diff options
74 files changed, 1165 insertions, 90 deletions
diff --git a/files/etc/auto_master.common b/files/etc/auto_master.common new file mode 100644 index 0000000..37f3e34 --- /dev/null +++ b/files/etc/auto_master.common @@ -0,0 +1,2 @@ +/net -hosts -nobrowse,nosuid,intr ++auto_master diff --git a/files/etc/cron.d/freeradius.radius_server b/files/etc/cron.d/freeradius.radius_server new file mode 100644 index 0000000..20f3ada --- /dev/null +++ b/files/etc/cron.d/freeradius.radius_server @@ -0,0 +1,2 @@ +MAILTO=root +@daily ${freeradius_user} find ${freeradius_tlscache_dir} -mindepth 1 -mtime +2 -exec rm -vf {} + diff --git a/files/etc/cron.d/invidious.invidious_server b/files/etc/cron.d/invidious.invidious_server new file mode 100644 index 0000000..89fa336 --- /dev/null +++ b/files/etc/cron.d/invidious.invidious_server @@ -0,0 +1,2 @@ +MAILTO=root +0 3 * * * root /usr/local/libexec/invidious-update -q ${invidious_local_username} ${invidious_repo_dir} diff --git a/files/etc/dma/dma.conf.freebsd b/files/etc/dma/dma.conf.freebsd index ff8aae0..6975ed1 100644 --- a/files/etc/dma/dma.conf.freebsd +++ b/files/etc/dma/dma.conf.freebsd @@ -2,4 +2,3 @@ SMARTHOST ${smtp_host} SECURETRANSFER STARTTLS OPPORTUNISTIC_TLS -MAILNAME ${email_domain} diff --git a/files/etc/exports.common b/files/etc/exports.common new file mode 100644 index 0000000..4ea7fd2 --- /dev/null +++ b/files/etc/exports.common @@ -0,0 +1,2 @@ +V4: ${nfs_root} +# The default is to not export anything. diff --git a/files/etc/login.conf.desktop b/files/etc/login.conf.desktop new file mode 100644 index 0000000..558c80a --- /dev/null +++ b/files/etc/login.conf.desktop @@ -0,0 +1,64 @@ +default:\\ + :passwd_format=sha512:\\ + :copyright=/etc/COPYRIGHT:\\ + :welcome=/var/run/motd:\\ + :setenv=BLOCKSIZE=K,XDG_DATA_DIRS=/usr/local/override\\c/usr/local/share,XDG_DATA_HOME=/usr/local/home/\$/.local/share,XDG_STATE_HOME=/usr/local/home/\$/.local/state,XDG_CACHE_HOME=/usr/local/home/\$/.cache,XDG_CONFIG_HOME=/usr/local/home/\$/.config,KDEHOME=/usr/local/home/\$/.kde:\\ + :mail=/var/mail/\$:\\ + :path=/sbin /bin /usr/local/sbin /usr/local/bin /usr/sbin /usr/bin ~/bin:\\ + :nologin=/var/run/nologin:\\ + :cputime=unlimited:\\ + :datasize=unlimited:\\ + :stacksize=unlimited:\\ + :memorylocked=64M:\\ + :memoryuse=unlimited:\\ + :filesize=unlimited:\\ + :coredumpsize=unlimited:\\ + :openfiles=unlimited:\\ + :maxproc=unlimited:\\ + :sbsize=unlimited:\\ + :vmemoryuse=unlimited:\\ + :swapuse=unlimited:\\ + :pseudoterminals=unlimited:\\ + :kqueues=unlimited:\\ + :umtxp=unlimited:\\ + :priority=0:\\ + :ignoretime@:\\ + :umask=022:\\ + :charset=UTF-8:\\ + :lang=${locale}: + +# +# A collection of common class names - forward them all to 'default' +# (login would normally do this anyway, but having a class name +# here suppresses the diagnostic) +# +standard:\\ + :tc=default: +xuser:\\ + :tc=default: +staff:\\ + :tc=default: + +# This PATH may be clobbered by individual applications. Notably, by default, +# rc(8), service(8), and cron(8) will all override it with a default PATH that +# may not include /usr/local/sbin and /usr/local/bin when starting services or +# jobs. +daemon:\\ + :path=/sbin /bin /usr/sbin /usr/bin /usr/local/sbin /usr/local/bin:\\ + :mail@:\\ + :memorylocked=128M:\\ + :tc=default: +news:\\ + :tc=default: +dialer:\\ + :tc=default: + +# +# Root can always login +# +# N.B. login_getpwclass(3) will use this entry for the root account, +# in preference to 'default'. +root:\\ + :ignorenologin:\\ + :memorylocked=unlimited:\\ + :tc=default: diff --git a/files/etc/login.conf.laptop b/files/etc/login.conf.laptop new file mode 120000 index 0000000..2dde3a4 --- /dev/null +++ b/files/etc/login.conf.laptop @@ -0,0 +1 @@ +login.conf.desktop
\ No newline at end of file diff --git a/files/etc/login.conf.roadwarrior_laptop b/files/etc/login.conf.roadwarrior_laptop new file mode 120000 index 0000000..2dde3a4 --- /dev/null +++ b/files/etc/login.conf.roadwarrior_laptop @@ -0,0 +1 @@ +login.conf.desktop
\ No newline at end of file diff --git a/files/etc/pam.d/cups.cups_server b/files/etc/pam.d/cups.cups_server new file mode 100644 index 0000000..b61c074 --- /dev/null +++ b/files/etc/pam.d/cups.cups_server @@ -0,0 +1,8 @@ +# auth +auth sufficient /usr/local/lib/security/pam_krb5.so try_first_pass +auth required pam_unix.so no_warn try_first_pass + +# account +account required /usr/local/lib/security/pam_krb5.so +account required pam_login_access.so +account required pam_unix.so diff --git a/files/etc/pam.d/kde.freebsd b/files/etc/pam.d/kde.freebsd new file mode 100644 index 0000000..2604c78 --- /dev/null +++ b/files/etc/pam.d/kde.freebsd @@ -0,0 +1,2 @@ +auth required /usr/local/lib/security/pam_krb5.so try_first_pass +account required /usr/local/lib/security/pam_krb5.so diff --git a/files/etc/pam.d/postgresql.postgresql_server b/files/etc/pam.d/postgresql.postgresql_server deleted file mode 100644 index 8475a53..0000000 --- a/files/etc/pam.d/postgresql.postgresql_server +++ /dev/null @@ -1,2 +0,0 @@ -auth required /usr/local/lib/security/pam_krb5.so try_first_pass keytab=${postgres_keytab} no_ccache ignore_k5login no_update_user minimum_uid=0 -account required pam_permit.so diff --git a/files/etc/pam.d/sddm.freebsd b/files/etc/pam.d/sddm.freebsd new file mode 100644 index 0000000..ef359ff --- /dev/null +++ b/files/etc/pam.d/sddm.freebsd @@ -0,0 +1,16 @@ +# NB: FreeBSD has no pam_stack.so or substack functionality, so we can't +# try multiple authentication sources (like krb5 but fall back to pam_unix) +# if we want pam_kwallet5 to execute. +# Hence, for sddm, we try krb5 only (no local accounts). +auth required /usr/local/lib/security/pam_krb5.so try_first_pass +auth optional pam_exec.so /usr/local/libexec/pam-create-local-homedir +auth optional pam_kwallet5.so + +account required /usr/local/lib/security/pam_krb5.so +account required pam_login_access.so +account required pam_unix.so + +session required pam_lastlog.so no_fail +session optional pam_kwallet5.so auto_start + +password required /usr/local/lib/security/pam_krb5.so try_first_pass diff --git a/files/etc/pam.d/sudo.freebsd b/files/etc/pam.d/sudo.freebsd new file mode 100644 index 0000000..425bf4e --- /dev/null +++ b/files/etc/pam.d/sudo.freebsd @@ -0,0 +1,15 @@ +# auth +auth sufficient /usr/local/lib/security/pam_krb5.so try_first_pass +auth required pam_unix.so no_warn try_first_pass + +# account +account required /usr/local/lib/security/pam_krb5.so +account required pam_login_access.so +account required pam_unix.so + +# session +account required pam_permit.so + +# password +password sufficient /usr/local/lib/security/pam_krb5.so try_first_pass +password required pam_unix.so no_warn try_first_pass diff --git a/files/etc/profile.d/kde.sh.common b/files/etc/profile.d/kde.sh.common new file mode 100644 index 0000000..010d5c1 --- /dev/null +++ b/files/etc/profile.d/kde.sh.common @@ -0,0 +1,6 @@ +#!/bin/sh + +if [ "$XDG_CURRENT_DESKTOP" = KDE ]; then + export SSH_ASKPASS_REQUIRE=prefer + export SSH_ASKPASS=/usr/local/bin/ksshaskpass +fi diff --git a/files/etc/profile.d/local-homedir.sh.common b/files/etc/profile.d/local-homedir.sh.common new file mode 100644 index 0000000..d5abb90 --- /dev/null +++ b/files/etc/profile.d/local-homedir.sh.common @@ -0,0 +1,25 @@ +#!