Initial commit
Signed-off-by: root <root@dreamon.rixotstudio.cz>
This commit is contained in:
root
commit
5682fe1229
|
|
@ -0,0 +1,33 @@
|
|||
# shellcheck shell=bash # Krey: Paludis doesn't expect shebang here
|
||||
# shellcheck disable=SC2034 # Krey: Appears unused is invalid since this is recognized by paludis
|
||||
|
||||
COMMON_FLAGS="-O2 -march=sandybridge -pipe"
|
||||
|
||||
i686_pc_linux_gnu_CFLAGS="$COMMON_FLAGS"
|
||||
i686_pc_linux_gnu_CXXFLAGS="$COMMON_FLAGS"
|
||||
|
||||
x86_64_pc_linux_gnu_CFLAGS="$COMMON_FLAGS"
|
||||
x86_64_pc_linux_gnu_CXXFLAGS="$COMMON_FLAGS"
|
||||
|
||||
i686_pc_linux_gnu_FFLAGS="$COMMON_FLAGS"
|
||||
x86_64_PC_linux_gnu_FFLAGS="$COMMON_FLAGS"
|
||||
|
||||
i686_pc_linux_gnu_FCLAGS="$COMMON_FLAGS"
|
||||
x86_64_PC_linux_gnu_FCLAGS="$COMMON_FLAGS"
|
||||
|
||||
i686_pc_linux_gnu_FDFLAGS="-Wl,-O2 -Wl, -pthread -lpthread"
|
||||
x86_64_pc_linux_gnu_FDFLAGS="-Wl,-O2 -Wl, -pthread -lpthread"
|
||||
|
||||
CHOST="x86_64-pc-linux-gnu"
|
||||
CBUILD="x86_64-pc-linux-gnu"
|
||||
|
||||
# Stratum
|
||||
# NOTICE(KREY): This breaks the runtime on sydbox violation
|
||||
#PALUDIS_TMPDIR="/bedrock/strata/exherbo/var/tmp/paludis/"
|
||||
|
||||
# FIXME: Investigate
|
||||
#RUSTFLAGS="-C target-cpu=native -C opt-level=3"
|
||||
|
||||
export PALUDIS_PATCHDIR="$ROOT/etc/paludis/paludis"
|
||||
|
||||
. "${PALUDIS_DIR:-/etc/paludis}/libs/shell/sysconf.bash"
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
root = "/bedrock/strata/exherbo/"
|
||||
world = "$root/etc/paludis/world"
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
Directory used to inject code in paludis's phases
|
||||
|
||||
https://paludis.exherbo.org/configuration/hooks.html
|
||||
|
|
@ -0,0 +1 @@
|
|||
This is a configuration directory for the bind package which is what is running the DNS server
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
# The bind.keys file is used to override the built-in DNSSEC trust anchors
|
||||
# which are included as part of BIND 9. The only trust anchors it contains
|
||||
# are for the DNS root zone ("."). Trust anchors for any other zones MUST
|
||||
# be configured elsewhere; if they are configured here, they will not be
|
||||
# recognized or used by named.
|
||||
#
|
||||
# To use the built-in root key, set "dnssec-validation auto;" in the
|
||||
# named.conf options, or else leave "dnssec-validation" unset. If
|
||||
# "dnssec-validation" is set to "yes", then the keys in this file are
|
||||
# ignored; keys will need to be explicitly configured in named.conf for
|
||||
# validation to work. "auto" is the default setting, unless named is
|
||||
# built with "configure --disable-auto-validation", in which case the
|
||||
# default is "yes".
|
||||
#
|
||||
# This file is NOT expected to be user-configured.
|
||||
#
|
||||
# Servers being set up for the first time can use the contents of this file
|
||||
# as initializing keys; thereafter, the keys in the managed key database
|
||||
# will be trusted and maintained automatically.
|
||||
#
|
||||
# These keys are current as of Mar 2019. If any key fails to initialize
|
||||
# correctly, it may have expired. In that event you should replace this
|
||||
# file with a current version. The latest version of bind.keys can always
|
||||
# be obtained from ISC at https://www.isc.org/bind-keys.
|
||||
#
|
||||
# See https://data.iana.org/root-anchors/root-anchors.xml for current trust
|
||||
# anchor information for the root zone.
|
||||
|
||||
trust-anchors {
|
||||
# This key (20326) was published in the root zone in 2017.
|
||||
. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
|
||||
+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
|
||||
ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
|
||||
0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
|
||||
oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
|
||||
RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
|
||||
R1AkUTV74bU=";
|
||||
};
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
;; Can be tested using clear; named-checkzone rixotstudio.cz rixotstudio.cz
|
||||
$TTL 3600
|
||||
$ORIGIN rixotstudio.cz.
|
||||
@ IN SOA (
|
||||
ns1.rixotstudio.cz. ; MNAME
|
||||
hostmaster.rixotstudio.cz. ; RNAME
|
||||
2020042100 ; SERIAL
|
||||
8H ; REFRESH
|
||||
2H ; RETRY
|
||||
1W ; EXPIRY
|
||||
2H ; MINIMUM Negative Cache TTL
|
||||
)
|
||||
;; NS
|
||||
@ 300 IN NS dreamon.rixotstudio.cz.
|
||||
@ 3600 IN NS ns.wedos.cz.
|
||||
@ 3600 IN NS ns.wedos.net.
|
||||
@ 3600 IN NS ns.wedos.eu.
|
||||
@ 3600 IN NS ns.wedos.com.
|
||||
;; DEFAULT
|
||||
rixotstudio.cz IN CNAME dreamon.rixotstudio.cz
|
||||
mail.rixotstudio.cz. IN MX 10 dreamon.rixotstudio.cz.
|
||||
openpgpkey.rixotstudio.cz. IN CNAME wkd.keys.openpgp.org.
|
||||
;rixotstudio.cz. IN DS 8837 13 2 <DIGEST>
|
||||
;; DREAMON
|
||||
dreamon.rixotstudio.cz. IN A 78.102.113.209
|
||||
mail.dreamon.rixotstudio.cz. 3600 IN MX 10 dreamon.rixotstudio.cz.
|
||||
smtp.dreamon.rixotstudio.cz IN CNAME dreamon.rixotstudio.cz.
|
||||
smtps.dreamon.rixotstudio.cz IN CNAME dreamon.rixotstudio.cz.
|
||||
imap.dreamon.rixotstudio.cz IN CNAME dreamon.rixotstudio.cz.
|
||||
imaps.dreamon.rixotstudio.cz IN CNAME dreamon.rixotstudio.cz.
|
||||
pop3.dreamon.rixotstudio.cz IN CNAME dreamon.rixotstudio.cz.
|
||||
pop3s.dreamon.rixotstudio.cz IN CNAME dreamon.rixotstudio.cz.
|
||||
;2020._domainkey.dreamon.rixotstudio.cz. 120 IN TXT "v=DKIM1; n=\"dreamon\"; h=rsa-sha256; k=rsa; s=email; p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr/UtumdfuHcGPMUmV/ilYtHZ8yoG4n6G29krAH4/6abcpthr0JMMJhb7yImfRa4yupZPOI6sggMPZNy2vBf89VkLJpf+PT9kZ9Dtbwi0xcRkwO3x5emhZ+DQsEvbZPkakP5qrGIORjWTpPQuit3QN716gwtV+TCnMWT3vF+A+Wz1qiC2DsINg2b45XZYclIIngmhR3YVq17Oai rb8fH24F/plNUQICr7VzI4RQNG8qJhCmcnLt8x1kThoNxX1c1FufUPacTNTUlu2sflUDKUEF+MUq/ng3NaXzyySkpEkeU3j9d3CG+BEfJitBFwEgdJoy7LvpHmjKZDb7ImIG4w8wPlBDorlVwi2Wtj6RsqS7NV7vm4FZ1vkbgA8/xmRbpV6kaz9tG1emKwnu+/8BMNUhzMDxrAta1aYgqR3w1EGId7OWuh7WW57uFOTnlnbzWSb+yo8Paf 8MbpUpYOYLWx8xsbgCqIGYrO8OuaLEqBEDHG7i1FoXUX5wmKM4ouuSsDxA9blce1pO2i7M6MnuO90X/404hptWt6EvTapilXcZb89ktbLvisxS+EcaINJTA0yZNVdfnp38b6uClbYNeCa3jx2C9t70FMwTWdmV1yiBB1bz265vo09dERefLPCHNauG5JQoRbUgDRQeCD1EiQebBdg71XmTRgeZH4CRIyg00CAwEAAQ=="
|
||||
_adsp._domainkey.dreamon.rixotstudio.cz. 3600 IN TXT "dkim=all"
|
||||
_dmarc.dreamon.rixotstudio.cz. 3600 IN TXT "v=DMARC1,p=quarantine,sp=quarantine,pct=100,rua=mailto:dmarc-report@rixotstudio.cz!20m,ruf=mailto:authfail@rixotstudio.cz!20m,adkim=r,aspf=r,fo=1,rf=afrf"
|
||||
dreamon.rixotstudio.cz. 3600 IN TXT "v=spf1 a:dreamon.rixotstudio.cz ip4:78.102.113.209 -all"
|
||||
;; LEONID
|
||||
leonid.rixotstudio.cz. IN A 94.113.123.218
|
||||
mail.leonid.rixotstudio.cz. 3600 IN MX 10 leonid.rixotstudio.cz.
|
||||
smtp.leonid.rixotstudio.cz. IN CNAME leonid.rixotstudio.cz.
|
||||
smtps.leonid.rixotstudio.cz. IN CNAME leonid.rixotstudio.cz.
|
||||
imap.leonid.rixotstudio.cz. IN CNAME leonid.rixotstudio.cz.
