Tomster/Fedora-CoreOS-Ignition
1
0
Fork 0
mirror of https://github.com/tommytran732/Fedora-CoreOS-Ignition synced 2024-11-23 01:31:32 -05:00
Code

Compare commits

base: Tomster:2155a601e16febe5d2c2691145479d149a48a200
Branches Tags
Tomster:main
..
compare: Tomster:89b9395dfe7c8f48eb4980bd373c67594f0e526a
Branches Tags
Tomster:main

No commits in common. "2155a601e16febe5d2c2691145479d149a48a200" and "89b9395dfe7c8f48eb4980bd373c67594f0e526a" have entirely different histories.
2155a601e1 ... 89b9395dfe

18 changed files with 400 additions and 338 deletions
Show Stats Expand all files Collapse all files

1
.gitignore vendored
View File

@ -1 +1,2 @@
.DS_Store

8
Fedora-CoreOS-Ignition.code-workspace Normal file
View File

@ -0,0 +1,8 @@
{
"folders": [
{
"path": "."
}
],
"settings": {}
}

82
Generic.ign
View File

@ -54,25 +54,22 @@
{
"path": "/etc/zincati/config.d/51-rollout-wariness.toml",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/zincati/config.d/51-rollout-wariness.toml"
"compression": "",
"source": "data:,%5Bidentity%5D%0Arollout_wariness%20%3D%200%0A"
}
},
{
"path": "/etc/zincati/config.d/55-updates-strategy.toml",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/zincati/config.d/55-updates-strategy.toml"
"compression": "gzip",
"source": "data:;base64,H4sIAAAAAAAC/2SNMarEMAxEe51C6ADB1S8+5BRbGmNMLLIGRw62TMieflGRats3b2b8PHNSHgGG9qS837gindxLy2UjePLlQQG0HBw/TdjM2rZUjRD4H3e5iuR2hQA53QNX9EivKYT2lrpGK9qK+3eOoLLs+o5Hkals+p+DbwAAAP//4Po2vKAAAAA="
}
},
{
"path": "/etc/yum.repos.d/docker-ce.repo",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/yum.repos.d/docker-ce.repo"
}
},
{
"path": "/etc/docker/daemon.json",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/docker/daemon.json"
"compression": "gzip",
"source": "data:;base64,H4sIAAAAAAAC/7zSsU+EMBTH8b1/BcOtvepqwuS5upybcSjt7wqh15K2qPffGyjKQCAm8pxoHqQvn/B91V61CFyBxyQrizfm5BXlaRwXj0/FeRwXvDhUMkIGVbPh0Adb1il18UEI7T+c9VIf82VH5a/CNq7/FBdoH6Q4BFjIiHcE8XONyAsZ3PDQ5T0znVE1VJuPLW6/32A6w9gCwzWq3jTu4tdZp+9P9gKOO/kq846AGX0f1MavO4/v499ceQkpJyGmheIFMVHkNyyjY2ykN4HIwyMGrkQ36fZMjg7iGlMne1sgnvOcIrtpJalnI75ZRt7fv0hXKpyZe4a4u+grAAD//29EVAF/BwAA"
}
},
{
@ -118,65 +115,80 @@
"source": "https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf"
}
},
{
"path": "/etc/ssh/sshd_config.d/10-custom.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf"
}
},
{
"path": "/etc/ssh/ssh_config.d/10-custom.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf"
}
},
{
"path": "/etc/systemd/system/sshd.service.d/local.conf",
"contents": {
"source": "https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf"
}
},
{
"path": "/etc/ssh/sshd_config/10-custom.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf"
}
},
{
"path": "/etc/tuned/active_profile",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/active_profile"
"compression": "",
"source": "data:,virtual-guest%0A"
}
},
{
"path": "/etc/tuned/profile_mode",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/profile_mode"
"compression": "",
"source": "data:,manual%0A"
}
},
{
"path": "/etc/systemd/zram-generator.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/zram-generator.conf"
"compression": "",
"source": "data:,%5Bzram0%5D%0Azram-fraction%20%3D%201%0Amax-zram-size%20%3D%208192%0Acompression-algorithm%20%3D%20zstd%0A"
}
},
{
"path": "/etc/security/limits.d/30-disable-coredump.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/security/limits.d/30-disable-coredump.conf"
"compression": "",
"source": "data:,*%20hard%20core%200%0A"
}
},
{
"path": "/etc/ssh/ssh_config.d/10-custom.conf",
"contents": {
"compression": "",
"source": "data:,GSSAPIAuthentication%20no%0AVerifyHostKeyDNS%20yes%0A"
