|
@ -168,12 +168,12 @@ function build_routes() { |
|
|
mkdir -p "$MIAOU_CONFIGDIR/dnsmasq" |
|
|
mkdir -p "$MIAOU_CONFIGDIR/dnsmasq" |
|
|
|
|
|
|
|
|
mapfile -t fqdns < <(yqm '.expanded.services[].fqdn') |
|
|
mapfile -t fqdns < <(yqm '.expanded.services[].fqdn') |
|
|
echo "found <${#fqdns[@]}> fqdn" |
|
|
|
|
|
|
|
|
echo "building ${#fqdns[@]} routes..." |
|
|
raw_dnsmasq='' |
|
|
raw_dnsmasq='' |
|
|
for i in "${fqdns[@]}"; do |
|
|
for i in "${fqdns[@]}"; do |
|
|
raw_dnsmasq+="address=/$i/$DMZ_IP\\n" |
|
|
raw_dnsmasq+="address=/$i/$DMZ_IP\\n" |
|
|
# append domains to conf |
|
|
# append domains to conf |
|
|
echo "re-routing any connection from https://$i to internal container <$DMZ_CONTAINER.lxd>" |
|
|
|
|
|
|
|
|
echo "container <$DMZ_CONTAINER.lxd> serves https://$i" |
|
|
done |
|
|
done |
|
|
|
|
|
|
|
|
builtin echo -e "$raw_dnsmasq" >"$MIAOU_CONFIGDIR/dnsmasq/raw.new" |
|
|
builtin echo -e "$raw_dnsmasq" >"$MIAOU_CONFIGDIR/dnsmasq/raw.new" |
|
@ -188,7 +188,7 @@ function build_routes() { |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
function build_dmz_certbot { |
|
|
function build_dmz_certbot { |
|
|
PREFIX="miaou:dmz:certbot" |
|
|
|
|
|
|
|
|
PREFIX="miaou:certbot" |
|
|
|
|
|
|
|
|
if [[ "$target" != dev ]]; then |
|
|
if [[ "$target" != dev ]]; then |
|
|
|
|
|
|
|
@ -244,18 +244,11 @@ function build_dmz_certbot { |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
function build_dmz_reverseproxy() { |
|
|
function build_dmz_reverseproxy() { |
|
|
PREFIX="miaou:dmz:nginx" |
|
|
|
|
|
|
|
|
PREFIX="miaou:reverseproxy" |
|
|
|
|
|
|
|
|
echo -n "building default configuration for nginx ... " |
|
|
|
|
|
mkdir -p "$MIAOU_CONFIGDIR/nginx" |
|
|
mkdir -p "$MIAOU_CONFIGDIR/nginx" |
|
|
tera -t "$MIAOU_BASEDIR/templates/nginx/_default.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nginx/_default" &>/dev/null |
|
|
tera -t "$MIAOU_BASEDIR/templates/nginx/_default.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nginx/_default" &>/dev/null |
|
|
PREFIX="" echo OK |
|
|
|
|
|
|
|
|
|
|
|
echo -n "building hosts configuration for nginx ... " |
|
|
|
|
|
tera -t "$MIAOU_BASEDIR/templates/nginx/hosts.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nginx/hosts" &>/dev/null |
|
|
tera -t "$MIAOU_BASEDIR/templates/nginx/hosts.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nginx/hosts" &>/dev/null |
|
|
PREFIX="" echo OK |
|
|
|
|
|
|
|
|
|
|
|
echo -n "pushing configuration to <$DMZ_CONTAINER> ... " |
|
|
|
|
|
for f in "$MIAOU_CONFIGDIR"/nginx/*; do |
|
|
for f in "$MIAOU_CONFIGDIR"/nginx/*; do |
|
|
lxc file push --uid=0 --gid=0 "$f" "$DMZ_CONTAINER/etc/nginx/sites-available/" &>/dev/null |
|
|
lxc file push --uid=0 --gid=0 "$f" "$DMZ_CONTAINER/etc/nginx/sites-available/" &>/dev/null |
|
|
done |
|
|
done |
|
@ -266,7 +259,6 @@ function build_dmz_reverseproxy() { |
|
|
done |
|
|
done |
|
|
nginx -tq && systemctl restart nginx |
|
|
nginx -tq && systemctl restart nginx |
|
|
EOF |
|
|
EOF |
|
|
PREFIX="" echo OK |
|
|
|
|
|
echo "nginx reloaded successfully!" |
|
|
echo "nginx reloaded successfully!" |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
@ -303,8 +295,8 @@ function build_monit() { |
|
|
|
|
|
|
|
|
# test whether monitored items actually run safely |
|
|
# test whether monitored items actually run safely |
|
|
PREFIX="monit:build" |
|
|
PREFIX="monit:build" |
|
|
echo -n "testing monitored hosts ..." |
|
|
|
|
|
readarray -t hosts < <(yqmt '.expanded.services[] | [ .container, .port, .fqdn ]') |
