diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..c5767bd --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,46 @@ +profile: basic + +skip_list: + # SCREAMING_SNAKE is the documented convention for infrastructure-wide vars + - var-naming[pattern] + # dot-notation role naming is the documented convention (e.g. software.install.wazuh) + - role-name + # dot-notation roles produce nonsensical prefix requirements + - var-naming[no-role-prefix] + # pre-existing task naming convention: lowercase names throughout catalog + - name[casing] + # large legacy codebase: hundreds of unnamed tasks, out of scope for CI hardening + - name[missing] + # plays in catalog bundles do not require names + - name[play] + # Jinja template syntax in task names is intentional + - name[template] + # cosmetic key ordering; pre-existing throughout catalog + - key-order[task] + # partial become (become without become_user) is pre-existing throughout catalog + - partial-become[task] + # octal file permission values are intentional (e.g. 0644, 0755) + - yaml[octal-values] + # pre-existing shell usage throughout catalog — all cases are intentional + - command-instead-of-shell + # pre-existing free-form module calls throughout catalog + - no-free-form + # pre-existing {{ var}} spacing in catalog roles — cosmetic only + - jinja[spacing] + +warn_list: + - yaml[line-length] + - yaml[truthy] + - yaml[trailing-spaces] + - yaml[empty-lines] + - yaml[new-line-at-end-of-file] + - yaml[colons] + - yaml[comments] + - yaml[indentation] + - risky-shell-pipe + +# catalog roles that reference themselves in test.yml or cross-repo roles not checked out in CI +mock_roles: + - soft.install.warmup.local_bin + - software.install.dotFiles + - system.checks.overview diff --git a/.ansible/roles/software.install.dotFiles/tasks/main.yml b/.ansible/roles/software.install.dotFiles/tasks/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/.ansible/roles/software.install.dotFiles/tasks/main.yml @@ -0,0 +1 @@ +--- diff --git a/.ansible/roles/system.checks.overview/tasks/main.yml b/.ansible/roles/system.checks.overview/tasks/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/.ansible/roles/system.checks.overview/tasks/main.yml @@ -0,0 +1 @@ +--- diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..50e50eb --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,7 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + labels: [dependencies, ci] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..f7aa280 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,17 @@ +name: CI +on: + push: + branches: [main, dev, 'feat/**', 'fix/**'] + pull_request: + branches: [main, dev] +jobs: + ansible-lint: + name: Ansible Lint + runs-on: ubuntu-latest + container: + image: python:3.13-slim + steps: + - run: apt-get update && apt-get install -y --no-install-recommends git + - uses: actions/checkout@v4 + - run: pip install --no-cache-dir ansible-lint + - run: ansible-lint 02_ansible_layer/ diff --git a/.gitignore b/.gitignore index 7246316..b42ed2f 100644 --- a/.gitignore +++ b/.gitignore @@ -3,5 +3,6 @@ notes CLAUDE.md **/CLAUDE.md +.claude/ **/.env !**/.env.example diff --git a/01_image_layer/debian_trixie/v1.0.0/image.yml b/01_image_layer/debian_trixie/v1.0.0/image.yml new file mode 100644 index 0000000..bb0288a --- /dev/null +++ b/01_image_layer/debian_trixie/v1.0.0/image.yml @@ -0,0 +1,12 @@ +id: debian_trixie +api_version: 1 +distro: debian +codename: trixie +description: Debian 13 (Trixie) +cloud_image: + url: "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.raw" + filename: "debian-13-genericcloud-amd64.img" +proxmox_templates: + - {vm_id: 9321, vm_name: "template-vm-debian-trixie-small", spec: "1cpu/4gb/32gb"} + - {vm_id: 9331, vm_name: "template-vm-debian-trixie-medium", spec: "2cpu/8gb/64gb"} + - {vm_id: 9341, vm_name: "template-vm-debian-trixie-large", spec: "4cpu/16gb/500gb"} diff --git a/01_image_layer/ubuntu_noble/v1.0.0/image.yml b/01_image_layer/ubuntu_noble/v1.0.0/image.yml new file mode 100644 index 0000000..11a6746 --- /dev/null +++ b/01_image_layer/ubuntu_noble/v1.0.0/image.yml @@ -0,0 +1,21 @@ +id: ubuntu_noble +api_version: 1 +distro: ubuntu +codename: noble +description: Ubuntu 24.04 LTS (Noble Numbat) +cloud_image: + url: "https://cloud-images.ubuntu.com/minimal/daily/noble/current/noble-minimal-cloudimg-amd64.img" + filename: "noble-minimal-cloudimg-amd64.img" +proxmox_templates: + - {vm_id: 9901, vm_name: "template-vm-ubuntu-noble-nano", spec: "1cpu/1gb/16gb"} + - {vm_id: 9211, vm_name: "template-vm-ubuntu-noble-micro-01-2g-24g", spec: "1cpu/2gb/24gb"} + - {vm_id: 9212, vm_name: "template-vm-ubuntu-noble-micro-02-2g-24g", spec: "1cpu/2gb/24gb"} + - {vm_id: 9221, vm_name: "template-vm-ubuntu-noble-small-01-4g-32g", spec: "1cpu/4gb/32gb"} + - {vm_id: 9222, vm_name: "template-vm-ubuntu-noble-small-02-4g-32g", spec: "1cpu/4gb/32gb"} + - {vm_id: 9224, vm_name: "template-vm-ubuntu-noble-small-04-4g-32g", spec: "1cpu/4gb/32gb"} + - {vm_id: 9232, vm_name: "template-vm-ubuntu-noble-medium-02-8g-64g", spec: "2cpu/8gb/64gb"} + - {vm_id: 9234, vm_name: "template-vm-ubuntu-noble-medium-04-8g-64g", spec: "4cpu/8gb/64gb"} + - {vm_id: 9236, vm_name: "template-vm-ubuntu-noble-medium-06-8g-64g", spec: "6cpu/8gb/64gb"} + - {vm_id: 9244, vm_name: "template-vm-ubuntu-noble-large-04-8g-64g", spec: "4cpu/8gb/64gb"} + - {vm_id: 9246, vm_name: "template-vm-ubuntu-noble-large-06-8g-64g", spec: "6cpu/8gb/64gb"} + - {vm_id: 9248, vm_name: "template-vm-ubuntu-noble-large-08-8g-64g", spec: "8cpu/8gb/64gb"} diff --git a/01_image_layer/ubuntu_resolute/v1.0.0/image.yml b/01_image_layer/ubuntu_resolute/v1.0.0/image.yml new file mode 100644 index 0000000..9fde987 --- /dev/null +++ b/01_image_layer/ubuntu_resolute/v1.0.0/image.yml @@ -0,0 +1,21 @@ +id: ubuntu_resolute +api_version: 1 +distro: ubuntu +codename: resolute +description: Ubuntu 26.04 LTS (Resolute Raccoon) +cloud_image: + url: "https://cloud-images.ubuntu.com/minimal/daily/resolute/current/resolute-minimal-cloudimg-amd64.img" + filename: "resolute-minimal-cloudimg-amd64.img" +proxmox_templates: + - {vm_id: 9501, vm_name: "template-vm-ubuntu-resolute-nano", spec: "1cpu/1gb/16gb"} + - {vm_id: 9511, vm_name: "template-vm-ubuntu-resolute-micro-01-2g-24g", spec: "1cpu/2gb/24gb"} + - {vm_id: 9512, vm_name: "template-vm-ubuntu-resolute-micro-02-2g-24g", spec: "1cpu/2gb/24gb"} + - {vm_id: 9521, vm_name: "template-vm-ubuntu-resolute-small-01-4g-32g", spec: "1cpu/4gb/32gb"} + - {vm_id: 9522, vm_name: "template-vm-ubuntu-resolute-small-02-4g-32g", spec: "1cpu/4gb/32gb"} + - {vm_id: 9524, vm_name: "template-vm-ubuntu-resolute-small-04-4g-32g", spec: "1cpu/4gb/32gb"} + - {vm_id: 9532, vm_name: "template-vm-ubuntu-resolute-medium-02-8g-64g", spec: "2cpu/8gb/64gb"} + - {vm_id: 9534, vm_name: "template-vm-ubuntu-resolute-medium-04-8g-64g", spec: "4cpu/8gb/64gb"} + - {vm_id: 9536, vm_name: "template-vm-ubuntu-resolute-medium-06-8g-64g", spec: "6cpu/8gb/64gb"} + - {vm_id: 9544, vm_name: "template-vm-ubuntu-resolute-large-04-8g-64g", spec: "4cpu/8gb/64gb"} + - {vm_id: 9546, vm_name: "template-vm-ubuntu-resolute-large-06-8g-64g", spec: "6cpu/8gb/64gb"} + - {vm_id: 9548, vm_name: "template-vm-ubuntu-resolute-large-08-8g-64g", spec: "8cpu/8gb/64gb"} diff --git a/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/defaults/main.yml b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/defaults/main.yml new file mode 100644 index 0000000..649935b --- /dev/null +++ b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/defaults/main.yml @@ -0,0 +1,18 @@ +--- +# defaults file +apt_mirror_enabled: false +apt_proxy_url: "" +apt_mirror_airgapped: false +apt_mirror_vm_ip: "" +apt_mirror_http_port: 80 +# Wait parameters — used only in airgapped (mirror) mode. +# apt-mirror prewarm runs async on the server; clients poll until the Release +# file is accessible before proceeding with apt update. +apt_mirror_wait_retries: 360 +apt_mirror_wait_delay: 30 +# Set to true only if backports are included in the mirror (apt_mirror_backports: true on server). +# When false (default), the backports suite is stripped from apt sources in airgapped mode. +apt_mirror_backports: false +# Must match apt_mirror_ubuntu_components on the mirror server. +# The client strips any components not listed here from ubuntu.sources in airgapped mode. +apt_mirror_ubuntu_components: "main restricted universe" diff --git a/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/handlers/main.yml b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/handlers/main.yml new file mode 100644 index 0000000..b6eaef5 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/handlers/main.yml @@ -0,0 +1,7 @@ +--- +# handlers file + +- name: update apt cache + ansible.builtin.apt: + update_cache: true + become: true diff --git a/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/meta/main.yml b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/meta/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/meta/main.yml @@ -0,0 +1 @@ +--- diff --git a/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/tasks/main.yml b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/tasks/main.yml new file mode 100644 index 0000000..211ed71 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/tasks/main.yml @@ -0,0 +1,149 @@ +--- +# tasks file + +- name: client - assert apt_mirror_vm_ip is set in airgapped mode + ansible.builtin.assert: + that: apt_mirror_vm_ip | length > 0 + fail_msg: "apt_mirror_vm_ip must be set when apt_mirror_airgapped is true" + when: + - apt_mirror_enabled | default(false) | bool + - apt_mirror_airgapped | default(false) | bool + +- name: client - set effective mirror URL (airgapped) + ansible.builtin.set_fact: + _apt_effective_url: "http://{{ apt_mirror_vm_ip }}:{{ apt_mirror_http_port }}" + when: + - apt_mirror_enabled | default(false) | bool + - apt_mirror_airgapped | default(false) | bool + +- name: client - set effective mirror URL (proxy) + ansible.builtin.set_fact: + _apt_effective_url: "{{ apt_proxy_url }}" + when: + - apt_mirror_enabled | default(false) | bool + - not apt_mirror_airgapped | default(false) | bool + +- name: client - wait for mirror Release file to be accessible + ansible.builtin.uri: + url: >- + {%- if ansible_distribution == 'Debian' -%} + {{ _apt_effective_url }}/deb.debian.org/debian/dists/{{ ansible_distribution_release }}/InRelease + {%- elif 'universe' in apt_mirror_ubuntu_components -%} + {{ _apt_effective_url }}/archive.ubuntu.com/ubuntu/dists/{{ ansible_distribution_release }}/universe/binary-amd64/Packages + {%- else -%} + {{ _apt_effective_url }}/archive.ubuntu.com/ubuntu/dists/{{ ansible_distribution_release }}/InRelease + {%- endif -%} + method: GET + status_code: 200 + timeout: 10 + register: _apt_mirror_release_check + until: _apt_mirror_release_check.status == 200 + retries: "{{ apt_mirror_wait_retries }}" + delay: "{{ apt_mirror_wait_delay }}" + when: + - apt_mirror_enabled | default(false) | bool + - apt_mirror_airgapped | default(false) | bool + - _apt_effective_url is defined + - ansible_distribution in ["Debian", "Ubuntu"] + +- name: client - remove backports suite from apt sources (not mirrored) + ansible.builtin.replace: + path: /etc/apt/sources.list.d/debian.sources + regexp: '(Suites:.*)[ \t]+{{ ansible_distribution_release }}-backports' + replace: '\1' + become: true + when: + - apt_mirror_enabled | default(false) | bool + - apt_mirror_airgapped | default(false) | bool + - not apt_mirror_backports | default(false) | bool + - ansible_distribution == "Debian" + +- name: client - remove backports suite from ubuntu apt sources (not mirrored) + ansible.builtin.replace: + path: /etc/apt/sources.list.d/ubuntu.sources + regexp: '(Suites:.*)[ \t]+{{ ansible_distribution_release }}-backports' + replace: '\1' + become: true + when: + - apt_mirror_enabled | default(false) | bool + - apt_mirror_airgapped | default(false) | bool + - not apt_mirror_backports | default(false) | bool + - ansible_distribution == "Ubuntu" + +- name: client - restrict ubuntu apt components to mirrored set + ansible.builtin.replace: + path: /etc/apt/sources.list.d/ubuntu.sources + regexp: '^Components:.*$' + replace: 'Components: {{ apt_mirror_ubuntu_components }}' + become: true + when: + - apt_mirror_enabled | default(false) | bool + - apt_mirror_airgapped | default(false) | bool + - ansible_distribution == "Ubuntu" + +- name: client - remove old proxy apt.conf.d files + ansible.builtin.file: + path: "{{ item }}" + state: absent + become: true + loop: + - /etc/apt/apt.conf.d/00range42-proxy + - /etc/apt/apt.conf.d/01-r42-bootstrap-block + - /etc/apt/apt.conf.d/01proxy + when: apt_mirror_enabled | default(false) | bool + +- name: client - rewrite debian mirror list + ansible.builtin.copy: + content: "{{ _apt_effective_url }}/deb.debian.org/debian\n" + dest: /etc/apt/mirrors/debian.list + owner: root + group: root + mode: "0644" + become: true + notify: update apt cache + when: + - apt_mirror_enabled | default(false) | bool + - _apt_effective_url is defined + - _apt_effective_url | length > 0 + - ansible_distribution == "Debian" + +- name: client - rewrite debian-security mirror list + ansible.builtin.copy: + content: "{{ _apt_effective_url }}/security.debian.org/debian-security\n" + dest: /etc/apt/mirrors/debian-security.list + owner: root + group: root + mode: "0644" + become: true + notify: update apt cache + when: + - apt_mirror_enabled | default(false) | bool + - _apt_effective_url is defined + - _apt_effective_url | length > 0 + - ansible_distribution == "Debian" + +- name: client - rewrite ubuntu archive URI + ansible.builtin.replace: + path: /etc/apt/sources.list.d/ubuntu.sources + regexp: 'http://archive\.ubuntu\.com/ubuntu' + replace: "{{ _apt_effective_url }}/archive.ubuntu.com/ubuntu" + become: true + notify: update apt cache + when: + - apt_mirror_enabled | default(false) | bool + - _apt_effective_url is defined + - _apt_effective_url | length > 0 + - ansible_distribution == "Ubuntu" + +- name: client - rewrite ubuntu security URI + ansible.builtin.replace: + path: /etc/apt/sources.list.d/ubuntu.sources + regexp: 'http://security\.ubuntu\.com/ubuntu' + replace: "{{ _apt_effective_url }}/security.ubuntu.com/ubuntu" + become: true + notify: update apt cache + when: + - apt_mirror_enabled | default(false) | bool + - _apt_effective_url is defined + - _apt_effective_url | length > 0 + - ansible_distribution == "Ubuntu" diff --git a/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/templates/01-apt-proxy.conf.j2 b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/templates/01-apt-proxy.conf.j2 new file mode 100644 index 0000000..97d636e --- /dev/null +++ b/02_ansible_layer/admin/roles/software.configure.apt_mirror_client/templates/01-apt-proxy.conf.j2 @@ -0,0 +1,5 @@ +Acquire::http::Proxy "http://{{ apt_proxy_url }}:{{ apt_mirror_port }}/"; +Acquire::https::Proxy "DIRECT"; +{% if apt_mirror_fallback %} +Acquire::http::ConnectTimeout "{{ apt_mirror_connect_timeout }}"; +{% endif %} diff --git a/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/ubuntu/deploy.yml b/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/debian-based/deploy.yml similarity index 84% rename from 02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/ubuntu/deploy.yml rename to 02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/debian-based/deploy.yml index 9c5dcfb..622f2cd 100644 --- a/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/ubuntu/deploy.yml +++ b/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/debian-based/deploy.yml @@ -51,10 +51,18 @@ block: # # + # Retry on transient failures (intermittent registry/mirror anycast timeouts + # pulling images are common on egress-filtered ranges). `up` is idempotent, + # so re-running resumes the pull. A persistent failure still surfaces after + # the retries are exhausted. - name: DOCKER - DOCKER-COMPOSE - RUN community.docker.docker_compose_v2: project_src: "{{ REMOTE_PROJECT_DIR }}" state: present + register: compose_run + until: compose_run is succeeded + retries: 5 + delay: 20 # - name: DOCKER - GET CONTAINER INFO {{ LABEL_PROJET_NAME }} community.docker.docker_container_info: diff --git a/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/main.yml b/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/main.yml index 925d39c..54bb4d2 100644 --- a/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/main.yml +++ b/02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/main.yml @@ -7,8 +7,10 @@ ansible.builtin.setup: # -- name: INCLUDE - ufw tasks - ubuntu - ansible.builtin.include_tasks: ./ubuntu/deploy.yml - when: ansible_facts['distribution'] == "Ubuntu" +# Tasks in ./debian-based/deploy.yml are apt/rsync based, so they run on every +# Debian-family host (Ubuntu + Debian). +- name: INCLUDE - deploy tasks - debian-based + ansible.builtin.include_tasks: ./debian-based/deploy.yml + when: ansible_facts['distribution'] in ['Ubuntu', 'Debian'] #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/02_ansible_layer/admin/roles/software.configure.firewalls/tasks/ubuntu/ufw.yml b/02_ansible_layer/admin/roles/software.configure.firewalls/tasks/debian-based/ufw.yml similarity index 100% rename from 02_ansible_layer/admin/roles/software.configure.firewalls/tasks/ubuntu/ufw.yml rename to 02_ansible_layer/admin/roles/software.configure.firewalls/tasks/debian-based/ufw.yml diff --git a/02_ansible_layer/admin/roles/software.configure.firewalls/tasks/main.yml b/02_ansible_layer/admin/roles/software.configure.firewalls/tasks/main.yml index 30fde99..68b0ddc 100644 --- a/02_ansible_layer/admin/roles/software.configure.firewalls/tasks/main.yml +++ b/02_ansible_layer/admin/roles/software.configure.firewalls/tasks/main.yml @@ -11,8 +11,8 @@ when: ansible_facts['distribution'] == "Fedora" # -- name: INCLUDE - ufw tasks - ubuntu - ansible.builtin.include_tasks: ./ubuntu/ufw.yml - when: ansible_facts['distribution'] == "Ubuntu" +- name: INCLUDE - ufw tasks - debian-based + ansible.builtin.include_tasks: ./debian-based/ufw.yml + when: ansible_facts['distribution'] in ['Ubuntu', 'Debian'] #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/defaults/main.