}
},
{
"overwrite": true,
"path": "/etc/sysconfig/chronyd",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd"
"compression": "",
"source": "data:,%23%20Command-line%20options%20for%20chronyd%0AOPTIONS%3D%22-F%201%22%0A"
}
},
{
"path": "/etc/unbound/unbound.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/unbound/unbound.conf"
"compression": "gzip",
"source": "data:;base64,H4sIAAAAAAAC/6xSQWvcPBC9768Q/s5jezfZ5MNQ6CWFQktL00uPE2lsD5ElZzTa1Pn1RbtdlyyFQqkNxp4373ne0ySSA0m3McaOEqN2pqo2G2MwawSVnBQw2DEK9OypM1VzQGk8PzQ5PMQcXFNY9SMt1caYV4TEQ0DPYejMQmljTOmER1ogUVAO5E9A4fkElkThIQdXftOQ2iYl35RqaiweYe7ZolKqreiZxfNIkjpTff7y6d37D3dv7r/df737eDQxsiMYVWfIiQRwoKDnYY4YuzKJLq+KRxMnD6/qB5LEMaxDOwoLYPhFRnEUAP0QwcXnMAg6ugA9ykDwlEmY0gUm1JMIephRxwssjfGYTp/4ZdXkIUQhsA56j2vKE36H7GY4dV61t7tSjC57AhtDz0NnqgN6dqhRDCtJeSnH9xRwIpg48MQJlWOApMJ2DS2HZwxKDoRmv4COQmmM3nVm256u0pQILM4J+ijAbs0rZh0ihwHm4mUmmVgLcXcNN/v91b70zCUEtav983dZm59CfZRnFAcvMVDZ2zJzZ6q6GDhjZTPynFQIp7PUGUPnpDPbuty7t//vr/5LZLOwLrX1MbveoxC4kGobp9/w2rr9C97upr3prm/b9vTottvtPxBp2z+L/AgAAP//qRxiA+IDAAA="
}
},
{
"path": "/etc/systemd/system/unbound.service.d/override.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf"
"compression": "gzip",
"source": "data:;base64,H4sIAAAAAAAC/2yRQWvcPBCG7/srBN8hp+T43Qxekt12ycYsiUsLpRRZfrMZLGvMzMjEl/72oqUbauhJo2dmmNGj7y+QmQJ+bJ4wsiwPSMtXIcPuHSEbKpOMzUlo9oYHlFJdsXacrnc2BPvMI1bgPnIY1oSTCcdPwnnSVeYRkhCPfP4XfuI+x+v0/1z7Ruo6gR/UZaV0dsphgDmejDipizTA3SjfSpi7/Hpz53bvU6RAFhfXk/ouwr2yuJmUOopky916YptTKVovcxIOFaVLU8TmGWpCwbZ9L1Dd+5EiQavt/ueh2bXuz/l/CZpdezw0jyX80hy+ffQ+w0ejq7eXRQ3jvY9xK+GNysws0Cp5o/nv9J6iQapfdSiKXR2mfIsxR1/e7+oeXT67esAixU49Xvy5kXMyV3OnHGFwtUA5S4B+7NP4ETr58tULdHPkMJwgyskXSRf2OwAA///OGG3DOAIAAA=="
}
},
{
"path": "/etc/docker/daemon.json",
"contents": {
"compression": "gzip",
"source": "data:;base64,H4sIAAAAAAAC/9RSS2rDMBDd+xRCaw/aB7zoOUoXiq04wfqhGbmUkrsXyU6oiigNNWmzMVjz5ul99N4wxhgf1EFGTRCipZNRfMd4iBZ7wDekID1vF9w6R75jy+blFHuYZlMc55GXdExsImIQ2vVSi/3Jiryxkn6mSeRPYUz8z8UwAwC8lnRwwXTpsraGsIpeXZi6o0PiBeDl+nduv2q/2Lyb/jLXTTxMs2EAaQfigJ3zyv63PqqIUvGtlf2d5Z9XuKXtaTYwqH0cH6LbrBS0GztBxourBfENvD5KWffq5udx76x++Siqea2cm2fWLN9z8xEAAP//Je94AgUGAAA="
}
}
],
@ -206,7 +218,7 @@
"systemd": {
"units": [
{
"contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
"contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
"enabled": true,
"name": "postinst.service"
},
@ -221,20 +233,10 @@
"name": "setsebool.service"
},
{
"contents": "[Unit]\nDescription=gVisor Download\nRequires=network-online.target\nBefore=docker.service\n\n[Service]\nUser=unpriv\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\n\n[Install]\nWantedBy=multi-user.target\n",
"enabled": true,
"name": "gvisor-downloader.service"
},
{
"contents": "[Unit]\nDescription=Copy gVisor to the correct location\nAfter=gvisor-downloader.service\n\n[Service]\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\n[Install]\nWantedBy=multi-user.target\n",
"contents": "[Unit]\nDescription=gVisor Update\nRequires=network-online.target\nBefore=docker.service\n\n[Service]\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\n[Install]\nWantedBy=multi-user.target\n",
"enabled": true,
"name": "gvisor-updater.service"
},
{
"contents": "[Unit]\nDescription=Update containers with Docker-Compose\nRequires=network-online.target\nRequires=docker.service\n\n[Service]\nWorkingDirectory=/path/to/directory\nType=oneshot\n#ExecStart=/usr/bin/git pull\nExecStart=/usr/bin/docker compose pull\nExecStart=/usr/bin/docker compose up -d\n\n[Install]\nWantedBy=multi-user.target\n",
"enabled": false,
"name": "docker-compose-updater.service"
},
{
"enabled": true,
"name": "docker.service"

