/contingent/pkg/iptables.yml
+101
View File
@@ -0,0 +1,101 @@
- name: Getting public IP addresses
block:
- name: Getting public IPv4 address
community.general.ipify_facts:
validate_certs: false
timeout: 20
- name: Getting public IPv6 address
when: ipv6_enabled
ansible.builtin.shell:
cmd: curl -6 icanhazip.com
register: ipify_public_ip6
- name: Getting available network interfaces
ansible.builtin.shell:
cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
register: intrfaces
- name: Turning acquired network interfaces into list
ansible.builtin.set_fact:
main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
- name: Pre-emptively allowing inbound connections already established and related to outbound requests
ansible.builtin.iptables:
ip_version: both
chain: INPUT
match:
- conntrack
ctstate:
- ESTABLISHED
- RELATED
jump: ACCEPT
comment: allowing inbound replies
- name: Pre-emptively establishing fiirewall rules for inbound ICMP requests
become: true
block:
- name: Pre-emptively allowing inbound IPv4 ICMP connections
ansible.builtin.iptables:
ip_version: ipv4
chain: INPUT
destination: "! {{ ipify_public_ip }}"
protocol: icmp
jump: ACCEPT
comment: ping
- name: Pre-emptively allowing inbound IPv6 ICMP connections
when: ipv6_enabled
ansible.builtin.iptables:
ip_version: ipv6
chain: INPUT
destination: "! {{ ipify_public_ip6.stdout }}"
protocol: icmp
jump: ACCEPT
comment: ping
- name: Pre-emptively establishing firewall rules for loopback interface
become: true
block:
- name: Pre-emptively allowing all inbound connections on loopback device
ansible.builtin.iptables:
ip_version: both
chain: INPUT
in_interface: lo
jump: ACCEPT
comment: loopback
- name: Pre-emptively allowing inbound SSH
become: true
ansible.builtin.iptables:
ip_version: both
chain: INPUT
protocol: tcp
destination_port: 22
in_interface: "{{ item }}"
jump: ACCEPT
comment: ssh
loop: "{{ main_interfaces }}"
- name: Crafting additional exceptions to the inbound default policy
become: true
when: iptables.allow.inbound is defined and iptables.allow.inbound != None
ansible.builtin.iptables:
ip_version: both
chain: INPUT
protocol: "{{ item[1].protocol | default('tcp') }}"
destination_port: "{{ item[1].port }}"
in_interface: "{{ item[1].interface | default(item[0]) }}"
jump: ACCEPT
comment: "{{ item[1].desc | default('srvr') }}"
loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
- name: Setting default policy for inbound connections
become: true
ansible.builtin.iptables:
chain: INPUT
policy: DROP
- name: Setting default policy for outbound connections
become: true
ansible.builtin.iptables:
chain: OUTPUT
policy: ACCEPT
- name: Backing up firewall rules
become: true
community.general.iptables_state:
ip_version: "{{ item[0] }}"
state: saved
path: /etc/iptables/initial_rules.{{ item[1] }}
loop:
- ["ipv4", "v4"]
- ["ipv6", "v6"]
roles/init-server/tasks/contingent/pkg/libpam-google-authenticator.yml
+14 -10
View File
@@ -67,12 +67,13 @@
owner: root
group: root
mode: "644"
- name: Prioritizing authentication methods in SSH
- name: Allowing interactive keyboard authentication
become: true
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config.d/auth.conf
line: "KbdInteractiveAuthentication yes # enable if implementing TOTP 2FA"
regexp: "^KbdInteractiveAuthentication"
line: "KbdInteractiveAuthentication yes # enable if implementing TOTP 2FA"
