mirror of
https://github.com/bashclub/zamba-lxc-toolbox.git
synced 2024-11-07 19:31:58 +01:00
Added orginal script by Markus Helmke
This commit is contained in:
parent
775a954fdf
commit
ffe7cb5576
195
create_lxc.sh
Normal file
195
create_lxc.sh
Normal file
@ -0,0 +1,195 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# This script wil create and fire up a standard debian buster lxc container on your proxmox pve.
|
||||||
|
# The Script will look for the next free lxc number and take the next free and use it. So take
|
||||||
|
# care that behind your last number is place for it.
|
||||||
|
|
||||||
|
#### SOME VARIABLES TO ADJUST ####
|
||||||
|
|
||||||
|
# Storage with templates
|
||||||
|
LXC_TMP="local"
|
||||||
|
|
||||||
|
# Size and pool of rootfs / in GB
|
||||||
|
SIZ_ROT="100"
|
||||||
|
S_ROT_P="local-zfs"
|
||||||
|
|
||||||
|
# Size and pool of Filestorage in GB will mounted to /share
|
||||||
|
SIZ_FIL="100"
|
||||||
|
S_FIL_P="local-zfs"
|
||||||
|
|
||||||
|
#Weather or not (1 and 0) the container will createt as unpriviliged LXC
|
||||||
|
LXC_UNP="1"
|
||||||
|
|
||||||
|
# Size of the RAM assigned to the LXC
|
||||||
|
LXC_MEM="1024"
|
||||||
|
|
||||||
|
# Size of the SWAP assigned to the LXC
|
||||||
|
LXC_SWA="1024"
|
||||||
|
|
||||||
|
# The hostname (eq. zamba1 or mailpiler1)
|
||||||
|
LXC_HOST="zamba"
|
||||||
|
|
||||||
|
# The domainname (searchdomain /etc/resolf.conf & hosts)
|
||||||
|
LXC_SDN="zmb.local"
|
||||||
|
|
||||||
|
# IP-address and subnet
|
||||||
|
LXC_IP="10.10.80.20/24"
|
||||||
|
|
||||||
|
# Gateway
|
||||||
|
LXC_GW="10.10.80.10"
|
||||||
|
|
||||||
|
# DNS-server and here shoud be your AD-DC
|
||||||
|
LXC_DNS="10.10.80.10"
|
||||||
|
|
||||||
|
# Networkbridge for this machine
|
||||||
|
LXC_BRD="vmbr80"
|
||||||
|
|
||||||
|
# root password - take care to delete from this file
|
||||||
|
LXC_PWD="MYPASSWD"
|
||||||
|
|
||||||
|
LXC_KEY="ssh-rsa xxxxxxxx"
|
||||||
|
|
||||||
|
############### Zamba-Server-Section ###############
|
||||||
|
|
||||||
|
# Domain Entries to samba/smb.conf. Will be also uses for samba domain-provisioning when zmb-pdc will choosen.
|
||||||
|
ZMB_REA="ZMB.LOCAL"
|
||||||
|
ZMB_DOM="ZMB"
|
||||||
|
|
||||||
|
# THE Domain-Admin and passwd for zamba-install
|
||||||
|
ZMB_ADA="Administrator"
|
||||||
|
ZMB_APW="MYPASSWORD"
|
||||||
|
|
||||||
|
############### Mailpiler-Section ###############
|
||||||
|
|
||||||
|
# The FQDN vor the Hostname. This must be exactly the same like the LXC_HOST / LXC_SDN at section above.
|
||||||
|
PILER_DOM="piler.zmb.rocks"
|
||||||
|
SMARTHOST="10.10.80.20"
|
||||||
|
PILER_VER="1.3.10"
|
||||||
|
SPHINX_VER="3.3.1"
|
||||||
|
PHP_VER="7.4"
|
||||||
|
|
||||||
|
############### Matrix-Section ###############
|
||||||
|
|
||||||
|
# The FQDN vor the Hostname. This should be the same like the LXC_HOST / LXC_SDN at section above.
|
||||||
|
MRX_DOM="matrix.zmb.rocks"
|
||||||
|
ELE_DOM="element.zmb.rocks"
|
||||||
|
ELE_VER="v1.7.21"
|
||||||
|
JIT_DOM="meet.zmb.rocks"
