.pct-helpers

@@ -196,23 +196,17 @@ xread(){
 }
 
 #
-#	xreadYes MSG [VAR]
+#	xreadYes MSG VAR
 #
+# XXX make VAR optional...
 xreadYes(){
-	if [ -z ${2} ] ; then
-		local var=__X
-		local __X
-	else
-		local var=${2}
-		local mode=
-	fi
 	# XXX check DFL_..???
-	if [[ "${!var}" == "SKIP" ]] ; then
+	if [[ "${!2}" == "SKIP" ]] ; then
-		eval "$var="
+		eval "$2="
 		return
 	fi
-	if [ -z ${!var} ] ; then
+	if [ -z ${!2} ] ; then
-		if [ -z $(eval "echo \$DFL_${var}") ] ; then
+		if [ -z $(eval "echo \$DFL_${2}") ] ; then
 			local yes=y
 			local no=N
 			local dfl=
@@ -221,23 +215,23 @@ xreadYes(){
 			local no=n
 			local dfl=1
 		fi
-		eval 'read -ep "'$1' ('$yes'/'$no') " '${var}''
+		eval 'read -ep "'$1' ('$yes'/'$no') " '${2}''
-		XREAD_VARS+=(${var})
+		XREAD_VARS+=(${2})
 		# normalize...
-		eval "${var}=${!var,,}"
+		eval "${2}=${!2,,}"
-		if [[ "${!var}" == 'y' ]] ; then
+		if [[ "${!2}" == 'y' ]] ; then
-			eval "${var}=1"
+			eval "${2}=1"
-		elif [[ ${!var} == 'n' ]] ; then
+		elif [[ ${!2} == 'n' ]] ; then
-			eval "${var}="
+			eval "${2}="
 		# set default if empty...
 		else
-			eval "${var}=\${${var}:-$dfl}"
+			eval "${2}=\${${2}:-$dfl}"
 		fi
 	fi
 	[ $SCRIPTING ] \
-		&& echo "$var=${!var}"
+		&& echo "$2=${!2}"
 
-	if [ -z ${!var} ] ; then
+	if [ -z ${!2} ] ; then
 		return 1
 	fi
 }
@@ -487,12 +481,11 @@ PCT_TEMPLATE_VARS=(
 	ADMIN_GATE
 )
 makePCTTemplateSEDPatterns(){
-	local vars=("${PCT_TEMPLATE_VARS[@]}" "$@")
 	# strip ips and save to *_IPn var...
 	local ip_vars=()
 	local var
 	local val
-	for var in ${vars[@]} ; do
+	for var in ${PCT_TEMPLATE_VARS[@]} ; do
 		if [[ $var =~ .*_IP ]] ; then
 			local val=${!var}
 			if [[ $val == SKIP ]] ; then
@@ -503,7 +496,7 @@ makePCTTemplateSEDPatterns(){
 		fi
 	done
 
-	makeTemplateSEDPatterns "${vars[@]}" "${ip_vars[@]}"
+	makeTemplateSEDPatterns "${PCT_TEMPLATE_VARS[@]}" "${ip_vars[@]}" "$@"
 }
 
 
@@ -551,12 +544,17 @@ expandPCTTemplate(){
 #
 #	buildAssets [VAR ..]
 #
+# XXX revise: SKIP handling...
 NOTES=NOTES.md
 buildAssets(){
 	local template_dir=${TEMPLATE_DIR:-templates}
 	local assets_dir=${ASSETS_DIR:-assets}
 	local staging_dir=${STAGING_DIR:-staging}
 
+	if ! [ -e $template_dir ] ; then
+		return
+	fi
+
 	local PCT_TEMPLATE_PATTERNS=($(makePCTTemplateSEDPatterns "$@"))
 
 	# assets...
@@ -566,7 +564,6 @@ buildAssets(){
 	fi
 
 	# template dir...
-	if [ -e $template_dir ] ; then
 	local TEMPLATES=($(find "$template_dir" -type f))
 	for file in "${TEMPLATES[@]}" ; do
 		file=${file#${template_dir}}
@@ -579,7 +576,6 @@ buildAssets(){
 			| expandTemplate \
 			> "${staging_dir}/${file}"
 	done
-	fi
 