284
Generic.yml
View File

@ -1,4 +1,4 @@
# Copyright (C) 2021-2024 Thien Tran
# Copyright (C) 2023 Thien Tran
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of
@ -43,7 +43,7 @@ systemd:
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac
ExecStart=/usr/bin/rpm-ostree install docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound
ExecStart=/usr/bin/rpm-ostree install docker-ce firewalld qemu-guest-agent tuned unbound
ExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth
ExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf
ExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf
@ -83,38 +83,24 @@ systemd:
ExecStart=/usr/sbin/setsebool virt_use_nfs off
ExecStart=/usr/sbin/setsebool virt_use_samba off
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
- name: gvisor-downloader.service
enabled: true
contents: |
[Unit]
Description=gVisor Download
Requires=network-online.target
Before=docker.service
[Service]
User=unpriv
WorkingDirectory=/var/home/unpriv
Type=oneshot
ExecStart=/usr/bin/sleep 5
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512
[Install]
WantedBy=multi-user.target
- name: gvisor-updater.service
enabled: true
contents: |
[Unit]
Description=Copy gVisor to the correct location
After=gvisor-downloader.service
Description=gVisor Update
Requires=network-online.target
Before=docker.service
[Service]
WorkingDirectory=/var/home/unpriv
Type=oneshot
ExecStart=/usr/bin/sleep 5
ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc
ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512
ExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
ExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512
ExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1
@ -122,23 +108,6 @@ systemd:
ExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin
ExecStart=/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc
[Install]
WantedBy=multi-user.target
- name: docker-compose-updater.service
enabled: false
contents: |
[Unit]
Description=Update containers with Docker-Compose
Requires=network-online.target
Requires=docker.service
[Service]
WorkingDirectory=/path/to/directory
Type=oneshot
#ExecStart=/usr/bin/git pull
ExecStart=/usr/bin/docker compose pull
ExecStart=/usr/bin/docker compose up -d
[Install]
WantedBy=multi-user.target
- name: docker.service
@ -158,16 +127,85 @@ storage:
files:
- path: /etc/zincati/config.d/51-rollout-wariness.toml
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/zincati/config.d/51-rollout-wariness.toml
inline: |
[identity]
rollout_wariness = 0
- path: /etc/zincati/config.d/55-updates-strategy.toml
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/zincati/config.d/55-updates-strategy.toml
inline: |
[updates]
strategy = "periodic"
[updates.periodic]
time_zone = "localtime"
[[updates.periodic.window]]
days = [ "Sun" ]
start_time = "0:00"
length_minutes = 60
- path: /etc/yum.repos.d/docker-ce.repo
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/yum.repos.d/docker-ce.repo
- path: /etc/docker/daemon.json
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/docker/daemon.json
inline: |
[docker-ce-stable]
name=Docker CE Stable - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-stable-debuginfo]
name=Docker CE Stable - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-stable-source]
name=Docker CE Stable - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test]
name=Docker CE Test - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test-debuginfo]
name=Docker CE Test - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test-source]
name=Docker CE Test - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly]
name=Docker CE Nightly - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly-debuginfo]
name=Docker CE Nightly - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly-source]
name=Docker CE Nightly - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
- path: /etc/chrony.conf
contents:
