Apply Composer changes: comprehensive API updates, migrations, middleware, and infrastructure improvements
- Add comprehensive database migrations (001-024) for schema evolution - Enhance API schema with expanded type definitions and resolvers - Add new middleware: audit logging, rate limiting, MFA enforcement, security, tenant auth - Implement new services: AI optimization, billing, blockchain, compliance, marketplace - Add adapter layer for cloud integrations (Cloudflare, Kubernetes, Proxmox, storage) - Update Crossplane provider with enhanced VM management capabilities - Add comprehensive test suite for API endpoints and services - Update frontend components with improved GraphQL subscriptions and real-time updates - Enhance security configurations and headers (CSP, CORS, etc.) - Update documentation and configuration files - Add new CI/CD workflows and validation scripts - Implement design system improvements and UI enhancements
This commit is contained in:
defiQUG
219
examples/production/basic-vm.yaml
Normal file
219
examples/production/basic-vm.yaml
Normal file
@@ -0,0 +1,219 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: basic-vm-001
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "tenant-001"
|
||||
environment: "production"
|
||||
app: "basic"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "basic-vm-001"
|
||||
cpu: 2
|
||||
memory: "4Gi"
|
||||
disk: "50Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
324
examples/production/cloudflare-tunnel-vm.yaml
Normal file
324
examples/production/cloudflare-tunnel-vm.yaml
Normal file
@@ -0,0 +1,324 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: cloudflare-tunnel-vm
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "cloudflare-tunnel"
|
||||
role: "infrastructure"
|
||||
component: "tunnel"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "cloudflare-tunnel-vm"
|
||||
cpu: 2
|
||||
memory: "4Gi"
|
||||
disk: "10Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# Cloudflare tunnel specific
|
||||
- ufw
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Install cloudflared
|
||||
- |
|
||||
echo "Installing cloudflared..."
|
||||
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb -o /tmp/cloudflared.deb
|
||||
if [ -f /tmp/cloudflared.deb ]; then
|
||||
dpkg -i /tmp/cloudflared.deb || apt-get install -f -y
|
||||
rm /tmp/cloudflared.deb
|
||||
echo "cloudflared installed successfully"
|
||||
else
|
||||
echo "ERROR: Failed to download cloudflared"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify cloudflared is installed
|
||||
- |
|
||||
if command -v cloudflared >/dev/null 2>&1; then
|
||||
echo "cloudflared is installed: $(cloudflared --version)"
|
||||
else
|
||||
echo "ERROR: cloudflared is not installed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Create cloudflared user
|
||||
- |
|
||||
if ! id -u cloudflared >/dev/null 2>&1; then
|
||||
useradd -r -s /bin/false cloudflared
|
||||
echo "cloudflared user created"
|
||||
else
|
||||
echo "cloudflared user already exists"
|
||||
fi
|
||||
|
||||
# Create directories
|
||||
- |
|
||||
mkdir -p /etc/cloudflared
|
||||
mkdir -p /var/log/cloudflared
|
||||
chown cloudflared:cloudflared /var/log/cloudflared
|
||||
echo "Cloudflared directories created"
|
||||
|
||||
# Create systemd service
|
||||
- |
|
||||
cat > /etc/systemd/system/cloudflared.service <<EOF
|
||||
[Unit]
|
||||
Description=cloudflared
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=cloudflared
|
||||
ExecStart=/usr/local/bin/cloudflared tunnel --config /etc/cloudflared/config.yaml run
|
||||
Restart=on-failure
|
||||
RestartSec=5s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
echo "Cloudflared systemd service created"
|
||||
|
||||
# Reload systemd and enable cloudflared
|
||||
- systemctl daemon-reload
|
||||
- systemctl enable cloudflared
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 22/tcp
|
||||
- ufw --force enable
|
||||
|
||||
# Verify cloudflared service is configured
|
||||
- |
|
||||
if systemctl is-enabled cloudflared >/dev/null 2>&1; then
|
||||
echo "cloudflared service is enabled"
|
||||
else
|
||||
echo "WARNING: cloudflared service may not be enabled"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
write_files:
|
||||
- path: /etc/cloudflared/config.yaml
|
||||
content: |
|
||||
# Cloudflare Tunnel Configuration
|
||||
# This file should be updated with actual tunnel credentials after VM creation
|
||||
#
|
||||
# To set up the tunnel:
|
||||
# 1. Create tunnel in Cloudflare dashboard or via API
|
||||
# 2. Download tunnel credentials JSON file
|
||||
# 3. Place credentials at: /etc/cloudflared/tunnel-credentials.json
|
||||
# 4. Update this config with ingress rules
|
||||
#
|
||||
# Example configuration:
|
||||
# tunnel: your-tunnel-id
|
||||
# credentials-file: /etc/cloudflared/tunnel-credentials.json
|
||||
#
|
||||
# ingress:
|
||||
# - hostname: example.sankofa.nexus
|
||||
# service: http://localhost:80
|
||||
# - service: http_status:404
|
||||
|
||||
loglevel: info
|
||||
logfile: /var/log/cloudflared/tunnel.log
|
||||
metrics: 0.0.0.0:9090
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
- Cloudflared: $(systemctl is-enabled cloudflared && echo 'enabled' || echo 'not enabled')
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
- cloudflared, ufw
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
- UFW firewall: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Configure Cloudflare tunnel credentials
|
||||
4. Update /etc/cloudflared/config.yaml with tunnel ID
|
||||
5. Start cloudflared service: systemctl start cloudflared
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
193
examples/production/large-vm.yaml
Normal file
193
examples/production/large-vm.yaml
