mirror of
https://github.com/deadcxap/init_scripts.git
synced 2026-07-02 05:43:40 +03:00
257 lines
8.6 KiB
Bash
257 lines
8.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
LOG_FILE=/var/log/core_setup.log
|
|
exec > >(tee -a "$LOG_FILE") 2>&1
|
|
|
|
log() {
|
|
echo "[$(date +'%Y-%m-%d %H:%M:%S')] $*"
|
|
}
|
|
|
|
SUMMARY=()
|
|
|
|
run() {
|
|
local desc="$1"
|
|
shift
|
|
log "$desc"
|
|
if "$@"; then
|
|
log "OK: $desc"
|
|
SUMMARY+=("$desc: OK")
|
|
else
|
|
local rc=$?
|
|
log "ERROR: $desc (code $rc)"
|
|
SUMMARY+=("$desc: ERROR")
|
|
exit $rc
|
|
fi
|
|
}
|
|
|
|
print_summary() {
|
|
echo "\n==== Итоговая сводка ===="
|
|
for item in "${SUMMARY[@]}"; do
|
|
echo "$item"
|
|
done
|
|
}
|
|
|
|
cleanup() {
|
|
local rc=$?
|
|
if [[ $rc -ne 0 ]]; then
|
|
log "Скрипт завершился с ошибкой (код $rc)"
|
|
else
|
|
log "Скрипт завершился успешно"
|
|
fi
|
|
print_summary
|
|
}
|
|
|
|
trap 'log "Ошибка (код $?) на строке $LINENO"' ERR
|
|
trap cleanup EXIT
|
|
|
|
usage() {
|
|
cat <<USAGE
|
|
Usage: $0 --user NAME --sshkey KEY [options]
|
|
-u, --user New user to create with passwordless sudo
|
|
-k, --sshkey Public SSH key string (e.g., "ssh-rsa AAAA...")
|
|
-s, --ssh-ip IP (optional) IP allowed to access SSH
|
|
-m, --monitor-ip IP (optional) IP allowed to access Beszel port 45876/tcp
|
|
-v, --vector URL (optional) URL of Vector sink
|
|
-c, --compose-url URL (optional) URL of docker-compose.yaml
|
|
-d, --compose-dir DIR (optional) Directory to place compose file
|
|
-n, --netbird-key KEY (optional) Netbird setup key
|
|
-i, --netbird-ip IP (optional) Netbird central server IP
|
|
-p, --netbird-port PORT (optional) Netbird central server port
|
|
USAGE
|
|
}
|
|
|
|
USERNAME=""
|
|
SSH_KEY=""
|
|
SSH_ALLOWED_IP=""
|
|
MONITOR_IP=""
|
|
VECTOR_ENDPOINT=""
|
|
COMPOSE_URL=""
|
|
COMPOSE_DIR=""
|
|
NETBIRD_KEY=""
|
|
NETBIRD_IP=""
|
|
NETBIRD_PORT=""
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-u|--user) USERNAME="$2"; shift 2;;
|
|
-k|--sshkey) SSH_KEY="$2"; shift 2;;
|
|
-s|--ssh-ip) SSH_ALLOWED_IP="$2"; shift 2;;
|
|
-m|--monitor-ip) MONITOR_IP="$2"; shift 2;;
|
|
-v|--vector) VECTOR_ENDPOINT="$2"; shift 2;;
|
|
-c|--compose-url) COMPOSE_URL="$2"; shift 2;;
|
|
-d|--compose-dir) COMPOSE_DIR="$2"; shift 2;;
|
|
-n|--netbird-key) NETBIRD_KEY="$2"; shift 2;;
|
|
-i|--netbird-ip) NETBIRD_IP="$2"; shift 2;;
|
|
-p|--netbird-port) NETBIRD_PORT="$2"; shift 2;;
|
|
-h|--help) usage; exit 0;;
|
|
*) log "Unknown parameter: $1"; usage; exit 1;;
|
|
esac
|
|
done
|
|
|
|
if [[ -z "$USERNAME" || -z "$SSH_KEY" ]]; then
|
|
usage
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -n "$COMPOSE_URL" && -z "$COMPOSE_DIR" ]] || [[ -z "$COMPOSE_URL" && -n "$COMPOSE_DIR" ]]; then
|
|
log "Both --compose-url and --compose-dir must be provided together"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ $(id -u) -ne 0 ]]; then
|
|
echo "This script must be run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
install_packages() {
|
|
run "Updating package index" apt-get update -y
|
|
