project_tunnelfin/init.sh

#!/bin/bash

#Run as normal user


#Wireguard config check
if [[ $(ls | grep 'wg0.conf') ]]; then
  echo 'Wireguard config found continuing'
else
  echo 'No Wireguard config found please place in home directory'
  exit 78
fi

#Nginx Repo setup
echo '[#] Installing pre-requisites'
sudo apt install -y curl gnupg2 ca-certificates lsb-release debian-archive-keyring git  > /dev/null
echo '[#] NGINX Repo setup' 
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg  > /dev/null
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/debian `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list  > /dev/null
echo '[#] Updating APT cache'
sudo apt update  > /dev/null

#Crowdsec Repo setup
echo '[#] Crowdsec Repo setup'
curl -s https://install.crowdsec.net | sudo sh  > /dev/null

#Package install
echo '[#] Installing packages'
sudo apt install -y iptables nginx crowdsec crowdsec-firewall-bouncer-iptables resolvconf wireguard avahi-daemon > /dev/null

#rsyslog setup
echo '[#] syslog forwarder setup'
sudo apt install -y rsyslog
echo '*.* @10.0.100.34:514' | sudo tee --append /etc/rsyslog.conf > /dev/null
sudo systemctl enable rsyslog
sudo systemctl start rsyslog

#Crowdsec setup
echo '[#] Enroling endpoint into Crowdsec console'
sudo cscli console enroll -e context clz7m6x9o0003jo08v8g6lm0v

#Add authorized keys to user matthew
echo '[#] Adding ssh keys'
mkdir ~/.ssh
curl http://git.lan.fisherhome.xyz/matthew/project_tunnelfin/raw/branch/main/authorized_keys > ~/.ssh/authorized_keys

#Start wireguard service
echo '[#] Starting Wireguard service'
sudo systemctl enable --now wg-quick@wg0

#Setup iptables
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT
#iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
#iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
#iptables -P INPUT DROP
#iptables -P OUTPUT DROP

#Setup Avahi
sudo systemctl start avahi-daemon
sudo systemctl enable avahi-daemon

#Setup Nginx
sudo apt install -y lua5.1 libnginx-mod-http-lua luarocks gettext-base lua-cjson
sudo apt install -y crowdsec-nginx-bouncer
curl http://git.lan.fisherhome.xyz/matthew/project_tunnelfin/raw/branch/main/ > /etc/nginx/conf.d/jellyfin.conf
sudo rm /etc/nginx/conf.d/default.conf
sudo systemctl restart nginx
sudo systemctl enable nginx

#Setup Telegraf
wget -q https://repos.influxdata.com/influxdata-archive_compat.key
echo '393e8779c89ac8d958f81f942f9ad7fb82a25e133faddaf92e15b16e6ac9ce4c influxdata-archive_compat.key' | sha256sum -c && cat influxdata-archive_compat.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/influxdata-archive_compat.gpg > /dev/null
echo 'deb [signed-by=/etc/apt/trusted.gpg.d/influxdata-archive_compat.gpg] https://repos.influxdata.com/debian stable main' | sudo tee /etc/apt/sources.list.d/influxdata.list

sudo apt-get update && sudo apt-get install telegraf