 	# special case: NOTES.md...
 	if [ -z "$DESCRIPTION" ] && [ -e "$NOTES" ] ; then
@@ -629,76 +625,32 @@ pveGetLatestTemplate(){
 
 
 #
-#	pctBaseCreate ID TEMPLATE ARGS [PASS]
+#	pctCreate ID TEMPLATE ARGS [PASS]
 #
-pctBaseCreate(){
+pctCreate(){
-	local ID=$1
-	local TEMPLATE=$2
-	local ARGS=$3
-	local PASS=$4
-
 	local TMP_PASS=$(cat /dev/urandom | base64 | head -c ${TMP_PASS_LEN:=32})
 	# NOTE: we are not setting the password here to avoid printing it to the terminal...
-	@ pct create $ID \
+	@ pct create $1 \
-		"${TEMPLATE}" \
+		${2} \
-		${ARGS} \
+		${3} \
 		--password="$TMP_PASS" \
 		--start 1 \
 	|| exit 1
-
 	# set actual root password...
-	if [ "$PASS" ] ; then
+	if [ "$4" ] ; then
-		echo "root:$PASS" \
+		echo "root:$4" \
-			| @ lxc-attach $ID chpasswd
+			| @ lxc-attach $1 chpasswd
 	fi
 }
 
 #
-#	pctCreate ID TEMPLATE [PASS]
+#	pctCreate<distro> ID ARGS [PASS]
-#
-#OPTS_STAGE_1=
-#INTERFACES=
-#CTHOSTNAME=
-#CORES=
-#RAM=
-#SWAP=
-#DRIVE=
-#PCT_EXTRA=
-pctCreate(){
-	# build network args...
-	local interfaces_args=()
-	local i=0
-	local interface
-	for interface in "${INTERFACES[@]}" ; do
-		interfaces_args+=("--net${i} "${interface}"")
-		i=$(( i + 1 ))
-	done
-
-	# NOTE: TKL gui will not function correctly without nesting enabled...
-	local args="\
-		--hostname $CTHOSTNAME \
-		--cores $CORES \
-		--memory $RAM \
-		--swap $SWAP \
-		"${interfaces_args[@]}" \
-		--storage local-lvm \
-		--rootfs local-lvm:$DRIVE \
-		--unprivileged 1 \
-		--features nesting=1 \
-		${PCT_EXTRA} \
-	"
-
-	pctBaseCreate "$1" "$2" "${OPTS_STAGE_1:-"${args}"}" "$3"
-}
-
-#
-#	pctCreate<distro> ID [PASS]
 #
 pctCreateAlpine(){
 	local TEMPLATE
 	pveGetLatestTemplate alpine TEMPLATE
 
-	pctCreate $1 "$TEMPLATE" "$2"
+	pctCreate $1 "$TEMPLATE" "$2" "$3"
 
 	sleep ${TIMEOUT:=5}
 
@@ -709,7 +661,7 @@ pctCreateDebian(){
 	local TEMPLATE
 	pveGetLatestTemplate 'debian-12-standard' TEMPLATE
 
-	pctCreate $1 "$TEMPLATE" "$2"
+	pctCreate $1 "$TEMPLATE" "$2" "$3"
 
 	sleep ${TIMEOUT:=5}
 
@@ -720,7 +672,7 @@ pctCreateUbuntu(){
 	local TEMPLATE
 	pveGetLatestTemplate ubuntu TEMPLATE
 
-	pctCreate $1 "$TEMPLATE" "$2"
+	pctCreate $1 "$TEMPLATE" "$2" "$3"
 
 	sleep ${TIMEOUT:=5}
 
@@ -729,7 +681,7 @@ pctCreateUbuntu(){
 }
 
 #
-#	pctCreateTurnkey APP ID [PASS]
+#	pctCreateTurnkey APP ID ARGS [PASS]
 #
 pctCreateTurnkey(){
 	local app=$1
@@ -737,13 +689,12 @@ pctCreateTurnkey(){
 	local TEMPLATE
 	pveGetLatestTemplate '.*-turnkey-'$app TEMPLATE
 
