Compare commits

...

30 Commits

Author SHA1 Message Date
2624425727
make network map depending on what is installed 2025-03-31 22:25:51 +02:00
b872a25cc0 [Doc] added, cryptpad, searxng and privatebin 2025-03-31 03:05:40 +02:00
0b514b29e1
edit wireguard syntax 2025-03-26 16:32:10 +01:00
f398f52e55
generate graphviz png 2025-03-26 16:29:53 +01:00
cd9bdb80c1
remove half-baked man page generator 2025-03-26 16:29:53 +01:00
aa65808edd [Readme] update 2025-03-26 05:33:01 +01:00
1b09537f14 [Readme] update
Signed-off-by: coja <coja@dmz.rs>
2025-03-26 05:15:42 +01:00
a829cce278 [Readme] update
Signed-off-by: coja <coja@dmz.rs>
2025-03-26 05:04:30 +01:00
edb9f7b785 sshfs doesn't exist on srv1, but postgres does with that id 2025-03-25 23:00:56 +01:00
64f9f6ffa3
[Doc] changed readme 2025-03-25 22:49:19 +01:00
40a4064ddb
add graph-easy dependency 2025-03-25 22:44:59 +01:00
763748322a
note recutils package required 2025-03-25 22:44:59 +01:00
fdb9cf9514
add record info to network.rec 2025-03-25 22:44:59 +01:00
1d35d54af1
embiggen recutils examples 2025-03-25 22:44:58 +01:00
452970261e
create check target 2025-03-25 22:44:58 +01:00
12644b80da
autogenerate map from network info 2025-03-25 22:44:58 +01:00
4b9dae9b3a
give example of inserting record 2025-03-25 22:44:58 +01:00
85479ec6ed
note recutils example command 2025-03-25 22:44:58 +01:00
9ff9633bc4
fix container and host names 2025-03-25 22:44:58 +01:00
37b3d56676
rework routers 2025-03-25 22:44:58 +01:00
0ecdda7302
names and places 2025-03-25 22:44:57 +01:00
f08d2838e3
expand network db 2025-03-25 22:44:57 +01:00
0f58a26e60
basic network db 2025-03-25 22:44:57 +01:00
76e9650abe
[Doc] added wiki link to ssh 2025-03-25 20:51:32 +01:00
624e8d2bfd
remove suggested username from ssh FAQ 2025-03-25 20:32:16 +01:00
c8282c82c5
Merge branch 'master' of ssh://gitea.dmz.rs:2222/Decentrala/dmzconf 2025-03-22 12:21:02 +01:00
c81ef26f4e [scripts] added generate random pass script 2025-03-22 05:02:51 +01:00
dbd7f3dfd4 [kralizec] updated readme for wireguard 2025-03-22 04:21:53 +01:00
547ef14a31 [kralizec] added readme for wireguard 2025-03-22 04:11:41 +01:00
e44620521f
remove old showpass script
The dmzadmin repo now populates password lists, no need for this.
2025-03-20 18:58:48 +01:00
14 changed files with 294 additions and 136 deletions

