diff --git a/dev/packer/digitalocean.json b/dev/packer/digitalocean.json index 0bd1523e..14b3f263 100644 --- a/dev/packer/digitalocean.json +++ b/dev/packer/digitalocean.json @@ -2,10 +2,9 @@ "variables": { "do_api_token": "{{env `DIGITALOCEAN_API_TOKEN`}}", "image_name": "wikijs-snapshot-{{timestamp}}", - "apt_packages": "apt-transport-https ca-certificates curl jq linux-image-extra-virtual software-properties-common gnupg-agent openssl ", + "apt_packages": "software-properties-common", "application_name": "Wiki.js", - "application_version": "{{env `WIKI_APP_VERSION`}}", - "docker_compose_version": "1.29.2" + "application_version": "{{env `WIKI_APP_VERSION`}}" }, "sensitive-variables": [ "do_api_token" @@ -14,7 +13,7 @@ { "type": "digitalocean", "api_token": "{{user `do_api_token`}}", - "image": "ubuntu-20-04-x64", + "image": "ubuntu-24-04-x64", "region": "tor1", "size": "s-1vcpu-1gb", "ssh_username": "root", @@ -73,11 +72,8 @@ ], "scripts": [ "scripts/010-docker.sh", - "scripts/011-docker-compose.sh", - "scripts/012-grub-opts.sh", - "scripts/013-docker-dns.sh", - "scripts/014-ufw-docker.sh", - "scripts/020-application-tag.sh", + "scripts/011-ufw-docker.sh", + "scripts/020-force-ssh-logout.sh", "scripts/900-cleanup.sh", "scripts/999-img-check.sh" ] diff --git a/dev/packer/scripts/001-onboot.sh b/dev/packer/scripts/001-onboot.sh index 2e4f9e4f..0a0804d1 100644 --- a/dev/packer/scripts/001-onboot.sh +++ b/dev/packer/scripts/001-onboot.sh @@ -1,15 +1,18 @@ #!/bin/bash -# Scripts in this directory will be executed by cloud-init on the first boot of droplets -# created from your image. Things ike generating passwords, configuration requiring IP address -# or other items that will be unique to each instance should be done in scripts here. - +# Generate PostgreSQL password openssl rand -base64 32 > /etc/wiki/.db-secret +# Start containers if [[ -z $DATABASE_URL ]]; then docker start db fi docker start wiki docker start wiki-update-companion -# docker start nginx-proxy -# docker start watchtower + +# Remove the ssh force logout command +sed -e '/Match User root/d' \ + -e '/.*ForceCommand.*droplet.*/d' \ + -i /etc/ssh/sshd_config + +systemctl restart ssh diff --git a/dev/packer/scripts/010-docker.sh b/dev/packer/scripts/010-docker.sh index c83681bc..661c9329 100644 --- a/dev/packer/scripts/010-docker.sh +++ b/dev/packer/scripts/010-docker.sh @@ -1,17 +1,33 @@ #!/bin/bash -curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - -sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" -apt -qqy update -apt -qqy -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' install docker-ce docker-ce-cli containerd.io +# Add Docker's official GPG key: +sudo install -m 0755 -d /etc/apt/keyrings +sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc +sudo chmod a+r /etc/apt/keyrings/docker.asc + +# Add the repository to Apt sources: +sudo tee /etc/apt/sources.list.d/docker.sources < /var/log/ufw.log diff --git a/dev/packer/scripts/012-grub-opts.sh b/dev/packer/scripts/012-grub-opts.sh deleted file mode 100644 index 9a336bb0..00000000 --- a/dev/packer/scripts/012-grub-opts.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/sh - -sed -e 's|GRUB_CMDLINE_LINUX="|GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1|g' \ - -i /etc/default/grub - -update-grub diff --git a/dev/packer/scripts/013-docker-dns.sh b/dev/packer/scripts/013-docker-dns.sh deleted file mode 100644 index 80fa11fe..00000000 --- a/dev/packer/scripts/013-docker-dns.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh - -sed -e 's|#DOCKER_OPTS|DOCKER_OPTS|g' \ - -i /etc/default/docker diff --git a/dev/packer/scripts/014-ufw-docker.sh b/dev/packer/scripts/014-ufw-docker.sh deleted file mode 100644 index 48199458..00000000 --- a/dev/packer/scripts/014-ufw-docker.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash - -sudo ufw allow ssh -sudo ufw allow http -sudo ufw allow https - -sudo ufw --force enable - -cat /dev/null > /var/log/ufw.log diff --git a/dev/packer/scripts/020-application-tag.sh b/dev/packer/scripts/020-application-tag.sh deleted file mode 100644 index 7d04593f..00000000 --- a/dev/packer/scripts/020-application-tag.