Merge branch 'master' of code.ungleich.ch:ungleich-public/ungleich-tools
This commit is contained in:
Nico Schottelius
commit
b038bcfee7
|
|
@ -0,0 +1,163 @@
|
|||
#!/bin/sh
|
||||
|
||||
# This script generates Devuan images for OpenNebula.
|
||||
#
|
||||
# Test image locally (without network) with:
|
||||
# qemu-system-x86_64 -enable-kvm -m 1G -drive file=$IMAGE,format=qcow2
|
||||
|
||||
set -e
|
||||
set -x
|
||||
|
||||
# XXX: Handle command-line arguments?
|
||||
RELEASE=beowulf
|
||||
ARCH=amd64
|
||||
IMAGE_PATH=devuan-$RELEASE-$(date --iso-8601).img.qcow2
|
||||
IMAGE_SIZE=10G
|
||||
NBD_DEVICE=/dev/nbd0
|
||||
HOSTNAME=devuan
|
||||
MIRROR=http://pkgmaster.devuan.org/merged
|
||||
|
||||
# TODO: find the package definition and built ourself, publish in some RPM repository.
|
||||
ONE_CONTEXT_DEB_URL="https://github.com/OpenNebula/addon-context-linux/releases/download/v5.10.0/one-context_5.10.0-1.deb"
|
||||
ONE_CONTEXT_DEB_PATH=/root/one-context.deb
|
||||
|
||||
cleanup() {
|
||||
# The order here is important.
|
||||
umount /mnt/dev/pts 2>/dev/null || true
|
||||
umount /mnt/dev/shm 2>/dev/null || true
|
||||
umount /mnt/dev 2>/dev/null || true
|
||||
umount /mnt/proc 2>/dev/null || true
|
||||
umount /mnt/run 2>/dev/null || true
|
||||
umount /mnt/sys 2>/dev/null || true
|
||||
umount /mnt/boot 2>/dev/null || true
|
||||
umount /mnt 2>/dev/null || true
|
||||
qemu-nbd --disconnect "$NBD_DEVICE" || true
|
||||
}
|
||||
|
||||
run_root() {
|
||||
chroot /mnt /usr/bin/env \
|
||||
PATH=/sbin:/usr/sbin:/bin:/usr/bin \
|
||||
sh -c "$*"
|
||||
}
|
||||
|
||||
if [ "$(whoami)" != 'root' ]; then
|
||||
echo "This script must be run as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $(lsb_release --short --id) != "Devuan" ]; then
|
||||
echo "WARNING: this script has been designed to run on a Devuan system." >&2
|
||||
echo "WARNING: Not running Debian. Giving you 5 seconds to abort." >&2
|
||||
sleep 5
|
||||
fi
|
||||
|
||||
# Create base QCOW2 image.
|
||||
qemu-img create -f qcow2 "$IMAGE_PATH" "$IMAGE_SIZE"
|
||||
modprobe nbd max_part=16
|
||||
qemu-nbd --connect="$NBD_DEVICE" "$IMAGE_PATH"
|
||||
|
||||
# Wait for qemu-nbd to settle.
|
||||
sleep 1
|
||||
|
||||
# Don't forget to cleanup, even if the script crash.
|
||||
trap cleanup EXIT
|
||||
|
||||
# Create partition table, format partitions.
|
||||
sfdisk --no-reread "$NBD_DEVICE" <<EOF
|
||||
1M,500M,L,*
|
||||
,,L
|
||||
EOF
|
||||
|
||||
mkfs.ext4 "${NBD_DEVICE}p1"
|
||||
mkfs.ext4 "${NBD_DEVICE}p2"
