init

2026-04-21 17:29:54 -03:00
commit 3deb54f5aa
116 changed files with 4551 additions and 0 deletions
@@ -0,0 +1,7 @@
+# ~/.bashrc
+clear
+echo "Server {{HOSTNAME}} IP: $(ip route get 1.1.1.1 | awk '{for(i=1;i<=NF;i++) if($i=="src") print $(i+1)}')"
+
+export PS1="\[\e[32m\]\h:\w\$\[\e[0m\] "
+df -h .
+cd /4server
@@ -0,0 +1 @@
+API_KEY={{API_KEY}}
@@ -0,0 +1,42 @@
+services:
+
+  beedb:
+    image: postgres:16
+    restart: always
+    environment:
+      - POSTGRES_DB=postgres
+      - POSTGRES_PASSWORD=ZpSwWNafyy9GhY2gzHw
+      - POSTGRES_USER=1gtT0sf8klB9lDbYZD9
+    volumes:
+      - /4server/data/postgres/data/:/var/lib/postgresql/data/
+      - /4server/data/postgres/pg_backup/:/BACKUP/
+      - /4server/data/postgres/etc/:/etc/postgresql/16/main/
+
+    networks:
+      4projects:
+        ipv4_address: 10.5.0.200
+
+  traefik:
+    image: docker.io/library/traefik:3.1
+    container_name: traefik
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - /run/docker.sock:/run/docker.sock:ro
+      - /4server/data/traefik/etc:/etc/traefik
+      - /4server/data/traefik/certs:/certs
+      - /4server/data/log/traefik-logs:/var/log/traefik
+    networks:
+      - 4projects
+    restart: unless-stopped
+
+networks:
+  4projects:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.5.0.0/16
+          gateway: 10.5.0.1
+          ip_range: 10.5.0.0/26
+
@@ -0,0 +1 @@
+permit nopass 4server as root
@@ -0,0 +1,10 @@
+[DEFAULT]
+bantime  = 1h
+findtime  = 30m
+maxretry = 1
+
+[sshd]
+enabled = true
+port    = ssh
+filter  = sshd
+logpath = /var/log/auth.log
@@ -0,0 +1,23 @@
+SERIAL ttyS0 115200
+DEFAULT menu.c32
+PROMPT 0
+MENU TITLE Alpine/Linux Boot Menu
+MENU HIDDEN
+MENU AUTOBOOT Alpine will be booted automatically in # seconds.
+TIMEOUT 100
+LABEL virt
+
+  MENU LABEL Linux virt
+  LINUX vmlinuz-virt
+  INITRD initramfs-virt
+  APPEND root=UUID=15665bb5-c475-4ac8-9479-d49df97d5ccb modules=sd-mod,usb-storage,ext4 console=ttyS0,115200n8 console=ttyAMA0,115200n8
+
+LABEL lts
+  MENU DEFAULT
+  MENU LABEL Linux lts
+  LINUX vmlinuz-lts
+  INITRD initramfs-lts
+  APPEND root=UUID=15665bb5-c475-4ac8-9479-d49df97d5ccb modules=sd-mod,usb-storage,ext4 console=ttyS0,115200n8 console=ttyAMA0,115200n8
+
+MENU SEPARATOR
+
@@ -0,0 +1,23 @@
+SERIAL ttyS0 115200
+DEFAULT menu.c32
+PROMPT 0
+MENU TITLE Alpine/Linux Boot Menu
+MENU HIDDEN
+MENU AUTOBOOT Alpine will be booted automatically in # seconds.
+TIMEOUT 100
+LABEL virt
+
+  MENU LABEL Linux virt
+  LINUX vmlinuz-virt
+  INITRD initramfs-virt
+  APPEND root=UUID=15665bb5-c475-4ac8-9479-d49df97d5ccb modules=sd-mod,usb-storage,ext4 console=ttyS0,115200n8 console=ttyAMA0,115200n8
+
+LABEL lts
+  MENU DEFAULT
+  MENU LABEL Linux lts
+  LINUX vmlinuz-lts
+  INITRD initramfs-lts
+  APPEND root=UUID=15665bb5-c475-4ac8-9479-d49df97d5ccb modules=sd-mod,usb-storage,ext4 console=ttyS0,115200n8 console=ttyAMA0,115200n8
+
+MENU SEPARATOR
+
@@ -0,0 +1,23 @@
+SERIAL ttyS0 115200
+DEFAULT menu.c32
+PROMPT 0
+MENU TITLE Alpine/Linux Boot Menu
+MENU HIDDEN
+MENU AUTOBOOT Alpine will be booted automatically in # seconds.