View File

@ -1,58 +1,77 @@
.PHONY: help
ignore_file = .git/info/exclude
.PHONY: help
help: ## Print the help message
@awk 'BEGIN {FS = ":.*?## "} /^[0-9a-zA-Z._-]+:.*?## / {printf "\033[36m%s\033[0m : %s\n", $$1, $$2}' $(MAKEFILE_LIST) | \
sort | \
column -s ':' -t
map.txt: map.ge ## Making map.txt
grep -v '# unimportant' $< | graph-easy --boxart > $@
cat $@
.PHONY: check
check: ## Check you have all dependencies
@command -v graph-easy >/dev/null || { echo "Install perl-graph-easy" && exit 1 ;}
@command -v recsel >/dev/null || { echo "Install recutils" && exit 1 ;}
@command -v lowdown >/dev/null || { echo "Install lowdown" && exit 1 ;}
@echo "All dependencies installed"
full_map.txt: map.ge ## Generating full_map.txt with graph-easy
graph-easy --boxart < $< > $@
cat $@
########## Network Map ##########
########## Man Pages ##########
graph_program != type graph-easy > /dev/null && printf graph-easy || printf dot
mandir = $(HOME)/.local/man/man6
graph_cmd = graph-easy --boxart
kralizec_docs != grep -rl "^section:" kralizec
kralmans = $(kralizec_docs:kralizec/%/README.md=$(mandir)/%.6)
queries = queries authqueries
$(mandir)/%.6: kralizec/%/README.md
lowdown -stman $< > $@
query_formats = $(patsubst %, .dbs/%.txt, $(queries))
krov_docs != grep -rl "^section:" krov
krovmans = $(krov_docs:krov/%/README.md=$(mandir)/%.6)
dotquery_formats = $(patsubst %, .dbs/%.dot, $(queries))
$(mandir)/%.6: krov/%/README.md
lowdown -stman $< > $@
.dbs/: | $(ignore_file)
mkdir $@
splint_docs != grep -rl "^section:" splintrs
splintmans = $(splint_docs:splintrs/%/README.md=$(mandir)/%.6)
ignored += .dbs/
$(mandir)/%.6: splintrs/%/README.md
lowdown -stman $< > $@
$(query_formats): .dbs/%.txt: | .dbs/
echo "[ {{name}} ] -- $(basename $(@F)) --> [ {{$(basename $(@F))}} ]" > $@
setup_docs != grep -rl "^section:" setup
setupmans = $(setup_docs:setup/%.md=$(mandir)/%.6)
$(dotquery_formats): .dbs/%.dot: | .dbs/
echo '{{name}} -> {{$(basename $(@F))}} [ label="$(basename $(@F))" ];' > $@
$(mandir)/%.6: setup/%.md
lowdown -stman $< > $@
ifeq ($(graph_program),dot)
map_file = network.png
else
map_file = network.txt
endif
$(mandir):
mkdir -p $@
ignored += $(map_file)
$(kralmans) $(krovmans) $(splintmans) $(setupmans) :| $(mandir)
.PHONY: map
map: $(map_file) ## Generate a network map
.PHONY: pages
pages: $(kralmans) $(krovmans) $(setupmans) $(splintmans)
$(info $(kralmans))
@test ! $(command -v mandb) || mandb --user-db
$(info Open DMZ's man pages with 'man 6 <tab>')
network.txt: .dbs/network.txt
$(graph_cmd) < $<
.dbs/network.txt: network.rec $(query_formats)
$(RM) $@
$(foreach relation, $(queries), \
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).txt >> $@ ;\
)
.dbs/network.dot: network.rec $(dotquery_formats)
echo 'digraph network {' > $@
$(foreach relation, $(queries), \
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).dot >> $@ ;\
)
echo '}' >> $@
network.png: .dbs/network.dot $(ignore_file)
dot -T png < $< > $@
##########
$(ignore_file): $(MAKEFILE_LIST)
echo $(ignored) | tr ' ' '\n' > $@
clean:
$(RM) $(kralmans) $(krovmans)
$(RM) -r $(ignored)