|
||||
|
||||
# Mount partitions, install base OS.
|
||||
|
||||
mount "${NBD_DEVICE}p2" /mnt
|
||||
mkdir /mnt/boot
|
||||
mount "${NBD_DEVICE}p1" /mnt/boot
|
||||
|
||||
debootstrap \
|
||||
--arch=$ARCH $RELEASE \
|
||||
/mnt $MIRROR
|
||||
|
||||
mount --bind /dev /mnt/dev
|
||||
mount --bind /dev/pts /mnt/dev/pts
|
||||
mount --bind /dev/shm /mnt/dev/shm
|
||||
mount --bind /proc /mnt/proc
|
||||
mount --bind /run /mnt/run
|
||||
mount --bind /sys /mnt/sys
|
||||
|
||||
# Guest networking is to be handled by the one-context package.
|
||||
# See https://github.com/OpenNebula/addon-context-linux for details.
|
||||
|
||||
# Required to resolve package mirror in chroot.
|
||||
cp /etc/resolv.conf /mnt/etc/resolv.conf
|
||||
|
||||
# Initialize /etc/hosts.
|
||||
cat > /mnt/etc/hosts << EOF
|
||||
127.0.0.1 $HOSTNAME localhost localhost.localdomain localhost4 localhost4.localdomain4
|
||||
::1 $HOSTNAME localhost localhost.localdomain localhost6 localhost6.localdomain6
|
||||
|
||||
EOF
|
||||
|
||||
run_root hostname $HOSTNAME
|
||||
|
||||
# Configure package sources and update package index.
|
||||
cat >/mnt/etc/apt/sources.list <<EOF
|
||||
# Stable
|
||||
deb $MIRROR $RELEASE main contrib non-free
|
||||
deb-src $MIRROR $RELEASE main contrib non-free
|
||||
|
||||
# Security updates
|
||||
deb $MIRROR $RELEASE-updates main contrib non-free
|
||||
deb-src $MIRROR $RELEASE-updates main contrib non-free
|
||||
|
||||
# Backports
|
||||
#deb $MIRROR $RELEASE-backports main
|
||||
#deb-src $MIRROR $RELEASE-backports main
|
||||
EOF
|
||||
run_root apt-get update
|
||||
|
||||
# Install (magic?) one-context DEB and hope things works as expected.
|
||||
curl -L "$ONE_CONTEXT_DEB_URL" > "/mnt$ONE_CONTEXT_DEB_PATH"
|
||||
run_root apt-get -y install "$ONE_CONTEXT_DEB_PATH"
|
||||
run_root rm "$ONE_CONTEXT_DEB_PATH"
|
||||
|
||||
# Manually install legacy network scripts used by one-context.
|
||||
run_root apt-get -y install ifupdown
|
||||
|
||||
run_root ln -sf /usr/share/zoneinfo/UTC /etc/localtime
|
||||
|
||||
# Install kernel and bootloader. Do not autoconfigure grub.
|
||||
run_root 'echo "grub-pc grub-pc/install_devices_empty boolean true" | debconf-set-selections'
|
||||
run_root DEBIAN_FRONTEND=noninteractive apt-get -y install locales linux-image-amd64 grub-pc
|
||||
|
||||
# Configure grub.
|
||||
run_root grub-install --target=i386-pc "${NBD_DEVICE}"
|
||||
run_root grub-mkconfig -o /boot/grub/grub.cfg
|
||||
|
||||
# Install en configure SSH daemon.
|
||||
run_root apt-get -y install openssh-server
|
||||
|
||||
# Install haveged due to lack of entropy in ONE environment.
|
||||
run_root apt-get -y install haveged
|
||||
run_root update-rc.d haveged defaults
|
||||
|
||||
# Generate locales.
|
||||
run_root 'sed -i "s/^# *\(en_GB.UTF-8\)/\1/" etc/locale.gen'
