-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathindex.xml
2359 lines (2039 loc) · 153 KB
/
index.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="utf-8" standalone="yes" ?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
<title>BastilleBSD</title>
<link>https://bastillebsd.org/</link>
<atom:link href="https://bastillebsd.org/index.xml" rel="self" type="application/rss+xml" />
<description>BastilleBSD</description>
<generator>Source Themes Academic (https://sourcethemes.com/academic/)</generator><language>en-us</language><copyright>© 2018-2023</copyright><lastBuildDate>Wed, 16 Feb 2022 21:21:25 -0700</lastBuildDate>
<image>
<url>https://bastillebsd.org/img/icon-192.png</url>
<title>BastilleBSD</title>
<link>https://bastillebsd.org/</link>
</image>
<item>
<title></title>
<link>https://bastillebsd.org/blog/posts/</link>
<pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
<guid>https://bastillebsd.org/blog/posts/</guid>
<description></description>
</item>
<item>
<title>Bastille In The Wild</title>
<link>https://bastillebsd.org/press/</link>
<pubDate>Fri, 01 Dec 2023 12:00:00 +0000</pubDate>
<guid>https://bastillebsd.org/press/</guid>
<description></description>
</item>
<item>
<title>BastilleBSD Release History</title>
<link>https://bastillebsd.org/history/</link>
<pubDate>Fri, 01 Dec 2023 00:00:00 +0000</pubDate>
<guid>https://bastillebsd.org/history/</guid>
<description></description>
</item>
<item>
<title>Compare Bastille</title>
<link>https://bastillebsd.org/compare/</link>
<pubDate>Fri, 01 Dec 2023 00:00:00 +0000</pubDate>
<guid>https://bastillebsd.org/compare/</guid>
<description></description>
</item>
<item>
<title>Getting Started With Bastille</title>
<link>https://bastillebsd.org/getting-started/</link>
<pubDate>Wed, 15 Nov 2023 12:00:00 +0000</pubDate>
<guid>https://bastillebsd.org/getting-started/</guid>
<description>
<figure>
<img src="https://bastillebsd.org/img/dangerous-to-go-alone.jpg" alt="" >
<figcaption>
It&rsquo;s dangerous to go alone! Take this.
</figcaption>
</figure>
<h2 id="bastille-on-freebsd">Bastille on FreeBSD</h2>
<p>This document is designed to help you be successful in your use and adoption of
Bastille and FreeBSD. This document begins with a brand-new FreeBSD 14.0 system
deployed locally or in the cloud. Manual installation is not covered in this
document.</p>
<h2 id="firstboot">Firstboot</h2>
<p>Upon logging into a system for the first time it is recommended to apply any
security patches available:</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">freebsd-update fetch install
reboot
</code></pre></div><p>After the <code>reboot</code> is complete, run <code>freebsd-update install</code> once again.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">freebsd-update install
</code></pre></div><p>Verify your version and patch level with <code>freebsd-version</code>.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">freebsd-version
</code></pre></div><blockquote>
<p>Tip: subscribe to <a href="https://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications">this mailing
list</a>
for FreeBSD security notifications (low volume). Anytime you receive an email
from this list, re-run <code>freebsd-update fetch install</code>.</p>
</blockquote>
<h2 id="packaging">Packaging</h2>
<p>FreeBSD provides binary packages, available in quarterly (default) and latest
branches. These binary packages are built from the FreeBSD ports tree, which
follows a rolling-release model. This means up-to-date packages are often
available. To use the binary package manager, bootstrap it by running <code>pkg</code> for
the first time:</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">root@freebsd:~ <span style="color:#75715e"># pkg bootstrap</span>
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? <span style="color:#f92672">[</span>y/N<span style="color:#f92672">]</span>: y
Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly, please wait...
Verifying signature with trusted certificate pkg.freebsd.org.2013102301... <span style="color:#66d9ef">done</span>
<span style="color:#f92672">[</span>freebsd<span style="color:#f92672">]</span> Installing pkg-1.17.5...
<span style="color:#f92672">[</span>freebsd<span style="color:#f92672">]</span> Extracting pkg-1.17.5: 100%
root@freebsd:~ <span style="color:#75715e">#</span>
</code></pre></div><p>Tip: this bootstrapping step can be automated using the following command:
<code>env ASSUME_ALWAYS_YES=YES pkg bootstrap</code></p>
<p><strong>Quarterly</strong></p>
<p>If you take a closer look at the line of output after the bootstrap
confirmation you&rsquo;ll notice that the last part of the URL says <code>quarterly</code>:</p>
<blockquote>
<p>Bootstrapping pkg &hellip; pkg.FreeBSD.org/FreeBSD:14:amd64/<code>quarterly</code>, please wait&hellip;</p>
</blockquote>
<p>This subscribes the host to a quarterly release cycle for binary packages. For
most systems this is adequate. No changes are needed to subscribe to the
quarterly repository.</p>
<p><strong>Latest</strong></p>
<p>To use the latest binary packages, update the pkg URL to use the latest suffix
instead. A simple way to override the default settings is to create a new
repository config with the updated path of <code>latest</code>.</p>
<p><strong>Migrate to latest:</strong></p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">mkdir -p /usr/local/etc/pkg/repos
echo <span style="color:#e6db74">&#39;FreeBSD: { url: &#39;</span>pkg+http://pkg.FreeBSD.org/<span style="color:#ae81ff">\$\{</span>ABI<span style="color:#ae81ff">\}</span>/latest<span style="color:#e6db74">&#39;, enabled: yes }&#39;</span> &gt; /usr/local/etc/pkg/repos/FreeBSD.conf
</code></pre></div><h2 id="package-basics">Package Basics</h2>
<p>In this section you&rsquo;ll learn the basics of using the package manager, and
install a few creature comforts. FreeBSD&rsquo;s binary package manager works much
like others you may have used.</p>
<p><strong>Example</strong></p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">pkg install vim git-lite bash ca_root_nss
</code></pre></div><p>The above pkg install command will add the <code>vim</code>, <code>git-lite</code>, <code>bash</code> and
<code>ca_root_nss</code> (CA certificates) from the quarterly/latest repositories.
