beatzaplenty/debian-configuration
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Stage 1 base config/hardening toolset, applied and verified on pve1

Browse Source 
Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.
This commit is contained in:
beatzaplenty
2026-07-21 05:44:50 +00:00
parent 24a0047fa8
commit 2cca6a7dc0
17 changed files with 625 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/pve-firewall/cluster.fw.example
+16 -10
View File
@@ -1,11 +1,17 @@
# Example cluster-wide firewall rules for /etc/pve/firewall/cluster.fw
#
# Placeholders to fill in once the network is built:
# <MGMT_CIDR> - management VLAN/subnet, e.g. 192.168.10.0/24
# <COROSYNC_CIDR> - corosync VLAN/subnet
# <CEPH_CIDR> - Ceph public + backend VLAN/subnet (once Ceph is live)
# Stage 1 (single host, current): only the mgmt IPSET applies. Applied
# automatically by scripts/deploy-firewall.sh, which fills in <MGMT_CIDR>.
#
# Copy to /etc/pve/firewall/cluster.fw and edit before enabling.
# Stage 2 (future cluster/Ceph): the corosync and Ceph rules below are
# commented out placeholders. Uncomment and fill in <COROSYNC_CIDR> /
# <CEPH_CIDR> when nodes 2/3 join and those networks actually exist -
# leaving them active on a single node with no corosync/Ceph traffic is
# just dead config, and a literal `<COROSYNC_CIDR>` is invalid syntax if
# left uncommented and unfilled.
#
# Copy to /etc/pve/firewall/cluster.fw and edit before enabling (or use
# scripts/deploy-firewall.sh).
[OPTIONS]
enable: 1
@@ -20,12 +26,12 @@ policy_out: ACCEPT
IN ACCEPT -source +mgmt -p tcp -dport 8006 -log nolog
IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog
# Corosync (cluster quorum) - nodes only, restrict source to the
# corosync subnet once it's provisioned
IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog
# Stage 2: Corosync (cluster quorum) - uncomment once node 2/3 join and
# the corosync network/VLAN exists.
# IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog
# Ceph (uncomment once Ceph is live; ports: mon 3300,6789, osd/mgr/mds
# 6800-7300)
# Stage 2: Ceph (uncomment once Ceph is live; ports: mon 3300,6789,
# osd/mgr/mds 6800-7300)
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 3300 -log nolog
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6789 -log nolog
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6800:7300 -log nolog