ipv4 only work
This commit is contained in:
@@ -1,257 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
dotnetDir="/opt/dotnet"
|
||||
dotnetVersion="10.0"
|
||||
dotnetRuntime="Microsoft.AspNetCore.App 10.0."
|
||||
dotnetUrl="https://dot.net/v1/dotnet-install.sh"
|
||||
|
||||
if [ -d "/etc/dns/config" ]
|
||||
then
|
||||
dnsDir="/etc/dns"
|
||||
else
|
||||
dnsDir="/opt/technitium/dns"
|
||||
fi
|
||||
|
||||
dnsConfig="/etc/dns"
|
||||
dnsLog="/var/log/technitium/dns"
|
||||
dnsTar="$dnsDir/DnsServerPortable.tar.gz"
|
||||
dnsUrl="https://download.technitium.com/dns/DnsServerPortable.tar.gz"
|
||||
|
||||
serviceUser="dns-server"
|
||||
installLog="$dnsDir/install.log"
|
||||
|
||||
echo ""
|
||||
echo "==============================="
|
||||
echo "Technitium DNS Server Installer"
|
||||
echo "==============================="
|
||||
echo ""
|
||||
|
||||
mkdir -p $dnsDir
|
||||
mkdir -p $dnsConfig
|
||||
|
||||
echo "" > $installLog
|
||||
|
||||
if dotnet --list-runtimes 2> /dev/null | grep -q "$dotnetRuntime";
|
||||
then
|
||||
dotnetFound="yes"
|
||||
else
|
||||
dotnetFound="no"
|
||||
fi
|
||||
|
||||
if [ ! -d $dotnetDir ] && [ "$dotnetFound" = "yes" ]
|
||||
then
|
||||
echo "ASP.NET Core Runtime is already installed."
|
||||
else
|
||||
if [ -d $dotnetDir ] && [ "$dotnetFound" = "yes" ]
|
||||
then
|
||||
dotnetUpdate="yes"
|
||||
echo "Updating ASP.NET Core Runtime..."
|
||||
else
|
||||
dotnetUpdate="no"
|
||||
echo "Installing ASP.NET Core Runtime..."
|
||||
fi
|
||||
|
||||
curl -sSL $dotnetUrl | bash /dev/stdin -c $dotnetVersion --runtime aspnetcore --no-path --install-dir $dotnetDir --verbose >> $installLog 2>&1
|
||||
|
||||
# On Alpine Linux dotnet requires libstdc++
|
||||
if command -v apk >/dev/null 2>&1
|
||||
then
|
||||
echo "Installing ASP.NET Core Runtime dependencies..."
|
||||
apk add --no-cache libstdc++ >> $installLog 2>&1
|
||||
fi
|
||||
|
||||
if [ ! -f "/usr/bin/dotnet" ]
|
||||
then
|
||||
ln -s $dotnetDir/dotnet /usr/bin >> $installLog 2>&1
|
||||
fi
|
||||
|
||||
if dotnet --list-runtimes 2> /dev/null | grep -q "$dotnetRuntime";
|
||||
then
|
||||
if [ "$dotnetUpdate" = "yes" ]
|
||||
then
|
||||
echo "ASP.NET Core Runtime was updated successfully!"
|
||||
else
|
||||
echo "ASP.NET Core Runtime was installed successfully!"
|
||||
fi
|
||||
else
|
||||
echo "Failed to install ASP.NET Core Runtime. Please check '$installLog' for details."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Downloading Technitium DNS Server..."
|
||||
|
||||
if ! curl -o $dnsTar --fail $dnsUrl >> $installLog 2>&1
|
||||
then
|
||||
echo "Failed to download Technitium DNS Server from: $dnsUrl"
|
||||
echo "Please check '$installLog' for details."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -d $dnsConfig ]
|
||||
then
|
||||
echo "Updating Technitium DNS Server..."
|
||||
else
|
||||
echo "Installing Technitium DNS Server..."
|
||||
fi
|
||||
|
||||
tar -zxf $dnsTar -C $dnsDir >> $installLog 2>&1
|
||||
|
||||
echo ""
|
||||
|
||||
if $( dotnet $dnsDir/DnsServerApp.dll --icu-test >> $installLog 2>&1 ) >/dev/null 2>&1;
|
||||
then
|
||||
echo "ICU package is already installed."
|
||||
else
|
||||
echo "Checking for required ICU package..."
