Setting up a proxmox host

#!/usr/bin/env bash
# create-templates.sh — download images and create Proxmox templates for the DevSecOps lab
# Run this on the Proxmox host before running Terraform.
# Safe to re-run — existing images and templates are skipped.
set -euo pipefail

STORAGE="local-lvm"
IMG_DIR="/var/lib/vz/images"

# ── FILL THIS IN before running ───────────────────────────────────────────────
# SSH *public* key injected into the kali user's authorized_keys so you (and
# Ansible) can log into the Kali template. Paste the full one-line contents of
# your public key, e.g. the output of:  cat ~/.ssh/id_ed25519.pub
KALI_SSH_PUBKEY="REPLACE_WITH_YOUR_SSH_PUBLIC_KEY"

# ── Prerequisites ─────────────────────────────────────────────────────────────
if ! command -v 7z &>/dev/null; then
  echo "Installing 7zip..."
  apt-get install -y 7zip
fi

if ! command -v virt-customize &>/dev/null; then
  echo "Installing libguestfs-tools..."
  apt-get install -y libguestfs-tools
fi

# ── SDN: Simple zone with SNAT + DHCP (creates vnet0) ─────────────────────────
# Scripts the manual GUI steps in proxmox.md. vnet0 must exist before the
# templates below reference it as their bridge.
ZONE="SNAT"
VNET="vnet0"
SUBNET="172.20.100.0/24"
GATEWAY="172.20.100.1"
DHCP_START="172.20.100.100"
DHCP_END="172.20.100.150"

# dnsmasq is required for SDN automatic DHCP, but its own service must be off —
# PVE runs a separate per-zone dnsmasq instance instead.
if ! command -v dnsmasq &>/dev/null; then
  echo "Installing dnsmasq (for SDN DHCP)..."
  apt-get install -y dnsmasq
fi
systemctl disable --now dnsmasq 2>/dev/null || true

if pvesh get /cluster/sdn/vnets/"$VNET" &>/dev/null; then
  echo "SDN vnet ${VNET} already exists — skipping SDN setup"
else
  echo "Creating SDN simple zone ${ZONE}, vnet ${VNET}, and SNAT subnet..."
  # Simple zone, automatic DHCP via dnsmasq, built-in pve IPAM
  pvesh create /cluster/sdn/zones \
    --type simple --zone "$ZONE" --ipam pve --dhcp dnsmasq

  # VNet inside the zone — this is the bridge the templates attach to
  pvesh create /cluster/sdn/vnets --vnet "$VNET" --zone "$ZONE"

  # Subnet with SNAT (outbound masquerade) + DHCP range
  pvesh create /cluster/sdn/vnets/"$VNET"/subnets \
    --subnet "$SUBNET" --type subnet \
    --gateway "$GATEWAY" --snat 1 \
    --dhcp-range "start-address=${DHCP_START},end-address=${DHCP_END}"

  # Apply pending SDN changes and reload host network config (GUI "Apply")
  pvesh set /cluster/sdn
  echo "  Done: SDN ${ZONE}/${VNET} with SNAT on ${SUBNET}"
fi

# ── Internal bridge (isolated 10.10.10.0/24 lab network) ──────────────────────
# A plain Linux bridge with no physical ports: VMs attached to it talk only to
# each other (attacks, Wazuh agent traffic, Suricata). Static IPs are assigned
# by Ansible — there is deliberately no gateway or DHCP on this segment.
if grep -q "^iface internal " /etc/network/interfaces 2>/dev/null; then
  echo "Internal bridge already configured — skipping"
else
  echo "Creating isolated internal bridge..."
  cat >> /etc/network/interfaces << 'EOF'

auto internal
iface internal inet manual
    bridge-ports none
    bridge-stp off
    bridge-fd 0
EOF
  ifreload -a
  echo "  Done: bridge 'internal' (isolated, no uplink)"
fi

# ── Host firewall: masquerade vnet0 (nftables) ────────────────────────────────
# Masquerades outbound traffic from vnet0. (SDN SNAT already does this; kept as
# belt-and-suspenders.) IP forwarding is required for NAT to route. The SSH
# port-forward into a lab VM is left commented in the config below — enable it
# only after moving the host sshd off :22 (see proxmox.md).
echo "Configuring nftables NAT (masquerade vnet0)..."
cat > /etc/nftables.conf << 'EOF'
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input   { type filter hook input   priority filter; }
    chain forward { type filter hook forward priority filter; }
    chain output  { type filter hook output  priority filter; }
}

table ip nat {
    chain prerouting {
        type nat hook prerouting priority -100; policy accept;
        # Optional: forward host SSH to a lab VM (move host sshd off :22 first).
        # Set <HOST_IP> to the vmbr0 address, then uncomment:
        # ip daddr <HOST_IP> tcp dport 22 dnat to 172.20.100.100:22
    }
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname "vnet0" masquerade
    }
}
EOF

# Forwarding must be on for NAT to route between bridges
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-lab-forward.conf
sysctl -p /etc/sysctl.d/99-lab-forward.conf

nft -f /etc/nftables.conf          # validate + apply immediately
systemctl enable --now nftables    # load /etc/nftables.conf at every boot
echo "  Done: nftables masquerade applied; nftables.service enabled"

