forked from Decentrala/dmzconf
Compare commits
30 Commits
Author | SHA1 | Date | |
---|---|---|---|
2624425727 | |||
b872a25cc0 | |||
0b514b29e1 | |||
f398f52e55 | |||
cd9bdb80c1 | |||
aa65808edd | |||
1b09537f14 | |||
a829cce278 | |||
edb9f7b785 | |||
64f9f6ffa3 | |||
40a4064ddb | |||
763748322a | |||
fdb9cf9514 | |||
1d35d54af1 | |||
452970261e | |||
12644b80da | |||
4b9dae9b3a | |||
85479ec6ed | |||
9ff9633bc4 | |||
37b3d56676 | |||
0ecdda7302 | |||
f08d2838e3 | |||
0f58a26e60 | |||
76e9650abe | |||
624e8d2bfd | |||
c8282c82c5 | |||
c81ef26f4e | |||
dbd7f3dfd4 | |||
547ef14a31 | |||
e44620521f |
87
Makefile
87
Makefile
@ -1,58 +1,77 @@
|
||||
.PHONY: help
|
||||
|
||||
ignore_file = .git/info/exclude
|
||||
|
||||
|
||||
.PHONY: help
|
||||
help: ## Print the help message
|
||||
@awk 'BEGIN {FS = ":.*?## "} /^[0-9a-zA-Z._-]+:.*?## / {printf "\033[36m%s\033[0m : %s\n", $$1, $$2}' $(MAKEFILE_LIST) | \
|
||||
sort | \
|
||||
column -s ':' -t
|
||||
|
||||
map.txt: map.ge ## Making map.txt
|
||||
grep -v '# unimportant' $< | graph-easy --boxart > $@
|
||||
cat $@
|
||||
.PHONY: check
|
||||
check: ## Check you have all dependencies
|
||||
@command -v graph-easy >/dev/null || { echo "Install perl-graph-easy" && exit 1 ;}
|
||||
@command -v recsel >/dev/null || { echo "Install recutils" && exit 1 ;}
|
||||
@command -v lowdown >/dev/null || { echo "Install lowdown" && exit 1 ;}
|
||||
@echo "All dependencies installed"
|
||||
|
||||
full_map.txt: map.ge ## Generating full_map.txt with graph-easy
|
||||
graph-easy --boxart < $< > $@
|
||||
cat $@
|
||||
########## Network Map ##########
|
||||
|
||||
########## Man Pages ##########
|
||||
graph_program != type graph-easy > /dev/null && printf graph-easy || printf dot
|
||||
|
||||
mandir = $(HOME)/.local/man/man6
|
||||
graph_cmd = graph-easy --boxart
|
||||
|
||||
kralizec_docs != grep -rl "^section:" kralizec
|
||||
kralmans = $(kralizec_docs:kralizec/%/README.md=$(mandir)/%.6)
|
||||
queries = queries authqueries
|
||||
|
||||
$(mandir)/%.6: kralizec/%/README.md
|
||||
lowdown -stman $< > $@
|
||||
query_formats = $(patsubst %, .dbs/%.txt, $(queries))
|
||||
|
||||
krov_docs != grep -rl "^section:" krov
|
||||
krovmans = $(krov_docs:krov/%/README.md=$(mandir)/%.6)
|
||||
dotquery_formats = $(patsubst %, .dbs/%.dot, $(queries))
|
||||
|
||||
$(mandir)/%.6: krov/%/README.md
|
||||
lowdown -stman $< > $@
|
||||
.dbs/: | $(ignore_file)
|
||||
mkdir $@
|
||||
|
||||
splint_docs != grep -rl "^section:" splintrs
|
||||
splintmans = $(splint_docs:splintrs/%/README.md=$(mandir)/%.6)
|
||||
ignored += .dbs/
|
||||
|
||||
$(mandir)/%.6: splintrs/%/README.md
|
||||
lowdown -stman $< > $@
|
||||
$(query_formats): .dbs/%.txt: | .dbs/
|
||||
echo "[ {{name}} ] -- $(basename $(@F)) --> [ {{$(basename $(@F))}} ]" > $@
|
||||
|
||||
setup_docs != grep -rl "^section:" setup
|
||||
setupmans = $(setup_docs:setup/%.md=$(mandir)/%.6)
|
||||
$(dotquery_formats): .dbs/%.dot: | .dbs/
|
||||
