From 1dcc048658ee5ee0d3a678ee4bff1826f3d28692 Mon Sep 17 00:00:00 2001 From: myve Date: Sun, 12 Jul 2026 19:49:13 +0000 Subject: [PATCH] Update homelab.sh --- homelab.sh | 97 ++++++++++++++++++++++++++++++++---------------------- 1 file changed, 57 insertions(+), 40 deletions(-) diff --git a/homelab.sh b/homelab.sh index c572905..48e9e51 100755 --- a/homelab.sh +++ b/homelab.sh @@ -818,16 +818,20 @@ do done # Mount datasets -zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT -zfs create -o mountpoint=/.boot zroot/BOOT -zfs create -o mountpoint=/home zroot/HOME -zfs create -o mountpoint=/etc/letsencrypt zroot/HTTPS -zfs create -o mountpoint=/opt/local zroot/LOCAL -zfs create -o mountpoint=/var/lib/libvirt/images -o recordsize=64K zroot/QEMU -zfs create -o mountpoint=/var/lib/docker zroot/DOCKER -zfs create -o mountpoint=/var/cache/pacman/pkg zroot/PKG -zfs create -o mountpoint=/var/log zroot/LOG -zfs create -o mountpoint=/var/tmp zroot/TMP +zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT +zfs create -o mountpoint=/.boot/ zroot/BOOT +zfs create -o mountpoint=/home/ zroot/HOME +zfs create -o mountpoint=/etc/letsencrypt/ zroot/HTTPS +zfs create -o mountpoint=/opt/local/ zroot/LOCAL +zfs create -o mountpoint=/var/lib/libvirt/images/ -o recordsize=64K zroot/QEMU +zfs create -o mountpoint=/var/lib/docker/ zroot/DOCKER + +zfs create -o mountpoint=/docker/ zroot/DOCKER/data +zfs create -o mountpoint=/docker/sql/ -o recordsize=8K zroot/DOCKER/sql + +zfs create -o mountpoint=/var/cache/pacman/pkg/ zroot/PKG +zfs create -o mountpoint=/var/log/ zroot/LOG +zfs create -o mountpoint=/var/tmp/ zroot/TMP zpool export zroot zpool import -R /mnt zroot -N -d ${installation_disks}-part2 printf '%s' "${lukspass}" | zfs load-key zroot @@ -917,7 +921,7 @@ sed -e "s|%PKGBASE%|linux|g" \ rsync -a /mnt/usr/lib/modules/*/vmlinuz /mnt/boot/vmlinuz-linux # Create custom system dirs -mkdir -p /mnt/etc/{zfs/zfs-list.cache,pacman.d/hooks,nginx/sites-{available,enabled}}/ \ +mkdir -p /mnt/etc/{zfs/zfs-list.cache,pacman.d/hooks,nginx/{conf.d,snippets}}/ \ /mnt/{zfs/{bin,snapshots},etc/libvirt/hooks/qemu.d}/ \ /mnt/etc/systemd/{logind,journald}.conf.d/ \ /mnt/opt/local/{bin,systemd,hooks}/ \ @@ -956,8 +960,8 @@ link if [ ${primaryip} ] then # Static IP - rsync -a /etc/systemd/network/20-ethernet.network /mnt/etc/systemd/network/zz-fallback.network - cat >/mnt/etc/systemd/network/20-${iface}.network <<- network + rsync -a /etc/systemd/network/20-ethernet.network /mnt/etc/systemd/network/99-fallback.network + cat >/mnt/etc/systemd/network/00-${iface}.network <<- network [Match] Name=eth0 @@ -987,7 +991,7 @@ tee -a /etc/skel/.bashrc >/dev/null <<'bashglobal' # Environment additions export PATH=${PATH}:/opt/local/bin:/zfs/bin export SUDO_PROMPT=$'\a'"$(tput rev)[sudo] password for %p:$(tput sgr0)"' ' -alias sudoedit='sudo vim' +alias sudoedit='doas vim' # Colored prompts alias diff='diff --color=auto' @@ -1232,7 +1236,7 @@ passwd -l root >/dev/null 2>&1 # Defaults timestamp_type=global # Defaults insults # DEFAULTS -# + # install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- 'COMMANDS' # Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot # Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool @@ -1242,15 +1246,16 @@ passwd -l root >/dev/null 2>&1 # Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save # Cmnd_Alias MISC = /usr/bin/rsync # COMMANDS -# + # install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- 'WHEEL' # %wheel ALL=(ALL:ALL) ALL # %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, QEMU, FAIL2BAN, PACMAN, IPTABLES, MISC # WHEEL -# + # install -m 0440 /dev/stdin /etc/sudoers.d/zz-NOPASSWD <<- 'NOPASSWD' # Defaults:user !authenticate # NOPASSWD + # Doas install -m 0440 /dev/stdin /etc/doas.conf <<- 'doas' permit nopass :root @@ -1258,7 +1263,8 @@ permit nopass :wheel doas install /dev/stdin /usr/local/bin/sudo <<- 'doas' #!