diff --git a/tasks/anawiki.yaml b/tasks/anawiki.yaml new file mode 100644 index 0000000..2d62c9d --- /dev/null +++ b/tasks/anawiki.yaml @@ -0,0 +1,140 @@ +--- +# tasks file for mediawiki +- name: Create MediaWiki namespace + k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: mediawiki + +- name: Deploy MariaDB + kubernetes.core.helm: + name: mariadb + chart_ref: bitnami/mariadb + release_namespace: mediawiki + values: + auth: + rootPassword: "{{ mediawiki_admin_password }}" + username: mediawiki + password: "{{ mediawiki_admin_password }}" + database: mediawiki + primary: + persistence: + size: 4Ti + +- name: Create a persistent volume claim for MediaWiki + k8s: + state: present + definition: + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: mediawiki + namespace: mediawiki + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 32Gi + +- name: Create Deployment for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: mediawiki + namespace: mediawiki + spec: + replicas: 1 + selector: + matchLabels: + app: mediawiki + template: + metadata: + labels: + app: mediawiki + spec: + containers: + - name: mediawiki + image: mediawiki + imagePullPolicy: IfNotPresent + resources: + requests: + memory: 2Gi + ports: + - containerPort: 80 + volumemounts: + - name: mediawiki + mountpath: /var/www/html + volumes: + - name: mediawiki + persistentVolumeClaim: + claimName: mediawiki + +- name: Create Service for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: mediawiki + namespace: mediawiki + spec: + selector: + app: mediawiki + ports: + - port: 80 + name: http + type: ClusterIP + +- name: Create OnionService + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: mediawiki + namespace: mediawiki + spec: + version: 3 + rules: + - port: + number: 80 + backend: + service: + name: mediawiki + port: + number: 80 + +#- name: Create Ingress +# k8s: +# state: present +# definition: +# apiVersion: networking.k8s.io/v1 +# kind: Ingress +# metadata: +# annotations: +# cert-manager.io/cluster-issuer: ca-issuer +# name: mediawiki +# namespace: mediawiki +# spec: +# ingressClassName: nginx +# rules: +# - host: mediawiki.eom.dev +# http: +# paths: +# - pathType: Prefix +# path: / +# backend: +# service: +# name: mediawiki +# port: +# number: 80 +# tls: +# - hosts: +# - mediawiki.eom.dev +# secretName: mediawiki diff --git a/tasks/demowiki.yaml b/tasks/demowiki.yaml new file mode 100644 index 0000000..6815efa --- /dev/null +++ b/tasks/demowiki.yaml @@ -0,0 +1,147 @@ +--- +# tasks file for mediawiki +- name: Create MediaWiki namespace + k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: mediawiki + +- name: Deploy MariaDB + kubernetes.core.helm: + name: mariadb + chart_ref: bitnami/mariadb + release_namespace: mediawiki + values: + auth: + rootPassword: "{{ mediawiki_admin_password }}" + username: mediawiki + password: "{{ mediawiki_admin_password }}" + database: mediawiki + primary: + persistence: + size: 4Ti + +- name: Create Deployment for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: mediawiki + namespace: mediawiki + spec: + replicas: 1 + selector: + matchLabels: + app: mediawiki + template: + metadata: + labels: + app: mediawiki + spec: + containers: + - name: mediawiki + image: ericomeehan/mediawiki-extended + imagePullPolicy: IfNotPresent + resources: + requests: + memory: 2Gi + env: + - name: WIKI_NAME + value: MediaWiki + - name: WIKI_ADMIN + value: mediawiki_admin + - name: WIKI_ADMIN_PASS + value: "{{ mediawiki_admin_password }}" + - name: WIKI_LANG + value: en + - name: WIKI_URL + value: https://mediawiki.eom.dev/ + - name: DB_HOST + value: mariadb + - name: DB_PORT + value: "3306" + - name: DB_NAME + value: mediawiki + - name: DB_USER + value: mediawiki + - name: DB_PASS + value: "{{ mediawiki_admin_password }}" + - name: LDAP_BASE + value: dc=eom,dc=dev + - name: LDAP_SERVER_NAME + value: openldap.openldap.svc.cluster.local + - name: LDAP_SERVER_PORT + value: "389" + - name: LDAP_DOMAINNAME + value: openldap.openldap.svc.cluster.local + - name: LDAP_ENCTYPE + value: clear + - name: LDAP_USER_ATTR + value: uid + - name: LDAP_REAL_NAME_ATTR + value: cn + - name: LDAP_MAIL_ATTR + value: mail + - name: LDAP_BIND_USER + value: cn=readonly,dc=eom,dc=dev + - name: LDAP_BIND_PASS + value: "{{ openldap_readonly_password }}" + - name: LDAP_BUREAUCRAT_GROUP + value: cn=Mediawiki Bureaucrats,ou=MediaWiki,ou=Services,dc=eom,dc=dev + - name: LDAP_INTERFACE_ADMIN_GROUP + value: cn=Mediawiki Interface Administrators,ou=MediaWiki,ou=Services,dc=eom,dc=dev + - name: LDAP_SYSOP_GROUP + value: cn=Mediawiki Sysops,ou=MediaWiki,ou=Services,dc=eom,dc=dev + - name: LDAP_SEARCH_FILTER + value: (&(objectClass=posixAccount)(uid=%1$s)(memberOf=cn=Mediawiki Users,ou=MediaWiki,ou=Services,dc=eom,dc=dev)) + ports: + - containerPort: 80 + +- name: Create Service for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: mediawiki + namespace: mediawiki + spec: + selector: + app: mediawiki + ports: + - port: 80 + name: http + type: ClusterIP + +- name: Create Ingress + k8s: + state: present + definition: + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + annotations: + cert-manager.io/cluster-issuer: ca-issuer + name: mediawiki + namespace: mediawiki + spec: + ingressClassName: nginx + rules: + - host: mediawiki.eom.dev + http: + paths: + - pathType: Prefix + path: / + backend: + service: + name: mediawiki + port: + number: 80 + tls: + - hosts: + - mediawiki.eom.dev + secretName: mediawiki diff --git a/tasks/discourse-onion.yaml b/tasks/discourse-onion.yaml new file mode 100644 index 0000000..ea35ebf --- /dev/null +++ b/tasks/discourse-onion.yaml @@ -0,0 +1,97 @@ +--- +# tasks file for discourse-onionservice +- name: onionservice for discourse + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: discourse + namespace: discourse + spec: + version: 3 + rules: + - port: + number: 80 + backend: + service: + name: discourse + port: + number: 80 + +- name: onionservice for gitea http + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: http + namespace: gitea + spec: + version: 3 + rules: + - port: + number: 80 + backend: + service: + name: gitea-http + port: + number: 3000 + +- name: onionservice for minio + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: minio + namespace: minio + spec: + version: 3 + rules: + - port: + number: 80 + backend: + service: + name: minio + port: + number: 9000 + +- name: onionservice for mastodon + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: mastodon + namespace: mastodon + spec: + version: 3 + rules: + - port: + number: 80 + backend: + service: + name: mastodon-apache + port: + number: 80 + +- name: onionservice for owncast + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: http + namespace: owncast + spec: + version: 3 + rules: + - port: + number: 80 + backend: + service: + name: owncast + port: + number: 8080 + diff --git a/tasks/fictwiki.yaml b/tasks/fictwiki.yaml new file mode 100644 index 0000000..4954ad0 --- /dev/null +++ b/tasks/fictwiki.yaml @@ -0,0 +1,89 @@ +--- +# tasks file for mediawiki +- name: Create MediaWiki namespace + k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: fictwiki + +- name: Deploy MariaDB + kubernetes.core.helm: + name: mariadb + chart_ref: bitnami/mariadb + release_namespace: fictwiki + values: + auth: + rootPassword: "{{ mediawiki_admin_password }}" + username: mediawiki + password: "{{ mediawiki_admin_password }}" + database: mediawiki + primary: + persistence: + size: 4Ti + +- name: Create Deployment for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: mediawiki + namespace: fictwiki + spec: + replicas: 1 + selector: + matchLabels: + app: mediawiki + template: + metadata: + labels: + app: mediawiki + spec: + containers: + - name: mediawiki + image: mediawiki + imagePullPolicy: IfNotPresent + resources: + requests: + memory: 2Gi + ports: + - containerPort: 80 + +- name: Create Service for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: mediawiki + namespace: fictwiki + spec: + selector: + app: mediawiki + ports: + - port: 80 + name: http + type: ClusterIP + +- name: Create OnionService + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: mediawiki + namespace: fictwiki + spec: + version: 3 + rules: + - port: + number: 80 + backend: + service: + name: mediawiki + port: + number: 80 + diff --git a/tasks/gitea.yaml b/tasks/gitea.yaml index b11de3d..5e39c8d 100644 --- a/tasks/gitea.yaml +++ b/tasks/gitea.yaml @@ -38,23 +38,6 @@ secretName: gitea-tls persistence: size: 2Ti - actions: - enabled: true - provisioning: - enabled: true - statefulset: - actRunner: - config: | - log: - level: debug - cache: - enabled: false - runner: - labels: - - "ubuntu-latest:docker://node:16-bullseye" - - "ubuntu-22.04:docker://node:16-bullseye" - - "ubuntu-20.04:docker://node:16-bullseye" - - "ubuntu-18.04:docker://node:16-buster" gitea: metrics: enabled: true @@ -82,6 +65,7 @@ SHOW_REGISTRATION_BUTTON: true DEFAULT_ALLOW_CREATE_ORGANIZATION: false ALLOW_ONLY_EXTERNAL_REGISTRATION: false + ENABLE_NOTIFY_MAIL: true oauth2_client: ENABLE_AUTO_REGISTRATION: true UPDATE_AVATAR: true @@ -105,6 +89,8 @@ enabled: false postgresql: enabled: true + image: + tag: 16.4.0-debian-12-r9 global: postgresql: auth: diff --git a/tasks/mail.yaml b/tasks/mail.yaml index 2f7c9d1..e5ed3a8 100644 --- a/tasks/mail.yaml +++ b/tasks/mail.yaml @@ -188,6 +188,8 @@ mountPath: /tmp/docker-mailserver/opendkim ports: - containerPort: 25 + - containerPort: 110 + - containerPort: 143 - containerPort: 465 - containerPort: 587 - containerPort: 993 @@ -276,14 +278,38 @@ app: mail ports: - port: 25 - name: smtp-a - - port: 465 - name: smtp-b - - port: 587 - name: smtps - - port: 993 - name: imap - - port: 995 + name: smtp + - port: 110 name: pop3 + - port: 143 + name: imap + - port: 465 + name: esmtps + - port: 587 + name: esmtp + - port: 993 + name: imaps + - port: 995 + name: pop3s type: LoadBalancer externalTrafficPolicy: Local + +- name: onionservice for smtp + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: smtp + namespace: mail + spec: + version: 3 + rules: + - port: + number: 25 + backend: + service: + name: mail + port: + number: 25 + diff --git a/tasks/main.yaml b/tasks/main.yaml index 6b5801e..5eb1dce 100644 --- a/tasks/main.yaml +++ b/tasks/main.yaml @@ -3,4 +3,4 @@ - name: Deploy include_tasks: "{{ item }}" loop: - - gitea.yaml + - monero.yaml diff --git a/tasks/mediawiki.yaml b/tasks/mediawiki.yaml index 6815efa..2d62c9d 100644 --- a/tasks/mediawiki.yaml +++ b/tasks/mediawiki.yaml @@ -24,6 +24,22 @@ persistence: size: 4Ti +- name: Create a persistent volume claim for MediaWiki + k8s: + state: present + definition: + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: mediawiki + namespace: mediawiki + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 32Gi + - name: Create Deployment for MediaWiki k8s: definition: @@ -44,62 +60,20 @@ spec: containers: - name: mediawiki - image: ericomeehan/mediawiki-extended + image: mediawiki imagePullPolicy: IfNotPresent resources: requests: memory: 2Gi - env: - - name: WIKI_NAME - value: MediaWiki - - name: WIKI_ADMIN - value: mediawiki_admin - - name: WIKI_ADMIN_PASS - value: "{{ mediawiki_admin_password }}" - - name: WIKI_LANG - value: en - - name: WIKI_URL - value: https://mediawiki.eom.dev/ - - name: DB_HOST - value: mariadb - - name: DB_PORT - value: "3306" - - name: DB_NAME - value: mediawiki - - name: DB_USER - value: mediawiki - - name: DB_PASS - value: "{{ mediawiki_admin_password }}" - - name: LDAP_BASE - value: dc=eom,dc=dev - - name: LDAP_SERVER_NAME - value: openldap.openldap.svc.cluster.local - - name: LDAP_SERVER_PORT - value: "389" - - name: LDAP_DOMAINNAME - value: openldap.openldap.svc.cluster.local - - name: LDAP_ENCTYPE - value: clear - - name: LDAP_USER_ATTR - value: uid - - name: LDAP_REAL_NAME_ATTR - value: cn - - name: LDAP_MAIL_ATTR - value: mail - - name: LDAP_BIND_USER - value: cn=readonly,dc=eom,dc=dev - - name: LDAP_BIND_PASS - value: "{{ openldap_readonly_password }}" - - name: LDAP_BUREAUCRAT_GROUP - value: cn=Mediawiki Bureaucrats,ou=MediaWiki,ou=Services,dc=eom,dc=dev - - name: LDAP_INTERFACE_ADMIN_GROUP - value: cn=Mediawiki Interface Administrators,ou=MediaWiki,ou=Services,dc=eom,dc=dev - - name: LDAP_SYSOP_GROUP - value: cn=Mediawiki Sysops,ou=MediaWiki,ou=Services,dc=eom,dc=dev - - name: LDAP_SEARCH_FILTER - value: (&(objectClass=posixAccount)(uid=%1$s)(memberOf=cn=Mediawiki Users,ou=MediaWiki,ou=Services,dc=eom,dc=dev)) ports: - containerPort: 80 + volumemounts: + - name: mediawiki + mountpath: /var/www/html + volumes: + - name: mediawiki + persistentVolumeClaim: + claimName: mediawiki - name: Create Service for MediaWiki k8s: @@ -117,31 +91,50 @@ name: http type: ClusterIP -- name: Create Ingress +- name: Create OnionService k8s: - state: present definition: - apiVersion: networking.k8s.io/v1 - kind: Ingress + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService metadata: - annotations: - cert-manager.io/cluster-issuer: ca-issuer name: mediawiki namespace: mediawiki spec: - ingressClassName: nginx + version: 3 rules: - - host: mediawiki.eom.dev - http: - paths: - - pathType: Prefix - path: / - backend: - service: - name: mediawiki - port: - number: 80 - tls: - - hosts: - - mediawiki.eom.dev - secretName: mediawiki + - port: + number: 80 + backend: + service: + name: mediawiki + port: + number: 80 + +#- name: Create Ingress +# k8s: +# state: present +# definition: +# apiVersion: networking.k8s.io/v1 +# kind: Ingress +# metadata: +# annotations: +# cert-manager.io/cluster-issuer: ca-issuer +# name: mediawiki +# namespace: mediawiki +# spec: +# ingressClassName: nginx +# rules: +# - host: mediawiki.eom.dev +# http: +# paths: +# - pathType: Prefix +# path: / +# backend: +# service: +# name: mediawiki +# port: +# number: 80 +# tls: +# - hosts: +# - mediawiki.eom.dev +# secretName: mediawiki diff --git a/tasks/meidawiki-extended.yaml b/tasks/meidawiki-extended.yaml new file mode 100644 index 0000000..6815efa --- /dev/null +++ b/tasks/meidawiki-extended.yaml @@ -0,0 +1,147 @@ +--- +# tasks file for mediawiki +- name: Create MediaWiki namespace + k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: mediawiki + +- name: Deploy MariaDB + kubernetes.core.helm: + name: mariadb + chart_ref: bitnami/mariadb + release_namespace: mediawiki + values: + auth: + rootPassword: "{{ mediawiki_admin_password }}" + username: mediawiki + password: "{{ mediawiki_admin_password }}" + database: mediawiki + primary: + persistence: + size: 4Ti + +- name: Create Deployment for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: mediawiki + namespace: mediawiki + spec: + replicas: 1 + selector: + matchLabels: + app: mediawiki + template: + metadata: + labels: + app: mediawiki + spec: + containers: + - name: mediawiki + image: ericomeehan/mediawiki-extended + imagePullPolicy: IfNotPresent + resources: + requests: + memory: 2Gi + env: + - name: WIKI_NAME + value: MediaWiki + - name: WIKI_ADMIN + value: mediawiki_admin + - name: WIKI_ADMIN_PASS + value: "{{ mediawiki_admin_password }}" + - name: WIKI_LANG + value: en + - name: WIKI_URL + value: https://mediawiki.eom.dev/ + - name: DB_HOST + value: mariadb + - name: DB_PORT + value: "3306" + - name: DB_NAME + value: mediawiki + - name: DB_USER + value: mediawiki + - name: DB_PASS + value: "{{ mediawiki_admin_password }}" + - name: LDAP_BASE + value: dc=eom,dc=dev + - name: LDAP_SERVER_NAME + value: openldap.openldap.svc.cluster.local + - name: LDAP_SERVER_PORT + value: "389" + - name: LDAP_DOMAINNAME + value: openldap.openldap.svc.cluster.local + - name: LDAP_ENCTYPE + value: clear + - name: LDAP_USER_ATTR + value: uid + - name: LDAP_REAL_NAME_ATTR + value: cn + - name: LDAP_MAIL_ATTR + value: mail + - name: LDAP_BIND_USER + value: cn=readonly,dc=eom,dc=dev + - name: LDAP_BIND_PASS + value: "{{ openldap_readonly_password }}" + - name: LDAP_BUREAUCRAT_GROUP + value: cn=Mediawiki Bureaucrats,ou=MediaWiki,ou=Services,dc=eom,dc=dev + - name: LDAP_INTERFACE_ADMIN_GROUP + value: cn=Mediawiki Interface Administrators,ou=MediaWiki,ou=Services,dc=eom,dc=dev + - name: LDAP_SYSOP_GROUP + value: cn=Mediawiki Sysops,ou=MediaWiki,ou=Services,dc=eom,dc=dev + - name: LDAP_SEARCH_FILTER + value: (&(objectClass=posixAccount)(uid=%1$s)(memberOf=cn=Mediawiki Users,ou=MediaWiki,ou=Services,dc=eom,dc=dev)) + ports: + - containerPort: 80 + +- name: Create Service for MediaWiki + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: mediawiki + namespace: mediawiki + spec: + selector: + app: mediawiki + ports: + - port: 80 + name: http + type: ClusterIP + +- name: Create Ingress + k8s: + state: present + definition: + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + annotations: + cert-manager.io/cluster-issuer: ca-issuer + name: mediawiki + namespace: mediawiki + spec: + ingressClassName: nginx + rules: + - host: mediawiki.eom.dev + http: + paths: + - pathType: Prefix + path: / + backend: + service: + name: mediawiki + port: + number: 80 + tls: + - hosts: + - mediawiki.eom.dev + secretName: mediawiki diff --git a/tasks/monero-hidden.yaml b/tasks/monero-hidden.yaml new file mode 100644 index 0000000..dce41b6 --- /dev/null +++ b/tasks/monero-hidden.yaml @@ -0,0 +1,328 @@ +--- +# tasks file for monero +- name: Create Monero namespace + k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: monero + +- name: Create PVC for Monero + k8s: + state: present + definition: + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: data + namespace: monero + spec: + storageClassName: r720-nfs-client + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 512Gi + +- name: Create PVC for P2Pool + k8s: + state: present + definition: + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: p2pool + namespace: monero + spec: + storageClassName: r720-nfs-client + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 64Gi + +- name: Create a Tor instance for Monerod + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: Tor + metadata: + name: tor + namespace: monero + +- name: Create Deployment for Monerod + when: setup + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: monerod + namespace: monero + spec: + replicas: 1 + selector: + matchLabels: + app: monerod + template: + metadata: + labels: + app: monerod + spec: + containers: + - name: monerod + image: nginx + imagePullPolicy: IfNotPresent + resources: + requests: + memory: 2Gi + ports: + - containerPort: 18080 + - containerPort: 18081 + - containerPort: 18083 + - containerPort: 18084 + volumeMounts: + - name: data + mountPath: /data + - name: p2pool + image: nginx + imagePullPolicy: IfNotPresent + ports: + - containerPort: 3333 + - containerPort: 37889 + volumes: + - name: data + persistentVolumeClaim: + claimName: data + +- name: Create Service for Monero + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: monerod + namespace: monero + spec: + selector: + app: monerod + ports: + - port: 18080 + name: p2p + - port: 18081 + name: rpc + - port: 18083 + name: zmq + - port: 18084 + name: anonp2p + type: ClusterIP + +- name: Create Service for P2Pool + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: p2pool + namespace: monero + spec: + selector: + app: p2pool + ports: + - port: 3333 + name: mine + - port: 37889 + name: p2p + type: LoadBalancer + +- name: Create OnionService + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: rpc + namespace: monero + spec: + version: 3 + rules: + - port: + number: 18081 + backend: + service: + name: monerod + port: + number: 18081 + +- name: Create OnionService + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: p2p + namespace: monero + spec: + version: 3 + rules: + - port: + number: 18084 + backend: + service: + name: monerod + port: + number: 18084 + +- name: Create OnionService + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: mining + namespace: monero + spec: + version: 3 + rules: + - port: + number: 3333 + backend: + service: + name: p2pool + port: + number: 3333 + +- name: Create OnionService + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: p2poolp2p + namespace: monero + spec: + version: 3 + rules: + - port: + number: 37889 + backend: + service: + name: p2pool + port: + number: 37889 + +- name: Get p2p OnionService info + kubernetes.core.k8s_info: + api_version: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + namespace: monero + field_selectors: + - metadata.name=p2p + register: p2p_onionservice + +- name: Get p2pool OnionService info + kubernetes.core.k8s_info: + api_version: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + namespace: monero + field_selectors: + - metadata.name=p2poolp2p + register: p2pool_onionservice + +- name: Get Tor Service info + kubernetes.core.k8s_info: + api_version: v1 + kind: Service + namespace: monero + field_selectors: + - metadata.name=tor-tor-svc + register: tor_svc + +- name: Edit Deployment for Monerod + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: monerod + namespace: monero + spec: + replicas: 1 + selector: + matchLabels: + app: monerod + template: + metadata: + labels: + app: monerod + spec: + containers: + - name: monerod + image: ericomeehan/monerod:latest + imagePullPolicy: Always + command: + - monerod + args: + - "--proxy={{ tor_svc.resources[0].spec.clusterIP }}:9050" + - "--p2p-bind-ip=0.0.0.0" + - "--p2p-bind-port=18080" + - "--rpc-bind-ip=0.0.0.0" + - "--rpc-bind-port=18081" + - "--tx-proxy=tor,{{ tor_svc.resources[0].spec.clusterIP }}:9050" + - "--anonymous-inbound={{ p2p_onionservice.resources[0].status.hostname }}:18084,0.0.0.0:18084" + - "--data-dir=/data" + - "--zmq-pub=tcp://127.0.0.1:18083" + - "--non-interactive" + - "--no-igd" + - "--confirm-external-bind" + resources: + requests: + memory: 2Gi + ports: + - containerPort: 18080 + - containerPort: 18081 + - containerPort: 18083 + - containerPort: 18084 + volumeMounts: + - name: monerod + mountPath: /data + - name: p2pool + image: ericomeehan/p2pool:latest + imagePullPolicy: IfNotPresent + command: + - p2pool + args: + - "--host" + - "127.0.0.1" + - "--rpc-port" + - "18081" + - "--wallet" + - "{{ monero_p2pool_wallet_address }}" + - "--stratum" + - "0.0.0.0:3333" + - "--p2p" + - "0.0.0.0:37889" + - "--addpeers" + - "65.21.227.114:37889" + - "--socks5" + - "{{ tor_svc.resources[0].spec.clusterIP }}:9050" + - "--no-dns" + - "--no-upnp" + - "--onion-address" + - "{{ p2pool_onionservice.resources[0].status.hostname }}" + ports: + - containerPort: 3333 + - containerPort: 37889 + volumeMounts: + - name: p2pool + mountPath: /home/p2pool + volumes: + - name: monerod + persistentVolumeClaim: + claimName: data + - name: p2pool + persistentVolumeClaim: + claimName: p2pool + diff --git a/tasks/monero.yaml b/tasks/monero.yaml new file mode 100644 index 0000000..5525edf --- /dev/null +++ b/tasks/monero.yaml @@ -0,0 +1,264 @@ +--- +# tasks file for monero +- name: Create Monero namespace + k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: monero + +- name: Create PVC for Monero + k8s: + state: present + definition: + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: data + namespace: monero + spec: + storageClassName: r720-nfs-client + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 512Gi + +- name: Create PVC for P2Pool + k8s: + state: present + definition: + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: p2pool + namespace: monero + spec: + storageClassName: r720-nfs-client + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 64Gi + +- name: Request a certificate for Monero + k8s: + state: present + definition: + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + name: monerotls + namespace: monero + spec: + secretName: monerotls + privateKey: + algorithm: RSA + encoding: PKCS1 + size: 2048 + duration: 2160h # 90d + renewBefore: 360h # 15d + isCA: false + usages: + - server auth + - client auth + subject: + organizations: + - EOM + commonName: monerod.eom.dev + dnsNames: + - monerod.eom.dev + issuerRef: + name: ca-issuer + kind: ClusterIssuer + +- name: Request a certificate for p2pool + k8s: + state: present + definition: + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + name: tls + namespace: monero + spec: + secretName: tls + privateKey: + algorithm: RSA + encoding: PKCS1 + size: 2048 + duration: 2160h # 90d + renewBefore: 360h # 15d + isCA: false + usages: + - server auth + - client auth + subject: + organizations: + - EOM + commonName: p2pool.eom.dev + dnsNames: + - p2pool.eom.dev + issuerRef: + name: ca-issuer + kind: ClusterIssuer + +- name: Edit Deployment for Monerod + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: monerod + namespace: monero + spec: + replicas: 1 + selector: + matchLabels: + app: monerod + template: + metadata: + labels: + app: monerod + spec: + containers: + - name: monerod + image: ericomeehan/monerod:latest + imagePullPolicy: Always + command: + - monerod + args: + - "--p2p-bind-ip=0.0.0.0" + - "--p2p-bind-port=18080" + - "--rpc-bind-ip=0.0.0.0" + - "--rpc-bind-port=18081" + - "--restricted-rpc" + - "--rpc-login={{ monerod_user }}:{{ monerod_password }}" + - "--data-dir=/data" + - "--zmq-pub=tcp://127.0.0.1:18083" + - "--rpc-ssl=enabled" + - "--rpc-ssl-private-key=/etc/letsencrypt/tls.key" + - "--rpc-ssl-certificate=/etc/letsencrypt/tls.crt" + - "--non-interactive" + - "--no-igd" + - "--confirm-external-bind" + - "--bootstrap-daemon-address=auto" + resources: + requests: + memory: 2Gi + ports: + - containerPort: 18080 + - containerPort: 18081 + - containerPort: 18083 + volumeMounts: + - name: monerod + mountPath: /data + - name: monerotls + mountPath: /etc/letsencrypt + volumes: + - name: monerod + persistentVolumeClaim: + claimName: data + - name: monerotls + secret: + secretName: monerotls + +- name: deploy p2pool + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: p2pool + namespace: monero + spec: + replicas: 1 + selector: + matchLabels: + app: p2pool + template: + metadata: + labels: + app: p2pool + spec: + containers: + - name: p2pool + image: ericomeehan/p2pool:latest + imagePullPolicy: IfNotPresent + command: + - p2pool + args: + - "--host" + - "monerod" + - "--rpc-port" + - "18081" + - "--wallet" + - "{{ monero_p2pool_wallet_address }}" + - "--stratum" + - "0.0.0.0:3333" + - "--p2p" + - "0.0.0.0:37889" + - "--addpeers" + - "65.21.227.114:37889" + - "--tls-cert" + - "/etc/letsencrypt/tls.crt" + - "--tls-cert-key" + - "/etc/letsencrypt/tls.key" + - "--rpc-ssl" + - "--rpc-login={{ monerod_user }}:{{ monerod_password }}" + ports: + - containerPort: 3333 + - containerPort: 37889 + volumeMounts: + - name: p2pool + mountPath: /home/p2pool + - name: tls + mountPath: /etc/letsencrypt + volumes: + - name: p2pool + persistentVolumeClaim: + claimName: p2pool + - name: tls + secret: + secretName: tls + +- name: monero service + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: monerod + namespace: monero + spec: + selector: + app: monerod + ports: + - port: 18080 + name: p2p + - port: 18081 + name: rpc + - port: 18083 + name: zmq + type: LoadBalancer + +- name: p2pool service + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: p2pool + namespace: monero + spec: + selector: + app: p2pool + ports: + - port: 3333 + name: mine + - port: 37889 + name: p2poolp2p + type: LoadBalancer + diff --git a/tasks/owncast.yaml b/tasks/owncast.yaml index 58bdbea..3c21eec 100644 --- a/tasks/owncast.yaml +++ b/tasks/owncast.yaml @@ -48,7 +48,7 @@ spec: containers: - name: owncast - image: owncast/owncast:0.2.0 + image: owncast/owncast:0.3.0 resources: requests: cpu: 1.5 diff --git a/tasks/p2pool.yaml b/tasks/p2pool.yaml new file mode 100644 index 0000000..948ebd8 --- /dev/null +++ b/tasks/p2pool.yaml @@ -0,0 +1,191 @@ +--- +# tasks file for monero +- name: Create P2Pool namespace + k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: p2pool + +- name: Create PVC for P2Pool + k8s: + state: present + definition: + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: data + namespace: p2pool + spec: + storageClassName: r720-nfs-client + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 64Gi + +- name: Create a Tor instance for P2Poold + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: Tor + metadata: + name: tor + namespace: p2pool + +- name: Create Deployment for P2Poold + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: p2pool + namespace: p2pool + spec: + replicas: 1 + selector: + matchLabels: + app: p2pool + template: + metadata: + labels: + app: p2pool + spec: + containers: + - name: p2pool + image: nginx + imagePullPolicy: IfNotPresent + ports: + - containerPort: 3333 + - containerPort: 37889 + +- name: Create Service for P2Pool + k8s: + definition: + apiVersion: v1 + kind: Service + metadata: + name: p2pool + namespace: p2pool + spec: + selector: + app: p2pool + ports: + - port: 3333 + name: mine + - port: 37889 + name: p2p + type: ClusterIP + +- name: Create OnionService for mining + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: mining + namespace: p2pool + spec: + version: 3 + rules: + - port: + number: 3333 + backend: + service: + name: p2pool + port: + number: 3333 + +- name: Create OnionService for P2P + k8s: + definition: + apiVersion: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + metadata: + name: p2p + namespace: p2pool + spec: + version: 3 + rules: + - port: + number: 28722 + backend: + service: + name: p2pool + port: + number: 37889 + +- name: Get Tor Service info + kubernetes.core.k8s_info: + api_version: v1 + kind: Service + namespace: p2pool + field_selectors: + - metadata.name=tor-tor-svc + register: tor_svc + +- name: Get p2pool OnionService info + kubernetes.core.k8s_info: + api_version: tor.k8s.torproject.org/v1alpha2 + kind: OnionService + namespace: p2pool + field_selectors: + - metadata.name=p2p + register: p2pool_onionservice + +- name: Edit Deployment for P2Poold + k8s: + definition: + apiVersion: v1 + kind: Deployment + metadata: + name: p2pool + namespace: p2pool + spec: + replicas: 1 + selector: + matchLabels: + app: p2pool + template: + metadata: + labels: + app: p2pool + spec: + containers: + - name: p2pool + image: ericomeehan/p2pool:latest + imagePullPolicy: IfNotPresent + command: + - p2pool + args: + - "--host" + - "{{ monero_p2pool_hostname }}" + - "--rpc-port" + - "18081" + - "--wallet" + - "{{ monero_p2pool_wallet_address }}" + - "--stratum" + - "0.0.0.0:3333" + - "--p2p" + - "0.0.0.0:37889" + - "--addpeers" + - "65.21.227.114:37889" + - "--socks5" + - "{{ tor_svc.resources[0].spec.clusterIP }}:9050" + - "--no-dns" + - "--no-upnp" + - "--onion-address" + - "{{ p2pool_onionservice.resources[0].status.hostname }}" + ports: + - containerPort: 3333 + - containerPort: 37889 + volumeMounts: + - name: data + mountPath: /home/p2pool + volumes: + - name: data + persistentVolumeClaim: + claimName: data + diff --git a/tasks/prometheus.yaml b/tasks/prometheus.yaml index 74a0a91..4fe71d3 100644 --- a/tasks/prometheus.yaml +++ b/tasks/prometheus.yaml @@ -7,37 +7,17 @@ release_namespace: prometheus create_namespace: true values: + alertmanager: + image: + repository: bitnamilegacy/alertmanager + tag: 0.28.1-debian-12-r15 server: + image: + repository: bitnamilegacy/prometheus + tag: 3.5.0-debian-12-r3 persistence: size: 256Gi extraScrapeConfigs: - - job_name: apps - static_configs: - - targets: - - discourse.eom.dev - labels: - instance: discourse - - targets: - - gitea.eom.dev - labels: - instance: gitea - - targets: - - grafana.eom.dev - labels: - instance: grafana - metrics_path: /metrics - - - job_name: owncast - scrape_interval: 1m - metrics_path: /api/admin/prometheus - scheme: https - basic_auth: - username: admin - password: "{{ owncast_admin_password }}" - static_config: - - targets: - - owncast.eom.dev - - job_name: local static_configs: - targets: @@ -45,103 +25,116 @@ labels: instance: nextcloud - targets: - - matrix-synapse.matrix.svc.cluster.local:9092 + - ingress-nginx-controller-metrics.ingress-nginx.svc.cluster.local:10254 + + - job_name: www + static_configs: + - targets: + - prometheus.www.svc.cluster.local:9117 labels: - instance: matrix - metrics_path: / + instance: www + metrics_path: /metrics - job_name: libvirt_exporter static_configs: - targets: - - 192.168.1.48:9177 + - poweredge-t640:9177 labels: instance: poweredge-t640 + - targets: + - poweredge-r720:9177 + labels: + instance: poweredge-r720 metrics_path: /metrics - job_name: node_exporter static_configs: - targets: - - 192.168.1.95:9100 + - poweredge-r350:9100 labels: instance: poweredge-r350 - targets: - - 192.168.1.48:9100 + - poweredge-t640:9100 labels: instance: poweredge-t640 - targets: - - 192.168.1.59:9100 + - poweredge-r720:9100 + labels: + instance: poweredge-r720 + - targets: + - alpha-control-plane:9100 labels: instance: alpha-control-plane - targets: - - 192.168.1.91:9100 + - alpha-worker-0:9100 labels: instance: alpha-worker-0 - targets: - - 192.168.1.70:9100 + - alpha-worker-1:9100 labels: instance: alpha-worker-1 - targets: - - 192.168.1.74:9100 + - alpha-worker-2:9100 labels: instance: alpha-worker-2 - targets: - - 192.168.1.75:9100 + - alpha-worker-3:9100 labels: instance: alpha-worker-3 - targets: - - 192.168.1.61:9100 + - alpha-worker-4:9100 labels: instance: alpha-worker-4 - targets: - - 192.168.1.66:9100 + - alpha-worker-5:9100 labels: instance: alpha-worker-5 - targets: - - 192.168.1.38:9100 + - alpha-worker-6:9100 labels: instance: alpha-worker-6 - targets: - - 192.168.1.92:9100 + - alpha-worker-7:9100 labels: instance: alpha-worker-7 - targets: - - 192.168.1.67:9100 + - alpha-worker-8:9100 labels: instance: alpha-worker-8 - targets: - - 192.168.1.63:9100 + - alpha-worker-9:9100 labels: instance: alpha-worker-9 - targets: - - 192.168.1.86:9100 + - alpha-worker-10:9100 labels: instance: alpha-worker-10 - targets: - - 192.168.1.65:9100 + - alpha-worker-11:9100 labels: instance: alpha-worker-11 - targets: - - 192.168.1.72:9100 + - alpha-worker-12:9100 labels: instance: alpha-worker-12 - targets: - - 192.168.1.95:9100 + - alpha-worker-13:9100 labels: instance: alpha-worker-13 - targets: - - 192.168.1.70:9100 + - alpha-worker-14:9100 labels: instance: alpha-worker-14 - targets: - - 192.168.1.46:9100 + - alpha-worker-15:9100 labels: instance: alpha-worker-15 - targets: - - 192.168.1.74:9100 + - alpha-worker-16:9100 labels: instance: alpha-worker-16 - targets: - - 192.168.1.88:9100 + - alpha-worker-17:9100 labels: instance: alpha-worker-17 metrics_path: /metrics diff --git a/tasks/tes3mp.yaml b/tasks/tes3mp.yaml index 90aa28c..dfdb4ea 100644 --- a/tasks/tes3mp.yaml +++ b/tasks/tes3mp.yaml @@ -16,7 +16,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: - name: config + name: data namespace: tes3mp spec: accessModes: @@ -25,6 +25,18 @@ requests: storage: 16Gi +- name: Create a config map + k8s: + state: present + definition: + apiVersion: v1 + kind: ConfigMap + metadata: + name: config + namespace: tes3mp + data: + tes3mp-server-default.cfg: "{{ lookup('template', 'tes3mp-server-default.cfg.j2') }}" + - name: Create a deployment k8s: definition: @@ -45,21 +57,32 @@ spec: containers: - name: tes3mp - image: tes3mp/server + image: tes3mp/server:0.7.0 + imagePullPolicy: Always volumeMounts: - name: data mountPath: /server/data + - name: config + mountPath: /server/tes3mp-server-default.cfg + subPath: tes3mp-server-default.cfg ports: - containerPort: 25565 env: - name: TES3MP_SERVER_GENERAL_HOSTNAME value: tes3.eom.dev - name: TES3MP_SERVER_GENERAL_PASSWORD - value: "{{ tes3mp_password }}" + value: "{{ tes3mp_server_general_password }}" + command: + - "./tes3mp-server" + args: + - "$@" volumes: - name: data persistentVolumeClaim: claimName: data + - name: config + configMap: + name: config - name: Expose deployment as a service k8s: @@ -73,7 +96,7 @@ selector: app: tes3mp ports: - - port: 25566 + - port: 25565 targetPort: 25565 name: tes3mp protocol: UDP diff --git a/templates/tes3mp-server-default.cfg.j2 b/templates/tes3mp-server-default.cfg.j2 new file mode 100644 index 0000000..e6b5587 --- /dev/null +++ b/templates/tes3mp-server-default.cfg.j2 @@ -0,0 +1,19 @@ +[General] +# The default localAddress of 0.0.0.0 makes the server reachable at all of its local addresses +localAddress = 0.0.0.0 +port = 25565 +maximumPlayers = 64 +hostname = {{ tes3mp_server_general_hostname }} +# 0 - Verbose (spam), 1 - Info, 2 - Warnings, 3 - Errors, 4 - Only fatal errors +logLevel = 1 +password = {{ tes3mp_server_general_password }} + +[Plugins] +home = /server/data +plugins = serverCore.lua + +[MasterServer] +enabled = true +address = master.tes3mp.com +port = 25561 +rate = 10000 diff --git a/templates/unrealircd.conf.j2 b/templates/unrealircd.conf.j2 new file mode 100644 index 0000000..d29475d --- /dev/null +++ b/templates/unrealircd.conf.j2 @@ -0,0 +1,706 @@ +/* Configuration file for UnrealIRCd 6 + * + * Simply copy this file to your conf/ directory and call it 'unrealircd.conf' + * + * If you are in a hurry then you can CTRL+F for: CHANGE THIS + * The items that must be changed are indicated with those two words. + * However, we actually recommend going through the file line by line + * and edit it where needed, so you can see all the basic items and + * what they