echo '{{name}} -> {{$(basename $(@F))}} [ label="$(basename $(@F))" ];' > $@
|
||||
|
||||
$(mandir)/%.6: setup/%.md
|
||||
lowdown -stman $< > $@
|
||||
ifeq ($(graph_program),dot)
|
||||
map_file = network.png
|
||||
else
|
||||
map_file = network.txt
|
||||
endif
|
||||
|
||||
$(mandir):
|
||||
mkdir -p $@
|
||||
ignored += $(map_file)
|
||||
|
||||
$(kralmans) $(krovmans) $(splintmans) $(setupmans) :| $(mandir)
|
||||
.PHONY: map
|
||||
map: $(map_file) ## Generate a network map
|
||||
|
||||
.PHONY: pages
|
||||
pages: $(kralmans) $(krovmans) $(setupmans) $(splintmans)
|
||||
$(info $(kralmans))
|
||||
@test ! $(command -v mandb) || mandb --user-db
|
||||
$(info Open DMZ's man pages with 'man 6 <tab>')
|
||||
network.txt: .dbs/network.txt
|
||||
$(graph_cmd) < $<
|
||||
|
||||
.dbs/network.txt: network.rec $(query_formats)
|
||||
$(RM) $@
|
||||
$(foreach relation, $(queries), \
|
||||
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).txt >> $@ ;\
|
||||
)
|
||||
|
||||
.dbs/network.dot: network.rec $(dotquery_formats)
|
||||
echo 'digraph network {' > $@
|
||||
$(foreach relation, $(queries), \
|
||||
recsel $< -t lxc -e "$(relation) != ''" -p name,$(relation) | recfmt -f .dbs/$(relation).dot >> $@ ;\
|
||||
)
|
||||
echo '}' >> $@
|
||||
|
||||
network.png: .dbs/network.dot $(ignore_file)
|
||||
dot -T png < $< > $@
|
||||
|
||||
##########
|
||||
|
||||
$(ignore_file): $(MAKEFILE_LIST)
|
||||
echo $(ignored) | tr ' ' '\n' > $@
|
||||
|
||||
clean:
|
||||
$(RM) $(kralmans) $(krovmans)
|
||||
$(RM) -r $(ignored)
|
||||
|
62
README.md
62
README.md
@ -2,6 +2,11 @@ These setup files provide the text-only configurations for DMZ.
|
||||
|
||||
*It should not contain private data.*
|
||||
|
||||
# Dependencies
|
||||
|
||||
- `recutils`
|
||||
- (optional) `graph-easy` (the package may be called `perl-graph-easy`)
|
||||
|
||||
# Aspirations
|
||||
|
||||
- Each service should reside in its own directory.
|
||||
@ -15,3 +20,60 @@ These setup files provide the text-only configurations for DMZ.
|
||||
- Any maintenance scripts.
|
||||
- Configurations should reside in shadow-directories, e.g. a backup `soft-serve`'s `config.yaml` should reside in this repo under `splint.rs/soft-serve/etc/soft/config.yaml`.
|
||||
|
||||
# Network Database
|
||||
|
||||
I have a half-baked plan to finally make use of plain-text databases, and it's already half-working.
|
||||
Try these commands:
|
||||
|
||||
Ask what types of _rec_ords it contains:
|
||||
|
||||
## Database
|
||||
|
||||
```sh
|
||||
recinf network.rec
|
||||
```
|
||||
|
||||
### Select queries
|
||||
|
||||
Select with `recsel`, then specify the database (.rec) and type of record (like table in db).
|
||||
|
||||
- `--include-descriptors` or `-d`
|
||||
- `--type` or `-t`
|
||||
- `--expression` or `-e`
|
||||
- `--quick` or `-q`
|
||||
|
||||
```sh
|
||||
recsel network.rec --type router
|
||||
recsel network.rec -d -t lxc
|
||||
```
|
||||
|
||||
User `-q` for a `--quick` selection, or `-e` for more precise selections.