|
|
readarray -t hosts < <(yqmt '.expanded.services[] | [ .container, .port, .fqdn ]') |
|
|
|
|
|
echo -n "monitoring ${#hosts[@]} hosts ..." |
|
|
for host in "${hosts[@]}"; do |
|
|
for host in "${hosts[@]}"; do |
|
|
read -r -a item <<<"$host" |
|
|
read -r -a item <<<"$host" |
|
|
container=${item[0]} |
|
|
container=${item[0]} |
|
@ -328,10 +320,8 @@ function build_monit() { |
|
|
fi |
|
|
fi |
|
|
|
|
|
|
|
|
done |
|
|
done |
|
|
PREFIX="" echo OK |
|
|
|
|
|
|
|
|
|
|
|
# templates for monit |
|
|
# templates for monit |
|
|
echo -n "copying templates for monit ..." |
|
|
|
|
|
mkdir -p "$MIAOU_CONFIGDIR/monit" |
|
|
mkdir -p "$MIAOU_CONFIGDIR/monit" |
|
|
tera -t "$MIAOU_BASEDIR/templates/monit/containers.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/monit/containers" >/dev/null |
|
|
tera -t "$MIAOU_BASEDIR/templates/monit/containers.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/monit/containers" >/dev/null |
|
|
tera -t "$MIAOU_BASEDIR/templates/monit/hosts.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/monit/hosts" >/dev/null |
|
|
tera -t "$MIAOU_BASEDIR/templates/monit/hosts.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/monit/hosts" >/dev/null |
|
@ -347,14 +337,14 @@ function count_service_for_container() { |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
function build_nftables() { |
|
|
function build_nftables() { |
|
|
PREFIX="miaou:nftables:build" |
|
|
|
|
|
|
|
|
PREFIX="miaou:nftables" |
|
|
mkdir -p "$MIAOU_CONFIGDIR/nftables.rules.d" |
|
|
mkdir -p "$MIAOU_CONFIGDIR/nftables.rules.d" |
|
|
|
|
|
|
|
|
container_mail_passthrough=$(yqm '.firewall.container_mail_passthrough') |
|
|
container_mail_passthrough=$(yqm '.firewall.container_mail_passthrough') |
|
|
if [[ "$container_mail_passthrough" != null ]]; then |
|
|
if [[ "$container_mail_passthrough" != null ]]; then |
|
|
ip_mail_passthrough=$(lxc list "$container_mail_passthrough" -c4 -f csv | grep eth0 | cut -d ' ' -f1) |
|
|
ip_mail_passthrough=$(lxc list "$container_mail_passthrough" -c4 -f csv | grep eth0 | cut -d ' ' -f1) |
|
|
[[ -z "$ip_mail_passthrough" ]] && echoerr "container <$container_mail_passthrough> passthrough unknown ip!" && exit 55 |
|
|
[[ -z "$ip_mail_passthrough" ]] && echoerr "container <$container_mail_passthrough> passthrough unknown ip!" && exit 55 |
|
|
echo "passthrough=$container_mail_passthrough/$ip_mail_passthrough" |
|
|
|
|
|
|
|
|
echo "submission protocol granted as passthrough from container <$container_mail_passthrough> ip <$ip_mail_passthrough>" |
|
|
|
|
|
|
|
|
count=$(count_service_for_container "$container_mail_passthrough") |
|
|
count=$(count_service_for_container "$container_mail_passthrough") |
|
|
[[ $count == 0 ]] && echowarn "no service detected => no passthrough, no change!" |
|
|
[[ $count == 0 ]] && echowarn "no service detected => no passthrough, no change!" |
|
@ -362,7 +352,7 @@ function build_nftables() { |
|
|
|
|
|
|
|
|
ip_mail_passthrough=$ip_mail_passthrough tera -e --env-key env -t "$MIAOU_BASEDIR/templates/nftables/lxd.table.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" &>/dev/null |
|
|
ip_mail_passthrough=$ip_mail_passthrough tera -e --env-key env -t "$MIAOU_BASEDIR/templates/nftables/lxd.table.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" &>/dev/null |
|
|
else |
|
|
else |
|
|
echo "no container passthrough" |
|
|
|
|
|
|
|
|
echo "submission protocol prevented from any container" |
|
|