-	pctCreate $1 "$TEMPLATE" "$2"
+	pctCreate $1 "$TEMPLATE" "$2" "$3"
 
 	tklWaitForSetup $1
 
 	sleep ${TIMEOUT:=5}
 }
-
 # Wait for /etc/inithooks.conf to be generated then cleared
 #
 # 	tklWaitForSetup ID
@@ -769,7 +720,6 @@ tklWaitForSetup(){
 	printf 'ready.\n'
 	sleep ${TIMEOUT:=5}
 }
-
 #
 #	pctUpdateTurnkey ID
 #

gate-traefik/make.sh

@@ -42,11 +42,20 @@ readVars
 
 #----------------------------------------------------------------------
 
-INTERFACES=(
+OPTS_STAGE_1="\
-	"name=wan,bridge=vmbr${WAN_BRIDGE},firewall=1${WAN_GATE:+,gw=${WAN_GATE}}${WAN_IP:+,ip=${WAN_IP}},type=veth"
+	--hostname $CTHOSTNAME \
-	"name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1${ADMIN_IP:+,ip=${ADMIN_IP}},type=veth"
+	--cores $CORES \
-	"name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1${LAN_IP:+,ip=${LAN_IP}},type=veth"
+	--memory $RAM \
-)
+	--swap $SWAP \
+	--net0 name=wan,bridge=vmbr${WAN_BRIDGE},firewall=1${WAN_GATE:+,gw=${WAN_GATE}}${WAN_IP:+,ip=${WAN_IP}},type=veth \
+	--net1 name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1${ADMIN_IP:+,ip=${ADMIN_IP}},type=veth \
+	--net2 name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1${LAN_IP:+,ip=${LAN_IP}},type=veth \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	--features nesting=1 \
+	${PCT_EXTRA} \
+"
 
 OPTS_STAGE_2="\
 	--startup order=80 \
@@ -60,7 +69,7 @@ echo "# Building config..."
 buildAssets
 
 echo "# Creating CT..."
-pctCreateAlpine $ID "$PASS"
+pctCreateAlpine $ID "${OPTS_STAGE_1}" "$PASS"
 
 echo "# Installing dependencies..."
 @ lxc-attach $ID apk add bash bridge iptables traefik logrotate

gitea/make.sh

@@ -41,9 +41,19 @@ readVars
 
 #----------------------------------------------------------------------
 
-INTERFACES=(
+# NOTE: TKL gui will not function correctly without nesting enabled...
-	"name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth"
+OPTS_STAGE_1="\
-)
+	--hostname $CTHOSTNAME \
+	--cores $CORES \
+	--memory $RAM \
+	--swap $SWAP \
+	--net0 name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	--features nesting=1 \
+	${PCT_EXTRA} \
+"
 
 OPTS_STAGE_2="\
 	--onboot 1 \
@@ -56,7 +66,7 @@ echo "# Building config..."
 buildAssets
 
 echo "# Creating CT..."
-pctCreateTurnkey 'gitea' $ID "$PASS"
+pctCreateTurnkey 'gitea' $ID "$OPTS_STAGE_1" "$PASS"
 
 echo "# Starting TKL UI..."
 @ lxc-attach $ID -- bash -c "HUB_APIKEY=SKIP SEC_UPDATES=SKIP /usr/sbin/turnkey-init"

nextcloud/make.sh

@@ -56,6 +56,27 @@ INTERFACES=(
 	"name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth"
 )
 