|
||||
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
# Debian/Ubuntu based
|
||||
if ! dpkg -l | grep -q "libicu"; then
|
||||
echo "Installing required ICU package..."
|
||||
apt-get update >> $installLog 2>&1
|
||||
|
||||
# Try to install the most common package name
|
||||
if apt-cache show libicu74 >/dev/null 2>&1; then
|
||||
echo "Installing libicu74 package..."
|
||||
apt-get install -y libicu74 >> $installLog 2>&1
|
||||
elif apt-cache show libicu72 >/dev/null 2>&1; then
|
||||
echo "Installing libicu72 package..."
|
||||
apt-get install -y libicu72 >> $installLog 2>&1
|
||||
elif apt-cache show libicu70 >/dev/null 2>&1; then
|
||||
echo "Installing libicu70 package..."
|
||||
apt-get install -y libicu70 >> $installLog 2>&1
|
||||
else
|
||||
# Fallback to a generic approach
|
||||
echo "No specific libicu package was found, trying generic installation..."
|
||||
apt-get install -y libicu* >> $installLog 2>&1
|
||||
fi
|
||||
fi
|
||||
elif command -v dnf >/dev/null 2>&1; then
|
||||
# Fedora/RHEL based
|
||||
if ! rpm -qa | grep -q "libicu"; then
|
||||
echo "Installing required ICU package..."
|
||||
dnf install -y libicu >> $installLog 2>&1
|
||||
fi
|
||||
elif command -v yum >/dev/null 2>&1; then
|
||||
# Older RHEL/CentOS systems
|
||||
if ! rpm -qa | grep -q "libicu"; then
|
||||
echo "Installing required ICU package..."
|
||||
yum install -y libicu >> $installLog 2>&1
|
||||
fi
|
||||
elif command -v zypper >/dev/null 2>&1; then
|
||||
# openSUSE based
|
||||
if ! rpm -qa | grep -q "libicu"; then
|
||||
echo "Installing required ICU package..."
|
||||
zypper install -y libicu >> $installLog 2>&1
|
||||
fi
|
||||
elif command -v pacman >/dev/null 2>&1; then
|
||||
# Arch based
|
||||
if ! pacman -Q | grep -q "icu"; then
|
||||
echo "Installing required ICU package..."
|
||||
pacman -S --noconfirm icu >> $installLog 2>&1
|
||||
fi
|
||||
elif command -v apk >/dev/null 2>&1; then
|
||||
# Alpine Linux
|
||||
if ! apk list --installed | grep -q "icu"; then
|
||||
echo "Installing required ICU package..."
|
||||
apk add --no-cache icu >> $installLog 2>&1
|
||||
fi
|
||||
else
|
||||
echo "Failed to install Technitium DNS Server: could not determine package manager to install ICU package. Please install ICU package manually and try again."
|
||||
echo "Please read the 'Missing ICU Package' section in this blog post to understand how to manually install the ICU package for your distro: https://blog.technitium.com/2017/11/running-dns-server-on-ubuntu-linux.html"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#test again to confirm
|
||||
if $( dotnet $dnsDir/DnsServerApp.dll --icu-test >> $installLog 2>&1 ) >/dev/null 2>&1;
|
||||
then
|
||||
echo "ICU package was installed successfully!"
|
||||
else
|
||||
echo "Failed to install Technitium DNS Server: failed to install ICU package. Please install ICU package manually and try again."
|
||||
echo "Please read the 'Missing ICU Package' section in this blog post to understand how to manually install the ICU package for your distro: https://blog.technitium.com/2017/11/running-dns-server-on-ubuntu-linux.html"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
if [ "$(ps --no-headers -o comm 1 | tr -d '\n')" = "systemd" ]
|
||||
then
|
||||
if [ -f "/etc/systemd/system/dns.service" ]
|
||||
then
|
||||
echo "Configuring permissions..."
|
||||
chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
|
||||
|
||||
echo "Restarting systemd service..."
|
||||
systemctl restart dns.service >> $installLog 2>&1
|
||||
else
|
||||
mkdir -p $dnsLog
|
||||
|
||||
echo "Configuring user and permissions..."
|
||||
useradd --system -M --shell /usr/sbin/nologin --user-group $serviceUser >> $installLog 2>&1
|
||||
chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
|
||||
|
||||
echo "Configuring systemd service..."