source: https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf
@ -190,37 +228,163 @@ storage:
- path: /etc/systemd/system/irqbalance.service.d/99-brace.conf
contents:
source: https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf
- path: /etc/ssh/sshd_config.d/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf
- path: /etc/ssh/ssh_config.d/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf
- path: /etc/systemd/system/sshd.service.d/local.conf
contents:
source: https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf
- path: /etc/ssh/sshd_config/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf
- path: /etc/tuned/active_profile
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/active_profile
inline: |
virtual-guest
- path: /etc/tuned/profile_mode
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/profile_mode
inline: |
manual
- path: /etc/systemd/zram-generator.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/zram-generator.conf
inline: |
[zram0]
zram-fraction = 1
max-zram-size = 8192
compression-algorithm = zstd
- path: /etc/security/limits.d/30-disable-coredump.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/security/limits.d/30-disable-coredump.conf
inline: |
* hard core 0
- path: /etc/ssh/ssh_config.d/10-custom.conf
contents:
inline: |
GSSAPIAuthentication no
VerifyHostKeyDNS yes
- path: /etc/sysconfig/chronyd
overwrite: true
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd
inline: |
# Command-line options for chronyd
OPTIONS="-F 1"
- path: /etc/unbound/unbound.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/unbound/unbound.conf
inline: |
server:
chroot: ""
auto-trust-anchor-file: "/var/lib/unbound/root.key"
trust-anchor-signaling: yes
root-key-sentinel: yes
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
tls-ciphers: "PROFILE=SYSTEM"
hide-http-user-agent: yes
hide-identity: yes
hide-trustanchor: yes
hide-version: yes
deny-any: yes
harden-algo-downgrade: yes
harden-large-queries: yes
harden-referral-path: yes
harden-short-bufsize: yes
ignore-cd-flag: yes
max-udp-size: 3072
module-config: "validator iterator"
qname-minimisation-strict: yes
unwanted-reply-threshold: 10000000
use-caps-for-id: yes
outgoing-port-permit: 1024-65535
prefetch: yes
prefetch-key: yes
forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 1.1.1.2@853#security.cloudflare-dns.com
forward-addr: 1.0.0.2@853#security.cloudflare-dns.com
forward-addr: 2606:4700:4700::1112@853#security.cloudflare-dns.com
forward-addr: 2606:4700:4700::1002@853#security.cloudflare-dns.com
- path: /etc/systemd/system/unbound.service.d/override.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf
inline: |
[Service]
MemoryDenyWriteExecute=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
# This breaks using socket options like 'so-rcvbuf'. Explicitly disable for visibility.
ProtectKernelTunables=true
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
RestrictNamespaces=yes
LockPersonality=yes
- path: /etc/docker/daemon.json
contents:
inline: |
{
"default-runtime": "runsc-systrap",
"runtimes": {
"runsc-kvm": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=kvm",
"--network=host"
]
},
"runsc-systrap": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=systrap",
"--network=host"
]
},
"runsc-kvm --host-uds=open": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=kvm",
"--network=host",
"--host-uds=open"
]
},
"runsc-systrap --host-uds=open": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=systrap",
"--network=host",
"--host-uds=open"
]
},
"runsc-kvm-debug": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=kvm",
"--network=host",
"--debug-log=/tmp/runsc-kvm/",
"--debug",
"--strace"
]
},
"runsc-systrap-debug": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=systrap",
"--network=host",
"--debug-log=/tmp/runsc-systrap/",
"--debug",
"--strace"
]
}
}
}
links:
- path: /etc/localtime
target: ../usr/share/zoneinfo/America/Phoenix