|
||||
imaps.leonid.rixotstudio.cz. IN CNAME leonid.rixotstudio.cz.
|
||||
pop3.leonid.rixotstudio.cz. IN CNAME leonid.rixotstudio.cz.
|
||||
pop3s.leonid.rixotstudio.cz. IN CNAME leonid.rixotstudio.cz.
|
||||
;; ROGISEK
|
||||
rogisek IN A 94.113.123.218
|
||||
mail.rogisek.rixotstudio.cz. 3600 IN MX 10 rogisek.rixotstudio.cz.
|
||||
smtp.rogisek.rixotstudio.cz. IN CNAME rogisek.rixotstudio.cz.
|
||||
smtps.rogisek.rixotstudio.cz. IN CNAME rogisek.rixotstudio.cz.
|
||||
imap.rogisek.rixotstudio.cz. IN CNAME rogisek.rixotstudio.cz.
|
||||
imaps.rogisek.rixotstudio.cz. IN CNAME rogisek.rixotstudio.cz.
|
||||
pop3.rogisek.rixotstudio.cz. IN CNAME rogisek.rixotstudio.cz.
|
||||
pop3s.rogisek.rixotstudio.cz. IN CNAME rogisek.rixotstudio.cz.
|
||||
|
||||
;; Security challenge
|
||||
_acme-challenge.dreamon.rixotstudio.cz. IN TXT "EjzaayF_SqOHaWLhgzYiNKXkCoWaxGz75VgIw8BeFlU"
|
||||
_acme-challenge.imap.dreamon.rixotstudio.cz. IN TXT "tJfxA2ebY8Lt93-danryaPrI7JZynaqvHbFLOCGLVzI"
|
||||
_acme-challenge.imap.rixotstudio.cz. IN TXT "NhFFlS-CYCXKGFOqmr69ypqRts4rgLUf5qVW4VPEl0E"
|
||||
_acme-challenge.imaps.dreamon.rixotstudio.cz. IN TXT "H4JBnbAuk-pIfNsOy43W56r90Pb6mq_636HjhfVP1_g"
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
options {
|
||||
// Krey: Set directory for bind
|
||||
directory "/bedrock/strata/exherbo/var/bind";
|
||||
|
||||
// Krey: Sets Random Device
|
||||
random-device "/dev/random";
|
||||
|
||||
// uncomment the following lines to turn on DNS forwarding,
|
||||
// and change the forwarding ip address(es) :
|
||||
//forward first;
|
||||
//forwarders {
|
||||
// 123.123.123.123;
|
||||
// 123.123.123.123;
|
||||
//};
|
||||
|
||||
listen-on-v6 { none; };
|
||||
listen-on { 127.0.0.1; };
|
||||
|
||||
// to allow only specific hosts to use the DNS server:
|
||||
//allow-query {
|
||||
// 127.0.0.1;
|
||||
//};
|
||||
|
||||
// if you have problems and are behind a firewall:
|
||||
//query-source address * port 53;
|
||||
pid-file "/bedrock/strata/exherbo/run/named/named.pid";
|
||||
};
|
||||
|
||||
// Briefly, a zone which has been declared delegation-only will be effectively
|
||||
// limited to containing NS RRs for subdomains, but no actual data beyond its
|
||||
// own apex (for example, its SOA RR and apex NS RRset). This can be used to
|
||||
// filter out "wildcard" or "synthesized" data from NAT boxes or from
|
||||
// authoritative name servers whose undelegated (in-zone) data is of no
|
||||
// interest.
|
||||
// See http://www.isc.org/products/BIND/delegation-only.html for more info
|
||||
|
||||
zone "rixotstudio.cz" {
|
||||
type master;
|
||||
file "/bedrock/strata/exherbo/etc/bind/master/rixotstudio.cz";
|
||||
allow-transfer {
|
||||
// Current Server IP
|
||||
78.102.113.209;
|
||||
// Secondary DNS IP - nic.cz (wedos.cz)
|
||||
46.28.104.66;
|
||||
};
|
||||
allow-update { 78.102.113.209; };
|
||||
key-directory "/bedrock/strata/exherbo/var/cache/bind/keys/rixotstudio.cz";
|
||||
inline-signing yes;
|
||||
auto-dnssec maintain;
|
||||
serial-update-method unixtime;
|
||||
};
|
||||
|
||||
zone "COM" { type delegation-only; };
|
||||
zone "NET" { type delegation-only; };
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.cache";
|
||||
};
|
||||
|
||||
zone "localhost" IN {
|
||||
type master;
|
||||
file "pri/localhost.zone";
|
||||
allow-update { none; };
|
||||
notify no;
|
||||
};
|
||||
|
||||
zone "127.in-addr.arpa" IN {
|
||||
type master;
|
||||
file "pri/127.zone";
|
||||
allow-update { none; };
|
||||
notify no;
|
||||
};
|
||||
|
|
@ -0,0 +1,617 @@
|
|||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
/*
|
||||
* This is a worthless, nonrunnable example of a named.conf file that has
|
||||
* every conceivable syntax element in use. We use it to test the parser.
|
||||
* It could also be used as a conceptual template for users of new features.
|
||||
*/
|
||||
|
||||
/*
|
||||
* C-style comments are OK
|
||||
*/
|
||||
|
||||
// So are C++-style comments
|
||||
|
||||
# So are shell-style comments
|
||||
|
||||
// watch out for ";" -- it's important!
|
||||
|
||||
options {
|
||||
additional-from-auth true;
|
||||
additional-from-cache false;
|
||||
|
||||
version "my version string";
|
||||
random-device "/dev/random";
|
||||
directory "/tmp";
|
||||
|
||||
port 666;
|
||||
|
||||
sig-validity-interval 33;
|
||||
|
||||
# Obsolete
|
||||
named-xfer "/usr/libexec/named-xfer"; // _PATH_XFER
|
||||
|
||||
dump-file "named_dump.db"; // _PATH_DUMPFILE
|
||||
pid-file "/var/run/named.pid"; // _PATH_PIDFILE
|
||||
statistics-file "named.stats"; // _PATH_STATS
|
||||
memstatistics-file "named.memstats"; // _PATH_MEMSTATS
|
||||
|
||||
max-cache-ttl 999;
|
||||
min-cache-ttl 66;
|
||||
auth-nxdomain yes; // always set AA on NXDOMAIN.
|
||||
// don't set this to 'no' unless
|
||||
// you know what you're doing -- older
|
||||
// servers won't like it.
|
||||
|
||||
# Obsolete
|
||||
deallocate-on-exit no;
|
||||
|
||||
dialup yes;
|
||||
|
||||
# Obsolete
|
||||
fake-iquery no;
|
||||
|
||||
fetch-glue yes;
|
||||
has-old-clients yes;
|
||||
host-statistics no;
|
||||
|
||||
# Obsolete
|
||||
multiple-cnames no; // if yes, then a name my have more
|
||||
// than one CNAME RR. This use
|
||||
// is non-standard and is not
|
||||
// recommended, but it is available
|
||||
// because previous releases supported
|
||||
// it and it was used by large sites
|
||||
// for load balancing.
|
||||
|
||||
notify yes; // send NOTIFY messages. You can set
|
||||
// notify on a zone-by-zone
|
||||
// basis in the "zone" statement
|
||||
// see (below)
|
||||
recursion yes;
|
||||
rfc2308-type1 no;
|
||||
|
||||
# Obsolete
|
||||
use-id-pool yes;
|
||||
|
||||
# Obsolete
|
||||
treat-cr-as-space yes;
|
||||
|
||||
also-notify { 10.0.2.3; };
|
||||
|
||||
// The "forward" option is only meaningful if you've defined
|
||||
// forwarders. "first" gives the normal BIND
|
||||
// forwarding behavior, i.e. ask the forwarders first, and if that
|
||||
// doesn't work then do the full lookup. You can also say
|
||||
// "forward only;" which is what used to be specified with
|
||||
// "slave" or "options forward-only". "only" will never attempt
|
||||
// a full lookup; only the forwarders will be used.
|
||||
forward first;
|
||||
forwarders {
|
||||
1.2.3.4;
|
||||
5.6.7.8;
|
||||
};
|
||||
|
||||
check-names master fail;
|
||||
check-names slave warn;
|
||||
check-names response ignore;
|
||||
|
||||
allow-query { any; };
|
||||
allow-transfer { any; };
|
||||
allow-recursion { !any; };
|
||||
blackhole { 45/24; };
|
||||
keep-response-order { 46/24; };
|
||||
|
||||
listen-on {
|
||||
10/24;
|
||||
10.0.0.3;
|
||||
};
|
||||
|
||||
listen-on port 53 { any; };
|
||||
|
||||
listen-on { 5.6.7.8; };
|
||||
|
||||
listen-on port 1234 {
|
||||
!1.2.3.4;
|
||||
1.2.3/24;
|
||||
};
|
||||
|
||||
listen-on-v6 {
|
||||
1:1:1:1:1:1:1:1;
|
||||
};
|
||||
|
||||
listen-on-v6 port 777 {
|
||||
2:2:2:2:2:2:2:2;
|
||||
};
|
||||
|
||||
query-source-v6 address 8:7:6:5:4:3:2:1 port *;
|
||||
query-source port * address 10.0.0.54 ;
|
||||
|
||||
lame-ttl 444;
|
||||
|
||||
max-transfer-time-in 300;
|
||||
max-transfer-time-out 10;
|
||||
max-transfer-idle-in 100;
|
||||
max-transfer-idle-out 11;
|
||||
|
||||
max-retry-time 1234;
|
||||
min-retry-time 1111;
|
||||
max-refresh-time 888;
|
||||
min-refresh-time 777;
|
||||
|
||||
max-ncache-ttl 333;
|
||||
min-ncache-ttl 22;
|
||||
min-roots 15;
|
||||
serial-queries 34;
|
||||
|
||||
transfer-format one-answer;
|
||||
|
||||
transfers-in 10;
|
||||
transfers-per-ns 2;
|
||||
transfers-out 0;
|
||||
|
||||
transfer-source 10.0.0.5;
|
||||
transfer-source-v6 4:3:2:1:5:6:7:8;
|
||||
|
||||
request-ixfr yes;
|
||||
provide-ixfr yes;
|
||||
|
||||
# Now called 'provide-ixfr'
|
||||
# maintain-ixfr-base no; // If yes, keep transaction log file for IXFR
|
||||
|
||||
max-ixfr-log-size 20m;
|
||||
coresize 100;
|
||||
datasize 101;
|
||||
files 230;
|
||||
max-cache-size 1m;
|
||||
stacksize 231;
|
||||
heartbeat-interval 1001;
|
||||
interface-interval 1002;
|
||||
statistics-interval 1003;
|
||||
|
||||
topology {
|
||||
10/8;
|
||||
|
||||
!1.2.3/24;
|
||||
|
||||
{ 1.2/16; 3/8; };
|
||||
|
||||
|
||||
};
|
||||
|
||||
sortlist { 10/8; 11/8; };
|
||||
|
||||
tkey-domain "foo.com";
|
||||
tkey-dhkey "xyz" 666 ;
|
||||
|
||||
rrset-order {
|
||||
class IN type A name "foo" order random;
|
||||
order cyclic;
|
||||
};
|
||||
};
|
||||
|
||||
/*
|
||||
* Control listeners, for "ndc". Every nameserver needs at least one.
