BastilleBSD/bastille
2
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

Cleanup whitespace

Browse Source
This commit is contained in:
Marius van Witzenburg
2020-04-14 11:52:29 +02:00
parent 0ed07b4ee2
commit f28054b47e
47 changed files with 245 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/Makefile
View File

@@ -16,4 +16,4 @@ help:
# Catch-all target: route all unknown targets to Sphinx using the new
# "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS).
%: Makefile
@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

15
docs/chapters/jail-config.rst
View File

@@ -45,7 +45,7 @@ devfs_ruleset
effective and enforce_statfs is set to a value lower than 2.
Devfs rules and rulesets cannot be viewed or modified from inside
a jail.
NOTE: It is important that only appropriate device nodes in devfs
be exposed to a jail; access to disk devices in the jail may
permit processes in the jail to bypass the jail sandboxing by
@@ -178,13 +178,13 @@ cases.
The kernel runs with five different security levels. Any super-user
process can raise the level, but no process can lower it. The security
levels are:
-1 Permanently insecure mode - always run the system in insecure mode.
This is the default initial value.
0 Insecure mode - immutable and append-only flags may be turned off.
All devices may be read or written subject to their permissions.
1 Secure mode - the system immutable and system append-only flags may
not be turned off; disks for mounted file systems, /dev/mem and
/dev/kmem may not be opened for writing; /dev/io (if your platform
@@ -192,18 +192,17 @@ cases.
not be loaded or unloaded. The kernel debugger may not be entered
using the debug.kdb.enter sysctl. A panic or trap cannot be forced
using the debug.kdb.panic and other sysctl's.
2 Highly secure mode - same as secure mode, plus disks may not be
opened for writing (except by mount(2)) whether mounted or not.
This level precludes tampering with file systems by unmounting
them, but also inhibits running newfs(8) while the system is multi-
user.
In addition, kernel time changes are restricted to less than or
equal to one second. Attempts to change the time by more than this
will log the message "Time adjustment clamped to +1 second".
3 Network secure mode - same as highly secure mode, plus IP packet
filter rules (see ipfw(8), ipfirewall(4) and pfctl(8)) cannot be
changed and dummynet(4) or pf(4) configuration cannot be adjusted.

12
docs/chapters/networking.rst
View File

@@ -95,20 +95,20 @@ Create the firewall rules:
.. code-block:: shell
ext_if="vtnet0"
set block-policy return
scrub in on $ext_if all fragment reassemble
set skip on lo
table <jails> persist
nat on $ext_if from <jails> to any -> ($ext_if)
## static rdr example
## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
## dynamic rdr anchor (see below)
rdr-anchor "rdr/*"
block in all
pass out quick modulate state
antispoof for $ext_if inet
@@ -127,7 +127,7 @@ to containers are:
.. code-block:: shell
nat on $ext_if from <jails> to any -> ($ext_if)
## static rdr example
## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
@@ -141,7 +141,7 @@ containers at `10.17.89.45`.
## dynamic rdr anchor (see below)
rdr-anchor "rdr/*"
The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
`bastille rdr` command at runtime - eg.
bastille rdr <jail> tcp 2001 22 # Redirects tcp port 2001 on host to 22 on jail
@@ -150,7 +150,7 @@ The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
bastille rdr <jail> clear # Clear dynamic rdr rules
Note that if you are redirecting ports where the host is also listening
(eg. ssh) you should make sure that the host service is not listening on
(eg. ssh) you should make sure that the host service is not listening on
the cloned interface - eg. for ssh set sshd_flags in rc.conf
sshd_flags="-o ListenAddress=<hostname>"

2
docs/chapters/subcommands/bootstrap.rst
View File

@@ -25,7 +25,7 @@ To `bootstrap` a release, run the bootstrap sub-command with the
release version as the argument.
.. code-block:: shell
ishmael ~ # bastille bootstrap 11.3-RELEASE [update]
ishmael ~ # bastille bootstrap 12.0-RELEASE
ishmael ~ # bastille bootstrap 12.1-RELEASE

10
docs/chapters/subcommands/console.rst
View File

@@ -9,25 +9,25 @@ root login.
ishmael ~ # bastille console folsom
[folsom]:
FreeBSD 12.1-RELEASE-p1 GENERIC
Welcome to FreeBSD!
Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories: https://www.FreeBSD.org/security/
FreeBSD Handbook: https://www.FreeBSD.org/handbook/
FreeBSD FAQ: https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums: https://forums.FreeBSD.org/
Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with: pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.
Show the version of FreeBSD installed: freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages: man man
FreeBSD directory layout: man hier
Edit /etc/motd to change this login announcement.
root@folsom:~ #

10
docs/chapters/subcommands/cp.rst
View File

@@ -7,15 +7,15 @@ This command allows efficiently copying files from host to container(s).
ishmael ~ # bastille cp ALL /tmp/resolv.conf-cf etc/resolv.conf
[bastion]:
[unbound0]:
[unbound1]:
[squid]:
[nginx]:
[folsom]:
Unless you see errors reported in the output the `cp` was successful.

