Initial commit - realms platform
This commit is contained in:
doomtube
parent
c590ab6d18
commit
c717c3751c
234 changed files with 74103 additions and 15231 deletions
232
terraform/modules/app_server/cloud-init.yaml.tpl
Normal file
232
terraform/modules/app_server/cloud-init.yaml.tpl
Normal file
|
|
@ -0,0 +1,232 @@
|
|||
#cloud-config
|
||||
|
||||
# =============================================================================
|
||||
# Realms App Server Cloud-Init Configuration
|
||||
# Production server for streaming platform - Docker-based deployment
|
||||
# =============================================================================
|
||||
|
||||
write_files:
|
||||
# SSH daemon configuration (non-standard port, VPC only access)
|
||||
- path: /etc/ssh/sshd_config.d/99-hardening.conf
|
||||
content: |
|
||||
# Non-standard port (VPC access only via jump host)
|
||||
Port ${ssh_port}
|
||||
|
||||
# Authentication hardening
|
||||
PermitRootLogin prohibit-password
|
||||
PasswordAuthentication no
|
||||
PubkeyAuthentication yes
|
||||
AuthenticationMethods publickey
|
||||
|
||||
# Security settings
|
||||
MaxAuthTries 3
|
||||
LoginGraceTime 30
|
||||
PermitEmptyPasswords no
|
||||
X11Forwarding no
|
||||
AllowTcpForwarding yes
|
||||
AllowAgentForwarding no
|
||||
PermitUserEnvironment no
|
||||
MaxSessions 5
|
||||
|
||||
# Session settings
|
||||
ClientAliveInterval 300
|
||||
ClientAliveCountMax 2
|
||||
|
||||
# Logging
|
||||
LogLevel VERBOSE
|
||||
permissions: '0644'
|
||||
|
||||
# Fail2ban configuration for SSH
|
||||
- path: /etc/fail2ban/jail.d/sshd.local
|
||||
content: |
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = ${ssh_port}
|
||||
filter = sshd
|
||||
logpath = /var/log/auth.log
|
||||
backend = systemd
|
||||
bantime = 1h
|
||||
findtime = 10m
|
||||
maxretry = 3
|
||||
permissions: '0644'
|
||||
|
||||
# Docker daemon configuration
|
||||
- path: /etc/docker/daemon.json
|
||||
content: |
|
||||
{
|
||||
"log-driver": "json-file",
|
||||
"log-opts": {
|
||||
"max-size": "50m",
|
||||
"max-file": "5"
|
||||
},
|
||||
"storage-driver": "overlay2",
|
||||
"live-restore": true,
|
||||
"no-new-privileges": true
|
||||
}
|
||||
permissions: '0644'
|
||||
|
||||
# UFW configuration script
|
||||
- path: /usr/local/bin/configure-firewall.sh
|
||||
content: |
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Reset UFW
|
||||
ufw --force reset
|
||||
|
||||
# Default policies
|
||||
ufw default deny incoming
|
||||
ufw default deny outgoing
|
||||
|
||||
# Inbound: HTTP/HTTPS
|
||||
ufw allow in 80/tcp comment 'HTTP'
|
||||
ufw allow in 443/tcp comment 'HTTPS'
|
||||
|
||||
# Inbound: Streaming ports
|
||||
ufw allow in 1935/tcp comment 'RTMP'
|
||||
ufw allow in 9999/udp comment 'SRT'
|
||||
ufw allow in 3333/tcp comment 'WebRTC TCP'
|
||||
ufw allow in 3333/udp comment 'WebRTC UDP'
|
||||
ufw allow in 3334/tcp comment 'WebRTC TCP fallback'
|
||||
|
||||
# Inbound: VPC traffic (includes system SSH)
|
||||
ufw allow in from ${vpc_ip_range} comment 'VPC internal'
|
||||
|
||||
# Outbound: Necessary traffic
|
||||
ufw allow out 53/tcp comment 'DNS'
|
||||
ufw allow out 53/udp comment 'DNS'
|
||||
ufw allow out 80/tcp comment 'HTTP'
|
||||
ufw allow out 443/tcp comment 'HTTPS'
|
||||
ufw allow out 123/udp comment 'NTP'
|
||||
ufw allow out to ${vpc_ip_range} comment 'VPC'
|
||||
|
||||
# Enable logging
|
||||
ufw logging medium
|
||||
|
||||
# Enable UFW
|
||||
ufw --force enable
|
||||
|
||||
echo "Firewall configured successfully"
|
||||
permissions: '0755'
|
||||
|
||||
# Swap configuration script (for 4GB RAM)
|
||||
- path: /usr/local/bin/configure-swap.sh
|
||||
content: |
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
SWAP_FILE="/swapfile"
|
||||
SWAP_SIZE="4G"
|
||||
|
||||
if [ ! -f "$SWAP_FILE" ]; then
|
||||
echo "Creating $SWAP_SIZE swap file..."
