holodeck-damogran.pkg.toml

[package]
name        = "holodeck-damogran"
version     = "20220703.3"
description = "holodeck: services on Damogran"

requires = [
    "secrets", # this uses /usr/bin/replicator
    "hologram-base-accessible",
    "hologram-uefi-bootloader",
    "hologram-monitoring-client",
    "hologram-borgbackup-receiver",
    # network setup (local DHCP, local DNS, wireless AP, NAT from internal networks to external internet)
    "dnsmasq",
    "iptables",
]

################################################################################
# identity

[[file]]
path    = "/etc/hostname"
content = "damogran"

[[file]]
path    = "/etc/profile.d/prettyprompt.sh"
content = """
export PRETTYPROMPT_COMMONUSER=stefan
export PRETTYPROMPT_HOSTCOLOR='0;35'
"""

################################################################################
# mask mdmonitor.service (this shows up in `systemctl --failed` otherwise)

[[symlink]]
path   = "/etc/systemd/system/mdmonitor.service"
target = "/dev/null"

################################################################################
# network setup: systemd-{networkd,resolved} to configure interfaces and upstream DNS

[[symlink]]
path   = "/etc/systemd/system/multi-user.target.wants/systemd-resolved.service"
target = "/usr/lib/systemd/system/systemd-resolved.service"

[[file]]
path    = "/etc/systemd/network/lan.network"
content = """
    [Match]
    Name={{.Vars.interfaces.lan}}

    [Network]
    Description=Internal LAN
    Address=10.0.0.1/24
    IPForward=ipv4

    [Address]
    # blackhole IP (traffic to this subnet is rejected)
    Address=10.0.13.13/32
"""
[[symlink]]
path   = "/usr/share/holo/files/50-damogran-vars/etc/systemd/network/lan.network.holoscript"
target = "/usr/bin/replicator"

[[file]]
path    = "/etc/systemd/network/wan.network"
content = """
    [Match]
    Name={{.Vars.interfaces.wan}}

    [Network]
    Description=External Network (Internet)
    DHCP=ipv4
"""
[[symlink]]
path   = "/usr/share/holo/files/50-damogran-vars/etc/systemd/network/wan.network.holoscript"
target = "/usr/bin/replicator"

################################################################################
# network setup: an iptables ruleset acts as firewall

[[symlink]]
path   = "/etc/systemd/system/multi-user.target.wants/iptables.service"
target = "/usr/lib/systemd/system/iptables.service"

[[file]]
path = "/etc/sysctl.d/90-firewall.conf"
content = """
    # filter spoofing of local source addresses from internet locations
    net.ipv4.conf.all.rp_filter = 1
    # enable IPv4 forwarding (NAT)
    net.ipv4.ip_forward = 1
    net.ipv4.conf.all.forwarding = 1
    net.ipv4.conf.default.forwarding = 1
    net.ipv4.conf.{{.Vars.interfaces.lan}}.forwarding = 1
    net.ipv4.conf.{{.Vars.interfaces.wan}}.forwarding = 1

    # disable IPv6 for internet-facing interfaces
    net.ipv6.conf.{{.Vars.interfaces.wan}}.disable_ipv6 = 1
"""
[[symlink]]
path   = "/usr/share/holo/files/50-damogran-vars/etc/sysctl.d/90-firewall.conf.holoscript"
target = "/usr/bin/replicator"

[[file]]
path = "/usr/share/holo/files/50-damogran/etc/iptables/iptables.rules"
content = """
    *filter

    # standard chains
    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT ACCEPT [0:0]
    # chains for accepting incoming connections
    :TCP - [0:0]
    :UDP - [0:0]



    # accept traffic on established connections
    -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    # accept all local traffic
    -A INPUT -i lo -j ACCEPT
    # drop all invalid traffic (esp. to avoid attacks from the internet)
    -A INPUT -m conntrack --ctstate INVALID -j DROP
    # accept pings from everywhere
    -A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
    # block traffic to blackhole IP
    -A INPUT --dest 10.0.13.13 -j REJECT --reject-with icmp-port-unreachable
    # attach chains for checking incoming connections
    -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
    -A INPUT -p tcp -m tcp --syn -m conntrack --ctstate NEW -j TCP
    # reject unwanted connections
    -A INPUT -p tcp -j REJECT --reject-with tcp-reset
    -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -j REJECT --reject-with icmp-proto-unreachable

    # allow SSH via intranet and Wireguard
    -A TCP -i wg-monitoring -p tcp -m tcp --dport 22 -j ACCEPT
    -A TCP -i {{.Vars.interfaces.lan}} -p tcp -m tcp --dport 22 -j ACCEPT
    # allow Prometheus scraping via Wireguard
    -A TCP -i wg-monitoring -p tcp -m tcp --dport 9100 -j ACCEPT

    # allow intranet DNS
    -A UDP -i {{.Vars.interfaces.lan}} -p udp -m udp --dport 53 -j ACCEPT
    # allow intranet DHCP
    -A UDP -i {{.Vars.interfaces.lan}} -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
    # allow public Wireguard
    -A UDP -p udp -m udp --dport {{.Vars.wg.port}} -j ACCEPT

    # accept traffic on established connections
    -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    # accept forwarding connections from intranet to public
    -A FORWARD -i {{.Vars.interfaces.lan}} -j ACCEPT
    # reject unwanted connections
    -A FORWARD -j REJECT --reject-with icmp-host-unreachable