Normal file
@@ -0,0 +1,193 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: large-vm-001
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "tenant-001"
|
||||
environment: "production"
|
||||
app: "large"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "large-vm-001"
|
||||
cpu: 8
|
||||
memory: "16Gi"
|
||||
disk: "200Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
193
examples/production/medium-vm.yaml
Normal file
193
examples/production/medium-vm.yaml
Normal file
@@ -0,0 +1,193 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: medium-vm-001
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "tenant-001"
|
||||
environment: "production"
|
||||
app: "medium"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "medium-vm-001"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "100Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
288
examples/production/nginx-proxy-vm.yaml
Normal file
288
examples/production/nginx-proxy-vm.yaml
Normal file
@@ -0,0 +1,288 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: nginx-proxy-vm
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "nginx-proxy"
|
||||
role: "infrastructure"
|
||||
component: "proxy"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "nginx-proxy-vm"
|
||||
cpu: 2
|
||||
memory: "4Gi"
|
||||
disk: "20Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# Nginx-specific packages
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- ufw
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure and start Nginx
|
||||
- systemctl enable nginx
|
||||
- systemctl start nginx
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 80/tcp
|
||||
- ufw allow 443/tcp
|
||||
- ufw allow 22/tcp
|
||||
- ufw --force enable
|
||||
|
||||
# Verify Nginx is running
|
||||
- |
|
||||
if systemctl is-active --quiet nginx; then
|
||||
echo "Nginx is running"
|
||||
systemctl status nginx --no-pager
|
||||
else
|
||||
echo "WARNING: Nginx may not have started properly"
|
||||
systemctl status nginx --no-pager || true
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
write_files:
|
||||
- path: /etc/nginx/nginx.conf
|
||||
content: |
|
||||
user www-data;
|
||||
worker_processes auto;
|
||||
pid /run/nginx.pid;
|
||||
include /etc/nginx/modules-enabled/*.conf;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# SSL Configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
|
||||
|
||||
# Logging
|
||||
access_log /var/log/nginx/access.log;
|
||||
error_log /var/log/nginx/error.log;
|
||||
|
||||
# Gzip
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss;
|
||||
|
||||
# Include server configurations
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
include /etc/nginx/sites-enabled/*;
|
||||
}
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
- Nginx: $(systemctl is-active nginx)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
- nginx, certbot, python3-certbot-nginx, ufw
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
- UFW firewall: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Configure Nginx virtual hosts
|
||||
4. Test SSL certificate generation with Certbot
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
288
examples/production/phoenix/as4-gateway.yaml
Normal file
288
examples/production/phoenix/as4-gateway.yaml
Normal file
@@ -0,0 +1,288 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-as4-gateway
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "as4-gateway"
|
||||
service: "b2b"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-as4-gateway"
|
||||
cpu: 8
|
||||
memory: "16Gi"
|
||||
disk: "500Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# AS4 gateway packages
|
||||
- docker.io
|
||||
- docker-compose
|
||||
- openjdk-11-jdk
|
||||
- openssl
|
||||
- xmlsec1
|
||||
- libxml2-utils
|
||||
- postgresql
|
||||
- postgresql-contrib
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- ufw
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo, docker
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure Docker
|
||||
- systemctl enable docker
|
||||
- systemctl start docker
|
||||
|
||||
# Configure PostgreSQL
|
||||
- systemctl enable postgresql
|
||||
- systemctl start postgresql
|
||||
|
||||
# Create AS4 gateway directories
|
||||
- |
|
||||
mkdir -p /opt/as4-gateway/{config,data,certificates,logs,archives}
|
||||
mkdir -p /opt/as4-gateway/trading-partners
|
||||
chown -R admin:admin /opt/as4-gateway
|
||||
|
||||
# Create PostgreSQL database for AS4 gateway
|
||||
- |
|
||||
sudo -u postgres psql <<EOF
|
||||
CREATE DATABASE as4_gateway;
|
||||
CREATE USER as4_user WITH PASSWORD 'CHANGE_ME_ON_FIRST_LOGIN';
|
||||
GRANT ALL PRIVILEGES ON DATABASE as4_gateway TO as4_user;
|
||||
EOF
|
||||
|
||||
# Configure Nginx reverse proxy
|
||||
- |
|
||||
cat > /etc/nginx/sites-available/as4-gateway <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
server_name as4.sankofa.nexus;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ln -sf /etc/nginx/sites-available/as4-gateway /etc/nginx/sites-enabled/
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 22/tcp # SSH
|
||||
- ufw allow 80/tcp # HTTP
|
||||
- ufw allow 443/tcp # HTTPS
|
||||
- ufw allow 8080/tcp # AS4 Gateway (direct access)
|
||||
- ufw --force enable
|
||||
|
||||
# Enable and start services
|
||||
- systemctl enable nginx
|
||||
- systemctl restart nginx
|
||||
|
||||
# Create AS4 gateway configuration template
|
||||
- |
|
||||
cat > /opt/as4-gateway/config/as4-config-template.xml <<EOF
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<as4-config>
|
||||
<server>
|
||||
<port>8080</port>
|
||||
<keystore>/opt/as4-gateway/certificates/keystore.jks</keystore>
|
||||
<truststore>/opt/as4-gateway/certificates/truststore.jks</truststore>
|
||||