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/defaults/main.yml new file mode 100644 index 0000000..e022085 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/defaults/main.yml @@ -0,0 +1,7 @@ +--- +# defaults file +apt_cacher_port: 3142 +apt_cacher_passthrough: true +apt_cacher_cache_dir: /var/cache/apt-cacher-ng +apt_cacher_log_dir: /var/log/apt-cacher-ng +apt_cacher_bind_address: "0.0.0.0" diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/handlers/main.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/handlers/main.yml new file mode 100644 index 0000000..88d12f5 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/handlers/main.yml @@ -0,0 +1,8 @@ +--- +# handlers file + +- name: restart apt-cacher-ng + ansible.builtin.systemd: + name: apt-cacher-ng + state: restarted + become: true diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/meta/main.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/meta/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/meta/main.yml @@ -0,0 +1 @@ +--- diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/configure.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/configure.yml new file mode 100644 index 0000000..0788179 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/configure.yml @@ -0,0 +1,11 @@ +--- + +- name: configure - deploy acng.conf + ansible.builtin.template: + src: acng.conf.j2 + dest: /etc/apt-cacher-ng/acng.conf + owner: root + group: root + mode: "0644" + become: true + notify: restart apt-cacher-ng diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/firewall.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/firewall.yml new file mode 100644 index 0000000..1b3b455 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/firewall.yml @@ -0,0 +1,8 @@ +--- + +- name: firewall - allow apt-cacher-ng port + community.general.ufw: + rule: allow + port: "{{ apt_cacher_port }}" + proto: tcp + become: true diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/install.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/install.yml new file mode 100644 index 0000000..fea766a --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/install.yml @@ -0,0 +1,13 @@ +--- + +- name: install - update apt cache + ansible.builtin.apt: + update_cache: true + cache_valid_time: 3600 + become: true + +- name: install - install apt-cacher-ng + ansible.builtin.apt: + name: apt-cacher-ng + state: present + become: true diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/main.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/main.yml new file mode 100644 index 0000000..b3e227e --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/main.yml @@ -0,0 +1,14 @@ +--- +# tasks file + +- name: INCLUDE - install apt-cacher-ng + ansible.builtin.include_tasks: install.yml + +- name: INCLUDE - configure apt-cacher-ng + ansible.builtin.include_tasks: configure.yml + +- name: INCLUDE - enable and start apt-cacher-ng service + ansible.builtin.include_tasks: service.yml + +- name: INCLUDE - open apt-cacher-ng firewall port + ansible.builtin.include_tasks: firewall.yml diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/service.yml b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/service.yml new file mode 100644 index 0000000..4ecfe34 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/tasks/service.yml @@ -0,0 +1,9 @@ +--- + +- name: service - enable and start apt-cacher-ng + ansible.builtin.systemd: + name: apt-cacher-ng + state: started + enabled: true + daemon_reload: true + become: true diff --git a/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/templates/acng.conf.j2 b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/templates/acng.conf.j2 new file mode 100644 index 0000000..6e530da --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_cacher_ng/templates/acng.conf.j2 @@ -0,0 +1,8 @@ +CacheDir: {{ apt_cacher_cache_dir }} +LogDir: {{ apt_cacher_log_dir }} +Port: {{ apt_cacher_port }} +BindAddress: {{ apt_cacher_bind_address }} +ReportPage: acng-report.html +{% if apt_cacher_passthrough %} +PassThroughPattern: .* +{% endif %} diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/defaults/main.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/defaults/main.yml new file mode 100644 index 0000000..2ead895 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/defaults/main.yml @@ -0,0 +1,17 @@ +--- +# defaults file +apt_mirror_http_port: 80 +apt_mirror_root: /var/spool/apt-mirror +apt_mirror_threads: 20 +apt_mirror_prewarm: false + +# Suites to mirror +apt_mirror_debian_bookworm: false +apt_mirror_debian_trixie: false +apt_mirror_ubuntu_jammy: false +apt_mirror_ubuntu_noble: false +apt_mirror_ubuntu_resolute: false +apt_mirror_security: true +apt_mirror_backports: false +apt_mirror_include_sources: false +apt_mirror_ubuntu_components: "main restricted universe" diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/handlers/main.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/handlers/main.yml new file mode 100644 index 0000000..8b48948 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/handlers/main.yml @@ -0,0 +1,8 @@ +--- +# handlers file + +- name: restart nginx + ansible.builtin.systemd: + name: nginx + state: restarted + become: true diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/meta/main.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/meta/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/meta/main.yml @@ -0,0 +1 @@ +--- diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/configure_mirror.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/configure_mirror.yml new file mode 100644 index 0000000..19b2a39 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/configure_mirror.yml @@ -0,0 +1,28 @@ +--- + +- name: configure mirror - create mirror root directory + ansible.builtin.file: + path: "{{ apt_mirror_root }}" + state: directory + owner: root + group: root + mode: "0755" + become: true + +- name: configure mirror - create mirror content directory + ansible.builtin.file: + path: "{{ apt_mirror_root }}/mirror" + state: directory + owner: root + group: root + mode: "0755" + become: true + +- name: configure mirror - write mirror.list + ansible.builtin.template: + src: mirror.list.j2 + dest: /etc/apt/mirror.list + owner: root + group: root + mode: "0644" + become: true diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/install_mirror.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/install_mirror.yml new file mode 100644 index 0000000..8a5b17e --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/install_mirror.yml @@ -0,0 +1,15 @@ +--- + +- name: install mirror - update apt cache + ansible.builtin.apt: + update_cache: true + cache_valid_time: 3600 + become: true + +- name: install mirror - install apt-mirror and nginx + ansible.builtin.apt: + name: + - apt-mirror + - nginx + state: present + become: true diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/main.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/main.yml new file mode 100644 index 0000000..00e7e6c --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/main.yml @@ -0,0 +1,14 @@ +--- +# tasks file + +- name: INCLUDE - install apt-mirror and nginx + ansible.builtin.include_tasks: install_mirror.yml + +- name: INCLUDE - configure apt-mirror + ansible.builtin.include_tasks: configure_mirror.yml + +- name: INCLUDE - prewarm apt-mirror + ansible.builtin.include_tasks: prewarm_mirror.yml + +- name: INCLUDE - serve mirror via nginx + ansible.builtin.include_tasks: serve_mirror.yml diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/prewarm_mirror.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/prewarm_mirror.yml new file mode 100644 index 0000000..7163ab8 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/prewarm_mirror.yml @@ -0,0 +1,19 @@ +--- + +- name: prewarm mirror - run apt-mirror in background + ansible.builtin.command: apt-mirror + become: true + async: 86400 + poll: 0 + register: apt_mirror_prewarm_job + when: apt_mirror_prewarm | default(false) | bool + +- name: prewarm mirror - report prewarm launched + ansible.builtin.debug: + msg: >- + apt-mirror prewarm started in background + (job {{ apt_mirror_prewarm_job.ansible_job_id | default('n/a') }}). + Mirror will be available once {{ apt_mirror_root }}/mirror/ is populated. + when: + - apt_mirror_prewarm | default(false) | bool + - apt_mirror_prewarm_job is defined diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/serve_mirror.yml b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/serve_mirror.yml new file mode 100644 index 0000000..ac1b961 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/tasks/serve_mirror.yml @@ -0,0 +1,43 @@ +--- + +- name: serve mirror - write nginx apt-mirror config + ansible.builtin.template: + src: nginx-aptmirror.conf.j2 + dest: /etc/nginx/conf.d/apt-mirror.conf + owner: root + group: root + mode: "0644" + become: true + notify: restart nginx + +- name: serve mirror - disable default nginx site + ansible.builtin.file: + path: /etc/nginx/sites-enabled/default + state: absent + become: true + notify: restart nginx + +- name: serve mirror - enable and start nginx + ansible.builtin.systemd: + name: nginx + state: started + enabled: true + daemon_reload: true + become: true + +- name: serve mirror - check ufw status + ansible.builtin.command: ufw status + register: _ufw_status_mirror + changed_when: false + failed_when: false + become: true + +- name: serve mirror - open port {{ apt_mirror_http_port }}/tcp + community.general.ufw: + rule: allow + port: "{{ apt_mirror_http_port | string }}" + proto: tcp + become: true + when: + - _ufw_status_mirror.rc == 0 + - "'inactive' not in _ufw_status_mirror.stdout" diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/templates/mirror.list.j2 b/02_ansible_layer/admin/roles/software.install.apt_mirror/templates/mirror.list.j2 new file mode 100644 index 0000000..4c32755 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/templates/mirror.list.j2 @@ -0,0 +1,128 @@ +######################################## +# apt-mirror configuration +# Managed by Ansible — do not edit manually +######################################## + +set base_path {{ apt_mirror_root }} +set mirror_path $base_path/mirror +set skel_path $base_path/skel +set var_path $base_path/var +set cleanscript $var_path/clean.sh +set nthreads {{ apt_mirror_threads }} +set _tilde 0 + +######################################## +# Debian bookworm +######################################## +{% if apt_mirror_debian_bookworm | default(false) | bool %} +deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware +deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware +deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware +{% endif %} +{% endif %} + +{% if apt_mirror_backports | default(false) | bool and apt_mirror_debian_bookworm | default(false) | bool %} +deb http://deb.debian.org/debian bookworm-backports main contrib non-free non-free-firmware +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://deb.debian.org/debian bookworm-backports main contrib non-free non-free-firmware +{% endif %} +{% endif %} + +{% if apt_mirror_security | default(true) | bool and apt_mirror_debian_bookworm | default(false) | bool %} +deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware +{% endif %} +{% endif %} + +######################################## +# Debian trixie +######################################## +{% if apt_mirror_debian_trixie | default(true) | bool %} +deb http://deb.debian.org/debian trixie main contrib non-free non-free-firmware +deb http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://deb.debian.org/debian trixie main contrib non-free non-free-firmware +deb-src http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware +{% endif %} +{% endif %} + +{% if apt_mirror_backports | default(false) | bool %} +deb http://deb.debian.org/debian trixie-backports main contrib non-free non-free-firmware +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://deb.debian.org/debian trixie-backports main contrib non-free non-free-firmware +{% endif %} +{% endif %} + +{% if apt_mirror_security | default(true) | bool %} +deb http://security.debian.org/debian-security trixie-security main contrib non-free non-free-firmware +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://security.debian.org/debian-security trixie-security main contrib non-free non-free-firmware +{% endif %} +{% endif %} + +######################################## +# Ubuntu 22.04 (jammy) +######################################## +{% if apt_mirror_ubuntu_jammy | default(false) | bool %} +deb http://archive.ubuntu.com/ubuntu jammy {{ apt_mirror_ubuntu_components }} +deb http://archive.ubuntu.com/ubuntu jammy-updates {{ apt_mirror_ubuntu_components }} +{% if apt_mirror_backports | default(false) | bool %} +deb http://archive.ubuntu.com/ubuntu jammy-backports {{ apt_mirror_ubuntu_components }} +{% endif %} +{% if apt_mirror_security | default(true) | bool %} +deb http://security.ubuntu.com/ubuntu jammy-security {{ apt_mirror_ubuntu_components }} +{% endif %} +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://archive.ubuntu.com/ubuntu jammy {{ apt_mirror_ubuntu_components }} +deb-src http://archive.ubuntu.com/ubuntu jammy-updates {{ apt_mirror_ubuntu_components }} +{% endif %} +{% endif %} + +######################################## +# Ubuntu 24.04 (noble) +######################################## +{% if apt_mirror_ubuntu_noble | default(false) | bool %} +deb http://archive.ubuntu.com/ubuntu noble {{ apt_mirror_ubuntu_components }} +deb http://archive.ubuntu.com/ubuntu noble-updates {{ apt_mirror_ubuntu_components }} +{% if apt_mirror_backports | default(false) | bool %} +deb http://archive.ubuntu.com/ubuntu noble-backports {{ apt_mirror_ubuntu_components }} +{% endif %} +{% if apt_mirror_security | default(true) | bool %} +deb http://security.ubuntu.com/ubuntu noble-security {{ apt_mirror_ubuntu_components }} +{% endif %} +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://archive.ubuntu.com/ubuntu noble {{ apt_mirror_ubuntu_components }} +deb-src http://archive.ubuntu.com/ubuntu noble-updates {{ apt_mirror_ubuntu_components }} +{% endif %} +{% endif %} + +######################################## +# Ubuntu 26.04 (resolute) +######################################## +{% if apt_mirror_ubuntu_resolute | default(false) | bool %} +deb http://archive.ubuntu.com/ubuntu resolute {{ apt_mirror_ubuntu_components }} +deb http://archive.ubuntu.com/ubuntu resolute-updates {{ apt_mirror_ubuntu_components }} +{% if apt_mirror_backports | default(false) | bool %} +deb http://archive.ubuntu.com/ubuntu resolute-backports {{ apt_mirror_ubuntu_components }} +{% endif %} +{% if apt_mirror_security | default(true) | bool %} +deb http://security.ubuntu.com/ubuntu resolute-security {{ apt_mirror_ubuntu_components }} +{% endif %} +{% if apt_mirror_include_sources | default(false) | bool %} +deb-src http://archive.ubuntu.com/ubuntu resolute {{ apt_mirror_ubuntu_components }} +deb-src http://archive.ubuntu.com/ubuntu resolute-updates {{ apt_mirror_ubuntu_components }} +{% endif %} +{% endif %} + +######################################## +# Clean scripts +######################################## +clean http://deb.debian.org/debian +clean http://security.debian.org/debian-security +{% if