insertafter: EOF
owner: root
group: root
mode: "644"
@@ -80,12 +81,20 @@
become: true
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config.d/auth.conf
regexp: "^AuthenticationMethods"
line: "AuthenticationMethods publickey keyboard-interactive:pam"
insertafter: "^KbdInteractiveAuthentication"
owner: root
group: root
mode: "644"
# - name: Adding Google Authenticator OTP module PAM authentication line for SSH
- name: Restarting SystemD SSH service
become: true
ansible.builtin.systemd_service:
name: sshd
scope: system
state: restarted
enabled: true
# - name: Adding Google Authenticator OTP module PAM authentication line for sudo
# become: true
# ansible.builtin.lineinfile:
# path: /etc/pam.d/sudo
@@ -94,7 +103,7 @@
# owner: root
# group: root
# mode: "644"
# - name: Adding Google Authenticator OTP module PAM authentication line for SSH
# - name: Adding Google Authenticator OTP module PAM authentication line for sudo
# become: true
# ansible.builtin.lineinfile:
# path: /etc/pam.d/su
@@ -102,9 +111,4 @@
# insertafter: "include common-auth$"
# owner: root
# group: root
# mode: "644"
- name: Restarting SystemD SSH service
become: true
ansible.builtin.systemd_service:
name: sshd
state: restarted
# mode: "644"
roles/init-server/tasks/contingent/pkg/podman.yml
+49 -1
View File
@@ -9,19 +9,49 @@
ansible.builtin.shell:
cmd: "echo {{ ansible_user }}"
register: current_user
- name: Checking if ZFS filesystem is present
ansible.builtin.shell:
cmd: "findmnt -D | awk '{ print $2 }' | tail -n +2"
register: fs_result
- name: Logging presence of ZFS filesystem
when: "'zfs' in fs_result.stdout"
ansible.builtin.set_fact:
zfs_present: true
- name: Logging absence of ZFS filesystem
when: "'zfs' not in fs_result.stdout"
ansible.builtin.set_fact:
zfs_present: false
- name: Configuring ZFS support
when: zfs_present
block:
- name: Getting available pools
ansible.builtin.shell:
cmd: "zpool list | awk '{ print $1 }' | tail -n +2"
register: zpools
- name: Turning available pools into list
ansible.builtin.set_fact:
zpool_list: "{{ zpools | replace('\n', ' ') | split(' ') }}"
- name: Allowing choice of zpool
ansible.builtin.pause:
prompt: "Type preferred zpool from available (i.e., {{ zpool_list | join(', ') }})"
register: preferred_zpool
- name: Ensuring user namespace support is enabled
become: true
ansible.posix.sysctl:
name: kernel.unprivileged_userns_clone
value: "1"
sysctl_file: /etc/sysctl.d/10-security.conf
sysctl_set: true
reload: true
state: present
- name: Ensuring user namespace support is enabled
become: true
ansible.posix.sysctl:
name: net.ipv4.ip_unprivileged_port_start
value: "0"
value: "20"
sysctl_file: /etc/sysctl.d/10-security.conf
sysctl_set: true
reload: true
state: present
- name: Creating container directory
ansible.builtin.file:
@@ -31,6 +61,24 @@
group: "{{ ansible_user }}"
mode: "755"
state: directory
- name: Creating a ZFS dataset for container secrets
become: true
when: zfs_present
community.general.zfs:
name: "{{ preferred_zpool.user_input }}/container_volumes"
state: present
extra_zfs_properties:
canmount: "on"
mountpoint: "{{ ansible_user_home.stdout }}/volumes"
- name: Configuring container image registries
become: true
ansible.builtin.file:
path: "{{ ansible_user_home.stdout }}/volumes"
recurse: true
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: "755"
state: directory