</server>
|
||||
<database>
|
||||
<url>jdbc:postgresql://localhost:5432/as4_gateway</url>
|
||||
<username>as4_user</username>
|
||||
<password>CHANGE_ME_ON_FIRST_LOGIN</password>
|
||||
</database>
|
||||
<messaging>
|
||||
<reliability>true</reliability>
|
||||
<security>true</security>
|
||||
<signing>true</signing>
|
||||
<encryption>true</encryption>
|
||||
</messaging>
|
||||
</as4-config>
|
||||
EOF
|
||||
chown admin:admin /opt/as4-gateway/config/as4-config-template.xml
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
318
examples/production/phoenix/business-integration-gateway.yaml
Normal file
318
examples/production/phoenix/business-integration-gateway.yaml
Normal file
@@ -0,0 +1,318 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-business-integration-gateway
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "integration"
|
||||
service: "workflow"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-business-integration-gateway"
|
||||
cpu: 8
|
||||
memory: "16Gi"
|
||||
disk: "200Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# Integration gateway packages
|
||||
- docker.io
|
||||
- docker-compose
|
||||
- nodejs
|
||||
- npm
|
||||
- python3
|
||||
- python3-pip
|
||||
- postgresql
|
||||
- postgresql-contrib
|
||||
- redis-server
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- ufw
|
||||
- jq
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo, docker
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure Docker
|
||||
- systemctl enable docker
|
||||
- systemctl start docker
|
||||
|
||||
# Configure PostgreSQL
|
||||
- systemctl enable postgresql
|
||||
- systemctl start postgresql
|
||||
|
||||
# Configure Redis
|
||||
- systemctl enable redis-server
|
||||
- systemctl start redis-server
|
||||
|
||||
# Create integration gateway directories
|
||||
- |
|
||||
mkdir -p /opt/phoenix-integration/{workflows,connectors,logs,data}
|
||||
mkdir -p /opt/phoenix-integration/workflows/templates
|
||||
chown -R admin:admin /opt/phoenix-integration
|
||||
|
||||
# Create PostgreSQL database for integration gateway
|
||||
- |
|
||||
sudo -u postgres psql <<EOF
|
||||
CREATE DATABASE phoenix_integration;
|
||||
CREATE USER integration_user WITH PASSWORD 'CHANGE_ME_ON_FIRST_LOGIN';
|
||||
GRANT ALL PRIVILEGES ON DATABASE phoenix_integration TO integration_user;
|
||||
EOF
|
||||
|
||||
# Configure Nginx reverse proxy
|
||||
- |
|
||||
cat > /etc/nginx/sites-available/phoenix-integration <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
server_name integration.sankofa.nexus;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:5678;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ln -sf /etc/nginx/sites-available/phoenix-integration /etc/nginx/sites-enabled/
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 22/tcp # SSH
|
||||
- ufw allow 80/tcp # HTTP
|
||||
- ufw allow 443/tcp # HTTPS
|
||||
- ufw allow 5678/tcp # n8n (if using)
|
||||
- ufw allow 8080/tcp # Airflow (if using)
|
||||
- ufw --force enable
|
||||
|
||||
# Enable and start services
|
||||
- systemctl enable nginx
|
||||
- systemctl restart nginx
|
||||
|
||||
# Create docker-compose template for n8n
|
||||
- |
|
||||
cat > /opt/phoenix-integration/docker-compose-n8n.yml <<EOF
|
||||
version: '3.8'
|
||||
services:
|
||||
n8n:
|
||||
image: n8nio/n8n:latest
|
||||
ports:
|
||||
- "5678:5678"
|
||||
environment:
|
||||
- DB_TYPE=postgresdb
|
||||
- DB_POSTGRESDB_HOST=localhost
|
||||
- DB_POSTGRESDB_DATABASE=phoenix_integration
|
||||
- DB_POSTGRESDB_USER=integration_user
|
||||
- DB_POSTGRESDB_PASSWORD=CHANGE_ME_ON_FIRST_LOGIN
|
||||
- N8N_BASIC_AUTH_ACTIVE=true
|
||||
- N8N_BASIC_AUTH_USER=admin
|
||||
- N8N_BASIC_AUTH_PASSWORD=CHANGE_ME_ON_FIRST_LOGIN
|
||||
volumes:
|
||||
- /opt/phoenix-integration/data:/home/node/.n8n
|
||||
restart: unless-stopped
|
||||
EOF
|
||||
chown admin:admin /opt/phoenix-integration/docker-compose-n8n.yml
|
||||
|
||||
# Create workflow template example
|
||||
- |
|
||||
cat > /opt/phoenix-integration/workflows/templates/example-workflow.json <<EOF
|
||||
{
|
||||
"name": "Example Phoenix Workflow",
|
||||
"nodes": [
|
||||
{
|
||||
"name": "Start",
|
||||
"type": "n8n-nodes-base.webhook",
|
||||
"parameters": {}
|
||||
},
|
||||
{
|
||||
"name": "Process Data",
|
||||
"type": "n8n-nodes-base.function",
|
||||
"parameters": {
|
||||
"functionCode": "// Phoenix workflow processing"
|
||||
}
|
||||
}
|
||||
],
|
||||
"connections": {}
|
||||
}
|
||||
EOF
|
||||
chown admin:admin /opt/phoenix-integration/workflows/templates/example-workflow.json
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
336
examples/production/phoenix/codespaces-ide.yaml
Normal file
336
examples/production/phoenix/codespaces-ide.yaml
Normal file
@@ -0,0 +1,336 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-codespaces-ide
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "codespaces"
|
||||
service: "ide"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-codespaces-ide"
|
||||
cpu: 8
|
||||
memory: "32Gi"
|
||||
disk: "200Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# IDE and development tools
|
||||
- git
|
||||
- docker.io
|
||||
- docker-compose
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- build-essential
|
||||
- nodejs
|
||||
- npm
|
||||
- python3
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- golang-go
|
||||
- jq
|
||||
- ufw
|
||||
# AI/ML tools
|
||||
- python3-dev
|
||||
- python3-wheel
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo, docker
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure Docker
|
||||
- systemctl enable docker
|
||||
- systemctl start docker
|
||||
|
||||
# Install code-server (VS Code in browser)
|
||||
- |
|
||||
echo "Installing code-server..."