6
README.md
View File

@ -3,8 +3,8 @@ Ignition configurations for Fedora CoreOS<br />
# Notes
1. These are the configs I personally use on my systems. You **MUST** edit the files before you use them. At the very least, you should add your SSH keys or password hash.<br />
2. Only ED25519 SSH keys are accepted with the SSHD hardening configuration. If you do not use ED25519 keys, you will need to adjust the `/etc/ssh/sshd_config.d/10-custom.conf` file accordingly.
2. Only ED25519 SSH keys are accepted with the SSHD hardening configuration. If you do not use ED25519 keys, you will need to edit the `ExecStart=/usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf -o /etc/ssh/sshd_config.d/10-custom.conf` accordingly.
3. If you create a passwordless user that requires administrative privileges, ensure that it is part of the `sudo` group (CoreOS allows this group to use sudo without a password) as the configs will disable empty password system authentication.
4. These configurations are made with a VPS in mind. You should adapt it for a bare metal deployment if that is what you are using (adding additional kernel parameters, configuring drive encryption, configuring storage, etc). You should also change the tuned profile from `virtual-guest` appropriately.
5. In most of these configs, the timezone is set to `America/Phoenix` and the automatic reboot time is set at 12 AM on Sunday. You need to be mindful of timezones with Daylight Savings per [Zincati documentation](https://coreos.github.io/zincati/usage/updates-strategy/).
6. The docker-compose-updater.service in `/etc/systemd/system` can be enabled to have automatic updates for your containers created by Docker Compose. Please make sure that the `WorkingDirectory` is appropriate.
5. In most of these configs, the timezone is set to `America/New_York` and the automatic reboot time is set at 12 AM on Sunday. Watchtower will kick in 5-10 minutes after the reboot to update and redeploy the containers. You should change it according to your needs. The Docker-Compose.yml file does not include Watchtower.
6. The auto-updater.service could be put in `/etc/systemd/system` and enable to have automatic updates for your docker-compose and its containers. Please make sure that the `WorkingDir` is appropriate.

