lab/archlinux
Watch
1
0
Fork
You've already forked archlinux
 0
mirror of https://git.myvelabs.com/lab/archlinux.git synced 2026-08-16 12:54:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

Update homelab.sh

Browse source
This commit is contained in:
myve 2026-07-12 19:49:13 +00:00
commit 1dcc048658
1 changed files with 57 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

97
homelab.sh
View file

@ -818,16 +818,20 @@ do
done done
# Mount datasets # Mount datasets
zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT
zfs create -o mountpoint=/.boot zroot/BOOT zfs create -o mountpoint=/.boot/ zroot/BOOT
zfs create -o mountpoint=/home zroot/HOME zfs create -o mountpoint=/home/ zroot/HOME
zfs create -o mountpoint=/etc/letsencrypt zroot/HTTPS zfs create -o mountpoint=/etc/letsencrypt/ zroot/HTTPS
zfs create -o mountpoint=/opt/local zroot/LOCAL zfs create -o mountpoint=/opt/local/ zroot/LOCAL
zfs create -o mountpoint=/var/lib/libvirt/images -o recordsize=64K zroot/QEMU zfs create -o mountpoint=/var/lib/libvirt/images/ -o recordsize=64K zroot/QEMU
zfs create -o mountpoint=/var/lib/docker zroot/DOCKER zfs create -o mountpoint=/var/lib/docker/ zroot/DOCKER
zfs create -o mountpoint=/var/cache/pacman/pkg zroot/PKG
zfs create -o mountpoint=/var/log zroot/LOG zfs create -o mountpoint=/docker/ zroot/DOCKER/data
zfs create -o mountpoint=/var/tmp zroot/TMP zfs create -o mountpoint=/docker/sql/ -o recordsize=8K zroot/DOCKER/sql
zfs create -o mountpoint=/var/cache/pacman/pkg/ zroot/PKG
zfs create -o mountpoint=/var/log/ zroot/LOG
zfs create -o mountpoint=/var/tmp/ zroot/TMP
zpool export zroot zpool export zroot
zpool import -R /mnt zroot -N -d ${installation_disks}-part2 zpool import -R /mnt zroot -N -d ${installation_disks}-part2
printf '%s' "${lukspass}" | zfs load-key zroot printf '%s' "${lukspass}" | zfs load-key zroot
@ -917,7 +921,7 @@ sed -e "s|%PKGBASE%|linux|g" \
rsync -a /mnt/usr/lib/modules/*/vmlinuz /mnt/boot/vmlinuz-linux rsync -a /mnt/usr/lib/modules/*/vmlinuz /mnt/boot/vmlinuz-linux
# Create custom system dirs # Create custom system dirs
mkdir -p /mnt/etc/{zfs/zfs-list.cache,pacman.d/hooks,nginx/sites-{available,enabled}}/ \ mkdir -p /mnt/etc/{zfs/zfs-list.cache,pacman.d/hooks,nginx/{conf.d,snippets}}/ \
/mnt/{zfs/{bin,snapshots},etc/libvirt/hooks/qemu.d}/ \ /mnt/{zfs/{bin,snapshots},etc/libvirt/hooks/qemu.d}/ \
/mnt/etc/systemd/{logind,journald}.conf.d/ \ /mnt/etc/systemd/{logind,journald}.conf.d/ \
/mnt/opt/local/{bin,systemd,hooks}/ \ /mnt/opt/local/{bin,systemd,hooks}/ \
@ -956,8 +960,8 @@ link
if [ ${primaryip} ] if [ ${primaryip} ]
then then
# Static IP # Static IP
rsync -a /etc/systemd/network/20-ethernet.network /mnt/etc/systemd/network/zz-fallback.network rsync -a /etc/systemd/network/20-ethernet.network /mnt/etc/systemd/network/99-fallback.network
cat >/mnt/etc/systemd/network/20-${iface}.network <<- network cat >/mnt/etc/systemd/network/00-${iface}.network <<- network
[Match] [Match]
Name=eth0 Name=eth0
@ -987,7 +991,7 @@ tee -a /etc/skel/.bashrc >/dev/null <<'bashglobal'
# Environment additions # Environment additions
export PATH=${PATH}:/opt/local/bin:/zfs/bin export PATH=${PATH}:/opt/local/bin:/zfs/bin
