Initialer Import der Synology Scripts
This commit is contained in:
root
+3
@@ -0,0 +1,3 @@
|
|||||||
|
{
|
||||||
|
"ansible.python.interpreterPath": "/usr/bin/python3"
|
||||||
|
}
|
||||||
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
Executable
+50
@@ -0,0 +1,50 @@
|
|||||||
|
- name: Deploy VMs auf Proxmox
|
||||||
|
hosts: localhost
|
||||||
|
gather_facts: false
|
||||||
|
collections:
|
||||||
|
- community.proxmox
|
||||||
|
- community.general
|
||||||
|
|
||||||
|
vars:
|
||||||
|
api_host: "localhost"
|
||||||
|
api_user: "root@pam"
|
||||||
|
api_token_id: "ansible"
|
||||||
|
api_token_secret: "f77b7f8c-8c73-4782-a4ad-8bbf7162e7ca"
|
||||||
|
|
||||||
|
node_map:
|
||||||
|
fhs0: FHS0
|
||||||
|
fhs1: FHS1
|
||||||
|
fhs2: FHS2
|
||||||
|
hs1: HS1
|
||||||
|
hs2: HS2
|
||||||
|
hs3: HS3
|
||||||
|
hs4: HS4
|
||||||
|
ts01: TS1
|
||||||
|
|
||||||
|
vm_json: "/mnt/scripte/VM_DEPLOYMENT/vm_output.json"
|
||||||
|
ct_json: "/mnt/scripte/VM_DEPLOYMENT/ct_output.json"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
- name: Load VM JSON
|
||||||
|
set_fact:
|
||||||
|
vm_list: "{{ lookup('file', vm_json) | from_json }}"
|
||||||
|
|
||||||
|
- name: Create VMs
|
||||||
|
include_tasks: 001h_sub_create_vm.yaml
|
||||||
|
loop: "{{ vm_list }}"
|
||||||
|
loop_control:
|
||||||
|
loop_var: item
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# Container
|
||||||
|
# -----------------------------
|
||||||
|
- name: Load CT JSON
|
||||||
|
set_fact:
|
||||||
|
ct_list: "{{ lookup('file', ct_json) | from_json }}"
|
||||||
|
|
||||||
|
- name: Create Containers
|
||||||
|
include_tasks: 002_sub_create_ct.yaml
|
||||||
|
loop: "{{ ct_list }}"
|
||||||
|
loop_control:
|
||||||
|
loop_var: item
|
||||||
Executable
+177
@@ -0,0 +1,177 @@
|
|||||||
|
# -----------------------------
|
||||||
|
# Reset facts for this VM
|
||||||
|
# -----------------------------
|
||||||
|
- name: Reset facts
|
||||||
|
set_fact:
|
||||||
|
scsi_disks: {}
|
||||||
|
net_config: {}
|
||||||
|
ide_config: {}
|
||||||
|
efidisk0_config: {}
|
||||||
|
tpmstate0_config: {}
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# Check if VM exists
|
||||||
|
# -----------------------------
|
||||||
|
- name: Check if VM exists
|
||||||
|
uri:
|
||||||
|
url: "https://{{ hostvars[node_map[item.Node]].ansible_host }}:8006/api2/json/nodes/{{ item.Node | lower }}/qemu/{{ item['VM ID'] }}/config"
|
||||||
|
method: GET
|
||||||
|
validate_certs: false
|
||||||
|
headers:
|
||||||
|
Authorization: "PVEAPIToken=root@pam!ansible={{ api_token_secret }}"
|
||||||
|
register: vm_config
|
||||||
|
failed_when: false # 401/404 stoppen das Playbook nicht
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: Set VM exists fact
|
||||||
|
set_fact:
|
||||||
|
vm_exists: "{{ vm_config.status == 200 }}"
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 1. Build SCSI disks map
|
||||||
|
# -----------------------------
|
||||||
|
- name: Build scsi disks map
|
||||||
|
set_fact:
|
||||||
|
scsi_disks: >-
|
||||||
|
{{
|
||||||
|
scsi_disks | default({}) |
|
||||||
|
combine({
|
||||||
|
('scsi' ~ disk.Device): {
|
||||||
|
"storage": item['Disk Storage'].split()[0],
|
||||||
|
"size": disk.Size | int
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}}
|
||||||
|
loop: "{{ item.Disks }}"
|
||||||
|
loop_control:
|
||||||
|
loop_var: disk
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 2. Build network config
|
||||||
|
# -----------------------------
|
||||||
|
- name: Build network config
|
||||||
|
set_fact:
|
||||||
|
net_config:
|
||||||
|
net0: "model={{ item.Model | lower | regex_replace(' .*','') }},bridge={{ item.Bridge }}"
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 3. Build IDE config
|
||||||
|
# -----------------------------
|
||||||
|
- name: Build IDE config
|
||||||
|
set_fact:
|
||||||
|
ide_config: >-
|
||||||
|
{{
|
||||||
|
( {} |
|
||||||
|
combine(
|
||||||
|
{ 'ide2': ((item['ISO Storage'] | default('ISO') | string).split()[0] ~ ":iso/" ~ item['ISO File'] ~ ",media=cdrom") }
|
||||||
|
) |
|
||||||
|
combine(
|
||||||
|
item['Enable VirtIO'] | ternary(
|
||||||
|
{ 'ide0': ((item['VirtIO Storage'] | default('ISO') | string).split()[0] ~ ":iso/" ~ item['VirtIO ISO'] ~ ",media=cdrom") },
|
||||||
|
{}
|
||||||
|
)
|
||||||
|
)
|
||||||
|
)
|
||||||
|
}}
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 4. Build EFI disk config
|
||||||
|
# -----------------------------
|
||||||
|
- name: Build EFI disk config
|
||||||
|
set_fact:
|
||||||
|
efidisk0_config: >-
|
||||||
|
{%
|
||||||
|
set efidisk = item['EFI STORAGE'] | ternary({
|
||||||
|
"storage": ((item['EFI STORAGE'] | string).split()[0]),
|
||||||
|
"efitype": "4m",
|
||||||
|
"format": "qcow2",
|
||||||
|
"pre_enrolled_keys": false
|
||||||
|
}, {}) %}
|
||||||
|
{{ efidisk }}
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 5. Build TPM config
|
||||||
|
# -----------------------------
|
||||||
|
- name: Build TPM config for Proxmox
|
||||||
|
set_fact:
|
||||||
|
tpmstate0_config: >-
|
||||||
|
{{
|
||||||
|
item['Add TPM'] | ternary({
|
||||||
|
"storage": (item['TPM Storage'] | string).split()[0],
|
||||||
|
"version": (item['TPM Version'] | regex_replace('^v','')) | default('2.0'),
|
||||||
|
}, {})
|
||||||
|
}}
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 6. Show VM variables before creating VM
|
||||||
|
# -----------------------------
|
||||||
|
- name: Show VM variables before creating VM
|
||||||
|
debug:
|
||||||
|
msg:
|
||||||
|
- "VM ID: {{ item['VM ID'] }}"
|
||||||
|
- "Node: {{ item.Node }}"
|
||||||
|
- "TPM Add: {{ item['Add TPM'] }}"
|
||||||
|
- "TPM Config: {{ tpmstate0_config }}"
|
||||||
|
- "SCSI Disks: {{ scsi_disks }}"
|
||||||
|
- "Network Config: {{ net_config }}"
|
||||||
|
- "IDE Config: {{ ide_config }}"
|
||||||
|
- "EFI Disk Config: {{ efidisk0_config }}"
|
||||||
|
- "Maschine Config: {{ item.Maschine }}"
|
||||||
|
- "BIOS Config: {{ item.BIOS }}"
|
||||||
|
- "VM exists: {{ vm_exists }}"
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 7. Create VM if it does not exist
|
||||||
|
# -----------------------------
|
||||||
|
- name: Create VM
|
||||||
|
community.proxmox.proxmox_kvm:
|
||||||
|
api_host: "{{ hostvars[node_map[item.Node]].ansible_host }}"
|
||||||
|
api_user: "root@pam"
|
||||||
|
api_token_id: "ansible"
|
||||||
|
api_token_secret: "{{ api_token_secret }}"
|
||||||
|
validate_certs: false
|
||||||
|
|
||||||
|
node: "{{ item.Node | lower }}"
|
||||||
|
vmid: "{{ item['VM ID'] }}"
|
||||||
|
name: "{{ item.Name | lower | regex_replace('_','-') }}"
|
||||||
|
memory: "{{ item.Memory }}"
|
||||||
|
cores: "{{ item.Cores }}"
|
||||||
|
sockets: "{{ item.Sockets }}"
|
||||||
|
machine: "{{ 'q35' if 'q35' in (item.Maschine | lower) else 'pc' }}"
|
||||||
|
bios: "{{ 'ovmf' if 'ovmf' in item.BIOS | lower else 'seabios' }}"
|
||||||
|
ostype: "{{ 'win11' if item['OS Typ'] == 'Microsoft' else 'l26' }}"
|
||||||
|
agent: "{{ 1 if item['Qemu Agent'] else 0 }}"
|
||||||
|
balloon: "{{ item.Ballooning }}"
|
||||||
|
onboot: "{{ item['Start at boot'] }}"
|
||||||
|
net: "{{ net_config }}"
|
||||||
|
ide: "{{ ide_config }}"
|
||||||
|
efidisk0: "{{ efidisk0_config if efidisk0_config != {} else omit }}"
|
||||||
|
tpmstate0: "{{ tpmstate0_config if tpmstate0_config != {} else omit }}"
|
||||||
|
tags: "{{ item.Service | lower }}"
|
||||||
|
state: present
|
||||||
|
timeout: 600
|
||||||
|
when: not vm_exists
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# 8. Create SCSI disks if not exist
|
||||||
|
# -----------------------------
|
||||||
|
- name: Create SCSI disks for VM
|
||||||
|
community.proxmox.proxmox_disk:
|
||||||
|
api_host: "{{ hostvars[node_map[item.Node]].ansible_host }}"
|
||||||
|
api_user: "root@pam"
|
||||||
|
api_token_id: "ansible"
|
||||||
|
api_token_secret: "{{ api_token_secret }}"
|
||||||
|
validate_certs: false
|
||||||
|
|
||||||
|
vmid: "{{ item['VM ID'] }}"
|
||||||
|
disk: "{{ disk.key }}"
|
||||||
|
storage: "{{ disk.value.storage }}"
|
||||||
|
size: "{{ disk.value.size }}"
|
||||||
|
state: present
|
||||||
|
iothread: 1
|
||||||
|
|
||||||
|
loop: "{{ scsi_disks | dict2items }}"
|
||||||
|
loop_control:
|
||||||
|
loop_var: disk
|
||||||
|
|
||||||
|
when: vm_exists and (disk.key not in vm_config.json.data.keys())
|
||||||
Executable
+96
@@ -0,0 +1,96 @@
|
|||||||
|
# -----------------------------
|
||||||
|
# 002_sub_create_ct.yaml
|
||||||
|
# -----------------------------
|
||||||
|
|
||||||
|
- name: Reset facts
|
||||||
|
set_fact:
|
||||||
|
net_config: ""
|
||||||
|
features_string: ""
|
||||||
|
|
||||||
|
- name: Normalize storage names
|
||||||
|
set_fact:
|
||||||
|
template_storage_clean: "{{ item['Template Storage'].split(' ')[0] | trim }}"
|
||||||
|
disk_storage_clean: "{{ item['Disk Storage'].split(' ')[0] | trim }}"
|
||||||
|
|
||||||
|
- name: Build ostemplate path
|
||||||
|
set_fact:
|
||||||
|
ostemplate_path: "{{ template_storage_clean }}:vztmpl/{{ item.Template }}"
|
||||||
|
|
||||||
|
- name: Build network config
|
||||||
|
set_fact:
|
||||||
|
net_config: "{{ 'name=eth0,bridge=' ~ item.Bridge ~ ',ip=' ~ (item['IPv4/CIDR'] | default('dhcp')) ~ (',gw=' ~ item['Gateway(IPv4)'] if item['Gateway(IPv4)'] else '') }}"
|
||||||
|
|
||||||
|
- name: Build features string
|
||||||
|
set_fact:
|
||||||
|
features_string: "{{ ['nesting=1' if item.Nesting | default(False) else '', 'keyctl=1' if item.get('Keyctl', False) else ''] | reject('equalto','') | join(',') }}"
|
||||||
|
|
||||||
|
- name: Show CT variables
|
||||||
|
debug:
|
||||||
|
msg:
|
||||||
|
- "CT ID: {{ item['CT ID'] }}"
|
||||||
|
- "Node: {{ item.Node }}"
|
||||||
|
- "Hostname: {{ item.Hostname }}"
|
||||||
|
- "Net: {{ net_config }}"
|
||||||
|
- "Features: {{ features_string }}"
|
||||||
|
- "Template Path: {{ ostemplate_path }}"
|
||||||
|
|
||||||
|
- name: Cleanup strings
|
||||||
|
set_fact:
|
||||||
|
net_config: "{{ net_config | trim }}"
|
||||||
|
features_string: "{{ features_string | trim }}"
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# CHECK IF CT EXISTS
|
||||||
|
# -----------------------------
|
||||||
|
- name: Check if CT exists
|
||||||
|
ansible.builtin.uri:
|
||||||
|
url: "https://{{ hostvars[node_map[item.Node]].ansible_host }}:8006/api2/json/nodes/{{ item.Node }}/lxc/{{ item['CT ID'] }}/status/current"
|
||||||
|
method: GET
|
||||||
|
headers:
|
||||||
|
Authorization: "PVEAPIToken=root@pam!ansible={{ api_token_secret }}"
|
||||||
|
validate_certs: false
|
||||||
|
register: ct_check
|
||||||
|
failed_when: false
|
||||||
|
delegate_to: localhost
|
||||||
|
|
||||||
|
- name: Set CT exists fact
|
||||||
|
set_fact:
|
||||||
|
ct_exists: "{{ ct_check.status == 200 }}"
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# CREATE CT
|
||||||
|
# -----------------------------
|
||||||
|
- name: Create LXC Container if not exists
|
||||||
|
community.general.proxmox:
|
||||||
|
api_host: "{{ hostvars[node_map[item.Node]].ansible_host }}"
|
||||||
|
api_user: "root@pam"
|
||||||
|
api_token_id: "ansible"
|
||||||
|
api_token_secret: "{{ api_token_secret }}"
|
||||||
|
validate_certs: false
|
||||||
|
|
||||||
|
node: "{{ item.Node }}"
|
||||||
|
vmid: "{{ item['CT ID'] }}"
|
||||||
|
hostname: "{{ item.Hostname }}"
|
||||||
|
cores: "{{ item.Cores }}"
|
||||||
|
memory: "{{ item.Memory }}"
|
||||||
|
swap: "{{ item.Swap }}"
|
||||||
|
|
||||||
|
ostemplate: "{{ ostemplate_path | trim }}"
|
||||||
|
disk: "{{ item.Disk | default('8') }}"
|
||||||
|
storage: "{{ disk_storage_clean | trim }}"
|
||||||
|
|
||||||
|
netif:
|
||||||
|
net0: "{{ net_config }}"
|
||||||
|
|
||||||
|
features: "{{ features_string }}"
|
||||||
|
|
||||||
|
state: present
|
||||||
|
when: not ct_exists
|
||||||
|
|
||||||
|
# -----------------------------
|
||||||
|
# DEBUG RESULT
|
||||||
|
# -----------------------------
|
||||||
|
- name: Show result
|
||||||
|
debug:
|
||||||
|
msg: "CT {{ item['CT ID'] }} created"
|
||||||
|
when: not ct_exists
|
||||||
Executable
+51
@@ -0,0 +1,51 @@
|
|||||||
|
---
|
||||||
|
- name: Netzwerk Ping Scan und CSV Export
|
||||||
|
hosts: localhost
|
||||||
|
gather_facts: false
|
||||||
|
|
||||||
|
vars:
|
||||||
|
netzwerke:
|
||||||
|
- "192.168.1.0/24"
|
||||||
|
- "9.99.0.0/24"
|
||||||
|
- "9.99.10.0/24"
|
||||||
|
- "9.99.20.0/24"
|
||||||
|
- "9.99.30.0/24"
|
||||||
|
- "9.99.40.0/24"
|
||||||
|
- "9.99.50.0/24"
|
||||||
|
- "9.99.60.0/24"
|
||||||
|
- "9.99.70.0/24"
|
||||||
|
|
||||||
|
csv_datei: "/mnt/scripte/NETWORK-SCAN/netzwerk_scan.csv"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
- name: Prüfen ob nmap installiert ist
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: which nmap
|
||||||
|
register: nmap_check
|
||||||
|
failed_when: nmap_check.rc != 0
|
||||||
|
|
||||||
|
- name: Netzwerkbereiche scannen
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "nmap -sn {{ item }}"
|
||||||
|
loop: "{{ netzwerke }}"
|
||||||
|
register: scan_ergebnis
|
||||||
|
|
||||||
|
- name: Scan-Ergebnisse zusammenführen
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
scan_text: "{{ scan_ergebnis.results | map(attribute='stdout') | join('\n') }}"
|
||||||
|
|
||||||
|
- name: CSV Datei erzeugen
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: "{{ csv_datei }}"
|
||||||
|
content: |
|
||||||
|
IP-Adresse,Status
|
||||||
|
{% for line in scan_text.split('\n') %}
|
||||||
|
{% if 'Nmap scan report for' in line %}
|
||||||
|
{{ line | regex_replace('.*for ', '') }},ONLINE
|
||||||
|
{% endif %}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
- name: Ergebnis anzeigen
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "Scan abgeschlossen. Datei: {{ csv_datei }}"
|
||||||
Executable
+108
@@ -0,0 +1,108 @@
|
|||||||
|
---
|
||||||
|
- name: Netzwerk Scan ARP + NMAP CSV
|
||||||
|
hosts: localhost
|
||||||
|
gather_facts: false
|
||||||
|
|
||||||
|
vars:
|
||||||
|
dns_server:
|
||||||
|
- "192.168.1.230"
|
||||||
|
lokales_netz:
|
||||||
|
- "192.168.1.0/24"
|
||||||
|
|
||||||
|
entfernte_netze:
|
||||||
|
- "9.99.0.0/24"
|
||||||
|
- "9.99.10.0/24"
|
||||||
|
- "9.99.20.0/24"
|
||||||
|
- "9.99.30.0/24"
|
||||||
|
- "9.99.40.0/24"
|
||||||
|
- "9.99.50.0/24"
|
||||||
|
- "9.99.60.0/24"
|
||||||
|
- "9.99.70.0/24"
|
||||||
|
|
||||||
|
csv_datei: "/mnt/scripte/NETWORK-SCAN/netzwerk_scan_combined.csv"
|
||||||
|
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
####################################################
|
||||||
|
# ARP Scan lokales Netzwerk
|
||||||
|
####################################################
|
||||||
|
|
||||||
|
- name: ARP Scan lokales Netz
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "sudo arp-scan {{ item }}"
|
||||||
|
loop: "{{ lokales_netz }}"
|
||||||
|
register: arp_ergebnis
|
||||||
|
|
||||||
|
|
||||||
|
- name: ARP Daten sammeln
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
hosts_liste: "{{ hosts_liste | default([]) + [ {
|
||||||
|
'ip': item.split()[0],
|
||||||
|
'mac': item.split()[1],
|
||||||
|
'hersteller': item.split()[2:] | join(' ')
|
||||||
|
} ] }}"
|
||||||
|
loop: "{{ arp_ergebnis.results | map(attribute='stdout_lines') | flatten }}"
|
||||||
|
when:
|
||||||
|
- item.split() | length >= 2
|
||||||
|
- item.split()[0] is match('^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$')
|
||||||
|
|
||||||
|
|
||||||
|
####################################################
|
||||||
|
# NMAP Scan entfernte Netzwerke
|
||||||
|
####################################################
|
||||||
|
|
||||||
|
- name: NMAP Scan entfernte Netze
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "nmap -sn {{ item }}"
|
||||||
|
loop: "{{ entfernte_netze }}"
|
||||||
|
register: nmap_ergebnis
|
||||||
|
|
||||||
|
|
||||||
|
- name: NMAP IPs hinzufügen
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
hosts_liste: "{{ hosts_liste | default([]) + [ {
|
||||||
|
'ip': item | regex_replace('.*for ', ''),
|
||||||
|
'mac': 'unbekannt',
|
||||||
|
'hersteller': 'unbekannt'
|
||||||
|
} ] }}"
|
||||||
|
loop: >-
|
||||||
|
{{
|
||||||
|
nmap_ergebnis.results
|
||||||
|
| map(attribute='stdout_lines')
|
||||||
|
| flatten
|
||||||
|
}}
|
||||||
|
when:
|
||||||
|
- "'Nmap scan report for' in item"
|
||||||
|
|
||||||
|
|
||||||
|
####################################################
|
||||||
|
# Hostnamen suchen
|
||||||
|
####################################################
|
||||||
|
|
||||||
|
- name: Hostnamen über zentralen DNS abfragen
|
||||||
|
ansible.builtin.shell:
|
||||||
|
cmd: "dig @{{ dns_server }} -x {{ item.ip }} +short | sed 's/\\.$//'"
|
||||||
|
loop: "{{ hosts_liste }}"
|
||||||
|
register: hostname_ergebnis
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
|
||||||
|
####################################################
|
||||||
|
# CSV schreiben
|
||||||
|
####################################################
|
||||||
|
|
||||||
|
- name: CSV erstellen
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: "{{ csv_datei }}"
|
||||||
|
content: |
|
||||||
|
IP : HOSTNAME : MAC ADRESSE : HERSTELLER
|
||||||
|
{% for host in hosts_liste %}
|
||||||
|
{{ host.ip }} : {{ hostname_ergebnis.results[loop.index0].stdout | trim | default('unbekannt', true) }} : {{ host.mac }} : {{ host.hersteller }}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
|
||||||
|
- name: Ergebnis anzeigen
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "Scan fertig: {{ csv_datei }}"
|
||||||
Executable
+7
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
- name: add non AD-GROUP
|
||||||
|
hosts: debian_vms
|
||||||
|
become: false #root berechtigung
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Update apt package cache and upgrade all packages
|
||||||
Executable
+18
@@ -0,0 +1,18 @@
|
|||||||
|
---
|
||||||
|
- name: add non AD-GROUP
|
||||||
|
hosts: debian_vms
|
||||||
|
become: false #root berechtigung
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: add local user
|
||||||
|
user:
|
||||||
|
name: ansible
|
||||||
|
shell: /bin/bash
|
||||||
|
#mkpasswd --method=sha-512
|
||||||
|
password: ''
|
||||||
|
groups: sudo
|
||||||
|
|
||||||
|
- name: Add SSH paublic Key for User to the "authorized Keys" file
|
||||||
|
authorized_key:
|
||||||
|
user: ansible
|
||||||
|
key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOY9BjyR9eK0/BDgwp+1E5LZjd/92fEtH5CcRRlP7lWf"
|
||||||
Executable
+6
@@ -0,0 +1,6 @@
|
|||||||
|
- name: Certificate Pipeline
|
||||||
|
hosts: all
|
||||||
|
gather_facts: true
|
||||||
|
|
||||||
|
roles:
|
||||||
|
- certificate
|
||||||
Executable
+71
@@ -0,0 +1,71 @@
|
|||||||
|
---
|
||||||
|
- name: Ensure EJBCA VM exists on Proxmox
|
||||||
|
hosts: front
|
||||||
|
gather_facts: no
|
||||||
|
connection: local
|
||||||
|
|
||||||
|
vars:
|
||||||
|
api_user: "root@pam!ansible"
|
||||||
|
api_token_id: "ansible" # Name des Tokens in PVE
|
||||||
|
api_token_secret: "f77b7f8c-8c73-4782-a4ad-8bbf7162e7ca" # Secret aus PVE
|
||||||
|
api_host: "{{ ansible_host }}"
|
||||||
|
node: "fhs0" # exakter Node-Name in Proxmox
|
||||||
|
vmid: 250
|
||||||
|
vm_name: "ca-heim"
|
||||||
|
memory: 4096
|
||||||
|
cores: 2
|
||||||
|
scsi_storage: "CEPH_SSD" # VM-Disk Speicher
|
||||||
|
scsi_size: 20
|
||||||
|
bridge: "DMZ"
|
||||||
|
iso_image: "debian-13.2.0-amd64-DVD.iso" # ISO auf CEPH-Share
|
||||||
|
start_vm: false
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Ensure old VM is absent (idempotent)
|
||||||
|
community.proxmox.proxmox_kvm:
|
||||||
|
api_user: "{{ api_user }}"
|
||||||
|
api_token_id: "{{ api_token_id }}"
|
||||||
|
api_token_secret: "{{ api_token_secret }}"
|
||||||
|
api_host: "{{ api_host }}"
|
||||||
|
node: "{{ node }}"
|
||||||
|
vmid: "{{ vmid }}"
|
||||||
|
state: absent
|
||||||
|
force: yes
|
||||||
|
validate_certs: false
|
||||||
|
|
||||||
|
- name: Create VM without starting
|
||||||
|
community.proxmox.proxmox_kvm:
|
||||||
|
api_user: "{{ api_user }}"
|
||||||
|
api_token_id: "{{ api_token_id }}"
|
||||||
|
api_token_secret: "{{ api_token_secret }}"
|
||||||
|
api_host: "{{ api_host }}"
|
||||||
|
node: "{{ node }}"
|
||||||
|
vmid: "{{ vmid }}"
|
||||||
|
name: "{{ vm_name }}"
|
||||||
|
memory: "{{ memory }}"
|
||||||
|
cores: "{{ cores }}"
|
||||||
|
net0: "virtio,bridge={{ bridge }}"
|
||||||
|
scsi0: "{{ scsi_storage }}:vm-{{ vmid }}-disk-0,size={{ scsi_size }}G,format=qcow2,pool={{ scsi_storage }}"
|
||||||
|
ide2: "CEPH-Share:iso/{{ iso_image }},media=cdrom"
|
||||||
|
boot: "cdn"
|
||||||
|
ostype: l26
|
||||||
|
state: present
|
||||||
|
validate_certs: false
|
||||||
|
|
||||||
|
- name: Optionally start VM
|
||||||
|
community.proxmox.proxmox_kvm:
|
||||||
|
api_user: "{{ api_user }}"
|
||||||
|
api_token_id: "{{ api_token_id }}"
|
||||||
|
api_token_secret: "{{ api_token_secret }}"
|
||||||
|
api_host: "{{ api_host }}"
|
||||||
|
node: "{{ node }}"
|
||||||
|
vmid: "{{ vmid }}"
|
||||||
|
state: started
|
||||||
|
wait: yes
|
||||||
|
timeout: 300
|
||||||
|
validate_certs: false
|
||||||
|
when: start_vm
|
||||||
|
|
||||||
|
- name: VM Info
|
||||||
|
debug:
|
||||||
|
msg: "VM '{{ vm_name }}' (ID {{ vmid }}) is ready. Disk on {{ scsi_storage }}, ISO on CEPH-Share"
|
||||||
Executable
+34
@@ -0,0 +1,34 @@
|
|||||||
|
---
|
||||||
|
- name: SMB Credentials auf Zielhosts erzeugen
|
||||||
|
hosts: all
|
||||||
|
become: false
|
||||||
|
gather_facts: false
|
||||||
|
ignore_unreachable: yes
|
||||||
|
|
||||||
|
vars_files:
|
||||||
|
- ../group_vars/all/smb_credentials.yaml
|
||||||
|
|
||||||
|
vars:
|
||||||
|
credentials_file: "/root/.smbcredentials2"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: SMB Credentials Datei erzeugen
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: "{{ credentials_file }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
content: |
|
||||||
|
username={{ smb_user }}
|
||||||
|
password={{ smb_pass }}
|
||||||
|
register: cred_file
|
||||||
|
|
||||||
|
- name: Prüfen ob die Credentials Datei existiert
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ credentials_file }}"
|
||||||
|
register: cred_stat
|
||||||
|
|
||||||
|
- name: "Debug: Status der Credentials Datei"
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "SMB Credentials existieren: {{ cred_stat.stat.exists }}"
|
||||||
|
when: cred_stat is defined and cred_stat.stat is defined
|
||||||
Executable
Executable
+20
@@ -0,0 +1,20 @@
|
|||||||
|
---
|
||||||
|
- name: Install Tree
|
||||||
|
hosts: debian_vms
|
||||||
|
become: false #root berechtigung
|
||||||
|
|
||||||
|
vars:
|
||||||
|
package_name: tree
|
||||||
|
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: install tree
|
||||||
|
package:
|
||||||
|
name: "{{ package_name }}"
|
||||||
|
state: present
|
||||||
|
update_cache: yes
|
||||||
|
register: install_output
|
||||||
|
|
||||||
|
- name: Print Package installation install_output
|
||||||
|
debug:
|
||||||
|
var: install_output
|
||||||
Executable
Executable
+100
@@ -0,0 +1,100 @@
|
|||||||
|
---
|
||||||
|
- name: HEIMLAN NFS Mount stabil und robust
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
gather_facts: true
|
||||||
|
|
||||||
|
vars:
|
||||||
|
mount_path: /mnt/HEIMLAN
|
||||||
|
nfs_export: "/volume1/HEIMLAN"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
# 1. NFS Client Installation
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: Debian/Ubuntu NFS Client installieren
|
||||||
|
apt:
|
||||||
|
name: nfs-common
|
||||||
|
state: present
|
||||||
|
update_cache: true
|
||||||
|
when: ansible_os_family == "Debian"
|
||||||
|
|
||||||
|
- name: RedHat NFS Client installieren
|
||||||
|
yum:
|
||||||
|
name: nfs-utils
|
||||||
|
state: present
|
||||||
|
when: ansible_os_family == "RedHat"
|
||||||
|
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
# 2. NFS Server Mapping (robust, kein Fail bei unbekannten Netzen)
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: NFS Server bestimmen
|
||||||
|
set_fact:
|
||||||
|
nfs_server: >-
|
||||||
|
{% if ansible_default_ipv4.address.startswith('9.99') %}
|
||||||
|
9.99.50.20
|
||||||
|
{% else %}
|
||||||
|
192.168.1.230
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
- name: Debug Mapping
|
||||||
|
debug:
|
||||||
|
msg: "Host {{ ansible_default_ipv4.address }} -> NFS Server {{ nfs_server }}"
|
||||||
|
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
# 3. Mountpoint sicherstellen
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: Mountpoint erstellen
|
||||||
|
file:
|
||||||
|
path: "{{ mount_path }}"
|
||||||
|
state: directory
|
||||||
|
mode: "0755"
|
||||||
|
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
# 4. Alte kaputte HEIMLAN Einträge entfernen
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: Alte HEIMLAN fstab Einträge entfernen
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/fstab
|
||||||
|
state: absent
|
||||||
|
regexp: 'HEIMLAN'
|
||||||
|
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
# 5. Korrekten fstab Eintrag schreiben (kein Whitespace Fehler)
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: fstab Eintrag setzen (sauber)
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/fstab
|
||||||
|
state: present
|
||||||
|
create: true
|
||||||
|
insertafter: EOF
|
||||||
|
line: "{{ nfs_server | trim }}:{{ nfs_export | trim }} {{ mount_path }} nfs rw,hard,intr,noatime,_netdev,vers=4 0 0"
|
||||||
|
regexp: '^{{ nfs_server | trim | regex_escape() }}:{{ nfs_export | trim | regex_escape() }}'
|
||||||
|
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
# 6. Mount ausführen
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: Mount aktivieren
|
||||||
|
mount:
|
||||||
|
path: "{{ mount_path }}"
|
||||||
|
state: mounted
|
||||||
|
register: mount_result
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
# 7. Ergebnis
|
||||||
|
# ------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: Status anzeigen
|
||||||
|
debug:
|
||||||
|
msg:
|
||||||
|
- "Server: {{ nfs_server }}"
|
||||||
|
- "Mount Path: {{ mount_path }}"
|
||||||
|
- "Mount changed: {{ mount_result.changed | default(false) }}"
|
||||||
Executable
+13
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
- name: Deploy new VM
|
||||||
|
hosts: back
|
||||||
|
become: true
|
||||||
|
|
||||||
|
|
||||||
|
- tasks:
|
||||||
|
|
||||||
|
- name: Deploy new VMs
|
||||||
|
- proxmox
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
BIN
Binary file not shown.
