mirror of
https://git.myvelabs.com/lab/archlinux.git
synced 2026-08-16 12:54:25 +00:00
Update homelab.sh
This commit is contained in:
parent
e3e256c072
commit
1dcc048658
1 changed files with 57 additions and 40 deletions
85
homelab.sh
85
homelab.sh
|
|
@ -819,15 +819,19 @@ done
|
|||
|
||||
# Mount datasets
|
||||
zfs create -o mountpoint=/ -o canmount=noauto zroot/ROOT
|
||||
zfs create -o mountpoint=/.boot zroot/BOOT
|
||||
zfs create -o mountpoint=/home zroot/HOME
|
||||
zfs create -o mountpoint=/etc/letsencrypt zroot/HTTPS
|
||||
zfs create -o mountpoint=/opt/local zroot/LOCAL
|
||||
zfs create -o mountpoint=/var/lib/libvirt/images -o recordsize=64K zroot/QEMU
|
||||
zfs create -o mountpoint=/var/lib/docker zroot/DOCKER
|
||||
zfs create -o mountpoint=/var/cache/pacman/pkg zroot/PKG
|
||||
zfs create -o mountpoint=/var/log zroot/LOG
|
||||
zfs create -o mountpoint=/var/tmp zroot/TMP
|
||||
zfs create -o mountpoint=/.boot/ zroot/BOOT
|
||||
zfs create -o mountpoint=/home/ zroot/HOME
|
||||
zfs create -o mountpoint=/etc/letsencrypt/ zroot/HTTPS
|
||||
zfs create -o mountpoint=/opt/local/ zroot/LOCAL
|
||||
zfs create -o mountpoint=/var/lib/libvirt/images/ -o recordsize=64K zroot/QEMU
|
||||
zfs create -o mountpoint=/var/lib/docker/ zroot/DOCKER
|
||||
|
||||
zfs create -o mountpoint=/docker/ zroot/DOCKER/data
|
||||
zfs create -o mountpoint=/docker/sql/ -o recordsize=8K zroot/DOCKER/sql
|
||||
|
||||
zfs create -o mountpoint=/var/cache/pacman/pkg/ zroot/PKG
|
||||
zfs create -o mountpoint=/var/log/ zroot/LOG
|
||||
zfs create -o mountpoint=/var/tmp/ zroot/TMP
|
||||
zpool export zroot
|
||||
zpool import -R /mnt zroot -N -d ${installation_disks}-part2
|
||||
printf '%s' "${lukspass}" | zfs load-key zroot
|
||||
|
|
@ -917,7 +921,7 @@ sed -e "s|%PKGBASE%|linux|g" \
|
|||
rsync -a /mnt/usr/lib/modules/*/vmlinuz /mnt/boot/vmlinuz-linux
|
||||
|
||||
# Create custom system dirs
|
||||
mkdir -p /mnt/etc/{zfs/zfs-list.cache,pacman.d/hooks,nginx/sites-{available,enabled}}/ \
|
||||
mkdir -p /mnt/etc/{zfs/zfs-list.cache,pacman.d/hooks,nginx/{conf.d,snippets}}/ \
|
||||
/mnt/{zfs/{bin,snapshots},etc/libvirt/hooks/qemu.d}/ \
|
||||
/mnt/etc/systemd/{logind,journald}.conf.d/ \
|
||||
/mnt/opt/local/{bin,systemd,hooks}/ \
|
||||
|
|
@ -956,8 +960,8 @@ link
|
|||
if [ ${primaryip} ]
|
||||
then
|
||||
# Static IP
|
||||
rsync -a /etc/systemd/network/20-ethernet.network /mnt/etc/systemd/network/zz-fallback.network
|
||||
cat >/mnt/etc/systemd/network/20-${iface}.network <<- network
|
||||
rsync -a /etc/systemd/network/20-ethernet.network /mnt/etc/systemd/network/99-fallback.network
|
||||
cat >/mnt/etc/systemd/network/00-${iface}.network <<- network
|
||||
[Match]
|
||||
Name=eth0
|
||||
|
||||
|
|
@ -987,7 +991,7 @@ tee -a /etc/skel/.bashrc >/dev/null <<'bashglobal'
|
|||
# Environment additions
|
||||
export PATH=${PATH}:/opt/local/bin:/zfs/bin
|
||||
export SUDO_PROMPT=$'\a'"$(tput rev)[sudo] password for %p:$(tput sgr0)"' '
|
||||
alias sudoedit='sudo vim'
|
||||
alias sudoedit='doas vim'
|
||||
|
||||
# Colored prompts
|
||||
alias diff='diff --color=auto'
|
||||
|
|
@ -1232,7 +1236,7 @@ passwd -l root >/dev/null 2>&1
|
|||
# Defaults timestamp_type=global
|
||||
# Defaults insults
|
||||
# DEFAULTS
|
||||
#
|
||||
|
||||
# install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- 'COMMANDS'
|
||||
# Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
|
||||
# Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
|
||||
|
|
@ -1242,15 +1246,16 @@ passwd -l root >/dev/null 2>&1
|
|||
# Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
|
||||
# Cmnd_Alias MISC = /usr/bin/rsync
|
||||
# COMMANDS
|
||||
#
|
||||
|
||||
# install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- 'WHEEL'
|
||||
# %wheel ALL=(ALL:ALL) ALL
|
||||
# %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, QEMU, FAIL2BAN, PACMAN, IPTABLES, MISC
|
||||
# WHEEL
|
||||
#
|
||||
|
||||
# install -m 0440 /dev/stdin /etc/sudoers.d/zz-NOPASSWD <<- 'NOPASSWD'
|
||||
# Defaults:user !authenticate
|
||||