+TIMEOUT 100
+LABEL virt
+
+  MENU LABEL Linux virt
+  LINUX vmlinuz-virt
+  INITRD initramfs-virt
+  APPEND root=LABEL=/ modules=sd-mod,usb-storage,ext4 console=ttyS0,115200n8 console=ttyAMA0,115200n8
+
+LABEL lts
+  MENU DEFAULT
+  MENU LABEL Linux lts
+  LINUX vmlinuz-lts
+  INITRD initramfs-lts
+  APPEND root=LABEL=/ modules=sd-mod,usb-storage,ext4 console=ttyS0,115200n8 console=ttyAMA0,115200n8
+
+MENU SEPARATOR
+
@@ -0,0 +1 @@
+{{HOSTNAME}}
@@ -0,0 +1,2 @@
+127.0.0.1 {{hostname}} localhost
+10.5.0.200 beedb
@@ -0,0 +1,30 @@
+#!/sbin/openrc-run
+
+name="api"
+description="4server API Service"
+
+# Command uses Python inside the venv
+command="/4server/sbin/api"
+command_args=""
+pidfile="/run/${RC_SVCNAME}.pid"
+command_background="yes"
+
+respawn_delay=5       # seconds to wait before restart
+respawn_max=0         # 0 = unlimited restarts
+
+# Load environment variables if needed
+if [ -f /etc/4server ]; then
+    . /etc/4server
+    export $(cut -d= -f1 /etc/4server)
+fi
+
+# Logs
+output_log="/4server/data/log/api.log"
+error_log="/4server/data/log/api.log"
+
+depend() {
+    need net
+    use logger dns
+    after firewall
+}
+
@@ -0,0 +1,30 @@
+#!/sbin/openrc-run
+
+name="checkCalls"
+description="check container service calls"
+
+# Command uses Python inside the venv
+command="/4server/sbin/checkCalls"
+command_args=""
+pidfile="/run/${RC_SVCNAME}.pid"
+command_background="yes"
+
+directory="/4server"
+command_user="root"
+
+respawn_delay=5       # seconds to wait before restart
+respawn_max=0         # 0 = unlimited restarts
+
+
+
+
+# Load environment variables if needed
+output_log="/4server/data/log/checkCalls.log"
+error_log="/4server/data/log/checkCalls.log"
+
+depend() {
+    need net
+    use logger dns
+    after firewall
+}
+
@@ -0,0 +1,17 @@
+#!/sbin/openrc-run
+# OpenRC service for /4server/sbin/cleanTmp
+
+name="cleanTmp"
+description="Looping /tmp cleaner that removes files older than 2 days"
+
+command="/4server/sbin/cleanTmp"
+command_background="yes"
+pidfile="/run/${RC_SVCNAME}.pid"
+output_log="/4server/data/log/checkCalls.log"
+error_log="/4server/data/log/checkCalls.log"
+
+depend() {
+    need localmount
+    after bootmisc
+}
+
@@ -0,0 +1,17 @@
+#!/sbin/openrc-run
+# OpenRC service for /4server/sbin/cpu
+
+name="cpu"
+description="Logs cpu usage"
+
+command="/4server/sbin/cpu"
+command_background="yes"
+pidfile="/run/cpu.pid"
+output_log="/4server/data/log/cpu.log"
+error_log="/4server/data/log/cpu.log"
+
+depend() {
+    need localmount
+    after bootmisc
+}
+
@@ -0,0 +1,12 @@
+#!/sbin/openrc-run
+command="/usr/bin/nebula"
+command_args="-config /etc/nebula/config.yml"
+command_background="yes"
+pidfile="/run/nebula.pid"
+name="nebula"
+
+depend() {
+  need localmount
+    after networking
+}
+
@@ -0,0 +1,17 @@
+#!/sbin/openrc-run
+description="Ping 192.168.9.1 every minute"
+
+pidfile="/run/ping_check.pid"
+
+start() {
+  ebegin "Starting ping_check service"
+    start-stop-daemon --start --background --make-pidfile --pidfile $pidfile --exec /bin/sh -- -c "while true; do ping -c 1 192.168.9.1; sleep 60; done"
+    eend $?
+}
+
+stop() {
+  ebegin "Stopping ping_check service"
+    start-stop-daemon --stop --pidfile $pidfile
+    eend $?