Naturally you can replace <code>bash</code> with <code>zsh</code> (or another shell of your choice).</p>
<p>You may also search the pkg repository for named packages. <code>pkg search foo</code>
will match packages including <code>foo</code>.</p>
<blockquote>
<p>Tip: Check out <a href="https://freshports.org">FreshPorts</a>.</p>
</blockquote>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">pkg help
</code></pre></div><p>You can always find help and a list of other options using <code>pkg help</code>.</p>
<h2 id="install-bastille">Install Bastille</h2>
<p>Now that you&rsquo;ve had a crash course in package basics, let&rsquo;s install <code>bastille</code>
and start working with containers. Use one of the three options below. These
are listed in order of preference / support.</p>
<p><strong>PKG</strong></p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">pkg install bastille
</code></pre></div><blockquote>
<p>Note: as outlined above, the version of Bastille installed may differ depending on whether you&rsquo;re using <code>quarterly</code> or <code>latest</code>.</p>
</blockquote>
<p><strong>PORTS</strong></p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">portsnap fetch auto
make -C /usr/ports/sysutils/bastille install clean
</code></pre></div><p><strong>GIT(bleeding edge/unstable)</strong></p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">git clone https://github.com/BastilleBSD/bastille.git
cd bastille
make install
</code></pre></div><h2 id="service-management">Service Management</h2>
<p>Services in FreeBSD are managed centrally in the <code>/etc/rc.conf</code> and use a
syntax of <code>name_enable=(YES|NO)</code>. For example, to start containers
automatically at boot you can set <code>bastille_enable=YES</code> using:</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sysrc bastille_enable<span style="color:#f92672">=</span>YES
</code></pre></div><p>By default, Bastille will start all created containers at boot when enabled.</p>
<p>To specify a limited list of containers to start at boot, set the optional
<code>bastille_list</code> value to the name(s) of containers to start.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sysrc bastille_list<span style="color:#f92672">=</span><span style="color:#e6db74">&#34;azkaban arkham alcatraz&#34;</span>
</code></pre></div><p>Once services have been enabled in the <code>/etc/rc.conf</code>, they can be managed
using the <code>service</code> command.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">service foo <span style="color:#f92672">[</span>start|stop|restart<span style="color:#f92672">]</span>
</code></pre></div><p>Bastille does not run as a service and does not need to be started as such.
Enabling Bastille primarily manages containers at startup and shutdown.</p>
<h2 id="bastille-containers">Bastille Containers</h2>
<p>Once Bastille is installed you&rsquo;ll want to verify the configuration. This is
where you can set the default file system (UFS or ZFS) and define the default
network interface for containers.</p>
<p><strong>/usr/local/etc/bastille/bastille.conf</strong></p>
<p>I recommend looking at the following:</p>
<h2 id="default-timezone">default timezone</h2>
<p>If you&rsquo;d prefer to set a specific timezone for your containers you may change
it here. The default is to use the timezone of the host.</p>
<p>Requires format &ldquo;America/Denver&rdquo; or &ldquo;Europe/Paris&rdquo;. (see <code>/usr/share/zoneinfo</code>)</p>
<pre tabindex="0"><code>bastille_tzdata=&quot;&quot; ## default: empty to use host's time zone
</code></pre><h2 id="zfs-recommended">ZFS (recommended)</h2>
<p>If your system uses ZFS as a filesystem you can make use of that here. Set the
enable option to <code>YES</code> and define the <code>zpool</code>. If either is undefined ZFS will
not be used.</p>
<pre tabindex="0"><code>## ZFS options
bastille_zfs_enable=&quot;&quot; ## default: &quot;&quot;
bastille_zfs_zpool=&quot;&quot; ## default: &quot;&quot;
</code></pre><h2 id="networking">Networking</h2>
<p>Bastille can be flexible about the way it handles networking. In this document
we will use the more portable &ldquo;loopback&rdquo; network design. This can be used in
the same way in the cloud or on local networks. Bastille uses this method by default.</p>
<p>If you&rsquo;d like to use an alternate method, refer to the <a href="https://docs.bastillebsd.org/en/latest/chapters/networking.html">Bastille Networking
Documentation</a>.</p>
<p>There is a one-time setup requirement to configure a new <code>bastille0</code> loopback
interface and define firewall rules:</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sysrc cloned_interfaces<span style="color:#f92672">+=</span>lo1
sysrc ifconfig_lo1_name<span style="color:#f92672">=</span><span style="color:#e6db74">&#34;bastille0&#34;</span>
service netif cloneup
</code></pre></div><p>With this in place we can create the firewall rules that will both limit access
to the host system and containers, and also provide a NAT rule for the new
<code>bastille0</code> loopback interface to access the broader network.</p>
<p>Create <code>/etc/pf.conf</code> and use the following rules:</p>
<pre tabindex="0"><code>ext_if=&quot;vtnet0&quot;
set block-policy return
scrub in on $ext_if all fragment reassemble
set skip on lo
table &lt;jails&gt; persist
nat on $ext_if from &lt;jails&gt; to any -&gt; ($ext_if:0)
rdr-anchor &quot;rdr/*&quot;
block in all
pass out quick keep state
antispoof for $ext_if inet
pass in inet proto tcp from any to any port ssh flags S/SA keep state
</code></pre><blockquote>
<p>IMPORTANT: Update <code>ext_if=&quot;vtnet0&quot;</code> with the name of your external interface as needed.</p>
</blockquote>
<p>This is a sane and simple ruleset that will allow all traffic outbound and
block all traffic inbound (with the exception of allowing SSH traffic in). It
is also what provides external network access to the containers by way of the
<code>table</code> and <code>nat</code> rule. Without those rules there is no external network access
for the containers.</p>
<p>Finally enable and start the firewall.</p>
<blockquote>
<p>Tip: Starting the firewall will disconnect any remote sessions (ie; the
connection you may be using now). SSH inbound access is allowed by the new
policy, simply reconnect.</p>
</blockquote>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sysrc pf_enable<span style="color:#f92672">=</span>YES
service pf start
</code></pre></div><p>Now equipped with a robust firewall and a sane configuration you&rsquo;re ready to
bootstrap a release and begin creating containers!</p>
<h2 id="bootstrap">bootstrap</h2>
<p>To <code>bootstrap</code> a release for use with your container use the <code>bootstrap</code>
sub-command.</p>
<blockquote>
<p>You can optionally append the keyword <code>update</code> to automagically apply <code>freebsd-update</code> to the downloaded release.</p>
</blockquote>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille bootstrap 14.0-RELEASE update
</code></pre></div><p>You can now create a container using the newly bootstrapped release.</p>
<h2 id="create">create</h2>
<p>In order to create a container you will need to provide a unique container
name, a bootstrapped release name and static IP address.</p>
<p>You can use any (<a href="https://tools.ietf.org/html/rfc1918">rfc1918</a>) private IP
range for your containers. For example, unless your host IP also has a 10.x.x.x
IP, it&rsquo;s safe to use any address within that range.</p>
<p>IP options include: <code>10.0.0.0/8</code>, <code>172.16.0.0/12</code> and <code>192.168.0.0/16</code>.</p>
<blockquote>
<p>Tip: container names cannot include the dot (&quot;.&quot;) character.</p>
</blockquote>
<p>Container creation should be very quick.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille create alcatraz 14.0-RELEASE 10.17.89.50/24
</code></pre></div><h2 id="list">list</h2>
<p>You can list running containers.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille list
</code></pre></div><h2 id="pkg">pkg</h2>
<p>Install packages inside the container.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille pkg alcatraz install -y htop
</code></pre></div><h2 id="htop">htop</h2>
<p>htop is an interactive process viewer. When you view processes inside a
container you only see that container&rsquo;s processes.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille htop alcatraz
</code></pre></div><p>Notice that <code>syslogd</code> and <code>cron</code> are the only default processes.</p>
<figure>
<img src="https://bastillebsd.org/img/bastille-htop-alcatraz.png" alt="" >
<figcaption>
Interactive Process Viewer
</figcaption>
</figure>
<p>Tip: Press &ldquo;q&rdquo; to quit.</p>
<h2 id="sysrc">sysrc</h2>
<p>Let&rsquo;s toggle a setting inside the container and enable the <code>sshd</code> service.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille sysrc alcatraz sshd_enable<span style="color:#f92672">=</span>YES
</code></pre></div><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell"><span style="color:#f92672">[</span>alcatraz<span style="color:#f92672">]</span>:
sshd_enable: NO -&gt; YES
</code></pre></div><h2 id="service">service</h2>
<p>Start up the newly enabled service.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille service alcatraz sshd start
</code></pre></div><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell"><span style="color:#f92672">[</span>alcatraz<span style="color:#f92672">]</span>:
Generating RSA host key.