|
||||||
|
|
||||||
|
#################################
|
||||||
|
|
||||||
|
# CHeck is the newest template available, else download it.
|
||||||
|
|
||||||
|
DEB_LOC=$(pveam list $LXC_TMP | grep debian-10-standard | cut -d'_' -f2)
|
||||||
|
|
||||||
|
DEB_REP=$(pveam available --section system | grep debian-10-standard | cut -d'_' -f2)
|
||||||
|
|
||||||
|
if [[ $DEB_LOC == $DEB_REP ]];
|
||||||
|
then
|
||||||
|
echo "Newest Version of Debian 10 Standard $DEP_REP exists.";
|
||||||
|
else
|
||||||
|
echo "Will now download newest Debian 10 Standard $DEP_REP.";
|
||||||
|
pveam download $LXC_TMP debian-10-standard_$DEB_REP\_amd64.tar.gz
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Get next free LXC-number
|
||||||
|
LXC_LST=$( lxc-ls | egrep -o '.{1,5}$' )
|
||||||
|
LXC_CHK=$((LXC_LST+1));
|
||||||
|
|
||||||
|
if [ $LXC_CHK -lt 100 ] || [ -f /etc/pve/qemu-server/$LXC_CHK.conf ]; then
|
||||||
|
LXC_NBR=$(pvesh get /cluster/nextid);
|
||||||
|
else
|
||||||
|
LXC_NBR=$LXC_CHK;
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Will now create LXC Container $LXC_NBR!";
|
||||||
|
|
||||||
|
# Create the container
|
||||||
|
pct create $LXC_NBR -unprivileged $LXC_UNP $LXC_TMP:vztmpl/debian-10-standard_$DEB_REP\_amd64.tar.gz -rootfs $S_ROT_P:$SIZ_ROT;
|
||||||
|
sleep 2;
|
||||||
|
|
||||||
|
pct set $LXC_NBR -memory $LXC_MEM -swap $LXC_SWA -hostname $LXC_HOST \-nameserver $LXC_DNS -searchdomain $LXC_SDN -onboot 1 -timezone Europe/Berlin -net0 name=eth0,bridge=$LXC_BRD,firewall=1,gw=$LXC_GW,ip=$LXC_IP,type=veth;
|
||||||
|
sleep 2;
|
||||||
|
|
||||||
|
PS3="Select the Server-Function: "
|
||||||
|
|
||||||
|
select opt in just_lxc zmb-standalone zmb-member zmb-pdc mailpiler matrix quit; do
|
||||||
|
case $opt in
|
||||||
|
just_lxc)
|
||||||
|
lxc-start $LXC_NBR;
|
||||||
|
sleep 5;
|
||||||
|
# Set the root password and key
|
||||||
|
echo -e "$LXC_PWD\n$LXC_PWD" | lxc-attach -n$LXC_NBR passwd;
|
||||||
|
lxc-attach -n$LXC_NBR mkdir /root/.ssh;
|
||||||
|
echo -e "$LXC_KEY" | lxc-attach -n$LXC_NBR tee /root/.ssh/authorized_keys;
|
||||||
|
lxc-attach -n$LXC_NBR service ssh restart;
|
||||||
|
echo "Should be ready!"
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
zmb-standalone)
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
zmb-member)
|
||||||
|
echo "Make some additions to LXC for AD-Member-Server!"
|
||||||
|
pct set $LXC_NBR -mp0 $S_FIL_P:$SIZ_FIL,mp=/tank
|
||||||
|
sleep 2;
|
||||||
|
lxc-start $LXC_NBR;
|
||||||
|
sleep 5;
|
||||||
|
# Set the root password and key
|
||||||
|
echo -e "$LXC_PWD\n$LXC_PWD" | lxc-attach -n$LXC_NBR passwd;
|
||||||
|
lxc-attach -n$LXC_NBR mkdir /root/.ssh;
|
||||||
|
echo -e "$LXC_KEY" | lxc-attach -n$LXC_NBR tee /root/.ssh/authorized_keys;
|
||||||
|
lxc-attach -n$LXC_NBR service ssh restart;
|
||||||
|
cp /root/zmb_mem.orig /root/zmb_mem.sh
|
||||||
|
sed -i "s|#ZMB_VAR|#ZMB_VAR\nZMB_REA='$ZMB_REA'\nZMB_DOM='$ZMB_DOM'\nZMB_ADA='$ZMB_ADA'\nZMB_APW='$ZMB_APW'|" /root/zmb_mem.sh
|
||||||
|
pct push $LXC_NBR /root/zmb_mem.sh /root/zmb_mem.sh
|
||||||
|
echo "Install zamba as AD-Member-Server!"
|
||||||
|
lxc-attach -n$LXC_NBR bash /root/zmb_mem.sh
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
zmb-pdc)
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
mailpiler)
|
||||||
|
echo "Make some additions to LXC for Mailpiler!"
