Skip to content

Commit 7310cde

Browse files
MOBergeronMOBergeron
committed
Updated with new changes and fixes. Fixed the templates/schemas as the copy was wrong. Added the new validators. Added mock tracks.
1 parent 7220ef4 commit 7310cde

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+1217
-915
lines changed

‎.deploy/cleanup.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
- name: Pre-deployment system cleanup
2+
hosts: all
3+
order: shuffle
4+
gather_facts: false
5+
any_errors_fatal: true
6+
7+
tasks:
8+
- name: Make network configuration static
9+
ansible.builtin.shell: |
10+
[ ! -e /run/systemd/resolve/resolv.conf ] && exit 0
11+
rm -f /etc/resolv.conf || true
12+
cat /run/systemd/resolve/resolv.conf > /etc/resolv.conf
13+
when: 'nsec_production | default(False)'
14+
changed_when: true
15+
16+
- name: Mask most systemd units
17+
ansible.builtin.shell: |
18+
for i in \
19+
apt-daily-upgrade.service \
20+
apt-daily-upgrade.timer \
21+
apt-daily.service \
22+
apt-daily.timer \
23+
console-getty.service \
24+
console-setup.service \
25+
dmesg.service \
26+
dpkg-db-backup.service \
27+
dpkg-db-backup.timer \
28+
e2scrub_all.service \
29+
e2scrub_all.timer \
30+
e2scrub_reap.service \
31+
emergency.service \
32+
fstrim.service \
33+
fstrim.timer \
34+
getty-static.service \
35+
[email protected] \
36+
initrd-cleanup.service \
37+
initrd-parse-etc.service \
38+
initrd-switch-root.service \
39+
initrd-udevadm-cleanup-db.service \
40+
keyboard-setup.service \
41+
kmod-static-nodes.service \
42+
ldconfig.service \
43+
logrotate.service \
44+
logrotate.timer \
45+
[email protected] \
46+
modprobe@dm_mod.service \
47+
[email protected] \
48+
[email protected] \
49+
[email protected] \
50+
motd-news.service \
51+
motd-news.timer \
52+
netplan-ovs-cleanup.service \
53+
rescue.service \
54+
rsyslog.service \
55+
setvtrgb.service \
56+
syslog.socket \
57+
systemd-ask-password-console.service \
58+
systemd-ask-password-wall.service \
59+
systemd-battery-check.service \
60+
systemd-bsod.service \
61+
systemd-confext.service \
62+
systemd-fsck-root.service \
63+
systemd-fsckd.service \
64+
systemd-fsckd.socket \
65+
systemd-hibernate-resume.service \
66+
systemd-initctl.service \
67+
systemd-initctl.socket \
68+
systemd-journal-catalog-update.service \
69+
systemd-journal-flush.service \
70+
systemd-journald-dev-log.socket \
71+
systemd-journald.service \
72+
systemd-journald.socket \
73+
systemd-pcrextend.socket \
74+
systemd-pcrlock-file-system.service \
75+
systemd-pcrlock-firmware-code.service \
76+
systemd-pcrlock-firmware-config.service \
77+
systemd-pcrlock-machine-id.service \
78+
systemd-pcrlock-make-policy.service \
79+
systemd-pcrlock-secureboot-authority.service \
80+
systemd-pcrlock-secureboot-policy.service \
81+
systemd-pcrmachine.service \
82+
systemd-pcrphase-initrd.service \
83+
systemd-pcrphase-sysinit.service \
84+
systemd-pcrphase.service \
85+
systemd-random-seed.service \
86+
systemd-repart.service \
87+
systemd-soft-reboot.service \
88+
systemd-sysctl.service \
89+
systemd-sysext.service \
90+
systemd-sysext.socket \
91+
systemd-sysupdate-reboot.service \
92+
systemd-sysupdate-reboot.timer \
93+
systemd-sysupdate.service \
94+
systemd-sysupdate.timer \
95+
systemd-sysusers.service \
96+
systemd-timesyncd.service \
97+
systemd-tpm2-setup-early.service \
98+
systemd-tpm2-setup.service \
99+
systemd-update-done.service \
100+
systemd-update-utmp-runlevel.service \
101+
systemd-update-utmp.service \
102+
ua-reboot-cmds.service \
103+
ua-timer.service \
104+
ua-timer.timer \
105+
ubuntu-advantage.service; do
106+
ln -s /dev/null /etc/systemd/system/${i} || true
107+
done
108+
changed_when: true
109+
110+
- name: Mask network systemd units
111+
ansible.builtin.shell: |
112+
for i in \
113+
networkd-dispatcher.service \
114+
systemd-network-generator.service \
115+
systemd-networkd-wait-online.service \
116+
systemd-networkd.service \
117+
systemd-networkd.socket \
118+
systemd-resolved.service \
119+
systemd-udev-settle.service \
120+
systemd-udev-trigger.service \
121+
systemd-udevd-control.socket \
122+
systemd-udevd-kernel.socket \
123+
systemd-udevd.service; do
124+
ln -s /dev/null /etc/systemd/system/${i} || true
125+
done
126+
when: 'nsec_production | default(False)'
127+
changed_when: true
128+
129+
- name: Remove all cron jobs
130+
ansible.builtin.shell: |
131+
rm -f /etc/cron.*/* || true
132+
changed_when: true
133+
134+
- name: Reboot the instance
135+
ansible.builtin.reboot:

