4615418000
collectd (with the python plugin) seems semi-abandoned. replace with our own. we have more control over how to collect things instead of relying on random plugins.
200 lines
7.2 KiB
Bash
Executable File
200 lines
7.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# This script is run on the base ubuntu. Put things here which are managed by ubuntu
|
|
# This script is also run after ubuntu upgrade
|
|
|
|
set -euv -o pipefail
|
|
|
|
readonly SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
readonly arg_infraversionpath="${SOURCE_DIR}/../src"
|
|
|
|
function die {
|
|
echo $1
|
|
exit 1
|
|
}
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
readonly ubuntu_codename=$(lsb_release -cs)
|
|
readonly ubuntu_version=$(lsb_release -rs)
|
|
|
|
# hold grub since updating it breaks on some VPS providers. also, dist-upgrade will trigger it
|
|
apt-mark hold grub* >/dev/null
|
|
apt-get -o Dpkg::Options::="--force-confdef" update -y
|
|
apt-get -o Dpkg::Options::="--force-confdef" upgrade -y
|
|
apt-mark unhold grub* >/dev/null
|
|
|
|
vendor=$(cat /sys/devices/virtual/dmi/id/sys_vendor || true)
|
|
if [[ "${vendor}" == "netcup" && ! -L /etc/resolv.conf ]]; then
|
|
echo "==> Fix netcup DNS setup"
|
|
nameservers=$(sed -ne 's/nameserver \(.*\)/"\1"/p' /etc/resolv.conf | paste -sd "," -) # json array
|
|
if lsattr -l /etc/resolv.conf 2>/dev/null | grep -q Immutable; then
|
|
chattr -i /etc/resolv.conf # this code is also in cloudron-setup. that code can be removed much after 8.0
|
|
fi
|
|
ln -frs /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
|
|
netplan set --origin-hint 50-cloud-init "ethernets.eth0.nameservers.addresses=[${nameservers}]"
|
|
netplan apply # generates /run/systemd/resolve/resolv.conf
|
|
systemctl restart systemd-resolved
|
|
fi
|
|
|
|
echo "==> Installing required packages"
|
|
|
|
debconf-set-selections <<< 'mysql-server mysql-server/root_password password password'
|
|
debconf-set-selections <<< 'mysql-server mysql-server/root_password_again password password'
|
|
|
|
# this enables automatic security upgrades (https://help.ubuntu.com/community/AutomaticSecurityUpdates)
|
|
case "${ubuntu_version}" in
|
|
16.04)
|
|
gpg_package="gnupg"
|
|
mysql_package="mysql-server-5.7"
|
|
ntpd_package=""
|
|
python_package="python2.7"
|
|
nginx_package="" # we use custom package for TLS v1.3 support
|
|
;;
|
|
18.04)
|
|
gpg_package="gpg"
|
|
mysql_package="mysql-server-5.7"
|
|
ntpd_package=""
|
|
python_package="python2.7"
|
|
nginx_package="" # we use custom package for TLS v1.3 support
|
|
;;
|
|
20.04)
|
|
gpg_package="gpg"
|
|
mysql_package="mysql-server-8.0"
|
|
ntpd_package="systemd-timesyncd"
|
|
python_package="python3.8"
|
|
nginx_package="nginx-full"
|
|
;;
|
|
22.04)
|
|
gpg_package="gpg"
|
|
mysql_package="mysql-server-8.0"
|
|
ntpd_package="systemd-timesyncd"
|
|
python_package="python3.10"
|
|
nginx_package="nginx-full"
|
|
;;
|
|
24.04)
|
|
gpg_package="gpg"
|
|
mysql_package="mysql-server-8.0"
|
|
ntpd_package="systemd-timesyncd"
|
|
python_package="python3.12"
|
|
nginx_package="nginx-full"
|
|
;;
|
|
esac
|
|
|
|
apt-get -y install --no-install-recommends \
|
|
acl \
|
|
apparmor \
|
|
build-essential \
|
|
cifs-utils \
|
|
cron \
|
|
curl \
|
|
debconf-utils \
|
|
dmsetup \
|
|
$gpg_package \
|
|
ipset \
|
|
iptables \
|
|
lib${python_package} \
|
|
linux-generic \
|
|
logrotate \
|
|
$mysql_package \
|
|
nfs-common \
|
|
$nginx_package \
|
|
$ntpd_package \
|
|
openssh-server \
|
|
python3-magic \
|
|
pwgen \
|
|
sshfs \
|
|
swaks \
|
|
tzdata \
|
|
unattended-upgrades \
|
|
unbound \
|
|
unbound-anchor \
|
|
unzip \
|
|
whois \
|
|
xfsprogs
|
|
|
|
# on some providers like scaleway the sudo file is changed and we want to keep the old one
|
|
apt-get -o Dpkg::Options::="--force-confold" install -y --no-install-recommends sudo
|
|
|
|
# this ensures that unattended upgades are enabled, if it was disabled during ubuntu install time (see #346)
|
|
# debconf-set-selection of unattended-upgrades/enable_auto_updates + dpkg-reconfigure does not work
|
