From 788b09c391013255f1c0f154f482d7e727fb9a5d Mon Sep 17 00:00:00 2001 From: Danny Nakielski Date: Sun, 25 Jun 2023 01:43:55 +0200 Subject: [PATCH 01/27] Migrate Nextcloud to debian bookworm --- src/nextcloud/constants-service.conf | 4 ++-- src/nextcloud/install-service.sh | 24 ++++++++++++++++++------ 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/src/nextcloud/constants-service.conf b/src/nextcloud/constants-service.conf index 51f9a33..c9825e5 100644 --- a/src/nextcloud/constants-service.conf +++ b/src/nextcloud/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="1" @@ -23,7 +23,7 @@ LXC_NESTING="1" NEXTCLOUD_VERSION="latest" # Defines the php version to install -NEXTCLOUD_PHP_VERSION="8.1" +NEXTCLOUD_PHP_VERSION="8.2" # Defines the IP from the SQL server NEXTCLOUD_DB_IP="127.0.0.1" diff --git a/src/nextcloud/install-service.sh b/src/nextcloud/install-service.sh index 79d65c6..95f7022 100644 --- a/src/nextcloud/install-service.sh +++ b/src/nextcloud/install-service.sh @@ -14,13 +14,13 @@ source /root/constants-service.conf HOSTNAME=$(hostname -f) -wget -q -O - https://packages.sury.org/php/apt.gpg | apt-key add - +wget -q -O - https://packages.sury.org/php/apt.gpg | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/sury-php.gpg >/dev/null echo "deb https://packages.sury.org/php/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/php.list -wget -q -O - https://nginx.org/keys/nginx_signing.key | apt-key add - +wget -q -O - https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx.gpg >/dev/null echo "deb http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list -wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - +wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.gpg >/dev/null echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list apt update @@ -76,7 +76,7 @@ sed -i "s/;session.cookie_secure.*/session.cookie_secure = True/" /etc/php/$NEXT sed -i "s/;opcache.enable=.*/opcache.enable=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.enable_cli=.*/opcache.enable_cli=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.memory_consumption=.*/opcache.memory_consumption=128/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini -sed -i "s/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=8/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini +sed -i "s/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=16/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=10000/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.revalidate_freq=.*/opcache.revalidate_freq=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini sed -i "s/;opcache.save_comments=.*/opcache.save_comments=1/" /etc/php/$NEXTCLOUD_PHP_VERSION/fpm/php.ini @@ -113,6 +113,9 @@ set_real_ip_from 127.0.0.1; real_ip_header X-Forwarded-For; real_ip_recursive on; include /etc/nginx/mime.types; +types { + text/javascript mjs; + } default_type application/octet-stream; sendfile on; send_timeout 3600; @@ -136,6 +139,10 @@ cat > /etc/nginx/conf.d/http.conf << EOF upstream php-handler { server unix:/run/php/php$NEXTCLOUD_PHP_VERSION-fpm.sock; } +map \$arg_v \$asset_immutable { + "" ""; + default "immutable"; +} server { listen 80 default_server; listen [::]:80 default_server; @@ -171,13 +178,15 @@ ssl_prefer_server_ciphers on; ssl_stapling on; ssl_stapling_verify on; client_max_body_size 5120M; +client_body_timeout 300s; +client_body_buffer_size 512k; fastcgi_buffers 64 4K; gzip on; gzip_vary on; gzip_comp_level 4; gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; -gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; +gzip_types application/atom+xml text/javascript application/wasm application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; add_header Permissions-Policy "interest-cohort=()"; add_header Referrer-Policy "no-referrer" always; @@ -230,10 +239,13 @@ fastcgi_pass php-handler; fastcgi_intercept_errors on; fastcgi_request_buffering off; } -location ~ \.(?:css|js|svg|gif)\$ { +location ~ \.(?:css|js|mjs|svg|gif|ico|wasm|tflite|map)\$ { try_files \$uri /index.php\$request_uri; expires 6M; access_log off; + location ~ \.wasm$ { + default_type application/wasm; + } } location ~ \.woff2?\$ { try_files \$uri /index.php\$request_uri; From 713219b6d5d0a8d39e38f8c81fffb3ff7e623a12 Mon Sep 17 00:00:00 2001 From: Danny Nakielski Date: Sun, 25 Jun 2023 03:20:24 +0200 Subject: [PATCH 02/27] Upgrade Nextcloud to Postgresql 15 --- src/nextcloud/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/nextcloud/install-service.sh b/src/nextcloud/install-service.sh index 95f7022..3a62f40 100644 --- a/src/nextcloud/install-service.sh +++ b/src/nextcloud/install-service.sh @@ -26,7 +26,7 @@ echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends tree locate screen zip ffmpeg ghostscript libfile-fcntllock-perl libfuse2 socat fail2ban ldap-utils cifs-utils redis-server imagemagick libmagickcore-6.q16-6-extra \ -postgresql-13 nginx php$NEXTCLOUD_PHP_VERSION-{fpm,gd,mysql,pgsql,curl,xml,zip,intl,mbstring,bz2,ldap,apcu,bcmath,gmp,imagick,igbinary,redis,dev,smbclient,cli,common,opcache,readline} +postgresql-15 nginx php$NEXTCLOUD_PHP_VERSION-{fpm,gd,mysql,pgsql,curl,xml,zip,intl,mbstring,bz2,ldap,apcu,bcmath,gmp,imagick,igbinary,redis,dev,smbclient,cli,common,opcache,readline} timedatectl set-timezone $LXC_TIMEZONE mkdir -p /$LXC_SHAREFS_MOUNTPOINT/$NEXTCLOUD_DATA /var/www From 80ad64f422eeb3f633f8e88844d5e94282463daf Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 27 Nov 2023 21:49:00 +0100 Subject: [PATCH 03/27] Beta ready zmb-cups --- src/zmb-cups/constants-service.conf | 4 ++-- src/zmb-cups/install-service.sh | 35 ++++++++++++++++------------- 2 files changed, 21 insertions(+), 18 deletions(-) diff --git a/src/zmb-cups/constants-service.conf b/src/zmb-cups/constants-service.conf index d68871d..9230b29 100644 --- a/src/zmb-cups/constants-service.conf +++ b/src/zmb-cups/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP="1" # Create unprivileged container LXC_UNPRIVILEGED="0" @@ -23,4 +23,4 @@ LXC_NESTING="1" LXC_MEM_MIN=1024 # service dependent meta tags -SERVICE_TAGS="samba,member,fileserver" \ No newline at end of file +SERVICE_TAGS="samba,member,cups,printserver" diff --git a/src/zmb-cups/install-service.sh b/src/zmb-cups/install-service.sh index f13919e..ed53a43 100644 --- a/src/zmb-cups/install-service.sh +++ b/src/zmb-cups/install-service.sh @@ -19,7 +19,7 @@ mv /etc/krb5.conf /etc/krb5.conf.bak cat > /etc/krb5.conf < /etc/samba/smb.conf < /etc/samba/smb.conf <> / systemctl restart winbind nmbd -chown -R ${ZMB_ADMIN_USER}:"domain admins" /var/lib/samba/printers -chmod -R 2775 /var/lib/samba/printers -setfacl -Rb /var/lib/samba/printers -setfacl -Rm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers -setfacl -Rdm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r--,g:"NT Authority/system":rwx,o::--- /var/lib/samba/printers -echo -e "${ZMB_ADMIN_PASS}" | net rpc rights grant "${ZMB_DOMAIN}\\Domain Admins" SePrintOperatorPrivilege -U "${ZMB_DOMAIN}\\${ZMB_ADMIN_USER}" -echo -e "!root = ${ZMB_DOMAIN}\\administrator ${ZMB_DOMAIN}\\Administrator" > /etc/samba/user.map +mkdir -p /${LXC_SHAREFS_MOUNTPOINT}/{spool,printerdrivers} +cp -rv /var/lib/samba/printers/* /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +chown -R root:"domain admins" /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +chmod -R 1777 /${LXC_SHAREFS_MOUNTPOINT}/spool +chmod -R 2775 /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rb /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r-x,o::--- /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +setfacl -Rdm u:${ZMB_ADMIN_USER}:rwx,g:"domain admins":rwx,g:"NT Authority/authenticated users":r-x,o::--- /${LXC_SHAREFS_MOUNTPOINT}/printerdrivers +echo -e "${ZMB_ADMIN_PASS}" | net rpc rights grant "${ZMB_DOMAIN}\\domain admins" SePrintOperatorPrivilege -U "${ZMB_DOMAIN}\\${ZMB_ADMIN_USER}" +systemctl disable --now cups-browsed.service cupsctl --remote-admin -systemctl restart cups smbd nmbd winbind wsdd +systemctl restart cups smbd nmbd winbind wsdd \ No newline at end of file From 4dbb11c3bd5ac99aa0fb0b81b80751e54cd15e9c Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Wed, 29 Nov 2023 19:45:03 +0100 Subject: [PATCH 04/27] Set checkmk version to 2.2.0p14 --- src/checkmk/constants-service.