<span style="color:#ae81ff">2048</span> SHA256:PsH1pAJbRC4hup+jyDxhFxhMHcGrYBWr5aL84y3Bjc0 root@alcatraz <span style="color:#f92672">(</span>RSA<span style="color:#f92672">)</span>
Generating ECDSA host key.
<span style="color:#ae81ff">256</span> SHA256:eqCAkH/tW2OnrV4B3BflK76ZV08jWGfoHF7AX/iPvM8 root@alcatraz <span style="color:#f92672">(</span>ECDSA<span style="color:#f92672">)</span>
Generating ED25519 host key.
<span style="color:#ae81ff">256</span> SHA256:1GFg1+agxbEZpernrtrcKEfLzWcih+2xRaOe97fmMcU root@alcatraz <span style="color:#f92672">(</span>ED25519<span style="color:#f92672">)</span>
Performing sanity check on sshd configuration.
Starting sshd.
</code></pre></div><h2 id="cmd">cmd</h2>
<p>Execute arbitrary commands inside the container. In this case check to see that
<code>sshd</code> is listening on port <code>:22</code> using the <code>sockstat -4</code> command.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille cmd alcatraz sockstat -4
</code></pre></div><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell"><span style="color:#f92672">[</span>alcatraz<span style="color:#f92672">]</span>:
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root sshd <span style="color:#ae81ff">34994</span> <span style="color:#ae81ff">4</span> tcp4 10.17.89.50:22 *:*
<span style="color:#f92672">[</span>alcatraz<span style="color:#f92672">]</span>: <span style="color:#ae81ff">0</span>
</code></pre></div><h2 id="console">console</h2>
<p>Finally, use <code>console</code> for a password-less root login to the container and have
a look around. You&rsquo;ll find yourself in a wholly contained FreeBSD system with
the ability to build whatever you need to build.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille console alcatraz
</code></pre></div><p>The <code>root</code> user is still (mostly) all powerful, but only within the confines of
that container.</p>
<p>When you&rsquo;re finished, log out of the container as normal with <code>exit</code> or
<code>ctrl-d</code>.</p>
<h2 id="stop">stop</h2>
<p>When you&rsquo;re done testing your container you can shut it off.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille stop alcatraz
</code></pre></div><h2 id="destroy">destroy</h2>
<p>Lastly, destroy your lightweight container.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">bastille destroy alcatraz
</code></pre></div><h2 id="usage">usage</h2>
<pre tabindex="0"><code>Bastille is an open-source system for automating deployment and management of
containerized applications on FreeBSD.
Usage:
bastille command TARGET [args]
Available Commands:
bootstrap Bootstrap a FreeBSD release for container base.
cmd Execute arbitrary command on targeted container(s).
clone Clone an existing container.
config Get or set a config value for the targeted container(s).
console Console into a running container.
convert Convert a Thin container into a Thick container.
cp cp(1) files from host to targeted container(s).
create Create a new thin container or a thick container if -T|--thick option specified.
destroy Destroy a stopped container or a FreeBSD release.
edit Edit container configuration files (advanced).
export Exports a specified container.
help Help about any command.
htop Interactive process viewer (requires htop).
import Import a specified container.
limits Apply resources limits to targeted container(s). See rctl(8).
list List containers (running and stopped).
mount Mount a volume inside the targeted container(s).
pkg Manipulate binary packages within targeted container(s). See pkg(8).
rcp reverse cp(1) files from a single container to the host.
rdr Redirect host port to container port.
rename Rename a container.
restart Restart a running container.
service Manage services within targeted container(s).
start Start a stopped container.
stop Stop a running container.
sysrc Safely edit rc files within targeted container(s).
template Apply file templates to targeted container(s).
top Display and update information about the top(1) cpu processes.
umount Unmount a volume from within the targeted container(s).
update Update container base -pX release.
upgrade Upgrade container release to X.Y-RELEASE.
verify Compare release against a &quot;known good&quot; index.
zfs Manage (get|set) ZFS attributes on targeted container(s).
Use &quot;bastille -v|--version&quot; for version information.
Use &quot;bastille command -h|--help&quot; for more information about a command.
</code></pre><hr>
<p>To learn more about automating containerized applications, see
the <a href="https://docs.bastillebsd.org">Bastille Documentation</a>.</p>
<hr>
</description>
</item>
<item>
<title>Ten Things To Do After Installing FreeBSD</title>
<link>https://bastillebsd.org/blog/2022/01/15/ten-things-to-do-after-installing-freebsd/</link>
<pubDate>Wed, 16 Feb 2022 21:21:25 -0700</pubDate>
<guid>https://bastillebsd.org/blog/2022/01/15/ten-things-to-do-after-installing-freebsd/</guid>
<description>
<figure>
<img src="https://bastillebsd.org/img/freebsd-new-logo.png" alt="" >
<figcaption>
The top ten things I configure on a new installation.