BIN
Binary file not shown.
@@ -0,0 +1,5 @@
|
|||||||
|
- name: samba
|
||||||
|
package:
|
||||||
|
name: samba
|
||||||
|
state: present
|
||||||
|
|
||||||
BIN
Binary file not shown.
@@ -0,0 +1,5 @@
|
|||||||
|
- name: Install Apache Webserver
|
||||||
|
package:
|
||||||
|
name: "apache2"
|
||||||
|
update_cache: yes
|
||||||
|
state: present
|
||||||
BIN
Binary file not shown.
+10
@@ -0,0 +1,10 @@
|
|||||||
|
# roles/SERVER_TYP_03/tasks/main.yml
|
||||||
|
|
||||||
|
- name: Install Notepad++
|
||||||
|
import_tasks: npp.yaml
|
||||||
|
|
||||||
|
- name: Install VLC
|
||||||
|
import_tasks: vlc.yaml
|
||||||
|
|
||||||
|
- name: Ping erlauben
|
||||||
|
import_tasks: ping.yml
|
||||||
+16
@@ -0,0 +1,16 @@
|
|||||||
|
- name: Download NPP
|
||||||
|
ansible.windows.win_get_url:
|
||||||
|
url: https://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.9/npp.8.9.Installer.exe
|
||||||
|
dest: C:\Windows\Temp\npp.exe
|
||||||
|
force: yes
|
||||||
|
|
||||||
|
- name: Install Notepad++ silent
|
||||||
|
ansible.windows.win_shell: |
|
||||||
|
Start-Process "C:\Windows\Temp\npp.exe" -ArgumentList "/S" -Wait
|
||||||
|
args:
|
||||||
|
creates: C:\Program Files\Notepad++\notepad++.exe
|
||||||
|
|
||||||
|
- name: Delete installer
|
||||||
|
ansible.windows.win_file:
|
||||||
|
path: C:\Windows\Temp\npp.exe
|
||||||
|
state: absent
|
||||||
+11
@@ -0,0 +1,11 @@
|
|||||||
|
- name: Allow Ping IN IPv4
|
||||||
|
win_firewall_rule:
|
||||||
|
name: "Allow Incoming ICMPv4 Echo Request (Ping)"
|
||||||
|
enabled: no
|
||||||
|
state: present
|
||||||
|
profiles: "domain,private,public"
|
||||||
|
action: allow
|
||||||
|
direction: in
|
||||||
|
protocol: icmpv4
|
||||||
|
icmp_type:code:
|
||||||
|
- '8:*'
|
||||||
+14
@@ -0,0 +1,14 @@
|
|||||||
|
- name: Download VLC
|
||||||
|
win_get_url:
|
||||||
|
url: "https://www.vlc.de/download/vlc/msi/vlc-3.0.4-win64.msi"
|
||||||
|
dest: "C:\\Windows\\Temp\\vlc.msi"
|
||||||
|
|
||||||
|
- name: Install VLC
|
||||||
|
win_package:
|
||||||
|
path: "C:\\Windows\\Temp\\vlc.msi"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Remove VLC
|
||||||
|
win_file:
|
||||||
|
path: "C:\\Windows\\Temp\\vlc.msi"
|
||||||
|
state: absent
|
||||||
+67
@@ -0,0 +1,67 @@
|
|||||||
|
|
||||||
|
- name: Skip wenn Zertifikat deaktiviert
|
||||||
|
meta: end_host
|
||||||
|
when: not (cert.enabled | default(false))
|
||||||
|
|
||||||
|
- name: Prüfe Profil
|
||||||
|
fail:
|
||||||
|
msg: "Kein Zertifikatsprofil definiert auf {{ inventory_hostname }}"
|
||||||
|
when: cert.profile is not defined
|
||||||
|
|
||||||
|
- name: Lade Profildefinition
|
||||||
|
set_fact:
|
||||||
|
cert_cfg: "{{ cert_profiles[cert.profile] }}"
|
||||||
|
|
||||||
|
- name: Zielpfad setzen
|
||||||
|
set_fact:
|
||||||
|
cert_path: "{{ cert_base_path }}/{{ inventory_hostname }}"
|
||||||
|
|
||||||
|
- name: Verzeichnisse erstellen
|
||||||
|
file:
|
||||||
|
path: "{{ cert_path }}/{{ item }}"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
loop:
|
||||||
|
- KEY
|
||||||
|
- CSR
|
||||||
|
- CERT
|
||||||
|
|
||||||
|
- name: Installiere cryptography Abhängigkeit
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- python3-cryptography
|
||||||
|
- python3-pip
|
||||||
|
state: present
|
||||||
|
update_cache: true
|
||||||
|
become: true
|
||||||
|
ignore_errors: true
|
||||||
|
|
||||||
|
- name: Private Key erzeugen
|
||||||
|
community.crypto.openssl_privatekey:
|
||||||
|
path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
|
||||||
|
size: "{{ cert_cfg.key_size }}"
|
||||||
|
type: RSA
|
||||||
|
|
||||||
|
- name: FQDN bestimmen
|
||||||
|
set_fact:
|
||||||
|
cert_fqdn: >-
|
||||||
|
{{
|
||||||
|
ansible_facts['fqdn']
|
||||||
|
| default(ansible_facts['hostname'])
|
||||||
|
| default(inventory_hostname ~ '.local')
|
||||||
|
}}
|
||||||
|
|
||||||
|
- name: SAN bauen (DNS + IP)
|
||||||
|
set_fact:
|
||||||
|
san_list: >-
|
||||||
|
{{
|
||||||
|
['DNS:' ~ cert_fqdn]
|
||||||
|
+ ([ 'IP:' ~ ansible_host ] if ansible_host is defined else [])
|
||||||
|
}}
|
||||||
|
|
||||||
|
- name: CSR erzeugen (dynamisch)
|
||||||
|
community.crypto.openssl_csr:
|
||||||
|
path: "{{ cert_path }}/CSR/{{ inventory_hostname }}.csr"
|
||||||
|
privatekey_path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
|
||||||
|
common_name: "{{ cert_fqdn }}"
|
||||||
|
subject_alt_name: "{{ san_list }}"
|
||||||
Executable
+4
@@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
- hosts: SERVER_TYP_03
|
||||||
|
roles:
|
||||||
|
- SERVER_TYP_03
|
||||||
Executable
+15
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
- hosts: SERVER_TYP_01
|
||||||
|
become: true
|
||||||
|
roles:
|
||||||
|
- SERVER_TYP_01
|
||||||
|
|
||||||
|
- hosts: SERVER_TYP_02
|
||||||
|
become: false
|
||||||
|
roles:
|
||||||
|
- SERVER_TYP_02
|
||||||
|
|
||||||
|
- hosts: SERVER_TYP_03
|
||||||
|
roles:
|
||||||
|
- SERVER_TYP_03
|
||||||
|
- import_playbook: certificate.yaml
|
||||||
Executable
+59
@@ -0,0 +1,59 @@
|
|||||||
|
---
|
||||||
|
- name: SMB Freigabe einrichten und mounten
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
gather_facts: true
|
||||||
|
|
||||||
|
vars:
|
||||||
|
mount_point: "/mnt/smbshare"
|
||||||
|
smb_server: "//192.168.1.10/DATA"
|
||||||
|
credentials_file: "/root/.smbcredentials"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
- name: Stelle sicher, dass cifs-utils installiert ist
|
||||||
|
ansible.builtin.package:
|
||||||
|
name: cifs-utils
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Mountpoint erstellen
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ mount_point }}"
|
||||||
|
state: directory
|
||||||
|
mode: "0755"
|
||||||
|
|
||||||
|
- name: SMB Credentials Datei erzeugen
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: "{{ credentials_file }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
content: |
|
||||||
|
username={{ smb_user }}
|
||||||
|
password={{ smb_pass }}
|
||||||
|
|
||||||
|
- name: Fstab-Eintrag sicherstellen
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /etc/fstab
|
||||||
|
line: "{{ smb_server }} {{ mount_point }} cifs credentials={{ credentials_file }},iocharset=utf8,vers=3.0 0 0"
|
||||||
|
state: present
|
||||||
|
insertafter: EOF
|
||||||
|
backup: yes
|
||||||
|
|
||||||
|
- name: SMB Freigabe mounten
|
||||||
|
ansible.builtin.mount:
|
||||||
|
path: "{{ mount_point }}"
|
||||||
|
src: "{{ smb_server }}"
|
||||||
|
fstype: cifs
|
||||||
|
opts: "credentials={{ credentials_file }},iocharset=utf8,vers=3.0"
|
||||||
|
state: mounted
|
||||||
|
|
||||||
|
- name: Prüfen ob SMB Freigabe gemounted wurde
|
||||||
|
ansible.builtin.command: mountpoint -q {{ mount_point }}
|
||||||
|
register: mount_check
|
||||||
|
changed_when: false
|
||||||
|
failed_when: mount_check.rc != 0
|
||||||
|
|
||||||
|
- name: Erfolgsmeldung
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "SMB Freigabe erfolgreich gemounted auf {{ mount_point }}"
|
||||||
Executable
+39
@@ -0,0 +1,39 @@
|
|||||||
|
---
|
||||||
|
- name: Upgrade VMs
|
||||||
|
hosts:
|
||||||
|
- debian_vms
|
||||||
|
- PDCs
|
||||||
|
- front
|
||||||
|
- back
|
||||||
|
- test
|
||||||
|
- pdm_hosts
|
||||||
|
- pbs_hosts
|
||||||
|
- dmz_hosts
|
||||||
|
- proxy_hosts
|
||||||
|
become: false
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Update apt package cache and upgrade all packages
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: "*"
|
||||||
|
update_cache: yes
|
||||||
|
state: latest
|
||||||
|
register: apt_result
|
||||||
|
|
||||||
|
- name: Zeige aktualisierte Pakete (robust)
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: >-
|
||||||
|
{{ apt_result.changed_packages
|
||||||
|
| default(apt_result.packages)
|
||||||
|
| default(apt_result.upgrade)
|
||||||
|
| default('Keine Paketänderungen oder kein apt_result-Feld gefunden') }}
|
||||||
|
|
||||||
|
- name: Print Package installation apt apt_result
|
||||||
|
debug:
|
||||||
|
var: apt_result
|
||||||
|
|
||||||
|
- name: Clean unwanted olderstuff
|
||||||
|
apt:
|
||||||
|
autoremove: yes
|
||||||
|
purge: yes
|
||||||
|
|
||||||
Executable
+6
@@ -0,0 +1,6 @@
|
|||||||
|
[defaults]
|
||||||
|
inventory = /mnt/scripte/Ansible/inventory
|
||||||
|
roles_path = /mnt/scripte/Ansible/Playbooks/roles
|
||||||
|
host_key_checking = False
|
||||||
|
stdout_callback = default
|
||||||
|
vault_password_file = /root/.vault_pass
|
||||||
+60
@@ -0,0 +1,60 @@
|
|||||||
|
cert_base_path: /mnt/HEIMLAN/001-Zertifikate
|
||||||
|
|
||||||
|
cert_profiles:
|
||||||
|
|
||||||
|
generic:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 365
|
||||||
|
|
||||||
|
docker_vm:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 365
|
||||||
|
san: true
|
||||||
|
|
||||||
|
domain_controller:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 825
|
||||||
|
eku:
|
||||||
|
- serverAuth
|
||||||
|
- clientAuth
|
||||||
|
|
||||||
|
pve_node:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 825
|
||||||
|
san: true
|
||||||
|
|
||||||
|
nextcloud:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 365
|
||||||
|
san: true
|
||||||
|
|
||||||
|
reverse_proxy:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 365
|
||||||
|
san: true
|
||||||
|
|
||||||
|
backup_server:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 825
|
||||||
|
|
||||||
|
datacenter_manager:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 825
|
||||||
|
|
||||||
|
windows:
|
||||||
|
key_size: 2048
|
||||||
|
algo: rsa
|
||||||
|
validity_days: 365
|
||||||
|
|
||||||
|
cert_hosts:
|
||||||
|
key_size: 4096
|
||||||
|
algo: rsa
|
||||||
|
alidity_days: 365
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
61373732373163666134623133323662303864343534653335613865396362316165626133356162
|
||||||
|
6466306461343136363565346264346437386463633765370a323461663533316531373431326631
|
||||||
|
65653062633933346232353165386233623432643434616566333162656461363739616264343839
|
||||||
|
3238646131333835300a363230626439346131653865633138386465626538613165363165356533
|
||||||
|
65653739326131376536613335336564333164383665353736393166373962363766373562393936
|
||||||
|
3537373534316337626235323363646366323432616135346233
|
||||||
Executable
+165
@@ -0,0 +1,165 @@
|
|||||||
|
all:
|
||||||
|
children:
|
||||||
|
|
||||||
|
debian_vms:
|
||||||
|
hosts:
|
||||||
|
ANSIBLE-NOTE-01:
|
||||||
|
ansible_host: 192.168.1.241
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: false
|
||||||
|
profile: generic
|
||||||
|
|
||||||
|
ANSIBLE-NOTE-02:
|
||||||
|
ansible_host: 192.168.1.242
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: false
|
||||||
|
profile: generic
|
||||||
|
|
||||||
|
Docker:
|
||||||
|
ansible_host: 192.168.1.244
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: docker_vm
|
||||||
|
|
||||||
|
PDCs:
|
||||||
|
hosts:
|
||||||
|
CERT-PDC:
|
||||||
|
ansible_host: 9.99.20.1
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: domain_controller
|
||||||
|
|
||||||
|
SERVICE-PDC:
|
||||||
|
ansible_host: 9.99.30.1
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: domain_controller
|
||||||
|
|
||||||
|
front:
|
||||||
|
hosts:
|
||||||
|
FHS0:
|
||||||
|
ansible_host: 192.168.1.200
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
FHS1:
|
||||||
|
ansible_host: 192.168.1.201
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
FHS2:
|
||||||
|
ansible_host: 192.168.1.202
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
back:
|
||||||
|
hosts:
|
||||||
|
HS1:
|
||||||
|
ansible_host: 192.168.1.211
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
HS2:
|
||||||
|
ansible_host: 192.168.1.212
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
HS3:
|
||||||
|
ansible_host: 192.168.1.213
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
HS4:
|
||||||
|
ansible_host: 192.168.1.214
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
test:
|
||||||
|
hosts:
|
||||||
|
TS01:
|
||||||
|
ansible_host: 192.168.1.231
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: pve_node
|
||||||
|
|
||||||
|
dmz_hosts:
|
||||||
|
hosts:
|
||||||
|
DMZ_NC:
|
||||||
|
ansible_host: 9.99.60.1
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: nextcloud
|
||||||
|
|
||||||
|
proxy_hosts:
|
||||||
|
hosts:
|
||||||
|
NPM:
|
||||||
|
ansible_host: 9.99.70.1
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: reverse_proxy
|
||||||
|
|
||||||
|
pbs_hosts:
|
||||||
|
hosts:
|
||||||
|
PBS_Master:
|
||||||
|
ansible_host: 192.168.1.221
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: backup_server
|
||||||
|
|
||||||
|
pdm_hosts:
|
||||||
|
hosts:
|
||||||
|
PDM:
|
||||||
|
ansible_host: 192.168.1.223
|
||||||
|
ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
|
cert:
|
||||||
|
enabled: true
|
||||||
|
profile: datacenter_manager
|
||||||
|
|
||||||
|
windows:
|
||||||
|
hosts:
|
||||||
|
SRV22-Test:
|
||||||
|
ansible_host: 192.168.1.243
|
||||||
|
cert:
|
||||||
|
enabled: false
|
||||||
|
profile: windows
|
||||||
|
|
||||||
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+541
@@ -0,0 +1,541 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Variablen
|
||||||
|
# Konfiguration für den Zugriff auf die Synology DiskStation
|
||||||
|
SYNOLOGY_HOST="9.99.50.10"
|
||||||
|
SYNOLOGY_USERNAME="Madzone"
|
||||||
|
SYNOLOGY_PASSWORD="P@ssw0rd"
|
||||||
|
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||||
|
host=$(nslookup 9.99.50.10)
|
||||||
|
# Zielpfad für das Full-Chain-Zertifikat
|
||||||
|
FULLCHAIN_CERT="fullchain.${HOST_FQDN}.crt"
|
||||||
|
HOST_FQDN=$(hostname -f)
|
||||||
|
HOST_NORMAL=$(hostname -s)
|
||||||
|
DOMAIN=$(hostname -d)
|
||||||
|
REMOTE_DIR="/volume1/HEIMLAN/HEIMLAN"
|
||||||
|
NFS_MOUNT="/mnt/CSR"
|
||||||
|
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||||
|
TMP="/tmp"
|
||||||
|
|
||||||
|
# Name der Zertifikatsdateien
|
||||||
|
ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||||
|
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||||
|
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||||
|
|
||||||
|
# Globale Variablen für das Betriebssystem
|
||||||
|
OS=""
|
||||||
|
distro=""
|
||||||
|
version=""
|
||||||
|
codename=""
|
||||||
|
|
||||||
|
# Globale Variablen für OPENSSL
|
||||||
|
CSR_DIR="/tmp"
|
||||||
|
KEY_DIR="/tmp"
|
||||||
|
SSL_DIR=""
|
||||||
|
PKI_DIR=""
|
||||||
|
|
||||||
|
# Extrahiere OU (Organizational Unit) und O (Organization) und wandele sie in Großbuchstaben um
|
||||||
|
OU=$(echo "${DOMAIN%%.*}" | tr '[:lower:]' '[:upper:]')
|
||||||
|
O=$(echo "${DOMAIN#*.}" | tr '[:lower:]' '[:upper:]')
|
||||||
|
|
||||||
|
# Read IP address dynamically from active network interface
|
||||||
|
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
||||||
|
echo "IP Address: $IP_ADDRESS"
|
||||||
|
|
||||||
|
# GLobale SSH Variablen
|
||||||
|
KEY_PATH="$HOME/.ssh/id_rsa_synology" # Pfad zum SSH-Schlüssel
|
||||||
|
NAS_HOME="/var/services/homes/$SYNOLOGY_USERNAME" # Angepasstes Home-Verzeichnis auf der NAS
|
||||||
|
dnf install sshpass nfs-utils -y
|
||||||
|
|
||||||
|
#*********************************************************************
|
||||||
|
#echo "SSH KEY wird im System implemntiert..."
|
||||||
|
#sudo ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_synology
|
||||||
|
#echo "SSH KEY wurde Erfolgreich im System implemntiert"
|
||||||
|
#echo "SSH Verbindung wird in die .ssh eingetragen...."
|
||||||
|
#sudo ssh-copy-id -i ~/.ssh/id_rsa_synology.pub ${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}${SYNOLOGY_PASSWORD}
|
||||||
|
#echo "SSH Verbindung wurde Erfolgreich in die .ssh eingetragen !!!"
|
||||||
|
|
||||||
|
|
||||||
|
colourmsg(){
|
||||||
|
echo -e "\033[0;36m$1\033[0m"
|
||||||
|
}
|
||||||
|
# Funktion zum Erstellen eines Ordners mit Unterordnern über SSH mit sshpass
|
||||||
|
create_remote_folders() {
|
||||||
|
|
||||||
|
# SSH-Befehl zum Erstellen des Ordners mit Unterordnern mit sshpass
|
||||||
|
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||||
|
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||||
|
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||||
|
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||||
|
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||||
|
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||||
|
echo "Ordner ${REMOTE_DIR}/$HOST_FQDN/ wurde auf ${host} erstellt."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen von SSH-Schlüsseln
|
||||||
|
generate_ssh_key() {
|
||||||
|
if [ ! -f "$KEY_PATH" ]; then
|
||||||
|
echo "Erstelle SSH-Schlüssel..."