56
UTM-Chrony.ign
View File

@ -43,6 +43,9 @@
"sshAuthorizedKeys": [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINkTKkJS7Id1WCyA5Klu/moLG9mP5hTC+v2qYqypMF1u contact@tommytran.io"
]
},
{
"name": "unpriv"
}
]
},
@ -51,7 +54,8 @@
{
"path": "/etc/zincati/config.d/51-rollout-wariness.toml",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/zincati/config.d/51-rollout-wariness.toml"
"compression": "",
"source": "data:,%5Bidentity%5D%0Arollout_wariness%20%3D%200%0A"
}
},
{
@ -104,65 +108,73 @@
"source": "https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf"
}
},
{
"path": "/etc/ssh/sshd_config.d/10-custom.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf"
}
},
{
"path": "/etc/ssh/ssh_config.d/10-custom.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf"
}
},
{
"path": "/etc/systemd/system/sshd.service.d/local.conf",
"contents": {
"source": "https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf"
}
},
{
"path": "/etc/ssh/sshd_config/10-custom.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf"
}
},
{
"path": "/etc/tuned/active_profile",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/active_profile"
"compression": "",
"source": "data:,virtual-guest%0A"
}
},
{
"path": "/etc/tuned/profile_mode",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/profile_mode"
"compression": "",
"source": "data:,manual%0A"
}
},
{
"path": "/etc/systemd/zram-generator.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/zram-generator.conf"
"compression": "",
"source": "data:,%5Bzram0%5D%0Azram-fraction%20%3D%201%0Amax-zram-size%20%3D%208192%0Acompression-algorithm%20%3D%20zstd%0A"
}
},
{
"path": "/etc/security/limits.d/30-disable-coredump.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/security/limits.d/30-disable-coredump.conf"
"compression": "",
"source": "data:,*%20hard%20core%200%0A"
}
},
{
"path": "/etc/ssh/ssh_config.d/10-custom.conf",
"contents": {
"compression": "",
"source": "data:,GSSAPIAuthentication%20no%0AVerifyHostKeyDNS%20yes%0A"
}
},
{
"overwrite": true,
"path": "/etc/sysconfig/chronyd",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd"
"compression": "",
"source": "data:,%23%20Command-line%20options%20for%20chronyd%0AOPTIONS%3D%22-F%201%22%0A"
}
},
{
"path": "/etc/unbound/unbound.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/unbound/unbound.conf"
"compression": "gzip",
"source": "data:;base64,H4sIAAAAAAAC/6xSQWvcPBC9768Q/s5jezfZ5MNQ6CWFQktL00uPE2lsD5ElZzTa1Pn1RbtdlyyFQqkNxp4373ne0ySSA0m3McaOEqN2pqo2G2MwawSVnBQw2DEK9OypM1VzQGk8PzQ5PMQcXFNY9SMt1caYV4TEQ0DPYejMQmljTOmER1ogUVAO5E9A4fkElkThIQdXftOQ2iYl35RqaiweYe7ZolKqreiZxfNIkjpTff7y6d37D3dv7r/df737eDQxsiMYVWfIiQRwoKDnYY4YuzKJLq+KRxMnD6/qB5LEMaxDOwoLYPhFRnEUAP0QwcXnMAg6ugA9ykDwlEmY0gUm1JMIephRxwssjfGYTp/4ZdXkIUQhsA56j2vKE36H7GY4dV61t7tSjC57AhtDz0NnqgN6dqhRDCtJeSnH9xRwIpg48MQJlWOApMJ2DS2HZwxKDoRmv4COQmmM3nVm256u0pQILM4J+ijAbs0rZh0ihwHm4mUmmVgLcXcNN/v91b70zCUEtav983dZm59CfZRnFAcvMVDZ2zJzZ6q6GDhjZTPynFQIp7PUGUPnpDPbuty7t//vr/5LZLOwLrX1MbveoxC4kGobp9/w2rr9C97upr3prm/b9vTottvtPxBp2z+L/AgAAP//qRxiA+IDAAA="
}
},
{
"path": "/etc/systemd/system/unbound.service.d/override.conf",
"contents": {
"source": "https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf"
"compression": "gzip",
"source": "data:;base64,H4sIAAAAAAAC/2yRQWvcPBCG7/srBN8hp+T43Qxekt12ycYsiUsLpRRZfrMZLGvMzMjEl/72oqUbauhJo2dmmNGj7y+QmQJ+bJ4wsiwPSMtXIcPuHSEbKpOMzUlo9oYHlFJdsXacrnc2BPvMI1bgPnIY1oSTCcdPwnnSVeYRkhCPfP4XfuI+x+v0/1z7Ruo6gR/UZaV0dsphgDmejDipizTA3SjfSpi7/Hpz53bvU6RAFhfXk/ouwr2yuJmUOopky916YptTKVovcxIOFaVLU8TmGWpCwbZ9L1Dd+5EiQavt/ueh2bXuz/l/CZpdezw0jyX80hy+ffQ+w0ejq7eXRQ3jvY9xK+GNysws0Cp5o/nv9J6iQapfdSiKXR2mfIsxR1/e7+oeXT67esAixU49Xvy5kXMyV3OnHGFwtUA5S4B+7NP4ETr58tULdHPkMJwgyskXSRf2OwAA///OGG3DOAIAAA=="
}
}
],
@ -192,9 +204,9 @@
"systemd": {
"units": [
{
"contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sed -i '$ a\\allow 10.0.2.2/32' /etc/chrony.conf\nExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
"contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sed -i '$ a\\allow 10.0.2.2/32' /etc/chrony.conf\nExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
"enabled": true,
"name": "postinst.service"
"name": "postinst1.service"
},
{
"contents": "[Unit]\nDescription=Initial System Setup Part 3\n# We run this after the packages have been overlayed\nAfter=firewalld.service\nConditionPathExists=!/var/lib/%N.stamp\nConditionPathExists=/var/lib/postinst.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/systemctl enable --now firewalld\nExecStart=/usr/bin/firewall-cmd --lockdown-on\nExecStart=/usr/bin/firewall-cmd --permanent --add-service=ntp\nExecStart=/usr/bin/firewall-cmd --reload\n\n[Install]\nWantedBy=multi-user.target\n",