|
||||
fallocate -l $SWAP_SIZE $SWAP_FILE
|
||||
chmod 600 $SWAP_FILE
|
||||
mkswap $SWAP_FILE
|
||||
swapon $SWAP_FILE
|
||||
|
||||
# Add to fstab
|
||||
echo "$SWAP_FILE none swap sw 0 0" >> /etc/fstab
|
||||
|
||||
# Adjust swappiness
|
||||
echo "vm.swappiness=10" >> /etc/sysctl.conf
|
||||
sysctl vm.swappiness=10
|
||||
|
||||
echo "Swap configured successfully"
|
||||
else
|
||||
echo "Swap file already exists"
|
||||
fi
|
||||
permissions: '0755'
|
||||
|
||||
# Unattended upgrades configuration
|
||||
- path: /etc/apt/apt.conf.d/50unattended-upgrades
|
||||
content: |
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"$${distro_id}:$${distro_codename}";
|
||||
"$${distro_id}:$${distro_codename}-security";
|
||||
"$${distro_id}:$${distro_codename}-updates";
|
||||
};
|
||||
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||
Unattended-Upgrade::MinimalSteps "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "false";
|
||||
permissions: '0644'
|
||||
|
||||
# Auto-upgrades configuration
|
||||
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
permissions: '0644'
|
||||
|
||||
# Message of the day
|
||||
- path: /etc/motd
|
||||
content: |
|
||||
|
||||
+---------------------------------------------------------------+
|
||||
| REALMS APP SERVER |
|
||||
| |
|
||||
| Domain: ${domain}
|
||||
| SSH Port: ${ssh_port} (VPC only)
|
||||
| |
|
||||
| App location: /opt/realms |
|
||||
| Docker compose: /opt/realms/docker-compose.yml |
|
||||
| |
|
||||
| Commands: |
|
||||
| cd /opt/realms && docker compose logs -f |
|
||||
| cd /opt/realms && docker compose pull && up -d |
|
||||
| |
|
||||
+---------------------------------------------------------------+
|
||||
|
||||
permissions: '0644'
|
||||
|
||||
runcmd:
|
||||
# Ensure .ssh directory exists
|
||||
- mkdir -p /root/.ssh && chmod 700 /root/.ssh
|
||||
|
||||
# Configure SSH
|
||||
- grep -q 'Include /etc/ssh/sshd_config.d' /etc/ssh/sshd_config || sed -i '1i Include /etc/ssh/sshd_config.d/*.conf' /etc/ssh/sshd_config
|
||||
- sed -i 's/^Port /#Port /' /etc/ssh/sshd_config
|
||||
- systemctl restart sshd
|
||||
|
||||
# Wait for dpkg lock
|
||||
- while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do echo "Waiting for dpkg lock..."; sleep 5; done
|
||||
|
||||
# Install prerequisites
|
||||
- apt-get update
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 install -y ca-certificates curl gnupg fail2ban ufw unattended-upgrades apt-listchanges vim git
|
||||
|
||||
# Add Docker's official GPG key and repository
|
||||
- install -m 0755 -d /etc/apt/keyrings
|
||||
- curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
||||
- chmod a+r /etc/apt/keyrings/docker.gpg
|
||||
- echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list
|
||||
|
||||
# Install Docker
|
||||
- apt-get update
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
||||
|
||||
# Enable and start Docker
|
||||
- systemctl enable docker
|
||||
- systemctl start docker
|
||||
|
||||
# Enable and start fail2ban
|
||||
- systemctl enable fail2ban
|
||||
- systemctl restart fail2ban
|
||||
|
||||
# Configure swap
|
||||
- /usr/local/bin/configure-swap.sh
|
||||
|
||||
# Configure firewall
|
||||
- /usr/local/bin/configure-firewall.sh
|
||||
|
||||
# Create app directory
|
||||
- mkdir -p /opt/realms
|
||||
- mkdir -p /opt/realms/uploads
|
||||
|
||||
# Enable unattended upgrades
|
||||
- systemctl enable unattended-upgrades
|
||||
- systemctl start unattended-upgrades
|
||||
|
||||
final_message: "Realms app server ready after $UPTIME seconds. Deploy via Forgejo CI/CD."
|
||||
Loading…
Add table
Add a link
Reference in a new issue