|
||||
*/
|
||||
controls {
|
||||
// 'inet' lines without a 'port' defaults to 'port 953'
|
||||
// 'keys' must be used and the list must have at least one entry
|
||||
inet * port 52 allow { any; } keys { "key2"; };
|
||||
unix "/var/run/ndc" perm 0600 owner 0 group 0; // ignored by named.
|
||||
inet 10.0.0.1 allow { any; key foo; } keys { "key4";};
|
||||
inet 10.0.0.2 allow { none; } keys { "key-1"; "key-2"; };
|
||||
inet 10.0.0.2 allow { none; };
|
||||
};
|
||||
|
||||
zone "master.demo.zone" {
|
||||
type master; // what used to be called "primary"
|
||||
database "somedb -option1 -option2 arg1 arg2 arg3";
|
||||
file "master.demo.zone";
|
||||
check-names fail;
|
||||
allow-update { none; };
|
||||
allow-update-forwarding { 10.0.0.5; !any; };
|
||||
allow-transfer { any; };
|
||||
allow-query { any; };
|
||||
sig-validity-interval 990;
|
||||
notify explicit;
|
||||
also-notify { 1.0.0.1; }; // don't notify any nameservers other
|
||||
// than those on the NS list for this
|
||||
// zone
|
||||
forward first;
|
||||
forwarders { 10.0.0.3; 1:2:3:4:5:6:7:8; };
|
||||
};
|
||||
|
||||
zone "slave.demo.zone" {
|
||||
type slave; // what used to be called "secondary"
|
||||
file "slave.demo.zone";
|
||||
ixfr-base "slave.demo.zone.ixfr"; // File name for IXFR transaction log file
|
||||
masters {
|
||||
1.2.3.4 port 10 key "foo"; // where to zone transfer from
|
||||
5.6.7.8;
|
||||
6.7.8.9 key "zippo";
|
||||
};
|
||||
transfer-source 10.0.0.53; // fixes multihoming problems
|
||||
check-names warn;
|
||||
allow-update { none; };
|
||||
allow-transfer { any; };
|
||||
allow-update-forwarding { any; };
|
||||
allow-query { any; };
|
||||
max-transfer-time-in 120; // if not set, global option is used.
|
||||
max-transfer-time-out 1; // if not set, global option is used.
|
||||
max-transfer-idle-in 2; // if not set, global option is used.
|
||||
max-transfer-idle-out 3; // if not set, global option is used.
|
||||
also-notify { 1.0.0.2; };
|
||||
forward only;
|
||||
forwarders { 10.45.45.45; 10.0.0.3; 1:2:3:4:5:6:7:8; };
|
||||
};
|
||||
|
||||
key "non-viewkey" { secret "YWFh" ; algorithm "zzz" ; };
|
||||
|
||||
view "test-view" in {
|
||||
key "viewkey" { algorithm "xxx" ; secret "eXl5" ; };
|
||||
also-notify { 10.2.2.3; };
|
||||
managed-keys {
|
||||
foo.com. static 4 3 2 "abdefghijklmnopqrstuvwxyz";
|
||||
};
|
||||
sig-validity-interval 45;
|
||||
max-cache-size 100000;
|
||||
allow-query { 10.0.0.30;};
|
||||
additional-from-cache false;
|
||||
additional-from-auth no;
|
||||
match-clients { 10.0.0.1 ; };
|
||||
check-names master warn;
|
||||
check-names slave ignore;
|
||||
check-names response fail;
|
||||
auth-nxdomain false;
|
||||
recursion true;
|
||||
provide-ixfr false;
|
||||
request-ixfr true;
|
||||
fetch-glue true;
|
||||
notify false;
|
||||
rfc2308-type1 false;
|
||||
transfer-source 10.0.0.55;
|
||||
transfer-source-v6 4:3:8:1:5:6:7:8;
|
||||
query-source port * address 10.0.0.54 ;
|
||||
query-source-v6 address 6:6:6:6:6:6:6:6 port *;
|
||||
max-transfer-time-out 45;
|
||||
max-transfer-idle-out 55;
|
||||
min-roots 3;
|
||||
lame-ttl 477;
|
||||
max-ncache-ttl 333;
|
||||
max-cache-ttl 777;
|
||||
transfer-format many-answers;
|
||||
max-retry-time 7;
|
||||
min-retry-time 4;
|
||||
max-refresh-time 999;
|
||||
min-refresh-time 111;
|
||||
|
||||
zone "view-zone.com" {
|
||||
type master;
|
||||
allow-update-forwarding { 10.0.0.34;};
|
||||
file "view-zone-master";
|
||||
};
|
||||
|
||||
server 5.6.7.8 {
|
||||
keys "viewkey";
|
||||
};
|
||||
|
||||
server 10.9.8.7 {
|
||||
keys "non-viewkey";
|
||||
};
|
||||
dialup yes;
|
||||
};
|
||||
|
||||
|
||||
zone "stub.demo.zone" {
|
||||
type stub; // stub zones are like slave zones,
|
||||
// except that only the NS records
|
||||
// are transferred.
|
||||
dialup yes;
|
||||
file "stub.demo.zone";
|
||||
masters {
|
||||
1.2.3.4 ; // where to zone transfer from
|
||||
5.6.7.8 port 999;
|
||||
};
|
||||
check-names warn;
|
||||
allow-update { none; };
|
||||
allow-transfer { any; };
|
||||
allow-query { any; };
|
||||
|
||||
max-retry-time 10;
|
||||
min-retry-time 11;
|
||||
max-refresh-time 12;
|
||||
min-refresh-time 13;
|
||||
|
||||
max-transfer-time-in 120; // if not set, global option is used.
|
||||
pubkey 257 255 1 "a useless key";
|
||||
pubkey 257 255 1 "another useless key";
|
||||
};
|
||||
|
||||
zone "." {
|
||||
type hint; // used to be specified w/ "cache"
|
||||
file "cache.db";
|
||||
// pubkey 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
|
||||
};
|
||||
|
||||
managed-keys {
|
||||
"." static 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
|
||||
};
|
||||
|
||||
|
||||
acl can_query { !1.2.3/24; any; }; // network 1.2.3.0 mask 255.255.255.0
|
||||
// is disallowed; rest are OK
|
||||
acl can_axfr { 1.2.3.4; can_query; }; // host 1.2.3.4 and any host allowed
|
||||
// by can_query are OK
|
||||
|
||||
zone "disabled-zone.com" {
|
||||
type master;
|
||||
file "bar";
|
||||
|
||||
max-retry-time 100;
|
||||
min-retry-time 110;
|
||||
max-refresh-time 120;
|
||||
min-refresh-time 130;
|
||||
};
|
||||
|
||||
zone "non-default-acl.demo.zone" {
|
||||
type master;
|
||||
file "foo";
|
||||
allow-query { can_query; };
|
||||
allow-transfer { can_axfr; };
|
||||
allow-update {
|
||||
1.2.3.4;
|
||||
5.6.7.8;
|
||||
};
|
||||
pubkey 666 665 664 "key of the beast";
|
||||
// Errors trapped by parser:
|
||||
// identity or name not absolute
|
||||
// 'wildcard' match type and no wildcard character in name
|
||||
//
|
||||
// issues:
|
||||
// - certain rdatatype values (such as "key") are config file keywords and
|
||||
// must be quoted or a syntax error will occur.
