From 3f81798a31990e1e7994498c2b4dcf08fd2c92e6 Mon Sep 17 00:00:00 2001 From: caelebfi Date: Mon, 24 Jan 2022 14:07:25 +0100 Subject: [PATCH] daily autocommit --- .etckeeper | 20 ++++++++++++- apt/apt.conf.d/02periodic | 6 ++++ apt/apt.conf.d/50unattended-upgrades | 42 ++++++++++------------------ bash_completion.d/pivpn | 1 + cmk-update-agent.state | 2 +- pivpn/wireguard/setupVars.conf | 23 +++++++++++++++ wireguard/configs/MI9T.conf | 10 +++++++ wireguard/configs/clients.txt | 4 +++ wireguard/configs/predator.conf | 10 +++++++ wireguard/configs/t450s.conf | 10 +++++++ wireguard/configs/work.conf | 10 +++++++ wireguard/keys/MI9T_priv | 1 + wireguard/keys/MI9T_psk | 1 + wireguard/keys/MI9T_pub | 1 + wireguard/keys/predator_priv | 1 + wireguard/keys/predator_psk | 1 + wireguard/keys/predator_pub | 1 + wireguard/keys/t450s_priv | 1 + wireguard/keys/t450s_psk | 1 + wireguard/keys/t450s_pub | 1 + wireguard/keys/work_priv | 1 + wireguard/keys/work_psk | 1 + wireguard/keys/work_pub | 1 + wireguard/wg0.conf | 24 ++++++++++++++++ 24 files changed, 145 insertions(+), 29 deletions(-) create mode 100644 apt/apt.conf.d/02periodic create mode 120000 bash_completion.d/pivpn create mode 100644 pivpn/wireguard/setupVars.conf create mode 100644 wireguard/configs/MI9T.conf create mode 100644 wireguard/configs/predator.conf create mode 100644 wireguard/configs/t450s.conf create mode 100644 wireguard/configs/work.conf create mode 100644 wireguard/keys/MI9T_priv create mode 100644 wireguard/keys/MI9T_psk create mode 100644 wireguard/keys/MI9T_pub create mode 100644 wireguard/keys/predator_priv create mode 100644 wireguard/keys/predator_psk create mode 100644 wireguard/keys/predator_pub create mode 100644 wireguard/keys/t450s_priv create mode 100644 wireguard/keys/t450s_psk create mode 100644 wireguard/keys/t450s_pub create mode 100644 wireguard/keys/work_priv create mode 100644 wireguard/keys/work_psk create mode 100644 wireguard/keys/work_pub diff --git a/.etckeeper b/.etckeeper index d0a95630..f166af1e 100755 --- a/.etckeeper +++ b/.etckeeper @@ -35,7 +35,6 @@ mkdir -p './nginx/modules-available' mkdir -p './nginx/streams-available' mkdir -p './nginx/streams-enabled' mkdir -p './opt' -mkdir -p './pivpn' mkdir -p './polkit-1/localauthority/10-vendor.d' mkdir -p './polkit-1/localauthority/20-org.d' mkdir -p './polkit-1/localauthority/30-site.d' @@ -122,6 +121,7 @@ maybe chmod 0755 'apt/apt.conf.d' maybe chmod 0644 'apt/apt.conf.d/01autoremove' maybe chmod 0444 'apt/apt.conf.d/01autoremove-kernels' maybe chmod 0444 'apt/apt.conf.d/01autoremove-postgresql' +maybe chmod 0644 'apt/apt.conf.d/02periodic' maybe chmod 0644 'apt/apt.conf.d/05etckeeper' maybe chmod 0644 'apt/apt.conf.d/15update-stamp' maybe chmod 0644 'apt/apt.conf.d/20auto-upgrades' @@ -1072,6 +1072,8 @@ maybe chmod 0644 'php/7.4/mods-available/sysvshm.ini' maybe chmod 0644 'php/7.4/mods-available/tokenizer.ini' maybe chmod 0644 'pip.conf' maybe chmod 0755 'pivpn' +maybe chmod 0755 'pivpn/wireguard' +maybe chmod 0644 'pivpn/wireguard/setupVars.conf' maybe chmod 0755 'pm' maybe chmod 0755 'pm/sleep.d' maybe chmod 0755 'pm/sleep.d/10_unattended-upgrades-hibernate' @@ -1352,10 +1354,26 @@ maybe chmod 0644 'vim/vimrc.tiny' maybe chmod 0644 'wgetrc' maybe chmod 0700 'wireguard' maybe chmod 0755 'wireguard/configs' +maybe chmod 0644 'wireguard/configs/MI9T.conf' maybe chmod 0644 'wireguard/configs/clients.txt' +maybe chmod 0644 'wireguard/configs/predator.conf' +maybe chmod 0644 'wireguard/configs/t450s.conf' +maybe chmod 0644 'wireguard/configs/work.conf' maybe chmod 0755 'wireguard/keys' +maybe chmod 0644 'wireguard/keys/MI9T_priv' +maybe chmod 0644 'wireguard/keys/MI9T_psk' +maybe chmod 0644 'wireguard/keys/MI9T_pub' +maybe chmod 0644 'wireguard/keys/predator_priv' +maybe chmod 0644 'wireguard/keys/predator_psk' +maybe chmod 0644 'wireguard/keys/predator_pub' maybe chmod 0644 'wireguard/keys/server_priv' maybe chmod 0644 'wireguard/keys/server_pub' +maybe chmod 0644 'wireguard/keys/t450s_priv' +maybe chmod 0644 'wireguard/keys/t450s_psk' +maybe chmod 0644 'wireguard/keys/t450s_pub' +maybe chmod 0644 'wireguard/keys/work_priv' +maybe chmod 0644 'wireguard/keys/work_psk' +maybe chmod 0644 'wireguard/keys/work_pub' maybe chmod 0644 'wireguard/wg0.conf' maybe chmod 0600 'wireguard_2021-01-28-103503.tar.gz' maybe chmod 0600 'wireguard_2022-01-24-091516.tar.gz' diff --git a/apt/apt.conf.d/02periodic b/apt/apt.conf.d/02periodic new file mode 100644 index 00000000..bab5f5bd --- /dev/null +++ b/apt/apt.conf.d/02periodic @@ -0,0 +1,6 @@ +APT::Periodic::Enable "1"; + APT::Periodic::Update-Package-Lists "1"; + APT::Periodic::Download-Upgradeable-Packages "1"; + APT::Periodic::Unattended-Upgrade "1"; + APT::Periodic::AutocleanInterval "7"; + APT::Periodic::Verbose "0"; diff --git a/apt/apt.conf.d/50unattended-upgrades b/apt/apt.conf.d/50unattended-upgrades index 7fbd3d44..b255343b 100644 --- a/apt/apt.conf.d/50unattended-upgrades +++ b/apt/apt.conf.d/50unattended-upgrades @@ -8,8 +8,8 @@ // file, but several aliases are accepted. The accepted keywords are: // a,archive,suite (eg, "stable") // c,component (eg, "main", "contrib", "non-free") -// l,label (eg, "Debian", "Debian-Security") -// o,origin (eg, "Debian", "Unofficial Multimedia Packages") +// l,label (eg, "Rapsbian", "Raspbian") +// o,origin (eg, "Raspbian", "Unofficial Multimedia Packages") // n,codename (eg, "jessie", "jessie-updates") // site (eg, "http.debian.net") // The available values on the system are printed by the command @@ -19,27 +19,27 @@ // Within lines unattended-upgrades allows 2 macros whose values are // derived from /etc/debian_version: // ${distro_id} Installed origin. -// ${distro_codename} Installed codename (eg, "buster") +// ${distro_codename} Installed codename (eg, "jessie") Unattended-Upgrade::Origins-Pattern { // Codename based matching: // This will follow the migration of a release through different // archives (e.g. from testing to stable and later oldstable). - // Software will be the latest available for the named release, - // but the Debian release itself will not be automatically upgraded. -// "origin=Debian,codename=${distro_codename}-updates"; -// "origin=Debian,codename=${distro_codename}-proposed-updates"; - "origin=Debian,codename=${distro_codename},label=Debian"; - "origin=Debian,codename=${distro_codename},label=Debian-Security"; - "origin=Debian,codename=${distro_codename}-security,label=Debian-Security"; +// "o=Raspbian,n=jessie"; +// "o=Raspbian,n=jessie-updates"; +// "o=Raspbian,n=jessie-proposed-updates"; +// "o=Raspbian,n=jessie,l=Raspbian"; // Archive or Suite based matching: // Note that this will silently match a different release after // migration to the specified archive (e.g. testing becomes the // new stable). -// "o=Debian,a=stable"; -// "o=Debian,a=stable-updates"; -// "o=Debian,a=proposed-updates"; -// "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports"; +// "o=Raspbian,a=stable"; +// "o=Raspbian,a=testing"; + "origin=Raspbian,codename=${distro_codename},label=Raspbian"; + + // Additionally, for those running Raspbian on a Raspberry Pi, + // match packages from the Raspberry Pi Foundation as well. + "origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspberry Pi Foundation"; }; // Python regular expressions, matching packages to exclude from upgrading @@ -111,7 +111,7 @@ Unattended-Upgrade::Package-Blacklist { //Unattended-Upgrade::Remove-Unused-Dependencies "false"; // Automatically reboot *WITHOUT CONFIRMATION* if -// the file /var/run/reboot-required is found after the upgrade +// the file /var/run/reboot-required is found after the upgrade //Unattended-Upgrade::Automatic-Reboot "false"; // Automatically reboot even if there are users currently logged in @@ -150,15 +150,3 @@ Unattended-Upgrade::Package-Blacklist { // Allow package downgrade if Pin-Priority exceeds 1000 // Unattended-Upgrade::Allow-downgrade "false"; - -// When APT fails to mark a package to be upgraded or installed try adjusting -// candidates of related packages to help APT's resolver in finding a solution -// where the package can be upgraded or installed. -// This is a workaround until APT's resolver is fixed to always find a -// solution if it exists. (See Debian bug #711128.) -// The fallback is enabled by default, except