|
# logs of upgrades are at /var/log/apt/history.log and /var/log/unattended-upgrades/unattended-upgrades-dpkg.log
|
|
# apt-daily-upgrade.service (timer) runs the unattended-upgrades script depending on APT::Periodic::Unattended-Upgrade
|
|
echo "==> Enabling automatic upgrades"
|
|
cp /usr/share/unattended-upgrades/20auto-upgrades /etc/apt/apt.conf.d/20auto-upgrades
|
|
|
|
echo "==> Ensuring python $python_package"
|
|
apt-get install -y --no-install-recommends $python_package # Install python which is required for npm rebuild
|
|
|
|
# do not upgrade grub because it might prompt user and break this script
|
|
echo "==> Enable memory accounting"
|
|
apt-get -y --no-upgrade --no-install-recommends install grub2-common
|
|
sed -e 's/^GRUB_CMDLINE_LINUX="\(.*\)"$/GRUB_CMDLINE_LINUX="\1 cgroup_enable=memory swapaccount=1 panic_on_oops=1 panic=5"/' -i /etc/default/grub
|
|
update-grub
|
|
|
|
# some hosts like atlantic install ntp which conflicts with timedatectl. https://serverfault.com/questions/1024770/ubuntu-20-04-time-sync-problems-and-possibly-incorrect-status-information
|
|
echo "==> Configuring host"
|
|
sed -e 's/^#NTP=/NTP=0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org/' -i /etc/systemd/timesyncd.conf
|
|
if systemctl is-active ntp; then
|
|
systemctl stop ntp
|
|
apt purge -y ntp
|
|
fi
|
|
timedatectl set-ntp 1
|
|
# mysql follows the system timezone
|
|
timedatectl set-timezone UTC
|
|
|
|
echo "==> Adding sshd configuration warning"
|
|
sed -e '/Port 22/ i # NOTE: Read https://docs.cloudron.io/security/#securing-ssh-access before changing this' -i /etc/ssh/sshd_config
|
|
|
|
# https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1701068
|
|
echo "==> Disabling motd news"
|
|
if [[ -f "/etc/default/motd-news" ]]; then
|
|
sed -i 's/^ENABLED=.*/ENABLED=0/' /etc/default/motd-news
|
|
fi
|
|
|
|
# If privacy extensions are not disabled on server, this breaks IPv6 detection
|
|
# https://bugs.launchpad.net/ubuntu/+source/procps/+bug/1068756
|
|
if [[ ! -f /etc/sysctl.d/99-cloudimg-ipv6.conf ]]; then
|
|
echo "==> Disable temporary address (IPv6)"
|
|
echo -e "# See https://bugs.launchpad.net/ubuntu/+source/procps/+bug/1068756\nnet.ipv6.conf.all.use_tempaddr = 0\nnet.ipv6.conf.default.use_tempaddr = 0\n\n" > /etc/sysctl.d/99-cloudimg-ipv6.conf
|
|
fi
|
|
|
|
# Disable exim4 (1blu.de)
|
|
systemctl stop exim4 || true
|
|
systemctl disable exim4 || true
|
|
|
|
# Disable bind for good measure (on online.net, kimsufi servers these are pre-installed)
|
|
systemctl stop bind9 || true
|
|
systemctl disable bind9 || true
|
|
|
|
# on ovh images dnsmasq seems to run by default
|
|
systemctl stop dnsmasq || true
|
|
systemctl disable dnsmasq || true
|
|
|
|
# on ssdnodes postfix seems to run by default
|
|
systemctl stop postfix || true
|
|
systemctl disable postfix || true
|
|
|
|
# on vultr, ufw is enabled by default. we have our own firewall
|
|
ufw disable || true
|
|
|
|
# nfs-common depends on rpcbind which is only needed for NFS v2/v3 . systemctl list-sockets | grep 111
|
|
systemctl disable rpcbind.socket rpcbind.service || true
|
|
systemctl stop rpcbind.socket rpcbind.service || true
|
|
|
|
# Ubuntu 22 has private home directories by default (https://discourse.ubuntu.com/t/private-home-directories-for-ubuntu-21-04-onwards/)
|
|
sed -e 's/^HOME_MODE\([[:space:]]\+\).*$/HOME_MODE\10755/' -i /etc/login.defs
|
|
|
|
# create the yellowtent user. system user has different numeric range, no age and won't show in login/gdm UI
|
|
# the nologin will also disable su/login. hardcoding uid helps in restoring
|
|
if ! id yellowtent 2>/dev/null; then
|
|
useradd --system --uid 808 --comment "Cloudron Box" --create-home --shell /usr/sbin/nologin yellowtent
|
|
fi
|
|
|
|
# add support user (no password, sudo)
|
|
if ! id cloudron-support 2>/dev/null; then
|
|
useradd --system --comment "Cloudron Support (support@cloudron.io)" --create-home --no-user-group --shell /bin/bash cloudron-support
|
|
fi
|
|
|