apt_mirror_ubuntu_jammy | default(false) | bool or apt_mirror_ubuntu_noble | default(false) | bool or apt_mirror_ubuntu_resolute | default(false) | bool %} +clean http://archive.ubuntu.com/ubuntu +clean http://security.ubuntu.com/ubuntu +{% endif %} diff --git a/02_ansible_layer/admin/roles/software.install.apt_mirror/templates/nginx-aptmirror.conf.j2 b/02_ansible_layer/admin/roles/software.install.apt_mirror/templates/nginx-aptmirror.conf.j2 new file mode 100644 index 0000000..2175287 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.apt_mirror/templates/nginx-aptmirror.conf.j2 @@ -0,0 +1,23 @@ +# Managed by Ansible — do not edit manually +server { + listen {{ apt_mirror_http_port }}; + listen [::]:{{ apt_mirror_http_port }}; + + server_name _; + + root {{ apt_mirror_root }}/mirror; + autoindex on; + + access_log /var/log/nginx/apt-mirror-access.log; + error_log /var/log/nginx/apt-mirror-error.log; + + location / { + try_files $uri $uri/ =404; + } + + location /healthz { + access_log off; + return 200 "ok\n"; + add_header Content-Type text/plain; + } +} diff --git a/02_ansible_layer/admin/roles/software.install.nextcloud/defaults/main.yml b/02_ansible_layer/admin/roles/software.install.nextcloud/defaults/main.yml new file mode 100644 index 0000000..d2edd8e --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.nextcloud/defaults/main.yml @@ -0,0 +1,6 @@ +--- +NEXTCLOUD_LOCAL_PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud" +NEXTCLOUD_REMOTE_PROJECT_DIR: "/opt/range42/nextcloud" +NEXTCLOUD_OPERATOR_USER: "{{ default_admin_vm_ci_user }}" +NEXTCLOUD_CONTAINER_NAME: "nextcloud" +NEXTCLOUD_LABEL_PROJECT_TYPE: "admin" diff --git a/02_ansible_layer/admin/roles/software.install.nextcloud/meta/main.yml b/02_ansible_layer/admin/roles/software.install.nextcloud/meta/main.yml new file mode 100644 index 0000000..d05b85f --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.nextcloud/meta/main.yml @@ -0,0 +1,14 @@ +--- +dependencies: [] +galaxy_info: + role_name: software_install_nextcloud + namespace: range42 + author: range42 + description: Deploy the Nextcloud docker-compose stack (admin collaboration service). + license: GPL-3.0-or-later + min_ansible_version: "2.14" + platforms: + - name: Ubuntu + versions: [noble] + - name: Debian + versions: [trixie] diff --git a/02_ansible_layer/admin/roles/software.install.nextcloud/tasks/main.yml b/02_ansible_layer/admin/roles/software.install.nextcloud/tasks/main.yml new file mode 100644 index 0000000..4d62729 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.nextcloud/tasks/main.yml @@ -0,0 +1,12 @@ +--- +- name: DEPLOY - nextcloud docker-compose stack + ansible.builtin.include_role: + name: software.configure.docker-compose + vars: + LOCAL__PROJECT_DIR: "{{ NEXTCLOUD_LOCAL_PROJECT_DIR }}" + REMOTE_PROJECT_DIR: "{{ NEXTCLOUD_REMOTE_PROJECT_DIR }}" + OPERATOR_USER: "{{ NEXTCLOUD_OPERATOR_USER }}" + LABEL_PROJECT_TYPE: "{{ NEXTCLOUD_LABEL_PROJECT_TYPE }}" + LABEL_PROJET_NAME: "{{ NEXTCLOUD_CONTAINER_NAME }}" + SEND_POC_DIR: "NO" + CLEAN_UP_DEPLOY_DIR: "NO" diff --git a/02_ansible_layer/admin/roles/software.install.nodejs_app_systemd/tasks/main.yml b/02_ansible_layer/admin/roles/software.install.nodejs_app_systemd/tasks/main.yml index 9851b1b..115809d 100644 --- a/02_ansible_layer/admin/roles/software.install.nodejs_app_systemd/tasks/main.yml +++ b/02_ansible_layer/admin/roles/software.install.nodejs_app_systemd/tasks/main.yml @@ -6,11 +6,23 @@ - name: INSTALL NODEJS block: # - - name: CURL OFFICIAL NODESOURCE SETUP - {{ NODE_VERSION }}.x - ansible.builtin.shell: | - curl -fsSL https://deb.nodesource.com/setup_{{ NODE_VERSION }}.x | bash - + - name: DOWNLOAD NODESOURCE SETUP SCRIPT - {{ NODE_VERSION }}.x + ansible.builtin.get_url: + url: "https://deb.nodesource.com/setup_{{ NODE_VERSION }}.x" + dest: /tmp/nodesource_setup.sh + mode: '0755' + become: true + + - name: RUN NODESOURCE SETUP - {{ NODE_VERSION }}.x + ansible.builtin.command: /tmp/nodesource_setup.sh args: - executable: /bin/bash + creates: /etc/apt/sources.list.d/nodesource.list + become: true + + - name: REMOVE NODESOURCE SETUP SCRIPT + ansible.builtin.file: + path: /tmp/nodesource_setup.sh + state: absent become: true # diff --git a/02_ansible_layer/admin/roles/software.install.rocketchat/README.md b/02_ansible_layer/admin/roles/software.install.rocketchat/README.md new file mode 100644 index 0000000..287e235 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.rocketchat/README.md @@ -0,0 +1,36 @@ +# software.install.rocketchat + +Deploys the **Rocket.Chat** docker-compose stack onto a target box. + +The stack itself (Rocket.Chat + MongoDB replica set + token provisioner) lives in +the catalog at [`03_container_layer/docker/admin/rocketchat/`](../../../../03_container_layer/docker/admin/rocketchat/). +This role rsyncs that directory onto the box and brings it up, delegating the +deploy + `docker compose up` to the shared +[`software.configure.docker-compose`](../software.configure.docker-compose/) role. + +## Requirements + +Docker engine + compose plugin must already be installed on the target. Wire +`software.install.warmup.basic_packages` with `INSTALL_PACKAGES_DOCKER: "YES"` +and `INSTALL_PACKAGES_DOCKER_COMPOSE: "YES"` before this role (the +`admin-rocketchat` box template does this). + +`RANGE42_INVENTORY` must be exported on the controller (done by `range42-context`) +so the stack source resolves. + +## Role variables + +| Variable | Default | Purpose | +|----------|---------|---------| +| `ROCKETCHAT_LOCAL_PROJECT_DIR` | `{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat` | Controller-side stack source | +| `ROCKETCHAT_REMOTE_PROJECT_DIR` | `/opt/range42/rocketchat` | Where the stack is staged + run on the box | +| `ROCKETCHAT_OPERATOR_USER` | `{{ default_admin_vm_ci_user }}` | Owner of staged files (scenario cloud-init admin user) | +| `ROCKETCHAT_CONTAINER_NAME` | `rocketchat` | Main container polled after `up` | +| `ROCKETCHAT_LABEL_PROJECT_TYPE` | `admin` | Label only | + +## Notes + +The compose stack ships sane defaults (admin creds, `ROOT_URL`, `HTTP_PORT=3000`) +via `.env.example`; override by editing the stack's `.env` before deploy. The web +UI listens on port 3000 — open it on the box firewall (the `admin-rocketchat` box +template does). diff --git a/02_ansible_layer/admin/roles/software.install.rocketchat/defaults/main.yml b/02_ansible_layer/admin/roles/software.install.rocketchat/defaults/main.yml new file mode 100644 index 0000000..dafc00b --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.rocketchat/defaults/main.yml @@ -0,0 +1,27 @@ +--- +# software.install.rocketchat — deploy the Rocket.Chat docker-compose stack. +# +# The stack itself lives in the catalog at +# 03_container_layer/docker/admin/rocketchat/ +# (Rocket.Chat + MongoDB replica set + provisioner). This role rsyncs that +# directory onto the target box and brings it up via docker compose, reusing the +# shared software.configure.docker-compose role. + +# Controller-side source: resolved from the workspace RANGE42_INVENTORY env var +# (exported by range42-context). Mirrors how CTF stacks resolve +# RANGE42_INVENTORY__DOCKER__CTF at deploy time. +ROCKETCHAT_LOCAL_PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat" + +# Where the stack is staged + run on the target box. +ROCKETCHAT_REMOTE_PROJECT_DIR: "/opt/range42/rocketchat" + +# Owner of the staged files on the box: the scenario cloud-init admin user. +# Matches the canonical OPERATOR_USER wiring (no fallback — fail loudly if the +# scenario never set it, rather than silently chown to a user that may not exist). +ROCKETCHAT_OPERATOR_USER: "{{ default_admin_vm_ci_user }}" + +# Container name docker-compose polls for after `up` — matches compose.yml. +ROCKETCHAT_CONTAINER_NAME: "rocketchat" + +# Label only; admin service (not a CTF target). +ROCKETCHAT_LABEL_PROJECT_TYPE: "admin" diff --git a/02_ansible_layer/admin/roles/software.install.rocketchat/meta/main.yml b/02_ansible_layer/admin/roles/software.install.rocketchat/meta/main.yml new file mode 100644 index 0000000..62522da --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.rocketchat/meta/main.yml @@ -0,0 +1,14 @@ +--- +dependencies: [] +galaxy_info: + role_name: software_install_rocketchat + namespace: range42 + author: range42 + description: Deploy the Rocket.Chat docker-compose stack (admin collaboration service). + license: GPL-3.0-or-later + min_ansible_version: "2.14" + platforms: + - name: Ubuntu + versions: [noble] + - name: Debian + versions: [trixie] diff --git a/02_ansible_layer/admin/roles/software.install.rocketchat/tasks/main.yml b/02_ansible_layer/admin/roles/software.install.rocketchat/tasks/main.yml new file mode 100644 index 0000000..eeb2dc7 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.rocketchat/tasks/main.yml @@ -0,0 +1,23 @@ +--- +## +## software.install.rocketchat +## +## Deploys the catalog Rocket.Chat docker-compose stack onto the target box by +## delegating to the shared software.configure.docker-compose role. Assumes the +## Docker engine + compose plugin are already present (wire +## software.install.warmup.basic_packages with INSTALL_PACKAGES_DOCKER first). +## + +- name: DEPLOY - rocket.chat docker-compose stack + ansible.builtin.include_role: + name: software.configure.docker-compose + vars: + LOCAL__PROJECT_DIR: "{{ ROCKETCHAT_LOCAL_PROJECT_DIR }}" + REMOTE_PROJECT_DIR: "{{ ROCKETCHAT_REMOTE_PROJECT_DIR }}" + OPERATOR_USER: "{{ ROCKETCHAT_OPERATOR_USER }}" + LABEL_PROJECT_TYPE: "{{ ROCKETCHAT_LABEL_PROJECT_TYPE }}" + LABEL_PROJET_NAME: "{{ ROCKETCHAT_CONTAINER_NAME }}" + SEND_POC_DIR: "NO" + CLEAN_UP_DEPLOY_DIR: "NO" + +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/defaults/main.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/defaults/main.yml deleted file mode 100644 index 1bfec26..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/defaults/main.yml +++ /dev/null @@ -1,37 +0,0 @@ ---- -# Used only for Debian/Ubuntu. -tailscale_apt_gpg_key: "https://pkgs.tailscale.com/stable/{{ ansible_distribution|lower }}/{{ ansible_distribution_release|lower }}.gpg" -tailscale_apt_repository: "deb https://pkgs.tailscale.com/stable/{{ ansible_distribution|lower }} {{ ansible_distribution_release|lower }} main" - -# Used only for RedHat/CentOS/Fedora. -__ts_yum_centos_repo_url: "https://pkgs.tailscale.com/stable/centos/{{ ansible_distribution_major_version }}/tailscale.repo" -__ts_yum_fedora_repo_url: "https://pkgs.tailscale.com/stable/fedora/tailscale.repo" -tailscale_yum_repository_url: "{{ (ansible_distribution == 'Fedora') | ternary(__ts_yum_fedora_repo_url, __ts_yum_centos_repo_url) }}" - -# Service options. -tailscale_service_name: "tailscaled" -tailscale_service_state: started -tailscale_service_enabled: true - -# Up options. -tailscale_up_node: false -tailscale_up_authkey: "" -tailscale_up_timeout: "30s" -tailscale_up_extra_args: "" -tailscale_up_no_log: true - -# Cert options. -tailscale_cert_enabled: false -tailscale_cert_domain: "" -tailscale_cert_dir: "/usr/local/etc/ssl/certs" -tailscale_cert_filename: "{{ tailscale_cert_domain }}.crt" -tailscale_cert_private_key_dir: "/usr/local/etc/ssl/private" -tailscale_cert_private_key_filename: "{{ tailscale_cert_domain }}.key" - -# Configure /etc/default/tailscaled options. -tailscale_default_options_enabled: true -# tailscale_default_options_settings: -# # Allow caddy user to fetch cert. -# # See https://tailscale.com/kb/1190/caddy-certificates/#provide-non-root-users-with-access-to-fetch-certificate. -# - regexp: "^#?TS_PERMIT_CERT_UID" -# line: "TS_PERMIT_CERT_UID=\"caddy\"" diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/handlers/main.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/handlers/main.yml deleted file mode 100644 index 7067a58..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/handlers/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: restart tailscaled - service: - name: tailscaled - state: restarted diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/meta/main.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/meta/main.yml deleted file mode 100644 index 773a467..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/meta/main.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -dependencies: [] - -galaxy_info: - role_name: tailscale - author: jason_riddle - description: "Tailscale on Linux." - issue_tracker_url: https://github.com/jason-riddle/ansible-role-tailscale/issues - license: "MIT" - min_ansible_version: 2.4 - platforms: - - name: Debian - versions: - - buster # Debian 10 - - bullseye # Debian 11 - - name: Ubuntu - versions: - - bionic # Ubuntu 18.04 - - focal # Ubuntu 20.04 - - name: Fedora - versions: - - 38 - galaxy_tags: - - system - - tailscale diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/cert.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/cert.yml deleted file mode 100644 index e713591..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/cert.yml +++ /dev/null @@ -1,44 +0,0 @@ ---- -- name: Assert that tailscale_cert_domain is not empty. - assert: - that: - - tailscale_cert_domain | length > 0 - quiet: true - -- name: Assert that tailscale_cert_dir is not empty. - assert: - that: - - tailscale_cert_dir | length > 0 - quiet: true - -- name: Assert that tailscale_cert_filename is not empty. - assert: - that: - - tailscale_cert_filename | length > 0 - quiet: true - -- name: Assert that tailscale_cert_private_key_dir is not empty. - assert: - that: - - tailscale_cert_private_key_dir | length > 0 - quiet: true - -- name: Assert that tailscale_cert_private_key_filename is not empty. - assert: - that: - - tailscale_cert_private_key_filename | length > 0 - quiet: true - -- name: Ensure {{ tailscale_cert_dir }} exists. - file: - path: "{{ tailscale_cert_dir }}" - state: directory - -- name: Ensure {{ tailscale_cert_private_key_dir }} exists. - file: - path: "{{ tailscale_cert_private_key_dir }}" - state: directory - -- name: Run tailscale cert and generate cert. - command: | - tailscale cert --cert-file="{{ tailscale_cert_dir }}/{{ tailscale_cert_filename }}" --key-file="{{ tailscale_cert_private_key_dir }}/{{ tailscale_cert_private_key_filename }}" "{{ tailscale_cert_domain }}" diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/default-options.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/default-options.yml deleted file mode 100644 index 3e05765..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/default-options.yml +++ /dev/null @@ -1,11 +0,0 @@ ---- -- name: Configure options in /etc/default/tailscaled. - lineinfile: - dest: /etc/default/tailscaled - regexp: "{{ item.regexp }}" - line: "{{ item.line }}" - insertafter: EOF - state: present - with_items: "{{ tailscale_default_options_settings }}" - notify: - - restart tailscaled diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/main.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/main.yml deleted file mode 100644 index 748edca..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/main.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- -- name: Include setup-Debian.yml - include_tasks: setup-Debian.yml - when: ansible_os_family == 'Debian' - -- name: Include setup-RedHat.yml - include_tasks: setup-RedHat.yml - when: ansible_os_family == 'RedHat' - -- name: Install tailscale. - package: - name: tailscale - state: present - -- name: Ensure service is running as desired. - service: - name: "{{ tailscale_service_name }}" - state: "{{ tailscale_service_state }}" - enabled: "{{ tailscale_service_enabled }}" - -- name: Include up.yml - include_tasks: up.yml - when: tailscale_up_node | bool - -- name: Include default-options.yml - include_tasks: default-options.yml - when: tailscale_default_options_enabled | bool - -# If /etc/default/tailscaled was modified, run 'restart tailscaled' -# handler before running `tailscale cert` command. -- name: Run handlers. - meta: flush_handlers - -- name: Include cert.yml - include_tasks: cert.yml - when: tailscale_cert_enabled | bool diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/setup-Debian.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/setup-Debian.yml deleted file mode 100644 index f962ba9..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/setup-Debian.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -- name: Ensure additional dependencies are installed (on Ubuntu < 20.04 and any other systems). - apt: - name: gnupg2 - state: present - when: ansible_distribution != 'Ubuntu' or ansible_distribution_version is version('20.04', '<') - -- name: Ensure additional dependencies are installed (on Ubuntu >= 20.04). - apt: - name: gnupg - state: present - when: ansible_distribution == 'Ubuntu' or ansible_distribution_version is version('20.04', '>=') - -- name: Add tailscale apt key. - apt_key: - url: "{{ tailscale_apt_gpg_key }}" - state: present - -- name: Add tailscale apt repository. - apt_repository: - repo: "{{ tailscale_apt_repository }}" - state: present - update_cache: true diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/setup-RedHat.