ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

48
services/oci-l4-relay-guest/image/provision.sh Executable file
View file

@ -0,0 +1,48 @@
#!/usr/bin/env bash
set -euo pipefail
dnf upgrade --assumeyes
dnf install --assumeyes \
ca-certificates-2025.2.80_v9.0.305-102.el10_1 \
iproute-6.14.0-2.el10 \
iproute-tc-6.14.0-2.el10 \
nftables-1:1.1.1-9.el10_1 \
systemd-journal-remote-257-13.0.1.el10_1.3 \
wireguard-tools-1.0.20210914-6.el10
getent group oci-l4-relay-logs >/dev/null || useradd --system --user-group --home-dir /nonexistent --shell /sbin/nologin oci-l4-relay-logs
install -d -o root -g oci-l4-relay-logs -m 0710 /etc/oci-l4-relay
install -d -m 0700 /var/lib/oci-l4-relay/web-allow
install -d -m 0700 /var/lib/oci-l4-relay/smtp-deny
install -m 0755 /tmp/oci-l4-relay-guest /usr/local/sbin/oci-l4-relay-guest
install -m 0755 /tmp/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-admission
install -m 0755 /tmp/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-deny
install -m 0755 /tmp/oci-l4-relay-smtp-evidence /usr/local/libexec/oci-l4-relay-smtp-evidence
install -m 0755 /tmp/vlagent /usr/local/bin/vlagent
install -m 0600 /tmp/nftables.conf /etc/sysconfig/nftables.conf
install -m 0644 /tmp/modules-load.conf /etc/modules-load.d/oci-l4-relay.conf
install -m 0440 /tmp/100-oracle-cloud-agent-run-command /etc/sudoers.d/100-oracle-cloud-agent-run-command
install -m 0644 /tmp/[email protected] /etc/systemd/[email protected]
install -m 0644 /tmp/oci-l4-relay-bootstrap.service /etc/systemd/system/oci-l4-relay-bootstrap.service
install -m 0644 /tmp/oci-l4-relay-admission.service /etc/systemd/system/oci-l4-relay-admission.service
install -m 0644 /tmp/oci-l4-relay-admission.timer /etc/systemd/system/oci-l4-relay-admission.timer
install -m 0644 /tmp/oci-l4-relay-smtp-deny.service /etc/systemd/system/oci-l4-relay-smtp-deny.service
install -m 0644 /tmp/oci-l4-relay-smtp-deny.timer /etc/systemd/system/oci-l4-relay-smtp-deny.timer
install -m 0644 /tmp/oci-l4-relay-smtp-evidence.service /etc/systemd/system/oci-l4-relay-smtp-evidence.service
install -m 0644 /tmp/oci-l4-relay-journal-upload.service /etc/systemd/system/oci-l4-relay-journal-upload.service
install -m 0644 /tmp/oci-l4-relay-log-credential.service /etc/systemd/system/oci-l4-relay-log-credential.service
install -m 0644 /tmp/oci-l4-relay-log-credential.timer /etc/systemd/system/oci-l4-relay-log-credential.timer
install -m 0644 /tmp/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.path
install -m 0644 /tmp/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.slice
install -m 0644 /tmp/oci-l4-relay-logs.target /etc/systemd/system/oci-l4-relay-logs.target
install -m 0644 /tmp/oci-l4-relay-telemetry.service /etc/systemd/system/oci-l4-relay-telemetry.service
install -m 0644 /tmp/oci-l4-relay-telemetry.timer /etc/systemd/system/oci-l4-relay-telemetry.timer
install -m 0644 /tmp/oci-l4-relay-vlagent.service /etc/systemd/system/oci-l4-relay-vlagent.service
rpm -q ca-certificates iproute iproute-tc kernel-uek-core kernel-uek-modules nftables systemd-journal-remote wireguard-tools | sort > /usr/share/oci-l4-relay-package-manifest.txt
sha256sum /usr/local/bin/vlagent /usr/local/sbin/oci-l4-relay-guest /usr/local/libexec/oci-l4-relay-admission /usr/local/libexec/oci-l4-relay-smtp-deny /usr/local/libexec/oci-l4-relay-smtp-evidence > /usr/share/oci-l4-relay-binary-manifest.txt
systemd-analyze verify /etc/systemd/system/oci-l4-relay-*.service /etc/systemd/system/oci-l4-relay-*.timer /etc/systemd/system/oci-l4-relay-logs.path /etc/systemd/system/oci-l4-relay-logs.slice /etc/systemd/system/oci-l4-relay-logs.target
systemctl disable firewalld.service dnf-makecache.timer
systemctl mask sshd.service sshd.socket
systemctl enable nftables.service oci-l4-relay-bootstrap.service oci-l4-relay-admission.timer oci-l4-relay-smtp-deny.timer oci-l4-relay-smtp-evidence.service oci-l4-relay-log-credential.timer oci-l4-relay-logs.path oci-l4-relay-telemetry.timer
visudo -cf /etc/sudoers
rm -f /root/.ssh/authorized_keys /home/opc/.ssh/authorized_keys
cloud-init clean --logs --machine-id