+# XXX move this to .pct-helpers
+INTERFACES_ARGS=()
+i=0
+for interface in "${INTERFACES[@]}" ; do
+	INTERFACES_ARGS+=("--net${i} "${interface}"")
+	i=$(( i + 1 ))
+done
+# NOTE: TKL gui will not function correctly without nesting enabled...
+OPTS_STAGE_1="\
+	--hostname $CTHOSTNAME \
+	--cores $CORES \
+	--memory $RAM \
+	--swap $SWAP \
+	"${INTERFACES_ARGS[@]}" \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	--features nesting=1 \
+	${PCT_EXTRA} \
+"
+
 OPTS_STAGE_2="\
 	--onboot 1 \
 "
@@ -67,7 +88,7 @@ echo "# Building config..."
 buildAssets
 
 echo "# Creating CT..."
-pctCreateTurnkey 'nextcloud' $ID "$PASS"
+pctCreateTurnkey 'nextcloud' $ID "$OPTS_STAGE_1" "$PASS"
 
 echo "# Starting TKL UI..."
 # XXX might be a good idea to reaaad stuff from config...

ns/make.sh

@@ -43,10 +43,19 @@ readVars
 
 #----------------------------------------------------------------------
 
-INTERFACES=(
+OPTS_STAGE_1="\
-	"name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1${LAN_GATE:+,gw=$LAN_GATE}${LAN_IP:+,ip=$LAN_IP},type=veth"
+	--hostname $CTHOSTNAME \
-	"name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1${ADMIN_IP:+,ip=$ADMIN_IP},type=veth"
+	--cores $CORES \
-)
+	--memory $RAM \
+	--swap $SWAP \
+	--net0 name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1${LAN_GATE:+,gw=$LAN_GATE}${LAN_IP:+,ip=$LAN_IP},type=veth \
+	--net1 name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1${ADMIN_IP:+,ip=$ADMIN_IP},type=veth \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	--features nesting=1 \
+	${PCT_EXTRA} \
+"
 
 OPTS_STAGE_2="\
 	--startup order=90,up=10 \
@@ -60,7 +69,7 @@ echo "# Building config..."
 buildAssets
 
 echo "# Creating CT..."
-pctCreateAlpine $ID "$PASS"
+pctCreateAlpine $ID "${OPTS_STAGE_1}" "$PASS"
 
 echo "# Installing dependencies..."
 @ lxc-attach $ID apk add bash dnsmasq logrotate

ssh/NOTES.md

@@ -1,8 +1,9 @@
 # SSH (admin)
 
-SSH gateway into the network
+SSH landing into the network
 
-${DOMAIN}  
+${HOSTNAME}  
 ${CTHOSTNAME}.srv  
 ${WAN_SSH_IPn}  
+${LAN_IP} (DHCP)  
 

ssh/make.sh

@@ -43,11 +43,20 @@ readVars
 
 #----------------------------------------------------------------------
 
-INTERFACES=(
+OPTS_STAGE_1="\
-	"name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth"
+	--hostname $CTHOSTNAME \
-	"name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1,ip=dhcp,type=veth"
+	--cores $CORES \
-	"name=wan,bridge=vmbr${WAN_BRIDGE},firewall=1${WAN_SSH_IP:+,ip=${WAN_SSH_IP}},type=veth"
+	--memory $RAM \
-)
+	--swap $SWAP \
+	--net0 name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth \
+	--net1 name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1,ip=dhcp,type=veth \
+	--net2 name=wan,bridge=vmbr${WAN_BRIDGE},firewall=1${WAN_SSH_IP:+,ip=${WAN_SSH_IP}},type=veth \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	--features nesting=1 \
+	${PCT_EXTRA} \
+"
 
 OPTS_STAGE_2="\
 	--onboot 1 \
@@ -56,28 +65,19 @@ OPTS_STAGE_2="\
 
 #----------------------------------------------------------------------
 
-echo "# Building config..."
-buildAssets WAN_SSH_IP
-
 echo "# Creating CT..."
-pctCreateDebian $ID "$PASS"
+pctCreateDebian $ID "${OPTS_STAGE_1}" "$PASS"
 
 echo "# Installing dependencies..."
 @ lxc-attach $ID -- bash -c 'yes | apt install vim htop iftop iotop tmux mc sudo'
 
