2 set -e -f ${DRY_RUN:+-n} -u
5 do tool
=$
(readlink
"$tool")
12 rule_help
() { # SYNTAX: [--hidden]
13 local hidden
; [ ${1:+set} ] || hidden
=set
16 ce script regroupe des règles pour administrer la VM ($vm_fqdn)
17 _depuis_ la VM hébergée ($vm_fqdn) ;
18 il sert à la fois d'outil (aisément bidouillable)
19 et de documentation (préçise).
20 Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
21 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
23 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/ \1\2/p" "$tool"/etc/vm.sh "$0")
25 TRACE # affiche les commandes avant leur exécution
26 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
30 rule_git_configure
() {
33 git config
--replace branch.master.remote .
34 git config
--replace branch.master.merge refs
/remotes
/master
36 tool
=$
(cd "$tool"; cd -)
37 install -m 770 /dev
/stdin .git
/hooks
/post-update
<<-EOF
42 git --git-dir=\$PWD/.git checkout -f -B master remotes/master
43 git --git-dir=\$PWD/.git clean -f -d -x
52 git checkout
-f -B master remotes
/master
58 local user
="$1"; shift
59 getent passwd
"$user" >/dev
/null ||
60 sudo adduser
"$@" "$user"
62 rule_apt_get_install
() { # SYNTAX: $package
64 DEBIAN_FRONTEND
=noninteractive \
66 apt-get
install --yes "$@"
68 rule_dpkg_reconfigure
() { # SYNTAX: $package
70 DEBIAN_FRONTEND
=noninteractive \
75 rule__chrooted_configure
() { # NOTE: est-ce bien utile à un moment ?
81 rule_apache2_configure
() { # XXX: cette règle n'est pas testée/mise-à-jour
83 rule apt_get_install \
86 # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
87 # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
88 # NOTE: apache2-mpm-itk semble le plus sécurisé,
89 # car on est certain que tout est exécuté avec les uid/gid
90 # assignés au VirtualHost/Directory/Location
91 # néamoins il se peut qu'une combinaison du genre :
92 # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
93 # soit plus performante (threads et pas forks),
94 # cependant l'usage de suexec impose des forks il semble..
95 # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
96 # donc pour l'instant : apache2-mpm-itk
99 sudo
install -d -m 770 -o www
-g www \
101 /etc
/apache
2/site.d \
103 cat /dev
/stdin
"$tool"/etc
/apache
2/apache2.conf
<<-EOF |
104 ServerName "$vm_fqdn"
106 sudo
install -m 660 -o root
-g root
/dev
/stdin \
107 /etc
/apache
2/apache2.conf
108 sudo
install -m 660 -o root
-g root \
109 "$tool"/etc
/apache
2/envvars \
111 sudo
install -m 660 -o root
-g root \
112 "$tool"/etc
/apache
2/httpd.conf \
113 /etc
/apache
2/httpd.conf
114 #sudo install -m 660 -o root -g root /dev/stdin \
115 # /etc/apache2/suexec/www-data <<-EOF
119 sudo
install -m 660 -o root
-g root \
120 "$tool"/etc
/apache
2/ports.conf \
121 /etc
/apache
2/ports.conf
131 /home
/www
/etc
/apache2
132 for conf
in "$tool"/etc
/apache
2/site.d
/*/VirtualHost.conf
133 do conf
=${conf#"$tool"/etc/apache2/site.d/}
134 local site
=${conf%/VirtualHost.conf}
137 local hint
="run vm_remote apache2_key_send before"
138 assert
"sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
139 sudo
install -d -m 770 -o www-
"$site" -g www-
"$site" \
141 /etc
/apache
2/site.d
/"$site" \
142 /etc
/apache
2/x509.d
/"$site" \
143 /etc
/apache
2/x509.d
/"$site"/ca \
