🔧 master: work in progress [might break]
This commit is contained in:
commit
70db1934be
6 changed files with 351 additions and 0 deletions
149
admin
Executable file
149
admin
Executable file
|
|
@ -0,0 +1,149 @@
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# curlcheck: https://playterm.org
|
||||||
|
# curlcheck: https://electribrary.electribers.com
|
||||||
|
# curlcheck: https://2wa.isvery.ninja
|
||||||
|
|
||||||
|
disk(){
|
||||||
|
space(){
|
||||||
|
df -h | awk '$6 ~ /^\/$/ {print $3" total used ("$5") of "$4}'
|
||||||
|
#echo '-------'
|
||||||
|
#ls /home | while read user; do du -hs /home/$user; done
|
||||||
|
}
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
health(){
|
||||||
|
echo "URL ONLINE SSL TIME"
|
||||||
|
echo "- - - -"
|
||||||
|
awk '/^# curlcheck: / {print $3}' $0 | while read url; do
|
||||||
|
printf "%s" "$url" | sed 's|.*://||g'
|
||||||
|
curl -v -w 'Total: %{time_total}s\n' ${url} 2>&1 | \
|
||||||
|
awk '
|
||||||
|
BEGIN{
|
||||||
|
err="\033[5m\033[36;5;94m❌\033[0m"
|
||||||
|
ok="\033[1;36m♥\033[0m"
|
||||||
|
c["SSL"]=err
|
||||||
|
c["ONL"]=ok
|
||||||
|
c["TIM"]="?"
|
||||||
|
}
|
||||||
|
/SSL certificate verify ok/ {c["SSL"]=ok }
|
||||||
|
/Could not resolve host:/ {c["ONL"]=err }
|
||||||
|
/^Total: / {c["TIM"]=$2 }
|
||||||
|
END { printf "\r\t\t\t\t"c["ONL"]" "c["SSL"]" "c["TIM"]"\n" }
|
||||||
|
'
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
init(){
|
||||||
|
grep ulimit /etc/profile || echo 'ulimit -n 65535 || true' >> /etc/profile # compensate alpine's low fd's
|
||||||
|
}
|
||||||
|
|
||||||
|
proxy(){
|
||||||
|
install(){
|
||||||
|
echo -e "\n[forwarded ports]" > .ports
|
||||||
|
iptables -t nat -F # flush
|
||||||
|
iptables -t nat -X # flush
|
||||||
|
iptables -F # flush
|
||||||
|
ip6tables -F -t nat# flush
|
||||||
|
ip6tables -F # flush
|
||||||
|
ip6tables -X # flush
|
||||||
|
ip6tables -t nat -F
|
||||||
|
ip6tables -t nat -X
|
||||||
|
ip_external=$(curl -s https://checkip.amazonaws.com)
|
||||||
|
ipv6_external=$(ip addr | awk '/inet6.*scope global/ { print $2 }')
|
||||||
|
# proxies
|
||||||
|
proxyport(){
|
||||||
|
printf " %-5s => %-10s [%s]\n" $1 $2 $3 >> .ports
|
||||||
|
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $1 -j REDIRECT --to-ports $2
|
||||||
|
#ip6tables -t nat -A PREROUTING -i eth0 -p tcp --dport $1 -j REDIRECT --to-ports $2
|
||||||
|
#iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport $1 -j REDIRECT --to-ports $2
|
||||||
|
iptables -t nat -I OUTPUT -p tcp -d $ip_external --dport $1 -j REDIRECT --to-ports $2 # reverse ip
|
||||||
|
#ip6tables -t nat -I OUTPUT -p tcp -d $ipv6_external --dport $1 -j REDIRECT --to-ports $2 # reverse ip
|
||||||
|
ip6tables -A INPUT -p tcp --dport $1 -j ACCEPT
|
||||||
|
ip6tables -A OUTPUT -p tcp --dport $1 -j ACCEPT
|
||||||
|
#iptables -t nat -A POSTROUTING -p tcp --dport $2 -j MASQUERADE
|
||||||
|
#iptables -t nat -A POSTROUTING -p tcp --dport $2 -j MASQUERADE
|
||||||
|
}
|
||||||
|
proxyport 80 8080 nginx-proxy-manager
|
||||||
|
#proxyport 81 8181 nginx-proxy-manager
|
||||||
|
proxyport 443 4443 nginx-proxy-manager
|
||||||
|
#proxyport 993 9993 stalwart-mail
|
||||||
|
#proxyport 25 2225 stalwart-mail
|
||||||
|
#proxyport 465 4465 stalwart-mail
|
