-
Notifications
You must be signed in to change notification settings - Fork 0
/
kick_paste_example.sh
executable file
·263 lines (209 loc) · 6.7 KB
/
kick_paste_example.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
# This file is intended to:
## - write base ENV variables that can be sourced by other scripts
## - download and source help functions
## - fire off initial configuration including sysctl configuration
# /etc/environment
# /root/.ssh
# /root/.bashrc
# /root/.config/
# ├── global.env
# ├── docker.env
# ├── smtp.env
# ├── snmp.env
# └── git.env
# Max Width
#<-------------------------------------------------------------------------------------------------->#
# Variables and Prep ------------------------------------------------------------------------------
GIT_PROTOCOL=""
GIT_SERVER_FQDN=""
GIT_USER=""
SECURE_USER_ID="1000"
SECURE_USER="$(id -nu "$SECURE_USER_ID" 2>/dev/null || echo "user")"
LAN_NIC=$(ip -o link show up | awk -F': ' 'NR==2 {print $2; exit}' | sed 's/@.*//')
BASE="/root/"
SCRIPTS="$BASE/scripts/"
CONFIGS="$BASE/.config/"
ENV_GLOBAL="$CONFIGS/global.env"
ssh_path="/root/.ssh"
mkdir -p "$SCRIPTS" "$CONFIGS" "$ssh_path"
apt update
apt install wget git openssh-client xterm -y
# Resize terminal
trap "resize >/dev/null" DEBUG
export TERM=xterm-256color
git clone "$GIT_PROTOCOL://$GIT_SERVER_FQDN/$GIT_USER/Base.git" "$SCRIPTS/base"
# Helper script(s)
source "$SCRIPTS/base/debian/logging_functions.sh"
source "$SCRIPTS/base/debian/env_writer.sh"
# System Variables -------------------------------------------------------------------------------
cat <<EOT > /etc/environment
# Localization
export TZ="America/Vancouver"
export LANG="en_US.UTF-8"
# Shell
export SHELL="/bin/bash"
export EDITOR="nano"
# Modprobe Blacklist
export MOD_BLACKLIST="/etc/modprobe.d/blacklist.conf"
EOT
source /etc/environment
# User Variables -------------------------------------------------------------------------------
env_writer \
--service 'Global' \
--content "
# FILEPATHS
export BASE=\"$BASE\"
export SCRIPTS=\"$SCRIPTS\"
export CONFIGS=\"$CONFIGS\"
export LOGS=/var/log
# filepaths
export base=\"$BASE\"
export scripts=\"$SCRIPTS\"
export configs=\"$CONFIGS\"
export logs=/var/log
# Logging
source $SCRIPTS/base/debian/logging_functions.sh
"
# IP Tables / Network
env_writer \
--source \
--service 'Network' \
--content "
# System
export LAN_NIC=$LAN_NIC # Predictable network interface name assigned by udev (v197) for the primary network interface
export DOMAIN="lan" # Referenced by scripts that need to know the local or remote domain extension
export FIREWALL="iptables" # Referenced by scripts that need to know what, if any firewall is intended to be used
export REV_PROXY_FQDN="172.27.0.1" # Local Reverse Proxy IP (if used)
# Trusted Subnets
export GREEN="10.0.0.0/24" # Subnet treated with high trust
export CYAN="192.168.111.0/24" # Semi-trusted Subnet
# Untrusted Subnets
export ORANGE="172.27.0.0/24" # DMZ Subnet
export BLUE="192.168.0.0/24" # Guest Subnet
# Isolated Subnets
export BROWN="192.168.7.0/24" # Isolated Subnet
# VPN Subnets
export VPN="10.2.0.0/24" # Subnet for VPN clients, similar to GREEN
export BLACK="172.27.7.0/24" # VPN outbound international
export GRAY="172.27.9.0/24" # VPN outbound national
# Alias for RFC1918 Local area subnets
export RFC1918="192.168.0.0/16,172.16.0.0/12,10.0.0.0/8"
"
# SMTP Secrets
env_writer \
--service 'SMTP' \
--content '
export ADMIN_EMAIL=""