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index 38f948e..bd543e5 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -20,7 +20,7 @@ LXC_UNPRIVILEGED="1" LXC_NESTING="1" # checkmk version -CMK_VERSION=2.2.0p7 +CMK_VERSION=2.2.0p14 # build number of the debian package (needs to start with underscore) CMK_BUILD=_0 @@ -28,4 +28,4 @@ CMK_BUILD=_0 LXC_MEM_MIN=2048 # service dependent meta tags -SERVICE_TAGS="apache2" \ No newline at end of file +SERVICE_TAGS="apache2" From 11a8f4ecc322eab67d8b998bd13d09d77b8bc068 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Wed, 29 Nov 2023 19:45:29 +0100 Subject: [PATCH 05/27] Change ntp server from ntpd to chrony --- src/zmb-ad-join/install-service.sh | 52 ++++++++++++++------------- src/zmb-ad/install-service.sh | 57 ++++++++++++++---------------- 2 files changed, 53 insertions(+), 56 deletions(-) diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index f51cf66..7cc51e8 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -27,38 +27,40 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -## configure ntp -cat << EOF > /etc/ntp.conf -# Local clock. Note that is not the "localhost" address! -server 127.127.1.0 -fudge 127.127.1.0 stratum 10 -# Where to retrieve the time from -server 0.de.pool.ntp.org iburst prefer -server 1.de.pool.ntp.org iburst prefer -server 2.de.pool.ntp.org iburst prefer -driftfile /var/lib/ntp/ntp.drift -logfile /var/log/ntp -ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ -# Access control -# Default restriction: Allow clients only to query the time -restrict default kod nomodify notrap nopeer mssntp -# No restrictions for "localhost" -restrict 127.0.0.1 -# Enable the time sources to only provide time to this host -restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -tinker panic 0 -EOF - echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils chrony sipcalc DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils rsync cifs-utils + +mkdir -p /etc/chrony/conf.d +mkdir -p /etc/systemd/system/chrony.service.d + +cat << EOF > /etc/default/chrony +# This is a configuration file for /etc/init.d/chrony and +# /lib/systemd/system/chrony.service; it allows you to pass various options to +# the chrony daemon without editing the init script or service file. + +# Options to pass to chrony. +DAEMON_OPTS="-x -F 1" +EOF + +cat << EOF > /etc/systemd/system/chrony.service.d/override.conf +[Unit] +ConditionCapability= +EOF + +cat << EOF > /etc/chrony/conf.d/samba.conf +bindcmdaddress $(sipcalc ${LXC_IP} | grep -m1 "Host address" | rev | cut -d' ' -f1 | rev) +server de.pool.ntp.org iburst +server europe.pool.ntp.org iburst +allow $(sipcalc ${LXC_IP} | grep -m1 "Network address" | rev | cut -d' ' -f1 | rev)/$(sipcalc ${LXC_IP} | grep -m1 "Network mask (bits)" | rev | cut -d' ' -f1 | rev) +ntpsigndsocket /var/lib/samba/ntp_signd +EOF + if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default server { diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index 21e5a52..d9d8fa3 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -27,45 +27,40 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -## configure ntp -cat << EOF > /etc/ntp.conf -# Local clock. Note that is not the "localhost" address! -server 127.127.1.0 -fudge 127.127.1.0 stratum 10 - -# Where to retrieve the time from -server 0.de.pool.ntp.org iburst prefer -server 1.de.pool.ntp.org iburst prefer -server 2.de.pool.ntp.org iburst prefer - -driftfile /var/lib/ntp/ntp.drift -logfile /var/log/ntp -ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ - -# Access control -# Default restriction: Allow clients only to query the time -restrict default kod nomodify notrap nopeer mssntp - -# No restrictions for "localhost" -restrict 127.0.0.1 - -# Enable the time sources to only provide time to this host -restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery -restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery - -tinker panic 0 -EOF - echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq dist-upgrade # install required packages -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils ntp +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" $LXC_TOOLSET $ADDITIONAL_PACKAGES ntpdate rpl net-tools dnsutils chrony sipcalc DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -t bookworm-backports -y -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" acl attr samba smbclient winbind libpam-winbind libnss-winbind krb5-user samba-dsdb-modules samba-vfs-modules lmdb-utils +mkdir -p /etc/chrony/conf.d +mkdir -p /etc/systemd/system/chrony.service.d + +cat << EOF > /etc/default/chrony +# This is a configuration file for /etc/init.d/chrony and +# /lib/systemd/system/chrony.service; it allows you to pass various options to +# the chrony daemon without editing the init script or service file. + +# Options to pass to chrony. +DAEMON_OPTS="-x -F 1" +EOF + +cat << EOF > /etc/systemd/system/chrony.service.d/override.conf +[Unit] +ConditionCapability= +EOF + +cat << EOF > /etc/chrony/conf.d/samba.conf +bindcmdaddress $(sipcalc ${LXC_IP} | grep -m1 "Host address" | rev | cut -d' ' -f1 | rev) +server de.pool.ntp.org iburst +server europe.pool.ntp.org iburst +allow $(sipcalc ${LXC_IP} | grep -m1 "Network address" | rev | cut -d' ' -f1 | rev)/$(sipcalc ${LXC_IP} | grep -m1 "Network mask (bits)" | rev | cut -d' ' -f1 | rev) +ntpsigndsocket /var/lib/samba/ntp_signd +EOF + if [[ "$ADDITIONAL_PACKAGES" == *"nginx-full"* ]]; then cat << EOF > /etc/nginx/sites-available/default server { From 98d2aae0c4e92cd91f523d30abf4a555623f0b4a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 20:48:50 +0100 Subject: [PATCH 06/27] Update unifi, fix mongodb repo --- src/unifi/install-service.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/unifi/install-service.sh b/src/unifi/install-service.sh index b09541f..be830d6 100644 --- a/src/unifi/install-service.sh +++ b/src/unifi/install-service.sh @@ -11,10 +11,10 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -wget -O /etc/apt/trusted.gpg.d/mongodb-3.6.asc https://www.mongodb.org/static/pgp/server-3.6.asc +wget -O /etc/apt/trusted.gpg.d/mongodb-4.4.asc https://pgp.mongodb.com/server-4.4.asc wget -O /etc/apt/trusted.gpg.d/unifi.gpg https://dl.ubnt.com/unifi/unifi-repo.gpg -echo "deb http://repo.mongodb.org/apt/debian stretch/mongodb-org/3.6 main" > /etc/apt/sources.list.d/mongodb.list +echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" > /etc/apt/sources.list.d/mongodb.list echo "deb http://www.ui.com/downloads/unifi/debian stable ubiquiti" > /etc/apt/sources.list.d/unifi.list apt update From c6e381e4fc40a06d435bdabb1129feb64c0bcf48 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 20:53:51 +0100 Subject: [PATCH 07/27] Test unifi on debian 12 --- src/unifi/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index ccb3471..7824d7f 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" +LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint LXC_MP="0" From 60b1d9c6ec3ce08ada5bd3aade132345d51683de Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 20:59:51 +0100 Subject: [PATCH 08/27] reset unifi to debian-11 --- src/unifi/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index 7824d7f..ccb3471 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -8,7 +8,7 @@ # This file contains the project constants on service level # Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-12-standard" +LXC_TEMPLATE_VERSION="debian-11-standard" # Create sharefs mountpoint LXC_MP="0" From 3977496d8ec006ca07d3c04d054c782966cce223 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Mon, 15 Jan 2024 21:03:12 +0100 Subject: [PATCH 09/27] Comment unifi os version --- src/unifi/constants-service.