|
||||||
|
ssh-keygen -t rsa -b 4096 -N "" -f "$KEY_PATH"
|
||||||
|
else
|
||||||
|
echo "SSH-Schlüssel existieren bereits."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren des öffentlichen Schlüssels zur NAS
|
||||||
|
copy_ssh_key_to_nas() {
|
||||||
|
echo "Kopiere den öffentlichen Schlüssel zur NAS..."
|
||||||
|
#cat ${KEY_PATH}.pub | ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||||
|
cat ${KEY_PATH}.pub | sshpass -p "$SYNOLOGY_PASSWORD" ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Öffentlicher Schlüssel erfolgreich zur NAS kopiert."
|
||||||
|
else
|
||||||
|
echo "Fehler beim Kopieren des öffentlichen Schlüssels zur NAS."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren der Datei von der NAS zum lokalen Rechner
|
||||||
|
copy_file_from_nas() {
|
||||||
|
echo "Kopiere die Datei von der NAS zum lokalen Rechner..."
|
||||||
|
scp -i "$KEY_PATH" $SYNOLOGY_USERNAME@SYNOLOGY_HOST:$NAS_HOME "$KEY_PATH"
|
||||||
|
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Datei erfolgreich kopiert."
|
||||||
|
else
|
||||||
|
echo "Fehler beim Kopieren der Datei."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
# Funktion zum Ermitteln des Betriebssystems
|
||||||
|
detect_os() {
|
||||||
|
echo "Das installierte Derivat wird ermittelt...."
|
||||||
|
OS=$(uname -s)
|
||||||
|
|
||||||
|
case $OS in
|
||||||
|
Linux*)
|
||||||
|
# Überprüfen, ob lsb_release verfügbar ist
|
||||||
|
if command -v lsb_release &> /dev/null; then
|
||||||
|
# Verwende lsb_release, wenn es verfügbar ist
|
||||||
|
distro=$(lsb_release -si)
|
||||||
|
version=$(lsb_release -sr)
|
||||||
|
codename=$(lsb_release -sc)
|
||||||
|
else
|
||||||
|
# Überprüfe /etc/os-release
|
||||||
|
if [ -f /etc/os-release ]; then
|
||||||
|
. /etc/os-release
|
||||||
|
distro=$NAME
|
||||||
|
version=$VERSION_ID
|
||||||
|
codename=$VERSION_CODENAME
|
||||||
|
# Überprüfe /etc/lsb-release
|
||||||
|
elif [ -f /etc/lsb-release ]; then
|
||||||
|
. /etc/lsb-release
|
||||||
|
distro=$DISTRIB_ID
|
||||||
|
version=$DISTRIB_RELEASE
|
||||||
|
codename=$DISTRIB_CODENAME
|
||||||
|
# Überprüfe /etc/debian_version
|
||||||
|
elif [ -f /etc/debian_version ]; then
|
||||||
|
distro="Debian"
|
||||||
|
version=$(cat /etc/debian_version)
|
||||||
|
codename=$(uname -r)
|
||||||
|
# Überprüfe /etc/redhat-release
|
||||||
|
elif [ -f /etc/redhat-release ]; then
|
||||||
|
distro=$(cat /etc/redhat-release)
|
||||||
|
version=$(uname -r)
|
||||||
|
codename=$(uname -r)
|
||||||
|
else
|
||||||
|
distro="Unbekannte Distribution"
|
||||||
|
version="Unbekannte Version"
|
||||||
|
codename="Unbekannter Codename"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
# Ausgabe der ermittelten Informationen
|
||||||
|
echo "\n\n"
|
||||||
|
echo "Distribution: $distro"
|
||||||
|
echo "Version: $version"
|
||||||
|
echo "Codename: $codename"
|
||||||
|
echo "\n\n"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unsupported OS: $OS"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
echo "${distro} wurde ....... Ausgewählt......."
|
||||||
|
}
|
||||||
|
install_requierments(){
|
||||||
|
echo "Erstellen des Zertifikatsrequests..."
|
||||||
|
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||||
|
apt install sudo sshpass nfs-common -y
|
||||||
|
;;
|
||||||
|
CentOS)
|
||||||
|
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||||
|
dnf install sudo sshpass nfs-utils -y
|
||||||
|
;;
|
||||||
|
"Red Hat Enterprise Linux")
|
||||||
|
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||||
|
dnf install sudo sshpass nfs-utils -y
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
# Funktion zum Erstellen des Zertifikatsrequests
|
||||||
|
create_certificate_request() {
|
||||||
|
echo "Erstellen des Zertifikatsrequests..."
|
||||||
|
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
apt install sudo sshpass nfs-common -y
|
||||||
|
# Debian / Ubuntu spezifische Pfade
|
||||||
|
#KEY_DIR="/etc/ssl/private/"
|
||||||
|
# Erstellen des privaten Schlüssels
|
||||||
|
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||||
|
echo "Privater Schlüssel wurde erstellt: private.key"
|
||||||
|
# CSR erstellen
|
||||||
|
#CSR_DIR="/tmp"
|
||||||
|
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=${O}/OU=${OU}/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||||
|
echo "Zertifikatsrequest wurde erstellt: request.csr"
|
||||||
|
# CSR anzeigen
|
||||||
|
echo "Inhalt des erstellten Zertifikatsrequests: DEBIAN|UBUNTU......."
|
||||||
|
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||||
|
;;
|
||||||
|
CentOS)
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
#KEY_DIR="/etc/pki/tls/private/"
|
||||||
|
# Erstellen des privaten Schlüssels
|
||||||
|
openssl genrsa -out "${KEY_DIR}KEY_${HOST_FQDN}.pem" 4096
|
||||||
|
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||||
|
# CSR erstellen
|
||||||
|
#CSR_DIR="/tmp"
|
||||||
|
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||||
|
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||||
|
# CSR anzeigen
|
||||||
|
echo "Inhalt des erstellten Zertifikatsrequests: CENTOS....."
|
||||||
|
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||||
|
;;
|
||||||
|
"Red Hat Enterprise Linux")
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
#KEY_DIR="/etc/pki/tls/private/"
|
||||||
|
# Erstellen des privaten Schlüssels
|
||||||
|
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||||
|
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||||
|
# CSR erstellen
|
||||||
|
#CSR_DIR="/tmp"
|
||||||
|
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||||
|
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||||
|
# CSR anzeigen
|
||||||
|
echo "Inhalt des erstellten Zertifikatsrequests: RHEL ....."
|
||||||
|
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen des SSH-Schlüsselpaars und Hinzufügen zur Synology
|
||||||
|
setup_ssh_keys() {
|
||||||
|
echo "=== Einrichten von SSH-Schlüsseln ==="
|
||||||
|
|
||||||
|
# Überprüfen, ob der private Schlüssel bereits vorhanden ist
|
||||||
|
if [ ! -f "${SSH_PRIVATE_KEY}" ]; then
|
||||||
|
echo "Erstelle SSH-Schlüsselpaar..."
|
||||||
|
ssh-keygen -t rsa -b 4096 -f "${SSH_PRIVATE_KEY}" -N "" -C "Synology SSH key"
|
||||||
|
echo "SSH-Schlüsselpaar wurde erstellt: ${SSH_PRIVATE_KEY}"
|
||||||
|
else
|
||||||
|
echo "SSH-Schlüsselpaar ist bereits vorhanden: ${SSH_PRIVATE_KEY}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# SSH-Schlüssel zur Synology hinzufügen
|
||||||
|
echo "Füge den öffentlichen Schlüssel zur Synology hinzu..."
|
||||||
|
ssh-copy-id -i "${SSH_PRIVATE_KEY}.pub" "${SYNOLOGY_USER}@${SYNOLOGY_HOST}"
|
||||||
|
echo "Öffentlicher Schlüssel wurde zur Synology hinzugefügt."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Hochladen des Requests zur Synology
|
||||||
|
upload_certificate_request() {
|
||||||
|
echo "Hochladen des Zertifikatsrequests zur Synology..."
|
||||||
|
# Mounten der NFS-Freigabe mit Benutzername und Passwort
|
||||||
|
sudo mkdir -p ${NFS_MOUNT}
|
||||||
|
echo "sudo mkdir $NFS_MOUNT"
|
||||||
|
#sudo mkdir -p ${NFS_MOUNT}
|
||||||
|
#sleep 10
|
||||||
|
#ls /mnt/CSR/
|
||||||
|
#sudo mount -t nfs -o username="${SYNOLOGY_USER}",password="${SYNOLOGY_PASSWORD}" "${SYNOLOGY_HOST}:${REMOTE_DIR}/$HOST_NORMAL/CSR" "${NFS_MOUNT}"
|
||||||
|
sudo mount -t nfs -o nfsvers=3 "${SYNOLOGY_HOST}:${REMOTE_DIR}" "${NFS_MOUNT}"
|
||||||
|
ls -lha /mnt/CSR/
|
||||||
|
#echo "TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||||
|
#sleep 30
|
||||||
|
# Überprüfen, ob das Mount erfolgreich war
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "NFS-Freigabe erfolgreich eingebunden: ${NFS_MOUNT}"
|
||||||
|
# Kopieren der Datei auf die NFS-Freigabe
|
||||||
|
ls -lha /mnt/CSR/
|
||||||
|
sleep 5
|
||||||
|
sudo cp "${CSR_DIR}/CSR_${HOST_FQDN}.csr" "${NFS_MOUNT}/${HOST_FQDN}/CSR/"
|
||||||
|
sudo cp "${KEY_DIR}/KEY_${HOST_FQDN}.pem" "${NFS_MOUNT}/${HOST_FQDN}/KEY/"
|
||||||
|
sleep 5
|
||||||
|
ls -lha /mnt/CSR/
|
||||||
|
echo "Datei erfolgreich auf die NFS-Freigabe hochgeladen."
|
||||||
|
#echo "2. TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||||
|
#sleep 30
|
||||||
|
else
|
||||||
|
echo "Fehler beim Einbinden der NFS-Freigabe: ${NFS_MOUNT}"
|
||||||
|
fi
|
||||||
|
echo "Zertifikatsrequest wurde zur Synology hochgeladen."
|
||||||
|
}
|
||||||
|
umountNFS(){
|
||||||
|
# NFS-Freigabe wieder aushängen
|
||||||
|
sudo umount "${NFS_MOUNT}"
|
||||||
|
cd /mnt
|
||||||
|
rmdir CSR/
|
||||||
|
echo "NFS-Freigabe erfolgreich ausgehängt."
|
||||||
|
}
|
||||||
|
# Funktion zum Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat
|
||||||
|
download_certificates() {
|
||||||
|
echo "Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat..."
|
||||||
|
echo "=== Überprüfen und Herunterladen der Datei von der Synology ==="
|
||||||
|
|
||||||
|
# SSH-Befehl, um die Existenz der Datei auf der Synology zu überprüfen
|
||||||
|
ssh -i "$KEY_PATH" "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" test -f "${REMOTE_DIR}/${HOST_FQDN}/CERT/$SERVER_CERT"
|
||||||
|
|
||||||
|
# Prüfen des Rückgabewerts von test (-f) und Entscheidung treffen
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Datei CERT_${HOST_FQDN}.crt auf der Synology gefunden. Beginne mit dem Download..."
|
||||||
|
cp "${NFS_MOUNT}/${HOST_FQDN}/CERT/$SERVER_CERT" "${TMP}/$SERVER_CERT"
|
||||||
|
cp "${NFS_MOUNT}/RootCA/$ROOT_CERT" "${TMP}/$ROOT_CERT"
|
||||||
|
cp "${NFS_MOUNT}/SubCA/$SUBCA_CERT" "${TMP}/$SUBCA_CERT"
|
||||||
|
echo "Datei erfolgreich heruntergeladen nach ${TMP}"
|
||||||
|
else
|
||||||
|
#echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||||
|
#sleep 300
|
||||||
|
echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||||
|
|
||||||
|
# Timer mit Countdown anzeigen
|
||||||
|
for ((i=300; i>0; i--)); do
|
||||||
|
echo -ne "Noch $i Sekunden warten...\r"
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
download_certificates # Rekursiver Aufruf, um erneut zu prüfen
|
||||||
|
fi
|
||||||
|
echo "Zertifikate wurden heruntergeladen."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen des Full-Chain-Zertifikats und Umbenennen
|
||||||
|
create_fullchain_certificate() {
|
||||||
|
echo "Erstellen des Full-Chain-Zertifikats..."
|
||||||
|
# Zielpfad für das Full-Chain-Zertifikat
|
||||||
|
FULLCHAIN_CERT="/tmp/fullchain.crt"
|
||||||
|
|
||||||
|
# Full-Chain-Zertifikat erstellen
|
||||||
|
cat "$TMP/$SERVER_CERT" "$TMP/$SUBCA_CERT" "$TMP/$ROOT_CERT" > "$FULLCHAIN_CERT"
|
||||||
|
|
||||||
|
echo "Full-Chain-Zertifikat wurde erstellt: $FULLCHAIN_CERT"
|
||||||
|
|
||||||
|
# Server-Zertifikat nach Hostnamen benennen
|
||||||
|
HOSTNAME=$(hostname)
|
||||||
|
mv "$FULLCHAIN_CERT" "$TMP/fullchain_$HOST_FQDN.crt"
|
||||||
|
|
||||||
|
echo "Full-Chain-Zertifikat umbenannt zu fullchain_$HOST_FQDN.crt"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach Derivat und Typ
|
||||||
|
copy_certificates() {
|
||||||
|
echo "Kopieren der Zertifikate in die richtigen Pfade..."
|
||||||
|
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
# Debian / Ubuntu spezifische Pfade
|
||||||
|
SSL_DIR="/usr/local/share/ca-certificates/"
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR kopiert."
|
||||||
|
update-ca-certificates
|
||||||
|
;;
|
||||||
|
CentOS|"Red Hat Enterprise Linux")
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
SSL_DIR="/etc/pki/tls/certs/"
|
||||||
|
PKI_DIR="/etc/pki/ca-trust/source/anchors/"
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||||
|
cp "$TMP/$ROOT_CERT" "$PKI_DIR/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$PKI_DIR/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||||
|
cp "$TMP/$SERVER_CERT" "$PKI_DIR/$SERVER_CERT"
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR und nach $PKI_DIR kopiert."
|
||||||
|
update-ca-trust
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Das Betriebssystem $OS wird nicht unterstützt für Zertifikate-Kopieren."
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach WebServer Ty
|
||||||
|
copy_web_certificates() {
|
||||||
|
echo "Kopieren der Zertifikate in die richtigen Pfade und Aktualisieren der Konfigurationsdateien..."
|
||||||
|
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
# Debian / Ubuntu spezifische Pfade
|
||||||
|
SSL_DIR_APACHE="/etc/ssl/certs/"
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
|
||||||
|
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||||
|
SSL_DIR_APACHE="/etc/apache2/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||||
|
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||||
|
|
||||||
|
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||||
|
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
CentOS|"Red Hat Enterprise Linux")
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
SSL_DIR_APACHE="/etc/pki/tls/certs/"
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
|
||||||
|
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||||
|
SSL_DIR_APACHE="/etc/httpd/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||||
|
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||||
|
|
||||||
|
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||||
|
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Es ist kein WEbServer auf diesen System Installiert"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Aktualisieren der Apache-Konfiguration
|
||||||
|
update_apache_config() {
|
||||||
|
local cert_file="$1"
|
||||||
|
local key_file="$2"
|
||||||
|
|
||||||
|
echo "Aktualisiere Apache-Konfiguration für SSL-Zertifikate..."
|
||||||
|
|
||||||
|
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||||
|
local apache_config_file=$(find /etc/apache2 -name "ssl.conf" -o -name "httpd.conf" 2>/dev/null | head -1)
|
||||||
|
if [ -n "$apache_config_file" ]; then
|
||||||
|
# SSLCertificateFile aktualisieren
|
||||||
|
sed -i "s|^\( *SSLCertificateFile *\).*|\1$cert_file|" "$apache_config_file"
|
||||||
|
# SSLCertificateKeyFile aktualisieren
|
||||||
|
sed -i "s|^\( *SSLCertificateKeyFile *\).*|\1$key_file|" "$apache_config_file"
|
||||||
|
echo "Apache-Konfiguration aktualisiert."
|
||||||
|
else
|
||||||
|
echo "Apache-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Aktualisieren der Nginx-Konfiguration
|
||||||
|
update_nginx_config() {
|
||||||
|
local cert_file="$1"
|
||||||
|
local key_file="$2"
|
||||||
|
|
||||||
|
echo "Aktualisiere Nginx-Konfiguration für SSL-Zertifikate..."
|
||||||
|
|
||||||
|
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||||
|
local nginx_config_file="/etc/nginx/nginx.conf"
|
||||||
|
if [ -f "$nginx_config_file" ]; then
|
||||||
|
# SSL Zertifikat und Key aktualisieren
|
||||||
|
sed -i "s|^\( *ssl_certificate *\).*|\1$cert_file;|" "$nginx_config_file"
|
||||||
|
sed -i "s|^\( *ssl_certificate_key *\).*|\1$key_file;|" "$nginx_config_file"
|
||||||
|
echo "Nginx-Konfiguration aktualisiert."
|
||||||
|
else
|
||||||
|
echo "Nginx-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Ermitteln des installierten Webserver-Dienstes
|
||||||
|
detect_webserver() {
|
||||||
|
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||||
|
echo "Apache Webserver ist installiert."
|
||||||
|
fi
|
||||||
|
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||||
|
echo "Apache Webserver ist installiert."
|
||||||
|
fi
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
echo "Nginx Webserver ist installiert."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
echo
|
||||||
|
# Hauptprogramm
|
||||||
|
detect_os
|
||||||
|
install_requierments
|
||||||
|
generate_ssh_key
|
||||||
|
copy_ssh_key_to_nas
|
||||||
|
create_certificate_request
|
||||||
|
create_remote_folders
|
||||||
|
#Wird nicht genutz
|
||||||
|
#setup_ssh_keys
|
||||||
|
upload_certificate_request
|
||||||
|
download_certificates
|
||||||
|
create_fullchain_certificate
|
||||||
|
copy_certificates
|
||||||
|
|
||||||
|
# Funktionen fue WebServer Zertifiakte
|
||||||
|
detect_webserver
|
||||||
|
copy_web_certificates
|
||||||
|
#umountNFS
|
||||||
|
echo "Prozess abgeschlossen."
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,32 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Installing PostgreSQL..."
|
||||||
|
sudo apt install -y postgresql postgresql-contrib
|
||||||
|
|
||||||
|
echo "Enable local connections"
|
||||||
|
sudo sed -i 's/local\s\+all\s\+postgres\s\+peer/local all postgres trust/' /etc/postgresql/16/main/pg_hba.conf
|
||||||
|
sudo sed -i 's/local\s\+all\s\+all\s\+peer/local all all md5/' /etc/postgresql/16/main/pg_hba.conf
|
||||||
|
|
||||||
|
echo "Stopping PostgreSQL service..."
|
||||||
|
sudo systemctl stop postgresql
|
||||||
|
|
||||||
|
echo "Starting PostgreSQL service..."
|
||||||
|
sudo systemctl start postgresql
|
||||||
|
|
||||||
|
echo "Configuring Alfresco database..."
|
||||||
|
psql -U postgres -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||||
|
psql -U postgres -c "CREATE DATABASE alfresco OWNER alfresco ENCODING 'UTF8';"
|
||||||
|
psql -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||||
|
|
||||||
|
echo "Stopping PostgreSQL service..."
|
||||||
|
sudo systemctl stop postgresql
|
||||||
|
|
||||||
|
echo "Enabling PostgreSQL to start on boot..."
|
||||||
|
sudo systemctl enable postgresql
|
||||||
|
|
||||||
|
echo "PostgreSQL installation and setup completed successfully!"
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Installing Java JDK 17..."
|
||||||
|
sudo apt install -y openjdk-17-jdk
|
||||||
|
|
||||||
|
echo "Setting Java 17 as the default Java version..."
|
||||||
|
sudo update-alternatives --install /usr/bin/java java /usr/lib/jvm/java-17-openjdk-amd64/bin/java 1
|
||||||
|
sudo update-alternatives --install /usr/bin/javac javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac 1
|
||||||
|
sudo update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java
|
||||||
|
sudo update-alternatives --set javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac
|
||||||
|
|
||||||
|
echo "Checking Java version..."
|
||||||
|
java -version
|
||||||
|
|
||||||
|
echo "Java JDK 17 installation and setup completed successfully!"
|
||||||
@@ -0,0 +1,64 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
TOMCAT_VERSION=10.1.26
|
||||||
|
TOMCAT_USER=ubuntu
|
||||||
|
TOMCAT_GROUP=ubuntu
|
||||||
|
TOMCAT_HOME=/home/ubuntu/tomcat
|
||||||
|
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Downloading Apache Tomcat..."
|
||||||
|
wget https://dlcdn.apache.org/tomcat/tomcat-10/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz -O /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz
|
||||||
|
|
||||||
|
echo "Extracting Tomcat..."
|
||||||
|
sudo mkdir -p $TOMCAT_HOME
|
||||||
|
sudo tar xzvf /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz -C $TOMCAT_HOME --strip-components=1
|
||||||
|
|
||||||
|
echo "Setting permissions for Tomcat directories..."
|
||||||
|
sudo chown -R $TOMCAT_USER:$TOMCAT_GROUP $TOMCAT_HOME
|
||||||
|
sudo chmod -R u+x $TOMCAT_HOME/bin
|
||||||
|
|
||||||
|
echo "Creating Tomcat systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/tomcat.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache Tomcat Web Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=$TOMCAT_USER
|
||||||
|
Group=$TOMCAT_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
Environment="CATALINA_PID=$TOMCAT_HOME/temp/tomcat.pid"
|
||||||
|
Environment="CATALINA_HOME=$TOMCAT_HOME"
|
||||||
|
Environment="CATALINA_BASE=$TOMCAT_HOME"
|
||||||
|
Environment="CATALINA_OPTS=-Xms2048M -Xmx3072M -server -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
|
||||||
|
Environment="JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom"
|
||||||
|
Environment="JAVA_TOOL_OPTIONS=-Dencryption.keystore.type=JCEKS -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding -Dencryption.keyAlgorithm=DESede -Dencryption.keystore.location=/home/ubuntu/keystore/metadata-keystore/keystore -Dmetadata-keystore.password=mp6yc0UD9e -Dmetadata-keystore.aliases=metadata -Dmetadata-keystore.metadata.password=oKIWzVdEdA -Dmetadata-keystore.metadata.algorithm=DESede"
|
||||||
|
|
||||||
|
ExecStart=$TOMCAT_HOME/bin/startup.sh
|
||||||
|
ExecStop=$TOMCAT_HOME/bin/shutdown.sh
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Tomcat service..."
|
||||||
|
sudo systemctl start tomcat
|
||||||
|
|
||||||
|
echo "Stopping Tomcat service..."
|
||||||
|
sudo systemctl stop tomcat
|
||||||
|
|
||||||
|
echo "Enabling Tomcat service to start on boot..."
|
||||||
|
sudo systemctl enable tomcat
|
||||||
|
|
||||||
|
echo "Apache Tomcat installation and setup completed successfully!"
|
||||||
@@ -0,0 +1,62 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
ACTIVEMQ_VERSION=5.18.5
|
||||||
|
ACTIVEMQ_USER=ubuntu
|
||||||
|
ACTIVEMQ_GROUP=ubuntu
|
||||||
|
ACTIVEMQ_HOME=/home/ubuntu/activemq
|
||||||
|
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Downloading ActiveMQ..."
|
||||||
|
wget https://dlcdn.apache.org/activemq/$ACTIVEMQ_VERSION/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -O /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz
|
||||||
|
|
||||||
|
echo "Extracting ActiveMQ..."
|
||||||
|
sudo mkdir -p $ACTIVEMQ_HOME
|
||||||
|
sudo tar xzvf /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -C $ACTIVEMQ_HOME --strip-components=1
|
||||||
|
|
||||||
|
echo "Setting permissions for ActiveMQ directories..."
|
||||||
|
sudo chown -R $ACTIVEMQ_USER:$ACTIVEMQ_GROUP $ACTIVEMQ_HOME
|
||||||
|
sudo chmod -R 755 $ACTIVEMQ_HOME
|
||||||
|
|
||||||
|
echo "Creating ActiveMQ systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache ActiveMQ
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=$ACTIVEMQ_USER
|
||||||
|
Group=$ACTIVEMQ_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
Environment="ACTIVEMQ_HOME=$ACTIVEMQ_HOME"
|
||||||
|
Environment="ACTIVEMQ_BASE=$ACTIVEMQ_HOME"
|
||||||
|
Environment="ACTIVEMQ_CONF=$ACTIVEMQ_HOME/conf"
|
||||||
|
Environment="ACTIVEMQ_DATA=$ACTIVEMQ_HOME/data"
|
||||||
|
|
||||||
|
ExecStart=$ACTIVEMQ_HOME/bin/activemq start
|
||||||
|
ExecStop=$ACTIVEMQ_HOME/bin/activemq stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting ActiveMQ service..."
|
||||||
|
sudo systemctl start activemq
|
||||||
|
|
||||||
|
echo "Stopping ActiveMQ service..."
|
||||||
|
sudo systemctl stop activemq
|
||||||
|
|
||||||
|
echo "Enabling ActiveMQ service to start on boot..."
|
||||||
|
sudo systemctl enable activemq
|
||||||
|
|
||||||
|
echo "Apache ActiveMQ installation and setup completed successfully!"
