Void Linux

#!/bin/sh

# Find the name of the current boot environment
BOOTENV="$(awk '$2 == "/" && $3 == "zfs" {print $1}' /proc/mounts)"
[ -n "${BOOTENV}" ] || exit

# Create a snapshot of the current state, differntiated by time
zfs snapshot "${BOOTENV}@kernel_upgrade_$(date +%Y-%m-%d_%H:%M:%S)" || exit

# Prune all except 2 last kernel_upgrade snapshots
zfs list -t snapshot -s creation -o name -H "${BOOTENV}" | \
  grep @kernel_upgrade_ | head -n -2 | \
  while read -r snapname; do
    zfs destroy "${snapname}"
  done

# Prune the old kernels
vkpurge rm all

#!/usr/sbin/nft -f

# This is somewhat important, otherwise it will just append to your existing
# rules. This can be somewhat confusing unless you run `nft list table inet
# filter` or similar
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0;

    # Allow all input on loopback
    iif lo accept

    # Accept stateful traffic
    ct state established,related accept

    # Accept SSH
    tcp dport { 22, 65535 } accept

    # Accept HTTP and HTTPs
    tcp dport { 80, 443 } accept

    # Allow some icmp traffic for ipv6
    ip6 nexthdr icmpv6 icmpv6 type {
      nd-neighbor-solicit, echo-request,
      nd-router-advert, nd-neighbor-advert
    } accept

    counter drop
  }
  chain forward {
    type filter hook forward priority 0;
  }
  chain output {
    type filter hook output priority 0;
  }
}

#!/bin/sh
exec 2>&1
USER='dienst'
GROUP='dienst'
BIN='/usr/local/bin/dienst'
# nur nötig wenn man Umgebungsvariablen setzen möchte
ENVDIR='/etc/sv/dienst/envdir'
# z.B. Konfiguration testen
env -i chpst -u ${USER}:${GROUP} -c /etc/dienst/config.yaml -t || exit $?
# abhängigen Dienst starten
sv start dienst_1 || exit 1
exec env -i chpst -u ${USER}:${GROUP} ${BIN} -c /etc/dienst/config.yaml
# oder um Umgebungsvariablen zu setzen
exec env -i chpst -u ${USER}:${GROUP} -e ${ENVDIR} ${BIN} -c /etc/dienst/config.yaml

#!/usr/bin/env fish

set BIN_PATH_INSTALLED "/usr/local/bin/crowdsec-firewall-bouncer"
set BIN_PATH "./crowdsec-firewall-bouncer"
set CONFIG_DIR "/etc/crowdsec/bouncers"
set FW_BACKEND "nftables"

install -v -m 755 -D "$BIN_PATH" "$BIN_PATH_INSTALLED"
mkdir -p "$CONFIG_DIR"
install -v -m 0600 "./config/crowdsec-firewall-bouncer.yaml" "$CONFIG_DIR/crowdsec-firewall-bouncer.yaml"

set SUFFIX (tr -dc A-Za-z0-9 </dev/urandom | head -c 8)
set API_KEY (cscli bouncers add cs-firewall-bouncer-$SUFFIX -o raw)

API_KEY=$API_KEY BACKEND=$FW_BACKEND envsubst < ./config/crowdsec-firewall-bouncer.yaml | install -m 0600 /dev/stdin "$CONFIG_DIR/crowdsec-firewall-bouncer.yaml"

#!/bin/sh
exec 2>&1
BIN=/usr/local/bin/crowdsec-firewall-bouncer
$BIN -c /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml -t || exit $?
sv start crowdsec || exit 1
sv start nftables || exit 1
exec $BIN -c /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

#!/bin/sh
exec 2>&1
cd /var/lib/container
export UID=$(id -u container)
export GID=$(id -g container)
sv -v up docker || exit 1
exec /bin/docker compose up --no-log-prefix

#!/bin/sh
cd /var/lib/container
/bin/docker compose down