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index ccb3471..56502bd 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -9,6 +9,8 @@ # Debian Version, which will be installed LXC_TEMPLATE_VERSION="debian-11-standard" +# !!!! Leave at debian 11, currently unifi depends on mongodb-server <= 4.4 and libssl1.1 +# libssl1.1 is unsupported on debian bookworm # Create sharefs mountpoint LXC_MP="0" From 6ac88f649b00bc54fa5912df6389b3a5f234e291 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 13:46:06 +0100 Subject: [PATCH 10/27] Add keyctl parameter --- install.sh | 2 +- src/ansible-semaphore/constants-service.conf | 3 +++ src/bookstack/constants-service.conf | 3 +++ src/checkmk/constants-service.conf | 3 +++ src/debian-priv/constants-service.conf | 3 +++ src/debian-unpriv/constants-service.conf | 3 +++ src/ecodms/constants-service.conf | 3 +++ src/gitea/constants-service.conf | 3 +++ src/kimai/constants-service.conf | 3 +++ src/kopano-core/constants-service.conf | 3 +++ src/mailpiler/constants-service.conf | 3 +++ src/matrix/constants-service.conf | 3 +++ src/nextcloud/constants-service.conf | 3 +++ src/omada/constants-service.conf | 3 +++ src/onlyoffice/constants-service.conf | 3 +++ src/open3a/constants-service.conf | 3 +++ src/proxmox-pbs/constants-service.conf | 3 +++ src/rei3/constants-service.conf | 3 +++ src/unifi/constants-service.conf | 3 +++ src/urbackup/constants-service.conf | 3 +++ src/vaultwarden/constants-service.conf | 3 +++ src/zabbix/constants-service.conf | 3 +++ src/zammad/constants-service.conf | 3 +++ src/zmb-ad-join/constants-service.conf | 3 +++ src/zmb-ad/constants-service.conf | 3 +++ src/zmb-cups/constants-service.conf | 3 +++ src/zmb-member/constants-service.conf | 3 +++ src/zmb-standalone/constants-service.conf | 3 +++ 28 files changed, 82 insertions(+), 1 deletion(-) diff --git a/install.sh b/install.sh index 8c556fa..92eca48 100755 --- a/install.sh +++ b/install.sh @@ -149,7 +149,7 @@ sleep 2; # Check vlan configuration if [[ $LXC_VLAN != "NONE" ]];then VLAN=",tag=$LXC_VLAN"; else VLAN=""; fi # Reconfigure conatiner -pct set $LXC_NBR -memory $LXC_MEM -swap $LXC_SWAP -hostname $LXC_HOSTNAME -onboot 1 -timezone $LXC_TIMEZONE -features nesting=$LXC_NESTING; +pct set $LXC_NBR -memory $LXC_MEM -swap $LXC_SWAP -hostname $LXC_HOSTNAME -onboot 1 -timezone $LXC_TIMEZONE -features nesting=$LXC_NESTING,keyctl=$LXC_KEYCTL; if [ $LXC_DHCP == true ]; then pct set $LXC_NBR -net0 "name=eth0,bridge=$LXC_BRIDGE,ip=dhcp,type=veth$VLAN" else diff --git a/src/ansible-semaphore/constants-service.conf b/src/ansible-semaphore/constants-service.conf index 8bc8c52..89fe5aa 100644 --- a/src/ansible-semaphore/constants-service.conf +++ b/src/ansible-semaphore/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/bookstack/constants-service.conf b/src/bookstack/constants-service.conf index 384ed69..5fbe65d 100644 --- a/src/bookstack/constants-service.conf +++ b/src/bookstack/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/checkmk/constants-service.conf b/src/checkmk/constants-service.conf index bd543e5..f4b4382 100644 --- a/src/checkmk/constants-service.conf +++ b/src/checkmk/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # checkmk version CMK_VERSION=2.2.0p14 # build number of the debian package (needs to start with underscore) diff --git a/src/debian-priv/constants-service.conf b/src/debian-priv/constants-service.conf index 2474bf3..7d06bc8 100644 --- a/src/debian-priv/constants-service.conf +++ b/src/debian-priv/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=512 diff --git a/src/debian-unpriv/constants-service.conf b/src/debian-unpriv/constants-service.conf index 0bdacfe..ae9bfcc 100644 --- a/src/debian-unpriv/constants-service.conf +++ b/src/debian-unpriv/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=512 diff --git a/src/ecodms/constants-service.conf b/src/ecodms/constants-service.conf index 592389e..86a2eda 100644 --- a/src/ecodms/constants-service.conf +++ b/src/ecodms/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # set ecodms release version ECODMS_RELEASE=ecodms_230164 diff --git a/src/gitea/constants-service.conf b/src/gitea/constants-service.conf index 513daa3..fa61d04 100644 --- a/src/gitea/constants-service.conf +++ b/src/gitea/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the IP from the SQL server GITEA_DB_IP="127.0.0.1" diff --git a/src/kimai/constants-service.conf b/src/kimai/constants-service.conf index c4ceb4e..8fc122c 100644 --- a/src/kimai/constants-service.conf +++ b/src/kimai/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of kimai mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') #KIMAI_VERSION="main" diff --git a/src/kopano-core/constants-service.conf b/src/kopano-core/constants-service.conf index d2e5808..b34a62d 100644 --- a/src/kopano-core/constants-service.conf +++ b/src/kopano-core/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') KOPANO_VERSION="latest" diff --git a/src/mailpiler/constants-service.conf b/src/mailpiler/constants-service.conf index 4523fd3..b4bdda8 100644 --- a/src/mailpiler/constants-service.conf +++ b/src/mailpiler/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') PILER_VERSION="1.3.12" # Defines the version of sphinx to install diff --git a/src/matrix/constants-service.conf b/src/matrix/constants-service.conf index f020016..793aee5 100644 --- a/src/matrix/constants-service.conf +++ b/src/matrix/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/nextcloud/constants-service.conf b/src/nextcloud/constants-service.conf index 51f9a33..fcb9e9a 100644 --- a/src/nextcloud/constants-service.conf +++ b/src/nextcloud/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') NEXTCLOUD_VERSION="latest" diff --git a/src/omada/constants-service.conf b/src/omada/constants-service.conf index ccb3471..048e0ad 100644 --- a/src/omada/constants-service.conf +++ b/src/omada/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=2048 diff --git a/src/onlyoffice/constants-service.conf b/src/onlyoffice/constants-service.conf index 4322e18..81018da 100644 --- a/src/onlyoffice/constants-service.conf +++ b/src/onlyoffice/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + ONLYOFFICE_DB_HOST=localhost ONLYOFFICE_DB_NAME=onlyoffice diff --git a/src/open3a/constants-service.conf b/src/open3a/constants-service.conf index 384ed69..5fbe65d 100644 --- a/src/open3a/constants-service.conf +++ b/src/open3a/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/proxmox-pbs/constants-service.conf b/src/proxmox-pbs/constants-service.conf index cf7b529..13579f1 100644 --- a/src/proxmox-pbs/constants-service.conf +++ b/src/proxmox-pbs/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Backup ubdir where Urbackup will store backups PBS_DATA="backup" diff --git a/src/rei3/constants-service.conf b/src/rei3/constants-service.conf index c941967..5a22a77 100644 --- a/src/rei3/constants-service.conf +++ b/src/rei3/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the IP from the SQL server REI3_DB_IP="127.0.0.1" diff --git a/src/unifi/constants-service.conf b/src/unifi/constants-service.conf index 56502bd..babc82b 100644 --- a/src/unifi/constants-service.conf +++ b/src/unifi/constants-service.conf @@ -21,6 +21,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=2048 diff --git a/src/urbackup/constants-service.conf b/src/urbackup/constants-service.conf index a393450..b24adc9 100644 --- a/src/urbackup/constants-service.conf +++ b/src/urbackup/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Backup ubdir where Urbackup will store backups URBACKUP_DATA="urbackup" diff --git a/src/vaultwarden/constants-service.conf b/src/vaultwarden/constants-service.conf index c8a86ef..b14393b 100644 --- a/src/vaultwarden/constants-service.conf +++ b/src/vaultwarden/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the name from the SQL database VAULTWARDEN_DB_NAME="vaultwarden" diff --git a/src/zabbix/constants-service.conf b/src/zabbix/constants-service.conf index b8157a1..f15397e 100644 --- a/src/zabbix/constants-service.conf +++ b/src/zabbix/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Defines the IP from the SQL server ZABBIX_DB_IP="127.0.0.1" diff --git a/src/zammad/constants-service.conf b/src/zammad/constants-service.conf index 0558f97..92cc445 100644 --- a/src/zammad/constants-service.conf +++ b/src/zammad/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="1" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=4096 diff --git a/src/zmb-ad-join/constants-service.conf b/src/zmb-ad-join/constants-service.conf index f4c0d1a..32ece93 100644 --- a/src/zmb-ad-join/constants-service.conf +++ b/src/zmb-ad-join/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # add optional features to samba ad dc # CURRENTLY SUPPORTED: diff --git a/src/zmb-ad/constants-service.conf b/src/zmb-ad/constants-service.conf index b9dbc8b..0939fc1 100644 --- a/src/zmb-ad/constants-service.conf +++ b/src/zmb-ad/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # add optional features to samba ad dc # CURRENTLY SUPPORTED: diff --git a/src/zmb-cups/constants-service.conf b/src/zmb-cups/constants-service.conf index 9230b29..cefc51f 100644 --- a/src/zmb-cups/constants-service.conf +++ b/src/zmb-cups/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/zmb-member/constants-service.conf b/src/zmb-member/constants-service.conf index bd524f3..1abbb20 100644 --- a/src/zmb-member/constants-service.conf +++ b/src/zmb-member/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 diff --git a/src/zmb-standalone/constants-service.conf b/src/zmb-standalone/constants-service.conf index c9d5a2a..e5088ee 100644 --- a/src/zmb-standalone/constants-service.conf +++ b/src/zmb-standalone/constants-service.conf @@ -19,6 +19,9 @@ LXC_UNPRIVILEGED="0" # enable nesting feature LXC_NESTING="1" +# enable keyctl feature +LXC_KEYCTL="0" + # Sets the minimum amount of RAM the service needs for operation LXC_MEM_MIN=1024 From 0ab5cffbef989d01aa1c2702821d65e3048d0971 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 13:47:07 +0100 Subject: [PATCH 11/27] Add docker service --- src/docker/constants-service.conf | 29 +++++++++++++++++++++++++++++ src/docker/install-service.sh | 16 ++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 src/docker/constants-service.conf create mode 100644 src/docker/install-service.sh diff --git a/src/docker/constants-service.conf b/src/docker/constants-service.conf new file mode 100644 index 0000000..32cc867 --- /dev/null +++ b/src/docker/constants-service.conf @@ -0,0 +1,29 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=2048 + +# service dependent meta tags +SERVICE_TAGS="" \ No newline at end of file diff --git a/src/docker/install-service.sh b/src/docker/install-service.sh new file mode 100644 index 0000000..aa63ac9 --- /dev/null +++ b/src/docker/install-service.