thesabear
c05c7164c8
rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.
Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.
83 lines
2.7 KiB
INI
83 lines
2.7 KiB
INI
#version=RHEL10
|
|
lang en_US.UTF-8
|
|
keyboard us
|
|
timezone Europe/Sofia --utc
|
|
authselect --enablefeatures=with-faillock
|
|
selinux --enforcing
|
|
firewall --disabled
|
|
services --enabled=sshd,qemu-guest-agent
|
|
firstboot --disable
|
|
network --bootproto=dhcp --device=link --onboot=on --hostname=rocky10 --activate
|
|
ignoredisk --only-use=vda
|
|
rootpw --plaintext thisisatemporarypassword
|
|
reboot
|
|
|
|
# Clear all partitions and create new MBR label
|
|
clearpart --all --initlabel --drives=vda --disklabel=msdos
|
|
|
|
# /boot with ext4
|
|
part /boot --fstype="ext4" --size=1024 --ondisk=vda --label=BOOT
|
|
|
|
# LVM physical volume on rest of disk
|
|
part pv.01 --fstype="lvmpv" --ondisk=vda --grow --size=1 --label=PV01
|
|
volgroup rocky pv.01
|
|
|
|
# Logical volumes
|
|
logvol /tmp --fstype=xfs --size=2048 --name=lv_tmp --vgname=rocky --fsoptions="defaults,nodev,nosuid"
|
|
logvol /home --fstype=xfs --size=2048 --name=lv_home --vgname=rocky --fsoptions="defaults,nodev"
|
|
logvol /var --fstype=xfs --size=4096 --name=lv_var --vgname=rocky --fsoptions="defaults,nodev"
|
|
logvol /var/tmp --fstype=xfs --size=1024 --name=lv_vartmp --vgname=rocky --fsoptions="defaults,nodev,nosuid,noexec"
|
|
logvol /var/log --fstype=xfs --size=2048 --name=lv_varlog --vgname=rocky --fsoptions="defaults,nodev,noexec,nosuid"
|
|
logvol /var/log/audit --fstype=xfs --size=2048 --name=lv_audit --vgname=rocky --fsoptions="defaults,nodev,noexec,nosuid"
|
|
logvol / --fstype=xfs --name=lv_root --vgname=rocky --grow --size=512 --fsoptions="defaults"
|
|
|
|
# BIOS-compatible bootloader
|
|
bootloader --location=mbr --boot-drive=vda
|
|
|
|
# Repositories
|
|
repo --name="base" --baseurl=https://download.rockylinux.org/pub/rocky/10/BaseOS/x86_64/os/
|
|
repo --name="appstream" --baseurl=https://download.rockylinux.org/pub/rocky/10/AppStream/x86_64/os/
|
|
|
|
%packages
|
|
@^minimal-environment
|
|
openssh-server
|
|
openssh-clients
|
|
qemu-guest-agent
|
|
nano
|
|
zsh
|
|
git
|
|
curl
|
|
sudo
|
|
util-linux-user
|
|
rsync
|
|
tree
|
|
nmap-ncat
|
|
%end
|
|
|
|
%post --erroronfail
|
|
|
|
# Enable Docker repository
|
|
dnf install -y epel-release dnf-plugins-core
|
|
dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
|
|
|
|
# Install Docker fastfetch jq
|
|
dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin fastfetch jq
|
|
|
|
# Enable services
|
|
systemctl enable sshd
|
|
systemctl enable docker
|
|
systemctl restart docker
|
|
systemctl restart sshd
|
|
|
|
# Enable password authentication for SSH
|
|
cat > /etc/ssh/sshd_config.d/99-password-login.conf <<EOF
|
|
PermitRootLogin yes
|
|
PasswordAuthentication yes
|
|
Subsystem sftp /usr/libexec/openssh/sftp-server
|
|
EOF
|
|
|
|
# Optional: enable LVM resize service (if available)
|
|
systemctl enable resize-lvm.service || true
|
|
|
|
%end
|