Maurice/alpine-server-setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updates

Browse Source
This commit is contained in:
Maurice
2025-09-30 20:06:30 +02:00
parent 9a0277a48d
commit 313284fafd
9 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
installation/podman.sh
View File

@@ -16,6 +16,9 @@ su -c "podman system migrate" podman
# Get rid of podman compose docker warning # Get rid of podman compose docker warning
touch /etc/containers/nodocker touch /etc/containers/nodocker
# Use netavark and nftables
sed -i '/^\[network\]/a network_backend = "netavark"\nfirewall_driver = "nftables"' /etc/containers/containers.conf
# Fix shared mount with local service # Fix shared mount with local service
cat << EOF > /etc/local.d/mount-rshared.start cat << EOF > /etc/local.d/mount-rshared.start
#!/bin/sh #!/bin/sh

7
services/adguard/service.toml
View File

@@ -1,5 +1,4 @@
user = "podman" capabilities = ["NET_RAW", "NET_ADMIN"]
capabilities = ["NET_BIND_SERVICE", "NET_RAW", "NET_ADMIN"]
[service] [service]
name = "adguard" name = "adguard"
@@ -16,12 +15,12 @@ target = "/opt/adguardhome/certificates"
create = true create = true
[[volumes]] [[volumes]]
source = "$HOME/adguard" source = "/var/containers/adguard"
target = "/opt/adguardhome/conf" target = "/opt/adguardhome/conf"
[[ports]] [[ports]]
host = 8888 host = 8888
container = 8080 container = 3000
# DNS ports # DNS ports
[[ports]] [[ports]]

4
services/adguard/update.sh
View File

@@ -1,3 +1,3 @@
#!/bin/sh #!/bin/sh
mkdir -p /home/podman/adguard mkdir -p /var/containers/adguard
ln -sf ./AdGuardHome.yaml /home/podman/adguard/AdGuardHome.yaml ln -sf $(pwd)/AdGuardHome.yaml /var/containers/adguard/AdGuardHome.yaml

2
services/caddy/service.toml
View File

@@ -7,7 +7,7 @@ image = "caddy:alpine"
[[mounts]] [[mounts]]
typ = "bind" typ = "bind"
source = "$HOME/caddy" source = "/var/containers/caddy"
target = "/etc/caddy" target = "/etc/caddy"
read_only = true read_only = true

5
services/caddy/update.sh
View File

@@ -1,6 +1,7 @@
#!/bin/sh #!/bin/sh
mkdir -p /home/podman/caddy mkdir -p /var/containers/caddy
ln -sf ./Caddyfile /home/podman/caddy/Caddyfile ln -sf $(pwd)/Caddyfile /var/containers/caddy/Caddyfile
chown -R podman:podman /var/containers/caddy
if [ "$1" = "reload" ]; then if [ "$1" = "reload" ]; then
podman exec caddy caddy reload -c /etc/caddy/Caddyfile podman exec caddy caddy reload -c /etc/caddy/Caddyfile

12
services/firewall/rules.nft
View File

@@ -7,6 +7,9 @@ define vpn_net = 10.0.0.0/24
define lan_net = 192.168.2.0/24 define lan_net = 192.168.2.0/24
define self = 192.168.2.22 define self = 192.168.2.22
# delegated prefix is 2a02:a45e:ce93::/48
define lan_net6 = 2a02:a45e:ce93:0::/64
define icmpv4_basic = { define icmpv4_basic = {
echo-reply, # type 0 / ping echo-reply, # type 0 / ping
echo-request, # type 8 / ping echo-request, # type 8 / ping
@@ -50,7 +53,7 @@ table inet firewall {
type filter hook input priority 0; policy drop; type filter hook input priority 0; policy drop;
ct state invalid drop # early drop of invalid packets ct state invalid drop # early drop of invalid packets
ct state {established, related} accept # allow established/related connections ct state { established, related } accept # allow established/related connections
iif lo accept # allow traffic from loopback interface iif lo accept # allow traffic from loopback interface
@@ -67,10 +70,13 @@ table inet firewall {
# AdGuard admin access (8888) only from LAN and VPN # AdGuard admin access (8888) only from LAN and VPN
ip saddr { $lan_net, $vpn_net } tcp dport 8888 accept ip saddr { $lan_net, $vpn_net } tcp dport 8888 accept
ip6 saddr $lan_net6 tcp dport 8888 accept
# AdGuard DNS, DHCP, DoT, DoQ ports only from LAN and VPN # Adguard DNS, DHCP, DoT, DoQ ports only from LAN and VPN
ip saddr { $lan_net, $vpn_net} udp dport { 53, 67, 68, 784 } accept ip saddr { $lan_net, $vpn_net} udp dport { 53, 67, 68, 784 } accept
ip saddr { $lan_net, $vpn_net} tcp dport { 53, 853 } accept ip saddr { $lan_net, $vpn_net} tcp dport { 53, 853 } accept
ip6 saddr $lan_net6 udp dport { 53, 67, 68, 784 } accept
ip6 saddr $lan_net6 tcp dport { 53, 853 } accept
# Rules for WAN interface only # Rules for WAN interface only
iifname $wan udp dport 51820 accept # Allow Wireguard incoming from WAN iifname $wan udp dport 51820 accept # Allow Wireguard incoming from WAN

2
services/firewall/update.sh
View File

@@ -1,5 +1,5 @@
#!/bin/sh #!/bin/sh
ln -sf ./rules.nft /etc/nftables.d/firewall.nft ln -sf $(pwd)/rules.nft /etc/nftables.d/firewall.nft
echo "Reloading firewall rules..." echo "Reloading firewall rules..."
nft -f /etc/nftables.nft nft -f /etc/nftables.nft

2
services/ssh/update.sh
View File

@@ -1,5 +1,5 @@
#!/bin/sh #!/bin/sh
ln -sf ./sshd_config /etc/ssh/sshd_config ln -sf $(pwd)/sshd_config /etc/ssh/sshd_config
if [ "$1" = "reload" ]; then if [ "$1" = "reload" ]; then
rc-service sshd restart rc-service sshd restart

4
services/wireguard/install.sh
View File

@@ -15,6 +15,10 @@ ListenPort = 51820
DNS = 192.168.2.22 # AdGuard DNS server IP DNS = 192.168.2.22 # AdGuard DNS server IP
EOF EOF
# Kernel module
modprobe wireguard
echo wireguard >> /etc/modules
# Enable IP forwarding, persistent # Enable IP forwarding, persistent
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/ip_forward.conf echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/ip_forward.conf
echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/ip_forward.conf echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/ip_forward.conf