nas-server/setup.sh

#!/usr/bin/env bash

# The purpose of this script is to setup our NAS server on a blank Armbian.
# This script is to be run as root.

# (Keep in mind that default root password is 1234)
# Flash SBC's SD with Armbian and copy this script as well as conf-sync.sh to /root

# YOU SHOULD REMOVE THIS SCRIPT AFTER SETUP

source "$run_directory/variables.conf"

# Functions
init() {
  echo "Starting initialization"
  echo $fqdn > /etc/hostname
  localectl set-keymap $keymap
  timedatectl set-timezone $timezone
  systemctl disable apt-daily-upgrade.timer
}

install_packages() {
  echo "Starting packages installation"
  sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list
  apt update
  apt upgrade -y
  packages_to_install="vim tree tmux neofetch cryptsetup clevis clevis-luks clevis-systemd"
  if [ "$dl_server" = "yes" ]; then
    packages_to_install+=" openvpn transmission-daemon"
  fi
  if [ "$upnp_server" = "yes" ]; then
    packages_to_install+=" minidlna"
  fi
  if [ "$ftp_server" = "yes" ]; then
    packages_to_install+=" vsftpd"
  fi
  apt install -y $packages_to_install
}

add_users() {
  echo "Adding users"
  useradd -U -G sudo -m -s /bin/bash $user
  chmod 700 /home/$user
  echo "Let's define a password for $user as we are about to run sudo with it. It can of course be changed after setup."
  passwd $user
}

get_sync() {
  echo "Getting and deploying sync configuration"
  sudo -H -u $user mkdir $sync_directory_path
  sudo -H -u $user git clone https://gitea.kto.black/adminconf/rcs-general.git $sync_directory_path/rcs-general
  sudo -H -u $user $sync_directory_path/rcs-general/install.sh
  sudo -H -u $user git clone https://gitea.kto.black/adminconf/conf-sync.git $sync_directory_path/conf-sync
  sudo -H -u $user cp $sync_directory_path/conf-sync/variables.conf.template \
    $sync_directory_path/conf-sync/variables.conf
  sudo -H -u $user sed -i -e "s/\"desktop\"/\"server\"/g" $sync_directory_path/conf-sync/variables.conf
  sudo -H -u $user $sync_directory_path/conf-sync/install.sh
  sudo -H -u $user git clone https://gitea.kto.black/adminconf/nas-server.git $sync_directory_path/nas-server
}

ssh_pubkey() {
  echo "Getting SSH public key"
  sudo -H -u $user mkdir /home/$user/.ssh
  sudo -H -u $user wget -P /home/$user/.ssh $remote_pubkey_location/$remote_pubkey
  sudo -H -u $user mv /home/$user/.ssh/$remote_pubkey /home/$user/.ssh/authorized_keys
}

set_sshd_conf() {
  echo "Editing OpenSSH daemon config..."
  sed -i -e "s/#PasswordAuthentication yes/PasswordAuthentication no/g" /etc/ssh/sshd_config
  sed -i -e "s/PermitRootLogin yes/PermitRootLogin no/g" /etc/ssh/sshd_config
}

set_vsftpd() {
  if [ "$ftp_server" != "yes" ]; then
    return 0
  fi
  echo "Setting vsftpd config"
  mkdir $nas_root
  chown $user:users $nas_root
  echo "nascrypt /dev/sda none noauto" >> /etc/crypttab
  sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf
  sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf
  # The two lines below set up TLS wrapping with a self-signed certificate, which causes issues with clients
  #sed -i -e "s/ssl_enable=NO/ssl_enable=YES/g" /etc/vsftpd.conf
  #openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem -subj "/C=/ST=/L=/O=/OU=/CN="
}

# Only run if the user is root
if [[ $USER != 'root' ]] ; then
  echo "You must run this script as root!"
  exit 1
fi

run_directory_path=$(pwd)

# Set parameters
fqdn='hk1.jab.kto.black'
keymap='fr'
timezone='Europe/Paris'
deb_apt_default_repo='deb.debian.org' # TODO check
deb_apt_repo='ftp.fr.debian.org'
user='alex'
sync_directory_path="/home/$user/.sync"
systemd_units_path='/etc/systemd/system'
remote_pubkey_location='https://keys.kto.black'
remote_pubkey='home.pub'
nas_root='/srv/nas'

# Main process
# You should comment below what you do not want to happen
init
install_packages
add_users
get_sync
ssh_pubkey
set_sshd_conf
set_vsftpd

echo ""
echo "We're all good here!"
echo "You should now:"
echo "* set $user's password"
echo "* lock root account"
echo "* remove $run_directory_path content"
if [ "$dl_server" = "yes" ]; then
  echo "* get the OpenVPN configuration file, move it to /etc/openvpn/client/vpn.conf"
  echo "  * and add at \`auth-user-pass\`: auth.txt"
  echo "  * create said auth.txt with VPN login and password (on two rows)"
fi
echo "* reboot the SBC"
echo "And perhaps:"
echo "* set htop at your convenience"
echo "* remove password for sudo" # TODO we should automate that, with a flag
echo "* use below commands to edit SSH config:"
echo "    sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config"
echo "    sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config"
echo "* register an encrypted volume to a tang server"

exit 0