From a7bcde41783b170773277c3832b95838966e743e Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 18:40:58 +0200 Subject: [PATCH 001/129] safely create .ssh folder --- install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install.sh b/install.sh index 1a0dfb1..d78885e 100755 --- a/install.sh +++ b/install.sh @@ -155,7 +155,7 @@ PS3="Select the Server-Function: " pct start $LXC_NBR; sleep 5; # Set the root ssh key -pct exec $LXC_NBR -- mkdir /root/.ssh +pct exec $LXC_NBR -- mkdir -p /root/.ssh pct push $LXC_NBR $LXC_AUTHORIZED_KEY /root/.ssh/authorized_keys pct push $LXC_NBR "$config" /root/zamba.conf pct exec $LXC_NBR -- sed -i "s,\${service},${service}," /root/zamba.conf From a33ad43a5054677b6a12a8d570f4cfb72c080991 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 18:42:45 +0200 Subject: [PATCH 002/129] Add debian bookworm sources --- src/lxc-base.sh | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/src/lxc-base.sh b/src/lxc-base.sh index d26954f..67140f8 100644 --- a/src/lxc-base.sh +++ b/src/lxc-base.sh @@ -24,27 +24,39 @@ EOF locale-gen $LXC_LOCALE # Generate sources -if [ "$LXC_TEMPLATE_VERSION" == "debian-11-standard" ] ; then +if [ "$LXC_TEMPLATE_VERSION" == "debian-10-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://debian.inf.tu-dresden.de/debian bullseye main contrib +deb http://ftp.halifax.rwth-aachen.de/debian/ buster main contrib -deb http://debian.inf.tu-dresden.de/debian bullseye-updates main contrib +deb http://ftp.halifax.rwth-aachen.de/debian/ buster-updates main contrib # security updates -deb http://debian.inf.tu-dresden.de/debian-security bullseye-security main contrib +deb http://security.debian.org/debian-security buster/updates main contrib EOF -elif [ "$LXC_TEMPLATE_VERSION" == "debian-10-standard" ] ; then +elif [ "$LXC_TEMPLATE_VERSION" == "debian-11-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://debian.inf.tu-dresden.de/debian buster main contrib +deb http://ftp.halifax.rwth-aachen.de/debian/ bullseye main contrib -deb http://debian.inf.tu-dresden.de/debian buster-updates main contrib +deb http://ftp.halifax.rwth-aachen.de/debian/ bullseye-updates main contrib # security updates -deb http://debian.inf.tu-dresden.de/debian-security buster/updates main contrib +deb http://security.debian.org/debian-security bullseye-security main contrib EOF + +elif [ "$LXC_TEMPLATE_VERSION" == "debian-12-standard" ] ; then + +cat << EOF > /etc/apt/sources.list +deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm main contrib + +deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-updates main contrib + +# security updates +deb http://security.debian.org/debian-security bookworm-security main contrib +EOF + else echo "LXC Debian Version false. Please check configuration files!" ; exit fi From 59220ac477423b0dfd428f0f2f8d67cbf0f0b689 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 18:43:43 +0200 Subject: [PATCH 003/129] Safely create folders --- src/bookstack/install-service.sh | 2 +- src/kimai/install-service.sh | 2 +- src/matrix/install-service.sh | 2 +- src/onlyoffice/install-service.sh | 2 +- src/open3a/install-service.sh | 2 +- src/urbackup/install-service.sh | 4 ++-- src/vaultwarden/install-service.sh | 2 +- src/zmb-member/install-service.sh | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/bookstack/install-service.sh b/src/bookstack/install-service.sh index 1ac181a..00d0626 100644 --- a/src/bookstack/install-service.sh +++ b/src/bookstack/install-service.sh @@ -20,7 +20,7 @@ DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq zip u wget -O /opt/wkhtmltox_0.12.6-1.buster_amd64.deb https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6-1/wkhtmltox_0.12.6-1.buster_amd64.deb DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq /opt/wkhtmltox_0.12.6-1.buster_amd64.deb -mkdir /etc/nginx/ssl +mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/open3a.key -out /etc/nginx/ssl/open3a.crt -subj "/CN=$LXC_HOSTNAME.$LXC_DOMAIN" -addext "subjectAltName=DNS:$LXC_HOSTNAME.$LXC_DOMAIN" PHP_VERSION=$(php -v | head -1 | cut -d ' ' -f2) diff --git a/src/kimai/install-service.sh b/src/kimai/install-service.sh index c07e4ed..95f9fd1 100644 --- a/src/kimai/install-service.sh +++ b/src/kimai/install-service.sh @@ -21,7 +21,7 @@ apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq zip unzip sudo nginx-full mariadb-server mariadb-client php8.1 php8.1-intl php8.1-cli php8.1-fpm php8.1-mysql php8.1-xml php8.1-mbstring php8.1-gd php8.1-tokenizer php8.1-zip php8.1-opcache php8.1-curl -mkdir /etc/nginx/ssl +mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/kimai.key -out /etc/nginx/ssl/kimai.crt -subj "/CN=$LXC_HOSTNAME.$LXC_DOMAIN" -addext "subjectAltName=DNS:$LXC_HOSTNAME.$LXC_DOMAIN" PHP_VERSION=$(php -v | head -1 | cut -d ' ' -f2) diff --git a/src/matrix/install-service.sh b/src/matrix/install-service.sh index 343ac0f..6605ab7 100644 --- a/src/matrix/install-service.sh +++ b/src/matrix/install-service.sh @@ -27,7 +27,7 @@ systemctl enable matrix-synapse ss -tulpen -mkdir /etc/nginx/ssl +mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/matrix.key -out /etc/nginx/ssl/matrix.crt -subj "/CN=$MATRIX_FQDN" -addext "subjectAltName=DNS:$MATRIX_FQDN" cat > /etc/nginx/sites-available/$MATRIX_FQDN < /etc/nginx/sites-available/default diff --git a/src/urbackup/install-service.sh b/src/urbackup/install-service.sh index e35ddcf..64e0f34 100644 --- a/src/urbackup/install-service.sh +++ b/src/urbackup/install-service.sh @@ -11,7 +11,7 @@ source /root/constants-service.conf mkdir -p /$LXC_SHAREFS_MOUNTPOINT/tmp mkdir -p /$LXC_SHAREFS_MOUNTPOINT/$URBACKUP_DATA -mkdir /etc/urbackup +mkdir -p /etc/urbackup echo "/$LXC_SHAREFS_MOUNTPOINT/$URBACKUP_DATA" > /etc/urbackup/backupfolder echo "deb http://download.opensuse.org/repositories/home:/uroni/$REPO_CODENAME/ /" | tee /etc/apt/sources.list.d/urbackup.list @@ -20,7 +20,7 @@ curl -fsSL https://download.opensuse.org/repositories/home:uroni/$REPO_CODENAME/ apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y --no-install-recommends -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" urbackup-server nginx -mkdir /etc/nginx/ssl +mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/urbackup.key -out /etc/nginx/ssl/urbackup.crt -subj "/CN=$LXC_HOSTNAME.$LXC_DOMAIN" -addext "subjectAltName=DNS:$LXC_HOSTNAME.$LXC_DOMAIN" ln -s /usr/share/urbackup/www /var/www/urbackup diff --git a/src/vaultwarden/install-service.sh b/src/vaultwarden/install-service.sh index bee4f3c..42a7b4e 100644 --- a/src/vaultwarden/install-service.sh +++ b/src/vaultwarden/install-service.sh @@ -18,7 +18,7 @@ systemctl enable --now postgresql wget https://raw.githubusercontent.com/jjlin/docker-image-extract/main/docker-image-extract chmod +x docker-image-extract ./docker-image-extract vaultwarden/server:alpine -mkdir /opt/vaultwarden +mkdir -p /opt/vaultwarden mkdir -p /var/lib/vaultwarden/data useradd vaultwarden chown -R vaultwarden:vaultwarden /var/lib/vaultwarden diff --git a/src/zmb-member/install-service.sh b/src/zmb-member/install-service.sh index 2dd69c3..2932abc 100644 --- a/src/zmb-member/install-service.sh +++ b/src/zmb-member/install-service.sh @@ -98,7 +98,7 @@ systemctl restart winbind nmbd wbinfo -u wbinfo -g -mkdir /$LXC_SHAREFS_MOUNTPOINT/$ZMB_SHARE +mkdir -p /$LXC_SHAREFS_MOUNTPOINT/$ZMB_SHARE # originally 'domain users' was set, added variable for domain admins group, samba wiki recommends separate group e.g. 'unix admins' chown "${ZMB_ADMIN_USER@L}" /$LXC_SHAREFS_MOUNTPOINT/$ZMB_SHARE From c6f1e0608442820c4d8a6263c960fb3d3680435a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 19:22:08 +0200 Subject: [PATCH 004/129] Fix #82, migrate bookstack to debian bookworm --- src/bookstack/constants-service.conf | 2 +- src/bookstack/install-service.sh | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/bookstack/constants-service.conf b/src/bookstack/constants-service.conf index 6e865bd..384ed69 100644 --- a/src/bookstack/constants-service.conf +++ b/src/bookstack/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/bookstack/install-service.sh b/src/bookstack/install-service.sh index 00d0626..fa5acd1 100644 --- a/src/bookstack/install-service.sh +++ b/src/bookstack/install-service.sh @@ -16,9 +16,9 @@ webroot=/var/www/bookstack/public apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq zip unzip nginx-full mariadb-server mariadb-client php php-cli php-fpm php-mysql php-xml php-mbstring php-gd php-tokenizer php-xml php-dompdf php-curl php-ldap php-tidy php-zip redis-server -wget -O /opt/wkhtmltox_0.12.6-1.buster_amd64.deb https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6-1/wkhtmltox_0.12.6-1.buster_amd64.deb -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq /opt/wkhtmltox_0.12.6-1.buster_amd64.deb +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends zip unzip nginx-full mariadb-server mariadb-client php php-cli php-fpm php-mysql php-xml php-mbstring php-gd php-tokenizer php-xml php-dompdf php-curl php-ldap php-tidy php-zip redis-server +curl -s https://api.github.com/repos/wkhtmltopdf/packaging/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'bookworm_amd64.deb$' | wget -O /opt/wkhtmltox.deb -i - +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends /opt/wkhtmltox.deb mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/open3a.key -out /etc/nginx/ssl/open3a.crt -subj "/CN=$LXC_HOSTNAME.$LXC_DOMAIN" -addext "subjectAltName=DNS:$LXC_HOSTNAME.$LXC_DOMAIN" @@ -106,9 +106,9 @@ CREATE DATABASE IF NOT EXISTS bookstack; GRANT ALL PRIVILEGES ON bookstack.* TO 'bookstack'@'localhost' IDENTIFIED BY '$BOOKSTACK_DB_PWD'; FLUSH PRIVILEGES;" -sed -i "s/post_max_size = 8M/post_max_size = 100M/g" /etc/php/7.4/fpm/php.ini -sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 100M/g" /etc/php/7.4/fpm/php.ini -sed -i "s/memory_limit = 128M/memory_limit = 512M/g" /etc/php/7.4/fpm/php.ini +sed -i "s/post_max_size = 8M/post_max_size = 100M/g" /etc/php/${PHP_VERSION:0:3}/fpm/php.ini +sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 100M/g" /etc/php/${PHP_VERSION:0:3}/fpm/php.ini +sed -i "s/memory_limit = 128M/memory_limit = 512M/g" /etc/php/${PHP_VERSION:0:3}/fpm/php.ini EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')" php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" @@ -178,8 +178,8 @@ WantedBy=multi-user.target EOF systemctl daemon-reload -systemctl enable --now bookstack-queue php7.4-fpm nginx redis-server -systemctl restart php7.4-fpm nginx bookstack-queue redis-server +systemctl enable --now bookstack-queue php${PHP_VERSION:0:3}-fpm nginx redis-server +systemctl restart php${PHP_VERSION:0:3}-fpm nginx bookstack-queue redis-server LXC_IP=$(ip address show dev eth0 | grep "inet " | cut -d ' ' -f6) From d51f6a4f10b60ebb288ddf0c8137b0b60a1cb3a4 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 19:26:16 +0200 Subject: [PATCH 005/129] Checkmk Version 2.2p04 --- src/checkmk/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index 0ba9409..24b5009 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -20,7 +20,7 @@ LXC_UNPRIVILEGED="1" LXC_NESTING="1" # checkmk version -CMK_VERSION=2.1.0p21 +CMK_VERSION=2.2.0p4 # build number of the debian package (needs to start with underscore) CMK_BUILD=_0 From cd0ee573abb9ba81ec7d66bbce235642b971f14a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 19:37:13 +0200 Subject: [PATCH 006/129] Debian bookworm for debian-priv and debian-unpriv --- src/debian-priv/constants-service.conf | 2 +- src/debian-unpriv/constants-service.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/debian-priv/constants-service.conf b/src/debian-priv/constants-service.conf index 6c4691a..2474bf3 100644 --- a/src/debian-priv/constants-service.conf +++ b/src/debian-priv/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/debian-unpriv/constants-service.conf b/src/debian-unpriv/constants-service.conf index 7e5a29b..0bdacfe 100644 --- a/src/debian-unpriv/constants-service.conf +++ b/src/debian-unpriv/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" From effbf224aa0bccd4ad5030180a01f1344c0bd2ae Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 20:43:21 +0200 Subject: [PATCH 007/129] Migrate gitea to debian bookworm --- src/gitea/constants-service.conf | 2 +- src/gitea/install-service.sh | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/src/gitea/constants-service.conf b/src/gitea/constants-service.conf index 4019690..513daa3 100644 --- a/src/gitea/constants-service.conf +++ b/src/gitea/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" diff --git a/src/gitea/install-service.sh b/src/gitea/install-service.sh index c49eba5..1f9169d 100644 --- a/src/gitea/install-service.sh +++ b/src/gitea/install-service.sh @@ -9,11 +9,11 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -wget -q -O - https://nginx.org/keys/nginx_signing.key | apt-key add - -echo "deb http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list +#wget -q -O - https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx.key +#echo "deb http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list -wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - -echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list +#wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.key +#echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list apt update @@ -120,6 +120,10 @@ chown -R root:git /etc/gitea chmod 770 /etc/gitea chmod 770 /etc/gitea/app.ini +if [ -f /etc/nginx/sites-enabled/default ]; then + unlink /etc/nginx/sites-enabled/default +fi + cat << EOF > /etc/nginx/conf.d/default.conf server { listen 80; From 60366677d4d216106a29071c1811c9036db9e303 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 24 Jun 2023 21:44:21 +0200 Subject: [PATCH 008/129] Migrate kimai to debian bookworm --- src/kimai/constants-service.conf | 6 +++--- src/kimai/install-service.sh | 23 ++++++++++++++--------- 2 files changed, 17 insertions(+), 12 deletions(-) diff --git a/src/kimai/constants-service.conf b/src/kimai/constants-service.conf index 12d6e1d..c4ceb4e 100644 --- a/src/kimai/constants-service.conf +++ b/src/kimai/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" @@ -20,10 +20,10 @@ LXC_UNPRIVILEGED="1" LXC_NESTING="1" # Defines the version number of kimai mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') -KIMAI_VERSION="main" +#KIMAI_VERSION="main" # Defines the php version to install -KIMAI_PHP_VERSION="8.1" +KIMAI_PHP_VERSION="8.2" # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/kimai/install-service.sh b/src/kimai/install-service.sh index 95f9fd1..ee941f7 100644 --- a/src/kimai/install-service.sh +++ b/src/kimai/install-service.sh @@ -14,12 +14,12 @@ source /root/constants-service.conf KIMAI_DB_PWD=$(random_password) webroot=/var/www/kimai/public -wget -q -O - https://packages.sury.org/php/apt.gpg | apt-key add - -echo "deb https://packages.sury.org/php/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/php.list +#wget -q -O - https://packages.sury.org/php/apt.gpg | apt-key add - +#echo "deb https://packages.sury.org/php/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/php.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq zip unzip sudo nginx-full mariadb-server mariadb-client php8.1 php8.1-intl php8.1-cli php8.1-fpm php8.1-mysql php8.1-xml php8.1-mbstring php8.1-gd php8.1-tokenizer php8.1-zip php8.1-opcache php8.1-curl +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq zip unzip sudo nginx-full mariadb-server mariadb-client php${KIMAI_PHP_VERSION} php${KIMAI_PHP_VERSION}-intl php${KIMAI_PHP_VERSION}-cli php${KIMAI_PHP_VERSION}-fpm php${KIMAI_PHP_VERSION}-mysql php${KIMAI_PHP_VERSION}-xml php${KIMAI_PHP_VERSION}-mbstring php${KIMAI_PHP_VERSION}-gd php${KIMAI_PHP_VERSION}-tokenizer php${KIMAI_PHP_VERSION}-zip php${KIMAI_PHP_VERSION}-opcache php${KIMAI_PHP_VERSION}-curl mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/kimai.key -out /etc/nginx/ssl/kimai.crt -subj "/CN=$LXC_HOSTNAME.$LXC_DOMAIN" -addext "subjectAltName=DNS:$LXC_HOSTNAME.$LXC_DOMAIN" @@ -132,7 +132,12 @@ rm composer-setup.php mv composer.phar /usr/local/bin/composer cd /var/www -git clone https://github.com/kimai/kimai.git --branch $KIMAI_VERSION --depth 1 +dl=$(curl -s https://api.github.com/repos/kimai/kimai/releases/latest | grep tarball_url | cut -d'"' -f4) +version=$(echo $dl | rev | cut -d'/' -f1 | rev) +wget -O kimai-${version}.tar.gz ${dl} +tar xfz kimai-${version}.tar.gz +rm kimai-${version}.tar.gz +mv kimai-* kimai cd kimai # Install kimai composer dependencies @@ -142,7 +147,7 @@ export COMPOSER_ALLOW_SUPERUSER=1 # Copy and update kimai environment variables cat << EOF > .env # For more infos about the variables, see .env.dist -DATABASE_URL=mysql://kimai:$KIMAI_DB_PWD@localhost:3306/kimai?charset=utf8&serverVersion=mariadb-10.5.8 +DATABASE_URL=mysql://kimai:$KIMAI_DB_PWD@localhost:3306/kimai?charset=utf8&serverVersion=mariadb-10.11.3 MAILER_FROM=admin@$LXC_DOMAIN MAILER_URL=null://null APP_ENV=prod @@ -150,14 +155,14 @@ APP_SECRET=$(random_password) CORS_ALLOW_ORIGIN=^https?://localhost(:[0-9]+)?$ EOF -chown -R www-data:www-data . -chmod -R g+r . -chmod -R g+rw var/ - bin/console kimai:install -n bin/console kimai:user:create admin admin@$LXC_DOMAIN ROLE_SUPER_ADMIN $LXC_PWD +chown -R www-data:www-data . +chmod -R g+r . +chmod -R g+rw var/ + systemctl daemon-reload systemctl enable --now php${PHP_VERSION}-fpm nginx systemctl restart php${PHP_VERSION}-fpm nginx From 788b09c391013255f1c0f154f482d7e727fb9a5d Mon Sep 17 00:00:00 2001 From: Danny Nakielski Date: Sun, 25 Jun 2023 01:43:55 +0200 Subject: [PATCH 009/129] Migrate Nextcloud to debian bookworm --- src/nextcloud/constants-service.conf | 4 ++-- src/nextcloud/install-service.sh | 24 ++++++++++++++++++------ 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/src/nextcloud/constants-service.conf b/src/nextcloud/constants-service.conf index 51f9a33..c9825e5 100644 --- a/src/nextcloud/constants-service.conf +++ b/src/nextcloud/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" @@ -23,7 +23,7 @@ LXC_NESTING="1" NEXTCLOUD_VERSION="latest" # Defines the php version to install -NEXTCLOUD_PHP_VERSION="8.1" +NEXTCLOUD_PHP_VERSION="8.2" # Defines the IP from the SQL server NEXTCLOUD_DB_IP="127.0.0.1" diff --git a/src/nextcloud/install-service.sh b/src/nextcloud/install-service.sh index 79d65c6..95f7022 100644 --- a/src/nextcloud/install-service.sh +++ b/src/nextcloud/install-service.sh @@ -14,13 +14,13 @@ source /root/constants-service.conf HOSTNAME=$(hostname -f) -wget -q -O - https://packages.sury.org/php/apt.gpg | apt-key add - +wget -q -O - https://packages.sury.org/php/apt.gpg | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/sury-php.gpg >/dev/null echo "deb https://packages.sury.org/php/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/php.list -wget -q -O - https://nginx.org/keys/nginx_signing.key | apt-key add - +wget -q -O - https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx.gpg >/dev/null echo "deb http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list -wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - +wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.gpg >/dev/null echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list apt update @@ -76,7 +76,7 @@ sed -i "s/;session.cookie_secure.*/session.cookie_secure = True/" /etc/php/$NEXT sed -i "s/;opcache.enable=.*/opcache.enable=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.enable_cli=.*/opcache.enable_cli=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.memory_consumption=.*/opcache.memory_consumption=128/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini -sed -i "s/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=8/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini +sed -i "s/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=16/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=10000/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.revalidate_freq=.*/opcache.revalidate_freq=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.save_comments=.*/opcache.save_comments=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini @@ -113,6 +113,9 @@ set_real_ip_from 127.0.0.1; real_ip_header X-Forwarded-For; real_ip_recursive on; include /etc/nginx/mime.types; +types { + text/javascript mjs; + } default_type application/octet-stream; sendfile on; send_timeout 3600; @@ -136,6 +139,10 @@ cat > /etc/nginx/conf.d/http.conf << EOF upstream php-handler { server unix:/run/php/php$NEXTCLOUD_PHP_VERSION-fpm.sock; } +map \$arg_v \$asset_immutable { + "" ""; + default "immutable"; +} server { listen 80 default_server; listen [::]:80 default_server; @@ -171,13 +178,15 @@ ssl_prefer_server_ciphers on; ssl_stapling on; ssl_stapling_verify on; client_max_body_size 5120M; +client_body_timeout 300s; +client_body_buffer_size 512k; fastcgi_buffers 64 4K; gzip on; gzip_vary on; gzip_comp_level 4; gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; -gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; +gzip_types application/atom+xml text/javascript application/wasm application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; add_header Permissions-Policy "interest-cohort=()"; add_header Referrer-Policy "no-referrer" always; @@ -230,10 +239,13 @@ fastcgi_pass php-handler; fastcgi_intercept_errors on; fastcgi_request_buffering off; } -location ~ \.(?:css|js|svg|gif)\$ { +location ~ \.(?:css|js|mjs|svg|gif|ico|wasm|tflite|map)\$ { try_files \$uri /index.php\$request_uri; expires 6M; access_log off; + location ~ \.wasm$ { + default_type application/wasm; + } } location ~ \.woff2?\$ { try_files \$uri /index.php\$request_uri; From 713219b6d5d0a8d39e38f8c81fffb3ff7e623a12 Mon Sep 17 00:00:00 2001 From: Danny Nakielski Date: Sun, 25 Jun 2023 03:20:24 +0200 Subject: [PATCH 010/129] Upgrade Nextcloud to Postgresql 15 --- src/nextcloud/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/nextcloud/install-service.sh b/src/nextcloud/install-service.sh index 95f7022..3a62f40 100644 --- a/src/nextcloud/install-service.sh +++ b/src/nextcloud/install-service.sh @@ -26,7 +26,7 @@ echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends tree locate screen zip ffmpeg ghostscript libfile-fcntllock-perl libfuse2 socat fail2ban ldap-utils cifs-utils redis-server imagemagick libmagickcore-6.q16-6-extra \ -postgresql-13 nginx php$NEXTCLOUD_PHP_VERSION-{fpm,gd,mysql,pgsql,curl,xml,zip,intl,mbstring,bz2,ldap,apcu,bcmath,gmp,imagick,igbinary,redis,dev,smbclient,cli,common,opcache,readline} +postgresql-15 nginx php$NEXTCLOUD_PHP_VERSION-{fpm,gd,mysql,pgsql,curl,xml,zip,intl,mbstring,bz2,ldap,apcu,bcmath,gmp,imagick,igbinary,redis,dev,smbclient,cli,common,opcache,readline} timedatectl set-timezone $LXC_TIMEZONE mkdir -p /$LXC_SHAREFS_MOUNTPOINT/$NEXTCLOUD_DATA /var/www From 806cc1c604c1285ebbca1836f80fc3481422bbbd Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 25 Jun 2023 08:32:01 +0200 Subject: [PATCH 011/129] Fixed #83 --- install.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/install.sh b/install.sh index d78885e..b504d9f 100755 --- a/install.sh +++ b/install.sh @@ -131,7 +131,9 @@ fi echo "Will now create LXC Container $LXC_NBR!"; # Create the container +set +u pct create $LXC_NBR $TAGS --password $LXC_PWD -unprivileged $LXC_UNPRIVILEGED $LXC_TEMPLATE_STORAGE:vztmpl/$TMPL_NAME -rootfs $LXC_ROOTFS_STORAGE:$LXC_ROOTFS_SIZE; +set -u sleep 2; # Check vlan configuration From 9ca05ed0f5e235260510b6e533463ed5ca2942d4 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 30 Jun 2023 11:45:29 +0200 Subject: [PATCH 012/129] Set backup=1 or lxc mountpooint --- install.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/install.sh b/install.sh index b504d9f..ab91868 100755 --- a/install.sh +++ b/install.sh @@ -148,7 +148,7 @@ fi sleep 2 if [ $LXC_MP -gt 0 ]; then - pct set $LXC_NBR -mp0 $LXC_SHAREFS_STORAGE:$LXC_SHAREFS_SIZE,mp=/$LXC_SHAREFS_MOUNTPOINT + pct set $LXC_NBR -mp0 $LXC_SHAREFS_STORAGE:$LXC_SHAREFS_SIZE,backup=1,mp=/$LXC_SHAREFS_MOUNTPOINT fi sleep 2; @@ -182,4 +182,4 @@ if [[ $service == "zmb-ad" ]]; then elif [[ $service == "zmb-ad-join" ]]; then pct set $LXC_NBR -nameserver "${LXC_IP%/*} $LXC_DNS" fi -pct start $LXC_NBR \ No newline at end of file +pct start $LXC_NBR From 06a362d6cd690ddfc4b0a5c1561c4b79a0285290 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Wed, 5 Jul 2023 17:57:57 +0200 Subject: [PATCH 013/129] Activate external repos --- src/gitea/install-service.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/gitea/install-service.sh b/src/gitea/install-service.sh index 1f9169d..40c8eef 100644 --- a/src/gitea/install-service.sh +++ b/src/gitea/install-service.sh @@ -9,11 +9,11 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -#wget -q -O - https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx.key -#echo "deb http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list +wget -q -O - https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx.key >/dev/null +echo "deb [signed-by=/etc/apt/trusted.gpg.d/nginx.key] http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list -#wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.key -#echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list +wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.key >/dev/null +echo "deb [signed-by=/etc/apt/trusted.gpg.d/postgresql.key] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list apt update From 07654432dfa62b63ddddd671a44ea41279dc45c5 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Thu, 6 Jul 2023 13:36:40 +0200 Subject: [PATCH 014/129] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index afe4f6a..b99491c 100644 --- a/README.md +++ b/README.md @@ -29,8 +29,8 @@ Proxmox VE Server (>=6.30) with at least one configured ZFS Pool. - `zammad` => Zammad Helpdesk and Ticketing Software [zammad.org](https://zammad.org/) - `zmb-ad` => ZMB (Samba) Active Directory Domain Controller, DNS Backends `SAMBA_INTERNAL` and `BIND9_DLZ` are supported - `zmb-ad-join` => Additional Active Directory Domain Controller joining an existing Domain -- `zmb-member` => ZMB (Samba) AD member with ZFS volume snapshot support (previous versions) -- `zmb-standalone` => ZMB (Samba) standalone server with ZFS volume snapshot support (previous versions) +- `zmb-member` => ZMB (Samba) AD member with ZFS volume snapshot support +- `zmb-standalone` => ZMB (Samba) standalone server with ZFS volume snapshot support ## Usage Just ssh into your Proxmox machine and clone this git repository. Make sure you have installed `git`. ```bash From e15c878b4deeb04241d86e32c76a95ffd841e27f Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 19:52:16 +0200 Subject: [PATCH 015/129] Migrate matrix to debian bookworm --- src/matrix/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/matrix/constants-service.conf b/src/matrix/constants-service.conf index 9bfdb2d..f020016 100644 --- a/src/matrix/constants-service.conf +++ b/src/matrix/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" From 12fef3afa07076a17af830c30e0c833ab82bbcc3 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 20:14:33 +0200 Subject: [PATCH 016/129] Migrate onlyoffice to debian bookworm --- src/onlyoffice/constants-service.conf | 2 +- src/onlyoffice/install-service.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/onlyoffice/constants-service.conf b/src/onlyoffice/constants-service.conf index d135850..4322e18 100644 --- a/src/onlyoffice/constants-service.conf +++ b/src/onlyoffice/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 2677191..4b1627a 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -11,7 +11,7 @@ source /root/constants-service.conf ONLYOFFICE_DB_PASS=$(random_password) -apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys CB2DE8E5 +curl -fsSL https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE | gpg --dearmor | tee /etc/apt/trusted.gpg.d/onlyoffice.gpg >/dev/null echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/sources.list.d/onlyoffice.list cat > /etc/apt/preferences.d/onlyoffice << EOF From 2a91ac74a1f11fd1d39d1705a103f9891b48dced Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 20:57:14 +0200 Subject: [PATCH 017/129] Migrate open3a to debian bookworm --- src/open3a/constants-service.conf | 2 +- src/open3a/install-service.sh | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/open3a/constants-service.conf b/src/open3a/constants-service.conf index 6e865bd..384ed69 100644 --- a/src/open3a/constants-service.conf +++ b/src/open3a/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/open3a/install-service.sh b/src/open3a/install-service.sh index f2c1afd..1dfb106 100644 --- a/src/open3a/install-service.sh +++ b/src/open3a/install-service.sh @@ -16,7 +16,7 @@ MYSQL_PASSWORD="$(random_password)" apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq unzip sudo nginx-full mariadb-server mariadb-client php php-cli php-fpm php-mysql php-xml php-mbstring php-gd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends unzip sudo nginx-full mariadb-server mariadb-client php php-cli php-fpm php-mysql php-xml php-mbstring php-gd mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/open3a.key -out /etc/nginx/ssl/open3a.crt -subj "/CN=$LXC_HOSTNAME.$LXC_DOMAIN" -addext "subjectAltName=DNS:$LXC_HOSTNAME.