|
||||||
|
pct set $LXC_NBR -features nesting=1
|
||||||
|
sleep 2;
|
||||||
|
lxc-start $LXC_NBR;
|
||||||
|
sleep 5;
|
||||||
|
# Set the root password and key
|
||||||
|
echo -e "$LXC_PWD\n$LXC_PWD" | lxc-attach -n$LXC_NBR passwd;
|
||||||
|
lxc-attach -n$LXC_NBR mkdir /root/.ssh;
|
||||||
|
echo -e "$LXC_KEY" | lxc-attach -n$LXC_NBR tee /root/.ssh/authorized_keys;
|
||||||
|
lxc-attach -n$LXC_NBR service ssh restart;
|
||||||
|
cp /root/mailpiler.orig /root/mailpiler.sh
|
||||||
|
sed -i "s|#PILER_VAR|#PILER_VAR\nPILER_DOM='$PILER_DOM'\nSMARTHOST='$SMARTHOST'\nPILER_VER='$PILER_VER'\nSPHINX_VER='$SPHINX_VER'\nPHP_VER='$PHP_VER'|" /root/mailpiler.sh
|
||||||
|
pct push $LXC_NBR /root/mailpiler.sh /root/mailpiler.sh
|
||||||
|
echo "Install Mailpiler mailarchiv!"
|
||||||
|
lxc-attach -n$LXC_NBR bash mailpiler.sh
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
matrix)
|
||||||
|
echo "Make some additions to LXC for Matrix!"
|
||||||
|
lxc-start $LXC_NBR;
|
||||||
|
sleep 5;
|
||||||
|
# Set the root password and key
|
||||||
|
echo -e "$LXC_PWD\n$LXC_PWD" | lxc-attach -n$LXC_NBR passwd;
|
||||||
|
lxc-attach -n$LXC_NBR mkdir /root/.ssh;
|
||||||
|
echo -e "$LXC_KEY" | lxc-attach -n$LXC_NBR tee /root/.ssh/authorized_keys;
|
||||||
|
lxc-attach -n$LXC_NBR service ssh restart;
|
||||||
|
cp /root/matrix.orig /root/matrix.sh
|
||||||
|
sed -i "s|#MATRIX_VAR|#Matrix_VAR\nMRX_DOM='$MRX_DOM'\nELE_DOM='$ELE_DOM'\nELE_VER='$ELE_VER'\nJIT_DOM='$JIT_DOM'|" /root/matrix.sh
|
||||||
|
pct push $LXC_NBR /root/matrix.sh /root/matrix.sh
|
||||||
|
echo "Install Matrix Chatserver!"
|
||||||
|
lxc-attach -n$LXC_NBR bash matrix.sh
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
quit)
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Invalid option!"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
179
mailpiler.orig
Normal file
179
mailpiler.orig
Normal file
@ -0,0 +1,179 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
#Variables will be filled in from the mainscript:
|
||||||
|
|
||||||
|
#PILER_VAR
|
||||||
|
|
||||||
|
|
||||||
|
HOSTNAME=$(hostname -f)
|
||||||
|
|
||||||
|
echo "Ensure your Hostname is set to your Piler FQDN!"
|
||||||
|
|
||||||
|
echo $HOSTNAME
|
||||||
|
|
||||||
|
if
|
||||||
|
[ "$HOSTNAME" != "$PILER_DOM" ]
|
||||||
|
then
|
||||||
|
echo "Hostname doesn't match Piler_Domain! Check install.sh, /etc/hosts, /etc/hostname." && exit
|
||||||
|
else
|
||||||
|
echo "Hostname matches PILER_DOMAIN, so starting installation."
