diff --git a/README.md b/README.md index 7ac6b66..fcb1ce0 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ pwsh ./_installer.ps1 | `podman/` | `podman_installer.sh` | Linux | Distribution repositories | | `terraform/` | `terraform_installer.sh` | Linux | HashiCorp repositories | | `TLS-tools/` | `TLS-checker.ps1` | Cross-platform | Tests TLS versions, HTTP versions, QUIC, HSTS, compression | -| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Comprehensive TLS/SSL scanner by Dirk Wetter — pinned at v3.2.3 | +| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Comprehensive TLS/SSL scanner by Dirk Wetter — pinned at a specific version | | `windows/` | `Enable-WinRM.ps1` | Windows | Configures WinRM for remote management | | `windows/` | `Get-InstalledSoftware.ps1` | Windows | Lists installed software from registry | | `windows/` | `configure-Windows-VM.ps1` | Windows | Disables unnecessary services for VMs | diff --git a/TLS-tools/README.md b/TLS-tools/README.md index db12550..e01cfbf 100644 --- a/TLS-tools/README.md +++ b/TLS-tools/README.md @@ -6,7 +6,7 @@ Tools for testing TLS/SSL configurations and HTTP security features. Cross-platform PowerShell script that tests TLS versions, HTTP versions, compression, QUIC, and HSTS using a self-contained cURL binary. -**Requirements:** PowerShell 7.5.0+ +**Requirements:** PowerShell 7.5+ ```powershell .\TLS-checker.ps1 -Domain "example.com" -TestType All @@ -17,7 +17,7 @@ Cross-platform PowerShell script that tests TLS versions, HTTP versions, compres Really strong TLS/SSL scanner. This one is included as a submodule from a project that I like. It scans ciphers, protocols, certificates, and vulnerabilities. -Currently, the Git submodule is pinned at v3.2.3. If missing after cloning, run: +Currently, the Git submodule is pinned at a specific version. If missing after cloning, run: ```bash git submodule update --init diff --git a/TLS-tools/TLS-checker.ps1 b/TLS-tools/TLS-checker.ps1 index abab7dc..0c2c0e3 100644 --- a/TLS-tools/TLS-checker.ps1 +++ b/TLS-tools/TLS-checker.ps1 @@ -4,7 +4,7 @@ TLS & HTTP feature tester using static cURL binary. .DESCRIPTION Downloads a self-contained curl if needed, then tests compression, TLS versions, - HTTP versions, QUIC, and HSTS for given domains. Requires PowerShell 7.5.0 or higher. + HTTP versions, QUIC, and HSTS for given domains. Requires PowerShell 7.5 or higher. .PARAMETER Domain The domain to test (can be provided interactively) .PARAMETER TestType @@ -34,7 +34,7 @@ .EXAMPLE .\TLS-checker.ps1 -Domain "example.com" -TestType "All" -PreferMusl .NOTES - Requires: PowerShell 7.5.0+ + Requires: PowerShell 7.5+ If you experience issues on Linux, try running with -Verbose to see detailed debugging information. This will show platform detection, curl binary selection, and connection attempts. diff --git a/ansible/ansible_installer.sh b/ansible/ansible_installer.sh index 6cffc21..b1a137b 100755 --- a/ansible/ansible_installer.sh +++ b/ansible/ansible_installer.sh @@ -2,7 +2,7 @@ # # Ansible Installer Script # -# Installs Ansible 13.5.0 (with its bundled ansible-core dependency) in a Python 3.14 virtual environment. +# Installs Ansible (with its bundled ansible-core dependency) in a Python virtual environment. # Note: 'ansible' is the community package; 