Compare commits
No commits in common. "5ef39754682f9de78d559feee4ffab7e7daad629" and "3f6aad7cbe2381384fc970e8ecabd8ea16c4306c" have entirely different histories.
5ef3975468
...
3f6aad7cbe
14
README.md
14
README.md
@ -1,21 +1,23 @@
|
||||
# Printscan server
|
||||
## Version 3.1
|
||||
## Version 3
|
||||
|
||||
This repository contains files used to set up our printscan server on a freshly installed Armbian. Target is Bullseye.
|
||||
|
||||
### Introduction
|
||||
(see wiki for need and concept explanation)
|
||||
|
||||
Version 3.1 implementation works roughly as follows:
|
||||
Version 3 implementation works roughly as follows:
|
||||
##### SBC
|
||||
* the Armbian-based device is connected to local network, and an all-in-one printer is connected to it via USB;
|
||||
* SANE and CUPS services are installed and running on the device;
|
||||
* CUPS is configured to provide a remote printer to network;
|
||||
* SANE is configured to provide local scan;
|
||||
* [scanservjs](https://github.com/sbs20/scanservjs) runs on the SBC, providing a web interface for scan.
|
||||
* SANE is configured to provide network scan to a specific host only.
|
||||
|
||||
##### Applicative container
|
||||
* this specific host is an applicative container running [scanservjs](https://github.com/sbs20/scanservjs);
|
||||
* it is configured to use the scanner provided by the SBC.
|
||||
|
||||
### Files
|
||||
Files in this repository cover all the SBC setup.
|
||||
Files in this repository only cover the SBC setup.
|
||||
#### Installation
|
||||
* `setup.sh` is a script automating the installation and configuration of required software
|
||||
* `cupsd.conf` is the config file for CUPS, set by setup script
|
||||
|
||||
102
cupsd.conf
102
cupsd.conf
@ -1,102 +0,0 @@
|
||||
LogLevel debug
|
||||
PageLogFormat
|
||||
MaxLogSize 0
|
||||
# Allow remote access
|
||||
Port 631
|
||||
Listen /var/run/cups/cups.sock
|
||||
Browsing On
|
||||
BrowseLocalProtocols dnssd
|
||||
DefaultAuthType Basic
|
||||
WebInterface Yes
|
||||
<Location />
|
||||
# Allow remote administration...
|
||||
Order allow,deny
|
||||
Allow @LOCAL
|
||||
</Location>
|
||||
<Location /admin>
|
||||
# Allow remote administration...
|
||||
Order allow,deny
|
||||
Allow @LOCAL
|
||||
</Location>
|
||||
<Location /admin/conf>
|
||||
AuthType Default
|
||||
Require user @SYSTEM
|
||||
# Allow remote access to the configuration files...
|
||||
Order allow,deny
|
||||
Allow @LOCAL
|
||||
</Location>
|
||||
<Location /admin/log>
|
||||
AuthType Default
|
||||
Require user @SYSTEM
|
||||
Order allow,deny
|
||||
# Allow remote access to the log files...
|
||||
Order allow,deny
|
||||
Allow @LOCAL
|
||||
</Location>
|
||||
<Policy default>
|
||||
JobPrivateAccess default
|
||||
JobPrivateValues default
|
||||
SubscriptionPrivateAccess default
|
||||
SubscriptionPrivateValues default
|
||||
<Limit Create-Job Print-Job Print-URI Validate-Job>
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
|
||||
Require user @OWNER @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
|
||||
AuthType Default
|
||||
Require user @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
|
||||
AuthType Default
|
||||
Require user @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit Cancel-Job CUPS-Authenticate-Job>
|
||||
Require user @OWNER @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit All>
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
</Policy>
|
||||
<Policy authenticated>
|
||||
JobPrivateAccess default
|
||||
JobPrivateValues default
|
||||
SubscriptionPrivateAccess default
|
||||
SubscriptionPrivateValues default
|
||||
<Limit Create-Job Print-Job Print-URI Validate-Job>
|
||||
AuthType Default
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
|
||||
AuthType Default
|
||||
Require user @OWNER @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
|
||||
AuthType Default
|
||||
Require user @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
|
||||
AuthType Default
|
||||
Require user @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit Cancel-Job CUPS-Authenticate-Job>
|
||||
AuthType Default
|
||||
Require user @OWNER @SYSTEM
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
<Limit All>
|
||||
Order deny,allow
|
||||
</Limit>
|
||||
</Policy>
|
||||
JobPrivateAccess default
|
||||
JobPrivateValues default
|
||||
SubscriptionPrivateAccess default
|
||||
SubscriptionPrivateValues default
|
||||
@ -1,13 +0,0 @@
|
||||
<VirtualHost *:443>
|
||||
ServerName printscan.hp3.kto.black
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile "/etc/ssl/cert.crt"
|
||||
SSLCertificateKeyFile "/etc/ssl/cert.key"
|
||||
|
||||
<Location />
|
||||
ProxyPass "http://127.0.0.1:8080/"
|
||||
ProxyPassReverse "http://127.0.0.1:8080/"