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/sh - -################################ -## PART: Write the application tag -## -## vi: syntax=sh expandtab ts=4 - -build_date=$(date +%Y-%m-%d) -distro="$(lsb_release -s -i)" -distro_release="$(lsb_release -s -r)" -distro_codename="$(lsb_release -s -c)" -distro_arch="$(uname -m)" - -mkdir -p /var/lib/digitalocean - -cat >> /var/lib/digitalocean/application.info <> /etc/ssh/sshd_config < /root/.bash_history @@ -36,12 +46,4 @@ The secure erase will complete successfully when you see:${NC} dd: writing to '/zerofile': No space left on device\n Beginning secure erase now\n" -dd if=/dev/zero of=/zerofile & - PID=$! - while [ -d /proc/$PID ] - do - printf "." - sleep 5 - done -sync; rm /zerofile; sync -cat /dev/null > /var/log/lastlog; cat /dev/null > /var/log/wtmp +dd if=/dev/zero of=/zerofile bs=4096 || rm /zerofile diff --git a/dev/packer/scripts/999-img-check.sh b/dev/packer/scripts/999-img-check.sh index 6473b662..cec950ff 100644 --- a/dev/packer/scripts/999-img-check.sh +++ b/dev/packer/scripts/999-img-check.sh @@ -4,7 +4,7 @@ # © 2021-2022 DigitalOcean LLC. # This code is licensed under Apache 2.0 license (see LICENSE.md for details) -VERSION="v. 1.8" +VERSION="v. 1.8.1" RUNDATE=$( date ) # Script should be run with SUDO @@ -75,7 +75,7 @@ function checkAgent { echo -en "\e[41m[FAIL]\e[0m DigitalOcean directory detected.\n" ((FAIL++)) STATUS=2 - if [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]]; then + if [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]] || [[ $OS == "CloudLinux" ]]; then echo "To uninstall the agent: 'sudo yum remove droplet-agent'" echo "To remove the DO directory: 'find /opt/digitalocean/ -type d -empty -delete'" elif [[ $OS == "Ubuntu" ]] || [[ $OS == "Debian" ]]; then @@ -357,7 +357,7 @@ function checkFirewall { # shellcheck disable=SC2031 ((WARN++)) fi - elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]]; then + elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]] || [[ $OS == "CloudLinux" ]]; then if [ -f /usr/lib/systemd/system/csf.service ]; then fw="csf" if [[ $(systemctl status $fw >/dev/null 2>&1) ]]; then @@ -456,7 +456,7 @@ function checkUpdates { echo -en "\e[32m[PASS]\e[0m There are no pending security updates for this image.\n\n" ((PASS++)) fi - elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]]; then + elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]] || [[ $OS == "CloudLinux" ]]; then echo -en "\nChecking for available security updates, this may take a minute...\n\n" update_count=$(yum check-update --security --quiet | wc -l) @@ -506,7 +506,7 @@ osv=0 if [[ $OS == "Ubuntu" ]]; then ost=1 - if [[ $VER == "22.04" ]] || [[ $VER == "20.04" ]] || [[ $VER == "18.04" ]] || [[ $VER == "16.04" ]]; then + if [[ $VER == "24.04" ]] || [[ $VER == "22.10" ]] || [[ $VER == "22.04" ]] || [[ $VER == "20.04" ]] || [[ $VER == "18.04" ]] || [[ $VER == "16.04" ]]; then osv=1 fi @@ -521,7 +521,13 @@ elif [[ "$OS" =~ Debian.* ]]; then ;; 11) osv=1 - ;; + ;; + 12) + osv=1 + ;; + 13) + osv=1 + ;; *) osv=2 ;; @@ -542,12 +548,28 @@ elif [[ $OS == "CentOS Stream" ]]; then ost=1 if [[ $VER == "8" ]]; then osv=1 + elif [[ $VER == "9" ]]; then + osv=1 else osv=2 fi elif [[ $OS == "Rocky Linux" ]]; then ost=1 - if [[ $VER =~ 8\. ]]; then + if [[ $VER =~ 8\. ]] || [[ $VER =~ 9\. ]]; then + osv=1 + else + osv=2 + fi +elif [[ $OS == "AlmaLinux" ]]; then + ost=1 + if [[ "$VER" =~ 8.* ]] || [[ "$VER" =~ 9.* ]]; then + osv=1 + else + osv=2 + fi +elif [[ $OS == "CloudLinux" ]]; then + ost=1 + if [[ "$VER" =~ 8.* ]] || [[ "$VER" =~ 9.* ]]; then osv=1 else osv=2 @@ -599,6 +621,12 @@ checkRoot checkAgent +# Source GPU compatibility check +if [ -f "$(dirname "$0")/check_gpu_support.sh" ]; then + source "$(dirname "$0")/check_gpu_support.sh" +else + echo "GPU check script not found. Skipping GPU compatibility checks." +fi # Summary echo -en "\n\n---------------------------------------------------------------------------------------------------\n" @@ -625,4 +653,4 @@ elif [[ $STATUS == 1 ]]; then else echo -en "Some critical tests failed. These items must be resolved and this scan re-run before you submit your image to the DigitalOcean Marketplace.\n\n" exit 1 -fi \ No newline at end of file +fi