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/setup-RedHat.yml deleted file mode 100644 index 5001d38..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/setup-RedHat.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: Add tailscale yum repository. - get_url: - url: "{{ tailscale_yum_repository_url }}" - dest: /etc/yum.repos.d/tailscale.repo - owner: root - group: root - mode: 0644 diff --git a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/up.yml b/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/up.yml deleted file mode 100644 index 5579154..0000000 --- a/02_ansible_layer/admin/roles/software.install.tailscale/trashed/tasks/up.yml +++ /dev/null @@ -1,45 +0,0 @@ ---- -- name: Assert that tailscale_up_authkey is not empty. - assert: - that: - - tailscale_up_authkey | length > 0 - quiet: true - -- name: Assert that tailscale_up_timeout is not empty. - assert: - that: - - tailscale_up_timeout | length > 0 - quiet: true - -- name: Get tailscale status before running up. - command: | - tailscale status --json - register: tailscale_status_before_up - changed_when: false - -# Up - V1 -# - name: Run tailscale up. -# command: | -# tailscale up --authkey="{{ tailscale_up_authkey }}" --timeout="{{ tailscale_up_timeout }}" {{ tailscale_up_extra_args }} -# tags: -# - molecule-idempotence-notest -# no_log: "{{ tailscale_up_no_log }}" - -# TODO: Still working on this. Logic seems fine, but comments need some work. -# -# In the previous version of up, the up command was running, but tailscale was always reporting a change. -# In this new version, we compare the output of the `Self` field from the previous status and from running status right after running up. -# So, if there is a difference, then something has changed and tailscale should mark this task as having changed in the playbook summary. -# If nothing has changed, then this will be shown as not having changed. -# -# Also, In order to compare the stdouts of both status commands, send the stdout of tailscale up to stderr. -# So if there was an issue running up, the stderr can be inspected. -# -# Up - V2 -- name: Run tailscale up. - shell: | - >&2 tailscale up --authkey="{{ tailscale_up_authkey }}" --timeout="{{ tailscale_up_timeout }}" {{ tailscale_up_extra_args }} - tailscale status --json - no_log: "{{ tailscale_up_no_log }}" - register: tailscale_status_after_up - changed_when: (tailscale_status_before_up.stdout | from_json).Self != (tailscale_status_after_up.stdout | from_json).Self diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/_main.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/_main.yaml index 35a0901..295054e 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/_main.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/_main.yaml @@ -3,9 +3,9 @@ - name: INCLUDE - install - docker block: # - - name: install - docker - ubuntu - ansible.builtin.include_tasks: ./ubuntu/docker.yaml - when: ansible_facts.distribution == 'Ubuntu' + - name: install - docker - debian-based + ansible.builtin.include_tasks: ./debian-based/docker.yaml + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: install - docker - fedora ansible.builtin.include_tasks: ./fedora/docker.yaml @@ -18,9 +18,9 @@ - name: INCLUDE - install - docker-compose block: # - - name: install - docker-compose - ubuntu - ansible.builtin.include_tasks: ./ubuntu/docker_compose.yaml - when: ansible_facts.distribution == 'Ubuntu' + - name: install - docker-compose - debian-based + ansible.builtin.include_tasks: ./debian-based/docker_compose.yaml + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: install - docker-compose - fedora ansible.builtin.include_tasks: ./fedora/docker_compose.yaml diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/debian-based/docker.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/debian-based/docker.yaml new file mode 100644 index 0000000..88cfdd6 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/debian-based/docker.yaml @@ -0,0 +1,80 @@ +--- +- name: install docker - requirements - fedora + block: + # + - name: install docker - requirements for docker-compose and docker - debian-based + ansible.builtin.apt: + name: + - apt-transport-https + - ca-certificates + - curl + # software-properties-common: Ubuntu-only here — absent from Debian + # trixie 'main', and unused anyway (the Docker repo is added via the + # apt_repository/apt_key modules, not add-apt-repository). + - make + - gcc + - python3-pip + - python3-dev + - libffi-dev + - libssl-dev + state: present + + #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### + + # apt-key is removed on Debian 12+/trixie (and deprecated on Ubuntu), so the + # apt_key module fails ("apt-key not found"). Use the modern keyring method: + # fetch the armored key into /etc/apt/keyrings and pin it via signed-by=. + - name: install docker - ensure /etc/apt/keyrings exists + ansible.builtin.file: + path: /etc/apt/keyrings + state: directory + mode: "0755" + + # + - name: install docker - add docker official GPG key (keyring) + ansible.builtin.get_url: + url: https://download.docker.com/linux/{{ ansible_facts.distribution | lower }}/gpg + dest: /etc/apt/keyrings/docker.asc + mode: "0644" + + # + - name: install docker - add Docker CE repository + ansible.builtin.apt_repository: + repo: "deb [arch={{ 'arm64' if ansible_facts.architecture == 'aarch64' else 'amd64' }} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/{{ ansible_facts.distribution | lower }} {{ ansible_distribution_release }} stable" + filename: docker + state: present + + # + - name: install docker - docker-ce - debian-based + ansible.builtin.apt: + name: + - docker-ce + - docker-ce-cli + - containerd.io + update_cache: yes + state: present + + # + - name: install docker - enable docker service + ansible.builtin.systemd: + name: docker + enabled: yes + state: started + + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] + +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### + +- name: check docker - checks debug - debian-based + block: + - name: check - docker installation + ansible.builtin.command: + cmd: docker version + register: result + + - name: check - docker version + ansible.builtin.debug: + msg: "{{ result.stdout }}" + when: result is defined + + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/debian-based/docker_compose.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/debian-based/docker_compose.yaml new file mode 100644 index 0000000..f86c602 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/debian-based/docker_compose.yaml @@ -0,0 +1,58 @@ +--- +# +- name: install docker-compose - requirements - debian-based + block: + # + - name: install docker-compose - requirements - debian-based + ansible.builtin.apt: + name: + - apt-transport-https + - ca-certificates + - curl + # software-properties-common: Ubuntu-only — absent from Debian trixie + # 'main' and unused here (repo added via apt_repository + signed-by). + - make + - gcc + - python3-pip + - python3-dev + - libffi-dev + - libssl-dev + # python Docker SDK — required by the community.docker modules + # (docker_compose_v2 / docker_container_info) used to deploy stacks. + - python3-docker + state: present + + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] + +# +# Docker Compose v2 is the `docker compose` CLI plugin (not the old standalone +# `docker-compose` binary). community.docker.docker_compose_v2 shells out to +# `docker compose`, so install the official plugin from the docker-ce repo +# (added by docker.yaml). The previous standalone-binary download used a v1-era +# asset name (docker-compose-Linux-x86_64) that 404s for v2 releases. +- name: install docker-compose - compose v2 plugin - debian-based + ansible.builtin.apt: + name: + - docker-compose-plugin + update_cache: true + state: present + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] + +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### + +- name: check docker-compose - checks debug - debian-based + block: + # + - name: check - docker compose v2 installation + ansible.builtin.command: + cmd: docker compose version + register: result + changed_when: false + + # + - name: check - docker compose version + ansible.builtin.debug: + msg: "{{ result.stdout }}" + when: result is defined + + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/ubuntu/docker.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/ubuntu/docker.yaml deleted file mode 100644 index 6f1f200..0000000 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/ubuntu/docker.yaml +++ /dev/null @@ -1,66 +0,0 @@ ---- -- name: install docker - requirements - fedora - block: - # - - name: install docker - requirements for docker-compose and docker - ubuntu - ansible.builtin.apt: - name: - - apt-transport-https - - ca-certificates - - curl - - software-properties-common - - make - - gcc - - python3-pip - - python3-dev - - libffi-dev - - libssl-dev - state: present - - #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### - - - name: install docker - add docker official GPG key - ansible.builtin.apt_key: - url: https://download.docker.com/linux/ubuntu/gpg - state: present - - # - - name: install docker - add Docker CE repository - ansible.builtin.apt_repository: - repo: deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable - state: present - - # - - name: install docker - docker-ce - ubuntu - ansible.builtin.apt: - name: - - docker-ce - - docker-ce-cli - - containerd.io - update_cache: yes - state: present - - # - - name: install docker - enable docker service - ansible.builtin.systemd: - name: docker - enabled: yes - state: started - - when: ansible_facts.distribution == 'Ubuntu' - -#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### - -- name: check docker - checks debug - ubuntu - block: - - name: check - docker installation - ansible.builtin.command: - cmd: docker version - register: result - - - name: check - docker version - ansible.builtin.debug: - msg: "{{ result.stdout }}" - when: result is defined - - when: ansible_facts.distribution == 'Ubuntu' diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/ubuntu/docker_compose.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/ubuntu/docker_compose.yaml deleted file mode 100644 index a3408ec..0000000 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/docker/ubuntu/docker_compose.yaml +++ /dev/null @@ -1,57 +0,0 @@ ---- -# -- name: install docker - requirements - fedora - block: - # - - name: install docker - requirements for docker-compose and docker - ubuntu - ansible.builtin.apt: - name: - - apt-transport-https - - ca-certificates - - curl - - software-properties-common - - make - - gcc - - python3-pip - - python3-dev - - libffi-dev - - libssl-dev - state: present - - when: ansible_facts.distribution == 'Ubuntu' - -# -- name: install docker-compose - get_url docker-compose - block: - # - - name: DOWNLOAD - docker-compose - ansible.builtin.get_url: - url: "https://github.com/docker/compose/releases/download/v{{ DOCKER_COMPOSE_VERSION | default('2.39.1') }}/docker-compose-Linux-x86_64" - dest: "/usr/local/bin/docker-compose" - mode: "0755" - - # - - name: install docker-compose - chmod +x docker-compose - ansible.builtin.file: - path: /usr/local/bin/docker-compose - mode: "u+x,g+x" - - when: ansible_facts.distribution == 'Ubuntu' - -#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### - -- name: check docker-compose - checks debug - ubuntu - block: - # - - name: check - docker-compose installation - ansible.builtin.command: - cmd: docker-compose --version - register: result - - # - - name: check - docker-compose version - ansible.builtin.debug: - msg: "{{ result.stdout }}" - when: result is defined - - when: ansible_facts.distribution == 'Ubuntu' diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/_main.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/_main.yaml index 7f65390..de07af9 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/_main.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/_main.yaml @@ -4,9 +4,9 @@ - name: INCLUDE - install - firewalls related packages block: # - - name: install - firewall packages - ubuntu - ansible.builtin.include_tasks: ./ubuntu/ufw.yaml - when: ansible_facts.distribution == 'Ubuntu' + - name: install - firewall packages - debian-based + ansible.builtin.include_tasks: ./debian-based/ufw.yaml + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: install - firewall packages - fedora diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/debian-based/ufw.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/debian-based/ufw.yaml new file mode 100644 index 0000000..7727285 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/debian-based/ufw.yaml @@ -0,0 +1,9 @@ +--- +# + +- name: install - firewall packages - debian-based + apt: + name: + - ufw + + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/ubuntu/ufw.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/ubuntu/ufw.yaml deleted file mode 100644 index 37fca1f..0000000 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/firewalls/ubuntu/ufw.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# - -- name: install - firewall packages - ubuntu - apt: - name: - - ufw - - when: ansible_facts.distribution == 'Ubuntu' diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/_main.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/_main.yaml index a7ce1a1..e3e5e6a 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/_main.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/_main.yaml @@ -2,10 +2,10 @@ block: # - - name: INCLUDE - install ntp client and force update time - ubuntu - ansible.builtin.include_tasks: ./ubuntu/systemd_timesyncd.yaml + - name: INCLUDE - install ntp client and force update time - debian-based + ansible.builtin.include_tasks: ./debian-based/systemd_timesyncd.yaml - when: ansible_facts.distribution == 'Ubuntu' + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: INCLUDE - install ntp client and force update time - fedora diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/ubuntu/systemd_timesyncd.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/debian-based/systemd_timesyncd.yaml similarity index 66% rename from 02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/ubuntu/systemd_timesyncd.yaml rename to 02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/debian-based/systemd_timesyncd.yaml index c9a1353..0ef0545 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/ubuntu/systemd_timesyncd.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/network/ntp_client/debian-based/systemd_timesyncd.yaml @@ -1,7 +1,7 @@ --- -# - name: install ntp package - ubuntu +# - name: install ntp package - debian-based # block: -# - name: install ntp - ubuntu +# - name: install ntp - debian-based # apt: # name: # - ntp @@ -9,13 +9,13 @@ # state: present # update_cache: yes -# when: ansible_facts.distribution == 'Ubuntu' +# when: ansible_facts.distribution in ['Ubuntu', 'Debian'] -# - name: reload ntp service - ubuntu +# - name: reload ntp service - debian-based # systemd: # name: ntp # state: restarted -# when: ansible_facts.distribution == 'Ubuntu' +# when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: force ntp sync - ntpdate # command: ntpdate -u pool.ntp.org @@ -23,7 +23,7 @@ # - debug: var=out.stdout_lines -# when: ansible_facts.distribution == 'Ubuntu' +# when: ansible_facts.distribution in ['Ubuntu', 'Debian'] - name: install ntp package - remove chrony or ntp to avoid conflicts then enable systemd-timesyncd block: @@ -36,19 +36,19 @@ state: absent # - - name: check systemd-timesyncd is installed - ubuntu + - name: check systemd-timesyncd is installed - debian-based apt: name: systemd-timesyncd state: present # - - name: enable and start systemd-timesyncd - ubuntu + - name: enable and start systemd-timesyncd - debian-based systemd: name: systemd-timesyncd enabled: true state: started - when: ansible_facts.distribution == 'Ubuntu' + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -58,7 +58,7 @@ block: # - - name: wait time drift - ubuntu + - name: wait time drift - debian-based command: timedatectl show -p NTPSynchronized --value register: ntp_sync_check until: ntp_sync_check.stdout == "yes" @@ -67,11 +67,11 @@ changed_when: false # - - name: assert - time is sync - ubuntu + - name: assert - time is sync - debian-based assert: that: - ntp_sync_check.stdout == "yes" fail_msg: " clock is not sync!" success_msg: " clock is sync !" - when: ansible_facts.distribution == 'Ubuntu' + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/_main.