Repository navigation
Expand file tree
/
Copy pathdu_setup.env.example
More file actions
114 lines (96 loc) · 4.57 KB
/
Copy pathdu_setup.env.example
File metadata and controls
114 lines (96 loc) · 4.57 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# ==============================================================================
# du_setup.sh — Example Environment Configuration for Unattended (--quiet) Runs
# ==============================================================================
# Usage:
# 1. Copy this file and restrict permissions (especially if adding keys/tokens):
# cp du_setup.env.example du_setup.env
# chmod 600 du_setup.env
# 2. Edit DU_USERNAME and DU_SSH_PUBLIC_KEY (and any optional settings below).
# 3. Run du_setup.sh with --config and --quiet:
# sudo -E ./du_setup.sh --config ./du_setup.env --quiet
#
# Notes:
# - Only DU_* variables are accepted by --config (parsed safely without eval).
# - Environment variables already exported on the command line take precedence
# over values defined in this file.
# ==============================================================================
# --- Required Admin User & SSH Key ---
DU_USERNAME="deploy"
# REQUIRED for new users (or existing users without ~/.ssh/authorized_keys).
# Replace the placeholder below with your real public key (ssh-ed25519, ecdsa-*, or ssh-rsa).
# Multiple keys can be separated with '|' (e.g., "ssh-ed25519 AAAA... key1|ssh-ed25519 BBBB... key2").
DU_SSH_PUBLIC_KEY="PASTE_YOUR_SSH_PUBLIC_KEY_HERE"
# Allow using DU_USERNAME if the account already exists on the system
DU_USE_EXISTING_USER="true"
# --- System Identity & SSH Port ---
# Leave DU_HOSTNAME empty to keep the server's current short hostname in --quiet mode
DU_HOSTNAME=""
DU_PRETTY_HOSTNAME=""
DU_SSH_PORT="2222"
DU_TIMEZONE="Etc/UTC"
# --- Sudo & Password Policy ---
# For new users (or existing key-only/cloud-init users with no active password):
# - Set DU_USER_PASSWORD to assign a specific sudo password, OR
# - Leave DU_USER_PASSWORD empty with DU_GENERATE_RANDOM_PASSWORD="true" (recommended)
# to auto-generate a 24-character password saved (mode 0600, owned by <username>:<group>) at:
# /home/<username>/.du_initial_sudo_password
# (a self-clearing login reminder prompts <username> to save it and run 'shred -u ~/.du_initial_sudo_password')
# - Existing users who already have an active password retain it unchanged unless DU_USER_PASSWORD is set.
# - Set DU_PASSWORDLESS_SUDO="true" ONLY if you explicitly want NOPASSWD sudo.
DU_USER_PASSWORD=""
DU_GENERATE_RANDOM_PASSWORD="true"
DU_PASSWORDLESS_SUDO="false"
# Install the enhanced custom .bashrc for DU_USERNAME
DU_INSTALL_CUSTOM_BASHRC="false"
# --- Firewall (UFW) ---
DU_ALLOW_HTTP="false"
DU_ALLOW_HTTPS="false"
DU_ALLOW_TAILSCALE_UDP="false"
# Optional space-separated custom UFW ports (e.g., "8080/tcp 8443/tcp")
DU_CUSTOM_UFW_PORTS=""
# --- Intrusion Detection / Prevention System ---
# Options: fail2ban | crowdsec | none
DU_IDS="fail2ban"
# Fail2Ban options (used when DU_IDS="fail2ban")
DU_FAIL2BAN_WHITELIST_CURRENT_IP="false"
# Space-separated IPs or CIDRs to ignore (e.g., "100.64.0.0/10 192.168.1.0/24")
DU_FAIL2BAN_IGNORE_IPS=""
# Optional port-scan jail ('ufw-probes'). Disabled by default because pre-handshake
# SYN packets can be spoofed unless your admin/VPN IPs are whitelisted in DU_FAIL2BAN_IGNORE_IPS.
DU_FAIL2BAN_UFW_PROBES="false"
# CrowdSec options (used when DU_IDS="crowdsec")
# Space-separated hub collections (e.g., "crowdsecurity/nginx crowdsecurity/http-cve")
DU_CROWDSEC_COLLECTIONS=""
DU_CROWDSEC_ENROLL_KEY=""
# --- System Hardening & DNS ---
DU_ENABLE_AUTO_UPDATES="true"
DU_ENABLE_SECURE_DNS="false"
DU_ENABLE_KERNEL_HARDENING="true"
# --- Docker & Container Firewall Hardening ---
DU_INSTALL_DOCKER="false"
# Apply DOCKER-USER rules in UFW (/etc/ufw/after.rules & after6.rules) so published
# container ports (-p) cannot bypass UFW incoming rules unless allowed via 'ufw route allow'
DU_DOCKER_UFW_HARDEN="true"
DU_INSTALL_DTOP="false"
# --- Mesh VPN (Optional) ---
# Options: none | tailscale | netbird | both
DU_VPN="none"
# Tailscale settings (used when DU_VPN="tailscale" or "both")
DU_TAILSCALE_AUTH_KEY=""
# Optional custom coordination/Headscale URL (e.g., "https://ts.example.com")
DU_TAILSCALE_LOGIN_SERVER=""
# Optional space-separated flags (e.g., "--accept-routes --accept-dns")
DU_TAILSCALE_FLAGS=""
# NetBird settings (used when DU_VPN="netbird" or "both")
DU_NETBIRD_SETUP_KEY=""
# Optional self-hosted NetBird management URL (e.g., "https://netbird.example.com:33073")
DU_NETBIRD_MANAGEMENT_URL=""
# --- Swap & Security Auditing ---
DU_CONFIGURE_SWAP="false"
DU_SWAP_SIZE="2G"
DU_SWAPPINESS="10"
DU_VFS_CACHE_PRESSURE="50"
DU_RUN_SECURITY_AUDIT="false"
DU_RUN_DEBSECAN="false"
# Automatically reboot at the end of --quiet provisioning (default: false)
DU_AUTO_REBOOT="false"