Compare commits
1 Commits
b35e807e3c
...
man
| Author | SHA1 | Date | |
|---|---|---|---|
30c0774d62
|
85
Makefile
85
Makefile
@@ -1,77 +1,52 @@
|
|||||||
|
|
||||||
ignore_file = .git/info/exclude
|
|
||||||
|
|
||||||
|
|
||||||
.PHONY: help
|
.PHONY: help
|
||||||
|
|
||||||
help: ## Print the help message
|
help: ## Print the help message
|
||||||
@awk 'BEGIN {FS = ":.*?## "} /^[0-9a-zA-Z._-]+:.*?## / {printf "\033[36m%s\033[0m : %s\n", $$1, $$2}' $(MAKEFILE_LIST) | \
|
@awk 'BEGIN {FS = ":.*?## "} /^[0-9a-zA-Z._-]+:.*?## / {printf "\033[36m%s\033[0m : %s\n", $$1, $$2}' $(MAKEFILE_LIST) | \
|
||||||
sort | \
|
sort | \
|
||||||
column -s ':' -t
|
column -s ':' -t
|
||||||
|
|
||||||
.PHONY: check
|
map.txt: map.ge ## Making map.txt
|
||||||
check: ## Check you have all dependencies
|
grep -v '# unimportant' $< | graph-easy --boxart > $@
|
||||||
@command -v graph-easy >/dev/null || { echo "Install perl-graph-easy" && exit 1 ;}
|
cat $@
|
||||||
@command -v recsel >/dev/null || { echo "Install recutils" && exit 1 ;}
|
|
||||||
@command -v lowdown >/dev/null || { echo "Install lowdown" && exit 1 ;}
|
|
||||||
@echo "All dependencies installed"
|
|
||||||
|
|
||||||
########## Network Map ##########
|
full_map.txt: map.ge ## Generating full_map.txt with graph-easy
|
||||||
|
graph-easy --boxart < $< > $@
|
||||||
|
cat $@
|
||||||
|
|
||||||
graph_program != type graph-easy > /dev/null && printf graph-easy || printf dot
|
########## Man Pages ##########
|
||||||
|
|
||||||
graph_cmd = graph-easy --boxart
|
mandir = $(HOME)/.local/man/man6
|
||||||
|
|
||||||
queries = queries authqueries
|
kralizec_docs != grep -rl "^section:" kralizec
|
||||||
|
kralmans = $(kralizec_docs:kralizec/%/README.md=$(mandir)/%.6)
|
||||||
|
|
||||||
query_formats = $(patsubst %, .dbs/%.txt, $(queries))
|
$(mandir)/%.6: kralizec/%/README.md
|
||||||
|
lowdown -stman $< > $@
|
||||||
|
|
||||||
dotquery_formats = $(patsubst %, .dbs/%.dot, $(queries))
|
krov_docs != grep -rl "^section:" krov
|
||||||
|
krovmans = $(krov_docs:krov/%/README.md=$(mandir)/%.6)
|
||||||
|
|
||||||
.dbs/: | $(ignore_file)
|
$(mandir)/%.6: krov/%/README.md
|
||||||
mkdir $@
|
lowdown -stman $< > $@
|
||||||
|
|
||||||
ignored += .dbs/
|
setup_docs != grep -rl "^section:" setup
|
||||||
|
setupmans = $(setup_docs:setup/%.md=$(mandir)/%.6)
|
||||||
|
|
||||||
$(query_formats): .dbs/%.txt: | .dbs/
|
$(mandir)/%.6: setup/%.md
|
||||||
echo "[ {{name}} ] -- $(basename $(@F)) --> [ {{$(basename $(@F))}} ]" > $@
|
lowdown -stman $< > $@
|
||||||
|
|
||||||
$(dotquery_formats): .dbs/%.dot: | .dbs/
|
$(mandir):
|
||||||
echo '{{name}} -> {{$(basename $(@F))}} [ label="$(basename $(@F))" ];' > $@
|
mkdir -p $@
|
||||||
|
|
||||||
ifeq ($(graph_program),dot)
|
$(kralmans) $(krovmans) $(setupmans) :| $(mandir)
|
||||||
map_file = network.png
|
|
||||||
else
|
|
||||||
map_file = network.txt
|
|
||||||
endif
|
|
||||||
|
|
||||||
ignored += $(map_file)
|
.PHONY: pages
|
||||||
|
pages: $(kralmans) $(krovmans) $(setupmans)
|
||||||
.PHONY: map
|
$(info $(kralmans))
|
||||||
map: $(map_file) ## Generate a network map
|
@test ! $(command -v mandb) || mandb --user-db
|
||||||
|
$(info Open DMZ's man pages with 'man 6 <tab>')
|
||||||
network.txt: .dbs/network.txt
|
|
||||||
$(graph_cmd) < $<
|
|
||||||
|
|
||||||
.dbs/network.txt: network.rec $(query_formats)
|
|
||||||
$(RM) $@
|
|
||||||
$(foreach relation, $(queries), \
|
|
||||||
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).txt >> $@ ;\
|
|
||||||
)
|
|
||||||
|
|
||||||
.dbs/network.dot: network.rec $(dotquery_formats)
|
|
||||||
echo 'digraph network {' > $@
|
|
||||||
$(foreach relation, $(queries), \
|
|
||||||
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).dot >> $@ ;\
|
|
||||||
)
|
|
||||||
echo '}' >> $@
|
|
||||||
|
|
||||||
network.png: .dbs/network.dot $(ignore_file)
|
|
||||||
dot -T png < $< > $@
|
|
||||||
|
|
||||||
##########
|
##########
|
||||||
|
|
||||||
$(ignore_file): $(MAKEFILE_LIST)
|
|
||||||
echo $(ignored) | tr ' ' '\n' > $@
|
|
||||||
|
|
||||||
clean:
|
clean:
|
||||||
$(RM) -r $(ignored)
|
$(RM) $(kralmans) $(krovmans)
|
||||||
|
|||||||
62
README.md
62
README.md
@@ -2,11 +2,6 @@ These setup files provide the text-only configurations for DMZ.