|
||||
//
|
||||
|
||||
update-policy {
|
||||
grant root.domain. subdomain host.domain. A MX CNAME;
|
||||
grant sub.root.domain. wildcard *.host.domain. A;
|
||||
grant root.domain. name host.domain. a ns md mf cname soa mb mg
|
||||
mr "null" wks ptr hinfo minfo mx txt rp afsdb x25
|
||||
isdn rt nsap sig "key" px gpos aaaa loc nxt srv naptr kx
|
||||
cert a6 dname opt unspec uri tkey tsig ;
|
||||
grant foo.bar.com. self foo.bar.com. a;
|
||||
};
|
||||
};
|
||||
|
||||
key sample_key { // for TSIG; supported by parser
|
||||
algorithm hmac-md5; // but not yet implemented in the
|
||||
secret "eW91ciBzZWNyZXQgaGVyZQ=="; // rest of the server
|
||||
};
|
||||
|
||||
key key2 {
|
||||
algorithm hmac-md5;
|
||||
secret "ZXJlaCB0ZXJjZXMgcm91eQ==";
|
||||
};
|
||||
|
||||
acl key_acl { key sample_key; }; // a request signed with sample_key
|
||||
|
||||
server 1.2.3.4 {
|
||||
request-ixfr no;
|
||||
provide-ixfr no;
|
||||
bogus no; // if yes, we won't query or listen
|
||||
// to this server
|
||||
transfer-format one-answer; // set transfer format for this
|
||||
// server (see the description of
|
||||
// 'transfer-format' above)
|
||||
// if not specified, the global option
|
||||
// will be used
|
||||
transfers 0; // not implemented
|
||||
keys { "sample_key" }; // for TSIG; supported by the parser
|
||||
// but not yet implemented in the
|
||||
// rest of the server
|
||||
# Now called 'request-ixfr'
|
||||
# support-ixfr yes; // for IXFR supported by server
|
||||
// if yes, the listed server talks IXFR
|
||||
};
|
||||
|
||||
logging {
|
||||
/*
|
||||
* All log output goes to one or more "channels"; you can make as
|
||||
* many of them as you want.
|
||||
*/
|
||||
|
||||
channel syslog_errors { // this channel will send errors or
|
||||
syslog user; // or worse to syslog (user facility)
|
||||
severity error;
|
||||
};
|
||||
|
||||
channel stderr_errors {
|
||||
stderr;
|
||||
};
|
||||
|
||||
/*
|
||||
* Channels have a severity level. Messages at severity levels
|
||||
* greater than or equal to the channel's level will be logged on
|
||||
* the channel. In order of decreasing severity, the levels are:
|
||||
*
|
||||
* critical a fatal error
|
||||
* error
|
||||
* warning
|
||||
* notice a normal, but significant event
|
||||
* info an informational message
|
||||
* debug 1 the least detailed debugging info
|
||||
* ...
|
||||
* debug 99 the most detailed debugging info
|
||||
*/
|
||||
|
||||
/*
|
||||
* Here are the built-in channels:
|
||||
*
|
||||
* channel default_syslog {
|
||||
* syslog daemon;
|
||||
* severity info;
|
||||
* };
|
||||
*
|
||||
* channel default_debug {
|
||||
* file "named.run"; // note: stderr is used instead
|
||||
* // of "named.run" if the server
|
||||
* // is started with the "-f"
|
||||
* // option.
|
||||
* severity dynamic; // this means log debugging
|
||||
* // at whatever debugging level
|
||||
* // the server is at, and don't
|
||||
* // log anything if not
|
||||
* // debugging.
|
||||
* };
|
||||
*
|
||||
* channel null { // this is the bit bucket;
|
||||
* file "/dev/null"; // any logging to this channel
|
||||
* // is discarded.
|
||||
* };
|
||||
*
|
||||
* channel default_stderr { // writes to stderr
|
||||
* file "<stderr>"; // this is illustrative only;
|
||||
* // there's currently no way
|
||||
* // of saying "stderr" in the
|
||||
* // configuration language.
|
||||
* // i.e. don't try this at home.
|
||||
* severity info;
|
||||
* };
|
||||
*
|
||||
* default_stderr only works before the server daemonizes (i.e.
|
||||
* during initial startup) or when it is running in foreground
|
||||
* mode (-f command line option).
|
||||
*/
|
||||
|
||||
/*
|
||||
* There are many categories, so you can send the logs
|
||||
* you want to see wherever you want, without seeing logs you
|
||||
* don't want. Right now the categories are
|
||||
*
|
||||
* default the catch-all. many things still
|
||||
* aren't classified into categories, and
|
||||
* they all end up here. also, if you
|
||||
* don't specify any channels for a
|
||||
* category, the default category is used
|
||||
* instead.
|
||||
* config high-level configuration file
|
||||
* processing
|
||||
* parser low-level configuration file processing
|
||||
* queries what used to be called "query logging"
|
||||
* lame-servers messages like "Lame server on ..."
|
||||
* statistics
|
||||
* panic if the server has to shut itself
|
||||
* down due to an internal problem, it
|
||||
* logs the problem here (as well as
|
||||
* in the problem's native category)
|
||||
* update dynamic update
|
||||
* ncache negative caching
|
||||
* xfer-in zone transfers we're receiving
|
||||
* xfer-out zone transfers we're sending
|
||||
* db all database operations
|
||||
* eventlib debugging info from the event system
|
||||
* (see below)
|
||||
* packet dumps of packets received and sent
|
||||
* (see below)
|
||||
* notify the NOTIFY protocol
|
||||
* cname messages like "XX points to a CNAME"
|
||||
* security approved/unapproved requests
|
||||
* os operating system problems
|
||||
* insist consistency check failures
|
||||
* maintenance periodic maintenance
|
||||
* load zone loading
|
||||
* response-checks messages like
|
||||
* "Malformed response ..."
|
||||
* "wrong ans. name ..."
|
||||
* "unrelated additional info ..."
|
||||
* "invalid RR type ..."
|
||||
* "bad referral ..."
|
||||
*/
|
||||
|
||||
category parser {
|
||||
syslog_errors; // you can log to as many channels
|
||||
default_syslog; // as you want
|
||||
};
|
||||
|
||||
category lame-servers { null; }; // don't log these at all
|
||||
|
||||
channel moderate_debug {
|
||||
file "foo"; // foo
|
||||
severity debug 3; // level 3 debugging to file
|
||||
print-time yes; // timestamp log entries
|
||||
print-category yes; // print category name
|
||||
print-severity yes; // print severity level
|
||||
/*
|
||||
* Note that debugging must have been turned on either
|
||||
* on the command line or with a signal to get debugging
|
||||
* output (non-debugging output will still be written to
|
||||
* this channel).
|
||||
*/
|
||||
};
|
||||
|
||||
channel another {
|
||||
file "bar" versions 99 size 10M;
|
||||
severity info;
|
||||
};
|
||||
|
||||
channel third {
|
||||
file "bar" size 100000 versions unlimited;
|
||||
severity debug; // use default debug level
|
||||
};
|
||||
|
||||
/*
|
||||
* If you don't want to see "zone XXXX loaded" messages but do
|
||||
* want to see any problems, you could do the following.
|
||||
*/
|
||||
channel no_info_messages {
|
||||
syslog;
|
||||
severity notice;
|
||||
};
|
||||
|
||||
category load { no_info_messages; };
|
||||
|
||||
/*
|
||||
* You can also define category "default"; it gets used when no
|
||||
* "category" statement has been given for a category.
|
||||
*/
|
||||
category default {
|
||||
default_syslog;
|
||||
moderate_debug;
|
||||
};
|
||||
|
||||
/*
|
||||
* If you don't define category default yourself, the default
|
||||
* default category will be used. It is
|
||||
*
|
||||
* category default { default_syslog; default_debug; };
|
||||
*/
|
||||
|
||||
/*
|
||||
* If you don't define category panic yourself, the default
|
||||
* panic category will be used. It is
|
||||
*
|
||||
* category panic { default_syslog; default_stderr; };
|
||||
*/
|
||||
|
||||
/*
|
||||
* Two categories, 'packet' and 'eventlib', are special. Only one
|
||||
* channel may be assigned to each of them, and it must be a
|
||||
* file channel. If you don't define them yourself, they default to
|
||||
*
|
||||
* category eventlib { default_debug; };
|
||||
*
|
||||
* category packet { default_debug; };
|
||||
*/
|
||||
};