</figcaption>
</figure>
<hr>
<p>Bastille is an open-source system for automating deployment and management
containerized applications on FreeBSD.</p>
<ul>
<li>Follow <a href="https://fosstodon.org/@BastilleBSD">@BastilleBSD on Mastodon</a></li>
<li>Join the discussion <a href="https://discord.gg/FawhD6DUdm">BastilleBSD on Discord</a></li>
<li>Join the discussion <a href="https://t.me/BastilleBSD">BastilleBSD on Telegram</a></li>
<li>Subscribe to <a href="https://www.youtube.com/c/BastilleBSD">BastilleBSD on YouTube</a></li>
<li>Support <a href="https://patreon.com/BastilleBSD">BastilleBSD on Patreon</a></li>
</ul>
<hr>
<h2 id="1-hushlogin">1. ~/.hushlogin</h2>
<p>Makes login quieter. (<a href="https://www.freebsd.org/cgi/man.cgi?login(1)">man login</a>)</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">touch ~/.hushlogin
</code></pre></div><h2 id="2-apply-patches">2. Apply Patches</h2>
<p>Apply updates to the host. (<a href="https://www.freebsd.org/cgi/man.cgi?freebsd-update(8)">man freebsd-update</a>)</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">freebsd-update fetch install
reboot
freebsd-update install
</code></pre></div><h2 id="3-disable-atime-zfs">3. disable atime (ZFS)</h2>
<pre tabindex="0"><code>zfs set atime=off zroot
</code></pre><h2 id="4-install-required-packages">4. install required packages</h2>
<p>Bootstrap the binary package manager and install core packages.</p>
<p><strong>Virtual Hardware</strong></p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">pkg install vim git-lite zsh htop tree node_exporter doas bastille rocinante
</code></pre></div><p><strong>Physical Hardware</strong></p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">pkg install vim git-lite zsh htop tree smartmontools node_exporter doas devcpu-data bastille rocinante
</code></pre></div><h2 id="5-configure-zsh-shell">5. configure zsh shell</h2>
<pre tabindex="0"><code>fetch https://git.io/antigen -o /usr/local/share/zsh/antigen.zsh
</code></pre><pre tabindex="0"><code>cat &lt;&lt;EOF&gt;~/.zshrc
source /usr/local/share/zsh/antigen.zsh
antigen use oh-my-zsh
antigen bundle zsh-users/zsh-syntax-highlighting
antigen bundle zsh-users/zsh-autosuggestions
antigen bundle zsh-users/zsh-completions
antigen theme gentoo
antigen bundle genpass
antigen apply
EOF
</code></pre><pre tabindex="0"><code>chsh -s /usr/local/bin/zsh
zsh
</code></pre><h2 id="6-configure-doas">6. configure doas</h2>
<p>Add any new admins to the wheel group.</p>
<p>Create <code>/usr/local/etc/doas.conf</code> and populate with a simple ruleset.</p>
<pre tabindex="0"><code>cat &lt;&lt;EOF&gt;/usr/local/etc/doas.conf
permit nopass :wheel
EOF
</code></pre><h2 id="7-generate-ssh-keys">7. generate SSH keys</h2>
<p>Delete the auto-generated SSH keys and regenerate using only good key types.</p>
<pre tabindex="0"><code>rm /etc/ssh/ssh_host_*
sysrc sshd_dsa_enable=&quot;no&quot;
sysrc sshd_ecdsa_enable=&quot;no&quot;
sysrc sshd_ed25519_enable=&quot;yes&quot;
sysrc sshd_rsa_enable=&quot;yes&quot;
service sshd keygen
service sshd restart
</code></pre><h2 id="8-network--firewall">8. network &amp; firewall</h2>
<pre tabindex="0"><code>sysrc cloned_interfaces+=lo1
sysrc ifconfig_lo1_name=bastille0
service netif cloneup
</code></pre><pre tabindex="0"><code>cat &lt;&lt;EOF&gt;/etc/pf.conf
ext_if=&quot;vtnet0&quot; ## &lt;- change vtnet0 to match host interface
set block-policy return
scrub in on \$ext_if all fragment reassemble
set skip on lo
table &lt;jails&gt; persist
nat on \$ext_if from &lt;jails&gt; to any -&gt; (\$ext_if:0)
rdr-anchor &quot;rdr/*&quot;
block in all
pass out quick keep state
pass in inet proto tcp from any to any port ssh flags S/SA keep state
pass in inet proto tcp from any to any port bootps flags S/SA keep state
pass in inet proto tcp from any to any port {9100,9124} flags S/SA keep state
EOF
</code></pre><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sysrc pf_enable<span style="color:#f92672">=</span>YES
service pf start
</code></pre></div><h2 id="9-metrics-prom_sysctl--node_exporter">9. metrics (prom_sysctl &amp; node_exporter)</h2>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sysrc inetd_enable<span style="color:#f92672">=</span>YES
sysrc node_exporter_enable<span style="color:#f92672">=</span>YES
sysrc node_exporter_args<span style="color:#f92672">=</span><span style="color:#e6db74">&#34;--collector.devstat --collector.ntp&#34;</span>
service inetd start
service node_exporter start
</code></pre></div><h2 id="10-bastille">10. bastille</h2>
<pre tabindex="0"><code>sysrc -f /usr/local/etc/bastill/bastille.conf bastille_zfs_enable=YES
sysrc -f /usr/local/etc/bastill/bastille.conf bastille_zfs_zpool=zroot
sysrc bastille_enable=YES
bastille bootstrap 13.0-RELEASE update
</code></pre><h2 id="bonus-hardware-only">Bonus (hardware only)</h2>
<h3 id="1-microcode-update-amd--intel">1. microcode update (amd / intel)</h3>
<pre tabindex="0"><code>sysrc microcode_update_enable=YES
service microcode_update start
</code></pre><h3 id="2-ntp-aka-what-time-is-it">2. NTP aka What time is it?</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-diff" data-lang="diff"><span style="color:#f92672">--- a/etc/ntp.conf 2021-04-09 00:25:48.000000000 -0600
</span><span style="color:#f92672"></span><span style="color:#a6e22e">+++ b/etc/ntp.conf 2021-12-23 21:51:41.700029000 -0700
</span><span style="color:#a6e22e"></span><span style="color:#75715e">@@ -30,6 +30,9 @@
</span><span style="color:#75715e"></span> # The option `iburst&#39; is used for faster initial synchronization.