/bin/sh + +# This file contains various environment variables and hacks to accomodate +# applications that don't play well with NFS-mounted home directories. + +if [ "$(id -u)" -lt 1000 ]; then + return 0 +fi + +LOCAL_HOME="/usr/local/home/${USER}" + +export PYTHONUSERBASE="${LOCAL_HOME}/.local" +export npm_config_cache="${LOCAL_HOME}/.npm" +export CARGO_HOME="${LOCAL_HOME}/.cargo" +export GOPATH="${LOCAL_HOME}/go" + +# firefox +mkdir -p "${LOCAL_HOME}/.mozilla" +ln -sfn "${LOCAL_HOME}/.mozilla" "${HOME}/.mozilla" + +# kwallet +# The kwallet PAM module hard-codes ~/.local/share/kwalletd, but kwallet itself +# honors XDG_DATA_HOME! So we symlink from the local disk back into NFS. Gross! +mkdir -p "${LOCAL_HOME}/.local/share/kwalletd" +ln -sfn "${HOME}/.local/share/kwalletd/kwallet.salt" "${LOCAL_HOME}/.local/share/kwalletd/kdewallet.salt" diff --git a/files/etc/syslog.conf.freebsd b/files/etc/syslog.conf.freebsd index dda6710..021836e 100644 --- a/files/etc/syslog.conf.freebsd +++ b/files/etc/syslog.conf.freebsd @@ -1,4 +1,5 @@ *.err;kern.warning;auth.notice;mail.crit /dev/console +!-devd *.info;authpriv.none;auth.none;cron.none;kern.debug;mail.crit;news.err /var/log/messages security.* /var/log/security auth.info;authpriv.info /var/log/auth.log @@ -7,6 +8,8 @@ cron.* /var/log/cron !-devd *.=debug /var/log/debug.log *.emerg * +!devd +*.>=info /var/log/devd.log !* include /etc/syslog.d include /usr/local/etc/syslog.d diff --git a/files/usr/local/etc/nginx/vhosts.conf.invidious_server b/files/usr/local/etc/nginx/vhosts.conf.invidious_server new file mode 100644 index 0000000..35947dc --- /dev/null +++ b/files/usr/local/etc/nginx/vhosts.conf.invidious_server @@ -0,0 +1,22 @@ +server { + listen 443 ssl default_server; + listen [::]:443 ssl default_server; + http2 on; + + ssl_certificate ${invidious_https_cert}; + ssl_certificate_key ${invidious_https_key}; + + add_header Strict-Transport-Security "max-age=63072000" always; + + location / { + proxy_http_version 1.1; + proxy_set_header Connection ""; + + proxy_set_header Host \$host; + proxy_set_header X-Real-IP \$remote_addr; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto \$scheme; + + proxy_pass http://127.0.0.1:${invidious_port}; + } +} diff --git a/files/usr/local/etc/nginx/vhosts.conf.pkg_repository b/files/usr/local/etc/nginx/vhosts.conf.pkg_repository index 8177626..73c5754 100644 --- a/files/usr/local/etc/nginx/vhosts.conf.pkg_repository +++ b/files/usr/local/etc/nginx/vhosts.conf.pkg_repository @@ -1,9 +1,14 @@ server { listen 0.0.0.0:80 default_server; - listen [::]:80 default_server; + listen [::]:80 default_server; + listen 443 ssl default_server; + listen [::]:443 ssl default_server; server_name ${fqdn}; root ${poudriere_data_dir}/data/packages; + ssl_certificate ${poudriere_https_cert}; + ssl_certificate_key ${poudriere_https_key}; + include mime.types; types { text/plain log; diff --git a/files/usr/local/etc/openldap/ldap.conf.common b/files/usr/local/etc/openldap/ldap.conf.common index 22b20bb..af1781e 100644 --- a/files/usr/local/etc/openldap/ldap.conf.common +++ b/files/usr/local/etc/openldap/ldap.conf.common @@ -12,3 +12,4 @@ USERS_BASE ${users_basedn} GROUPS_BASE ${groups_basedn} HOSTS_BASE ${hosts_basedn} ROLES_BASE ${roles_basedn} +AUTOMOUNT_BASE ${automount_basedn} diff --git a/files/usr/local/etc/openldap/ldap.conf.idm_server b/files/usr/local/etc/openldap/ldap.conf.idm_server index 4c7a929..aa6f8c9 100644 --- a/files/usr/local/etc/openldap/ldap.conf.idm_server +++ b/files/usr/local/etc/openldap/ldap.conf.idm_server @@ -12,3 +12,4 @@ USERS_BASE ${users_basedn} GROUPS_BASE ${groups_basedn} HOSTS_BASE ${hosts_basedn} ROLES_BASE ${roles_basedn} +AUTOMOUNT_BASE ${automount_basedn} diff --git a/files/usr/local/etc/polkit-1/rules.d/51-desktop.rules.desktop b/files/usr/local/etc/polkit-1/rules.d/51-desktop.rules.desktop new file mode 100644 index 0000000..d57c4b9 --- /dev/null +++ b/files/usr/local/etc/polkit-1/rules.d/51-desktop.rules.desktop @@ -0,0 +1,8 @@ +polkit.addRule(function (action, subject) { + if ((action.id == "org.freedesktop.consolekit.system.restart" || + action.id == "org.freedesktop.consolekit.system.stop" || + action.id == "org.freedesktop.consolekit.system.suspend") + && subject.isInGroup("${desktop_access_role}")) { + return polkit.Result.YES; + } +}); diff --git a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository index 6ef6f4a..7c69474 100644 --- a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository +++ b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository @@ -10,8 +10,8 @@ OPTIONS_SET=GSSAPI GSSAPI_MIT MIT NONFREE LIBEDIT # Per-port options databases_akonadi_SET=MYSQL databases_luadbi_SET=PGSQL -databases_postgresql${postgresql_version}-client_SET=PAM -databases_postgresql${postgresql_version}-server_SET=PAM +databases_postgresql${postgresql_version}-client_SET=PAM LDAP +databases_postgresql${postgresql_version}-server_SET=PAM LDAP devel_apr1_SET=LDAP devel_gitolite_SET=GITUSER devel_kio-extras_UNSET=AFC diff --git a/files/usr/local/etc/poudriere.d/patches/chromium-gssapi.patch.pkg_repository b/files/usr/local/etc/poudriere.d/patches/chromium-gssapi.patch.pkg_repository new file mode 100644 index 0000000..7cb0372 --- /dev/null +++ b/files/usr/local/etc/poudriere.d/patches/chromium-gssapi.patch.pkg_repository @@ -0,0 +1,54 @@ +--- www/chromium/Makefile 2024-10-14 22:31:01.044557000 -0400 ++++ www/chromium/Makefile 2024-10-14 22:37:11.304192000 -0400 +@@ -144,19 +144,20 @@ + SUB_FILES= chromium-browser.desktop chrome + SUB_LIST+= COMMENT="${COMMENT}" + +-OPTIONS_DEFINE= CODECS CUPS DEBUG DRIVER KERBEROS LTO PIPEWIRE TEST WIDEVINE +-OPTIONS_DEFAULT= CODECS CUPS DRIVER KERBEROS PIPEWIRE SNDIO ALSA PULSEAUDIO ++OPTIONS_DEFINE= CODECS CUPS DEBUG DRIVER LTO PIPEWIRE TEST WIDEVINE ++OPTIONS_DEFAULT= CODECS CUPS DRIVER KERBEROS PIPEWIRE SNDIO ALSA PULSEAUDIO GSSAPI_MIT + OPTIONS_EXCLUDE_aarch64=LTO + OPTIONS_GROUP= AUDIO + OPTIONS_GROUP_AUDIO= ALSA PULSEAUDIO SNDIO +-OPTIONS_RADIO= KERBEROS +-OPTIONS_RADIO_KERBEROS= HEIMDAL HEIMDAL_BASE MIT ++OPTIONS_SINGLE= KERBEROS ++OPTIONS_SINGLE_KERBEROS=GSSAPI_NONE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT + OPTIONS_SUB= yes + CODECS_DESC= Compile and enable patented codecs like H.264 + DRIVER_DESC= Install chromedriver +-HEIMDAL_BASE_DESC= Heimdal Kerberos (base) +-HEIMDAL_DESC= Heimdal Kerberos (security/heimdal) +-MIT_DESC= MIT Kerberos (security/krb5) ++GSSAPI_NONE_DESC= Build without GSSAPI support ++GSSAPI_BASE_DESC= Use GSSAPI from base ++GSSAPI_HEIMDAL_DESC= Use Heimdal GSSAPI from security/heimdal ++GSSAPI_MIT_DESC= Use MIT GSSAPI from security/krb5 + + ALSA_LIB_DEPENDS= libasound.so:audio/alsa-lib + ALSA_RUN_DEPENDS= ${LOCALBASE}/lib/alsa-lib/libasound_module_pcm_oss.so:audio/alsa-plugins \ +@@ -189,16 +190,19 @@ + + DRIVER_MAKE_ARGS= chromedriver + +-HEIMDAL_LIB_DEPENDS= libkrb.so.26:security/heimdal +-KERBEROS_VARS= GN_ARGS+=use_kerberos=true +-KERBEROS_VARS_OFF= GN_ARGS+=use_kerberos=false ++GSSAPI_BASE_USES= gssapi ++GSSAPI_HEIMDAL_USES= gssapi:heimdal ++GSSAPI_MIT_USES= gssapi:mit ++GSSAPI_BASE_VARS= GN_ARGS+=use_kerberos=true ++GSSAPI_MIT_VARS= GN_ARGS+=use_kerberos=true ++GSSAPI_HEIMDAL_VARS= GN_ARGS+=use_kerberos=true ++GSSAPI_NONE_VARS= GN_ARGS+=use_kerberos=false + + LTO_VARS= GN_ARGS+=use_thin_lto=true \ + GN_ARGS+=thin_lto_enable_optimizations=true \ + WANTSPACE="14 GB" + LTO_VARS_OFF= GN_ARGS+=use_thin_lto=false + +-MIT_LIB_DEPENDS= libkrb.so.3:security/krb5 + + PIPEWIRE_DESC= Screen capture via PipeWire + PIPEWIRE_LIB_DEPENDS= libpipewire-0.3.so:multimedia/pipewire diff --git a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository index ec63f48..35b8f9a 100644 --- a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository +++ b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository @@ -1,5 +1,11 @@ +archivers/7-zip archivers/php${php_version}-phar archivers/php${php_version}-zip +archivers/unzip +archivers/zip +audio/juk +audio/kid3 +audio/kmix converters/php${php_version}-iconv converters/php${php_version}-mbstring databases/luadbi @@ -11,25 +17,38 @@ databases/postgresql${postgresql_version}-client databases/postgresql${postgresql_version}-server databases/redis devel/ccache +devel/cgit devel/git@lite +devel/gitolite devel/php${php_version}-gettext devel/php${php_version}-intl devel/php${php_version}-pcntl devel/php${php_version}-tokenizer +devel/py-pip +devel/shards dns/bind-tools dns/nsd dns/powerdns dns/unbound +editors/libreoffice editors/vim@console editors/vim@tiny +finance/gnucash +finance/kmymoney ftp/php${php_version}-curl +graphics/ImageMagick7@nox11 +graphics/drm-kmod +graphics/p5-Image-ExifTool graphics/php${php_version}-exif graphics/php${php_version}-gd +irc/konversation irc/znc irc/znc-clientbuffer +java/eclipse java/openjdk21 -lang/python +lang/crystal lang/php${php_version} +lang/python mail/dovecot mail/dovecot-pigeonhole mail/isync @@ -38,27 +57,37 @@ mail/postfix mail/rspamd mail/sieve-connect misc/php${php_version}-calendar +multimedia/audacious +multimedia/libva-intel-media-driver +multimedia/makemkv +net-im/dino +net-im/gajim +net-im/prosody +net-im/prosody-modules +net-im/signal-desktop +net-mgmt/unifi8 net/asterisk18 +net/freeradius3 net/lualdap net/nss-pam-ldapd-sasl net/openldap26-client net/openldap26-server net/p5-perl-ldap net/php${php_version}-ldap +net/php${php_version}-sockets net/py-python-ldap net/rsync -net/php${php_version}-sockets net/turnserver -net-im/prosody -net-im/prosody-modules +net/wireguard-tools ports-mgmt/poudriere print/cups print/cups-filters security/acme.sh +security/bitwarden-cli security/cyrus-sasl2-saslauthd -security/kstart security/krb5@default security/krb5@ldap +security/kstart security/openssh-portable security/pam_krb5@mit security/pam_mkhomedir @@ -67,20 +96,38 @@ security/sshpass security/sudo security/vaultwarden sysutils/htop +sysutils/k3b sysutils/lsof sysutils/p5-Sys-Syslog +sysutils/password-store sysutils/php${php_version}-fileinfo sysutils/php${php_version}-posix sysutils/pwgen sysutils/stow sysutils/tmux sysutils/tree +textproc/hs-pandoc +textproc/jq textproc/p5-YAML textproc/php${php_version}-ctype textproc/php${php_version}-dom textproc/php${php_version}-simplexml textproc/php${php_version}-xml textproc/php${php_version}-xmlwriter +textproc/py-docutils +textproc/py-markdown +textproc/py-pygments +www/chromium +www/fcgiwrap +www/firefox +www/linux-widevine-cdm www/nginx www/php${php_version}-opcache www/php${php_version}-session +www/w3m +x11-fonts/terminus-font +x11-fonts/terminus-ttf +x11/kde5 +x11/sddm +x11/xev +x11/xorg diff --git a/files/usr/local/etc/raddb/mods-available/eap.radius_server b/files/usr/local/etc/raddb/mods-available/eap.radius_server new file mode 100644 index 0000000..5c1aafd --- /dev/null +++ b/files/usr/local/etc/raddb/mods-available/eap.radius_server @@ -0,0 +1,42 @@ +eap { + default_eap_type = tls + timer_expire = 60 + ignore_unknown_eap_types = yes + cisco_accounting_username_bug = no + max_sessions = \${max_requests} + + tls-config tls-common { + private_key_password = + private_key_file = ${freeradius_tls_key} + certificate_file = ${freeradius_tls_cert} + ca_file = ${site_cacert_path} + ca_path = \${cadir} + auto_chain = no + check_crl = no + cipher_list = "DEFAULT" + cipher_server_preference = no + tls_min_version = "1.2" + tls_max_version = "1.3" + ecdh_curve = "" + + cache { + enable = yes + lifetime = 24 # hours + name = "EAP module" + persist_dir = "${freeradius_tlscache_dir}" + store { + Tunnel-Private-Group-Id + } + } + + verify { } + + ocsp { + enable = no + } + } + + tls { + tls = tls-common + } +} diff --git a/files/usr/local/etc/raddb/radiusd.conf.radius_server b/files/usr/local/etc/raddb/radiusd.conf.radius_server new file mode 100644 index 0000000..cc5a7a3 --- /dev/null +++ b/files/usr/local/etc/raddb/radiusd.conf.radius_server @@ -0,0 +1,80 @@ +prefix = /usr/local +exec_prefix = \${prefix} +sysconfdir = \${prefix}/etc +localstatedir = /var +sbindir = \${exec_prefix}/sbin +logdir = /var/log +raddbdir = \${sysconfdir}/raddb +radacctdir = \${logdir}/radacct + +name = radiusd + +confdir = \${raddbdir} +modconfdir = \${confdir}/mods-config +certdir = \${confdir}/certs +cadir = \${confdir}/certs +run_dir = \${localstatedir}/run/\${name} + +db_dir = \${raddbdir} + +libdir = /usr/local/lib/freeradius-${freeradius_version} + +pidfile = \${run_dir}/\${name}.pid + +max_request_time = 30 + +cleanup_delay = 5 + +max_requests = 16384 + +hostname_lookups = no + +log { + destination = syslog + colourise = no + file = \${logdir}/radius.log + syslog_facility = daemon + stripped_names = no + auth = yes + auth_badpass = no + auth_goodpass = no + msg_denied = "You are already logged in - access denied" +} + +checkrad = \${sbindir}/checkrad + +ENV { } + +security { + allow_core_dumps = no + max_attributes = 200 + reject_delay = 1 + status_server = yes +} + +proxy_requests = yes +\$INCLUDE proxy.conf + +\$INCLUDE clients.conf + + +thread pool { + start_servers = 5 + max_servers = 32 + min_spare_servers = 3 + max_spare_servers = 10 + max_requests_per_server = 0 + auto_limit_acct = no +} + +modules { + \$INCLUDE mods-enabled/ +} + +instantiate { } + +policy { + \$INCLUDE policy.d/ +} + +\$INCLUDE sites-enabled/ diff --git a/files/usr/local/etc/rc.d/invidious.invidious_server b/files/usr/local/etc/rc.d/invidious.invidious_server new file mode 100644 index 0000000..44acbad --- /dev/null +++ b/files/usr/local/etc/rc.d/invidious.invidious_server @@ -0,0 +1,41 @@ +#!/bin/sh + +# PROVIDE: invidious +# REQUIRE: NETWORKING +# KEYWORD: shutdown + +. /etc/rc.subr + +name=invidious +rcvar=invidious_enable + +load_rc_config "$name" + +: ${invidious_enable:='NO'} +: ${invidious_dir:='/usr/local/invidious/invidious.git'} +: ${invidious_user='www'} +: ${invidious_syslog_priority:='info'} +: ${invidious_syslog_facility:='daemon'} + +invidious_syslog_tag=invidious + +invidious_chdir=$invidious_dir +pidfile=/var/run/invidious/invidious.pid +command=/usr/sbin/daemon + +command_args="-f \ +-s ${invidious_syslog_priority} \ +-l ${invidious_syslog_facility} \ +-T ${invidious_syslog_tag} \ +-p ${pidfile} \ +-t invidious \ +${invidious_dir}/invidious" + +procname="${invidious_dir}/invidious" +start_precmd=invidious_prestart + +invidious_prestart(){ + install -d -m 0755 -o ${invidious_user} /var/run/invidious +} + +run_rc_command "$1" diff --git a/files/usr/local/etc/sddm.conf.common b/files/usr/local/etc/sddm.conf.common new file mode 100644 index 0000000..09c2000 --- /dev/null +++ b/files/usr/local/etc/sddm.conf.common @@ -0,0 +1,9 @@ +[General] +DisplayServer = x11 + +[Wayland] +SessionDir = /dev/null + +[Users] +MinimumUid = ${sddm_min_uid} +MaximumUid = ${sddm_max_uid} diff --git a/files/usr/local/etc/ssh/sshd_config.freebsd b/files/usr/local/etc/ssh/sshd_config.freebsd index eca2276..0e0d730 100644 --- a/files/usr/local/etc/ssh/sshd_config.freebsd +++ b/files/usr/local/etc/ssh/sshd_config.freebsd @@ -13,4 +13,6 @@ GSSAPICleanupCredentials yes UsePAM yes UseDNS no +# TODO: require group to login? + Subsystem sftp /usr/local/libexec/sftp-server diff --git a/files/usr/local/invidious/invidious.git/config/config.yml.invidious_server b/files/usr/local/invidious/invidious.git/config/config.yml.invidious_server new file mode 100644 index 0000000..fb7fe54 --- /dev/null +++ b/files/usr/local/invidious/invidious.git/config/config.yml.invidious_server @@ -0,0 +1,35 @@ +log_level: info +domain: ${invidious_fqdn} +external_port: 443 +channel_threads: 1 +feed_threads: 1 +database_url: postgres://${invidious_username}:${invidious_password}@${invidious_dbhost}/${invidious_dbname}?sslmode=verify-full&auth_methods=cleartext +use_pubsub_feeds: false +hmac_key: ${invidious_hmac_key} +https_only: true +registration_enabled: true +port: ${invidious_port} +host_binding: 127.0.0.1 +popular_enabled: false +captcha_enabled: false +check_tables: true +cache_annotations: true +po_token: ${invidious_po_token} +visitor_data: ${invidious_visitor_data} +signature_server: ${invidious_signature_sock} + +default_user_preferences: + dark_mode: auto + autoplay: false + continue: true + continue_autoplay: false + local: true + quality: dash + quality_dash: 1080p + locale: en-US + region: US + related_videos: true + video_loop: false + player_style: invidious + default_home: Subscriptions + feed_menu: [Subscriptions, Playlists] diff --git a/files/usr/local/libexec/idm-autofs-map.common b/files/usr/local/libexec/idm-autofs-map.common new file mode 100644 index 0000000..296bf91 --- /dev/null +++ b/files/usr/local/libexec/idm-autofs-map.common @@ -0,0 +1,44 @@ +#!