821675ab4a
Specs stay at repo root (cross-VM). Move deploy and code into logical projects with README per domain, updated manifest.yaml, and symlinks at legacy paths for VM122 backward compatibility.
70 lines
2.4 KiB
Bash
Executable file
70 lines
2.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# VM123 bootstrap — users, swap, docker, fail2ban (Spec 024)
|
|
# Executar como root na VM123 recém-instalada (Ubuntu 24.04).
|
|
set -euo pipefail
|
|
|
|
DESK_PASSWORD="${DESK_PASSWORD:-805353}"
|
|
|
|
echo "==> Utilizadores mini, admin, root"
|
|
id mini &>/dev/null || useradd -m -s /bin/bash mini
|
|
id admin &>/dev/null || useradd -m -s /bin/bash admin
|
|
usermod -aG sudo admin 2>/dev/null || true
|
|
echo "mini:${DESK_PASSWORD}" | chpasswd
|
|
echo "admin:${DESK_PASSWORD}" | chpasswd
|
|
echo "root:${DESK_PASSWORD}" | chpasswd
|
|
|
|
echo "==> Swap 2G (piloto 4GB RAM)"
|
|
if ! swapon --show | grep -q swapfile; then
|
|
fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
|
|
chmod 600 /swapfile
|
|
mkswap /swapfile
|
|
swapon /swapfile
|
|
grep -q '/swapfile' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab
|
|
fi
|
|
|
|
echo "==> Pacotes base"
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq curl wget git ufw fail2ban unattended-upgrades \
|
|
apt-transport-https ca-certificates gnupg lsb-release
|
|
|
|
echo "==> Docker"
|
|
if ! command -v docker &>/dev/null; then
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
|
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
|
|
> /etc/apt/sources.list.d/docker.list
|
|
apt-get update -qq
|
|
apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
fi
|
|
usermod -aG docker admin 2>/dev/null || true
|
|
usermod -aG docker mini 2>/dev/null || true
|
|
|
|
echo "==> fail2ban sshd"
|
|
cat > /etc/fail2ban/jail.local <<'EOF'
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
findtime = 600
|
|
EOF
|
|
systemctl enable fail2ban
|
|
systemctl restart fail2ban
|
|
|
|
echo "==> UFW básico"
|
|
ufw allow OpenSSH
|
|
ufw allow 80/tcp
|
|
ufw allow 443/tcp
|
|
ufw allow 2083/tcp comment 'OpenPanel user'
|
|
ufw allow 2087/tcp comment 'OpenAdmin' from 10.10.10.0/24
|
|
ufw --force enable || true
|
|
|
|
echo "==> Wazuh agent (VM104) — instalar manualmente se o manager estiver activo:"
|
|
echo " curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.2-1_amd64.deb"
|
|
echo " WAZUH_MANAGER=10.10.10.104 dpkg -i wazuh-agent.deb"
|
|
|
|
hostnamectl set-hostname vm123-finance 2>/dev/null || true
|
|
echo "Bootstrap VM123 concluído."
|