Skip to content

Commit 3b40ab6

Browse files
perigrinperigrin
committed
Add DigitalOcean migration scripts and security remediation
- Implement sidecar Tailscale architecture for containers - Add host-level Tailscale deployment scripts for better admin access - Create security remediation scripts for exposed auth keys - Add comprehensive deployment scripts for IRC servers and Atheme services - Document migration strategy from sidecar to host architecture - Include cleanup scripts for git history security Note: Tailscale auth keys have been removed from git history and replaced with placeholders. New deployments should use environment variables.
1 parent 6a832ae commit 3b40ab6

25 files changed

+1387
-0
lines changed

‎COMPLETE_ATHEME_DEPLOYMENT.md‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# Complete Atheme Services Deployment
2+
3+
## Current Status
4+
5+
The Atheme services container is running but showing "no uplinks configured" because it's missing the required environment variables for IRC server connections.
6+
7+
## Required Action
8+
9+
Run this command on the `magnet-atheme` server (SSH via Tailscale: `ssh [email protected]`):
10+
11+
```bash
12+
# Stop existing container
13+
docker stop magnet-atheme
14+
docker rm magnet-atheme
15+
16+
# Start with full configuration
17+
docker run -d --name magnet-atheme \
18+
--restart unless-stopped \
19+
--network container:magnet-atheme-tailscale \
20+
-e SERVER_NAME=magnet-atheme \
21+
-e TAILSCALE_DOMAIN=camel-kanyu.ts.net \
22+
-e SERVICES_PASSWORD=vRH6PLBIQeZpTrla0QH3iR2Hn42WY1pj \
23+
-e ADMIN_NAME="Chris Prather" \
24+
-e ADMIN_EMAIL="[email protected]" \
25+
-e ATHEME_NETWORK=Magnet \
26+
-e ATHEME_HUB_HOSTNAME=magnet-9rl.camel-kanyu.ts.net \
27+
-e ATHEME_FALLBACK_HOSTNAME=magnet-1eu.camel-kanyu.ts.net \
28+
-e PASSWORD_9RL=vRH6PLBIQeZpTrla0QH3iR2Hn42WY1pj \
29+
-e PASSWORD_1EU=vRH6PLBIQeZpTrla0QH3iR2Hn42WY1pj \
30+
magnet-atheme-services
31+
32+
# Check logs
33+
docker logs magnet-atheme --tail 20
34+
```
35+
36+
## Expected Outcome
37+
38+
After running this command, Atheme should connect to the IRC servers and you should see log messages like:
39+
40+
```
41+
[timestamp] Connected to uplink magnet-9rl.camel-kanyu.ts.net
42+
[timestamp] Introducing service NickServ
43+
[timestamp] Introducing service ChanServ
44+
[timestamp] Introducing service OperServ
45+
[timestamp] Introducing service MemoServ
46+
```
47+
48+
## Configuration Details
49+
50+
The configuration establishes:
51+
52+
- **Primary uplink**: `magnet-9rl.camel-kanyu.ts.net` (US Hub)
53+
- **Fallback uplink**: `magnet-1eu.camel-kanyu.ts.net` (EU Leaf)
54+
- **Services**: NickServ, ChanServ, OperServ, MemoServ
55+
- **Database**: OpenSEX flat file (no PostgreSQL needed)
56+
- **Networking**: Via Tailscale mesh (`magnet-atheme.camel-kanyu.ts.net`)
57+
58+
## Alternative Script Method
59+
60+
You can also copy `restart-atheme.sh` to the server and run it:
61+
62+
```bash
63+
scp restart-atheme.sh [email protected]:~/
64+
ssh [email protected]
65+
chmod +x restart-atheme.sh
66+
./restart-atheme.sh
67+
```
68+
69+
## Verification
70+
71+
Once complete, test IRC services functionality:
72+
73+
1. Connect to IRC: `/connect magnet-9rl.camel-kanyu.ts.net 6667`
74+
2. Register nickname: `/msg NickServ REGISTER password email`
75+
3. Join channel: `/join #test`
76+
4. Register channel: `/msg ChanServ REGISTER #test`
77+
78+
The migration from Fly.io to DigitalOcean will be complete once Atheme connects successfully.