# NOPASSWD
|
||||
|
||||
# Doas
|
||||
install -m 0440 /dev/stdin /etc/doas.conf <<- 'doas'
|
||||
permit nopass :root
|
||||
|
|
@ -1258,7 +1263,8 @@ permit nopass :wheel
|
|||
doas
|
||||
install /dev/stdin /usr/local/bin/sudo <<- 'doas'
|
||||
#!/usr/bin/env bash
|
||||
exec doas "${@/--preserve-env*/}"
|
||||
#exec doas "${@/--preserve-env*/}"
|
||||
/usr/bin/run0 "${@}"
|
||||
doas
|
||||
|
||||
say as heading "Configured superuser and user"
|
||||
|
|
@ -1318,12 +1324,12 @@ cat >/etc/ssh/ssh_config.d/zz-homelab.conf <<- sshconfig
|
|||
Ciphers aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
|
||||
|
||||
# Only use ipv4
|
||||
AddressFamily inet
|
||||
# AddressFamily inet
|
||||
|
||||
# Multiplex
|
||||
ControlMaster auto
|
||||
ControlPath ~/.ssh/sockets/%r@%h-%p
|
||||
ControlPersist 10m
|
||||
# ControlMaster auto
|
||||
# ControlPath ~/.ssh/sockets/%r@%h-%p
|
||||
# ControlPersist 10m
|
||||
|
||||
# Ease up on local area network devices
|
||||
Host 192.168.* *.kvm *.local
|
||||
|
|
@ -1671,9 +1677,11 @@ sshd
|
|||
# Nginx
|
||||
sed '/^http {/a\
|
||||
include http_redirect;\
|
||||
include sites-enabled/\*.conf;\n\
|
||||
include conf.d/\*.conf;\n\
|
||||
types_hash_max_size 4096;\
|
||||
server_names_hash_bucket_size 128;\n' \
|
||||
server_names_hash_bucket_size 128;\n
|
||||
proxy_headers_hash_max_size 1024;\
|
||||
proxy_headers_hash_bucket_size 128;\n' \
|
||||
-i /etc/nginx/nginx.conf
|
||||
cat >/etc/nginx/http_redirect <<- 'redirect'
|
||||
server {
|
||||
|
|
@ -1685,14 +1693,19 @@ server {
|
|||
}
|
||||
redirect
|
||||
cat >/etc/nginx/proxy_params <<- 'proxy_params'
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Accept-Encoding "";
|
||||
proxy_set_header Referer $http_referer;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Port $server_port;
|
||||
proxy_set_header X-Forwarded-Scheme $scheme;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host:$remote_port;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-Port $remote_port;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Accept-Encoding "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-Port $remote_port;
|
||||
|
||||
proxy_next_upstream error timeout;
|
||||
|
||||
|
|
@ -1712,7 +1725,7 @@ server_tokens off;
|
|||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "noindex, nofollow" always;
|
||||
|
||||
|
|
@ -1721,9 +1734,11 @@ http2 on;
|
|||
|
||||
# http3 (open port 443/udp to use http3)
|
||||
# Add reuseport to ONLY ONE virtual host: listen 443 quic reuseport;
|
||||
add_header Alt-Svc 'h3=":443"; ma=86400';
|
||||
quic_retry on;
|
||||
http3 on;
|
||||
quic_retry on;
|
||||
ssl_early_data on;
|
||||
quic_gso on;
|
||||
add_header Alt-Svc 'h3=":443"; ma=86400';
|
||||
|
||||
# Certbot defaults
|
||||
add_header Strict-Transport-Security "max-age=31536000" always;
|
||||
|
|
@ -1736,11 +1751,14 @@ if [ -f /etc/nginx/nginx.conf.pacnew ]
|
|||
then
|
||||
sed '/^http {/a\
|
||||
include http_redirect;\
|
||||
include sites-enabled/\*.conf;\n\
|
||||
include conf.d/\*.conf;\n\
|
||||
types_hash_max_size 4096;\
|
||||
server_names_hash_bucket_size 128;\n' \
|
||||
server_names_hash_bucket_size 128;\n
|
||||
proxy_headers_hash_max_size 1024;\
|
||||
proxy_headers_hash_bucket_size 128;\n' \
|
||||
-i /etc/nginx/nginx.conf.pacnew
|
||||
mv /etc/nginx/nginx.conf.pacnew /etc/nginx/nginx.conf
|
||||
nginx -s reload
|
||||
fi
|
||||
hook
|
||||
# /etc/nginx/nginx.conf.pacnew hook
|
||||
|
|
@ -1759,7 +1777,7 @@ nginx
|
|||
|
||||
# Pacman cache
|
||||
# Nginx conf
|
||||
cat >/etc/nginx/sites-available/pacman.conf <<- 'pacman'
|
||||
cat >/etc/nginx/conf.d/pacman.conf <<- 'pacman'
|
||||
server {
|
||||
listen 9090;
|
||||
client_max_body_size 0;
|
||||
|
|
@ -1773,7 +1791,6 @@ server {
|
|||
}
|
||||
}
|
||||
pacman
|
||||
ln -s /etc/nginx/sites-available/pacman.conf /etc/nginx/sites-enabled/
|
||||
# # Systemd service
|
||||
# cat >/etc/systemd/system/local-update-pkg-cache.service <<'service'
|
||||
# [Unit]
|
||||
|
|
|
|||
Loading…
Reference in a new issue