|
||||||
|
fi
|
||||||
|
|
||||||
|
apt install -y gpg apt-transport-https lsb-release
|
||||||
|
|
||||||
|
wget -q https://packages.sury.org/php/apt.gpg -O- | apt-key add -
|
||||||
|
echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list
|
||||||
|
|
||||||
|
apt update && apt full-upgrade -y
|
||||||
|
|
||||||
|
apt install -y mc sysstat build-essential libwrap0-dev libpst-dev tnef libytnef0-dev unrtf catdoc libtre-dev tre-agrep poppler-utils libzip-dev unixodbc libpq5 software-properties-common libpoppler-dev openssl libssl-dev memcached telnet nginx mariadb-server default-libmysqlclient-dev python-mysqldb gcc libwrap0 libzip4 latex2rtf latex2html catdoc tnef libpq5 zipcmp zipmerge ziptool libsodium23
|
||||||
|
|
||||||
|
apt update && apt install -y php$PHP_VER-{fpm,common,ldap,mysql,cli,opcache,phpdbg,gd,memcache,json,readline,zip}
|
||||||
|
|
||||||
|
apt purge -y postfix
|
||||||
|
|
||||||
|
cat > /etc/mysql/conf.d/mailpiler.conf <<EOF
|
||||||
|
innodb_buffer_pool_size=256M
|
||||||
|
innodb_flush_log_at_trx_commit=1
|
||||||
|
innodb_log_buffer_size=64M
|
||||||
|
innodb_log_file_size=16M
|
||||||
|
query_cache_size=0
|
||||||
|
query_cache_type=0
|
||||||
|
query_cache_limit=2M
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl restart mariadb
|
||||||
|
|
||||||
|
cd /tmp
|
||||||
|
wget https://download.mailpiler.com/generic-local/sphinx-$SPHINX_VER-bin.tar.gz
|
||||||
|
tar -xvzf sphinx-$SPHINX_VER-bin.tar.gz -C /
|
||||||
|
|
||||||
|
groupadd piler
|
||||||
|
useradd -g piler -m -s /bin/bash -d /var/piler piler
|
||||||
|
usermod -L piler
|
||||||
|
chmod 755 /var/piler
|
||||||
|
|
||||||
|
wget https://bitbucket.org/jsuto/piler/downloads/piler-$PILER_VER.tar.gz
|
||||||
|
tar -xvzf piler-$PILER_VER.tar.gz
|
||||||
|
cd piler-$PILER_VER/
|
||||||
|
./configure --localstatedir=/var --with-database=mysql --enable-tcpwrappers --enable-memcached
|
||||||
|
make
|
||||||
|
make install
|
||||||
|
ldconfig
|
||||||
|
|
||||||
|
cp util/postinstall.sh util/postinstall.sh.bak
|
||||||
|
sed -i "s/ SMARTHOST=.*/ SMARTHOST="\"$SMARTHOST\""/" util/postinstall.sh
|
||||||
|
sed -i 's/ WWWGROUP=.*/ WWWGROUP="www-data"/' util/postinstall.sh
|
||||||
|
|
||||||
|
make postinstall
|
||||||
|
|
||||||
|
cp /usr/local/etc/piler/piler.conf /usr/local/etc/piler/piler.conf.bak
|
||||||
|
sed -i "s/hostid=.*/hostid=$PILER_DOM/" /usr/local/etc/piler/piler.conf
|
||||||
|
sed -i "s/update_counters_to_memcached=.*/update_counters_to_memcached=1/" /usr/local/etc/piler/piler.conf
|
||||||
|
|
||||||
|
su piler -c "indexer --all --config /usr/local/etc/piler/sphinx.conf"
|
||||||
|
|
||||||
|
/etc/init.d/rc.piler start
|
||||||
|
/etc/init.d/rc.searchd start
|
||||||
|
|
||||||
|
update-rc.d rc.piler defaults
|
||||||
|
update-rc.d rc.searchd defaults
|
||||||
|
|
||||||
|
mkdir -p /etc/nginx/ssl
|
||||||
|
openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/piler.key -out /etc/nginx/ssl/piler.crt -subj "/CN=$PILER_DOM" -addext "subjectAltName=DNS:$PILER_DOM"
|
||||||
|
|
||||||
|
cd /etc/nginx/sites-available
|
||||||
|
cp /tmp/piler-$PILER_VER/contrib/webserver/piler-nginx.conf /etc/nginx/sites-available/
|
||||||
|
ln -s /etc/nginx/sites-available/piler-nginx.conf /etc/nginx/sites-enabled/piler-nginx.conf
|
||||||
|
|
||||||
|
sed -i "s|PILER_HOST|$PILER_DOM|g" /etc/nginx/sites-available/piler-nginx.conf
|
||||||
|
sed -i "s|/var/run/php/php7.4-fpm.sock|/var/run/php/php$PHP_VER-fpm.sock|g" /etc/nginx/sites-available/piler-nginx.conf
|
||||||
|
|
||||||
|
sed -i "/server_name.*/a \\
|
||||||
|
listen 443 ssl http2;\n\n\
|
||||||
|
ssl_certificate /etc/nginx/ssl/piler.crt;\n\
|
||||||
|