|
||||
</Location>
|
||||
</VirtualHost>
|
||||
|
||||
73
setup.sh
73
setup.sh
@ -4,7 +4,7 @@
|
||||
# This script is to be run as root.
|
||||
|
||||
# (Keep in mind that default root password is 1234)
|
||||
# Flash SBC's SD with Armbian and clone this repository in /root
|
||||
# Flash SBC's SD with Armbian and copy this script as well as conf-sync.sh to /root
|
||||
|
||||
# YOU SHOULD REMOVE THIS SCRIPT AFTER SETUP
|
||||
|
||||
@ -23,7 +23,7 @@ install_packages() {
|
||||
sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list
|
||||
apt update
|
||||
apt upgrade -y
|
||||
apt install -y vim tree tmux neofetch sane sane-utils hplip apache2
|
||||
apt install -y vim tree tmux neofetch sane sane-utils hplip
|
||||
}
|
||||
|
||||
add_users() {
|
||||
@ -33,38 +33,43 @@ add_users() {
|
||||
usermod -a -G lp saned
|
||||
}
|
||||
|
||||
get_conf() { # TODO when new conf-sync will be available
|
||||
get_conf() {
|
||||
echo "Getting configuration"
|
||||
sudo -H -u $user mkdir $sync_directory_path
|
||||
|
||||
git clone https://gitea.kto.black/adminconf/rcs-general.git $sync_directory_path/rcs-general
|
||||
# git clone confsync-du-futur
|
||||
cp $run_directory_path/conf-sync.sh $sync_directory_path/
|
||||
chown $user:$user $sync_directory_path/conf-sync.sh
|
||||
sudo -H -u $user chmod u+x $sync_directory_path/conf-sync.sh
|
||||
sudo -H -u $user $sync_directory_path/conf-sync.sh
|
||||
}
|
||||
|
||||
set_conf() { # TODO when new conf-sync will be available
|
||||
set_conf() {
|
||||
echo "Setting configuration"
|
||||
# deploy confsync-du-futur
|
||||
ln -s $sync_directory_path/conf-sync-server.timer $systemd_units_path/conf-sync.timer
|
||||
ln -s $sync_directory_path/*.service $systemd_units_path/
|
||||
systemctl daemon-reload
|
||||
systemctl enable conf-sync.timer
|
||||
}
|
||||
|
||||
set_cups_conf() {
|
||||
echo "Setting CUPS configuration"
|
||||
mv $cups_conf_path/cupsd.conf $cups_conf_path/cupsd.conf.orig
|
||||
cp $run_directory_path/cupsd.conf $cups_conf_path/cupsd.conf
|
||||
ln -s $sync_directory_path/cupsd.conf $cups_conf_path/cupsd.conf
|
||||
}
|
||||
|
||||
set_sane_conf() {
|
||||
echo $printscan_container_ip >> /etc/sane.d/saned.conf
|
||||
systemctl enable saned.socket
|
||||
}
|
||||
|
||||
rcs_links() { # NOTE this should be handled by an install script in rcs-general
|
||||
rcs_links() {
|
||||
echo "Linking rcs"
|
||||
rm /home/$user/.bashrc
|
||||
rm /root/.bashrc
|
||||
sudo -H -u $user ln -s $sync_directory_path/rcs-general/bashrc /home/$user/.bashrc
|
||||
sudo -H -u $user ln -s $sync_directory_path/bashrc /home/$user/.bashrc
|
||||
ln -s /home/$user/.bashrc /root/.bashrc
|
||||
sudo -H -u $user ln -s $sync_directory_path/rcs-general/vimrc /home/$user/.vimrc
|
||||
sudo -H -u $user ln -s $sync_directory_path/vimrc /home/$user/.vimrc
|
||||
ln -s /home/$user/.vimrc /root/.vimrc
|
||||
sudo -H -u $user ln -s $sync_directory_path/rcs-general/tmux.conf /home/$user/.tmux.conf
|
||||
sudo -H -u $user ln -s $sync_directory_path/tmux.conf /home/$user/.tmux.conf
|
||||
ln -s /home/$user/.tmux.conf /root/.tmux.conf
|
||||
}
|
||||
|
||||
@ -75,33 +80,6 @@ ssh_pubkey() {
|
||||
sudo -H -u $user mv /home/$user/.ssh/$remote_pubkey /home/$user/.ssh/authorized_keys