144 /etc
/apache
2/x509.d
/"$site"/empty \
145 /etc
/apache
2/x509.d
/"$site"/rvk \
146 /etc
/apache
2/x509.d
/"$site"/usr
147 sudo
install -m 664 -o www
-g www \
148 "$tool"/var
/pub
/x509
/"$site"/crt.self-signed.pem \
149 /etc
/apache
2/x509.d
/"$site"/crt.self-signed.pem
150 #sudo install -m 664 -o www-"$site" -g www-"$site" \
151 # "$tool"/var/pub/x509/"$site"/rvk.pem \
152 # /etc/apache2/x509.d/"$site"/rvk.pem
153 sudo
install -m 664 -o www
-g www \
154 "$tool"/var
/pub
/x509
/"$site"/ca
/crt.self-signed.pem \
155 /etc
/apache
2/x509.d
/"$site"/ca
/crt.pem
156 sudo
install -m 664 -o www
-g www \
157 "$tool"/var
/pub
/x509
/"$site"/crt.pem \
158 /etc
/apache
2/x509.d
/"$site"/crt.pem
165 <VirtualHost *:$port>
166 AssignUserID www-$site www-$site
167 BrowserMatch "MSIE [2-6]" ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
168 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
169 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
170 #CustomLog "/dev/null" Combined
171 DocumentRoot /home/www/pub/$site
172 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
173 #ErrorLog "/dev/null"
175 SSLCACertificateFile /etc/apache2/x509.d/$site/crt.self-signed.pem
176 SSLCACertificatePath /etc/apache2/x509.d/$site/usr/
177 #SSLCARevocationFile /etc/apache2/x509.d/$site/rvk.pem
178 SSLCADNRequestFile /etc/apache2/x509.d/$site/crt.self-signed.pem
179 SSLCADNRequestPath /etc/apache2/x509.d/$site/empty/
180 # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés
181 SSLCARevocationPath /etc/apache2/x509.d/$site/rvk/
182 SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem
183 SSLCertificateFile /etc/apache2/x509.d/$site/crt.pem
184 SSLCertificateKeyFile /etc/apache2/x509.d/$site/key.pem
185 SSLCipherSuite AES+RSA+SHA256
187 SSLInsecureRenegotiation Off
188 SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
189 SSLProtocol -All +TLSv1
190 #SSLRenegBufferSize 262144
191 SSLSessionCacheTimeout 1200
192 SSLStrictSNIVHostCheck On
193 SSLUserName SSL_CLIENT_S_DN_CN
196 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
203 <VirtualHost *:$port>
204 AssignUserID www-$site www-$site
205 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
206 #CustomLog "/dev/null" Combined
207 DocumentRoot /home/www/pub/$site
208 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
209 #ErrorLog "/dev/null"
211 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
216 sudo
install -m 660 -o root
-g root
/dev
/stdin \
217 /etc
/apache
2/site.d
/"$site"/VirtualHost.conf
219 ..
/site.d
/"$site"/VirtualHost.conf \
220 /etc
/apache
2/sites-available
/"$site"
221 sudo
install -d -m 770 -o www-
"$site" -g www-
"$site" \
222 /home
/www
/log
/"$site" \
223 /home
/www
/log
/"$site"/apache2
225 /etc
/apache
2/site.d
/"$site" \
226 /home
/www
/etc
/apache
2/"$site"
227 test -e /home
/www
/pub
/"$site" ||
228 sudo
install -d -m 2770 -o www-
"$site" -g www-
"$site" \
229 /home
/www
/pub
/"$site"
230 rule adduser www-
"$site"
231 --disabled-password \
234 --home /home
/www
/pub
/"$site" \
237 #sudo setfacl -m u:"www-$site":--x \
240 # /home/www/pub/"$site"/
241 #sudo setfacl -m d:u:"www-$site":rwx \
242 # "$home"/pub/www/"$site"/
243 test ! -r "$tool"/etc
/apache
2/site.d
/"$site"/configure.sh ||
244 .