$LXC_DOMAIN" @@ -45,7 +45,7 @@ server { location ~ .php$ { include snippets/fastcgi-php.conf; - fastcgi_pass unix:/var/run/php/php7.4-fpm.sock; + fastcgi_pass unix:/var/run/php/php8.2-fpm.sock; } } @@ -57,7 +57,7 @@ CREATE DATABASE IF NOT EXISTS open3a; GRANT ALL PRIVILEGES ON open3a . * TO 'open3a'@'localhost';" cd $webroot -wget https://www.open3a.de/download/open3A%203.7.zip -O $webroot/open3a.zip +wget https://www.open3a.de/download/open3A%203.8.zip -O $webroot/open3a.zip unzip open3a.zip rm open3a.zip chmod 666 system/DBData/Installation.pfdb.php @@ -76,8 +76,8 @@ localhost &%%%&open3a &%%%&$MYSQL_PAS */ ?> EOF -systemctl enable --now php7.4-fpm -systemctl restart php7.4-fpm nginx +systemctl enable --now php8.2-fpm +systemctl restart php8.2-fpm nginx LXC_IP=$(ip address show dev eth0 | grep "inet " | cut -d ' ' -f6) From aade2903812641a56992884927baaf6c1afb03ef Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 21:11:22 +0200 Subject: [PATCH 018/129] Migrate pbs to debian bookworm --- src/proxmox-pbs/constants-service.conf | 2 +- src/proxmox-pbs/install-service.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/proxmox-pbs/constants-service.conf b/src/proxmox-pbs/constants-service.conf index e720f35..cf7b529 100644 --- a/src/proxmox-pbs/constants-service.conf +++ b/src/proxmox-pbs/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" diff --git a/src/proxmox-pbs/install-service.sh b/src/proxmox-pbs/install-service.sh index 6bcfa59..249217a 100644 --- a/src/proxmox-pbs/install-service.sh +++ b/src/proxmox-pbs/install-service.sh @@ -15,7 +15,7 @@ cat << EOF > /etc/apt/sources.list.d/pbs-no-subscription.list deb http://download.proxmox.com/debian/pbs $(lsb_release -cs) pbs-no-subscription EOF -wget https://enterprise.proxmox.com/debian/proxmox-release-bullseye.gpg -O /etc/apt/trusted.gpg.d/proxmox-release-bullseye.gpg +wget -q -O - https://enterprise.proxmox.com/debian/proxmox-release-bookworm.gpg | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg >/dev/null apt update && apt upgrade -y DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" proxmox-backup-server From bd75acfd724212cca94d6e397a0ab98d2d53dbfb Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 22:12:25 +0200 Subject: [PATCH 019/129] Migrate urbackup to debian bookworm --- src/urbackup/constants-service.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/urbackup/constants-service.conf b/src/urbackup/constants-service.conf index d1511bb..a393450 100644 --- a/src/urbackup/constants-service.conf +++ b/src/urbackup/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" @@ -23,7 +23,7 @@ LXC_NESTING="1" URBACKUP_DATA="urbackup" # OS codename for opensuse / urbackup repo -REPO_CODENAME="Debian_11" +REPO_CODENAME="Debian_12" # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 From 8b563d9b981e7f7353535a47e1b24676e6c1413e Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 22:23:57 +0200 Subject: [PATCH 020/129] Migrate vaultwarden to debian bookworm --- src/vaultwarden/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/vaultwarden/constants-service.conf b/src/vaultwarden/constants-service.conf index 65d4f55..c8a86ef 100644 --- a/src/vaultwarden/constants-service.conf +++ b/src/vaultwarden/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" From 3c241e3fd3cee7d9bf936c3ac29506bb7f5d55a6 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 22:42:27 +0200 Subject: [PATCH 021/129] Migrate zabbix to debian bookworm --- src/zabbix/constants-service.conf | 2 +- src/zabbix/install-service.sh | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/zabbix/constants-service.conf b/src/zabbix/constants-service.conf index 8e267ce..b8157a1 100644 --- a/src/zabbix/constants-service.conf +++ b/src/zabbix/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/zabbix/install-service.sh b/src/zabbix/install-service.sh index db4a2e7..12eae4c 100644 --- a/src/zabbix/install-service.sh +++ b/src/zabbix/install-service.sh @@ -10,7 +10,7 @@ source /root/zamba.conf source /root/constants-service.conf apt-key adv --fetch https://repo.zabbix.com/zabbix-official-repo.key -echo "deb https://repo.zabbix.com/zabbix/6.0/debian/ bullseye main contrib non-free" > /etc/apt/sources.list.d/zabbix-6.0.list +echo "deb https://repo.zabbix.com/zabbix/6.0/debian/ $(lsb_release -cs) main contrib non-free" > /etc/apt/sources.list.d/zabbix-6.0.list wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list @@ -18,7 +18,7 @@ echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql nginx php7.4-pgsql php7.4-fpm zabbix-server-pgsql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent ssl-cert +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql nginx php8.2-pgsql php8.2-fpm zabbix-server-pgsql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent ssl-cert unlink /etc/nginx/sites-enabled/default @@ -224,6 +224,6 @@ echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_server.conf openssl dhparam -out /etc/nginx/dhparam.pem 4096 -systemctl enable --now zabbix-server zabbix-agent nginx php7.4-fpm +systemctl enable --now zabbix-server zabbix-agent nginx php8.2-fpm -systemctl restart zabbix-server zabbix-agent nginx php7.4-fpm \ No newline at end of file +systemctl restart zabbix-server zabbix-agent nginx php8.2-fpm \ No newline at end of file From c296ea017a0f5898e3f47582b1995e9c749a16a2 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 23:40:26 +0200 Subject: [PATCH 022/129] Migrate zammad to debian bookworm --- src/zammad/constants-service.conf | 2 +- src/zammad/install-service.sh | 16 +++++++++------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/src/zammad/constants-service.conf b/src/zammad/constants-service.conf index 823fde3..0558f97 100644 --- a/src/zammad/constants-service.conf +++ b/src/zammad/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/zammad/install-service.sh b/src/zammad/install-service.sh index d71d113..7a9f52a 100644 --- a/src/zammad/install-service.sh +++ b/src/zammad/install-service.sh @@ -9,10 +9,11 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -apt-key adv --fetch https://dl.packager.io/srv/zammad/zammad/key -apt-key adv --fetch https://artifacts.elastic.co/GPG-KEY-elasticsearch -wget -O /etc/apt/sources.list.d/zammad.list https://dl.packager.io/srv/zammad/zammad/stable/installer/debian/11.repo -echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" > /etc/apt/sources.list.d/elastic-7.x.list +curl -fsSL https://dl.packager.io/srv/zammad/zammad/key | gpg --dearmor | tee /etc/apt/trusted.gpg.d/pkgr-zammad.gpg > /dev/null +curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --dearmor | tee /etc/apt/trusted.gpg.d/elasticsearch.gpg> /dev/null +echo "deb [signed-by=/etc/apt/trusted.gpg.d/elasticsearch.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main"| tee -a /etc/apt/sources.list.d/elastic-7.x.list > /dev/null +echo "deb [signed-by=/etc/apt/trusted.gpg.d/pkgr-zammad.gpg] https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 12 main"| tee /etc/apt/sources.list.d/zammad.list > /dev/null + apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install ssl-cert nginx-full postgresql zammad @@ -59,7 +60,7 @@ upstream zammad-websocket { server { listen 80; listen [::]:80; - server_name _; + server_name ${LXC_HOSTNAME}.${LXC_DOMAIN}; server_tokens off; @@ -76,7 +77,7 @@ server { listen 443 ssl http2; listen [::]:443 ssl http2; - server_name _; + server_name ${LXC_HOSTNAME}.${LXC_DOMAIN}; server_tokens off; ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem; @@ -158,11 +159,12 @@ ln -sf /etc/nginx/sites-available/zammad.conf /etc/nginx/sites-enabled/ openssl dhparam -out /etc/nginx/dhparam.pem 4096 +/usr/share/elasticsearch/bin/elasticsearch-plugin install -b ingest-attachment + systemctl enable elasticsearch.service systemctl restart nginx elasticsearch.service # Elasticsearch conntact to Zammad -/usr/share/elasticsearch/bin/elasticsearch-plugin install -b ingest-attachment zammad run rails r "Setting.set('es_url', 'http://localhost:9200')" zammad run rails r "Setting.set('es_index', Socket.gethostname.downcase + '_zammad')" zammad run rails r "User.find_by(email: 'nicole.braun@zammad.org').destroy" From b2df1a984b9ffd043e01a30972f04af24192745a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 6 Jul 2023 23:55:10 +0200 Subject: [PATCH 023/129] Migrate zmb-ad to debian bookworm --- src/zmb-ad/constants-service.conf | 2 +- src/zmb-ad/install-service.sh | 6 +----- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/src/zmb-ad/constants-service.conf b/src/zmb-ad/constants-service.conf index 79de74b..50f8bb1 100644 --- a/src/zmb-ad/constants-service.conf +++ b/src/zmb-ad/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 2ba387f..0f7a968 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -15,8 +15,6 @@ for f in ${OPTIONAL_FEATURES[@]}; do if [[ "$f" == "wsdd" ]]; then ADDITIONAL_PACKAGES="wsdd $ADDITIONAL_PACKAGES" ADDITIONAL_SERVICES="wsdd $ADDITIONAL_SERVICES" - apt-key adv --fetch-keys https://pkg.ltec.ch/public/conf/ltec-ag.gpg.key - echo "deb https://pkg.ltec.ch/public/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/wsdd.list elif [[ "$f" == "splitdns" ]]; then ADDITIONAL_PACKAGES="nginx-full $ADDITIONAL_PACKAGES" ADDITIONAL_SERVICES="nginx $ADDITIONAL_SERVICES" @@ -59,14 +57,12 @@ restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery tinker panic 0 EOF -echo "deb http://ftp.de.debian.org/debian $(lsb_release -cs)-backports main contrib" > /etc/apt/sources.list.d/$(lsb_release -cs)-backports.list - # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" -t $(lsb_release -cs)-backports acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default From 15afd4541e7722846cc6d8cf33e61af827273610 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Fri, 7 Jul 2023 00:25:39 +0200 Subject: [PATCH 024/129] Migrate zmb-ad-join to debian bookworm --- src/zmb-ad-join/constants-service.conf | 2 +- src/zmb-ad-join/install-service.sh | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/src/zmb-ad-join/constants-service.conf b/src/zmb-ad-join/constants-service.conf index 712060f..568e7ca 100644 --- a/src/zmb-ad-join/constants-service.conf +++ b/src/zmb-ad-join/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index 67b0798..c4efce7 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -15,8 +15,6 @@ for f in ${OPTIONAL_FEATURES[@]}; do if [[ "$f" == "wsdd" ]]; then ADDITIONAL_PACKAGES="wsdd $ADDITIONAL_PACKAGES" ADDITIONAL_SERVICES="wsdd $ADDITIONAL_SERVICES" - apt-key adv --fetch-keys https://pkg.ltec.ch/public/conf/ltec-ag.gpg.key - echo "deb https://pkg.ltec.ch/public/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/wsdd.list elif [[ "$f" == "splitdns" ]]; then ADDITIONAL_PACKAGES="nginx-full $ADDITIONAL_PACKAGES" ADDITIONAL_SERVICES="nginx $ADDITIONAL_SERVICES" @@ -53,14 +51,12 @@ restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery tinker panic 0 EOF -echo "deb http://ftp.de.debian.org/debian $(lsb_release -cs)-backports main contrib" > /etc/apt/sources.list.d/$(lsb_release -cs)-backports.list - # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" -t $(lsb_release -cs)-backports acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default server { @@ -127,7 +123,7 @@ systemctl disable --now smbd nmbd winbind systemd-resolved rm -f /etc/samba/smb.conf echo -e "$ZMB_ADMIN_PASS" | kinit -V $ZMB_ADMIN_USER -samba-tool domain join $ZMB_REALM DC -k yes --backend-store=mdb +samba-tool domain join $ZMB_REALM DC --use-kerberos=required --backend-store=mdb mkdir -p /mnt/sysvol From 1403c03acffa66600ee53ce428adfa0fc8b0fa67 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Fri, 7 Jul 2023 00:32:38 +0200 Subject: [PATCH 025/129] Migrate zmb-member to debian bookworm --- src/zmb-member/constants-service.conf | 2 +- src/zmb-member/install-service.sh | 7 +------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/src/zmb-member/constants-service.conf b/src/zmb-member/constants-service.conf index 47f6a82..bd524f3 100644 --- a/src/zmb-member/constants-service.conf +++ b/src/zmb-member/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" diff --git a/src/zmb-member/install-service.sh b/src/zmb-member/install-service.sh index 2932abc..f8c35ef 100644 --- a/src/zmb-member/install-service.sh +++ b/src/zmb-member/install-service.sh @@ -9,14 +9,9 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -# add wsdd package repo -apt-key adv --fetch-keys https://pkg.ltec.ch/public/conf/ltec-ag.gpg.key -echo "deb https://pkg.ltec.ch/public/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/wsdd.list -echo "deb http://ftp.de.debian.org/debian $(lsb_release -cs)-backports main contrib" > /etc/apt/sources.list.d/$(lsb_release -cs)-backports.list - apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" -t $(lsb_release -cs)-backports acl samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd mv /etc/krb5.conf /etc/krb5.conf.bak cat > /etc/krb5.conf < Date: Fri, 7 Jul 2023 00:39:21 +0200 Subject: [PATCH 026/129] Migrate zmb-standalone to debian bookworm --- src/zmb-standalone/constants-service.conf | 2 +- src/zmb-standalone/install-service.sh | 24 +---------------------- 2 files changed, 2 insertions(+), 24 deletions(-) diff --git a/src/zmb-standalone/constants-service.conf b/src/zmb-standalone/constants-service.conf index 1b9daf8..c9d5a2a 100644 --- a/src/zmb-standalone/constants-service.conf +++ b/src/zmb-standalone/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" diff --git a/src/zmb-standalone/install-service.sh b/src/zmb-standalone/install-service.sh index b14bd3b..7865323 100644 --- a/src/zmb-standalone/install-service.sh +++ b/src/zmb-standalone/install-service.sh @@ -9,34 +9,12 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -# add wsdd package repo -apt-key adv --fetch-keys https://pkg.ltec.ch/public/conf/ltec-ag.gpg.key apt-key adv --fetch-keys https://repo.45drives.com/key/gpg.asc echo "deb https://repo.45drives.com/debian focal main" > /etc/apt/sources.list.d/45drives.list -echo "deb https://pkg.ltec.ch/public/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/wsdd.list -echo "deb http://ftp.de.debian.org/debian $(lsb_release -cs)-backports main contrib" > /etc/apt/sources.list.d/$(lsb_release -cs)-backports.list - -cat << EOF > /etc/apt/preferences.d/samba -Package: samba* -Pin: release a=$(lsb_release -cs)-backports -Pin-Priority: 900 -EOF - -cat << EOF > /etc/apt/preferences.d/winbind -Package: winbind* -Pin: release a=$(lsb_release -cs)-backports -Pin-Priority: 900 -EOF - -cat << EOF > /etc/apt/preferences.d/cockpit -Package: cockpit* -Pin: release a=$(lsb_release -cs)-backports -Pin-Priority: 900 -EOF apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" -t $(lsb_release -cs)-backports acl samba samba-common samba-common-bin samba-dsdb-modules samba-vfs-modules samba-libs libwbclient0 winbind wsdd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba samba-common samba-common-bin samba-dsdb-modules samba-vfs-modules samba-libs libwbclient0 winbind wsdd DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" --no-install-recommends cockpit cockpit-identities cockpit-file-sharing cockpit-navigator USER=$(echo "$ZMB_ADMIN_USER" | awk '{print tolower($0)}') From 322f64759c828f0476313898084b84c4ea62a84e Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 8 Jul 2023 18:20:52 +0200 Subject: [PATCH 027/129] Add ansible semaphore container --- src/ansible-semaphore/constants-service.conf | 35 +++ src/ansible-semaphore/install-service.sh | 214 +++++++++++++++++++ 2 files changed, 249 insertions(+) create mode 100644 src/ansible-semaphore/constants-service.conf create mode 100644 src/ansible-semaphore/install-service.sh diff --git a/src/ansible-semaphore/constants-service.conf b/src/ansible-semaphore/constants-service.conf new file mode 100644 index 0000000..8bc8c52 --- /dev/null +++ b/src/ansible-semaphore/constants-service.conf @@ -0,0 +1,35 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=1024 + +# Defines the name from the SQL database +SEMAPHORE_DB_NAME="semaphore" + +# Defines the name from the SQL user +SEMAPHORE_DB_USR="semaphore" + +# Build a strong password for the SQL user - could be overwritten with something fixed +SEMAPHORE_DB_PWD="$(random_password)" + +# service dependent meta tags +SERVICE_TAGS="postgresql,nginx" \ No newline at end of file diff --git a/src/ansible-semaphore/install-service.sh b/src/ansible-semaphore/install-service.sh new file mode 100644 index 0000000..c3a05ad --- /dev/null +++ b/src/ansible-semaphore/install-service.sh @@ -0,0 +1,214 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +wget -q -O - https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx.key >/dev/null +echo "deb [signed-by=/etc/apt/trusted.gpg.d/nginx.key] http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list + +wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.key >/dev/null +echo "deb [signed-by=/etc/apt/trusted.gpg.d/postgresql.key] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list + +apt update + +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq postgresql nginx git ssl-cert unzip zip ansible ansible-lint + +systemctl enable --now postgresql + +su - postgres < /usr/local/bin/update-semaphore +PATH="/bin:/usr/bin:/usr/local/bin" +echo "Checking github for new semaphore version" +current_version=\$(curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep "tag_name" | cut -d '"' -f4) +installed_version=\$(semaphore version) +echo "Installed semaphore version is \$installed_version" +if [ \$installed_version != \$current_version ]; then + echo "New semaphore version \$current_version available. Stopping semaphore.service" + systemctl stop semaphore.service + echo "Downloading semaphore version \$current_version..." + curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'linux_amd64.deb$' | wget -i - -O /opt/semaphore_linux_amd64.deb + DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install /opt/semaphore_linux_amd64.deb + echo "Starting semaphore.service..." + systemctl start semaphore.service + echo "semaphore update finished!" +else + echo "semaphore version is up-to-date!" +fi +EOF +chmod +x /usr/local/bin/update-semaphore + +cat << EOF > /etc/apt/apt.conf.d/80-semaphore-apt-hook +DPkg::Post-Invoke {"/usr/local/bin/update-semaphore";}; +EOF +chmod +x /etc/apt/apt.conf.d/80-semaphore-apt-hook + +cat << EOF > /etc/systemd/system/semaphore.service +[Unit] +Description=Semaphore Ansible +Documentation=https://github.com/ansible-semaphore/semaphore +Wants=network-online.target +After=network-online.target + +[Service] +Type=simple +ExecReload=/bin/kill -HUP \$MAINPID +ExecStart=/usr/bin/semaphore service --config=/etc/semaphore/config.json +SyslogIdentifier=semaphore +Restart=always + +[Install] +WantedBy=multi-user.target +EOF + +mkdir -p /etc/semaphore + +cat << EOF > /etc/semaphore/config.json +{ + "mysql": { + "host": "", + "user": "", + "pass": "", + "name": "", + "options": null + }, + "bolt": { + "host": "", + "user": "", + "pass": "", + "name": "", + "options": null + }, + "postgres": { + "host": "127.0.0.1:5432", + "user": "${SEMAPHORE_DB_USR}", + "pass": "${SEMAPHORE_DB_PWD}", + "name": "${SEMAPHORE_DB_NAME}", + "options": { + "sslmode": "disable" + } + }, + "dialect": "postgres", + "port": "", + "interface": "", + "tmp_path": "/tmp/semaphore", + "cookie_hash": "$(head -c32 /dev/urandom | base64)", + "cookie_encryption": "$(head -c32 /dev/urandom | base64)", + "access_key_encryption": "$(head -c32 /dev/urandom | base64)", + "email_sender": "", + "email_host": "", + "email_port": "", + "email_username": "", + "email_password": "", + "web_host": "", + "ldap_binddn": "", + "ldap_bindpassword": "", + "ldap_server": "", + "ldap_searchdn": "", + "ldap_searchfilter": "", + "ldap_mappings": { + "dn": "", + "mail": "", + "uid": "", + "cn": "" + }, + "telegram_chat": "", + "telegram_token": "", + "slack_url": "", + "max_parallel_tasks": 0, + "email_alert": false, + "email_secure": false, + "telegram_alert": false, + "slack_alert": false, + "ldap_enable": false, + "ldap_needtls": false, + "ssh_config_path": "~/.ssh/", + "demo_mode": false, + "git_client": "" + } +EOF + +if [ -f /etc/nginx/sites-enabled/default ]; then + unlink /etc/nginx/sites-enabled/default +fi + +cat << EOF > /etc/nginx/conf.d/default.conf +server { + listen 80; + listen [::]:80; + server_name _; + + server_tokens off; + + access_log /var/log/nginx/semaphore.access.log; + error_log /var/log/nginx/semaphore.error.log; + + location /.well-known/ { + root /var/www/html; + } + + return 301 https://${LXC_HOSTNAME}.${LXC_DOMAIN}\$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name ${LXC_HOSTNAME}.${LXC_DOMAIN}; + + server_tokens off; + ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem; + ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key; + + ssl_protocols TLSv1.3 TLSv1.2; + ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:EECDH+AESGCM:EDH+AESGCM; + ssl_dhparam /etc/nginx/dhparam.pem; + ssl_prefer_server_ciphers on; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 180m; + + ssl_stapling on; + ssl_stapling_verify on; + + resolver 1.1.1.1 1.0.0.1; + + add_header Strict-Transport-Security "max-age=31536000" always; + + access_log /var/log/nginx/semaphore.access.log; + error_log /var/log/nginx/semaphore.error.log; + + client_max_body_size 50M; + + location / { + proxy_set_header X-Real-IP \$remote_addr; + proxy_set_header Host \$host; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + proxy_pass http://127.0.0.1:3000; + proxy_read_timeout 90; + } +} +EOF + +echo "source <(semaphore completion bash)" >> /root/.bashrc +semaphore user add --admin --login ${SEMAPHORE_ADMIN} --name ${SEMAPHORE_ADMIN_DISPLAY_NAME} --email ${SEMAPHORE_ADMIN_EMAIL} --password ${SEMAPHORE_ADMIN_PASSWORD} --config /etc/semaphore/config.json + + +openssl dhparam -out /etc/nginx/dhparam.pem 4096 + +systemctl daemon-reload +systemctl enable --now semaphore.service +systemctl restart nginx.service From 82d3be6e147b32f42951bf90ee4601cb0acd4428 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 7 Aug 2023 12:44:28 +0200 Subject: [PATCH 028/129] Update ecodms to 230164 and debian bookworm --- src/ecodms/constants-service.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ecodms/constants-service.conf b/src/ecodms/constants-service.conf index 06b8fa2..592389e 100644 --- a/src/ecodms/constants-service.conf +++ b/src/ecodms/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" @@ -20,7 +20,7 @@ LXC_UNPRIVILEGED="1" LXC_NESTING="1" # set ecodms release version -ECODMS_RELEASE=ecodms_220864 +ECODMS_RELEASE=ecodms_230164 # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=6144 From 95d1ebd0130350e697b77331b58a53fe0e6d42a9 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 7 Aug 2023 12:53:23 +0200 Subject: [PATCH 029/129] Update checkmk to 2.2.0p7 and debian bookworm --- src/checkmk/constants-service.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index 24b5009..38f948e 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" @@ -20,7 +20,7 @@ LXC_UNPRIVILEGED="1" LXC_NESTING="1" # checkmk version -CMK_VERSION=2.2.0p4 +CMK_VERSION=2.2.0p7 # build number of the debian package (needs to start with underscore) CMK_BUILD=_0 From e0aa991878bb1a46693e1f3d37e6609343bad435 Mon Sep 17 00:00:00 2001 From: Carsten Date: Thu, 17 Aug 2023 17:18:31 +0200 Subject: [PATCH 030/129] rei3 hinzugefuegt --- src/rei3/constants-service.conf | 42 +++++++++++++++++++++++++++++++++ src/rei3/install-service.sh | 42 +++++++++++++++++++++++++++++++++ 2 files changed, 84 insertions(+) create mode 100644 src/rei3/constants-service.conf create mode 100644 src/rei3/install-service.sh diff --git a/src/rei3/constants-service.conf b/src/rei3/constants-service.conf new file mode 100644 index 0000000..c941967 --- /dev/null +++ b/src/rei3/constants-service.conf @@ -0,0 +1,42 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + + +# Defines the IP from the SQL server +REI3_DB_IP="127.0.0.1" + +# Defines the PORT from the SQL server +REI3_DB_PORT="5432" + +# Defines the name from the SQL database +REI3_DB_NAME="app" + +# Defines the name from the SQL user +REI3_DB_USR="rei3" + +# Build a strong password for the SQL user - could be overwritten with something fixed +REI3_DB_PWD="$(random_password)" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=4096 + +# service dependent meta tags +SERVICE_TAGS="postgresql" diff --git a/src/rei3/install-service.sh b/src/rei3/install-service.sh new file mode 100644 index 0000000..0d18b50 --- /dev/null +++ b/src/rei3/install-service.sh @@ -0,0 +1,42 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +mkdir /opt/rei3 +wget -c https://rei3.de/downloads/REI3_3.4.2_x64_linux.tar.gz -O - | tar -zx -C /opt/rei3 + +wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgres.gpg +echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list + +apt update + +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql imagemagick ghostscript postgresql-client + +timedatectl set-timezone ${LXC_TIMEZONE} + +systemctl enable --now postgresql + +su - postgres < Date: Thu, 24 Aug 2023 20:28:59 +0200 Subject: [PATCH 031/129] Fix password function --- src/functions.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/functions.sh b/src/functions.sh index 5798afd..50356f1 100644 --- a/src/functions.sh +++ b/src/functions.sh @@ -5,5 +5,5 @@ LXC_RANDOMPWD=32 random_password() { set +o pipefail - C_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom 2>/dev/null | head -c${LXC_RANDOMPWD} + LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom 2>/dev/null | head -c${LXC_RANDOMPWD} } \ No newline at end of file From 1bc031af1723b596b01159302089e593c98f2d33 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 24 Aug 2023 20:29:20 +0200 Subject: [PATCH 032/129] Add ansible-semaphore variables --- conf/zamba.conf.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 0f238c7..ccc863a 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -193,3 +193,10 @@ VW_SMTP_USERNAME=vaultwarden@bashclub.org # password of your mailbox VW_SMTP_PASSWORD='' + +############### ansible-semaphore Section ############### + +SEMAPHORE_ADMIN=admin +SEMAPHORE_ADMIN_DISPLAY_NAME="Semaphore Administrator" +SEMAPHORE_ADMIN_EMAIL="admin@zmb.rocks" +SEMAPHORE_ADMIN_PASSWORD=$(LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom 2>/dev/null | head -c32) \ No newline at end of file From 08680024642361caabf0d72b6db17828e326051e Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 24 Aug 2023 21:36:04 +0200 Subject: [PATCH 033/129] run semaphore as unpriv user --- src/ansible-semaphore/install-service.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/ansible-semaphore/install-service.sh b/src/ansible-semaphore/install-service.sh index c3a05ad..1b316a4 100644 --- a/src/ansible-semaphore/install-service.sh +++ b/src/ansible-semaphore/install-service.sh @@ -52,6 +52,9 @@ fi EOF chmod +x /usr/local/bin/update-semaphore +useradd -m -r -s /bin/bash semaphore +sudo -s -u semaphore bash -c 'ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -q -N ""' + cat << EOF > /etc/apt/apt.conf.d/80-semaphore-apt-hook DPkg::Post-Invoke {"/usr/local/bin/update-semaphore";}; EOF @@ -70,6 +73,8 @@ ExecReload=/bin/kill -HUP \$MAINPID ExecStart=/usr/bin/semaphore service --config=/etc/semaphore/config.json SyslogIdentifier=semaphore Restart=always +User=semaphore +Group=semaphore [Install] WantedBy=multi-user.target From d1f9867415e93717e6ea41d87e8bc14194feef0c Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 24 Aug 2023 21:37:45 +0200 Subject: [PATCH 034/129] print credentials --- src/ansible-semaphore/install-service.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/ansible-semaphore/install-service.sh b/src/ansible-semaphore/install-service.sh index 1b316a4..e242d25 100644 --- a/src/ansible-semaphore/install-service.sh +++ b/src/ansible-semaphore/install-service.sh @@ -217,3 +217,6 @@ openssl dhparam -out /etc/nginx/dhparam.pem 4096 systemctl daemon-reload systemctl enable --now semaphore.service systemctl restart nginx.service + + +echo -e "\n######################################################################\n\n Please note this user and password for the semaphore login:\n '$SEMAPHORE_ADMIN' / '$SEMAPHORE_ADMIN_PASSWORD'\n Enjoy your semaphore intallation.\n\n######################################################################" From 858f17c03fff7d61db851ee2178f425ba09c83fb Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Wed, 30 Aug 2023 13:05:06 +0200 Subject: [PATCH 035/129] Set semaphore password in zamba.conf.example --- conf/zamba.conf.example | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index ccc863a..1f33eef 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -199,4 +199,4 @@ VW_SMTP_PASSWORD='' SEMAPHORE_ADMIN=admin SEMAPHORE_ADMIN_DISPLAY_NAME="Semaphore Administrator" SEMAPHORE_ADMIN_EMAIL="admin@zmb.rocks" -SEMAPHORE_ADMIN_PASSWORD=$(LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom 2>/dev/null | head -c32) \ No newline at end of file +SEMAPHORE_ADMIN_PASSWORD='Start123' \ No newline at end of file From 5802c2c04337f0f04d629f25a37547df5bec11a6 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 10 Sep 2023 11:17:10 +0200 Subject: [PATCH 036/129] Add dhparam generation function --- src/functions.