Compare commits

..

No commits in common. "master" and "Help" have entirely different histories.
master ... Help

107 changed files with 147 additions and 888 deletions

View File

@ -1,77 +1,14 @@
ignore_file = .git/info/exclude
.PHONY: help .PHONY: help
help: ## Print the help message help: ## Print the help message
@awk 'BEGIN {FS = ":.*?## "} /^[0-9a-zA-Z._-]+:.*?## / {printf "\033[36m%s\033[0m : %s\n", $$1, $$2}' $(MAKEFILE_LIST) | \ @awk 'BEGIN {FS = ":.*?## "} /^[0-9a-zA-Z._-]+:.*?## / {printf "\033[36m%s\033[0m : %s\n", $$1, $$2}' $(MAKEFILE_LIST) | \
sort | \ sort | \
column -s ':' -t column -s ':' -t
.PHONY: check map.txt: map.ge ## Making map.txt
check: ## Check you have all dependencies grep -v '# unimportant' $< | graph-easy --boxart > $@
@command -v graph-easy >/dev/null || { echo "Install perl-graph-easy" && exit 1 ;} cat $@
@command -v recsel >/dev/null || { echo "Install recutils" && exit 1 ;}
@command -v lowdown >/dev/null || { echo "Install lowdown" && exit 1 ;}
@echo "All dependencies installed"
########## Network Map ########## full_map.txt: map.ge ## Generating full_map.txt with graph-easy
graph-easy --boxart < $< > $@
graph_program != type graph-easy > /dev/null && printf graph-easy || printf dot cat $@
graph_cmd = graph-easy --boxart
queries = queries authqueries
query_formats = $(patsubst %, .dbs/%.txt, $(queries))
dotquery_formats = $(patsubst %, .dbs/%.dot, $(queries))
.dbs/: | $(ignore_file)
mkdir $@
ignored += .dbs/
$(query_formats): .dbs/%.txt: | .dbs/
echo "[ {{name}} ] -- $(basename $(@F)) --> [ {{$(basename $(@F))}} ]" > $@
$(dotquery_formats): .dbs/%.dot: | .dbs/
echo '{{name}} -> {{$(basename $(@F))}} [ label="$(basename $(@F))" ];' > $@
ifeq ($(graph_program),dot)
map_file = network.png
else
map_file = network.txt
endif
ignored += $(map_file)
.PHONY: map
map: $(map_file) ## Generate a network map
network.txt: .dbs/network.txt
$(graph_cmd) < $<
.dbs/network.txt: network.rec $(query_formats)
$(RM) $@
$(foreach relation, $(queries), \
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).txt >> $@ ;\
)
.dbs/network.dot: network.rec $(dotquery_formats)
echo 'digraph network {' > $@
$(foreach relation, $(queries), \
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).dot >> $@ ;\
)
echo '}' >> $@
network.png: .dbs/network.dot $(ignore_file)
dot -T png < $< > $@
##########
$(ignore_file): $(MAKEFILE_LIST)
echo $(ignored) | tr ' ' '\n' > $@
clean:
$(RM) -r $(ignored)

View File

@ -2,11 +2,6 @@ These setup files provide the text-only configurations for DMZ.
*It should not contain private data.* *It should not contain private data.*
# Dependencies
- `recutils`
- (optional) `graph-easy` (the package may be called `perl-graph-easy`)
# Aspirations # Aspirations
- Each service should reside in its own directory. - Each service should reside in its own directory.
@ -18,62 +13,5 @@ These setup files provide the text-only configurations for DMZ.
- Idempotency. - Idempotency.
- All secrets stored elsewhere (probably in the `dmzadmin` repo) - All secrets stored elsewhere (probably in the `dmzadmin` repo)
- Any maintenance scripts. - Any maintenance scripts.
- Configurations should reside in shadow-directories, e.g. a backup `soft-serve`'s `config.yaml` should reside in this repo under `splint.rs/soft-serve/etc/soft/config.yaml`. - Configurations should reside in shadow-directories, e.g. a backup of `/etc/soft/config` should reside in this repo under `etc/soft/config`.
# Network Database
I have a half-baked plan to finally make use of plain-text databases, and it's already half-working.
Try these commands:
Ask what types of _rec_ords it contains:
## Database
```sh
recinf network.rec
```
### Select queries
Select with `recsel`, then specify the database (.rec) and type of record (like table in db).
- `--include-descriptors` or `-d`
- `--type` or `-t`
- `--expression` or `-e`
- `--quick` or `-q`
```sh
recsel network.rec --type router
recsel network.rec -d -t lxc
```
User `-q` for a `--quick` selection, or `-e` for more precise selections.
```sh
recsel network.rec --type lxc --quick wiki
recsel network.rec -t lxc -q nginx
recsel network.rec -t lxc -e "name ~ 'nginx'"
recsel network.rec -t lxc -e "name = 'nginx12'"
```
### Insert queries
Insert a new record with `recins`.
```sh
recins network.rec -t lxc -r "name: bob" -r "service: bob" -r "host: moxx"
```
### Update queries
If you can select something, you can also set its fields with `recset`.
Use `-f` to set the `--field`, and `-a` to `--add`, or `-s` to `--set`.
```sh
recset network.rec -t lxc -e "name = 'nginx12'" -f proxies -a soft-serve
recsel network.rec -t lxc -e "name = 'nginx11'" -p proxies[0]
recset network.rec -t lxc -e" name = 'nginx11'" -f proxies[0] -s wiki9
```