View File

@ -2,6 +2,11 @@ These setup files provide the text-only configurations for DMZ.
*It should not contain private data.*
# Dependencies
- `recutils`
- (optional) `graph-easy` (the package may be called `perl-graph-easy`)
# Aspirations
- Each service should reside in its own directory.
@ -15,3 +20,60 @@ These setup files provide the text-only configurations for DMZ.
- Any maintenance scripts.
- Configurations should reside in shadow-directories, e.g. a backup `soft-serve`'s `config.yaml` should reside in this repo under `splint.rs/soft-serve/etc/soft/config.yaml`.
# Network Database
I have a half-baked plan to finally make use of plain-text databases, and it's already half-working.
Try these commands:
Ask what types of _rec_ords it contains:
## Database
```sh
recinf network.rec
```
### Select queries
Select with `recsel`, then specify the database (.rec) and type of record (like table in db).
- `--include-descriptors` or `-d`
- `--type` or `-t`
- `--expression` or `-e`
- `--quick` or `-q`
```sh
recsel network.rec --type router
recsel network.rec -d -t lxc
```
User `-q` for a `--quick` selection, or `-e` for more precise selections.
```sh
recsel network.rec --type lxc --quick wiki
recsel network.rec -t lxc -q nginx
recsel network.rec -t lxc -e "name ~ 'nginx'"
recsel network.rec -t lxc -e "name = 'nginx12'"
```
### Insert queries
Insert a new record with `recins`.
```sh
recins network.rec -t lxc -r "name: bob" -r "service: bob" -r "host: moxx"
```
### Update queries
If you can select something, you can also set its fields with `recset`.
Use `-f` to set the `--field`, and `-a` to `--add`, or `-s` to `--set`.
```sh
recset network.rec -t lxc -e "name = 'nginx12'" -f proxies -a soft-serve
recsel network.rec -t lxc -e "name = 'nginx11'" -p proxies[0]
recset network.rec -t lxc -e" name = 'nginx11'" -f proxies[0] -s wiki9
```

View File

@ -1,3 +1,5 @@
---
VMID: 114
---
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)

View File

@ -0,0 +1,56 @@
---
VMID: 103
---
[Wireguard VPN quickstart](https://www.wireguard.com/quickstart)
Check `dmzadmin` for `wireguard.gpg` to know who to contact for access
---
### Client config
Client config example
`x` is the assigned on the server as peer:
```conf
[Interface]
Address = 192.168.164.x/32
DNS = 1.1.1.1
MTU = 1420
SaveConfig = true
ListenPort = 51820
FwMark = 0xca6c
PrivateKey = <your_private_wg_key>
[Peer]
PublicKey = JP2FTHLUujkevz1kUymciLImsx1OX9ViUko7oPAIoiA=
AllowedIPs = 192.168.164.0/24, 192.168.1.0/24
Endpoint = 77.105.27.232:51820
PersistentKeepalive = 21
```
---
### Server config
New user/client needs to provide their wireguard `publickey` and new ip on the network needs to be assigned (`x`)
check the server config file `/etc/wireguard/wg0.conf` to find free address
```sh
sudo wg set wg0 peer <client_public_key> allowed-ips 192.168.164.x/32
```
---
Command to resolve IP clashing with current and wireguard network, if needed
```shell
ip route add <ip> dev <wg0>
```
- `ip` you want to resolve -> for wireguard VM 192.168.1.10
- `wg0` name of the wireguard config

View File

@ -0,0 +1,7 @@
---
VMID: 106
---
[Project page](https://cryptpad.org/)

View File

@ -0,0 +1,8 @@
---
VMID: 120
---
[Project page](https://privatebin.info/)
Hosted on [subdomain on dmz](https://pastebin.dmz.rs/)

View File

@ -0,0 +1,8 @@
---
VMID: 121
---
[Project git repo](https://github.com/searxng/searxng)
Hosted on [subdomain on dmz](https://search.dmz.rs/)

View File

@ -0,0 +1,5 @@
---
VMID: 100
---
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)

39
map.ge
View File

@ -1,39 +0,0 @@
# Network map of Decentrala. Use with:
# graph-easy --boxart < netmap.txt
(Mox
[ m_router ]{label: router ;}
[ wireguard ] --> [ m_nginx ]{label: nginx-11 ;}
[ wiki ] --> [ m_nginx ]
[ gitea ] --> [ m_nginx ]
[ tor11 ] --> [ m_nginx ] --> [ m_router ]
[ smtp ]
)
(Serverko
[ s_nginx ]{label: nginx-12 ;}
[ s_router ]{label: router ;}
[ s_nginx ] --> [ nextcloud ]
[ s_nginx ] --> [ tor12 ]
[ s_nginx ] --> [ s_router ]
)
(splint.rs # unimportant
[ soft-serve ] # unimportant
[ mail-cache ]# unimportant
) # unimportant
[ tor12 ] <..> [ onions ] <..> [ tor11 ]
[ m_router ] <..> [ BGP ] <..> [ madness ] <..> [ s_router ]
[ smtp ] <..> [ madness ]
[ madness ] <..> [ mail-cache ]# unimportant
[ A ]{label: "" ;}
[ B ]{label: "" ;}
[ C ]{label: "" ;}
[ D ]{label: "" ;}
[ onions ] <..> [ A ]
[ onions ] <..> [ B ]
[ A ] <..> [ C ]
[ B ] <..> [ D ]
(Sharks! [ D ])