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/functions.sh b/src/functions.sh index 50356f1..f5eb4b4 100644 --- a/src/functions.sh +++ b/src/functions.sh @@ -6,4 +6,15 @@ LXC_RANDOMPWD=32 random_password() { set +o pipefail LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom 2>/dev/null | head -c${LXC_RANDOMPWD} -} \ No newline at end of file +} + +generate_dhparam() { + openssl dhparam -out /etc/nginx/dhparam.pem 2048 + cat << EOF > /etc/cron.weekly/generate-dhparams +#!/bin/bash +openssl dhparam -out /etc/nginx/dhparam.gen 4096 > /dev/null 2>&1 +mv /etc/nginx/dhparam.gen /etc/nginx/dhparam.pem +systemctl restart nginx +EOF + chmod +x /etc/cron.weekly/generate-dhparams +} From a8a5cda289e5bd06642218e10c956ec131a1e2ee Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 10 Sep 2023 11:22:40 +0200 Subject: [PATCH 037/129] Change dhparam gen to monthly --- src/functions.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/functions.sh b/src/functions.sh index f5eb4b4..a6032a3 100644 --- a/src/functions.sh +++ b/src/functions.sh @@ -10,11 +10,11 @@ random_password() { generate_dhparam() { openssl dhparam -out /etc/nginx/dhparam.pem 2048 - cat << EOF > /etc/cron.weekly/generate-dhparams + cat << EOF > /etc/cron.monthly/generate-dhparams #!/bin/bash openssl dhparam -out /etc/nginx/dhparam.gen 4096 > /dev/null 2>&1 mv /etc/nginx/dhparam.gen /etc/nginx/dhparam.pem systemctl restart nginx EOF - chmod +x /etc/cron.weekly/generate-dhparams + chmod +x /etc/cron.monthly/generate-dhparams } From 96e6d0d3ba9fcd521343304b7f0cf83e382345d5 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 10 Sep 2023 11:24:40 +0200 Subject: [PATCH 038/129] =?UTF-8?q?Add=20signups=20allowed=20parameter=20f?= =?UTF-8?q?=C3=BCr=20vaultwarden?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- conf/zamba.conf.example | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 1f33eef..c28569f 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -170,6 +170,10 @@ KOPANO_MAILGW="192.168.100.254" KOPANO_REPKEY="1234567890abcdefghijklmno" ############### vaultwarden Section ############### + +# Enable/disable signups (true/false) +VW_SIGNUPS_ALLOWED=false + # Hostname of your mailserver VW_SMTP_HOST=mail.bashclub.org From 862929cd515dbda0e34ebe55dc3b80d75ad734bb Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 10 Sep 2023 11:25:55 +0200 Subject: [PATCH 039/129] Change dh param gen to function --- src/ansible-semaphore/install-service.sh | 2 +- src/gitea/install-service.sh | 2 +- src/kopano-core/install-service.sh | 2 +- src/nextcloud/install-service.sh | 2 +- src/vaultwarden/install-service.sh | 7 +++++-- src/zabbix/install-service.sh | 2 +- src/zammad/install-service.sh | 2 +- 7 files changed, 11 insertions(+), 8 deletions(-) diff --git a/src/ansible-semaphore/install-service.sh b/src/ansible-semaphore/install-service.sh index e242d25..864b278 100644 --- a/src/ansible-semaphore/install-service.sh +++ b/src/ansible-semaphore/install-service.sh @@ -212,7 +212,7 @@ echo "source <(semaphore completion bash)" >> /root/.bashrc semaphore user add --admin --login ${SEMAPHORE_ADMIN} --name ${SEMAPHORE_ADMIN_DISPLAY_NAME} --email ${SEMAPHORE_ADMIN_EMAIL} --password ${SEMAPHORE_ADMIN_PASSWORD} --config /etc/semaphore/config.json -openssl dhparam -out /etc/nginx/dhparam.pem 4096 +generate_dhparam systemctl daemon-reload systemctl enable --now semaphore.service diff --git a/src/gitea/install-service.sh b/src/gitea/install-service.sh index 40c8eef..bbda4c0 100644 --- a/src/gitea/install-service.sh +++ b/src/gitea/install-service.sh @@ -181,7 +181,7 @@ server { } EOF -openssl dhparam -out /etc/nginx/dhparam.pem 4096 +generate_dhparam systemctl daemon-reload systemctl enable --now gitea diff --git a/src/kopano-core/install-service.sh b/src/kopano-core/install-service.sh index b3644f4..7a76446 100644 --- a/src/kopano-core/install-service.sh +++ b/src/kopano-core/install-service.sh @@ -149,7 +149,7 @@ sed -i "s/define('LANG', 'en_US.UTF-8')/define('LANG', 'de_DE.UTF-8')/" /etc/kop #### Adjust nginx settings #### openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/ssl/private/kopano.key -out /etc/ssl/certs/kopano.crt -subj "/CN=$KOPANO_FQDN" -addext "subjectAltName=DNS:$KOPANO_FQDN" -openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096 +generate_dhparam #mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak diff --git a/src/nextcloud/install-service.sh b/src/nextcloud/install-service.sh index 79d65c6..0974c0f 100644 --- a/src/nextcloud/install-service.sh +++ b/src/nextcloud/install-service.sh @@ -90,7 +90,7 @@ sed -i "s/rights=\"none\" pattern=\"XPS\"/rights=\"read|write\" pattern=\"XPS\"/ mkdir -p /etc/nginx/ssl openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/ssl/private/nextcloud.key -out /etc/ssl/certs/nextcloud.crt -subj "/CN=$NEXTCLOUD_FQDN" -addext "subjectAltName=DNS:$NEXTCLOUD_FQDN" -openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096 +generate_dhparam mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak diff --git a/src/vaultwarden/install-service.sh b/src/vaultwarden/install-service.sh index 42a7b4e..db2f95b 100644 --- a/src/vaultwarden/install-service.sh +++ b/src/vaultwarden/install-service.sh @@ -40,7 +40,7 @@ ORG_CREATION_USERS=admin@$LXC_DOMAIN # Use `openssl rand -base64 48` to generate ADMIN_TOKEN=$admin_token # Uncomment this once vaults restored -SIGNUPS_ALLOWED=false +SIGNUPS_ALLOWED=$VW_SIGNUPS_ALLOWED SMTP_HOST=$VW_SMTP_HOST SMTP_FROM=$VW_SMTP_FROM SMTP_FROM_NAME="$VW_SMTP_FROM_NAME" @@ -154,7 +154,10 @@ server { } EOF -openssl dhparam -out /etc/nginx/dhparam.pem 4096 + +generate_dhparam + +unlink /etc/nginx/sites-enabled/default systemctl daemon-reload systemctl enable --now vaultwarden diff --git a/src/zabbix/install-service.sh b/src/zabbix/install-service.sh index 12eae4c..9a4ac6a 100644 --- a/src/zabbix/install-service.sh +++ b/src/zabbix/install-service.sh @@ -222,7 +222,7 @@ zcat /usr/share/zabbix-sql-scripts/postgresql/server.sql.gz | sudo -u zabbix psq echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_server.conf -openssl dhparam -out /etc/nginx/dhparam.pem 4096 +generate_dhparam systemctl enable --now zabbix-server zabbix-agent nginx php8.2-fpm diff --git a/src/zammad/install-service.sh b/src/zammad/install-service.sh index 7a9f52a..a58a901 100644 --- a/src/zammad/install-service.sh +++ b/src/zammad/install-service.sh @@ -157,7 +157,7 @@ EOF ln -sf /etc/nginx/sites-available/zammad.conf /etc/nginx/sites-enabled/ -openssl dhparam -out /etc/nginx/dhparam.pem 4096 +generate_dhparam /usr/share/elasticsearch/bin/elasticsearch-plugin install -b ingest-attachment From c51d2a91fffdcd28292bbddeccbbd8d5d7fcb423 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 7 Oct 2023 15:09:15 +0200 Subject: [PATCH 040/129] Add cpu core count --- conf/zamba.conf.example | 3 +++ install.sh | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index c28569f..b45134d 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -27,6 +27,9 @@ LXC_SHAREFS_STORAGE="local-zfs" # Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) LXC_SHAREFS_MOUNTPOINT="tank" +# cpu core count (default: 0 = unlimited) +LXC_THREADS=0 + # Defines the amount of RAM in MB your LXC container is allowed to use (default: 1024) LXC_MEM=1024 diff --git a/install.sh b/install.sh index ab91868..d4e6ce2 100755 --- a/install.sh +++ b/install.sh @@ -130,9 +130,13 @@ else fi echo "Will now create LXC Container $LXC_NBR!"; +if [ $LXC_THREADS -gt 0 ]; then + LXC_CORES=--cores$LXC_THREADS +fi + # Create the container set +u -pct create $LXC_NBR $TAGS --password $LXC_PWD -unprivileged $LXC_UNPRIVILEGED $LXC_TEMPLATE_STORAGE:vztmpl/$TMPL_NAME -rootfs $LXC_ROOTFS_STORAGE:$LXC_ROOTFS_SIZE; +pct create $LXC_NBR $TAGS $LXC_CORES --password $LXC_PWD -unprivileged $LXC_UNPRIVILEGED $LXC_TEMPLATE_STORAGE:vztmpl/$TMPL_NAME -rootfs $LXC_ROOTFS_STORAGE:$LXC_ROOTFS_SIZE; set -u sleep 2; From b148d290ce2f2b58950dc727a60e5a4bf30ae3d3 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 7 Oct 2023 15:37:08 +0200 Subject: [PATCH 041/129] Fix Kerberos config on dcs --- src/zmb-ad-join/install-service.sh | 10 +++++++++- src/zmb-ad/install-service.sh | 2 +- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index c4efce7..6bd3af4 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -125,6 +125,10 @@ rm -f /etc/samba/smb.conf echo -e "$ZMB_ADMIN_PASS" | kinit -V $ZMB_ADMIN_USER samba-tool domain join $ZMB_REALM DC --use-kerberos=required --backend-store=mdb + +rm /etc/krb5.conf +ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf + mkdir -p /mnt/sysvol cat << EOF > /root/.smbcredentials @@ -138,11 +142,15 @@ echo "//$LXC_DNS/sysvol /mnt/sysvol cifs credentials=/root/.smbcredentials 0 0" mount.cifs //$LXC_DNS/sysvol /mnt/sysvol -o credentials=/root/.smbcredentials cat > /etc/cron.d/sysvol-sync << EOF -*/15 * * * * root /usr/bin/rsync -XAavz --delete-after /mnt/sysvol/ /var/lib/samba/sysvol +*/15 * * * * root /usr/bin/rsync -XAavz --delete-after /mnt/sysvol/ /var/lib/samba/sysvol; if ! /usr/bin/samba-tool ntacl sysvolcheck > /dev/null 2>&1 ; then /usr/bin/samba-tool ntacl sysvolreset ; fi EOF /usr/bin/rsync -XAavz --delete-after /mnt/sysvol/ /var/lib/samba/sysvol +if ! samba-tool ntacl sysvolcheck > /dev/null 2>&1 ; then + samba-tool ntacl sysvolreset +fi + ssh-keygen -q -f "$HOME/.ssh/id_rsa" -N "" -b 4096 systemctl unmask samba-ad-dc diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 0f7a968..941ef65 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -131,7 +131,7 @@ rm -f /etc/krb5.conf # provision zamba domain samba-tool domain provision --use-rfc2307 --realm=$ZMB_REALM --domain=$ZMB_DOMAIN --adminpass=$ZMB_ADMIN_PASS --server-role=dc --backend-store=mdb --dns-backend=$ZMB_DNS_BACKEND -cp /var/lib/samba/private/krb5.conf /etc/krb5.conf +ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf systemctl unmask samba-ad-dc systemctl enable samba-ad-dc From 975855f7a8ad1558c4c8c96e28b46d245f9397c0 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Tue, 17 Oct 2023 21:52:28 +0200 Subject: [PATCH 042/129] Fix dhparams path --- src/kopano-core/install-service.sh | 2 +- src/nextcloud/install-service.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/kopano-core/install-service.sh b/src/kopano-core/install-service.sh index 7a76446..fa73226 100644 --- a/src/kopano-core/install-service.sh +++ b/src/kopano-core/install-service.sh @@ -187,7 +187,7 @@ server { ssl_prefer_server_ciphers on; # # ssl_dhparam require you to create a dhparam.pem, this takes a long time - ssl_dhparam /etc/ssl/certs/dhparam.pem; + ssl_dhparam /etc/nginx/dhparam.pem; # # add headers diff --git a/src/nextcloud/install-service.sh b/src/nextcloud/install-service.sh index 0974c0f..2235d55 100644 --- a/src/nextcloud/install-service.sh +++ b/src/nextcloud/install-service.sh @@ -160,7 +160,7 @@ ssl_trusted_certificate /etc/ssl/certs/nextcloud.crt; #ssl_certificate /etc/letsencrypt/ecc-certs/fullchain.pem; #ssl_certificate_key /etc/letsencrypt/ecc-certs/privkey.pem; #ssl_trusted_certificate /etc/letsencrypt/ecc-certs/chain.pem; -ssl_dhparam /etc/ssl/certs/dhparam.pem; +ssl_dhparam /etc/nginx/dhparam.pem; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; From 818a5ecd84c782e5ea7585beccc6c40b022feef1 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 21:57:37 +0100 Subject: [PATCH 043/129] Switch to backports, add backup function --- src/zmb-ad-join/constants-service.conf | 2 +- src/zmb-ad-join/install-service.sh | 64 +++++++++++++++++++++++- src/zmb-ad/constants-service.conf | 2 +- src/zmb-ad/install-service.sh | 69 ++++++++++++++++++++++++-- 4 files changed, 131 insertions(+), 6 deletions(-) diff --git a/src/zmb-ad-join/constants-service.conf b/src/zmb-ad-join/constants-service.conf index 568e7ca..f3ce8f9 100644 --- a/src/zmb-ad-join/constants-service.conf +++ b/src/zmb-ad-join/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP="1" # Create unprivileged container LXC_UNPRIVILEGED="0" diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index 6bd3af4..d5783ea 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -51,12 +51,14 @@ restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery tinker panic 0 EOF +echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list + # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default server { @@ -156,3 +158,63 @@ ssh-keygen -q -f "$HOME/.ssh/id_rsa" -N "" -b 4096 systemctl unmask samba-ad-dc systemctl enable samba-ad-dc systemctl restart samba-ad-dc $ADDITIONAL_SERVICES + +# configure ad backup +cat << EOF > /usr/local/bin/smb-backup +#!/bin/bash +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +rc=0 +keep=$1 +if \$1 ; then + keep=\$1 +fi + +mkdir -p /${LXC_SHAREFS_MOUNTPOINT}/{online,offline} + +prune () { + backup_type=\$1 + if [ \$(find /${LXC_SHAREFS_MOUNTPOINT}/\$backup_type/*.tar.bz2 | wc -l) -gt \$keep ]; then + find /${LXC_SHAREFS_MOUNTPOINT}/\$backup_type/*.tar.bz2 | head --lines=-\$keep | xargs -d '\n' rm + fi +} + +echo "\$(date) Starting samba-ad-dc online backup" +if echo -e "${LXC_ADMIN_PASS}" | samba-tool domain backup online --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/online --server=${LXC_HOSTNAME}.${LXC_DOMAIN} -UAdministrator ; then + echo "\$(date) Finished samba-ad-dc online backup. Cleaning up old online backups..." + prune online +else + echo "\$(date) samba-ad-dc online backup failed" + rc=\$((\$rc + 1)) +fi + +echo "\$(date) Starting samba-ad-dc offline backup" +if samba-tool domain backup offline --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/offline ; then + echo "\$(date) Finished samba-ad-dc offline backup. Cleaning up old offline backups..." + prune offline +else + echo "S(date) samba-ad-dc offline backup failed" + rc=\$((\$rc + 1)) +fi + +exit \$rc +EOF +chmod +x /usr/local/bin/smb-backup + +cat << EOF > /etc/cron.d/smb-backup +23 * * * * root /usr/local/bin/smb-backup 7 >> /var/log/smb-backup.log 2>&1 +EOF + +cat << EOF > /etc/logrotate.d/smb-backup +/var/log/smb-backup.log { + weekly + rotate 12 + compress + delaycompress + missingok + notifempty + create 644 root root +} +EOF + +smb-backup 7 diff --git a/src/zmb-ad/constants-service.conf b/src/zmb-ad/constants-service.conf index 50f8bb1..a5fc127 100644 --- a/src/zmb-ad/constants-service.conf +++ b/src/zmb-ad/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP="1" # Create unprivileged container LXC_UNPRIVILEGED="0" diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 941ef65..6326e5a 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -57,12 +57,14 @@ restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery tinker panic 0 EOF +echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list + # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworn-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default @@ -121,8 +123,6 @@ EOF mkdir -p /var/lib/samba/bind-dns/dns fi - - # stop + disable samba services and remove default config systemctl disable --now smbd nmbd winbind systemd-resolved rm -f /etc/samba/smb.conf @@ -133,8 +133,71 @@ samba-tool domain provision --use-rfc2307 --realm=$ZMB_REALM --domain=$ZMB_DOMAI ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf +# disable password expiry for administrator +samba-tool user setexpiry Administrator --noexpiry + systemctl unmask samba-ad-dc systemctl enable samba-ad-dc systemctl restart samba-ad-dc $ADDITIONAL_SERVICES +# configure ad backup +cat << EOF > /usr/local/bin/smb-backup +#!/bin/bash +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +rc=0 +keep=$1 +if \$1 ; then + keep=\$1 +fi + +mkdir -p /${LXC_SHAREFS_MOUNTPOINT}/{online,offline} + +prune () { + backup_type=\$1 + if [ \$(find /${LXC_SHAREFS_MOUNTPOINT}/\$backup_type/*.tar.bz2 | wc -l) -gt \$keep ]; then + find /${LXC_SHAREFS_MOUNTPOINT}/\$backup_type/*.tar.bz2 | head --lines=-\$keep | xargs -d '\n' rm + fi +} + +echo "\$(date) Starting samba-ad-dc online backup" +if echo -e "${LXC_ADMIN_PASS}" | samba-tool domain backup online --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/online --server=${LXC_HOSTNAME}.${LXC_DOMAIN} -UAdministrator ; then + echo "\$(date) Finished samba-ad-dc online backup. Cleaning up old online backups..." + prune online +else + echo "\$(date) samba-ad-dc online backup failed" + rc=\$((\$rc + 1)) +fi + +echo "\$(date) Starting samba-ad-dc offline backup" +if samba-tool domain backup offline --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/offline ; then + echo "\$(date) Finished samba-ad-dc offline backup. Cleaning up old offline backups..." + prune offline +else + echo "S(date) samba-ad-dc offline backup failed" + rc=\$((\$rc + 1)) +fi + +exit \$rc +EOF +chmod +x /usr/local/bin/smb-backup + +cat << EOF > /etc/cron.d/smb-backup +23 * * * * root /usr/local/bin/smb-backup 7 >> /var/log/smb-backup.log 2>&1 +EOF + +cat << EOF > /etc/logrotate.d/smb-backup +/var/log/smb-backup.log { + weekly + rotate 12 + compress + delaycompress + missingok + notifempty + create 644 root root +} +EOF + +smb-backup 7 + exit 0 \ No newline at end of file From 677383edb00142dd01e7bc8821ea1db849ef7b9f Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 21:57:55 +0100 Subject: [PATCH 044/129] Switch to backports --- src/zmb-standalone/install-service.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/zmb-standalone/install-service.sh b/src/zmb-standalone/install-service.sh index 7865323..827aac6 100644 --- a/src/zmb-standalone/install-service.sh +++ b/src/zmb-standalone/install-service.sh @@ -12,10 +12,12 @@ source /root/constants-service.conf apt-key adv --fetch-keys https://repo.45drives.com/key/gpg.asc echo "deb https://repo.45drives.com/debian focal main" > /etc/apt/sources.list.d/45drives.list +echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list + apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba samba-common samba-common-bin samba-dsdb-modules samba-vfs-modules samba-libs libwbclient0 winbind wsdd -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" --no-install-recommends cockpit cockpit-identities cockpit-file-sharing cockpit-navigator +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba samba-common samba-common-bin samba-dsdb-modules samba-vfs-modules samba-libs libwbclient0 winbind wsdd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" --no-install-recommends cockpit cockpit-identities cockpit-file-sharing cockpit-navigator USER=$(echo "$ZMB_ADMIN_USER" | awk '{print tolower($0)}') useradd --comment "Zamba fileserver admin" --create-home --shell /bin/bash $USER From 38590ee60aa71f9da4e568a86eec0c56d14bf17a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 21:58:17 +0100 Subject: [PATCH 045/129] Switch to backports --- src/zmb-member/install-service.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/zmb-member/install-service.sh b/src/zmb-member/install-service.sh index f8c35ef..6e4e3e2 100644 --- a/src/zmb-member/install-service.sh +++ b/src/zmb-member/install-service.sh @@ -9,9 +9,11 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf +echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list + apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd mv /etc/krb5.conf /etc/krb5.conf.bak cat > /etc/krb5.conf < Date: Sun, 29 Oct 2023 21:59:30 +0100 Subject: [PATCH 046/129] Add smb/cups server draft --- src/zmb-cups/constants-service.conf | 26 +++++++ src/zmb-cups/install-service.sh | 106 ++++++++++++++++++++++++++++ 2 files changed, 132 insertions(+) create mode 100644 src/zmb-cups/constants-service.conf create mode 100644 src/zmb-cups/install-service.sh diff --git a/src/zmb-cups/constants-service.conf b/src/zmb-cups/constants-service.conf new file mode 100644 index 0000000..d68871d --- /dev/null +++ b/src/zmb-cups/constants-service.conf @@ -0,0 +1,26 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="0" + +# enable nesting feature +LXC_NESTING="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=1024 + +# service dependent meta tags +SERVICE_TAGS="samba,member,fileserver" \ No newline at end of file diff --git a/src/zmb-cups/install-service.sh b/src/zmb-cups/install-service.sh new file mode 100644 index 0000000..f13919e --- /dev/null +++ b/src/zmb-cups/install-service.sh @@ -0,0 +1,106 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list + +apt update + +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl cups samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd + +mv /etc/krb5.conf /etc/krb5.conf.bak +cat > /etc/krb5.conf < /etc/samba/smb.conf <> /etc/pam.d/common-session + +systemctl restart winbind nmbd + +chown -R ${ZMB_ADMIN_USER}:"domain admins" /var/lib/samba/printers +chmod -R 2775 /var/lib/samba/printers +setfacl -Rb /var/lib/samba/printers +setfacl -Rm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers +setfacl -Rdm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers +echo -e "${ZMB_ADMIN_PASS}" | net rpc rights grant "${ZMB_DOMAIN}\\Domain Admins" SePrintOperatorPrivilege -U "${ZMB_DOMAIN}\\${ZMB_ADMIN_USER}" +echo -e "!root = ${ZMB_DOMAIN}\\administrator ${ZMB_DOMAIN}\\Administrator" > /etc/samba/user.map + +cupsctl --remote-admin + +systemctl restart cups smbd nmbd winbind wsdd From a93bda84ae63b9fddcd7bdaa0cf92de0eea2ff20 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 21:59:53 +0100 Subject: [PATCH 047/129] Set zabbix version to 6.5 (7.0 beta) --- src/zabbix/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zabbix/install-service.sh b/src/zabbix/install-service.sh index 9a4ac6a..8a0402a 100644 --- a/src/zabbix/install-service.sh +++ b/src/zabbix/install-service.sh @@ -10,7 +10,7 @@ source /root/zamba.conf source /root/constants-service.conf apt-key adv --fetch https://repo.zabbix.com/zabbix-official-repo.key -echo "deb https://repo.zabbix.com/zabbix/6.0/debian/ $(lsb_release -cs) main contrib non-free" > /etc/apt/sources.list.d/zabbix-6.0.list +echo "deb https://repo.zabbix.com/zabbix/6.5/debian/ $(lsb_release -cs) main contrib non-free" > /etc/apt/sources.list.d/zabbix-6.5.list wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list From 05260c545667fd50cc1f446fd03554cf8cb57350 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 22:26:06 +0100 Subject: [PATCH 048/129] Fix install line --- src/zmb-ad/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 6326e5a..13336ff 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -64,7 +64,7 @@ apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworn-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default From 16330657cd12478de5701b69405f165e046c6689 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 22:27:34 +0100 Subject: [PATCH 049/129] Fix cpu cores --- install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install.sh b/install.sh index d4e6ce2..bbdcc9f 100755 --- a/install.sh +++ b/install.sh @@ -131,7 +131,7 @@ fi echo "Will now create LXC Container $LXC_NBR!"; if [ $LXC_THREADS -gt 0 ]; then - LXC_CORES=--cores$LXC_THREADS + LXC_CORES=--cores\ $LXC_THREADS fi # Create the container From f2d28c9c8b83075802c83d34b91681648b682f2b Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 22:27:56 +0100 Subject: [PATCH 050/129] Remove splitdns from defaults --- src/zmb-ad/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zmb-ad/constants-service.conf b/src/zmb-ad/constants-service.conf index a5fc127..b9dbc8b 100644 --- a/src/zmb-ad/constants-service.conf +++ b/src/zmb-ad/constants-service.conf @@ -29,7 +29,7 @@ LXC_NESTING="1" # Example: # OPTIONAL_FEATURES=(wsdd) # OPTIONAL_FEATURES=(wsdd splitdns) -OPTIONAL_FEATURES=(wsdd splitdns) +OPTIONAL_FEATURES=(wsdd) # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 From 54883a83d114baf4bbd83577c23f6ea4e8a0ff16 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 22:28:32 +0100 Subject: [PATCH 051/129] Remove splitdns from default --- src/zmb-ad-join/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zmb-ad-join/constants-service.conf b/src/zmb-ad-join/constants-service.conf index f3ce8f9..f4c0d1a 100644 --- a/src/zmb-ad-join/constants-service.conf +++ b/src/zmb-ad-join/constants-service.conf @@ -29,7 +29,7 @@ LXC_NESTING="1" # Example: # OPTIONAL_FEATURES=(wsdd) # OPTIONAL_FEATURES=(wsdd splitdns) -OPTIONAL_FEATURES=(wsdd splitdns) +OPTIONAL_FEATURES=(wsdd) # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 From fbe274117f0d33c52e1f13782ccb6e821ebfed2f Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 22:35:07 +0100 Subject: [PATCH 052/129] Add ressource pool parameter --- conf/zamba.conf.example | 3 +++ install.sh | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index b45134d..d76b20c 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -87,6 +87,9 @@ LXC_VIM_BG_DARK=1 # Default random password length LXC_RANDOMPWD=32 +# Move lxc to specific ressource pool +LXC_RESSOURCE_POOL="" + # Automatically add meta tags to lxc container LXC_AUTOTAG=1 diff --git a/install.sh b/install.sh index bbdcc9f..ce499a7 100755 --- a/install.sh +++ b/install.sh @@ -134,9 +134,15 @@ if [ $LXC_THREADS -gt 0 ]; then LXC_CORES=--cores\ $LXC_THREADS fi + +if [[ $LXC_RESSOURCE_POOL != "" ]]; then + LXC_POOL=--pool\ $LXC_RESSOURCE_POOL +fi + + # Create the container set +u -pct create $LXC_NBR $TAGS $LXC_CORES --password $LXC_PWD -unprivileged $LXC_UNPRIVILEGED $LXC_TEMPLATE_STORAGE:vztmpl/$TMPL_NAME -rootfs $LXC_ROOTFS_STORAGE:$LXC_ROOTFS_SIZE; +pct create $LXC_NBR $TAGS $LXC_CORES $LXC_POOL --password $LXC_PWD -unprivileged $LXC_UNPRIVILEGED $LXC_TEMPLATE_STORAGE:vztmpl/$TMPL_NAME -rootfs $LXC_ROOTFS_STORAGE:$LXC_ROOTFS_SIZE; set -u sleep 2; From 3ce6d7c2ae321d4fa15efc60f23f29759fb48fbc Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 22:58:18 +0100 Subject: [PATCH 053/129] fix backup, systemd-resolved --- install.sh | 4 ++++ src/zmb-ad/install-service.sh | 9 ++------- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/install.sh b/install.sh index ce499a7..8c556fa 100755 --- a/install.sh +++ b/install.sh @@ -193,3 +193,7 @@ elif [[ $service == "zmb-ad-join" ]]; then pct set $LXC_NBR -nameserver "${LXC_IP%/*} $LXC_DNS" fi pct start $LXC_NBR +if [[ $service == "zmb-ad" ]] || [[ $service == "zmb-ad-join" ]]; then + sleep 5 + pct exec $LXC_NBR /usr/local/bin/smb-backup 7 +fi \ No newline at end of file diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 13336ff..f4e6e17 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -124,7 +124,7 @@ EOF fi # stop + disable samba services and remove default config -systemctl disable --now smbd nmbd winbind systemd-resolved +systemctl disable --now smbd nmbd winbind systemd-resolved > /dev/null 2>&1 rm -f /etc/samba/smb.conf rm -f /etc/krb5.conf @@ -146,10 +146,7 @@ cat << EOF > /usr/local/bin/smb-backup PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin rc=0 -keep=$1 -if \$1 ; then - keep=\$1 -fi +keep=\$1 mkdir -p /${LXC_SHAREFS_MOUNTPOINT}/{online,offline} @@ -198,6 +195,4 @@ cat << EOF > /etc/logrotate.d/smb-backup } EOF -smb-backup 7 - exit 0 \ No newline at end of file From 2164f6d2ce75b87bbcad3d5a22a3ce20aaaad348 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 29 Oct 2023 22:59:43 +0100 Subject: [PATCH 054/129] Fix systemd-resolved, backup --- src/zmb-ad-join/install-service.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index d5783ea..4601e10 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -121,7 +121,7 @@ cat > /etc/krb5.conf < /dev/null 2>&1 rm -f /etc/samba/smb.conf echo -e "$ZMB_ADMIN_PASS" | kinit -V $ZMB_ADMIN_USER @@ -216,5 +216,3 @@ cat << EOF > /etc/logrotate.d/smb-backup create 644 root root } EOF - -smb-backup 7 From 9fa103d8aefa8f13ddd8d76be140e4dd55886f1c Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 30 Oct 2023 00:35:42 +0100 Subject: [PATCH 055/129] Fix backup script --- src/zmb-ad-join/install-service.sh | 2 +- src/zmb-ad/install-service.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index 4601e10..f51cf66 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -180,7 +180,7 @@ prune () { } echo "\$(date) Starting samba-ad-dc online backup" -if echo -e "${LXC_ADMIN_PASS}" | samba-tool domain backup online --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/online --server=${LXC_HOSTNAME}.${LXC_DOMAIN} -UAdministrator ; then +if echo -e '${ZMB_ADMIN_PASS}' | samba-tool domain backup online --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/online --server=${LXC_HOSTNAME}.${LXC_DOMAIN} -UAdministrator ; then echo "\$(date) Finished samba-ad-dc online backup. Cleaning up old online backups..." prune online else diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index f4e6e17..21e5a52 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -158,7 +158,7 @@ prune () { } echo "\$(date) Starting samba-ad-dc online backup" -if echo -e "${LXC_ADMIN_PASS}" | samba-tool domain backup online --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/online --server=${LXC_HOSTNAME}.${LXC_DOMAIN} -UAdministrator ; then +if echo -e '${ZMB_ADMIN_PASS}' | samba-tool domain backup online --targetdir=/${LXC_SHAREFS_MOUNTPOINT}/online --server=${LXC_HOSTNAME}.