|
||||
|
||||
```sh
|
||||
recsel network.rec --type lxc --quick wiki
|
||||
recsel network.rec -t lxc -q nginx
|
||||
recsel network.rec -t lxc -e "name ~ 'nginx'"
|
||||
recsel network.rec -t lxc -e "name = 'nginx12'"
|
||||
```
|
||||
|
||||
### Insert queries
|
||||
|
||||
Insert a new record with `recins`.
|
||||
|
||||
```sh
|
||||
recins network.rec -t lxc -r "name: bob" -r "service: bob" -r "host: moxx"
|
||||
```
|
||||
|
||||
### Update queries
|
||||
|
||||
If you can select something, you can also set its fields with `recset`.
|
||||
|
||||
Use `-f` to set the `--field`, and `-a` to `--add`, or `-s` to `--set`.
|
||||
|
||||
|
||||
```sh
|
||||
recset network.rec -t lxc -e "name = 'nginx12'" -f proxies -a soft-serve
|
||||
recsel network.rec -t lxc -e "name = 'nginx11'" -p proxies[0]
|
||||
recset network.rec -t lxc -e" name = 'nginx11'" -f proxies[0] -s wiki9
|
||||
```
|
||||
|
||||
|
@ -1,3 +1,5 @@
|
||||
---
|
||||
VMID: 114
|
||||
---
|
||||
|
||||
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)
|
||||
|
56
kralizec/wireguard11/README.md
Normal file
56
kralizec/wireguard11/README.md
Normal file
@ -0,0 +1,56 @@
|
||||
---
|
||||
VMID: 103
|
||||
---
|
||||
|
||||
[Wireguard VPN quickstart](https://www.wireguard.com/quickstart)
|
||||
|
||||
Check `dmzadmin` for `wireguard.gpg` to know who to contact for access
|
||||
|
||||
---
|
||||
|
||||
### Client config
|
||||
|
||||
Client config example
|
||||
`x` is the assigned on the server as peer:
|
||||
|
||||
```conf
|
||||
|
||||
[Interface]
|
||||
Address = 192.168.164.x/32
|
||||
DNS = 1.1.1.1
|
||||
MTU = 1420
|
||||
SaveConfig = true
|
||||
ListenPort = 51820
|
||||
FwMark = 0xca6c
|
||||
PrivateKey = <your_private_wg_key>
|
||||
|
||||
[Peer]
|
||||
PublicKey = JP2FTHLUujkevz1kUymciLImsx1OX9ViUko7oPAIoiA=
|
||||
AllowedIPs = 192.168.164.0/24, 192.168.1.0/24
|
||||
Endpoint = 77.105.27.232:51820
|
||||
PersistentKeepalive = 21
|
||||
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Server config
|
||||
|
||||
New user/client needs to provide their wireguard `publickey` and new ip on the network needs to be assigned (`x`)
|
||||
check the server config file `/etc/wireguard/wg0.conf` to find free address
|
||||
|
||||
```sh
|
||||
sudo wg set wg0 peer <client_public_key> allowed-ips 192.168.164.x/32
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
Command to resolve IP clashing with current and wireguard network, if needed
|
||||
|
||||
```shell
|
||||
ip route add <ip> dev <wg0>
|
||||
```
|
||||
|
||||
- `ip` you want to resolve -> for wireguard VM 192.168.1.10
|
||||
- `wg0` name of the wireguard config
|
||||
|
7
krov/srv1/cryptpad/README.md
Normal file
