Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
48 lines
1.3 KiB
Bash
Executable File
48 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Shared helpers for proxmox-configuration scripts. Sourced, not executed
|
|
# directly:
|
|
# SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# source "${SCRIPT_DIR}/lib/common.sh"
|
|
|
|
require_root() {
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "Must run as root." >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Codename of the running Debian/PVE release, e.g. "trixie".
|
|
pve_codename() {
|
|
(. /etc/os-release && echo "$VERSION_CODENAME")
|
|
}
|
|
|
|
# backup_file <path>
|
|
# Copies an existing file to <path>.bak.<epoch>. No-op if it doesn't exist.
|
|
backup_file() {
|
|
local path="$1"
|
|
if [ -f "$path" ]; then
|
|
cp "$path" "${path}.bak.$(date +%s)"
|
|
echo "Backed up ${path}"
|
|
fi
|
|
}
|
|
|
|
# write_if_changed <path> <content>
|
|
# Writes content to path only if it differs from what's already there,
|
|
# backing up the previous version first. Prints what happened.
|
|
write_if_changed() {
|
|
local path="$1" content="$2"
|
|
if [ -f "$path" ] && [ "$(cat "$path")" = "$content" ]; then
|
|
echo "Already up to date: $path"
|
|
return 0
|
|
fi
|
|
backup_file "$path"
|
|
printf '%s\n' "$content" > "$path"
|
|
echo "Wrote $path"
|
|
}
|
|
|
|
# --- audit.sh status helpers ---
|
|
# Callers should initialize: AUDIT_FAIL=0
|
|
audit_pass() { echo "PASS $1"; }
|
|
audit_fail() { echo "FAIL $1"; AUDIT_FAIL=1; }
|
|
audit_warn() { echo "WARN $1"; }
|