|
||||
curl -fsSL https://code-server.dev/install.sh | sh
|
||||
systemctl enable --now code-server@admin || echo "Code-server will be configured post-deployment"
|
||||
|
||||
# Install Python AI/ML packages
|
||||
- |
|
||||
echo "Installing Python AI/ML packages..."
|
||||
python3 -m pip install --upgrade pip
|
||||
python3 -m pip install --user langchain openai anthropic transformers torch torchvision || echo "AI packages will be installed post-deployment"
|
||||
|
||||
# Create directories for code-server
|
||||
- |
|
||||
mkdir -p /home/admin/.config/code-server
|
||||
mkdir -p /home/admin/workspaces
|
||||
mkdir -p /opt/phoenix-ide
|
||||
chown -R admin:admin /home/admin/.config
|
||||
chown -R admin:admin /home/admin/workspaces
|
||||
chown -R admin:admin /opt/phoenix-ide
|
||||
|
||||
# Create Phoenix-branded code-server config
|
||||
- |
|
||||
cat > /home/admin/.config/code-server/config.yaml <<EOF
|
||||
bind-addr: 127.0.0.1:8080
|
||||
auth: password
|
||||
password: CHANGE_ME_ON_FIRST_LOGIN
|
||||
cert: false
|
||||
user-data-dir: /home/admin/.local/share/code-server
|
||||
# Phoenix branding
|
||||
welcome-text: "Welcome to Phoenix Codespaces IDE"
|
||||
disable-telemetry: true
|
||||
disable-update-check: true
|
||||
EOF
|
||||
chown admin:admin /home/admin/.config/code-server/config.yaml
|
||||
chmod 600 /home/admin/.config/code-server/config.yaml
|
||||
|
||||
# Configure Nginx reverse proxy
|
||||
- |
|
||||
cat > /etc/nginx/sites-available/phoenix-codespaces <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
server_name codespaces.sankofa.nexus;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
|
||||
# WebSocket support
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ln -sf /etc/nginx/sites-available/phoenix-codespaces /etc/nginx/sites-enabled/
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 22/tcp # SSH
|
||||
- ufw allow 80/tcp # HTTP
|
||||
- ufw allow 443/tcp # HTTPS
|
||||
- ufw allow 8080/tcp # Code-server (direct access, if needed)
|
||||
- ufw --force enable
|
||||
|
||||
# Enable and start services
|
||||
- systemctl enable nginx
|
||||
- systemctl restart nginx
|
||||
|
||||
# Create AI agent service directory
|
||||
- |
|
||||
mkdir -p /opt/phoenix-ide/agents
|
||||
mkdir -p /opt/phoenix-ide/workspaces
|
||||
mkdir -p /opt/phoenix-ide/extensions
|
||||
chown -R admin:admin /opt/phoenix-ide
|
||||
|
||||
# Install common VS Code extensions (via code-server CLI)
|
||||
- |
|
||||
echo "VS Code extensions will be installed post-deployment via code-server CLI"
|
||||
echo "Recommended extensions:"
|
||||
echo " - GitHub Copilot (or alternative)"
|
||||
echo " - Python"
|
||||
echo " - TypeScript"
|
||||
echo " - Docker"
|
||||
echo " - GitLens"
|
||||
echo " - Remote Development"
|
||||
|
||||
# Create Phoenix AI agent helper script
|
||||
- |
|
||||
cat > /opt/phoenix-ide/phoenix-ai-agent.py <<'PYEOF'
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Phoenix AI Agent - Copilot-like AI assistant for Phoenix Codespaces IDE
|
||||
This script provides AI-powered code completion and assistance
|
||||
"""
|
||||
import sys
|
||||
import json
|
||||
|
||||
def main():
|
||||
print("Phoenix AI Agent - Initialized")
|
||||
print("This agent will be configured post-deployment")
|
||||
print("Features:")
|
||||
print(" - Code completion")
|
||||
print(" - Code generation")
|
||||
print(" - Code review")
|
||||
print(" - Automated testing")
|
||||
print(" - Documentation generation")
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
PYEOF
|
||||
chmod +x /opt/phoenix-ide/phoenix-ai-agent.py
|
||||
chown admin:admin /opt/phoenix-ide/phoenix-ai-agent.py
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
245
examples/production/phoenix/devops-runner.yaml
Normal file
245
examples/production/phoenix/devops-runner.yaml
Normal file
@@ -0,0 +1,245 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-devops-runner
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "devops"
|
||||
role: "runner"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-devops-runner"
|
||||
cpu: 8
|
||||
memory: "16Gi"
|
||||
disk: "200Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# DevOps tools
|
||||
- git
|
||||
- docker.io
|
||||
- docker-compose
|
||||
- build-essential
|
||||
- nodejs
|
||||
- npm
|
||||
- python3
|
||||
- python3-pip
|
||||
- golang-go
|
||||
- jq
|
||||
- ufw
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo, docker
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure Docker
|
||||
- systemctl enable docker
|
||||
- systemctl start docker
|
||||
|
||||
# Install kubectl
|
||||
- |
|
||||
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
|
||||
install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
|
||||
rm kubectl
|
||||
|
||||
# Install Helm
|
||||
- |
|
||||
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
||||
|
||||
# Create CI/CD directories
|
||||
- mkdir -p /opt/ci-cd/workspace
|
||||
- mkdir -p /opt/ci-cd/artifacts
|
||||
- mkdir -p /opt/ci-cd/cache
|
||||
- chown -R admin:admin /opt/ci-cd
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 22/tcp # SSH
|
||||
- ufw allow 8080/tcp # Jenkins (if using)
|
||||
- ufw allow 8090/tcp # GitLab Runner (if using)
|
||||
- ufw --force enable
|
||||
|
||||
# Verify tools
|
||||
- |
|
||||
echo "Verifying installed tools..."