- name: Configuring container storage
become: true
become_user: "{{ current_user.stdout }}"
roles/init-server/tasks/contingent/pkg/quartz.yml
+8 -1
View File
@@ -36,7 +36,7 @@
become_user: "{{ current_user.stdout }}"
community.general.npm:
path: "{{ ansible_user_home.stdout }}/repos/.foreign/quartz"
state: latest
state: present
- name: Configuring quartz software
block:
- name: Creating path for Quartz content files (path for Obsidian vaults)
@@ -97,6 +97,13 @@
- plugin
- install
chdir: "{{ ansible_user_home.stdout }}/repos/.foreign/quartz"
- name: Creating directory for caddy configuration
ansible.builtin.file:
path: "{{ ansible_user_home.stdout }}/srv/notes.{{ web_fqdn }}"
recurse: true
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
state: directory
- name: Starting quartz site web server
become: true
become_user: "{{ current_user.stdout }}"
roles/init-server/tasks/contingent/pkg/radicle.yml
+1 -2
View File
@@ -15,13 +15,12 @@
ansible.builtin.shell:
cmd: "{{ ansible_user_home.stdout }}/.local/bin/radicle-install.sh"
creates: "{{ ansible_user_home.stdout }}/.radicle"
async: 600
async: 300
poll: 5
- name: Bootstrapping Radicle
become: true
block:
- name: Linking binaries to directories already in PATH environment variable
ignore_errors: true
ansible.builtin.file:
src: "{{ ansible_user_home.stdout }}/.radicle/bin/{{ item }}"
dest: "/usr/bin/{{ item }}"
roles/init-server/tasks/contingent/pkg/rustup.yml
+1 -1
View File
@@ -15,7 +15,7 @@
ansible.builtin.shell:
cmd: "{{ ansible_user_home.stdout }}/.local/bin/rustup-install.sh -yq"
creates: "{{ ansible_user_home.stdout }}/.cargo/bin"
async: 600
async: 300
poll: 5
- name: Linking binaries to directories already in PATH environment variable
become: true
roles/init-server/tasks/contingent/pkg/skato_compose.yml
+837 -127
View File
File diff suppressed because it is too large. Load diff
roles/init-server/tasks/contingent/pkg/ufw.yml
+72
View File
@@ -0,0 +1,72 @@
- name: Getting public IP addresses
block:
- name: Getting public IPv4 address
community.general.ipify_facts:
validate_certs: false
timeout: 20
- name: Getting public IPv6 address
when: ipv6_enabled
ansible.builtin.shell:
cmd: curl -6 icanhazip.com
register: ipify_public_ip6
- name: Getting available network interfaces
ansible.builtin.shell:
cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
register: intrfaces
- name: Turning acquired network interfaces into list
ansible.builtin.set_fact:
main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
- name: Enabling UFW startup
become: true
ansible.builtin.systemd_service:
name: ufw
scope: system
state: started
enabled: true
- name: Enabling firewall startup
community.general.ufw:
state: enabled
- name: Pre-emptively establishing firewall rules for loopback interface
become: true
block:
- name: Pre-emptively allowing inbound connections on loopback interface
community.general.ufw:
rule: allow
direction: in
interface: lo
- name: Allowing outbound connections on loopback interface
community.general.ufw:
rule: allow
direction: out
interface: lo
- name: Denying inbound connections from loopback address on rest of interfaces
community.general.ufw:
rule: deny
direction: in
interface: "{{ item[1] }}"
from_ip: "{{ item[0] }}"
loop: "{{ ['127.0.0.0/8', '::/128'] | product(main_interfaces) }}"
- name: Pre-emptively allowing rate-limited inbound SSH