|
|||||||
|
|
||||||
*It should not contain private data.*
|
*It should not contain private data.*
|
||||||
|
|
||||||
# Dependencies
|
|
||||||
|
|
||||||
- `recutils`
|
|
||||||
- (optional) `graph-easy` (the package may be called `perl-graph-easy`)
|
|
||||||
|
|
||||||
# Aspirations
|
# Aspirations
|
||||||
|
|
||||||
- Each service should reside in its own directory.
|
- Each service should reside in its own directory.
|
||||||
@@ -20,60 +15,3 @@ These setup files provide the text-only configurations for DMZ.
|
|||||||
- Any maintenance scripts.
|
- Any maintenance scripts.
|
||||||
- Configurations should reside in shadow-directories, e.g. a backup `soft-serve`'s `config.yaml` should reside in this repo under `splint.rs/soft-serve/etc/soft/config.yaml`.
|
- Configurations should reside in shadow-directories, e.g. a backup `soft-serve`'s `config.yaml` should reside in this repo under `splint.rs/soft-serve/etc/soft/config.yaml`.
|
||||||
|
|
||||||
# Network Database
|
|
||||||
|
|
||||||
I have a half-baked plan to finally make use of plain-text databases, and it's already half-working.
|
|
||||||
Try these commands:
|
|
||||||
|
|
||||||
Ask what types of _rec_ords it contains:
|
|
||||||
|
|
||||||
## Database
|
|
||||||
|
|
||||||
```sh
|
|
||||||
recinf network.rec
|
|
||||||
```
|
|
||||||
|
|
||||||
### Select queries
|
|
||||||
|
|
||||||
Select with `recsel`, then specify the database (.rec) and type of record (like table in db).
|
|
||||||
|
|
||||||
- `--include-descriptors` or `-d`
|
|
||||||
- `--type` or `-t`
|
|
||||||
- `--expression` or `-e`
|
|
||||||
- `--quick` or `-q`
|
|
||||||
|
|
||||||
```sh
|
|
||||||
recsel network.rec --type router
|
|
||||||
recsel network.rec -d -t lxc
|
|
||||||
```
|
|
||||||
|
|
||||||
User `-q` for a `--quick` selection, or `-e` for more precise selections.
|
|
||||||
|
|
||||||
```sh
|
|
||||||
recsel network.rec --type lxc --quick wiki
|
|
||||||
recsel network.rec -t lxc -q nginx
|
|
||||||
recsel network.rec -t lxc -e "name ~ 'nginx'"
|
|
||||||
recsel network.rec -t lxc -e "name = 'nginx12'"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Insert queries
|
|
||||||
|
|
||||||
Insert a new record with `recins`.
|
|
||||||
|
|
||||||
```sh
|
|
||||||
recins network.rec -t lxc -r "name: bob" -r "service: bob" -r "host: moxx"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Update queries
|
|
||||||
|
|
||||||
If you can select something, you can also set its fields with `recset`.
|
|
||||||
|
|
||||||
Use `-f` to set the `--field`, and `-a` to `--add`, or `-s` to `--set`.