|
||||
echo "Docker: $(docker --version)"
|
||||
echo "Git: $(git --version)"
|
||||
echo "Node.js: $(node --version)"
|
||||
echo "Python: $(python3 --version)"
|
||||
echo "Go: $(go version)"
|
||||
echo "kubectl: $(kubectl version --client --short)"
|
||||
echo "Helm: $(helm version --short)"
|
||||
echo "jq: $(jq --version)"
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
320
examples/production/phoenix/dns-primary.yaml
Normal file
320
examples/production/phoenix/dns-primary.yaml
Normal file
@@ -0,0 +1,320 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-dns-primary
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "dns"
|
||||
role: "primary"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-dns-primary"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "50Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# DNS server packages
|
||||
- bind9
|
||||
- bind9utils
|
||||
- bind9-doc
|
||||
- dnsutils
|
||||
- ufw
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure BIND9
|
||||
- |
|
||||
echo "Configuring BIND9 DNS server..."
|
||||
# Enable BIND9 to listen on all interfaces
|
||||
sed -i 's/OPTIONS=.*/OPTIONS="-u bind -4"/' /etc/default/bind9
|
||||
|
||||
# Create basic named.conf.local (will be configured post-deployment)
|
||||
cat > /etc/bind/named.conf.local <<EOF
|
||||
// Local DNS zones for sankofa.nexus
|
||||
// This file will be configured post-deployment with actual zone files
|
||||
|
||||
// Example zone configuration:
|
||||
// zone "sankofa.nexus" {
|
||||
// type master;
|
||||
// file "/etc/bind/db.sankofa.nexus";
|
||||
// };
|
||||
EOF
|
||||
|
||||
# Start and enable BIND9
|
||||
systemctl enable named
|
||||
systemctl start named
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 53/tcp
|
||||
- ufw allow 53/udp
|
||||
- ufw allow 22/tcp
|
||||
- ufw --force enable
|
||||
|
||||
# Verify BIND9 is running
|
||||
- |
|
||||
if systemctl is-active --quiet named; then
|
||||
echo "BIND9 DNS server is running"
|
||||
systemctl status named --no-pager
|
||||
else
|
||||
echo "WARNING: BIND9 may not have started properly"
|
||||
systemctl status named --no-pager || true
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
- BIND9 DNS Server: $(systemctl is-active named)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
- bind9, bind9utils, dnsutils
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
- UFW firewall: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Configure DNS zones in /etc/bind/named.conf.local
|
||||
4. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
244
examples/production/phoenix/email-server.yaml
Normal file
244
examples/production/phoenix/email-server.yaml
Normal file
@@ -0,0 +1,244 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-email-server
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "email"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-email-server"
|
||||
cpu: 8
|
||||
memory: "16Gi"
|
||||
disk: "200Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# Email server packages
|
||||
- postfix
|
||||
- dovecot-core
|
||||
- dovecot-imapd
|
||||
- dovecot-pop3d
|
||||
- dovecot-lmtpd
|
||||
- opendkim
|
||||
- opendmarc
|
||||
- spamassassin
|
||||
- spamc
|
||||
- clamav
|
||||
- clamav-daemon
|
||||
- ufw
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Update ClamAV database
|
||||
- freshclam || echo "ClamAV database update will run in background"
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 25/tcp # SMTP
|
||||
- ufw allow 587/tcp # SMTP submission
|
||||
- ufw allow 465/tcp # SMTPS
|
||||
- ufw allow 143/tcp # IMAP
|
||||
- ufw allow 993/tcp # IMAPS
|
||||
- ufw allow 110/tcp # POP3
|
||||
- ufw allow 995/tcp # POP3S
|
||||
- ufw allow 80/tcp # HTTP (for webmail)
|
||||
- ufw allow 443/tcp # HTTPS (for webmail)
|
||||
- ufw allow 22/tcp # SSH
|
||||
- ufw --force enable
|
||||
|
||||
# Enable services (configuration will be done post-deployment)
|
||||
- systemctl enable postfix
|
||||
- systemctl enable dovecot
|
||||
- systemctl enable opendkim
|
||||
- systemctl enable opendmarc
|
||||
- systemctl enable spamassassin
|
||||
- systemctl enable clamav-daemon
|
||||
- systemctl enable nginx
|
||||
|
||||
# Start services
|
||||
- systemctl start postfix || echo "Postfix will be configured post-deployment"
|
||||
- systemctl start dovecot || echo "Dovecot will be configured post-deployment"
|
||||
- systemctl start opendkim || echo "OpenDKIM will be configured post-deployment"
|
||||
- systemctl start opendmarc || echo "OpenDMARC will be configured post-deployment"
|
||||
- systemctl start spamassassin || echo "SpamAssassin will be configured post-deployment"
|
||||
- systemctl start clamav-daemon || echo "ClamAV will be configured post-deployment"
|
||||
- systemctl start nginx || echo "Nginx will be configured post-deployment"
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
309
examples/production/phoenix/financial-messaging-gateway.yaml
Normal file
309
examples/production/phoenix/financial-messaging-gateway.yaml
Normal file
@@ -0,0 +1,309 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-financial-messaging-gateway
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "financial-messaging"
|
||||
service: "banking"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-financial-messaging-gateway"
|
||||
cpu: 8
|
||||
memory: "16Gi"
|
||||
disk: "500Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# Financial messaging packages
|
||||
- docker.io
|
||||
- docker-compose
|
||||
- openjdk-11-jdk
|
||||
- python3
|
||||
- python3-pip
|
||||
- postgresql
|
||||
- postgresql-contrib
|
||||
- redis-server
|
||||
- openssl
|
||||
- xmlsec1
|
||||
- libxml2-utils
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- ufw
|
||||
- jq
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo, docker
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure Docker
|
||||
- systemctl enable docker
|
||||
- systemctl start docker
|
||||
|
||||
# Configure PostgreSQL
|
||||
- systemctl enable postgresql
|
||||
- systemctl start postgresql
|
||||
|
||||
# Configure Redis
|
||||
- systemctl enable redis-server
|
||||
- systemctl start redis-server
|
||||
|
||||
# Create financial messaging gateway directories
|
||||
- |
|
||||
mkdir -p /opt/financial-messaging/{config,data,archives,audit,certificates}
|
||||
mkdir -p /opt/financial-messaging/messages/{incoming,outgoing,processed}
|
||||
mkdir -p /opt/financial-messaging/formats/{iso20022,swift,fix,edi}
|
||||
chown -R admin:admin /opt/financial-messaging
|
||||
|
||||
# Create PostgreSQL database for financial messaging
|
||||
- |
|
||||
sudo -u postgres psql <<EOF