${LXC_DOMAIN} -UAdministrator ; then echo "\$(date) Finished samba-ad-dc online backup. Cleaning up old online backups..." prune online else From 80ad64f422eeb3f633f8e88844d5e94282463daf Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 27 Nov 2023 21:49:00 +0100 Subject: [PATCH 056/129] Beta ready zmb-cups --- src/zmb-cups/constants-service.conf | 4 ++-- src/zmb-cups/install-service.sh | 35 ++++++++++++++++------------- 2 files changed, 21 insertions(+), 18 deletions(-) diff --git a/src/zmb-cups/constants-service.conf b/src/zmb-cups/constants-service.conf index d68871d..9230b29 100644 --- a/src/zmb-cups/constants-service.conf +++ b/src/zmb-cups/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP="1" # Create unprivileged container LXC_UNPRIVILEGED="0" @@ -23,4 +23,4 @@ LXC_NESTING="1" LXC_MEM_MIN=1024 # service dependent meta tags -SERVICE_TAGS="samba,member,fileserver" \ No newline at end of file +SERVICE_TAGS="samba,member,cups,printserver" diff --git a/src/zmb-cups/install-service.sh b/src/zmb-cups/install-service.sh index f13919e..ed53a43 100644 --- a/src/zmb-cups/install-service.sh +++ b/src/zmb-cups/install-service.sh @@ -19,7 +19,7 @@ mv /etc/krb5.conf /etc/krb5.conf.bak cat > /etc/krb5.conf < /etc/samba/smb.conf < /etc/samba/smb.conf <> / systemctl restart winbind nmbd -chown -R ${ZMB_ADMIN_USER}:"domain admins" /var/lib/samba/printers -chmod -R 2775 /var/lib/samba/printers -setfacl -Rb /var/lib/samba/printers -setfacl -Rm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers -setfacl -Rdm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers -echo -e "${ZMB_ADMIN_PASS}" | net rpc rights grant "${ZMB_DOMAIN}\\Domain Admins" SePrintOperatorPrivilege -U "${ZMB_DOMAIN}\\${ZMB_ADMIN_USER}" -echo -e "!root = ${ZMB_DOMAIN}\\administrator ${ZMB_DOMAIN}\\Administrator" > /etc/samba/user.map +mkdir -p /${LXC_SHAREFS_MOUNTPOINT}/{spool,printerdrivers} +cp -rv /var/lib/samba/printers/* /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +chown -R root:"domain admins" /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +chmod -R 1777 /${LXC_SHAREFS_MOUNTPOINT}/spool +chmod -R 2775 /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rb /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r-x,o::--- /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rdm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r-x,o::--- /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +echo -e "${ZMB_ADMIN_PASS}" | net rpc rights grant "${ZMB_DOMAIN}\\domain admins" SePrintOperatorPrivilege -U "${ZMB_DOMAIN}\\${ZMB_ADMIN_USER}" +systemctl disable --now cups-browsed.service cupsctl --remote-admin -systemctl restart cups smbd nmbd winbind wsdd +systemctl restart cups smbd nmbd winbind wsdd \ No newline at end of file From 4dbb11c3bd5ac99aa0fb0b81b80751e54cd15e9c Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Wed, 29 Nov 2023 19:45:03 +0100 Subject: [PATCH 057/129] Set checkmk version to 2.2.0p14 --- src/checkmk/constants-service.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index 38f948e..bd543e5 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -20,7 +20,7 @@ LXC_UNPRIVILEGED="1" LXC_NESTING="1" # checkmk version -CMK_VERSION=2.2.0p7 +CMK_VERSION=2.2.0p14 # build number of the debian package (needs to start with underscore) CMK_BUILD=_0 @@ -28,4 +28,4 @@ CMK_BUILD=_0 LXC_MEM_MIN=2048 # service dependent meta tags -SERVICE_TAGS="apache2" \ No newline at end of file +SERVICE_TAGS="apache2" From 11a8f4ecc322eab67d8b998bd13d09d77b8bc068 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Wed, 29 Nov 2023 19:45:29 +0100 Subject: [PATCH 058/129] Change ntp server from ntpd to chrony --- src/zmb-ad-join/install-service.sh | 52 ++++++++++++++------------- src/zmb-ad/install-service.sh | 57 ++++++++++++++---------------- 2 files changed, 53 insertions(+), 56 deletions(-) diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index f51cf66..7cc51e8 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -27,38 +27,40 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -## configure ntp -cat << EOF > /etc/ntp.conf -# Local clock. Note that is not the "localhost" address! -server 127.127.1.0 -fudge 127.127.1.0 stratum 10 -# Where to retrieve the time from -server 0.de.pool.ntp.org iburst prefer -server 1.de.pool.ntp.org iburst prefer -server 2.de.pool.ntp.org iburst prefer -driftfile /var/lib/ntp/ntp.drift -logfile /var/log/ntp -ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ -# Access control -# Default restriction: Allow clients only to query the time -restrict default kod nomodify notrap nopeer mssntp -# No restrictions for "localhost" -restrict 127.0.0.1 -# Enable the time sources to only provide time to this host -restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -tinker panic 0 -EOF - echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils chrony sipcalc DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils + +mkdir -p /etc/chrony/conf.d +mkdir -p /etc/systemd/system/chrony.service.d + +cat << EOF > /etc/default/chrony +# This is a configuration file for /etc/init.d/chrony and +# /lib/systemd/system/chrony.service; it allows you to pass various options to +# the chrony daemon without editing the init script or service file. + +# Options to pass to chrony. +DAEMON_OPTS="-x -F 1" +EOF + +cat << EOF > /etc/systemd/system/chrony.service.d/override.conf +[Unit] +ConditionCapability= +EOF + +cat << EOF > /etc/chrony/conf.d/samba.conf +bindcmdaddress $(sipcalc ${LXC_IP} | grep -m1 "Host address" | rev | cut -d' ' -f1 | rev) +server de.pool.ntp.org iburst +server europe.pool.ntp.org iburst +allow $(sipcalc ${LXC_IP} | grep -m1 "Network address" | rev | cut -d' ' -f1 | rev)/$(sipcalc ${LXC_IP} | grep -m1 "Network mask (bits)" | rev | cut -d' ' -f1 | rev) +ntpsigndsocket /var/lib/samba/ntp_signd +EOF + if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default server { diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 21e5a52..d9d8fa3 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -27,45 +27,40 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -## configure ntp -cat << EOF > /etc/ntp.conf -# Local clock. Note that is not the "localhost" address! -server 127.127.1.0 -fudge 127.127.1.0 stratum 10 - -# Where to retrieve the time from -server 0.de.pool.ntp.org iburst prefer -server 1.de.pool.ntp.org iburst prefer -server 2.de.pool.ntp.org iburst prefer - -driftfile /var/lib/ntp/ntp.drift -logfile /var/log/ntp -ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ - -# Access control -# Default restriction: Allow clients only to query the time -restrict default kod nomodify notrap nopeer mssntp - -# No restrictions for "localhost" -restrict 127.0.0.1 - -# Enable the time sources to only provide time to this host -restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery - -tinker panic 0 -EOF - echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils chrony sipcalc DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils +mkdir -p /etc/chrony/conf.d +mkdir -p /etc/systemd/system/chrony.service.d + +cat << EOF > /etc/default/chrony +# This is a configuration file for /etc/init.d/chrony and +# /lib/systemd/system/chrony.service; it allows you to pass various options to +# the chrony daemon without editing the init script or service file. + +# Options to pass to chrony. +DAEMON_OPTS="-x -F 1" +EOF + +cat << EOF > /etc/systemd/system/chrony.service.d/override.conf +[Unit] +ConditionCapability= +EOF + +cat << EOF > /etc/chrony/conf.d/samba.conf +bindcmdaddress $(sipcalc ${LXC_IP} | grep -m1 "Host address" | rev | cut -d' ' -f1 | rev) +server de.pool.ntp.org iburst +server europe.pool.ntp.org iburst +allow $(sipcalc ${LXC_IP} | grep -m1 "Network address" | rev | cut -d' ' -f1 | rev)/$(sipcalc ${LXC_IP} | grep -m1 "Network mask (bits)" | rev | cut -d' ' -f1 | rev) +ntpsigndsocket /var/lib/samba/ntp_signd +EOF + if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default server { From 98d2aae0c4e92cd91f523d30abf4a555623f0b4a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 20:48:50 +0100 Subject: [PATCH 059/129] Update unifi, fix mongodb repo --- src/unifi/install-service.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/unifi/install-service.sh b/src/unifi/install-service.sh index b09541f..be830d6 100644 --- a/src/unifi/install-service.sh +++ b/src/unifi/install-service.sh @@ -11,10 +11,10 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -wget -O /etc/apt/trusted.gpg.d/mongodb-3.6.asc https://www.mongodb.org/static/pgp/server-3.6.asc +wget -O /etc/apt/trusted.gpg.d/mongodb-4.4.asc https://pgp.mongodb.com/server-4.4.asc wget -O /etc/apt/trusted.gpg.d/unifi.gpg https://dl.ubnt.com/unifi/unifi-repo.gpg -echo "deb http://repo.mongodb.org/apt/debian stretch/mongodb-org/3.6 main" > /etc/apt/sources.list.d/mongodb.list +echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" > /etc/apt/sources.list.d/mongodb.list echo "deb http://www.ui.com/downloads/unifi/debian stable ubiquiti" > /etc/apt/sources.list.d/unifi.list apt update From c6e381e4fc40a06d435bdabb1129feb64c0bcf48 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 20:53:51 +0100 Subject: [PATCH 060/129] Test unifi on debian 12 --- src/unifi/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index ccb3471..7824d7f 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" From 60b1d9c6ec3ce08ada5bd3aade132345d51683de Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 20:59:51 +0100 Subject: [PATCH 061/129] reset unifi to debian-11 --- src/unifi/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index 7824d7f..ccb3471 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-12-standard" +LXC_TEMPLATE_VERSION="debian-11-standard" # Create sharefs mountpoint LXC_MP="0" From 3977496d8ec006ca07d3c04d054c782966cce223 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 21:03:12 +0100 Subject: [PATCH 062/129] Comment unifi os version --- src/unifi/constants-service.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index ccb3471..56502bd 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -9,6 +9,8 @@ # Debian Version, which will be installed LXC_TEMPLATE_VERSION="debian-11-standard" +# !!!! Leave at debian 11, currently unifi depends on mongodb-server <= 4.4 and libssl1.1 +# libssl1.1 is unsupported on debian bookworm # Create sharefs mountpoint LXC_MP="0" From 6ac88f649b00bc54fa5912df6389b3a5f234e291 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 13:46:06 +0100 Subject: [PATCH 063/129] Add keyctl parameter --- install.sh | 2 +- src/ansible-semaphore/constants-service.conf | 3 +++ src/bookstack/constants-service.conf | 3 +++ src/checkmk/constants-service.conf | 3 +++ src/debian-priv/constants-service.conf | 3 +++ src/debian-unpriv/constants-service.conf | 3 +++ src/ecodms/constants-service.conf | 3 +++ src/gitea/constants-service.conf | 3 +++ src/kimai/constants-service.conf | 3 +++ src/kopano-core/constants-service.conf | 3 +++ src/mailpiler/constants-service.conf | 3 +++ src/matrix/constants-service.conf | 3 +++ src/nextcloud/constants-service.conf | 3 +++ src/omada/constants-service.conf | 3 +++ src/onlyoffice/constants-service.conf | 3 +++ src/open3a/constants-service.conf | 3 +++ src/proxmox-pbs/constants-service.conf | 3 +++ src/rei3/constants-service.conf | 3 +++ src/unifi/constants-service.conf | 3 +++ src/urbackup/constants-service.conf | 3 +++ src/vaultwarden/constants-service.conf | 3 +++ src/zabbix/constants-service.conf | 3 +++ src/zammad/constants-service.conf | 3 +++ src/zmb-ad-join/constants-service.conf | 3 +++ src/zmb-ad/constants-service.conf | 3 +++ src/zmb-cups/constants-service.conf | 3 +++ src/zmb-member/constants-service.conf | 3 +++ src/zmb-standalone/constants-service.conf | 3 +++ 28 files changed, 82 insertions(+), 1 deletion(-) diff --git a/install.sh b/install.sh index 8c556fa..92eca48 100755 --- a/install.sh +++ b/install.sh @@ -149,7 +149,7 @@ sleep 2; # Check vlan configuration if [[ $LXC_VLAN != "NONE" ]];then VLAN=",tag=$LXC_VLAN"; else VLAN=""; fi # Reconfigure conatiner -pct set $LXC_NBR -memory $LXC_MEM -swap $LXC_SWAP -hostname $LXC_HOSTNAME -onboot 1 -timezone $LXC_TIMEZONE -features nesting=$LXC_NESTING; +pct set $LXC_NBR -memory $LXC_MEM -swap $LXC_SWAP -hostname $LXC_HOSTNAME -onboot 1 -timezone $LXC_TIMEZONE -features nesting=$LXC_NESTING,keyctl=$LXC_KEYCTL; if [ $LXC_DHCP == true ]; then pct set $LXC_NBR -net0 "name=eth0,bridge=$LXC_BRIDGE,ip=dhcp,type=veth$VLAN" else diff --git a/src/ansible-semaphore/constants-service.conf b/src/ansible-semaphore/constants-service.conf index 8bc8c52..89fe5aa 100644 --- a/src/ansible-semaphore/constants-service.conf +++ b/src/ansible-semaphore/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/bookstack/constants-service.conf b/src/bookstack/constants-service.conf index 384ed69..5fbe65d 100644 --- a/src/bookstack/constants-service.conf +++ b/src/bookstack/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index bd543e5..f4b4382 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # checkmk version CMK_VERSION=2.2.0p14 # build number of the debian package (needs to start with underscore) diff --git a/src/debian-priv/constants-service.conf b/src/debian-priv/constants-service.conf index 2474bf3..7d06bc8 100644 --- a/src/debian-priv/constants-service.conf +++ b/src/debian-priv/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=512 diff --git a/src/debian-unpriv/constants-service.conf b/src/debian-unpriv/constants-service.conf index 0bdacfe..ae9bfcc 100644 --- a/src/debian-unpriv/constants-service.conf +++ b/src/debian-unpriv/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=512 diff --git a/src/ecodms/constants-service.conf b/src/ecodms/constants-service.conf index 592389e..86a2eda 100644 --- a/src/ecodms/constants-service.conf +++ b/src/ecodms/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # set ecodms release version ECODMS_RELEASE=ecodms_230164 diff --git a/src/gitea/constants-service.conf b/src/gitea/constants-service.conf index 513daa3..fa61d04 100644 --- a/src/gitea/constants-service.conf +++ b/src/gitea/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the IP from the SQL server GITEA_DB_IP="127.0.0.1" diff --git a/src/kimai/constants-service.conf b/src/kimai/constants-service.conf index c4ceb4e..8fc122c 100644 --- a/src/kimai/constants-service.conf +++ b/src/kimai/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of kimai mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') #KIMAI_VERSION="main" diff --git a/src/kopano-core/constants-service.conf b/src/kopano-core/constants-service.conf index d2e5808..b34a62d 100644 --- a/src/kopano-core/constants-service.conf +++ b/src/kopano-core/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') KOPANO_VERSION="latest" diff --git a/src/mailpiler/constants-service.conf b/src/mailpiler/constants-service.conf index 4523fd3..b4bdda8 100644 --- a/src/mailpiler/constants-service.conf +++ b/src/mailpiler/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') PILER_VERSION="1.3.12" # Defines the version of sphinx to install diff --git a/src/matrix/constants-service.conf b/src/matrix/constants-service.conf index f020016..793aee5 100644 --- a/src/matrix/constants-service.conf +++ b/src/matrix/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/nextcloud/constants-service.conf b/src/nextcloud/constants-service.conf index 51f9a33..fcb9e9a 100644 --- a/src/nextcloud/constants-service.conf +++ b/src/nextcloud/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') NEXTCLOUD_VERSION="latest" diff --git a/src/omada/constants-service.conf b/src/omada/constants-service.conf index ccb3471..048e0ad 100644 --- a/src/omada/constants-service.conf +++ b/src/omada/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=2048 diff --git a/src/onlyoffice/constants-service.conf b/src/onlyoffice/constants-service.conf index 4322e18..81018da 100644 --- a/src/onlyoffice/constants-service.conf +++ b/src/onlyoffice/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + ONLYOFFICE_DB_HOST=localhost ONLYOFFICE_DB_NAME=onlyoffice diff --git a/src/open3a/constants-service.conf b/src/open3a/constants-service.conf index 384ed69..5fbe65d 100644 --- a/src/open3a/constants-service.conf +++ b/src/open3a/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/proxmox-pbs/constants-service.conf b/src/proxmox-pbs/constants-service.conf index cf7b529..13579f1 100644 --- a/src/proxmox-pbs/constants-service.conf +++ b/src/proxmox-pbs/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Backup ubdir where Urbackup will store backups PBS_DATA="backup" diff --git a/src/rei3/constants-service.conf b/src/rei3/constants-service.conf index c941967..5a22a77 100644 --- a/src/rei3/constants-service.conf +++ b/src/rei3/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the IP from the SQL server REI3_DB_IP="127.0.0.1" diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index 56502bd..babc82b 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -21,6 +21,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=2048 diff --git a/src/urbackup/constants-service.conf b/src/urbackup/constants-service.conf index a393450..b24adc9 100644 --- a/src/urbackup/constants-service.conf +++ b/src/urbackup/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Backup ubdir where Urbackup will store backups URBACKUP_DATA="urbackup" diff --git a/src/vaultwarden/constants-service.conf b/src/vaultwarden/constants-service.conf index c8a86ef..b14393b 100644 --- a/src/vaultwarden/constants-service.conf +++ b/src/vaultwarden/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the name from the SQL database VAULTWARDEN_DB_NAME="vaultwarden" diff --git a/src/zabbix/constants-service.conf b/src/zabbix/constants-service.conf index b8157a1..f15397e 100644 --- a/src/zabbix/constants-service.conf +++ b/src/zabbix/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the IP from the SQL server ZABBIX_DB_IP="127.0.0.1" diff --git a/src/zammad/constants-service.conf b/src/zammad/constants-service.conf index 0558f97..92cc445 100644 --- a/src/zammad/constants-service.conf +++ b/src/zammad/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=4096 diff --git a/src/zmb-ad-join/constants-service.conf b/src/zmb-ad-join/constants-service.conf index f4c0d1a..32ece93 100644 --- a/src/zmb-ad-join/constants-service.conf +++ b/src/zmb-ad-join/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # add optional features to samba ad dc # CURRENTLY SUPPORTED: diff --git a/src/zmb-ad/constants-service.conf b/src/zmb-ad/constants-service.conf index b9dbc8b..0939fc1 100644 --- a/src/zmb-ad/constants-service.conf +++ b/src/zmb-ad/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # add optional features to samba ad dc # CURRENTLY SUPPORTED: diff --git a/src/zmb-cups/constants-service.conf b/src/zmb-cups/constants-service.conf index 9230b29..cefc51f 100644 --- a/src/zmb-cups/constants-service.conf +++ b/src/zmb-cups/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/zmb-member/constants-service.conf b/src/zmb-member/constants-service.conf index bd524f3..1abbb20 100644 --- a/src/zmb-member/constants-service.conf +++ b/src/zmb-member/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/zmb-standalone/constants-service.conf b/src/zmb-standalone/constants-service.conf index c9d5a2a..e5088ee 100644 --- a/src/zmb-standalone/constants-service.conf +++ b/src/zmb-standalone/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 From 0ab5cffbef989d01aa1c2702821d65e3048d0971 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 13:47:07 +0100 Subject: [PATCH 064/129] Add docker service --- src/docker/constants-service.conf | 29 +++++++++++++++++++++++++++++ src/docker/install-service.sh | 16 ++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 src/docker/constants-service.conf create mode 100644 src/docker/install-service.sh diff --git a/src/docker/constants-service.conf b/src/docker/constants-service.conf new file mode 100644 index 0000000..32cc867 --- /dev/null +++ b/src/docker/constants-service.conf @@ -0,0 +1,29 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=2048 + +# service dependent meta tags +SERVICE_TAGS="" \ No newline at end of file diff --git a/src/docker/install-service.sh b/src/docker/install-service.sh new file mode 100644 index 0000000..aa63ac9 --- /dev/null +++ b/src/docker/install-service.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# Add Docker's official GPG key: +install -m 0755 -d /etc/apt/keyrings +curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg +chmod a+r /etc/apt/keyrings/docker.gpg + +# Add the repository to Apt sources: +echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null +apt-get update +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \ No newline at end of file From 8644cab71fe8400fb31e54e079854ea30c16c833 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 17:17:12 +0100 Subject: [PATCH 065/129] Add portainer and portainer agent option --- conf/zamba.conf.example | 7 +++- src/docker/install-service.sh | 65 ++++++++++++++++++++++++++++++++++- 2 files changed, 70 insertions(+), 2 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index d76b20c..38dfd03 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -209,4 +209,9 @@ VW_SMTP_PASSWORD='' SEMAPHORE_ADMIN=admin SEMAPHORE_ADMIN_DISPLAY_NAME="Semaphore Administrator" SEMAPHORE_ADMIN_EMAIL="admin@zmb.rocks" -SEMAPHORE_ADMIN_PASSWORD='Start123' \ No newline at end of file +SEMAPHORE_ADMIN_PASSWORD='Start123' + +############### docker Section ############### + +# Install Portainer (=full), Protainer Agent (=agent) or none +PORTAINER=none \ No newline at end of file diff --git a/src/docker/install-service.sh b/src/docker/install-service.sh index aa63ac9..c242173 100644 --- a/src/docker/install-service.sh +++ b/src/docker/install-service.sh @@ -5,6 +5,10 @@ # (C) 2021 Script design and prototype by Markus Helmke # (C) 2021 Script rework and documentation by Thorsten Spille +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + # Add Docker's official GPG key: install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg @@ -13,4 +17,63 @@ chmod a+r /etc/apt/keyrings/docker.gpg # Add the repository to Apt sources: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null apt-get update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \ No newline at end of file +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin + +SECRET=$(random_password) +myip=$(ip a s dev eth0 | grep -m1 inet | cut -d' ' -f6 | cut -d'/' -f1) + +install_portainer_full() { + mkdir -p /opt/portainer/data + cd /opt/portainer + cat << EOF > /opt/portainer/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/portainer:latest + volumes: + - ./data:/data + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "8000:8000" + - "9443:9443" + command: --admin-password-file=/data/admin_password +EOF + echo -n "$SECRET" > ./data/admin_password + + docker compose pull + docker compose up -d + echo -e "\n######################################################################\n\n You can access Portainer with your browser at https://${myip}:9443\n\n Please note the following admin password to access the portainer:\n '$SECRET'\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +install_portainer_agent() { + mkdir -p /opt/portainer-agent/data + cd /opt/portainer-agent + cat << EOF > /opt/portainer-agent/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/agent:latest + volumes: + - /var/lib/docker/volumes:/var/lib/docker/volumes + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "9001:9001" +EOF + + docker compose pull + docker compose up -d + + echo -e "\n######################################################################\n\n Please enter the following data into the Portainer "Add environment" wizard:\n\tEnvironment address: ${myip}:9001\n\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +case $PORTAINER in + full) install_portainer_full ;; + agent) install_portainer_agent ;; + *) echo -e "\n######################################################################\n\n Enjoy your Docker intallation.\n\n######################################################################" ;; +esac \ No newline at end of file From a9853a6fbeb871a851bdfbc51fcce5b015cd4ed3 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 21:15:21 +0100 Subject: [PATCH 066/129] Add authentik container --- src/authentik/constants-service.conf | 29 ++++++++ src/authentik/install-service.sh | 107 +++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 src/authentik/constants-service.conf create mode 100644 src/authentik/install-service.sh diff --git a/src/authentik/constants-service.conf b/src/authentik/constants-service.conf new file mode 100644 index 0000000..32cc867 --- /dev/null +++ b/src/authentik/constants-service.conf @@ -0,0 +1,29 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=2048 + +# service dependent meta tags +SERVICE_TAGS="" \ No newline at end of file diff --git a/src/authentik/install-service.sh b/src/authentik/install-service.sh new file mode 100644 index 0000000..b454a7c --- /dev/null +++ b/src/authentik/install-service.sh @@ -0,0 +1,107 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +# Add Docker's official GPG key: +install -m 0755 -d /etc/apt/keyrings +curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg +chmod a+r /etc/apt/keyrings/docker.gpg + +# Add the repository to Apt sources: +echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null +apt-get update +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin pwgen + +SECRET=$(random_password) +myip=$(ip a s dev eth0 | grep -m1 inet | cut -d' ' -f6 | cut -d'/' -f1) + +install_portainer_full() { + mkdir -p /opt/portainer/data + cd /opt/portainer + cat << EOF > /opt/portainer/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/portainer:latest + volumes: + - ./data:/data + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "8000:8000" + - "9443:9443" + command: --admin-password-file=/data/admin_password +EOF + echo -n "$SECRET" > ./data/admin_password + + docker compose pull + docker compose up -d + echo -e "\n######################################################################\n\n You can access Portainer with your browser at https://${myip}:9443\n\n Please note the following admin password to access the portainer:\n '$SECRET'\n Enjoy your Docker intallation.\n\n######################################################################\n\n Setup your authentik instance by entering https://${myip}/if/flow/initial-setup/ into your browser.\n\n######################################################################" + +} + +install_portainer_agent() { + mkdir -p /opt/portainer-agent/data + cd /opt/portainer-agent + cat << EOF > /opt/portainer-agent/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/agent:latest + volumes: + - /var/lib/docker/volumes:/var/lib/docker/volumes + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "9001:9001" +EOF + + docker compose pull + docker compose up -d + + echo -e "\n######################################################################\n\n Please enter the following data into the Portainer "Add environment" wizard:\n\tEnvironment address: ${myip}:9001\n\n Enjoy your Docker intallation.\n\n######################################################################\n\n Setup your authentik instance by entering https://${myip}/if/flow/initial-setup/ into your browser.\n\n######################################################################" + +} + +mkdir -p /opt/authentik +wget -O /opt/authentik/docker-compose.yml https://goauthentik.io/docker-compose.yml +cd /opt/authentik +cat << EOF > .env +PG_PASS=$(pwgen -s 40 1) +AUTHENTIK_SECRET_KEY=$(pwgen -s 50 1) +AUTHENTIK_DISABLE_UPDATE_CHECK=false +AUTHENTIK_ERROR_REPORTING__ENABLED=false +AUTHENTIK_DISABLE_STARTUP_ANALYTICS=true +AUTHENTIK_AVATARS=initials +COMPOSE_PORT_HTTP=80 +COMPOSE_PORT_HTTPS=443 +AUTHENTIK_EMAIL__HOST= +AUTHENTIK_EMAIL__PORT= +AUTHENTIK_EMAIL__USERNAME= +AUTHENTIK_EMAIL__PASSWORD= +# Use StartTLS +AUTHENTIK_EMAIL__USE_TLS=false +# Use SSL +AUTHENTIK_EMAIL__USE_SSL=false +AUTHENTIK_EMAIL__TIMEOUT=10 +# Email address authentik will send from, should have a correct @domain +AUTHENTIK_EMAIL__FROM= +EOF + +docker compose pull +docker compose up -d + +case $PORTAINER in + full) install_portainer_full ;; + agent) install_portainer_agent ;; + *) echo -e "\n######################################################################\n\n Enjoy your authentik intallation.\n\n######################################################################\n\n Setup your authentik instance by entering https://${myip}/if/flow/initial-setup/ into your browser.