||||||
|
#proxyport 587 5587 nodered
|
||||||
|
#proxyport 25 5587 nodered
|
||||||
|
|
||||||
|
# block port 3000 (nginx-proxy-manager exposes it)
|
||||||
|
iptables -A INPUT -p tcp -d $ip_external --dport 3000 -j REJECT
|
||||||
|
ip6tables -A INPUT -p tcp -d $ip_external --dport 3000 -j REJECT --reject-with icmp6-adm-unreach-3
|
||||||
|
|
||||||
|
# block port 25
|
||||||
|
#iptables -A INPUT -p tcp -d $ip_external --dport 25 -j REJECT
|
||||||
|
#ip6tables -A INPUT -p tcp -d $ip_external --dport 25-j REJECT
|
||||||
|
|
||||||
|
# block irc 0.0.0.0:6667 port except for nodered docker
|
||||||
|
iptables -A INPUT -i lo -p tcp --dport 6667 -j ACCEPT
|
||||||
|
iptables -A INPUT -s 10.0.2.2 -p tcp --dport 6667 -j ACCEPT
|
||||||
|
iptables -A INPUT -p tcp --dport 6667 -j REJECT
|
||||||
|
ip6tables -A INPUT -i lo -j ACCEPT
|
||||||
|
ip6tables -A INPUT -s fd00::/64 -p tcp --dport 6667 -j ACCEPT
|
||||||
|
ip6tables -A INPUT -p tcp --dport 6667 -j REJECT
|
||||||
|
|
||||||
|
# rateliming per ip
|
||||||
|
#iptables --new-chain RATE-LIMIT
|
||||||
|
#iptables --append RATE-LIMIT \
|
||||||
|
# --match hashlimit \
|
||||||
|
# --hashlimit-mode srcip \
|
||||||
|
# --hashlimit-upto 50/sec \
|
||||||
|
# --hashlimit-burst 20 \
|
||||||
|
# --hashlimit-name conn_rate_limit \
|
||||||
|
# --jump ACCEPT
|
||||||
|
#iptables --append RATE-LIMIT --jump DROP
|
||||||
|
rc-update add iptables
|
||||||
|
rc-update add ip6tables
|
||||||
|
/etc/init.d/iptables save
|
||||||
|
/etc/init.d/ip6tables save
|
||||||
|
}
|
||||||
|
|
||||||
|
clear
|
||||||
|
"$@"
|
||||||
|
{
|
||||||
|
iptables -t nat -L -n -v
|
||||||
|
iptables -L
|
||||||
|
ip6tables -L
|
||||||
|
} | more
|
||||||
|
cat .ports
|
||||||
|
}
|
||||||
|
|
||||||
|
logs(){
|
||||||
|
tail -qf /home/2wa/nginx-proxy-manager/data/log/*.log | grep -v favicon | sed 's|\] \[.*|]|g'
|
||||||
|
}
|
||||||
|
|
||||||
|
backup(){
|
||||||
|
cd /root
|
||||||
|
echo "$(date) ./admin backup [start]" >> .cron.log
|
||||||
|
BACKUP=backup-2wa.isvery.ninja.zip
|
||||||
|
crontab -l > crontab.root.txt
|
||||||
|
apk list -i > alpine.packages.txt
|
||||||
|
echo "$(su -c 'crontab -l' 2wa)" > crontab.2wa.txt
|
||||||
|
nice -n 19 /usr/bin/ionice -c2 -n7 zip -r $BACKUP \
|
||||||
|
/root/admin /root/crontab.* /root/alpine*.txt /root/.ssh \
|
||||||
|
/home/2wa/.ssh /home/2wa/.config /home/2wa/nginx-proxy-manager/{app.sh,data,*.key} \
|
||||||
|
/home/2wa/weechat-redbean \
|
||||||
|
/home/2wa/invoiceninja \
|
||||||
|
/home/2wa/mailtrain \
|
||||||
|
/home/2wa/stalwart-mail \
|
||||||
|
/home/2wa/node-red \
|
||||||
|
/home/2wa/ntfy \
|
||||||
|
/home/2wa/portsleep* \
|
||||||
|
/home/2wa/tcgi* \
|
||||||
|
/home/2wa/stats \
|
||||||
|
-x '*.log.*' -x '*.weecha*' -x 'postfix/*' | awk '{ printf( "\r"$0 ) } END{ print ""}'
|
||||||
|
ls -lah $BACKUP
|
||||||
|
rclone copy $BACKUP stack:backup/. --progress
|
||||||
|
echo "$(date) ./admin backup [stop]" >> /root/.cron.log
|
||||||
|
}
|
||||||
|
|
||||||
|
test -z $1 && { echo "Usage: "; grep '(){' $0; }
|
||||||
|
"$@"
|
||||||
13
docker-compose.yaml
Normal file
13
docker-compose.yaml
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
# docker-compose.yml
|
||||||
|
services:
|
||||||
|
traefik:
|
||||||
|
image: traefik:v3.6
|