|
||||
}
|
||||
|
||||
# based on https://github.com/sbs20/scanservjs/blob/master/docs/install.md
|
||||
install_scanservjs() {
|
||||
wget -O $run_directory_path/scanservjs.tar.gz $(curl -s \
|
||||
https://api.github.com/repos/sbs20/scanservjs/releases/latest | grep browser_download_url | cut -d '"' -f 4)
|
||||
mkdir $run_directory_path/scanservjs
|
||||
tar -xf scanservjs.tar.gz -C $run_directory_path/scanservjs/
|
||||
sudo $run_directory_path/scanservjs/installer.sh -i
|
||||
rm $run_directory_path/scanservjs.tar.gz
|
||||
rm -r $run_directory_path/scanservjs
|
||||
}
|
||||
|
||||
tls_cert() {
|
||||
echo "Generating TLS certificate"
|
||||
openssl req -newkey rsa:4096 -x509 -sha256 -days 999 -nodes -out $tls_directory/$cert -keyout $tls_directory/$cert_key -subj "/C=/ST=/L=/O=/OU=/CN="
|
||||
chmod o+r $tls_directory/$cert_key
|
||||
}
|
||||
|
||||
set_apache() {
|
||||
echo "Setting up Apache HTTP Server"
|
||||
cp $run_directory_path/scanservjs.conf $apache_sites_directory_path/
|
||||
a2dissite *
|
||||
a2ensite scanservjs
|
||||
a2enmod ssl proxy proxy_http proxy_http2
|
||||
}
|
||||
|
||||
# TODO add a firewall rule to prevent access to http:8080 from other than local
|
||||
|
||||
# Only run if the user is root
|
||||
if [[ $USER != 'root' ]] ; then
|
||||
echo "You must run this script as root!"
|
||||
@ -113,22 +91,20 @@ run_directory_path=$(pwd)
|
||||
# Set parameters
|
||||
default_hostname='pine64'
|
||||
hostname='pn1'
|
||||
fqdn='pn1.hr.kto.black'
|
||||
fqdn='pn1.kto.black'
|
||||
keymap='fr'
|
||||
timezone='Europe/Paris'
|
||||
deb_apt_default_repo='deb.debian.org'
|
||||
deb_apt_repo='ftp.fr.debian.org'
|
||||
user='alex'
|
||||
scan_user='scan'
|
||||
scan_user_home_directory="/home/$scan_user"
|
||||
sync_directory_path="/home/$user/.sync"
|
||||
systemd_units_path='/etc/systemd/system'
|
||||
cups_conf_path='/etc/cups'
|
||||
printscan_container_ip='192.168.0.91'
|
||||
remote_pubkey_location='https://keys.kto.black'
|
||||
remote_pubkey='home.pub'
|
||||
scanservjs_dest='/srv/scanservjs'
|
||||
tls_directory='/etc/ssl/'
|
||||
cert='cert.crt'
|
||||
cert_key='cert.key'
|
||||
apache_sites_directory_path='/etc/apache2/sites-available'
|
||||
|
||||
# Main process
|
||||
# You should comment below what you do not want to happen
|
||||
@ -141,15 +117,13 @@ set_cups_conf
|
||||
set_sane_conf
|
||||
rcs_links
|
||||
ssh_pubkey
|
||||
install_scanservjs
|
||||
tls_cert
|
||||
set_apache
|
||||
|
||||
echo ""
|
||||
echo "We're all good here!"
|
||||
echo "You should now:"
|
||||
echo "* set $user's password"
|
||||
echo "* lock root account"
|
||||
echo "* remove setup.sh and conf-sync.sh"
|
||||
echo "* reboot the SBC"
|
||||
echo "And perhaps:"
|
||||
echo "* connect to http://$hostname:631/ and add a printer"
|
||||
@ -158,5 +132,4 @@ echo "* remove password for sudo" # TODO we should automate that, with a flag
|
||||
echo "* use below commands to edit SSH config:"
|
||||
echo " sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config"
|
||||
echo " sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config"
|
||||
echo "* MIND THAT CONF-SYNC IS NOT SET"
|
||||
exit 0
|
||||
|
||||
Loading…
Reference in New Issue
Block a user