| FROM ubuntu:bionic | |
| LABEL org.opencontainers.image.authors="Victor Seva <[email protected]>" | |
| # Important! Update this no-op ENV variable when this Dockerfile | |
| # is updated with the current date. It will force refresh of all | |
| # of the base images and things like 'apt-get update' won't be using | |
| # old cached versions when the Dockerfile is built. | |
| ENV REFRESHED_AT=2024-11-11 | |
| RUN rm -rf /var/lib/apt/lists/* && apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -qq --assume-yes gnupg wget apt-transport-https |
| [toplevel] | |
| whoami = sts get-caller-identity | |
| create-assume-role = | |
| !f() { | |
| aws iam create-role --role-name "${1}" \ | |
| --assume-role-policy-document \ | |
| "{\"Statement\":[{\ | |
| \"Action\":\"sts:AssumeRole\",\ |
This took me some time to figure out so writing it down for posterity.
Setting up Rundeck in AWS running on Amazon Linux 2 using RPM install: https://docs.rundeck.com/docs/administration/install/linux-rpm.html
JRE runtime using AWS Corretto 8: https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/amazon-linux-install.html
DB Backend using Aurora MySQL Serverless v2. Create rundeck user/pass.
| #!/bin/bash | |
| sudo mkdir /tmp/ssm | |
| cd /tmp/ssm | |
| wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb | |
| sudo dpkg -i amazon-ssm-agent.deb | |
| sudo systemctl enable amazon-ssm-agent | |
| rm amazon-ssm-agent.deb |
| provider "aws" { | |
| region = "eu-west-1" | |
| } | |
| provider "aws" { | |
| alias = "central" | |
| region = "eu-central-1" | |
| } | |
| resource "aws_iam_role" "replication" { |
| ~/.aws/config: | |
| [profile account1] | |
| region = us-east-1 | |
| output = json | |
| [profile account2] | |
| region = us-east-1 | |
| output = json | |
| role_arn = arn:aws:iam::<account1_number>:role/<role_name> | |
| source_profile = account1 |
| # BEGIN: Add proxy to RCE service | |
| ProxyRequests Off | |
| ProxyPreserveHost On | |
| <Proxy *> | |
| Order deny,allow | |
| Deny from all | |
| Allow from all | |
| </Proxy> | |
| <LocationMatch "/rce"> | |
| ProxyPass http://127.0.0.1:3000 keepalive=On |
| server { | |
| listen 80; | |
| server_name _; | |
| root /var/canvas/public; | |
| charset utf-8; | |
| include mime.types; | |
| default_type application/octet-stream; | |
| access_log /var/log/nginx/canvas.access.log; | |
| error_log /var/log/nginx/canvas.error.log; | |
| passenger_enabled on; |
| #!/bin/bash | |
| # Configuration | |
| IPTABLES_CONF=/etc/iptables/rules.v4 | |
| GITHUB_IPS=/var/tmp/github-ips | |
| GITHUB_BEGIN="^# GITHUB BEGINS$" | |
| GITHUB_END="^# GITHUB ENDS$" | |
| if ! [ -x "$(command -v jq)" ]; then | |
| echo "Cannot find 'jq' in your PATH, exiting..." |
| [23/41]: configure dirsrv ccache | |
| [24/41]: enabling SASL mapping fallback | |
| [25/41]: restarting directory server | |
| [26/41]: creating DS keytab | |
| [27/41]: ignore time skew for initial replication | |
| [28/41]: setting up initial replication | |
| Starting replication, please wait until this has completed. | |
| Update in progress, 4 seconds elapsedNo status yet | |
| No status yet | |
| No status yet |