/usr/bin/env bash -exec doas "${@/--preserve-env*/}" +#exec doas "${@/--preserve-env*/}" +/usr/bin/run0 "${@}" doas say as heading "Configured superuser and user" @@ -1318,12 +1324,12 @@ cat >/etc/ssh/ssh_config.d/zz-homelab.conf <<- sshconfig Ciphers aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com # Only use ipv4 -AddressFamily inet +# AddressFamily inet # Multiplex -ControlMaster auto -ControlPath ~/.ssh/sockets/%r@%h-%p -ControlPersist 10m +# ControlMaster auto +# ControlPath ~/.ssh/sockets/%r@%h-%p +# ControlPersist 10m # Ease up on local area network devices Host 192.168.* *.kvm *.local @@ -1671,9 +1677,11 @@ sshd # Nginx sed '/^http {/a\ include http_redirect;\ - include sites-enabled/\*.conf;\n\ + include conf.d/\*.conf;\n\ types_hash_max_size 4096;\ - server_names_hash_bucket_size 128;\n' \ + server_names_hash_bucket_size 128;\n + proxy_headers_hash_max_size 1024;\ + proxy_headers_hash_bucket_size 128;\n' \ -i /etc/nginx/nginx.conf cat >/etc/nginx/http_redirect <<- 'redirect' server { @@ -1685,14 +1693,19 @@ server { } redirect cat >/etc/nginx/proxy_params <<- 'proxy_params' +proxy_set_header Host $host; +proxy_set_header Accept-Encoding ""; +proxy_set_header Referer $http_referer; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; -proxy_set_header X-Forwarded-Host $host; +proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Port $server_port; proxy_set_header X-Forwarded-Scheme $scheme; -proxy_set_header X-Forwarded-Proto $scheme; +proxy_set_header X-Forwarded-Host $host:$remote_port; +proxy_set_header X-Forwarded-Server $host; +proxy_set_header X-Forwarded-Port $remote_port; +proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Real-IP $remote_addr; -proxy_set_header Accept-Encoding ""; -proxy_set_header Host $host; +proxy_set_header X-Real-Port $remote_port; proxy_next_upstream error timeout; @@ -1709,21 +1722,23 @@ proxy_params cat >/etc/nginx/http_upgrade <<- 'http_upgrade' # Security server_tokens off; -add_header X-Frame-Options "SAMEORIGIN" always; -add_header X-Content-Type-Options "nosniff" always; -add_header X-XSS-Protection "1; mode=block" always; -add_header Referrer-Policy "no-referrer" always; -add_header X-Permitted-Cross-Domain-Policies "none" always; -add_header X-Robots-Tag "noindex, nofollow" always; +add_header X-Frame-Options "SAMEORIGIN" always; +add_header X-Content-Type-Options "nosniff" always; +add_header X-XSS-Protection "1; mode=block" always; +add_header Referrer-Policy "strict-origin-when-cross-origin" always; +add_header X-Permitted-Cross-Domain-Policies "none" always; +add_header X-Robots-Tag "noindex, nofollow" always; # http2 http2 on; # http3 (open port 443/udp to use http3) # Add reuseport to ONLY ONE virtual host: listen 443 quic reuseport; -add_header Alt-Svc 'h3=":443"; ma=86400'; -quic_retry on; http3 on; +quic_retry on; +ssl_early_data on; +quic_gso on; +add_header Alt-Svc 'h3=":443"; ma=86400'; # Certbot defaults add_header Strict-Transport-Security "max-age=31536000" always; @@ -1736,11 +1751,14 @@ if [ -f /etc/nginx/nginx.conf.pacnew ] then sed '/^http {/a\ include http_redirect;\ - include sites-enabled/\*.conf;\n\ + include conf.d/\*.conf;\n\ types_hash_max_size 4096;\ - server_names_hash_bucket_size 128;\n' \ + server_names_hash_bucket_size 128;\n + proxy_headers_hash_max_size 1024;\ + proxy_headers_hash_bucket_size 128;\n' \ -i /etc/nginx/nginx.conf.pacnew mv /etc/nginx/nginx.conf.pacnew /etc/nginx/nginx.conf + nginx -s reload fi hook # /etc/nginx/nginx.conf.pacnew hook @@ -1759,7 +1777,7 @@ nginx # Pacman cache # Nginx conf -cat >/etc/nginx/sites-available/pacman.conf <<- 'pacman' +cat >/etc/nginx/conf.d/pacman.conf <<- 'pacman' server { listen 9090; client_max_body_size 0; @@ -1773,7 +1791,6 @@ server { } } pacman -ln -s /etc/nginx/sites-available/pacman.conf /etc/nginx/sites-enabled/ # # Systemd service # cat >/etc/systemd/system/local-update-pkg-cache.service <<'service' # [Unit]