/usr/local/bin/perl + +use strict; +use warnings; + +use Net::LDAP; +use Net::LDAP::Util qw(escape_dn_value); +use Authen::SASL; + +open my $fh, '<', '/usr/local/etc/openldap/ldap.conf' or die($!); +my %config; +while (<$fh>) { + chomp; + next if /^#/; + my @pair = split(' ', $_, 2); + next unless (@pair == 2); + $config{$pair[0]} = $pair[1]; +} +close($fh); + +my $mech = $config{SASL_MECH} // 'GSSAPI'; +my $uri = $config{URI} // die("URI not specified\n"); +my $basedn = $config{AUTOMOUNT_BASE} // die("AUTOMOUNT_BASE not specified\n"); + +@ARGV == 1 or die "usage: $0 MAPNAME\n"; +my $mapname = $ARGV[0]; + +my $conn = Net::LDAP->new($uri, version => '3') or die "$0: $@"; +my $sasl = Authen::SASL->new($mech); +my $status = $conn->bind(sasl => $sasl); +$status->code and die "$0: ".$status->error."\n"; + +my $search = $conn->search( + scope => 'one', + base => 'automountMapName='.escape_dn_value($mapname).",$basedn", + filter => '(objectClass=automount)', + attrs => ['automountKey', 'automountInformation']); +$search->code and die "$0: $mapname: ".$search->error."\n"; + +foreach my $entry ($search->entries) { + my $key = ($entry->get_value('automountKey'))[0]; + my $info = ($entry->get_value('automountInformation'))[0]; + print "$key $info\n"; +} diff --git a/files/usr/local/libexec/invidious-update.invidious_server b/files/usr/local/libexec/invidious-update.invidious_server new file mode 100644 index 0000000..b89b4bf --- /dev/null +++ b/files/usr/local/libexec/invidious-update.invidious_server @@ -0,0 +1,48 @@ +#!/bin/sh + +set -eu -o pipefail + +prog=$(basename "$(readlink -f "$0")") +usage="${prog} [-q] INVIDIOUS_USER INVIDIOUS_SRCDIR" + +die() { + printf '%s: %s\n' "$prog" "$*" 1>&2 + exit 1 +} + +usage(){ + printf 'usage: %s\n' "$usage" 1>&2 + exit 2 +} + +as_invidious(){ + su -m "$invidious_user" -c "HOME=$(dirname "$invidious_dir") ${@}" +} + +while getopts hq opt; do + case $opt in + h) usage ;; + q) exec 1>/dev/null ;; + esac +done +shift $((OPTIND - 1)) + +[ $# -eq 2 ] || usage + +invidious_user=$1 +invidious_dir=$2 + +cd "$invidious_dir" + +su -m "$invidious_user" -c 'git fetch' +local_rev=$(as_invidious 'git rev-parse HEAD') +upstream_rev=$(as_invidious 'git rev-parse "@{u}"') + +if [ "$local_rev" != "$upstream_rev" ]; then + echo "updating invidious to rev ${upstream_rev}" + as_invidious 'git pull --ff-only && shards install --production && crystal build src/invidious.cr --release' +else + echo "invidious already up to date at rev ${local_rev}" +fi + +service invidious restart diff --git a/files/usr/local/libexec/pam-create-local-homedir.common b/files/usr/local/libexec/pam-create-local-homedir.common new file mode 100644 index 0000000..a956d65 --- /dev/null +++ b/files/usr/local/libexec/pam-create-local-homedir.common @@ -0,0 +1,10 @@ +#!/bin/sh + +set -e + +uid=$(id -u "$PAM_USER") + +if [ "$uid" -ge 1000 ]; then + install -m 0755 -d /usr/local/home + install -o "$uid" -g "$uid" -m 0700 -d "/usr/local/home/${PAM_USER}" +fi diff --git a/files/usr/local/override/applications/signal-desktop.desktop.common b/files/usr/local/override/applications/signal-desktop.desktop.common new file mode 100644 index 0000000..d0c9160 --- /dev/null +++ b/files/usr/local/override/applications/signal-desktop.desktop.common @@ -0,0 +1,12 @@ +[Desktop Entry] +Type=Application +Name=Signal +Comment=Signal - Private Messenger +Icon=signal-desktop +Exec=signal-desktop --use-tray-icon -- %u +Terminal=false +Categories=Network;InstantMessaging; +StartupWMClass=Signal +MimeType=x-scheme-handler/sgnl; +Keywords=sgnl;chat;im;messaging;messenger;sms;security;privat; +X-GNOME-UsesNotifications=true diff --git a/files/usr/local/www/davical/config/config.php.dav_server b/files/usr/local/www/davical/config/config.php.dav_server index ec2cb26..3d1174d 100644 --- a/files/usr/local/www/davical/config/config.php.dav_server +++ b/files/usr/local/www/davical/config/config.php.dav_server @@ -20,8 +20,12 @@ 'port' => '389', 'sasl' => 'yes', 'sasl_mech' => 'GSSAPI', - 'baseDNUsers' => '${users_basedn}', + 'baseDNUsers' => '${people_basedn}', 'baseDNGroups' => '${groups_basedn}', + /* Must use scope=onelevel here because if davical picks up a user and group + * with the same name, then the group takes precedence and the user is lost. + * Sad for us because we store user private groups in LDAP. + */ 'scope' => 'onelevel', 'protocolVersion' => 3, 'optReferrals' => 0, @@ -44,6 +48,6 @@ 'H' => array(8,2), 'M' => array(10,2), 'S' => array(12,2)), - 'i_use_mode_kerberos' => 'i_know_what_i_am_doing', + 'i_use_mode_kerberos' => 'allow_fallback_to_ldap_auth', ); include_once('drivers_ldap.php'); diff --git a/files/var/db/postgres/data16/pg_hba.conf.postgresql_server b/files/var/db/postgres/data16/pg_hba.conf.postgresql_server index 0e98783..4810eb9 100644 --- a/files/var/db/postgres/data16/pg_hba.conf.postgresql_server +++ b/files/var/db/postgres/data16/pg_hba.conf.postgresql_server @@ -2,4 +2,4 @@ local all postgres peer map=postgres local all all peer hostgssenc all all all gss include_realm=0 krb_realm=${realm} -hostssl all all all pam +hostssl all all all ldap ldapserver="${ldap_hosts}" ldaptls=1 ldapbinddn="${postgres_dn}" ldapbindpasswd="${postgres_ldap_password}" ldapbasedn="${users_basedn}" ldapsearchattribute=uid diff --git a/hostclasses b/hostclasses index 22b77ce..92c1d38 100644 --- a/hostclasses +++ b/hostclasses @@ -5,6 +5,7 @@ smtp_server ^smtp[0-9] imap_server ^imap[0-9] dev_server ^dev[0-9] radius_server ^radius[0-9] +desktop ^desktop[0-9] laptop ^laptop[0-9] roadwarrior_laptop ^rlaptop[0-9] postgresql_server ^postgres[0-9] @@ -21,7 +22,7 @@ internal_webserver ^web[0-9] public_webserver ^www[0-9] authoritative_nameserver ^ns[0-9] asterisk_server ^pbx[0-9] -nfs_server ^nas[0-9] +nfs_server ^nfs[0-9] turn_server ^turn[0-9] syncthing_server ^syncthing[0-9] icinga_server ^icinga[0-9] diff --git a/scripts/common/10-vars b/scripts/common/10-vars index cae4496..361bb7b 100644 --- a/scripts/common/10-vars +++ b/scripts/common/10-vars @@ -34,4 +34,4 @@ sudo_basedn="ou=sudo,${basedn}" dns_basedn="ou=dns,${basedn}" kdc_basedn="cn=kdc,${basedn}" -boxconf_dn="krbPrincipalName=${boxconf_username}@${realm},${robots_basedn}" +boxconf_dn="uid=${boxconf_username},${robots_basedn}" diff --git a/scripts/hostclass/bitwarden_server b/scripts/hostclass/bitwarden_server index 5e19bdd..1f025fe 100644 --- a/scripts/hostclass/bitwarden_server +++ b/scripts/hostclass/bitwarden_server @@ -6,7 +6,6 @@ : ${vaultwarden_fqdn:="$fqdn"} vaultwarden_local_username=$nginx_user -vaultwarden_uid=$(id -u "$vaultwarden_local_username") vaultwarden_https_cert="${nginx_conf_dir}/vaultwarden.crt" vaultwarden_https_key="${nginx_conf_dir}/vaultwarden.key" vaultwarden_home=/usr/local/www/vaultwarden @@ -24,6 +23,7 @@ ktadd -k "$vaultwarden_client_keytab" "$vaultwarden_username" chgrp "$vaultwarden_local_username" "$vaultwarden_client_keytab" chmod 640 "$vaultwarden_client_keytab" +vaultwarden_uid=$(id -u "$vaultwarden_local_username") install_directory -o "$vaultwarden_local_username" -m 0700 "/var/krb5/user/${vaultwarden_uid}" ln -snfv "$vaultwarden_client_keytab" "/var/krb5/user/${vaultwarden_uid}/client.keytab" diff --git a/scripts/hostclass/cups_server b/scripts/hostclass/cups_server index e3ad928..6667829 100644 --- a/scripts/hostclass/cups_server +++ b/scripts/hostclass/cups_server @@ -16,6 +16,9 @@ pkg install -y cups cups-filters install_certificate -g "$cups_user" cups "$cups_tls_cert" install_certificate_key -g "$cups_user" cups "$cups_tls_key" +# Generate CUPS pam configuration. +install_file -m 0644 /etc/pam.d/cups + # Copy CUPS configuration. install_template -o root -g "$cups_user" -m 0640 \ "${cups_conf_dir}/cupsd.conf" \ diff --git a/scripts/hostclass/desktop b/scripts/hostclass/desktop index 561fb8d..35237fd 100644 --- a/scripts/hostclass/desktop +++ b/scripts/hostclass/desktop @@ -1,75 +1,75 @@ #!/bin/sh -load_kernel_module linux linux64 acpi_ibm - -pkg install -y \ - chromium \ - compton \ - dino \ - dmenu \ - eclipse \ - firefox \ - git \ - gnupg \ - krb5 \ - i3 \ - libreoffice \ - libva-intel-media-driver \ - networkmgr \ - password-store \ - py${python_version}-pip \ - stow \ - terminus-font \ - terminus-ttf \ - tmux \ - tree \ - wireguard-tools \ - xfontsel \ - xidle \ - xorg \ - xterm +: ${desktop_access_role:='desktop-access'} +: ${desktop_access_gid:='40000'} + +: ${sddm_min_uid:='10000'} +: ${sddm_max_uid:='19999'} + +if [ "${enable_idm:-}" = false ]; then + desktop_access_role=operator +else + ldap_add "cn=${desktop_access_role},${roles_basedn}" <<EOF +objectClass: groupOfMembers +objectClass: posixGroup +cn: ${desktop_access_role} +gidNumber: ${desktop_access_gid} +EOF +fi + +# Load linux kernel modules. +load_kernel_module linux linux64 +set_loader_conf \ + linux_load=YES \ + linux64_load=YES + +# Install packages common to all DEs. +pkg install -y $desktop_common_packages + +# Install scripts for creating local (non-NFS) home directories. +install_file -m 0555 \ + /usr/local/libexec/pam-create-local-homedir \ + /etc/profile.d/local-homedir.sh +install_directory -m 0755 /usr/local/home case $desktop_type in i3) - pkg install \ - dunst \ - i3 \ - i3lock \ - i3status \ - profanity + pkg install -y $desktop_i3_packages ;; kde) - pkg install \ - juk \ - k3b \ - kde5 \ - kid3-qt6 \ - kmix \ - konversation \ - sddm + # Install KDE packages. + pkg install -y $desktop_kde_packages + + # Configure pam services. + install_file -m 0644 \ + /etc/pam.d/sddm \ + /etc/pam.d/kde + + # Copy SDDM config file. + install_template -m 0644 /usr/local/etc/sddm.conf + + # Create profile script for KDE environment variables. + install_file -m 0644 /etc/profile.d/kde.sh + + # Create SDDM local homedir. + install_directory -o sddm -g sddm -m 0700 /usr/local/home/sddm + + # Enable sddm. + sysrc -v sddm_enable=YES ;; esac +# Tune sysctls for desktop usage. set_sysctl \ net.local.stream.recvspace=65536 \ net.local.stream.sendspace=65536 \ kern.sched.preempt_thresh=224 \ - vfs.usermount=1 \ - hw.snd.latency=7 + vfs.usermount=1 set_loader_conf \ kern.ipc.shmseg=1024 \ kern.ipc.shmmni=1024 \ kern.maxproc=100000 \ - linux_load=YES \ - linux64_load=YES \ - acpi_ibm_load=YES \ - compat.linuxkpi.i915_enable_dc=2 \ - compat.linuxkpi.i915_enable_fbc=1 \ - compat.linuxkpi.i915_fastboot=1 \ - compat.linuxkpi.i915_disable_power_well=1 \ - machdep.hwpstate_pkg_ctrl=0 \ - vfs.zfs.txg.timeout=10 \ hw.pci.do_power_nodriver=3 # Create policy file for firefox. @@ -88,6 +88,18 @@ install_file -m 0644 /usr/local/lib/libreoffice/program/sofficerc # Add terminus font to X11 install_file -m 0644 /usr/local/etc/X11/xorg.conf.d/terminus.conf +# Create xdg override directory. +install_directory -m 0755 \ + /usr/local/override \ + /usr/local/override/applications + +# Create xdg application overrides. +install_file -m 0644 \ + /usr/local/override/applications/signal-desktop.desktop + +# Create polkit rules for shutdown/reboot/suspend +install_template -m 0644 /usr/local/etc/polkit-1/rules.d/51-desktop.rules + # Enable dbus. sysrc -v dbus_enable=YES service dbus status || service dbus start @@ -98,6 +110,9 @@ case $graphics_type in pkg install -y drm-kmod sysrc -v kld_list+=i915kms load_kernel_module i915kms + set_loader_conf \ + compat.linuxkpi.i915_enable_fbc=1 \ + compat.linuxkpi.i915_fastboot=1 \ ;; esac @@ -164,3 +179,8 @@ xterm-256color|xterm with 256 colors, tbc=\E[3g, u6=\E[%i%d;%dR, u7=\E[6n, u8=\E[?%[;0123456789]c, u9=\E[c, vpa=\E[%i%p1%dd, EOF + +# Start login manager. +case $desktop_type in + kde) service sddm status || service sddm start > /dev/null 2>&1 < /dev/null || die 'failed to start sddm' ;; +esac diff --git a/scripts/hostclass/freebsd_hypervisor b/scripts/hostclass/freebsd_hypervisor index bdaa3c0..24c1da5 100644 --- a/scripts/hostclass/freebsd_hypervisor +++ b/scripts/hostclass/freebsd_hypervisor @@ -24,6 +24,9 @@ hypervisor_jail_bpf_ruleset=1000 # Required for vnet jails. set_sysctl net.link.tap.up_on_open=1 +# Required to for kerberized NFS within jails. +sysrc -v kld_list+='kgssapi kgssapi_krb5' + # https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=262189 set_sysctl vfs.zfs.vol.mode=2 diff --git a/scripts/hostclass/idm_server/10-slapd b/scripts/hostclass/idm_server/10-slapd index d108ae2..f6c9b4a 100644 --- a/scripts/hostclass/idm_server/10-slapd +++ b/scripts/hostclass/idm_server/10-slapd @@ -180,6 +180,21 @@ objectClass: organizationalUnit ou: $(ldap_rdn_value "$automount_basedn") EOF + # automountMapName=auto_master,ou=automount,dc=example,dc=com + ldap_add "automountMapName=auto_master,${automount_basedn}" <<EOF +objectClass: automountMap +automountMapName: auto_master +EOF + ldap_add "automountKey=/home,automountMapName=auto_master,${automount_basedn}" <<EOF +objectClass: automount +automountKey: /home +automountInformation: auto_home +EOF + ldap_add "automountMapName=auto_home,${automount_basedn}" <<EOF +objectClass: automountMap +automountMapName: auto_home +EOF + # ou=sudo,dc=example,dc=com ldap_add "$sudo_basedn" <<EOF objectClass: organizationalUnit diff --git a/scripts/hostclass/idm_server/90-idm b/scripts/hostclass/idm_server/90-idm index adfdf36..1f6920b 100644 --- a/scripts/hostclass/idm_server/90-idm +++ b/scripts/hostclass/idm_server/90-idm @@ -93,11 +93,11 @@ install_file -m 0555 \ # Create the boxconf administrative user. if is_primary_server && ! ldap_dn_exists "$boxconf_dn"; then ldap_add "$boxconf_dn" <<EOF -objectClass: krbPrincipal +objectClass: account objectClass: simpleSecurityObject -krbPrincipalName: ${boxconf_username}@${realm} +uid: ${boxconf_username} userPassword: {SASL}${boxconf_username}@${realm} EOF - kadmin.local change_password -pw "$boxconf_password" "$boxconf_username" + kadmin.local add_principal -x "dn=${boxconf_dn}" -pw "$boxconf_password" "$boxconf_username" fi diff --git a/scripts/hostclass/invidious_server b/scripts/hostclass/invidious_server new file mode 100644 index 0000000..95333a5 --- /dev/null +++ b/scripts/hostclass/invidious_server @@ -0,0 +1,91 @@ +#!