"$tool"/etc
/apache
2/site.d
/"$site"/configure.sh
245 test -e /etc
/apache
2/sites-enabled
/"$site" ||
246 sudo a2ensite
"$site"
248 sudo service apache2 restart
250 rule_apt_configure
() {
251 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/sources.list
<<-EOF
252 deb http://ftp.rezopole.net/debian $vm_lsb_name main
254 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/sources.list.d
/$vm_lsb_name-backports.list
<<-EOF
255 deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
257 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/sources.list.d
/openerp.list
<<-EOF
258 deb http://nightly.openerp.com/7.0/nightly/deb/ ./
260 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/preferences
<<-EOF
262 Pin: release a=$vm_lsb_name
266 Pin: release a=$vm_lsb_name-backports
270 rule apt_get_install apticron
272 --define=VM_DOMAINNAME
=$vm_domainname \
273 <"$tool"/etc
/apticron
/apticron.conf.
m4 |
274 sudo
install -m 644 -o root
-g root
/dev
/stdin \
275 /etc
/apticron
/apticron.conf
277 rule_boot_configure
() {
278 #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
279 sudo debconf-set-selections
<<-EOF
280 grub-pc grub-pc/install_devices multiselect
282 rule apt_get_install grub-pc
283 sudo
install -d -m 644 -o root
-g root
/boot
/grub
284 rule apt_get_install linux-image-
$vm_arch
285 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/default
/grub
<<-EOF
288 GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
289 GRUB_CMDLINE_LINUX_DEFAULT="quiet"
290 GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
291 GRUB_DISABLE_RECOVERY="true"
292 #GRUB_PRELOAD_MODULES="lvm"
294 sudo
install -m 644 -o root
-g root
/dev
/stdin
/boot
/grub
/device.map
<<-EOF
296 (hd0) /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
298 sudo update-grub2
# NOTE: prend en compte /boot/grub/device.map
299 rule initramfs_configure
300 rule apt_get_install molly-guard
301 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/molly-guard
/rc
<<-EOF
302 ALWAYS_QUERY_HOSTNAME=true
303 # NOTE: une alternative est de dire à sudo de conserver les SSH_*
304 # néamoins demander tout le temps n'est pas trop contraignant
305 # et davantage sécurisant.
308 rule_etckeeper_configure
() {
309 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/etckeeper
/etckeeper.conf
<<-EOF
311 GIT_COMMIT_OPTIONS=""
312 AVOID_DAILY_AUTOCOMMITS=1
313 #AVOID_SPECIAL_FILE_WARNING=1
314 AVOID_COMMIT_BEFORE_INSTALL=1
315 HIGHLEVEL_PACKAGE_MANAGER=apt
316 LOWLEVEL_PACKAGE_MANAGER=dpkg
318 sudo
install -m 644 -o root
-g root \
319 "$tool"/etc
/etckeeper
/prompt.sh \
320 /etc
/etckeeper
/prompt.sh
321 rule apt_get_install etckeeper
323 rule_filesystem_configure
() {
325 --define=VM_LVM_LV
=$vm_lvm_lv \
326 --define=VM_LVM_VG
=$vm_lvm_vg \
327 <"$tool"/etc
/fstab.
m4 |
328 sudo
install -m 644 -o root
-g root
/dev
/stdin \
331 --define=VM_LVM_LV
=$vm_lvm_lv \
332 --define=VM_LVM_VG
=$vm_lvm_vg \
333 <"$tool"/etc
/crypttab.