|
||||
run_root locale-gen
|
||||
|
||||
# Generate fstab file.
|
||||
boot_uuid=$(blkid --match-tag UUID --output value "${NBD_DEVICE}p1")
|
||||
root_uuid=$(blkid --match-tag UUID --output value "${NBD_DEVICE}p2")
|
||||
cat >>/mnt/etc/fstab <<EOF
|
||||
UUID=$boot_uuid /boot ext4 rw,relatime,data=ordered 0 2
|
||||
UUID=$root_uuid / ext4 rw,relatime,data=ordered 0 1
|
||||
EOF
|
||||
|
||||
# Remove temporary files and reclaim freed disk space.
|
||||
run_root apt-get clean
|
||||
|
||||
# Make sure everything is written to disk before exiting.
|
||||
sync
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
#!/bin/sh
|
||||
|
||||
if [ $# -lt 1 ]; then
|
||||
echo "$0 ip-address"
|
||||
echo " ip-address: where to find the device"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
set -x
|
||||
|
||||
openwrt_ip=$1; shift
|
||||
|
||||
ping -c3 ${openwrt_ip}
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Cannot reach ${openwrt_ip}, aborting"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat <<EOF | ssh -t "root@${openwrt_ip}"
|
||||
set -x
|
||||
|
||||
opkg update
|
||||
opkg install mjpg-streamer kmod-video-uvc
|
||||
|
||||
uci set mjpg-streamer.core.enabled=1
|
||||
uci set mjpg-streamer.core.resolution="1920x1080"
|
||||
uci delete mjpg-streamer.core.username
|
||||
uci delete mjpg-streamer.core.password
|
||||
uci commit
|
||||
|
||||
/etc/init.d/mjpg-streamer restart
|
||||
|
||||
EOF
|
||||
|
||||
exit 0
|
||||
|
||||
|
||||
# This is old code / when we used motion
|
||||
|
||||
cat <<EOF | ssh -t "root@${openwrt_ip}"
|
||||
set -x
|
||||
|
||||
opkg update
|
||||
opkg install motion kmod-video-uvc
|
||||
|
||||
uci set motion.general.enabled=1
|
||||
|
||||
cat > /etc/motion.conf <<COF
|
||||
|
||||
ipv6_enabled on
|
||||
daemon off
|
||||
process_id_file /var/run/motion/motion.pid
|
||||
setup_mode off
|
||||
|
||||
webcontrol_port 8080
|
||||
webcontrol_localhost on
|
||||
|
||||
videodevice /dev/video0
|
||||
v4l2_palette 8
|
||||
|
||||
width 1280
|
||||
height 720
|
||||
|
||||
videodevice /dev/video0
|
||||
input -1
|
||||
stream_port 8081
|
||||
stream_localhost off
|
||||
|
||||
COF
|
||||
|
||||
/etc/init.d/motion restart
|
||||
EOF
|
||||
|
|
@ -1,5 +1,31 @@
|
|||
#!/bin/sh
|
||||
|
||||
opkg install kmod-usb-acm
|
||||
if [ $# -lt 1 ]; then
|
||||
echo "$0 ip-address"
|
||||
echo " ip-address: where to find the device"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ugps?