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# URLs of the resources to be downloaded
|
||||||
|
URLS=(
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-content-services-community-distribution/23.2.1/alfresco-content-services-community-distribution-23.2.1.zip"
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-search-services/2.0.9.1/alfresco-search-services-2.0.9.1.zip"
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-transform-core-aio/5.1.0/alfresco-transform-core-aio-5.1.0.jar"
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
# Directory to save the downloaded files
|
||||||
|
DOWNLOAD_DIR="./downloads"
|
||||||
|
|
||||||
|
# Create the download directory if it does not exist
|
||||||
|
mkdir -p "$DOWNLOAD_DIR"
|
||||||
|
|
||||||
|
# Function to download a file
|
||||||
|
download_file() {
|
||||||
|
local url=$1
|
||||||
|
local dest_dir=$2
|
||||||
|
local filename=$(basename "$url")
|
||||||
|
|
||||||
|
echo "Downloading $filename..."
|
||||||
|
curl -L -o "$dest_dir/$filename" -w "\nHTTP Status: %{http_code}\n" "$url"
|
||||||
|
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Downloaded $filename successfully."
|
||||||
|
else
|
||||||
|
echo "Failed to download $filename."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if the file size is greater than 0 bytes
|
||||||
|
if [ ! -s "$dest_dir/$filename" ]; then
|
||||||
|
echo "Warning: Downloaded file $filename is empty."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Loop through each URL and download the file
|
||||||
|
for url in "${URLS[@]}"; do
|
||||||
|
download_file "$url" "$DOWNLOAD_DIR"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "All downloads are complete."
|
||||||
|
|
||||||
@@ -0,0 +1,90 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
echo "Install unzip command"
|
||||||
|
sudo apt -y install unzip
|
||||||
|
|
||||||
|
echo "Create support folders and configuration in Tomcat"
|
||||||
|
mkdir -p /home/ubuntu/tomcat/shared/classes && mkdir -p /home/ubuntu/tomcat/shared/lib
|
||||||
|
sed -i 's|^shared.loader=$|shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar|' /home/ubuntu/tomcat/conf/catalina.properties
|
||||||
|
|
||||||
|
echo "Unzip Alfresco ZIP Distribution File"
|
||||||
|
mkdir /tmp/alfresco
|
||||||
|
unzip downloads/alfresco-content-services-community-distribution-23.2.1.zip -d /tmp/alfresco
|
||||||
|
|
||||||
|
echo "Copy JDBC driver"
|
||||||
|
cp /tmp/alfresco/web-server/lib/postgresql-42.6.0.jar /home/ubuntu/tomcat/shared/lib/
|
||||||
|
|
||||||
|
echo "Configure JAR Addons deployment"
|
||||||
|
mkdir -p /home/ubuntu/modules/platform && mkdir -p /home/ubuntu/modules/share && mkdir -p /home/ubuntu/tomcat/conf/Catalina/localhost
|
||||||
|
cp /tmp/alfresco/web-server/conf/Catalina/localhost/* /home/ubuntu/tomcat/conf/Catalina/localhost/
|
||||||
|
|
||||||
|
echo "Install Web Applications"
|
||||||
|
cp /tmp/alfresco/web-server/webapps/* /home/ubuntu/tomcat/webapps/
|
||||||
|
|
||||||
|
echo "Apply configuration"
|
||||||
|
cp -r /tmp/alfresco/web-server/shared/classes/* /home/ubuntu/tomcat/shared/classes/
|
||||||
|
mkdir /home/ubuntu/keystore && cp -r /tmp/alfresco/keystore/* /home/ubuntu/keystore/
|
||||||
|
mkdir /home/ubuntu/alf_data
|
||||||
|
cat <<EOL | tee /home/ubuntu/tomcat/shared/classes/alfresco-global.properties
|
||||||
|
#
|
||||||
|
# Custom content and index data location
|
||||||
|
#
|
||||||
|
dir.root=/home/ubuntu/alf_data
|
||||||
|
dir.keystore=/home/ubuntu/keystore/
|
||||||
|
|
||||||
|
#
|
||||||
|
# Database connection properties
|
||||||
|
#
|
||||||
|
db.username=alfresco
|
||||||
|
db.password=alfresco
|
||||||
|
db.driver=org.postgresql.Driver
|
||||||
|
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||||
|
|
||||||
|
#
|
||||||
|
# Solr Configuration
|
||||||
|
#
|
||||||
|
solr.secureComms=secret
|
||||||
|
solr.sharedSecret=secret
|
||||||
|
solr.host=localhost
|
||||||
|
solr.port=8983
|
||||||
|
index.subsystem.name=solr6
|
||||||
|
|
||||||
|
#
|
||||||
|
# Transform Configuration
|
||||||
|
#
|
||||||
|
localTransform.core-aio.url=http://localhost:8090/
|
||||||
|
|
||||||
|
#
|
||||||
|
# Events Configuration
|
||||||
|
#
|
||||||
|
messaging.broker.url=failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# URL Generation Parameters
|
||||||
|
#-------------
|
||||||
|
alfresco.context=alfresco
|
||||||
|
alfresco.host=localhost
|
||||||
|
alfresco.port=8080
|
||||||
|
alfresco.protocol=http
|
||||||
|
share.context=share
|
||||||
|
share.host=localhost
|
||||||
|
share.port=8080
|
||||||
|
share.protocol=http
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Apply AMPs"
|
||||||
|
mkdir /home/ubuntu/amps && cp -r /tmp/alfresco/amps/* /home/ubuntu/amps/
|
||||||
|
mkdir /home/ubuntu/bin && cp -r /tmp/alfresco/bin/* /home/ubuntu/bin/
|
||||||
|
java -jar /home/ubuntu/bin/alfresco-mmt.jar install /home/ubuntu/amps /home/ubuntu/tomcat/webapps/alfresco.war -directory
|
||||||
|
java -jar /home/ubuntu/bin/alfresco-mmt.jar list /home/ubuntu/tomcat/webapps/alfresco.war
|
||||||
|
|
||||||
|
echo "Modify alfresco and share logs directory"
|
||||||
|
mkdir /home/ubuntu/tomcat/webapps/alfresco && unzip /home/ubuntu/tomcat/webapps/alfresco.war -d /home/ubuntu/tomcat/webapps/alfresco
|
||||||
|
mkdir /home/ubuntu/tomcat/webapps/share && unzip /home/ubuntu/tomcat/webapps/share.war -d /home/ubuntu/tomcat/webapps/share
|
||||||
|
sed -i 's|^appender\.rolling\.fileName=alfresco\.log|appender.rolling.fileName=/home/ubuntu/tomcat/logs/alfresco.log|' /home/ubuntu/tomcat/webapps/alfresco/WEB-INF/classes/log4j2.properties
|
||||||
|
sed -i 's|^appender\.rolling\.fileName=share\.log|appender.rolling.fileName=/home/ubuntu/tomcat/logs/share.log|' /home/ubuntu/tomcat/webapps/share/WEB-INF/classes/log4j2.properties
|
||||||
|
|
||||||
|
|
||||||
|
echo "Alfresco has been configured"
|
||||||
@@ -0,0 +1,48 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
echo "Unzip SOLR ZIP Distribution File"
|
||||||
|
mkdir /tmp/solr
|
||||||
|
unzip downloads/alfresco-search-services-2.0.9.1.zip -d /tmp/solr
|
||||||
|
mv /tmp/solr/alfresco-search-services /home/ubuntu
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
SOLR_USER=ubuntu
|
||||||
|
SOLR_GROUP=ubuntu
|
||||||
|
SOLR_HOME=/home/ubuntu/alfresco-search-services
|
||||||
|
|
||||||
|
echo "Creating SOLR systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache SOLR Web Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=$SOLR_USER
|
||||||
|
Group=$SOLR_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
|
||||||
|
ExecStart=/home/ubuntu/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||||
|
ExecStop=/home/ubuntu/alfresco-search-services/solr/bin/solr stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Solr service..."
|
||||||
|
sudo systemctl start solr
|
||||||
|
|
||||||
|
echo "Stopping Solr service..."
|
||||||
|
sudo systemctl stop solr
|
||||||
|
|
||||||
|
echo "Enabling Solr service to start on boot..."
|
||||||
|
sudo systemctl enable solr
|
||||||
|
|
||||||
|
echo "SOLR has been configured"
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
echo "Install Transform dependencies"
|
||||||
|
sudo apt-get update &&
|
||||||
|
sudo apt install -y imagemagick &&
|
||||||
|
sudo apt install -y libreoffice &&
|
||||||
|
sudo apt install -y exiftool
|
||||||
|
|
||||||
|
curl -L -o /tmp/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz &&
|
||||||
|
sudo tar xf /tmp/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||||
|
|
||||||
|
echo "Configure Transform server"
|
||||||
|
mkdir /home/ubuntu/transform
|
||||||
|
cp downloads/alfresco-transform-core-aio-5.1.0.jar /home/ubuntu/transform
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
TRANSFORM_USER=ubuntu
|
||||||
|
TRANSFORM_GROUP=ubuntu
|
||||||
|
TRANSFORM_HOME=/home/ubuntu/transform
|
||||||
|
|
||||||
|
echo "Creating Transform systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||||
|
[Unit]
|
||||||
|
Description=Transform Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
|
||||||
|
User=$TRANSFORM_USER
|
||||||
|
Group=$TRANSFORM_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||||
|
|
||||||
|
ExecStart=java -jar /home/ubuntu/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||||
|
ExecStop=/bin/kill -15 $MAINPID
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Transform service..."
|
||||||
|
sudo systemctl start transform
|
||||||
|
|
||||||
|
echo "Stopping Transform service..."
|
||||||
|
sudo systemctl stop transform
|
||||||
|
|
||||||
|
echo "Enabling Transform service to start on boot..."
|
||||||
|
sudo systemctl enable transform
|
||||||
|
|
||||||
|
echo "Transform has been configured"
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Install Node.js and npm (LTS version)
|
||||||
|
echo "Installing Node.js and npm..."
|
||||||
|
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
|
||||||
|
sudo apt install -y nodejs
|
||||||
|
|
||||||
|
# Verify Node.js and npm installation
|
||||||
|
echo "Verifying Node.js and npm installation..."
|
||||||
|
node -v
|
||||||
|
npm -v
|
||||||
|
|
||||||
|
# Clone the Alfresco Content App repository
|
||||||
|
git clone https://github.com/Alfresco/alfresco-content-app.git
|
||||||
|
cd alfresco-content-app
|
||||||
|
|
||||||
|
# Checkout to the specific version 4.4.1
|
||||||
|
git checkout tags/4.4.1 -b 4.4.1
|
||||||
|
|
||||||
|
# Install project dependencies
|
||||||
|
npm install
|
||||||
|
|
||||||
|
# Build the application for production
|
||||||
|
npm run build
|
||||||
@@ -0,0 +1,93 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Exit script on any error
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Update and upgrade the system
|
||||||
|
echo "Updating system..."
|
||||||
|
sudo apt update && sudo apt upgrade -y
|
||||||
|
|
||||||
|
# Install Nginx
|
||||||
|
echo "Installing Nginx..."
|
||||||
|
sudo apt install -y nginx
|
||||||
|
|
||||||
|
# Create directory for the Alfresco Content App
|
||||||
|
echo "Creating directory for Alfresco Content App..."
|
||||||
|
sudo mkdir -p /var/www/alfresco-content-app
|
||||||
|
sudo cp -r /home/ubuntu/alfresco-content-app/dist/content-ce/* /var/www/alfresco-content-app
|
||||||
|
|
||||||
|
echo "Creating nginx systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||||
|
[Unit]
|
||||||
|
Description=A high performance web server and a reverse proxy server
|
||||||
|
Documentation=man:nginx(8)
|
||||||
|
After=network.target remote-fs.target nss-lookup.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
PIDFile=/run/nginx.pid
|
||||||
|
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
|
||||||
|
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
|
||||||
|
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
|
||||||
|
ExecStop=/bin/kill -s QUIT $MAINPID
|
||||||
|
PrivateTmp=true
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Enabling nginx service to start on boot..."
|
||||||
|
sudo systemctl enable nginx
|
||||||
|
|
||||||
|
# Configure Nginx to serve the Alfresco Content App
|
||||||
|
echo "Configuring Nginx..."
|
||||||
|
cat <<EOL | sudo tee /etc/nginx/sites-available/alfresco-content-app
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name localhost;
|
||||||
|
|
||||||
|
client_max_body_size 0;
|
||||||
|
|
||||||
|
set \$allowOriginSite *;
|
||||||
|
proxy_pass_request_headers on;
|
||||||
|
proxy_pass_header Set-Cookie;
|
||||||
|
|
||||||
|
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
|
||||||
|
proxy_redirect off;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_set_header Host \$host:\$server_port;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_pass_header Set-Cookie;
|
||||||
|
|
||||||
|
root /var/www/alfresco-content-app;
|
||||||
|
index index.html;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
try_files \$uri \$uri/ /index.html;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /alfresco/ {
|
||||||
|
proxy_pass http://localhost:8080;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /share/ {
|
||||||
|
proxy_pass http://localhost:8080;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOL
|
||||||
|
|
||||||
|
|
||||||
|
# Enable the new Nginx configuration
|
||||||
|
echo "Enabling Nginx configuration..."
|
||||||
|
sudo ln -s /etc/nginx/sites-available/alfresco-content-app /etc/nginx/sites-enabled/
|
||||||
|
sudo nginx -t
|
||||||
|
sudo systemctl restart nginx
|
||||||
|
|
||||||
|
sudo systemctl stop nginx
|
||||||
|
|
||||||
|
# Instructions to transfer the built files
|
||||||
|
echo "Nginx setup complete."
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
## RECOMMENDATION: run this sequence of commands manually, waiting between one command and the next one to ensure service dependencies are met.
|
||||||
|
|
||||||
|
echo "Starting postgresql"
|
||||||
|
sudo systemctl start postgresql
|
||||||
|
|
||||||
|
echo "Starting activemq"
|
||||||
|
sudo systemctl start activemq
|
||||||
|
|
||||||
|
echo "Starting transform"
|
||||||
|
sudo systemctl start transform
|
||||||
|
|
||||||
|
echo "Starting tomcat"
|
||||||
|
sudo systemctl start tomcat
|
||||||
|
|
||||||
|
echo "Starting solr"
|
||||||
|
sudo systemctl start solr
|
||||||
|
|
||||||
|
echo "Starting nginx"
|
||||||
|
sudo systemctl start nginx
|
||||||
|
|
||||||
|
|
||||||
|
echo "Services have been started successfully!"
|
||||||
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
+109
@@ -0,0 +1,109 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Überprüfung des Betriebssystems
|
||||||
|
function check_os() {
|
||||||
|
if [ -f /etc/redhat-release ]; then
|
||||||
|
echo "Red Hat Derivat erkannt"
|
||||||
|
OS="redhat"
|
||||||
|
elif [ -f /etc/debian_version ]; then
|
||||||
|
echo "Debian/Ubuntu erkannt"
|
||||||
|
OS="debian"
|
||||||
|
else
|
||||||
|
echo "Betriebssystem nicht unterstützt"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Automatische Ermittlung von Systeminformationen
|
||||||
|
function get_system_info() {
|
||||||
|
HOSTNAME=$(hostname)
|
||||||
|
IP_ADDR=$(hostname -I | awk '{print $1}')
|
||||||
|
CPU_CORES=$(nproc)
|
||||||
|
TOTAL_MEM=$(grep MemTotal /proc/meminfo | awk '{print $2}')
|
||||||
|
echo "Systeminformationen:"
|
||||||
|
echo "Hostname: $HOSTNAME"
|
||||||
|
echo "IP-Adresse: $IP_ADDR"
|
||||||
|
echo "CPU-Kerne: $CPU_CORES"
|
||||||
|
echo "Speicher (kB): $TOTAL_MEM"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Installation der notwendigen Pakete auf Debian/Ubuntu
|
||||||
|
function install_debian_dependencies() {
|
||||||
|
echo "Installiere Abhängigkeiten auf Debian/Ubuntu..."
|
||||||
|
sudo apt update
|
||||||
|
sudo apt install -y openjdk-11-jdk postgresql postgresql-contrib libreoffice curl wget unzip
|
||||||
|
}
|
||||||
|
|
||||||
|
# Installation der notwendigen Pakete auf Red Hat Derivaten
|
||||||
|
function install_redhat_dependencies() {
|
||||||
|
echo "Installiere Abhängigkeiten auf Red Hat..."
|
||||||
|
sudo yum update -y
|
||||||
|
sudo yum install -y java-11-openjdk postgresql-server postgresql-contrib libreoffice curl wget unzip
|
||||||
|
}
|
||||||
|
|
||||||
|
# Alfresco herunterladen
|
||||||
|
function download_alfresco() {
|
||||||
|
echo "Lade Alfresco herunter..."
|
||||||
|
wget https://download.alfresco.com/cloudfront/release/community/202210-GA-build-411/alfresco-content-services-community-distribution-202210.zip -O alfresco.zip
|
||||||
|
#wget https://nexus.alfresco.com/nexus/service/local/repositories/releases/content/org/alfresco/alfresco-content-services-community-distribution/23.1.0/alfresco-content-services-community-distribution-23.1.0.zip -O alfresco.zip
|
||||||
|
unzip alfresco.zip -d /opt/alfresco
|
||||||
|
chmod -R 755 /opt/alfresco
|
||||||
|
}
|
||||||
|
|
||||||
|
# Datenbank konfigurieren (PostgreSQL)
|
||||||
|
function configure_database() {
|
||||||
|
echo "Konfiguriere PostgreSQL..."
|
||||||
|
sudo postgresql-setup initdb
|
||||||
|
sudo systemctl start postgresql
|
||||||
|
sudo systemctl enable postgresql
|
||||||
|
sudo -u postgres psql -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||||
|
sudo -u postgres psql -c "CREATE DATABASE alfresco WITH OWNER alfresco;"
|
||||||
|
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Alfresco konfigurieren
|
||||||
|
function configure_alfresco() {
|
||||||
|
echo "Konfiguriere Alfresco..."
|
||||||
|
ALFRESCO_GLOBAL_PROPERTIES="/opt/alfresco/web-server/shared/classes/alfresco-global.properties"
|
||||||
|
cp /opt/alfresco/web-server/shared/classes/alfresco-global.properties.sample $ALFRESCO_GLOBAL_PROPERTIES
|
||||||
|
|
||||||
|
cat <<EOL >> $ALFRESCO_GLOBAL_PROPERTIES
|
||||||
|
db.driver=org.postgresql.Driver
|
||||||
|
db.username=alfresco
|
||||||
|
db.password=alfresco
|
||||||
|
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||||
|
alfresco.host=$IP_ADDR
|
||||||
|
alfresco.port=8080
|
||||||
|
share.host=$IP_ADDR
|
||||||
|
share.port=8080
|
||||||
|
index.subsystem.name=solr6
|
||||||
|
EOL
|
||||||
|
}
|
||||||
|
|
||||||
|
# Alfresco Dienst starten
|
||||||
|
function start_alfresco() {
|
||||||
|
echo "Starte Alfresco..."
|
||||||
|
/opt/alfresco/alfresco.sh start
|
||||||
|
}
|
||||||
|
|
||||||
|
# Hauptfunktion zur Installation und Konfiguration von Alfresco
|
||||||
|
function install_alfresco() {
|
||||||
|
check_os
|
||||||
|
get_system_info
|
||||||
|
|
||||||
|
if [ "$OS" == "debian" ]; then
|
||||||
|
install_debian_dependencies
|
||||||
|
elif [ "$OS" == "redhat" ]; then
|
||||||
|
install_redhat_dependencies
|
||||||
|
fi
|
||||||
|
|
||||||
|
download_alfresco
|
||||||
|
configure_database
|
||||||
|
configure_alfresco
|
||||||
|
start_alfresco
|
||||||
|
|
||||||
|
echo "Alfresco Installation und Konfiguration abgeschlossen!"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Skript starten
|
||||||
|
install_alfresco
|
||||||
+666
@@ -0,0 +1,666 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Detect the OS
|
||||||
|
if [ -f /etc/redhat-release ]; then
|
||||||
|
OS="RHEL"
|
||||||
|
elif [ -f /etc/lsb-release ]; then
|
||||||
|
OS="Ubuntu"
|
||||||
|
else
|
||||||
|
echo "Unsupported OS"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
#MAIN
|
||||||
|
download_files() {
|
||||||
|
# Array von URLs
|
||||||
|
URLS=(
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-content-services-community-distribution/23.2.1/alfresco-content-services-community-distribution-23.2.1.zip"
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-search-services/2.0.9.1/alfresco-search-services-2.0.9.1.zip"
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-transform-core-aio/5.1.0/alfresco-transform-core-aio-5.1.0.jar"
|
||||||
|
)
|
||||||
|
|
||||||
|
# Verzeichnis, in das die Dateien heruntergeladen werden sollen
|
||||||
|
DEST_DIR="/tmp/downloads"
|
||||||
|
|
||||||
|
# Erstelle das Verzeichnis, falls es nicht existiert
|
||||||
|
mkdir -p "$DEST_DIR"
|
||||||
|
|
||||||
|
# Herunterladen der Dateien
|
||||||
|
for URL in "${URLS[@]}"; do
|
||||||
|
echo "Downloading $URL..."
|
||||||
|
# Extrahiere den Dateinamen aus der URL
|
||||||
|
FILE_NAME=$(basename "$URL")
|
||||||
|
# Lade die Datei herunter und speichere sie im Zielverzeichnis
|
||||||
|
curl -L "$URL" -o "$DEST_DIR/$FILE_NAME"
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Successfully downloaded $FILE_NAME"
|
||||||
|
else
|
||||||
|
echo "Failed to download $FILE_NAME"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Functions for RHEL
|
||||||
|
install_postgresql_rhel() {
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo yum update -y
|
||||||
|
|
||||||
|
echo "Installing PostgreSQL 16..."
|
||||||
|
#sudo yum install -y https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/pgdg-redhat-repo-latest.noarch.rpm
|
||||||
|
sudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-8-x86_64/pgdg-redhat-repo-latest.noarch.rpm
|
||||||
|
sudo dnf -qy module disable postgresql
|
||||||
|
sudo yum install -y postgresql16-server postgresql16-contrib
|
||||||
|
|
||||||
|
echo "Initializing PostgreSQL database..."
|
||||||
|
sudo /usr/pgsql-16/bin/postgresql-16-setup initdb
|
||||||
|
|
||||||
|
echo "Enable local connections"
|
||||||
|
sudo sed -i 's/peer/trust/' /var/lib/pgsql/16/data/pg_hba.conf
|
||||||
|
sudo sed -i 's/ident/md5/' /var/lib/pgsql/16/data/pg_hba.conf
|
||||||
|
|
||||||
|
echo "Starting PostgreSQL service..."
|
||||||
|
sudo systemctl start postgresql-16
|
||||||
|
|
||||||
|
echo "Configuring Alfresco database..."
|
||||||
|
sudo -u postgres psql -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||||
|
sudo -u postgres psql -c "CREATE DATABASE alfresco OWNER alfresco ENCODING 'UTF8';"
|
||||||
|
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||||
|
|
||||||
|
echo "Stopping PostgreSQL service..."
|
||||||
|
sudo systemctl stop postgresql-16
|
||||||
|
|
||||||
|
echo "Enabling PostgreSQL to start on boot..."
|
||||||
|
sudo systemctl enable postgresql-16
|
||||||
|
|
||||||
|
echo "PostgreSQL installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
install_java_rhel() {
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo dnf update -y
|
||||||
|
|
||||||
|
echo "Installing the latest Java JDK and development tools..."
|
||||||
|
# Install Java JDK and development tools (java-17-openjdk and java-17-openjdk-devel)
|
||||||
|
sudo dnf install -y java-17-openjdk java-17-openjdk-devel
|
||||||
|
|
||||||
|
echo "Setting Java as the default version..."
|
||||||
|
# Update alternatives to ensure the correct Java version is used
|
||||||
|
sudo alternatives --install /usr/bin/java java /usr/lib/jvm/java-17-openjdk-*/bin/java 1
|
||||||
|
sudo alternatives --install /usr/bin/javac javac /usr/lib/jvm/java-17-openjdk-*/bin/javac 1
|
||||||
|
|
||||||
|
echo "Checking the installed Java version..."
|
||||||
|
java -version
|
||||||
|
|
||||||
|
# Automatically select the correct version
|
||||||
|
echo "Selecting the Java alternative..."
|
||||||
|
# Hier die Nummer der gewünschten Java-Version setzen. Ersetze "1" durch die entsprechende Nummer.
|
||||||
|
echo "1" | sudo alternatives --config java
|
||||||
|
|
||||||
|
echo "Selecting the javac alternative..."
|
||||||
|
# Hier die Nummer der gewünschten javac-Version setzen. Ersetze "1" durch die entsprechende Nummer.
|
||||||
|
echo "1" | sudo alternatives --config javac
|
||||||
|
|
||||||
|
echo "Verifying Java installation..."
|
||||||
|
java -version
|
||||||
|
javac -version
|
||||||
|
|
||||||
|
echo "Java JDK installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
install_tomcat_rhel() {
|
||||||
|
# Tomcat installation for RHEL
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo yum update -y
|
||||||
|
|
||||||
|
echo "Installing Tomcat 10..."
|
||||||
|
sudo yum install -y tomcat tomcat-webapps tomcat-admin-webapps
|
||||||
|
|
||||||
|
echo "Starting Tomcat service..."
|
||||||
|
sudo systemctl start tomcat
|
||||||
|
|
||||||
|
echo "Enabling Tomcat to start on boot..."
|
||||||
|
sudo systemctl enable tomcat
|
||||||
|
|
||||||
|
echo "Tomcat installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
install_activemq_rhel() {
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo yum update -y
|
||||||
|
|
||||||
|
echo "Downloading ActiveMQ..."
|
||||||
|
wget https://dlcdn.apache.org/activemq/6.1.3/apache-activemq-6.1.3-bin.tar.gz -O /tmp/apache-activemq-6.1.3-bin.tar.gz
|
||||||
|
|
||||||
|
echo "Extracting ActiveMQ..."