/bin/sh + +# Note: does not work. inv_sig_helper does not build on FreeBSD... + +# Generate using: https://github.com/iv-org/youtube-trusted-session-generator +: ${invidious_po_token:='changeme'} +: ${invidious_visitor_data:='changeme'} + +: ${invidious_username:='s-invidious'} +: ${invidious_password:='changeme'} +: ${invidious_hmac_key:='changemeeeeeeeeeeee'} +: ${invidious_dbname:='invidious'} +: ${invidious_dbhost:="$postgres_host"} +: ${invidious_fqdn:="$fqdn"} +: ${invidious_repo='https://github.com/iv-org/invidious'} +: ${invidious_branch='master'} + +invidious_dn="uid=${invidious_username},${robots_basedn}" +invidious_local_username=$nginx_user +invidious_home=/usr/local/invidious +invidious_port=8080 +invidious_repo_dir="${invidious_home}/invidious.git" +invidious_https_cert="${nginx_conf_dir}/invidious.crt" +invidious_https_key="${nginx_conf_dir}/invidious.key" +invidious_signature_sock=/tmp/inv_sig_helper.sock + +# Install required packages. +pkg install -y \ + ca_root_nss \ + git \ + crystal \ + shards \ + sqlite3 \ + nginx \ + postgresql${postgresql_version}-client \ + rust + +# Create invidious user account. +ldap_add "$invidious_dn" <<EOF +objectClass: account +objectClass: simpleSecurityObject +uid: ${invidious_username} +userPassword: {SSHA-512} +EOF + +# Set LDAP password for invidious user. +ldap_passwd "$invidious_dn" "$invidious_password" + +# Create postgres user and database. +postgres_create_role "$invidious_dbhost" "$invidious_username" +postgres_create_database "$invidious_dbhost" "$invidious_dbname" "$invidious_username" + +# Clone git repo. +install_directory -o "$invidious_local_username" -g "$invidious_local_username" -m 0775 "$invidious_home" +[ -d "${invidious_repo_dir}" ] || su -m "$invidious_local_username" -c "git clone ${invidious_repo} ${invidious_repo_dir}" + +# Update git repo. +su -m "$invidious_local_username" -c "git -C ${invidious_repo_dir} pull --ff-only" +su -m "$invidious_local_username" -c "git -C ${invidious_repo_dir} switch ${invidious_branch}" + +# Build invidious. +( cd "$invidious_repo_dir" + su -m "$invidious_local_username" -c "HOME=${invidious_home} shards install --production" + su -m "$invidious_local_username" -c "HOME=${invidious_home} crystal build src/invidious.cr --release" +) + +# Copy invidious configuration. +install_template -o "$invidious_local_username" -g "$invidious_local_username" -m 0600 "${invidious_repo_dir}/config/config.yml" + +# Copy invidious rc script. +install_file -m 0555 /usr/local/etc/rc.d/invidious + +# Copy TLS certificate for nginx. +install_certificate invidious "$invidious_https_cert" +install_certificate_key invidious "$invidious_https_key" + +# Generate nginx configuration. +install_template -m 0644 \ + /usr/local/etc/nginx/nginx.conf \ + /usr/local/etc/nginx/vhosts.conf + +# Start daemons. +sysrc -v \ + invidious_enable=YES \ + nginx_enable=YES +service invidious restart +service nginx restart + +# Copy invidous auto-update script. +install_file -m 0555 /usr/local/libexec/invidious-update +install_template -m 0644 /etc/cron.d/invidious diff --git a/scripts/hostclass/laptop b/scripts/hostclass/laptop index 26f9fe6..dba2c5f 100644 --- a/scripts/hostclass/laptop +++ b/scripts/hostclass/laptop @@ -1,5 +1,9 @@ #!/bin/sh +# Enable thinkpad hardware features. +load_kernel_module acpi_ibm +set_loader_conf acpi_ibm_load=YES + # Set USB power savings usbconfig | awk -F: '{ print $1 }' | xargs -rtn1 -I% usbconfig -d % power_save ||: install_file /etc/rc.local @@ -14,6 +18,19 @@ load_kernel_module if_urndis set_loader_conf if_urndis_load=YES sysrc -v ifconfig_ue0='DHCP' +# Install laptop packages. +pkg install -y networkmgr + +# Misc power saving stuff. +set_loader_conf \ + vfs.zfs.txg.timeout=10 \ + +if [ "$graphics_type" = intel ]; then + set_loader_conf \ + compat.linuxkpi.i915_disable_power_well=1 \ + compat.linuxkpi.i915_enable_dc=2 +fi + case ${wireless_type:-} in iwm*) set_loader_conf \ @@ -28,6 +45,9 @@ case ${wireless_type:-} in ;; esac +# Enable power saving for sound card. +set_sysctl hw.snd.latency=7 + # Configure wireless card. sysrc -v \ create_args_wlan0='country US regdomain FCC' \ diff --git a/scripts/hostclass/nfs_server b/scripts/hostclass/nfs_server new file mode 100644 index 0000000..ce47cfe --- /dev/null +++ b/scripts/hostclass/nfs_server @@ -0,0 +1,47 @@ +#!/bin/sh + +# Jails serving NFS need 'allow.nfsd' option. + +: ${nfsuserd_cache_size:='256'} +: ${nfsuserd_num_servers:='4'} +: ${nfsuserd_cache_timeout:='1'} +: ${nfsd_srvmaxio:='1048576'} + +nfs_root=/share +nfs_dataset="${state_dataset}/nfs" + +# Create ZFS dataset for NFS share. +create_dataset -o "mountpoint=${nfs_root}" "${nfs_dataset}" + +# Create nfs service principal and keytab. +add_principal -nokey -x "containerdn=${services_basedn}" "nfs/${fqdn}" +ktadd -k "${keytab_dir}/host.keytab" "nfs/${fqdn}" + +if [ "$BOXCONF_VIRTUALIZATION_TYPE" != jail ]; then + set_sysctl \ + vfs.nfsd.issue_delegations=1 \ + vfs.nfsd.enable_locallocks=0 +fi + +sysrc -v \ + nfs_server_managegids=YES \ + nfsuserd_enable=YES \ + nfsuserd_flags="-usermax ${nfsuserd_cache_size} -usertimeout ${nfsuserd_cache_timeout} ${nfsuserd_num_servers}" \ + gssd_enable=YES \ + nfs_server_enable=YES \ + nfs_server_flags='-t' \ + nfs_server_maxio="$nfsd_srvmaxio" \ + nfsv4_server_only=YES \ + mountd_enable=YES \ + mountd_flags='-R -S' + +# Our krb5.conf assumes MIT Kerberos, but the gssd in base uses the base +# Heimdal kerberos, which doesnt support %{euid} expansion. So we must +# override the keytab path with an environment variable. +sysrc -v gssd_env="KRB5_KTNAME=${keytab_dir}/host.keytab" + +install_template -m 0644 /etc/exports + +for service in gssd nfsuserd mountd nfsd; do + service "$service" restart +done diff --git a/scripts/hostclass/pkg_repository b/scripts/hostclass/pkg_repository index 6070794..7226b77 100644 --- a/scripts/hostclass/pkg_repository +++ b/scripts/hostclass/pkg_repository @@ -9,6 +9,8 @@ : ${poudriere_ccache_size:='50.0G'} : ${poudriere_default_versions:='imagemagick=7-nox11'} +poudriere_https_cert="${nginx_conf_dir}/poudriere.crt" +poudriere_https_key="${nginx_conf_dir}/poudriere.key" poudriere_data_dir=/usr/local/poudriere poudriere_conf_dir=/usr/local/etc/poudriere.d poudriere_patch_dir="${poudriere_conf_dir}/patches" @@ -42,10 +44,15 @@ install_directory -m 0755 /usr/ports/distfiles install_directory -m 0755 -o nobody -g nobody "${poudriere_data_dir}/ccache" install_template -m 0644 -o nobody -g nobody "${poudriere_data_dir}/ccache/ccache.conf" +# Copy TLS certificate for nginx. +install_certificate nginx "$poudriere_https_cert" +install_certificate_key nginx "$poudriere_https_key" + # Configure and enable nginx to serve the packages. install_template -m 0644 \ /usr/local/etc/nginx/nginx.conf \ /usr/local/etc/nginx/vhosts.conf + sysrc -v nginx_enable=YES service nginx restart @@ -59,7 +66,8 @@ poudriere ports -v -u -p latest install_directory -m 0755 "$poudriere_patch_dir" rm -f "${poudriere_patch_dir}/"*.patch install_file -m 0644 \ - "${poudriere_patch_dir}/postgresql16-gssapi.patch" + "${poudriere_patch_dir}/postgresql16-gssapi.patch" \ + "${poudriere_patch_dir}/chromium-gssapi.patch" for patch in "${poudriere_patch_dir}/"*.patch; do [ -f "$patch" ] || continue diff --git a/scripts/hostclass/postgresql_server b/scripts/hostclass/postgresql_server index fb0ddcd..10bafc8 100644 --- a/scripts/hostclass/postgresql_server +++ b/scripts/hostclass/postgresql_server @@ -8,7 +8,10 @@ : ${postgres_maintenance_work_mem:="$(( memsize / 20 ))"} : ${postgres_temp_buffers:="$((32 * 1024 * 1024))"} : ${postgres_effective_cache_size:="$(( memsize * 3 / 4 ))"} +: ${postgres_ldap_username:='s-postgresql'} +: ${postgres_ldap_password:='changeme'} +postgres_dn="uid=${postgres_ldap_username},${robots_basedn}" postgres_user=postgres