103
UTM-Chrony.yml
View File

@ -1,4 +1,4 @@
# Copyright (C) 2021-2024 Thien Tran
# Copyright (C) 2023 Thien Tran
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of
@ -22,9 +22,10 @@ passwd:
groups:
- wheel
- sudo
- name: unpriv
systemd:
units:
- name: postinst.service
- name: postinst1.service
enabled: true
contents: |
[Unit]
@ -104,7 +105,9 @@ storage:
files:
- path: /etc/zincati/config.d/51-rollout-wariness.toml
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/zincati/config.d/51-rollout-wariness.toml
inline: |
[identity]
rollout_wariness = 0
- path: /etc/zincati/config.d/55-updates-strategy.toml
contents:
inline: |
@ -132,37 +135,105 @@ storage:
- path: /etc/systemd/system/irqbalance.service.d/99-brace.conf
contents:
source: https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf
- path: /etc/ssh/sshd_config.d/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf
- path: /etc/ssh/ssh_config.d/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf
- path: /etc/systemd/system/sshd.service.d/local.conf
contents:
source: https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf
- path: /etc/ssh/sshd_config/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf
- path: /etc/tuned/active_profile
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/active_profile
inline: |
virtual-guest
- path: /etc/tuned/profile_mode
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/profile_mode
inline: |
manual
- path: /etc/systemd/zram-generator.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/zram-generator.conf
inline: |
[zram0]
zram-fraction = 1
max-zram-size = 8192
compression-algorithm = zstd
- path: /etc/security/limits.d/30-disable-coredump.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/security/limits.d/30-disable-coredump.conf
inline: |
* hard core 0
- path: /etc/ssh/ssh_config.d/10-custom.conf
contents:
inline: |
GSSAPIAuthentication no
VerifyHostKeyDNS yes
- path: /etc/sysconfig/chronyd
overwrite: true
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd
inline: |
# Command-line options for chronyd
OPTIONS="-F 1"
- path: /etc/unbound/unbound.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/unbound/unbound.conf
inline: |
server:
chroot: ""
auto-trust-anchor-file: "/var/lib/unbound/root.key"
trust-anchor-signaling: yes
root-key-sentinel: yes
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
tls-ciphers: "PROFILE=SYSTEM"
hide-http-user-agent: yes
hide-identity: yes
hide-trustanchor: yes
hide-version: yes
deny-any: yes
harden-algo-downgrade: yes
harden-large-queries: yes
harden-referral-path: yes
harden-short-bufsize: yes
ignore-cd-flag: yes
max-udp-size: 3072
module-config: "validator iterator"
qname-minimisation-strict: yes
unwanted-reply-threshold: 10000000
use-caps-for-id: yes
outgoing-port-permit: 1024-65535
prefetch: yes
prefetch-key: yes
forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 1.1.1.2@853#security.cloudflare-dns.com
forward-addr: 1.0.0.2@853#security.cloudflare-dns.com
forward-addr: 2606:4700:4700::1112@853#security.cloudflare-dns.com
forward-addr: 2606:4700:4700::1002@853#security.cloudflare-dns.com
- path: /etc/systemd/system/unbound.service.d/override.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf
inline: |
[Service]
MemoryDenyWriteExecute=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
# This breaks using socket options like 'so-rcvbuf'. Explicitly disable for visibility.
ProtectKernelTunables=true
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
RestrictNamespaces=yes
LockPersonality=yes
links:
- path: /etc/localtime
target: ../usr/share/zoneinfo/America/Phoenix