become: true
community.general.ufw:
rule: allow
name: ssh
- name: Crafting additional exceptions to the inbound default policy
become: true
community.general.ufw:
rule: allow
direction: in
proto: "{{ item[1].protocol | default('tcp') }}"
interface: "{{ item[1].interface | default(item[0]) }}"
port: "{{ item[1].port }}"
loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
- name: Setting default policy for inbound connections
become: true
community.general.ufw:
direction: incoming
default: deny
- name: Setting default policy for outbound connections
become: true
community.general.ufw:
direction: outgoing
default: allow
roles/init-server/tasks/contingent/pkg/uv.yml
+1 -1
View File
@@ -15,7 +15,7 @@
ansible.builtin.shell:
cmd: "{{ ansible_user_home.stdout }}/.local/bin/uv-install.sh"
creates: "{{ ansible_user_home.stdout }}/.local/bin/uv"
async: 600
async: 300
poll: 5
- name: Linking binaries to directories already in PATH environment variable
become: true
roles/init-server/tasks/contingent/pkg/wireguard.yml
+8
View File
@@ -13,25 +13,33 @@
ansible.posix.sysctl:
name: net.ipv4.ip_forward
value: "1"
sysctl_file: /etc/sysctl.d/10-security.conf
sysctl_set: true
reload: true
state: present
- name: Marking IPv4 forwarded traffic as valid
ansible.posix.sysctl:
name: net.ipv4.conf.all.src_valid_mark
value: "1"
sysctl_file: /etc/sysctl.d/10-security.conf
sysctl_set: true
reload: true
state: present
- name: Enabling IPv6 forwarding
ansible.posix.sysctl:
name: net.ipv6.conf.all.forwarding
value: "1"
sysctl_file: /etc/sysctl.d/10-security.conf
sysctl_set: true
reload: true
state: present
- name: Marking IPv6 traffic as valid
ansible.posix.sysctl:
name: net.ipv6.conf.all.src_valid_mark
value: "1"
sysctl_file: /etc/sysctl.d/10-security.conf
sysctl_set: true
reload: true
state: present
- name: Preparing to allow Wireguard logging
when: "wireguard.debug"
roles/init-server/tasks/core@install-pkgs.yml
+7
View File
@@ -38,6 +38,13 @@
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
state: directory
- name: Creating prerequisite directory tree for git repos
ansible.builtin.file:
path: "{{ ansible_user_home.stdout }}/repos/.foreign"
recurse: true
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
state: directory
- name: Installing Linux software
when: ansible_facts["system"] == "Linux"
block:
roles/init-server/tasks/netrc.yml
+3 -1
View File
@@ -17,4 +17,6 @@
dest: "{{ ansible_user_home.stdout }}/.netrc"
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: "600"
mode: "600"
force: true
backup: true
roles/init-server/templates/user/actual.env.j2
+1
View File
@@ -0,0 +1 @@
ACTUAL_LISTEN_PORT={{ actual.port }}
roles/init-server/templates/user/all.env.j2
+8 -2
View File
@@ -9,9 +9,15 @@ SERVER_FQDN={{ (certbot.domains | reject("regex", "^\\*\\.") | list)[0] }}
{% if nextcloud.subdomain is defined and nextcloud != None %}
NEXTCLOUD_SUBDOMAIN={{ nextcloud.subdomain }}
{% endif %}
{% if gitea is defined and gitea != None %}
GITEA_SUBDOMAIN={{ gitea.subdomain }}
{% if forgejo is defined and forgejo != None %}
FORGEJO_SUBDOMAIN={{ forgejo.subdomain }}
{% endif %}
{% if gist is defined and gist != None %}
OG_SUBDOMAIN={{ gist.subdomain }}
{% endif %}
{% if syncplay is defined and syncplay != None %}
SYNCPLAY_SUBDOMAIN={{ syncplay.subdomain }}
{% endif %}
{% if nodebb is defined and nodebb != None %}