|
|
||||||
|
|
||||||
|
|
||||||
```sh
|
|
||||||
recset network.rec -t lxc -e "name = 'nginx12'" -f proxies -a soft-serve
|
|
||||||
recsel network.rec -t lxc -e "name = 'nginx11'" -p proxies[0]
|
|
||||||
recset network.rec -t lxc -e" name = 'nginx11'" -f proxies[0] -s wiki9
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|||||||
18
kn.mk
Normal file
18
kn.mk
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
all_docs != find krov/serverko -name README.md
|
||||||
|
|
||||||
|
path_to_docs = $(patsubst krov/%/README.md, docs/%.md, $(all_docs))
|
||||||
|
|
||||||
|
stripped_docs = $(notdir $(path_to_docs))
|
||||||
|
|
||||||
|
x:
|
||||||
|
$(info $(all_docs))
|
||||||
|
$(info $(stripped_docs))
|
||||||
|
|
||||||
|
docs/kralizec/%.md: kralizec/%/README.md
|
||||||
|
mkdir -p $(@D)
|
||||||
|
cp $< $@
|
||||||
|
|
||||||
|
docs/serverko/%.md: krov/serverko/%/README.md
|
||||||
|
mkdir -p $(@D)
|
||||||
|
cp $< $@
|
||||||
|
|
||||||
@@ -1,6 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 109
|
VMID: 109
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -1,46 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 119
|
|
||||||
---
|
|
||||||
|
|
||||||
|
|
||||||
## Data
|
|
||||||
|
|
||||||
`/var/discourse/shared/web_only/`
|
|
||||||
|
|
||||||
|
|
||||||
## Web
|
|
||||||
|
|
||||||
`/var/discourse_docker/`
|
|
||||||
|
|
||||||
|
|
||||||
## Help
|
|
||||||
|
|
||||||
`/var/discourse_docker/discourse_doctor`
|
|
||||||
|
|
||||||
|
|
||||||
## Docker rebuild errors
|
|
||||||
|
|
||||||
`/var/discourse_docker/launcher rebuild web_only`
|
|
||||||
|
|
||||||
|
|
||||||
```
|
|
||||||
Plugin name is 'ldap', but plugin directory is named 'discourse-ldap-auth'
|
|
||||||
rake aborted!
|
|
||||||
ActiveRecord::NoDatabaseError: We could not find your database: discoursedb. Available database configurations can be found in config/database.yml. (ActiveRecord::NoDatabaseError)
|
|
||||||
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|
||||||
```
|
|
||||||
FAILED
|
|
||||||
--------------------
|
|
||||||
Pups::ExecError: cd /var/www/discourse && su discourse -c 'bundle exec rake db:migrate' failed with return #<Process::Status: pid 593 exit 1>
|
|
||||||
Location of failure: /usr/local/lib/ruby/gems/3.3.0/gems/pups-1.3.0/lib/pups/exec_command.rb:131:in `spawn'
|
|
||||||
exec failed with the params {"cd"=>"$home", "tag"=>"migrate", "hook"=>"db_migrate", "cmd"=>["su discourse -c 'bundle exec rake db:migrate'"]}
|
|
||||||
bootstrap failed with exit code 1
|
|
||||||
** FAILED TO BOOTSTRAP ** please scroll up and look for earlier error messages, there may be more than one.
|
|
||||||
./discourse-doctor may help diagnose the problem.
|
|
||||||
a9a704b1ee166487d8cd2acd5bd9bcc050ed0ec93fc065f58440e4ae208e1937
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|
||||||
@@ -1,14 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 105
|
VMID: 105
|
||||||
---
|
---
|
||||||
|
|
||||||
Posgresql v13
|
|
||||||
|
|
||||||
- ejabberd (xmpp)
|
|
||||||
- discourse (forum)
|
|
||||||
|
|
||||||
root@192.168.1.28
|
|
||||||
|
|
||||||
other databases are migrated to posgresql12
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -1,54 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 121
|
|
||||||
---
|
|
||||||
|
|
||||||
PostgreSql v15
|
|
||||||
|
|
||||||
port 5432
|
|
||||||
|
|
||||||
[installation wiki](https://wiki.debian.org/PostgreSql)
|
|
||||||
|
|
||||||
## Users
|
|
||||||
|
|
||||||
- ejabberd
|
|
||||||
- discorse
|
|
||||||
- gitea
|
|
||||||
- wiki
|
|
||||||
- replication
|
|
||||||
- xmppsqlkrov (not created)
|
|
||||||
- dmzrsflask (not created)
|
|
||||||
|
|
||||||
|
|
||||||
## Config for databases
|
|
||||||
|
|
||||||
- ejabberddb - `/etc/ejabberd/ejabberd.yml`
|
|
||||||
- discorsedb (forum11) `/etc/discorse_docker/containers/web_only.yml` and `-||-/data.yml`
|
|
||||||
- giteadb `/etc/gitea/app.ini`
|
|
||||||
- wikidb `/root/wiki/config.yml`
|
|
||||||
- replication
|
|
||||||
|
|
||||||
|
|
||||||
```sh
|
|
||||||
pg_dump -d <database> -f <file>
|
|
||||||
psql -U <user> -d <dababase> -f <dump.psql>
|
|
||||||
|
|
||||||
```
|
|
||||||
|
|
||||||
## Config file
|
|
||||||
|
|
||||||
`/etc/postresql/15main/postresql.conf`
|
|
||||||
changed listening_address from localhost to *
|
|
||||||
|
|
||||||
`/etc/postresql/15main/pg_hba.conf`
|
|
||||||
host all all all md5
|
|
||||||
|
|
||||||
add `/etc/ssl/certs/ssl-cert-snakeoil.pem` to `/etc/ssl/` on every service
|
|
||||||
|
|
||||||
|
|
||||||
## SSL
|
|
||||||
|
|
||||||
