thomas.koppandClaude Opus 5
4b38b80875
Task 7 as planned would have checked out over shron and reviewed what was lost afterwards. That is the wrong order for a machine whose .zshrc holds working operational tooling: ipt-block, a CrowdSec whitelist helper, reboot_required, the German locale and dircolors would all have been gone between the checkout and the review. Also found: shron runs ZSH_THEME="ys" and has no powerlevel10k. The theme selection would have fallen through to oh-my-zsh's default, which is a regression nobody asked for, so 05-pre-omz.zsh keeps ys where p10k is absent. The red role colour is still set, but it is honest to say it does nothing there until p10k is installed - the safeguard the role split was built around does not currently apply to the one machine it was meant for. 05-prompt.zsh becomes 05-pre-omz.zsh: the theme was never the only thing that has to precede oh-my-zsh. DISABLE_AUTO_UPDATE belongs there too - a server should not go fetching updates on its own while somebody is logged in fixing something - and the stub no longer sets the update mode itself. update-blacklist is carried over with a note rather than silently: openbl.org answers 301 and the curl call has no -L, so it has been reporting "Blacklist download failed" for some time. CrowdSec covers that ground now, but the iptables chain it created may still exist and is worth removing deliberately. PYTHONPATH pointed at python3.4 on shron and at 3.9 on beastix. Neither directory exists; neither is carried over. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
101 lines
3.7 KiB
Bash
101 lines
3.7 KiB
Bash
# Role: server (shron - Arch, headless, mail/web/cloud)
|
|
#
|
|
# The theme and DISABLE_AUTO_UPDATE are in 05-pre-omz.zsh, because oh-my-zsh
|
|
# reads them while it is being sourced.
|
|
|
|
# Role colour, set here rather than earlier because ~/.p10k.zsh assigns
|
|
# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced in 30-path.zsh.
|
|
#
|
|
# Note that this only takes effect where powerlevel10k is installed, and on
|
|
# shron it is not - the ys theme has no equivalent. The colour is kept anyway
|
|
# so it works the moment p10k arrives, but the red prompt cannot be relied on
|
|
# as a safeguard there today.
|
|
typeset -g POWERLEVEL9K_CONTEXT_BACKGROUND=red
|
|
typeset -g POWERLEVEL9K_ALWAYS_SHOW_CONTEXT=true
|
|
|
|
# German locale. The base does not set one, since the desktop inherits it from
|
|
# the session and the Mac has its own; an SSH session brings only what the
|
|
# client sends, which is usually nothing useful.
|
|
export LANG=de_DE.UTF-8
|
|
export LANGUAGE=de_DE.UTF-8
|
|
export LC_MESSAGES=de_DE.UTF-8
|
|
export LC_ALL=de_DE.UTF-8
|
|
|
|
# vim rather than the base's nvim. Both are installed here; this is the
|
|
# existing preference and there is no reason to change it from a distance.
|
|
alias vi="vim"
|
|
|
|
# Colours for ls, from a file that only exists on this machine.
|
|
[[ -f "$HOME/.dircolors" ]] && eval "$(dircolors "$HOME/.dircolors")"
|
|
|
|
# Block a single address permanently.
|
|
ipt-block() {
|
|
sudo iptables -A INPUT -s "$1" -j DROP
|
|
echo "permblocked $1"
|
|
}
|
|
|
|
# Lift a CrowdSec ban and whitelist the address for a while. The message says
|
|
# one hour, the command says twelve - left as it was rather than guessing which
|
|
# one was meant.
|
|
whitelist() {
|
|
if [[ -z "$1" ]]; then
|
|
echo "Bitte geben Sie eine IP-Adresse an."
|
|
return 1
|
|
fi
|
|
|
|
local ip="$1"
|
|
sudo cscli decisions delete --ip "$ip"
|
|
sudo cscli decisions add --ip "$ip" --duration 12h --type whitelist --reason "Manuell whitelisted"
|
|
echo "IP $ip wurde für 1 Stunde whitelisted und entbannt."
|
|
}
|
|
|
|
# Is the running kernel still the installed one?
|
|
reboot_required() {
|
|
local installed running
|
|
installed=$(pacman -Q linux-lts | sed 's/linux-lts //')
|
|
running=$(uname -r | sed 's/-lts//')
|
|
|
|
if [[ "$installed" == "$running" ]]; then
|
|
echo "no reboot required."
|
|
else
|
|
echo "reboot required!"
|
|
fi
|
|
}
|
|
|
|
# Pull the OpenBL list into an iptables chain.
|
|
#
|
|
# Carried over unchanged, but it does not work: www.openbl.org answers 301 and
|
|
# the curl call has no -L, so the download returns nothing and the function
|
|
# reports "Blacklist download failed" every time. Kept rather than deleted
|
|
# because the iptables chain it manages may still exist and be worth cleaning
|
|
# up deliberately - CrowdSec covers this ground now.
|
|
update-blacklist() {
|
|
local CHAINLIST BLACKLIST IPCOUNT
|
|
CHAINLIST=$(sudo /sbin/iptables -nL | grep 'Chain block-traffic-from-openbl' | cut -d' ' -f 2)
|
|
|
|
if [ -z "$CHAINLIST" ]; then
|
|
sudo /sbin/iptables -N block-traffic-from-openbl
|
|
sudo /sbin/iptables -A INPUT -j block-traffic-from-openbl
|
|
fi
|
|
|
|
BLACKLIST=$(/usr/bin/curl -fs http://www.openbl.org/lists/base_7days.txt.gz | gunzip | grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}")
|
|
|
|
if [ -z "$BLACKLIST" ]; then
|
|
echo "Blacklist download failed."
|
|
return 1
|
|
fi
|
|
|
|
sudo /sbin/iptables -F block-traffic-from-openbl
|
|
IPCOUNT=$(echo "$BLACKLIST" | tr ' ' '\n' | wc -l)
|
|
echo "Adding $IPCOUNT IPs to blacklist. - $(date)"
|
|
|
|
echo "$BLACKLIST" | tr ' ' '\n' | while read -r line ; do
|
|
case "$line" in \#*) continue ;; esac
|
|
sudo /sbin/iptables -A block-traffic-from-openbl -p tcp -s "$line" -j REJECT --reject-with tcp-reset
|
|
done
|
|
}
|
|
|
|
# The previous configuration exported PYTHONPATH=/usr/lib/python3.4/site-packages.
|
|
# Python 3.4 has not shipped with Arch for years and the directory is gone, so
|
|
# it is not carried over. beastix had the same line pointing at 3.9.
|