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/_main.yaml index 77e463c..67456a8 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/_main.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/_main.yaml @@ -3,9 +3,9 @@ - name: install - basics packages - block block: # - - name: INCLUDE - install - basics packages - ubuntu - ansible.builtin.include_tasks: ./ubuntu/packages_basics.yaml - when: ansible_facts.distribution == 'Ubuntu' + - name: INCLUDE - install - basics packages - debian-based + ansible.builtin.include_tasks: ./debian-based/packages_basics.yaml + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: INCLUDE - install - basics packages - fedora ansible.builtin.include_tasks: ./fedora/packages_basics.yaml diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/ubuntu/packages_basics.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/debian-based/packages_basics.yaml similarity index 70% rename from 02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/ubuntu/packages_basics.yaml rename to 02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/debian-based/packages_basics.yaml index e311a19..45329a2 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/ubuntu/packages_basics.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/basics/debian-based/packages_basics.yaml @@ -1,7 +1,7 @@ --- # -- name: install - basics packages - ubuntu +- name: install - basics packages - debian-based apt: name: - git @@ -21,4 +21,4 @@ state: present update_cache: yes - when: ansible_facts.distribution == 'Ubuntu' + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/cleaning/_main.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/cleaning/_main.yaml index 36612e3..e8f81cb 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/cleaning/_main.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/cleaning/_main.yaml @@ -3,9 +3,9 @@ - name: install - basics packages - block block: # - # - name: INCLUDE - remove packages - ubuntu - # ansible.builtin.include_tasks: ./ubuntu/packages_basics.yaml - # when: ansible_facts.distribution == 'Ubuntu' + # - name: INCLUDE - remove packages - debian-based + # ansible.builtin.include_tasks: ./debian-based/packages_basics.yaml + # when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: INCLUDE - remove packages - fedora ansible.builtin.include_tasks: ./fedora/remove_cockpit.yaml diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/_main.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/_main.yaml index 6c1ccb5..1917833 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/_main.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/_main.yaml @@ -3,9 +3,9 @@ - name: install - basics packages - block block: # - - name: INCLUDE - install - utils_json packages - ubuntu - ansible.builtin.include_tasks: ./ubuntu/utils_json.yaml - when: ansible_facts.distribution == 'Ubuntu' + - name: INCLUDE - install - utils_json packages - debian-based + ansible.builtin.include_tasks: ./debian-based/utils_json.yaml + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: INCLUDE - install - utils_json packages - fedora ansible.builtin.include_tasks: ./fedora/utils_json.yaml diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/debian-based/utils_json.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/debian-based/utils_json.yaml new file mode 100644 index 0000000..08ee34a --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/debian-based/utils_json.yaml @@ -0,0 +1,12 @@ +--- +# + +- name: install - utils_json packages - debian-based + apt: + name: + - jq + - wget + - curl + - parallel + + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/ubuntu/utils_json.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/ubuntu/utils_json.yaml deleted file mode 100644 index 6d5324f..0000000 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/json/ubuntu/utils_json.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -# - -- name: install - utils_json packages - ubuntu - apt: - name: - - jq - - wget - - curl - - parallel - - when: ansible_facts.distribution == 'Ubuntu' diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/_main.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/_main.yaml index 212bf62..e1c3795 100644 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/_main.yaml +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/_main.yaml @@ -4,9 +4,9 @@ - name: install - utils packages - block block: # - - name: INCLUDE - install - network related packages - ubuntu - ansible.builtin.include_tasks: ./ubuntu/utils_network.yaml - when: ansible_facts.distribution == 'Ubuntu' + - name: INCLUDE - install - network related packages - debian-based + ansible.builtin.include_tasks: ./debian-based/utils_network.yaml + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] # - name: INCLUDE - install - network related packages - fedora diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/debian-based/utils_network.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/debian-based/utils_network.yaml new file mode 100644 index 0000000..dcf8b36 --- /dev/null +++ b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/debian-based/utils_network.yaml @@ -0,0 +1,12 @@ +--- +# + +- name: install - utils_network packages - debian-based + apt: + name: + - nmap + - tcpdump + - net-tools + - iputils-ping + + when: ansible_facts.distribution in ['Ubuntu', 'Debian'] diff --git a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/ubuntu/utils_network.yaml b/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/ubuntu/utils_network.yaml deleted file mode 100644 index 5bb0015..0000000 --- a/02_ansible_layer/admin/roles/software.install.warmup.basic_packages/tasks/include/packages-sets/utils/network/ubuntu/utils_network.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -# - -- name: install - utils_network packages - ubuntu - apt: - name: - - nmap - - tcpdump - - net-tools - - iputils-ping - - when: ansible_facts.distribution == 'Ubuntu' diff --git a/02_ansible_layer/admin/roles/software.install.wazuh/meta/main.yml b/02_ansible_layer/admin/roles/software.install.wazuh/meta/main.yml index 4b059bf..fc5ffbb 100644 --- a/02_ansible_layer/admin/roles/software.install.wazuh/meta/main.yml +++ b/02_ansible_layer/admin/roles/software.install.wazuh/meta/main.yml @@ -4,7 +4,7 @@ galaxy_info: description: Installing, deploying and configuring Wazuh using Ansible. company: wazuh.com license: license (GPLv3) - min_ansible_version: 2.0 + min_ansible_version: "2.0" platforms: - name: EL versions: diff --git a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Debian.yml b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Debian.yml index 043ad9a..2d3f9f5 100644 --- a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Debian.yml +++ b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Debian.yml @@ -24,26 +24,11 @@ until: wazuh_agent_ca_package_install is succeeded when: not (ansible_distribution == "Debian" and ansible_distribution_major_version in ['11']) -- name: Debian/Ubuntu | Installing Wazuh repository key (Ubuntu 14) - become: true - shell: | - set -o pipefail - curl -s {{ wazuh_agent_config.repo.gpg }} | apt-key add - - args: - # warn: false - executable: /bin/bash - changed_when: false - when: - - ansible_distribution == "Ubuntu" - - ansible_distribution_major_version | int == 14 - - not wazuh_custom_packages_installation_agent_enabled - - name: Debian/Ubuntu | Download Wazuh repository key get_url: url: "{{ wazuh_agent_config.repo.gpg }}" dest: "{{ wazuh_agent_config.repo.path }}" when: - - not (ansible_distribution == "Ubuntu" and ansible_distribution_major_version | int == 14) - not wazuh_custom_packages_installation_agent_enabled - name: Debian/Ubuntu | Import Wazuh GPG key diff --git a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml index f312253..6845be7 100644 --- a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml +++ b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml @@ -88,7 +88,7 @@ state: directory - name: Windows | Installing agent configuration (ossec.conf) - template: # noqa 208 + template: # noqa: risky-file-permissions src: var-ossec-etc-ossec-agent.conf.j2 dest: "{{ wazuh_agent_win_path }}ossec.conf" notify: Windows | Restart Wazuh Agent diff --git a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-manager/tasks/Debian.yml b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-manager/tasks/Debian.yml index fdbfdde..8831f33 100644 --- a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-manager/tasks/Debian.yml +++ b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/ansible-wazuh-manager/tasks/Debian.yml @@ -12,26 +12,11 @@ register: wazuh_manager_https_packages_installed until: wazuh_manager_https_packages_installed is succeeded -- name: Debian/Ubuntu | Installing Wazuh repository key (Ubuntu 14) - become: true - shell: | - set -o pipefail - curl -s {{ wazuh_manager_config.repo.gpg }} | apt-key add - - args: - # warn: false - executable: /bin/bash - changed_when: false - when: - - ansible_distribution == "Ubuntu" - - ansible_distribution_major_version | int == 14 - - not wazuh_custom_packages_installation_manager_enabled - - name: Debian/Ubuntu | Download Wazuh repository key get_url: url: "{{ wazuh_manager_config.repo.gpg }}" dest: "{{ wazuh_manager_config.repo.path }}" when: - - not (ansible_distribution == "Ubuntu" and ansible_distribution_major_version | int == 14) - not wazuh_custom_packages_installation_manager_enabled - name: Debian/Ubuntu | Import Wazuh GPG key diff --git a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/wazuh-dashboard/tasks/main.yml b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/wazuh-dashboard/tasks/main.yml index 4381db2..ddfcd93 100755 --- a/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/wazuh-dashboard/tasks/main.yml +++ b/02_ansible_layer/admin/roles/software.install.wazuh/roles/wazuh/wazuh-dashboard/tasks/main.yml @@ -18,7 +18,7 @@ - name: Remove Dashboard configuration file file: - # noqa 503 + # noqa: no-handler path: "{{ dashboard_conf_path }}/opensearch_dashboards.yml" state: absent tags: install @@ -40,7 +40,7 @@ - name: Ensuring Wazuh dashboard directory owner file: - # noqa 208 + # noqa: risky-file-permissions path: "/usr/share/wazuh-dashboard" state: directory owner: wazuh-dashboard diff --git a/03_container_layer/docker/_ctf/cve/blank_template/Makefile b/03_container_layer/docker/_ctf/cve/blank_template/Makefile index 7359ab3..55765e8 100644 --- a/03_container_layer/docker/_ctf/cve/blank_template/Makefile +++ b/03_container_layer/docker/_ctf/cve/blank_template/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 85 +# ISSUE REPLACE_ME # -SERVICE = tomcat-cve-2025-24813 +SERVICE = REPLACE_ME DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2014-0160/Makefile b/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2014-0160/Makefile index c50ebe0..039cce5 100644 --- a/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2014-0160/Makefile +++ b/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2014-0160/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 50 +# ISSUE 50 # SERVICE = crypto-openssl-cve-2014-0160 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2022-0778/Makefile b/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2022-0778/Makefile index fdaaae2..c1d35b1 100644 --- a/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2022-0778/Makefile +++ b/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2022-0778/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 51 +# ISSUE 51 # SERVICE = crypto-openssl-cve-2022-0778 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/network/erlang-ssh/CVE-2025-32433/Makefile b/03_container_layer/docker/_ctf/cve/network/erlang-ssh/CVE-2025-32433/Makefile index d5188ee..8ed7b9c 100644 --- a/03_container_layer/docker/_ctf/cve/network/erlang-ssh/CVE-2025-32433/Makefile +++ b/03_container_layer/docker/_ctf/cve/network/erlang-ssh/CVE-2025-32433/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 42 +# ISSUE 42 # SERVICE = erlang-ssh-cve-2025-32433 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2018-15473/Makefile b/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2018-15473/Makefile index a616be3..160bffe 100644 --- a/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2018-15473/Makefile +++ b/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2018-15473/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 38 +# ISSUE 38 # SERVICE = openssh-cve-2018-15473 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2024-6387/Makefile b/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2024-6387/Makefile index 28074e1..ec193da 100644 --- a/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2024-6387/Makefile +++ b/03_container_layer/docker/_ctf/cve/network/openssh/CVE-2024-6387/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 123 +# ISSUE 123 # -SERVICE = openssh-cve-2018-15473 +SERVICE = openssh-cve-2024-6387 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2023-22809/Makefile b/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2023-22809/Makefile index 7799877..27971c7 100644 --- a/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2023-22809/Makefile +++ b/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2023-22809/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 126 - chore +# ISSUE 126 # SERVICE = sudo-cve-2023-22809 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32462/Makefile b/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32462/Makefile index 1813749..ad73e4d 100644 --- a/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32462/Makefile +++ b/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32462/Makefile @@ -5,85 +5,76 @@ SERVICE = sudo-cve-2025-32462 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32463/Makefile b/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32463/Makefile index 421dfcc..ee90e08 100644 --- a/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32463/Makefile +++ b/03_container_layer/docker/_ctf/cve/system/sudo/CVE-2025-32463/Makefile @@ -5,85 +5,76 @@ SERVICE = sudo-cve-2025-32463 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/web/apache/CVE-2021-42013/Makefile b/03_container_layer/docker/_ctf/cve/web/apache/CVE-2021-42013/Makefile index 132eaa2..1359ac6 100644 --- a/03_container_layer/docker/_ctf/cve/web/apache/CVE-2021-42013/Makefile +++ b/03_container_layer/docker/_ctf/cve/web/apache/CVE-2021-42013/Makefile @@ -1,89 +1,80 @@ # -# ISSUE - 133 +# ISSUE 133 # SERVICE = apache-cve-2021-42013 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/web/pdfjs/CVE-2024-4367/Makefile b/03_container_layer/docker/_ctf/cve/web/pdfjs/CVE-2024-4367/Makefile index e2c1323..70d9ca4 100644 --- a/03_container_layer/docker/_ctf/cve/web/pdfjs/CVE-2024-4367/Makefile +++ b/03_container_layer/docker/_ctf/cve/web/pdfjs/CVE-2024-4367/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 39 +# ISSUE 39 # SERVICE = pdf-cve-2024-4367 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/web/php/CVE-2019-11043/Makefile b/03_container_layer/docker/_ctf/cve/web/php/CVE-2019-11043/Makefile index 92fc451..48bba04 100644 --- a/03_container_layer/docker/_ctf/cve/web/php/CVE-2019-11043/Makefile +++ b/03_container_layer/docker/_ctf/cve/web/php/CVE-2019-11043/Makefile @@ -1,89 +1,80 @@ # -# ISSUE - 74 +# ISSUE 74 # -SERVICE = apache-cve-2021-42013 +SERVICE = php-cve-2019-11043 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/web/tomcat/CVE-2025-24813/Makefile b/03_container_layer/docker/_ctf/cve/web/tomcat/CVE-2025-24813/Makefile index 697ce25..e98f363 100644 --- a/03_container_layer/docker/_ctf/cve/web/tomcat/CVE-2025-24813/Makefile +++ b/03_container_layer/docker/_ctf/cve/web/tomcat/CVE-2025-24813/Makefile @@ -1,89 +1,80 @@ # -# ISSUE #49 +# ISSUE 49 # SERVICE = tomcat-cve-2025-24813 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/web/uwsg_php/CVE-2018-7490/Makefile b/03_container_layer/docker/_ctf/cve/web/uwsg_php/CVE-2018-7490/Makefile index c413764..d5160cd 100644 --- a/03_container_layer/docker/_ctf/cve/web/uwsg_php/CVE-2018-7490/Makefile +++ b/03_container_layer/docker/_ctf/cve/web/uwsg_php/CVE-2018-7490/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 95 +# ISSUE 95 # SERVICE = uwsgi-php-cve-2018-7490 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/Makefile b/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/Makefile index c7390c9..f108fc3 100644 --- a/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/Makefile +++ b/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 41 +# ISSUE 41 # -SERVICE = vite-cve-2022-44615 +SERVICE = vite-cve-2023-34092 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: - docker exec -it $(SERVICE) /bin/sh + docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug - docker exec -it $(DEBUG_SERVICE) /bin/sh + docker compose up --build -d $(DEBUG_SERVICE) + docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/compose.yml b/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/compose.yml index 5142797..3222b8c 100644 --- a/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/compose.yml +++ b/03_container_layer/docker/_ctf/cve/web/vite/CVE-2023-34092/compose.yml @@ -4,11 +4,11 @@ services: - vite-cve-2022-44615 : &main # set main anchor. + vite-cve-2023-34092: &main # set main anchor. build: context: . dockerfile: Dockerfile - container_name: vite-cve-2022-44615 + container_name: vite-cve-2023-34092 ports: - "7001:80" restart: unless-stopped @@ -17,7 +17,7 @@ services: # # debug: # <<: *main -# container_name: vite-cve-2022-44615 -debug +# container_name: vite-cve-2023-34092-debug # ports: # - "60443:443" # command: ["sleep", "infinity"] diff --git a/03_container_layer/docker/_ctf/cve/web/vite/CVE-2025-30208/Makefile b/03_container_layer/docker/_ctf/cve/web/vite/CVE-2025-30208/Makefile index f463128..ba549b7 100644 --- a/03_container_layer/docker/_ctf/cve/web/vite/CVE-2025-30208/Makefile +++ b/03_container_layer/docker/_ctf/cve/web/vite/CVE-2025-30208/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 41 +# ISSUE 41 # SERVICE = vite-cve-2025-30208 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: - docker exec -it $(SERVICE) /bin/sh + docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug - docker exec -it $(DEBUG_SERVICE) /bin/sh + docker compose up --build -d $(DEBUG_SERVICE) + docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/misconfiguration/network/vsftpd/ftp_anon_server/Makefile b/03_container_layer/docker/_ctf/misconfiguration/network/vsftpd/ftp_anon_server/Makefile index 4fad946..675055d 100644 --- a/03_container_layer/docker/_ctf/misconfiguration/network/vsftpd/ftp_anon_server/Makefile +++ b/03_container_layer/docker/_ctf/misconfiguration/network/vsftpd/ftp_anon_server/Makefile @@ -1,89 +1,80 @@ # -# ISSUE 84 +# ISSUE 84 # SERVICE = misconfig-vsftpd-anonymous DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" + @echo " make term - run and open bash shell" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/_ctf/misconfiguration/system/lpe-01/Makefile b/03_container_layer/docker/_ctf/misconfiguration/system/lpe-01/Makefile index 3fa3af2..27e8b40 100644 --- a/03_container_layer/docker/_ctf/misconfiguration/system/lpe-01/Makefile +++ b/03_container_layer/docker/_ctf/misconfiguration/system/lpe-01/Makefile @@ -1,93 +1,84 @@ # -# ISSUE 95 +# ISSUE 95 # SERVICE = misconfig-linux-lpe-01 DEBUG_SERVICE = $(SERVICE)-debug -help: +.PHONY: help up down stop stop-debug-build build rebuild build-up rebuild-up clean term term-user term-debug-build print + +help: + @echo "" @echo "" + @echo " Available : " @echo "" - @echo " Available : " - @echo "" - @echo " make up - run $(SERVICE) container in background" + @echo " make up - run $(SERVICE) container in background" @echo " make down - down $(SERVICE) " @echo " make stop - stop $(SERVICE) " @echo " make stop-debug-build - stop $(DEBUG_SERVICE) " @echo "" - @echo " make build - build $(SERVICE) image" - @echo " make build-up - build $(SERVICE) image then run" + @echo " make build - build $(SERVICE) image" + @echo " make build-up - build $(SERVICE) image then run" @echo "" - @echo " make rebuild - full rebuild $(SERVICE) without cache" - @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" + @echo " make rebuild - full rebuild $(SERVICE) without cache" + @echo " make rebuild-up - full rebuild $(SERVICE) without cache then run" @echo "" - @echo " make term - run and open bash shell" - @echo " make term - run and open bash shell - as user if applicable" + @echo " make term - run and open bash shell" + @echo " make term-user - run and open bash shell as lpe user" @echo " make term-debug-build - build get term on $(DEBUG_SERVICE) " - @echo " make clean - delete all containers, images, volumes and unused network" - @echo " make print - print this help" + @echo " make clean - delete containers, images and volumes for this service" + @echo " make print - print this help" @echo "" @echo "" -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # up: docker compose up -d $(SERVICE) down: docker compose down $(SERVICE) -stop: - docker compose stop $(SERVICE) # stop only - main +stop: + docker compose stop $(SERVICE) -stop-debug-build : - docker compose stop $(DEBUG_SERVICE) # stop only debug - docker compose rm -sf debug +stop-debug-build: + docker compose stop $(DEBUG_SERVICE) # stop and remove debug + docker compose rm -sf $(DEBUG_SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # build: - docker compose build + docker compose build $(SERVICE) rebuild: docker compose down - docker compose build --no-cache + docker compose build --no-cache $(SERVICE) -# # # # # # # # # # # # +# # # # # # # # # # # # build-up: - docker compose build - docker compose up -d + docker compose build $(SERVICE) + docker compose up -d $(SERVICE) rebuild-up: docker compose down - docker compose build --no-cache - docker compose up -d + docker compose build --no-cache $(SERVICE) + docker compose up -d $(SERVICE) -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # -clean: - docker system prune -a --volumes -f - -docker stop $(shell docker ps -aq) # stop all containers - -docker rm -f $(shell docker ps -aq) # delete all containers - -docker rmi -f $(shell docker images -q) # delete all images - -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - -docker network prune -f # docker unused network int +clean: + docker compose down --rmi all --volumes --remove-orphans -# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # term: docker exec -it $(SERVICE) /bin/bash -term-user: - docker exec -it -u lpe $(SERVICE) /bin/bash +term-user: + docker exec -it -u lpe $(SERVICE) /bin/bash term-debug-build: - # docker compose down - # -docker stop $(shell docker ps -aq) # stop all containers - # -docker rm -f $(shell docker ps -aq) # delete all containers - # -docker rmi -f $(shell docker images -q) # delete all images - # -docker volume rm -f $(shell docker volume ls -q) # delete all volumes - - - docker compose up --build -d debug + docker compose up --build -d $(DEBUG_SERVICE) docker exec -it $(DEBUG_SERVICE) /bin/bash +print: help diff --git a/03_container_layer/docker/admin/nextcloud/.env.example b/03_container_layer/docker/admin/nextcloud/.env.example index 341741d..356afa9 100644 --- a/03_container_layer/docker/admin/nextcloud/.env.example +++ b/03_container_layer/docker/admin/nextcloud/.env.example @@ -23,3 +23,10 @@ POSTGRES_DB=nextcloud # ── Host ports ────────────────────────────────────────────────────────────── HTTP_PORT=8080 + +# ── Teams ──────────────────────────────────────────────────────────────────── +NC_TEAMS=team-blue,team-red +NC_INSTRUCTOR_ORG=instructors +NC_INSTRUCTOR_COUNT=1 +NC_USERS_PER_TEAM=2 +NC_USER_DOMAIN=range42.local diff --git a/03_container_layer/docker/admin/nextcloud/Dockerfile b/03_container_layer/docker/admin/nextcloud/Dockerfile index ffedee7..16730d6 100644 --- a/03_container_layer/docker/admin/nextcloud/Dockerfile +++ b/03_container_layer/docker/admin/nextcloud/Dockerfile @@ -1,32 +1,12 @@ # # ISSUE 146 # - -# -# BUILDER — php:8.3-apache-bookworm (same base as official Nextcloud Dockerfile) -# Installs yq and jq as static binaries; copies and pre-validates provisioning scripts. -# -FROM php:8.3-apache-bookworm AS builder - -RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && \ - rm -rf /var/lib/apt/lists/* && \ - curl -sL https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_amd64 \ - -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq && \ - curl -sL https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64 \ - -o /usr/local/bin/jq && chmod +x /usr/local/bin/jq - -COPY provisioning/ /provisioning/ -RUN chmod +x /provisioning/init.sh - -# -# RUNTIME — nextcloud:latest (PHP/Apache/Debian, provisioner via OCS API) -# Copies tooling and provisioning scripts from builder. -# Acts as the provisioner sidecar: creates users and app passwords via OCS API. +# Lightweight provisioner image — Alpine with the OCS-API toolchain. +# Provisioning scripts are volume-mounted at runtime (not baked in), +# mirroring the misp-standalone provisioner pattern. # -FROM nextcloud:latest AS runtime +FROM alpine:3.20 -COPY --from=builder /usr/local/bin/yq /usr/local/bin/yq -COPY --from=builder /usr/local/bin/jq /usr/local/bin/jq -COPY --from=builder /provisioning/ /provisioning/ +RUN apk add --no-cache bash curl jq openssl -ENTRYPOINT ["/provisioning/init.sh"] +ENTRYPOINT ["/provisioning/provision.sh"] diff --git a/03_container_layer/docker/admin/nextcloud/Makefile b/03_container_layer/docker/admin/nextcloud/Makefile index b2c68c1..867ef35 100644 --- a/03_container_layer/docker/admin/nextcloud/Makefile +++ b/03_container_layer/docker/admin/nextcloud/Makefile @@ -6,7 +6,7 @@ SERVICE = nextcloud PROVISIONER = nextcloud-provisioner DEBUG_SERVICE = $(SERVICE)-debug -.PHONY: help up down stop build rebuild build-up rebuild-up reprovision logs-provisioner tokens term term-debug-build clean print +.PHONY: help up down stop build rebuild build-up rebuild-up reprovision logs-provisioner tokens keys term term-debug-build clean print help: @echo "" @@ -26,6 +26,7 @@ help: @echo " make reprovision - remove the provisioning stamp and restart provisioner" @echo " make logs-provisioner - tail provisioner output" @echo " make tokens - print generated app passwords" + @echo " make keys - print full credentials JSON (usernames + passwords)" @echo "" @echo " make term - open shell in $(SERVICE) container" @echo " make term-debug-build - build and open shell in $(DEBUG_SERVICE)" @@ -75,6 +76,9 @@ logs-provisioner: tokens: docker run --rm -v nextcloud_nextcloud-tokens:/tokens alpine cat /tokens/tokens.txt +keys: + docker run --rm -v nextcloud_nextcloud-tokens:/tokens alpine cat /tokens/nc-credentials.json + # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # clean: diff --git a/03_container_layer/docker/admin/nextcloud/README.md b/03_container_layer/docker/admin/nextcloud/README.md index 40af5b0..993c057 100644 --- a/03_container_layer/docker/admin/nextcloud/README.md +++ b/03_container_layer/docker/admin/nextcloud/README.md @@ -47,29 +47,21 @@ docker push registry.example.com/range42/nextcloud-provisioner:latest ## Declaring Users -Edit `provisioning/users.yml` before the first `make up`: - -```yaml -admins: - - username: nc-admin2 - email: admin2@range42.local - password: "Admin1234!" - display_name: "NC Admin 2" - -users: - - username: trainee01 - email: trainee01@range42.local - password: "Trainee1234!" - display_name: "Trainee 01" -``` +Users are declared entirely through environment variables in `.env` — no YAML file needed. + +| Variable | Default | Description | +|----------|---------|-------------| +| `NC_TEAMS` | `team-blue,team-red` | Comma-separated list of team names | +| `NC_INSTRUCTOR_ORG` | `instructors` | Group label for instructor accounts | +| `NC_INSTRUCTOR_COUNT` | `1` | Number of instructor accounts | +| `NC_USERS_PER_TEAM` | `2` | Regular users per team (leads are additional) | +| `NC_USER_DOMAIN` | `range42.local` | Email domain for generated accounts | -- `admins[]` entries are created and added to the Nextcloud `admin` group. -- `users[]` entries are regular accounts. -- `nc-admin` (set via `NC_ADMIN_USER`) is created automatically by Nextcloud — do not repeat it here. -- An app password is auto-generated for every user and written to `/tokens/tokens.txt`. +For each team the provisioner creates one **lead** (admin group) and `NC_USERS_PER_TEAM` regular users. +Passwords are auto-generated on first run; they are written to `/tokens/nc-credentials.json`. **The provisioner runs only once** (guarded by `/tokens/.provisioned`). -To re-provision after changes, run: +To re-provision with a clean volume, run: ```bash make reprovision @@ -77,22 +69,14 @@ make reprovision --- -## App Password Retrieval - -App passwords are written to the `nextcloud-tokens` volume during provisioning. -Retrieve them at any time: +## Credential Retrieval ```bash +# App passwords (username:apppassword, one per line) make tokens -``` -Example output: - -``` -nc-admin2: -trainee01: -trainee02: -trainee03: +# Full credentials JSON (usernames + plain passwords + roles) +make keys ``` --- @@ -142,6 +126,11 @@ curl -H "OCS-APIRequest: true" -H "Accept: application/json" \ | `NC_DOMAIN` | `localhost` | Trusted domain for Nextcloud | | `NC_ADMIN_USER` | `nc-admin` | Initial admin username (auto-created by Nextcloud) | | `NC_ADMIN_PASS` | `Admin1234!` | Initial admin password | +| `NC_TEAMS` | `team-blue,team-red` | Comma-separated team list | +| `NC_INSTRUCTOR_ORG` | `instructors` | Group label for instructor accounts | +| `NC_INSTRUCTOR_COUNT` | `1` | Number of instructor accounts | +| `NC_USERS_PER_TEAM` | `2` | Regular users per team | +| `NC_USER_DOMAIN` | `range42.local` | Email domain for generated accounts | | `POSTGRES_USER` | `nextcloud` | DB user | | `POSTGRES_PASSWORD` | `nextcloud` | DB password — **change before deploying** | | `POSTGRES_DB` | `nextcloud` | DB name | diff --git a/03_container_layer/docker/admin/nextcloud/compose.yml b/03_container_layer/docker/admin/nextcloud/compose.yml index 8bac8d0..d64b432 100644 --- a/03_container_layer/docker/admin/nextcloud/compose.yml +++ b/03_container_layer/docker/admin/nextcloud/compose.yml @@ -72,13 +72,14 @@ services: context: . dockerfile: Dockerfile container_name: nextcloud-provisioner + env_file: .env environment: - NC_URL: http://nextcloud - NC_ADMIN_USER: ${NC_ADMIN_USER:-nc-admin} - NC_ADMIN_PASS: ${NC_ADMIN_PASS:-Admin1234!} - USERS_FILE: /provisioning/users.yml + NC_URL: http://nextcloud volumes: - nextcloud-tokens:/tokens + - ./provisioning/provision.sh:/provisioning/provision.sh:ro + - ./provisioning/provision-users.sh:/provisioning/provision-users.sh:ro + - ./provisioning/provision-tokens.sh:/provisioning/provision-tokens.sh:ro depends_on: nextcloud: condition: service_healthy diff --git a/03_container_layer/docker/admin/nextcloud/provisioning/init.sh b/03_container_layer/docker/admin/nextcloud/provisioning/init.sh deleted file mode 100644 index 3e43ab1..0000000 --- a/03_container_layer/docker/admin/nextcloud/provisioning/init.sh +++ /dev/null @@ -1,164 +0,0 @@ -#!/bin/sh -# -# ISSUE 146 -# -# Bootstrap script for the Nextcloud provisioner sidecar. -# Runs once after Nextcloud is healthy; guarded by a stamp file for idempotency. -# -# User declarations come from USERS_FILE (default: /provisioning/users.yml). -# Admin users are created via the OCS API and added to the admin group. -# Regular users are created via the OCS API. -# App passwords are generated for every user and written to /tokens/tokens.txt. -# -set -eu - -NC_URL="${NC_URL:-http://nextcloud}" -NC_ADMIN_USER="${NC_ADMIN_USER:-nc-admin}" -NC_ADMIN_PASS="${NC_ADMIN_PASS:-Admin1234!