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# Add Docker's official GPG key: +install -m 0755 -d /etc/apt/keyrings +curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg +chmod a+r /etc/apt/keyrings/docker.gpg + +# Add the repository to Apt sources: +echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null +apt-get update +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \ No newline at end of file From 8644cab71fe8400fb31e54e079854ea30c16c833 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 17:17:12 +0100 Subject: [PATCH 12/27] Add portainer and portainer agent option --- conf/zamba.conf.example | 7 +++- src/docker/install-service.sh | 65 ++++++++++++++++++++++++++++++++++- 2 files changed, 70 insertions(+), 2 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index d76b20c..38dfd03 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -209,4 +209,9 @@ VW_SMTP_PASSWORD='' SEMAPHORE_ADMIN=admin SEMAPHORE_ADMIN_DISPLAY_NAME="Semaphore Administrator" SEMAPHORE_ADMIN_EMAIL="admin@zmb.rocks" -SEMAPHORE_ADMIN_PASSWORD='Start123' \ No newline at end of file +SEMAPHORE_ADMIN_PASSWORD='Start123' + +############### docker Section ############### + +# Install Portainer (=full), Protainer Agent (=agent) or none +PORTAINER=none \ No newline at end of file diff --git a/src/docker/install-service.sh b/src/docker/install-service.sh index aa63ac9..c242173 100644 --- a/src/docker/install-service.sh +++ b/src/docker/install-service.sh @@ -5,6 +5,10 @@ # (C) 2021 Script design and prototype by Markus Helmke # (C) 2021 Script rework and documentation by Thorsten Spille +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + # Add Docker's official GPG key: install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg @@ -13,4 +17,63 @@ chmod a+r /etc/apt/keyrings/docker.gpg # Add the repository to Apt sources: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null apt-get update -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \ No newline at end of file +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin + +SECRET=$(random_password) +myip=$(ip a s dev eth0 | grep -m1 inet | cut -d' ' -f6 | cut -d'/' -f1) + +install_portainer_full() { + mkdir -p /opt/portainer/data + cd /opt/portainer + cat << EOF > /opt/portainer/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/portainer:latest + volumes: + - ./data:/data + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "8000:8000" + - "9443:9443" + command: --admin-password-file=/data/admin_password +EOF + echo -n "$SECRET" > ./data/admin_password + + docker compose pull + docker compose up -d + echo -e "\n######################################################################\n\n You can access Portainer with your browser at https://${myip}:9443\n\n Please note the following admin password to access the portainer:\n '$SECRET'\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +install_portainer_agent() { + mkdir -p /opt/portainer-agent/data + cd /opt/portainer-agent + cat << EOF > /opt/portainer-agent/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/agent:latest + volumes: + - /var/lib/docker/volumes:/var/lib/docker/volumes + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "9001:9001" +EOF + + docker compose pull + docker compose up -d + + echo -e "\n######################################################################\n\n Please enter the following data into the Portainer "Add environment" wizard:\n\tEnvironment address: ${myip}:9001\n\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +case $PORTAINER in + full) install_portainer_full ;; + agent) install_portainer_agent ;; + *) echo -e "\n######################################################################\n\n Enjoy your Docker intallation.\n\n######################################################################" ;; +esac \ No newline at end of file From a9853a6fbeb871a851bdfbc51fcce5b015cd4ed3 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 21:15:21 +0100 Subject: [PATCH 13/27] Add authentik container --- src/authentik/constants-service.conf | 29 ++++++++ src/authentik/install-service.sh | 107 +++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 src/authentik/constants-service.conf create mode 100644 src/authentik/install-service.sh diff --git a/src/authentik/constants-service.conf b/src/authentik/constants-service.conf new file mode 100644 index 0000000..32cc867 --- /dev/null +++ b/src/authentik/constants-service.conf @@ -0,0 +1,29 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=2048 + +# service dependent meta tags +SERVICE_TAGS="" \ No newline at end of file diff --git a/src/authentik/install-service.sh b/src/authentik/install-service.sh new file mode 100644 index 0000000..b454a7c --- /dev/null +++ b/src/authentik/install-service.sh @@ -0,0 +1,107 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +# Add Docker's official GPG key: +install -m 0755 -d /etc/apt/keyrings +curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg +chmod a+r /etc/apt/keyrings/docker.gpg + +# Add the repository to Apt sources: +echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null +apt-get update +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin pwgen + +SECRET=$(random_password) +myip=$(ip a s dev eth0 | grep -m1 inet | cut -d' ' -f6 | cut -d'/' -f1) + +install_portainer_full() { + mkdir -p /opt/portainer/data + cd /opt/portainer + cat << EOF > /opt/portainer/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/portainer:latest + volumes: + - ./data:/data + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "8000:8000" + - "9443:9443" + command: --admin-password-file=/data/admin_password +EOF + echo -n "$SECRET" > ./data/admin_password + + docker compose pull + docker compose up -d + echo -e "\n######################################################################\n\n You can access Portainer with your browser at https://${myip}:9443\n\n Please note the following admin password to access the portainer:\n '$SECRET'\n Enjoy your Docker intallation.\n\n######################################################################\n\n Setup your authentik instance by entering https://${myip}/if/flow/initial-setup/ into your browser.\n\n######################################################################" + +} + +install_portainer_agent() { + mkdir -p /opt/portainer-agent/data + cd /opt/portainer-agent + cat << EOF > /opt/portainer-agent/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/agent:latest + volumes: + - /var/lib/docker/volumes:/var/lib/docker/volumes + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "9001:9001" +EOF + + docker compose pull + docker compose up -d + + echo -e "\n######################################################################\n\n Please enter the following data into the Portainer "Add environment" wizard:\n\tEnvironment address: ${myip}:9001\n\n Enjoy your Docker intallation.\n\n######################################################################\n\n Setup your authentik instance by entering https://${myip}/if/flow/initial-setup/ into your browser.