|
||||
|
||||
set -x
|
||||
|
||||
openwrt_ip=$1; shift
|
||||
|
||||
ping -c3 ${openwrt_ip}
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Cannot reach ${openwrt_ip}, aborting"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat <<EOF | ssh -t "root@${openwrt_ip}"
|
||||
set -x
|
||||
|
||||
opkg update
|
||||
opkg install kmod-usb-acm gpsd
|
||||
|
||||
uci set gpsd.core.enabled=1
|
||||
uci set gpsd.core.listen_globally=1
|
||||
uci set gpsd.core.device="/dev/ttyACM0"
|
||||
uci commit
|
||||
|
||||
EOF
|
||||
|
|
|
|||
|
|
@ -0,0 +1,32 @@
|
|||
#!/bin/sh
|
||||
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "$0 ip-address nat64-prefix"
|
||||
echo " ip-address: where to find the OpenWRT device"
|
||||
echo " nat64-prefix: which network to use for outgoing 'ipv4' (f.i. 2a0a:e5c0:2:10::/96)"
|
||||
echo " ip-address: where to find the OpenWRT device"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
my_ip=$1; shift
|
||||
nat64_prefix=$1; shift
|
||||
|
||||
cat <<EOF | ssh -t "root@${my_ip}"
|
||||
set -x
|
||||
|
||||
opkg update
|
||||
opkg install kmod-jool jool-tools
|
||||
|
||||
# Depending on the interface
|
||||
sysctl -w net.ipv6.conf.wlan0.accept_ra=2
|
||||
|
||||
modprobe jool_siit
|
||||
jool_siit -6 2a0a:e5c0:2:10::/96
|
||||
jool_siit -e -a 2a0a:e5c0:10:b01::/64 192.168.1.0/24
|
||||
|
||||
|
||||
|
||||
#jool_siit -e -a 2a0a:e5c1:14d:f00d::/96 10.0.0.0/8
|
||||
|
||||
|
||||
EOF
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
#!/bin/sh
|
||||
# Based on work of Samuel Hailu, 2020-09-10
|
||||
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "$0 ip-address interface"
|
||||
echo " ip-address: where to find the OpenWRT device"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
my_ip=$1; shift
|
||||
interface=$1; shift
|
||||
|
||||
cat <<EOF | ssh -t "root@${my_ip}"
|
||||
set -x
|
||||
|
||||
# update the sources & allow https handling
|
||||
opkg update
|
||||
opkg install libustream-openssl ca-bundle ca-certificates
|
||||
|
||||
# Install needed kernel module
|
||||
opkg install kmod-usb-net-qmi-wwan uqmi luci-proto-qmi
|
||||
|
||||
# opkg install usb-modeswitch kmod-mii kmod-usb-net kmod-usb-wdm kmod-usb-net-qmi-wwan uqmi
|
||||
|
||||
# Create interface
|
||||
# uci set network.LTE=interface
|
||||
# uci set network.LTE.ifname='${interface}'
|
||||
# uci set network.LTE.proto='dhcp'
|
||||
|
||||
# add to correct firewall zone
|
||||
# current_networks=\$(uci get firewall.@zone[1].network)
|
||||
|
||||
# if ! echo \$current_networks | grep -q LTE; then
|
||||
# uci set firewall.@zone[1].network='\${current_networks} LTE'
|
||||
# fi
|
||||
|
||||
# commit
|
||||
uci commit
|
||||
|
||||
# reboot
|
||||
|
||||
reboot
|
||||
|
||||
EOF
|
||||
|
|
@ -1,9 +1,39 @@
|
|||
#!/bin/sh
|
||||
|
||||
opkg install kmod-usb-hid
|
||||
opkg install python3-pyserial
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "$0 ip-address"
|
||||
echo " ip-address: where to find the OpenWRT device"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
wget -O - https://files.pythonhosted.org/packages/cc/bb/2f676fdf64be88de068938be2193f091e76c53d277277e07f6153223cdda/temper-py-0.0.1.tar.gz | tar xz temper-py-0.0.1/temper.py
|
||||
my_ip=$1; shift
|
||||
|
||||
|
||||
temper_version=0.0.2
|
||||
temper_url=https://files.pythonhosted.org/packages/7e/1b/0579fef8482660fe194099d988a8ae82b5e5843a60070520039789b26a84/temper-py-0.0.2.tar.gz
|
||||
|
||||