26
docs/dmzrs/README.md Normal file
View File

@ -0,0 +1,26 @@
Add this configuration to ~/.ssh/config file
Host dmzkrovdmzrs12
Hostname veyxphzuqnooc7wb7utfza3joaoopgqgwp6l6d4en5yfmyr7kxvminqd.onion
User root
IdentityFile ~/.ssh/id_rsa
PasswordAuthentication no
Now you can log in by typing:
torsocks ssh dmzkrovdmzrs12
Install all needed packages
apt install rsync git nginx
git clone https://gitea.dmz.rs/Decentrala/website
Run updatewebsite.sh script every minute using crontab (run "crontab -e")
This fill automaticlly pull from git repo and regenerate events page
Add nginx-dmz.rs.conf to /etc/nginx/sites-available/dmz.rs and create a symlink
from /etc/nginx/sites-enabled/dmz.rs to that file
You can do this by running:
ln -s /etc/nginx/sites-available/dmz.rs /etc/nginx/sites-enabled/dmz.rs
Increase server_names_hash_bucket_size to 256 in /etc/nginx/nginx.conf in order to support onion addresses.
In the nginx configuration /account/ is redirected to luser (https://gitea.dmz.rs/fram3d/luser) instance running at 192.168.1.211

View File

@ -1,9 +1,3 @@
---
title: ejabberd configurations
section: 6
source: Decentrala
---
#On your PC #On your PC
Add this configuration to ~/.ssh/config Add this configuration to ~/.ssh/config

View File

@ -17,6 +17,16 @@ VMID Name
111 taskmanager12 111 taskmanager12
112 stopreklamama12 112 stopreklamama12
##### Legend ## srv1
12 -> debian 12 VMID Name
102 tor12
103 dendrite
106 icecast12
107 mariadb12
108 mpd12
109 ympd
111 sshfs11
113 ollama12
114 chatbot12
115 goodvibes12

View File

@ -1,3 +0,0 @@
---
VMID: 115
---

View File

@ -1,3 +0,0 @@
---
VMID: 126
---

View File

@ -1,40 +0,0 @@
Add this configuration to `~/.ssh/config` file
```
Host dmzkrovdmzrs12
Hostname veyxphzuqnooc7wb7utfza3joaoopgqgwp6l6d4en5yfmyr7kxvminqd.onion
User root
IdentityFile ~/.ssh/id_rsa
PasswordAuthentication no
```
Now you can log in by typing:
```bash
torsocks ssh dmzkrovdmzrs12
```
Install all needed packages:
```bash
apt install rsync git nginx
git clone https://gitea.dmz.rs/Decentrala/website
```
Run `updatewebsite.sh` script every minute using `crontab` (run "`crontab -e`")
This fill automatically pull from git repo and regenerate events page
Add `nginx-dmz.rs.conf` to `/etc/nginx/sites-available/dmz.rs` and create a symlink
from `/etc/nginx/sites-enabled/dmz.rs` to that file.
You can do this by running:
```bash
ln -s /etc/nginx/sites-available/dmz.rs /etc/nginx/sites-enabled/dmz.rs
```
Increase `server_names_hash_bucket_size` to 256 in `/etc/nginx/nginx.conf` in order to support onion addresses.
In the `nginx` configuration /account/ is redirected to the `luser` [instance](https://gitea.dmz.rs/fram3d/luser) running at `192.168.1.211`.