For wiki machine certificate pinging is setup
|
|
||||||
In config.yml on wiki machine, the certificate path for new sql server should be added
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -1,5 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 114
|
VMID: 114
|
||||||
---
|
---
|
||||||
|
|
||||||
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)
|
|
||||||
|
|||||||
@@ -1,56 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 103
|
|
||||||
---
|
|
||||||
|
|
||||||
[Wireguard VPN quickstart](https://www.wireguard.com/quickstart)
|
|
||||||
|
|
||||||
Check `dmzadmin` for `wireguard.gpg` to know who to contact for access
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### Client config
|
|
||||||
|
|
||||||
Client config example
|
|
||||||
`x` is the assigned on the server as peer:
|
|
||||||
|
|
||||||
```conf
|
|
||||||
|
|
||||||
[Interface]
|
|
||||||
Address = 192.168.164.x/32
|
|
||||||
DNS = 1.1.1.1
|
|
||||||
MTU = 1420
|
|
||||||
SaveConfig = true
|
|
||||||
ListenPort = 51820
|
|
||||||
FwMark = 0xca6c
|
|
||||||
PrivateKey = <your_private_wg_key>
|
|
||||||
|
|
||||||
[Peer]
|
|
||||||
PublicKey = JP2FTHLUujkevz1kUymciLImsx1OX9ViUko7oPAIoiA=
|
|
||||||
AllowedIPs = 192.168.164.0/24, 192.168.1.0/24
|
|
||||||
Endpoint = 77.105.27.232:51820
|
|
||||||
PersistentKeepalive = 21
|
|
||||||
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### Server config
|
|
||||||
|
|
||||||
New user/client needs to provide their wireguard `publickey` and new ip on the network needs to be assigned (`x`)
|
|
||||||
check the server config file `/etc/wireguard/wg0.conf` to find free address
|
|
||||||
|
|
||||||
```sh
|
|
||||||
sudo wg set wg0 peer <client_public_key> allowed-ips 192.168.164.x/32
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
Command to resolve IP clashing with current and wireguard network, if needed
|
|
||||||
|
|
||||||
```shell
|
|
||||||
ip route add <ip> dev <wg0>
|
|
||||||
```
|
|
||||||
|
|
||||||
- `ip` you want to resolve -> for wireguard VM 192.168.1.10
|
|
||||||
- `wg0` name of the wireguard config
|
|
||||||
|
|
||||||
@@ -17,6 +17,3 @@ VMID Name
|
|||||||
111 taskmanager12
|
111 taskmanager12
|
||||||
112 stopreklamama12
|
112 stopreklamama12
|
||||||
|
|
||||||
##### Legend
|
|
||||||
|
|
||||||
12 -> debian 12
|
|
||||||
|
|||||||
@@ -1,5 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 109
|
VMID: 109
|
||||||
---
|
---
|
||||||
|
|
||||||
XMPP server, used for future decentralization
|
|
||||||
|
|||||||
@@ -1,26 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 100
|
VMID: 100
|
||||||
---
|
---
|
||||||
|
|
||||||
This VM is a reverse proxy, all serveces go through it and get their SSL certificates
|
|
||||||
|
|
||||||
## Creating new record
|
|
||||||
|
|
||||||
```sh
|
|
||||||
cd /etc/nginx/sites-available/ # configs are located here
|
|
||||||
vim.tiny pastebin.dmz.rs # using pastebin as example, copy existing one and edit it
|
|
||||||
ln -s /etc/nginx/sites-available/pastebin.dmz.rs /etc/nging/sites-enabled/pastebin.dmz.rs # creating link since file is the same
|
|
||||||
mkdir /var/www/pastebindmzrs # new dir where certificate will be validated
|
|
||||||
nginx -t # checking for errors
|
|
||||||
systemctl reload nginx.service # reloading the service for changes to apply, reset will work too
|
|
||||||
service nginx reload # alternative server reload
|
|
||||||
certbot certonly --webroot -w /var/www/pastebindmzrs -d pastebin.dmz.rs -d pastebin.decentrala.org # requesting the certificates
|
|
||||||
```
|
|
||||||
|
|
||||||
## renewal
|
|
||||||
|
|
||||||
```sh
|
|
||||||
ls /var/www/
|
|
||||||
cd /etc/letsencrypt/renewal
|
|
||||||
certbot renew
|
|
||||||
```
|
|
||||||
|
|||||||
@@ -1,6 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 112
|
VMID: 112
|
||||||
---
|
---
|
||||||
|
|
||||||
This container is for hosting the [website](https://gitea.dmz.rs/svitvojimilioni/stopreklamama)
|
|
||||||
hosted on domen `stopreklamama.dmz.rs`
|
|
||||||
|
|||||||
@@ -1,8 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 111
|
VMID: 111
|
||||||
---
|
---
|
||||||
|
|
||||||
Old app for group task managment, [gitea project](https://gitea.dmz.rs/Decentrala/taskmanager)
|
|
||||||
Hosted on [todo.dmz.rs](https://todo.dmz.rs/)
|
|
||||||
|
|
||||||
Now using soft.dmz.rs/fixme instead
|
|
||||||
|
|||||||
@@ -1,5 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 103
|
VMID: 103
|
||||||
---
|
---
|
||||||
|
|
||||||
In this container hosts the tor onion service, used for remote access to the proxmox, through tor.