|
||||||
|
sudo mkdir /opt/activemq
|
||||||
|
sudo tar xzvf /tmp/apache-activemq-6.1.3-bin.tar.gz -C /opt/activemq --strip-components=1
|
||||||
|
|
||||||
|
echo "Setting permissions for ActiveMQ directories..."
|
||||||
|
sudo useradd activemq
|
||||||
|
sudo chown -R activemq:activemq /opt/activemq
|
||||||
|
sudo chmod -R 755 /opt/activemq
|
||||||
|
|
||||||
|
echo "Creating ActiveMQ systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache ActiveMQ
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=activemq
|
||||||
|
Group=activemq
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
Environment="ACTIVEMQ_HOME=/opt/activemq"
|
||||||
|
Environment="ACTIVEMQ_BASE=/opt/activemq"
|
||||||
|
Environment="ACTIVEMQ_CONF=/opt/activemq/conf"
|
||||||
|
Environment="ACTIVEMQ_DATA=/opt/activemq/data"
|
||||||
|
|
||||||
|
ExecStart=/opt/activemq/bin/activemq start
|
||||||
|
ExecStop=/opt/activemq/bin/activemq stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting ActiveMQ service..."
|
||||||
|
sudo systemctl start activemq
|
||||||
|
|
||||||
|
echo "Enabling ActiveMQ service to start on boot..."
|
||||||
|
sudo systemctl enable activemq
|
||||||
|
|
||||||
|
echo "Apache ActiveMQ installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
install_alfresco_rhel(){
|
||||||
|
|
||||||
|
echo "Create support folders and configuration in Tomcat"
|
||||||
|
mkdir -p /etc/tomcat/shared/classes && mkdir -p /etc/tomcat/shared/lib
|
||||||
|
sed -i 's|^shared.loader=$|shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar|' /etc/tomcat/catalina.properties
|
||||||
|
|
||||||
|
echo "Unzip Alfresco ZIP Distribution File"
|
||||||
|
mkdir /tmp/downloads/alfresco
|
||||||
|
|
||||||
|
echo "Copy JDBC driver"
|
||||||
|
cp /tmp/downloads/alfresco/web-server/lib/postgresql-42.6.0.jar /etc/tomcat/shared/lib/
|
||||||
|
|
||||||
|
echo "Configure JAR Addons deployment"
|
||||||
|
mkdir -p /etc/modules/platform && mkdir -p /opt/modules/share && mkdir -p /opt/tomcat/conf/Catalina/localhost
|
||||||
|
cp /tmp/downloads/alfresco/web-server/conf/Catalina/localhost/* /opt/tomcat/conf/Catalina/localhost/
|
||||||
|
|
||||||
|
echo "Install Web Applications"
|
||||||
|
cp /tmp/downloads/alfresco/web-server/webapps/* /etc/tomcat/webapps/
|
||||||
|
|
||||||
|
echo "Apply configuration"
|
||||||
|
cp -r /tmp/downloads/alfresco/web-server/shared/classes/* /etc/tomcat/shared/classes/
|
||||||
|
mkdir /opt/keystore && cp -r /tmp/downloads/alfresco/keystore/* /opt/keystore/
|
||||||
|
mkdir /opt/alf_data
|
||||||
|
cat <<EOL | tee /etc/tomcat/shared/classes/alfresco-global.properties
|
||||||
|
#
|
||||||
|
# Custom content and index data location
|
||||||
|
#
|
||||||
|
dir.root=/opt/alf_data
|
||||||
|
dir.keystore=/opt/keystore/
|
||||||
|
|
||||||
|
#
|
||||||
|
# Database connection properties
|
||||||
|
#
|
||||||
|
db.username=alfresco
|
||||||
|
db.password=alfresco
|
||||||
|
db.driver=org.postgresql.Driver
|
||||||
|
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||||
|
|
||||||
|
#
|
||||||
|
# Solr Configuration
|
||||||
|
#
|
||||||
|
solr.secureComms=secret
|
||||||
|
solr.sharedSecret=secret
|
||||||
|
solr.host=localhost
|
||||||
|
solr.port=8983
|
||||||
|
index.subsystem.name=solr6
|
||||||
|
|
||||||
|
#
|
||||||
|
# Transform Configuration
|
||||||
|
#
|
||||||
|
localTransform.core-aio.url=http://localhost:8090/
|
||||||
|
|
||||||
|
#
|
||||||
|
# Events Configuration
|
||||||
|
#
|
||||||
|
messaging.broker.url=failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# URL Generation Parameters
|
||||||
|
#-------------
|
||||||
|
alfresco.context=alfresco
|
||||||
|
alfresco.host=localhost
|
||||||
|
alfresco.port=8080
|
||||||
|
alfresco.protocol=http
|
||||||
|
share.context=share
|
||||||
|
share.host=localhost
|
||||||
|
share.port=8080
|
||||||
|
share.protocol=http
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Apply AMPs"
|
||||||
|
mkdir /opt/amps && cp -r /tmp/downloads/alfresco/amps/* /opt/amps/
|
||||||
|
mkdir /opt/bin && cp -r /tmp/downloads/alfresco/bin/* /opt/bin/
|
||||||
|
java -jar /opt/bin/alfresco-mmt.jar install /opt/amps /etc/tomcat/webapps/alfresco.war -directory
|
||||||
|
java -jar /opt/bin/alfresco-mmt.jar list /etc/tomcat/webapps/alfresco.war
|
||||||
|
|
||||||
|
echo "Modify alfresco and share logs directory"
|
||||||
|
mkdir /etc/tomcat/webapps/alfresco && unzip /etc/tomcat/webapps/alfresco.war -d /etc/tomcat/webapps/alfresco
|
||||||
|
mkdir /etc/tomcat/webapps/share && unzip /etc/tomcat/webapps/share.war -d /etc/tomcat/webapps/share
|
||||||
|
sed -i 's|^appender\.rolling\.fileName=alfresco\.log|appender.rolling.fileName=/opt/tomcat/logs/alfresco.log|' /etc/tomcat/webapps/alfresco/WEB-INF/classes/log4j2.properties
|
||||||
|
sed -i 's|^appender\.rolling\.fileName=share\.log|appender.rolling.fileName=/opt/tomcat/logs/share.log|' /etc/tomcat/webapps/share/WEB-INF/classes/log4j2.properties
|
||||||
|
|
||||||
|
|
||||||
|
echo "Alfresco has been configured"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_solr_rhel() {
|
||||||
|
echo "Unzip SOLR ZIP Distribution File"
|
||||||
|
mkdir /tmp/solr
|
||||||
|
unzip /tmp/downloads/alfresco-search-services-2.0.9.1.zip -d /tmp/solr
|
||||||
|
mv /tmp/solr/alfresco-search-services /opt/solr/alfresco-search-services
|
||||||
|
echo "creating user ..."
|
||||||
|
sudo useradd solr
|
||||||
|
echo "Creating SOLR systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache SOLR Web Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=solr
|
||||||
|
Group=solr
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk"
|
||||||
|
|
||||||
|
ExecStart=/opt/solr/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||||
|
ExecStop=/opt/solr/alfresco-search-services/solr/bin/solr stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "SELinux anpassungen werden durchgeführt...."
|
||||||
|
ausearch -c '(solr)' --raw | audit2allow -M my-solr
|
||||||
|
semodule -X 300 -i my-solr.pp
|
||||||
|
|
||||||
|
echo "Permission für für solr werden gesetzt...."
|
||||||
|
chmod -R 755 /opt/solr/alfresco-search-services/solr/server/../../logs
|
||||||
|
chown -R solr:solr /opt/solr/alfresco-search-services/solr/server/../../logs
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Solr service..."
|
||||||
|
sudo systemctl start solr
|
||||||
|
|
||||||
|
echo "Enabling Solr service to start on boot..."
|
||||||
|
sudo systemctl enable solr
|
||||||
|
|
||||||
|
echo "SOLR has been configured"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_transform_rhel() {
|
||||||
|
echo "Install Repo Dependency..."
|
||||||
|
sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||||
|
sudo dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||||
|
|
||||||
|
echo "Install Transform dependencies"
|
||||||
|
sudo dnf install -y GraphicsMagick libreoffice perl-Image-ExifTool
|
||||||
|
|
||||||
|
curl -L -o /tmp/downloads/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
|
||||||
|
sudo tar xf /tmp/downloads/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||||
|
|
||||||
|
echo "Configure Transform server"
|
||||||
|
mkdir /opt/transform
|
||||||
|
cp /tmp/downloads/alfresco-transform-core-aio-5.1.0.jar /opt/transform
|
||||||
|
|
||||||
|
echo " User wird angelegt..."
|
||||||
|
sudo useradd transform
|
||||||
|
|
||||||
|
echo "Creating Transform systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||||
|
|
||||||
|
[Unit]
|
||||||
|
Description=Transform Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
|
||||||
|
User=transform
|
||||||
|
Group=transform
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk"
|
||||||
|
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||||
|
|
||||||
|
ExecStart=java -jar /opt/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||||
|
ExecStop=/bin/kill -15 $MAINPID
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Transform service..."
|
||||||
|
sudo systemctl start transform
|
||||||
|
|
||||||
|
echo "Enabling Transform service to start on boot..."
|
||||||
|
sudo systemctl enable transform
|
||||||
|
|
||||||
|
echo "Transform has been configured"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_nginx_rhel() {
|
||||||
|
echo "Updating system..."
|
||||||
|
sudo yum update -y
|
||||||
|
|
||||||
|
echo "Installing Nginx..."
|
||||||
|
sudo yum install -y nginx
|
||||||
|
|
||||||
|
echo "Creating directory for Alfresco Content App..."
|
||||||
|
sudo mkdir -p /var/www/alfresco-content-app
|
||||||
|
sudo cp -r /tmp/downloads/alfresco-content-app/dist/content-ce/* /var/www/alfresco-content-app
|
||||||
|
|
||||||
|
echo "Creating nginx systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||||
|
[Unit]
|
||||||
|
Description=NGINX web server
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
ExecStart=/usr/sbin/nginx
|
||||||
|
ExecReload=/usr/sbin/nginx -s reload
|
||||||
|
ExecStop=/usr/sbin/nginx -s stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Nginx service..."
|
||||||
|
sudo systemctl start nginx
|
||||||
|
|
||||||
|
echo "Enabling Nginx to start on boot..."
|
||||||
|
sudo systemctl enable nginx
|
||||||
|
|
||||||
|
echo "Nginx installation and configuration completed successfully!"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Functions for Ubuntu
|
||||||
|
install_postgresql_ubuntu() {
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Installing PostgreSQL 16..."
|
||||||
|
sudo apt install -y wget ca-certificates
|
||||||
|
wget -qO - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
|
||||||
|
echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs) pgdg" | sudo tee /etc/apt/sources.list.d/pgdg.list
|
||||||
|
sudo apt update
|
||||||
|
sudo apt install -y postgresql-16 postgresql-client-16
|
||||||
|
|
||||||
|
echo "Enable local connections"
|
||||||
|
sudo sed -i 's/peer/trust/' /etc/postgresql/16/main/pg_hba.conf
|
||||||
|
sudo sed -i 's/ident/md5/' /etc/postgresql/16/main/pg_hba.conf
|
||||||
|
|
||||||
|
echo "Starting PostgreSQL service..."
|
||||||
|
sudo systemctl start postgresql
|
||||||
|
|
||||||
|
echo "Configuring Alfresco database..."
|
||||||
|
sudo -u postgres psql -c "CREATE USER alfresco WITH PASSWORD 'alfresco';"
|
||||||
|
sudo -u postgres psql -c "CREATE DATABASE alfresco OWNER alfresco ENCODING 'UTF8';"
|
||||||
|
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE alfresco TO alfresco;"
|
||||||
|
|
||||||
|
echo "Stopping PostgreSQL service..."
|
||||||
|
sudo systemctl stop postgresql
|
||||||
|
|
||||||
|
echo "Enabling PostgreSQL to start on boot..."
|
||||||
|
sudo systemctl enable postgresql
|
||||||
|
|
||||||
|
echo "PostgreSQL installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_java_ubuntu() {
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Installing Java JDK 17..."
|
||||||
|
sudo apt install -y openjdk-17-jdk
|
||||||
|
|
||||||
|
echo "Checking Java version..."
|
||||||
|
java -version
|
||||||
|
|
||||||
|
echo "Java JDK 17 installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_tomcat_ubuntu() {
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Installing Tomcat 10..."
|
||||||
|
sudo apt install -y tomcat10 tomcat10-admin tomcat10-common tomcat10-examples
|
||||||
|
|
||||||
|
echo "Starting Tomcat service..."
|
||||||
|
sudo systemctl start tomcat10
|
||||||
|
|
||||||
|
echo "Enabling Tomcat to start on boot..."
|
||||||
|
sudo systemctl enable tomcat10
|
||||||
|
|
||||||
|
echo "Tomcat installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_activemq_ubuntu() {
|
||||||
|
echo "Updating package list..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Downloading ActiveMQ..."
|
||||||
|
wget https://dlcdn.apache.org/activemq/5.18.5/apache-activemq-5.18.5-bin.tar.gz -O /tmp/apache-activemq-5.18.5-bin.tar.gz
|
||||||
|
|
||||||
|
echo "Extracting ActiveMQ..."
|
||||||
|
sudo mkdir -p /home/ubuntu/activemq
|
||||||
|
sudo tar xzvf /tmp/apache-activemq-5.18.5-bin.tar.gz -C /home/ubuntu/activemq --strip-components=1
|
||||||
|
|
||||||
|
echo "Setting permissions for ActiveMQ directories..."
|
||||||
|
sudo chown -R ubuntu:ubuntu /home/ubuntu/activemq
|
||||||
|
sudo chmod -R 755 /home/ubuntu/activemq
|
||||||
|
|
||||||
|
echo "Creating ActiveMQ systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache ActiveMQ
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=ubuntu
|
||||||
|
Group=ubuntu
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
Environment="ACTIVEMQ_HOME=/home/ubuntu/activemq"
|
||||||
|
Environment="ACTIVEMQ_BASE=/home/ubuntu/activemq"
|
||||||
|
Environment="ACTIVEMQ_CONF=/home/ubuntu/activemq/conf"
|
||||||
|
Environment="ACTIVEMQ_DATA=/home/ubuntu/activemq/data"
|
||||||
|
|
||||||
|
ExecStart=/home/ubuntu/activemq/bin/activemq start
|
||||||
|
ExecStop=/home/ubuntu/activemq/bin/activemq stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting ActiveMQ service..."
|
||||||
|
sudo systemctl start activemq
|
||||||
|
|
||||||
|
echo "Enabling ActiveMQ service to start on boot..."
|
||||||
|
sudo systemctl enable activemq
|
||||||
|
|
||||||
|
echo "Apache ActiveMQ installation and setup completed successfully!"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_solr_ubuntu() {
|
||||||
|
echo "Unzip SOLR ZIP Distribution File"
|
||||||
|
mkdir /tmp/solr
|
||||||
|
unzip downloads/alfresco-search-services-2.0.9.1.zip -d /tmp/solr
|
||||||
|
mv /tmp/solr/alfresco-search-services /home/ubuntu
|
||||||
|
|
||||||
|
echo "Creating SOLR systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache SOLR Web Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=ubuntu
|
||||||
|
Group=ubuntu
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
|
||||||
|
ExecStart=/home/ubuntu/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||||
|
ExecStop=/home/ubuntu/alfresco-search-services/solr/bin/solr stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Solr service..."
|
||||||
|
sudo systemctl start solr
|
||||||
|
|
||||||
|
echo "Enabling Solr service to start on boot..."
|
||||||
|
sudo systemctl enable solr
|
||||||
|
|
||||||
|
echo "SOLR has been configured"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_transform_ubuntu() {
|
||||||
|
echo "Install Transform dependencies"
|
||||||
|
sudo apt install -y imagemagick libreoffice exiftool
|
||||||
|
|
||||||
|
curl -L -o /tmp/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
|
||||||
|
sudo tar xf /tmp/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||||
|
|
||||||
|
echo "Configure Transform server"
|
||||||
|
mkdir /home/ubuntu/transform
|
||||||
|
cp downloads/alfresco-transform-core-aio-5.1.0.jar /home/ubuntu/transform
|
||||||
|
|
||||||
|
echo "Creating Transform systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||||
|
[Unit]
|
||||||
|
Description=Transform Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
|
||||||
|
User=ubuntu
|
||||||
|
Group=ubuntu
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64"
|
||||||
|
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||||
|
|
||||||
|
ExecStart=java -jar /home/ubuntu/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||||
|
ExecStop=/bin/kill -15 $MAINPID
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Transform service..."
|
||||||
|
sudo systemctl start transform
|
||||||
|
|
||||||
|
echo "Enabling Transform service to start on boot..."
|
||||||
|
sudo systemctl enable transform
|
||||||
|
|
||||||
|
echo "Transform has been configured"
|
||||||
|
}
|
||||||
|
|
||||||
|
install_nginx_ubuntu() {
|
||||||
|
echo "Updating system..."
|
||||||
|
sudo apt update
|
||||||
|
|
||||||
|
echo "Installing Nginx..."
|
||||||
|
sudo apt install -y nginx
|
||||||
|
|
||||||
|
echo "Creating directory for Alfresco Content App..."
|
||||||
|
sudo mkdir -p /var/www/alfresco-content-app
|
||||||
|
sudo cp -r /home/ubuntu/alfresco-content-app/dist/content-ce/* /var/www/alfresco-content-app
|
||||||
|
|
||||||
|
echo "Creating nginx systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||||
|
[Unit]
|
||||||
|
Description=NGINX web server
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
ExecStart=/usr/sbin/nginx
|
||||||
|
ExecReload=/usr/sbin/nginx -s reload
|
||||||
|
ExecStop=/usr/sbin/nginx -s stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Nginx service..."
|
||||||
|
sudo systemctl start nginx
|
||||||
|
|
||||||
|
echo "Enabling Nginx to start on boot..."
|
||||||
|
sudo systemctl enable nginx
|
||||||
|
|
||||||
|
echo "Nginx installation and configuration completed successfully!"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Run the appropriate installation based on the OS
|
||||||
|
if [ "$OS" == "RHEL" ]; then
|
||||||
|
#download_files
|
||||||
|
#install_postgresql_rhel
|
||||||
|
#install_java_rhel
|
||||||
|
#install_tomcat_rhel
|
||||||
|
#install_activemq_rhel
|
||||||
|
install_alfresco_rhel
|
||||||
|
#install_solr_rhel
|
||||||
|
#install_transform_rhel
|
||||||
|
#install_nginx_rhel
|
||||||
|
elif [ "$OS" == "Ubuntu" ]; then
|
||||||
|
download_files
|
||||||
|
install_postgresql_ubuntu
|
||||||
|
install_java_ubuntu
|
||||||
|
install_tomcat_ubuntu
|
||||||
|
install_activemq_ubuntu
|
||||||
|
install_solr_ubuntu
|
||||||
|
install_transform_ubuntu
|
||||||
|
install_nginx_ubuntu
|
||||||
|
else
|
||||||
|
echo "Unsupported OS"
|
||||||
|
fi
|
||||||
+128
@@ -0,0 +1,128 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Farben für die Ausgabe
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
NC='\033[0m' # No Color
|
||||||
|
|
||||||
|
# Funktion zur Überprüfung des Linux-Derivats
|
||||||
|
check_distro() {
|
||||||
|
if [ -f /etc/debian_version ]; then
|
||||||
|
echo "Debian/Ubuntu erkannt."
|
||||||
|
DISTRO="debian"
|
||||||
|
elif [ -f /etc/redhat-release ]; then
|
||||||
|
echo "RedHat/CentOS erkannt."
|
||||||
|
DISTRO="redhat"
|
||||||
|
else
|
||||||
|
echo -e "${RED}Unbekanntes Linux-Derivat. Das Skript unterstützt nur Debian/Ubuntu und RedHat/CentOS.${NC}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zur Installation von Openfire auf Debian/Ubuntu
|
||||||
|
install_openfire_debian() {
|
||||||
|
echo -e "${GREEN}Installation von Openfire auf Debian/Ubuntu...${NC}"
|
||||||
|
wget -O openfire.deb https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire_4.6.0_all.deb
|
||||||
|
sudo dpkg -i openfire.deb
|
||||||
|
sudo apt-get install -f -y # Um Abhängigkeiten zu installieren
|
||||||
|
sudo systemctl enable openfire
|
||||||
|
sudo systemctl start openfire
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zur Installation von Openfire auf RedHat/CentOS
|
||||||
|
install_openfire_redhat() {
|
||||||
|
echo -e "${GREEN}Installation von Openfire auf RedHat/CentOS...${NC}"
|
||||||
|
wget -O openfire.rpm https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire-4.6.0-1.noarch.rpm
|
||||||
|
sudo yum install -y openfire.rpm
|
||||||
|
sudo systemctl enable openfire
|
||||||
|
sudo systemctl start openfire
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zur Konfiguration als Publisher
|
||||||
|
configure_publisher() {
|
||||||
|
echo -e "${GREEN}Konfiguration als Publisher...${NC}"
|
||||||
|
read -p "Geben Sie die JID des Publishers ein (z.B. publisher@deinserver.com): " PUBLISHER_JID
|
||||||
|
read -sp "Geben Sie das Passwort des Publishers ein: " PUBLISHER_PASSWORD
|
||||||
|
echo ""
|
||||||
|
read -p "Geben Sie den PubSub-Server ein (z.B. pubsub.deinserver.com): " PUBSUB_SERVER
|
||||||
|
read -p "Geben Sie den PubSub-Node ein (z.B. mynode): " PUBSUB_NODE
|
||||||
|
|
||||||
|
# Erstelle ein Bash-Skript für den Publisher
|
||||||
|
cat <<EOL > publisher.sh
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
JID="$PUBLISHER_JID"
|
||||||
|
PASSWORD="$PUBLISHER_PASSWORD"
|
||||||
|
SERVER="$PUBSUB_SERVER"
|
||||||
|
NODE="$PUBSUB_NODE"
|
||||||
|
MESSAGE="Dies ist eine Testnachricht vom Publisher"
|
||||||
|
|
||||||
|
echo "\$MESSAGE" | sendxmpp -t -u "\$JID" -p "\$PASSWORD" -j "\$SERVER" "\$NODE"
|
||||||
|
EOL
|
||||||
|
|
||||||
|
chmod +x publisher.sh
|
||||||
|
echo -e "${GREEN}Publisher-Skript 'publisher.sh' erstellt.${NC}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zur Konfiguration als Subscriber
|
||||||
|
configure_subscriber() {
|
||||||
|
echo -e "${GREEN}Konfiguration als Subscriber...${NC}"
|
||||||
|
read -p "Geben Sie die JID des Subscribers ein (z.B. subscriber@deinserver.com): " SUBSCRIBER_JID
|
||||||
|
read -sp "Geben Sie das Passwort des Subscribers ein: " SUBSCRIBER_PASSWORD
|
||||||
|
echo ""
|
||||||
|
read -p "Geben Sie den PubSub-Server ein (z.B. pubsub.deinserver.com): " PUBSUB_SERVER
|
||||||
|
read -p "Geben Sie den PubSub-Node ein (z.B. mynode): " PUBSUB_NODE
|
||||||
|
|
||||||
|
# Erstelle ein Bash-Skript für den Subscriber
|
||||||
|
cat <<EOL > subscriber.sh
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
JID="$SUBSCRIBER_JID"
|
||||||
|
PASSWORD="$SUBSCRIBER_PASSWORD"
|
||||||
|
SERVER="$PUBSUB_SERVER"
|
||||||
|
NODE="$PUBSUB_NODE"
|
||||||
|
|
||||||
|
profanity --server "\$SERVER" --username "\$JID" --password "\$PASSWORD" --join "\$NODE"
|
||||||
|
EOL
|
||||||
|
|
||||||
|
chmod +x subscriber.sh
|
||||||
|
echo -e "${GREEN}Subscriber-Skript 'subscriber.sh' erstellt.${NC}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Auswahlmenü für die Konfiguration
|
||||||
|
show_menu() {
|
||||||
|
echo -e "${GREEN}Openfire wurde erfolgreich installiert!${NC}"
|
||||||
|
echo "Wählen Sie die gewünschte Rolle:"
|
||||||
|
echo "1) Publisher konfigurieren"
|
||||||
|
echo "2) Subscriber konfigurieren"
|
||||||
|
echo "3) Abbrechen"
|
||||||
|
|
||||||
|
read -p "Option [1-3]: " OPTION
|
||||||
|
case $OPTION in
|
||||||
|
1)
|
||||||
|
configure_publisher
|
||||||
|
;;
|
||||||
|
2)
|
||||||
|
configure_subscriber
|
||||||
|
;;
|
||||||
|
3)
|
||||||
|
echo -e "${RED}Abbruch.${NC}"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo -e "${RED}Ungültige Option.${NC}"
|
||||||
|
show_menu
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Hauptskript
|
||||||
|
check_distro
|
||||||
|
|
||||||
|
if [ "$DISTRO" == "debian" ]; then
|
||||||
|
install_openfire_debian
|
||||||
|
elif [ "$DISTRO" == "redhat" ]; then
|
||||||
|
install_openfire_redhat
|
||||||
|
fi
|
||||||
|
|
||||||
|
show_menu
|
||||||
Executable
+78
@@ -0,0 +1,78 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Funktion zur Installation erforderlicher Pakete
|
||||||
|
install_packages() {
|
||||||
|
local DISTRO=$1
|
||||||
|
case $DISTRO in
|
||||||
|
"debian"|"ubuntu")
|
||||||
|
apt-get update
|
||||||
|
apt-get install -y realmd samba-common samba-common-bin krb5-user sssd adcli packagekit
|
||||||
|
;;
|
||||||
|
"rhel"|"centos"|"fedora")
|
||||||
|
yum install -y realmd samba samba-common samba-common-tools krb5-workstation sssd adcli
|
||||||
|
;;
|
||||||
|
"arch")
|
||||||
|
pacman -Syu --noconfirm realmd samba krb5 sssd adcli
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unsupported distribution: $DISTRO"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Joinen der Domäne
|
||||||
|
join_domain() {
|
||||||
|
local DOMAIN=$1
|
||||||
|
local USER=$2
|
||||||
|
local PASSWORD=$3
|
||||||
|
|
||||||
|
echo "Konfiguriere Domain-Join für Domain: $DOMAIN"
|
||||||
|
|
||||||
|
# Realm beitreten
|
||||||
|
echo "$PASSWORD" | realm join --user="$USER" "$DOMAIN" --password
|
||||||
|
|
||||||
|
# Überprüfen, ob der Join erfolgreich war
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Domain join erfolgreich!"