View File

@ -1,3 +0,0 @@
---
VMID: 122
---

View File

@ -1,3 +0,0 @@
---
VMID: 118
---

View File

@ -1,3 +0,0 @@
---
VMID: 124
---

View File

@ -1,3 +0,0 @@
---
VMID: 111
---

View File

@ -1,3 +0,0 @@
---
VMID: 106
---

View File

@ -1,3 +0,0 @@
---
VMID: 119
---

View File

@ -1,3 +0,0 @@
---
VMID: 109
---

View File

@ -1,3 +0,0 @@
---
VMID: 117
---

View File

@ -1,3 +0,0 @@
---
VMID: 104
---

View File

@ -1,3 +0,0 @@
---
VMID: 121
---

View File

@ -1,3 +0,0 @@
---
VMID: 108
---

View File

@ -1,3 +0,0 @@
---
VMID: 127
---

View File

@ -1,3 +0,0 @@
---
VMID: 113
---

View File

@ -1,3 +0,0 @@
---
VMID: 105
---

View File

@ -1,3 +0,0 @@
---
VMID: 116
---

View File

@ -1,3 +0,0 @@
---
VMID: 123
---

View File

@ -1,5 +0,0 @@
---
VMID: 114
---
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)

View File

@ -1,3 +0,0 @@
---
VMID: 112
---

View File

@ -1,3 +0,0 @@
---
VMID: 101
---

View File

@ -1,3 +0,0 @@
---
VMID: 125
---

View File

@ -1,3 +0,0 @@
---
VMID: 120
---

View File

@ -1,56 +0,0 @@
---
VMID: 103
---
[Wireguard VPN quickstart](https://www.wireguard.com/quickstart)
Check `dmzadmin` for `wireguard.gpg` to know who to contact for access
---
### Client config
Client config example
`x` is the assigned on the server as peer:
```conf
[Interface]
Address = 192.168.164.x/32
DNS = 1.1.1.1
MTU = 1420
SaveConfig = true
ListenPort = 51820
FwMark = 0xca6c
PrivateKey = <your_private_wg_key>
[Peer]
PublicKey = JP2FTHLUujkevz1kUymciLImsx1OX9ViUko7oPAIoiA=
AllowedIPs = 192.168.164.0/24, 192.168.1.0/24
Endpoint = 77.105.27.232:51820
PersistentKeepalive = 21
```
---
### Server config
New user/client needs to provide their wireguard `publickey` and new ip on the network needs to be assigned (`x`)
check the server config file `/etc/wireguard/wg0.conf` to find free address
```sh
sudo wg set wg0 peer <client_public_key> allowed-ips 192.168.164.x/32
```
---
Command to resolve IP clashing with current and wireguard network, if needed
```shell
ip route add <ip> dev <wg0>
```
- `ip` you want to resolve -> for wireguard VM 192.168.1.10
- `wg0` name of the wireguard config

View File

@ -1,3 +0,0 @@
---
VMID: 102
---

View File

@ -1,3 +0,0 @@
---
VMID: 101
---

View File

@ -1,3 +0,0 @@
---
VMID: 102
---

View File

@ -1,3 +0,0 @@
---
VMID: 110
---

View File

@ -1,5 +0,0 @@
---
VMID: 109
---
XMPP server, used for future decentralization

View File

@ -1,3 +0,0 @@
---
VMID: 107
---

View File

@ -1,26 +0,0 @@
---
VMID: 100
---
This VM is a reverse proxy, all serveces go through it and get their SSL certificates
## Creating new record
```sh
cd /etc/nginx/sites-available/ # configs are located here
vim.tiny pastebin.dmz.rs # using pastebin as example, copy existing one and edit it
ln -s /etc/nginx/sites-available/pastebin.dmz.rs /etc/nging/sites-enabled/pastebin.dmz.rs # creating link since file is the same
mkdir /var/www/pastebindmzrs # new dir where certificate will be validated
nginx -t # checking for errors
systemctl reload nginx.service # reloading the service for changes to apply, reset will work too
service nginx reload # alternative server reload
certbot certonly --webroot -w /var/www/pastebindmzrs -d pastebin.dmz.rs -d pastebin.decentrala.org # requesting the certificates
```
## renewal
```sh
ls /var/www/
cd /etc/letsencrypt/renewal
certbot renew
```