|
||||
|
||||
#include "filename"; // can't do within a statement
|
||||
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
# $OpenBSD: ssh_config,v 1.35 2020/07/17 03:43:42 dtucker Exp $
|
||||
|
||||
# This is the ssh client system-wide configuration file. See
|
||||
# ssh_config(5) for more information. This file provides defaults for
|
||||
# users, and the values can be changed in per-user configuration files
|
||||
# or on the command line.
|
||||
|
||||
# Configuration data is parsed as follows:
|
||||
# 1. command line options
|
||||
# 2. user-specific file
|
||||
# 3. system-wide file
|
||||
# Any configuration value is only changed the first time it is set.
|
||||
# Thus, host-specific definitions should be at the beginning of the
|
||||
# configuration file, and defaults at the end.
|
||||
|
||||
# Site-wide defaults for some commonly used options. For a comprehensive
|
||||
# list of available options, their meanings and defaults, please see the
|
||||
# ssh_config(5) man page.
|
||||
|
||||
Host *
|
||||
# ForwardAgent no
|
||||
# ForwardX11 no
|
||||
# PasswordAuthentication yes
|
||||
# HostbasedAuthentication no
|
||||
# GSSAPIAuthentication no
|
||||
# GSSAPIDelegateCredentials no
|
||||
# BatchMode no
|
||||
# CheckHostIP yes
|
||||
# AddressFamily any
|
||||
# ConnectTimeout 0
|
||||
# StrictHostKeyChecking ask
|
||||
# IdentityFile ~/.ssh/id_rsa
|
||||
# IdentityFile ~/.ssh/id_dsa
|
||||
# IdentityFile ~/.ssh/id_ecdsa
|
||||
# IdentityFile ~/.ssh/id_ed25519
|
||||
Port 22
|
||||
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
|
||||
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com
|
||||
# EscapeChar ~
|
||||
# Tunnel no
|
||||
# TunnelDevice any:any
|
||||
# PermitLocalCommand no
|
||||
# VisualHostKey no
|
||||
# ProxyCommand ssh -q -W %h:%p gateway.example.com
|
||||
# RekeyLimit 1G 1h
|
||||
# UserKnownHostsFile ~/.ssh/known_hosts.d/%k
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
### SECURITY CHECKLIST
|
||||
## - [X] Use standard port 22 for SSH
|
||||
Port 22
|
||||
|
||||
## - [X] Require pubkey and then password authentication
|
||||
AuthenticationMethods publickey,password
|
||||
|
||||
## - [ ] Disable root login
|
||||
# FIXME-SECURITY(Krey): Brainstorm since we are using it for deployment
|
||||
PermitRootLogin yes
|
||||
|
||||
## - [X] Require publickey authentification
|
||||
PubkeyAuthentication yes
|
||||
# SECURITY-WARNING(Krey): Do not use 'ssh-rsa' since that is using md5sum to verify the signature which is insecure!
|
||||
PubkeyAcceptedKeyTypes rsa-sha2-512
|
||||
# FIXME-SECURITY: There are methods that may require multiple layers of authentification -> Investigate
|
||||
# FIXME: Invalid
|
||||
#AuthentificationMethods publickey
|
||||
# Just to ensure that ssh is usinc publickey at all cost
|
||||
# FIXME: Invalid
|
||||
#PreferredAuthentications publickey
|
||||
|
||||
## - [ ] Do not allow empty passwords
|
||||
# FIXME: Invalid
|
||||
#PermitEmptyPassowrds no
|
||||
|
||||
## - [X] Set Maximum connections attempts
|
||||
# FIXME: Investigate fail2ban
|
||||
# NOTICE(Krey): We are using publickey so this should be set to 1, if there is required a second attempt for pubkey authentication then there is something wrong going on
|
||||
MaxAuthTries 1
|
||||
|
||||
## - [X] Set Maximum allowed sessions
|
||||
MaxSessions 5
|
||||
|
||||
## - [ ] Disconnect the users after 5 minutes
|
||||
# FIXME: Help-wanted
|
||||
# ConnectTimeout ?
|
||||
# ForwardX11Timeout ?
|
||||
|
||||
## - [ ] Add various counter-measures for brute-force attacks
|
||||
# FIXME: Help-wanted
|
||||
|
||||
## - [ ] Disable X11
|
||||
# FIXME: Invalid
|
||||
#ForwardX11 no
|
||||
|
||||
## - [ ] Capture failed login attemps and implement remote logging to capture security issues
|
||||
# FIXME: Help-wanted
|
||||
|
||||
## - [ ] Check integrity of critical files using checksum
|
||||
# FIXME: Needs to be implemented
|
||||
|
||||
# Logging
|
||||
# FIXME
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
Nickname Dreamon
|
||||
ContactInfo 0x765AED304211C28410D5C478FCBA0482B0AB9F10 Jacob Hrbek <kreyren@rixotstudio.cz>
|
||||
NumCPUs 8
|
||||
SocksPort 9050
|
||||
ORPort 9001
|
||||
|
||||
# Set up SSH Daemon to run through Tor
|
||||
HiddenServiceDir /var/lib/tor/sshd/
|
||||
HiddenServicePort 22 127.0.0.1:22
|
||||
|
||||
# SMTP
|
||||
HiddenServiceDir /var/lib/tor/smtp
|
||||
HiddenServicePort 995 127.0.0.1:25
|
||||
|
||||
# IMAP
|
||||
HiddenServiceDir /var/lib/tor/imap
|
||||
HiddenServicePort 143 127.0.0.1:143
|
||||
|
||||
# POP3
|
||||
HiddenServiceDir /var/lib/tor/pop3
|
||||
HiddenServicePort 110 127.0.0.1:110
|
||||
|
||||
# Submission
|
||||
HiddenServiceDir /var/lib/tor/submission
|
||||
HiddenServicePort 587 127.0.0.1:587
|
||||
|
||||
# SMTPS
|
||||
HiddenServiceDir /var/lib/tor/smtps
|
||||
HiddenServicePort 465 127.0.0.1:465
|
||||
|
||||
# IMAPS
|
||||
HiddenServiceDir /var/lib/tor/imaps
|
||||
HiddenServicePort 993 127.0.0.1:993
|
||||
|
||||
# POP3S
|
||||
HiddenServiceDir /var/lib/tor/pop3s
|
||||
HiddenServicePort 995 127.0.0.1:995
|
||||
|
||||
# Include configuration for hidden_mx
|
||||
# NOTICE(Krey): OnionMX requires more research and is currently disabled
|
||||
#%include /etc/tor/torrc.d/hidden_mx
|
||||
|
||||
# To provide informations about this relay to public
|
||||
# FIXME: Verify that we can use this as an exit node, then uncomment
|
||||
#DirPortFrontPage /etc/tor//tor-exit-notice.html
|
||||
|
||||
# FIXME: Verify that ISP doesn't log the traffic
|
||||
ExitRelay 0
|
||||
|
||||
# FIXME(Krey): Value autodetected by tor -> requires logic
|
||||
maxMemInQueues 5960 MB
|
||||
|
||||
# Setup Bandwidth limiters
|
||||
RelayBandwidthRate 125 KB # Throttle traffic to 125KB/s 1000kbps)
|
||||
RelayBandwidthBurst 375 KB # But allow bursts up to 375KB/s (3000kbps)
|
||||
|
||||
# DNS
|
||||
DNSPort 5400
|
||||
|
||||
# To provide informations about this relay to public
|
||||
# FIXME: Verify that we can use this as an exit node, then uncomment
|
||||
#DirPortFrontPage /etc/tor//tor-exit-notice.html
|
||||
|
|
@ -0,0 +1,315 @@
|
|||
# Global OpenRC configuration settings
|
||||
|
||||
# Set to "YES" if you want the rc system to try and start services
|
||||
# in parallel for a slight speed improvement. When running in parallel we
|
||||
# prefix the service output with its name as the output will get
|
||||
# jumbled up.
|
||||
# WARNING: whilst we have improved parallel, it can still potentially lock
|
||||
# the boot process. Don't file bugs about this unless you can supply
|
||||
# patches that fix it without breaking other things!
|
||||
rc_parallel="YES"
|
||||
|
||||
# Set rc_interactive to "YES" and you'll be able to press the I key during
|
||||
# boot so you can choose to start specific services. Set to "NO" to disable
|
||||
# this feature. This feature is automatically disabled if rc_parallel is
|
||||
# set to YES.
|
||||
#rc_interactive="YES"
|
||||
|
||||
# If we need to drop to a shell, you can specify it here.
|
||||
# If not specified we use $SHELL, otherwise the one specified in /etc/passwd,
|
||||
# otherwise /bin/sh
|
||||
# Linux users could specify /sbin/sulogin
|
||||
#rc_shell=/bin/sh
|
||||
|
||||
# Do we allow any started service in the runlevel to satisfy the dependency
|
||||
# or do we want all of them regardless of state? For example, if net.eth0
|
||||
# and net.eth1 are in the default runlevel then with rc_depend_strict="NO"
|
||||
# both will be started, but services that depend on 'net' will work if either
|
||||
# one comes up. With rc_depend_strict="YES" we would require them both to
|
||||
# come up.
|
||||
#rc_depend_strict="YES"
|
||||
|
||||
# rc_hotplug controls which services we allow to be hotplugged.
|
||||
# A hotplugged service is one started by a dynamic dev manager when a matching
|
||||
# hardware device is found.
|
||||
# Hotplugged services appear in the "hotplugged" runlevel.
|
||||
# If rc_hotplug is set to any value, we compare the name of this service
|
||||
# to every pattern in the value, from left to right, and we allow the
|
||||
# service to be hotplugged if it matches a pattern, or if it matches no
|
||||
# patterns. Patterns can include shell wildcards.
|
||||
# To disable services from being hotplugged, prefix patterns with "!".
|
||||
#If rc_hotplug is not set or is empty, all hotplugging is disabled.
|
||||
# Example - rc_hotplug="net.wlan !net.*"
|
||||
# This allows net.wlan and any service not matching net.* to be hotplugged.
|
||||
# Example - rc_hotplug="!net.*"
|
||||
# This allows services that do not match "net.*" to be hotplugged.
|
||||
|
||||
# rc_logger launches a logging daemon to log the entire rc process to
|
||||
# /var/log/rc.log
|
||||
# NOTE: Linux systems require the devfs service to be started before
|
||||
# logging can take place and as such cannot log the sysinit runlevel.
|
||||
rc_logger="YES"
|
||||
|
||||
# Through rc_log_path you can specify a custom log file.
|
||||
# The default value is: /var/log/rc.log
|
||||
rc_log_path="/var/log/openrc.log"
|
||||
|
||||
# If you want verbose output for OpenRC, set this to yes. If you want
|
||||
# verbose output for service foo only, set it to yes in /etc/conf.d/foo.
|
||||
#rc_verbose=no
|
||||
|
||||
# By default we filter the environment for our running scripts. To allow other
|
||||
# variables through, add them here. Use a * to allow all variables through.
|
||||
#rc_env_allow="VAR1 VAR2"
|
||||
|
||||
# By default we assume that all daemons will start correctly.
|
||||
# However, some do not - a classic example is that they fork and return 0 AND
|
||||
# then child barfs on a configuration error. Or the daemon has a bug and the
|
||||
# child crashes. You can set the number of milliseconds start-stop-daemon
|
||||
# waits to check that the daemon is still running after starting here.
|
||||
# The default is 0 - no checking.
|
||||
#rc_start_wait=100
|
||||
|
||||
# rc_nostop is a list of services which will not stop when changing runlevels.
|
||||
# This still allows the service itself to be stopped when called directly.
|
||||
#rc_nostop=""