m4 |
334 sudo
install -m 644 -o root
-g root
/dev
/stdin \
338 rule_initramfs_configure
() {
339 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/initramfs-tools
/initramfs.conf
<<-EOF
346 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/modprobe.d
/xen-pv.conf
<<-EOF
348 alias scsi_hostadapter xenblk
350 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/modules
<<-EOF
356 # NOTE: pour Xen en mode HVM :
357 #modprobe xen-platform-pci
359 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/initramfs-tools
/modules
<<-EOF
361 sudo
sed -e '/^configure_networking /s/ &$//' \
362 -i /usr
/share
/initramfs-tools
/scripts
/init-premount
/dropbear
363 # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
364 ssh-keygen
-F "init.$vm_fqdn" -f "$tool"/etc
/openssh
/known_hosts |
365 ( while IFS
= read -r line
366 do case $line in (*" RSA") return 0; break;; esac
370 /etc
/initramfs-tools
/etc
/dropbear
/dropbear_rsa_host_key \
371 /etc
/initramfs-tools
/etc
/dropbear
/dropbear_rsa_host_key.pub
372 sudo dropbearkey
-t rsa
-s 4096 -f \
373 /etc
/initramfs-tools
/etc
/dropbear
/dropbear_rsa_host_key
375 # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
376 sudo
install -d -m 640 -o root
-g root \
377 /etc
/initramfs-tools
/root \
378 /etc
/initramfs-tools
/root
/.
ssh
380 while IFS
=: read -r group x x users
381 do while test -n "$users" && IFS
=, read -r user users
<<-EOF
384 do eval local home\
; home
="~$user"
385 sudo
cat "$home"/etc
/ssh
/authorized_keys
388 sudo
install -m 644 -o root
-g root
/dev
/stdin \
389 /etc
/initramfs-tools
/root
/.ssh
/authorized_keys
391 /etc
/initramfs-tools
/root
/.ssh
/id_rsa.dropbear \
392 /etc
/initramfs-tools
/root
/.ssh
/id_rsa.pub \
393 /etc
/initramfs-tools
/root
/.ssh
/id_rsa
394 # NOTE: clefs générées par Debian
395 sudo update-initramfs
-u
397 rule_insserv_remove
() { # SYNTAX: $sv
399 #sudo chmod u+x /etc/init.d/"$sv"
400 sudo insserv
--force --remove "$sv"
401 sudo
test ! -x /etc
/init.d
/"$sv" ||
402 sudo
/etc
/init.d
/"$sv" stop
403 sudo
chmod ugo-x
/etc
/init.d
/"$sv"
405 rule_gitolite_configure
() {
406 sudo debconf-set-selections
<<-EOF
407 gitolite gitolite/gituser string git
408 gitolite gitolite/adminkey string
409 gitolite gitolite/gitdir string /home/git
411 rule apt_get_install gitolite
413 --disabled-password \
418 sudo chfn
--full-name git git
419 rule adduser log-git \
421 --disabled-password \
423 --home /home
/git
/log \
426 rule adduser git-data \
428 --disabled-password \
430 --home /home
/git
/pub \
433 sudo adduser git git-data
434 sudo
install -d -m 750 -o git
-g git \
438 sudo
install -d -m 751 -o git
-g git \
440 sudo
install -d -m 2770 -o git-data
-g git-data \
442 sudo
install -d -m 1771 -o git
-g git \
444 sudo
install -d -m 2770 -o git
-g log-git \
445 /home
/git
/log
/gitolite \
446 /home
/git
/log
/gitolite
/perf
447 sudo
install -d -m 3771 -o git
-g git \
449 sudo
ln -fns /etc
/gitolite
/home
/git
/etc
/gitolite
450 sudo
ln -fns /etc
/gitweb
/home
/git
/etc
/gitweb
451 sudo
ln -fns etc
/gitolite
/gitolite.rc
/home
/git
/.gitolite.rc
452 sudo
ln -fns etc
/ssh /home
/git
/.
ssh
453 sudo
install -m 770 -o git
-g git
/dev
/stdin \
454 /home
/git
/etc
/gitolite
/gitolite.rc
<<-EOF
455 #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
456 #\$BIG_INFO_CAP = 20;
457 #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
458 # NOTE: Please use single quotes, not double quotes.