# ── Ubuntu 26.04 (template VMID 1001) ────────────────────────────────────────
UBUNTU_IMG="${IMG_DIR}/ubuntu-26.04-server-cloudimg-amd64.img"

if [[ ! -f "$UBUNTU_IMG" ]]; then
  echo "Downloading Ubuntu 26.04 cloud image..."
  curl -L --progress-bar -o "$UBUNTU_IMG" \
    https://cloud-images.ubuntu.com/releases/resolute/release/ubuntu-26.04-server-cloudimg-amd64.img
fi

if qm status 1001 &>/dev/null; then
  echo "template-ubuntu-26.04 (1001) already exists — skipping"
else
  echo "Creating template-ubuntu-26.04..."
  qemu-img resize "$UBUNTU_IMG" 32G

  qm create 1001 \
    --name "template-ubuntu-26.04" \
    --ostype l26 --memory 4096 --agent 1 \
    --bios seabios --machine q35 --cpu host \
    --sockets 1 --cores 4 \
    --vga serial0 --serial0 socket \
    --net0 virtio,bridge=vnet0

  qm importdisk 1001 "$UBUNTU_IMG" "${STORAGE}"

  qm set 1001 \
    --scsihw virtio-scsi-pci \
    --virtio0 "${STORAGE}:vm-1001-disk-0,discard=on" \
    --boot order=virtio0 \
    --ide2 "${STORAGE}:cloudinit" \
    --ipconfig0 ip=dhcp

  # cloud-init vendor config: passwordless sudo for the sudo group + qemu-guest-agent
  mkdir -p /var/lib/vz/snippets
  cat > /var/lib/vz/snippets/ubuntu-vendor.yaml << 'EOF'
#cloud-config
write_files:
  - path: /etc/sudoers.d/90-nopasswd-sudo
    content: "%sudo ALL=(ALL) NOPASSWD:ALL\n"
    permissions: "0440"
runcmd:
  - apt update
  - apt install -y qemu-guest-agent
  - systemctl enable --now qemu-guest-agent
EOF
  qm set 1001 --cicustom "vendor=local:snippets/ubuntu-vendor.yaml"
  qm cloudinit update 1001
  qm template 1001
  echo "  Done: template-ubuntu-26.04 (1001)"
fi

# ── Kali (template VMID 1002) ─────────────────────────────────────────────────
KALI_QCOW="$(ls "${IMG_DIR}"/kali-linux-*.qcow2 2>/dev/null | head -1 || true)"

if [[ -z "$KALI_QCOW" ]]; then
  KALI_7Z="$(ls "${IMG_DIR}"/kali-linux-*.7z 2>/dev/null | head -1 || true)"
  if [[ -z "$KALI_7Z" ]]; then
    echo "Downloading Kali QEMU image (~4 GB)..."
    curl -L --progress-bar -o "${IMG_DIR}/kali-linux-2026.1-qemu-amd64.7z" \
      https://cdimage.kali.org/kali-2026.1/kali-linux-2026.1-qemu-amd64.7z
    KALI_7Z="${IMG_DIR}/kali-linux-2026.1-qemu-amd64.7z"
  fi
  echo "Extracting Kali image..."
  7z e "$KALI_7Z" -o"${IMG_DIR}"
  KALI_QCOW="$(ls "${IMG_DIR}"/kali-linux-*.qcow2 | head -1)"
fi

if qm status 1002 &>/dev/null; then
  echo "template-kali (1002) already exists — skipping"
else
  if [[ "$KALI_SSH_PUBKEY" == "REPLACE_WITH_YOUR_SSH_PUBLIC_KEY" || -z "$KALI_SSH_PUBKEY" ]]; then
    echo "ERROR: set KALI_SSH_PUBKEY at the top of this script before building the Kali template." >&2
    exit 1
  fi

  echo "Customizing Kali image..."
  virt-customize -a "$KALI_QCOW" \
    --run-command 'echo "%sudo ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-nopasswd-sudo && chmod 0440 /etc/sudoers.d/90-nopasswd-sudo' \
    --run-command 'systemctl enable ssh' \
    --ssh-inject "kali:string:${KALI_SSH_PUBKEY}"

  echo "Creating template-kali..."
  qm create 1002 \
    --name "template-kali" \
    --ostype l26 --memory 4096 --agent 1 \
    --bios seabios --machine q35 --cpu host \
    --sockets 1 --cores 2 \
    --vga serial0 --serial0 socket \
    --net0 virtio,bridge=vnet0

  qm importdisk 1002 "${KALI_QCOW}" "${STORAGE}"

  qm set 1002 \
    --scsihw virtio-scsi-pci \
    --virtio0 "${STORAGE}:vm-1002-disk-0,discard=on" \
    --boot order=virtio0 \
    --ide2 "${STORAGE}:cloudinit" \
    --ipconfig0 ip=dhcp

  qm cloudinit update 1002
  qm template 1002
  echo "  Done: template-kali (1002)"
fi

echo ""
echo "Templates ready. Proceed to Terraform."

chmod +x create-templates.sh
sudo bash create-templates.sh

# On the Proxmox host
sudo pveum user token add student@pam terraform --privsep=0
# Note the token secret shown — it is only displayed once
# if the token already exists, delete it, then re-run the above command
# sudo pveum user token delete student@pam terraform

cd secdevops/devsecops-lab
tofu init
tofu plan      # review what will be created
tofu apply

for vmid in 200 201 202; do
  qm snapshot $vmid baseline --description "Pre-course baseline $(date +%Y-%m-%d)"
done