are set to. + * + * BEFORE YOU PROCEED: + * Important: all lines, except { and } end with an ; + * This is very important, if you miss a ; somewhere then the + * configuration file parser will complain and the file will not + * be processed correctly! + * If this is your first experience with an UnrealIRCd configuration + * file then we really recommend you to read a little about the syntax, + * this only takes a few minutes and will help you a lot: + * https://www.unrealircd.org/docs/Configuration#Configuration_file_syntax + * + * UnrealIRCd 6 documentation (very extensive!): + * https://www.unrealircd.org/docs/UnrealIRCd_6_documentation + * + * Frequently Asked Questions: + * https://www.unrealircd.org/docs/FAQ + */ + +/* This is a comment, all text here is ignored (comment type #1) */ +// This is also a comment, this line is ignored (comment type #2) +# This is also a comment, again this line is ignored (comment type #3) + +/* UnrealIRCd makes heavy use of modules. Modules allow you to completely + * customize the featureset you wish to enable in UnrealIRCd. + * See: https://www.unrealircd.org/docs/Modules + * + * By using the include below we instruct the IRCd to read the file + * 'modules.default.conf' which will load more than 150 modules + * shipped with UnrealIRCd. In other words: this will simply load + * all the available features in UnrealIRCd. + * If you are setting up UnrealIRCd for the first time we suggest you + * use this. Then, when everything is up and running you can come + * back later to customize the list (if you wish). + */ +include "modules.default.conf"; + +/* Now let's include some other files as well: + * - help/help.conf for our on-IRC /HELPOP system + * - badwords.conf for channel and user mode +G + * - spamfilter.conf as an example for spamfilter usage + * (commented out) + * - operclass.default.conf contains some good operclasses which + * you can use in your oper blocks. + */ +include "help/help.conf"; +include "badwords.conf"; +//include "spamfilter.conf"; +include "operclass.default.conf"; +include "snomasks.default.conf"; + +/* Load the default cloaking module (2021 onwards): */ +loadmodule "cloak_sha256"; +/* Or load the old module from UnrealIRCd 3.2/4/5 instead: */ +//loadmodule "cloak_md5"; + +// CHANGE THIS (the 'name' and the 'info'): +/* This is the me { } block which basically says who we are. + * It defines our server name, some information line and an unique "sid". + * The server id (sid) must start with a digit followed by two digits or + * letters. The sid must be unique for your IRC network (each server should + * have it's own sid). It is common to use 001 for the first server. + */ +me { + name "{{ onionservice.resources[0].status.hostname }}"; + info "{{ unrealircd.me.info }}"; + sid "001"; +} + +// CHANGE THIS: +/* The admin { } block defines what users will see if they type /ADMIN. + * It normally contains information on how to contact the administrator. + */ +admin { + "{{ unrealircd.admin.name }}"; + "{{ unrealircd.admin.username }}"; + "{{ unrealircd.admin.email }}"; +} + +/* Clients and servers are put in class { } blocks, we define them here. + * Class blocks consist of the following items: + * - pingfreq: how often to ping a user / server (in seconds) + * - connfreq: how often we try to connect to this server (in seconds) + * - sendq: the maximum queue size for a connection + * - recvq: maximum receive queue from a connection (flood control) + */ + +/* Client class with good defaults */ +class clients +{ + pingfreq 90; + maxclients 1000; + sendq 200k; + recvq 8000; +} + +/* Special class for IRCOps with higher limits */ +class opers +{ + pingfreq 90; + maxclients 50; + sendq 1M; + recvq 8000; +} + +/* Server class with good defaults */ +class servers +{ + pingfreq 60; + connfreq 15; /* try to connect every 15 seconds */ + maxclients 10; /* max servers */ + sendq 20M; +} + +/* Allow blocks define which clients may connect to this server. + * This allows you to add a server password or restrict the server to + * specific IPs only. You also configure the maximum connections + * allowed per IP here. + * See also: https://www.unrealircd.org/docs/Allow_block + */ + +/* Allow everyone in, but only 3 connections per IP */ +allow { + mask *; + class clients; + maxperip 3; +} + +/* Example of a special allow block on a specific IP: + * Requires users on that IP to connect with a password. If the password + * is correct then it permits 20 connections on that IP. + */ +// allow { +// mask 192.0.2.1; +// class clients; +// password "somesecretpasswd"; +// maxperip 20; +// } + +/* Oper blocks define your IRC Operators. + * IRC Operators are people who have "extra rights" compared to others, + * for example they may /KILL other people, initiate server linking, + * /JOIN channels even though they are banned, etc. + * + * For more information about becoming an IRCOp and how to do admin + * tasks, see: https://www.unrealircd.org/docs/IRCOp_guide + * + * For details regarding the oper { } block itself, see + * https://www.unrealircd.org/docs/Oper_block + */ + +/* Here is an example oper block for 'bobsmith' + * YOU MUST CHANGE THIS!! (the oper name and the password) + */ +oper bobsmith { + class opers; + mask *@*; + + /* Technically you can put oper passwords in plaintext in the conf but + * this is HIGHLY DISCOURAGED. Instead you should generate a password hash: + * On *NIX, run: ./unrealircd mkpasswd + * On Windows, run: "C:\Program Files\UnrealIRCd 6\bin\unrealircdctl" mkpasswd + * .. and then paste the result below: + */ + password "$argon2id..etc.."; + /* See https://www.unrealircd.org/docs/Authentication_types for + * more information, including even better authentication types + * such as 'certfp', and how to generate hashes on Windows. + */ + + /* Oper permissions are defined in an 'operclass' block. + * See https://www.unrealircd.org/docs/Operclass_block + * UnrealIRCd ships with a number of default blocks, see + * the article for a full list. We choose 'netadmin' here. + */ + operclass netadmin; + swhois "is a Network Administrator"; + vhost netadmin.example.org; +} + +/* Listen blocks define the ports where the server should listen on. + * In other words: the ports that clients and servers may use to + * connect to this server. + * + * Syntax: + * listen { + * ip ; + * port ; + * options { + * ; + * } + * } + */ + +/* Standard IRC port 6667: + * Insecure plaintext (NOT for production servers) + * This listen block is here only for quick testing. + * Delete or comment out this listen block on production servers + * and use TLS on port 6697 instead. + */ +listen { + ip *; + port 6667; +} + +/* Standard IRC SSL/TLS port 6697 */ +listen { + ip *; + port 6697; + options { tls; } +} + +/* Special SSL/TLS servers-only port for linking */ +listen { + ip *; + port 6900; + options { tls; serversonly; } +} + +/* NOTE: If you are on an IRCd shell with multiple IP's and you use + * the above listen { } blocks then you will likely get an + * 'Address already in use' error and the ircd won't start. + * This means you MUST bind to a specific IP instead of '*' like: + * listen { ip 1.2.3.4; port 6667; } + * Of course, replace the IP with the IP that was assigned to you. + */ + +/* + * Link blocks allow you to link multiple servers together to form a network. + * See https://www.unrealircd.org/docs/Tutorial:_Linking_servers + */ +//link hub.example.org +//{ +// incoming { +// mask *@something; +// } +// +// outgoing { +// bind-ip *; /* or explicitly an IP */ +// hostname hub.example.org; +// port 6900; +// options { tls; } +// } +// +// /* We use the SPKI fingerprint of the other server for authentication. +// * Open a shell on the OTHER SERVER and run the command to get the fingerprint: +// * On *NIX, run: ./unrealircd spkifp +// * On Windows, run: "C:\Program Files\UnrealIRCd 6\bin\unrealircdctl" spkifp +// */ +// password "AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUV=" { spkifp; } +// +// class servers; +//} + +/* The link block for services is usually much simpler. + * For more information about what Services are, + * see https://www.unrealircd.org/docs/Services + */ +//link services.example.org +//{ +// incoming { +// mask 127.0.0.1; +// } +// +// password "changemeplease"; +// +// class servers; +//} + +link {{ anope_os.resources[0].status.hostname }} { + incoming { + mask { ip 127.0.0.1; } + }; + password "mypassword"; + class servers; +}; +ulines { services.example.net; }; + +/* U-lines give other servers (even) more power/commands. + * If you use services you MUST add them here. You must add the + * services server name in ulines { } in the config file on + * every UnrealIRCd server on your network. + * IMPORTANT: Never put the name of an UnrealIRCd server here, + * it's only for Services! + */ +//ulines { +// services.example.org; +//} + +/* Here you can add a password for the IRCOp-only /DIE and /RESTART commands. + * This is mainly meant to provide a little protection against accidental + * restarts and server kills. + */ +drpass { + restart "restart"; + die "die"; +} + +/* The log block defines what should be logged and to what file. + * See also https://www.unrealircd.org/docs/Log_block + */ + +/* This is a good default, it logs everything except + * debug stuff and join/part/kick. + */ +log { + source { + all; + !debug; + !join.LOCAL_CLIENT_JOIN; + !join.REMOTE_CLIENT_JOIN; + !part.LOCAL_CLIENT_PART; + !part.REMOTE_CLIENT_PART; + !kick.LOCAL_CLIENT_KICK; + !kick.REMOTE_CLIENT_KICK; + } + destination { + file "ircd.log" { maxsize 100M; } + } +} + +/* In addition to regular logging, also add a JSON log file. + * This includes lots of information about every event so is great + * for auditing purposes and is machine readable. It is, however + * less readable for humans. + */ +log { + source { + all; + !debug; + !join.LOCAL_CLIENT_JOIN; + !join.REMOTE_CLIENT_JOIN; + !part.LOCAL_CLIENT_PART; + !part.REMOTE_CLIENT_PART; + !kick.LOCAL_CLIENT_KICK; + !kick.REMOTE_CLIENT_KICK; + } + destination { + file "ircd.json.log" { maxsize 250M; type json; } + } +} + +/* With "aliases" you can create an alias like /SOMETHING to send a message to + * some user or bot. They are usually used for services. + * + * We have a number of pre-set alias files, check out the alias/ directory. + * As an example, here we include all aliases used for anope services. + */ +include "aliases/anope.conf"; + +/* Ban nick names so they cannot be used by regular users */ +// ban nick { +// mask "*C*h*a*n*S*e*r*v*"; +// reason "Reserved for Services"; +// } + +/* Ban ip. + * Note that you normally use /KLINE, /GLINE and /ZLINE for this. + */ +// ban ip { +// mask 195.86.232.81; +// reason "Hate you"; +// } + +/* Ban server - if we see this server linked to someone then we delink */ +// ban server { +// mask eris.berkeley.edu; +// reason "Get out of here."; +// } + +/* Ban user - just as an example, you normally use /KLINE or /GLINE for this */ +// ban user { +// mask *tirc@*.saturn.bbn.com; +// reason "Idiot"; +// } + +/* Ban realname allows you to ban clients based on their 'real name' + * or 'gecos' field. + */ +// ban realname { +// mask "Swat Team"; +// reason "mIRKFORCE"; +// } + +// ban realname { +// mask "sub7server"; +// reason "sub7"; +// } + +/* Ban and TKL exceptions. Allows you to exempt users / machines from + * KLINE, GLINE, etc. + * If you are an IRCOp with a static IP (and no untrusted persons on that IP) + * then we suggest you add yourself here. That way you can always get in + * even if you accidentally place a *LINE ban on yourself. + */ + +/* except ban with type 'all' protects you from GLINE, GZLINE, QLINE, SHUN */ +// except ban { +// mask *@192.0.2.1; +// type all; +// } + +/* This allows IRCCloud connections in without maxperip restrictions + * and also exempt them from connect-flood throttling. + */ +except ban { + mask *.irccloud.com; + type { maxperip; connect-flood; } +} + +/* With deny dcc blocks you can ban filenames for DCC */ +// deny dcc { +// filename "*sub7*"; +// reason "Possible Sub7 Virus"; +// } + +/* deny channel allows you to ban a channel (mask) entirely */ +// deny channel { +// channel "*warez*"; +// reason "Warez is illegal"; +// class "clients"; +// } + +/* VHosts (Virtual Hosts) allow users to acquire a different host. + * See https://www.unrealircd.org/docs/Vhost_block + */ + +/* Example vhost which you can use. On IRC type: /VHOST test test + */ +// vhost { +// vhost i.hate.microsefrs.com; +// mask *@*; +// login "test"; +// password "test"; +// } + +/* Blacklist blocks will query an external DNS Blacklist service + * whenever a user connects, to see if the IP address is known + * to cause drone attacks, is a known hacked machine, etc. + * Documentation: https://www.unrealircd.org/docs/Blacklist_block + * Or just have a look at the blocks below. + */ + +/* DroneBL, probably the most popular blacklist used by IRC Servers. + * See https://dronebl.org/ for their documentation and the + * meaning of the reply types. At time of writing we use types: + * 3: IRC Drone, 5: Bottler, 6: Unknown spambot or drone, + * 7: DDoS Drone, 8: SOCKS Proxy, 9: HTTP Proxy, 10: ProxyChain, + * 11: Web Page Proxy, 12: Open DNS Resolver, 13: Brute force attackers, + * 14: Open Wingate Proxy, 15: Compromised router / gateway, + * 16: Autorooting worms. + */ +blacklist dronebl { + dns { + name dnsbl.dronebl.org; + type record; + reply { 3; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; } + } + action gline; + ban-time 24h; + reason "Proxy/Drone detected. Check https://dronebl.org/lookup?ip=$ip for details."; +} + +/* EFnetRBL, see https://rbl.efnetrbl.org/ for documentation + * and the meaning of the reply types. + * At time of writing: 1 is open proxy, 4 is TOR, 5 is drones/flooding. + * + * NOTE: If you want to permit TOR proxies on your server, then + * you need to remove the '4;' below in the reply section. + */ +blacklist efnetrbl { + dns { + name rbl.efnetrbl.org; + type record; + reply { 1; 4; 5; } + } + action gline; + ban-time 24h; + reason "Proxy/Drone/TOR detected. Check https://rbl.efnetrbl.org/?i=$ip for details."; +} + +/* You can include other configuration files */ +/* include "klines.conf"; */ + +/* Network configuration */ +set { + // CHANGE THIS, ALL 4 ITEMS: + network-name "ExampleNET"; + default-server "irc.example.org"; + services-server "services.example.org"; + stats-server "stats.example.org"; + + /* Normal defaults */ + help-channel "#Help"; + cloak-prefix "Clk"; + prefix-quit "Quit"; + + /* Cloak keys should be the same at all servers on the network. + * They are used for generating masked hosts and should be kept secret. + * YOU MUST CHANGE THIS! + * The keys should be 3 random strings of 80 characters each (or more). + * and must consist of lowcase (a-z), upcase (A-Z) and digits (0-9). + * On *NIX, you can run './unrealircd gencloak' in your shell to let + * UnrealIRCd generate 3 random strings for you. + * On Windows, you can run "C:\Program Files\UnrealIRCd 6\bin\unrealircdctl" gencloak + */ + cloak-keys { + "Oozahho1raezoh0iMee4ohvegaifahv5xaepeitaich9tahdiquaid0geecipahdauVaij3zieph4ahi"; + "and another one"; + "and another one"; + } +} + +/* Server specific configuration */ +set { + // FINALLY, YOU MUST CHANGE THIS NEXT ITEM: + kline-address 'set.this.to.email.address'; /* e-mail or URL shown when a user is banned */ + + modes-on-connect "+ixw"; /* when users connect, they will get these user modes */ + modes-on-oper "+xws"; /* when someone becomes IRCOp they'll get these modes */ + modes-on-join "+nt"; /* default channel modes when a new channel is created */ + oper-auto-join "#opers"; /* IRCOps are auto-joined to this channel */ + options { + hide-ulines; /* hide U-lines in /MAP and /LINKS */ + show-connect-info; /* show "looking up your hostname" messages on connect */ + } + + maxchannelsperuser 10; /* maximum number of channels a user may /JOIN */ + + /* The minimum time a user must be connected before being allowed to + * use a QUIT message. This will hopefully help stop spam. + */ + anti-spam-quit-message-time 10s; + + /* Or simply set a static quit, meaning any /QUIT reason is ignored */ + /* static-quit "Client quit"; */ + + /* static-part does the same for /PART */ + /* static-part yes; */ + + /* Flood protection */ + anti-flood { + /* There are lots of settings for this and most have good defaults. + * See https://www.unrealircd.org/docs/Anti-flood_settings + */ + + channel { + /* For channel-specific anti-flood settings, see + * https://www.unrealircd.org/docs/Channel_anti-flood_settings + * In UnrealIRCd 6.2.0+ the default is profile "normal". + * Chanops can override this via "MODE #channel +F relaxed" + * or "+F off". If you are afraid of too many false positives + * then you could set this to "relaxed" instead. Note that + * doing so would reduce protection for everyone. Another + * option is to set it here to "off" to disable this default + * channel protection entirely (not recommended). + */ + default-profile normal; + } + } + + /* Settings for spam filter */ + spamfilter { + ban-time 1d; /* default duration of a *LINE ban set by spamfilter */ + ban-reason "Spam/Advertising"; /* default reason */ + virus-help-channel "#help"; /* channel to use for 'viruschan' action */ + /* except "#help"; channel to exempt from Spamfilter */ + } + + /* Restrict certain commands. + * See https://www.unrealircd.org/docs/Set_block#set::restrict-commands + */ + restrict-commands { + list { + except { + connect-time 60; /* after 60 seconds you can use LIST */ + identified yes; /* or immediately, if you are identified to services */ + reputation-score 24; /* or if you have a reputation score of 24 or more */ + } + } + invite { + except { + connect-time 120; + identified yes; + reputation-score 24; + } + } + /* In addition to the ability to restrict any command, + * such as shown above. There are also 4 special types + * that you can restrict. These are "private-message", + * "private-notice", "channel-message" and "channel-notice". + * They are commented out (disabled) in this example: + */ + //private-message { + // except { connect-time 10; } + //} + //private-notice { + // except { connect-time 10; } + //} + } +} + +/* + * The following will configure connection throttling of "unknown users". + * + * When UnrealIRCd detects a high number of users connecting from IP addresses + * that have not been seen before, then connections from new IP's are rejected + * above the set rate. For example at 10:60 only 10 users per minute can connect + * that have not been seen before. Known IP addresses can always get in, + * regardless of the set rate. Same for users who login using SASL. + * + * See also https://www.unrealircd.org/docs/Connthrottle for details. + * Or just keep reading the default configuration settings below: + */ + +set { + connthrottle { + /* First we configure which users are exempt from the + * restrictions. These users are always allowed in! + * By default these are users on IP addresses that have + * a score of 24 or higher. A score of 24 means that the + * IP was connected to this network for at least 2 hours + * in the past month (or minimum 1 hour if registered). + * We also allow users who are identified to services via + * SASL to bypass the restrictions. + */ + except { + reputation-score 24; + identified yes; + /* for more options, see + * https://www.unrealircd.org/docs/Mask_item + */ + } + + /* New users are all users that do not belong in the + * known-users group. They are considered "new" and in + * case of a high number of such new users connecting + * they are subject to connection rate limiting. + * By default the rate is 20 new local users per minute + * and 30 new global users per minute. + */ + new-users { + local-throttle 20:60; + global-throttle 30:60; + } + + /* This configures when this module will NOT be active. + * The default settings will disable the module when: + * - The reputation module has been running for less than + * a week. If running less than 1 week then there is + * insufficient data to consider who is a "known user". + * - The server has just been booted up (first 3 minutes). + */ + disabled-when { + reputation-gathering 1w; + start-delay 3m; + } + } +} + +/* CHANNEL HISTORY: + * UnrealIRCd has channel mode +H which can be used by users to read back + * channel history, such as from before they joined. For general information + * on this feature, see https://www.unrealircd.org/docs/Channel_history + * + * The history limits can be configured via set::history. The defaults are + * probably already good for you, but if you are on a low-memory system + * or have thousands of channels then you may want to double check. See + * https://www.unrealircd.org/docs/Set_block#set::history for the options. + * + * In addition to that, you can have "persistent channel history", which + * means channel history is stored encrypted on disk so it is preserved + * between IRC server restarts, see + * https://www.unrealircd.org/docs/Set_block#Persistent_channel_history + * The persistent history feature is NOT enabled by default because you + * need to configure a secret { } block for it. The following is a simple + * example with passwords stored directly in the configuration file. + * To get better security, read https://www.unrealircd.org/docs/Secret_block + * on alternative ways so you don't store passwords directly in the config. + */ +//secret historydb { password "somepassword"; } +//set { history { channel { persist yes; db-secret "historydb"; } } } + +/* Finally, you may wish to have a MOTD (Message of the Day), this can be + * done by creating an 'ircd.motd' text file in your conf/ directory. + * This file will be shown to your users on connect. + * For more information see https://www.unrealircd.org/docs/MOTD_and_Rules + */ + +/* + * Problems or need more help? + * 1) https://www.unrealircd.org/docs/ + * 2) https://www.unrealircd.org/docs/FAQ <- answers 80% of your questions! + * 3) If you are still having problems then you can get support: + * - Forums: https://forums.unrealircd.org/ + * - IRC: irc.unrealircd.org (SSL on port 6697) / #unreal-support + * Note that we require you to read the documentation and FAQ first! + */