\n\n######################################################################" ;; +esac \ No newline at end of file From f3db293064109e3f5d6aad2eedfa2b4dcb41faf8 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 21:45:13 +0100 Subject: [PATCH 067/129] Add mailcow --- src/mailcow/constants-service.conf | 29 +++ src/mailcow/install-service.sh | 362 +++++++++++++++++++++++++++++ 2 files changed, 391 insertions(+) create mode 100644 src/mailcow/constants-service.conf create mode 100644 src/mailcow/install-service.sh diff --git a/src/mailcow/constants-service.conf b/src/mailcow/constants-service.conf new file mode 100644 index 0000000..dc0939c --- /dev/null +++ b/src/mailcow/constants-service.conf @@ -0,0 +1,29 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=8192 + +# service dependent meta tags +SERVICE_TAGS="docker" \ No newline at end of file diff --git a/src/mailcow/install-service.sh b/src/mailcow/install-service.sh new file mode 100644 index 0000000..69e5c44 --- /dev/null +++ b/src/mailcow/install-service.sh @@ -0,0 +1,362 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +# Add Docker's official GPG key: +install -m 0755 -d /etc/apt/keyrings +curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg +chmod a+r /etc/apt/keyrings/docker.gpg + +# Add the repository to Apt sources: +echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null +apt-get update +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get purge -y -qq postfix + +SECRET=$(random_password) +myip=$(ip a s dev eth0 | grep -m1 inet | cut -d' ' -f6 | cut -d'/' -f1) + +install_portainer_full() { + mkdir -p /opt/portainer/data + cd /opt/portainer + cat << EOF > /opt/portainer/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/portainer:latest + volumes: + - ./data:/data + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "8000:8000" + - "9443:9443" + command: --admin-password-file=/data/admin_password +EOF + echo -n "$SECRET" > ./data/admin_password + + docker compose pull + docker compose up -d + echo -e "\n######################################################################\n\n You can access Portainer with your browser at https://${myip}:9443\n\n Please note the following admin password to access the portainer:\n '$SECRET'\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +install_portainer_agent() { + mkdir -p /opt/portainer-agent/data + cd /opt/portainer-agent + cat << EOF > /opt/portainer-agent/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/agent:latest + volumes: + - /var/lib/docker/volumes:/var/lib/docker/volumes + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "9001:9001" +EOF + + docker compose pull + docker compose up -d + + echo -e "\n######################################################################\n\n Please enter the following data into the Portainer "Add environment" wizard:\n\tEnvironment address: ${myip}:9001\n\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +cd /opt +git clone https://github.com/mailcow/mailcow-dockerized +cd mailcow-dockerized + +cat << EOF > mailcow.conf +# ------------------------------ +# mailcow web ui configuration +# ------------------------------ +# example.org is _not_ a valid hostname, use a fqdn here. +# Default admin user is "admin" +# Default password is "moohoo" + +MAILCOW_HOSTNAME=${LXC_HOSTNAME}.${LXC_DOMAIN} + +# Password hash algorithm +# Only certain password hash algorithm are supported. For a fully list of supported schemes, +# see https://docs.mailcow.email/models/model-passwd/ +MAILCOW_PASS_SCHEME=BLF-CRYPT + +# ------------------------------ +# SQL database configuration +# ------------------------------ + +DBNAME=mailcow +DBUSER=mailcow + +# Please use long, random alphanumeric strings (A-Za-z0-9) + +DBPASS=$(LC_ALL=C /dev/null | head -c 28) +DBROOT=$(LC_ALL=C /dev/null | head -c 28) + +# ------------------------------ +# HTTP/S Bindings +# ------------------------------ + +# You should use HTTPS, but in case of SSL offloaded reverse proxies: +# Might be important: This will also change the binding within the container. +# If you use a proxy within Docker, point it to the ports you set below. +# Do _not_ use IP:PORT in HTTP(S)_BIND or HTTP(S)_PORT +# IMPORTANT: Do not use port 8081, 9081 or 65510! +# Example: HTTP_BIND=1.2.3.4 +# For IPv4 leave it as it is: HTTP_BIND= & HTTPS_PORT= +# For IPv6 see https://docs.mailcow.email/post_installation/firststeps-ip_bindings/ + +HTTP_PORT=80 +HTTP_BIND= + +HTTPS_PORT=443 +HTTPS_BIND= + +# ------------------------------ +# Other bindings +# ------------------------------ +# You should leave that alone +# Format: 11.22.33.44:25 or 12.34.56.78:465 etc. + +SMTP_PORT=25 +SMTPS_PORT=465 +SUBMISSION_PORT=587 +IMAP_PORT=143 +IMAPS_PORT=993 +POP_PORT=110 +POPS_PORT=995 +SIEVE_PORT=4190 +DOVEADM_PORT=127.0.0.1:19991 +SQL_PORT=127.0.0.1:13306 +SOLR_PORT=127.0.0.1:18983 +REDIS_PORT=127.0.0.1:7654 + +# Your timezone +# See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for a list of timezones +# Use the column named 'TZ identifier' + pay attention for the column named 'Notes' + +TZ=${LXC_TIMEZONE} + +# Fixed project name +# Please use lowercase letters only + +COMPOSE_PROJECT_NAME=mailcowdockerized + +# Used Docker Compose version +# Switch here between native (compose plugin) and standalone +# For more informations take a look at the mailcow docs regarding the configuration options. +# Normally this should be untouched but if you decided to use either of those you can switch it manually here. +# Please be aware that at least one of those variants should be installed on your machine or mailcow will fail. + +DOCKER_COMPOSE_VERSION=native + +# Set this to "allow" to enable the anyone pseudo user. Disabled by default. +# When enabled, ACL can be created, that apply to "All authenticated users" +# This should probably only be activated on mail hosts, that are used exclusivly by one organisation. +# Otherwise a user might share data with too many other users. +ACL_ANYONE=disallow + +# Garbage collector cleanup +# Deleted domains and mailboxes are moved to /var/vmail/_garbage/timestamp_sanitizedstring +# How long should objects remain in the garbage until they are being deleted? (value in minutes) +# Check interval is hourly + +MAILDIR_GC_TIME=7200 + +# Additional SAN for the certificate +# +# You can use wildcard records to create specific names for every domain you add to mailcow. +# Example: Add domains "example.com" and "example.net" to mailcow, change ADDITIONAL_SAN to a value like: +#ADDITIONAL_SAN=imap.*,smtp.* +# This will expand the certificate to "imap.example.com", "smtp.example.com", "imap.example.net", "smtp.example.net" +# plus every domain you add in the future. +# +# You can also just add static names... +#ADDITIONAL_SAN=srv1.example.net +# ...or combine wildcard and static names: +#ADDITIONAL_SAN=imap.*,srv1.example.com +# + +ADDITIONAL_SAN= + +# Additional server names for mailcow UI +# +# Specify alternative addresses for the mailcow UI to respond to +# This is useful when you set mail.* as ADDITIONAL_SAN and want to make sure mail.maildomain.com will always point to the mailcow UI. +# If the server name does not match a known site, Nginx decides by best-guess and may redirect users to the wrong web root. +# You can understand this as server_name directive in Nginx. +# Comma separated list without spaces! Example: ADDITIONAL_SERVER_NAMES=a.b.c,d.e.f + +ADDITIONAL_SERVER_NAMES= + +# Skip running ACME (acme-mailcow, Let's Encrypt certs) - y/n + +SKIP_LETS_ENCRYPT=y + +# Create seperate certificates for all domains - y/n +# this will allow adding more than 100 domains, but some email clients will not be able to connect with alternative hostnames +# see https://doc.dovecot.org/admin_manual/ssl/sni_support +ENABLE_SSL_SNI=n + +# Skip IPv4 check in ACME container - y/n + +SKIP_IP_CHECK=n + +# Skip HTTP verification in ACME container - y/n + +SKIP_HTTP_VERIFICATION=n + +# Skip ClamAV (clamd-mailcow) anti-virus (Rspamd will auto-detect a missing ClamAV container) - y/n + +SKIP_CLAMD=n + +# Skip SOGo: Will disable SOGo integration and therefore webmail, DAV protocols and ActiveSync support (experimental, unsupported, not fully implemented) - y/n + +SKIP_SOGO=n + +# Skip Solr on low-memory systems or if you do not want to store a readable index of your mails in solr-vol-1. + +SKIP_SOLR=n + +# Solr heap size in MB, there is no recommendation, please see Solr docs. +# Solr is a prone to run OOM and should be monitored. Unmonitored Solr setups are not recommended. + +SOLR_HEAP=1024 + +# Allow admins to log into SOGo as email user (without any password) + +ALLOW_ADMIN_EMAIL_LOGIN=n + +# Enable watchdog (watchdog-mailcow) to restart unhealthy containers + +USE_WATCHDOG=y + +# Send watchdog notifications by mail (sent from watchdog@MAILCOW_HOSTNAME) +# CAUTION: +# 1. You should use external recipients +# 2. Mails are sent unsigned (no DKIM) +# 3. If you use DMARC, create a separate DMARC policy ("v=DMARC1; p=none;" in _dmarc.MAILCOW_HOSTNAME) +# Multiple rcpts allowed, NO quotation marks, NO spaces + +#WATCHDOG_NOTIFY_EMAIL=a@example.com,b@example.com,c@example.com +#WATCHDOG_NOTIFY_EMAIL= + +# Send notifications to a webhook URL that receives a POST request with the content type "application/json". +# You can use this to send notifications to services like Discord, Slack and others. +#WATCHDOG_NOTIFY_WEBHOOK=https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +# JSON body included in the webhook POST request. Needs to be in single quotes. +# Following variables are available: SUBJECT, BODY +#WATCHDOG_NOTIFY_WEBHOOK_BODY='{"username": "mailcow Watchdog", "content": "**${SUBJECT}**\n${BODY}"}' + +# Notify about banned IP (includes whois lookup) +WATCHDOG_NOTIFY_BAN=n + +# Send a notification when the watchdog is started. +WATCHDOG_NOTIFY_START=y + +# Subject for watchdog mails. Defaults to "Watchdog ALERT" followed by the error message. +#WATCHDOG_SUBJECT= + +# Checks if mailcow is an open relay. Requires a SAL. More checks will follow. +# https://www.servercow.de/mailcow?lang=en +# https://www.servercow.de/mailcow?lang=de +# No data is collected. Opt-in and anonymous. +# Will only work with unmodified mailcow setups. +WATCHDOG_EXTERNAL_CHECKS=n + +# Enable watchdog verbose logging +WATCHDOG_VERBOSE=n + +# Max log lines per service to keep in Redis logs + +LOG_LINES=9999 + +# Internal IPv4 /24 subnet, format n.n.n (expands to n.n.n.0/24) +# Use private IPv4 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses + +IPV4_NETWORK=172.22.1 + +# Internal IPv6 subnet in fc00::/7 +# Use private IPv6 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses + +IPV6_NETWORK=fd4d:6169:6c63:6f77::/64 + +# Use this IPv4 for outgoing connections (SNAT) + +#SNAT_TO_SOURCE= + +# Use this IPv6 for outgoing connections (SNAT) + +#SNAT6_TO_SOURCE= + +# Create or override an API key for the web UI +# You _must_ define API_ALLOW_FROM, which is a comma separated list of IPs +# An API key defined as API_KEY has read-write access +# An API key defined as API_KEY_READ_ONLY has read-only access +# Allowed chars for API_KEY and API_KEY_READ_ONLY: a-z, A-Z, 0-9, - +# You can define API_KEY and/or API_KEY_READ_ONLY + +#API_KEY= +#API_KEY_READ_ONLY= +#API_ALLOW_FROM=172.22.1.1,127.0.0.1 + +# mail_home is ~/Maildir +MAILDIR_SUB=Maildir + +# SOGo session timeout in minutes +SOGO_EXPIRE_SESSION=480 + +# DOVECOT_MASTER_USER and DOVECOT_MASTER_PASS must both be provided. No special chars. +# Empty by default to auto-generate master user and password on start. +# User expands to DOVECOT_MASTER_USER@mailcow.local +# LEAVE EMPTY IF UNSURE +DOVECOT_MASTER_USER= +# LEAVE EMPTY IF UNSURE +DOVECOT_MASTER_PASS= + +# Let's Encrypt registration contact information +# Optional: Leave empty for none +# This value is only used on first order! +# Setting it at a later point will require the following steps: +# https://docs.mailcow.email/troubleshooting/debug-reset_tls/ +ACME_CONTACT= + +# WebAuthn device manufacturer verification +# After setting WEBAUTHN_ONLY_TRUSTED_VENDORS=y only devices from trusted manufacturers are allowed +# root certificates can be placed for validation under mailcow-dockerized/data/web/inc/lib/WebAuthn/rootCertificates +WEBAUTHN_ONLY_TRUSTED_VENDORS=n + +# Spamhaus Data Query Service Key +# Optional: Leave empty for none +# Enter your key here if you are using a blocked ASN (OVH, AWS, Cloudflare e.g) for the unregistered Spamhaus Blocklist. +# If empty, it will completely disable Spamhaus blocklists if it detects that you are running on a server using a blocked AS. +# Otherwise it will work normally. +SPAMHAUS_DQS_KEY= + +EOF + +chmod 600 mailcow.conf + +mkdir -p data/assets/ssl + +openssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl/key.pem -out data/assets/ssl/cert.pem -days 365 -subj "/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${LXC_HOSTNAME}.${LXC_DOMAIN}" -sha256 -nodes + +docker compose pull +docker compose up -d + +case $PORTAINER in + full) install_portainer_full ;; + agent) install_portainer_agent ;; + *) echo -e "\n######################################################################\n\n Enjoy your Docker intallation.\n\n######################################################################" ;; +esac \ No newline at end of file From f8c3d90ebee91fdfbe402232a0368f927d6e0f63 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 21:45:34 +0100 Subject: [PATCH 068/129] Authentik: add docker tag --- src/authentik/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/authentik/constants-service.conf b/src/authentik/constants-service.conf index 32cc867..ca2f81b 100644 --- a/src/authentik/constants-service.conf +++ b/src/authentik/constants-service.conf @@ -26,4 +26,4 @@ LXC_KEYCTL="1" LXC_MEM_MIN=2048 # service dependent meta tags -SERVICE_TAGS="" \ No newline at end of file +SERVICE_TAGS="docker" \ No newline at end of file From 3b3174e19cf3dac0c715911b478f4127dc257d50 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 22:51:55 +0100 Subject: [PATCH 069/129] Add mailcow-dockerized --- src/mailcow/constants-service.conf | 2 +- src/mailcow/install-service.sh | 76 ++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+), 1 deletion(-) diff --git a/src/mailcow/constants-service.conf b/src/mailcow/constants-service.conf index dc0939c..520118f 100644 --- a/src/mailcow/constants-service.conf +++ b/src/mailcow/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP="1" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/mailcow/install-service.sh b/src/mailcow/install-service.sh index 69e5c44..e058097 100644 --- a/src/mailcow/install-service.sh +++ b/src/mailcow/install-service.sh @@ -346,12 +346,88 @@ SPAMHAUS_DQS_KEY= EOF +cat << EOF > data/conf/nginx/redirect.conf +server { + root /web; + listen 80 default_server; + listen [::]:80 default_server; + include /etc/nginx/conf.d/server_name.active; + if ( \$request_uri ~* "%0A|%0D" ) { return 403; } + location ^~ /.well-known/acme-challenge/ { + allow all; + default_type "text/plain"; + } + location / { + return 301 https://\$host\$uri\$is_args\$args; + } +} +EOF + +cat << EOF > /etc/cron.daily/mailcowbackup +#!/bin/sh + +# Backup mailcow data +# https://docs.mailcow.email/backup_restore/b_n_r-backup/ + +set -e + +OUT="\$(mktemp)" +export MAILCOW_BACKUP_LOCATION="/$LXC_SHAREFS_MOUNTPOINT/backup" +SCRIPT="/opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh" +PARAMETERS="backup all" +OPTIONS="--delete-days 7" +mkdir -p \$MAILCOW_BACKUP_LOCATION + +# run command +set +e +"\${SCRIPT}" \${PARAMETERS} \${OPTIONS} 2>&1 > "\$OUT" +RESULT=\$? + +if [ \$RESULT -ne 0 ] + then + echo "\${SCRIPT} \${PARAMETERS} \${OPTIONS} encounters an error:" + echo "RESULT=\$RESULT" + echo "STDOUT / STDERR:" + cat "\$OUT" +fi +EOF + +chmod +x /etc/cron.daily/mailcowbackup + +cat << EOF > /etc/cron.daily/checkmk-mailcow-update-check +#!/bin/bash +if ! which check_mk_agent ; then + cd /opt/mailcow-dockerized/ && ./update.sh -c >/dev/null + status=\$? + if [ \$status -eq 3 ]; then + state="0 \"mailcow_update\" mailcow_update=0;1;;0;1 No updates available." + elif [ \$status -eq 0 ]; then + state="1 \"mailcow_update\" mailcow_update=1;1;;0;1 Updated code is available.\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master" + else + state="3 \"mailcow_update\" - Unknown output from update script ..." + fi + echo -e "<<>>\n$\state" > /tmp/87000_mailcowupdate + mv /tmp/87000_mailcowupdate /var/lib/check_mk_agent/spool/ +fi +exit +EOF +chmod +x /etc/cron.daily/checkmk-mailcow-update-check + chmod 600 mailcow.conf mkdir -p data/assets/ssl openssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl/key.pem -out data/assets/ssl/cert.pem -days 365 -subj "/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${LXC_HOSTNAME}.${LXC_DOMAIN}" -sha256 -nodes +openssl dhparam -out data/assets/ssl/dhparams.pem 2048 +cat << EOF > /etc/cron.monthly/generate-dhparams +#!/bin/bash +openssl dhparam -out data/assets/ssl/dhparams.gen 4096 > /dev/null 2>&1 +mv data/assets/ssl/dhparams.gen data/assets/ssl/dhparams.pem +systemctl restart nginx +EOF +chmod +x /etc/cron.monthly/generate-dhparams + docker compose pull docker compose up -d From 2f4e674474aa5d2914368384730ba7b20fafe6d0 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 14:37:58 +0100 Subject: [PATCH 070/129] Update install-service.sh 8.0.1-31 --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 4b1627a..54e70df 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -16,7 +16,7 @@ echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/s cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver -Pin: version 7.1.1-23 +Pin: version 8.0.1-31 Pin-Priority: 900 EOF From e18c9b1ed5eba15dd74cdf62686c02cac2499e42 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 15:04:00 +0100 Subject: [PATCH 071/129] Update install-service.sh bookworm --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 54e70df..10a75dd 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -12,7 +12,7 @@ source /root/constants-service.conf ONLYOFFICE_DB_PASS=$(random_password) curl -fsSL https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE | gpg --dearmor | tee /etc/apt/trusted.gpg.d/onlyoffice.gpg >/dev/null -echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/sources.list.d/onlyoffice.list +echo "deb https://download.onlyoffice.com/repo/debian bookworm main" > /etc/apt/sources.list.d/onlyoffice.list cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver From 55f5bd6eec373e493df29e47a92a261758603324 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 15:46:23 +0100 Subject: [PATCH 072/129] Update install-service.sh --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 10a75dd..54e70df 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -12,7 +12,7 @@ source /root/constants-service.conf ONLYOFFICE_DB_PASS=$(random_password) curl -fsSL https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE | gpg --dearmor | tee /etc/apt/trusted.gpg.d/onlyoffice.gpg >/dev/null -echo "deb https://download.onlyoffice.com/repo/debian bookworm main" > /etc/apt/sources.list.d/onlyoffice.list +echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/sources.list.d/onlyoffice.list cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver From 83873fd5a3547a2e98c39589ce8e091c4bb135b5 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 18:07:22 +0100 Subject: [PATCH 073/129] Update install-service.sh 7.2.2 --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 54e70df..6ac97b3 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -16,7 +16,7 @@ echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/s cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver -Pin: version 8.0.1-31 +Pin: version 7.2.2 Pin-Priority: 900 EOF From 773c852c186a14189718a335486eb539fca30e71 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 18:22:42 +0100 Subject: [PATCH 074/129] Update install-service.sh --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 6ac97b3..4b1627a 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -16,7 +16,7 @@ echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/s cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver -Pin: version 7.2.2 +Pin: version 7.1.1-23 Pin-Priority: 900 EOF From d0693c82e211d07dc75b71baec3351cefd2861b2 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Tue, 19 Mar 2024 20:35:05 +0100 Subject: [PATCH 075/129] Update install-service.sh Remove LimitNPROC=64 --- src/vaultwarden/install-service.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/vaultwarden/install-service.sh b/src/vaultwarden/install-service.sh index db2f95b..2fcc438 100644 --- a/src/vaultwarden/install-service.sh +++ b/src/vaultwarden/install-service.sh @@ -64,7 +64,6 @@ Group=vaultwarden EnvironmentFile=/var/lib/vaultwarden/.env ExecStart=/opt/vaultwarden/vaultwarden LimitNOFILE=1048576 -LimitNPROC=64 PrivateTmp=true PrivateDevices=true ProtectHome=true @@ -161,4 +160,4 @@ unlink /etc/nginx/sites-enabled/default systemctl daemon-reload systemctl enable --now vaultwarden -systemctl restart nginx \ No newline at end of file +systemctl restart nginx From ccc69b6d55e8b599a4c47d69c3a69af1442348cb Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Fri, 5 Apr 2024 22:26:06 +0200 Subject: [PATCH 076/129] Change debian repos to deb.debian.org --- src/lxc-base.sh | 12 ++++++------ src/zmb-ad-join/install-service.sh | 2 +- src/zmb-ad/install-service.sh | 2 +- src/zmb-cups/install-service.sh | 2 +- src/zmb-standalone/install-service.sh | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/lxc-base.sh b/src/lxc-base.sh index 67140f8..006f48d 100644 --- a/src/lxc-base.sh +++ b/src/lxc-base.sh @@ -27,9 +27,9 @@ locale-gen $LXC_LOCALE if [ "$LXC_TEMPLATE_VERSION" == "debian-10-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://ftp.halifax.rwth-aachen.de/debian/ buster main contrib +deb http://deb.debian.org/debian/ buster main contrib -deb http://ftp.halifax.rwth-aachen.de/debian/ buster-updates main contrib +deb http://deb.debian.org/debian/ buster-updates main contrib # security updates deb http://security.debian.org/debian-security buster/updates main contrib @@ -38,9 +38,9 @@ EOF elif [ "$LXC_TEMPLATE_VERSION" == "debian-11-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://ftp.halifax.rwth-aachen.de/debian/ bullseye main contrib +deb http://deb.debian.org/debian/ bullseye main contrib -deb http://ftp.halifax.rwth-aachen.de/debian/ bullseye-updates main contrib +deb http://deb.debian.org/debian/ bullseye-updates main contrib # security updates deb http://security.debian.org/debian-security bullseye-security main contrib @@ -49,9 +49,9 @@ EOF elif [ "$LXC_TEMPLATE_VERSION" == "debian-12-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm main contrib +deb http://deb.debian.org/debian/ bookworm main contrib -deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-updates main contrib +deb http://deb.debian.org/debian/ bookworm-updates main contrib # security updates deb http://security.debian.org/debian-security bookworm-security main contrib diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index 7cc51e8..2af7e5e 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -27,7 +27,7 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index d9d8fa3..1a2922e 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -27,7 +27,7 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update diff --git a/src/zmb-cups/install-service.sh b/src/zmb-cups/install-service.sh index ed53a43..821d37d 100644 --- a/src/zmb-cups/install-service.sh +++ b/src/zmb-cups/install-service.sh @@ -9,7 +9,7 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list apt update diff --git a/src/zmb-standalone/install-service.sh b/src/zmb-standalone/install-service.sh index 827aac6..b84f478 100644 --- a/src/zmb-standalone/install-service.sh +++ b/src/zmb-standalone/install-service.sh @@ -12,7 +12,7 @@ source /root/constants-service.conf apt-key adv --fetch-keys https://repo.45drives.com/key/gpg.asc echo "deb https://repo.45drives.com/debian focal main" > /etc/apt/sources.list.d/45drives.list -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list apt update From a3c8efc00d27d24140e3bc411d1689f35697573a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 12:42:58 +0200 Subject: [PATCH 077/129] Remove obsolete PILER_FQDN config parameter --- conf/zamba.conf.example | 2 -- 1 file changed, 2 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 38dfd03..10f0715 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -114,8 +114,6 @@ ZMB_SHARE="share" ############### Mailpiler-Section ############### -# Defines the (public) FQDN of your piler mail archive -PILER_FQDN="mailpiler.zmb.rocks" # Defines the smarthost for piler mail archive PILER_SMARTHOST="mail.zmb.rocks" From 92f7a4774c88b27374c1b98f12f42b09ca6ef1d9 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 16:42:03 +0200 Subject: [PATCH 078/129] Replace mailpiler by piler (updgrade to 1.4) --- src/mailpiler/constants-service.conf | 36 ----- src/mailpiler/install-service.sh | 189 --------------------------- src/piler/constants-service.conf | 27 ++++ src/piler/install-service.sh | 23 ++++ 4 files changed, 50 insertions(+), 225 deletions(-) delete mode 100644 src/mailpiler/constants-service.conf delete mode 100644 src/mailpiler/install-service.sh create mode 100644 src/piler/constants-service.conf create mode 100644 src/piler/install-service.sh diff --git a/src/mailpiler/constants-service.conf b/src/mailpiler/constants-service.conf deleted file mode 100644 index b4bdda8..0000000 --- a/src/mailpiler/constants-service.conf +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/bash - -# Authors: -# (C) 2021 Idea an concept by Christian Zengel -# (C) 2021 Script design and prototype by Markus Helmke -# (C) 2021 Script rework and documentation by Thorsten Spille - -# This file contains the project constants on service level - -# Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" - -# Create sharefs mountpoint -LXC_MP="0" - -# Create unprivileged container -LXC_UNPRIVILEGED="1" - -# enable nesting feature -LXC_NESTING="1" - -# enable keyctl feature -LXC_KEYCTL="0" - -# Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') -PILER_VERSION="1.3.12" -# Defines the version of sphinx to install -PILER_SPHINX_VERSION="3.3.1" -# Defines the php version to install -PILER_PHP_VERSION="7.4" - -# Sets the minimum amount of RAM the service needs for operation -LXC_MEM_MIN=1024 - -# service dependent meta tags -SERVICE_TAGS="php-fpm,nginx,mariadb,sphinx" \ No newline at end of file diff --git a/src/mailpiler/install-service.sh b/src/mailpiler/install-service.sh deleted file mode 100644 index 217bfc6..0000000 --- a/src/mailpiler/install-service.sh +++ /dev/null @@ -1,189 +0,0 @@ -#!/bin/bash - -# Authors: -# (C) 2021 Idea an concept by Christian Zengel -# (C) 2021 Script design and prototype by Markus Helmke -# (C) 2021 Script rework and documentation by Thorsten Spille - -source /root/functions.sh -source /root/zamba.conf -source /root/constants-service.conf - -HOSTNAME=$(hostname -f) - -echo "Ensure your Hostname is set to your Piler FQDN!" - -echo $HOSTNAME - -if - [ "$HOSTNAME" != "$PILER_FQDN" ] -then - echo "Hostname doesn't match $PILER_FQDN! Check install.sh, /etc/hosts, /etc/hostname." && exit -else - echo "Hostname matches $PILER_FQDN, so starting installation." -fi - -# install php -wget -q https://packages.sury.org/php/apt.gpg -O- | apt-key add - -echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list - -apt-key adv --fetch-keys 'https://mariadb.org/mariadb_release_signing_key.asc' -add-apt-repository "deb [arch=amd64] https://mirror.wtnet.de/mariadb/repo/10.5/debian $(lsb_release -cs) main" - -apt update - -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq build-essential libwrap0-dev libpst-dev tnef libytnef0-dev \ -unrtf catdoc libtre-dev tre-agrep poppler-utils libzip-dev unixodbc libpq5 libpoppler-dev openssl libssl-dev memcached telnet nginx \ -mariadb-server default-libmysqlclient-dev python3-mysqldb gcc libwrap0 libzip4 latex2rtf latex2html catdoc tnef zipcmp zipmerge ziptool libsodium23 \ -php$PILER_PHP_VERSION-{fpm,common,ldap,mysql,cli,opcache,phpdbg,gd,memcache,json,readline,zip} - -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt remove --purge -y -qq postfix - -cat > /etc/mysql/conf.d/mailpiler.conf <> /usr/local/etc/piler/config-site.php < + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="0" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=1024 + +# service dependent meta tags +SERVICE_TAGS="php-fpm,nginx,mariadb,manticore" \ No newline at end of file diff --git a/src/piler/install-service.sh b/src/piler/install-service.sh new file mode 100644 index 0000000..406861f --- /dev/null +++ b/src/piler/install-service.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +# Author: +# (C) 2024 Thorsten Spille + +source zamba.conf + +wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg + +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/manticore bookworm main" > /etc/apt/sources.list.d/bashclub-manticore.list +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/testing bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list +apt update + +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends piler + +echo -e "Installation of piler finished." +echo -e "\nFor administration please visit the following Website:" +echo -e "\thttps://${LXC_HOSTNAME}.${LXC_DOMAIN}/" +echo -e "\nLogin with following credentials:" +echo -e "\tUser: admin@local" +echo -e "\tPass: pilerrocks" +echo -e "\n\nPlease have a look the the GOBD notes (in German):" +echo -e "\thttps://${LXC_HOSTNAME}.