ssl_certificate_key /etc/nginx/ssl/piler.key;\n\n\
|
||||||
|
ssl_session_timeout 1d;\n\
|
||||||
|
ssl_session_cache shared:SSL:15m;\n\
|
||||||
|
ssl_session_tickets off;\n\n\
|
||||||
|
# modern configuration of Mozilla SSL configurator. Tweak to your needs.\n\
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;\n\
|
||||||
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;\n\
|
||||||
|
ssl_prefer_server_ciphers off;\n\n\
|
||||||
|
add_header X-Frame-Options SAMEORIGIN;\n\
|
||||||
|
add_header X-Content-Type-Options nosniff;" /etc/nginx/sites-available/piler-nginx.conf
|
||||||
|
|
||||||
|
sed -i "/^server {.*/i\
|
||||||
|
server {\n\
|
||||||
|
listen 80;\n\
|
||||||
|
server_name $PILER_DOM;\n\
|
||||||
|
server_tokens off;\n\
|
||||||
|
# HTTP to HTTPS redirect.\n\
|
||||||
|
return 301 https://$PILER_DOM;\n\
|
||||||
|
}" /etc/nginx/sites-available/piler-nginx.conf
|
||||||
|
|
||||||
|
cp /usr/local/etc/piler/config-site.php /usr/local/etc/piler/config-site.php.bak
|
||||||
|
sed -i "s|\$config\['SITE_URL'\] = .*|\$config\['SITE_URL'\] = 'https://$PILER_DOM/';|" /usr/local/etc/piler/config-site.php
|
||||||
|
cat >> /usr/local/etc/piler/config-site.php <<EOF
|
||||||
|
|
||||||
|
// CUSTOM
|
||||||
|
\$config['PROVIDED_BY'] = '$PILER_DOM';
|
||||||
|
\$config['SUPPORT_LINK'] = 'https://$PILER_DOM';
|
||||||
|
\$config['COMPATIBILITY'] = '';
|
||||||
|
|
||||||
|
// fancy features.
|
||||||
|
\$config['ENABLE_INSTANT_SEARCH'] = 1;
|
||||||
|
\$config['ENABLE_TABLE_RESIZE'] = 1;
|
||||||
|
|
||||||
|
\$config['ENABLE_DELETE'] = 1;
|
||||||
|
\$config['ENABLE_ON_THE_FLY_VERIFICATION'] = 1;
|
||||||
|
|
||||||
|
// general settings.
|
||||||
|
\$config['TIMEZONE'] = 'Europe/Berlin';
|
||||||
|
|
||||||
|
// authentication
|
||||||
|
// Enable authentication against an imap server
|
||||||
|
//\$config['ENABLE_IMAP_AUTH'] = 1;
|
||||||
|
//\$config['RESTORE_OVER_IMAP'] = 1;
|
||||||
|
//\$config['IMAP_RESTORE_FOLDER_INBOX'] = 'INBOX';
|
||||||
|
//\$config['IMAP_RESTORE_FOLDER_SENT'] = 'Sent';
|
||||||
|
//\$config['IMAP_HOST'] = '$SMARTHOST';
|
||||||
|
//\$config['IMAP_PORT'] = 993;
|
||||||
|
//\$config['IMAP_SSL'] = true;
|
||||||
|
|
||||||
|
// authentication against an ldap directory (disabled by default)
|
||||||
|
//\$config['ENABLE_LDAP_AUTH'] = 1;
|
||||||
|
//\$config['LDAP_HOST'] = '$SMARTHOST';
|
||||||
|
//\$config['LDAP_PORT'] = 389;
|
||||||
|
//\$config['LDAP_HELPER_DN'] = 'cn=administrator,cn=users,dc=mydomain,dc=local';
|
||||||
|
//\$config['LDAP_HELPER_PASSWORD'] = 'myxxxxpasswd';
|
||||||
|
//\$config['LDAP_MAIL_ATTR'] = 'mail';
|
||||||
|
//\$config['LDAP_AUDITOR_MEMBER_DN'] = '';
|
||||||
|
//\$config['LDAP_ADMIN_MEMBER_DN'] = '';
|
||||||
|
//\$config['LDAP_BASE_DN'] = 'ou=Benutzer,dc=krs,dc=local';
|
||||||
|
|
||||||
|
// authentication against an Uninvention based ldap directory
|
||||||
|
//\$config['ENABLE_LDAP_AUTH'] = 1;
|
||||||
|
//\$config['LDAP_HOST'] = '$SMARTHOST';
|
||||||
|
//\$config['LDAP_PORT'] = 7389;
|
||||||
|
//\$config['LDAP_HELPER_DN'] = 'uid=ldap-search-user,cn=users,dc=mydomain,dc=local';
|
||||||
|
//\$config['LDAP_HELPER_PASSWORD'] = 'myxxxxpasswd';
|
||||||
|
//\$config['LDAP_AUDITOR_MEMBER_DN'] = '';
|
||||||
|
//\$config['LDAP_ADMIN_MEMBER_DN'] = '';
|
||||||
|
//\$config['LDAP_BASE_DN'] = 'cn=users,dc=mydomain,dc=local';
|
||||||
|
//\$config['LDAP_MAIL_ATTR'] = 'mailPrimaryAddress';
|
||||||
|
//\$config['LDAP_ACCOUNT_OBJECTCLASS'] = 'person';
|
||||||
|
//\$config['LDAP_DISTRIBUTIONLIST_OBJECTCLASS'] = 'person';
|
||||||
|
//\$config['LDAP_DISTRIBUTIONLIST_ATTR'] = 'mailAlternativeAddress';
|
||||||
|
|
||||||
|
// special settings.