|
||||
|
||||
# rc will attempt to start crashed services by default.
|
||||
# However, it will not stop them by default as that could bring down other
|
||||
# critical services.
|
||||
#rc_crashed_stop=NO
|
||||
#rc_crashed_start=YES
|
||||
|
||||
# Set rc_nocolor to yes if you do not want colors displayed in OpenRC
|
||||
# output.
|
||||
#rc_nocolor=NO
|
||||
|
||||
##############################################################################
|
||||
# MISC CONFIGURATION VARIABLES
|
||||
# There variables are shared between many init scripts
|
||||
|
||||
# Set unicode to YES to turn on unicode support for keyboards and screens.
|
||||
# SECURITY-NOTICE(Krey): No need for unicode support and to avoid unexpected behavior
|
||||
#unicode="NO"
|
||||
|
||||
# This is how long fuser should wait for a remote server to respond. The
|
||||
# default is 60 seconds, but it can be adjusted here.
|
||||
#rc_fuser_timeout=60
|
||||
|
||||
# Below is the default list of network fstypes.
|
||||
#
|
||||
# afs ceph cifs coda davfs fuse fuse.sshfs gfs glusterfs lustre ncpfs
|
||||
# nfs nfs4 ocfs2 shfs smbfs
|
||||
#
|
||||
# If you would like to add to this list, you can do so by adding your
|
||||
# own fstypes to the following variable.
|
||||
#extra_net_fs_list=""
|
||||
|
||||
##############################################################################
|
||||
# SERVICE CONFIGURATION VARIABLES
|
||||
# These variables are documented here, but should be configured in
|
||||
# /etc/conf.d/foo for service foo and NOT enabled here unless you
|
||||
# really want them to work on a global basis.
|
||||
# If your service has characters in its name which are not legal in
|
||||
# shell variable names and you configure the variables for it in this
|
||||
# file, those characters should be replaced with underscores in the
|
||||
# variable names as shown below.
|
||||
|
||||
# Some daemons are started and stopped via start-stop-daemon.
|
||||
# We can set some things on a per service basis, like the nicelevel.
|
||||
#SSD_NICELEVEL="-19"
|
||||
# Or the ionice level. The format is class[:data] , just like the
|
||||
# --ionice start-stop-daemon parameter.
|
||||
#SSD_IONICELEVEL="2:2"
|
||||
|
||||
# Pass ulimit parameters
|
||||
# If you are using bash in POSIX mode for your shell, note that the
|
||||
# ulimit command uses a block size of 512 bytes for the -c and -f
|
||||
# options
|
||||
#rc_ulimit="-u 30"
|
||||
|
||||
# It's possible to define extra dependencies for services like so
|
||||
#rc_config="/etc/foo"
|
||||
#rc_need="openvpn"
|
||||
#rc_use="net.eth0"
|
||||
#rc_after="clock"
|
||||
#rc_before="local"
|
||||
#rc_provide="!net"
|
||||
|
||||
# You can also enable the above commands here for each service. Below is an
|
||||
# example for service foo.
|
||||
#rc_foo_config="/etc/foo"
|
||||
#rc_foo_need="openvpn"
|
||||
#rc_foo_after="clock"
|
||||
|
||||
# Below is an example for service foo-bar. Note that the '-' is illegal
|
||||
# in a shell variable name, so we convert it to an underscore.
|
||||
# example for service foo-bar.
|
||||
#rc_foo_bar_config="/etc/foo-bar"
|
||||
#rc_foo_bar_need="openvpn"
|
||||
#rc_foo_bar_after="clock"
|
||||
|
||||
# You can also remove dependencies.
|
||||
# This is mainly used for saying which services do NOT provide net.
|
||||
#rc_net_tap0_provide="!net"
|
||||
|
||||
# This is the subsystem type.
|
||||
# It is used to match against keywords set by the keyword call in the
|
||||
# depend function of service scripts.
|
||||
#
|
||||
# It should be set to the value representing the environment this file is
|
||||
# PRESENTLY in, not the virtualization the environment is capable of.
|
||||
# If it is commented out, automatic detection will be used.
|
||||
#
|
||||
# The list below shows all possible settings as well as the host
|
||||
# operating systems where they can be used and autodetected.
|
||||
#
|
||||
# "" - nothing special
|
||||
# "docker" - Docker container manager (Linux)
|
||||
# "jail" - Jail (DragonflyBSD or FreeBSD)
|
||||
# "lxc" - Linux Containers
|
||||
# "openvz" - Linux OpenVZ
|
||||
# "prefix" - Prefix
|
||||
# "rkt" - CoreOS container management system (Linux)
|
||||
# "subhurd" - Hurd subhurds (to be checked)
|
||||
# "systemd-nspawn" - Container created by systemd-nspawn (Linux)
|
||||
# "uml" - Usermode Linux
|
||||
# "vserver" - Linux vserver
|
||||
# "xen0" - Xen0 Domain (Linux and NetBSD)
|
||||
# "xenU" - XenU Domain (Linux and NetBSD)
|
||||
#rc_sys=""
|
||||
|
||||
# if you use openrc-init, which is currently only available on Linux,
|
||||
# this is the default runlevel to activate after "sysinit" and "boot"
|
||||
# when booting.
|
||||
#rc_default_runlevel="default"
|
||||
|
||||
# on Linux and Hurd, this is the number of ttys allocated for logins
|
||||
# It is used in the consolefont, keymaps, numlock and termencoding
|
||||
# service scripts.
|
||||
rc_tty_number=12
|
||||
|
||||
##############################################################################
|
||||
# LINUX CGROUPS RESOURCE MANAGEMENT
|
||||
|
||||
# This sets the mode used to mount cgroups.
|
||||
# "hybrid" mounts cgroups version 2 on /sys/fs/cgroup/unified and
|
||||
# cgroups version 1 on /sys/fs/cgroup.
|
||||
# "legacy" mounts cgroups version 1 on /sys/fs/cgroup
|
||||
# "unified" mounts cgroups version 2 on /sys/fs/cgroup
|
||||
#rc_cgroup_mode="hybrid"
|
||||
|
||||
# This is a list of controllers which should be enabled for cgroups version 2.
|
||||
# If hybrid mode is being used, controllers listed here will not be
|
||||
# available for cgroups version 1.
|
||||
# This is a global setting.
|
||||
#rc_cgroup_controllers=""
|
||||
|
||||
# This variable contains the cgroups version 2 settings for your services.
|
||||
# If this is set in this file, the settings will apply to all services.
|
||||
# If you want different settings for each service, place the settings in
|
||||
# /etc/conf.d/foo for service foo.
|
||||
# The format is to specify the setting and value followed by a newline.
|
||||
# Multiple settings and values can be specified.
|
||||
# For example, you would use this to set the maximum memory and maximum
|
||||
# number of pids for a service.
|
||||
#rc_cgroup_settings="
|
||||
#memory.max 10485760
|
||||
#pids.max max
|
||||
#"
|
||||
#
|
||||
# For more information about the adjustments that can be made with
|
||||
# cgroups version 2, see Documentation/cgroups-v2.txt in the linux kernel
|
||||
# source tree.
|
||||
#rc_cgroup_settings=""
|
||||
|
||||
# This switch controls whether or not cgroups version 1 controllers are
|
||||
# individually mounted under
|
||||
# /sys/fs/cgroup in hybrid or legacy mode.
|
||||
#rc_controller_cgroups="YES"
|
||||
|
||||
# The following setting turns on the memory.use_hierarchy setting in the
|
||||
# root memory cgroup for cgroups v1.
|
||||
# It must be set to yes in this file if you want this functionality.
|
||||
#rc_cgroup_memory_use_hierarchy="NO"
|
||||
|
||||
# The following settings allow you to set up values for the cgroups version 1
|
||||
# controllers for your services.
|
||||
# They can be set in this file;, however, if you do this, the settings
|
||||
# will apply to all of your services.
|
||||
# If you want different settings for each service, place the settings in
|
||||
# /etc/conf.d/foo for service foo.
|
||||
# The format is to specify the names of the settings followed by their
|
||||
# values. Each variable can hold multiple settings.
|
||||
# For example, you would use this to set the cpu.shares setting in the
|
||||
# cpu controller to 512 for your service.
|
||||
# rc_cgroup_cpu="
|
||||
# cpu.shares 512
|
||||
# "
|
||||
#
|
||||
# For more information about the adjustments that can be made with
|
||||
# cgroups version 1, see Documentation/cgroups-v1/* in the linux kernel
|
||||
# source tree.
|
||||
|
||||
# Set the blkio controller settings for this service.
|
||||
#rc_cgroup_blkio=""
|
||||
|
||||
# Set the cpu controller settings for this service.
|
||||
#rc_cgroup_cpu=""
|
||||
|
||||
# Add this service to the cpuacct controller (any value means yes).
|
||||
#rc_cgroup_cpuacct=""
|
||||
|
||||
# Set the cpuset controller settings for this service.
|
||||
#rc_cgroup_cpuset=""
|
||||
|
||||
# Set the devices controller settings for this service.
|
||||
#rc_cgroup_devices=""
|
||||
|
||||
# Set the hugetlb controller settings for this service.
|
||||
#rc_cgroup_hugetlb=""
|
||||
|
||||
# Set the memory controller settings for this service.
|
||||
#rc_cgroup_memory=""
|
||||
|
||||
# Set the net_cls controller settings for this service.
|
||||
#rc_cgroup_net_cls=""
|
||||
|
||||
# Set the net_prio controller settings for this service.
|
||||
#rc_cgroup_net_prio=""
|
||||
|
||||
# Set the pids controller settings for this service.
|
||||
#rc_cgroup_pids=""