View File

@ -1,3 +0,0 @@
---
VMID: 106
---

View File

@ -1,3 +0,0 @@
---
VMID: 108
---

View File

@ -1,3 +0,0 @@
---
VMID: 104
---

View File

@ -1,6 +0,0 @@
---
VMID: 112
---
This container is for hosting the [website](https://gitea.dmz.rs/svitvojimilioni/stopreklamama)
hosted on domen `stopreklamama.dmz.rs`

View File

@ -1,8 +0,0 @@
---
VMID: 111
---
Old app for group task managment, [gitea project](https://gitea.dmz.rs/Decentrala/taskmanager)
Hosted on [todo.dmz.rs](https://todo.dmz.rs/)
Now using soft.dmz.rs/fixme instead

View File

@ -1,5 +0,0 @@
---
VMID: 103
---
In this container hosts the tor onion service, used for remote access to the proxmox, through tor.

View File

@ -1,5 +0,0 @@
---
VMID: 105
---
Wireguard server for VPN access to krov network

View File

@ -1,39 +0,0 @@
# List of containers
# srv1
VMID Name
100 ssh12
101 vukbox
102 mad3v-container-postgresql
103 nextcloud1
104 pentest
105 dns12
106 cryptpad
107 cryptpad12
108 ejabberd12
109 dante12
111 postgresql12
112 gitea12
113 game12
114 coja-nginx
115 mad3v-container-1
116 hugo12
118 mumble
119 netstat-game12
120 privatebin12
121 searxng12
122 alpine-it-tools
123 test
124 jitsi12
---
### Hardware
Dell enterprise server
##### Legend
12 -> debian 12 lxc

View File

@ -1,7 +0,0 @@
---
VMID: 122
---
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=alpine-it-tools)
Plan to host it on tools.dmz.rs

View File

@ -1,13 +0,0 @@
---
VMID: 106
---
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=cryptpad)
[Project page](https://cryptpad.org/)
Plan to host it on cryptpad.dmz.rs
cryptpad (106) is already on that subdomain, but it doesnt work

View File

@ -1,5 +0,0 @@
---
VMID: 108
---
XMPP server, practice for future decentralization of the service

View File

@ -1,9 +0,0 @@
---
VMID: 117
---
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=haos-vm)
[Forum descussion](https://forum.dmz.rs/t/automatizacija-krova/469)

View File

@ -1,9 +0,0 @@
---
VMID: 124
---
Video converencing server. Zoom alternative.
[website](https://jitsi.org/)
Plan to host it on jitsi.dmz.rs, video.dmz.rs or else

View File

@ -1,9 +0,0 @@
---
VMID: 118
---
VOIP server, hosted on krov.dmz.rs
[website](https://www.mumble.info/)

View File

@ -1,6 +0,0 @@
---
VMID: 119
---
Open arena server, free clone of FPS Quake III Arena
Hosted on krov.dmz.rs:27960 for LAN Parties

View File

@ -1,9 +0,0 @@
---
VMID: 103
---
Plan for this services was to use the shared callendar with members of DC Krov
Register as a user is disabled, only admins can create the accounts
LDAP is not connected

View File

@ -1 +0,0 @@
Those serveces are not on the server

View File

@ -1,5 +0,0 @@
---
VMID: 114
---
[Forum discussion](https://forum.dmz.rs/t/jel-neko-u-krovu-bot/779)

View File

@ -1,3 +0,0 @@
---
VMID: 103
---

View File

@ -1,3 +0,0 @@
---
VMID: 115
---

View File

@ -1,3 +0,0 @@
---
VMID: 107
---

View File

@ -1,3 +0,0 @@
---
VMID: 108
---

View File

@ -1,3 +0,0 @@
---
VMID: 113
---

View File

@ -1,3 +0,0 @@
---
VMID: 102
---

View File

@ -1,3 +0,0 @@
---
VMID: 109
---

View File

@ -1,32 +0,0 @@
Here should be the list of other containers on the server
## "Personal containers"
created on some of the sysadmin workshops, used for learning and practice, usually named by the nickname
- vukbox
- hugo12
- malin
- mad3v-container-postresql
- mad3v-container-1
- coja-nginx hosting [coja.krov.dmz.rs](https://coja.krov.dmz.rs/)
-
---
## Other
- pentest - created by fleka for CTF challange
---
## Containers with no info
Feel free to add info
- dante12
- dns12
- gitea12
- test
- game12

View File

@ -1,5 +0,0 @@
---
VMID: 111
---
Probably used as a testing ground for syncing the database, for future decentralization.