NODEBB_SUBDOMAIN={{ nodebb.subdomain }}
{% endif %}
roles/init-server/templates/user/aria.env.j2
+9
View File
@@ -0,0 +1,9 @@
{% if aria.rpc.enabled %}
ARIA_RPC_LISTEN_PORT={{ aria.rpc.port }}
# {% if aria.rpc.credentials is undefined or aria.rpc.credentials == None %}
# ARIA_RPC_SECRET_TOKEN={{ aria.rpc.secret }}
# {% endif %}
{% endif %}
{% if aria.trnt.dht.enabled %}
ARIA_TRNT_LISTEN_PORT={{ aria.trnt.dht.port }}
{% endif %}
roles/init-server/templates/user/aria2/aria2.conf.j2
+2 -2
View File
@@ -37,7 +37,7 @@ max-resume-failure-tries=0
{% if aria.rpc.enabled %}
enable-rpc=true
{% if mode == "prod" or aria.rpc.scheme == "https" %}
{% if mode == "prod" and aria.rpc.scheme == "https" %}
rpc-secure=true
{% if not certbot.containerized %}
@@ -59,7 +59,7 @@ rpc-listen-all=false
rpc-listen-port={{ aria.rpc.port | string }}
{% if aria.rpc.credentials is undefined or aria.rpc.credentials == None %}
rpc-secret={{ aria.rpc.secret | default(lookup('password', './.tmp/' + inventory_hostname + '-aria/aria.secret', chars=['ascii_lowercase', 'digits'], length=32)) }}
rpc-secret={{ aria.rpc.secret }}
{% else %}
rpc-user={{ aria.rpc.credentials.username }}
rpc-password={{ aria.rpc.credentials.password }}
roles/init-server/templates/user/config/caddy/Caddyfile.j2
+1 -1
View File
@@ -7,7 +7,7 @@ http://<< web_fqdn >> {
}
}
:80 {
root /srv/certbot.<< web_fqdn >>
root ~/srv/certbot.<< web_fqdn >>
browse
}
<< web_fqdn >> {
roles/init-server/templates/user/config/glance/glance.yml.j2
+4 -10
View File
@@ -1,9 +1,10 @@
server:
port: {{ glance.port }}
{% if glance.proxied %}
{% if glance.proxied %}
proxied: true
{% endif %}
{% endif %}
base-url: /
assets-path: /app/assets
pages:
- name: home
head-widgets:
@@ -48,7 +49,7 @@ pages:
url: https://hexdocs.pm/?q={QUERY}&packages=plug%3Alatest%2Cphoenix%3Alatest%2Cphoenix_html%3Alatest%2Cphoenix_live_view%3Alatest%2Cphoenix_pubsub%3Alatest%2Cphoenix_template%3Alatest
- title: Javascript
shortcut: "@js"
shortcut: https://javascript.info/search?query={QUERY}
url: https://javascript.info/search?query={QUERY}
- title: MDN
shortcut: "@mdn"
url: https://developer.mozilla.org/en-US/search?q={QUERY}
@@ -330,10 +331,3 @@ pages:
- UCDG73pGqESS1XcEVY_0xwWw
- UCR2uRTQ53V_egXKFflMMaaw
- UCzGUT9PjV3SMBwjWXUYh4HA
- name: services
columns:
- size: full
widgets:
- type: docker-containers
title: status
hide-by-default: false
roles/init-server/templates/user/config/opengist/config.yml.j2
+1 -1
View File
@@ -6,4 +6,4 @@ log-level: info
{% endif %}
custom.static-links:
- name: Playbooks
path: {{ "https://" + gitea.subdomain + "." + web_fqdn + "/admin/skato-ansible" }}
path: {{ "https://" + forgejo.subdomain + "." + web_fqdn + "/admin/skato-ansible" }}
roles/init-server/templates/user/config/tailscale/conf.json.j2
+84
View File
@@ -18,6 +18,48 @@
"Proxy": "http://localhost:8080"
}
}
},
"aria.${TS_CERT_DOMAIN}:443": {
"Handlers": {
"/": {
"Proxy": "http://localhost:6880"
}
}
},
"slsk.${TS_CERT_DOMAIN}:443": {
"Handlers": {
"/": {
"Proxy": "http://localhost:5030"
}
}
},
"grocy.${TS_CERT_DOMAIN}:443": {
"Handlers": {
"/": {
"Proxy": "http://localhost:80"
}
}
},
"budget.${TS_CERT_DOMAIN}:443": {
"Handlers": {
"/": {
"Proxy": "http://localhost:5006"
}
}
},
"reader.${TS_CERT_DOMAIN}:443": {
"Handlers": {
"/": {
"Proxy": "http://localhost:9999"
}
}
},
"stash.${TS_CERT_DOMAIN}:443": {