|
||||
|
||||
# Set this to YES if you want all of the processes in a service's cgroup
|
||||
# killed when the service is stopped or restarted.
|
||||
# Be aware that setting this to yes means all of a service's
|
||||
# child processes will be killed. Keep this in mind if you set this to
|
||||
# yes here instead of for the individual services in
|
||||
# /etc/conf.d/<service>.
|
||||
# To perform this cleanup manually for a stopped service, you can
|
||||
# execute cgroup_cleanup with /etc/init.d/<service> cgroup_cleanup or
|
||||
# rc-service <service> cgroup_cleanup.
|
||||
# The process followed in this cleanup is the following:
|
||||
# 1. send stopsig (sigterm if it isn't set) to all processes left in the
|
||||
# cgroup immediately followed by sigcont.
|
||||
# 2. Send sighup to all processes in the cgroup if rc_send_sighup is
|
||||
# yes.
|
||||
# 3. delay for rc_timeout_stopsec seconds.
|
||||
# 4. send sigkill to all processes in the cgroup unless disabled by
|
||||
# setting rc_send_sigkill to no.
|
||||
# rc_cgroup_cleanup="NO"
|
||||
|
||||
# If this is yes, we will send sighup to the processes in the cgroup
|
||||
# immediately after stopsig and sigcont.
|
||||
#rc_send_sighup="NO"
|
||||
|
||||
# This is the amount of time in seconds that we delay after sending sigcont
|
||||
# and optionally sighup, before we optionally send sigkill to all
|
||||
# processes in the # cgroup.
|
||||
# The default is 90 seconds.
|
||||
#rc_timeout_stopsec="90"
|
||||
|
||||
# If this is set to no, we do not send sigkill to all processes in the
|
||||
# cgroup.
|
||||
#rc_send_sigkill="YES"
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
#!/bin/sh
|
||||
# shellcheck shell=sh # Written to be POSIX compatible
|
||||
|
||||
###! Non-standard function used to handle configuration files of compiled target in IMAGE dir prior to merge in the userland
|
||||
###! SYNOPSIS: function-name [CATEGORY/[PN|PNV|PNVR]...
|
||||
###! License: Created by Jacob Hrbek identified by GPG identifier assigned to the electronic mail <kreyren@rixotstudio.cz> based on keyserver <https://keys.openpgp.org> under GPLv3 license <https://www.gnu.org/licenses/gpl-3.0.en.html> in 11/10/2020-EU 09:51:21 CEST
|
||||
###! Bugs-to: https://gitea.com/kreyren/kreyren
|
||||
imgconf() {
|
||||
case "$PALUDIS_DEBUG" in *"func"*) ${SET:-set} -x; esac
|
||||
|
||||
# Krey: Define input
|
||||
package="$1"
|
||||
|
||||
# Krey: Provide name of the hook to be used in the logic
|
||||
hookName="imgconf"
|
||||
|
||||
${EDEBUG:-edebug} func "Starting hook '$hookName'"
|
||||
|
||||
# Krey: Process variables
|
||||
[ -n "$PALUDIS_DIR" ] || PALUDIS_DIR="/etc/paludis/"
|
||||
${EDEBUG:-edebug} var "Variable 'PALUDIS_DIR' assigned value '$PALUDIS_DIR'"
|
||||
|
||||
[ -n "$PALUDIS_PACKAGE_CONFIG_DIR" ] || PALUDIS_PACKAGE_CONFIG_DIR="${PALUDIS_DIR:-/etc/paludis}/$hookName"
|
||||
PPCD="$PALUDIS_PACKAGE_CONFIG_DIR"
|
||||
${EDEBUG:-edebug} var "Variable 'PALUDIS_PACKAGE_CONFIG_DIR' assigned value '$PALUDIS_PACKAGE_CONFIG_DIR'"
|
||||
${EDEBUG:-edebug} var "Variable 'PPCD' assigned value '$PPCD'"
|
||||
|
||||
[ -n "$PALUDIS_PACKAGE_CONFIG_FILE" ] || PALUDIS_PACKAGE_CONFIG_FILE="${PALUDIS_DIR:-/etc/paludis}/$hookName"
|
||||
PPCF="$PALUDIS_PACKAGE_CONFIG_FILE"
|
||||
${EDEBUG:-edebug} var "Variable 'PALUDIS_PACKAGE_CONFIG_FILE' assigned value '$PALUDIS_PACKAGE_CONFIG_FILE'"
|
||||
${EDEBUG:-edebug} var "Variable 'PPCF' assigned value '$PPCF'"
|
||||
|
||||
# Krey: Process input
|
||||
case "$package" in
|
||||
"$CATEGORY/$PN" | "$CATEGORY/$PNV" | "$CATEGORY/$PNVR")
|
||||
if [ -d "$PPCD/$package" ]; then
|
||||
for pathname in "$PPCD"/"$package"/*; do
|
||||
${CP:-cp} -r "$pathname" "$IMAGE" || ${DIE:-die} hookfail "Hook '$hookName' is unable to copy '$pathname' to '$IMAGE'"
|
||||
${DIE:-einfo} hooksuccess "Hook '$hookName' finished processing '$package'"
|
||||
return 0 # paludis-compat
|
||||
done
|
||||
elif [ ! -d "$PPCD/$package" ]; then
|
||||
${DIE:-einfo} hooksuccess "Hook '$hookName' did not find any configuration files in '$PPCD/$package', skipping.."
|
||||
${UNSET:-unset} hookName
|
||||
${RETURNL:-return} 0
|
||||
else
|
||||
${DIE:-die} bug "processing '$PPCD/$CATEGORY/$PN'"
|
||||
fi
|
||||
;;
|
||||
*) ${DIE:-die} syntaxerr "Hook '$hookName' was provided with invalid input: $*"
|
||||
esac
|
||||
|
||||
case "$PALUDIS_DEBUG" in *"func"*) ${SET:-set} +x; esac
|
||||
|
||||
${UNSET:-unset} hookName
|
||||
}
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
# Mask all licences
|
||||
*/* -*
|
||||
|
||||
## FSF
|
||||
# GPL-3
|
||||
*/* GPL-3 LGPL-3
|
||||
|
||||
# LGPL-2.1
|
||||
*/* LGPL-2.1
|
||||
|
||||
# GPL-2
|
||||
*/* GPL-2 LGPL-2
|
||||
|
||||
## BSD
|
||||
|
||||
*/* BSD-2 BSD-3
|
||||
|
||||
## MIT
|
||||
|
||||
*/* MIT
|
||||
|
||||
## Mozilla
|
||||
|
||||
# MPL-2.0
|
||||
*/* MPL-2.0
|
||||
|
||||
# Others
|
||||
*/* public-domain
|
||||
|
||||
# Needs to be checked
|
||||
app-arch/bzip2:0::arbor[>=1.0.8] bzip2-withdocs
|
||||
app-arch/xz:0::arbor[>=5.2.5] public-domain
|
||||
sys-apps/util-linux:0::arbor[>=2.36] ISC
|
||||
sys-libs/ncurses:0::arbor[>=6.1-r3] as-is
|
||||
sys-libs/timezone-data:0::arbor[=2020a] public-domain
|
||||
sys-libs/zlib:0::arbor[>=1.2.11-r1] ZLIB
|
||||
dev-lang/python::arbor[=3.8.6] PSF-2.2
|
||||
sys-apps/eudev-scm::arbor FDL-1.3
|
||||
sys-devel/automake::arbor FDL-1.3
|
||||
app-text/tidy::arbor ZLIB
|
||||
dev-lang/python::arbor PSF-2.2
|
||||
dev-libs/openssl::arbor openssl
|
||||
sys-apps/debianutils::arbor SMAIL
|
||||
sys-devel/autoconf::arbor FDL-1.3
|
||||
dev-perl/Unicode-EastAsianWidth::arbor CC0
|
||||
sys-apps/man-pages::arbor man-pages
|
||||
app-crypt/rhash::arbor BSD-0
|
||||
dev-libs/libuv::arbor ISC
|
||||
app-text/docbook-xml-dtd::arbor X11
|
||||
sys-devel/ninja::arbor Apache-2.0
|
||||
sys-devel/meson::arbor Apache-2.0
|
||||
dev-libs/icu::arbor icu
|
||||
app-arch/unzip::arbor Info-ZIP
|
||||
|
||||
|
||||
# Hotfix
|
||||
sys-apps/systemd:0::arbor[=scm] public-domain
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
# shellcheck shell=sh # Paludis doesn't expect shebang here, Written to be POSIX compatible
|
||||
|
||||
worldFile="/etc/paludis/world"
|
||||
|
||||
# Source bashrc
|
||||
[ ! -d "/etc/paludis/bashrc" ] || . /etc/paludis/bashrc
|
||||
|
||||
###! This function expects PCRE RegEx expression from the world file
|
||||
checkpkg() { ${GREP:-grep} -qP "$1" "$worldFile" ;}
|
||||
|
||||
# GIT
|
||||
##@ +pcre = To get PCRE regex for 'git grep'
|
||||
##@ +curl = Allows using http/https URI
|
||||
checkpkg "^dev-scm\/git\$" && ${PRINTF:-printf} '%s\n' \
|
||||
"dev-scm/git::arbor curl pcre" || true
|
||||
|
||||
checkpkg "^sys-apps\/sydbox\$" && ${PRINTF:-printf} '%s\n' \
|
||||
"sys-apps/sydbox::arbor seccomp" || true
|
||||
|
||||
# BIND9
|
||||
##@ caps = Fails to build without it (https://gitlab.exherbo.org/exherbo/arbor/-/issues/45)
|
||||
checkpkg "^net-dns\/bind\$" && ${PRINTF:-printf} '%s\n' \
|
||||
"net-dns/bind::arbor caps" || true
|
||||
|
||||
# SSH
|
||||
##@ X509 = To generate X.509 certs
|
||||
##@ lsns = For DNSSEC support (according to exherbo)
|
||||
checkpkg "^net-misc\/openssh\$" && ${PRINTF:-printf} '%s\n' \
|
||||
"net-misc/openssh::arbor X509 ldns" || true
|
||||
|
||||
# Jobs
|
||||
${PRINTF:-printf} "*/* BUILD_OPTIONS: jobs=%s\\n" "$(${NPROC:-nproc} || ${PRINTF:-printf} 1)"
|
||||
|
||||
# CPU flags
|
||||
AMD64_CPU_FEATURES="$(${CAT:-cat} /proc/cpuinfo | ${GREP:-grep} -m 1 flags | ${SED:-sed} 's/^flags.*: //g')"
|
||||
X86_CPU_FEATURES="$(${CAT:-cat} /proc/cpuinfo | ${GREP:-grep} -m 1 flags | ${SED:-sed} 's/^flags.*: //g')"
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
*/* -* bash-completion threads pulseaudio btrfs openssl \
|
||||
TARGETS: -* x86_64-pc-linux-gnu \
|
||||
PROVIDERS: -* gnu dhcpcd openssl man krb5 unzip lynx libxml2 dbus-broker ijg-jpeg elfutils pkg-config \
|
||||
INPUT_DRIVERS: -* evdev keyboard mouse synaptics consolekit \
|
||||
LINGUAS: -* en_US cs \
|
||||
HOSTS: -* x86_64-pc-linux-gnu -x86_64-pc-linux-musl \
|
||||
VIDEO_DRIVERS: -* -i915 intel
|
||||
|
||||
# Recommended on IRC #exherbo
|
||||
sys-apps/paludis -python
|
||||
|
||||
# Version handling of backend
|
||||
*/* \
|
||||
PYTHON_ABIS: -* 3.6 \
|
||||
RUBY_ABIS: -* 2.7 \
|
||||
LUA_ABIS: -* 5.3 \
|
||||
PHP_ABIS: -* 7.4 \
|
||||
POSTGRESQL_SERVERS: -* 12
|
||||
|
||||
# Removing systemd
|
||||
*/* -systemd -journald \
|
||||
PROVIDERS: -systemd -journald eudev sysvinit \
|
||||
PARTS: openrc
|
||||
|
||||
# Syslog
|
||||
*/* PROVIDERS: syslog-ng
|
||||
|
||||
# Hotfix
|
||||
*/* BUILD_OPTIONS: -recommended_tests
|
||||
|
||||
# Unknown dependency
|
||||
dev-libs/libxml2:2.0::arbor[=2.9.10-r2] python
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# always_keep_output_logs may be set to 'true' to always keep output logs, even if a build succeeds.