|
|
||||||
|
|||||||
@@ -1,5 +1,3 @@
|
|||||||
---
|
---
|
||||||
VMID: 105
|
VMID: 105
|
||||||
---
|
---
|
||||||
|
|
||||||
Wireguard server for VPN access to krov network
|
|
||||||
|
|||||||
@@ -1,39 +1,15 @@
|
|||||||
# List of containers
|
# List of containers
|
||||||
|
|
||||||
# srv1
|
## srv1
|
||||||
|
|
||||||
VMID Name
|
VMID Name
|
||||||
100 ssh12
|
102 tor12
|
||||||
101 vukbox
|
103 dendrite
|
||||||
102 mad3v-container-postgresql
|
106 icecast12
|
||||||
103 nextcloud1
|
107 mariadb12
|
||||||
104 pentest
|
108 mpd12
|
||||||
105 dns12
|
109 ympd
|
||||||
106 cryptpad
|
111 sshfs11
|
||||||
107 cryptpad12
|
113 ollama12
|
||||||
108 ejabberd12
|
114 chatbot12
|
||||||
109 dante12
|
115 goodvibes12
|
||||||
111 postgresql12
|
|
||||||
112 gitea12
|
|
||||||
113 game12
|
|
||||||
114 coja-nginx
|
|
||||||
115 mad3v-container-1
|
|
||||||
116 hugo12
|
|
||||||
118 mumble
|
|
||||||
119 netstat-game12
|
|
||||||
120 privatebin12
|
|
||||||
121 searxng12
|
|
||||||
122 alpine-it-tools
|
|
||||||
123 test
|
|
||||||
124 jitsi12
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### Hardware
|
|
||||||
|
|
||||||
Dell enterprise server
|
|
||||||
|
|
||||||
##### Legend
|
|
||||||
|
|
||||||
12 -> debian 12 lxc
|
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 122
|
|
||||||
---
|
|
||||||
|
|
||||||
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=alpine-it-tools)
|
|
||||||
|
|
||||||
Plan to host it on tools.dmz.rs
|
|
||||||
3
krov/srv1/chatbot12/README.md
Normal file
3
krov/srv1/chatbot12/README.md
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
VMID: 114
|
||||||
|
---
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 106
|
|
||||||
---
|
|
||||||
|
|
||||||
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=cryptpad)
|
|
||||||
|
|
||||||
[Project page](https://cryptpad.org/)
|
|
||||||
|
|
||||||
|
|
||||||
Plan to host it on cryptpad.dmz.rs
|
|
||||||
|
|
||||||
cryptpad (106) is already on that subdomain, but it doesnt work
|
|
||||||
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 108
|
|
||||||
---
|
|
||||||
|
|
||||||
XMPP server, practice for future decentralization of the service
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 117
|
|
||||||
---
|
|
||||||
|
|
||||||
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=haos-vm)
|
|
||||||
|
|
||||||
[Forum descussion](https://forum.dmz.rs/t/automatizacija-krova/469)
|
|
||||||
|
|
||||||
|
|
||||||
3
krov/srv1/icecast12/README.md
Normal file
3
krov/srv1/icecast12/README.md
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
VMID: 106
|
||||||
|
---
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 124
|
|
||||||
---
|
|
||||||
|
|
||||||
Video converencing server. Zoom alternative.