-echo "# Copying assets..."
-pctPushAssets $ID
-
 echo "# Setup: users..."
 while true ; do
-	xread "User name for ssh (empty to skip): " SSH_USER
+	xread "user name for ssh: " SSH_USER
-	if [ -z "$SSH_USER" ] ; then
+	[ -z $SSH_USER ] \
-		break
+		|| @ lxc-attach $ID -- adduser $SSH_USER
-	fi
+	read -ep "Add another user? [y/N] " MORE
-
+	if [[ $MORE == 'y' ]] ; then
-	@ lxc-attach $ID -- adduser $SSH_USER
-
-	if xreadYes "Add another user?" ; then
 		continue
 	fi
 	break

syncthing/NOTES.md

@@ -1,5 +1,5 @@
 # Syncthing
 
-https://${CTHOSTNAME}.adm
+https://${CTHOSTNAME}.srv
 
 

syncthing/assets/etc/sysctl.d/ports.conf

@@ -1 +0,0 @@
-net.ipv4.ip_unprivileged_port_start=443

syncthing/make.sh

@@ -39,10 +39,19 @@ readVars
 
 #----------------------------------------------------------------------
 
-INTERFACES=(
+OPTS_STAGE_1="\
-	"name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth"
+	--hostname $CTHOSTNAME \
-	"name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1,ip=dhcp,type=veth"
+	--cores $CORES \
-)
+	--memory $RAM \
+	--swap $SWAP \
+	--net0 name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth \
+	--net1 name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1,ip=dhcp,type=veth \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	--features nesting=1 \
+	${PCT_EXTRA} \
+"
 
 OPTS_STAGE_2="\
 	--onboot 1 \
@@ -55,17 +64,11 @@ echo "# Building config..."
 buildAssets
 
 echo "# Creating CT..."
-pctCreateAlpine $ID "$PASS"
+pctCreateAlpine $ID "${OPTS_STAGE_1}" "$PASS"
 
 echo "# Installing dependencies..."
 @ lxc-attach $ID apk add bash syncthing logrotate
 
-echo "# Copying assets..."
-pctPushAssets $ID
-
-echo "# Setup: sysctl..."
-@ lxc-attach $ID rc-update add sysctl
-
 echo "# Setup: syncthing..."
 @ lxc-attach $ID rc-update add syncthing
 @ lxc-attach $ID rc-service syncthing start
@@ -74,8 +77,7 @@ echo "# Setup: dashboard..."
 sleep ${TIMEOUT:=5}
 @ lxc-attach $ID -- \
 	sed \
-		-e 's/tls="false"/tls="true"/g' \
+		-e 's/127\.0\.0\.1:8384/0.0.0.0:8384/g' \
-		-e 's/127\.0\.0\.1:8384/0.0.0.0:443/g' \
 		-i /var/lib/syncthing/.config/syncthing/config.xml
 
 echo "# Setup: firewall..."

wireguard/make.sh

@@ -68,11 +68,19 @@ readVars
 
 #----------------------------------------------------------------------
 
-INTERFACES=(
+OPTS_STAGE_1="\
-	"name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth"
+	--hostname $CTHOSTNAME \
-	"name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1,ip=dhcp,type=veth"
+	--cores $CORES \
-)
+	--memory $RAM \
-
+	--swap $SWAP \
+	--net0 name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth \
+	--net1 name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1,ip=dhcp,type=veth \
+	--storage local-lvm \
+	--rootfs local-lvm:$DRIVE \
+	--unprivileged 1 \
+	--features nesting=1 \
+	${PCT_EXTRA} \
+"
 
 OPTS_STAGE_2="\
 	--onboot 1 \
@@ -85,7 +93,7 @@ echo "# Building config..."
 buildAssets ENDPOINT ENDPOINT_PORT DNS CLIENT_IPS ALLOWED_IPS
 
 echo "# Creating CT..."
-pctCreateAlpine $ID "$PASS"
+pctCreateAlpine $ID "${OPTS_STAGE_1}" "$PASS"
 
 echo "# Installing dependencies..."
 @ lxc-attach $ID apk add \