#
pool 0.freebsd.pool.ntp.org iburst
<span style="color:#a6e22e">+pool 1.freebsd.pool.ntp.org iburst
</span><span style="color:#a6e22e">+pool 2.freebsd.pool.ntp.org iburst
</span><span style="color:#a6e22e">+pool 3.freebsd.pool.ntp.org iburst
</span><span style="color:#a6e22e"></span>
#
# If you want to pick yourself which country&#39;s public NTP server
</code></pre></div><pre tabindex="0"><code>sysrc ntpd_enable=YES
service ntpd restart
</code></pre><h3 id="3-smartd">3. smartd</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sysrc smartd_enable<span style="color:#f92672">=</span>YES
service smartd start
</code></pre></div></description>
</item>
<item>
<title>Bastille Template: AdGuard Home Exporter</title>
<link>https://bastillebsd.org/blog/2022/01/14/bastille-template-examples-adguardhome-exporter/</link>
<pubDate>Thu, 13 Jan 2022 12:00:10 -0700</pubDate>
<guid>https://bastillebsd.org/blog/2022/01/14/bastille-template-examples-adguardhome-exporter/</guid>
<description>
<figure>
<img src="https://bastillebsd.org/img/adguardhome-exporter-template.png" alt="" >
<figcaption>
AdGuard Exporter Grafana Dashboard (ID: 13330).
</figcaption>
</figure>
<hr>
<p>Bastille is an open-source system for automating deployment and management
containerized applications on FreeBSD.</p>
<ul>
<li>Follow <a href="https://fosstodon.org/@BastilleBSD">@BastilleBSD on Mastodon</a></li>
<li>Join the discussion <a href="https://discord.gg/FawhD6DUdm">BastilleBSD on Discord</a></li>
<li>Join the discussion <a href="https://t.me/BastilleBSD">BastilleBSD on Telegram</a></li>
<li>Subscribe to <a href="https://www.youtube.com/c/BastilleBSD">BastilleBSD on YouTube</a></li>
<li>Support <a href="https://patreon.com/BastilleBSD">BastilleBSD on Patreon</a></li>
</ul>
<hr>
<h2 id="template-adguard-home-exporter">Template: AdGuard Home Exporter</h2>
<p>Bastille is more than just lightweight containers for FreeBSD. The template
command allows you to automatically deploy a wide range of software!</p>
<p>We continue the series with a template that builds on last month&rsquo;s example.
This template will install and integrate a Prometheus exporter into the AdGuard
Home service we installed last time.</p>
<p>If you missed &ldquo;last time&rdquo; you can find it here: <a href="https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/">Bastille Template: AdGuard
Home</a>.</p>
<p>Prometheus is my preferred way to capture metrics and monitor a home or
corporate network. Exporting my DNS information to Prometheus is a great
addition to my dashboards.</p>
<p>If you&rsquo;d like to extend AdGuard Home with this Prometheus exporter follow these
steps:</p>
<h3 id="bootstrap">Bootstrap</h3>
<pre tabindex="0"><code>bastille bootstrap https://gitlab.com/bastillebsd-templates/adguardhome-exporter
</code></pre><p><strong>Output Example</strong></p>
<pre tabindex="0"><code>ishmael ~ # bastille bootstrap https://gitlab.com/bastillebsd-templates/adguardhome-exporter
Cloning into '/usr/local/bastille/templates/bastillebsd-templates/adguardhome-exporter'...
warning: redirecting to https://gitlab.com/bastillebsd-templates/adguardhome-exporter.git/
remote: Enumerating objects: 24, done.
remote: Counting objects: 100% (24/24), done.
remote: Compressing objects: 100% (23/23), done.
remote: Total 24 (delta 7), reused 0 (delta 0), pack-reused 0
Receiving objects: 100% (24/24), 6.05 KiB | 6.05 MiB/s, done.
Resolving deltas: 100% (7/7), done.
Detected Bastillefile hook.
[Bastillefile]:
PKG adguard-exporter
SYSRC adguard_exporter_enable=YES
SYSRC adguard_exporter_username=adguard
SYSRC adguard_exporter_password=BastilleBSD!
SYSRC adguard_exporter_hostname=${JAIL_IP}
SYSRC adguard_exporter_port=80
SYSRC adguard_exporter_protocol=http
SERVICE adguard_exporter restart
Template ready to use.
</code></pre><h3 id="template">Template</h3>
<p>Apply the new template to your existing adguardhome container created from the
previous guide.</p>
<pre tabindex="0"><code>bastille template adguardhome bastillebsd-templates/adguardhome-exporter
</code></pre><p><strong>Output Example</strong></p>
<pre tabindex="0"><code>[adguard]:
Applying template: bastillebsd-templates/adguardhome-exporter...
[adguard]:
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
adguard-exporter: 1.14
Number of packages to be installed: 1
The process will require 6 MiB more space.
2 MiB to be downloaded.
[adguard] [1/1] Fetching adguard-exporter-1.14.pkg: 100% 2 MiB 2.0MB/s 00:01
Checking integrity... done (0 conflicting)
[adguard] [1/1] Installing adguard-exporter-1.14...
===&gt; Creating groups.
Using existing group 'nobody'.
===&gt; Creating users
Using existing user 'nobody'.
[adguard] [1/1] Extracting adguard-exporter-1.14: 100%
[adguard]:
adguard_exporter_enable: -&gt; YES
[adguard]:
adguard_exporter_username: -&gt; adguard
[adguard]:
adguard_exporter_password: -&gt; BastilleBSD!
[adguard]:
adguard_exporter_hostname: -&gt; 10.17.89.53
[adguard]:
adguard_exporter_port: -&gt; 80
[adguard]:
adguard_exporter_protocol: -&gt; http
[adguard]:
Starting adguard_exporter.
Template applied: bastillebsd-templates/adguardhome-exporter
</code></pre><h3 id="usage">Usage</h3>
<p>Now that the template is applied you can add the node to your Prometheus targets.