export SUDO_PROMPT=$'\a'"$(tput rev)[sudo] password for %p:$(tput sgr0)"' ' export SUDO_PROMPT=$'\a'"$(tput rev)[sudo] password for %p:$(tput sgr0)"' '
alias sudoedit='sudo vim' alias sudoedit='doas vim'
# Colored prompts # Colored prompts
alias diff='diff --color=auto' alias diff='diff --color=auto'
@ -1232,7 +1236,7 @@ passwd -l root >/dev/null 2>&1
# Defaults timestamp_type=global # Defaults timestamp_type=global
# Defaults insults # Defaults insults
# DEFAULTS # DEFAULTS
#
# install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- 'COMMANDS' # install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- 'COMMANDS'
# Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot # Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
# Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool # Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
@ -1242,15 +1246,16 @@ passwd -l root >/dev/null 2>&1
# Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save # Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
# Cmnd_Alias MISC = /usr/bin/rsync # Cmnd_Alias MISC = /usr/bin/rsync
# COMMANDS # COMMANDS
#
# install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- 'WHEEL' # install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- 'WHEEL'
# %wheel ALL=(ALL:ALL) ALL # %wheel ALL=(ALL:ALL) ALL
# %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, QEMU, FAIL2BAN, PACMAN, IPTABLES, MISC # %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, QEMU, FAIL2BAN, PACMAN, IPTABLES, MISC
# WHEEL # WHEEL
#
# install -m 0440 /dev/stdin /etc/sudoers.d/zz-NOPASSWD <<- 'NOPASSWD' # install -m 0440 /dev/stdin /etc/sudoers.d/zz-NOPASSWD <<- 'NOPASSWD'
# Defaults:user !authenticate # Defaults:user !authenticate
# NOPASSWD # NOPASSWD
# Doas # Doas
install -m 0440 /dev/stdin /etc/doas.conf <<- 'doas' install -m 0440 /dev/stdin /etc/doas.conf <<- 'doas'
permit nopass :root permit nopass :root
@ -1258,7 +1263,8 @@ permit nopass :wheel
doas doas
install /dev/stdin /usr/local/bin/sudo <<- 'doas' install /dev/stdin /usr/local/bin/sudo <<- 'doas'
#!/usr/bin/env bash #!/usr/bin/env bash
exec doas "${@/--preserve-env*/}" #exec doas "${@/--preserve-env*/}"
/usr/bin/run0 "${@}"
doas doas
say as heading "Configured superuser and user" say as heading "Configured superuser and user"
@ -1318,12 +1324,12 @@ cat >/etc/ssh/ssh_config.d/zz-homelab.conf <<- sshconfig
Ciphers aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com Ciphers aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
# Only use ipv4 # Only use ipv4
AddressFamily inet # AddressFamily inet
# Multiplex # Multiplex
ControlMaster auto # ControlMaster auto
ControlPath ~/.ssh/sockets/%r@%h-%p # ControlPath ~/.ssh/sockets/%r@%h-%p
ControlPersist 10m # ControlPersist 10m
# Ease up on local area network devices # Ease up on local area network devices
Host 192.168.* *.kvm *.local Host 192.168.* *.kvm *.local
@ -1671,9 +1677,11 @@ sshd
# Nginx # Nginx
sed '/^http {/a\ sed '/^http {/a\
include http_redirect;\ include http_redirect;\
include sites-enabled/\*.conf;\n\ include conf.d/\*.conf;\n\
types_hash_max_size 4096;\ types_hash_max_size 4096;\
server_names_hash_bucket_size 128;\n' \ server_names_hash_bucket_size 128;\n
proxy_headers_hash_max_size 1024;\
proxy_headers_hash_bucket_size 128;\n' \
