diff --git a/bundles/grafana/items.py b/bundles/grafana/items.py index e0c8549..a2645c6 100644 --- a/bundles/grafana/items.py +++ b/bundles/grafana/items.py @@ -160,6 +160,8 @@ for dashboard_id, monitored_node in enumerate(monitored_nodes, start=1): files[f'/var/lib/grafana/dashboards/{monitored_node.name}.json'] = { 'content': json.dumps(dashboard, indent=4), + 'owner': 'grafana', + 'group': 'grafana', 'triggers': [ 'svc_systemd:grafana-server:restart', ] diff --git a/bundles/nginx/files/fastcgi b/bundles/nginx/files/fastcgi index d115cf1..8acfabc 100644 --- a/bundles/nginx/files/fastcgi +++ b/bundles/nginx/files/fastcgi @@ -1,4 +1,3 @@ -fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; @@ -24,6 +23,3 @@ fastcgi_param SERVER_NAME $server_name; # PHP only, required if PHP was built with --enable-force-cgi-redirect fastcgi_param REDIRECT_STATUS 200; - -# This is the only thing that's different to the debian default. -fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; diff --git a/bundles/rufbereitschaftsalarm/files/rufbereitschaftsalarm b/bundles/rufbereitschaftsalarm/files/rufbereitschaftsalarm new file mode 100644 index 0000000..50d1738 --- /dev/null +++ b/bundles/rufbereitschaftsalarm/files/rufbereitschaftsalarm @@ -0,0 +1,8 @@ +#!/bin/bash + +gpio=$(gpiofind SCL1) + +while gpiomon --num-events=1 --falling-edge $gpio 2&> /dev/null +do + systemctl stop rufbereitschafts-klingel +done diff --git a/bundles/rufbereitschaftsalarm/items.py b/bundles/rufbereitschaftsalarm/items.py new file mode 100644 index 0000000..206105b --- /dev/null +++ b/bundles/rufbereitschaftsalarm/items.py @@ -0,0 +1,16 @@ +files = { + '/opt/rufbereitschaftsalarm': { + 'mode': '550', + }, +} + +svc_systemd = { + 'rufbereitschaftsalarm.service': { + 'enabled': False, + 'running': False, + 'needs': [ + 'pkg_apt:gpiod', + 'file:/opt/rufbereitschaftsalarm', + ], + } +} diff --git a/bundles/rufbereitschaftsalarm/metadata.py b/bundles/rufbereitschaftsalarm/metadata.py new file mode 100644 index 0000000..b7ce193 --- /dev/null +++ b/bundles/rufbereitschaftsalarm/metadata.py @@ -0,0 +1,42 @@ +defaults = { + 'apt': { + 'packages': { + 'gpiod': {}, + }, + }, + 'flask': { + + }, + 'systemd': { + 'units': { + 'rufbereitschaftsalarm-sound.service': { + 'Unit': { + 'Description': 'rufbereitschaftsalarm sound effect', + 'After': 'network.target', + }, + 'Service': { + 'ExecStart': '/opt/rufbereitschaftsalarm-sound', + }, + 'Install': { + 'WantedBy': { + 'multi-user.target' + }, + }, + }, + 'rufbereitschaftsalarm-stop.service': { + 'Unit': { + 'Description': 'rufbereitschaftsalarm stop button', + 'After': 'network.target', + }, + 'Service': { + 'ExecStart': '/opt/rufbereitschaftsalarm-stop', + }, + 'Install': { + 'WantedBy': { + 'multi-user.target' + }, + }, + }, + }, + }, +} diff --git a/data/nginx/run_program.conf b/data/nginx/run_program.conf new file mode 100644 index 0000000..a5d3222 --- /dev/null +++ b/data/nginx/run_program.conf @@ -0,0 +1,29 @@ +# https://www.nginx.com/resources/wiki/start/topics/examples/fcgiwrap/ + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name ${server_name}; + + ssl_certificate /var/lib/dehydrated/certs/${server_name}/fullchain.pem; + ssl_certificate_key /var/lib/dehydrated/certs/${server_name}/privkey.pem; + + location / { + # Disable gzip (it makes scripts feel slower since they have to complete + # before getting gzipped) + gzip off; + + # Set the root to /usr/lib (inside this location this means that we are + # giving access to the files under /usr/lib/cgi-bin) + root /usr/lib; + + # Fastcgi socket + fastcgi_pass unix:/run/fcgiwrap.socket; + + # Fastcgi parameters, include the standard ones + include /etc/nginx/params/fastcgi; + + # Adjust non standard parameters (SCRIPT_FILENAME) + fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/hello.cgi; + } +} diff --git a/nodes/home.rufbereitschaft.py b/nodes/home.rufbereitschaft.py new file mode 100644 index 0000000..cdb40fe --- /dev/null +++ b/nodes/home.rufbereitschaft.py @@ -0,0 +1,72 @@ +{ + 'hostname': '10.0.0.190', + 'groups': [ + 'autologin', + 'debian-12', + 'hardware', + 'home', + 'monitored', + 'webserver', + ], + 'bundles': [ + 'wireguard', + ], + 'metadata': { + 'id': '4eb7ba69-37fa-4594-8d54-3ebfc4e7e5d6', + 'network': { + 'internal': { + 'interface': 'eth0', + 'ipv4': '10.0.0.190/24', + 'gateway4': '10.0.0.1', + }, + }, + 'apt': { + 'packages': { + 'alsa-utils': {}, + 'espeak': {}, + 'libnginx-mod-http-lua': {}, + }, + }, + 'nginx': { + 'vhosts': { + 'rufbereitschaftsalarm.ckn.li': { + 'content': 'nginx/run_program.conf', + 'context': { + 'script': 'hello', + }, + }, + }, + }, + 'systemd': { + 'units': { + "wireguard.network": { + "Route#smedia": { + "Destination": "10.200.128.1", + "Gateway": "10.200.128.11" + }, + }, + "wireguard.netdev": { + "NetDev": { + "Description": "WireGuard server", + "Kind": "wireguard", + "Name": "wg0" + }, + "WireGuard": { + "ListenPort": 51820, + "PrivateKey": "encrypt$gAAAAABk6FEX92wQzlBIqxP6w5FQydlrDqOZeo1AZS9zaBE3QzujtBnB_cf6KlECzmoljr71dmRiFN5yvA8bzRIpcecvnufIji1XNg-i1UW1fq393XppRq0p9EtNBVzoXoyzZFEcjQRo" + }, + "WireGuardPeer#rufbereitsschaftsalarm": { + "AllowedIPs": "0.0.0.0/0", + "Endpoint": "185.122.180.82:51820", + "PersistentKeepalive": 30, + "PresharedKey": "!decrypt:encrypt$gAAAAABk6FD0_39AzxKTTse3ukqs7VOcZ5mPsBsN09Y4FgITOEnbBVWZ-zDsaZi-woNbp4k10nrJtIrqz8a-FIFdNbQaTgulhRDKF6TFH4BhYlEB7d8NH5CU3kTTtqtjSWW9GPqAgb3z", + "PublicKey": "gPKjFV8mAx5GZdfPmjThNolpSaXs285e7YznhaBlOwY=" + } + }, + }, + }, + 'wireguard': { + 'my_ip': '10.200.128.11/24', + }, + }, +}