‎Dockerfile.atheme-host‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# ABOUTME: Atheme IRC services container for host Tailscale deployment
2+
# ABOUTME: Simplified container without embedded networking complexity
3+
4+
# Build stage
5+
FROM alpine:latest AS builder
6+
7+
# Install build dependencies
8+
RUN apk update && apk add --no-cache \
9+
build-base \
10+
pkgconfig \
11+
automake \
12+
autoconf \
13+
libtool \
14+
openssl-dev \
15+
git
16+
17+
# Build Atheme following standard recipe
18+
WORKDIR /tmp
19+
RUN git clone https://github.com/atheme/atheme.git
20+
WORKDIR /tmp/atheme
21+
RUN git submodule update --init
22+
RUN ./configure --prefix=/opt/atheme --enable-fhs-paths --enable-large-net --disable-nls
23+
RUN make
24+
RUN make install
25+
26+
# Runtime stage
27+
FROM alpine:latest
28+
29+
# Install runtime dependencies
30+
RUN apk update && apk add --no-cache \
31+
openssl \
32+
ca-certificates \
33+
gettext \
34+
su-exec
35+
36+
# Copy built Atheme from build stage
37+
COPY --from=builder /opt/atheme /opt/atheme
38+
39+
# Copy configuration template and startup script
40+
COPY atheme.conf.template /opt/atheme/etc/atheme.conf.template
41+
COPY start-atheme-host.sh /app/start-atheme-host.sh
42+
RUN chmod +x /app/start-atheme-host.sh
43+
44+
# Container runs as root, drops to atheme user for services
45+
WORKDIR /opt/atheme
46+
47+
CMD ["/app/start-atheme-host.sh"]

‎Dockerfile.atheme-simple‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# ABOUTME: Atheme-only container designed for Tailscale sidecar networking
2+
# ABOUTME: Focused on IRC services functionality without networking complexity
3+
4+
# Build stage
5+
FROM alpine:latest AS builder
6+
7+
# Install build dependencies
8+
RUN apk update && apk add --no-cache \
9+
build-base \
10+
pkgconfig \
11+
automake \
12+
autoconf \
13+
libtool \
14+
openssl-dev \
15+
git
16+
17+
# Build Atheme following standard recipe
18+
WORKDIR /tmp
19+
RUN git clone https://github.com/atheme/atheme.git
20+
WORKDIR /tmp/atheme
21+
RUN ./autogen.sh
22+
RUN ./configure --prefix=/opt/atheme --enable-fhs-paths --enable-large-net --disable-nls
23+
RUN make
24+
RUN make install
25+
26+
# Runtime stage
27+
FROM alpine:latest
28+
29+
# Install runtime dependencies
30+
RUN apk update && apk add --no-cache \
31+
openssl \
32+
ca-certificates \
33+
gettext \
34+
su-exec
35+
36+
# Copy built Atheme from build stage
37+
COPY --from=builder /opt/atheme /opt/atheme
38+
39+
# Copy configuration template and startup script
40+
COPY atheme.conf.template /opt/atheme/conf/atheme.conf.template
41+
COPY start-atheme-simple.sh /app/start-atheme-simple.sh
42+
RUN chmod +x /app/start-atheme-simple.sh
43+
44+
# Container starts as root, drops to atheme user for services
45+
WORKDIR /opt/atheme
46+
47+
# No network exposure - handled by Tailscale sidecar
48+
CMD ["/app/start-atheme-simple.sh"]

‎Dockerfile.atheme-working‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# ABOUTME: Atheme IRC services container adapted for sidecar networking
2+
# ABOUTME: Based on working Atheme build but without embedded Tailscale
3+
4+
FROM alpine:latest
5+
6+
# Install build and runtime dependencies for Atheme
7+
RUN apk update && apk add --no-cache \
8+
build-base \
9+
pkgconfig \
10+
automake \
11+
autoconf \
12+
libtool \
13+
git \
14+
ca-certificates \
15+
gettext \
16+
su-exec \
17+
netcat-openbsd \
18+
procps \
19+
openssl-dev \
20+
openssl \
21+
pcre2-dev
22+
23+
# Build Atheme from source
24+
WORKDIR /tmp
25+
RUN git clone https://github.com/atheme/atheme.git
26+
WORKDIR /tmp/atheme
27+
RUN git submodule update --init
28+
29+
# Configure and build Atheme
30+
RUN ./configure --prefix=/opt/atheme --enable-contrib --enable-large-net --with-pcre
31+
RUN make -j$(nproc)
32+
RUN make install
33+
34+
# Create directories and set up runtime environment
35+
RUN mkdir -p /var/run/tailscale /var/cache/tailscale /var/lib/tailscale
36+
RUN mkdir -p /opt/atheme/var/log /opt/atheme/var/run /opt/atheme/etc /opt/atheme/conf
37+
RUN adduser -D -h /opt/atheme -u 1001 atheme
38+
RUN chown -R atheme:atheme /opt/atheme/
39+
40+
# Copy configuration and startup scripts
41+
COPY atheme.conf.template /opt/atheme/conf/atheme.conf.template
42+
COPY start-atheme-simple.sh /app/start-atheme-simple.sh
43+
RUN chmod +x /app/start-atheme-simple.sh
44+
45+
# Container starts as root, drops to atheme user for services
46+
WORKDIR /opt/atheme
47+
48+
CMD ["/app/start-atheme-simple.sh"]