on Debian's sid release because -// uninstallable packages are frequent there. -// Disabling the fallback speeds up unattended-upgrades when there are -// uninstallable packages at the expense of rarely keeping back packages which -// could be upgraded or installed. -// Unattended-Upgrade::Allow-APT-Mark-Fallback "true"; diff --git a/bash_completion.d/pivpn b/bash_completion.d/pivpn new file mode 120000 index 00000000..f1d988b2 --- /dev/null +++ b/bash_completion.d/pivpn @@ -0,0 +1 @@ +/usr/local/src/pivpn/scripts/wireguard/bash-completion \ No newline at end of file diff --git a/cmk-update-agent.state b/cmk-update-agent.state index f6ebe8cf..15e672ab 100644 --- a/cmk-update-agent.state +++ b/cmk-update-agent.state @@ -1 +1 @@ -{'protocol': 'http', 'installed_aghash': 'f6a96ac380071a09', 'last_error': None, 'site': 'realm', 'last_check': 1643008609.7402506, 'host_name': 'serviceraspi.realm.local', 'server': '192.168.0.99', 'last_update': 1639470832.6044304, 'host_secret': 'pntxhkgisefetedlluhmbneceelnviymvmrfcsaezocoirlcjurakqmfhjuunxlv', 'user': 'caelebfi'} +{'protocol': 'http', 'installed_aghash': '78cb4186321cf9e7', 'last_error': None, 'site': 'realm', 'last_check': 1643029425.086851, 'host_name': 'serviceraspi.realm.local', 'server': '192.168.0.99', 'last_update': 1643022138.3070705, 'host_secret': 'pntxhkgisefetedlluhmbneceelnviymvmrfcsaezocoirlcjurakqmfhjuunxlv', 'user': 'caelebfi', 'pending_hash': None} diff --git a/pivpn/wireguard/setupVars.conf b/pivpn/wireguard/setupVars.conf new file mode 100644 index 00000000..b2e8ddb9 --- /dev/null +++ b/pivpn/wireguard/setupVars.conf @@ -0,0 +1,23 @@ +PLAT=Raspbian +OSCN=bullseye +USING_UFW=0 +IPv4dev=enxb827eb4e3dec +IPv4addr=192.168.0.28/24 +IPv4gw=192.168.0.1 +install_user=pi +install_home=/home/pi +VPN=wireguard +pivpnPORT=51830 +pivpnDNS1=192.168.0.28 +pivpnDNS2=192.168.0.1 +pivpnHOST=realm.mynetgear.com +INPUT_CHAIN_EDITED=0 +FORWARD_CHAIN_EDITED=1 +pivpnPROTO=udp +pivpnMTU=1420 +pivpnDEV=wg0 +pivpnNET=10.6.0.0 +subnetClass=24 +ALLOWED_IPS="0.0.0.0/0, ::0/0" +UNATTUPG=1 +INSTALLED_PACKAGES=(bsdmainutils iptables-persistent wireguard-tools qrencode unattended-upgrades) diff --git a/wireguard/configs/MI9T.conf b/wireguard/configs/MI9T.conf new file mode 100644 index 00000000..93a16c8f --- /dev/null +++ b/wireguard/configs/MI9T.conf @@ -0,0 +1,10 @@ +[Interface] +PrivateKey = CKN9X90gBumM3eyO9l4U2NnbBRDKbN6QxkjzAaV1v3Q= +Address = 10.6.0.3/24 +DNS = 192.168.0.28, 192.168.0.1 + +[Peer] +PublicKey = pNroC7tmKBFYMAsxpy6OCO4R5+q6UkI0Kc3HpU20DGs= +PresharedKey = WAZz3vuj7Z/OB7QRUWfktJAM40iyQOs40Wf35Y4j1uU= +Endpoint = realm.mynetgear.com:51830 +AllowedIPs = 0.0.0.0/0, ::0/0 diff --git a/wireguard/configs/clients.txt b/wireguard/configs/clients.txt index e69de29b..c988486a 100644 --- a/wireguard/configs/clients.txt +++ b/wireguard/configs/clients.txt @@ -0,0 +1,4 @@ +t450s fRbaZkTY6J6GmpxS1l96mGwbtOPfqkXn5y+nqk7LPUQ= 1643012371 2 +MI9T ia/Rg8VebUFZNxmXE6QZbtJ+6hu2A9CLi2/rmAMxUlI= 1643012459 3 +predator iVjCSQcal+EqsJtNBg9OXudoqMnW+mfgt11ckBDtrxQ= 1643012716 4 +work u0FZwyBFiC3Jc2A04HECN1GhKRQRRLrPRYqIT5+fXyo= 1643012761 5 diff --git a/wireguard/configs/predator.conf b/wireguard/configs/predator.conf new file mode 100644 index 00000000..d798c954 --- /dev/null +++ b/wireguard/configs/predator.conf @@ -0,0 +1,10 @@ +[Interface] +PrivateKey = CNvvrxg1GGSJJuSdGiOnAflXnuH90bANCGPo+VRkqFs= +Address = 10.6.0.4/24 +DNS = 192.168.0.28, 192.168.0.1 + +[Peer] +PublicKey = pNroC7tmKBFYMAsxpy6OCO4R5+q6UkI0Kc3HpU20DGs= +PresharedKey = CduCO3afIN67CeI3wPR0jvp9VycpYHldeVXRGnpPOH4= +Endpoint = realm.mynetgear.com:51830 +AllowedIPs = 0.0.0.0/0, ::0/0 diff --git a/wireguard/configs/t450s.conf b/wireguard/configs/t450s.conf new file mode 100644 index 00000000..b409c78e --- /dev/null +++ b/wireguard/configs/t450s.conf @@ -0,0 +1,10 @@ +[Interface] +PrivateKey = KOsacxvqq2ZNxEB9MxvOZhl4nYKQHVLp0g2m3+8TNVY= +Address = 10.6.0.2/24 +DNS = 192.168.0.28, 192.168.0.1 + +[Peer] +PublicKey = pNroC7tmKBFYMAsxpy6OCO4R5+q6UkI0Kc3HpU20DGs= +PresharedKey = EeuNCPP6k0Jr1hIlevdXPSrFerNIqqIQOGNjAp9m+q4= +Endpoint = realm.mynetgear.com:51830 +AllowedIPs = 0.0.0.0/0, ::0/0 diff --git a/wireguard/configs/work.conf b/wireguard/configs/work.conf new file mode 100644 index 00000000..b37b044d --- /dev/null +++ b/wireguard/configs/work.conf @@ -0,0 +1,10 @@ +[Interface] +PrivateKey = MFkQznj/NI30INN6lsZY/aa+pA8VDyh3k2VoRi87SWM= +Address = 10.6.0.5/24 +DNS = 192.168.0.28, 192.168.0.1 + +[Peer] +PublicKey = pNroC7tmKBFYMAsxpy6OCO4R5+q6UkI0Kc3HpU20DGs= +PresharedKey = ZjFhEO1NeoIeHrvnyfAURJ6m+MfjjnXUEP2w5ovonqk= +Endpoint = realm.mynetgear.com:51830 +AllowedIPs = 0.0.0.0/0, ::0/0 diff --git a/wireguard/keys/MI9T_priv b/wireguard/keys/MI9T_priv new file mode 100644 index 00000000..8192cce5 --- /dev/null +++ b/wireguard/keys/MI9T_priv @@ -0,0 +1 @@ +CKN9X90gBumM3eyO9l4U2NnbBRDKbN6QxkjzAaV1v3Q= diff --git a/wireguard/keys/MI9T_psk b/wireguard/keys/MI9T_psk new file mode 100644 index 00000000..b18d36be --- /dev/null +++ b/wireguard/keys/MI9T_psk @@ -0,0 +1 @@ +WAZz3vuj7Z/OB7QRUWfktJAM40iyQOs40Wf35Y4j1uU= diff --git a/wireguard/keys/MI9T_pub b/wireguard/keys/MI9T_pub new file mode 100644 index 00000000..767d38eb --- /dev/null +++ b/wireguard/keys/MI9T_pub @@ -0,0 +1 @@ +ia/Rg8VebUFZNxmXE6QZbtJ+6hu2A9CLi2/rmAMxUlI= diff --git a/wireguard/keys/predator_priv b/wireguard/keys/predator_priv new file mode 100644 index 00000000..8e4f3e6e --- /dev/null +++ b/wireguard/keys/predator_priv @@ -0,0 +1 @@ +CNvvrxg1GGSJJuSdGiOnAflXnuH90bANCGPo+VRkqFs= diff --git