Makefile

@@ -28,7 +28,7 @@ EMISSARY_ARCH ?= armv6
 EMISSARY_RECONCILIATION_INTERVAL ?=
 EMISSARY_SERVER_URL ?=
 
-BASE_INSTALL ?= install-emissary-files install-common-uci-defaults install-common-additional-agent-collectors
+BASE_INSTALL ?= install-emissary-files
 ADDITIONAL_INSTALL ?=
 ADDITIONAL_OPENWRT_PACKAGES ?=
 

install/common.mk

@@ -1,6 +0,0 @@
-install-common-uci-defaults:
-	mkdir -p files/etc/uci-defaults
-	cp misc/common/uci-defaults/* files/etc/uci-defaults/
-
-install-common-additional-agent-collectors: tools/yq/bin/yq
-	tools/yq/bin/yq -i '.agent.collectors += load("misc/common/agent/collectors.yml")' files/etc/emissary/agent.yml

install/raspberrypi.mk

@@ -1,3 +1,7 @@
 install-rpi-network-config:
 	mkdir -p files/etc/config
 	cp misc/rpi/uci/network files/etc/config/network
+
+install-rpi-uci-defaults:
+	mkdir -p files/etc/uci-defaults
+	cp misc/rpi/uci-defaults/* files/etc/uci-defaults/

misc/common/agent/collectors.yml

@@ -1,9 +0,0 @@
-- name: network-interfaces
-  command: ip
-  args:
-    - addr
-    - show
-- name: emissary-firmware
-  commant: cat
-  args:
-    - /etc/emissary_firmware

misc/turris/omnia/uci-defaults/98-turris-omnia-uci-custom.sh

@@ -0,0 +1,37 @@
+#/bin/sh
+
+set -e
+
+main() {
+    # Update default firewall ruleset
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow SSH on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='22'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='80'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='443'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci commit firewall
+    
+    # Disable DNS-rebind protection
+    uci set dhcp.@dnsmasq[0].rebind_protection='0'
+    uci commit dhcp
+
+    reload_config
+}
+
+main

misc/x86/uci-defaults/99-x86-uci-custom.sh

@@ -0,0 +1,37 @@
+#/bin/sh
+
+set -e
+
+main() {
+    # Update default firewall ruleset
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow SSH on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='22'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='80'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='443'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci commit firewall
+    
+    # Disable DNS-rebind protection
+    uci set dhcp.@dnsmasq[0].rebind_protection='0'
+    uci commit dhcp
+
+    reload_config
+}
+
+main

targets/generic.mk

@@ -2,7 +2,7 @@ all: x86-generic
 
 x86-generic:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="install-x86-network-config" \
+		ADDITIONAL_INSTALL="install-x86-network-config install-x86-uci-defaults" \
 		ADDITIONAL_OPENWRT_PACKAGES="dmidecode" \
 		OPENWRT_TARGET="x86/generic" \
 		EMISSARY_ARCH="386" \

targets/raspberrypi.mk

@@ -2,7 +2,7 @@ all: rpi-4 rpi-3
 
 rpi-4:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="install-rpi-network-config" \
+		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
 		OPENWRT_TARGET="bcm27xx/bcm2711" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-4" \
@@ -10,7 +10,7 @@ rpi-4:
 
 rpi-3:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="install-rpi-network-config" \
+		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
 		OPENWRT_TARGET="bcm27xx/bcm2710" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-3" \