7
krov/srv1/cryptpad/README.md
Normal file
@ -0,0 +1,7 @@
|
||||
---
|
||||
VMID: 106
|
||||
---
|
||||
|
||||
[Project page](https://cryptpad.org/)
|
||||
|
||||
|
8
krov/srv1/privatebin/README.md
Normal file
8
krov/srv1/privatebin/README.md
Normal file
@ -0,0 +1,8 @@
|
||||
---
|
||||
VMID: 120
|
||||
---
|
||||
|
||||
[Project page](https://privatebin.info/)
|
||||
|
||||
Hosted on [subdomain on dmz](https://pastebin.dmz.rs/)
|
||||
|
8
krov/srv1/searxng/README.md
Normal file
8
krov/srv1/searxng/README.md
Normal file
@ -0,0 +1,8 @@
|
||||
---
|
||||
VMID: 121
|
||||
---
|
||||
|
||||
[Project git repo](https://github.com/searxng/searxng)
|
||||
|
||||
Hosted on [subdomain on dmz](https://search.dmz.rs/)
|
||||
|
5
krov/srv1/ssh12/README.md
Normal file
5
krov/srv1/ssh12/README.md
Normal file
@ -0,0 +1,5 @@
|
||||
---
|
||||
VMID: 100
|
||||
---
|
||||
|
||||
[wiki page](https://wiki.dmz.rs/en/sysadmin/ssh)
|
39
map.ge
39
map.ge
@ -1,39 +0,0 @@
|
||||
# Network map of Decentrala. Use with:
|
||||
# graph-easy --boxart < netmap.txt
|
||||
|
||||
(Mox
|
||||
[ m_router ]{label: router ;}
|
||||
[ wireguard ] --> [ m_nginx ]{label: nginx-11 ;}
|
||||
[ wiki ] --> [ m_nginx ]
|
||||
[ gitea ] --> [ m_nginx ]
|
||||
[ tor11 ] --> [ m_nginx ] --> [ m_router ]
|
||||
[ smtp ]
|
||||
)
|
||||
|
||||
(Serverko
|
||||
[ s_nginx ]{label: nginx-12 ;}
|
||||
[ s_router ]{label: router ;}
|
||||
[ s_nginx ] --> [ nextcloud ]
|
||||
[ s_nginx ] --> [ tor12 ]
|
||||
[ s_nginx ] --> [ s_router ]
|
||||
)
|
||||
|
||||
(splint.rs # unimportant
|
||||
[ soft-serve ] # unimportant
|
||||
[ mail-cache ]# unimportant
|
||||
) # unimportant
|
||||
|
||||
[ tor12 ] <..> [ onions ] <..> [ tor11 ]
|
||||
[ m_router ] <..> [ BGP ] <..> [ madness ] <..> [ s_router ]
|
||||
[ smtp ] <..> [ madness ]
|
||||
[ madness ] <..> [ mail-cache ]# unimportant
|
||||
[ A ]{label: "" ;}
|
||||
[ B ]{label: "" ;}
|
||||
[ C ]{label: "" ;}
|
||||
[ D ]{label: "" ;}
|
||||
[ onions ] <..> [ A ]
|
||||
[ onions ] <..> [ B ]
|
||||
[ A ] <..> [ C ]
|
||||
[ B ] <..> [ D ]
|
||||
|
||||
(Sharks! [ D ])
|
88
network.rec
Normal file
88
network.rec
Normal file
@ -0,0 +1,88 @@
|
||||
%rec: router
|
||||
%doc: Routers, or possibly modems?
|
||||
|
||||
name: ISP Router
|
||||
location: kralizec
|
||||
ISP: Orion
|
||||
|
||||
name: ISP Router
|
||||
location: krov
|
||||
ISP: Yettel
|
||||
|
||||
%rec: host
|
||||
%doc: These are the real machines, most of which run VMs or containters.
|
||||
%key: name
|
||||
|
||||
name: moxx
|
||||
location: kralizec
|
||||
|
||||
name: Serverko
|
||||
location: krov
|
||||
|
||||
%rec: lxc
|
||||
%doc: A container, usually on a Proxmox host.