55
etc/docker/daemon.json
View File

@ -1,55 +0,0 @@
{
"default-runtime": "runsc-systrap",
"runtimes": {
"runsc-kvm": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=kvm",
"--network=host"
]
},
"runsc-systrap": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=systrap",
"--network=host"
]
},
"runsc-kvm --host-uds=open": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=kvm",
"--network=host",
"--host-uds=open"
]
},
"runsc-systrap --host-uds=open": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=systrap",
"--network=host",
"--host-uds=open"
]
},
"runsc-kvm-debug": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=kvm",
"--network=host",
"--debug-log=/tmp/runsc-kvm/",
"--debug",
"--strace"
]
},
"runsc-systrap-debug": {
"path": "/usr/local/bin/runsc",
"runtimeArgs": [
"--platform=systrap",
"--network=host",
"--debug-log=/tmp/runsc-systrap/",
"--debug",
"--strace"
]
}
}
}

1
etc/security/limits.d/30-disable-coredump.conf
View File

@ -1 +0,0 @@
* hard core 0

19
etc/systemd/system/unbound.service.d/override.conf
View File

@ -1,19 +0,0 @@
[Service]
MemoryDenyWriteExecute=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
# This breaks using socket options like 'so-rcvbuf'. Explicitly disable for visibility.
ProtectKernelTunables=true
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes

4
etc/systemd/zram-generator.conf
View File

@ -1,4 +0,0 @@
[zram0]
zram-fraction = 1
max-zram-size = 8192
compression-algorithm = zstd

1
etc/tuned/active_profile
View File

@ -1 +0,0 @@
virtual-guest

1
etc/tuned/profile_mode
View File

@ -1 +0,0 @@
manual

39
etc/unbound/unbound.conf
View File

@ -1,39 +0,0 @@
server:
chroot: ""
auto-trust-anchor-file: "/var/lib/unbound/root.key"
trust-anchor-signaling: yes
root-key-sentinel: yes
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
tls-ciphers: "PROFILE=SYSTEM"
hide-http-user-agent: yes
hide-identity: yes
hide-trustanchor: yes
hide-version: yes
deny-any: yes
harden-algo-downgrade: yes
harden-large-queries: yes
harden-referral-path: yes
harden-short-bufsize: yes
ignore-cd-flag: yes
max-udp-size: 3072
module-config: "validator iterator"
qname-minimisation-strict: yes
unwanted-reply-threshold: 10000000
use-caps-for-id: yes
outgoing-port-permit: 1024-65535
prefetch: yes
prefetch-key: yes
forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 1.1.1.2@853#security.cloudflare-dns.com
forward-addr: 1.0.0.2@853#security.cloudflare-dns.com
forward-addr: 2606:4700:4700::1112@853#security.cloudflare-dns.com
forward-addr: 2606:4700:4700::1002@853#security.cloudflare-dns.com

62
etc/yum.repos.d/docker-ce.repo
View File

@ -1,62 +0,0 @@
[docker-ce-stable]
name=Docker CE Stable - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-stable-debuginfo]
name=Docker CE Stable - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-stable-source]
name=Docker CE Stable - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test]
name=Docker CE Test - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test-debuginfo]
name=Docker CE Test - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test-source]
name=Docker CE Test - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly]
name=Docker CE Nightly - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly-debuginfo]
name=Docker CE Nightly - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly-source]
name=Docker CE Nightly - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg

2
etc/zincati/config.d/51-rollout-wariness.toml
View File

@ -1,2 +0,0 @@
[identity]
rollout_wariness = 0

10
etc/zincati/config.d/55-updates-strategy.toml
View File

@ -1,10 +0,0 @@
[updates]
strategy = "periodic"
[updates.periodic]
time_zone = "localtime"
[[updates.periodic.window]]
days = [ "Sun" ]
start_time = "0:00"
length_minutes = 60

4
kargs
View File

@ -1,4 +1,4 @@
# Copyright (C) 2021-2024 Thien Tran
# Copyright (C) 2023 Thien Tran
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of
@ -12,6 +12,4 @@
# License for the specific language governing permissions and limitations under
# the License.
# This file is just incase you want to quickly copy-paste the kernel arguments into `rpm-ostree kargs`
mitigations=auto,nosmt spectre_v2=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=isolation_force efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on extra_latent_entropy debugfs=off