}" -USERS_FILE="${USERS_FILE:-/provisioning/users.yml}" -TOKENS_DIR="/tokens" -TOKENS_FILE="${TOKENS_DIR}/tokens.txt" -PROVISION_STAMP="${TOKENS_DIR}/.provisioned" - -# ── 1. Wait for Nextcloud HTTP (max 180 s) ────────────────────────────────── -echo "[init] Waiting for Nextcloud at ${NC_URL} ..." -attempts=0 -until curl -sf "${NC_URL}/status.php" 2>/dev/null | grep -q '"installed":true'; do - attempts=$((attempts + 1)) - if [ "${attempts}" -ge 60 ]; then - echo "[fatal] Nextcloud did not become healthy after 180 s. Aborting." - exit 1 - fi - sleep 3 -done -echo "[init] Nextcloud is up." - -# ── 2. Idempotency guard ──────────────────────────────────────────────────── -if [ -f "${PROVISION_STAMP}" ]; then - echo "[init] Already provisioned (stamp found at ${PROVISION_STAMP}). Exiting." - exit 0 -fi - -mkdir -p "${TOKENS_DIR}" -: > "${TOKENS_FILE}" - -# ── Helper: create a user via OCS API ────────────────────────────────────── -create_user() { - local username="${1}" - local password="${2}" - local email="${3}" - local display_name="${4}" - - resp=$(curl -sf -X POST "${NC_URL}/ocs/v1.php/cloud/users" \ - -u "${NC_ADMIN_USER}:${NC_ADMIN_PASS}" \ - -H "OCS-APIRequest: true" \ - -H "Accept: application/json" \ - --data-urlencode "userid=${username}" \ - --data-urlencode "password=${password}" \ - --data-urlencode "email=${email}" \ - --data-urlencode "displayName=${display_name}" \ - || echo '{}') - status=$(echo "${resp}" | jq -r '.ocs.meta.statuscode // 999' 2>/dev/null || echo 999) - case "${status}" in - 100) echo "[init] + user created: ${username}" ;; - 102) echo "[warn] ${username} already exists — skipping" ;; - *) echo "[error] Failed to create ${username} (OCS status ${status}): $(echo "${resp}" | jq -r '.ocs.meta.message // "unknown error"' 2>/dev/null)"; exit 1 ;; - esac -} - -# ── Helper: add a user to the admin group ────────────────────────────────── -add_to_admin_group() { - local username="${1}" - - echo "[init] + adding ${username} to admin group" - curl -sf -X POST "${NC_URL}/ocs/v1.php/cloud/groups/admin/users" \ - -u "${NC_ADMIN_USER}:${NC_ADMIN_PASS}" \ - -H "OCS-APIRequest: true" \ - -H "Accept: application/json" \ - --data-urlencode "userid=${username}" \ - >/dev/null \ - || echo "[warn] Failed to add ${username} to admin group" -} - -# ── Helper: generate an app password for a user ──────────────────────────── -generate_app_password() { - local username="${1}" - local password="${2}" - - echo "[init] + generating app password for ${username}" - app_pass_resp=$(curl -sf -X POST "${NC_URL}/ocs/v2.php/core/apppassword" \ - -u "${username}:${password}" \ - -H "OCS-APIRequest: true" \ - -H "Accept: application/json" \ - || echo '{}') - - app_pass=$(printf '%s' "${app_pass_resp}" | jq -r '.ocs.data.apppassword // "ERROR"' 2>/dev/null || echo "ERROR") - - if [ "${app_pass}" = "ERROR" ] || [ -z "${app_pass}" ]; then - echo "[warn] Could not generate app password for ${username}" - app_pass="ERROR" - fi - - printf '%s: %s\n' "${username}" "${app_pass}" >> "${TOKENS_FILE}" - printf '[token] %s: %s\n' "${username}" "${app_pass}" -} - -# ── 3. Admin users ────────────────────────────────────────────────────────── -admin_count=$(yq e '.admins | length' "${USERS_FILE}") -echo "[init] Creating ${admin_count} admin user(s) ..." - -i=0 -while [ "${i}" -lt "${admin_count}" ]; do - username=$(yq e ".admins[${i}].username" "${USERS_FILE}") - email=$(yq e ".admins[${i}].email" "${USERS_FILE}") - password=$(yq e ".admins[${i}].password" "${USERS_FILE}") - display_name=$(yq e ".admins[${i}].display_name // \"\"" "${USERS_FILE}") - - create_user "${username}" "${password}" "${email}" "${display_name}" - add_to_admin_group "${username}" - - i=$((i + 1)) -done - -# ── 4. Regular users ──────────────────────────────────────────────────────── -user_count=$(yq e '.users | length' "${USERS_FILE}") -echo "[init] Creating ${user_count} regular user(s) ..." - -i=0 -while [ "${i}" -lt "${user_count}" ]; do - username=$(yq e ".users[${i}].username" "${USERS_FILE}") - email=$(yq e ".users[${i}].email" "${USERS_FILE}") - password=$(yq e ".users[${i}].password" "${USERS_FILE}") - display_name=$(yq e ".users[${i}].display_name // \"\"" "${USERS_FILE}") - - create_user "${username}" "${password}" "${email}" "${display_name}" - - i=$((i + 1)) -done - -# ── 4b. Wait for user accounts to be ready before generating app passwords ── -echo "[init] Waiting for user accounts to be ready ..." -sleep 2 - -# ── 4c. Generate app passwords for all users ──────────────────────────────── -echo "[init] Generating app passwords ..." - -i=0 -while [ "${i}" -lt "${admin_count}" ]; do - username=$(yq e ".admins[${i}].username" "${USERS_FILE}") - password=$(yq e ".admins[${i}].password" "${USERS_FILE}") - generate_app_password "${username}" "${password}" - i=$((i + 1)) -done - -i=0 -while [ "${i}" -lt "${user_count}" ]; do - username=$(yq e ".users[${i}].username" "${USERS_FILE}") - password=$(yq e ".users[${i}].password" "${USERS_FILE}") - generate_app_password "${username}" "${password}" - i=$((i + 1)) -done - -# ── 5. Mark as provisioned ────────────────────────────────────────────────── -touch "${PROVISION_STAMP}" -echo "[init] Provisioning complete. App passwords written to ${TOKENS_FILE}." diff --git a/03_container_layer/docker/admin/nextcloud/provisioning/provision-tokens.sh b/03_container_layer/docker/admin/nextcloud/provisioning/provision-tokens.sh new file mode 100755 index 0000000..56f28a6 --- /dev/null +++ b/03_container_layer/docker/admin/nextcloud/provisioning/provision-tokens.sh @@ -0,0 +1,57 @@ +#!/usr/bin/env bash +# +# ISSUE 146 +# +# provision-tokens.sh — generates a Nextcloud app password for every user in +# nc-credentials.json and appends the result to /tokens/tokens.txt. +# +# App passwords are generated by calling POST /ocs/v2.php/core/apppassword +# while authenticated as the target user (Nextcloud only issues app passwords +# for the currently-authenticated principal). +# +set -euo pipefail + +TOKENS_DIR="/tokens" +CREDS_FILE="${TOKENS_DIR}/nc-credentials.json" +TOKENS_FILE="${TOKENS_DIR}/tokens.txt" + +if [ ! -f "${CREDS_FILE}" ]; then + echo "[provision-tokens] ERROR: credentials file not found: ${CREDS_FILE}" + exit 1 +fi + +NC_URL="$(jq -r '.baseurl' "${CREDS_FILE}")" + +: > "${TOKENS_FILE}" +chmod 600 "${TOKENS_FILE}" + +echo "[provision-tokens] Generating app passwords ..." + +generate_token() { + local username="$1" password="$2" + local resp app_pass + + resp=$(curl -sf -X POST "${NC_URL}/ocs/v2.php/core/apppassword" \ + -u "${username}:${password}" \ + -H "OCS-APIRequest: true" \ + -H "Accept: application/json" \ + || echo '{}') + + app_pass=$(printf '%s' "${resp}" | jq -r '.ocs.data.apppassword // "ERROR"' 2>/dev/null || echo "ERROR") + + if [ "${app_pass}" = "ERROR" ] || [ -z "${app_pass}" ]; then + echo "[provision-tokens] WARN: could not generate app password for ${username}" + return + fi + + printf '%s:%s\n' "${username}" "${app_pass}" >> "${TOKENS_FILE}" + echo "[provision-tokens] + token: ${username}" +} + +while IFS= read -r entry; do + username=$(printf '%s' "${entry}" | jq -r '.username') + password=$(printf '%s' "${entry}" | jq -r '.password') + generate_token "${username}" "${password}" +done < <(jq -c '.users[]' "${CREDS_FILE}") + +echo "[provision-tokens] App passwords written to ${TOKENS_FILE}." diff --git a/03_container_layer/docker/admin/nextcloud/provisioning/provision-users.sh b/03_container_layer/docker/admin/nextcloud/provisioning/provision-users.sh new file mode 100755 index 0000000..bbcbb82 --- /dev/null +++ b/03_container_layer/docker/admin/nextcloud/provisioning/provision-users.sh @@ -0,0 +1,157 @@ +#!/usr/bin/env bash +# +# ISSUE 146 +# +# provision-users.sh — creates instructor and team accounts in Nextcloud via the OCS API. +# Writes credentials to /tokens/nc-credentials.json and stamps /tokens/.provisioned. +# +# The primary admin (NC_ADMIN_USER) is auto-created by Nextcloud on first boot; +# this script records it in the credentials file but does not re-create it via OCS. +# +# Env vars consumed (all required): +# NC_URL — internal service URL (e.g. http://nextcloud) +# NC_ADMIN_USER — Nextcloud admin username +# NC_ADMIN_PASS — Nextcloud admin password +# NC_TEAMS — comma-separated team list (e.g. team-blue,team-red) +# NC_INSTRUCTOR_ORG — group label for instructor accounts (e.g. instructors) +# NC_INSTRUCTOR_COUNT — number of instructor accounts to create +# NC_USERS_PER_TEAM — number of regular users per team (leads are additional) +# NC_USER_DOMAIN — email domain (e.g. range42.local) +# +set -euo pipefail + +NC_URL="${NC_URL:-http://nextcloud}" +NC_ADMIN_USER="${NC_ADMIN_USER:-nc-admin}" +NC_ADMIN_PASS="${NC_ADMIN_PASS:-Admin1234!}" +NC_TEAMS="${NC_TEAMS:-team-blue,team-red}" +NC_INSTRUCTOR_ORG="${NC_INSTRUCTOR_ORG:-instructors}" +NC_INSTRUCTOR_COUNT="${NC_INSTRUCTOR_COUNT:-1}" +NC_USERS_PER_TEAM="${NC_USERS_PER_TEAM:-2}" +NC_USER_DOMAIN="${NC_USER_DOMAIN:-range42.local}" + +TOKENS_DIR="/tokens" +CREDS_FILE="${TOKENS_DIR}/nc-credentials.json" +PROVISION_STAMP="${TOKENS_DIR}/.provisioned" + +# ── 1. Wait for Nextcloud (max 180 s) ───────────────────────────────────────── +echo "[provision-users] Waiting for Nextcloud at ${NC_URL} ..." +attempts=0 +until curl -sf "${NC_URL}/status.php" 2>/dev/null | grep -q '"installed":true'; do + attempts=$((attempts + 1)) + if [ "${attempts}" -ge 60 ]; then + echo "[fatal] Nextcloud did not become ready after 180 s. Aborting." + exit 1 + fi + sleep 3 +done +echo "[provision-users] Nextcloud is up." + +# ── 2. Idempotency guard ────────────────────────────────────────────────────── +if [ -f "${PROVISION_STAMP}" ]; then + echo "[provision-users] Already provisioned (stamp found). Exiting." + exit 0 +fi + +mkdir -p "${TOKENS_DIR}" + +# ── Helpers ─────────────────────────────────────────────────────────────────── +gen_password() { + printf 'R42!%s' "$(openssl rand -base64 16 | tr -d '/+=')" | head -c 20 +} + +create_user() { + local username="$1" password="$2" email="$3" display_name="$4" + local resp status + resp=$(curl -sf -X POST "${NC_URL}/ocs/v1.php/cloud/users" \ + -u "${NC_ADMIN_USER}:${NC_ADMIN_PASS}" \ + -H "OCS-APIRequest: true" \ + -H "Accept: application/json" \ + --data-urlencode "userid=${username}" \ + --data-urlencode "password=${password}" \ + --data-urlencode "email=${email}" \ + --data-urlencode "displayName=${display_name}" \ + || echo '{}') + status=$(printf '%s' "${resp}" | jq -r '.ocs.meta.statuscode // 999' 2>/dev/null || echo 999) + case "${status}" in + 100) echo "[provision-users] + created: ${username}" ;; + 102) echo "[provision-users] ~ already exists: ${username}" ;; + *) echo "[provision-users] ERROR: failed to create ${username} (OCS ${status}): $(printf '%s' "${resp}" | jq -r '.ocs.meta.message // "unknown"' 2>/dev/null)"; exit 1 ;; + esac +} + +add_to_admin_group() { + local username="$1" + curl -sf -X POST "${NC_URL}/ocs/v1.php/cloud/groups/admin/users" \ + -u "${NC_ADMIN_USER}:${NC_ADMIN_PASS}" \ + -H "OCS-APIRequest: true" \ + -H "Accept: application/json" \ + --data-urlencode "userid=${username}" \ + >/dev/null \ + || echo "[warn] Failed to add ${username} to admin group" +} + +CREDS_TMP="$(mktemp)" +printf '[\n' > "${CREDS_TMP}" +_CRED_FIRST=true + +append_cred() { + local username="$1" role="$2" team="$3" password="$4" + "${_CRED_FIRST}" || printf ',\n' >> "${CREDS_TMP}" + _CRED_FIRST=false + printf ' {"username":"%s","role":"%s","team":"%s","password":"%s"}' \ + "${username}" "${role}" "${team}" "${password}" >> "${CREDS_TMP}" +} + +# ── 3. Record primary admin (auto-created by Nextcloud) ─────────────────────── +echo "[provision-users] Recording primary admin: ${NC_ADMIN_USER}" +append_cred "${NC_ADMIN_USER}" "admin" "" "${NC_ADMIN_PASS}" + +# ── 4. Instructor accounts ──────────────────────────────────────────────────── +echo "[provision-users] Creating ${NC_INSTRUCTOR_COUNT} instructor(s) ..." +i=1 +while [ "${i}" -le "${NC_INSTRUCTOR_COUNT}" ]; do + username="nc-instructor-${i}" + password="$(gen_password)" + email="${username}@${NC_USER_DOMAIN}" + display_name="NC Instructor ${i}" + create_user "${username}" "${password}" "${email}" "${display_name}" + add_to_admin_group "${username}" + append_cred "${username}" "instructor" "${NC_INSTRUCTOR_ORG}" "${password}" + i=$((i + 1)) +done + +# ── 5. Team leads and users ─────────────────────────────────────────────────── +IFS=',' read -ra TEAM_LIST <<< "${NC_TEAMS}" +for team in "${TEAM_LIST[@]}"; do + echo "[provision-users] Creating accounts for team: ${team}" + + lead_user="nc-${team}-lead" + lead_pass="$(gen_password)" + lead_email="${lead_user}@${NC_USER_DOMAIN}" + create_user "${lead_user}" "${lead_pass}" "${lead_email}" "NC Lead ${team}" + add_to_admin_group "${lead_user}" + append_cred "${lead_user}" "lead" "${team}" "${lead_pass}" + + j=1 + while [ "${j}" -le "${NC_USERS_PER_TEAM}" ]; do + username="nc-${team}-user-${j}" + password="$(gen_password)" + email="${username}@${NC_USER_DOMAIN}" + create_user "${username}" "${password}" "${email}" "NC User ${team} ${j}" + append_cred "${username}" "user" "${team}" "${password}" + j=$((j + 1)) + done +done + +# ── 6. Write credentials file ───────────────────────────────────────────────── +printf '\n]\n' >> "${CREDS_TMP}" +jq --arg svc "nextcloud" --arg url "${NC_URL}" \ + '{"service":$svc,"baseurl":$url,"users":.}' \ + "${CREDS_TMP}" > "${CREDS_FILE}" +rm -f "${CREDS_TMP}" +chmod 600 "${CREDS_FILE}" +echo "[provision-users] Credentials written to ${CREDS_FILE}" + +# ── 7. Idempotency stamp ────────────────────────────────────────────────────── +touch "${PROVISION_STAMP}" +echo "[provision-users] Done." diff --git a/03_container_layer/docker/admin/nextcloud/provisioning/provision.sh b/03_container_layer/docker/admin/nextcloud/provisioning/provision.sh new file mode 100755 index 0000000..85135c2 --- /dev/null +++ b/03_container_layer/docker/admin/nextcloud/provisioning/provision.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash +# provision.sh — orchestrates all provisioning steps in dependency order. +# Entrypoint for the provisioner service in compose.yml. +set -euo pipefail + +/provisioning/provision-users.sh +/provisioning/provision-tokens.sh diff --git a/03_container_layer/docker/admin/nextcloud/provisioning/users.yml b/03_container_layer/docker/admin/nextcloud/provisioning/users.yml deleted file mode 100644 index 163b50f..0000000 --- a/03_container_layer/docker/admin/nextcloud/provisioning/users.yml +++ /dev/null @@ -1,25 +0,0 @@ -# !! CHANGE ALL PASSWORDS BEFORE DEPLOYING !! -# App passwords are auto-generated by the provisioner and written to /tokens/tokens.txt -# -# Note: nc-admin (NEXTCLOUD_ADMIN_USER) is created automatically by Nextcloud on first boot. -# This file declares ADDITIONAL users to be provisioned via the OCS API. - -admins: - - username: nc-admin2 - email: admin2@range42.local - password: "Admin1234!" - display_name: "NC Admin 2" - -users: - - username: trainee01 - email: trainee01@range42.local - password: "Trainee1234!" - display_name: "Trainee 01" - - username: trainee02 - email: trainee02@range42.local - password: "Trainee1234!" - display_name: "Trainee 02" - - username: trainee03 - email: trainee03@range42.local - password: "Trainee1234!" - display_name: "Trainee 03" diff --git a/03_container_layer/docker/admin/rocketchat/Dockerfile b/03_container_layer/docker/admin/rocketchat/Dockerfile index 551f027..e42bfa6 100644 --- a/03_container_layer/docker/admin/rocketchat/Dockerfile +++ b/03_container_layer/docker/admin/rocketchat/Dockerfile @@ -21,6 +21,10 @@ FROM rocketchat/rocket.chat:latest AS runtime USER root +# init.sh drives the Rocket.Chat REST API with curl, but the rocket.chat image +# (Alpine) ships neither curl nor wget — add curl so provisioning can run. +RUN apk add --no-cache curl + COPY --from=builder /usr/bin/yq /usr/bin/yq COPY --from=builder /usr/bin/jq /usr/bin/jq COPY --from=builder /provisioning/ /provisioning/ diff --git a/03_container_layer/docker/admin/rocketchat/compose.yml b/03_container_layer/docker/admin/rocketchat/compose.yml index 15d92a7..b17ac3a 100644 --- a/03_container_layer/docker/admin/rocketchat/compose.yml +++ b/03_container_layer/docker/admin/rocketchat/compose.yml @@ -5,7 +5,7 @@ services: mongodb: - image: mongo:6.0 + image: mongo:8.0 container_name: rocketchat-mongodb command: mongod --replSet rs0 --oplogSize 128 volumes: @@ -19,7 +19,7 @@ services: restart: unless-stopped mongo-init-replica: - image: mongo:6.0 + image: mongo:8.0 container_name: rocketchat-mongo-init command: > bash -c " @@ -59,7 +59,15 @@ services: mongo-init-replica: condition: service_completed_successfully healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:3000/api/v1/info"] + # The rocket.chat image ships Node (it runs `node main.js`) but NOT curl, + # so a curl-based probe never passes and the container is stuck + # "health: starting" forever (blocking the provisioner via depends_on). + # Use Node's built-in fetch (Node 18+) to hit the info endpoint instead. + test: + - CMD + - node + - -e + - "fetch('http://localhost:3000/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))" interval: 20s timeout: 10s retries: 15 diff --git a/03_container_layer/docker/admin/rocketchat/provisioning/init.sh b/03_container_layer/docker/admin/rocketchat/provisioning/init.sh index 1b7f14f..0dc2e1c 100644 --- a/03_container_layer/docker/admin/rocketchat/provisioning/init.sh +++ b/03_container_layer/docker/admin/rocketchat/provisioning/init.sh @@ -23,7 +23,7 @@ echo "[init] Waiting for Rocket.Chat at ${RC_URL} ..." attempts=0 max_attempts=60 -until curl -sf "${RC_URL}/api/v1/info" >/dev/null 2>&1; do +until curl -sf "${RC_URL}/api/info" >/dev/null 2>&1; do attempts=$((attempts + 1)) if [ "${attempts}" -ge "${max_attempts}" ]; then echo "[init] ERROR: Rocket.Chat did not become healthy after $((max_attempts * 3))s. Aborting." diff --git a/05_topology_layer/box_templates/admin-nextcloud/v1.0.0/template.yml b/05_topology_layer/box_templates/admin-nextcloud/v1.0.0/template.yml new file mode 100644 index 0000000..58ec5c5 --- /dev/null +++ b/05_topology_layer/box_templates/admin-nextcloud/v1.0.0/template.yml @@ -0,0 +1,24 @@ +id: admin-nextcloud +api_version: 1 +description: >- + Nextcloud admin box on Debian — provisions the Docker baseline, opens the + service port, and bootstraps the Nextcloud compose