The exporter presents metrics on port <code>:9617</code>.</p>
<p>You&rsquo;ll probably want to import the <a href="https://grafana.com/grafana/dashboards/13330">AdGuard Exporter Grafana
Dashboard</a> too.</p>
</description>
</item>
<item>
<title>Bastille 0.9.20211225 Demo Livestream</title>
<link>https://bastillebsd.org/blog/2022/01/07/bastille-0-9-20211225-demo-livestream/</link>
<pubDate>Fri, 07 Jan 2022 12:00:10 -0700</pubDate>
<guid>https://bastillebsd.org/blog/2022/01/07/bastille-0-9-20211225-demo-livestream/</guid>
<description><hr>
<p>Bastille is an open-source system for automating deployment and management
containerized applications on FreeBSD.</p>
<ul>
<li>Follow <a href="https://fosstodon.org/@BastilleBSD">@BastilleBSD on Mastodon</a></li>
<li>Join the discussion <a href="https://discord.gg/FawhD6DUdm">BastilleBSD on Discord</a></li>
<li>Join the discussion <a href="https://t.me/BastilleBSD">BastilleBSD on Telegram</a></li>
<li>Subscribe to <a href="https://www.youtube.com/c/BastilleBSD">BastilleBSD on YouTube</a></li>
<li>Support <a href="https://patreon.com/BastilleBSD">BastilleBSD on Patreon</a></li>
</ul>
<hr>
<h1 id="bastille-0920211225-demo-livestream">Bastille 0.9.20211225 Demo Livestream</h1>
<div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;">
<iframe src="https://www.youtube.com/embed/Ur43kOWdYJ0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe>
</div>
</description>
</item>
<item>
<title>Closing Out 2021 With New Bastille Release</title>
<link>https://bastillebsd.org/blog/2021/12/25/closing-out-2021-with-new-bastille-release/</link>
<pubDate>Thu, 23 Dec 2021 15:52:01 -0700</pubDate>
<guid>https://bastillebsd.org/blog/2021/12/25/closing-out-2021-with-new-bastille-release/</guid>
<description>
<figure>
<img src="https://bastillebsd.org/img/debian-ubuntu.jpg" alt="" >
<figcaption>
Experimenting with Debian and Ubuntu Containers
</figcaption>
</figure>
<hr>
<p>Bastille is an open-source system for automating deployment and management
containerized applications on FreeBSD.</p>
<ul>
<li>Follow <a href="https://fosstodon.org/@BastilleBSD">@BastilleBSD on Mastodon</a></li>
<li>Join the discussion <a href="https://discord.gg/FawhD6DUdm">BastilleBSD on Discord</a></li>
<li>Join the discussion <a href="https://t.me/BastilleBSD">BastilleBSD on Telegram</a></li>
<li>Subscribe to <a href="https://www.youtube.com/channel/UCniTnQDKIZN9ZTLPiyMI5eA">BastilleBSD on YouTube</a></li>
<li>Support <a href="https://patreon.com/BastilleBSD">BastilleBSD on Patreon</a></li>
</ul>
<hr>
<h1 id="bastille-0920211225-happy-holidays">Bastille 0.9.20211225 &ldquo;Happy Holidays&rdquo;</h1>
<p>Happy Holidays! Bastille development continues with five months of new features
and fixes! These release notes outline the changes you can expect to find in
our latest version.</p>
<h2 id="more-linux-improvements">More Linux Improvements</h2>
<p>This release adds additional experimental support for Debian 11 &ldquo;Bullseye&rdquo;,
Debian 10 &ldquo;Buster&rdquo;, Debian 9 &ldquo;Stretch&rdquo;, Ubuntu 18.04 &ldquo;Bionic&rdquo; and Ubuntu 20.04
&ldquo;Focal&rdquo;. Linux support is maturing thanks to feedback and contributions from
the community!</p>
<p>What&rsquo;s more, the <code>CMD</code> and <code>PKG</code> sub-commands support these Linux releases!</p>
<p>These changes open up initial support for using templates with Linux
containers. Currently limited to <code>CMD</code> and <code>PKG</code> only.</p>
<p>Note: this release updates the <code>bastille.conf</code>. If you are upgrading please
merge config changes.</p>
<h3 id="debian-releases">Debian releases</h3>
<p><strong>Bullseye</strong></p>
<pre tabindex="0"><code>bastille bootstrap bullseye
bastille create -L debian11 bullseye 10.17.89.11
</code></pre><p><strong>Buster</strong></p>
<pre tabindex="0"><code>bastille bootstrap buster
bastille create -L debian10 buster 10.17.89.10
</code></pre><p><strong>Stretch</strong></p>
<pre tabindex="0"><code>bastille bootstrap stretch
bastille create -L debian9 stretch 10.17.89.9
</code></pre><h3 id="ubuntu-releases">Ubuntu releases</h3>
<p><strong>Bionic</strong></p>
<pre tabindex="0"><code>bastille bootstrap bionic
bastille create -L ubuntu18 bionic 10.17.89.18
</code></pre><p><strong>Focal</strong></p>
<pre tabindex="0"><code>bastille bootstrap focal
bastille create -L ubuntu20 focal 10.17.89.20
</code></pre><p>Improvements have also been made to simplify future Linux additions to the codebase.</p>
<h3 id="linux-support-for-pkg">Linux support for PKG</h3>
<p>The <code>pkg</code> sub-command now supports Ubuntu &amp; Debian containers by using <code>apt</code>
transparently inside the container.</p>
<pre tabindex="0"><code>bastille pkg debian11 upgrade
</code></pre><h3 id="linux-support-for-cmd">Linux support for CMD</h3>
<p>The <code>cmd</code> sub-command now supports Ubuntu &amp; Debian containers.</p>
<pre tabindex="0"><code>bastille cmd debian11 ps -ef
</code></pre><h3 id="new-pkg-option">New PKG option</h3>
<p>The <code>pkg</code> sub-command now optionally supports using the hosts package manager
instead of the container pkg binary.</p>
<pre tabindex="0"><code>bastille pkg -H alcatraz upgrade
bastille pkg --host alcatraz install htop
</code></pre><h2 id="exit-codes">Exit Codes</h2>
<p>CMD now returns exit code for individual jails and ALL jails.</p>
<p>If CMD is executed against ALL jails and any return an error the command will
return exit code 1. All jails need to return 0 for the command to return 0.</p>
<h2 id="timezone-settings">Timezone settings</h2>
<p>Bastille will now use the timezone configured on the host unless otherwise
defined in the bastille.conf.</p>
<h2 id="vnet-improvements">VNET Improvements</h2>
<p>This release adds more options to VNET containers including descriptions and
usage of existing bridge interfaces.</p>
<h3 id="vnet-bridge">VNET Bridge</h3>
<p>The <code>create</code> command now supports a <code>-B</code> option to attach a VNET container to
an existing bridge.</p>
<pre tabindex="0"><code>bastille create -B alcatraz 13.0-RELEASE 192.168.1.5/24 bridge0
</code></pre><h3 id="vnet-descriptions">VNET descriptions</h3>