tera -t "$MIAOU_BASEDIR/templates/nftables/lxd.table.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" &>/dev/null |
|
|
tera -t "$MIAOU_BASEDIR/templates/nftables/lxd.table.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" &>/dev/null |
|
|
fi |
|
|
fi |
|
|
|
|
|
|
|
@ -457,40 +447,44 @@ function check_resolv_conf() { |
|
|
local bridge_gw resolver |
|
|
local bridge_gw resolver |
|
|
|
|
|
|
|
|
bridge_gw=$(lxc network get lxdbr0 ipv4.address | cut -d'/' -f1) |
|
|
bridge_gw=$(lxc network get lxdbr0 ipv4.address | cut -d'/' -f1) |
|
|
PREFIX="resolver:check" echo "container bridge is <$bridge_gw>" |
|
|
|
|
|
|
|
|
|
|
|
resolver=$(grep nameserver /etc/resolv.conf | head -n1 | cut -d ' ' -f2) |
|
|
resolver=$(grep nameserver /etc/resolv.conf | head -n1 | cut -d ' ' -f2) |
|
|
PREFIX="resolver:check" echo "first resolver is <$resolver>" |
|
|
|
|
|
|
|
|
|
|
|
[[ "$bridge_gw" != "$resolver" ]] && return 21 |
|
|
[[ "$bridge_gw" != "$resolver" ]] && return 21 |
|
|
|
|
|
|
|
|
|
|
|
PREFIX="miaou:resolver" echo "nameserver for containers is <$resolver>" |
|
|
|
|
|
|
|
|
return 0 |
|
|
return 0 |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
function prepare_containers() { |
|
|
function prepare_containers() { |
|
|
PREFIX="miaou:prepare" |
|
|
|
|
|
|
|
|
PREFIX="miaou:containers" |
|
|
readarray -t containers < <(yqmt ".containers.[] | [ key, .[] ] ") |
|
|
readarray -t containers < <(yqmt ".containers.[] | [ key, .[] ] ") |
|
|
|
|
|
echo "preparing ${#containers[@]} containers for recipes..." |
|
|
|
|
|
recipe_count=0 |
|
|
for i in "${containers[@]}"; do |
|
|
for i in "${containers[@]}"; do |
|
|
read -r -a item <<<"$i" |
|
|
read -r -a item <<<"$i" |
|
|
container=${item[0]} |
|
|
container=${item[0]} |
|
|
for ((j = 1; j < ${#item[@]}; j++)); do |
|
|
for ((j = 1; j < ${#item[@]}; j++)); do |
|
|
|
|
|
recipe_count=$((recipe_count + 1)) |
|
|
service="${item[$j]}" |
|
|
service="${item[$j]}" |
|
|
recipe_install="$MIAOU_BASEDIR/recipes/$service/install.sh" |
|
|
recipe_install="$MIAOU_BASEDIR/recipes/$service/install.sh" |
|
|
if [[ -f "$recipe_install" ]]; then |
|
|
if [[ -f "$recipe_install" ]]; then |
|
|
echo "install [$service] provided by container <$container>" |
|
|
|
|
|
"$recipe_install" "$container" |
|
|
"$recipe_install" "$container" |
|
|
else |
|
|
else |
|
|
echoerr "FAILURE, for container <$container>, install recipe [$service] not found!" |
|
|
echoerr "FAILURE, for container <$container>, install recipe [$service] not found!" |
|
|
echoerr "please review configuration, mismatch recipe name maybe?" |
|
|
echoerr "please review configuration, mismatch recipe name maybe?" |
|
|
exit 50 |
|
|
exit 50 |
|
|
fi |
|
|
fi |
|
|
|
|
|
echo "container <$container> accepts recipe [$service]" |
|
|
done |
|
|
done |
|
|
done |
|
|
done |
|
|
|
|
|
echo "approved ${#containers[@]} containers ready to accept ${recipe_count} recipes" |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
function build_services() { |
|
|
function build_services() { |
|
|
PREFIX="miaou:build:services" |
|
|
|
|
|
echo "building services..." |
|
|
|
|
|
|
|
|
PREFIX="miaou:services" |
|
|
readarray -t services < <(yqmt '.expanded.services[] | [ .[] ]') |
|
|
readarray -t services < <(yqmt '.expanded.services[] | [ .[] ]') |
|
|
|
|
|
|
|
|
|
|
|
echo "building ${#services[@]} services..." |
|
|
for i in "${services[@]}"; do |
|
|
for i in "${services[@]}"; do |
|
|
|
|
|
|
|
|
read -r -a item <<<"$i" |
|
|
read -r -a item <<<"$i" |
|
|