kjuulh/wireguard-setup
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

Use single shell provisioner

Browse Source
This commit is contained in:
Héctor Molinero Fernández 2020-02-06 20:02:31 +01:00
parent 05724647e7
commit 082c6290e1
1 changed files with 54 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
packer/build.pkr.hcl
View File

@ -9,73 +9,65 @@ build {
destination = "/" destination = "/"
} }
provisioner "shell" {
inline = [
"chmod 644 /etc/apt/apt.conf.d/20auto-upgrades",
"chmod 644 /etc/apt/apt.conf.d/50unattended-upgrades",
"chmod 644 /etc/fail2ban/jail.d/sshd.conf",
"chmod 644 /etc/ssh/sshd_config",
"chmod 644 /etc/unbound/unbound.conf",
"chmod 644 /etc/wireguard/client-sample.conf",
"chmod 644 /etc/wireguard/wg0-peers.conf",
"chmod 600 /etc/wireguard/wg0.conf"
]
}
provisioner "shell" { provisioner "shell" {
environment_vars = [ environment_vars = [
"DPKG_FORCE=confold",
"DEBIAN_FRONTEND=noninteractive" "DEBIAN_FRONTEND=noninteractive"
] ]
inline_shebang = "/bin/sh -eux"
inline = [ inline = [
"printf 'deb http://ppa.launchpad.net/wireguard/wireguard/ubuntu/ bionic main\n' > /etc/apt/sources.list.d/wireguard.list", <<EOF
"apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E1B39B6EF6DDB96564797591AE33835F504A1A25", chmod 644 /etc/apt/apt.conf.d/20auto-upgrades
"apt-get update", chmod 644 /etc/apt/apt.conf.d/50unattended-upgrades
"apt-get upgrade -yo DPkg::options::=--force-confold", chmod 644 /etc/fail2ban/jail.d/sshd.conf
"apt-get install -yo DPkg::options::=--force-confold dns-root-data fail2ban ufw unattended-upgrades unbound", chmod 644 /etc/ssh/sshd_config
"apt-get install -yo DPkg::options::=--force-confold linux-headers-$(uname -r) openresolv wireguard", chmod 644 /etc/unbound/unbound.conf
"apt-get install -yo DPkg::options::=--force-confold htop iperf3 qrencode nano ssh-import-id", chmod 644 /etc/wireguard/client-sample.conf
"apt-get autoremove -y" chmod 644 /etc/wireguard/wg0-peers.conf
] chmod 600 /etc/wireguard/wg0.conf
} EOF
,
provisioner "shell" { <<EOF
inline = [ printf 'deb http://ppa.launchpad.net/wireguard/wireguard/ubuntu/ bionic main\n' > /etc/apt/sources.list.d/wireguard.list
"systemctl disable --now systemd-resolved.service", apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E1B39B6EF6DDB96564797591AE33835F504A1A25
"unlink /etc/resolv.conf && printf 'nameserver 127.0.0.1\n' > /etc/resolv.conf", apt-get update
"systemctl enable --now unbound.service unbound-resolvconf.service", apt-get upgrade -yo DPkg::options::=--force-confold
] apt-get install -yo DPkg::options::=--force-confold dns-root-data fail2ban ufw unattended-upgrades unbound
} apt-get install -yo DPkg::options::=--force-confold linux-headers-$(uname -r) openresolv wireguard
apt-get install -yo DPkg::options::=--force-confold htop iperf3 qrencode nano ssh-import-id
provisioner "shell" { apt-get autoremove -y
inline = [ EOF
"systemctl enable --now fail2ban.service ufw.service unattended-upgrades.service", ,
"systemctl enable --now wg-quick@wg0.service" <<EOF
] systemctl disable --now systemd-resolved.service
} unlink /etc/resolv.conf && printf 'nameserver 127.0.0.1\n' > /etc/resolv.conf
systemctl enable --now unbound.service unbound-resolvconf.service
provisioner "shell" { EOF
inline = [ ,
"ufw --force enable", <<EOF
"ufw default deny incoming", systemctl enable --now fail2ban.service ufw.service unattended-upgrades.service
"ufw default allow outgoing", systemctl enable --now wg-quick@wg0.service
"ufw allow from any to any port 22 proto tcp" EOF
] ,
} <<EOF
ufw --force enable
provisioner "shell" { ufw default deny incoming
inline = [ ufw default allow outgoing
"groupadd -r ssh-user", ufw allow from any to any port 22 proto tcp
"usermod -aG ssh-user root", EOF
"passwd -d root" ,
] <<EOF
} groupadd -r ssh-user
usermod -aG ssh-user root
provisioner "shell" { passwd -d root
inline = [ EOF
"rm -f /etc/ssh/ssh_host_*key*", ,
"rm -f /etc/wireguard/*-*key", <<EOF
"rm -f /etc/wireguard/*-iface", rm -f /etc/ssh/ssh_host_*key*
"rm -rf /var/lib/apt/lists/*" rm -f /etc/wireguard/*-*key
rm -f /etc/wireguard/*-iface
rm -rf /var/lib/apt/lists/*
EOF
] ]
} }
} }