|
||||||
|
else
|
||||||
|
echo "Fehler beim Domain Join."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Automatische Anmeldung aktivieren
|
||||||
|
if [ -f /etc/pam.d/common-session ]; then
|
||||||
|
sed -i 's/^.*pam_sssd.so/#&/' /etc/pam.d/common-session
|
||||||
|
sed -i 's/^.*pam_sssd.so/#&/' /etc/pam.d/common-session-noninteractive
|
||||||
|
sed -i '/common-session/a session required pam_mkhomedir.so skel=/etc/skel umask=0022' /etc/pam.d/common-session
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zur Erkennung der Distribution
|
||||||
|
get_distro() {
|
||||||
|
if [ -f /etc/os-release ]; then
|
||||||
|
. /etc/os-release
|
||||||
|
echo "$ID"
|
||||||
|
else
|
||||||
|
echo "Unknown"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Hauptskript
|
||||||
|
main() {
|
||||||
|
if [ "$#" -ne 3 ]; then
|
||||||
|
echo "Usage: $0 <domain> <username> <password>"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local DOMAIN=$1
|
||||||
|
local USER=$2
|
||||||
|
local PASSWORD=$3
|
||||||
|
|
||||||
|
local DISTRO=$(get_distro)
|
||||||
|
|
||||||
|
install_packages "$DISTRO"
|
||||||
|
join_domain "$DOMAIN" "$USER" "$PASSWORD"
|
||||||
|
}
|
||||||
|
|
||||||
|
main "$@"
|
||||||
Executable
+547
@@ -0,0 +1,547 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Variablen
|
||||||
|
# Konfiguration für den Zugriff auf die Synology DiskStation
|
||||||
|
SYNOLOGY_HOST="9.99.50.10"
|
||||||
|
SYNOLOGY_USERNAME="Madzone"
|
||||||
|
SYNOLOGY_PASSWORD="P@ssw0rd"
|
||||||
|
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||||
|
host=$(nslookup 9.99.50.10)
|
||||||
|
# Zielpfad für das Full-Chain-Zertifikat
|
||||||
|
FULLCHAIN_CERT="fullchain.${HOST_FQDN}.crt"
|
||||||
|
HOST_FQDN=$(hostname -f)
|
||||||
|
HOST_NORMAL=$(hostname -s)
|
||||||
|
DOMAIN=$(hostname -d)
|
||||||
|
REMOTE_DIR="/volume1/HEIMLAN/HEIMLAN"
|
||||||
|
NFS_MOUNT="/mnt/CSR"
|
||||||
|
SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa_synology"
|
||||||
|
TMP="/tmp"
|
||||||
|
|
||||||
|
# Name der Zertifikatsdateien
|
||||||
|
ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
||||||
|
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
||||||
|
SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
||||||
|
|
||||||
|
# Globale Variablen für das Betriebssystem
|
||||||
|
OS=""
|
||||||
|
distro=""
|
||||||
|
version=""
|
||||||
|
codename=""
|
||||||
|
|
||||||
|
# Globale Variablen für OPENSSL
|
||||||
|
CSR_DIR="/tmp"
|
||||||
|
KEY_DIR="/tmp"
|
||||||
|
SSL_DIR=""
|
||||||
|
PKI_DIR=""
|
||||||
|
|
||||||
|
# Extrahiere OU (Organizational Unit) und O (Organization) und wandele sie in Großbuchstaben um
|
||||||
|
OU=$(echo "${DOMAIN%%.*}" | tr '[:lower:]' '[:upper:]')
|
||||||
|
O=$(echo "${DOMAIN#*.}" | tr '[:lower:]' '[:upper:]')
|
||||||
|
|
||||||
|
# Read IP address dynamically from active network interface
|
||||||
|
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
||||||
|
echo "IP Address: $IP_ADDRESS"
|
||||||
|
|
||||||
|
# GLobale SSH Variablen
|
||||||
|
KEY_PATH="$HOME/.ssh/id_rsa_synology" # Pfad zum SSH-Schlüssel
|
||||||
|
NAS_HOME="/var/services/homes/$SYNOLOGY_USERNAME" # Angepasstes Home-Verzeichnis auf der NAS
|
||||||
|
dnf install sshpass nfs-utils -y
|
||||||
|
|
||||||
|
#*********************************************************************
|
||||||
|
#echo "SSH KEY wird im System implemntiert..."
|
||||||
|
#sudo ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_synology
|
||||||
|
#echo "SSH KEY wurde Erfolgreich im System implemntiert"
|
||||||
|
#echo "SSH Verbindung wird in die .ssh eingetragen...."
|
||||||
|
#sudo ssh-copy-id -i ~/.ssh/id_rsa_synology.pub ${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}${SYNOLOGY_PASSWORD}
|
||||||
|
#echo "SSH Verbindung wurde Erfolgreich in die .ssh eingetragen !!!"
|
||||||
|
|
||||||
|
|
||||||
|
colourmsg(){
|
||||||
|
echo -e "\033[0;36m$1\033[0m"
|
||||||
|
}
|
||||||
|
# Funktion zum Erstellen eines Ordners mit Unterordnern über SSH mit sshpass
|
||||||
|
create_remote_folders() {
|
||||||
|
|
||||||
|
# SSH-Befehl zum Erstellen des Ordners mit Unterordnern mit sshpass
|
||||||
|
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||||
|
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CSR"
|
||||||
|
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||||
|
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/CERT"
|
||||||
|
echo sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||||
|
sshpass -p $SYNOLOGY_PASSWORD ssh "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" "mkdir -p ${REMOTE_DIR}/${HOST_FQDN}/KEY"
|
||||||
|
echo "Ordner ${REMOTE_DIR}/$HOST_FQDN/ wurde auf ${host} erstellt."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen von SSH-Schlüsseln
|
||||||
|
generate_ssh_key() {
|
||||||
|
if [ ! -f "$KEY_PATH" ]; then
|
||||||
|
echo "Erstelle SSH-Schlüssel..."
|
||||||
|
ssh-keygen -t rsa -b 4096 -N "" -f "$KEY_PATH"
|
||||||
|
else
|
||||||
|
echo "SSH-Schlüssel existieren bereits."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren des öffentlichen Schlüssels zur NAS
|
||||||
|
copy_ssh_key_to_nas() {
|
||||||
|
echo "Kopiere den öffentlichen Schlüssel zur NAS..."
|
||||||
|
#cat ${KEY_PATH}.pub | ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||||
|
cat ${KEY_PATH}.pub | sshpass -p "$SYNOLOGY_PASSWORD" ssh -o StrictHostKeyChecking=no $SYNOLOGY_USERNAME@$SYNOLOGY_HOST "tee -a $NAS_HOME/.ssh/authorized_keys && chmod 600 $NAS_HOME/.ssh/authorized_keys"
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Öffentlicher Schlüssel erfolgreich zur NAS kopiert."
|
||||||
|
else
|
||||||
|
echo "Fehler beim Kopieren des öffentlichen Schlüssels zur NAS."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren der Datei von der NAS zum lokalen Rechner
|
||||||
|
copy_file_from_nas() {
|
||||||
|
echo "Kopiere die Datei von der NAS zum lokalen Rechner..."
|
||||||
|
scp -i "$KEY_PATH" $SYNOLOGY_USERNAME@SYNOLOGY_HOST:$NAS_HOME "$KEY_PATH"
|
||||||
|
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Datei erfolgreich kopiert."
|
||||||
|
else
|
||||||
|
echo "Fehler beim Kopieren der Datei."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
# Funktion zum Ermitteln des Betriebssystems
|
||||||
|
detect_os() {
|
||||||
|
echo "Das installierte Derivat wird ermittelt...."
|
||||||
|
OS=$(uname -s)
|
||||||
|
|
||||||
|
case $OS in
|
||||||
|
Linux*)
|
||||||
|
# Überprüfen, ob lsb_release verfügbar ist
|
||||||
|
if command -v lsb_release &> /dev/null; then
|
||||||
|
# Verwende lsb_release, wenn es verfügbar ist
|
||||||
|
distro=$(lsb_release -si)
|
||||||
|
version=$(lsb_release -sr)
|
||||||
|
codename=$(lsb_release -sc)
|
||||||
|
else
|
||||||
|
# Überprüfe /etc/os-release
|
||||||
|
if [ -f /etc/os-release ]; then
|
||||||
|
. /etc/os-release
|
||||||
|
distro=$NAME
|
||||||
|
version=$VERSION_ID
|
||||||
|
codename=$VERSION_CODENAME
|
||||||
|
# Überprüfe /etc/lsb-release
|
||||||
|
elif [ -f /etc/lsb-release ]; then
|
||||||
|
. /etc/lsb-release
|
||||||
|
distro=$DISTRIB_ID
|
||||||
|
version=$DISTRIB_RELEASE
|
||||||
|
codename=$DISTRIB_CODENAME
|
||||||
|
# Überprüfe /etc/debian_version
|
||||||
|
elif [ -f /etc/debian_version ]; then
|
||||||
|
distro="Debian"
|
||||||
|
version=$(cat /etc/debian_version)
|
||||||
|
codename=$(uname -r)
|
||||||
|
# Überprüfe /etc/redhat-release
|
||||||
|
elif [ -f /etc/redhat-release ]; then
|
||||||
|
distro=$(cat /etc/redhat-release)
|
||||||
|
version=$(uname -r)
|
||||||
|
codename=$(uname -r)
|
||||||
|
else
|
||||||
|
distro="Unbekannte Distribution"
|
||||||
|
version="Unbekannte Version"
|
||||||
|
codename="Unbekannter Codename"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
# Ausgabe der ermittelten Informationen
|
||||||
|
echo "\n\n"
|
||||||
|
echo "Distribution: $distro"
|
||||||
|
echo "Version: $version"
|
||||||
|
echo "Codename: $codename"
|
||||||
|
echo "\n\n"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unsupported OS: $OS"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
echo "${distro} wurde ....... Ausgewählt......."
|
||||||
|
}
|
||||||
|
install_requierments(){
|
||||||
|
echo "Erstellen des Zertifikatsrequests..."
|
||||||
|
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||||
|
apt install sudo sshpass nfs-common -y
|
||||||
|
;;
|
||||||
|
CentOS)
|
||||||
|
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||||
|
dnf install sudo sshpass nfs-utils -y
|
||||||
|
;;
|
||||||
|
"Red Hat Enterprise Linux")
|
||||||
|
echo "" Alle Noetigen Kompomenten werden Installiert....
|
||||||
|
dnf install sudo sshpass nfs-utils -y
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
# Funktion zum Erstellen des Zertifikatsrequests
|
||||||
|
create_certificate_request() {
|
||||||
|
echo "Erstellen des Zertifikatsrequests..."
|
||||||
|
echo " Funktion create_certificate_request() wert der Variable distro: $distro"
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
apt install sudo sshpass nfs-common -y
|
||||||
|
# Debian / Ubuntu spezifische Pfade
|
||||||
|
#KEY_DIR="/etc/ssl/private/"
|
||||||
|
# Erstellen des privaten Schlüssels
|
||||||
|
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||||
|
echo "Privater Schlüssel wurde erstellt: private.key"
|
||||||
|
# CSR erstellen
|
||||||
|
#CSR_DIR="/tmp"
|
||||||
|
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=${O}/OU=${OU}/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||||
|
echo "Zertifikatsrequest wurde erstellt: request.csr"
|
||||||
|
# CSR anzeigen
|
||||||
|
echo "Inhalt des erstellten Zertifikatsrequests: DEBIAN|UBUNTU......."
|
||||||
|
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||||
|
;;
|
||||||
|
CentOS)
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
#KEY_DIR="/etc/pki/tls/private/"
|
||||||
|
# Erstellen des privaten Schlüssels
|
||||||
|
openssl genrsa -out "${KEY_DIR}KEY_${HOST_FQDN}.pem" 4096
|
||||||
|
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||||
|
# CSR erstellen
|
||||||
|
#CSR_DIR="/tmp"
|
||||||
|
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||||
|
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||||
|
# CSR anzeigen
|
||||||
|
echo "Inhalt des erstellten Zertifikatsrequests: CENTOS....."
|
||||||
|
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||||
|
;;
|
||||||
|
"Red Hat Enterprise Linux")
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
#KEY_DIR="/etc/pki/tls/private/"
|
||||||
|
# Erstellen des privaten Schlüssels
|
||||||
|
openssl genrsa -out "${KEY_DIR}/KEY_${HOST_FQDN}.pem" 4096
|
||||||
|
echo "Privater Schlüssel wurde erstellt und gespeichert unter: ${KEY_DIR}KEY_${HOST_FQDN}.key"
|
||||||
|
# CSR erstellen
|
||||||
|
#CSR_DIR="/tmp"
|
||||||
|
openssl req -new -key "${KEY_DIR}/KEY_${HOST_FQDN}.pem" -out "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -subj "/C=DE/ST=TH/L=ILM/O=HEIMLAN/OU=HEIMLAN/CN=${HOST_FQDN}/emailAddress=admin@$DOMAIN"
|
||||||
|
echo "Zertifikatsrequest wurde erstellt und gespeichert unter: ${CSR_DIR}/CSR_${HOST_FQDN}.csr"
|
||||||
|
# CSR anzeigen
|
||||||
|
echo "Inhalt des erstellten Zertifikatsrequests: RHEL ....."
|
||||||
|
openssl req -in "${CSR_DIR}/CSR_${HOST_FQDN}.csr" -text -noout
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Das Betriebssystem wird nicht unterstützt für Zertifikatsrequest.";;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen des SSH-Schlüsselpaars und Hinzufügen zur Synology
|
||||||
|
setup_ssh_keys() {
|
||||||
|
echo "=== Einrichten von SSH-Schlüsseln ==="
|
||||||
|
|
||||||
|
# Überprüfen, ob der private Schlüssel bereits vorhanden ist
|
||||||
|
if [ ! -f "${SSH_PRIVATE_KEY}" ]; then
|
||||||
|
echo "Erstelle SSH-Schlüsselpaar..."
|
||||||
|
ssh-keygen -t rsa -b 4096 -f "${SSH_PRIVATE_KEY}" -N "" -C "Synology SSH key"
|
||||||
|
echo "SSH-Schlüsselpaar wurde erstellt: ${SSH_PRIVATE_KEY}"
|
||||||
|
else
|
||||||
|
echo "SSH-Schlüsselpaar ist bereits vorhanden: ${SSH_PRIVATE_KEY}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# SSH-Schlüssel zur Synology hinzufügen
|
||||||
|
echo "Füge den öffentlichen Schlüssel zur Synology hinzu..."
|
||||||
|
ssh-copy-id -i "${SSH_PRIVATE_KEY}.pub" "${SYNOLOGY_USER}@${SYNOLOGY_HOST}"
|
||||||
|
echo "Öffentlicher Schlüssel wurde zur Synology hinzugefügt."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Hochladen des Requests zur Synology
|
||||||
|
upload_certificate_request() {
|
||||||
|
echo "Hochladen des Zertifikatsrequests zur Synology..."
|
||||||
|
# Mounten der NFS-Freigabe mit Benutzername und Passwort
|
||||||
|
sudo mkdir -p ${NFS_MOUNT}
|
||||||
|
echo "sudo mkdir $NFS_MOUNT"
|
||||||
|
#sudo mkdir -p ${NFS_MOUNT}
|
||||||
|
#sleep 10
|
||||||
|
#ls /mnt/CSR/
|
||||||
|
#sudo mount -t nfs -o username="${SYNOLOGY_USER}",password="${SYNOLOGY_PASSWORD}" "${SYNOLOGY_HOST}:${REMOTE_DIR}/$HOST_NORMAL/CSR" "${NFS_MOUNT}"
|
||||||
|
sudo mount -t nfs -o nfsvers=3 "${SYNOLOGY_HOST}:${REMOTE_DIR}" "${NFS_MOUNT}"
|
||||||
|
ls -lha /mnt/CSR/
|
||||||
|
#echo "TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||||
|
#sleep 30
|
||||||
|
# Überprüfen, ob das Mount erfolgreich war
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "NFS-Freigabe erfolgreich eingebunden: ${NFS_MOUNT}"
|
||||||
|
# Kopieren der Datei auf die NFS-Freigabe
|
||||||
|
ls -lha /mnt/CSR/
|
||||||
|
sleep 5
|
||||||
|
sudo cp "${CSR_DIR}/CSR_${HOST_FQDN}.csr" "${NFS_MOUNT}/${HOST_FQDN}/CSR/"
|
||||||
|
sudo cp "${KEY_DIR}/KEY_${HOST_FQDN}.pem" "${NFS_MOUNT}/${HOST_FQDN}/KEY/"
|
||||||
|
sleep 5
|
||||||
|
ls -lha /mnt/CSR/
|
||||||
|
echo "Datei erfolgreich auf die NFS-Freigabe hochgeladen."
|
||||||
|
#echo "2. TEST WARTE ZEIT 30 SEKUNDEN......"
|
||||||
|
#sleep 30
|
||||||
|
else
|
||||||
|
echo "Fehler beim Einbinden der NFS-Freigabe: ${NFS_MOUNT}"
|
||||||
|
fi
|
||||||
|
echo "Zertifikatsrequest wurde zur Synology hochgeladen."
|
||||||
|
}
|
||||||
|
umountNFS(){
|
||||||
|
# NFS-Freigabe wieder aushängen
|
||||||
|
sudo umount "${NFS_MOUNT}"
|
||||||
|
cd /mnt
|
||||||
|
rmdir CSR/
|
||||||
|
echo "NFS-Freigabe erfolgreich ausgehängt."
|
||||||
|
}
|
||||||
|
# Funktion zum Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat
|
||||||
|
download_certificates() {
|
||||||
|
echo "Herunterladen von Root-Zertifikat, Sub-CA-Zertifikat und Server-Zertifikat..."
|
||||||
|
echo "=== Überprüfen und Herunterladen der Datei von der Synology ==="
|
||||||
|
|
||||||
|
# SSH-Befehl, um die Existenz der Datei auf der Synology zu überprüfen
|
||||||
|
ssh -i "$KEY_PATH" "${SYNOLOGY_USERNAME}@${SYNOLOGY_HOST}" test -f "${REMOTE_DIR}/${HOST_FQDN}/CERT/$SERVER_CERT"
|
||||||
|
|
||||||
|
# Prüfen des Rückgabewerts von test (-f) und Entscheidung treffen
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Datei CERT_${HOST_FQDN}.crt auf der Synology gefunden. Beginne mit dem Download..."
|
||||||
|
cp "${NFS_MOUNT}/${HOST_FQDN}/CERT/$SERVER_CERT" "${TMP}/$SERVER_CERT"
|
||||||
|
cp "${NFS_MOUNT}/RootCA/$ROOT_CERT" "${TMP}/$ROOT_CERT"
|
||||||
|
cp "${NFS_MOUNT}/SubCA/$SUBCA_CERT" "${TMP}/$SUBCA_CERT"
|
||||||
|
echo "Datei erfolgreich heruntergeladen nach ${TMP}"
|
||||||
|
else
|
||||||
|
#echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||||
|
#sleep 300
|
||||||
|
echo "Datei $SERVER_CERT nicht auf der Synology gefunden. Warte 300 Sekunden..."
|
||||||
|
|
||||||
|
# Timer mit Countdown anzeigen
|
||||||
|
for ((i=300; i>0; i--)); do
|
||||||
|
echo -ne "Noch $i Sekunden warten...\r"
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
download_certificates # Rekursiver Aufruf, um erneut zu prüfen
|
||||||
|
fi
|
||||||
|
echo "Zertifikate wurden heruntergeladen."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen des Full-Chain-Zertifikats und Umbenennen
|
||||||
|
create_fullchain_certificate() {
|
||||||
|
echo "Erstellen des Full-Chain-Zertifikats..."
|
||||||
|
# Zielpfad für das Full-Chain-Zertifikat
|
||||||
|
FULLCHAIN_CERT="/tmp/fullchain.crt"
|
||||||
|
|
||||||
|
# Full-Chain-Zertifikat erstellen
|
||||||
|
cat "$TMP/$SERVER_CERT" "$TMP/$SUBCA_CERT" "$TMP/$ROOT_CERT" > "$FULLCHAIN_CERT"
|
||||||
|
|
||||||
|
echo "Full-Chain-Zertifikat wurde erstellt: $FULLCHAIN_CERT"
|
||||||
|
|
||||||
|
# Server-Zertifikat nach Hostnamen benennen
|
||||||
|
HOSTNAME=$(hostname)
|
||||||
|
mv "$FULLCHAIN_CERT" "$TMP/fullchain_$HOST_FQDN.crt"
|
||||||
|
|
||||||
|
echo "Full-Chain-Zertifikat umbenannt zu fullchain_$HOST_FQDN.crt"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach Derivat und Typ
|
||||||
|
copy_certificates() {
|
||||||
|
echo "Kopieren der Zertifikate in die richtigen Pfade..."
|
||||||
|
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
# Debian / Ubuntu spezifische Pfade
|
||||||
|
SSL_DIR="/usr/local/share/ca-certificates/"
|
||||||
|
KEY_STORE="usr/local/share/ca-certificates/"
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||||
|
# Server Key kopieren
|
||||||
|
cp "$TMP/KEY_${HOST_FQDN}.pem" "$KEY_STORE/KEY_${HOST_FQDN}.pem"
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR kopiert."
|
||||||
|
update-ca-certificates
|
||||||
|
;;
|
||||||
|
CentOS|"Red Hat Enterprise Linux")
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
SSL_DIR="/etc/pki/tls/certs/"
|
||||||
|
KEY_STORE="etc/pki/tls/private/"
|
||||||
|
PKI_DIR="/etc/pki/ca-trust/source/anchors/"
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR/$ROOT_CERT"
|
||||||
|
cp "$TMP/$ROOT_CERT" "$PKI_DIR/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR/$SUBCA_CERT"
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$PKI_DIR/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR/$SERVER_CERT"
|
||||||
|
cp "$TMP/$SERVER_CERT" "$PKI_DIR/$SERVER_CERT"
|
||||||
|
# Server Key kopieren
|
||||||
|
cp "$TMP/KEY_${HOST_FQDN}.pem" "$KEY_STORE/KEY_${HOST_FQDN}.pem"
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR und nach $PKI_DIR kopiert."
|
||||||
|
update-ca-trust
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Das Betriebssystem $OS wird nicht unterstützt für Zertifikate-Kopieren."