stack (Nextcloud + + PostgreSQL + Redis + provisioner) from + 03_container_layer/docker/admin/nextcloud via software.install.nextcloud. +template_vm: "template-vm-debian-trixie-medium" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} + - {ip: "all", port: 8080, protocol: "tcp"} # nextcloud web ui + - kind: role + catalog_ref: software.install.warmup.basic_packages + params: + INSTALL_PACKAGES_BASICS: "YES" + INSTALL_PACKAGES_DOCKER: "YES" + INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" + INSTALL_PACKAGES_UTILS_JSON: "YES" + INSTALL_PACKAGES_UTILS_NETWORK: "YES" + - {kind: role, catalog_ref: software.install.nextcloud, params: {}} diff --git a/05_topology_layer/box_templates/admin-rocketchat/v1.0.0/template.yml b/05_topology_layer/box_templates/admin-rocketchat/v1.0.0/template.yml new file mode 100644 index 0000000..4fbacf8 --- /dev/null +++ b/05_topology_layer/box_templates/admin-rocketchat/v1.0.0/template.yml @@ -0,0 +1,30 @@ +id: admin-rocketchat +api_version: 1 +description: >- + Rocket.Chat admin box on Debian — provisions the Docker baseline, opens the + service port, and bootstraps the Rocket.Chat compose stack (Rocket.Chat + + MongoDB replica set + provisioner) from + 03_container_layer/docker/admin/rocketchat via software.install.rocketchat. +template_vm: "template-vm-debian-trixie-medium" +default_attachments: + # host firewall — 22 (ssh) + 3000 (Rocket.Chat HTTP, HTTP_PORT default) + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {ip: "all", port: 3000, protocol: "tcp"} # rocketchat web ui + # Docker baseline: engine + compose plugin + operator utilities. + # NTP sync is intentionally NOT enabled: in an air-gapped / egress-filtered + # range, udp/123 is blocked, systemd-timesyncd never reaches a server, and the + # role's hard "wait for NTPSynchronized" fails. VMs take host (kvm-clock) time. + - kind: role + catalog_ref: software.install.warmup.basic_packages + params: + INSTALL_PACKAGES_BASICS: "YES" + INSTALL_PACKAGES_DOCKER: "YES" + INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" + INSTALL_PACKAGES_UTILS_JSON: "YES" + INSTALL_PACKAGES_UTILS_NETWORK: "YES" + # Bootstrap Rocket.Chat: rsync the catalog compose stack + docker compose up + - {kind: role, catalog_ref: software.install.rocketchat, params: {}} diff --git a/05_topology_layer/box_templates/admin-wazuh/v1.0.0/template.yml b/05_topology_layer/box_templates/admin-wazuh/v1.0.0/template.yml new file mode 100644 index 0000000..6035770 --- /dev/null +++ b/05_topology_layer/box_templates/admin-wazuh/v1.0.0/template.yml @@ -0,0 +1,14 @@ +id: admin-wazuh +api_version: 1 +description: Wazuh SIEM admin box (indexer + manager + dashboard). +template_vm: "template-vm-ubuntu-noble-medium-04-8g-64g" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {ip: "all", port: 443, protocol: "tcp"} # dashboard + - {ip: "all", port: 1514, protocol: "tcp"} # wazuh agent events + - {ip: "all", port: 1515, protocol: "tcp"} # wazuh agent enrollment + - {kind: role, catalog_ref: software.install.wazuh, params: {}} diff --git a/05_topology_layer/box_templates/apt-cache/v1.0.0/template.yml b/05_topology_layer/box_templates/apt-cache/v1.0.0/template.yml new file mode 100644 index 0000000..b8c0ef9 --- /dev/null +++ b/05_topology_layer/box_templates/apt-cache/v1.0.0/template.yml @@ -0,0 +1,20 @@ +id: apt-cache +api_version: 1 +description: apt-cacher-ng transparent caching proxy. Caches packages on first fetch and serves them locally to the rest of the lab. +template_vm: "template-vm-debian-trixie-small" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {ip: "all", port: 3142, protocol: "tcp"} # apt-cacher-ng + - {kind: role, catalog_ref: software.install.warmup.basic_packages, params: {}} + - kind: role + catalog_ref: software.install.apt_cacher_ng + params: + apt_cacher_port: 3142 + apt_cacher_passthrough: true + apt_cacher_cache_dir: /var/cache/apt-cacher-ng + apt_cacher_log_dir: /var/log/apt-cacher-ng + apt_cacher_bind_address: "0.0.0.0" diff --git a/05_topology_layer/box_templates/apt-mirror/v1.0.0/template.yml b/05_topology_layer/box_templates/apt-mirror/v1.0.0/template.yml new file mode 100644 index 0000000..ad5c06c --- /dev/null +++ b/05_topology_layer/box_templates/apt-mirror/v1.0.0/template.yml @@ -0,0 +1,35 @@ +id: apt-mirror +api_version: 1 +description: Local apt mirror served via nginx. Configure which distros and suites to mirror via params. +template_vm: "template-vm-debian-trixie-large" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {ip: "all", port: 80, protocol: "tcp"} # nginx apt mirror + - {kind: role, catalog_ref: software.install.warmup.basic_packages, params: {}} + - kind: role + catalog_ref: software.install.apt_mirror + params: + # Suites — auto-detected from client boxes by the r42playbooks compiler. + # The generator inspects every box wired via services.apt and enables the + # matching distro/codename flag (e.g. ubuntu-jump → apt_mirror_ubuntu_resolute: true). + # Uncomment and set explicitly only to force or suppress a specific suite: + # + # apt_mirror_debian_bookworm: false + # apt_mirror_debian_trixie: false + # apt_mirror_ubuntu_jammy: false + # apt_mirror_ubuntu_noble: false + # apt_mirror_ubuntu_resolute: false + apt_mirror_security: true + apt_mirror_backports: false + apt_mirror_include_sources: false + apt_mirror_ubuntu_components: "main restricted universe" + # Behaviour + apt_mirror_prewarm: true + apt_mirror_threads: 20 + # Storage / network + apt_mirror_http_port: 80 + apt_mirror_root: /var/spool/apt-mirror diff --git a/05_topology_layer/box_templates/debian-jump/v1.0.0/template.yml b/05_topology_layer/box_templates/debian-jump/v1.0.0/template.yml new file mode 100644 index 0000000..8793348 --- /dev/null +++ b/05_topology_layer/box_templates/debian-jump/v1.0.0/template.yml @@ -0,0 +1,35 @@ +id: debian-jump +api_version: 1 +description: Debian 13 (trixie) student jump box — example of an image=debian_trixie box. +template_vm: "template-vm-debian-trixie-small" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {kind: role, catalog_ref: software.install.warmup.basic_packages, params: {}} + + # --- apt integration (pick one, uncomment) --- + # + # Option A — proxy via apt-cache box (apt-cacher-ng, port 3142) + # Deploy an apt-cache box in the same topology and set apt_proxy_url to its IP. + # All packages are fetched through the cache; upstream internet access is still required. + # + # - kind: role + # catalog_ref: software.configure.apt_mirror_client + # params: + # apt_mirror_enabled: true + # apt_proxy_url: "http://:3142" + # + # Option B — full local mirror via apt-mirror box (nginx, port 80, airgapped) + # Deploy an apt-mirror box, set apt_mirror_vm_ip to its IP. + # No upstream internet access needed on this box once the mirror is populated. + # + # - kind: role + # catalog_ref: software.configure.apt_mirror_client + # params: + # apt_mirror_enabled: true + # apt_mirror_airgapped: true + # apt_mirror_vm_ip: "" + # apt_mirror_http_port: 80 diff --git a/05_topology_layer/box_templates/deployer/v1.0.0/template.yml b/05_topology_layer/box_templates/deployer/v1.0.0/template.yml new file mode 100644 index 0000000..e5d236b --- /dev/null +++ b/05_topology_layer/box_templates/deployer/v1.0.0/template.yml @@ -0,0 +1,13 @@ +id: deployer +api_version: 1 +description: range42 deployer platform box (api-gateway / api-backend / ui). +template_vm: "template-vm-ubuntu-noble-small-01-4g-32g" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {ip: "all", port: 80, protocol: "tcp"} # http + - {ip: "all", port: 443, protocol: "tcp"} # https (api / ui) + - {kind: role, catalog_ref: software.install.warmup.basic_packages, params: {}} diff --git a/05_topology_layer/box_templates/student-box/v1.0.0/template.yml b/05_topology_layer/box_templates/student-box/v1.0.0/template.yml new file mode 100644 index 0000000..0331fd6 --- /dev/null +++ b/05_topology_layer/box_templates/student-box/v1.0.0/template.yml @@ -0,0 +1,11 @@ +id: student-box +api_version: 1 +description: Student / trainee workstation box. +template_vm: "template-vm-ubuntu-noble-small-01-4g-32g" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {kind: role, catalog_ref: software.install.warmup.basic_packages, params: {}} diff --git a/05_topology_layer/box_templates/ubuntu-jump/v1.0.0/template.yml b/05_topology_layer/box_templates/ubuntu-jump/v1.0.0/template.yml new file mode 100644 index 0000000..7d1ece9 --- /dev/null +++ b/05_topology_layer/box_templates/ubuntu-jump/v1.0.0/template.yml @@ -0,0 +1,36 @@ +id: ubuntu-jump +api_version: 1 +description: Ubuntu 26.04 LTS (Resolute Raccoon) student jump box — example of an image=ubuntu_resolute box. +template_vm: "template-vm-ubuntu-resolute-small-01-4g-32g" +default_attachments: + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} # ssh + - {kind: role, catalog_ref: software.install.warmup.basic_packages, params: {}} + + # --- apt integration (pick one, uncomment) --- + # + # Option A — proxy via apt-cache box (apt-cacher-ng, port 3142) + # Deploy an apt-cache box in the same topology and set apt_proxy_url to its IP. + # All packages are fetched through the cache; upstream internet access is still required. + # + # - kind: role + # catalog_ref: software.configure.apt_mirror_client + # params: + # apt_mirror_enabled: true + # apt_proxy_url: "http://:3142" + # + # Option B — full local mirror via apt-mirror box (nginx, port 80, airgapped) + # Deploy an apt-mirror box (ensure apt_mirror_ubuntu_noble: true is set on it), + # then set apt_mirror_vm_ip to its IP. + # No upstream internet access needed on this box once the mirror is populated. + # + # - kind: role + # catalog_ref: software.configure.apt_mirror_client + # params: + # apt_mirror_enabled: true + # apt_mirror_airgapped: true + # apt_mirror_vm_ip: "" + # apt_mirror_http_port: 80 diff --git a/05_topology_layer/box_templates/vuln-box/v1.0.0/template.yml b/05_topology_layer/box_templates/vuln-box/v1.0.0/template.yml new file mode 100644 index 0000000..f73da9d --- /dev/null +++ b/05_topology_layer/box_templates/vuln-box/v1.0.0/template.yml @@ -0,0 +1,16 @@ +id: vuln-box +api_version: 1 +description: CTF vulnerable target box — Docker-hosted CVE / misconfig stacks. +template_vm: "template-vm-ubuntu-noble-small-01-4g-32g" +default_attachments: + # host firewall — rules carried as attachment params, emitted into stage_01 + - kind: role + catalog_ref: software.configure.firewalls + params: + firewall_rules: + - {ip: "all", port: 22, protocol: "tcp"} + - {ip: "all", port: 80, protocol: "tcp"} + - {ip: "all", port: 8080, protocol: "tcp"} + - {kind: role, catalog_ref: software.install.wazuh-agent, params: {}} + # example CTF docker stack — wired to a docker-compose play in stage_01 + - {kind: container, catalog_ref: cve/crypto/openssl/CVE-2014-0160, params: {}} diff --git a/05_topology_layer/network_policies/air-gap-ctf/v1.0.0/template.yml b/05_topology_layer/network_policies/air-gap-ctf/v1.0.0/template.yml new file mode 100644 index 0000000..8c71ffa --- /dev/null +++ b/05_topology_layer/network_policies/air-gap-ctf/v1.0.0/template.yml @@ -0,0 +1,31 @@ +id: air-gap-ctf +api_version: 1 +kind: isolation-policy +description: >- + Admin/CTF zone isolation with Wazuh agent exceptions and a CTF air-gap. + Symbolic generalization of demo_lab_network's hardcoded 05_network_isolation + FORWARD rules — the topology binds `admin`/`ctf` to concrete subnets/bridges + and `siem` to the Wazuh IP, so no addresses are baked into this template. +params: + # siem_ip is the default Wazuh address; a topology overrides it via + # service_bindings at compile time (P3). Kept here for documentation. + siem_ip: "192.168.142.100" +zones: + - {name: admin} + - {name: ctf} + - {name: wan, wan: true} +services: + - name: siem + zone: admin + ports: + - {proto: tcp, port: 1514} # wazuh agent events + - {proto: tcp, port: 1515} # wazuh agent enrollment +defaults: + default_action: drop + accept_established_related: true + allow_intra_zone: true + airgap_zones: [ctf] # ctf -> wan DROP (air-gap) +matrix: + - {src: admin, dst: ctf, action: accept, comment: "admin manages vuln boxes"} + - {src: ctf, dst: "svc:siem", action: accept, comment: "wazuh agent events + enrollment"} + - {src: ctf, dst: admin, action: drop, comment: "zone isolation"} diff --git a/05_topology_layer/network_policies/dual-lan-isolate/v1.0.0/template.yml b/05_topology_layer/network_policies/dual-lan-isolate/v1.0.0/template.yml new file mode 100644 index 0000000..cfb303c --- /dev/null +++ b/05_topology_layer/network_policies/dual-lan-isolate/v1.0.0/template.yml @@ -0,0 +1,27 @@ +id: dual-lan-isolate +api_version: 1 +kind: isolation-policy +description: >- + Mutual isolation between lan1 and lan2 — neither zone can initiate connections + to the other. Intra-zone traffic is allowed. Designed for dual-lan scenarios + where the two LANs must not communicate through the Proxmox host router. + Zone names match the dual-lan subnet layout (lan1, lan2). +zones: + - {name: lan1} + - {name: lan2} + - {name: wan, wan: true} +services: [] +defaults: + default_action: drop + accept_established_related: true + allow_intra_zone: true + airgap_zones: [] +matrix: + # Internet egress — dst: wan resolves to no CIDR so these compile at + # W_EGRESS_ACCEPT (700), AFTER the cross-LAN DROPs (500). This preserves + # deny-by-default without shadowing the isolation rules below. + - {src: lan1, dst: wan, action: accept, comment: "lan1 internet egress"} + - {src: lan2, dst: wan, action: accept, comment: "lan2 internet egress"} + # Zone isolation + - {src: lan1, dst: lan2, action: drop, comment: "lan1 cannot reach lan2"} + - {src: lan2, dst: lan1, action: drop, comment: "lan2 cannot reach lan1"} diff --git a/05_topology_layer/network_policies/flat-open/v1.0.0/template.yml b/05_topology_layer/network_policies/flat-open/v1.0.0/template.yml new file mode 100644 index 0000000..26b2cb7 --- /dev/null +++ b/05_topology_layer/network_policies/flat-open/v1.0.0/template.yml @@ -0,0 +1,15 @@ +id: flat-open +api_version: 1 +kind: isolation-policy +description: >- + No-isolation baseline — all declared zones may reach each other. Useful for + early bring-up and debugging before an isolation policy is applied. +zones: + - {name: admin} + - {name: ctf} +defaults: + default_action: accept + accept_established_related: true + allow_intra_zone: true + airgap_zones: [] +matrix: [] diff --git a/05_topology_layer/subnet_layouts/default-3zone/v1.0.0/template.yml b/05_topology_layer/subnet_layouts/default-3zone/v1.0.0/template.yml new file mode 100644 index 0000000..9cc7d97 --- /dev/null +++ b/05_topology_layer/subnet_layouts/default-3zone/v1.0.0/template.yml @@ -0,0 +1,10 @@ +id: default-3zone +api_version: 1 +description: >- + Reference 3-zone layout — admin (vmbr142), student (vmbr143), ctf (vmbr144). + Mirrors the demo_lab / demo_lab_network bridge plan. +subnets: + - {name: admin, cidr: "192.168.142.0/24", bridge: vmbr142, gateway: "192.168.142.1"} + - {name: student, cidr: "192.168.143.0/24", bridge: vmbr143} + - {name: ctf, cidr: "192.168.144.0/24", bridge: vmbr144} +template_subnet: {cidr: "192.168.140.0/24", bridge: vmbr140} diff --git a/05_topology_layer/subnet_layouts/dual-lan/v1.0.0/template.yml b/05_topology_layer/subnet_layouts/dual-lan/v1.0.0/template.yml new file mode 100644 index 0000000..b42ebe5 --- /dev/null +++ b/05_topology_layer/subnet_layouts/dual-lan/v1.0.0/template.yml @@ -0,0 +1,8 @@ +id: dual-lan +api_version: 1 +description: >- + Two-LAN layout — lan1 (vmbr150) and lan2 (vmbr151). +subnets: + - {name: lan1, cidr: "192.168.150.0/24", bridge: vmbr150, gateway: "192.168.150.1"} + - {name: lan2, cidr: "192.168.151.0/24", bridge: vmbr151, gateway: "192.168.151.1"} +template_subnet: {cidr: "192.168.140.0/24", bridge: vmbr140} diff --git a/manifest.json b/manifest.json index 5b24df4..925deea 100644 --- a/manifest.json +++ b/manifest.json @@ -90,6 +90,27 @@ "description": "Network-themed challenges" } } + }, + "topology": { + "path": "05_topology_layer", + "description": "Symbolic, parametric templates consumed by the r42topo compiler to author + compile topology.json into deployable scenarios", + "categories": { + "box_templates": { + "path": "box_templates", + "description": "VM/box archetypes (role, inventory group, spec, default catalog attachments)", + "layout": "/v../template.yml" + }, + "network_policies": { + "path": "network_policies", + "description": "Symbolic zone-isolation policies (zones, services, allow/deny matrix, air-gap) — generalizes per-scenario iptables rules", + "layout": "/v../template.yml" + }, + "subnet_layouts": { + "path": "subnet_layouts", + "description": "Reusable subnet/bridge layouts a topology can adopt", + "layout": "/v../template.yml" + } + } } }, "conventions": {