459 #\$GITWEB_URI_ESCAPE = 0;
462 \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
463 #\$GL_ALL_INCLUDES_SPECIAL = 0;
464 #\$GL_ALL_READ_ALL = 0;
466 \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
467 \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
468 #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
469 \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
470 #\$GL_HOSTNAME = "git.$vm_domainname";
471 # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
472 #\$GL_HTTP_ANON_USER = "mob";
473 \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
474 \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
475 #\$GL_NICE_VALUE = 0;
476 \$GL_NO_CREATE_REPOS = 0;
477 \$GL_NO_DAEMON_NO_GITWEB = 0;
478 \$GL_NO_SETUP_AUTHKEYS = 0;
479 \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
480 \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
481 #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
482 #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
483 \$GL_SITE_INFO = "git.$vm_domainname";
484 #\$GL_SLAVE_MODE = 0;
486 #\$GL_WILDREPOS_DEFPERMS = 'R @all';
487 \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
488 \$HTPASSWD_FILE = "";
489 \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
494 #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
495 \$WEB_INTERFACE = "gitweb";
498 sudo
install -m 600 -o git
-g git \
499 "$tool"/var
/pub
/ssh
/git.key \
500 /home
/git
/etc
/ssh
/git.pub
502 GL_RC
=/home
/git
/etc
/gitolite
/gitolite.rc \
503 GIT_AUTHOR_NAME
=git \
504 gl-setup
-q /home
/git
/etc
/ssh
/git.pub git
506 for d
in doc logs src
507 do test ! -d /home
/git
/etc
/gitolite
/"$d" ||
508 rmdir /home
/git
/etc
/gitolite
/"$d"
511 rule_locales_configure
() {
512 sudo debconf-set-selections
<<-EOF
513 locales locales/default_environment_locale select None
514 locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8
516 rule dpkg_reconfigure locales
518 rule_login_configure
() {
519 sudo
install -m 644 -o root
-g root \
520 "$tool"/etc
/inittab \
522 sudo
install -m 644 -o root
-g root \
523 "$tool"/etc
/login.defs \
525 grep -q '^session optional pam_umask.so\>' /etc
/pam.d
/common-session ||
526 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/pam.d
/common-session
<<-EOF
527 $(cat /etc/pam.d/common-session)
528 session optional pam_umask.so
530 grep -q '^hvc0$' /etc
/securetty ||
531 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/securetty
<<-EOF
532 $(cat /etc/securetty)
535 grep -q '^xvc0$' /etc
/securetty ||
536 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/securetty
<<-EOF
537 $(cat /etc/securetty)
541 rule_network_configure
() {
542 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/hostname
<<-EOF
545 grep -q " $vm\$" /etc
/hosts ||
546 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/hosts
<<-EOF
548 127.0.0.1 $vm_fqdn $vm
550 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/resolv.conf
<<-EOF
552 nameserver ${vm_host_nameserver}
555 --define=VM_IPV4
=$vm_ipv4 \
556 <"$tool"/etc
/network
/interfaces.
m4 |
557 sudo
install -m 640 -o root
-g root
/dev
/stdin \
558 /etc
/network
/interfaces
560 rule_runit_configure
() { # SYNTAX: $sv
561 #rule apt_get_install runit
566 $
(sudo
find /etc
/sv \
567 -mindepth 1 -maxdepth 1 -type d \
568 -printf '%p\n' |
sort)
574 (*) services
="$services $1"; shift;;
577 #for sv in $(sudo find /etc/sv \
578 # -mindepth 1 -maxdepth 1 -type d \
579 # -false $(printf -- '-or -name %s\n' $services) \
582 # case $(sudo sv stop "$sv" | tee /dev/stderr) in
583 # (*": runsv not running") true;;
584 # (*": unable to open supervise/ok: file does not exist") true;;
585 # ("ok: down:"*) true;;
589 for sv
in $
(find "$tool"/etc
/sv \
590 -mindepth 1 -maxdepth 1 -type d \
591 -false $
(printf -- '-or -name %s\n' $services) \
594 rule runit_sv_configure
"$sv" "$@"
595 rule runit_sv_start
"$sv"
598 #sudo find -L /etc/service -type l -delete
601 rule_runit_sv_configure
() { # SYNTAX: $sv $configure_options
603 sudo
install -d -m 770 -o root
-g root \
605 sudo
install -m 770 -o root
-g root \
606 "$tool"/etc
/sv
/"$sv"/run \
608 if test -e "$tool"/etc
/sv
/"$sv"/log
/run
610 sudo
install -d -m 770 -o root
-g root \
612 sudo
install -m 770 -o root
-g root \
613 "$tool"/etc
/sv
/"$sv"/log
/run \
614 /etc
/sv
/"$sv"/log
/run
617 test ! -r "$tool"/etc
/sv
/"$sv"/configure.sh ||
618 .