2
docs/chapters/subcommands/create.rst
View File

@@ -13,7 +13,7 @@ bootstrapped release and a private (rfc1918) IP address.
.. code-block:: shell
ishmael ~ # bastille create folsom 11.3-RELEASE 10.17.89.10 [interface]
RELEASE: 11.3-RELEASE.
NAME: folsom.
IP: 10.17.89.10.

2
docs/chapters/subcommands/htop.rst
View File

@@ -2,7 +2,7 @@
htop
====
This one runs `htop` inside the container.
This one runs `htop` inside the container.
note: won't work if you don't have htop installed in the container.

26
docs/chapters/subcommands/pkg.rst
View File

@@ -23,7 +23,7 @@ To manage binary packages within the container use `bastille pkg`.
All repositories are up to date.
Updating database digests format: 100%
The following 10 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
vim-console: 8.1.0342
git-lite: 2.19.1
@@ -35,12 +35,12 @@ To manage binary packages within the container use `bastille pkg`.
pcre: 8.42
gettext-runtime: 0.19.8.1_1
indexinfo: 0.3.1
Number of packages to be installed: 10
The process will require 77 MiB more space.
17 MiB to be downloaded.
Proceed with this action? [y/N]: y
[folsom] [1/10] Fetching vim-console-8.1.0342.txz: 100% 5 MiB 5.8MB/s 00:01
[folsom] [2/10] Fetching git-lite-2.19.1.txz: 100% 4 MiB 2.1MB/s 00:02
@@ -77,7 +77,7 @@ To manage binary packages within the container use `bastille pkg`.
[folsom] [9/10] Extracting git-lite-2.19.1: 100%
[folsom] [10/10] Installing zsh-5.6.2...
[folsom] [10/10] Extracting zsh-5.6.2: 100%
The PKG sub-command can, of course, do more than just `install`. The
expectation is that you can fully leverage the pkg manager. This means,
@@ -97,7 +97,7 @@ expectation is that you can fully leverage the pkg manager. This means,
Processing candidates (1 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.
[unbound0]:
Updating pkg.bastillebsd.org repository catalogue...
[unbound0] Fetching meta.txz: 100% 560 B 0.6kB/s 00:01
@@ -109,7 +109,7 @@ expectation is that you can fully leverage the pkg manager. This means,
Processing candidates (0 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.
[unbound1]:
Updating pkg.bastillebsd.org repository catalogue...
[unbound1] Fetching meta.txz: 100% 560 B 0.6kB/s 00:01
@@ -121,7 +121,7 @@ expectation is that you can fully leverage the pkg manager. This means,
Processing candidates (0 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.
[squid]:
Updating pkg.bastillebsd.org repository catalogue...
[squid] Fetching meta.txz: 100% 560 B 0.6kB/s 00:01
@@ -133,7 +133,7 @@ expectation is that you can fully leverage the pkg manager. This means,
Processing candidates (0 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.
[nginx]:
Updating pkg.bastillebsd.org repository catalogue...
[nginx] Fetching meta.txz: 100% 560 B 0.6kB/s 00:01
@@ -144,14 +144,14 @@ expectation is that you can fully leverage the pkg manager. This means,
Checking for upgrades (1 candidates): 100%
Processing candidates (1 candidates): 100%
The following 1 package(s) will be affected (of 0 checked):
Installed packages to be UPGRADED:
nginx-lite: 1.14.0_14,2 -> 1.14.1,2
Number of packages to be upgraded: 1
315 KiB to be downloaded.
Proceed with this action? [y/N]: y
[nginx] [1/1] Fetching nginx-lite-1.14.1,2.txz: 100% 315 KiB 322.8kB/s 00:01
Checking integrity... done (0 conflicting)

10
docs/chapters/subcommands/rdr.rst
View File

@@ -3,12 +3,12 @@ rdr
===
`bastille rdr` allows you to configure dynamic rdr rules for your containers
without modifying pf.conf (assuming you are using the `bastille0` interface
for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf
without modifying pf.conf (assuming you are using the `bastille0` interface
for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf
as described in the Networking section).
Note: you need to be careful if host services are configured to run
on all interfaces as this will include the jail interface - you should
Note: you need to be careful if host services are configured to run
on all interfaces as this will include the jail interface - you should
sepcify the interface they run on in rc.conf (or other config files)
.. code-block:: shell
@@ -24,5 +24,3 @@ sepcify the interface they run on in rc.conf (or other config files)
rdr on em0 inet proto udp from any to any port = 2053 -> 10.17.89.1 port 53
# bastille rdr dev1 clear
nat cleared

2
docs/chapters/subcommands/restart.rst
View File

@@ -8,6 +8,6 @@ To restart a container you can use the `bastille restart` command.
ishmael ~ # bastille restart folsom
[folsom]:
folsom: removed
[folsom]:
folsom: created

2
docs/chapters/subcommands/top.rst
View File

@@ -2,7 +2,7 @@
top
===
This one runs `top` in that container.
This one runs `top` in that container.
.. image:: ../../images/top.png

4
docs/chapters/subcommands/update.rst
View File

@@ -16,7 +16,7 @@ If no updates are available, a message will be shown:
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.
No updates needed to update system to 11.2-RELEASE-p4.
No updates are available to install.
@@ -34,7 +34,7 @@ The older the release, however, the more updates will be available:
Fetching 2 metadata files... done.
Inspecting system... done.
Preparing to download files... done.
The following files will be added as part of updating to 10.4-RELEASE-p13:
...[snip]...