\n\n######################################################################" + +} + +mkdir -p /opt/authentik +wget -O /opt/authentik/docker-compose.yml https://goauthentik.io/docker-compose.yml +cd /opt/authentik +cat << EOF > .env +PG_PASS=$(pwgen -s 40 1) +AUTHENTIK_SECRET_KEY=$(pwgen -s 50 1) +AUTHENTIK_DISABLE_UPDATE_CHECK=false +AUTHENTIK_ERROR_REPORTING__ENABLED=false +AUTHENTIK_DISABLE_STARTUP_ANALYTICS=true +AUTHENTIK_AVATARS=initials +COMPOSE_PORT_HTTP=80 +COMPOSE_PORT_HTTPS=443 +AUTHENTIK_EMAIL__HOST= +AUTHENTIK_EMAIL__PORT= +AUTHENTIK_EMAIL__USERNAME= +AUTHENTIK_EMAIL__PASSWORD= +# Use StartTLS +AUTHENTIK_EMAIL__USE_TLS=false +# Use SSL +AUTHENTIK_EMAIL__USE_SSL=false +AUTHENTIK_EMAIL__TIMEOUT=10 +# Email address authentik will send from, should have a correct @domain +AUTHENTIK_EMAIL__FROM= +EOF + +docker compose pull +docker compose up -d + +case $PORTAINER in + full) install_portainer_full ;; + agent) install_portainer_agent ;; + *) echo -e "\n######################################################################\n\n Enjoy your authentik intallation.\n\n######################################################################\n\n Setup your authentik instance by entering https://${myip}/if/flow/initial-setup/ into your browser.\n\n######################################################################" ;; +esac \ No newline at end of file From f3db293064109e3f5d6aad2eedfa2b4dcb41faf8 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 21:45:13 +0100 Subject: [PATCH 14/27] Add mailcow --- src/mailcow/constants-service.conf | 29 +++ src/mailcow/install-service.sh | 362 +++++++++++++++++++++++++++++ 2 files changed, 391 insertions(+) create mode 100644 src/mailcow/constants-service.conf create mode 100644 src/mailcow/install-service.sh diff --git a/src/mailcow/constants-service.conf b/src/mailcow/constants-service.conf new file mode 100644 index 0000000..dc0939c --- /dev/null +++ b/src/mailcow/constants-service.conf @@ -0,0 +1,29 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="1" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=8192 + +# service dependent meta tags +SERVICE_TAGS="docker" \ No newline at end of file diff --git a/src/mailcow/install-service.sh b/src/mailcow/install-service.sh new file mode 100644 index 0000000..69e5c44 --- /dev/null +++ b/src/mailcow/install-service.sh @@ -0,0 +1,362 @@ +#!/bin/bash + +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf + +# Add Docker's official GPG key: +install -m 0755 -d /etc/apt/keyrings +curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg +chmod a+r /etc/apt/keyrings/docker.gpg + +# Add the repository to Apt sources: +echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null +apt-get update +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get purge -y -qq postfix + +SECRET=$(random_password) +myip=$(ip a s dev eth0 | grep -m1 inet | cut -d' ' -f6 | cut -d'/' -f1) + +install_portainer_full() { + mkdir -p /opt/portainer/data + cd /opt/portainer + cat << EOF > /opt/portainer/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/portainer:latest + volumes: + - ./data:/data + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "8000:8000" + - "9443:9443" + command: --admin-password-file=/data/admin_password +EOF + echo -n "$SECRET" > ./data/admin_password + + docker compose pull + docker compose up -d + echo -e "\n######################################################################\n\n You can access Portainer with your browser at https://${myip}:9443\n\n Please note the following admin password to access the portainer:\n '$SECRET'\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +install_portainer_agent() { + mkdir -p /opt/portainer-agent/data + cd /opt/portainer-agent + cat << EOF > /opt/portainer-agent/docker-compose.yml +version: "3.4" + +services: + portainer: + restart: always + image: portainer/agent:latest + volumes: + - /var/lib/docker/volumes:/var/lib/docker/volumes + - /var/run/docker.sock:/var/run/docker.sock + ports: + - "9001:9001" +EOF + + docker compose pull + docker compose up -d + + echo -e "\n######################################################################\n\n Please enter the following data into the Portainer "Add environment" wizard:\n\tEnvironment address: ${myip}:9001\n\n Enjoy your Docker intallation.\n\n######################################################################" + +} + +cd /opt +git clone https://github.com/mailcow/mailcow-dockerized +cd mailcow-dockerized + +cat << EOF > mailcow.conf +# ------------------------------ +# mailcow web ui configuration +# ------------------------------ +# example.org is _not_ a valid hostname, use a fqdn here. +# Default admin user is "admin" +# Default password is "moohoo" + +MAILCOW_HOSTNAME=${LXC_HOSTNAME}.${LXC_DOMAIN} + +# Password hash algorithm +# Only certain password hash algorithm are supported. For a fully list of supported schemes, +# see https://docs.mailcow.email/models/model-passwd/ +MAILCOW_PASS_SCHEME=BLF-CRYPT + +# ------------------------------ +# SQL database configuration +# ------------------------------ + +DBNAME=mailcow +DBUSER=mailcow + +# Please use long, random alphanumeric strings (A-Za-z0-9) + +DBPASS=$(LC_ALL=C /dev/null | head -c 28) +DBROOT=$(LC_ALL=C /dev/null | head -c 28) + +# ------------------------------ +# HTTP/S Bindings +# ------------------------------ + +# You should use HTTPS, but in case of SSL offloaded reverse proxies: +# Might be important: This will also change the binding within the container. +# If you use a proxy within Docker, point it to the ports you set below. +# Do _not_ use IP:PORT in HTTP(S)_BIND or HTTP(S)_PORT +# IMPORTANT: Do not use port 8081, 9081 or 65510! +# Example: HTTP_BIND=1.2.3.4 +# For IPv4 leave it as it is: HTTP_BIND= & HTTPS_PORT= +# For IPv6 see https://docs.mailcow.email/post_installation/firststeps-ip_bindings/ + +HTTP_PORT=80 +HTTP_BIND= + +HTTPS_PORT=443 +HTTPS_BIND= + +# ------------------------------ +# Other bindings +# ------------------------------ +# You should leave that alone +# Format: 11.22.33.44:25 or 12.34.56.78:465 etc. + +SMTP_PORT=25 +SMTPS_PORT=465 +SUBMISSION_PORT=587 +IMAP_PORT=143 +IMAPS_PORT=993 +POP_PORT=110 +POPS_PORT=995 +SIEVE_PORT=4190 +DOVEADM_PORT=127.0.0.1:19991 +SQL_PORT=127.0.0.1:13306 +SOLR_PORT=127.0.0.1:18983 +REDIS_PORT=127.0.0.1:7654 + +# Your timezone +# See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for a list of timezones +# Use the column named 'TZ identifier' + pay attention for the column named 'Notes' + +TZ=${LXC_TIMEZONE} + +# Fixed project name +# Please use lowercase letters only + +COMPOSE_PROJECT_NAME=mailcowdockerized + +# Used Docker Compose version +# Switch here between native (compose plugin) and standalone +# For more informations take a look at the mailcow docs regarding the configuration options. +# Normally this should be untouched but if you decided to use either of those you can switch it manually here. +# Please be aware that at least one of those variants should be installed on your machine or mailcow will fail. + +DOCKER_COMPOSE_VERSION=native + +# Set this to "allow" to enable the anyone pseudo user. Disabled by default. +# When enabled, ACL can be created, that apply to "All authenticated users" +# This should probably only be activated on mail hosts, that are used exclusivly by one organisation. +# Otherwise a user might share data with too many other users. +ACL_ANYONE=disallow + +# Garbage collector cleanup +# Deleted domains and mailboxes are moved to /var/vmail/_garbage/timestamp_sanitizedstring +# How long should objects remain in the garbage until they are being deleted? (value in minutes) +# Check interval is hourly + +MAILDIR_GC_TIME=7200 + +# Additional SAN for the certificate +# +# You can use wildcard records to create specific names for every domain you add to mailcow. +# Example: Add domains "example.com" and "example.net" to mailcow, change ADDITIONAL_SAN to a value like: +#ADDITIONAL_SAN=imap.*,smtp.* +# This will expand the certificate to "imap.example.com", "smtp.example.com", "imap.example.net", "smtp.example.net" +# plus every domain you add in the future. +# +# You can also just add static names... +#ADDITIONAL_SAN=srv1.example.net +# ...or combine wildcard and static names: +#ADDITIONAL_SAN=imap.*,srv1.example.com +# + +ADDITIONAL_SAN= + +# Additional server names for mailcow UI +# +# Specify alternative addresses for the mailcow UI to respond to +# This is useful when you set mail.