postgres_home=/var/db/postgres postgres_data_dir="${postgres_home}/data${postgresql_version}" @@ -16,10 +19,6 @@ postgres_tls_cert="${postgres_home}/postgres.crt" postgres_tls_key="${postgres_home}/postgres.key" postgres_keytab="${keytab_dir}/postgres.keytab" -psql(){ - command psql --quiet --no-align --echo-all --tuples-only --no-password --username=postgres --dbname=postgres "$@" -} - pkg install -y postgresql${postgresql_version}-server # Create ZFS dataset for postgresql data. @@ -46,8 +45,16 @@ postgres_uid=$(id -u "$postgres_user") install_directory -o "$postgres_user" -m 0700 "/var/krb5/user/${postgres_uid}" ln -snfv "$postgres_keytab" "/var/krb5/user/${postgres_uid}/keytab" -# Create postgresql PAM service. -install_template -m 0644 /etc/pam.d/postgresql +# Create PostgreSQL LDAP user account. +ldap_add "$postgres_dn" <<EOF +objectClass: account +objectClass: simpleSecurityObject +uid: ${postgres_ldap_username} +userPassword: {SSHA-512} +EOF + +# Set LDAP password for PostgreSQL user. +ldap_passwd "$postgres_dn" "$postgres_ldap_password" # Copy TLS certificate for postgres. install_certificate -m 0644 -o root -g "$postgres_user" postgres "$postgres_tls_cert" @@ -63,10 +70,11 @@ install_file -m 0600 -o "$postgres_user" -g "$postgres_user" \ # The postgresql rc script seems to hold onto open descriptors, which causes # the parent boxconf SSH process to never close. echo 'Restarting postgresql.' -service postgresql restart > /dev/null 2>&1 < /dev/null +service postgresql restart > /dev/null 2>&1 < /dev/null || die 'failed to start postgresql' # Create boxconf admin user. -psql -c "DO +psql --quiet --no-align --echo-all --tuples-only --no-password --username=postgres --dbname=postgres -c \ +"DO \$$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${boxconf_username}') THEN @@ -74,4 +82,3 @@ BEGIN END IF; END \$$" - diff --git a/scripts/hostclass/radius_server b/scripts/hostclass/radius_server new file mode 100644 index 0000000..bde1be2 --- /dev/null +++ b/scripts/hostclass/radius_server @@ -0,0 +1,56 @@ +#!/bin/sh + +# radius_clients=client1 +# radius_client1_address='192.168.1.0/24' +# radius_client1_secret='s3cret' + +: ${radius_clients=''} + +freeradius_user=freeradius +freeradius_conf_dir=/usr/local/etc/raddb +freeradius_tls_cert="${freeradius_conf_dir}/freeradius.crt" +freeradius_tls_key="${freeradius_conf_dir}/freeradius.key" +freeradius_cache_dir=/var/cache/radiusd +freeradius_tlscache_dir="${freeradius_cache_dir}/tlscache" + +# Install packages. +pkg install -y freeradius3 + +freeradius_version=$(pkg info freeradius3 | awk '$1 == "Version" { print $3 }') + +# Generate configuration. +install_directory -m 0755 "${freeradius_conf_dir}/certs" +install_template -o "$freeradius_user" -g "$freeradius_user" -m 0640 \ + "${freeradius_conf_dir}/radiusd.conf" \ + "${freeradius_conf_dir}/mods-available/eap" +rm -f "${freeradius_conf_dir}/sites-enabled/inner-tunnel" + +# Copy TLS certificate for freeradius. +install_certificate -g "$freeradius_user" freeradius "$freeradius_tls_cert" +install_certificate_key -g "$freeradius_user" freeradius "$freeradius_tls_key" + +# Generate clients.conf. +install -Cv -o "$freeradius_user" -g "$freeradius_user" -m 0660 /dev/null "${freeradius_conf_dir}/clients.conf" +for client_name in $radius_clients; do + eval "client_address=\$radius_${client_name}_address" + eval "client_secret=\$radius_${client_name}_secret" + cat <<EOF >> "${freeradius_conf_dir}/clients.conf" +client ${client_name} { + ipaddr = ${client_address} + secret = ${client_secret} +} + +EOF +done + +# Create cache directories. +install_directory -o "$freeradius_user" -g "$freeradius_user" -m 700 \ + "$freeradius_cache_dir" \ + "$freeradius_tlscache_dir" + +# Clean up tlscache with cron job. +install_template -m 0644 /etc/cron.d/freeradius + +# Enable and start daemons. +sysrc -v radiusd_enable=YES +service radiusd restart diff --git a/scripts/hostclass/smtp_server/10-rspamd b/scripts/hostclass/smtp_server/10-rspamd index 1794e04..7b1aae9 100644 --- a/scripts/hostclass/smtp_server/10-rspamd +++ b/scripts/hostclass/smtp_server/10-rspamd @@ -77,8 +77,8 @@ install_template -m 0640 -g "$rspamd_user" \ printf '%s\n' ${rspamd_domain_whitelist} | tee "${rspamd_conf_dir}/local.d/maps.d/domain-whitelist.map" # Copy DKIM keys. -for domain in $postfix_virtual_domains; do - install_file -m 0640 -g "$rspamd_user" "${rspamd_data_dir}/dkim/${domain}.key" +for _domain in $postfix_virtual_domains; do + install_file -m 0640 -g "$rspamd_user" "${rspamd_data_dir}/dkim/${_domain}.key" done # Add rspamd user to redis group, so it can write to the redis unix socket. diff --git a/scripts/hostclass/unifi_controller b/scripts/hostclass/unifi_controller new file mode 100644 index 0000000..32df063 --- /dev/null +++ b/scripts/hostclass/unifi_controller @@ -0,0 +1,40 @@ +#!/bin/sh + +unifi_user=unifi +unifi_home=/usr/local/share/java/unifi +unifi_https_cert="${unifi_home}/data/unifi.crt" +unifi_https_key="${unifi_home}/data/unifi.key" +unifi_keystore="${unifi_home}/data/keystore" + +# Install required packages. +pkg install -y unifi8 + +# Create ZFS dataset for unifi data. +create_dataset -o "mountpoint=${unifi_home}/data" "${state_dataset}/unifi" + +# Set ownership on unifi data dir. +install_directory -o "$unifi_user" -g "$unifi_user" -m 0700 "${unifi_home}/data" + +# Copy TLS certificate for unifi. +install_certificate -g "$unifi_user" unifi "$unifi_https_cert" +install_certificate_key -m 0640 -g "$unifi_user" unifi "$unifi_https_key" + +# Enable unifi. +sysrc -v unifi_enable=YES + +# Stop the unifi service. +service unifi status && service unifi stop + +# Add HTTPS certificate to unifi keystore. +[ -f "${unifi_home}/data/keystore" ] || install -Cv -o "$unifi_user" -g "$unifi_user" -m 0600 /dev/null "${unifi_home}/data/keystore" +su -m "$unifi_user" -c "java -jar ${unifi_home}/lib/ace.jar import_key_cert ${unifi_https_key} ${unifi_https_cert} ${site_cacert_path}" + +# Disable analytics. +install_directory -m 0640 -o "$unifi_user" -g "$unifi_user" \ + "${unifi_home}/data/sites" \ + "${unifi_home}/data/sites/default" +grep -xFq 'config.system_cfg.1=system.analytics.anonymous=disabled' "${unifi_home}/data/sites/default/config.properties" \ + || echo 'config.system_cfg.1=system.analytics.anonymous=disabled' | tee -a "${unifi_home}/data/sites/default/config.properties" + +# Start unifi. +service unifi start diff --git a/scripts/hostname/nfs1 b/scripts/hostname/nfs1 new file mode 100644 index 0000000..98d5bcc --- /dev/null +++ b/scripts/hostname/nfs1 @@ -0,0 +1,29 @@ +#!