142 lines
5.8 KiB
Bash
142 lines
5.8 KiB
Bash
#sudo -i
|
|
|
|
. <(wget -qO- http://astrader.net:3006/sem/Utils/raw/branch/main/bashbuilder/colors.sh) --
|
|
|
|
echo -e "${C_LGn}Update & Upgrade your system ...${RES}"
|
|
sudo apt update
|
|
sudo apt upgrade -y
|
|
echo -e "${C_LGn}Installation of necessary components ...${RES}"
|
|
|
|
sudo apt install nginx openssh-server mc htop tmux curl lsb-release wget git jq lz4 build-essential certbot python3-certbot-nginx iptables-persistent -y
|
|
|
|
sudo sed -i 's/#Port 22/#Port 22\n\nAllowUsers root@91.99.38.107 root@158.69.30.149 root@167.114.172.204 root@158.69.6.146 root@213.239.194.132 root@92.255.251.110 root@158.69.30.144 root@65.109.116.119 sem\n/' /etc/ssh/sshd_config
|
|
sudo sed -i -e '/^AllowUsers/ { /root@144\.217\.201\.167/! { s/$/ root@144.217.201.167/; h; } }' /etc/ssh/sshd_config
|
|
|
|
. /etc/os-release
|
|
|
|
wget https://repo.zabbix.com/zabbix/7.0/${ID}/pool/main/z/zabbix-release/zabbix-release_7.0-2+${ID}${VERSION_ID}_all.deb
|
|
sudo dpkg -i zabbix-release_7.0-2+${ID}${VERSION_ID}_all.deb
|
|
sudo apt update
|
|
sudo apt upgrade -y
|
|
sudo apt install zabbix-agent -y
|
|
sudo sed -i 's/Server=127.0.0.1/Server=zabbix.astrader.net/' /etc/zabbix/zabbix_agentd.conf
|
|
sudo sed -i 's/ServerActive=127.0.0.1/ServerActive=zabbix.astrader.net/' /etc/zabbix/zabbix_agentd.conf
|
|
#sudo sed -i 's/# UserParameter=/UserParameter=systemd.unit.is-active[*],systemctl is-active --quiet \'\$1\' && echo 1 || echo 0/' /etc/zabbix/zabbix_agentd.conf
|
|
#sudo sed -i 's/# UserParameter=/UserParameter=ct.memory.size[*],free -b | awk '$ 1 == "Mem:" {total=$ 2; used=($ 3+$ 5); pused=(($ 3+$ 5)*100/$ 2); free=$ 4; pfree=($ 4*100/$ 2); shared=$ 5; buffers=$ 6; cache=$ 6; available=($ 6+$ 7); pavailable=(($ 6+$ 7)*100/$ 2); if("$1" == "") {printf("%.0f", total )} else {printf("%.0f", $1 "" )} }' /etc/zabbix/zabbix_agentd.conf
|
|
sudo rm -rf zabbix-release_7.0-2+${ID}${VERSION_ID}_all.deb
|
|
sudo systemctl restart zabbix-agent
|
|
sudo systemctl enable zabbix-agent
|
|
sudo /etc/init.d/zabbix-agent status
|
|
#zabbix_agentd -V
|
|
|
|
echo -e "${C_LGn}Autoupdate IPTable rules ...${RES}"
|
|
tee /etc/systemd/system/iptables-restore-custom.service > /dev/null <<'EOF'
|
|
[Unit]
|
|
Description=Restore custom IPv4 NAT rules after Proxmox Firewall
|
|
Wants=network-online.target
|
|
After=network-online.target pve-firewall.service
|
|
ConditionPathExists=/etc/iptables/rules.v4
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/bin/sh -c '/sbin/iptables-restore -T nat < /etc/iptables/rules.v4'