‎.deploy/common.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- name: Pre-deployment Common
2+
hosts: all
3+
order: shuffle
4+
gather_facts: false
5+
any_errors_fatal: true
6+
7+
tasks:
8+
- name: Distro update and Python3 install
9+
ansible.builtin.raw: |
10+
apt update && apt upgrade -y && apt install -y python3
11+
changed_when: true
12+
13+
- name: Importing cleanup.yaml Playbook
14+
ansible.builtin.import_playbook: cleanup.yaml

‎.deploy/common/dns.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "incus_network_zone" "this" {
2+
remote = var.incus_remote
3+
4+
name = "ctf"
5+
description = "DNS zone for the internal .ctf TLD"
6+
}

‎.deploy/common/variables.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
variable "incus_remote" {
2+
default = "local"
3+
type = string
4+
}
5+
6+
variable "deploy" {
7+
default = "dev"
8+
type = string
9+
}
10+
11+
locals {
12+
track = yamldecode(file("${path.module}/../track.yaml"))
13+
}

‎.deploy/common/versions.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_version = ">=1.5.7"
3+
required_providers {
4+
incus = {
5+
source = "lxc/incus"
6+
version = ">=0.1.3"
7+
}
8+
}
9+
}

‎.deploy/track.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{}

‎.github/workflows/tests.yml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
name: Full deployment test
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
8+
permissions:
9+
contents: read
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
jobs:
16+
deploy:
17+
name: Full deployment test
18+
if: github.repository == 'nsec/ctf-script'
19+
timeout-minutes: 45
20+
strategy:
21+
fail-fast: false
22+
runs-on: ubuntu-24.04
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
27+
- name: Git LFS Pull for deployment
28+
run: |
29+
echo "Pulling all Git LFS"
30+
git lfs pull -I **/challenges/**/ansible/**/*
31+
32+
echo "Pulled files:"
33+
{ git lfs ls-files | grep -E '[a-f0-9]{10}\s\*'; } || true
34+
35+
- name: Remove docker
36+
run: |
37+
sudo apt-get autopurge -y moby-containerd docker uidmap
38+
sudo ip link delete docker0
39+
sudo nft flush ruleset
40+
41+
- name: Install dependencies
42+
run: |
43+
sudo apt-get install --no-install-recommends --yes zfsutils-linux
44+
45+
- name: Setup squid
46+
run: |
47+
sudo apt-get install --no-install-recommends --yes squid
48+
49+
(
50+
cat << EOF
51+
# No logging
52+
cache_access_log /dev/null
53+
cache_store_log none
54+
cache_log /dev/null
55+
56+
# Caching
57+
maximum_object_size 200 MB
58+
cache_mem 1024 MB
59+
60+
# Port and mode configuration
61+
acl local_subnet src 9000::/16
62+
http_access allow local_subnet
63+
http_access deny all
64+
http_port [2602:fc62:ef:11::2]:3128
65+
66+
# Hide our traces
67+
forwarded_for transparent
68+
via off
69+
reply_header_access X-Cache deny all
70+
reply_header_access X-Cache-Lookup deny all
71+
72+
EOF
73+
) | sudo tee /etc/squid/conf.d/nsec.conf
74+
75+