|
||||||
|
\$config['MEMCACHED_ENABLED'] = 1;
|
||||||
|
\$config['SPHINX_STRICT_SCHEMA'] = 1; // required for Sphinx $SPHINX_VER, see https://bitbucket.org/jsuto/piler/issues/1085/sphinx-331.
|
||||||
|
EOF
|
||||||
|
|
||||||
|
nginx -t && systemctl restart nginx
|
||||||
|
|
||||||
|
apt autoremove -y
|
||||||
|
apt clean -y
|
||||||
|
|
||||||
|
|
||||||
150
matrix.orig
Normal file
150
matrix.orig
Normal file
@ -0,0 +1,150 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
#MATRIX_VAR
|
||||||
|
|
||||||
|
|
||||||
|
MRX_PKE=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
|
||||||
|
|
||||||
|
ELE_DBNAME="synapse_db"
|
||||||
|
ELE_DBUSER="synapse_user"
|
||||||
|
ELE_DBPASS=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
|
||||||
|
|
||||||
|
apt update && apt full-upgrade -y
|
||||||
|
|
||||||
|
apt install -y lsb-release apt-transport-https curl gpg software-properties-common net-tools nginx mc postgresql python3-psycopg2
|
||||||
|
|
||||||
|
wget wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
|
||||||
|
echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/matrix-org.list
|
||||||
|
apt update && apt install -y matrix-synapse-py3
|
||||||
|
systemctl enable matrix-synapse
|
||||||
|
|
||||||
|
ss -tulpen
|
||||||
|
|
||||||
|
mkdir /etc/nginx/ssl
|
||||||
|
openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/nginx/ssl/matrix.key -out /etc/nginx/ssl/matrix.crt -subj "/CN=$MRX_DOM" -addext "subjectAltName=DNS:$MRX_DOM"
|
||||||
|
|
||||||
|
cat > /etc/nginx/sites-available/$MRX_DOM <<EOF
|
||||||
|
# Virtual Host configuration for example.com
|
||||||
|
#
|
||||||
|
# You can move that to a different file under sites-available/ and symlink that
|
||||||
|
# to sites-enabled/ to enable it.
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name $MRX_DOM;
|
||||||
|
|
||||||
|
return 301 https://$MRX_DOM;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
listen [::]:443 ssl;
|
||||||
|
server_name $MRX_DOM;
|
||||||
|
|
||||||
|
ssl on;
|
||||||
|
ssl_certificate /etc/nginx/ssl/matrix.crt;
|
||||||
|
ssl_certificate_key /etc/nginx/ssl/matrix.key;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:8008;
|
||||||
|
proxy_set_header X-Forwarded-For \$remote_addr;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 8448 ssl;
|
||||||
|
listen [::]:8448 ssl;
|
||||||
|
server_name $MRX_DOM;
|
||||||
|
|
||||||
|
ssl on;
|
||||||
|
ssl_certificate /etc/nginx/ssl/matrix.crt;
|
||||||
|
ssl_certificate_key /etc/nginx/ssl/matrix.key;
|
||||||
|
|
||||||
|
# If you don't wanna serve a site, comment this out
|
||||||
|
root /var/www/$MRX_DOM;
|
||||||
|
index index.html index.htm;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:8008;
|
||||||
|
proxy_set_header X-Forwarded-For \$remote_addr;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
