Compare commits

...

8 commits
nginx ... dev

Author SHA1 Message Date
fc090a010c Alpine 3.17.1
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
2023-01-15 18:00:36 -03:00
37ad9e62a2 nftables
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
2022-11-17 22:50:56 -03:00
e9edb55a47 data: Sobreescribir si ya existe
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
2022-11-17 22:38:39 -03:00
962493f352 Alpine 3.16.3
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
2022-11-17 22:29:10 -03:00
986a5cc1ee qemu.sh: quiet 2022-11-17 22:28:55 -03:00
4622625570 runit: poweroff/reboot scripts 2022-11-17 22:28:32 -03:00
88e9406963 runit: Arreglar reboot 2022-11-17 22:28:19 -03:00
320e94b40d runit: Iniciar tty en serial 2022-11-17 22:25:55 -03:00
5 changed files with 109 additions and 4 deletions

View file

@ -31,7 +31,7 @@ mount '{{path}}' '{{mountpoint}}' -o bind,umask=100,uid={{uid}},gid={{gid}} || e
local link = links[i]
string = string .. t([[
mkdir -p '{{dirname}}' || exit 1
ln -s '{{target}}' '{{path}}' || exit 1
ln -sf '{{target}}' '{{path}}' || exit 1
]],
{ dirname = utils.dirname(link.path),
target = link.target, path = link.path }

95
modules/nftables.lua Normal file
View file

@ -0,0 +1,95 @@
modules.nftables = {}
add_packages({ "nftables" })
add_file("/etc/nftables.nft", [[
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
iifname lo accept \
comment "Accept any localhost traffic"
ct state { established, related } accept \
comment "Accept traffic originated from us"
ct state invalid drop \
comment "Drop invalid connections"
tcp dport 113 reject with icmpx type port-unreachable \
comment "Reject AUTH to make it fail fast"
ip protocol icmp icmp type {
echo-reply, # type 0
destination-unreachable, # type 3
echo-request, # type 8
time-exceeded, # type 11
parameter-problem, # type 12
} accept \
comment "Accept ICMP"
ip6 nexthdr icmpv6 icmpv6 type {
destination-unreachable, # type 1
packet-too-big, # type 2
time-exceeded, # type 3
parameter-problem, # type 4
echo-request, # type 128
echo-reply, # type 129
} accept \
comment "Accept basic IPv6 functionality"
ip6 nexthdr icmpv6 icmpv6 type {
nd-router-solicit, # type 133
nd-router-advert, # type 134
nd-neighbor-solicit, # type 135
nd-neighbor-advert, # type 136
} ip6 hoplimit 255 accept \
comment "Allow IPv6 SLAAC"
ip6 nexthdr icmpv6 icmpv6 type {
mld-listener-query, # type 130
mld-listener-report, # type 131
mld-listener-reduction, # type 132
mld2-listener-report, # type 143
} ip6 saddr fe80::/10 accept \
comment "Allow IPv6 multicast listener discovery on link-local"
ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept \
comment "Accept DHCPv6 replies from IPv6 link-local addresses"
tcp dport 80 counter accept \
comment "Allow HTTP"
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
# The state of stateful objects saved on the nftables service stop.
include "/var/lib/nftables/*.nft"
]])
modules.runit.add_service("nftables", [[#!/bin/sh
if [ ! -r /etc/nftables.nft ]; then
echo "No config, dropping everything"
nft -f /dev/stdin <<-EOF
flush ruleset
table inet filter {
chain input { type filter hook input priority 0; policy drop; }
chain forward { type filter hook forward priority 0; policy drop; }
chain output { type filter hook output priority 0; policy drop; }
}
EOF
exit 1
fi
nft -f /etc/nftables.nft
exec sleep infinity
]])

View file

@ -2,6 +2,7 @@ mkdir("/etc/runit/runsvdir/default")
add_symlink("/etc/runit/runsvdir/current", "/etc/runit/runsvdir/default")
add_symlink("/etc/service", "/etc/runit/runsvdir/current")
add_symlink("/etc/runit/stopit", "/run/runit/stopit")
add_symlink("/etc/runit/reboot", "/run/runit/reboot")
local t = require "../utils/templater"
local function add_executable(path, script)
@ -361,9 +362,17 @@ if [ -z "$VIRTUALIZATION" ]; then
fi
]])
-- https://wiki.gentoo.org/wiki/Runit#Reboot_and_shutdown
add_executable("/usr/local/sbin/rpoweroff", [[#!/bin/sh
runit-init 0]])
add_executable("/usr/local/sbin/rreboot", [[#!/bin/sh
runit-init 6]])
add_packages({ "runit", "eudev" })
modules.runit.add_service("getty-tty1", [[#!/bin/sh
exec chpst -P getty 38400 tty1 linux]], false)
modules.runit.add_service("getty-tty2", [[#!/bin/sh
exec chpst -P getty 38400 tty2 linux]], false)
modules.runit.add_service("getty-ttyS0", [[#!/bin/sh
exec chpst -P getty 38400 ttyS0 linux]], false)

View file

@ -15,4 +15,4 @@ qemu-system-x86_64 -enable-kvm -m 2048 \
-net nic,model=virtio-net-pci \
-net user,hostfwd=tcp:10.69.0.2:8080-:80 \
-kernel boot/vmlinuz-virt -initrd boot/initramfs-virt \
-append "root=/dev/sda rootfstype=squashfs modules=ext4 init=/sbin/runit-init $append" $qemuappend
-append "root=/dev/sda rootfstype=squashfs modules=ext4 quiet init=/sbin/runit-init $append" $qemuappend

View file

@ -1,8 +1,8 @@
local utils = require("utils")
local alpine = require("alpine")
local alpine_base_version = "3.16"
local alpine_version = alpine_base_version..".0"
local alpine_base_version = "3.17"
local alpine_version = alpine_base_version..".1"
local packages = {
"alpine-baselayout",
-- "alpine-conf",
@ -49,6 +49,7 @@ module "hostname"
module "dhcpcd"
module "ntpsec"
module "nginx"
module "nftables"
print("=> Installing and upgrading packages...")
utils.expect_nil(alpine.make_world(root, packages))