95 lines
3.4 KiB
Bash
Executable File
95 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
echo "=== [1/5] Configuring Debian Repositories for OpenZFS DKMS ==="
|
|
# Enable contrib and non-free-firmware for zfs-dkms
|
|
sed -i 's/Components: main/Components: main contrib non-free-firmware/g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
|
|
sed -i 's/main$/main contrib non-free-firmware/g' /etc/apt/sources.list 2>/dev/null || true
|
|
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends linux-headers-amd64 zfsutils-linux zfs-dkms
|
|
|
|
# Pre-compile DKMS modules during bake time so first boot has zero compilation delay
|
|
systemctl enable zfs-import-cache zfs-import.target zfs.target || true
|
|
|
|
echo "=== [2/5] Installing Docker CE from Official Debian Repository ==="
|
|
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do
|
|
apt-get remove -y "$pkg" 2>/dev/null || true
|
|
done
|
|
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
|
|
chmod a+r /etc/apt/keyrings/docker.asc
|
|
|
|
echo \
|
|
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
|
|
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
|
tee /etc/apt/sources.list.d/docker.list > /dev/null
|
|
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
|
|
|
mkdir -p /srv/docker
|
|
cat << 'EOF_DOCKER' > /etc/docker/daemon.json
|
|
{
|
|
"data-root": "/srv/docker",
|
|
"log-driver": "json-file",
|
|
"log-opts": {
|
|
"max-size": "20m",
|
|
"max-file": "3"
|
|
}
|
|
}
|
|
EOF_DOCKER
|
|
systemctl enable docker.service containerd.service
|
|
|
|
echo "=== [3/5] Installing and Configuring UFW + ufw-docker ==="
|
|
apt-get install -y --no-install-recommends ufw iptables
|
|
|
|
curl -fsSL https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker -o /usr/local/bin/ufw-docker
|
|
chmod +x /usr/local/bin/ufw-docker
|
|
|
|
# Pre-configure firewall baseline (keep port 22 open during build for Packer SSH session)
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
ufw default allow routed
|
|
ufw allow 22/tcp comment 'SSH default for builder'
|
|
ufw allow 2222/tcp comment 'SSH for Apex'
|
|
ufw --force enable
|
|
|
|
# Set up ufw-docker routing in after.rules (now that UFW is active)
|
|
/usr/local/bin/ufw-docker install || true
|
|
|
|
# Symlink into adam ~/.local/bin for engine compatibility
|
|
mkdir -p /etc/skel/.local/bin
|
|
ln -sf /usr/local/bin/ufw-docker /etc/skel/.local/bin/ufw-docker
|
|
|
|
echo "=== [4/5] Hardening SSH Configuration ==="
|
|
mkdir -p /etc/ssh/sshd_config.d
|
|
cat << 'EOF_SSH' > /etc/ssh/sshd_config.d/99-apex.conf
|
|
Port 2222
|
|
PasswordAuthentication no
|
|
PermitEmptyPasswords no
|
|
KbdInteractiveAuthentication no
|
|
X11Forwarding no
|
|
AllowUsers adam
|
|
EOF_SSH
|
|
|
|
echo "=== [5/5] Installing CrowdSec ==="
|
|
# PackageCloud does not publish a dedicated 'trixie' suite yet; bookworm suite works seamlessly on Debian 13
|
|
export os=debian
|
|
export dist=bookworm
|
|
if curl -fsSL https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | bash; then
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends crowdsec crowdsec-firewall-bouncer-iptables
|
|
else
|
|
echo "PackageCloud script failed, falling back to Debian native repository..."
|
|
rm -f /etc/apt/sources.list.d/crowdsec*.list
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends crowdsec crowdsec-firewall-bouncer-iptables || \
|
|
apt-get install -y --no-install-recommends crowdsec
|
|
fi
|
|
|
|
echo "=== Docker, ZFS & Security Stack Complete ==="
|