EOF
|
||||||
|
ln -s /etc/nginx/sites-available/$MRX_DOM /etc/nginx/sites-enabled/$MRX_DOM
|
||||||
|
|
||||||
|
cat > /etc/nginx/sites-available/$ELE_DOM <<EOF
|
||||||
|
# Virtual Host configuration for example.com
|
||||||
|
#
|
||||||
|
# You can move that to a different file under sites-available/ and symlink that
|
||||||
|
# to sites-enabled/ to enable it.
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name $ELE_DOM;
|
||||||
|
return 301 https://$ELE_DOM;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
listen [::]:443 ssl;
|
||||||
|
server_name $ELE_DOM;
|
||||||
|
|
||||||
|
ssl on;
|
||||||
|
ssl_certificate /etc/nginx/ssl/matrix.crt;
|
||||||
|
ssl_certificate_key /etc/nginx/ssl/matrix.key;
|
||||||
|
|
||||||
|
# If you don't wanna serve a site, comment this out
|
||||||
|
root /var/www/$ELE_DOM/element;
|
||||||
|
index index.html index.htm;
|
||||||
|
}
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
ln -s /etc/nginx/sites-available/$ELE_DOM /etc/nginx/sites-enabled/$ELE_DOM
|
||||||
|
|
||||||
|
systemctl restart nginx
|
||||||
|
|
||||||
|
mkdir /var/www/$ELE_DOM
|
||||||
|
cd /var/www/$ELE_DOM
|
||||||
|
wget https://packages.riot.im/element-release-key.asc
|
||||||
|
gpg --import element-release-key.asc
|
||||||
|
|
||||||
|
wget https://github.com/vector-im/element-web/releases/download/$ELE_VER/element-$ELE_VER.tar.gz
|
||||||
|
wget https://github.com/vector-im/element-web/releases/download/$ELE_VER/element-$ELE_VER.tar.gz.asc
|
||||||
|
gpg --verify element-$ELE_VER.tar.gz.asc
|
||||||
|
|
||||||
|
tar -xzvf element-$ELE_VER.tar.gz
|
||||||
|
ln -s element-$ELE_VER element
|
||||||
|
chown www-data:www-data -R element
|
||||||
|
cp ./element/config.sample.json ./element/config.json
|
||||||
|
sed -i "s|https://matrix-client.matrix.org|https://$MRX_DOM|" ./element/config.json
|
||||||
|
sed -i "s|\"server_name\": \"matrix.org\"|\"server_name\": \"$MRX_DOM\"|" ./element/config.json
|
||||||
|
|
||||||
|
su postgres <<EOF
|
||||||
|
psql -c "CREATE USER $ELE_DBUSER WITH PASSWORD '$ELE_DBPASS';"
|
||||||
|
psql -c "CREATE DATABASE $ELE_DBNAME ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0 OWNER $ELE_DBUSER;"
|
||||||
|
echo "Postgres User '$ELE_DBUSER' and database '$ELE_DBNAME' created."
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cd /
|
||||||
|
sed -i "s|#registration_shared_secret: <PRIVATE STRING>|registration_shared_secret: \"$MRX_PKE\"|" /etc/matrix-synapse/homeserver.yaml
|
||||||
|
sed -i "s|#public_baseurl: https://example.com/|public_baseurl: https://$MRX_DOM/|" /etc/matrix-synapse/homeserver.yaml
|
||||||
|
sed -i "s|#enable_registration: false|enable_registration: true|" /etc/matrix-synapse/homeserver.yaml
|
||||||
|
sed -i "s|name: sqlite3|name: psycopg2|" /etc/matrix-synapse/homeserver.yaml
|
||||||
|
sed -i "s|database: /var/lib/matrix-synapse/homeserver.db|database: $ELE_DBNAME\n user: $ELE_DBUSER\n password: $ELE_DBPASS\n host: 127.0.0.1\n cp_min: 5\n cp_max: 10|" /etc/matrix-synapse/homeserver.yaml
|
||||||
|
|
||||||
|
systemctl restart matrix-synapse
|
||||||
|
|
||||||
|
register_new_matrix_user -c /etc/matrix-synapse/homeserver.yaml http://127.0.0.1:8008
|
||||||
|
|
||||||
|
#curl https://download.jitsi.org/jitsi-key.gpg.key | sh -c 'gpg --dearmor > /usr/share/keyrings/jitsi-keyring.gpg'
|
||||||
|
#echo 'deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/' | tee /etc/apt/sources.list.d/jitsi-stable.list > /dev/null
|
||||||
|
|
||||||
|
#apt update
|
||||||
|
#apt install -y jitsi-meet
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