|
|
||||||
|
|
||||||
[website](https://jitsi.org/)
|
|
||||||
|
|
||||||
Plan to host it on jitsi.dmz.rs, video.dmz.rs or else
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 118
|
|
||||||
---
|
|
||||||
|
|
||||||
VOIP server, hosted on krov.dmz.rs
|
|
||||||
|
|
||||||
[website](https://www.mumble.info/)
|
|
||||||
|
|
||||||
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 119
|
|
||||||
---
|
|
||||||
|
|
||||||
Open arena server, free clone of FPS Quake III Arena
|
|
||||||
Hosted on krov.dmz.rs:27960 for LAN Parties
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 103
|
|
||||||
---
|
|
||||||
|
|
||||||
Plan for this services was to use the shared callendar with members of DC Krov
|
|
||||||
|
|
||||||
Register as a user is disabled, only admins can create the accounts
|
|
||||||
LDAP is not connected
|
|
||||||
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
Those serveces are not on the server
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 114
|
|
||||||
---
|
|
||||||
|
|
||||||
[Forum discussion](https://forum.dmz.rs/t/jel-neko-u-krovu-bot/779)
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
Here should be the list of other containers on the server
|
|
||||||
|
|
||||||
## "Personal containers"
|
|
||||||
created on some of the sysadmin workshops, used for learning and practice, usually named by the nickname
|
|
||||||
|
|
||||||
- vukbox
|
|
||||||
- hugo12
|
|
||||||
- malin
|
|
||||||
- mad3v-container-postresql
|
|
||||||
- mad3v-container-1
|
|
||||||
- coja-nginx hosting [coja.krov.dmz.rs](https://coja.krov.dmz.rs/)
|
|
||||||
-
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Other
|
|
||||||
|
|
||||||
- pentest - created by fleka for CTF challange
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Containers with no info
|
|
||||||
Feel free to add info
|
|
||||||
|
|
||||||
- dante12
|
|
||||||
- dns12
|
|
||||||
- gitea12
|
|
||||||
- test
|
|
||||||
- game12
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 111
|
|
||||||
---
|
|
||||||
|
|
||||||
Probably used as a testing ground for syncing the database, for future decentralization.
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 120
|
|
||||||
---
|
|
||||||
|
|
||||||
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=privatebin)
|
|
||||||
|
|
||||||
[Project page](https://privatebin.info/)
|
|
||||||
|
|
||||||
Hosted on [subdomain on dmz](https://pastebin.dmz.rs/)
|
|
||||||
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 121
|
|
||||||
---
|
|
||||||
|
|
||||||
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=searxng)
|
|
||||||
|
|
||||||
[Project git repo](https://github.com/searxng/searxng)
|
|
||||||
|
|
||||||
Hosted on [subdomain on dmz](https://search.dmz.rs/)
|
|
||||||
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
VMID: 100
|
|
||||||
---
|
|
||||||
|
|
||||||
SSH port from this container is forwarded on krov.dmz.rs
|
|
||||||
SSH access to other containers is done through this one with ssh jump, passwords are disabled, so only keys verification is used.
|
|
||||||
|
|
||||||
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)
|
|
||||||
3
krov/srv1/sshfs11/README.md
Normal file
3
krov/srv1/sshfs11/README.md
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
VMID: 111
|
||||||
|
---
|
||||||
39
map.ge
Normal file
39
map.ge
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
# Network map of Decentrala. Use with:
|
||||||
|
# graph-easy --boxart < netmap.txt
|
||||||
|
|
||||||
|
(Mox
|
||||||
|
[ m_router ]{label: router ;}
|
||||||
|
[ wireguard ] --> [ m_nginx ]{label: nginx-11 ;}
|
||||||
|
[ wiki ] --> [ m_nginx ]
|
||||||
|
[ gitea ] --> [ m_nginx ]
|
||||||
|
[ tor11 ] --> [ m_nginx ] --> [ m_router ]
|
||||||
|
[ smtp ]
|
||||||
|
)
|
||||||
|
|
||||||
|
(Serverko
|
||||||
|
[ s_nginx ]{label: nginx-12 ;}
|
||||||
|
[ s_router ]{label: router ;}
|
||||||
|
[ s_nginx ] --> [ nextcloud ]
|
||||||
|
[ s_nginx ] --> [ tor12 ]
|
||||||
|
[ s_nginx ] --> [ s_router ]
|
||||||
|
)
|
||||||
|
|
||||||
|
(splint.rs # unimportant
|
||||||
|
[ soft-serve ] # unimportant
|
||||||
|
[ mail-cache ]# unimportant
|
||||||
|
) # unimportant
|
||||||
|
|
||||||
|
[ tor12 ] <..> [ onions ] <..> [ tor11 ]
|
||||||
|
[ m_router ] <..> [ BGP ] <..> [ madness ] <..> [ s_router ]
|
||||||
|
[ smtp ] <..> [ madness ]
|
||||||
|
[ madness ] <..> [ mail-cache ]# unimportant
|
||||||
|
[ A ]{label: "" ;}
|
||||||
|
[ B ]{label: "" ;}
|
||||||
|
[ C ]{label: "" ;}
|
||||||
|
[ D ]{label: "" ;}
|
||||||
|
[ onions ] <..> [ A ]
|
||||||
|
[ onions ] <..> [ B ]
|
||||||
|
[ A ] <..> [ C ]
|
||||||
|
[ B ] <..> [ D ]
|
||||||
|
|
||||||
|
(Sharks! [ D ])
|
||||||
93
network.rec
93
network.rec
@@ -1,93 +0,0 @@
|
|||||||
%rec: router
|
|
||||||
%doc: Routers, or possibly modems?
