feat: use emissary v2023.6.23-4a58847

emissary_release.txt

@@ -1 +1 @@
-v2023.4.14-813f837
+v2023.6.23-4a58847

install/raspberrypi.mk

@@ -0,0 +1,7 @@
+install-rpi-network-config:
+	mkdir -p files/etc/config
+	cp misc/rpi/uci/network files/etc/config/network
+
+install-rpi-uci-defaults:
+	mkdir -p files/etc/uci-defaults
+	cp misc/rpi/uci-defaults/* files/etc/uci-defaults/

misc/rpi/uci-defaults/99-x86-uci-custom.sh

@@ -0,0 +1,37 @@
+#/bin/sh
+
+set -e
+
+main() {
+    # Update default firewall ruleset
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow SSH on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='22'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='80'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='443'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci commit firewall
+    
+    # Disable DNS-rebind protection
+    uci set dhcp.@dnsmasq[0].rebind_protection='0'
+    uci commit dhcp
+
+    reload_config
+}
+
+main

misc/rpi/uci/network

@@ -0,0 +1,9 @@
+config interface 'loopback'
+	option ifname 'lo'
+	option proto 'static'
+	option ipaddr '127.0.0.1'
+	option netmask '255.0.0.0'
+
+config interface 'wan'
+	option ifname 'eth0'
+	option proto 'dhcp'

misc/turris/omnia/uci-defaults/98-turris-omnia-uci-custom.sh

@@ -0,0 +1,37 @@
+#/bin/sh
+
+set -e
+
+main() {
+    # Update default firewall ruleset
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow SSH on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='22'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='80'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='443'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci commit firewall
+    
+    # Disable DNS-rebind protection
+    uci set dhcp.@dnsmasq[0].rebind_protection='0'
+    uci commit dhcp
+
+    reload_config
+}
+
+main

misc/turris/omnia/uci-defaults/99-resize-disk.sh

@@ -2,6 +2,8 @@
 
 set -eo pipefail
 
+block info
+
 DISK=/dev/mmcblk0
 PARTITION="${DISK}p2"
 
@@ -11,5 +13,9 @@ FS_SIZE="$(unsquashfs -s "$PARTITION" | grep -o 'Filesystem size [0-9]* bytes' |
 FS_OFFSET="$(expr '(' "$FS_SIZE" + 65535 ')' / 65536 '*' 65536)"
 LOOP_DEVICE="$(losetup -f --show -o "$FS_OFFSET" "$PARTITION")"
 
-e2fsck -fy "$LOOP_DEVICE"
+e2fsck -y -f "$LOOP_DEVICE"
 resize2fs "$LOOP_DEVICE"
+
+rm -f /etc/uci-defaults/99-resize-disk.sh
+
+reboot

targets/raspberrypi.mk

@@ -2,7 +2,7 @@ all: rpi-4 rpi-3
 
 rpi-4:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="" \
+		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
 		OPENWRT_TARGET="bcm27xx/bcm2711" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-4" \
@@ -10,7 +10,7 @@ rpi-4:
 
 rpi-3:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="" \
+		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
 		OPENWRT_TARGET="bcm27xx/bcm2710" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-3" \

targets/turris.mk

@@ -5,7 +5,7 @@ turris: omnia
 omnia:
 	$(MAKE) \
 		ADDITIONAL_INSTALL="install-turris-omnia-uci-defaults" \
-		ADDITIONAL_OPENWRT_PACKAGES="losetup squashfs-tools-unsquashfs resize2fs e2fsprogs parted" \
+		ADDITIONAL_OPENWRT_PACKAGES="losetup squashfs-tools-unsquashfs resize2fs e2fsprogs parted block-mount" \
 		OPENWRT_TARGET="mvebu/cortexa9" \
 		EMISSARY_ARCH="armv7" \
 		OPENWRT_PROFILE="cznic_turris-omnia" \