Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
38 lines
1.4 KiB
Plaintext
38 lines
1.4 KiB
Plaintext
# Example cluster-wide firewall rules for /etc/pve/firewall/cluster.fw
|
|
#
|
|
# Stage 1 (single host, current): only the mgmt IPSET applies. Applied
|
|
# automatically by scripts/deploy-firewall.sh, which fills in <MGMT_CIDR>.
|
|
#
|
|
# Stage 2 (future cluster/Ceph): the corosync and Ceph rules below are
|
|
# commented out placeholders. Uncomment and fill in <COROSYNC_CIDR> /
|
|
# <CEPH_CIDR> when nodes 2/3 join and those networks actually exist -
|
|
# leaving them active on a single node with no corosync/Ceph traffic is
|
|
# just dead config, and a literal `<COROSYNC_CIDR>` is invalid syntax if
|
|
# left uncommented and unfilled.
|
|
#
|
|
# Copy to /etc/pve/firewall/cluster.fw and edit before enabling (or use
|
|
# scripts/deploy-firewall.sh).
|
|
|
|
[OPTIONS]
|
|
enable: 1
|
|
policy_in: DROP
|
|
policy_out: ACCEPT
|
|
|
|
[IPSET mgmt]
|
|
<MGMT_CIDR>
|
|
|
|
[RULES]
|
|
# Web UI + SSH only from the management network
|
|
IN ACCEPT -source +mgmt -p tcp -dport 8006 -log nolog
|
|
IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog
|
|
|
|
# Stage 2: Corosync (cluster quorum) - uncomment once node 2/3 join and
|
|
# the corosync network/VLAN exists.
|
|
# IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog
|
|
|
|
# Stage 2: Ceph (uncomment once Ceph is live; ports: mon 3300,6789,
|
|
# osd/mgr/mds 6800-7300)
|
|
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 3300 -log nolog
|
|
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6789 -log nolog
|
|
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6800:7300 -log nolog
|