-i /etc/nginx/nginx.conf -i /etc/nginx/nginx.conf
cat >/etc/nginx/http_redirect <<- 'redirect' cat >/etc/nginx/http_redirect <<- 'redirect'
server { server {
@ -1685,14 +1693,19 @@ server {
} }
redirect redirect
cat >/etc/nginx/proxy_params <<- 'proxy_params' cat >/etc/nginx/proxy_params <<- 'proxy_params'
proxy_set_header Host $host;
proxy_set_header Accept-Encoding "";
proxy_set_header Referer $http_referer;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port; proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host:$remote_port;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-Port $remote_port;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Accept-Encoding ""; proxy_set_header X-Real-Port $remote_port;
proxy_set_header Host $host;
proxy_next_upstream error timeout; proxy_next_upstream error timeout;
@ -1709,21 +1722,23 @@ proxy_params
cat >/etc/nginx/http_upgrade <<- 'http_upgrade' cat >/etc/nginx/http_upgrade <<- 'http_upgrade'
# Security # Security
server_tokens off; server_tokens off;
add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always; add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always; add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Permitted-Cross-Domain-Policies "none" always; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "noindex, nofollow" always; add_header X-Robots-Tag "noindex, nofollow" always;
# http2 # http2
http2 on; http2 on;
# http3 (open port 443/udp to use http3) # http3 (open port 443/udp to use http3)
# Add reuseport to ONLY ONE virtual host: listen 443 quic reuseport; # Add reuseport to ONLY ONE virtual host: listen 443 quic reuseport;
add_header Alt-Svc 'h3=":443"; ma=86400';
quic_retry on;
http3 on; http3 on;
quic_retry on;
ssl_early_data on;
quic_gso on;
add_header Alt-Svc 'h3=":443"; ma=86400';
# Certbot defaults # Certbot defaults
add_header Strict-Transport-Security "max-age=31536000" always; add_header Strict-Transport-Security "max-age=31536000" always;
@ -1736,11 +1751,14 @@ if [ -f /etc/nginx/nginx.conf.pacnew ]
then then
sed '/^http {/a\ sed '/^http {/a\
include http_redirect;\ include http_redirect;\
include sites-enabled/\*.conf;\n\ include conf.d/\*.conf;\n\
types_hash_max_size 4096;\ types_hash_max_size 4096;\
server_names_hash_bucket_size 128;\n' \ server_names_hash_bucket_size 128;\n
proxy_headers_hash_max_size 1024;\
proxy_headers_hash_bucket_size 128;\n' \
-i /etc/nginx/nginx.conf.pacnew -i /etc/nginx/nginx.conf.pacnew
mv /etc/nginx/nginx.conf.pacnew /etc/nginx/nginx.conf mv /etc/nginx/nginx.conf.pacnew /etc/nginx/nginx.conf
nginx -s reload
fi fi
hook hook
# /etc/nginx/nginx.conf.pacnew hook # /etc/nginx/nginx.conf.pacnew hook
@ -1759,7 +1777,7 @@ nginx
# Pacman cache # Pacman cache
# Nginx conf # Nginx conf
cat >/etc/nginx/sites-available/pacman.conf <<- 'pacman' cat >/etc/nginx/conf.d/pacman.conf <<- 'pacman'
server { server {
listen 9090; listen 9090;
client_max_body_size 0; client_max_body_size 0;
@ -1773,7 +1791,6 @@ server {
} }
} }
pacman pacman
ln -s /etc/nginx/sites-available/pacman.conf /etc/nginx/sites-enabled/
# # Systemd service # # Systemd service
# cat >/etc/systemd/system/local-update-pkg-cache.service <<'service' # cat >/etc/systemd/system/local-update-pkg-cache.service <<'service'
# [Unit] # [Unit]