|
||||
cp $dnsDir/systemd.service /etc/systemd/system/dns.service
|
||||
systemctl enable dns.service >> $installLog 2>&1
|
||||
|
||||
systemctl stop systemd-resolved >> $installLog 2>&1
|
||||
systemctl disable systemd-resolved >> $installLog 2>&1
|
||||
|
||||
systemctl start dns.service >> $installLog 2>&1
|
||||
|
||||
if [ -f "/etc/NetworkManager/NetworkManager.conf" ]
|
||||
then
|
||||
currentVal=$(grep -F "dns=" /etc/NetworkManager/NetworkManager.conf)
|
||||
|
||||
if [ "$currentVal" = "" ]
|
||||
then
|
||||
printf "\n[main]\ndns=none\n" >> /etc/NetworkManager/NetworkManager.conf 2>> $installLog
|
||||
elif [ "$currentVal" != "dns=none" ]
|
||||
then
|
||||
sed -i "s/$currentVal/dns=none/g" /etc/NetworkManager/NetworkManager.conf 2>> $installLog
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
elif [ -x "/sbin/rc-service" ]
|
||||
then
|
||||
if [ -f "/etc/init.d/dns" ]
|
||||
then
|
||||
echo "Configuring permissions..."
|
||||
chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
|
||||
|
||||
echo "Restarting OpenRC service..."
|
||||
rc-service dns stop >> $installLog 2>&1
|
||||
rc-service dns start >> $installLog 2>&1
|
||||
else
|
||||
mkdir -p $dnsLog
|
||||
|
||||
echo "Configuring user and permissions..."
|
||||
addgroup -S $serviceUser >> $installLog 2>&1
|
||||
adduser -H -S -D -s /bin/false -G $serviceUser $serviceUser >> $installLog 2>&1
|
||||
chown -R $serviceUser:$serviceUser $dnsDir $dnsConfig $dnsLog >> $installLog 2>&1
|
||||
|
||||
echo "Configuring OpenRC service..."
|
||||
cp $dnsDir/openrc.service /etc/init.d/dns
|
||||
chmod +x /etc/init.d/dns
|
||||
rc-update add dns >> $installLog 2>&1
|
||||
rc-service dns start >> $installLog 2>&1
|
||||
fi
|
||||
else
|
||||
echo "Failed to install Technitium DNS Server: systemd/openrc was not detected."
|
||||
echo "Please read the 'Installing DNS Server Manually' section in this blog post to understand how to manually install the DNS server on your distro: https://blog.technitium.com/2017/11/running-dns-server-on-ubuntu-linux.html"
|
||||
exit 1
|
||||
fi 2>/dev/null
|
||||
|
||||
cp -a /etc/resolv.conf $dnsDir/resolv.conf.bak >> $installLog 2>&1
|
||||
rm /etc/resolv.conf >> $installLog 2>&1
|
||||
printf "# Generated by Technitium DNS Server Installer\n\nnameserver 127.0.0.1\n" > /etc/resolv.conf 2>> $installLog
|
||||
|
||||
echo ""
|
||||
echo "Technitium DNS Server was installed successfully!"
|
||||
echo "Open http://$(cat /proc/sys/kernel/hostname):5380/ to access the web console."
|
||||
echo ""
|
||||
echo "Donate! Make a contribution by becoming a Patron: https://www.patreon.com/technitium"
|
||||
echo ""
|
||||
@@ -1 +0,0 @@
|
||||
ansible_ssh_host: ch01.balsillie.house
|
||||
@@ -1 +0,0 @@
|
||||
unprivileged_user: quadlet
|
||||
@@ -1 +0,0 @@
|
||||
ansible_ssh_host: ch02.balsillie.house
|
||||
@@ -1 +0,0 @@
|
||||
unprivileged_user: quadlet
|
||||
@@ -0,0 +1 @@
|
||||
ansible_ssh_host: cs01.balsillie.house
|
||||
@@ -0,0 +1,5 @@
|
||||
unprivileged_users:
|
||||
- git
|
||||
- distribution
|
||||
- talos-discovery
|
||||
- syncthing
|
||||
@@ -0,0 +1 @@
|
||||
ansible_ssh_host: cs02.balsillie.house
|
||||
@@ -0,0 +1,5 @@
|
||||
unprivileged_users:
|
||||
- git
|
||||
- distribution
|
||||
- talos-discovery
|
||||
- syncthing
|
||||
@@ -1 +1,2 @@
|
||||
unprivileged_user: download
|
||||
unprivileged_users:
|
||||
- download
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
ansible_ssh_host: ns01.balsillie.house
|
||||