'ansible-core' is the engine it ships with. # Supports Debian/Ubuntu (apt) and RHEL/Fedora (dnf). # Run as root. @@ -141,7 +141,7 @@ else fi # === Install Ansible === -info "Installing Ansible 13.5.0 (community package, bundles ansible-core~=2.20.4)..." +info "Installing Ansible (community package, bundles ansible-core)..." ( source "$VENV_DIR/bin/activate" command -v pip &>/dev/null || error "pip not found in venv." diff --git a/nginx/nginx_installer.ps1 b/nginx/nginx_installer.ps1 index 76c2f55..698eac8 100644 --- a/nginx/nginx_installer.ps1 +++ b/nginx/nginx_installer.ps1 @@ -3,7 +3,7 @@ NGINX Installer Script for Linux (PowerShell) .DESCRIPTION - Builds and installs NGINX with OpenSSL 3.6, HTTP/3, zstd compression, + Builds and installs NGINX with OpenSSL, HTTP/3, zstd compression, and ACME support on Linux. .PARAMETER Command @@ -156,6 +156,8 @@ function Get-PkgMgr { return 'apt' } elseif (Get-Command dnf -ErrorAction SilentlyContinue) { return 'dnf' + } elseif (Get-Command pacman -ErrorAction SilentlyContinue) { + return 'pacman' } else { return 'unknown' } @@ -189,8 +191,13 @@ function Install-Dependencies { 'dnf' { & dnf install -y -q gcc gcc-c++ make pcre2-devel zlib-devel libzstd-devel curl perl cargo pkgconf-pkg-config clang gawk cmake 2>&1 | Out-Null } + 'pacman' { + if (-not (& pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf 2>&1 | Out-Null)) { + Write-Log WARN "pacman install failed, will try rustup for cargo. Note: zlib is not required (zlib-ng-compat provides it)." + } + } default { - Stop-Script 'Unsupported package manager. Only apt and dnf are supported.' + Stop-Script 'Unsupported package manager. Only apt, dnf and pacman are supported.' } } @@ -227,6 +234,10 @@ function Update-SystemPackages { if ($LASTEXITCODE -ne 0) { Stop-Script 'dnf upgrade failed' } if ($dnfOutput) { $dnfOutput | Out-Host } } + 'pacman' { + & pacman -Syu --noconfirm 2>&1 | Out-Null + if ($LASTEXITCODE -ne 0) { Stop-Script 'pacman upgrade failed' } + } default { Write-Log 'WARN' 'Unable to detect package manager' } @@ -360,6 +371,7 @@ function Build-Nginx { switch ($mgr) { 'apt' { & apt-get install -y libssl-dev 2>&1 | Out-Null } 'dnf' { & dnf install -y openssl-devel 2>&1 | Out-Null } + 'pacman' { & pacman -Sy --noconfirm openssl 2>&1 | Out-Null } } Write-Log 'INFO' 'Using system OpenSSL' } @@ -371,13 +383,10 @@ function Build-Nginx { Push-Location $nginxSrc # Verify libzstd availability - $ldconfigOut = bash -lc 'ldconfig -p 2>/dev/null || true' - if (-not ($ldconfigOut -match 'libzstd\.so')) { - $zstdPaths = @('/usr/lib/libzstd.so', '/usr/lib64/libzstd.so', '/usr/local/lib/libzstd.so') - $found = $zstdPaths | Where-Object { Test-Path $_ } - if (-not $found) { - Stop-Script 'Shared libzstd not found. Install libzstd-dev/devel' - } + $zstdPaths = @('/usr/lib/libzstd.so', '/usr/lib/libzstd.so.1', '/usr/lib64/libzstd.so', '/usr/lib64/libzstd.so.1', '/usr/local/lib/libzstd.so') + $found = $zstdPaths | Where-Object { Test-Path $_ } + if (-not $found) { + Stop-Script 'Shared libzstd not found. Install libzstd-dev/devel' } $pcre2Path = Join-Path $Script:BUILD_DIR 'pcre2' @@ -548,6 +557,7 @@ function New-NginxSelfSignedCertificate { switch ($mgr) { 'apt' { & apt-get install -y openssl 2>&1 | Out-Null } 'dnf' { & dnf install -y openssl 2>&1 | Out-Null } + 'pacman' { & pacman -Sy --noconfirm openssl 2>&1 | Out-Null } } $opensslBin = (Get-Command openssl -ErrorAction SilentlyContinue)?.Source } @@ -610,7 +620,8 @@ http { tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; - types_hash_max_size 2048; + types_hash_max_size 4096; + types_hash_bucket_size 128; # Gzip compression gzip on; @@ -740,8 +751,10 @@ function Install-Nginx { } # Install dynamic modules - Copy-Item "$Script:BUILD_DIR/nginx/objs/*.so" -Destination $Script:NGINX_MODULES_PATH -Force -ErrorAction SilentlyContinue - Copy-Item "$Script:BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" -Destination $Script:NGINX_MODULES_PATH -Force -ErrorAction SilentlyContinue + Copy-Item "$Script:BUILD_DIR/nginx/objs/*.so" -Destination $Script:NGINX_MODULES_PATH -Force + if ($LASTEXITCODE -ne 0) { Stop-Script "Failed to copy NGINX modules" } + Copy-Item "$Script:BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" -Destination $Script:NGINX_MODULES_PATH -Force + if ($LASTEXITCODE -ne 0) { Stop-Script "Failed to copy ACME module" } # Install configuration files Install-HtmlFiles @@ -752,6 +765,9 @@ function Install-Nginx { bash -c 'id nginx 2>/dev/null || useradd -r -s /sbin/nologin nginx' | Out-Null bash -c "chown -R nginx:nginx /var/log/nginx /var/cache/nginx /var/lib/nginx" | Out-Null + bash -c "chown root:nginx /etc/nginx/ssl" | Out-Null + bash -c "chmod 640 /etc/nginx/ssl/nginx.key" | Out-Null + bash -c "chmod 644 /etc/nginx/ssl/nginx.crt" | Out-Null bash -c "chmod 755 /etc/nginx/conf.d '$Script:NGINX_MODULES_PATH'" | Out-Null # Create systemd service diff --git a/nginx/nginx_installer.sh b/nginx/nginx_installer.sh index 1871549..b7da8f6 100755 --- a/nginx/nginx_installer.sh +++ b/nginx/nginx_installer.sh @@ -6,7 +6,7 @@ set -euo pipefail # ============================================================================ # # Description: -# Builds and installs NGINX with OpenSSL 3.6, HTTP/3, zstd compression, +# Builds and installs NGINX with OpenSSL, HTTP/3, zstd compression, # and ACME support on Linux. # # Usage: @@ -126,6 +126,8 @@ Detect-PkgMgr() { echo "apt" elif command -v dnf >/dev/null 2>&1; then echo "dnf" + elif command -v pacman >/dev/null 2>&1; then + echo "pacman" else echo "unknown" fi @@ -153,8 +155,13 @@ Install-Dependencies() { dnf) dnf install -y -q gcc gcc-c++ make pcre2-devel zlib-devel libzstd-devel curl perl cargo pkgconf-pkg-config clang gawk cmake >/dev/null 2>&1 ;; + pacman) + if ! pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf >/dev/null 2>&1; then + Write-Log WARN "pacman install failed, will try rustup for cargo. Note: zlib is not required (zlib-ng-compat provides it)." + fi + ;; *) - Stop-Script "Unsupported package manager. Only apt and dnf are supported." + Stop-Script "Unsupported package manager. Only apt, dnf and pacman are supported." ;; esac @@ -188,6 +195,9 @@ Update-SystemPackages() { Stop-Script "dnf upgrade failed" fi ;; + pacman) + pacman -Syu --noconfirm >/dev/null 2>&1 || Write-Log WARN "pacman upgrade failed" + ;; *) Write-Log WARN "Unable to detect package manager" ;; @@ -294,7 +304,9 @@ Build-Nginx() { use_system_ssl=true Write-Log WARN "OpenSSL build failed" else - make install_sw 2>&1 | grep -v '^DEBUG:' || true + if ! make install_sw >/dev/null 2>&1; then + Stop-Script "OpenSSL make install_sw failed" + fi ssl_opt="--with-openssl=$BUILD_DIR/openssl" Write-Log INFO "OpenSSL built successfully" fi @@ -308,6 +320,7 @@ Build-Nginx() { case $mgr in apt) apt-get install -y libssl-dev >/dev/null 2>&1 ;; dnf) dnf install -y openssl-devel >/dev/null 2>&1 ;; + pacman) pacman -Sy --noconfirm openssl >/dev/null 2>&1 ;; esac Write-Log INFO "Using system OpenSSL" fi @@ -320,14 +333,9 @@ Build-Nginx() { export CC=gcc # Verify libzstd availability - if command -v ldconfig >/dev/null 2>&1; then - if ! ldconfig -p 2>/dev/null | grep -q "libzstd.so"; then - Stop-Script "Shared libzstd not found. Install libzstd-dev/devel" - fi - else - if [[ ! -f /usr/lib/libzstd.so && ! -f /usr/lib64/libzstd.so && ! -f /usr/local/lib/libzstd.so ]]; then - Stop-Script "Shared libzstd not found" - fi + if [[ ! -f /usr/lib/libzstd.so && ! -f /usr/lib/libzstd.so.1 && + ! -f /usr/lib64/libzstd.so && ! -f /usr/lib64/libzstd.so.1 ]]; then + Stop-Script "Shared libzstd not found. Install libzstd-dev/devel" fi export LDFLAGS="-lzstd" @@ -483,6 +491,7 @@ New-SelfSignedCertificate() { case $mgr in apt) apt-get install -y openssl >/dev/null 2>&1 ;; dnf) dnf install -y openssl >/dev/null 2>&1 ;; + pacman) pacman -Sy --noconfirm openssl >/dev/null 2>&1 ;; esac ssl_bin=$(command -v openssl || true) fi @@ -560,7 +569,8 @@ http { tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; - types_hash_max_size 2048; + types_hash_max_size 4096; + types_hash_bucket_size 128; # Gzip compression gzip on; @@ -659,6 +669,9 @@ Install-Nginx() { Stop-Script "Nginx install failed" fi + # Verify nginx binary exists + [[ -x /usr/sbin/nginx ]] || Stop-Script "NGINX binary not found after install" + # Create directories mkdir -p /etc/nginx/{conf.d,sites-available,sites-enabled} mkdir -p "${NGINX_MODULES_PATH}" @@ -685,6 +698,9 @@ Install-Nginx() { fi chown -R nginx:nginx /var/log/nginx /var/cache/nginx /var/lib/nginx + chown root:nginx /etc/nginx/ssl + chmod 640 /etc/nginx/ssl/nginx.key + chmod 644 /etc/nginx/ssl/nginx.crt chmod 755 /etc/nginx/conf.d "${NGINX_MODULES_PATH}" # Create systemd service diff --git a/renovate.json b/renovate.json index 38b623e..2b95ea8 100644 --- a/renovate.json +++ b/renovate.json @@ -229,6 +229,30 @@ "matchStrings": ["K8S_VERSION:-(?v[0-9.]+)"], "depNameTemplate": "kubernetes/kubernetes", "datasourceTemplate": "github-releases" + }, + { + "description": "Request Python versie in ansible installer", + "customType": "regex", + "managerFilePatterns": ["/^ansible/ansible_installer\\.sh$/"], + "matchStrings": ["REQ_PYTHON_VERSION=\"(?[0-9.]+)\""] , + "depNameTemplate": "python", + "datasourceTemplate": "py" + }, + { + "description": "Build Python versie in ansible installer", + "customType": "regex", + "managerFilePatterns": ["/^ansible/ansible_installer\\.sh$/"], + "matchStrings": ["BUILD_PYTHON_VERSION=\"(?[0-9.]+)\""] , + "depNameTemplate": "python", + "datasourceTemplate": "py" + }, + { + "description": "vagrant-vmware-utility in Windows installer", + "customType": "regex", + "managerFilePatterns": ["/^windows/Install-VagrantVMware\\.ps1$/"], + "matchStrings": ["vagrant-vmware-utility/(?[0-9.]+)/"], + "depNameTemplate": "hashicorp/vagrant-vmware-utility", + "datasourceTemplate": "github-releases" } ], "vulnerabilityAlerts": {