"Handlers": {
"/": {
"Proxy": "http://localhost:5000"
}
}
}
<% elif mode == "dev" or tailscale.scheme == "http" %>
"${TS_CERT_DOMAIN}:80": {
@@ -26,6 +68,48 @@
"Proxy": "http://localhost:8080"
}
}
},
"aria.${TS_CERT_DOMAIN}:80": {
"Handlers": {
"/": {
"Proxy": "http://localhost:6880"
}
}
},
"slsk.${TS_CERT_DOMAIN}:80": {
"Handlers": {
"/": {
"Proxy": "http://localhost:5030"
}
}
},
"grocy.${TS_CERT_DOMAIN}:80": {
"Handlers": {
"/": {
"Proxy": "http://localhost:80"
}
}
},
"budget.${TS_CERT_DOMAIN}:80": {
"Handlers": {
"/": {
"Proxy": "http://localhost:5006"
}
}
},
"reader.${TS_CERT_DOMAIN}:80": {
"Handlers": {
"/": {
"Proxy": "http://localhost:9999"
}
}
},
"stash.${TS_CERT_DOMAIN}:80": {
"Handlers": {
"/": {
"Proxy": "http://localhost:5000"
}
}
}
<% endif %>
},
roles/init-server/templates/user/flexget/config.yml.j2
+12 -12
View File
@@ -36,7 +36,7 @@ templates:
tasks:
# @NOTE uncommenting aria2 block requires commenting out download and proxy blocks
populate_folders:
{% if download_mode == 'direct' %}
{% if flexget.download_mode == 'direct' %}
proxy:
https: 'socks5://<< tor.proxy.hostname >>:<< tor.proxy.port >>'
{% endif %}
@@ -63,7 +63,7 @@ tasks:
template: limited_series
{% if flexget.download_mode == 'aria2' %}
aria2:
server: << aria.rpc.hostname >>
server: << aria.rpc.hostname | default((fqdn | default(inventory_hostname))) >>
port: << aria.rpc.port >>
{% if aria.rpc.secret != None and aria.rpc.secret is defined %}
secret: << aria.rpc.secret >>
@@ -71,8 +71,8 @@ tasks:
username: << aria.rpc.credentials.username >>
password: << aria.rpc.credentials.password >>
{% endif %}
{% if mode == 'prod' %}
scheme: << aria.rpc.scheme >>
{% if aria.rpc.scheme == 'https' and mode == 'prod' %}
scheme: https
{% else %}
scheme: http
{% endif %}
@@ -86,14 +86,14 @@ tasks:
{% endif %}
# @NOTE uncommenting aria2 block requires commenting out download and proxy blocks
fap_queue:
{% if download_mode == 'direct' %}
{% if flexget.download_mode == 'direct' %}
proxy:
https: 'socks5://<< tor.proxy.hostname >>:<< tor.proxy.port >>'
{% endif %}
template: porn_vids
{% if flexget.download_mode == 'aria2' %}
aria2:
server: << aria.rpc.hostname >>
server: << aria.rpc.hostname | default((fqdn | default(inventory_hostname))) >>
port: << aria.rpc.port >>
{% if aria.rpc.secret != None and aria.rpc.secret is defined %}
secret: << aria.rpc.secret >>
@@ -102,8 +102,8 @@ tasks:
username: << aria.rpc.credentials.username >>
password: << aria.rpc.credentials.password >>
{% endif %}
{% if mode == 'prod' %}
scheme: << aria.rpc.scheme >>
{% if aria.rpc.scheme == 'https' and mode == 'prod' %}
scheme: https
{% else %}
scheme: http
{% endif %}
@@ -117,14 +117,14 @@ tasks:
{% endif %}
# @NOTE uncommenting aria2 block requires commenting out download and proxy blocks
film_queue:
{% if download_mode == 'direct' %}
{% if flexget.download_mode == 'direct' %}
proxy:
https: 'socks5://<< tor.proxy.hostname >>:<< tor.proxy.port >>'
{% endif %}
template: feature_films
{% if flexget.download_mode == 'aria2' %}
aria2:
server: << aria.rpc.hostname >>
server: << aria.rpc.hostname | default((fqdn | default(inventory_hostname))) >>
port: << aria.rpc.port >>
{% if aria.rpc.secret != None or aria.rpc.secret is defined %}
secret: << aria.rpc.secret >>
@@ -133,8 +133,8 @@ tasks:
username: << aria.rpc.credentials.username >>
password: << aria.rpc.credentials.password >>