View File

@ -1,10 +0,0 @@
---
VMID: 120
---
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=privatebin)
[Project page](https://privatebin.info/)
Hosted on [subdomain on dmz](https://pastebin.dmz.rs/)

View File

@ -1,10 +0,0 @@
---
VMID: 121
---
Installed with [proxmox helper scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=searxng)
[Project git repo](https://github.com/searxng/searxng)
Hosted on [subdomain on dmz](https://search.dmz.rs/)

View File

@ -1,8 +0,0 @@
---
VMID: 100
---
SSH port from this container is forwarded on krov.dmz.rs
SSH access to other containers is done through this one with ssh jump, passwords are disabled, so only keys verification is used.
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)

39
map.ge Normal file
View File

@ -0,0 +1,39 @@
# Network map of Decentrala. Use with:
# graph-easy --boxart < netmap.txt
(Mox
[ m_router ]{label: router ;}
[ wireguard ] --> [ m_nginx ]{label: nginx-11 ;}
[ wiki ] --> [ m_nginx ]
[ gitea ] --> [ m_nginx ]
[ tor11 ] --> [ m_nginx ] --> [ m_router ]
[ smtp ]
)
(Serverko
[ s_nginx ]{label: nginx-12 ;}
[ s_router ]{label: router ;}
[ s_nginx ] --> [ nextcloud ]
[ s_nginx ] --> [ tor12 ]
[ s_nginx ] --> [ s_router ]
)
(splint.rs # unimportant
[ soft-serve ] # unimportant
[ mail-cache ]# unimportant
) # unimportant
[ tor12 ] <..> [ onions ] <..> [ tor11 ]
[ m_router ] <..> [ BGP ] <..> [ madness ] <..> [ s_router ]
[ smtp ] <..> [ madness ]
[ madness ] <..> [ mail-cache ]# unimportant
[ A ]{label: "" ;}
[ B ]{label: "" ;}
[ C ]{label: "" ;}
[ D ]{label: "" ;}
[ onions ] <..> [ A ]
[ onions ] <..> [ B ]
[ A ] <..> [ C ]
[ B ] <..> [ D ]
(Sharks! [ D ])

View File

@ -1,88 +0,0 @@
%rec: router
%doc: Routers, or possibly modems?
name: ISP Router
location: kralizec
ISP: Orion
name: ISP Router
location: krov
ISP: Yettel
%rec: host
%doc: These are the real machines, most of which run VMs or containters.
%key: name
name: moxx
location: kralizec
name: Serverko
location: krov
%rec: lxc
%doc: A container, usually on a Proxmox host.
%type: host rec host
name: nginx11
gateway: ISP-router
host: moxx
proxies: wiki11
proxies: gitea11
proxies: forum11
proxies: ejabberd11
proxies: dmzrs
name: LDAP
host: moxx
name: website
host: moxx
authqueries: LDAP
queries: postgresql11
service: dmzrs
service: flask accounts
name: gitea11
service: gitea
host: moxx
authqueries: LDAP
queries: postgresql11
name: ejabberd11
service: ejabberd
host: moxx
authqueries: LDAP
queries: postgresql11
name: forum11
service: forum
host: moxx
authqueries: LDAP
queries: postgresql11
name: postfix11
service: postfix
authqueries: LDAP
name: tor11
service: tor
host: moxx
name: postgresql11
service: postgresql
host: moxx
name: wiki11
service: wiki
host: moxx
authqueries: LDAP
name: nginx12
host: Serverko
name: nextcloud
host: Serverko
name: tor12
host: nginx

View File

@ -1,5 +0,0 @@
#!/bin/bash
echo $(shuf shared/english.txt | head) | sed "s/ //g"

Some files were not shown because too many files have changed in this diff Show More