||||||
|
command:
|
||||||
|
- "--api.insecure=true"
|
||||||
|
- "--providers.docker=true"
|
||||||
|
- "--entrypoints.web.address=:80"
|
||||||
|
ports:
|
||||||
|
- "80:80"
|
||||||
|
- "8080:8080"
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
86
glance.yml
Normal file
86
glance.yml
Normal file
|
|
@ -0,0 +1,86 @@
|
||||||
|
server:
|
||||||
|
host: localhost
|
||||||
|
port: 8081
|
||||||
|
pages:
|
||||||
|
- name: Home
|
||||||
|
columns:
|
||||||
|
- size: small
|
||||||
|
widgets:
|
||||||
|
- type: calendar
|
||||||
|
first-day-of-week: monday
|
||||||
|
|
||||||
|
- type: rss
|
||||||
|
limit: 10
|
||||||
|
collapse-after: 3
|
||||||
|
cache: 12h
|
||||||
|
feeds:
|
||||||
|
- url: https://selfh.st/rss/
|
||||||
|
title: selfh.st
|
||||||
|
limit: 4
|
||||||
|
- url: https://ciechanow.ski/atom.xml
|
||||||
|
- url: https://www.joshwcomeau.com/rss.xml
|
||||||
|
title: Josh Comeau
|
||||||
|
- url: https://samwho.dev/rss.xml
|
||||||
|
- url: https://ishadeed.com/feed.xml
|
||||||
|
title: Ahmad Shadeed
|
||||||
|
|
||||||
|
- type: twitch-channels
|
||||||
|
channels:
|
||||||
|
- theprimeagen
|
||||||
|
- j_blow
|
||||||
|
- piratesoftware
|
||||||
|
- cohhcarnage
|
||||||
|
- christitustech
|
||||||
|
- EJ_SA
|
||||||
|
|
||||||
|
- size: full
|
||||||
|
widgets:
|
||||||
|
- type: group
|
||||||
|
widgets:
|
||||||
|
- type: hacker-news
|
||||||
|
- type: lobsters
|
||||||
|
|
||||||
|
- type: videos
|
||||||
|
channels:
|
||||||
|
- UCXuqSBlHAE6Xw-yeJA0Tunw # Linus Tech Tips
|
||||||
|
- UCR-DXc1voovS8nhAvccRZhg # Jeff Geerling
|
||||||
|
- UCsBjURrPoezykLs9EqgamOA # Fireship
|
||||||
|
- UCBJycsmduvYEL83R_U4JriQ # Marques Brownlee
|
||||||
|
- UCHnyfMqiRRG1u-2MsSQLbXA # Veritasium
|
||||||
|
|
||||||
|
- type: group
|
||||||
|
widgets:
|
||||||
|
- type: reddit
|
||||||
|
subreddit: technology
|
||||||
|
show-thumbnails: true
|
||||||
|
- type: reddit
|
||||||
|
subreddit: selfhosted
|
||||||
|
show-thumbnails: true
|
||||||
|
|
||||||
|
- size: small
|
||||||
|
widgets:
|
||||||
|
- type: weather
|
||||||
|
location: London, United Kingdom
|
||||||
|
units: metric
|
||||||
|
hour-format: 12h
|
||||||
|
|
||||||
|
- type: markets
|
||||||
|
markets:
|
||||||
|
- symbol: SPY
|
||||||
|
name: S&P 500
|
||||||
|
- symbol: BTC-USD
|
||||||
|
name: Bitcoin
|
||||||
|
- symbol: NVDA
|
||||||
|
name: NVIDIA
|
||||||
|
- symbol: AAPL
|
||||||
|
name: Apple
|
||||||
|
- symbol: MSFT
|
||||||
|
name: Microsoft
|
||||||
|
|
||||||
|
- type: releases
|
||||||
|
cache: 1d
|
||||||
|
repositories:
|
||||||
|
- glanceapp/glance
|
||||||
|
- go-gitea/gitea
|
||||||
|
- immich-app/immich
|
||||||
|
- syncthing/syncthing
|
||||||
56
process-compose.yaml
Normal file
56
process-compose.yaml
Normal file
|
|
@ -0,0 +1,56 @@
|
||||||
|
mcp_server:
|
||||||
|
host: localhost
|
||||||
|
port: 3000
|
||||||
|
transport: sse
|
||||||
|
|
||||||
|
version: "0.5"
|
||||||
|
disable_env_expansion: true
|
||||||
|
vars:
|
||||||
|
FOO: 1 # {{.FOO}}
|
||||||
|
|
||||||
|
processes:
|
||||||
|
install:
|
||||||
|
disabled: true # run `process-compose run install`
|
||||||
|
command: |
|
||||||
|
util/wget a69b6424cda4887e84247b1e01dbfb36ae613ac2cb37f19e307889db2cecc39b https://github.com/glanceapp/glance/releases/download/v0.8.4/glance-linux-amd64.tar.gz