    COMMIT
    *nat

    # standard chains for NAT
    :PREROUTING ACCEPT [0:0]
    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    :POSTROUTING ACCEPT [0:0]

    # establish forwarding connections from intranet (IP range) to public ({{.Vars.interfaces.wan}})
    -A POSTROUTING -s 10.0.0.0/24 -o {{.Vars.interfaces.wan}} -j MASQUERADE

    COMMIT
"""
[[symlink]]
path   = "/usr/share/holo/files/50-damogran-vars/etc/iptables/iptables.rules.holoscript"
target = "/usr/bin/replicator"

################################################################################
# network setup: dnsmasq to provide DHCP and DNS in the internal networks

[[symlink]]
path   = "/etc/systemd/system/multi-user.target.wants/dnsmasq.service"
target = "/usr/lib/systemd/system/dnsmasq.service"

[[file]]
path    = "/etc/systemd/system/dnsmasq.service.d/reorder.conf"
content = """
    [Unit]
    After=systemd-resolved.service
    Requires=systemd-resolved.service
"""

[[file]]
path    = "/usr/share/holo/files/50-damogran/etc/dnsmasq.conf"
content = """
    # bind DHCP and DNS servers to all interfaces except external internet
    bind-interfaces
    except-interface={{.Vars.interfaces.wan}}

    # allocate IPv4 ranges for DHCP
    dhcp-range=10.0.0.100,10.0.0.199,12h
    # assign static IPs to well-known hosts
    {{ range $host, $cfg := .Vars.hosts }}{{ if $cfg.mac }}
    dhcp-host={{$cfg.mac}},{{$cfg.ip}}
    {{ end }}{{ end }}
    # speed up DHCP by allowing dnsmasq to reject unknown leases
    dhcp-authoritative

    # upstream DNS
    server={{.Vars.dns.upstream}}
    # local DNS overrides
    address=/damogran.local/10.0.0.1
    {{- range $host, $cfg := .Vars.hosts }}
    address=/{{$host}}/{{$cfg.ip}}
    {{- end }}

    dnssec
    trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5

    # adblock
    addn-hosts=/var/cache/adblock/hosts.txt
"""
[[symlink]]
path   = "/usr/share/holo/files/50-damogran-vars/etc/dnsmasq.conf.holoscript"
target = "/usr/bin/replicator"

# break cyclic dependency between dnsmasq and adblock-sync with an initial
# empty host list (dnsmasq needs the host list generated by adblock-sync, which
# can only download the public host lists when dnsmasq is running)
[[action]]
on     = "setup"
script = """
    if [ ! -f /var/cache/adblock/hosts.txt ]; then
        touch /var/cache/adblock/hosts.txt
        chown dnsmasq:dnsmasq /var/cache/adblock/hosts.txt
    fi
"""

################################################################################
# network setup: DNS-level adblocking using dnsmasq

[[file]]
path    = "/usr/lib/adblock-sync.sh"
mode    = "0755"
content = '''
    #!/bin/bash
    cd /var/cache/adblock/

    # source: https://github.com/pi-hole/pi-hole/blob/963eacfe0537a7abddf30441c754c67ca1e40965/gravity.sh
    sources=(
        'https://adaway.org/hosts.txt'
        'http://adblock.gjtech.net/?format=unix-hosts'
        # 'http://adblock.mahakala.is/'
        'http://hosts-file.net/.%5Cad_servers.txt'
        'http://www.malwaredomainlist.com/hostslist/hosts.txt'
        'http://pgl.yoyo.org/adservers/serverlist.php?'
        'http://someonewhocares.org/hosts/hosts'
        'http://winhelp2002.mvps.org/hosts.txt'
    )

    # query all sources
    i=0
    for s in ${sources[@]}; do
        i=$((i+1))
        wget -O hosts-$i.txt.new "$s" && mv hosts-$i.txt.new hosts-$i.txt
    done

    # select hostnames from hosts files (sed removes the IP, removes comments and trailing whitespace)
    for file in hosts-?.txt; do
        grep -E '^(127\.0\.0\.1|0\.0\.0\.0)\s' $file | sed 's/^\S*\s\+//;s/#.*//;s/\s\+$//'
    # now generate a single addn-hosts file (sed adds the target, a blackhole IP configured on this host)
    done | sort -u | grep -Ev '^local(host(.localdomain)?)?$' | sed 's/^/10.0.13.13 /' > hosts.txt
'''

[[directory]]
path  = "/var/cache/adblock"
owner = "dnsmasq"
group = "dnsmasq"

[[file]]
path    = "/usr/lib/systemd/system/adblock-sync.service"
content = """
    [Unit]
    Description=Generate domain-level adblock list
    After=network-online.target

    [Service]
    Type=oneshot
    ExecStart=/usr/lib/adblock-sync.sh
    ExecStartPost=/usr/bin/systemctl reload dnsmasq.service
    User=dnsmasq
    PermissionsStartOnly=true
"""

[[file]]
path    = "/usr/lib/systemd/system/adblock-sync.timer"
content = """
    [Unit]
    Description=Renew domain-level adblock list weekly
    After=network-online.target dnsmasq.service
    Wants=network-online.target dnsmasq.service

    [Timer]
    OnBootSec=10s
    OnUnitActiveSec=1w

    [Install]
    WantedBy=timers.target
"""

[[symlink]]
path   = "/etc/systemd/system/timers.target.wants/adblock-sync.timer"
target = "/usr/lib/systemd/system/adblock-sync.timer"