|
||||
CREATE DATABASE financial_messaging;
|
||||
CREATE USER financial_user WITH PASSWORD 'CHANGE_ME_ON_FIRST_LOGIN';
|
||||
GRANT ALL PRIVILEGES ON DATABASE financial_messaging TO financial_user;
|
||||
EOF
|
||||
|
||||
# Configure Nginx reverse proxy
|
||||
- |
|
||||
cat > /etc/nginx/sites-available/financial-messaging <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
server_name financial.sankofa.nexus;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ln -sf /etc/nginx/sites-available/financial-messaging /etc/nginx/sites-enabled/
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 22/tcp # SSH
|
||||
- ufw allow 80/tcp # HTTP
|
||||
- ufw allow 443/tcp # HTTPS
|
||||
- ufw allow 8080/tcp # Financial Gateway (direct access)
|
||||
- ufw allow 5000/tcp # SWIFT (if using)
|
||||
- ufw --force enable
|
||||
|
||||
# Enable and start services
|
||||
- systemctl enable nginx
|
||||
- systemctl restart nginx
|
||||
|
||||
# Create financial message format templates
|
||||
- |
|
||||
cat > /opt/financial-messaging/formats/iso20022/README.md <<EOF
|
||||
# ISO 20022 Message Formats
|
||||
|
||||
Supported message types:
|
||||
- pain.001 (Payment Initiation)
|
||||
- pain.002 (Payment Status Report)
|
||||
- pacs.008 (FIToFICustomerCreditTransfer)
|
||||
- pacs.009 (FIToFICustomerDirectDebit)
|
||||
- camt.053 (BankToCustomerStatement)
|
||||
- camt.054 (BankToCustomerDebitCreditNotification)
|
||||
EOF
|
||||
chown admin:admin /opt/financial-messaging/formats/iso20022/README.md
|
||||
|
||||
# Create message processing script template
|
||||
- |
|
||||
cat > /opt/financial-messaging/process-message.sh <<'EOF'
|
||||
#!/bin/bash
|
||||
# Financial message processing script
|
||||
# This script will be configured post-deployment
|
||||
|
||||
MESSAGE_FILE=$1
|
||||
MESSAGE_TYPE=$2
|
||||
|
||||
echo "Processing financial message: $MESSAGE_FILE"
|
||||
echo "Message type: $MESSAGE_TYPE"
|
||||
|
||||
# Validation
|
||||
# Transformation
|
||||
# Routing
|
||||
# Archiving
|
||||
EOF
|
||||
chmod +x /opt/financial-messaging/process-message.sh
|
||||
chown admin:admin /opt/financial-messaging/process-message.sh
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
238
examples/production/phoenix/git-server.yaml
Normal file
238
examples/production/phoenix/git-server.yaml
Normal file
@@ -0,0 +1,238 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: phoenix-git-server
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "infrastructure"
|
||||
environment: "production"
|
||||
app: "phoenix"
|
||||
component: "git"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "phoenix-git-server"
|
||||
cpu: 8
|
||||
memory: "16Gi"
|
||||
disk: "500Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
# Git and container packages
|
||||
- git
|
||||
- docker.io
|
||||
- docker-compose
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- postgresql
|
||||
- postgresql-contrib
|
||||
- redis-server
|
||||
- ufw
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo, docker
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure Docker
|
||||
- systemctl enable docker
|
||||
- systemctl start docker
|
||||
|
||||
# Configure PostgreSQL
|
||||
- systemctl enable postgresql
|
||||
- systemctl start postgresql
|
||||
|
||||
# Configure Redis
|
||||
- systemctl enable redis-server
|
||||
- systemctl start redis-server
|
||||
|
||||
# Configure Nginx
|
||||
- systemctl enable nginx
|
||||
- systemctl start nginx
|
||||
|
||||
# Configure UFW firewall
|
||||
- ufw allow 22/tcp # SSH
|
||||
- ufw allow 80/tcp # HTTP
|
||||
- ufw allow 443/tcp # HTTPS
|
||||
- ufw allow 3000/tcp # Gitea (if using)
|
||||
- ufw allow 8080/tcp # GitLab (if using)
|
||||
- ufw --force enable
|
||||
|
||||
# Create directories for Git repositories
|
||||
- mkdir -p /opt/git/repositories
|
||||
- mkdir -p /opt/git/data
|
||||
- chown -R admin:admin /opt/git
|
||||
|
||||
# Create docker-compose directory structure
|
||||
- mkdir -p /opt/git/docker-compose
|
||||
- chown -R admin:admin /opt/git/docker-compose
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
193
examples/production/smom-dbis-138/blockscout.yaml
Normal file
193
examples/production/smom-dbis-138/blockscout.yaml
Normal file
@@ -0,0 +1,193 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-blockscout
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "blockscout"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "smom-blockscout"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "12Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
207
examples/production/smom-dbis-138/management.yaml
Normal file
207
examples/production/smom-dbis-138/management.yaml
Normal file
@@ -0,0 +1,207 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: management
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "services"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "management"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "35Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
207
examples/production/smom-dbis-138/monitoring.yaml
Normal file
207
examples/production/smom-dbis-138/monitoring.yaml
Normal file
@@ -0,0 +1,207 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: monitoring
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "services"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "monitoring"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "35Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
207
examples/production/smom-dbis-138/rpc-node-01.yaml
Normal file
207
examples/production/smom-dbis-138/rpc-node-01.yaml
Normal file
@@ -0,0 +1,207 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: rpc-node-01
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "services"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "rpc-node-01"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "35Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
207
examples/production/smom-dbis-138/rpc-node-02.yaml
Normal file
207
examples/production/smom-dbis-138/rpc-node-02.yaml
Normal file
@@ -0,0 +1,207 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: rpc-node-02
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "services"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "rpc-node-02"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "35Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
207
examples/production/smom-dbis-138/rpc-node-03.yaml
Normal file
207
examples/production/smom-dbis-138/rpc-node-03.yaml
Normal file
@@ -0,0 +1,207 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: rpc-node-03