${LXC_DOMAIN}/gobd" \ No newline at end of file From 72d72bf8d29fff2f08fbeecd7e8a0c1138a573ea Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 16:44:28 +0200 Subject: [PATCH 079/129] Add PILER_BRANCH variable --- conf/zamba.conf.example | 3 +-- src/piler/install-service.sh | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 10f0715..5274fa8 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -114,8 +114,7 @@ ZMB_SHARE="share" ############### Mailpiler-Section ############### -# Defines the smarthost for piler mail archive -PILER_SMARTHOST="mail.zmb.rocks" +PILER_BRANCH=release ############### Matrix-Section ############### diff --git a/src/piler/install-service.sh b/src/piler/install-service.sh index 406861f..f93717f 100644 --- a/src/piler/install-service.sh +++ b/src/piler/install-service.sh @@ -8,7 +8,7 @@ source zamba.conf wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/manticore bookworm main" > /etc/apt/sources.list.d/bashclub-manticore.list -echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/testing bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/$PILER_BRANCH bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends piler From e72430dc0276e43ec85ce9144d283a1a8fc8ab16 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 17:29:27 +0200 Subject: [PATCH 080/129] Fix apt repo --- src/piler/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/piler/install-service.sh b/src/piler/install-service.sh index f93717f..72a7e98 100644 --- a/src/piler/install-service.sh +++ b/src/piler/install-service.sh @@ -8,7 +8,7 @@ source zamba.conf wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/manticore bookworm main" > /etc/apt/sources.list.d/bashclub-manticore.list -echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/$PILER_BRANCH bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/$PILER_BRANCH bookworm main" > /etc/apt/sources.list.d/bashclub-$PILER_BRANCH.list apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends piler From 907093512b79cd25fe617b37b65577ed209d673f Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Wed, 1 May 2024 17:19:19 +0200 Subject: [PATCH 081/129] Update zmb-cups --- src/zmb-cups/constants-service.conf | 4 ++-- src/zmb-cups/install-service.sh | 33 ++++++++++++++++------------- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/src/zmb-cups/constants-service.conf b/src/zmb-cups/constants-service.conf index d68871d..d0fc540 100644 --- a/src/zmb-cups/constants-service.conf +++ b/src/zmb-cups/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP="1" # Create unprivileged container LXC_UNPRIVILEGED="0" @@ -23,4 +23,4 @@ LXC_NESTING="1" LXC_MEM_MIN=1024 # service dependent meta tags -SERVICE_TAGS="samba,member,fileserver" \ No newline at end of file +SERVICE_TAGS="samba,member,fileserver" diff --git a/src/zmb-cups/install-service.sh b/src/zmb-cups/install-service.sh index f13919e..4f12ef9 100644 --- a/src/zmb-cups/install-service.sh +++ b/src/zmb-cups/install-service.sh @@ -19,7 +19,7 @@ mv /etc/krb5.conf /etc/krb5.conf.bak cat > /etc/krb5.conf < /etc/samba/smb.conf < /etc/samba/smb.conf <> / systemctl restart winbind nmbd -chown -R ${ZMB_ADMIN_USER}:"domain admins" /var/lib/samba/printers -chmod -R 2775 /var/lib/samba/printers -setfacl -Rb /var/lib/samba/printers -setfacl -Rm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers -setfacl -Rdm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers -echo -e "${ZMB_ADMIN_PASS}" | net rpc rights grant "${ZMB_DOMAIN}\\Domain Admins" SePrintOperatorPrivilege -U "${ZMB_DOMAIN}\\${ZMB_ADMIN_USER}" -echo -e "!root = ${ZMB_DOMAIN}\\administrator ${ZMB_DOMAIN}\\Administrator" > /etc/samba/user.map +mkdir -p /${LXC_SHAREFS_MOUNTPOINT}/{spool,printerdrivers} +cp -rv /var/lib/samba/printers/* /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +chown -R root:"domain admins" /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +chmod -R 1777 /${LXC_SHAREFS_MOUNTPOINT}/spool +chmod -R 2775 /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rb /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r-x,o::--- /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rdm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r-x,o::--- /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +echo -e "${ZMB_ADMIN_PASS}" | net rpc rights grant "${ZMB_DOMAIN}\\domain admins" SePrintOperatorPrivilege -U "${ZMB_DOMAIN}\\${ZMB_ADMIN_USER}" +systemctl disable --now cups-browsed.service cupsctl --remote-admin From e2245b25280296ab126b7adc89284f50104cbef4 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Sun, 5 May 2024 11:13:27 +0200 Subject: [PATCH 082/129] Set recordsize for mp0 --- conf/zamba.conf.example | 3 ++- install.sh | 5 +++++ src/ansible-semaphore/constants-service.conf | 6 +++++- src/authentik/constants-service.conf | 6 +++++- src/bookstack/constants-service.conf | 6 +++++- src/checkmk/constants-service.conf | 7 ++++++- src/debian-priv/constants-service.conf | 6 +++++- src/debian-unpriv/constants-service.conf | 6 +++++- src/docker/constants-service.conf | 6 +++++- src/ecodms/constants-service.conf | 6 +++++- src/gitea/constants-service.conf | 6 +++++- src/kimai/constants-service.conf | 6 +++++- src/kopano-core/constants-service.conf | 6 +++++- src/mailcow/constants-service.conf | 6 +++++- src/matrix/constants-service.conf | 6 +++++- src/nextcloud/constants-service.conf | 6 +++++- src/omada/constants-service.conf | 6 +++++- src/onlyoffice/constants-service.conf | 6 +++++- src/open3a/constants-service.conf | 6 +++++- src/piler/constants-service.conf | 6 +++++- src/proxmox-pbs/constants-service.conf | 6 +++++- src/rei3/constants-service.conf | 6 +++++- src/unifi/constants-service.conf | 6 +++++- src/urbackup/constants-service.conf | 6 +++++- src/vaultwarden/constants-service.conf | 6 +++++- src/zabbix/constants-service.conf | 6 +++++- src/zammad/constants-service.conf | 6 +++++- src/zmb-ad-join/constants-service.conf | 6 +++++- src/zmb-ad/constants-service.conf | 6 +++++- src/zmb-cups/constants-service.conf | 6 +++++- src/zmb-member/constants-service.conf | 6 +++++- src/zmb-standalone/constants-service.conf | 6 +++++- 32 files changed, 158 insertions(+), 31 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 5274fa8..f0f8bd2 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -25,7 +25,8 @@ LXC_SHAREFS_SIZE="100" # Defines the Proxmox storage where your LXC container's filesystem shared by Zamba will be generated (default: local-zfs) LXC_SHAREFS_STORAGE="local-zfs" # Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) -LXC_SHAREFS_MOUNTPOINT="tank" +# Moved to constants-service.conf, be careful if you override this value +# LXC_SHAREFS_MOUNTPOINT="tank" # cpu core count (default: 0 = unlimited) LXC_THREADS=0 diff --git a/install.sh b/install.sh index 92eca48..560af26 100755 --- a/install.sh +++ b/install.sh @@ -155,11 +155,16 @@ if [ $LXC_DHCP == true ]; then else pct set $LXC_NBR -net0 "name=eth0,bridge=$LXC_BRIDGE,firewall=1,gw=$LXC_GW,ip=$LXC_IP,type=veth$VLAN" -nameserver $LXC_DNS -searchdomain $LXC_DOMAIN fi + sleep 2 if [ $LXC_MP -gt 0 ]; then pct set $LXC_NBR -mp0 $LXC_SHAREFS_STORAGE:$LXC_SHAREFS_SIZE,backup=1,mp=/$LXC_SHAREFS_MOUNTPOINT + pool=$(grep -A 4 $LXC_SHAREFS_MOUNTPOINT /etc/pve/storage.cfg | grep "pool " | cut -d ' ' -f2) + dataset=$(grep mp0 /etc/pve/lxc/$LXC_NBR.conf | cut -d ':' -f3 | cut -d',' -f1) + zfs set recordsize=$LXC_MP_RECORDSIZE $pool/$dataset fi + sleep 2; PS3="Select the Server-Function: " diff --git a/src/ansible-semaphore/constants-service.conf b/src/ansible-semaphore/constants-service.conf index 89fe5aa..9204cd7 100644 --- a/src/ansible-semaphore/constants-service.conf +++ b/src/ansible-semaphore/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/authentik/constants-service.conf b/src/authentik/constants-service.conf index ca2f81b..af4c4ca 100644 --- a/src/authentik/constants-service.conf +++ b/src/authentik/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="var/lib/docker" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/bookstack/constants-service.conf b/src/bookstack/constants-service.conf index 5fbe65d..c4548eb 100644 --- a/src/bookstack/constants-service.conf +++ b/src/bookstack/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index f4b4382..c6b6627 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -10,8 +10,13 @@ # Debian Version, which will be installed LXC_TEMPLATE_VERSION="debian-12-standard" + # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="omd" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/debian-priv/constants-service.conf b/src/debian-priv/constants-service.conf index 7d06bc8..48ffd59 100644 --- a/src/debian-priv/constants-service.conf +++ b/src/debian-priv/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="0" diff --git a/src/debian-unpriv/constants-service.conf b/src/debian-unpriv/constants-service.conf index ae9bfcc..a7e36f5 100644 --- a/src/debian-unpriv/constants-service.conf +++ b/src/debian-unpriv/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/docker/constants-service.conf b/src/docker/constants-service.conf index 32cc867..01b28ca 100644 --- a/src/docker/constants-service.conf +++ b/src/docker/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="var/lib/docker" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/ecodms/constants-service.conf b/src/ecodms/constants-service.conf index 86a2eda..c7744af 100644 --- a/src/ecodms/constants-service.conf +++ b/src/ecodms/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/gitea/constants-service.conf b/src/gitea/constants-service.conf index fa61d04..43c49cd 100644 --- a/src/gitea/constants-service.conf +++ b/src/gitea/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/kimai/constants-service.conf b/src/kimai/constants-service.conf index 8fc122c..a940f2e 100644 --- a/src/kimai/constants-service.conf +++ b/src/kimai/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/kopano-core/constants-service.conf b/src/kopano-core/constants-service.conf index b34a62d..0dae961 100644 --- a/src/kopano-core/constants-service.conf +++ b/src/kopano-core/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-11-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/mailcow/constants-service.conf b/src/mailcow/constants-service.conf index 520118f..2a4ef89 100644 --- a/src/mailcow/constants-service.conf +++ b/src/mailcow/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="var/lib/docker" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/matrix/constants-service.conf b/src/matrix/constants-service.conf index 793aee5..57f799e 100644 --- a/src/matrix/constants-service.conf +++ b/src/matrix/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/nextcloud/constants-service.conf b/src/nextcloud/constants-service.conf index bd39390..684f4c1 100644 --- a/src/nextcloud/constants-service.conf +++ b/src/nextcloud/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/omada/constants-service.conf b/src/omada/constants-service.conf index 048e0ad..83aedc6 100644 --- a/src/omada/constants-service.conf +++ b/src/omada/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-11-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/onlyoffice/constants-service.conf b/src/onlyoffice/constants-service.conf index 81018da..e5ffe58 100644 --- a/src/onlyoffice/constants-service.conf +++ b/src/onlyoffice/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/open3a/constants-service.conf b/src/open3a/constants-service.conf index 5fbe65d..c4548eb 100644 --- a/src/open3a/constants-service.conf +++ b/src/open3a/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/piler/constants-service.conf b/src/piler/constants-service.conf index 9aa8aff..873a465 100644 --- a/src/piler/constants-service.conf +++ b/src/piler/constants-service.conf @@ -9,7 +9,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="var/piler" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/proxmox-pbs/constants-service.conf b/src/proxmox-pbs/constants-service.conf index 13579f1..92b94cb 100644 --- a/src/proxmox-pbs/constants-service.conf +++ b/src/proxmox-pbs/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="128K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/rei3/constants-service.conf b/src/rei3/constants-service.conf index 5a22a77..ac00ebb 100644 --- a/src/rei3/constants-service.conf +++ b/src/rei3/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index babc82b..d9ef60e 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -13,7 +13,11 @@ LXC_TEMPLATE_VERSION="debian-11-standard" # libssl1.1 is unsupported on debian bookworm # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/urbackup/constants-service.conf b/src/urbackup/constants-service.conf index b24adc9..9222b47 100644 --- a/src/urbackup/constants-service.conf +++ b/src/urbackup/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="128K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/vaultwarden/constants-service.conf b/src/vaultwarden/constants-service.conf index b14393b..d9325a7 100644 --- a/src/vaultwarden/constants-service.conf +++ b/src/vaultwarden/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/zabbix/constants-service.conf b/src/zabbix/constants-service.conf index f15397e..8271c81 100644 --- a/src/zabbix/constants-service.conf +++ b/src/zabbix/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/zammad/constants-service.conf b/src/zammad/constants-service.conf index 92cc445..014cafd 100644 --- a/src/zammad/constants-service.conf +++ b/src/zammad/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/zmb-ad-join/constants-service.conf b/src/zmb-ad-join/constants-service.conf index 32ece93..1042bbc 100644 --- a/src/zmb-ad-join/constants-service.conf +++ b/src/zmb-ad-join/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="backup" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="0" diff --git a/src/zmb-ad/constants-service.conf b/src/zmb-ad/constants-service.conf index 0939fc1..6016953 100644 --- a/src/zmb-ad/constants-service.conf +++ b/src/zmb-ad/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="backup" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="0" diff --git a/src/zmb-cups/constants-service.conf b/src/zmb-cups/constants-service.conf index 3bc3806..5bf228d 100644 --- a/src/zmb-cups/constants-service.conf +++ b/src/zmb-cups/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="0" diff --git a/src/zmb-member/constants-service.conf b/src/zmb-member/constants-service.conf index 1abbb20..71c2446 100644 --- a/src/zmb-member/constants-service.conf +++ b/src/zmb-member/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="128K" # Create unprivileged container LXC_UNPRIVILEGED="0" diff --git a/src/zmb-standalone/constants-service.conf b/src/zmb-standalone/constants-service.conf index e5088ee..ffe82ed 100644 --- a/src/zmb-standalone/constants-service.conf +++ b/src/zmb-standalone/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=1 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="128K" # Create unprivileged container LXC_UNPRIVILEGED="0" From d43131f872dc942e01bbc3319719a070cab4f0b6 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 5 May 2024 11:31:59 +0200 Subject: [PATCH 083/129] Fix pool path detection --- install.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/install.sh b/install.sh index 560af26..75485da 100755 --- a/install.sh +++ b/install.sh @@ -160,7 +160,7 @@ sleep 2 if [ $LXC_MP -gt 0 ]; then pct set $LXC_NBR -mp0 $LXC_SHAREFS_STORAGE:$LXC_SHAREFS_SIZE,backup=1,mp=/$LXC_SHAREFS_MOUNTPOINT - pool=$(grep -A 4 $LXC_SHAREFS_MOUNTPOINT /etc/pve/storage.cfg | grep "pool " | cut -d ' ' -f2) + pool=$(grep -A 4 $LXC_SHAREFS_STORAGE /etc/pve/storage.cfg | grep "pool " | cut -d ' ' -f2) dataset=$(grep mp0 /etc/pve/lxc/$LXC_NBR.conf | cut -d ':' -f3 | cut -d',' -f1) zfs set recordsize=$LXC_MP_RECORDSIZE $pool/$dataset fi @@ -201,4 +201,4 @@ pct start $LXC_NBR if [[ $service == "zmb-ad" ]] || [[ $service == "zmb-ad-join" ]]; then sleep 5 pct exec $LXC_NBR /usr/local/bin/smb-backup 7 -fi \ No newline at end of file +fi From ec5bc5796c2dd03091a5f05d869679c7a43fcb81 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 5 May 2024 13:02:58 +0200 Subject: [PATCH 084/129] Fix mailpiler min ram --- src/piler/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/piler/constants-service.conf b/src/piler/constants-service.conf index 873a465..88aac0c 100644 --- a/src/piler/constants-service.conf +++ b/src/piler/constants-service.conf @@ -25,7 +25,7 @@ LXC_NESTING="1" LXC_KEYCTL="0" # Sets the minimum amount of RAM the service needs for operation -LXC_MEM_MIN=1024 +LXC_MEM_MIN=2048 # service dependent meta tags SERVICE_TAGS="php-fpm,nginx,mariadb,manticore" \ No newline at end of file From 8551291e6ffdd4b931c3a79b52628fd3a2ec123b Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 5 May 2024 15:36:09 +0200 Subject: [PATCH 085/129] Fix storage path parser --- install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install.sh b/install.sh index 75485da..6a50fcf 100755 --- a/install.sh +++ b/install.sh @@ -160,7 +160,7 @@ sleep 2 if [ $LXC_MP -gt 0 ]; then pct set $LXC_NBR -mp0 $LXC_SHAREFS_STORAGE:$LXC_SHAREFS_SIZE,backup=1,mp=/$LXC_SHAREFS_MOUNTPOINT - pool=$(grep -A 4 $LXC_SHAREFS_STORAGE /etc/pve/storage.cfg | grep "pool " | cut -d ' ' -f2) + pool=$(grep -A 4 $LXC_SHAREFS_STORAGE /etc/pve/storage.cfg | grep -m1 "pool " | cut -d ' ' -f2) dataset=$(grep mp0 /etc/pve/lxc/$LXC_NBR.conf | cut -d ':' -f3 | cut -d',' -f1) zfs set recordsize=$LXC_MP_RECORDSIZE $pool/$dataset fi From cbea17efdf723821879fa06cf6804698e2a87ca3 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Tue, 14 May 2024 00:19:17 +0200 Subject: [PATCH 086/129] Add repo function --- src/functions.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/functions.sh b/src/functions.sh index a6032a3..9ece872 100644 --- a/src/functions.sh +++ b/src/functions.sh @@ -18,3 +18,14 @@ systemctl restart nginx EOF chmod +x /etc/cron.monthly/generate-dhparams } + +apt_repo() { + apt_name=$1 + apt_key_url=$2 + apt_key_path=/usr/share/keyrings/${apt_name}.gpg + apt_repo_url=$3 + + wget -q -O - ${apt_key_url} | gpg --dearmor -o ${apt_key_path} + echo "deb [signed-by=${apt_key_path}] ${apt_repo_url}" > /etc/apt/sources.list.d/${apt_name}.list + +} \ No newline at end of file From 99a47fb130f6d007ab2cc2a5b8e240300e400133 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Tue, 14 May 2024 00:19:52 +0200 Subject: [PATCH 087/129] update zabbix to 6.5 (7.0 beta) , add timescaledb --- src/zabbix/constants-service.conf | 7 ++++++- src/zabbix/install-service.sh | 25 ++++++++++++++++--------- 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/src/zabbix/constants-service.conf b/src/zabbix/constants-service.conf index 8271c81..9ba34d4 100644 --- a/src/zabbix/constants-service.conf +++ b/src/zabbix/constants-service.conf @@ -13,7 +13,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP=0 # Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) -LXC_SHAREFS_MOUNTPOINT="tank" +LXC_SHAREFS_MOUNTPOINT="data" # Defines the recordsize of mp0 LXC_MP_RECORDSIZE="16K" @@ -42,6 +42,11 @@ ZABBIX_DB_USR="zabbix" # Build a strong password for the SQL user - could be overwritten with something fixed ZABBIX_DB_PWD="$(random_password)" +ZABBIX_VERSION=6.5 #zabbix 7 beta +POSTGRES_VERSION=16 #postgres repo, latest release (2024-05-13) +PHP_VERSION=8.2 # debian 12 default +TS_VERSION=2.14.2 # currently latest by zabbix supported version of timescaledb (2024-05-13) + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=4096 diff --git a/src/zabbix/install-service.sh b/src/zabbix/install-service.sh index 8a0402a..da85ff1 100644 --- a/src/zabbix/install-service.sh +++ b/src/zabbix/install-service.sh @@ -5,20 +5,20 @@ # (C) 2021 Script design and prototype by Markus Helmke # (C) 2021 Script rework and documentation by Thorsten Spille +set -euo pipefail + source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -apt-key adv --fetch https://repo.zabbix.com/zabbix-official-repo.key -echo "deb https://repo.zabbix.com/zabbix/6.5/debian/ $(lsb_release -cs) main contrib non-free" > /etc/apt/sources.list.d/zabbix-6.5.list - -wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - -echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list +apt_repo "zabbix" "https://repo.zabbix.com/zabbix-official-repo.key" "https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/debian/ $(lsb_release -cs) main" +apt_repo "postgresql" "https://www.postgresql.org/media/keys/ACCC4CF8.asc" "http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" +apt_repo "timescaledb" "https://packagecloud.io/timescale/timescaledb/gpgkey" "https://packagecloud.io/timescale/timescaledb/debian/ $(lsb_release -c -s) main" apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql nginx php8.2-pgsql php8.2-fpm zabbix-server-pgsql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent ssl-cert +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql-$POSTGRES_VERSION timescaledb-2-oss-$TS_VERSION-postgresql-$POSTGRES_VERSION postgresql-client timescaledb-tools nginx php$PHP_VERSION-pgsql php$PHP_VERSION-fpm zabbix-server-pgsql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent ssl-cert unlink /etc/nginx/sites-enabled/default @@ -122,7 +122,7 @@ server { } EOF -cat << EOF > /etc/php/7.4/fpm/pool.d/zabbix-php-fpm.conf +cat << EOF > /etc/php/$PHP_VERSION/fpm/pool.d/zabbix-php-fpm.conf [zabbix] user = www-data group = www-data @@ -220,10 +220,17 @@ sed -i "s/false/true/g" /usr/share/zabbix/include/locales.inc.php zcat /usr/share/zabbix-sql-scripts/postgresql/server.sql.gz | sudo -u zabbix psql ${ZABBIX_DB_NAME} +timescaledb-tune --quiet --yes >> /etc/postgresql/$POSTGRES_VERSION/main/postgresql.conf + +systemctl restart postgresql + +echo "CREATE EXTENSION IF NOT EXISTS timescaledb CASCADE;" | sudo -u postgres psql zabbix +cat /usr/share/zabbix-sql-scripts/postgresql/timescaledb/schema.sql | sudo -u zabbix psql ${ZABBIX_DB_NAME} + echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_server.conf generate_dhparam -systemctl enable --now zabbix-server zabbix-agent nginx php8.2-fpm +systemctl enable nginx php$PHP_VERSION-fpm zabbix-server zabbix-agent -systemctl restart zabbix-server zabbix-agent nginx php8.2-fpm \ No newline at end of file +systemctl restart nginx php$PHP_VERSION-fpm zabbix-server zabbix-agent > /dev/null 2>&1 \ No newline at end of file From 592f3cae7d76b46f36c641abbc299f95033782e0 Mon Sep 17 00:00:00 2001 From: Chriz Date: Tue, 14 May 2024 16:44:22 +0200 Subject: [PATCH 088/129] Update constants-service.conf 2.2.0p26 --- src/checkmk/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index c6b6627..3c23dc4 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -28,7 +28,7 @@ LXC_NESTING="1" LXC_KEYCTL="0" # checkmk version -CMK_VERSION=2.2.0p14 +CMK_VERSION=2.2.0p26 # build number of the debian package (needs to start with underscore) CMK_BUILD=_0 From 8ed654f6ea479f46acb447940f9fd9a0953896fe Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Tue, 14 May 2024 22:28:32 +0200 Subject: [PATCH 089/129] Change cmk version to 2.3.0p2, change mountpoint --- src/checkmk/constants-service.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index c6b6627..edb2308 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -14,7 +14,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP=1 # Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) -LXC_SHAREFS_MOUNTPOINT="omd" +LXC_SHAREFS_MOUNTPOINT="opt" # Defines the recordsize of mp0 LXC_MP_RECORDSIZE="16K" @@ -28,7 +28,7 @@ LXC_NESTING="1" LXC_KEYCTL="0" # checkmk version -CMK_VERSION=2.2.0p14 +CMK_VERSION=2.3.0p2 # build number of the debian package (needs to start with underscore) CMK_BUILD=_0 From 333d55916d819db6db565e6b6cbea624e2f20ddd Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Tue, 14 May 2024 22:34:27 +0200 Subject: [PATCH 090/129] add mp settings to apt --- src/apt/constants-service.conf | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/apt/constants-service.conf b/src/apt/constants-service.conf index 2e64d35..0eb1e13 100644 --- a/src/apt/constants-service.conf +++ b/src/apt/constants-service.conf @@ -11,7 +11,11 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="1" +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="srv" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" # Create unprivileged container LXC_UNPRIVILEGED="1" From 69d2653e4b2a7f835b38295e87cdee89ecdc03eb Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Thu, 16 May 2024 12:03:29 +0200 Subject: [PATCH 091/129] Add draft for zabbix-proxy --- src/zabbix-proxy/constants-service.conf | 52 +++++++++++++++++++++++++ src/zabbix-proxy/install-service.sh | 39 +++++++++++++++++++ 2 files changed, 91 insertions(+) create mode 100644 src/zabbix-proxy/constants-service.conf create mode 100644 src/zabbix-proxy/install-service.sh diff --git a/src/zabbix-proxy/constants-service.conf b/src/zabbix-proxy/constants-service.conf new file mode 100644 index 0000000..07b8f78 --- /dev/null +++ b/src/zabbix-proxy/constants-service.conf @@ -0,0 +1,52 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="data" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="0" + + +# Defines the IP from the SQL server +ZABBIX_DB_IP="127.0.0.1" + +# Defines the PORT from the SQL server +ZABBIX_DB_PORT="5432" + +# Defines the name from the SQL database +ZABBIX_DB_NAME="zabbix" + +# Defines the name from the SQL user +ZABBIX_DB_USR="zabbix" + +# Build a strong password for the SQL user - could be overwritten with something fixed +ZABBIX_DB_PWD="$(random_password)" + +ZABBIX_VERSION=6.5 #zabbix 7 beta +POSTGRES_VERSION=16 #postgres repo, latest release (2024-05-13) + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=4096 + +# service dependent meta tags +SERVICE_TAGS="php-fpm,nginx,postgresql" \ No newline at end of file diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh new file mode 100644 index 0000000..0fa0fc0 --- /dev/null +++ b/src/zabbix-proxy/install-service.sh @@ -0,0 +1,39 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +set -euo pipefail + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +apt_repo "zabbix" "https://repo.zabbix.com/zabbix-official-repo.key" "https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/debian/ $(lsb_release -cs) main" +apt_repo "postgresql" "https://www.postgresql.org/media/keys/ACCC4CF8.asc" "http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" + +apt update + +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql-$POSTGRES_VERSION postgresql-client zabbix-proxy-pgsql zabbix-sql-scripts ssl-cert + +timedatectl set-timezone ${LXC_TIMEZONE} + +systemctl enable --now postgresql + +su - postgres <> /etc/zabbix/zabbix_server.conf + + +systemctl enable zabbix-proxy + +systemctl restart zabbix-proxy \ No newline at end of file From d76b7ebfd2e09b751bdd61531caa52285f20a2f7 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Thu, 16 May 2024 12:07:43 +0200 Subject: [PATCH 092/129] Fix db schema import --- src/zabbix-proxy/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 0fa0fc0..08c6007 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -29,7 +29,7 @@ psql -c "CREATE DATABASE ${ZABBIX_DB_NAME} ENCODING UTF8 TEMPLATE template0 OWNE echo "Postgres User ${ZABBIX_DB_USR} and database ${ZABBIX_DB_NAME} created." EOF -zcat /usr/share/zabbix-sql-scripts/postgresql/proxy.sql.gz | sudo -u zabbix psql ${ZABBIX_DB_NAME} +cat /usr/share/zabbix-sql-scripts/postgresql/proxy.sql | sudo -u zabbix psql ${ZABBIX_DB_NAME} echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_server.conf From d1c9615a4a4abfe92851ec2467bb681a0f523dd3 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 12:18:41 +0200 Subject: [PATCH 093/129] add server parameter for zabbix proxy --- conf/zamba.conf.example | 7 ++++++- src/zabbix-proxy/install-service.sh | 3 ++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index f0f8bd2..0af5d85 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -212,4 +212,9 @@ SEMAPHORE_ADMIN_PASSWORD='Start123' ############### docker Section ############### # Install Portainer (=full), Protainer Agent (=agent) or none -PORTAINER=none \ No newline at end of file +PORTAINER=none + +############### zabbix Section ############### + +# (Zabbix Proxy) Name:Port of the zabbix server +ZBX_ADDR=zabbix.zmb.rocks:10051 \ No newline at end of file diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 08c6007..ef00b39 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -31,7 +31,8 @@ EOF cat /usr/share/zabbix-sql-scripts/postgresql/proxy.sql | sudo -u zabbix psql ${ZABBIX_DB_NAME} -echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_server.conf +echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_proxy.conf +echo "Server=${ZBX_ADDR}" >> /etc/zabbix/zabbix_proxy.conf systemctl enable zabbix-proxy From 84173e46a85fd404740666f2bf04e99a299766bc Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 12:47:41 +0200 Subject: [PATCH 094/129] Change zabbix proxy config --- src/zabbix-proxy/constants-service.conf | 2 +- src/zabbix-proxy/install-service.sh | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/zabbix-proxy/constants-service.conf b/src/zabbix-proxy/constants-service.conf index 07b8f78..1f68f3a 100644 --- a/src/zabbix-proxy/constants-service.conf +++ b/src/zabbix-proxy/constants-service.conf @@ -34,7 +34,7 @@ ZABBIX_DB_IP="127.0.0.1" ZABBIX_DB_PORT="5432" # Defines the name from the SQL database -ZABBIX_DB_NAME="zabbix" +ZABBIX_DB_NAME="zabbix_proxy" # Defines the name from the SQL user ZABBIX_DB_USR="zabbix" diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index ef00b39..7921edd 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -32,8 +32,9 @@ EOF cat /usr/share/zabbix-sql-scripts/postgresql/proxy.sql | sudo -u zabbix psql ${ZABBIX_DB_NAME} echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_proxy.conf -echo "Server=${ZBX_ADDR}" >> /etc/zabbix/zabbix_proxy.conf +$srv=$(grep -E "^Server" /etc/zabbix/zabbix_proxy.conf) +sed -i "s/$srv/Server=${ZBX_ADDR}/g" "s/# ListenPort=/ListenPort=/g" "s/Hostname=Zabbix proxy/# Hostname=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf systemctl enable zabbix-proxy From 774217a55c62efacc815c31bdf2de1674683346e Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 12:51:25 +0200 Subject: [PATCH 095/129] Fix var --- src/zabbix-proxy/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 7921edd..787f1dc 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -33,7 +33,7 @@ cat /usr/share/zabbix-sql-scripts/postgresql/proxy.sql | sudo -u zabbix psql ${Z echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_proxy.conf -$srv=$(grep -E "^Server" /etc/zabbix/zabbix_proxy.conf) +srv=$(grep -E "^Server" /etc/zabbix/zabbix_proxy.conf) sed -i "s/$srv/Server=${ZBX_ADDR}/g" "s/# ListenPort=/ListenPort=/g" "s/Hostname=Zabbix proxy/# Hostname=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf systemctl enable zabbix-proxy From 8f668262d8f32dbc57b75b9f7fe0dbe7a5fc6d91 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 12:55:17 +0200 Subject: [PATCH 096/129] Fix zabbix proxy config --- src/zabbix-proxy/install-service.