100
zmb_mem.orig
Normal file
100
zmb_mem.orig
Normal file
@ -0,0 +1,100 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
#ZMB_VAR
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
apt update && apt full-upgrade -y
|
||||||
|
echo -ne '\n' | apt install -y acl dnsutils mc samba winbind libpam-winbind libnss-winbind krb5-user krb5-config samba-dsdb-modules samba-vfs-modules
|
||||||
|
|
||||||
|
mv /etc/krb5.conf /etc/krb5.conf.bak
|
||||||
|
cat > /etc/krb5.conf <<EOF
|
||||||
|
[libdefaults]
|
||||||
|
default_realm = $ZMB_REA
|
||||||
|
ticket_lifetime = 600
|
||||||
|
dns_lookup_realm = true
|
||||||
|
dns_lookup_kdc = true
|
||||||
|
renew_lifetime = 7d
|
||||||
|
EOF
|
||||||
|
|
||||||
|
echo -e "$ZMB_APW" | kinit -V $ZMB_ADA
|
||||||
|
klist
|
||||||
|
|
||||||
|
mv /etc/samba/smb.conf /etc/samba/smb.conf.bak
|
||||||
|
cat > /etc/samba/smb.conf <<EOF
|
||||||
|
[global]
|
||||||
|
workgroup = $ZMB_DOM
|
||||||
|
security = ADS
|
||||||
|
realm = $ZMB_REA
|
||||||
|
server string = %h server
|
||||||
|
|
||||||
|
vfs objects = acl_xattr shadow_copy2
|
||||||
|
map acl inherit = Yes
|
||||||
|
store dos attributes = Yes
|
||||||
|
idmap config *:backend = tdb
|
||||||
|
idmap config *:range = 3000000-4000000
|
||||||
|
idmap config *:schema_mode = rfc2307
|
||||||
|
|
||||||
|
winbind refresh tickets = Yes
|
||||||
|
winbind use default domain = Yes
|
||||||
|
winbind separator = /
|
||||||
|
winbind nested groups = yes
|
||||||
|
winbind nss info = rfc2307
|
||||||
|
|
||||||
|
pam password change = Yes
|
||||||
|
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
|
||||||
|
passwd program = /usr/bin/passwd %u
|
||||||
|
|
||||||
|
template homedir = /home/%U
|
||||||
|
template shell = /bin/bash
|
||||||
|
bind interfaces only = Yes
|
||||||
|
interfaces = lo eth0
|
||||||
|
log file = /var/log/samba/log.%m
|
||||||
|
logging = syslog
|
||||||
|
max log size = 1000
|
||||||
|
panic action = /usr/share/samba/panic-action %d
|
||||||
|
|
||||||
|
load printers = No
|
||||||
|
printcap name = /dev/null
|
||||||
|
printing = bsd
|
||||||
|
disable spoolss = Yes
|
||||||
|
|
||||||
|
allow trusted domains = No
|
||||||
|
dns proxy = No
|
||||||
|
shadow: snapdir = .zfs/snapshot
|
||||||
|
shadow: sort = desc
|
||||||
|
shadow: format = -%Y-%m-%d-%H%M
|
||||||
|
shadow: snapprefix = ^zfs-auto-snap_\(frequent\)\{0,1\}\(hourly\)\{0,1\}\(daily\)\{0,1\}\(monthly\)\{0,1\}
|
||||||
|
shadow: delimiter = -20
|
||||||
|
|
||||||
|
[share]
|
||||||
|
comment = Main Share
|
||||||
|
path = /tank/share
|
||||||
|
read only = No
|
||||||
|
create mask = 0660
|
||||||
|
directory mask = 0770
|
||||||
|
inherit acls = Yes
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl restart smbd
|
||||||
|
|
||||||
|
echo -e "$ZMB_APW" | net ads join -U $ZMB_ADA createcomputer=Computers
|
||||||
|
sed -i "s|files systemd|files systemd winbind|g" /etc/nsswitch.conf
|
||||||
|
sed -i "s|#WINBINDD_OPTS=|WINBINDD_OPTS=|" /etc/default/winbind
|
||||||
|
echo -e "session optional pam_mkhomedir.so skel=/etc/skel umask=077" >> /etc/pam.d/common-session
|
||||||
|
|
||||||
|
systemctl restart winbind nmbd
|
||||||
|
wbinfo -u
|
||||||
|
wbinfo -g
|
||||||
|
|
||||||
|
mkdir /tank/share
|
||||||
|
chown 'administrator':'domain users' /tank/share
|
||||||
|
|
||||||
|
setfacl -Rm u:administrator:rwx,g::-,o::- /tank/share
|
||||||
|
setfacl -Rdm u:administrator:rwx,g::-,o::- /tank/share
|
||||||
|
|
||||||
|
systemctl restart smbd nmbd winbind
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user