1
docs/chapters/subcommands/upgrade.rst
View File

@@ -8,4 +8,3 @@ workflow this can be similar to a `bootstrap`.
.. code-block:: shell
ishmael ~ # bastille upgrade 11.2-RELEASE 12.0-RELEASE

24
docs/chapters/targeting.rst
View File

@@ -25,23 +25,23 @@ Examples: Containers
| command | target | args | description |
+===========+========+==================+=============================================================+
| cmd | ALL | 'sockstat -4' | execute `sockstat -4` in ALL containers (ip4 sockets) |
+-----------+--------+-----+------------+-------------------------------------------------------------+
+-----------+--------+-----+------------+-------------------------------------------------------------+
| console | mariadb02 | --- | console (shell) access to mariadb02 |
+----+------+----+---------+------------+--------------+----------------------------------------------+
+----+------+----+---------+------------+--------------+----------------------------------------------+
| pkg | web01 | 'install nginx' | install nginx package in web01 container |
+-----------+--------+------------------+-------------------------------------------------------------+
| pkg | ALL | upgrade | upgrade packages in ALL containers |
+-----------+--------+------------------+-------------------------------------------------------------+
+-----------+--------+------------------+-------------------------------------------------------------+
| pkg | ALL | audit | (CVE) audit packages in ALL containers |
+-----------+--------+------------------+-------------------------------------------------------------+
+-----------+--------+------------------+-------------------------------------------------------------+
| sysrc | web01 | nginx_enable=YES | execute `sysrc nginx_enable=YES` in web01 container |
+-----------+--------+------------------+-------------------------------------------------------------+
+-----------+--------+------------------+-------------------------------------------------------------+
| template | ALL | username/base | apply `username/base` template to ALL containers |
+-----------+--------+------------------+-------------------------------------------------------------+
+-----------+--------+------------------+-------------------------------------------------------------+
| start | web02 | --- | start web02 container |
+-----------+--------+-----+------------+-------------------------------------------------------------+
+-----------+--------+-----+------------+-------------------------------------------------------------+
| cp | bastion03 | /tmp/resolv.conf-cf etc/resolv.conf | copy host-path to container-path in bastion03|
+----+------+----+---+------------------+--------------+----------------------------------------------+
+----+------+----+---+------------------+--------------+----------------------------------------------+
| create | folsom | 12.0-RELEASE 10.17.89.10 | create 12.0 container named `folsom` with IP |
+-----------+--------+------------------+--------------+----------------------------------------------+
@@ -57,10 +57,10 @@ Examples: Releases
| command | target | args | description |
+===========+==============+==============+=============================================================+
| bootstrap | 12.0-RELEASE | --- | bootstrap 12.0-RELEASE release |
+-----------+--------------+--------------+-------------------------------------------------------------+
+-----------+--------------+--------------+-------------------------------------------------------------+
| update | 11.3-RELEASE | --- | update 11.2-RELEASE release |
+-----------+--------------+--------------+-------------------------------------------------------------+
+-----------+--------------+--------------+-------------------------------------------------------------+
| upgrade | 11.2-RELEASE | 11.3-RELEASE | update 11.2-RELEASE release |
+-----------+--------------+--------------+-------------------------------------------------------------+
+-----------+--------------+--------------+-------------------------------------------------------------+
| verify | 11.3-RELEASE | --- | update 11.2-RELEASE release |
+-----------+--------------+--------------+-------------------------------------------------------------+
+-----------+--------------+--------------+-------------------------------------------------------------+

3
docs/chapters/template.rst
View File

@@ -115,7 +115,7 @@ directory names in the `bastille/templates` directory.
Executing final command(s).
chsh: user information updated
Template Complete.
[web01]:
Copying files...
Copy complete.
@@ -143,4 +143,3 @@ directory names in the `bastille/templates` directory.
Executing final command(s).
chsh: user information updated
Template Complete.

6
docs/chapters/usage.rst
View File

@@ -6,10 +6,10 @@ Usage
ishmael ~ # bastille -h
Bastille is an open-source system for automating deployment and management of
containerized applications on FreeBSD.
Usage:
bastille command [ALL|glob] [args]
Available Commands:
bootstrap Bootstrap a FreeBSD release for container base.
cmd Execute arbitrary command on targeted container(s).
@@ -32,6 +32,6 @@ Usage
upgrade Upgrade container release to X.Y-RELEASE.
verify Compare release against a "known good" index.
zfs Manage (get|set) zfs attributes on targeted container(s).
Use "bastille -v|--version" for version information.
Use "bastille command -h|--help" for more information about a command.