+}
+
@@ -0,0 +1 @@
+{{NEBULA_CA}}
@@ -0,0 +1,65 @@
+pki:
+  ca: /etc/nebula/ca.crt
+  cert: /etc/nebula/host.crt
+  key: /etc/nebula/host.key
+static_host_map:
+  "192.168.9.1": ["167.71.79.60:4242"]
+lighthouse:
+  am_lighthouse: false
+  interval: 60
+  hosts:
+listen:
+  host: 0.0.0.0
+  port: 4242
+punchy:
+  punch: true
+
+relay:
+  am_relay: false
+  use_relays: true
+
+tun:
+  disabled: false
+  dev: nebula2
+  drop_local_broadcast: false
+  drop_multicast: false
+  tx_queue: 500
+  mtu: 1300
+  routes:
+    #- mtu: 8800
+    #  route: 10.0.0.0/16
+
+  unsafe_routes:
+logging:
+  level: info
+  format: text
+firewall:
+  outbound_action: drop
+  inbound_action: drop
+
+  conntrack:
+    tcp_timeout: 12m
+    udp_timeout: 3m
+    default_timeout: 10m
+
+  outbound:
+    - port: any
+      proto: any
+      host: any
+
+  inbound:
+    - port: any  #ping
+      proto: icmp
+      groups:
+        - admin
+
+
+    - port: 22  #GIT
+      proto: tcp
+      groups:
+        - admin
+
+
+
+
+
@@ -0,0 +1 @@
+{{NEBULA_CRT}}
@@ -0,0 +1 @@
+{{NEBULA_KEY}}
@@ -0,0 +1,3 @@
+# Example: allow your host to connect to all DBs as any user with password
+host    all     all     10.5.0.1/32       md5
+
@@ -0,0 +1,3 @@
+https://dl-cdn.alpinelinux.org/alpine/v3.22/main
+https://dl-cdn.alpinelinux.org/alpine/v3.22/community
+
@@ -0,0 +1 @@
+{{SSH_PRIVATE}}
@@ -0,0 +1 @@
+{{SSH_PUBLIC}}
@@ -0,0 +1,103 @@
+global:
+  checkNewVersion: false
+  sendAnonymousUsage: false
+
+accesslog:
+  filePath: /var/log/traefik/access.log
+
+api:
+  dashboard: false
+  disableDashboardAd: true
+  insecure: false
+
+entryPoints:
+  web:
+    address: :80
+    # -- (Optional) Redirect all HTTP to HTTPS
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+  websecure:
+    #    http:
+    #  middlewares:
+    #    - crowdsec-bouncer@file
+    address: :443
+    transport:
+      respondingTimeouts:
+        readTimeout: 0
+        writeTimeout: 0
+        idleTimeout: 42
+
+# -- Configure your CertificateResolver here...
+certificatesResolvers:
+#   staging:
+#     acme:
+#       email: your-email@example.com
+#       storage: /etc/traefik/certs/acme.json
+#       caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
+#       httpChallenge:
+#         entryPoint: web
+
+  production:
+    acme:
+      email: oliver@odoo4projects.com
+      storage: /certs/acme.json
+      caServer: "https://acme-v02.api.letsencrypt.org/directory"
+      httpChallenge:
+        entryPoint: web
+
+# -- (Optional) Disable TLS Cert verification check
+# serversTransport:
+#   insecureSkipVerify: true
+
+# -- (Optional) Overwrite Default Certificates
+# tls:
+#   stores:
+#     default:
+#       defaultCertificate:
+#         certFile: /etc/traefik/certs/cert.pem
+#         keyFile: /etc/traefik/certs/cert-key.pem
+# -- (Optional) Disable TLS version 1.0 and 1.1
+#   options:
+#     default:
+#       minVersion: VersionTLS12
+
+providers:
+  docker:
+    # -- (Optional) Enable this, if you want to expose all containers automatically
+    exposedByDefault: true
+  file:
+    directory: /etc/traefik
+    watch: true
+
+
+http:
+  middlewares:
+    crowdsec-bouncer:
+      forwardauth:
+        address: http://bouncer-traefik:8080/api/v1/forwardAuth
+        trustForwardHeader: true
+
+    cors-headers:
+      headers:
+        accessControlAllowCredentials: true
+
+
+  routers:
+    api-router:
+      rule: "Host(`{{HOSTNAME}}.odoo4projects.com`)"
+      service: api-service
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: production
+
+  services:
+    api-service:
+      loadBalancer:
+        servers:
+          - url: "http://10.5.0.1:8888"
+
+