Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
47 lines
1.9 KiB
Bash
Executable File
47 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# Install and configure unattended-upgrades for security patches. Deliberately
|
|
# conservative for a hypervisor: security-only origins (Debian security +
|
|
# the active PVE repo), no automatic reboot ever - a flag file is left at
|
|
# /var/run/reboot-required for you to act on manually.
|
|
#
|
|
# Idempotent - safe to re-run. Run as root on the PVE host.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if ! dpkg -s unattended-upgrades >/dev/null 2>&1; then
|
|
apt-get update
|
|
apt-get install -y unattended-upgrades
|
|
fi
|
|
|
|
CODENAME="$(pve_codename)"
|
|
|
|
write_if_changed "/etc/apt/apt.conf.d/51pve-unattended-upgrades.conf" "// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
|
|
Unattended-Upgrade::Origins-Pattern {
|
|
\"origin=Debian,codename=${CODENAME},label=Debian-Security\";
|
|
\"origin=Debian,codename=${CODENAME}-security,label=Debian-Security\";
|
|
\"origin=Proxmox\";
|
|
};
|
|
|
|
// Never auto-reboot a hypervisor. Check /var/run/reboot-required manually
|
|
// (or via scripts/audit.sh) and reboot during a planned maintenance window.
|
|
Unattended-Upgrade::Automatic-Reboot \"false\";
|
|
|
|
// Don't remove packages automatically; review before doing so by hand.
|
|
Unattended-Upgrade::Remove-Unused-Dependencies \"false\";
|
|
Unattended-Upgrade::Remove-Unused-Kernel-Packages \"false\";"
|
|
|
|
write_if_changed "/etc/apt/apt.conf.d/20auto-upgrades" '// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::Download-Upgradeable-Packages "1";
|
|
APT::Periodic::AutocleanInterval "7";'
|
|
|
|
systemctl enable --now unattended-upgrades.service >/dev/null
|
|
echo "unattended-upgrades enabled (security-only origins, no auto-reboot)."
|
|
echo "Dry run:"
|
|
unattended-upgrade --dry-run --debug 2>&1 | tail -20
|