a/wireguard/keys/predator_psk b/wireguard/keys/predator_psk new file mode 100644 index 00000000..fd724415 --- /dev/null +++ b/wireguard/keys/predator_psk @@ -0,0 +1 @@ +CduCO3afIN67CeI3wPR0jvp9VycpYHldeVXRGnpPOH4= diff --git a/wireguard/keys/predator_pub b/wireguard/keys/predator_pub new file mode 100644 index 00000000..2464cb85 --- /dev/null +++ b/wireguard/keys/predator_pub @@ -0,0 +1 @@ +iVjCSQcal+EqsJtNBg9OXudoqMnW+mfgt11ckBDtrxQ= diff --git a/wireguard/keys/t450s_priv b/wireguard/keys/t450s_priv new file mode 100644 index 00000000..d61bafee --- /dev/null +++ b/wireguard/keys/t450s_priv @@ -0,0 +1 @@ +KOsacxvqq2ZNxEB9MxvOZhl4nYKQHVLp0g2m3+8TNVY= diff --git a/wireguard/keys/t450s_psk b/wireguard/keys/t450s_psk new file mode 100644 index 00000000..5bccc216 --- /dev/null +++ b/wireguard/keys/t450s_psk @@ -0,0 +1 @@ +EeuNCPP6k0Jr1hIlevdXPSrFerNIqqIQOGNjAp9m+q4= diff --git a/wireguard/keys/t450s_pub b/wireguard/keys/t450s_pub new file mode 100644 index 00000000..4cb3485e --- /dev/null +++ b/wireguard/keys/t450s_pub @@ -0,0 +1 @@ +fRbaZkTY6J6GmpxS1l96mGwbtOPfqkXn5y+nqk7LPUQ= diff --git a/wireguard/keys/work_priv b/wireguard/keys/work_priv new file mode 100644 index 00000000..f27708d5 --- /dev/null +++ b/wireguard/keys/work_priv @@ -0,0 +1 @@ +MFkQznj/NI30INN6lsZY/aa+pA8VDyh3k2VoRi87SWM= diff --git a/wireguard/keys/work_psk b/wireguard/keys/work_psk new file mode 100644 index 00000000..ac5c7d4c --- /dev/null +++ b/wireguard/keys/work_psk @@ -0,0 +1 @@ +ZjFhEO1NeoIeHrvnyfAURJ6m+MfjjnXUEP2w5ovonqk= diff --git a/wireguard/keys/work_pub b/wireguard/keys/work_pub new file mode 100644 index 00000000..e0f37399 --- /dev/null +++ b/wireguard/keys/work_pub @@ -0,0 +1 @@ +u0FZwyBFiC3Jc2A04HECN1GhKRQRRLrPRYqIT5+fXyo= diff --git a/wireguard/wg0.conf b/wireguard/wg0.conf index 72eb4c4f..4708d803 100644 --- a/wireguard/wg0.conf +++ b/wireguard/wg0.conf @@ -3,3 +3,27 @@ PrivateKey = KPhif2Qq68yCMR+HaGjTxm7IXYMUOOsnvAYimS9AVFw= Address = 10.6.0.1/24 MTU = 1420 ListenPort = 51830 +### begin t450s ### +[Peer] +PublicKey = fRbaZkTY6J6GmpxS1l96mGwbtOPfqkXn5y+nqk7LPUQ= +PresharedKey = EeuNCPP6k0Jr1hIlevdXPSrFerNIqqIQOGNjAp9m+q4= +AllowedIPs = 10.6.0.2/32 +### end t450s ### +### begin MI9T ### +[Peer] +PublicKey = ia/Rg8VebUFZNxmXE6QZbtJ+6hu2A9CLi2/rmAMxUlI= +PresharedKey = WAZz3vuj7Z/OB7QRUWfktJAM40iyQOs40Wf35Y4j1uU= +AllowedIPs = 10.6.0.3/32 +### end MI9T ### +### begin predator ### +[Peer] +PublicKey = iVjCSQcal+EqsJtNBg9OXudoqMnW+mfgt11ckBDtrxQ= +PresharedKey = CduCO3afIN67CeI3wPR0jvp9VycpYHldeVXRGnpPOH4= +AllowedIPs = 10.6.0.4/32 +### end predator ### +### begin work ### +[Peer] +PublicKey = u0FZwyBFiC3Jc2A04HECN1GhKRQRRLrPRYqIT5+fXyo= +PresharedKey = ZjFhEO1NeoIeHrvnyfAURJ6m+MfjjnXUEP2w5ovonqk= +AllowedIPs = 10.6.0.5/32 +### end work ###