run "Installing base packages" apt-get install -y sudo curl wget git ufw logrotate unattended-upgrades ca-certificates gnupg lsb-release apt-transport-https
|
|
}
|
|
|
|
setup_timezone() {
|
|
run "Setting timezone to Europe/Moscow" timedatectl set-timezone Europe/Moscow
|
|
}
|
|
|
|
setup_unattended_upgrades() {
|
|
run "Configuring unattended upgrades" bash -c "cat >/etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
|
|
APT::Periodic::Update-Package-Lists \"1\";
|
|
APT::Periodic::Download-Upgradeable-Packages \"1\";
|
|
APT::Periodic::AutocleanInterval \"7\";
|
|
APT::Periodic::Unattended-Upgrade \"1\";
|
|
EOF"
|
|
run "Enabling unattended upgrades" systemctl enable --now unattended-upgrades.service
|
|
}
|
|
|
|
create_user() {
|
|
run "Creating user $USERNAME" bash -c "id '$USERNAME' >/dev/null 2>&1 || adduser --disabled-password --gecos '' '$USERNAME'"
|
|
run "Granting sudo privileges to $USERNAME" bash -c "usermod -aG sudo '$USERNAME' && printf '%s ALL=(ALL) NOPASSWD:ALL\\n' '$USERNAME' >/etc/sudoers.d/90-$USERNAME"
|
|
}
|
|
|
|
configure_ssh() {
|
|
run "Configuring SSH access" bash -c "install -d -m 700 /home/$USERNAME/.ssh && cat >/home/$USERNAME/.ssh/authorized_keys <<'KEY'
|
|
$SSH_KEY
|
|
KEY
|
|
chmod 600 /home/$USERNAME/.ssh/authorized_keys && chown -R '$USERNAME':'$USERNAME' /home/$USERNAME/.ssh && sed -i 's/^#\\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config && sed -i 's/^#\\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && systemctl restart sshd"
|
|
run "Checking SSH configuration" bash -c "sshd -T | grep -q '^passwordauthentication no' && sshd -T | grep -q '^permitrootlogin no'"
|
|
}
|
|
|
|
configure_ufw() {
|
|
run "Resetting UFW" ufw --force reset
|
|
run "Setting UFW defaults" bash -c "ufw default deny incoming && ufw default allow outgoing"
|
|
run "Allow HTTPS" ufw allow 443/tcp comment 'HTTPS'
|
|
if [[ -n "$SSH_ALLOWED_IP" ]]; then
|
|
run "Allow SSH from $SSH_ALLOWED_IP" ufw allow from "$SSH_ALLOWED_IP" to any port 22 proto tcp comment 'SSH'
|
|
else
|
|
run "Allow SSH from anywhere" ufw allow 22/tcp comment 'SSH'
|
|
fi
|
|
if [[ -n "$MONITOR_IP" ]]; then
|
|
run "Allow Beszel from $MONITOR_IP" ufw allow from "$MONITOR_IP" to any port 45876 proto tcp comment 'Beszel monitoring'
|
|
fi
|
|
if [[ -n "$NETBIRD_KEY" && -n "$NETBIRD_IP" && -n "$NETBIRD_PORT" ]]; then
|
|
run "Allow Netbird central from $NETBIRD_IP:$NETBIRD_PORT" ufw allow from "$NETBIRD_IP" to any port "$NETBIRD_PORT" proto tcp comment 'Netbird central'
|
|
fi
|
|
run "Enable UFW" ufw --force enable
|
|
run "Checking UFW active" bash -c "ufw status | grep -q 'Status: active'"
|
|
run "Checking UFW SSH rule" bash -c "ufw status | grep -q '22/tcp'"
|
|
run "Checking UFW HTTPS rule" bash -c "ufw status | grep -q '443/tcp'"
|
|
if [[ -n "$MONITOR_IP" ]]; then
|
|
run "Checking UFW Beszel rule" bash -c "ufw status | grep -q '45876/tcp'"
|
|
fi
|
|
if [[ -n "$NETBIRD_KEY" && -n "$NETBIRD_IP" && -n "$NETBIRD_PORT" ]]; then
|
|
run "Checking UFW Netbird rule" bash -c "ufw status | grep -q '$NETBIRD_PORT/tcp'"
|
|
fi
|
|
}
|
|
|
|
install_docker() {