|
||||
always_keep_output_logs = false
|
||||
|
||||
# quiet may be set to 'true' to show only messages, rather than all output, when carrying out an action.
|
||||
quiet = true
|
||||
|
||||
# log_path can be set to change where log files are saved. It defaults to ${root}/var/log/paludis .
|
||||
log_path = /bedrock/strata/exherbo/var/log/paludis
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# Hotfix
|
||||
dev-lang/python::arbor testing
|
||||
sys-apps/eudev::arbor scm
|
||||
sys-apps/systemd::arbor scm
|
||||
sys-devel/ninja::arbor scm
|
||||
net-proxy/torsocks::net scm
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
*/* amd64
|
||||
|
||||
# SECURITY(Krey): This is a hotfix, because exherbo downstream is incompetent
|
||||
*/* ~amd64
|
||||
|
|
@ -0,0 +1 @@
|
|||
format = accounts
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
location = ${root}/var/db/paludis/repositories/arbor
|
||||
sync = git+https://git.exherbo.org/git/arbor.git
|
||||
profiles = ${location}/profiles/amd64
|
||||
format = e
|
||||
names_cache = ${root}/var/cache/paludis/names
|
||||
write_cache = ${root}/var/cache/paludis/metadata
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/bruners
|
||||
sync = git+https://github.com/Bruners/exheres.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/compnerd
|
||||
sync = git+https://git.exherbo.org/git/dev/compnerd.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/danyspin97
|
||||
sync = git+https://gitlab.exherbo.org/DanySpin97/danyspin97-exheres
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/desktop
|
||||
sync = git+https://git.exherbo.org/git/desktop.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/exony
|
||||
sync = git+https://github.com/ony/exony.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/games
|
||||
sync = git+https://git.exherbo.org/git/games.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/gnome
|
||||
sync = git+https://git.exherbo.org/git/gnome.git
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
format = unwritten
|
||||
name = graveyard
|
||||
location = /var/db/paludis/repositories/graveyard
|
||||
sync = git+https://git.exherbo.org/git/graveyard.git
|
||||
importance = -90
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/hardware
|
||||
sync = git+https://git.exherbo.org/git/hardware.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/haskell-unofficial
|
||||
sync = git+https://gitlab.exherbo.org/exherbo-unofficial/haskell-unofficial.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/hasufell
|
||||
sync = git+https://gogs.hasufell.de/hasufell/hasufell-repository.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/heirecka
|
||||
sync = git+https://git.exherbo.org/git/dev/heirecka.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/ingmar
|
||||
sync = git+https://git.exherbo.org/git/dev/ingmar.git
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
format = exndbam
|
||||
location = ${root}/var/db/paludis/repositories/installed
|
||||
names_cache = ${root}/var/cache/paludis/names
|
||||
split_debug_location = /usr/x86_64-pc-linux-gnu/lib/debug
|
||||
tool_prefix = x86_64-pc-linux-gnu-
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
format = installed-accounts
|
||||
handler = passwd
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/java
|
||||
sync = git+https://git.exherbo.org/git/java.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/kde
|
||||
sync = git+https://git.exherbo.org/git/kde.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/media
|
||||
sync = git+https://git.exherbo.org/git/media.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/mono
|
||||
sync = git+https://git.exherbo.org/git/mono.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/net
|
||||
sync = git+https://git.exherbo.org/git/net.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/ocaml-unofficial
|
||||
sync = git+https://github.com/Exherbo/ocaml-unofficial
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/office
|
||||
sync = git+https://git.exherbo.org/git/office.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/perl
|
||||
sync = git+https://git.exherbo.org/git/perl.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/platypus
|
||||
sync = git+https://gitlab.exherbo.org/kapsh/platypus.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/python
|
||||
sync = git+https://git.exherbo.org/git/python.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/rbrown
|
||||
sync = git+https://git.exherbo.org/git/dev/rbrown.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = repository
|
||||
config_filename = /etc/paludis/repositories/%{repository_template_name}.conf
|
||||
config_template = /etc/paludis/repository.template
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/rust
|
||||
sync = git+https://git.exherbo.org/git/rust.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/tombriden
|
||||
sync = git+https://gitlab.exherbo.org/tombriden/tombriden-exheres
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
format = unavailable
|
||||
name = unavailable-unofficial
|
||||
location = ${root}/var/db/paludis/repositories/unavailable-unofficial
|
||||
sync = tar+https://git.exherbo.org/exherbo_unofficial_repositories.tar.bz2
|
||||
importance = -100
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
format = unavailable
|
||||
name = unavailable
|
||||
location = ${root}/var/db/paludis/repositories/unavailable
|
||||
sync = tar+https://git.exherbo.org/exherbo_repositories.tar.bz2
|
||||
importance = -100
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = installed_unpackaged
|
||||
name = installed_unpackaged
|
||||
location = ${root}/var/db/paludis/repositories/unpackaged
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
format = unwritten
|
||||
name = unwritten
|
||||
location = ${root}/var/db/paludis/repositories/unwritten
|
||||
sync = git+https://git.exherbo.org/git/unwritten.git
|
||||
importance = -100
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/vim
|
||||
sync = git+https://git.exherbo.org/git/vim.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/virtualization
|
||||
sync = git+https://git.exherbo.org/git/virtualization.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = e
|
||||
location = /var/db/paludis/repositories/x11
|
||||
sync = git+https://git.exherbo.org/git/x11.git
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
format = %{repository_template_format}
|
||||
location = /var/db/paludis/repositories/%{repository_template_name}
|
||||
sync = %{repository_template_sync}
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
# Repositories
|
||||
repository/accounts
|
||||
repository/arbor
|
||||
repository/bruners
|
||||
repository/compnerd
|
||||
repository/danyspin97
|
||||
repository/desktop
|
||||
#repository/exheredrey
|
||||
repository/exony
|
||||
repository/games
|
||||
repository/gnome
|
||||
repository/graveyard
|
||||
repository/hardware
|
||||
repository/haskell-unofficial
|
||||
repository/hasufell
|
||||
repository/heirecka
|
||||
repository/ingmar
|
||||
repository/java
|
||||
repository/kde
|
||||
repository/media
|
||||
repository/mono
|
||||
repository/net
|
||||
repository/ocaml-unofficial
|
||||
repository/office
|
||||
repository/perl
|
||||
repository/platypus
|
||||
repository/python
|
||||
repository/rbrown
|
||||
repository/repository
|
||||
repository/rust
|
||||
repository/tombriden
|
||||
repository/unavailable
|
||||
repository/unavailable-unofficial
|
||||
repository/unwritten
|
||||
repository/vim
|
||||
repository/virtualization
|
||||
repository/x11
|
||||
|
||||
# CORE
|
||||
sys-apps/paludis
|
||||
sys-apps/sydbox
|
||||
dev-scm/git
|
||||
sys-apps/openrc
|
||||
sys-boot/grub
|
||||
dev-libs/libxml2
|
||||
sys-devel/meson
|
||||
app-arch/zstd
|
||||
x11-misc/shared-mime-info
|
||||
net-misc/tor
|
||||
## Syslog
|
||||
sys-apps/syslog-ng
|
||||
## SSH
|
||||
net-misc/openssh
|
||||
|
||||
# DNS
|
||||
net-dns/bind
|
||||
Loading…
Reference in New Issue