<p>VNET interfaces will now be given an interface description including the
container name. This will help map containers with interfaces in VNET
configurations.</p>
<h2 id="template-improvements">Template Improvements</h2>
<h3 id="recursive-verify">recursive verify</h3>
<p>When using <code>bastille verify</code> against a template that contains an <code>INCLUDE</code>
statement Bastille will now recursively verify every template in the chain.</p>
<h3 id="bastille-update-supports-templates">bastille update supports templates</h3>
<p>You can now easily update templates using <code>bastille update ...</code>. The syntax
supports multiple options as described here:</p>
<p>Update all templates (using git)</p>
<pre tabindex="0"><code>bastille update TEMPLATES
</code></pre><p>Update the bastillebsd-templates/nginx template only</p>
<pre tabindex="0"><code>bastille update bastillebsd-templates/nginx
</code></pre><h2 id="whats-changed">What&rsquo;s Changed</h2>
<ul>
<li>Fix creation of Linux jails by @cynix in <a href="https://github.com/BastilleBSD/bastille/pull/422">https://github.com/BastilleBSD/bastille/pull/422</a></li>
<li>Fix minor typo in README by @yaazkal in <a href="https://github.com/BastilleBSD/bastille/pull/425">https://github.com/BastilleBSD/bastille/pull/425</a></li>
<li>Refactor: Creates Linux jails bootstrap functions by @yaazkal in <a href="https://github.com/BastilleBSD/bastille/pull/426">https://github.com/BastilleBSD/bastille/pull/426</a></li>
<li>Adds: Debian 9 (Stretch) as a release for linux jails by @yaazkal in <a href="https://github.com/BastilleBSD/bastille/pull/427">https://github.com/BastilleBSD/bastille/pull/427</a></li>
<li>Added logic for setting ipv6_defaultrouter for vnet template by @FloGatt in <a href="https://github.com/BastilleBSD/bastille/pull/429">https://github.com/BastilleBSD/bastille/pull/429</a></li>
<li>Adds: Debian 10 (Buster) as a release for linux jails by @yaazkal in <a href="https://github.com/BastilleBSD/bastille/pull/430">https://github.com/BastilleBSD/bastille/pull/430</a></li>
<li>bastille cmd exit code not respected #272 by @yerrysherry in <a href="https://github.com/BastilleBSD/bastille/pull/303">https://github.com/BastilleBSD/bastille/pull/303</a></li>
<li>improve NO_COLOR detection by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/431">https://github.com/BastilleBSD/bastille/pull/431</a></li>
<li>fix overloaded variable in mount command by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/432">https://github.com/BastilleBSD/bastille/pull/432</a></li>
<li>basic PKG support for ubuntu/debian containers by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/433">https://github.com/BastilleBSD/bastille/pull/433</a></li>
<li>Sets require NETWORKING in the rc script by @yaazkal in <a href="https://github.com/BastilleBSD/bastille/pull/436">https://github.com/BastilleBSD/bastille/pull/436</a></li>
<li>Zfs support to docs by @Bennykillua in <a href="https://github.com/BastilleBSD/bastille/pull/453">https://github.com/BastilleBSD/bastille/pull/453</a></li>
<li>fix image path for zfs support screenshot by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/454">https://github.com/BastilleBSD/bastille/pull/454</a></li>
<li>add zfs-support doc to toctree by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/455">https://github.com/BastilleBSD/bastille/pull/455</a></li>
<li>minor fix for docs path by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/456">https://github.com/BastilleBSD/bastille/pull/456</a></li>
<li>fixing issue with docs (conflict with docutils v0.18) by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/457">https://github.com/BastilleBSD/bastille/pull/457</a></li>
<li>Added code and -B option to &ldquo;create&rdquo; to allow creating/managing jails attached to external bridge by @draga79 in <a href="https://github.com/BastilleBSD/bastille/pull/465">https://github.com/BastilleBSD/bastille/pull/465</a></li>
<li>Use the devfs_ruleset number from imported iocage jails by @robarnold in <a href="https://github.com/BastilleBSD/bastille/pull/461">https://github.com/BastilleBSD/bastille/pull/461</a></li>
<li>add recursive verify for includes in Bastillefile by @w4andy in <a href="https://github.com/BastilleBSD/bastille/pull/452">https://github.com/BastilleBSD/bastille/pull/452</a></li>
<li>Fix for issue #403 by @zilti in <a href="https://github.com/BastilleBSD/bastille/pull/442">https://github.com/BastilleBSD/bastille/pull/442</a></li>
<li>Fixed to update_fstab() in clone.sh by @frikilax in <a href="https://github.com/BastilleBSD/bastille/pull/446">https://github.com/BastilleBSD/bastille/pull/446</a></li>
<li>update vagrant to FreeBSD-13.0 and install git by @w4andy in <a href="https://github.com/BastilleBSD/bastille/pull/451">https://github.com/BastilleBSD/bastille/pull/451</a></li>
<li>[REF] bootsrap: Removes code duplication to prevent future errors by @yaazkal in <a href="https://github.com/BastilleBSD/bastille/pull/466">https://github.com/BastilleBSD/bastille/pull/466</a></li>
<li>Add a description to the host vnet interface by @robarnold in <a href="https://github.com/BastilleBSD/bastille/pull/459">https://github.com/BastilleBSD/bastille/pull/459</a></li>
<li>TEMPLATE.SH::ADDED:: ability to apply templates using a custom directory path by @frikilax in <a href="https://github.com/BastilleBSD/bastille/pull/445">https://github.com/BastilleBSD/bastille/pull/445</a></li>
<li>Use host&rsquo;s time zone by default for jails by @yaazkal in <a href="https://github.com/BastilleBSD/bastille/pull/467">https://github.com/BastilleBSD/bastille/pull/467</a></li>
<li>use full path when calling jls binary by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/469">https://github.com/BastilleBSD/bastille/pull/469</a></li>
<li>hotfix for the VNET interface description patch by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/471">https://github.com/BastilleBSD/bastille/pull/471</a></li>
<li>easy way to update templates by @w4andy in <a href="https://github.com/BastilleBSD/bastille/pull/450">https://github.com/BastilleBSD/bastille/pull/450</a></li>
<li>Extra validation for Linux jails, small changes by @JRGTH in <a href="https://github.com/BastilleBSD/bastille/pull/420">https://github.com/BastilleBSD/bastille/pull/420</a></li>