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
run "Installing Docker" bash -c "install -m 0755 -d /etc/apt/keyrings && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg && echo 'deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable' | tee /etc/apt/sources.list.d/docker.list >/dev/null && apt-get update -y && apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin"
|
|
fi
|
|
run "Adding $USERNAME to docker group" usermod -aG docker "$USERNAME"
|
|
run "Checking Docker service" systemctl is-active --quiet docker
|
|
run "Checking Docker CLI" docker --version
|
|
run "Checking docker compose" docker compose version
|
|
run "Checking docker ps" docker ps >/dev/null
|
|
}
|
|
|
|
configure_fail2ban() {
|
|
run "Installing fail2ban" apt-get install -y fail2ban
|
|
run "Configuring fail2ban" bash -c "cat >/etc/fail2ban/jail.local <<'EOF'
|
|
[sshd]
|
|
enabled = true
|
|
bantime = 10m
|
|
findtime = 10m
|
|
maxretry = 3
|
|
EOF"
|
|
run "Enabling fail2ban" systemctl enable --now fail2ban
|
|
}
|
|
|
|
configure_logrotate() {
|
|
run "Configuring logrotate for Docker logs" bash -c "cat >/etc/logrotate.d/docker <<'EOF'
|
|
/var/lib/docker/containers/*/*.log {
|
|
rotate 7
|
|
daily
|
|
compress
|
|
missingok
|
|
delaycompress
|
|
copytruncate
|
|
}
|
|
EOF"
|
|
}
|
|
|
|
install_netbird() {
|
|
[[ -z "$NETBIRD_KEY" ]] && return
|
|
run "Installing Netbird" bash -c "curl -fsSL https://pkgs.netbird.io/install.sh | sh"
|
|
run "Starting Netbird" netbird up --setup-key "$NETBIRD_KEY"
|
|
run "Checking Netbird service" systemctl is-active --quiet netbird
|
|
run "Checking Netbird connection" bash -c "netbird status | grep -qi 'connected'"
|
|
}
|
|
|
|
setup_vector() {
|
|
[[ -z "$VECTOR_ENDPOINT" ]] && return
|
|
if ! command -v vector >/dev/null 2>&1; then
|
|
run "Installing Vector" bash -c "curl -1sLf 'https://repositories.timber.io/public/vector/cfg/setup/bash.deb.sh' | bash && apt-get install -y vector"
|
|
fi
|
|
run "Configuring Vector" bash -c "cat >/etc/vector/vector.toml <<'EOF'
|
|
[sources.syslog]
|
|
type = 'file'
|
|
include = ['/var/log/*.log']
|
|
|
|
[sources.docker]
|
|
type = 'docker_logs'
|
|
|
|
[sinks.out]
|
|
type = 'http'
|
|
inputs = ['syslog', 'docker']
|
|
uri = '$VECTOR_ENDPOINT'
|
|
encoding.codec = 'json'
|
|
EOF"
|
|
run "Enabling Vector" systemctl enable --now vector
|
|
run "Checking Vector service" systemctl is-active --quiet vector
|
|
}
|
|
|
|
setup_compose() {
|
|
[[ -z "$COMPOSE_URL" ]] && return
|
|
run "Creating directory $COMPOSE_DIR" mkdir -p "$COMPOSE_DIR"
|
|
run "Downloading compose file" curl -fsSL "$COMPOSE_URL" -o "$COMPOSE_DIR/docker-compose.yml"
|
|
run "Setting ownership for compose dir" chown -R "$USERNAME:$USERNAME" "$COMPOSE_DIR"
|
|
run "Starting docker compose" bash -c "cd '$COMPOSE_DIR' && docker compose up -d"
|
|
}
|
|
|
|
main() {
|
|
install_packages
|
|
setup_timezone
|
|
setup_unattended_upgrades
|
|
create_user
|
|
configure_ssh
|
|
configure_ufw
|
|
install_docker
|
|
configure_fail2ban
|
|
configure_logrotate
|
|
install_netbird
|
|
setup_vector
|
|
setup_compose
|
|
}
|
|
|
|
main
|