"$tool"/etc
/sv
/"$sv"/configure.sh ||
return 1
621 test ! -r "$tool"/etc
/sv
/"$sv"/log
/configure.sh ||
622 .
"$tool"/etc
/sv
/"$sv"/log
/configure.sh ||
return 1
628 rule_runit_sv_restart
() { # SYNTAX: $sv
631 do case $
(sudo sv restart
"$sv" |
tee /dev
/stderr
) in
632 (*": runsv not running") sleep 1;;
633 (*": unable to open supervise/ok: file does not exist") sleep 1;;
638 rule_runit_sv_start
() { # SYNTAX: $sv
641 do case $
(sudo sv start
"$sv" |
tee /dev
/stderr
) in
642 (*": runsv not running") sleep 1;;
643 (*": unable to open supervise/ok: file does not exist") sleep 1;;
648 rule_shorewall_configure
() {
649 # DOC: http://shorewall.net/Introduction.html
651 rule apt_get_install shorewall
652 sudo
install -m 644 -o root
-g root
/dev
/stdin \
653 /etc
/default
/shorewall
<<-EOF
662 for conf
in "$tool"/etc
/shorewall
/*
663 do conf
=${conf#"$tool"/etc/shorewall/}
664 sudo
test ! -f "$tool"/etc
/shorewall
/"$conf" ||
665 sudo
install -m 640 -o root
-g root \
666 "$tool"/etc
/shorewall
/"$conf" \
667 /etc
/shorewall
/"$conf"
669 sudo
install -d -m 750 -o root
-g root \
670 /etc
/shorewall
/macro.d
671 for conf
in "$tool"/etc
/shorewall
/macro.d
/*
672 do conf
=${conf#"$tool"/etc/shorewall/macro.d/}
673 sudo
test ! -f "$tool"/etc
/shorewall
/macro.d
/"$conf" ||
674 sudo
install -m 640 -o root
-g root \
675 "$tool"/etc
/shorewall
/macro.d
/"$conf" \
676 /etc
/shorewall
/macro.d
/"$conf"
678 sudo
install -d -m 750 -o root
-g root \
679 /etc
/shorewall
/action.d
680 #for conf in "$tool"/etc/shorewall/action.d/*
681 # do conf=${conf#"$tool"/etc/shorewall/action.d/}
682 # sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" ||
683 # sudo install -m 640 -o root -g root \
684 # "$tool"/etc/shorewall/action.d/"$conf" \
685 # /etc/shorewall/action.d/"$conf"
687 #sudo shorewall safe-restart
689 rule_sysctl_configure
() {
691 for conf
in "$tool"/etc
/sysctl.d
/*.conf
692 do conf
=${conf#"$tool"/etc/sysctl.d/}
693 sudo
install -m 660 -o root
-g root \
694 "$tool"/etc
/sysctl.d
/"$conf" \
695 /etc
/sysctl.d
/"$conf"
697 sudo
install -m 660 -o root
-g root
/dev
/stdin \
698 /etc
/sysctl.d
/local-kernel-name.conf
<<-EOF
699 kernel.hostname = $vm_hostname
700 kernel.domainname = $vm_domainname
704 rule_tmpfs_configure
() {
705 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/default
/tmpfs
<<-EOF
706 LOCK_SIZE=5242880 # NOTE: 5MiB
712 TMP_MODE=1777,nr_inodes=1000k,noatime
713 TMP_OVERFLOW_LIMIT=1024
714 # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
715 # on the root filesystem (overriding RAMTMP).
