be77f1eb2f
Sister to s8n/production-deb. Edge-box config + provision script for
running the OpenBSD-edge role per s8n/production-setup-audit Topology 02.
v0.1 = stock OpenBSD install ISO (interactive, 5 min) + scripted provision
from onyx. Autoinstall ISO build deferred to v0.2.
Layout:
README.md workflow + service mapping (Debian → OpenBSD)
flash.sh burn stock install76.iso to USB
etc/ pf / relayd / acme-client / unbound /
hostname.wg0.example / sshd_config / doas.conf
scripts/
provision.sh from onyx: SSH+git clone+run install.sh
install.sh on edge: copy /etc/*, validate, restart, cron
cert-renew-check.sh weekly LE renewal
read-logs.sh pull /var/log/* for offline diagnostics
docs/
setup-checklist.md 7-phase first-time install walkthrough
Hardware target: Dell Precision T5600 per
s8n/production-setup-audit/hardware/dell-t5600.md
WG mesh: 10.10.10.0/29 between edge (.1) and nullstone (.2). UDP 51820.
Keys generated per-host (NEVER committed to repo).
Public traffic flow after migration:
Internet → router → edge T5600 (relayd TLS term) → wg0 →
nullstone Traefik (10.10.10.2:8443, private only)
CVE delta vs single-host Debian: regreSSHion + xz backdoor mitigated;
public IP runs OpenBSD base only — no systemd, no glibc, no Docker.
16 lines
731 B
Bash
Executable file
16 lines
731 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# flash.sh — flash stock OpenBSD install ISO to USB
|
|
# Usage: ./flash.sh /dev/sdX
|
|
set -euo pipefail
|
|
DEV="${1:-}"
|
|
[[ -n "$DEV" && -b "$DEV" ]] || { echo "Usage: $0 /dev/sdX"; exit 1; }
|
|
case "$DEV" in /dev/nvme*|/dev/sda|/dev/mmcblk*|/dev/vd*) echo "ERR: refusing internal $DEV" >&2; exit 2;; esac
|
|
URL="https://cdn.openbsd.org/pub/OpenBSD/7.6/amd64/install76.iso"
|
|
ISO=/tmp/install76.iso
|
|
[[ -f "$ISO" ]] || { echo "[*] downloading $URL"; curl -fL -o "$ISO" "$URL"; }
|
|
echo "About to flash $ISO -> $DEV. Type yes:"
|
|
read -r ANS; [[ "$ANS" == "yes" ]] || exit 1
|
|
sudo dd if="$ISO" of="$DEV" bs=4M status=progress conv=fsync oflag=direct
|
|
sudo sync
|
|
sudo eject "$DEV"
|
|
echo "EJECTED — pull, plug into edge box, install"
|