|
|
||||||
|
|
||||||
name: ISP Router
|
|
||||||
location: kralizec
|
|
||||||
ISP: Orion
|
|
||||||
|
|
||||||
name: ISP Router
|
|
||||||
location: krov
|
|
||||||
ISP: Yettel
|
|
||||||
|
|
||||||
%rec: host
|
|
||||||
%doc: These are the real machines, most of which run VMs or containters.
|
|
||||||
%key: name
|
|
||||||
|
|
||||||
name: moxx
|
|
||||||
location: kralizec
|
|
||||||
local_access: 192.168.1.200:8006
|
|
||||||
|
|
||||||
name: Serverko
|
|
||||||
location: krov
|
|
||||||
|
|
||||||
%rec: lxc
|
|
||||||
%doc: A container, usually on a Proxmox host.
|
|
||||||
%type: host rec host
|
|
||||||
|
|
||||||
name: nginx11
|
|
||||||
gateway: ISP-router
|
|
||||||
host: moxx
|
|
||||||
proxies: wiki11
|
|
||||||
proxies: gitea11
|
|
||||||
proxies: forum11
|
|
||||||
proxies: ejabberd11
|
|
||||||
proxies: dmzrs
|
|
||||||
|
|
||||||
name: LDAP
|
|
||||||
host: moxx
|
|
||||||
|
|
||||||
name: dmzrs
|
|
||||||
host: moxx
|
|
||||||
note: hosts the dmz.rs website
|
|
||||||
|
|
||||||
name: website
|
|
||||||
host: moxx
|
|
||||||
authqueries: LDAP
|
|
||||||
queries: postgresql11
|
|
||||||
service: dmzrs
|
|
||||||
service: flask accounts
|
|
||||||
|
|
||||||
name: gitea11
|
|
||||||
service: gitea
|
|
||||||
host: moxx
|
|
||||||
authqueries: LDAP
|
|
||||||
queries: postgresql11
|
|
||||||
|
|
||||||
name: ejabberd11
|
|
||||||
service: ejabberd
|
|
||||||
host: moxx
|
|
||||||
authqueries: LDAP
|
|
||||||
queries: postgresql11
|
|
||||||
|
|
||||||
name: forum11
|
|
||||||
service: forum
|
|
||||||
host: moxx
|
|
||||||
authqueries: LDAP
|
|
||||||
queries: postgresql11
|
|
||||||
|
|
||||||
name: postfix11
|
|
||||||
service: postfix
|
|
||||||
authqueries: LDAP
|
|
||||||
|
|
||||||
name: tor11
|
|
||||||
service: tor
|
|
||||||
host: moxx
|
|
||||||
|
|
||||||
name: postgresql11
|
|
||||||
service: postgresql
|
|
||||||
host: moxx
|
|
||||||
|
|
||||||
name: wiki11
|
|
||||||
service: wiki
|
|
||||||
host: moxx
|
|
||||||
authqueries: LDAP
|
|
||||||
|
|
||||||
name: nginx12
|
|
||||||
host: Serverko
|
|
||||||
|
|
||||||
name: nextcloud
|
|
||||||
host: Serverko
|
|
||||||
|
|
||||||
name: tor12
|
|
||||||
host: nginx
|
|
||||||
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
|
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
echo $(shuf shared/english.txt | head) | sed "s/ //g"
|
|
||||||
|
|
||||||
62
scripts/showpass.sh
Executable file
62
scripts/showpass.sh
Executable file
@@ -0,0 +1,62 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
# If you want to add these passwords to the `pass` program, you can
|
||||||
|
# symlink all the passwords which you can open, then open the
|
||||||
|
# passwords with a script like this.
|
||||||
|
|
||||||
|
pass_store=~/.password-store
|
||||||
|
|
||||||
|
# THIS_PLACE="$PWD"
|
||||||
|
# mkdir $pass_store/dmz
|
||||||
|
# cd !$
|
||||||
|
# find "$THIS_PLACE" -type f -name "*.gpg" | \
|
||||||
|
# sed "s#/home/ghost#../..#" | \
|
||||||
|
# while read -r line; do
|
||||||
|
# gpg -d "$line" && ln -sf "$line" .
|
||||||
|
# done
|
||||||
|
|
||||||
|
|
||||||
|
sanity_check(){
|
||||||
|
command -v $1 >/dev/null || (
|
||||||
|
echo "You must install $1"
|
||||||
|
exit 1
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
set_selector_if_program_exists(){
|
||||||
|
command -v "$1" > /dev/null && selector="$1 $2"
|
||||||
|
}
|
||||||
|
|
||||||
|
if [ -z "$DISPLAY" ]; then
|
||||||
|
set_selector_if_program_exists sk || \
|
||||||
|
set_selector_if_program_exists fzy || \
|
||||||
|
set_selector_if_program_exists fzf
|
||||||
|
fail_sender='echo'
|
||||||
|
else
|
||||||
|
set_selector_if_program_exists "rofi" 'rofi -dmenu "$@"' || \
|
||||||
|
set_selector_if_program_exists dmenu || \
|
||||||
|
(
|
||||||
|
echo "Cannot find anything to select a key. Install dmenu."