88
network.rec Normal file
View File

@ -0,0 +1,88 @@
%rec: router
%doc: Routers, or possibly modems?
name: ISP Router
location: kralizec
ISP: Orion
name: ISP Router
location: krov
ISP: Yettel
%rec: host
%doc: These are the real machines, most of which run VMs or containters.
%key: name
name: moxx
location: kralizec
name: Serverko
location: krov
%rec: lxc
%doc: A container, usually on a Proxmox host.
%type: host rec host
name: nginx11
gateway: ISP-router
host: moxx
proxies: wiki11
proxies: gitea11
proxies: forum11
proxies: ejabberd11
proxies: dmzrs
name: LDAP
host: moxx
name: website
host: moxx
authqueries: LDAP
queries: postgresql11
service: dmzrs
service: flask accounts
name: gitea11
service: gitea
host: moxx
authqueries: LDAP
queries: postgresql11
name: ejabberd11
service: ejabberd
host: moxx
authqueries: LDAP
queries: postgresql11
name: forum11
service: forum
host: moxx
authqueries: LDAP
queries: postgresql11
name: postfix11
service: postfix
authqueries: LDAP
name: tor11
service: tor
host: moxx
name: postgresql11
service: postgresql
host: moxx
name: wiki11
service: wiki
host: moxx
authqueries: LDAP
name: nginx12
host: Serverko
name: nextcloud
host: Serverko
name: tor12
host: nginx

5
scripts/generatepass.sh Executable file
View File

@ -0,0 +1,5 @@
#!/bin/bash
echo $(shuf shared/english.txt | head) | sed "s/ //g"

View File

@ -1,62 +0,0 @@
#!/bin/sh
# If you want to add these passwords to the `pass` program, you can
# symlink all the passwords which you can open, then open the
# passwords with a script like this.
pass_store=~/.password-store
# THIS_PLACE="$PWD"
# mkdir $pass_store/dmz
# cd !$
# find "$THIS_PLACE" -type f -name "*.gpg" | \
# sed "s#/home/ghost#../..#" | \
# while read -r line; do
# gpg -d "$line" && ln -sf "$line" .
# done
sanity_check(){
command -v $1 >/dev/null || (
echo "You must install $1"
exit 1
)
}
set_selector_if_program_exists(){
command -v "$1" > /dev/null && selector="$1 $2"
}
if [ -z "$DISPLAY" ]; then
set_selector_if_program_exists sk || \
set_selector_if_program_exists fzy || \
set_selector_if_program_exists fzf
fail_sender='echo'
else
set_selector_if_program_exists "rofi" 'rofi -dmenu "$@"' || \
set_selector_if_program_exists dmenu || \
(
echo "Cannot find anything to select a key. Install dmenu."
exit 1
)
fail_sender='notify-send'
fi
list_keys(){
find -L . -mindepth 1 -type f -name "*.gpg" | \
sed 's/\.\///' | \
sed 's/.gpg//'
}
####################
set -e
sanity_check pass
cd "$pass_store"
password="$(list_keys | $selector)"
pass -c "$password" || $fail_sender 'Cannot decrypt'

View File

@ -56,7 +56,6 @@ Now all the files have 'read, write, and execute', but only for `$USER`.
Host soft
HostName soft.dmz.rs
Port 2222
User ghost
IdentityFile ~/.ssh/id rsa
Host dmz
HostName dmz.rs