|
||||
%type: host rec host
|
||||
|
||||
name: nginx11
|
||||
gateway: ISP-router
|
||||
host: moxx
|
||||
proxies: wiki11
|
||||
proxies: gitea11
|
||||
proxies: forum11
|
||||
proxies: ejabberd11
|
||||
proxies: dmzrs
|
||||
|
||||
name: LDAP
|
||||
host: moxx
|
||||
|
||||
name: website
|
||||
host: moxx
|
||||
authqueries: LDAP
|
||||
queries: postgresql11
|
||||
service: dmzrs
|
||||
service: flask accounts
|
||||
|
||||
name: gitea11
|
||||
service: gitea
|
||||
host: moxx
|
||||
authqueries: LDAP
|
||||
queries: postgresql11
|
||||
|
||||
name: ejabberd11
|
||||
service: ejabberd
|
||||
host: moxx
|
||||
authqueries: LDAP
|
||||
queries: postgresql11
|
||||
|
||||
name: forum11
|
||||
service: forum
|
||||
host: moxx
|
||||
authqueries: LDAP
|
||||
queries: postgresql11
|
||||
|
||||
name: postfix11
|
||||
service: postfix
|
||||
authqueries: LDAP
|
||||
|
||||
name: tor11
|
||||
service: tor
|
||||
host: moxx
|
||||
|
||||
name: postgresql11
|
||||
service: postgresql
|
||||
host: moxx
|
||||
|
||||
name: wiki11
|
||||
service: wiki
|
||||
host: moxx
|
||||
authqueries: LDAP
|
||||
|
||||
name: nginx12
|
||||
host: Serverko
|
||||
|
||||
name: nextcloud
|
||||
host: Serverko
|
||||
|
||||
name: tor12
|
||||
host: nginx
|
||||
|
5
scripts/generatepass.sh
Executable file
5
scripts/generatepass.sh
Executable file
@ -0,0 +1,5 @@
|
||||
|
||||
#!/bin/bash
|
||||
|
||||
echo $(shuf shared/english.txt | head) | sed "s/ //g"
|
||||
|
@ -1,62 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
# If you want to add these passwords to the `pass` program, you can
|
||||
# symlink all the passwords which you can open, then open the
|
||||
# passwords with a script like this.
|
||||
|
||||
pass_store=~/.password-store
|
||||
|
||||
# THIS_PLACE="$PWD"
|
||||
# mkdir $pass_store/dmz
|
||||
# cd !$
|
||||
# find "$THIS_PLACE" -type f -name "*.gpg" | \
|
||||
# sed "s#/home/ghost#../..#" | \
|
||||
# while read -r line; do
|
||||
# gpg -d "$line" && ln -sf "$line" .
|
||||
# done
|
||||
|
||||
|
||||
sanity_check(){
|
||||
command -v $1 >/dev/null || (
|
||||
echo "You must install $1"
|
||||
exit 1
|
||||
)
|
||||
}
|
||||
|
||||
set_selector_if_program_exists(){
|
||||
command -v "$1" > /dev/null && selector="$1 $2"
|
||||
}
|
||||
|
||||
if [ -z "$DISPLAY" ]; then
|
||||
set_selector_if_program_exists sk || \
|
||||
set_selector_if_program_exists fzy || \
|
||||
set_selector_if_program_exists fzf
|
||||
fail_sender='echo'
|
||||
else
|
||||
set_selector_if_program_exists "rofi" 'rofi -dmenu "$@"' || \
|
||||
set_selector_if_program_exists dmenu || \
|
||||
(
|
||||
echo "Cannot find anything to select a key. Install dmenu."
|
||||
exit 1
|
||||
)
|
||||
fail_sender='notify-send'
|
||||
fi
|
||||
|
||||
list_keys(){
|
||||
find -L . -mindepth 1 -type f -name "*.gpg" | \
|
||||
sed 's/\.\///' | \
|
||||
sed 's/.gpg//'
|
||||
}
|
||||
|
||||
####################
|
||||
|
||||
set -e
|
||||
|
||||
sanity_check pass
|
||||
|
||||
cd "$pass_store"
|
||||
|
||||
password="$(list_keys | $selector)"
|
||||
|
||||
pass -c "$password" || $fail_sender 'Cannot decrypt'
|
||||
|
@ -56,7 +56,6 @@ Now all the files have 'read, write, and execute', but only for `$USER`.
|
||||
Host soft
|
||||
HostName soft.dmz.rs
|
||||
Port 2222
|
||||
User ghost
|
||||
IdentityFile ~/.ssh/id rsa
|
||||
Host dmz
|
||||
HostName dmz.rs
|
||||
|
Loading…
x
Reference in New Issue
Block a user