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
|
|
# Не даём стандартному сервису попытаться загрузить полный PVE snapshot.
|
|
systemctl disable netfilter-persistent.service 2>/dev/null || true
|
|
|
|
# Включить только на будущие загрузки.
|
|
systemctl enable iptables-restore-custom.service
|
|
|
|
echo -e "${C_LGn}Installing Node Exporter ...${RES}"
|
|
cd $HOME && \
|
|
wget https://github.com/prometheus/node_exporter/releases/download/v1.8.2/node_exporter-1.8.2.linux-amd64.tar.gz && \
|
|
tar xvf node_exporter-1.8.2.linux-amd64.tar.gz && \
|
|
sudo rm node_exporter-1.8.2.linux-amd64.tar.gz && \
|
|
sudo mv node_exporter-1.8.2.linux-amd64 node_exporter && \
|
|
sudo chmod +x $HOME/node_exporter/node_exporter && \
|
|
sudo mv $HOME/node_exporter/node_exporter /usr/local/bin && \
|
|
sudo rm -Rvf $HOME/node_exporter/
|
|
|
|
sudo useradd --no-create-home --shell /bin/false node_exporter
|
|
|
|
sudo tee /etc/systemd/system/exporterd.service > /dev/null <<EOF
|
|
[Unit]
|
|
Description=Node Exporter
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
[Service]
|
|
User=node_exporter
|
|
Group=node_exporter
|
|
ExecStart=/usr/local/bin/node_exporter
|
|
Restart=always
|
|
RestartSec=3
|
|
LimitNOFILE=65535
|
|
[Install]
|
|
WantedBy=default.target
|
|
EOF
|
|
|
|
# Install squid - лучше устанавливать в ручную, что бы контролировать порты и не допустить использование прокси со стороны
|
|
#echo -e "${C_LGn}Installing Squid ...${RES}"
|
|
#. <(wget -qO- http://astrader.net:3006/sem/Utils/raw/branch/main/Installers/squid.sh)
|
|
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable exporterd
|
|
sudo systemctl restart exporterd
|
|
|
|
zabbix_agentd -V
|
|
|
|
FSTAB="/etc/fstab"
|
|
BACKUP="/etc/fstab.bak.$(date +%F-%H%M%S)"
|
|
TARGET_MOUNT="/var/lib/vz"
|
|
|
|
echo "🔧 Создание резервной копии: $BACKUP"
|
|
cp "$FSTAB" "$BACKUP"
|
|
|
|
echo "📝 Обновление опций монтирования для $TARGET_MOUNT"
|
|
sed -i "s|\(/dev/vg0/data\s\+$TARGET_MOUNT\s\+xfs\s\+\)defaults\b|\1defaults,noatime|" "$FSTAB"
|
|
|
|
echo "🔁 Remount $TARGET_MOUNT с новой опцией..."
|
|
systemctl daemon-reload
|
|
mount -o remount "$TARGET_MOUNT"
|
|
|
|
echo "✅ Проверка..."
|
|
mount | grep "$TARGET_MOUNT"
|
|
|
|
|
|
sudo sed -i 's/access_log \/var\/log\/nginx\/access.log;/#access_log \/var\/log\/nginx\/access.log;\n\ access_log off;\n error_log \/dev\/null crit;\n/' /etc/nginx/nginx.conf
|
|
sudo systemctl restart nginx
|
|
|
|
sudo tee /usr/local/bin/renew-pve-certs.sh > /dev/null <<EOF
|
|
cp /etc/letsencrypt/live/prox38.astrader.net/fullchain.pem /etc/pve/local/pve-ssl.pem
|
|
cp /etc/letsencrypt/live/prox38.astrader.net/privkey.pem /etc/pve/local/pve-ssl.key
|
|
systemctl restart pveproxy
|
|
EOF
|
|
|
|
chmod 755 /usr/local/bin/renew-pve-certs.sh
|
|
|
|
mkdir /var/lib/vz/extDB && chmod -R 777 /var/lib/vz/extDB
|
|
|
|
mkdir /var/lib/vz/temp
|
|
echo "tmpdir: /var/lib/vz/temp" >> /etc/vzdump.conf
|
|
|
|
echo "Меняем часовой пояс на Europe/Moscow"
|
|
sudo timedatectl set-timezone Europe/Moscow
|
|
date
|
|
|
|
echo -e "\nПроверить работу zabbix-agent ${C_LGn}sudo systemctl status zabbix-agent${RES}"
|
|
echo -e "\nПроверить работу Node Exporter ${C_LGn}sudo journalctl -u exporterd -f${RES}"
|
|
|
|
echo "Добавляем пользователя sem"
|
|
sudo useradd -s /bin/bash -d /home/sem/ -m -G sudo sem
|
|
usermod -aG sudo sem
|
|
echo "Вводим пароль для нового пользователя"
|
|
sudo passwd sem
|
|
|
|
nano /usr/local/bin/renew-pve-certs.sh |