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "services"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "rpc-node-03"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "35Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
207
examples/production/smom-dbis-138/rpc-node-04.yaml
Normal file
207
examples/production/smom-dbis-138/rpc-node-04.yaml
Normal file
@@ -0,0 +1,207 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: rpc-node-04
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "services"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "rpc-node-04"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "35Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
221
examples/production/smom-dbis-138/sentry-01.yaml
Normal file
221
examples/production/smom-dbis-138/sentry-01.yaml
Normal file
@@ -0,0 +1,221 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-sentry-01
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "sentry"
|
||||
instance: "01"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "smom-sentry-01"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "15Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
221
examples/production/smom-dbis-138/sentry-02.yaml
Normal file
221
examples/production/smom-dbis-138/sentry-02.yaml
Normal file
@@ -0,0 +1,221 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-sentry-02
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "sentry"
|
||||
instance: "02"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "smom-sentry-02"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "15Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
221
examples/production/smom-dbis-138/sentry-03.yaml
Normal file
221
examples/production/smom-dbis-138/sentry-03.yaml
Normal file
@@ -0,0 +1,221 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-sentry-03
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "sentry"
|
||||
instance: "03"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "smom-sentry-03"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "15Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
221
examples/production/smom-dbis-138/sentry-04.yaml
Normal file
221
examples/production/smom-dbis-138/sentry-04.yaml
Normal file
@@ -0,0 +1,221 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-sentry-04
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "sentry"
|
||||
instance: "04"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "smom-sentry-04"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "15Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
207
examples/production/smom-dbis-138/services.yaml
Normal file
207
examples/production/smom-dbis-138/services.yaml
Normal file
@@ -0,0 +1,207 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-services
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "services"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "r630-01"
|
||||
name: "smom-services"
|
||||
cpu: 4
|
||||
memory: "8Gi"
|
||||
disk: "35Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-2"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
220
examples/production/smom-dbis-138/validator-01.yaml
Normal file
220
examples/production/smom-dbis-138/validator-01.yaml
Normal file
@@ -0,0 +1,220 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-validator-01
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "validator"
|
||||
instance: "01"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "smom-validator-01"
|
||||
cpu: 6
|
||||
memory: "12Gi"
|
||||
disk: "20Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
220
examples/production/smom-dbis-138/validator-02.yaml
Normal file
220
examples/production/smom-dbis-138/validator-02.yaml
Normal file
@@ -0,0 +1,220 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-validator-02
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "validator"
|
||||
instance: "02"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "smom-validator-02"
|
||||
cpu: 6
|
||||
memory: "12Gi"
|
||||
disk: "20Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
220
examples/production/smom-dbis-138/validator-03.yaml
Normal file
220
examples/production/smom-dbis-138/validator-03.yaml
Normal file
@@ -0,0 +1,220 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-validator-03
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "validator"
|
||||
instance: "03"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "smom-validator-03"
|
||||
cpu: 6
|
||||
memory: "12Gi"
|
||||
disk: "20Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
220
examples/production/smom-dbis-138/validator-04.yaml
Normal file
220
examples/production/smom-dbis-138/validator-04.yaml
Normal file
@@ -0,0 +1,220 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: smom-validator-04
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "smom-dbis-138"
|
||||
environment: "production"
|
||||
app: "smom-dbis-138"
|
||||
component: "validator"
|
||||
instance: "04"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "smom-validator-04"
|
||||
cpu: 6
|
||||
memory: "12Gi"
|
||||
disk: "20Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
220
examples/production/vm-100.yaml
Normal file
220
examples/production/vm-100.yaml
Normal file
@@ -0,0 +1,220 @@
|
||||
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
||||
kind: ProxmoxVM
|
||||
metadata:
|
||||
name: vm-100
|
||||
namespace: default
|
||||
labels:
|
||||
tenant.sankofa.nexus/id: "tenant-001"
|
||||
environment: "production"
|
||||
app: "basic"
|
||||
vmid: "100"
|
||||
spec:
|
||||
forProvider:
|
||||
node: "ml110-01"
|
||||
name: "vm-100"
|
||||
cpu: 2
|
||||
memory: "4Gi"
|
||||
disk: "50Gi"
|
||||
storage: "local-lvm"
|
||||
network: "vmbr0"
|
||||
image: "local:iso/ubuntu-22.04-cloud.img"
|
||||
site: "site-1"
|
||||
userData: |
|
||||
#cloud-config
|
||||
# Package management
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
# Required packages
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- curl
|
||||
- wget
|
||||
- net-tools
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- chrony
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
|
||||
# Time synchronization (NTP)
|
||||
ntp:
|
||||
enabled: true
|
||||
ntp_client: chrony
|
||||
servers:
|
||||
- 0.pool.ntp.org
|
||||
- 1.pool.ntp.org
|
||||
- 2.pool.ntp.org
|
||||
- 3.pool.ntp.org
|
||||
|
||||
# User configuration
|
||||
users:
|
||||
- name: admin
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
lock_passwd: false
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
||||
|
||||
# Boot commands - executed in order
|
||||
runcmd:
|
||||
# Verify packages are installed
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying required packages are installed..."