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 787f1dc..6f5b5ff 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -34,7 +34,9 @@ cat /usr/share/zabbix-sql-scripts/postgresql/proxy.sql | sudo -u zabbix psql ${Z echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_proxy.conf srv=$(grep -E "^Server" /etc/zabbix/zabbix_proxy.conf) -sed -i "s/$srv/Server=${ZBX_ADDR}/g" "s/# ListenPort=/ListenPort=/g" "s/Hostname=Zabbix proxy/# Hostname=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/$srv/Server=${ZBX_ADDR}/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/# ListenPort=/ListenPort=/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/Hostname=Zabbix proxy/# Hostname=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf systemctl enable zabbix-proxy From 430e125350c7078c01999087c81b63fb33650fbf Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 12:58:27 +0200 Subject: [PATCH 097/129] Fix hostname in proxy config --- src/zabbix-proxy/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 6f5b5ff..7753011 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -36,7 +36,7 @@ echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_proxy.conf srv=$(grep -E "^Server" /etc/zabbix/zabbix_proxy.conf) sed -i "s/$srv/Server=${ZBX_ADDR}/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/# ListenPort=/ListenPort=/g" /etc/zabbix/zabbix_proxy.conf -sed -i "s/Hostname=Zabbix proxy/# Hostname=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/Hostname=Zabbix proxy/Hostname=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf systemctl enable zabbix-proxy From 52f641e87388ee539abd2f626f73cd3242a883a7 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 17:14:14 +0200 Subject: [PATCH 098/129] Add psk encryption to zabbix proxy --- src/zabbix-proxy/install-service.sh | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 7753011..071f2b3 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -38,6 +38,30 @@ sed -i "s/$srv/Server=${ZBX_ADDR}/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/# ListenPort=/ListenPort=/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/Hostname=Zabbix proxy/Hostname=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf +mkdir -p /var/lib/zabbix +chown -R zabbix:zabbix /var/lib/zabbix/ +chmod 700 /var/lib/zabbix/ + + +psk=$(openssl rand -hex 32) +echo "$psk" > /var/lib/zabbix/proxy.psk +chmod 600 /var/lib/zabbix/proxy.psk + +sed -i "s/# TLSConnect=unencrypted/TLSConnect=psk/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/# TLSAccept=unencrypted/TLSAccept=psk/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/# TLSPSKIdentity=/TLSPSKIdentity=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/# TLSPSKFile=/TLSPSKFile=${psk}/g" /etc/zabbix/zabbix_proxy.conf + systemctl enable zabbix-proxy -systemctl restart zabbix-proxy \ No newline at end of file +systemctl restart zabbix-proxy + + +echo -e "Installation of zabbix-proxy finished." +echo -e "\nPlease register the Proxy on yout zabbix server with following data:" +echo -e "Proxy name:\ŧ${LXC_HOSTNAME}.${LXC_DOMAIN}" +echo -e "Proxy mode: Active" +echo -e "Proxy address:\t$(ip a s dev eth0 | grep -m1 inet | cut -d ' ' -f6 | cut -d'/' -f1)" +echo -e "Encryption:\tPSK" +echo -e "PSK identity:\ŧ${LXC_HOSTNAME}.${LXC_DOMAIN}" +echo -e "PSK:\t\ŧ${psk}" From 2521cbd14e50bf3a9d0ccbf2f7d8212f0cacd1fb Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 17:18:22 +0200 Subject: [PATCH 099/129] fix tabs --- src/zabbix-proxy/install-service.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 071f2b3..aeb4b12 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -59,9 +59,9 @@ systemctl restart zabbix-proxy echo -e "Installation of zabbix-proxy finished." echo -e "\nPlease register the Proxy on yout zabbix server with following data:" -echo -e "Proxy name:\ŧ${LXC_HOSTNAME}.${LXC_DOMAIN}" +echo -e "Proxy name:\t${LXC_HOSTNAME}.${LXC_DOMAIN}" echo -e "Proxy mode: Active" echo -e "Proxy address:\t$(ip a s dev eth0 | grep -m1 inet | cut -d ' ' -f6 | cut -d'/' -f1)" echo -e "Encryption:\tPSK" -echo -e "PSK identity:\ŧ${LXC_HOSTNAME}.${LXC_DOMAIN}" -echo -e "PSK:\t\ŧ${psk}" +echo -e "PSK identity:\t${LXC_HOSTNAME}.${LXC_DOMAIN}" +echo -e "PSK:\t\t${psk}" From 0a34587b399fe4b3c966c31a3811b338e265aa5f Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 17:19:20 +0200 Subject: [PATCH 100/129] fix config --- src/zabbix-proxy/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index aeb4b12..023fbc2 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -50,7 +50,7 @@ chmod 600 /var/lib/zabbix/proxy.psk sed -i "s/# TLSConnect=unencrypted/TLSConnect=psk/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/# TLSAccept=unencrypted/TLSAccept=psk/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/# TLSPSKIdentity=/TLSPSKIdentity=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf -sed -i "s/# TLSPSKFile=/TLSPSKFile=${psk}/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s/# TLSPSKFile=/TLSPSKFile=/var/lib/zabbix/proxy.psk/g" /etc/zabbix/zabbix_proxy.conf systemctl enable zabbix-proxy From 404cf7f66c769c18e96810b497aa80e32351e781 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 17:23:01 +0200 Subject: [PATCH 101/129] fix sed --- src/zabbix-proxy/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 023fbc2..317538a 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -50,7 +50,7 @@ chmod 600 /var/lib/zabbix/proxy.psk sed -i "s/# TLSConnect=unencrypted/TLSConnect=psk/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/# TLSAccept=unencrypted/TLSAccept=psk/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/# TLSPSKIdentity=/TLSPSKIdentity=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf -sed -i "s/# TLSPSKFile=/TLSPSKFile=/var/lib/zabbix/proxy.psk/g" /etc/zabbix/zabbix_proxy.conf +sed -i "s|# TLSPSKFile=|TLSPSKFile=/var/lib/zabbix/proxy.psk|g" /etc/zabbix/zabbix_proxy.conf systemctl enable zabbix-proxy From 9b166bef7a2e33e7ec063612e889d0a50392e23f Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 17:32:59 +0200 Subject: [PATCH 102/129] fix permissions --- src/zabbix-proxy/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 317538a..1657187 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -44,7 +44,7 @@ chmod 700 /var/lib/zabbix/ psk=$(openssl rand -hex 32) -echo "$psk" > /var/lib/zabbix/proxy.psk +sudo -u zabbix echo "$psk" > /var/lib/zabbix/proxy.psk chmod 600 /var/lib/zabbix/proxy.psk sed -i "s/# TLSConnect=unencrypted/TLSConnect=psk/g" /etc/zabbix/zabbix_proxy.conf From 0dc6ef906230f0e0c984a2ef9e02cded78a334e5 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Fri, 17 May 2024 17:37:00 +0200 Subject: [PATCH 103/129] fix permissions --- src/zabbix-proxy/install-service.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index 1657187..d795e83 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -44,7 +44,8 @@ chmod 700 /var/lib/zabbix/ psk=$(openssl rand -hex 32) -sudo -u zabbix echo "$psk" > /var/lib/zabbix/proxy.psk +echo "$psk" > /var/lib/zabbix/proxy.psk +chown zabbix:zabbix /var/lib/zabbix/proxy.psk chmod 600 /var/lib/zabbix/proxy.psk sed -i "s/# TLSConnect=unencrypted/TLSConnect=psk/g" /etc/zabbix/zabbix_proxy.conf From a49ca5208dba20bb27de45461ccea0bc1c60a051 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 25 May 2024 19:56:38 +0200 Subject: [PATCH 104/129] Add freescout container --- src/freescout/constants-service.conf | 33 +++++++ src/freescout/install-service.sh | 133 +++++++++++++++++++++++++++ 2 files changed, 166 insertions(+) create mode 100644 src/freescout/constants-service.conf create mode 100644 src/freescout/install-service.sh diff --git a/src/freescout/constants-service.conf b/src/freescout/constants-service.conf new file mode 100644 index 0000000..c4548eb --- /dev/null +++ b/src/freescout/constants-service.conf @@ -0,0 +1,33 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) +LXC_SHAREFS_MOUNTPOINT="tank" +# Defines the recordsize of mp0 +LXC_MP_RECORDSIZE="16K" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="0" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=1024 + +# service dependent meta tags +SERVICE_TAGS="php-fpm,nginx,mariadb" \ No newline at end of file diff --git a/src/freescout/install-service.sh b/src/freescout/install-service.sh new file mode 100644 index 0000000..cfe3b11 --- /dev/null +++ b/src/freescout/install-service.sh @@ -0,0 +1,133 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +set -euo pipefail + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +webroot=/var/www/html + +LXC_RANDOMPWD=20 +MYSQL_PASSWORD="$(random_password)" + +apt update + +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends unzip sudo nginx-full mariadb-server mariadb-client php php-cli php-zip php-curl php-intl php-fpm php-mysql php-imap php-xml php-mbstring php-gd ssl-cert git + + +echo ‘cgi.fix_pathinfo=0’ >> /etc/php/8.2/fpm/php.ini + +cat << EOF > /etc/nginx/sites-available/default +server { + listen 80; + listen [::]:80; + server_name _; + + return 301 https://$LXC_HOSTNAME.$LXC_DOMAIN; +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name $LXC_HOSTNAME.$LXC_DOMAIN; + + root $webroot/freescout/public; + + index index.php index.html index.htm; + + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; + + client_max_body_size 20M; + + location / { + try_files \$uri \$uri/ /index.php?\$query_string; + } + + location ~ .php$ { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass unix:/var/run/php/php8.2-fpm.sock; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name; + include fastcgi_params; + } + + location ^~ /storage/app/attachment/ { + internal; + alias /var/www/html/storage/app/attachment/; + } + + location ~* ^/storage/attachment/ { + expires 1M; + access_log off; + try_files \$uri \$uri/ /index.php?\$query_string; + } + + location ~* ^/(?:css|js)/.*\.(?:css|js)$ { + expires 2d; + access_log off; + add_header Cache-Control "public, must-revalidate"; + } + + # The list should be in sync with /storage/app/public/uploads/.htaccess and /config/app.php + location ~* ^/storage/.*\.((?!(jpg|jpeg|jfif|pjpeg|pjp|apng|bmp|gif|ico|cur|png|tif|tiff|webp|pdf|txt|diff|patch|json|mp3|wav|ogg|wma)).)*$ { + add_header Content-disposition "attachment; filename=\$2"; + default_type application/octet-stream; + } + + location ~* ^/(?:css|fonts|img|installer|js|modules|[^\\\\\\]+\..*)$ { + expires 1M; + access_log off; + add_header Cache-Control "public"; + } + + location ~ /\. { + deny all; + } +} + +EOF + +rm /var/www/html/*nginx*.html +mkdir -p /etc/nginx/ssl +ln -sf /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/nginx/ssl/fullchain.pem +ln -sf /etc/ssl/private/ssl-cert-snakeoil.key /etc/nginx/ssl/privkey.pem + +mysql -uroot -e "CREATE USER 'freescout'@'localhost' IDENTIFIED BY '$MYSQL_PASSWORD'; +GRANT USAGE ON * . * TO 'freescout'@'localhost' IDENTIFIED BY '$MYSQL_PASSWORD' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0 ; +CREATE DATABASE IF NOT EXISTS freescout; +GRANT ALL PRIVILEGES ON freescout . * TO 'freescout'@'localhost';" + +curl -s https://api.github.com/repos/freescout-helpdesk/freescout/releases/latest | grep tarball_url | cut -d '"' -f 4 | wget -O $webroot/freescout.tar.gz -i - +cd $webroot +tar -vxf freescout.tar.gz +dir=$(ls -d freescout-helpdesk-freescout*) +mv -v $dir freescout +chown -R www-data:www-data /var/www/html +find /var/www/html -type f -exec chmod 664 {} \; +find /var/www/html -type d -exec chmod 775 {} \; +cd $webroot/freescout +APP_KEY=$(sudo -u www-data php artisan key:generate --show) +sudo -u www-data sed -e "s|APP_URL=.*|APP_URL=https://${LXC_HOSTNAME}.${LXC_DOMAIN}|" -e "s|DB_DATABASE=|DB_DATABASE=freescout|" -e "s|DB_USERNAME=|DB_USERNAME=freescout|" -e "s|DB_PASSWORD=|DB_PASSWORD=${MYSQL_PASSWORD}|" -e "s|APP_KEY=|APP_KEY=${APP_KEY}|" .env.example > .env +sudo -u www-data php artisan freescout:clear-cache +sudo -u www-data php artisan storage:link +sudo -u www-data php artisan migrate -n --force +FS_PASSWORD=$(random_password) +sudo -u www-data php artisan freescout:create-user -n --role=admin --firstName=$FS_FIRSTNAME --lastName=$FS_LASTNAME --email=$FS_EMAIL --password=$FS_PASSWORD + +cat << EOF > /etc/cron.d/freescout +* * * * * www-data /bin/php /var/www/html/freescout/artisan schedule:run >> /dev/null 2>&1 +EOF + +systemctl enable --now php8.2-fpm +systemctl restart php8.2-fpm nginx + +LXC_IP=$(ip address show dev eth0 | grep "inet " | cut -d ' ' -f6) + +echo -e "Your freescout installation is now complete. Please continue with setup in your Browser:\nURL:\t\thttps://$(echo $LXC_IP | cut -d'/' -f1)\nLogin:\t\t$FS_EMAIL\nPassword:\t$FS_PASSWORD\n" \ No newline at end of file From 80b2e5c9d12595b6f9606936ddd12f354802323a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 25 May 2024 19:56:57 +0200 Subject: [PATCH 105/129] Add freescout options --- conf/zamba.conf.example | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 0af5d85..714c47d 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -217,4 +217,9 @@ PORTAINER=none ############### zabbix Section ############### # (Zabbix Proxy) Name:Port of the zabbix server -ZBX_ADDR=zabbix.zmb.rocks:10051 \ No newline at end of file +ZBX_ADDR=zabbix.zmb.rocks:10051 + +############### freescout Section ################ +FS_FIRSTNAME=Max +FS_LASTNAME=Mustermann +FS_EMAIL=mail@zmb.rocks \ No newline at end of file From e90395ba3c42816246369adf141c895250fe50f8 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 26 May 2024 00:52:50 +0200 Subject: [PATCH 106/129] remove /etc/hosts manipulation --- src/zammad/install-service.sh | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-) diff --git a/src/zammad/install-service.sh b/src/zammad/install-service.sh index a58a901..b738102 100644 --- a/src/zammad/install-service.sh +++ b/src/zammad/install-service.sh @@ -19,23 +19,6 @@ DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install ssl-cert nginx-full postgresql zammad -cat << EOF >>/etc/hosts -0.0.0.0 image.zammad.com -0.0.0.0 images.zammad.com -0.0.0.0 geo.zammad.com -0.0.0.0 www.zammad.com -0.0.0.0 www.zammad.org -0.0.0.0 www.zammad.net -0.0.0.0 www.zammad.de -0.0.0.0 zammad.com -0.0.0.0 zammad.org -0.0.0.0 zammad.net -0.0.0.0 zammad.de -# -127.0.0.1 elasticsearch -0.0.0.0 geoip.elastic.co -EOF - # Java set startup environment mkdir -p /etc/elasticsearch/jvm.options.d cat << EOF >>/etc/elasticsearch/jvm.options.d/msmx-size.options @@ -165,8 +148,8 @@ systemctl enable elasticsearch.service systemctl restart nginx elasticsearch.service # Elasticsearch conntact to Zammad -zammad run rails r "Setting.set('es_url', 'http://localhost:9200')" +zammad run rails r "Setting.set('es_url', 'http://127.0.0.1:9200')" zammad run rails r "Setting.set('es_index', Socket.gethostname.downcase + '_zammad')" zammad run rails r "User.find_by(email: 'nicole.braun@zammad.org').destroy" systemctl restart elasticsearch.service -zammad run rake searchindex:rebuild \ No newline at end of file +zammad run rake zammad:searchindex:rebuild[$(nproc)] \ No newline at end of file From db302d671340327acefed6af78013ce17450ad45 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 8 Jun 2024 21:38:40 +0200 Subject: [PATCH 107/129] Change zabbix version to 7.0 --- src/zabbix-proxy/constants-service.conf | 4 ++-- src/zabbix/constants-service.conf | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/zabbix-proxy/constants-service.conf b/src/zabbix-proxy/constants-service.conf index 1f68f3a..a931567 100644 --- a/src/zabbix-proxy/constants-service.conf +++ b/src/zabbix-proxy/constants-service.conf @@ -42,11 +42,11 @@ ZABBIX_DB_USR="zabbix" # Build a strong password for the SQL user - could be overwritten with something fixed ZABBIX_DB_PWD="$(random_password)" -ZABBIX_VERSION=6.5 #zabbix 7 beta +ZABBIX_VERSION=7.0 #zabbix 7 beta POSTGRES_VERSION=16 #postgres repo, latest release (2024-05-13) # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=4096 # service dependent meta tags -SERVICE_TAGS="php-fpm,nginx,postgresql" \ No newline at end of file +SERVICE_TAGS="php-fpm,nginx,postgresql" diff --git a/src/zabbix/constants-service.conf b/src/zabbix/constants-service.conf index 9ba34d4..14e4783 100644 --- a/src/zabbix/constants-service.conf +++ b/src/zabbix/constants-service.conf @@ -42,7 +42,7 @@ ZABBIX_DB_USR="zabbix" # Build a strong password for the SQL user - could be overwritten with something fixed ZABBIX_DB_PWD="$(random_password)" -ZABBIX_VERSION=6.5 #zabbix 7 beta +ZABBIX_VERSION=7.0 #zabbix 7 beta POSTGRES_VERSION=16 #postgres repo, latest release (2024-05-13) PHP_VERSION=8.2 # debian 12 default TS_VERSION=2.14.2 # currently latest by zabbix supported version of timescaledb (2024-05-13) @@ -51,4 +51,4 @@ TS_VERSION=2.14.2 # currently latest by zabbix supported version of timescaledb LXC_MEM_MIN=4096 # service dependent meta tags -SERVICE_TAGS="php-fpm,nginx,postgresql" \ No newline at end of file +SERVICE_TAGS="php-fpm,nginx,postgresql" From b56ae6487b7223ba17258c71d719b7cebaf8b2e1 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 8 Jun 2024 21:50:32 +0200 Subject: [PATCH 108/129] install zabbix-agent2 --- src/zabbix-proxy/install-service.sh | 7 +++---- src/zabbix/install-service.sh | 6 +++--- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/zabbix-proxy/install-service.sh b/src/zabbix-proxy/install-service.sh index d795e83..fc9472a 100644 --- a/src/zabbix-proxy/install-service.sh +++ b/src/zabbix-proxy/install-service.sh @@ -17,7 +17,7 @@ apt_repo "postgresql" "https://www.postgresql.org/media/keys/ACCC4CF8.asc" "http apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql-$POSTGRES_VERSION postgresql-client zabbix-proxy-pgsql zabbix-sql-scripts ssl-cert +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql-$POSTGRES_VERSION postgresql-client zabbix-proxy-pgsql zabbix-sql-scripts zabbix-agent2 zabbix-agent2-plugin-* ssl-cert timedatectl set-timezone ${LXC_TIMEZONE} @@ -53,10 +53,9 @@ sed -i "s/# TLSAccept=unencrypted/TLSAccept=psk/g" /etc/zabbix/zabbix_proxy.conf sed -i "s/# TLSPSKIdentity=/TLSPSKIdentity=${LXC_HOSTNAME}.${LXC_DOMAIN}/g" /etc/zabbix/zabbix_proxy.conf sed -i "s|# TLSPSKFile=|TLSPSKFile=/var/lib/zabbix/proxy.psk|g" /etc/zabbix/zabbix_proxy.conf -systemctl enable zabbix-proxy - -systemctl restart zabbix-proxy +systemctl enable zabbix-proxy zabbix-agent2 +systemctl restart zabbix-proxy zabbix-agent2 echo -e "Installation of zabbix-proxy finished." echo -e "\nPlease register the Proxy on yout zabbix server with following data:" diff --git a/src/zabbix/install-service.sh b/src/zabbix/install-service.sh index da85ff1..bc9b73b 100644 --- a/src/zabbix/install-service.sh +++ b/src/zabbix/install-service.sh @@ -18,7 +18,7 @@ apt_repo "timescaledb" "https://packagecloud.io/timescale/timescaledb/gpgkey" "h apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql-$POSTGRES_VERSION timescaledb-2-oss-$TS_VERSION-postgresql-$POSTGRES_VERSION postgresql-client timescaledb-tools nginx php$PHP_VERSION-pgsql php$PHP_VERSION-fpm zabbix-server-pgsql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent ssl-cert +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install --no-install-recommends postgresql-$POSTGRES_VERSION timescaledb-2-oss-$TS_VERSION-postgresql-$POSTGRES_VERSION postgresql-client timescaledb-tools nginx php$PHP_VERSION-pgsql php$PHP_VERSION-fpm zabbix-server-pgsql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent2 zabbix-agent2-plugin-* ssl-cert unlink /etc/nginx/sites-enabled/default @@ -231,6 +231,6 @@ echo "DBPassword=${ZABBIX_DB_PWD}" >> /etc/zabbix/zabbix_server.conf generate_dhparam -systemctl enable nginx php$PHP_VERSION-fpm zabbix-server zabbix-agent +systemctl enable nginx php$PHP_VERSION-fpm zabbix-server zabbix-agent2 -systemctl restart nginx php$PHP_VERSION-fpm zabbix-server zabbix-agent > /dev/null 2>&1 \ No newline at end of file +systemctl restart nginx php$PHP_VERSION-fpm zabbix-server zabbix-agent2 > /dev/null 2>&1 \ No newline at end of file From ddcedc57e4fd02e1c572370623586656e64816cd Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sat, 8 Jun 2024 22:43:31 +0200 Subject: [PATCH 109/129] zammad fix webserver config --- src/zammad/install-service.sh | 120 +++------------------------------- 1 file changed, 10 insertions(+), 110 deletions(-) diff --git a/src/zammad/install-service.sh b/src/zammad/install-service.sh index b738102..de918b5 100644 --- a/src/zammad/install-service.sh +++ b/src/zammad/install-service.sh @@ -28,120 +28,20 @@ cat << EOF >>/etc/elasticsearch/jvm.options.d/msmx-size.options -Xmx1g EOF -# configurwe nginx -rm -f /etc/nginx/sites-enabled/default +# configure nginx +unlink /etc/nginx/sites-enabled/default +sed -e "s|server_name example.com;|server_name ${LXC_HOSTNAME}.${LXC_DOMAIN};|g" \ + -e "s|ssl_certificate /etc/nginx/ssl/example.com-fullchain.pem;|ssl_certificate /etc/nginx/ssl/fullchain.pem;|g" \ + -e "s|ssl_certificate_key /etc/nginx/ssl/example.com-privkey.pem;|ssl_certificate_key /etc/nginx/ssl/privkey.pem;|g" \ + -e "s|ssl_protocols TLSv1.2;|ssl_protocols TLSv1.2 TLSv1.3;|g" \ + -e "s|ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;|# ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;|g" \ + /opt/zammad/contrib/nginx/zammad_ssl.conf > /etc/nginx/sites-available/zammad_ssl.conf -cat << EOF > /etc/nginx/sites-available/zammad.conf -upstream zammad-railsserver { - server 127.0.0.1:3000; -} - -upstream zammad-websocket { - server 127.0.0.1:6042; -} - -server { - listen 80; - listen [::]:80; - server_name ${LXC_HOSTNAME}.${LXC_DOMAIN}; - - server_tokens off; - - access_log /var/log/nginx/zammad.access.log; - error_log /var/log/nginx/zammad.error.log; - - location /.well-known/ { - root /var/www/html; - } - - return 301 https://\$host\$request_uri; -} -server { - listen 443 ssl http2; - listen [::]:443 ssl http2; - - server_name ${LXC_HOSTNAME}.${LXC_DOMAIN}; - - server_tokens off; - ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem; - ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key; - - ssl_protocols TLSv1.3 TLSv1.2; - ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:EECDH+AESGCM:EDH+AESGCM; - ssl_dhparam /etc/nginx/dhparam.pem; - ssl_prefer_server_ciphers on; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 180m; - - ssl_stapling on; - ssl_stapling_verify on; - - resolver 1.1.1.1 1.0.0.1; -# -# https://webdock.io/en/docs/how-guides/security-guides/how-to-configure-security-headers-in-nginx-and-apache -# - add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload'; - add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src *; style-src *"; - add_header Referrer-Policy "strict-origin"; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"; - add_header Strict-Transport-Security "max-age=31536000" always; - - location = /robots.txt { - access_log off; log_not_found off; - } - - location = /favicon.ico { - access_log off; log_not_found off; - } - - root /opt/zammad/public; - - access_log /var/log/nginx/zammad.access.log; - error_log /var/log/nginx/zammad.error.log; - - client_max_body_size 50M; - - location ~ ^/(assets/|robots.txt|humans.txt|favicon.ico|apple-touch-icon.png) { - expires max; - } - - location /ws { - proxy_http_version 1.1; - proxy_set_header Upgrade \$http_upgrade; - proxy_set_header Connection "Upgrade"; - proxy_set_header CLIENT_IP \$remote_addr; - proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto \$scheme; - proxy_read_timeout 86400; - proxy_pass http://zammad-websocket; - } - - location / { - proxy_set_header Host \$http_host; - proxy_set_header CLIENT_IP \$remote_addr; - proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto \$scheme; - - # change this line in an SSO setup - proxy_set_header X-Forwarded-User ""; - - proxy_read_timeout 180; - proxy_pass http://zammad-railsserver; - - gzip on; - gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml; - gzip_proxied any; - } -} -EOF - -ln -sf /etc/nginx/sites-available/zammad.conf /etc/nginx/sites-enabled/ +ln -sf /etc/nginx/sites-available/zammad_ssl.conf /etc/nginx/sites-enabled/ generate_dhparam +# configure elasticsearch /usr/share/elasticsearch/bin/elasticsearch-plugin install -b ingest-attachment systemctl enable elasticsearch.service From b24ec835a27485e1bc2f14df844a7061f6ca0c77 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 12:45:59 +0200 Subject: [PATCH 110/129] update unifi debian 12 mongodb 7 --- src/unifi/constants-service.conf | 4 +--- src/unifi/install-service.sh | 10 +++++----- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index d9ef60e..09898b2 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -8,9 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" -# !!!! Leave at debian 11, currently unifi depends on mongodb-server <= 4.4 and libssl1.1 -# libssl1.1 is unsupported on debian bookworm +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP=0 diff --git a/src/unifi/install-service.sh b/src/unifi/install-service.sh index be830d6..4c005f8 100644 --- a/src/unifi/install-service.sh +++ b/src/unifi/install-service.sh @@ -11,12 +11,12 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -wget -O /etc/apt/trusted.gpg.d/mongodb-4.4.asc https://pgp.mongodb.com/server-4.4.asc -wget -O /etc/apt/trusted.gpg.d/unifi.gpg https://dl.ubnt.com/unifi/unifi-repo.gpg +wget -O - https://www.mongodb.org/static/pgp/server-7.0.asc | gpg --dearmor > /usr/share/keyrings/mongodb7.gpg +wget -O - https://dl.ubnt.com/unifi/unifi-repo.gpg | gpg --dearmor > /usr/share/keyrings/unifi.gpg -echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" > /etc/apt/sources.list.d/mongodb.list -echo "deb http://www.ui.com/downloads/unifi/debian stable ubiquiti" > /etc/apt/sources.list.d/unifi.list +echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list +echo "deb [ signed-by=/usr/share/keyrings/unifi.gpg ] http://www.ui.com/downloads/unifi/debian stable ubiquiti" > /etc/apt/sources.list.d/unifi.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq unifi \ No newline at end of file +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq default-jre-headless mongodb-server unifi \ No newline at end of file From f764354471e641146fad943f5e696953c6c51279 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 15:59:33 +0200 Subject: [PATCH 111/129] remove mongodb-server package --- src/unifi/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/unifi/install-service.sh b/src/unifi/install-service.sh index 4c005f8..d1649e8 100644 --- a/src/unifi/install-service.sh +++ b/src/unifi/install-service.sh @@ -19,4 +19,4 @@ echo "deb [ signed-by=/usr/share/keyrings/unifi.gpg ] http://www.ui.com/download apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq default-jre-headless mongodb-server unifi \ No newline at end of file +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq default-jre-headless unifi \ No newline at end of file From 02946ec248b9ee60e21c2e4da7e85868f32e5647 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 17:30:21 +0200 Subject: [PATCH 112/129] Fix nginx config in zammad --- src/zammad/install-service.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/zammad/install-service.sh b/src/zammad/install-service.sh index de918b5..db36772 100644 --- a/src/zammad/install-service.sh +++ b/src/zammad/install-service.sh @@ -29,7 +29,16 @@ cat << EOF >>/etc/elasticsearch/jvm.options.d/msmx-size.options EOF # configure nginx +generate_dhparam + unlink /etc/nginx/sites-enabled/default +unlink /etc/nginx/sites-enabled/zammad.conf + +mkdir -p /etc/nginx/ssl +ln -sf /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/nginx/ssl/fullchain.pem +ln -sf /etc/ssl/private/ssl-cert-snakeoil.key /etc/nginx/ssl/privkey.pem +ln -sf /etc/nginx/dhparam.pem /etc/nginx/ssl/dhparam.pem + sed -e "s|server_name example.com;|server_name ${LXC_HOSTNAME}.${LXC_DOMAIN};|g" \ -e "s|ssl_certificate /etc/nginx/ssl/example.com-fullchain.pem;|ssl_certificate /etc/nginx/ssl/fullchain.pem;|g" \ -e "s|ssl_certificate_key /etc/nginx/ssl/example.com-privkey.pem;|ssl_certificate_key /etc/nginx/ssl/privkey.pem;|g" \ @@ -39,7 +48,6 @@ sed -e "s|server_name example.com;|server_name ${LXC_HOSTNAME}.