‎Dockerfile.solanum-host‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# ABOUTME: Solanum IRC container for host Tailscale deployment
2+
# ABOUTME: Simplified container without embedded networking complexity
3+
4+
# Build stage
5+
FROM alpine:latest AS builder
6+
7+
# Install build dependencies
8+
RUN apk update && apk add --no-cache \
9+
build-base \
10+
pkgconfig \
11+
automake \
12+
autoconf \
13+
libtool \
14+
openssl-dev \
15+
git
16+
17+
# Build Solanum following optimized recipe
18+
WORKDIR /tmp
19+
RUN git clone https://github.com/solanum-ircd/solanum.git
20+
WORKDIR /tmp/solanum
21+
RUN ./autogen.sh
22+
RUN ./configure --prefix=/opt/solanum --enable-openssl --enable-fhs-paths --with-program-prefix= --disable-assert
23+
RUN make
24+
RUN make install
25+
26+
# Runtime stage
27+
FROM alpine:latest
28+
29+
# Install runtime dependencies
30+
RUN apk update && apk add --no-cache \
31+
openssl \
32+
ca-certificates \
33+
gettext \
34+
su-exec
35+
36+
# Copy built Solanum from build stage
37+
COPY --from=builder /opt/solanum /opt/solanum
38+
39+
# Copy configuration template and startup script
40+
COPY common.conf.template /opt/solanum/etc/common.conf.template
41+
COPY opers.conf.template /opt/solanum/etc/opers.conf.template
42+
COPY start-solanum-host.sh /app/start-solanum-host.sh
43+
RUN chmod +x /app/start-solanum-host.sh
44+
45+
# Container runs as root, drops to solanum user for ircd
46+
WORKDIR /opt/solanum
47+
48+
EXPOSE 6667 6697
49+
50+
CMD ["/app/start-solanum-host.sh"]

‎Dockerfile.solanum-simple‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# ABOUTME: IRC-only Solanum container designed for Tailscale sidecar networking
2+
# ABOUTME: Focused on IRC server functionality without networking complexity
3+
4+
# Build stage
5+
FROM alpine:latest AS builder
6+
7+
# Install build dependencies only
8+
RUN apk update && apk add --no-cache \
9+
build-base \
10+
pkgconfig \
11+
automake \
12+
autoconf \
13+
libtool \
14+
sqlite-dev \
15+
openssl-dev \
16+
bison \
17+
flex \
18+
git
19+
20+
# Build Solanum following official README recipe
21+
WORKDIR /tmp
22+
RUN git clone https://github.com/solanum-ircd/solanum.git
23+
WORKDIR /tmp/solanum
24+
RUN ./autogen.sh
25+
RUN ./configure --prefix=/opt/solanum --enable-openssl
26+
RUN make
27+
RUN make check || echo "Tests completed (may have warnings)"
28+
RUN make install
29+
30+
# Runtime stage
31+
FROM alpine:latest
32+
33+
# Install runtime dependencies - includes libraries Solanum was built against
34+
RUN apk update && apk add --no-cache \
35+
openssl \
36+
sqlite-libs \
37+
ca-certificates \
38+
gettext \
39+
su-exec \
40+
netcat-openbsd \
41+
procps \
42+
libtool \
43+
libltdl \
44+
mkpasswd
45+
46+
# Copy built Solanum from build stage
47+
COPY --from=builder /opt/solanum /opt/solanum
48+
49+
# Create directories
50+
RUN mkdir -p /opt/solanum/var/log /opt/solanum/var/run /opt/solanum/etc /opt/solanum/conf /opt/solanum/logs
51+
52+
# Add ircd user
53+
RUN adduser -D -h /opt/solanum -u 1000 ircd
54+
RUN chown -R ircd:ircd /opt/solanum/
55+
56+
# Copy configuration templates and startup script
57+
COPY common.conf.template /opt/solanum/conf/common.conf.template
58+
COPY opers.conf.template /opt/solanum/conf/opers.conf.template
59+
COPY start-simple.sh /app/start-simple.sh
60+
RUN chmod +x /app/start-simple.sh
61+
62+
# Copy server-specific config (will be overridden by deployment)
63+
COPY server.conf /opt/solanum/conf/server.conf.template
64+
65+
# Container starts as root, drops to ircd user for Solanum
66+
WORKDIR /opt/solanum
67+
68+
# No network exposure - handled by Tailscale sidecar
69+
CMD ["/app/start-simple.sh"]

‎Dockerfile.tailscale‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# ABOUTME: Dedicated Tailscale sidecar container for IRC server networking
2+
# ABOUTME: Provides secure mesh networking without coupling to IRC server container
3+
4+
FROM tailscale/tailscale:latest
5+
6+
# Create directories for Tailscale state
7+
RUN mkdir -p /var/run/tailscale /var/cache/tailscale /var/lib/tailscale
8+
9+
# Copy startup script
10+
COPY start-tailscale.sh /app/start-tailscale.sh
11+
RUN chmod +x /app/start-tailscale.sh
12+
13+
# Expose standard IRC ports
14+
EXPOSE 6667 6697 7000
15+
16+
CMD ["/app/start-tailscale.sh"]

0 commit comments

Comments
 (0)