Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
49 lines
1.5 KiB
Bash
Executable File
49 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Deploy the Proxmox datacenter-level firewall from
|
|
# config/pve-firewall/cluster.fw.example, with the management CIDR filled
|
|
# in, and enable it. Default-deny inbound; allow SSH/8006 from mgmt only.
|
|
#
|
|
# Idempotent - safe to re-run. Run as root on the PVE host.
|
|
#
|
|
# Usage: MGMT_CIDR=192.168.2.0/24 ./deploy-firewall.sh
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if [ -z "${MGMT_CIDR:-}" ]; then
|
|
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! [[ "$MGMT_CIDR" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]]; then
|
|
echo "MGMT_CIDR '${MGMT_CIDR}' doesn't look like a CIDR (e.g. 192.168.2.0/24)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
TEMPLATE="${SCRIPT_DIR}/../config/pve-firewall/cluster.fw.example"
|
|
if [ ! -f "$TEMPLATE" ]; then
|
|
echo "Template not found: $TEMPLATE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Corosync/Ceph rules stay commented placeholders until Stage 2 (cluster);
|
|
# only the mgmt IPSET is real for a single Stage 1 node.
|
|
mkdir -p /etc/pve/firewall
|
|
write_if_changed "/etc/pve/firewall/cluster.fw" "$(sed "s|<MGMT_CIDR>|${MGMT_CIDR}|" "$TEMPLATE")"
|
|
|
|
echo "Validating ruleset..."
|
|
pve-firewall compile
|
|
|
|
echo "Restarting pve-firewall..."
|
|
pve-firewall restart
|
|
sleep 1
|
|
pve-firewall status
|
|
|
|
echo
|
|
echo "Firewall enabled. SSH (22) and the web UI (8006) are now only reachable"
|
|
echo "from ${MGMT_CIDR}. If your current SSH session is NOT from that range,"
|
|
echo "reconnect and verify access before closing this session."
|