|
||||||
|
exit 1
|
||||||
|
)
|
||||||
|
fail_sender='notify-send'
|
||||||
|
fi
|
||||||
|
|
||||||
|
list_keys(){
|
||||||
|
find -L . -mindepth 1 -type f -name "*.gpg" | \
|
||||||
|
sed 's/\.\///' | \
|
||||||
|
sed 's/.gpg//'
|
||||||
|
}
|
||||||
|
|
||||||
|
####################
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
sanity_check pass
|
||||||
|
|
||||||
|
cd "$pass_store"
|
||||||
|
|
||||||
|
password="$(list_keys | $selector)"
|
||||||
|
|
||||||
|
pass -c "$password" || $fail_sender 'Cannot decrypt'
|
||||||
|
|
||||||
@@ -56,6 +56,7 @@ Now all the files have 'read, write, and execute', but only for `$USER`.
|
|||||||
Host soft
|
Host soft
|
||||||
HostName soft.dmz.rs
|
HostName soft.dmz.rs
|
||||||
Port 2222
|
Port 2222
|
||||||
|
User ghost
|
||||||
IdentityFile ~/.ssh/id rsa
|
IdentityFile ~/.ssh/id rsa
|
||||||
Host dmz
|
Host dmz
|
||||||
HostName dmz.rs
|
HostName dmz.rs
|
||||||
|
|||||||
@@ -1,36 +0,0 @@
|
|||||||
---
|
|
||||||
volume: Decentrala
|
|
||||||
section: 6
|
|
||||||
title: Access Linux Containers in Moxx over `ssh`
|
|
||||||
author: Malin
|
|
||||||
source: dmz.rs
|
|
||||||
---
|
|
||||||
|
|
||||||
Access `moxx`, the Proxmox machine:
|
|
||||||
|
|
||||||
1. Check you can access the creds in `dmzadmin`: `gpg -d credentials/kralizec/ssh11.gpg`.
|
|
||||||
2. Check the creds work: `ssh dmz.rs ls`.
|
|
||||||
3. Copy your ssh keys across: `ssh-copy-id -i ~/id_selected dmz.rs`.
|
|
||||||
4. Check that works: `test $(ssh dmz.rs hostname) = ssh11`
|
|
||||||
5. Find `moxx`' IP address in its credentials: `moxxIP=[ user ]@[ local ip ]`
|
|
||||||
6. Jump through `ssh11` to access `moxx`: `ssh -J user@dmz.rs $moxx_ip`
|
|
||||||
|
|
||||||
|
|
||||||
# Enter Containers
|
|
||||||
|
|
||||||
Use `pct` to find and access containers:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
pct list | grep -v stopped
|
|
||||||
pct enter 112
|
|
||||||
```
|
|
||||||
|
|
||||||
- Don't tell people to type 'pct enter', or they will type `pct`, and hit the enter key I TOLD YOU ALL THE KEY SHOULD BE CALLED RETURN.
|
|
||||||
- Now you're in the container.
|
|
||||||
|
|
||||||
## Just for Fun
|
|
||||||
|
|
||||||
```sh
|
|
||||||
pct list | grep -v VMID |\
|
|
||||||
column -J -N vmid,state,current,name | less -R
|
|
||||||
```
|
|
||||||
@@ -1,9 +1,3 @@
|
|||||||
---
|
|
||||||
source: Decentrala
|
|
||||||
section: 6
|
|
||||||
title: Soft-Serve Basics
|
|
||||||
---
|
|
||||||
|
|
||||||
Soft Serve has its configurations stored inside itself in a repo. Admins can pull:
|
Soft Serve has its configurations stored inside itself in a repo. Admins can pull:
|
||||||
|
|
||||||
`git clone ssh://soft.dmz.rs:2222/.soft-serve`
|
`git clone ssh://soft.dmz.rs:2222/.soft-serve`
|
||||||
|
|||||||
@@ -1,9 +1,3 @@
|
|||||||
---
|
|
||||||
source: Decentrala
|
|
||||||
section: 6
|
|
||||||
title: Soft-Serve Webhooks
|
|
||||||
---
|
|
||||||
|
|
||||||
### Soft serve webhooks
|
### Soft serve webhooks
|
||||||
|
|
||||||
Soft serve supports [webhooks](https://en.wikipedia.org/wiki/Webhook)
|
Soft serve supports [webhooks](https://en.wikipedia.org/wiki/Webhook)
|
||||||
|
|||||||
Reference in New Issue
Block a user