|
||||||
|
|
||||||
|
paramjob:
|
||||||
|
command: "echo @{foo}"
|
||||||
|
description: "parametrized job"
|
||||||
|
disabled: true # MCP processes must be disabled initially
|
||||||
|
working_dir: "/var/log"
|
||||||
|
mcp:
|
||||||
|
type: tool
|
||||||
|
arguments:
|
||||||
|
- name: foo
|
||||||
|
type: string
|
||||||
|
description: "example arg"
|
||||||
|
required: true
|
||||||
|
|
||||||
|
#job_$next$next1:
|
||||||
|
# command: |
|
||||||
|
# sed -i 's|^ job_| job_$next|g' process-compose.yaml
|
||||||
|
# process-compose project update -f process-compose.yaml
|
||||||
|
|
||||||
|
create_container:
|
||||||
|
command: |
|
||||||
|
ID="$RANDOM$RANDOM"
|
||||||
|
echo "starting $ID"
|
||||||
|
echo curl --data 'log=https://localhost:8080/process/logs/create_container' -X POST https://home.org/created_container/$ID
|
||||||
|
disabled: true # run `curl https://loclahost:8080/process/start/create_container`
|
||||||
|
|
||||||
|
glance:
|
||||||
|
command: pkg/glance
|
||||||
|
availability:
|
||||||
|
restart: on_failure # other options: "exit_on_failure", "always", "no" (default)
|
||||||
|
backoff_seconds: 2 # default: 1
|
||||||
|
max_restarts: 5 # default: 0 (unlimited)
|
||||||
|
readiness_probe:
|
||||||
|
http_get:
|
||||||
|
host: "localhost"
|
||||||
|
port: 8081
|
||||||
|
scheme: "http"
|
||||||
|
period_seconds: 2
|
||||||
|
timeout_seconds: 5
|
||||||
|
success_threshold: 1
|
||||||
|
failure_threshold: 3
|
||||||
30
shell.nix
Normal file
30
shell.nix
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
{ pkgs ? import <nixos-unstable> {} } :
|
||||||
|
{
|
||||||
|
|
||||||
|
#pkgs = import (builtins.fetchGit {
|
||||||
|
# name = "nixos-25.05";
|
||||||
|
# url = "https://github.com/nixos/nixpkgs";
|
||||||
|
# rev = "11cb3517b3af6af300dd6c055aeda73c9bf52c48";
|
||||||
|
#}) {};
|
||||||
|
|
||||||
|
foo = pkgs.mkShell {
|
||||||
|
# nativeBuildInputs is usually what you want -- tools you need to run
|
||||||
|
nativeBuildInputs = with pkgs.buildPackages; [
|
||||||
|
|
||||||
|
authbind
|
||||||
|
process-compose
|
||||||
|
docker-compose
|
||||||
|
|
||||||
|
];
|
||||||
|
|
||||||
|
shellHooks = ''
|
||||||
|
export NIX_SHELL_VPS=1
|
||||||
|
|
||||||
|
echo "available commands:"
|
||||||
|
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
17
util/wget
Executable file
17
util/wget
Executable file
|
|
@ -0,0 +1,17 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# downloads an url [+installs to path] [+checks bit-by-bit reproducability]
|
||||||
|
test -z "$1" && { echo "wget.install [sha256checksum] <url>"; exit 0; }
|
||||||
|
set -e
|
||||||
|
test -n "$2" && url="$2" || url="$2"
|
||||||
|
file=$(basename "$url")
|
||||||
|
test -n "$OUT" || OUT="pkg"
|
||||||
|
wget -O "$file" "$url"
|
||||||
|
sha256sum "$file"
|
||||||
|
if test -n "$2"; then
|
||||||
|
echo "$1 $file" | sha256sum --check || { echo "[!] wrong checksum.."; rm $file; exit 1; }
|
||||||
|
fi
|
||||||
|
# extract
|
||||||
|
test -d $OUT || mkdir -p $OUT
|
||||||
|
mv $file $OUT/. && cd $OUT
|
||||||
|
echo $file | grep -q '\.zip' && unzip $file && rm $file
|
||||||
|
echo $file | grep -q '\.tar' && tar -xvf $file && rm $file
|
||||||
Loading…
Add table
Reference in a new issue