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren der Zertifikate in die richtigen Pfade je nach WebServer Ty
|
||||||
|
copy_web_certificates() {
|
||||||
|
echo "Kopieren der Zertifikate in die richtigen Pfade und Aktualisieren der Konfigurationsdateien..."
|
||||||
|
|
||||||
|
case $distro in
|
||||||
|
Debian|Ubuntu)
|
||||||
|
# Debian / Ubuntu spezifische Pfade
|
||||||
|
SSL_DIR_APACHE="/etc/ssl/certs/"
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
|
||||||
|
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||||
|
SSL_DIR_APACHE="/etc/apache2/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||||
|
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||||
|
|
||||||
|
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||||
|
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
CentOS|"Red Hat Enterprise Linux")
|
||||||
|
# CentOS spezifische Pfade
|
||||||
|
SSL_DIR_APACHE="/etc/pki/tls/certs/"
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
|
||||||
|
# Prüfen, ob Apache installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||||
|
SSL_DIR_APACHE="/etc/httpd/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Prüfen, ob Nginx installiert ist und den SSL-Pfad anpassen
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
SSL_DIR_NGINX="/etc/nginx/ssl/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Root-Zertifikat kopieren
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_APACHE/$ROOT_CERT"
|
||||||
|
cp "$TMP/$ROOT_CERT" "$SSL_DIR_NGINX/$ROOT_CERT"
|
||||||
|
# Sub-CA-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_APACHE/$SUBCA_CERT"
|
||||||
|
cp "$TMP/$SUBCA_CERT" "$SSL_DIR_NGINX/$SUBCA_CERT"
|
||||||
|
# Server-Zertifikat kopieren
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_CERT"
|
||||||
|
cp "$TMP/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_CERT"
|
||||||
|
|
||||||
|
echo "Zertifikate wurden nach $SSL_DIR_APACHE und $SSL_DIR_NGINX kopiert."
|
||||||
|
|
||||||
|
# Aktualisieren der Apache-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||||
|
update_apache_config "$SSL_DIR_APACHE/$SERVER_CERT" "$SSL_DIR_APACHE/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Aktualisieren der Nginx-Konfiguration, falls vorhanden
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
update_nginx_config "$SSL_DIR_NGINX/$SERVER_CERT" "$SSL_DIR_NGINX/$SERVER_KEY"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Es ist kein WEbServer auf diesen System Installiert"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Aktualisieren der Apache-Konfiguration
|
||||||
|
update_apache_config() {
|
||||||
|
local cert_file="$1"
|
||||||
|
local key_file="$2"
|
||||||
|
|
||||||
|
echo "Aktualisiere Apache-Konfiguration für SSL-Zertifikate..."
|
||||||
|
|
||||||
|
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||||
|
local apache_config_file=$(find /etc/apache2 -name "ssl.conf" -o -name "httpd.conf" 2>/dev/null | head -1)
|
||||||
|
if [ -n "$apache_config_file" ]; then
|
||||||
|
# SSLCertificateFile aktualisieren
|
||||||
|
sed -i "s|^\( *SSLCertificateFile *\).*|\1$cert_file|" "$apache_config_file"
|
||||||
|
# SSLCertificateKeyFile aktualisieren
|
||||||
|
sed -i "s|^\( *SSLCertificateKeyFile *\).*|\1$key_file|" "$apache_config_file"
|
||||||
|
echo "Apache-Konfiguration aktualisiert."
|
||||||
|
else
|
||||||
|
echo "Apache-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Aktualisieren der Nginx-Konfiguration
|
||||||
|
update_nginx_config() {
|
||||||
|
local cert_file="$1"
|
||||||
|
local key_file="$2"
|
||||||
|
|
||||||
|
echo "Aktualisiere Nginx-Konfiguration für SSL-Zertifikate..."
|
||||||
|
|
||||||
|
# Konfigurationsdatei für SSL-Zertifikate finden und bearbeiten
|
||||||
|
local nginx_config_file="/etc/nginx/nginx.conf"
|
||||||
|
if [ -f "$nginx_config_file" ]; then
|
||||||
|
# SSL Zertifikat und Key aktualisieren
|
||||||
|
sed -i "s|^\( *ssl_certificate *\).*|\1$cert_file;|" "$nginx_config_file"
|
||||||
|
sed -i "s|^\( *ssl_certificate_key *\).*|\1$key_file;|" "$nginx_config_file"
|
||||||
|
echo "Nginx-Konfiguration aktualisiert."
|
||||||
|
else
|
||||||
|
echo "Nginx-Konfigurationsdatei nicht gefunden oder nicht aktualisiert."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Ermitteln des installierten Webserver-Dienstes
|
||||||
|
detect_webserver() {
|
||||||
|
if [ -f "/etc/apache2/apache2.conf" ]; then
|
||||||
|
echo "Apache Webserver ist installiert."
|
||||||
|
fi
|
||||||
|
if [ -f "/etc/httpd/conf/httpd.conf" ]; then
|
||||||
|
echo "Apache Webserver ist installiert."
|
||||||
|
fi
|
||||||
|
if [ -f "/etc/nginx/nginx.conf" ]; then
|
||||||
|
echo "Nginx Webserver ist installiert."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
echo
|
||||||
|
# Hauptprogramm
|
||||||
|
detect_os
|
||||||
|
install_requierments
|
||||||
|
generate_ssh_key
|
||||||
|
copy_ssh_key_to_nas
|
||||||
|
create_certificate_request
|
||||||
|
create_remote_folders
|
||||||
|
#Wird nicht genutz
|
||||||
|
#setup_ssh_keys
|
||||||
|
upload_certificate_request
|
||||||
|
download_certificates
|
||||||
|
create_fullchain_certificate
|
||||||
|
copy_certificates
|
||||||
|
|
||||||
|
# Funktionen fue WebServer Zertifiakte
|
||||||
|
detect_webserver
|
||||||
|
copy_web_certificates
|
||||||
|
#umountNFS
|
||||||
|
echo "Prozess abgeschlossen."
|
||||||
Binary file not shown.
Executable
+177
@@ -0,0 +1,177 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Globale Variablen
|
||||||
|
#HOSTNAME=$(hostname -f | tr '[:lower:]' '[:upper:]') # FQDN in Großbuchstaben
|
||||||
|
HOSTNAME=$(hostname -f)
|
||||||
|
NETBIOS=$(hostname)
|
||||||
|
DOMAIN=$(hostname -d | cut -d'.' -f1 | tr '[:lower:]' '[:upper:]') # Kurze Domain in Großbuchstaben
|
||||||
|
REALM="${DOMAIN^^}.HEIM.LAN" # Realm in Großbuchstaben, muss die gesamte Domain sein
|
||||||
|
IP_ADDRESS=$(hostname -I | awk '{print $1}')
|
||||||
|
PASSWORD="P@ssw0rd" # Globale Variable für das Administrator-Passwort
|
||||||
|
ERROR_LOG="/var/log/samba_install_error.log"
|
||||||
|
|
||||||
|
# Zertifikat-Pfade
|
||||||
|
tls_keyfile="/etc/samba/tls/private/KEY_${HOSTNAME}.pem"
|
||||||
|
tls_certfile="/etc/samba/tls/certs/fullchain_${HOSTNAME}.crt"
|
||||||
|
tls_cafile="/etc/samba/tls/certs/CERT_HEIMLAN_SubCA.crt"
|
||||||
|
|
||||||
|
# ROOT and SubCa
|
||||||
|
ROOT_CRT="CERT_HEIMLAN_RootCA.crt"
|
||||||
|
SUBCA_CRT="CERT_HEIMLAN_SubCA.crt"
|
||||||
|
# Funktion zum Beenden des Skripts bei einem Fehler
|
||||||
|
error_exit() {
|
||||||
|
echo "$1" | tee -a $ERROR_LOG
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Kopieren der Zertifikate und Schlüssel in das entsprechende Verzeichnis
|
||||||
|
copy_certs_key() {
|
||||||
|
mkdir -p /etc/samba/tls/certs /etc/samba/tls/private || error_exit "Fehler beim Erstellen der Verzeichnisse für Zertifikate und Schlüssel"
|
||||||
|
|
||||||
|
# Kopieren der Zertifikate und Schlüssel
|
||||||
|
cp /tmp/$ROOT_CRT /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||||
|
cp /tmp/$SUBCA_CRT /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||||
|
cp /tmp/CERT_${HOSTNAME}.crt /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Zertifikats"
|
||||||
|
cp /tmp/fullchain_${HOSTNAME}.crt /etc/samba/tls/certs || error_exit "Fehler beim Kopieren des Fullchain-Zertifikats"
|
||||||
|
cp /tmp/KEY_${HOSTNAME}.pem /etc/samba/tls/private || error_exit "Fehler beim Kopieren des Schlüssels"
|
||||||
|
|
||||||
|
# Setzen der Berechtigungen
|
||||||
|
chmod 644 /etc/samba/tls/certs/* || error_exit "Fehler beim Setzen der Berechtigungen für Zertifikate"
|
||||||
|
chmod 600 /etc/samba/tls/private/* || error_exit "Fehler beim Setzen der Berechtigungen für Schlüssel"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Aktualisieren und Installieren von Paketen
|
||||||
|
install_packages() {
|
||||||
|
apt-get update || error_exit "Fehler beim Ausführen von apt-get update"
|
||||||
|
apt-get upgrade -y || error_exit "Fehler beim Ausführen von apt-get upgrade"
|
||||||
|
apt-get install -y samba samba-common-bin krb5-user krb5-config winbind libnss-winbind libpam-winbind dnsutils bind9 bind9utils bind9-doc || error_exit "Fehler beim Installieren der Pakete"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Sichern von Konfigurationsdateien
|
||||||
|
backup_configs() {
|
||||||
|
[ -f /etc/samba/smb.conf ] && mv /etc/samba/smb.conf /etc/samba/smb.conf.orig || error_exit "Fehler beim Sichern der smb.conf"
|
||||||
|
[ -f /etc/krb5.conf ] && mv /etc/krb5.conf /etc/krb5.conf.orig || error_exit "Fehler beim Sichern der krb5.conf"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen der Samba-Konfiguration
|
||||||
|
create_samba_config() {
|
||||||
|
cat <<EOL > /etc/samba/smb.conf || error_exit "Fehler beim Schreiben der smb.conf"
|
||||||
|
[global]
|
||||||
|
workgroup = $DOMAIN
|
||||||
|
bind interfaces only = Yes
|
||||||
|
interfaces = $IP_ADDRESS
|
||||||
|
realm = $REALM
|
||||||
|
netbios name = $NETBIOS
|
||||||
|
server role = active directory domain controller
|
||||||
|
idmap_ldb:use rfc2307 = yes
|
||||||
|
server services = -dns
|
||||||
|
|
||||||
|
# TLS SETTING
|
||||||
|
tls enabled = yes
|
||||||
|
tls keyfile = $tls_keyfile
|
||||||
|
tls certfile = $tls_certfile
|
||||||
|
tls cafile = $tls_cafile
|
||||||
|
|
||||||
|
# LOGGING SETTING
|
||||||
|
log level = 1
|
||||||
|
log file = /var/log/samba/log.%m
|
||||||
|
max log size = 1000
|
||||||
|
|
||||||
|
# UNIX PASSWORD SETTING
|
||||||
|
unix password sync = yes
|
||||||
|
|
||||||
|
[sysvol]
|
||||||
|
path = /var/lib/samba/sysvol
|
||||||
|
read only = no
|
||||||
|
|
||||||
|
[netlogon]
|
||||||
|
path = /var/lib/samba/sysvol/${DOMAIN}/scripts
|
||||||
|
read only = no
|
||||||
|
EOL
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Erstellen der Kerberos-Konfiguration
|
||||||
|
create_kerberos_config() {
|
||||||
|
cat <<EOL > /etc/krb5.conf || error_exit "Fehler beim Schreiben der krb5.conf"
|
||||||
|
[libdefaults]
|
||||||
|
default_realm = $REALM
|
||||||
|
dns_lookup_realm = true
|
||||||
|
dns_lookup_kdc = true
|
||||||
|
ticket_lifetime = 24h
|
||||||
|
renew_lifetime = 7d
|
||||||
|
forwardable = true
|
||||||
|
|
||||||
|
[realms]
|
||||||
|
$REALM = {
|
||||||
|
default_domain = $(hostname -d)
|
||||||
|
# pkinit_anchors = /etc/samba/tls/certs/CERT_HEIMLAN_Root.crt
|
||||||
|
kdc = $(hostname -f)
|
||||||
|
admin_server = $(hostname -f)
|
||||||
|
}
|
||||||
|
|
||||||
|
[domain_realm]
|
||||||
|
.$(hostname -d) = $REALM
|
||||||
|
$(hostname -d) = $REALM
|
||||||
|
EOL
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Provisionieren von Samba
|
||||||
|
provision_samba() {
|
||||||
|
samba-tool domain provision --use-rfc2307 --realm=$REALM --domain=${DOMAIN} --server-role=dc --adminpass=$PASSWORD --dns-backend=BIND9_DLZ || error_exit "Fehler beim Provisionieren der Samba-Domäne"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Konfigurieren von Bind9 für DLZ
|
||||||
|
configure_bind9() {
|
||||||
|
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.orig || error_exit "Fehler beim Sichern der named.conf.options"
|
||||||
|
cp /etc/bind/named.conf.local /etc/bind/named.conf.local.orig || error_exit "Fehler beim Sichern der named.conf.local"
|
||||||
|
|
||||||
|
cat <<EOL > /etc/bind/named.conf.options || error_exit "Fehler beim Schreiben der named.conf.options"
|
||||||
|
options {
|
||||||
|
directory "/var/cache/bind";
|
||||||
|
|
||||||
|
forwarders {
|
||||||
|
8.8.8.8; # Google DNS
|
||||||
|
};
|
||||||
|
|
||||||
|
dnssec-validation auto;
|
||||||
|
auth-nxdomain no; # conform to RFC1035
|
||||||
|
listen-on-v6 { any; };
|
||||||
|
};
|
||||||
|
EOL
|
||||||
|
|
||||||
|
cat <<EOL > /etc/bind/named.conf.local || error_exit "Fehler beim Schreiben der named.conf.local"
|
||||||
|
include "/var/lib/samba/bind-dns/named.conf";
|
||||||
|
EOL
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Setzen der Berechtigungen für Bind9 DLZ
|
||||||
|
set_bind9_permissions() {
|
||||||
|
mkdir /var/lib/samba/private/dns
|
||||||
|
chown bind:bind /var/lib/samba/bind-dns/named.conf || error_exit "Fehler beim Setzen der Berechtigungen für named.conf"
|
||||||
|
chown -R bind:bind /var/lib/samba/private/dns || error_exit "Fehler beim Setzen der Berechtigungen für das DNS-Verzeichnis"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion zum Neustarten der Dienste
|
||||||
|
restart_services() {
|
||||||
|
systemctl restart smbd nmbd winbind bind9 || error_exit "Fehler beim Neustarten der Dienste"
|
||||||
|
systemctl enable smbd nmbd winbind bind9 || error_exit "Fehler beim Aktivieren der Dienste"
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# Hauptfunktion zum Ausführen aller Schritte
|
||||||
|
main() {
|
||||||
|
copy_certs_key
|
||||||
|
install_packages
|
||||||
|
backup_configs
|
||||||
|
create_samba_config
|
||||||
|
create_kerberos_config
|
||||||
|
provision_samba
|
||||||
|
configure_bind9
|
||||||
|
set_bind9_permissions
|
||||||
|
restart_services
|
||||||
|
|
||||||
|
echo "Samba AD DC mit Bind9-DLZ Installation abgeschlossen."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Ausführen der Hauptfunktion
|
||||||
|
main
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
+141
@@ -0,0 +1,141 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Variablenblock
|
||||||
|
NEXTCLOUD_VERSION="29.0.7"
|
||||||
|
DB_NAME="nextcloud"
|
||||||
|
DB_USER="nextclouduser"
|
||||||
|
DB_PASSWORD=$(openssl rand -base64 32)
|
||||||
|
DB_ROOT_PASSWORD=$(openssl rand -base64 32)
|
||||||
|
NEXTCLOUD_DIR="/var/www/nextcloud"
|
||||||
|
SSL_CERT_FILE="/etc/ssl/certs/nextcloud-cert.pem"
|
||||||
|
SSL_KEY_FILE="/etc/ssl/private/nextcloud-key.pem"
|
||||||
|
DOMAIN="nextcloud.example.com"
|
||||||
|
APACHE_CONF="/etc/apache2/sites-available/nextcloud.conf"
|
||||||
|
|
||||||
|
# Funktion: Update und Installiere benötigte Pakete
|
||||||
|
install_dependencies() {
|
||||||
|
echo "System aktualisieren und benötigte Pakete installieren..."
|
||||||
|
apt update && apt upgrade -y
|
||||||
|
apt install -y apache2 mariadb-server libapache2-mod-php php php-mysql php-xml php-mbstring php-zip php-gd php-curl php-intl php-bcmath php-imagick php-gmp php-apcu unzip wget curl
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion: MariaDB konfigurieren
|
||||||
|
configure_mariadb() {
|
||||||
|
echo "MariaDB einrichten..."
|
||||||
|
systemctl start mariadb
|
||||||
|
systemctl enable mariadb
|
||||||
|
|
||||||
|
mysql -e "CREATE DATABASE ${DB_NAME};"
|
||||||
|
mysql -e "CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';"
|
||||||
|
mysql -e "GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';"
|
||||||
|
mysql -e "FLUSH PRIVILEGES;"
|
||||||
|
|
||||||
|
# Root Passwort setzen
|
||||||
|
mysqladmin -u root password "${DB_ROOT_PASSWORD}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion: SSL-Zertifikate konfigurieren
|
||||||
|
configure_ssl() {
|
||||||
|
echo "SSL Zertifikate konfigurieren..."
|
||||||
|
if [[ ! -f "$SSL_CERT_FILE" || ! -f "$SSL_KEY_FILE" ]]; then
|
||||||
|
echo "SSL-Zertifikate nicht gefunden, bitte überprüfen!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
a2enmod ssl
|
||||||
|
systemctl restart apache2
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion: Nextcloud herunterladen und installieren
|
||||||
|
install_nextcloud() {
|
||||||
|
echo "Nextcloud herunterladen und installieren..."
|
||||||
|
wget https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.zip
|
||||||
|
unzip nextcloud-${NEXTCLOUD_VERSION}.zip -d /var/www/
|
||||||
|
chown -R www-data:www-data ${NEXTCLOUD_DIR}
|
||||||
|
chmod -R 755 ${NEXTCLOUD_DIR}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion: Apache konfigurieren
|
||||||
|
configure_apache() {
|
||||||
|
echo "Apache für Nextcloud konfigurieren..."
|
||||||
|
|
||||||
|
cat <<EOF > ${APACHE_CONF}
|
||||||
|
<VirtualHost *:80>
|
||||||
|
ServerAdmin admin@${DOMAIN}
|
||||||
|
DocumentRoot ${NEXTCLOUD_DIR}
|
||||||
|
ServerName ${DOMAIN}
|
||||||
|
|
||||||
|
<Directory ${NEXTCLOUD_DIR}>
|
||||||
|
AllowOverride All
|
||||||
|
Require all granted
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
ErrorLog \${APACHE_LOG_DIR}/error.log
|
||||||
|
CustomLog \${APACHE_LOG_DIR}/access.log combined
|
||||||
|
|
||||||
|
RewriteEngine on
|
||||||
|
RewriteCond %{SERVER_NAME} =${DOMAIN}
|
||||||
|
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
|
||||||
|
</VirtualHost>
|
||||||
|
|
||||||
|
<VirtualHost *:443>
|
||||||
|
ServerAdmin admin@${DOMAIN}
|
||||||
|
DocumentRoot ${NEXTCLOUD_DIR}
|
||||||
|
ServerName ${DOMAIN}
|
||||||
|
|
||||||
|
<Directory ${NEXTCLOUD_DIR}>
|
||||||
|
AllowOverride All
|
||||||
|
Require all granted
|
||||||
|
</Directory>
|
||||||
|
|
||||||
|
SSLEngine on
|
||||||
|
SSLCertificateFile ${SSL_CERT_FILE}
|
||||||
|
SSLCertificateKeyFile ${SSL_KEY_FILE}
|
||||||
|
|
||||||
|
ErrorLog \${APACHE_LOG_DIR}/error.log
|
||||||
|
CustomLog \${APACHE_LOG_DIR}/access.log combined
|
||||||
|
</VirtualHost>
|
||||||
|
EOF
|
||||||
|
|
||||||
|
a2ensite nextcloud.conf
|
||||||
|
a2enmod rewrite headers env dir mime
|
||||||
|
systemctl restart apache2
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion: Nextcloud über die Kommandozeile initialisieren
|
||||||
|
initialize_nextcloud() {
|
||||||
|
echo "Nextcloud initialisieren..."
|
||||||
|
|
||||||
|
sudo -u www-data php ${NEXTCLOUD_DIR}/occ maintenance:install \
|
||||||
|
--database "mysql" \
|
||||||
|
--database-name "${DB_NAME}" \
|
||||||
|
--database-user "${DB_USER}" \
|
||||||
|
--database-pass "${DB_PASSWORD}" \
|
||||||
|
--admin-user "admin" \
|
||||||
|
--admin-pass "$(openssl rand -base64 16)"
|
||||||
|
|
||||||
|
sudo -u www-data php ${NEXTCLOUD_DIR}/occ config:system:set trusted_domains 0 --value="${DOMAIN}"
|
||||||
|
sudo -u www-data php ${NEXTCLOUD_DIR}/occ config:system:set overwrite.cli.url --value="https://${DOMAIN}/"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Funktion: Firewall konfigurieren
|
||||||
|
configure_firewall() {
|
||||||
|
echo "Firewall konfigurieren..."
|
||||||
|
ufw allow in "Apache Full"
|
||||||
|
ufw enable
|
||||||
|
}
|
||||||
|
|
||||||
|
# Installation starten
|
||||||
|
main() {
|
||||||
|
install_dependencies
|
||||||
|
configure_mariadb
|
||||||
|
configure_ssl
|
||||||
|
install_nextcloud
|
||||||
|
configure_apache
|
||||||
|
initialize_nextcloud
|
||||||
|
configure_firewall
|
||||||
|
echo "Installation abgeschlossen. Besuchen Sie https://${DOMAIN}, um Ihre Nextcloud-Instanz zu nutzen."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Skript starten
|
||||||
|
main
|
||||||
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Executable
+87
@@ -0,0 +1,87 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Exit on any error
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
||||||
|
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
||||||
|
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
||||||
|
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
||||||
|
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
||||||
|
EXTERNAL_CA="true" # Setzt das Skript auf externe CA
|
||||||
|
PASSWORD="P@ssw0rd1234" # Admin-Passwort (in der Praxis sicher speichern)
|
||||||
|
DIRMAN_PASSWORD="P@ssw0rd12345" # Directory Manager Passwort
|
||||||
|
|
||||||
|
# Function to check if running as root
|
||||||
|
function check_root {
|
||||||
|
if [[ $EUID -ne 0 ]]; then
|
||||||
|
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to install the necessary packages
|
||||||
|
function install_packages {
|
||||||
|
echo "Installiere benötigte Pakete..."
|
||||||
|
# System aktualisieren
|
||||||
|
echo "Aktualisiere das System..."
|
||||||
|
sudo yum update -y
|
||||||
|
|
||||||
|
# Erforderliche Pakete installieren
|
||||||
|
echo "Installiere erforderliche Pakete..."
|
||||||
|
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||||
|
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||||
|
sudo dnf -y install @idm:DL1
|
||||||
|
|
||||||
|
# Erforderliche Pakete installieren
|
||||||
|
echo "Installiere erforderliche Pakete..."
|
||||||
|
sudo yum install -y ipa-server ipa-server-dns
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to install the IDM server
|
||||||
|
function install_idm_server {
|
||||||
|
echo "Installiere IdM-Server mit DNS..."
|
||||||
|
|
||||||
|
# Falls externe CA genutzt werden soll, aber keine eigene CA installiert wird
|
||||||
|
if [ "$EXTERNAL_CA" = "true" ]; then
|
||||||
|
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||||
|
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||||
|
--ip-address=$IP_ADDRESS --no-pkinit --external-ca \
|
||||||
|
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U
|
||||||
|
else
|
||||||
|
# Für den Fall, dass keine externe CA genutzt wird, aber dennoch ohne CA gearbeitet wird
|
||||||
|
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
||||||
|
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
||||||
|
--ip-address=$IP_ADDRESS --no-pkinit --setup-dns \
|
||||||
|
--auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to configure firewall
|
||||||
|
function configure_firewall {
|
||||||
|
echo "Konfiguriere Firewall..."
|
||||||
|
firewall-cmd --add-service=freeipa-ldap --permanent
|
||||||
|
firewall-cmd --add-service=freeipa-ldaps --permanent
|
||||||
|
firewall-cmd --add-service=freeipa-replication --permanent
|
||||||
|
firewall-cmd --add-service=freeipa-trust --permanent
|
||||||
|
firewall-cmd --add-service=dns --permanent
|
||||||
|
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
||||||
|
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
||||||
|
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
||||||
|
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
||||||
|
firewall-cmd --add-port=123/udp --permanent # NTP
|
||||||
|
firewall-cmd --reload
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main function
|
||||||
|
function main {
|
||||||
|
check_root
|
||||||
|
install_packages
|
||||||
|
install_idm_server
|
||||||
|
configure_firewall
|
||||||
|
echo "IdM-Server Installation abgeschlossen."
|
||||||
|
}
|
||||||
|
|
||||||
|
# Run the script
|
||||||
|
main
|
||||||
+556
@@ -0,0 +1,556 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
POSTGRES_USER=alfresco
|
||||||
|
POSTGRES_PASSWORD=alfresco
|
||||||
|
POSTGRES_DB=alfresco
|
||||||
|
|
||||||
|
JAVA_HOME=/usr/lib/jvm/java-17-openjdk
|
||||||
|
TOMCAT_VERSION=10.1.26
|
||||||
|
TOMCAT_USER=rheluser
|
||||||
|
TOMCAT_GROUP=rheluser
|
||||||
|
TOMCAT_HOME=/home/rheluser/tomcat
|
||||||
|
|
||||||
|
ACTIVEMQ_VERSION=5.18.5
|
||||||
|
ACTIVEMQ_USER=rheluser
|
||||||
|
ACTIVEMQ_GROUP=rheluser
|
||||||
|
ACTIVEMQ_HOME=/home/rheluser/activemq
|
||||||
|
|
||||||
|
SOLR_VERSION=2.0.9.1
|
||||||
|
SOLR_USER=rheluser
|
||||||
|
SOLR_GROUP=rheluser
|
||||||
|
SOLR_HOME=/home/rheluser/alfresco-search-services
|
||||||
|
|
||||||
|
TRANSFORM_JAR=alfresco-transform-core-aio-5.1.0.jar
|
||||||
|
TRANSFORM_USER=rheluser
|
||||||
|
TRANSFORM_GROUP=rheluser
|
||||||
|
TRANSFORM_HOME=/home/rheluser/transform
|
||||||
|
|
||||||
|
NODEJS_SETUP_URL="/root/RHEL_full_install_alfresco_addon.sh"
|
||||||
|
CONTENT_APP_REPO=https://github.com/Alfresco/alfresco-content-app.git
|
||||||
|
CONTENT_APP_VERSION=4.4.1
|
||||||
|
NGINX_CONF_PATH=/etc/nginx/conf.d/alfresco-content-app.conf
|
||||||
|
NGINX_ROOT=/var/www/alfresco-content-app
|
||||||
|
|
||||||
|
# Helper function to print and execute commands
|
||||||
|
execute() {
|
||||||
|
echo "$ $@"
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
# Anlegen des Users und Gruppe
|
||||||
|
user_add_and_group(){
|
||||||
|
execute sudo groupadd rheluser
|
||||||
|
execute sudo useradd -m -g rheluser rheluser
|
||||||
|
}
|
||||||
|
|
||||||
|
# Update and upgrade the system
|
||||||
|
00_update_system() {
|
||||||
|
echo "Updating system..."
|
||||||
|
execute sudo dnf update -y
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install PostgreSQL and configure database
|
||||||
|
01_install_postgresql() {
|
||||||
|
echo "Installing PostgreSQL..."
|
||||||
|
execute sudo dnf install -y postgresql-server postgresql-contrib
|
||||||
|
|
||||||
|
echo "Initializing PostgreSQL database..."