{% endif %}
{% if mode == 'prod' %}
scheme: << aria.rpc.scheme >>
{% if aria.rpc.scheme == 'https' and mode == 'prod' %}
scheme: https
{% else %}
scheme: http
{% endif %}
roles/init-server/templates/user/forgejo.env.j2
+28
View File
@@ -0,0 +1,28 @@
FORGEJO_MODE={{ mode | default("dev") }}
FORGEJO_NAME={{ (web_fqdn | split("."))[0].upper() + " Grimoire" }}
FORGEJO_SLOGAN={{ forgejo.description }}
FORGEJO_SSH_PORT={{ forgejo.ssh.port }}
FORGEJO_LANDING={{ forgejo.site.landing }}
FORGEJO_TRUSTED_PROXIES={{ forgejo.trusted.proxies | join(",") }}
FORGEJO_DESC={{ forgejo.description }}
FORGEJO_LOCK_REASONS={{ forgejo.site.lock_reasons | join(",") }}
FORGEJO_KANBAN_COLUMNS={{ forgejo.site.kanban_columns | join(",") }}
FORGEJO_TRIAGE_CATEGORIES={{ forgejo.site.triage_categories | join(",")}}
{% if compose.mode == "dev" %}
FORGEJO_PROTOCOL=http
{% elif compose.mode == "prod" %}
FORGEJO_PROTOCOL=https
{% endif %}
{% if forgejo.site.registration.enabled %}
FORGEJO_PROHIBIT_REGISTRATION=false
{% else %}
FORGEJO_PROHIBIT_REGISTRATION=true
{% endif %}
FORGEJO_DB_TYPE={{ forgejo.db.type }}
{% if forgejo.db.type == "mysql" %}
FORGEJO_DB_NAME={{ forgejo.db.name }}
{% endif %}
roles/init-server/templates/user/gitea.env.j2
-17
View File
@@ -1,17 +0,0 @@
GITEA_MODE={{ mode | default("dev") }}
GITEA_NAME={{ (web_fqdn | split("."))[0].upper() + " Nous" }}
GITEA_SSH_PORT={{ gitea.ssh.port }}
GITEA_LANDING={{ gitea.site.landing }}
GITEA_TRUSTED_PROXIES={{ gitea.trusted.proxies | join(",") }}
{% if gitea.site.registration.enabled %}
GITEA_PROHIBIT_REGISTRATION=false
{% else %}
GITEA_PROHIBIT_REGISTRATION=true
{% endif %}
GITEA_DB_TYPE={{ gitea.db.type }}
{% if gitea.db.type == "mysql" %}
GITEA_DB_NAME={{ gitea.db.name }}
{% endif %}
roles/init-server/templates/user/stash.env.j2
+1
View File
@@ -0,0 +1 @@
STASH_LISTEN_PORT={{ stash.port }}
roles/init-server/templates/user/syncplay.env.j2
+8
View File
@@ -0,0 +1,8 @@
SYNCPLAY_PASSWORD={{ syncplay.password }}
SYNCPLAY_MOTD={{ syncplay.motd }}
{% if mode == "prod" %}
SYNCPLAY_TLS=ON
{% else %}
SYNCPLAY_TLS=OFF
{% endif %}
SYNCPLAY_SALT={{ syncplay.salt }}
roles/init-server/templates/usr/local/bin/dsnet-forward.sh.j2
-22
View File
@@ -1,22 +0,0 @@
#!/bin/bash
set -euo pipefail
if [[ "$1" == "start" ]]; then
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 80 -j ACCEPT # HTTP
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -A FORWARD -i dsnet -p udp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 465 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 587 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 995 -j ACCEPT # POP3 (receive)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 993 -j ACCEPT # IMAP (receive)
/usr/sbin/iptables -t nat -A POSTROUTING -o dsnet -j MASQUERADE
elif [[ "$1" == "stop" ]]; then
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 80 -j ACCEPT # HTTP
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -D FORWARD -i dsnet -p udp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 465 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 587 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 995 -j ACCEPT # POP3 (receive)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 993 -j ACCEPT # IMAP (receive)
/usr/sbin/iptables -t nat -D POSTROUTING -o dsnet -j MASQUERADE
fi