<li>add Debian 11 &lsquo;bullseye&rsquo; to Linux supported list by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/473">https://github.com/BastilleBSD/bastille/pull/473</a></li>
<li>jls path fix + support using host package manager by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/474">https://github.com/BastilleBSD/bastille/pull/474</a></li>
<li>change new PKG option from -P to -H by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/475">https://github.com/BastilleBSD/bastille/pull/475</a></li>
<li>accidentally the jail name in run test by @cedwards in <a href="https://github.com/BastilleBSD/bastille/pull/476">https://github.com/BastilleBSD/bastille/pull/476</a></li>
</ul>
<h2 id="new-contributors">New Contributors</h2>
<ul>
<li>@FloGatt made their first contribution in <a href="https://github.com/BastilleBSD/bastille/pull/429">https://github.com/BastilleBSD/bastille/pull/429</a></li>
<li>@yerrysherry made their first contribution in <a href="https://github.com/BastilleBSD/bastille/pull/303">https://github.com/BastilleBSD/bastille/pull/303</a></li>
<li>@Bennykillua made their first contribution in <a href="https://github.com/BastilleBSD/bastille/pull/453">https://github.com/BastilleBSD/bastille/pull/453</a></li>
<li>@draga79 made their first contribution in <a href="https://github.com/BastilleBSD/bastille/pull/465">https://github.com/BastilleBSD/bastille/pull/465</a></li>
<li>@robarnold made their first contribution in <a href="https://github.com/BastilleBSD/bastille/pull/461">https://github.com/BastilleBSD/bastille/pull/461</a></li>
<li>@w4andy made their first contribution in <a href="https://github.com/BastilleBSD/bastille/pull/452">https://github.com/BastilleBSD/bastille/pull/452</a></li>
<li>@frikilax made their first contribution in <a href="https://github.com/BastilleBSD/bastille/pull/446">https://github.com/BastilleBSD/bastille/pull/446</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/BastilleBSD/bastille/compare/0.9.20210714...0.9.20211225">https://github.com/BastilleBSD/bastille/compare/0.9.20210714...0.9.20211225</a></p>
</description>
</item>
<item>
<title>Bastille Template: AdGuard Home</title>
<link>https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/</link>
<pubDate>Tue, 14 Dec 2021 12:00:10 -0700</pubDate>
<guid>https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/</guid>
<description>
<figure>
<img src="https://bastillebsd.org/img/adguardhome-template.png" alt="" >
<figcaption>
AdGuard Home is network-wide software for blocking ads &amp; tracking.
</figcaption>
</figure>
<hr>
<p>Bastille is an open-source system for automating deployment and management
containerized applications on FreeBSD.</p>
<ul>
<li>Follow <a href="https://fosstodon.org/@BastilleBSD">@BastilleBSD on Mastodon</a></li>
<li>Join the discussion <a href="https://discord.gg/FawhD6DUdm">BastilleBSD on Discord</a></li>
<li>Join the discussion <a href="https://t.me/BastilleBSD">BastilleBSD on Telegram</a></li>
<li>Subscribe to <a href="https://www.youtube.com/c/BastilleBSD">BastilleBSD on YouTube</a></li>
<li>Support <a href="https://patreon.com/BastilleBSD">BastilleBSD on Patreon</a></li>
</ul>
<hr>
<h2 id="template-adguard-home">Template: AdGuard Home</h2>
<p>Bastille is more than just lightweight containers for FreeBSD. The template
command allows you to automatically deploy a wide range of software! This post
begins a series highlighting examples of deploying popular applications using
Bastille on FreeBSD.</p>
<p>We begin the series with something I run in my homelab. I run three instances
if I&rsquo;m being honest. A network-wide service for blocking ads &amp; online tracking,
AdGuard Home.</p>
<p>AdGuard Home provides a privacy focused DNS server inside your home network
giving you network-wide blocking of ads and tracking. This means ad blocking
for your phones, laptops, desktops, TVs and any other Internet connected
devices in your home all in one place. No apps to install or browser plugins to
update. Simply point everything to the AdGuard Home server(s) and you&rsquo;re done.</p>
<p>As I mentioned, I run three of these instances in my homelab supporting fifty
devices. The dashboard results have been enlightening in understanding DNS
behavior on my network. Who knew the streaming device connected to my TV would
be a top offender!</p>
<p>If you&rsquo;d like to run AdGuard Home with Bastille follow these steps:</p>
<h3 id="bootstrap">Bootstrap</h3>
<pre tabindex="0"><code>bastille bootstrap https://gitlab.com/bastillebsd-templates/adguardhome
</code></pre><p><strong>Output Example</strong></p>
<pre tabindex="0"><code>ishmael ~ # bastille bootstrap https://gitlab.com/bastillebsd-templates/adguardhome
Cloning into '/usr/local/bastille/templates/bastillebsd-templates/adguardhome'...
warning: redirecting to https://gitlab.com/bastillebsd-templates/adguardhome.git/
remote: Enumerating objects: 30, done.
remote: Counting objects: 100% (15/15), done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 30 (delta 4), reused 2 (delta 0), pack-reused 15
Receiving objects: 100% (30/30), 7.62 KiB | 7.63 MiB/s, done.
Resolving deltas: 100% (8/8), done.
Detected Bastillefile hook.
[Bastillefile]:
PKG ca_root_nss adguardhome
CP usr /
SYSRC adguardhome_enable=YES
SERVICE adguardhome start
RDR tcp 80 80
RDR udp 53 53
Template ready to use.
</code></pre><h3 id="create">Create</h3>
<pre tabindex="0"><code>bastille create adguardhome 13.0-RELEASE 10.17.89.53 bastille0
</code></pre><p><strong>Output Example</strong></p>
<pre tabindex="0"><code>ishmael ~ # bastille create adguardhome 13.0-RELEASE 10.17.89.53 bastille0
Valid: (10.17.89.53).
Valid: (bastille0).
[adguardhome]:
adguard: created
[adguardhome]:
Applying template: default/thin...
[adguardhome]:
Applying template: default/base...
[adguardhome]:
[adguardhome]:
syslogd_flags: -s -&gt; -ss
[adguardhome]:
sendmail_enable: NO -&gt; NO
[adguardhome]:
sendmail_submit_enable: YES -&gt; NO
[adguardhome]:
sendmail_outbound_enable: YES -&gt; NO
[adguardhome]:
sendmail_msp_queue_enable: YES -&gt; NO
[adguardhome]:
cron_flags: -&gt; -J 60