@@ -0,0 +1,2 @@
|
||||
ha_pair_value: '01'
|
||||
subnet_suffix_value: '1'
|
||||
@@ -0,0 +1,2 @@
|
||||
unprivileged_users:
|
||||
- technitium
|
||||
@@ -0,0 +1 @@
|
||||
ansible_ssh_host: ns02.balsillie.house
|
||||
@@ -0,0 +1,2 @@
|
||||
ha_pair_value: '02'
|
||||
subnet_suffix_value: '2'
|
||||
@@ -0,0 +1,2 @@
|
||||
unprivileged_users:
|
||||
- technitium
|
||||
@@ -18,3 +18,6 @@ all:
|
||||
hosts:
|
||||
hv01.balsillie.house:
|
||||
hv02.balsillie.house:
|
||||
ipv4_only_hosts:
|
||||
children:
|
||||
download_clients:
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
- name: Configure ssh and firewall
|
||||
hosts:
|
||||
# - archlinux_servers
|
||||
- ch02.balsillie.house
|
||||
# - ch02.balsillie.house
|
||||
- dl01.balsillie.house
|
||||
gather_facts: false
|
||||
become: true
|
||||
pre_tasks:
|
||||
@@ -34,4 +35,5 @@
|
||||
# - sudoers
|
||||
# - sshd
|
||||
# - podman
|
||||
- technitium
|
||||
# - technitium
|
||||
- ipv4_only
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
# code: language=ansible
|
||||
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
reboot_timeout: 180
|
||||
@@ -0,0 +1,32 @@
|
||||
# code: language=ansible
|
||||
|
||||
- name: Disable ipv6 (all)
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item }}"
|
||||
reload: true
|
||||
state: present
|
||||
sysctl_set: true
|
||||
value: 1
|
||||
loop:
|
||||
- net.ipv6.conf.all.disable_ipv6
|
||||
- net.ipv6.conf.default.disable_ipv6
|
||||
- net.ipv6.conf.lo.disable_ipv6
|
||||
notify:
|
||||
- Reboot
|
||||
|
||||
- name: Remove IPv6 localhost entries from /etc/hosts
|
||||
when:
|
||||
- (ipv4_only | default(false))
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
line: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- '::1 localhost ip6-localhost ip6-loopback'
|
||||
- 'ff02::1 ip6-allnodes'
|
||||
- 'ff02::2 ip6-allrouters'
|
||||
notify:
|
||||
- Reboot
|
||||
|
||||
- name: Flush handlers to trigger reboot if required
|
||||
ansible.builtin.meta: flush_handlers
|
||||
@@ -0,0 +1 @@
|
||||
# code: language=ansible
|
||||
@@ -46,7 +46,7 @@
|
||||
name: "{{ sudoers_user }}"
|
||||
state: present
|
||||
|
||||
- name: Add sudoers entries
|
||||
- name: Add main root sudoers entry
|
||||
community.general.sudoers:
|
||||
commands:
|
||||
- ALL
|
||||
@@ -54,19 +54,28 @@
|
||||
- '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
|
||||
group: sudo
|
||||
host: "{{ inventory_hostname_short }}"
|
||||
name: sudo_{{ item.name }}
|
||||
nopassword: "{{ item.nopassword }}"
|
||||
runas: "{{ item.name }}"
|
||||
name: sudo_root
|
||||
nopassword: false
|
||||
runas: root
|
||||
state: present
|
||||
sudoers_path: "/etc/sudoers.d"
|
||||
validation: required
|
||||
loop:
|
||||
- name: root
|
||||
nopassword: false
|
||||
- name: "{{ unprivileged_user }}"
|
||||
nopassword: true
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
- name: Add become unpriviligeed users sudoers entries
|
||||
community.general.sudoers:
|
||||
commands:
|
||||
- ALL
|
||||
defaults:
|
||||
- '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
|
||||
group: sudo
|
||||
host: "{{ inventory_hostname_short }}"
|
||||
name: sudo_{{ item }}
|
||||
nopassword: true
|
||||
runas: "{{ item }}"
|
||||
state: present
|
||||
sudoers_path: "/etc/sudoers.d"
|
||||
validation: required
|
||||
loop: "{{ unprivileged_users }}"
|
||||
|
||||
- name: Remove default sudoers file
|
||||
ansible.builtin.file:
|
||||
|
||||
Reference in New Issue
Block a user