cat <<EOF | ssh -t "root@${my_ip}"
|
||||
set -x
|
||||
|
||||
opkg update
|
||||
|
||||
opkg install libustream-openssl ca-bundle ca-certificates
|
||||
opkg install kmod-usb-hid python3-pyserial
|
||||
|
||||
|
||||
wget -O - ${temper_url} | tar xz temper-py-${temper_version}/temper.py
|
||||
|
||||
mv temper-py-${temper_version}/temper.py /usr/bin
|
||||
rmdir temper-py-${temper_version}
|
||||
chmod a+rx /usr/bin/temper.py
|
||||
|
||||
if ! grep -q temper /etc/crontabs/root; then
|
||||
echo "*/5 * * * * /usr/bin/temper.py | awk '{ print $7 " " $8 }' > /www/temperature.txt" >> /etc/crontabs/root
|
||||
/etc/init.d/cron restart
|
||||
fi
|
||||
|
||||
|
||||
EOF
|
||||
|
||||
exit 0
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,63 @@
|
|||
#!/bin/sh
|
||||
# Nico Schottelius
|
||||
# 2020-11-19
|
||||
|
||||
if [ $# -lt 4 ]; then
|
||||
echo "$0 ip-address vpn-server ipv6-network [privatekey]"
|
||||
echo " ip-address: where to find the OpenWRT device"
|
||||
echo " vpn-server: where to connect to"
|
||||
echo " vpn-server-pubkey: public key of the server"
|
||||
echo " ipv6-network: which network to use for us (/48 expected)"
|
||||
echo " private-key: specify wireguard key optionally"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
my_ip=$1; shift
|
||||
vpn_endpoint_host=$1; shift
|
||||
vpn_endpoint_pubkey=$1; shift
|
||||
network=$1; shift
|
||||
|
||||
# wireguard
|
||||
if [ $# -eq 1 ]; then
|
||||
private_key=$1; shift
|
||||
else
|
||||
private_key=$(wg genkey)
|
||||
fi
|
||||
|
||||
my_prefix=$(echo $network | sed 's,::/.*,,')
|
||||
my_wireguard_ip=${my_prefix}::42
|
||||
|
||||
public_key=$(echo $private_key | wg pubkey)
|
||||
|
||||
cat <<EOF | ssh -t "root@${my_ip}"
|
||||
set -x
|
||||
|
||||
opkg update
|
||||
|
||||
opkg install wireguard luci-app-wireguard
|
||||
|
||||
# VPN / Wireguard
|
||||
uci set network.wg0=interface
|
||||
uci set network.wg0.proto='wireguard'
|
||||
uci set network.wg0.private_key='${private_key}'
|
||||
uci set network.wg0.listen_port='51820'
|
||||
uci set network.wg0.addresses='${my_wireguard_ip}/64'
|
||||
|
||||
if ! uci get network.@wireguard_wg0[0]; then
|
||||
uci add network wireguard_wg0
|
||||
fi
|
||||
|
||||
uci set network.@wireguard_wg0[0]=wireguard_wg0
|
||||
uci set network.@wireguard_wg0[0].persistent_keepalive='25'
|
||||
uci set network.@wireguard_wg0[0].public_key='${vpn_endpoint_pubkey}'
|
||||
uci set network.@wireguard_wg0[0].description='IPv6VPN.ch by ungleich'
|
||||
uci set network.@wireguard_wg0[0].allowed_ips='::/0'
|
||||
uci set network.@wireguard_wg0[0].endpoint_host='${vpn_endpoint_host}'
|
||||
uci set network.@wireguard_wg0[0].endpoint_port='51820'
|
||||
uci set network.@wireguard_wg0[0].route_allowed_ips='1'
|
||||
|
||||
# commit
|
||||
uci commit
|
||||
reboot
|
||||
|
||||
EOF
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
#!/bin/sh
|
||||
|
||||
if [ $# -lt 1 ]; then
|
||||
echo "$0 ip-address"
|
||||
echo " ip-address: where to find the device"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
openwrt_ip=$1; shift
|
||||
|
||||
ping -c3 ${openwrt_ip}
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Cannot reach ${openwrt_ip}, aborting"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat <<EOF | ssh -t "root@${openwrt_ip}"
|
||||
opkg update
|
||||
opkg install kmod-iwlwifi iwlwifi-firmware-iwl7265d wpa-supplicant
|
||||
EOF
|
||||
Loading…
Reference in New Issue