roles/init-server/templates/usr/local/bin/dsnet-routing.sh.j2
Executable
+28
View File
@@ -0,0 +1,28 @@
#!/bin/bash
set -euo pipefail
MASQ_TARGET_NET4=$(echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*//g')
# @WARNING below may not grab public IP of interface
ETH_INTF_IP4=($(ip addr show | grep inet | awk '/enp[0-9]+s[0-9]+|eth[0-9]+$/{print$2}' | sed 's/\/[0-9]*//'))
ETH_INTF=($(ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -E "enp[0-9]+s[0-9]+|eth[0-9]+" | sed 's/://g'))
{% if (vpn.server.forwards is defined and vpn.server.forwards != None) and (vpn.server.forwards | length) > 0 %}
PORT_DESTS=(<% vpn.server.forwards | map('string') | join(" ") %>)
{% endif %}
# sudo sysctl -w net.ipv4.ip_forward=1
# sudo sysctl -w net.ipv4.conf.all.src_valid_mark=1
sudo sysctl -p
if [[ "$1" == "up" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -A PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
done
sudo iptables -t nat -A POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
elif [[ "$1" == "down" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -D PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
done
sudo iptables -t nat -D POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
fi
roles/init-server/templates/usr/local/bin/dsnet-routing6.sh.j2
Executable
+37
View File
@@ -0,0 +1,37 @@
#!/bin/bash
set -euo pipefail
MASQ_TARGET_NET4=$(echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*//g')
MASQ_TARGET_NET6=$(echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network6":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*//g')
# @WARNING below may not grab public IP of interface
ETH_INTF_IP4=($(ip addr show | grep inet | awk '/enp[0-9]+s[0-9]+|eth[0-9]+$/{print$2}' | sed 's/\/[0-9]*//'))
ETH_INTF_IP6=($(ip addr show | grep -A5 -E "enp[0-9]+s[0-9]+|eth[0-9]+" | awk '/^ {4}inet6 .* global/ { print $2 }' | sed 's/\/[0-9]*//g'))
ETH_INTF=($(ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -E "enp[0-9]+s[0-9]+|eth[0-9]+" | sed 's/://g'))
{% if (vpn.server.forwards is defined and vpn.server.forwards != None) and (vpn.server.forwards | length) > 0 %}
PORT_DESTS=(<% vpn.server.forwards | map('string') | join(" ") %>)
{% endif %}
# sudo sysctl -w net.ipv4.ip_forward=1
# sudo sysctl -w net.ipv6.conf.all.forwarding=1
# sudo sysctl -w net.ipv4.conf.all.src_valid_mark=1
sudo sysctl -p
if [[ "$1" == "up" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
CLIENT_IP6=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -A PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
sudo ip6tables -t nat -A PREROUTING -d <% ipify_public_ip6.stdout %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP6}:${portdest}"
done
sudo iptables -t nat -A POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
sudo ip6tables -t nat -A POSTROUTING -s <% masq_target_net_ip6.stdout %> -j MASQUERADE
elif [[ "$1" == "down" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
CLIENT_IP6=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -D PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
sudo ip6tables -t nat -D PREROUTING -d <% ipify_public_ip6.stdout %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP6}:${portdest}"
done
sudo iptables -t nat -D POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
sudo ip6tables -t nat -D POSTROUTING -s <% masq_target_net_ip6.stdout %> -j MASQUERADE
fi