* as ADDITIONAL_SAN and want to make sure mail.maildomain.com will always point to the mailcow UI. +# If the server name does not match a known site, Nginx decides by best-guess and may redirect users to the wrong web root. +# You can understand this as server_name directive in Nginx. +# Comma separated list without spaces! Example: ADDITIONAL_SERVER_NAMES=a.b.c,d.e.f + +ADDITIONAL_SERVER_NAMES= + +# Skip running ACME (acme-mailcow, Let's Encrypt certs) - y/n + +SKIP_LETS_ENCRYPT=y + +# Create seperate certificates for all domains - y/n +# this will allow adding more than 100 domains, but some email clients will not be able to connect with alternative hostnames +# see https://doc.dovecot.org/admin_manual/ssl/sni_support +ENABLE_SSL_SNI=n + +# Skip IPv4 check in ACME container - y/n + +SKIP_IP_CHECK=n + +# Skip HTTP verification in ACME container - y/n + +SKIP_HTTP_VERIFICATION=n + +# Skip ClamAV (clamd-mailcow) anti-virus (Rspamd will auto-detect a missing ClamAV container) - y/n + +SKIP_CLAMD=n + +# Skip SOGo: Will disable SOGo integration and therefore webmail, DAV protocols and ActiveSync support (experimental, unsupported, not fully implemented) - y/n + +SKIP_SOGO=n + +# Skip Solr on low-memory systems or if you do not want to store a readable index of your mails in solr-vol-1. + +SKIP_SOLR=n + +# Solr heap size in MB, there is no recommendation, please see Solr docs. +# Solr is a prone to run OOM and should be monitored. Unmonitored Solr setups are not recommended. + +SOLR_HEAP=1024 + +# Allow admins to log into SOGo as email user (without any password) + +ALLOW_ADMIN_EMAIL_LOGIN=n + +# Enable watchdog (watchdog-mailcow) to restart unhealthy containers + +USE_WATCHDOG=y + +# Send watchdog notifications by mail (sent from watchdog@MAILCOW_HOSTNAME) +# CAUTION: +# 1. You should use external recipients +# 2. Mails are sent unsigned (no DKIM) +# 3. If you use DMARC, create a separate DMARC policy ("v=DMARC1; p=none;" in _dmarc.MAILCOW_HOSTNAME) +# Multiple rcpts allowed, NO quotation marks, NO spaces + +#WATCHDOG_NOTIFY_EMAIL=a@example.com,b@example.com,c@example.com +#WATCHDOG_NOTIFY_EMAIL= + +# Send notifications to a webhook URL that receives a POST request with the content type "application/json". +# You can use this to send notifications to services like Discord, Slack and others. +#WATCHDOG_NOTIFY_WEBHOOK=https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +# JSON body included in the webhook POST request. Needs to be in single quotes. +# Following variables are available: SUBJECT, BODY +#WATCHDOG_NOTIFY_WEBHOOK_BODY='{"username": "mailcow Watchdog", "content": "**${SUBJECT}**\n${BODY}"}' + +# Notify about banned IP (includes whois lookup) +WATCHDOG_NOTIFY_BAN=n + +# Send a notification when the watchdog is started. +WATCHDOG_NOTIFY_START=y + +# Subject for watchdog mails. Defaults to "Watchdog ALERT" followed by the error message. +#WATCHDOG_SUBJECT= + +# Checks if mailcow is an open relay. Requires a SAL. More checks will follow. +# https://www.servercow.de/mailcow?lang=en +# https://www.servercow.de/mailcow?lang=de +# No data is collected. Opt-in and anonymous. +# Will only work with unmodified mailcow setups. +WATCHDOG_EXTERNAL_CHECKS=n + +# Enable watchdog verbose logging +WATCHDOG_VERBOSE=n + +# Max log lines per service to keep in Redis logs + +LOG_LINES=9999 + +# Internal IPv4 /24 subnet, format n.n.n (expands to n.n.n.0/24) +# Use private IPv4 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses + +IPV4_NETWORK=172.22.1 + +# Internal IPv6 subnet in fc00::/7 +# Use private IPv6 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses + +IPV6_NETWORK=fd4d:6169:6c63:6f77::/64 + +# Use this IPv4 for outgoing connections (SNAT) + +#SNAT_TO_SOURCE= + +# Use this IPv6 for outgoing connections (SNAT) + +#SNAT6_TO_SOURCE= + +# Create or override an API key for the web UI +# You _must_ define API_ALLOW_FROM, which is a comma separated list of IPs +# An API key defined as API_KEY has read-write access +# An API key defined as API_KEY_READ_ONLY has read-only access +# Allowed chars for API_KEY and API_KEY_READ_ONLY: a-z, A-Z, 0-9, - +# You can define API_KEY and/or API_KEY_READ_ONLY + +#API_KEY= +#API_KEY_READ_ONLY= +#API_ALLOW_FROM=172.22.1.1,127.0.0.1 + +# mail_home is ~/Maildir +MAILDIR_SUB=Maildir + +# SOGo session timeout in minutes +SOGO_EXPIRE_SESSION=480 + +# DOVECOT_MASTER_USER and DOVECOT_MASTER_PASS must both be provided. No special chars. +# Empty by default to auto-generate master user and password on start. +# User expands to DOVECOT_MASTER_USER@mailcow.local +# LEAVE EMPTY IF UNSURE +DOVECOT_MASTER_USER= +# LEAVE EMPTY IF UNSURE +DOVECOT_MASTER_PASS= + +# Let's Encrypt registration contact information +# Optional: Leave empty for none +# This value is only used on first order! +# Setting it at a later point will require the following steps: +# https://docs.mailcow.email/troubleshooting/debug-reset_tls/ +ACME_CONTACT= + +# WebAuthn device manufacturer verification +# After setting WEBAUTHN_ONLY_TRUSTED_VENDORS=y only devices from trusted manufacturers are allowed +# root certificates can be placed for validation under mailcow-dockerized/data/web/inc/lib/WebAuthn/rootCertificates +WEBAUTHN_ONLY_TRUSTED_VENDORS=n + +# Spamhaus Data Query Service Key +# Optional: Leave empty for none +# Enter your key here if you are using a blocked ASN (OVH, AWS, Cloudflare e.g) for the unregistered Spamhaus Blocklist. +# If empty, it will completely disable Spamhaus blocklists if it detects that you are running on a server using a blocked AS. +# Otherwise it will work normally. +SPAMHAUS_DQS_KEY= + +EOF + +chmod 600 mailcow.conf + +mkdir -p data/assets/ssl + +openssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl/key.pem -out data/assets/ssl/cert.pem -days 365 -subj "/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${LXC_HOSTNAME}.${LXC_DOMAIN}" -sha256 -nodes + +docker compose pull +docker compose up -d + +case $PORTAINER in + full) install_portainer_full ;; + agent) install_portainer_agent ;; + *) echo -e "\n######################################################################\n\n Enjoy your Docker intallation.\n\n######################################################################" ;; +esac \ No newline at end of file From f8c3d90ebee91fdfbe402232a0368f927d6e0f63 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 21:45:34 +0100 Subject: [PATCH 15/27] Authentik: add docker tag --- src/authentik/constants-service.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/authentik/constants-service.conf b/src/authentik/constants-service.conf index 32cc867..ca2f81b 100644 --- a/src/authentik/constants-service.conf +++ b/src/authentik/constants-service.conf @@ -26,4 +26,4 @@ LXC_KEYCTL="1" LXC_MEM_MIN=2048 # service dependent meta tags -SERVICE_TAGS="" \ No newline at end of file +SERVICE_TAGS="docker" \ No newline at end of file From 3b3174e19cf3dac0c715911b478f4127dc257d50 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Sun, 21 Jan 2024 22:51:55 +0100 Subject: [PATCH 16/27] Add mailcow-dockerized --- src/mailcow/constants-service.conf | 2 +- src/mailcow/install-service.sh | 76 ++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+), 1 deletion(-) diff --git a/src/mailcow/constants-service.conf b/src/mailcow/constants-service.conf index dc0939c..520118f 100644 --- a/src/mailcow/constants-service.conf +++ b/src/mailcow/constants-service.conf @@ -11,7 +11,7 @@ LXC_TEMPLATE_VERSION="debian-12-standard" # Create sharefs mountpoint -LXC_MP="0" +LXC_MP="1" # Create unprivileged container LXC_UNPRIVILEGED="1" diff --git a/src/mailcow/install-service.sh b/src/mailcow/install-service.sh index 69e5c44..e058097 100644 --- a/src/mailcow/install-service.sh +++ b/src/mailcow/install-service.sh @@ -346,12 +346,88 @@ SPAMHAUS_DQS_KEY= EOF +cat << EOF > data/conf/nginx/redirect.conf +server { + root /web; + listen 80 default_server; + listen [::]:80 default_server; + include /etc/nginx/conf.d/server_name.active; + if ( \$request_uri ~* "%0A|%0D" ) { return 403; } + location ^~ /.well-known/acme-challenge/ { + allow all; + default_type "text/plain"; + } + location / { + return 301 https://\$host\$uri\$is_args\$args; + } +} +EOF + +cat << EOF > /etc/cron.daily/mailcowbackup +#!/bin/sh + +# Backup mailcow data +# https://docs.mailcow.email/backup_restore/b_n_r-backup/ + +set -e + +OUT="\$(mktemp)" +export MAILCOW_BACKUP_LOCATION="/$LXC_SHAREFS_MOUNTPOINT/backup" +SCRIPT="/opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh" +PARAMETERS="backup all" +OPTIONS="--delete-days 7" +mkdir -p \$MAILCOW_BACKUP_LOCATION + +# run command +set +e +"\${SCRIPT}" \${PARAMETERS} \${OPTIONS} 2>&1 > "\$OUT" +RESULT=\$? + +if [ \$RESULT -ne 0 ] + then + echo "\${SCRIPT} \${PARAMETERS} \${OPTIONS} encounters an error:" + echo "RESULT=\$RESULT" + echo "STDOUT / STDERR:" + cat "\$OUT" +fi +EOF + +chmod +x /etc/cron.daily/mailcowbackup + +cat << EOF > /etc/cron.daily/checkmk-mailcow-update-check +#!