echo "2602:fc62:ef:11::2 proxy.ctf-int.internal.nsec.io" | sudo tee /etc/hosts
76+
sudo systemctl restart squid --no-block
77+
sudo ip -6 a add dev lo 2602:fc62:ef:11::2/128
78+
79+
- name: Setup Incus
80+
run: |
81+
curl https://pkgs.zabbly.com/get/incus-stable | sudo sh
82+
sudo chmod 666 /var/lib/incus/unix.socket
83+
84+
incus network create incusbr0
85+
incus profile device add default eth0 nic network=incusbr0 name=eth0
86+
87+
incus storage create default zfs size=100GiB
88+
incus profile device add default root disk pool=default path=/
89+
90+
sudo zfs set sync=disabled default
91+
92+
sudo ip6tables -I FORWARD -j REJECT
93+
94+
- name: Setup Ansible
95+
run: |
96+
pipx install --force --include-deps ansible
97+
pipx inject ansible passlib
98+
99+
- name: Setup OpenTofu
100+
run: |
101+
curl -sL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh
102+
chmod +x install-opentofu.sh
103+
./install-opentofu.sh --install-method deb
104+
rm -f install-opentofu.sh
105+
106+
- name: Install python dependencies
107+
run: |
108+
pip install -e .
109+
110+
- name: Validate CTF structure
111+
run: |
112+
ctf validate
113+
114+
- name: Deployment check
115+
run: |
116+
ctf check
117+
118+
- name: File generation
119+
run: |
120+
ctf generate
121+
122+
- name: Test deployment looping through tracks
123+
run: |
124+
IFS=" " read -r -a tracks <<< "$(python3 -c 'from ctf.utils import get_all_available_tracks,validate_track_can_be_deployed;print(str([t for t in get_all_available_tracks() if validate_track_can_be_deployed(t)]).strip("[]\x27").replace("\x27, \x27"," "))')"
125+
126+
[ "${#tracks[@]}" -eq 0 ] && exit 1
127+
128+
for track in "${tracks[@]}"
129+
do
130+
ctf deploy --production --tracks "$track"
131+
incus --project="$track" info "$track"
132+
done
133+
134+
ctf destroy --force
135+
136+
- name: Test full deployment
137+
run: |
138+
ctf deploy --production
139+
[ "$(incus list --all-projects -cn -fcsv | wc -l)" -eq 2 ] || exit 1
140+
ctf destroy --force
141+
142+
- name: Test redeployment of Mock Track Apache PHP
143+
run: |
144+
ctf deploy --production
145+
[ "$(incus list --all-projects -cn -fcsv | wc -l)" -eq 2 ] || exit 1
146+
ctf redeploy --production --tracks mock-track-apache-php
147+
[ "$(incus list --all-projects -cn -fcsv | wc -l)" -eq 2 ] || exit 1
148+
ctf destroy --force
149+
150+
- name: Test deployment of a track not deployed without destroying the rest
151+
run: |
152+
ctf deploy --production --production --tracks mock-track-apache-php
153+
[ "$(incus list --all-projects -cn -fcsv | wc -l)" -eq 1 ] || exit 1
154+
ctf redeploy --production --tracks mock-track-python-service
155+
[ "$(incus list --all-projects -cn -fcsv | wc -l)" -eq 2 ] || exit 1
156+
ctf destroy --force
157+
158+
- name: Check deployment results
159+
run: |
160+
incus project list
161+
incus network zone record list ctf
162+
incus network list --all-projects
163+
incus list --all-projects

0 commit comments

Comments
 (0)