|
||||
echo "=========================================="
|
||||
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
||||
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
||||
echo "ERROR: Package $pkg is not installed"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Package $pkg is installed"
|
||||
done
|
||||
echo "All required packages verified"
|
||||
|
||||
# Verify qemu-guest-agent package details
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Checking qemu-guest-agent package details..."
|
||||
echo "=========================================="
|
||||
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
||||
echo "✅ qemu-guest-agent package IS installed"
|
||||
dpkg -l | grep qemu-guest-agent
|
||||
else
|
||||
echo "❌ qemu-guest-agent package is NOT installed"
|
||||
echo "Attempting to install..."
|
||||
apt-get update
|
||||
apt-get install -y qemu-guest-agent
|
||||
fi
|
||||
|
||||
# Enable and start QEMU Guest Agent
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Enabling and starting QEMU Guest Agent..."
|
||||
echo "=========================================="
|
||||
systemctl enable qemu-guest-agent
|
||||
systemctl start qemu-guest-agent
|
||||
echo "QEMU Guest Agent enabled and started"
|
||||
|
||||
# Verify guest agent service is running
|
||||
- |
|
||||
echo "=========================================="
|
||||
echo "Verifying QEMU Guest Agent service status..."
|
||||
echo "=========================================="
|
||||
for i in {1..30}; do
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent service IS running"
|
||||
systemctl status qemu-guest-agent --no-pager -l
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
||||
systemctl status qemu-guest-agent --no-pager -l || true
|
||||
echo "Attempting to restart..."
|
||||
systemctl restart qemu-guest-agent
|
||||
sleep 3
|
||||
if systemctl is-active --quiet qemu-guest-agent; then
|
||||
echo "✅ QEMU Guest Agent started after restart"
|
||||
else
|
||||
echo "❌ QEMU Guest Agent failed to start"
|
||||
fi
|
||||
|
||||
# Configure automatic security updates
|
||||
- |
|
||||
echo "Configuring automatic security updates..."
|
||||
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
||||
EOF
|
||||
systemctl enable unattended-upgrades
|
||||
systemctl start unattended-upgrades
|
||||
echo "Automatic security updates configured"
|
||||
|
||||
# Configure NTP (Chrony)
|
||||
- |
|
||||
echo "Configuring NTP (Chrony)..."
|
||||
systemctl enable chrony
|
||||
systemctl restart chrony
|
||||
sleep 3
|
||||
if systemctl is-active --quiet chrony; then
|
||||
echo "NTP (Chrony) is running"
|
||||
chronyc tracking | head -1 || true
|
||||
else
|
||||
echo "WARNING: NTP (Chrony) may not be running"
|
||||
fi
|
||||
|
||||
# SSH hardening
|
||||
- |
|
||||
echo "Hardening SSH configuration..."
|
||||
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
fi
|
||||
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
||||
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
systemctl restart sshd
|
||||
echo "SSH hardening completed"
|
||||
|
||||
# Write files for security configuration
|
||||
write_files:
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
|
||||
# Final message
|
||||
final_message: |
|
||||
==========================================
|
||||
System Boot Completed Successfully!
|
||||
==========================================
|
||||
|
||||
Services Status:
|
||||
- QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
|
||||
- NTP (Chrony): $(systemctl is-active chrony)
|
||||
- Automatic Security Updates: $(systemctl is-active unattended-upgrades)
|
||||
|
||||
System Information:
|
||||
- Hostname: $(hostname)
|
||||
- IP Address: $(hostname -I | awk '{print $1}')
|
||||
- Time: $(date)
|
||||
|
||||
Packages Installed:
|
||||
- qemu-guest-agent, curl, wget, net-tools
|
||||
- chrony (NTP), unattended-upgrades (Security)
|
||||
|
||||
Security Configuration:
|
||||
- SSH: Root login disabled, Password auth disabled
|
||||
- Automatic security updates: Enabled
|
||||
- NTP synchronization: Enabled
|
||||
|
||||
Next Steps:
|
||||
1. Verify all services are running
|
||||
2. Check cloud-init logs: /var/log/cloud-init-output.log
|
||||
3. Test SSH access
|
||||
==========================================
|
||||
providerConfigRef:
|
||||
name: proxmox-provider-config
|
||||
|
||||
Reference in New Issue
Block a user