/bin/bash +if ! which check_mk_agent ; then + cd /opt/mailcow-dockerized/ && ./update.sh -c >/dev/null + status=\$? + if [ \$status -eq 3 ]; then + state="0 \"mailcow_update\" mailcow_update=0;1;;0;1 No updates available." + elif [ \$status -eq 0 ]; then + state="1 \"mailcow_update\" mailcow_update=1;1;;0;1 Updated code is available.\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master" + else + state="3 \"mailcow_update\" - Unknown output from update script ..." + fi + echo -e "<<>>\n$\state" > /tmp/87000_mailcowupdate + mv /tmp/87000_mailcowupdate /var/lib/check_mk_agent/spool/ +fi +exit +EOF +chmod +x /etc/cron.daily/checkmk-mailcow-update-check + chmod 600 mailcow.conf mkdir -p data/assets/ssl openssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl/key.pem -out data/assets/ssl/cert.pem -days 365 -subj "/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${LXC_HOSTNAME}.${LXC_DOMAIN}" -sha256 -nodes +openssl dhparam -out data/assets/ssl/dhparams.pem 2048 +cat << EOF > /etc/cron.monthly/generate-dhparams +#!/bin/bash +openssl dhparam -out data/assets/ssl/dhparams.gen 4096 > /dev/null 2>&1 +mv data/assets/ssl/dhparams.gen data/assets/ssl/dhparams.pem +systemctl restart nginx +EOF +chmod +x /etc/cron.monthly/generate-dhparams + docker compose pull docker compose up -d From 2f4e674474aa5d2914368384730ba7b20fafe6d0 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 14:37:58 +0100 Subject: [PATCH 17/27] Update install-service.sh 8.0.1-31 --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 4b1627a..54e70df 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -16,7 +16,7 @@ echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/s cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver -Pin: version 7.1.1-23 +Pin: version 8.0.1-31 Pin-Priority: 900 EOF From e18c9b1ed5eba15dd74cdf62686c02cac2499e42 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 15:04:00 +0100 Subject: [PATCH 18/27] Update install-service.sh bookworm --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 54e70df..10a75dd 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -12,7 +12,7 @@ source /root/constants-service.conf ONLYOFFICE_DB_PASS=$(random_password) curl -fsSL https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE | gpg --dearmor | tee /etc/apt/trusted.gpg.d/onlyoffice.gpg >/dev/null -echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/sources.list.d/onlyoffice.list +echo "deb https://download.onlyoffice.com/repo/debian bookworm main" > /etc/apt/sources.list.d/onlyoffice.list cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver From 55f5bd6eec373e493df29e47a92a261758603324 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 15:46:23 +0100 Subject: [PATCH 19/27] Update install-service.sh --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 10a75dd..54e70df 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -12,7 +12,7 @@ source /root/constants-service.conf ONLYOFFICE_DB_PASS=$(random_password) curl -fsSL https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE | gpg --dearmor | tee /etc/apt/trusted.gpg.d/onlyoffice.gpg >/dev/null -echo "deb https://download.onlyoffice.com/repo/debian bookworm main" > /etc/apt/sources.list.d/onlyoffice.list +echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/sources.list.d/onlyoffice.list cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver From 83873fd5a3547a2e98c39589ce8e091c4bb135b5 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 18:07:22 +0100 Subject: [PATCH 20/27] Update install-service.sh 7.2.2 --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 54e70df..6ac97b3 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -16,7 +16,7 @@ echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/s cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver -Pin: version 8.0.1-31 +Pin: version 7.2.2 Pin-Priority: 900 EOF From 773c852c186a14189718a335486eb539fca30e71 Mon Sep 17 00:00:00 2001 From: Chriz Date: Mon, 4 Mar 2024 18:22:42 +0100 Subject: [PATCH 21/27] Update install-service.sh --- src/onlyoffice/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onlyoffice/install-service.sh b/src/onlyoffice/install-service.sh index 6ac97b3..4b1627a 100644 --- a/src/onlyoffice/install-service.sh +++ b/src/onlyoffice/install-service.sh @@ -16,7 +16,7 @@ echo "deb https://download.onlyoffice.com/repo/debian squeeze main" > /etc/apt/s cat > /etc/apt/preferences.d/onlyoffice << EOF Package: onlyoffice-documentserver -Pin: version 7.2.2 +Pin: version 7.1.1-23 Pin-Priority: 900 EOF From d0693c82e211d07dc75b71baec3351cefd2861b2 Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Tue, 19 Mar 2024 20:35:05 +0100 Subject: [PATCH 22/27] Update install-service.sh Remove LimitNPROC=64 --- src/vaultwarden/install-service.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/vaultwarden/install-service.sh b/src/vaultwarden/install-service.sh index db2f95b..2fcc438 100644 --- a/src/vaultwarden/install-service.sh +++ b/src/vaultwarden/install-service.sh @@ -64,7 +64,6 @@ Group=vaultwarden EnvironmentFile=/var/lib/vaultwarden/.env ExecStart=/opt/vaultwarden/vaultwarden LimitNOFILE=1048576 -LimitNPROC=64 PrivateTmp=true PrivateDevices=true ProtectHome=true @@ -161,4 +160,4 @@ unlink /etc/nginx/sites-enabled/default systemctl daemon-reload systemctl enable --now vaultwarden -systemctl restart nginx \ No newline at end of file +systemctl restart nginx From ccc69b6d55e8b599a4c47d69c3a69af1442348cb Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Fri, 5 Apr 2024 22:26:06 +0200 Subject: [PATCH 23/27] Change debian repos to deb.debian.org --- src/lxc-base.sh | 12 ++++++------ src/zmb-ad-join/install-service.sh | 2 +- src/zmb-ad/install-service.sh | 2 +- src/zmb-cups/install-service.sh | 2 +- src/zmb-standalone/install-service.sh | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/lxc-base.sh b/src/lxc-base.sh index 67140f8..006f48d 100644 --- a/src/lxc-base.sh +++ b/src/lxc-base.sh @@ -27,9 +27,9 @@ locale-gen $LXC_LOCALE if [ "$LXC_TEMPLATE_VERSION" == "debian-10-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://ftp.halifax.rwth-aachen.de/debian/ buster main contrib +deb http://deb.debian.org/debian/ buster main contrib -deb http://ftp.halifax.rwth-aachen.de/debian/ buster-updates main contrib +deb http://deb.debian.org/debian/ buster-updates main contrib # security updates deb http://security.debian.org/debian-security buster/updates main contrib @@ -38,9 +38,9 @@ EOF elif [ "$LXC_TEMPLATE_VERSION" == "debian-11-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://ftp.halifax.rwth-aachen.de/debian/ bullseye main contrib +deb http://deb.debian.org/debian/ bullseye main contrib -deb http://ftp.halifax.rwth-aachen.de/debian/ bullseye-updates main contrib +deb http://deb.debian.org/debian/ bullseye-updates main contrib # security updates deb http://security.debian.org/debian-security bullseye-security main contrib @@ -49,9 +49,9 @@ EOF elif [ "$LXC_TEMPLATE_VERSION" == "debian-12-standard" ] ; then cat << EOF > /etc/apt/sources.list -deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm main contrib +deb http://deb.debian.org/debian/ bookworm main contrib -deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-updates main contrib +deb http://deb.debian.org/debian/ bookworm-updates main contrib # security updates deb http://security.debian.org/debian-security bookworm-security main contrib diff --git a/src/zmb-ad-join/install-service.sh b/src/zmb-ad-join/install-service.sh index 7cc51e8..2af7e5e 100644 --- a/src/zmb-ad-join/install-service.sh +++ b/src/zmb-ad-join/install-service.sh @@ -27,7 +27,7 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update diff --git a/src/zmb-ad/install-service.sh b/src/zmb-ad/install-service.sh index d9d8fa3..1a2922e 100644 --- a/src/zmb-ad/install-service.sh +++ b/src/zmb-ad/install-service.sh @@ -27,7 +27,7 @@ for f in ${OPTIONAL_FEATURES[@]}; do fi done -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list # update packages apt update diff --git a/src/zmb-cups/install-service.sh b/src/zmb-cups/install-service.sh index ed53a43..821d37d 100644 --- a/src/zmb-cups/install-service.sh +++ b/src/zmb-cups/install-service.sh @@ -9,7 +9,7 @@ source /root/functions.sh source /root/zamba.conf source /root/constants-service.conf -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list apt update diff --git a/src/zmb-standalone/install-service.sh b/src/zmb-standalone/install-service.sh index 827aac6..b84f478 100644 --- a/src/zmb-standalone/install-service.sh +++ b/src/zmb-standalone/install-service.sh @@ -12,7 +12,7 @@ source /root/constants-service.conf apt-key adv --fetch-keys https://repo.45drives.com/key/gpg.asc echo "deb https://repo.45drives.com/debian focal main" > /etc/apt/sources.list.d/45drives.list -echo "deb http://ftp.halifax.rwth-aachen.de/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list +echo "deb http://deb.debian.org/debian/ bookworm-backports main contrib" >> /etc/apt/sources.list apt update From a3c8efc00d27d24140e3bc411d1689f35697573a Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 12:42:58 +0200 Subject: [PATCH 24/27] Remove obsolete PILER_FQDN config parameter --- conf/zamba.conf.example | 2 -- 1 file changed, 2 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 38dfd03..10f0715 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -114,8 +114,6 @@ ZMB_SHARE="share" ############### Mailpiler-Section ############### -# Defines the (public) FQDN of your piler mail archive -PILER_FQDN="mailpiler.zmb.rocks" # Defines the smarthost for piler mail archive PILER_SMARTHOST="mail.zmb.rocks" From 92f7a4774c88b27374c1b98f12f42b09ca6ef1d9 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 16:42:03 +0200 Subject: [PATCH 25/27] Replace mailpiler by piler (updgrade to 1.4) --- src/mailpiler/constants-service.conf | 36 ----- src/mailpiler/install-service.sh | 189 --------------------------- src/piler/constants-service.conf | 27 ++++ src/piler/install-service.sh | 23 ++++ 4 files changed, 50 insertions(+), 225 deletions(-) delete mode 100644 src/mailpiler/constants-service.conf delete mode 100644 src/mailpiler/install-service.sh create mode 100644 src/piler/constants-service.conf create mode 100644 src/piler/install-service.sh diff --git a/src/mailpiler/constants-service.conf b/src/mailpiler/constants-service.conf deleted file mode 100644 index b4bdda8..0000000 --- a/src/mailpiler/constants-service.conf +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/bash - -# Authors: -# (C) 2021 Idea an concept by Christian Zengel -# (C) 2021 Script design and prototype by Markus Helmke -# (C) 2021 Script rework and documentation by Thorsten Spille - -# This file contains the project constants on service level - -# Debian Version, which will be installed -LXC_TEMPLATE_VERSION="debian-11-standard" - -# Create sharefs mountpoint -LXC_MP="0" - -# Create unprivileged container -LXC_UNPRIVILEGED="1" - -# enable nesting feature -LXC_NESTING="1" - -# enable keyctl feature -LXC_KEYCTL="0" - -# Defines the version number of piler mail archive to install (type in exact version number (e.g. 1.3.11) or 'latest') -PILER_VERSION="1.3.12" -# Defines the version of sphinx to install -PILER_SPHINX_VERSION="3.3.1" -# Defines the php version to install -PILER_PHP_VERSION="7.4" - -# Sets the minimum amount of RAM the service needs for operation -LXC_MEM_MIN=1024 - -# service dependent meta tags -SERVICE_TAGS="php-fpm,nginx,mariadb,sphinx" \ No newline at end of file diff --git a/src/mailpiler/install-service.sh b/src/mailpiler/install-service.sh deleted file mode 100644 index 217bfc6..0000000 --- a/src/mailpiler/install-service.sh +++ /dev/null @@ -1,189 +0,0 @@ -#!/bin/bash - -# Authors: -# (C) 2021 Idea an concept by Christian Zengel -# (C) 2021 Script design and prototype by Markus Helmke -# (C) 2021 Script rework and documentation by Thorsten Spille - -source /root/functions.sh -source /root/zamba.conf -source /root/constants-service.conf - -HOSTNAME=$(hostname -f) - -echo "Ensure your Hostname is set to your Piler FQDN!" - -echo $HOSTNAME - -if - [ "$HOSTNAME" != "$PILER_FQDN" ] -then - echo "Hostname doesn't match $PILER_FQDN! Check install.sh, /etc/hosts, /etc/hostname." && exit -else - echo "Hostname matches $PILER_FQDN, so starting installation." -fi - -# install php -wget -q https://packages.sury.org/php/apt.gpg -O- | apt-key add - -echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list - -apt-key adv --fetch-keys 'https://mariadb.org/mariadb_release_signing_key.asc' -add-apt-repository "deb [arch=amd64] https://mirror.wtnet.de/mariadb/repo/10.5/debian $(lsb_release -cs) main" - -apt update - -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq build-essential libwrap0-dev libpst-dev tnef libytnef0-dev \ -unrtf catdoc libtre-dev tre-agrep poppler-utils libzip-dev unixodbc libpq5 libpoppler-dev openssl libssl-dev memcached telnet nginx \ -mariadb-server default-libmysqlclient-dev python3-mysqldb gcc libwrap0 libzip4 latex2rtf latex2html catdoc tnef zipcmp zipmerge ziptool libsodium23 \ -php$PILER_PHP_VERSION-{fpm,common,ldap,mysql,cli,opcache,phpdbg,gd,memcache,json,readline,zip} - -DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt remove --purge -y -qq postfix - -cat > /etc/mysql/conf.d/mailpiler.conf <> /usr/local/etc/piler/config-site.php < + +# This file contains the project constants on service level + +# Debian Version, which will be installed +LXC_TEMPLATE_VERSION="debian-12-standard" + +# Create sharefs mountpoint +LXC_MP="0" + +# Create unprivileged container +LXC_UNPRIVILEGED="1" + +# enable nesting feature +LXC_NESTING="1" + +# enable keyctl feature +LXC_KEYCTL="0" + +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=1024 + +# service dependent meta tags +SERVICE_TAGS="php-fpm,nginx,mariadb,manticore" \ No newline at end of file diff --git a/src/piler/install-service.sh b/src/piler/install-service.sh new file mode 100644 index 0000000..406861f --- /dev/null +++ b/src/piler/install-service.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +# Author: +# (C) 2024 Thorsten Spille + +source zamba.conf + +wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg + +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/manticore bookworm main" > /etc/apt/sources.list.d/bashclub-manticore.list +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/testing bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list +apt update + +DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends piler + +echo -e "Installation of piler finished." +echo -e "\nFor administration please visit the following Website:" +echo -e "\thttps://${LXC_HOSTNAME}.${LXC_DOMAIN}/" +echo -e "\nLogin with following credentials:" +echo -e "\tUser: admin@local" +echo -e "\tPass: pilerrocks" +echo -e "\n\nPlease have a look the the GOBD notes (in German):" +echo -e "\thttps://${LXC_HOSTNAME}.${LXC_DOMAIN}/gobd" \ No newline at end of file From 72d72bf8d29fff2f08fbeecd7e8a0c1138a573ea Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 16:44:28 +0200 Subject: [PATCH 26/27] Add PILER_BRANCH variable --- conf/zamba.conf.example | 3 +-- src/piler/install-service.sh | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/conf/zamba.conf.example b/conf/zamba.conf.example index 10f0715..5274fa8 100644 --- a/conf/zamba.conf.example +++ b/conf/zamba.conf.example @@ -114,8 +114,7 @@ ZMB_SHARE="share" ############### Mailpiler-Section ############### -# Defines the smarthost for piler mail archive -PILER_SMARTHOST="mail.zmb.rocks" +PILER_BRANCH=release ############### Matrix-Section ############### diff --git a/src/piler/install-service.sh b/src/piler/install-service.sh index 406861f..f93717f 100644 --- a/src/piler/install-service.sh +++ b/src/piler/install-service.sh @@ -8,7 +8,7 @@ source zamba.conf wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/manticore bookworm main" > /etc/apt/sources.list.d/bashclub-manticore.list -echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/testing bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/$PILER_BRANCH bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends piler From e72430dc0276e43ec85ce9144d283a1a8fc8ab16 Mon Sep 17 00:00:00 2001 From: thorstenspille Date: Thu, 25 Apr 2024 17:29:27 +0200 Subject: [PATCH 27/27] Fix apt repo --- src/piler/install-service.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/piler/install-service.sh b/src/piler/install-service.sh index f93717f..72a7e98 100644 --- a/src/piler/install-service.sh +++ b/src/piler/install-service.sh @@ -8,7 +8,7 @@ source zamba.conf wget -O - https://apt.bashclub.org/gpg/bashclub.pub | gpg --dearmor > /usr/share/keyrings/bashclub-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/manticore bookworm main" > /etc/apt/sources.list.d/bashclub-manticore.list -echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/$PILER_BRANCH bookworm main" > /etc/apt/sources.list.d/bashclub-testing.list +echo "deb [signed-by=/usr/share/keyrings/bashclub-keyring.gpg] https://apt.bashclub.org/$PILER_BRANCH bookworm main" > /etc/apt/sources.list.d/bashclub-$PILER_BRANCH.list apt update DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install -y -qq --no-install-recommends piler