${LXC_DOMAIN};|g" ln -sf /etc/nginx/sites-available/zammad_ssl.conf /etc/nginx/sites-enabled/ -generate_dhparam # configure elasticsearch /usr/share/elasticsearch/bin/elasticsearch-plugin install -b ingest-attachment From d96b78dad731b1b63d14647bdf79ed7be64004d6 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 18:08:55 +0200 Subject: [PATCH 113/129] Fix mongodb repo --- src/unifi/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/unifi/install-service.sh b/src/unifi/install-service.sh index d1649e8..753fa77 100644 --- a/src/unifi/install-service.sh +++ b/src/unifi/install-service.sh @@ -11,7 +11,7 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -wget -O - https://www.mongodb.org/static/pgp/server-7.0.asc | gpg --dearmor > /usr/share/keyrings/mongodb7.gpg +wget -O - https://www.mongodb.org/static/pgp/server-7.0.asc | gpg --dearmor > /usr/share/keyrings/mongodb-server-7.0.gpg wget -O - https://dl.ubnt.com/unifi/unifi-repo.gpg | gpg --dearmor > /usr/share/keyrings/unifi.gpg echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list From 0448dee51783d39f04226d2bef7f04c37f7b8025 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 18:22:19 +0200 Subject: [PATCH 114/129] Fix postgres repo for rei3 --- src/rei3/install-service.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/rei3/install-service.sh b/src/rei3/install-service.sh index 0d18b50..e1e68f6 100644 --- a/src/rei3/install-service.sh +++ b/src/rei3/install-service.sh @@ -12,8 +12,8 @@ source /root/constants-service.conf mkdir /opt/rei3 wget -c https://rei3.de/downloads/REI3_3.4.2_x64_linux.tar.gz -O - | tar -zx -C /opt/rei3 -wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgres.gpg -echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list +wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /usr/share/keyrings/postgres.gpg +echo "deb [signed-by=/usr/share/keyrings/postgres.gpg] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list apt update From 5cdd54f5c5b7be33b174adc8887377b983a232a1 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 18:36:12 +0200 Subject: [PATCH 115/129] Fix rei3 download url, set to latest version --- src/rei3/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rei3/install-service.sh b/src/rei3/install-service.sh index e1e68f6..7ecaaaf 100644 --- a/src/rei3/install-service.sh +++ b/src/rei3/install-service.sh @@ -10,7 +10,7 @@ source /root/zamba.conf source /root/constants-service.conf mkdir /opt/rei3 -wget -c https://rei3.de/downloads/REI3_3.4.2_x64_linux.tar.gz -O - | tar -zx -C /opt/rei3 +wget -c https://rei3.de/latest/x64_linux -O - | tar -zx -C /opt/rei3 wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /usr/share/keyrings/postgres.gpg echo "deb [signed-by=/usr/share/keyrings/postgres.gpg] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list From 3d2efa450d6f40f47db6513c8db0ef439efba9d3 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 18:46:13 +0200 Subject: [PATCH 116/129] Change open3a version to 4.0 --- src/open3a/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/open3a/install-service.sh b/src/open3a/install-service.sh index 1dfb106..ff96ff0 100644 --- a/src/open3a/install-service.sh +++ b/src/open3a/install-service.sh @@ -57,7 +57,7 @@ CREATE DATABASE IF NOT EXISTS open3a; GRANT ALL PRIVILEGES ON open3a . * TO 'open3a'@'localhost';" cd $webroot -wget https://www.open3a.de/download/open3A%203.8.zip -O $webroot/open3a.zip +wget https://www.open3a.de/download/open3A%204.0.zip -O $webroot/open3a.zip unzip open3a.zip rm open3a.zip chmod 666 system/DBData/Installation.pfdb.php From 115ccab33ed8c07ac96e07692ec3108d77c053ba Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 19:14:29 +0200 Subject: [PATCH 117/129] Update omada --- src/omada/constants-service.conf | 2 +- src/omada/install-service.sh | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/src/omada/constants-service.conf b/src/omada/constants-service.conf index 83aedc6..09898b2 100644 --- a/src/omada/constants-service.conf +++ b/src/omada/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP=0 diff --git a/src/omada/install-service.sh b/src/omada/install-service.sh index 11efb2e..a509d92 100644 --- a/src/omada/install-service.sh +++ b/src/omada/install-service.sh @@ -14,15 +14,14 @@ source /root/constants-service.conf wget -qO - https://adoptopenjdk.jfrog.io/adoptopenjdk/api/gpg/key/public | apt-key add - add-apt-repository --yes https://adoptopenjdk.jfrog.io/adoptopenjdk/deb/ -wget -O /etc/apt/trusted.gpg.d/mongodb-4.4.asc https://www.mongodb.org/static/pgp/server-4.4.asc - -echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" > /etc/apt/sources.list.d/mongodb.list +wget -O - https://www.mongodb.org/static/pgp/server-7.0.asc | gpg --dearmor > /usr/share/keyrings/mongodb-server-7.0.gpg +echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq adoptopenjdk-8-hotspot jsvc mongodb-org +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq default-jre-headless jsvc mongodb-org -DL=$(wget -O - -q https://www.tp-link.com/de/support/download/omada-software-controller/ 2>/dev/null | grep Download-Detail-Software_Omada-Software-Controller | grep "Linux_x64.deb" | head -1 | cut -d'"' -f6) +DL=$(wget -O - -q https://www.tp-link.com/de/support/download/omada-software-controller/ 2>/dev/null | grep -m1 -o "https.*Omada_SDN_Controller.*linux_x64.deb") wget -O /tmp/omada.deb -q $DL From 5dfef6e5ff5eaadbc1f9b7f77131395a48d4b55a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 20:05:40 +0200 Subject: [PATCH 118/129] Fix mongodb --- src/omada/install-service.sh | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/omada/install-service.sh b/src/omada/install-service.sh index a509d92..ee60db7 100644 --- a/src/omada/install-service.sh +++ b/src/omada/install-service.sh @@ -11,11 +11,8 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -wget -qO - https://adoptopenjdk.jfrog.io/adoptopenjdk/api/gpg/key/public | apt-key add - -add-apt-repository --yes https://adoptopenjdk.jfrog.io/adoptopenjdk/deb/ - -wget -O - https://www.mongodb.org/static/pgp/server-7.0.asc | gpg --dearmor > /usr/share/keyrings/mongodb-server-7.0.gpg -echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list +wget -O - https://pgp.mongodb.com/server-4.4.asc | gpg --dearmor > /usr/share/keyrings/mongodb-server-4.4.gpg +echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-4.4.gpg ] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/4.4 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list apt update From be58381932566123648660f3bfc8b4cacfe13623 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 20:14:11 +0200 Subject: [PATCH 119/129] Reset omada to debian 11 --- src/omada/constants-service.conf | 2 +- src/omada/install-service.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/omada/constants-service.conf b/src/omada/constants-service.conf index 09898b2..83aedc6 100644 --- a/src/omada/constants-service.conf +++ b/src/omada/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-12-standard" +LXC_TEMPLATE_VERSION="debian-11-standard" # Create sharefs mountpoint LXC_MP=0 diff --git a/src/omada/install-service.sh b/src/omada/install-service.sh index ee60db7..fb82e54 100644 --- a/src/omada/install-service.sh +++ b/src/omada/install-service.sh @@ -12,7 +12,7 @@ source /root/zamba.conf source /root/constants-service.conf wget -O - https://pgp.mongodb.com/server-4.4.asc | gpg --dearmor > /usr/share/keyrings/mongodb-server-4.4.gpg -echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-4.4.gpg ] http://repo.mongodb.org/apt/debian bookworm/mongodb-org/4.4 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list +echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-4.4.gpg ] http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list apt update From a6244afe44ddfcca8821a867b38c07cc73ec7709 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 21:12:44 +0200 Subject: [PATCH 120/129] Move omada sdn controller to bashclub repo --- src/omada/install-service.sh | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/src/omada/install-service.sh b/src/omada/install-service.sh index fb82e54..69f7a5e 100644 --- a/src/omada/install-service.sh +++ b/src/omada/install-service.sh @@ -10,16 +10,12 @@ set -euo pipefail source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf - +wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg wget -O - https://pgp.mongodb.com/server-4.4.asc | gpg --dearmor > /usr/share/keyrings/mongodb-server-4.4.gpg +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/omada bullseye main" > /etc/apt/sources.list.d/bashclub-omada.list + echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-4.4.gpg ] http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq default-jre-headless jsvc mongodb-org - -DL=$(wget -O - -q https://www.tp-link.com/de/support/download/omada-software-controller/ 2>/dev/null | grep -m1 -o "https.*Omada_SDN_Controller.*linux_x64.deb") - -wget -O /tmp/omada.deb -q $DL - -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq /tmp/omada.deb \ No newline at end of file +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq default-jre-headless jsvc mongodb-org omadac From 8304e3b13a7ec5734ed8e1beaa5f7babc01355f3 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 21:18:24 +0200 Subject: [PATCH 121/129] Add tmux to default packages --- src/constants.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/constants.conf b/src/constants.conf index 1f6464b..2bd09ff 100644 --- a/src/constants.conf +++ b/src/constants.conf @@ -8,4 +8,4 @@ # This file contains the project constants on container level # Define your (administrative) tools, you always want to have installed into your LXC container -LXC_TOOLSET_BASE="sudo lsb-release curl dirmngr git gnupg2 apt-transport-https software-properties-common wget ssl-cert" +LXC_TOOLSET_BASE="sudo lsb-release curl dirmngr git gnupg2 apt-transport-https software-properties-common wget ssl-cert tmux" From f6dd7bbf5500da892e54ee4ced49540ab7492fe0 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 21:42:25 +0200 Subject: [PATCH 122/129] Add temurin jre --- src/omada/install-service.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/omada/install-service.sh b/src/omada/install-service.sh index 69f7a5e..48ae8b4 100644 --- a/src/omada/install-service.sh +++ b/src/omada/install-service.sh @@ -10,12 +10,14 @@ set -euo pipefail source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf +wget -qO - https://packages.adoptium.net/artifactory/api/gpg/key/public | gpg --dearmor > /usr/share/keyrings/adoptium-keyring.gpg wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg wget -O - https://pgp.mongodb.com/server-4.4.asc | gpg --dearmor > /usr/share/keyrings/mongodb-server-4.4.gpg -echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/omada bullseye main" > /etc/apt/sources.list.d/bashclub-omada.list - -echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-4.4.gpg ] http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/omada $(lsb_release -cs 2>/dev/null) main" > /etc/apt/sources.list.d/bashclub-omada.list +echo "deb [signed-by=/usr/share/keyrings/adoptium-keyring.gpg] https://packages.adoptium.net/artifactory/deb $(lsb_release -cs 2>/dev/null) main" > /etc/apt/sources.list.d/adoptium.list +echo "deb [signed-by=/usr/share/keyrings/mongodb-server-4.4.gpg] http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" > /etc/apt/sources.list.d/mongodb-org-7.0.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq default-jre-headless jsvc mongodb-org omadac +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq temurin-17-jre jsvc mongodb-org +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq omadac \ No newline at end of file From 97c8ba8cd1cce1c7b5b56b7e066b3b974344d34b Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 21:58:53 +0200 Subject: [PATCH 123/129] Fix java version omada --- src/omada/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/omada/install-service.sh b/src/omada/install-service.sh index 48ae8b4..7e88549 100644 --- a/src/omada/install-service.sh +++ b/src/omada/install-service.sh @@ -19,5 +19,5 @@ echo "deb [signed-by=/usr/share/keyrings/mongodb-server-4.4.gpg] http://repo.mon apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq temurin-17-jre jsvc mongodb-org +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq temurin-8-jre jsvc mongodb-org DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq omadac \ No newline at end of file From f442f0c0edf99a4b51fe7b2ee9546420f64c9c66 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 9 Jun 2024 22:10:45 +0200 Subject: [PATCH 124/129] update element-web repo url --- src/matrix/install-service.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/matrix/install-service.sh b/src/matrix/install-service.sh index 6605ab7..f0532c3 100644 --- a/src/matrix/install-service.sh +++ b/src/matrix/install-service.sh @@ -120,10 +120,10 @@ cd /var/www wget -O element-release-key.asc https://packages.riot.im/element-release-key.asc gpg --import element-release-key.asc -MATRIX_ELEMENT_VERSION=$(curl -s https://api.github.com/repos/vector-im/element-web/releases/latest | grep tag_name | cut -d'"' -f4) +MATRIX_ELEMENT_VERSION=$(curl -s https://api.github.com/repos/element-hq/element-web/releases/latest | grep tag_name | cut -d'"' -f4) -wget -O element-$MATRIX_ELEMENT_VERSION.tar.gz https://github.com/vector-im/element-web/releases/download/$MATRIX_ELEMENT_VERSION/element-$MATRIX_ELEMENT_VERSION.tar.gz -wget -O element-$MATRIX_ELEMENT_VERSION.tar.gz.asc https://github.com/vector-im/element-web/releases/download/$MATRIX_ELEMENT_VERSION/element-$MATRIX_ELEMENT_VERSION.tar.gz.asc +wget -O element-$MATRIX_ELEMENT_VERSION.tar.gz https://github.com/element-hq/element-web/releases/download/$MATRIX_ELEMENT_VERSION/element-$MATRIX_ELEMENT_VERSION.tar.gz +wget -O element-$MATRIX_ELEMENT_VERSION.tar.gz.asc https://github.com/element-hq/element-web/releases/download/$MATRIX_ELEMENT_VERSION/element-$MATRIX_ELEMENT_VERSION.tar.gz.asc gpg --verify element-$MATRIX_ELEMENT_VERSION.tar.gz.asc tar -xzvf element-$MATRIX_ELEMENT_VERSION.tar.gz From 6218183d9cf6fa0b7d6b1407ef9144d15e719760 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 10 Jun 2024 21:15:59 +0200 Subject: [PATCH 125/129] set checkmk version to 2.3.0p6 --- src/checkmk/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index edb2308..4bd1582 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -28,7 +28,7 @@ LXC_NESTING="1" LXC_KEYCTL="0" # checkmk version -CMK_VERSION=2.3.0p2 +CMK_VERSION=2.3.0p6 # build number of the debian package (needs to start with underscore) CMK_BUILD=_0 From 246b7a348d4e76ab2be9b4ac07af8939019421a0 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 10 Jun 2024 21:37:24 +0200 Subject: [PATCH 126/129] checkmk: improve apache config --- src/checkmk/install-service.sh | 40 ++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/src/checkmk/install-service.sh b/src/checkmk/install-service.sh index 6822b58..d619409 100644 --- a/src/checkmk/install-service.sh +++ b/src/checkmk/install-service.sh @@ -23,6 +23,46 @@ cat << EOF > /etc/apache2/sites-available/000-default.conf EOF +cat << EOF > /etc/apache2/sites-available/default-ssl.conf + + RewriteEngine On + RewriteCond %{REQUEST_URI} !^/$CMK_INSTANCE + RewriteRule ^/(.*) https://%{HTTP_HOST}/$CMK_INSTANCE/\$1 [R=301,L] + + ServerAdmin webmaster@localhost + + DocumentRoot /var/www/html + + ErrorLog \${APACHE_LOG_DIR}/error.log + CustomLog \${APACHE_LOG_DIR}/access.log combined + + SSLEngine on + + SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem + SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key + + #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt + + #SSLCACertificatePath /etc/ssl/certs/ + #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt + + #SSLCARevocationPath /etc/apache2/ssl.crl/ + #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl + + #SSLVerifyClient require + #SSLVerifyDepth 10 + + #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire + + SSLOptions +StdEnvVars + + + SSLOptions +StdEnvVars + + + +EOF + a2enmod ssl a2enmod rewrite a2ensite default-ssl From e28752b8b8a757c056bd4906f35e4fb458ea17f4 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 10 Jun 2024 22:40:36 +0200 Subject: [PATCH 127/129] Fixed semaphore repo urls --- src/ansible-semaphore/install-service.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/ansible-semaphore/install-service.sh b/src/ansible-semaphore/install-service.sh index 864b278..79f7a05 100644 --- a/src/ansible-semaphore/install-service.sh +++ b/src/ansible-semaphore/install-service.sh @@ -27,21 +27,21 @@ psql -c "CREATE DATABASE ${SEMAPHORE_DB_NAME} ENCODING UTF8 TEMPLATE template0 O echo "Postgres User ${SEMAPHORE_DB_USR} and database ${SEMAPHORE_DB_NAME} created." EOF -curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'linux_amd64.deb$' | wget -i - -O /opt/semaphore_linux_amd64.deb +curl -s https://api.github.com/repos/semaphoreui/semaphore/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'linux_amd64.deb$' | wget -i - -O /opt/semaphore_linux_amd64.deb DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install /opt/semaphore_linux_amd64.deb cat << EOF > /usr/local/bin/update-semaphore PATH="/bin:/usr/bin:/usr/local/bin" echo "Checking github for new semaphore version" -current_version=\$(curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep "tag_name" | cut -d '"' -f4) +current_version=\$(curl -s https://api.github.com/repos/semaphoreui/semaphore/releases/latest | grep "tag_name" | cut -d '"' -f4) installed_version=\$(semaphore version) echo "Installed semaphore version is \$installed_version" if [ \$installed_version != \$current_version ]; then echo "New semaphore version \$current_version available. Stopping semaphore.service" systemctl stop semaphore.service echo "Downloading semaphore version \$current_version..." - curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'linux_amd64.deb$' | wget -i - -O /opt/semaphore_linux_amd64.deb + curl -s https://api.github.com/repos/semaphoreui/semaphore/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'linux_amd64.deb$' | wget -i - -O /opt/semaphore_linux_amd64.deb DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install /opt/semaphore_linux_amd64.deb echo "Starting semaphore.service..." systemctl start semaphore.service @@ -63,7 +63,7 @@ chmod +x /etc/apt/apt.conf.d/80-semaphore-apt-hook cat << EOF > /etc/systemd/system/semaphore.service [Unit] Description=Semaphore Ansible -Documentation=https://github.com/ansible-semaphore/semaphore +Documentation=https://github.com/semaphoreui/semaphore Wants=network-online.target After=network-online.target From 45da9e8a47ceefcfbaa97e07109b8c6eafdeb3b6 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Tue, 11 Jun 2024 18:20:20 +0200 Subject: [PATCH 128/129] update apt mirror (work in progress) --- src/apt/constants-service.conf | 4 +- src/apt/install-service.sh | 103 +++++++++++++++++++++++++++++++++ 2 files changed, 105 insertions(+), 2 deletions(-) diff --git a/src/apt/constants-service.conf b/src/apt/constants-service.conf index 0eb1e13..c538e56 100644 --- a/src/apt/constants-service.conf +++ b/src/apt/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP=0 +LXC_MP=1 # Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) LXC_SHAREFS_MOUNTPOINT="srv" # Defines the recordsize of mp0 @@ -30,4 +30,4 @@ LXC_KEYCTL="0" LXC_MEM_MIN=1024 # service dependent meta tags -SERVICE_TAGS="aptly,nginx" \ No newline at end of file +SERVICE_TAGS="aptly,nginx" diff --git a/src/apt/install-service.sh b/src/apt/install-service.sh index cbc5799..34bca19 100644 --- a/src/apt/install-service.sh +++ b/src/apt/install-service.sh @@ -54,6 +54,18 @@ cat << EOF > /etc/aptly.conf } EOF +cat << EOF > /usr/local/bin/update-apt-mirrors +#!/bin/bash +PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" + +for m in $(aptly mirror list -raw); do + aptly mirror update -keyring='/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg' \$m +done +EOF + +chmod +x /usr/local/bin/update-apt-mirrors + + cat << EOF > /etc/nginx/conf.d/default.conf server { listen 80 default_server; @@ -153,6 +165,95 @@ TimeoutStopSec=15s WantedBy=multi-user.target EOF +cat << EOF > /root/mirror-examples +# import proxmox keyring +wget -O - http://download.proxmox.com/debian/proxmox-release-bookworm.gpg | gpg --no-default-keyring --keyring /$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg --import + +# proxmox 8 no subscription mirror (about 11.5 GB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg pve8.pve-no-subscription http://download.proxmox.com/debian/ bookworm pve-no-suscription +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg pve8.pve-no-subscription + +# import debian keyring +cat /etc/apt/trusted.gpg.d/debian-archive* | gpg --no-default-keyring --keyring /$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg --import + +# debian 12 main mirror (about 87 GB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main http://deb.debian.org/debian/ bookworm main +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main + +# debian 12 contrib mirror (about 600 MB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib http://deb.debian.org/debian/ bookworm contrib +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib + +# debian 12 non-free mirror (about7,2 GB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free http://deb.debian.org/debian/ bookworm non-free +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free + +# debian 12 non-free-firmware mirror (38 Packages) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware http://deb.debian.org/debian/ bookworm non-free-firmware +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware + +# debian 12 update main mirror (about 2,5 GB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main.update http://deb.debian.org/debian/ bookworm-updates main +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main.update + +# debian 12 update contrib mirror (currently empty) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib.updates http://deb.debian.org/debian/ bookworm-updates contrib +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib.updates + +# debian 12 updates non-free mirror (about 900 MB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free.updates http://deb.debian.org/debian/ bookworm-updates non-free +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free.updates + +# debian 12 updates non-free-firmware mirror (about 70 MB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware.updates http://deb.debian.org/debian/ bookworm-updates non-free-firmware +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware.updates + +# debian 12 security main mirror (about 5,5 GB) +aptly mirror create -force-components -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main.security http://security.debian.org/debian-security bookworm-security main +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main.security + +# debian 12 security contrib mirror (2 packages) +aptly mirror create -force-components -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib.security http://security.debian.org/debian-security bookworm-security contrib +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib.security + +# debian 12 security non-free mirror (currently empty) +aptly mirror create -force-components -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free.security http://security.debian.org/debian-security bookworm-security non-free +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free.security + +# debian 12 security non-free-firmware mirror (1 package) +aptly mirror create -force-components -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware.security http://security.debian.org/debian-security bookworm-security non-free-firmware +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware.security + +# debian 12 backports main mirror (about 14,5 GB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main.backports http://deb.debian.org/debian/ bookworm-backports main +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.main.backports + +# debian 12 backports contrib mirror (about 100 MB) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib.backports http://deb.debian.org/debian/ bookworm-backports contrib +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.contrib.backports + +# debian 12 backports non-free mirror (2 packages) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free.backports http://deb.debian.org/debian/ bookworm-backports non-free +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free.backports + +# debian 12 backports non-free-firmware mirror (currently empty) +aptly mirror create -architectures="amd64" -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware.backports http://deb.debian.org/debian/ bookworm-backports non-free-firmware +aptly mirror update -keyring=/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg debian12.non-free-firmware.backports +EOF + +cat << EOF > /usr/local/bin/update-apt-mirrors +#!/bin/bash +PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" + +for m in \$(aptly mirror list -raw); do + aptly mirror update -keyring='/$LXC_SHAREFS_MOUNTPOINT/trustedkeys.gpg' $m +done +EOF + +echo "0 4 * * * root /usr/local/bin/update-apt-mirrors" > /etc/cron.d/update-apt-mirrors + +chmod +x /usr/local/bin/update-apt-mirrors + chown -R www-data:www-data /$LXC_SHAREFS_MOUNTPOINT chown -R www-data:www-data /var/www @@ -168,3 +269,5 @@ generate_dhparam systemctl daemon-reload systemctl enable --now aptly aptly-api systemctl restart nginx + +echo "Apt mirror installation complete. Please look into /root/mirror-examples for mirror examples." \ No newline at end of file From efbc86394d64a952d35bf0d47c1a5bd18655ee17 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Fri, 14 Jun 2024 09:45:23 +0200 Subject: [PATCH 129/129] Change samba version from backports to main --- src/zmb-ad-join/install-service.sh | 5 +++-- src/zmb-ad/install-service.sh | 5 +++-- src/zmb-cups/install-service.sh | 5 +++-- src/zmb-member/install-service.sh | 5 +++-- src/zmb-standalone/install-service.sh | 8 +++++--- 5 files changed, 17 insertions(+), 11 deletions(-) diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index 2af7e5e..c5c683f 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -27,14 +27,15 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +# echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils chrony sipcalc -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils +# DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils mkdir -p /etc/chrony/conf.d mkdir -p /etc/systemd/system/chrony.service.d diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 1a2922e..c75b8c6 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -27,14 +27,15 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +# echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils chrony sipcalc -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils +# DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils mkdir -p /etc/chrony/conf.d mkdir -p /etc/systemd/system/chrony.service.d diff --git a/src/zmb-cups/install-service.sh b/src/zmb-cups/install-service.sh index 821d37d..726b191 100644 --- a/src/zmb-cups/install-service.sh +++ b/src/zmb-cups/install-service.sh @@ -9,11 +9,12 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +# echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl cups samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd +# DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl cups samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl cups samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd mv /etc/krb5.conf /etc/krb5.conf.bak cat > /etc/krb5.conf <> /etc/apt/sources.list +# echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd +#DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules wsdd mv /etc/krb5.conf /etc/krb5.conf.bak cat > /etc/krb5.conf < /etc/apt/sources.list.d/45drives.list -echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +# echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list apt update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba samba-common samba-common-bin samba-dsdb-modules samba-vfs-modules samba-libs libwbclient0 winbind wsdd -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" --no-install-recommends cockpit cockpit-identities cockpit-file-sharing cockpit-navigator +#DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba samba-common samba-common-bin samba-dsdb-modules samba-vfs-modules samba-libs libwbclient0 winbind wsdd +#DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" --no-install-recommends cockpit cockpit-identities cockpit-file-sharing cockpit-navigator +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl samba samba-common samba-common-bin samba-dsdb-modules samba-vfs-modules samba-libs libwbclient0 winbind wsdd +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" --no-install-recommends cockpit cockpit-identities cockpit-file-sharing cockpit-navigator USER=$(echo "$ZMB_ADMIN_USER" | awk '{print tolower($0)}') useradd --comment "Zamba fileserver admin" --create-home --shell /bin/bash $USER