export SMTP_USER=""
export SMTP_PASS=""
export SMTP_SERVER_FQDN=""
export SMTP_PORT="587"
'
# SNMP
env_writer \
--service 'SNMP' \
--content '
export SNMP_AGENT_PORT="161"
export SNMP_POLLER_FQDN=""
export SNMP_LOCATION=""
'
# SSH
env_writer \
--service 'SSH' \
--content '
export SSH_ALLOW_FQDN=""
export SSH_ALLOW_IPS="$GREEN"
'
# Docker -----------------------------------------------------------------------------------------
env_writer \
--source \
--service 'Docker' \
--content '
# Paths
export DOCKER_CONTROLLER="$SCRIPTS/docker/.controller"
export DOCKER_ROOT_DIR="/var/lib/docker"
export DOCKER_MOUNTS="$DOCKER_ROOT_DIR/mounts"
export DOCKER_VOLUMES="$DOCKER_ROOT_DIR/volumes"
export DOCKER_CONFIGS="$CONFIGS/containers"
export DOCKER_API_PORT=2376
# Docker
export DOCKER_REGISTRY_MIRROR_FQDN=""
# Portainer
export PORTAINER_SERVER_FQDN=""
# Docker Controller
alias dc="$DOCKER_CONTROLLER/docker-controller.sh"
'
# Restic Info
env_writer \
--service 'Restic' \
--content '
# Server Details, REST: https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#rest-server
export RESTIC_SERVER_FQDN=""
export RESTIC_SERVER_PORT="443"
export RESTIC_SERVER_TYPE="Rest"
# Server User Credentials
export RESTIC_SERVER_USER_NAME=""
export RESTIC_SERVER_USER_PASSWORD=""
export RESTIC_SERVER_BASE_REPO_URL="rest:https://$RESTIC_SERVER_USER_NAME:$RESTIC_SERVER_USER_PASSWORD@$RESTIC_SERVER_FQDN" #/$RESTIC_SERVER_USER_NAME-$LABEL
# Default Repo Password
export RESTIC_REPO_DEFAULT_PASSWORD=""
export
'
# Git -----------------------------------------------------------------------------------------------
env_writer \
--service 'GIT' \
--content "
# Git
export GIT_SERVER_FQDN=\"$GIT_SERVER_FQDN\"
export GIT_USER=\"$GIT_USER\"
# Specific Repo SSH aliases
export GIT_APT_URL=\"git@$GIT_SERVER_FQDN-Apt:/$GIT_USER\"
export GIT_DOCKER_URL=\"git@$GIT_SERVER_FQDN-Docker:/$GIT_USER\"
"
### Identity Files
cat <<EOT > "$ssh_path/gitRepo-Apt-deploy.key"
-----BEGIN OPENSSH PRIVATE KEY-----
-----END OPENSSH PRIVATE KEY-----
EOT
cat <<EOT > "$ssh_path/gitRepo-Docker-deploy.key"
-----BEGIN OPENSSH PRIVATE KEY-----
-----END OPENSSH PRIVATE KEY-----
EOT
### Aliases
cat <<EOT >> /root/.ssh/config
# Github SSH Server Aliases ------------------------------------
Host $GIT_SERVER_FQDN-Apt
Hostname $GIT_SERVER_FQDN
IdentityFile=$ssh_path/gitRepo-Apt-deploy.key
Host $GIT_SERVER_FQDN-Docker
Hostname $GIT_SERVER_FQDN
IdentityFile=$ssh_path/gitRepo-Docker-deploy.key
EOT
# Fix permission all all the keys and config above
chmod -R 700 "$ssh_path"
# Bash RC -----------------------------------------------------------------------------------------------
cat <<EOT >> /root/.bashrc
# Non-Root user, from preseed.cfg
export SECURE_USER_UID="$SECURE_USER_ID"
export SECURE_USER="$SECURE_USER"
export SECURE_USER_GROUP=users
# Environmental Variables Global list
export ENV_GLOBAL="$ENV_GLOBAL"
source "$ENV_GLOBAL"
# Aliases
alias aptup="$SCRIPTS/base/debian/update.sh"
alias update="$SCRIPTS/base/debian/update.sh"
alias clean="$SCRIPTS/apt/clean.sh"
alias pullall="$SCRIPTS/base/debian/pullall.sh"
EOT
# Reload .bashrc
. ~/.bashrc
# Clone Apt, don't ask about new fingerprints
export GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no'
git clone "$GIT_APT_URL/Apt.git" "$SCRIPTS/apt"
# Prep-VM
. "$SCRIPTS/base/prepVM.sh"
# Debian Base
. "$SCRIPTS/base/up.sh"
# source $ENV_GIT
# git clone "$GIT_DOCKER_URL/docker.git" "$SCRIPTS/docker"