/bin/sh + +homedir_priv_quota=250G +homedir_pub_quota=10G + +create_dataset "${nfs_dataset}/user" +create_dataset "${nfs_dataset}/group" + +for user in ${nfs_homedirs:-}; do + create_dataset "${nfs_dataset}/user/${user}" + create_dataset "${nfs_dataset}/user/${user}/priv" + create_dataset "${nfs_dataset}/user/${user}/pub" + + zfs set "refquota=${homedir_priv_quota}" "${nfs_dataset}/user/${user}/priv" + zfs set "refquota=${homedir_pub_quota}" "${nfs_dataset}/user/${user}/pub" + + chown "${user}:${user}" \ + "${nfs_root}/user/${user}/priv" \ + "${nfs_root}/user/${user}/pub" + + chmod 700 "${nfs_root}/user/${user}/priv" + chmod 755 "${nfs_root}/user/${user}/pub" +done + + ldap_add "automountKey=*,automountMapName=auto_home,${automount_basedn}" <<EOF +objectClass: automount +automountKey: * +automountInformation: -nfsv4,gssname=host,sec=krb5p ${fqdn}:/user/&/priv +EOF diff --git a/scripts/os/freebsd/10-cpu b/scripts/os/freebsd/10-cpu index adc27d4..ea2afcf 100644 --- a/scripts/os/freebsd/10-cpu +++ b/scripts/os/freebsd/10-cpu @@ -19,6 +19,8 @@ sysrc -v \ performance_cx_lowest="$cx_lowest" \ economy_cx_lowest="$cx_lowest" +set_loader_conf machdep.hwpstate_pkg_ctrl=0 + # Set energy/performance preference for Intel P-states. # 0 = most performance, 100 = most power savings if sysctl -n dev.hwpstate_intel.0.epp >/dev/null 2>&1; then diff --git a/scripts/os/freebsd/10-sysctls b/scripts/os/freebsd/10-sysctls index 865544a..b07a46c 100644 --- a/scripts/os/freebsd/10-sysctls +++ b/scripts/os/freebsd/10-sysctls @@ -70,6 +70,8 @@ if [ "$BOXCONF_VIRTUALIZATION_TYPE" != jail ]; then security.bsd.see_other_gids="$see_other_uids" \ security.bsd.see_other_uids="$see_other_uids" \ security.bsd.unprivileged_read_msgbuf=0 \ + vfs.nfsd.enable_locallocks=0 \ + vfs.nfsd.issue_delegations=1 \ vfs.zfs.min_auto_ashift=12 # FreeBSD automatically scales kern.maxfilesperproc with the amount of memory. diff --git a/scripts/os/freebsd/20-zfs b/scripts/os/freebsd/20-zfs index aa37c0a..1cdc465 100644 --- a/scripts/os/freebsd/20-zfs +++ b/scripts/os/freebsd/20-zfs @@ -3,7 +3,7 @@ # Every host should have a "state" dataset, which is a ZFS dataset which # persists across OS rebuilds. [ -n "${state_dataset:-}" ] || die 'state_dataset not defined!' -create_dataset "$state_dataset" +create_dataset -o mountpoint=none "$state_dataset" # If this is baremetal host or a VM, trim the zpools periodically. if [ "$BOXCONF_VIRTUALIZATION_TYPE" != jail ]; then diff --git a/scripts/os/freebsd/50-idm b/scripts/os/freebsd/50-idm index d9c2541..0a9e882 100644 --- a/scripts/os/freebsd/50-idm +++ b/scripts/os/freebsd/50-idm @@ -20,7 +20,8 @@ pkg install -y \ # Configure PAM/NSS integration. install_file -m 0644 \ /etc/nsswitch.conf \ - /etc/pam.d/sshd + /etc/pam.d/sshd \ + /etc/pam.d/sudo install_template -m 0644 \ /etc/krb5.conf \ @@ -114,7 +115,11 @@ install_file -m 0555 \ /usr/local/libexec/idm-ssh-authorized-keys # Create user for running SSH AuthorizedKeysCommand. -add_user -u "$ssh_authzkeys_uid" -g "$host_keytab_groupname" "$ssh_authzkeys_username" +add_user \ + -u "$ssh_authzkeys_uid" \ + -g "$host_keytab_groupname" \ + -d /nonexistent \ + "$ssh_authzkeys_username" # Enable and start nslcd/nscd. sysrc -v \ diff --git a/scripts/os/freebsd/51-autofs b/scripts/os/freebsd/51-autofs new file mode 100644 index 0000000..4fe3c52 --- /dev/null +++ b/scripts/os/freebsd/51-autofs @@ -0,0 +1,33 @@ +#!/bin/sh + +# NFS mounts are not supported within jails. +if [ "$BOXCONF_VIRTUALIZATION_TYPE" = jail ] || \ + [ "$BOXCONF_HOSTCLASS" = nfs_server ] || \ + [ "${enable_idm:-}" = false ] || \ + [ "${enable_autofs:-}" = false ]; then + return 0 +fi + +: ${nfsuserd_cache_size:='256'} +: ${nfsuserd_num_servers:='4'} +: ${nfsuserd_cache_timeout:='1'} + +sysrc -v \ + nfsuserd_enable=YES \ + nfsuserd_flags="-usermax ${nfsuserd_cache_size} -usertimeout ${nfsuserd_cache_timeout} ${nfsuserd_num_servers}" \ + gssd_enable=YES \ + gssd_flags='-h -s /tmp' \ + gssd_env="KRB5_KTNAME=${keytab_dir}/host.keytab" + nfs_client_enable=YES \ + nfscbd_enable=NO \ + nfscbd_flags="-p ${nfscbd_port} -P host" \ + autofs_enable=YES + +install_file -m 0644 /etc/auto_master +install_file -m 0555 /usr/local/libexec/idm-autofs-map +ln -snfv /usr/local/libexec/idm-autofs-map /etc/autofs/include + +# No nfscbd: causes kernel panics on FreeBSD 14.1 +for service in gssd nfsclient nfsuserd automount automountd autounmountd; do + service "$service" status || service "$service" start +done diff --git a/vars/common b/vars/common index 92a0c96..d072ea8 100644 --- a/vars/common +++ b/vars/common @@ -58,7 +58,7 @@ tcp_buffer_size=2097152 # suitable for 1 GigE nginx_nofile=2048 nginx_worker_connections=768 -if (( nproc > 4 )); then +if [ "$nproc" -gt 4 ]; then nginx_worker_processes=4 else nginx_worker_processes=$nproc diff --git a/vars/hostclass/cups_server b/vars/hostclass/cups_server new file mode 100644 index 0000000..9c2915a --- /dev/null +++ b/vars/hostclass/cups_server @@ -0,0 +1,3 @@ +#!/bin/sh + +allowed_tcp_ports="ssh http https ipp" diff --git a/vars/hostclass/desktop b/vars/hostclass/desktop new file mode 100644 index 0000000..fe6f4bc --- /dev/null +++ b/vars/hostclass/desktop @@ -0,0 +1,45 @@ +#!/bin/sh + +desktop_common_packages=" +bind-tools +chromium +eclipse +firefox +git +gnupg +krb5 +libreoffice +libva-intel-media-driver +password-store +py${python_version}-pip +signal-desktop +stow +terminus-font +terminus-ttf +tmux +tree +wireguard-tools +xorg" + +desktop_kde_packages=' +dino +gajim +juk +k3b +kde5 +kid3-qt6 +kmix +konversation +sddm' + +desktop_i3_packages=' +compton +dunst +dmenu +i3 +i3lock +i3status +profanity +xfontsel +xidle +xterm' diff --git a/vars/hostclass/invidious_server b/vars/hostclass/invidious_server new file mode 100644 index 0000000..5ae7588 --- /dev/null +++ b/vars/hostclass/invidious_server @@ -0,0 +1,3 @@ +#!/bin/sh + +allowed_tcp_ports="ssh http https" diff --git a/vars/hostclass/laptop b/vars/hostclass/laptop new file mode 120000 index 0000000..8714ca2 --- /dev/null +++ b/vars/hostclass/laptop @@ -0,0 +1 @@ +desktop
\ No newline at end of file diff --git a/vars/hostclass/nfs_server b/vars/hostclass/nfs_server new file mode 100644 index 0000000..2957aec --- /dev/null +++ b/vars/hostclass/nfs_server @@ -0,0 +1,3 @@ +#!/bin/sh + +allowed_tcp_ports='ssh nfsd' diff --git a/vars/hostclass/pkg_repository b/vars/hostclass/pkg_repository index 4752685..e60a0c4 100644 --- a/vars/hostclass/pkg_repository +++ b/vars/hostclass/pkg_repository @@ -1,4 +1,4 @@ #!/bin/sh -allowed_tcp_ports='ssh http' +allowed_tcp_ports='ssh http https' nginx_redirect=false diff --git a/vars/hostclass/radius_server b/vars/hostclass/radius_server new file mode 100644 index 0000000..1354ecd --- /dev/null +++ b/vars/hostclass/radius_server @@ -0,0 +1,3 @@ +#!/bin/sh + +allowed_udp_ports="radius" diff --git a/vars/hostclass/roadwarrior_laptop/desktop b/vars/hostclass/roadwarrior_laptop/desktop new file mode 120000 index 0000000..2c7c348 --- /dev/null +++ b/vars/hostclass/roadwarrior_laptop/desktop @@ -0,0 +1 @@ +../desktop
\ No newline at end of file diff --git a/vars/hostclass/roadwarrior_laptop b/vars/hostclass/roadwarrior_laptop/vars index 45bade8..712d724 100644 --- a/vars/hostclass/roadwarrior_laptop +++ b/vars/hostclass/roadwarrior_laptop/vars @@ -1,4 +1,6 @@ #!/bin/sh + resolvers=$bootstrap_resolvers pf_skip_interfaces=wg see_other_uids=1 +enable_idm=false diff --git a/vars/hostclass/unifi_controller b/vars/hostclass/unifi_controller new file mode 100644 index 0000000..d937b0d --- /dev/null +++ b/vars/hostclass/unifi_controller @@ -0,0 +1,8 @@ +#!/bin/sh + +allowed_tcp_ports='ssh 6789 8080 8443 8843 8880' +allowed_udp_ports='3478 10001' + +redirect_tcp_ports=' +https 8443 +http 8880' diff --git a/vars/hostname/invidious1 b/vars/hostname/invidious1 new file mode 100644 index 0000000..f06a891 --- /dev/null +++ b/vars/hostname/invidious1 @@ -0,0 +1,4 @@ +#!/bin/sh + +cnames=invidious +invidious_fqdn="invidious.${domain}" diff --git a/vars/hostname/nfs1 b/vars/hostname/nfs1 new file mode 100644 index 0000000..3ea50e6 --- /dev/null +++ b/vars/hostname/nfs1 @@ -0,0 +1,3 @@ +#!/bin/sh + +cnames=nfs diff --git a/vars/hostname/radius1 b/vars/hostname/radius1 new file mode 100644 index 0000000..5d5380e --- /dev/null +++ b/vars/hostname/radius1 @@ -0,0 +1,3 @@ +#!/bin/sh + +cnames='radius' diff --git a/vars/hostname/unifi1 b/vars/hostname/unifi1 new file mode 100644 index 0000000..7c418d9 --- /dev/null +++ b/vars/hostname/unifi1 @@ -0,0 +1,3 @@ +#!/bin/sh + +cnames=unifi diff --git a/scripts/hostname/znc1 b/vars/hostname/znc1 index dc11b11..dc11b11 100644 --- a/scripts/hostname/znc1 +++ b/vars/hostname/znc1 |