|
||||||
|
execute sudo postgresql-setup --initdb
|
||||||
|
|
||||||
|
echo "Configuring PostgreSQL..."
|
||||||
|
execute sudo sed -i 's/local\s\+all\s\+postgres\s\+peer/local all postgres trust/' /var/lib/pgsql/data/pg_hba.conf
|
||||||
|
execute sudo sed -i 's/local\s\+all\s\+all\s\+peer/local all all md5/' /var/lib/pgsql/data/pg_hba.conf
|
||||||
|
|
||||||
|
echo "Starting PostgreSQL service..."
|
||||||
|
execute sudo systemctl start postgresql
|
||||||
|
execute sudo systemctl enable postgresql
|
||||||
|
|
||||||
|
echo "Configuring Alfresco database..."
|
||||||
|
execute sudo -u postgres psql -c "CREATE USER ${POSTGRES_USER} WITH PASSWORD '$POSTGRES_PASSWORD';"
|
||||||
|
execute sudo -u postgres psql -c "CREATE DATABASE ${POSTGRES_DB} OWNER ${POSTGRES_USER} ENCODING 'UTF8';"
|
||||||
|
execute sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${POSTGRES_DB} TO ${POSTGRES_USER};"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install Java JDK 17
|
||||||
|
02_install_java() {
|
||||||
|
echo "Installing Java JDK 17..."
|
||||||
|
execute sudo dnf install -y java-17-openjdk
|
||||||
|
|
||||||
|
echo "Checking Java version..."
|
||||||
|
execute java -version
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install Apache Tomcat
|
||||||
|
03_install_tomcat() {
|
||||||
|
echo "Downloading and installing Apache Tomcat..."
|
||||||
|
execute wget https://dlcdn.apache.org/tomcat/tomcat-10/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz -O /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz
|
||||||
|
execute sudo mkdir -p $TOMCAT_HOME
|
||||||
|
execute sudo tar xzvf /tmp/apache-tomcat-$TOMCAT_VERSION.tar.gz -C $TOMCAT_HOME --strip-components=1
|
||||||
|
|
||||||
|
echo "Setting permissions for Tomcat directories..."
|
||||||
|
execute sudo chown -R $TOMCAT_USER:$TOMCAT_GROUP $TOMCAT_HOME
|
||||||
|
execute sudo chmod -R u+x $TOMCAT_HOME/bin
|
||||||
|
|
||||||
|
echo "Creating Tomcat systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/tomcat.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache Tomcat Web Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=$TOMCAT_USER
|
||||||
|
Group=$TOMCAT_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=$JAVA_HOME"
|
||||||
|
Environment="CATALINA_PID=$TOMCAT_HOME/temp/tomcat.pid"
|
||||||
|
Environment="CATALINA_HOME=$TOMCAT_HOME"
|
||||||
|
Environment="CATALINA_BASE=$TOMCAT_HOME"
|
||||||
|
Environment="CATALINA_OPTS=-Xms2048M -Xmx3072M -server -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
|
||||||
|
Environment="JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom"
|
||||||
|
Environment="JAVA_TOOL_OPTIONS=-Dencryption.keystore.type=JCEKS -Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding -Dencryption.keyAlgorithm=DESede -Dencryption.keystore.location=/home/rheluser/keystore/metadata-keystore/keystore -Dmetadata-keystore.password=mp6yc0UD9e -Dmetadata-keystore.aliases=metadata -Dmetadata-keystore.metadata.password=oKIWzVdEdA -Dmetadata-keystore.metadata.algorithm=DESede"
|
||||||
|
|
||||||
|
ExecStart=$TOMCAT_HOME/bin/startup.sh
|
||||||
|
ExecStop=$TOMCAT_HOME/bin/shutdown.sh
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
execute sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Tomcat service..."
|
||||||
|
execute sudo systemctl start tomcat
|
||||||
|
|
||||||
|
echo "Stopping Tomcat service..."
|
||||||
|
execute sudo systemctl stop tomcat
|
||||||
|
|
||||||
|
echo "Enabling Tomcat service to start on boot..."
|
||||||
|
execute sudo systemctl enable tomcat
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install Apache ActiveMQ
|
||||||
|
04_install_activemq() {
|
||||||
|
echo "Downloading and installing Apache ActiveMQ..."
|
||||||
|
execute wget https://dlcdn.apache.org/activemq/$ACTIVEMQ_VERSION/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -O /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz
|
||||||
|
execute sudo mkdir -p $ACTIVEMQ_HOME
|
||||||
|
execute sudo tar xzvf /tmp/apache-activemq-$ACTIVEMQ_VERSION-bin.tar.gz -C $ACTIVEMQ_HOME --strip-components=1
|
||||||
|
|
||||||
|
echo "Setting permissions for ActiveMQ directories..."
|
||||||
|
execute sudo chown -R $ACTIVEMQ_USER:$ACTIVEMQ_GROUP $ACTIVEMQ_HOME
|
||||||
|
execute sudo chmod -R 755 $ACTIVEMQ_HOME
|
||||||
|
|
||||||
|
echo "Creating ActiveMQ systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/activemq.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache ActiveMQ
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=$ACTIVEMQ_USER
|
||||||
|
Group=$ACTIVEMQ_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=$JAVA_HOME"
|
||||||
|
Environment="ACTIVEMQ_HOME=$ACTIVEMQ_HOME"
|
||||||
|
Environment="ACTIVEMQ_BASE=$ACTIVEMQ_HOME"
|
||||||
|
Environment="ACTIVEMQ_CONF=$ACTIVEMQ_HOME/conf"
|
||||||
|
Environment="ACTIVEMQ_DATA=$ACTIVEMQ_HOME/data"
|
||||||
|
|
||||||
|
ExecStart=$ACTIVEMQ_HOME/bin/activemq start
|
||||||
|
ExecStop=$ACTIVEMQ_HOME/bin/activemq stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
execute sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting ActiveMQ service..."
|
||||||
|
execute sudo systemctl start activemq
|
||||||
|
|
||||||
|
echo "Stopping ActiveMQ service..."
|
||||||
|
execute sudo systemctl stop activemq
|
||||||
|
|
||||||
|
echo "Enabling ActiveMQ service to start on boot..."
|
||||||
|
execute sudo systemctl enable activemq
|
||||||
|
}
|
||||||
|
# Download Content
|
||||||
|
05_down_content(){
|
||||||
|
|
||||||
|
# Ensure system is updated and curl is installed
|
||||||
|
echo "Updating package list and installing curl..."
|
||||||
|
sudo dnf update -y
|
||||||
|
sudo dnf install -y curl
|
||||||
|
|
||||||
|
# URLs of the resources to be downloaded
|
||||||
|
URLS=(
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-content-services-community-distribution/23.2.1/alfresco-content-services-community-distribution-23.2.1.zip"
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-search-services/2.0.9.1/alfresco-search-services-2.0.9.1.zip"
|
||||||
|
"https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-transform-core-aio/5.1.0/alfresco-transform-core-aio-5.1.0.jar"
|
||||||
|
)
|
||||||
|
|
||||||
|
# Directory to save the downloaded files
|
||||||
|
DOWNLOAD_DIR="./downloads"
|
||||||
|
|
||||||
|
# Create the download directory if it does not exist
|
||||||
|
mkdir -p "$DOWNLOAD_DIR"
|
||||||
|
|
||||||
|
# Function to download a file
|
||||||
|
download_file() {
|
||||||
|
local url=$1
|
||||||
|
local dest_dir=$2
|
||||||
|
local filename=$(basename "$url")
|
||||||
|
|
||||||
|
echo "Downloading $filename..."
|
||||||
|
curl -L -o "$dest_dir/$filename" -w "\nHTTP Status: %{http_code}\n" "$url"
|
||||||
|
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "Downloaded $filename successfully."
|
||||||
|
else
|
||||||
|
echo "Failed to download $filename."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if the file size is greater than 0 bytes
|
||||||
|
if [ ! -s "$dest_dir/$filename" ]; then
|
||||||
|
echo "Warning: Downloaded file $filename is empty."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Loop through each URL and download the file
|
||||||
|
for url in "${URLS[@]}"; do
|
||||||
|
download_file "$url" "$DOWNLOAD_DIR"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "All downloads are complete."
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install Alfresco Community Edition
|
||||||
|
06_install_alfresco(){
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
echo "Install unzip command"
|
||||||
|
execute sudo dnf -y install unzip
|
||||||
|
|
||||||
|
echo "Create support folders and configuration in Tomcat"
|
||||||
|
mkdir -p /home/rheluser/tomcat/shared/classes && mkdir -p /home/rheluser/tomcat/shared/lib
|
||||||
|
sed -i 's|^shared.loader=$|shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar|' /home/rheluser/tomcat/conf/catalina.properties
|
||||||
|
|
||||||
|
echo "Unzip Alfresco ZIP Distribution File"
|
||||||
|
mkdir /tmp/alfresco
|
||||||
|
unzip downloads/alfresco-content-services-community-distribution-23.2.1.zip -d /tmp/alfresco
|
||||||
|
|
||||||
|
echo "Copy JDBC driver"
|
||||||
|
cp /tmp/alfresco/web-server/lib/postgresql-42.6.0.jar /home/rheluser/tomcat/shared/lib/
|
||||||
|
|
||||||
|
echo "Configure JAR Addons deployment"
|
||||||
|
mkdir -p /home/rheluser/modules/platform && mkdir -p /home/rheluser/modules/share && mkdir -p /home/rheluser/tomcat/conf/Catalina/localhost
|
||||||
|
cp /tmp/alfresco/web-server/conf/Catalina/localhost/* /home/rheluser/tomcat/conf/Catalina/localhost/
|
||||||
|
|
||||||
|
echo "Install Web Applications"
|
||||||
|
cp /tmp/alfresco/web-server/webapps/* /home/rheluser/tomcat/webapps/
|
||||||
|
|
||||||
|
echo "Apply configuration"
|
||||||
|
cp -r /tmp/alfresco/web-server/shared/classes/* /home/rheluser/tomcat/shared/classes/
|
||||||
|
mkdir /home/rheluser/keystore && cp -r /tmp/alfresco/keystore/* /home/rheluser/keystore/
|
||||||
|
mkdir /home/rheluser/alf_data
|
||||||
|
cat <<EOL | tee /home/rheluser/tomcat/shared/classes/alfresco-global.properties
|
||||||
|
#
|
||||||
|
# Custom content and index data location
|
||||||
|
#
|
||||||
|
dir.root=/home/rheluser/alf_data
|
||||||
|
dir.keystore=/home/rheluser/keystore/
|
||||||
|
|
||||||
|
#
|
||||||
|
# Database connection properties
|
||||||
|
#
|
||||||
|
db.username=alfresco
|
||||||
|
db.password=alfresco
|
||||||
|
db.driver=org.postgresql.Driver
|
||||||
|
db.url=jdbc:postgresql://localhost:5432/alfresco
|
||||||
|
|
||||||
|
#
|
||||||
|
# Solr Configuration
|
||||||
|
#
|
||||||
|
solr.secureComms=secret
|
||||||
|
solr.sharedSecret=secret
|
||||||
|
solr.host=localhost
|
||||||
|
solr.port=8983
|
||||||
|
index.subsystem.name=solr6
|
||||||
|
|
||||||
|
#
|
||||||
|
# Transform Configuration
|
||||||
|
#
|
||||||
|
localTransform.core-aio.url=http://localhost:8090/
|
||||||
|
|
||||||
|
#
|
||||||
|
# Events Configuration
|
||||||
|
#
|
||||||
|
messaging.broker.url=failover:(nio://localhost:61616)?timeout=3000&jms.useCompression=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# URL Generation Parameters
|
||||||
|
#-------------
|
||||||
|
alfresco.context=alfresco
|
||||||
|
alfresco.host=localhost
|
||||||
|
alfresco.port=8080
|
||||||
|
alfresco.protocol=http
|
||||||
|
share.context=share
|
||||||
|
share.host=localhost
|
||||||
|
share.port=8080
|
||||||
|
share.protocol=http
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Apply AMPs"
|
||||||
|
mkdir /home/rheluser/amps && cp -r /tmp/alfresco/amps/* /home/rheluser/amps/
|
||||||
|
mkdir /home/rheluser/bin && cp -r /tmp/alfresco/bin/* /home/rheluser/bin/
|
||||||
|
java -jar /home/rheluser/bin/alfresco-mmt.jar install /home/rheluser/amps /home/rheluser/tomcat/webapps/alfresco.war -directory
|
||||||
|
java -jar /home/rheluser/bin/alfresco-mmt.jar list /home/rheluser/tomcat/webapps/alfresco.war
|
||||||
|
|
||||||
|
echo "Modify alfresco and share logs directory"
|
||||||
|
mkdir /home/rheluser/tomcat/webapps/alfresco && unzip /home/rheluser/tomcat/webapps/alfresco.war -d /home/rheluser/tomcat/webapps/alfresco
|
||||||
|
mkdir /home/rheluser/tomcat/webapps/share && unzip /home/rheluser/tomcat/webapps/share.war -d /home/rheluser/tomcat/webapps/share
|
||||||
|
sed -i 's|^appender\.rolling\.fileName=alfresco\.log|appender.rolling.fileName=/home/rheluser/tomcat/logs/alfresco.log|' /home/rheluser/tomcat/webapps/alfresco/WEB-INF/classes/log4j2.properties
|
||||||
|
sed -i 's|^appender\.rolling\.fileName=share\.log|appender.rolling.fileName=/home/rheluser/tomcat/logs/share.log|' /home/rheluser/tomcat/webapps/share/WEB-INF/classes/log4j2.properties
|
||||||
|
|
||||||
|
echo "Alfresco has been configured"
|
||||||
|
|
||||||
|
}
|
||||||
|
# Install Apache Solr
|
||||||
|
07_install_solr() {
|
||||||
|
echo "Downloading and installing Apache Solr..."
|
||||||
|
execute mkdir /tmp/solr
|
||||||
|
execute unzip downloads/alfresco-search-services-$SOLR_VERSION.zip -d /tmp/solr
|
||||||
|
execute mv /tmp/solr/alfresco-search-services /home/rheluser
|
||||||
|
|
||||||
|
echo "Creating Solr systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/solr.service
|
||||||
|
[Unit]
|
||||||
|
Description=Apache SOLR Web Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
|
||||||
|
User=$SOLR_USER
|
||||||
|
Group=$SOLR_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=$JAVA_HOME"
|
||||||
|
|
||||||
|
ExecStart=/home/rheluser/alfresco-search-services/solr/bin/solr start -a "-Dcreate.alfresco.defaults=alfresco,archive -Dalfresco.secureComms=secret -Dalfresco.secureComms.secret=secret"
|
||||||
|
ExecStop=/home/rheluser/alfresco-search-services/solr/bin/solr stop
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
execute sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Solr service..."
|
||||||
|
execute sudo systemctl start solr
|
||||||
|
|
||||||
|
echo "Stopping Solr service..."
|
||||||
|
execute sudo systemctl stop solr
|
||||||
|
|
||||||
|
echo "Enabling Solr service to start on boot..."
|
||||||
|
execute sudo systemctl enable solr
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install Transform dependencies
|
||||||
|
08_install_transform() {
|
||||||
|
sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
||||||
|
sudo dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
||||||
|
|
||||||
|
echo "Install Transform dependencies"
|
||||||
|
sudo dnf install -y GraphicsMagick libreoffice perl-Image-ExifTool
|
||||||
|
|
||||||
|
echo "Downloading and installing Alfresco PDF Renderer..."
|
||||||
|
execute curl -L -o /tmp/alfresco-pdf-renderer-1.2-linux.tgz https://nexus.alfresco.com/nexus/repository/releases/org/alfresco/alfresco-pdf-renderer/1.2/alfresco-pdf-renderer-1.2-linux.tgz
|
||||||
|
execute sudo tar xf /tmp/alfresco-pdf-renderer-1.2-linux.tgz -C /usr/bin
|
||||||
|
|
||||||
|
echo "Configuring Transform server..."
|
||||||
|
execute mkdir /home/rheluser/transform
|
||||||
|
execute cp downloads/alfresco-transform-core-aio-5.1.0.jar /home/rheluser/transform
|
||||||
|
|
||||||
|
echo "Creating Transform systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/transform.service
|
||||||
|
[Unit]
|
||||||
|
Description=Transform Application Container
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
|
||||||
|
User=$TRANSFORM_USER
|
||||||
|
Group=$TRANSFORM_GROUP
|
||||||
|
|
||||||
|
Environment="JAVA_HOME=$JAVA_HOME"
|
||||||
|
Environment="LIBREOFFICE_HOME=/usr/lib/libreoffice"
|
||||||
|
|
||||||
|
ExecStart=java -jar /home/rheluser/transform/alfresco-transform-core-aio-5.1.0.jar
|
||||||
|
ExecStop=/bin/kill -15 $MAINPID
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
execute sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Starting Transform service..."
|
||||||
|
execute sudo systemctl start transform
|
||||||
|
|
||||||
|
echo "Stopping Transform service..."
|
||||||
|
execute sudo systemctl stop transform
|
||||||
|
|
||||||
|
echo "Enabling Transform service to start on boot..."
|
||||||
|
execute sudo systemctl enable transform
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install Node.js and build Alfresco Content App
|
||||||
|
09_install_nodejs() {
|
||||||
|
echo "Installing Node.js and npm..."
|
||||||
|
#execute curl -fsSL $NODEJS_SETUP_URL | sudo -E bash -
|
||||||
|
bash $NODEJS_SETUP_UR
|
||||||
|
execute sudo dnf install -y nodejs
|
||||||
|
|
||||||
|
echo "Verifying Node.js and npm installation..."
|
||||||
|
execute node -v
|
||||||
|
execute npm -v
|
||||||
|
|
||||||
|
echo "Cloning and building Alfresco Content App..."
|
||||||
|
execute git clone $CONTENT_APP_REPO
|
||||||
|
execute cd alfresco-content-app
|
||||||
|
execute git checkout tags/$CONTENT_APP_VERSION -b $CONTENT_APP_VERSION
|
||||||
|
execute npm install
|
||||||
|
execute npm run build
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install and configure Nginx
|
||||||
|
10_install_nginx() {
|
||||||
|
echo "Installing Nginx..."
|
||||||
|
execute sudo dnf install -y nginx
|
||||||
|
|
||||||
|
echo "Creating directory for Alfresco Content App..."
|
||||||
|
execute sudo mkdir -p $NGINX_ROOT
|
||||||
|
execute sudo cp -r /home/rheluser/alfresco-content-app/dist/content-ce/* $NGINX_ROOT
|
||||||
|
|
||||||
|
echo "Creating Nginx systemd service file..."
|
||||||
|
cat <<EOL | sudo tee /etc/systemd/system/nginx.service
|
||||||
|
[Unit]
|
||||||
|
Description=A high performance web server and a reverse proxy server
|
||||||
|
Documentation=man:nginx(8)
|
||||||
|
After=network.target remote-fs.target nss-lookup.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
PIDFile=/run/nginx/nginx.pid
|
||||||
|
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
|
||||||
|
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
|
||||||
|
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
|
||||||
|
ExecStop=/bin/kill -s QUIT $MAINPID
|
||||||
|
PrivateTmp=true
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Reloading systemd daemon..."
|
||||||
|
execute sudo systemctl daemon-reload
|
||||||
|
|
||||||
|
echo "Enabling Nginx service to start on boot..."
|
||||||
|
execute sudo systemctl enable nginx
|
||||||
|
|
||||||
|
echo "Configuring Nginx..."
|
||||||
|
cat <<EOL | sudo tee $NGINX_CONF_PATH
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name localhost;
|
||||||
|
|
||||||
|
client_max_body_size 0;
|
||||||
|
|
||||||
|
set \$allowOriginSite *;
|
||||||
|
proxy_pass_request_headers on;
|
||||||
|
proxy_pass_header Set-Cookie;
|
||||||
|
|
||||||
|
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
|
||||||
|
proxy_redirect off;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_set_header Host \$host:\$server_port;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_pass_header Set-Cookie;
|
||||||
|
|
||||||
|
root $NGINX_ROOT;
|
||||||
|
index index.html;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
try_files \$uri \$uri/ /index.html;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /alfresco/ {
|
||||||
|
proxy_pass http://localhost:8080;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /share/ {
|
||||||
|
proxy_pass http://localhost:8080;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOL
|
||||||
|
|
||||||
|
echo "Restarting Nginx..."
|
||||||
|
execute sudo systemctl restart nginx
|
||||||
|
}
|
||||||
|
11_service_restart(){
|
||||||
|
## RECOMMENDATION: run this sequence of commands manually, waiting between one command and the next one to ensure service dependencies are met.
|
||||||
|
|
||||||
|
echo "Starting postgresql"
|
||||||
|
sudo systemctl start postgresql
|
||||||
|
|
||||||
|
echo "Starting activemq"
|
||||||
|
sudo systemctl start activemq
|
||||||
|
|
||||||
|
echo "Starting transform"
|
||||||
|
sudo systemctl start transform
|
||||||
|
|
||||||
|
echo "Starting tomcat"
|
||||||
|
sudo systemctl start tomcat
|
||||||
|
|
||||||
|
echo "Starting solr"
|
||||||
|
sudo systemctl start solr
|
||||||
|
|
||||||
|
echo "Starting nginx"
|
||||||
|
sudo systemctl start nginx
|
||||||
|
|
||||||
|
|
||||||
|
echo "Services have been started successfully!"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main script execution
|
||||||
|
main() {
|
||||||
|
user_add_and_group
|
||||||
|
00_update_system
|
||||||
|
01_install_postgresql
|
||||||
|
02_install_java
|
||||||
|
03_install_tomcat
|
||||||
|
04_install_activemq
|
||||||
|
05_down_content
|
||||||
|
06_install_alfresco
|
||||||
|
07_install_solr
|
||||||
|
08_install_transform
|
||||||
|
09_install_nodejs
|
||||||
|
10_install_nginx
|
||||||
|
11_servie_restart
|
||||||
|
echo "Installation and configuration complete."
|
||||||
|
}
|
||||||
|
|
||||||
|
main
|
||||||
+100
@@ -0,0 +1,100 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Logger Function
|
||||||
|
log() {
|
||||||
|
local message="$1"
|
||||||
|
local type="$2"
|
||||||
|
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
||||||
|
local color
|
||||||
|
local endcolor="\033[0m"
|
||||||
|
|
||||||
|
case "$type" in
|
||||||
|
"info") color="\033[38;5;79m" ;;
|
||||||
|
"success") color="\033[1;32m" ;;
|
||||||
|
"error") color="\033[1;31m" ;;
|
||||||
|
*) color="\033[1;34m" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
echo -e "${color}${timestamp} - ${message}${endcolor}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Error handler function
|
||||||
|
handle_error() {
|
||||||
|
local exit_code=$1
|
||||||
|
local error_message="$2"
|
||||||
|
log "Error: $error_message (Exit Code: $exit_code)" "error"
|
||||||
|
exit $exit_code
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to check for command availability
|
||||||
|
command_exists() {
|
||||||
|
command -v "$1" &> /dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
check_os() {
|
||||||
|
if ! [ -f "/etc/redhat-release" ]; then
|
||||||
|
echo "Error: This script is only supported on RHEL-based systems."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to install the script prerequisites
|
||||||
|
install_pre_reqs() {
|
||||||
|
log "Installing pre-requisites" "info"
|
||||||
|
|
||||||
|
# Run 'yum update'
|
||||||
|
if ! yum update -y; then
|
||||||
|
handle_error "$?" "Failed to run 'yum update'"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Install required packages
|
||||||
|
if ! yum install -y curl ca-certificates gnupg2; then
|
||||||
|
handle_error "$?" "Failed to install required packages"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Create directory for keyrings
|
||||||
|
if ! mkdir -p /etc/pki/rpm-gpg; then
|
||||||
|
handle_error "$?" "Failed to create /etc/pki/rpm-gpg directory"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Remove old keyring if exists
|
||||||
|
rm -f /etc/pki/rpm-gpg/nodesource.gpg || true
|
||||||
|
|
||||||
|
# Download and import the NodeSource GPG key
|
||||||
|
if ! curl -fsSL https://rpm.nodesource.com/pub/el/NODESOURCE-GPG-SIGNING-KEY-EL | gpg --dearmor -o /etc/pki/rpm-gpg/nodesource.gpg; then
|
||||||
|
handle_error "$?" "Failed to download and import the NodeSource GPG key"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to configure the Node.js repository for RHEL
|
||||||
|
configure_repo() {
|
||||||
|
local node_version=$1
|
||||||
|
|
||||||
|
# Create the Nodesource repo file
|
||||||
|
cat <<EOF > /etc/yum.repos.d/nodesource.repo
|
||||||
|
[nodesource]
|
||||||
|
name=Node.js Packages for Enterprise Linux
|
||||||
|
baseurl=https://rpm.nodesource.com/pub_$(echo $node_version | tr -d 'x').x/el/\$releasever/\$basearch
|
||||||
|
enabled=1
|
||||||
|
gpgcheck=1
|
||||||
|
gpgkey=file:///etc/pki/rpm-gpg/nodesource.gpg
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Run 'yum clean all' and 'yum makecache' to refresh the repository
|
||||||
|
if ! yum clean all && yum makecache; then
|
||||||
|
handle_error "$?" "Failed to refresh repositories"
|
||||||
|
else
|
||||||
|
log "Repository configured successfully." "success"
|
||||||
|
log "To install Node.js, run: yum install nodejs -y" "info"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Define Node.js version
|
||||||
|
NODE_VERSION="20.x"
|
||||||
|
|
||||||
|
# Check OS
|
||||||
|
check_os
|
||||||
|
|
||||||
|
# Main execution
|
||||||
|
install_pre_reqs || handle_error $? "Failed installing pre-requisites"
|
||||||
|
configure_repo "$NODE_VERSION" || handle_error $? "Failed configuring repository"
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user