720 rule_user_add
() { # SYNTAX: $user
721 local user
="$1"; shift
722 rule adduser
"$user" --disabled-password "$@"
723 # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
724 eval local home\
; home
="~$user"
725 sudo adduser
"$user" users
726 sudo
install -m 640 -o "$user" -g "$user" \
727 "$tool"/var
/pub
/ssh
/"$user".key \
728 "$home"/etc
/ssh
/authorized_keys
729 local key
; local -; set +f
730 for key
in "$tool"/var
/pub
/openpgp
/*.key
731 do sudo
-u "$user" gpg
--import - <"$key"
734 rule_user_configure
() {
735 rule apt_get_install bash-completion
736 sudo
install -m 660 -o root
-g root \
737 "$tool"/etc
/adduser.conf \
739 sudo
install -d -m 750 -o root
-g root \
744 sudo
install -d -m 770 -o root
-g root \
746 /etc
/skel
/var
/cache \
749 /etc
/skel
/var
/run
/ssh
750 sudo
ln -fns etc
/ssh /etc
/skel
/.
ssh
751 sudo
ln -fns etc
/gpg
/etc
/skel
/.gnupg
752 sudo
install -m 640 -o root
-g root
/dev
/stdin
/etc
/sudoers.d
/passwd-init
<<-EOF
753 %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
754 case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
755 ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
757 sudo
install -m 640 -o root
-g root
/dev
/stdin
/etc
/sudoers.d
/etckeeper-unclean
<<-EOF
758 %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
760 sudo
install -m 640 -o root
-g root
/dev
/stdin
/etc
/sudoers.d
/env_keep
<<-EOF
761 Defaults env_keep = " \\
765 GIT_COMMITTER_NAME \\
766 GIT_COMMITTER_EMAIL \\
769 sudo
install -m 755 -o root
-g root
/dev
/stdin
/usr
/local
/bin
/passwd-init
<<-EOF
771 # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
772 sudo /bin/sh -e -f -u -c \
773 'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
775 sudo
install -m 644 -o root
-g root \
776 "$tool"/etc
/bash.bashrc \
778 sudo
install -m 644 -o root
-g root \
779 "$tool"/etc
/screenrc \
781 local sh
; local -; set +f
782 for sh
in "$tool"/etc
/user.d
/*/configure.sh
783 do sh
=${sh#"$tool"/etc/user.d/}
784 local user
="${sh%/configure.sh}"
786 .
"$tool"/etc
/user.d
/"$sh" ||
return 1
790 rule_user_admin_add
() { # SYNTAX: $user
793 rule adduser
"$user" --disabled-password
794 eval local home\
; home
="~$user"
795 sudo adduser
"$user" sudo
796 sudo
install -m 640 -o root
-g root \
797 "$tool"/var
/pub
/ssh
/"$user".key \
798 "$home"/etc
/ssh
/authorized_keys
799 local key
; local -; set +f
800 for key
in "$tool"/var
/pub
/openpgp
/*.key
801 do sudo
-u "$user" gpg
--import - <"$key"
803 rule user_admin_configure
805 rule_user_admin_configure
() {
806 rule initramfs_configure
807 rule user_root_configure
809 rule_user_root_configure
() {
810 sudo
install -d -m 750 -o root
-g root \
814 sudo
ln -fns etc
/gpg
/root
/.gnupg
815 sudo
ln -fns etc
/ssh /root
/.
ssh
817 while IFS
=: read -r group x x users
818 do while test -n "$users" && IFS
=, read -r user users
<<-EOF
821 do eval local home\
; home
="~$user"
822 sudo
cat "$home"/etc
/ssh
/authorized_keys
825 sudo
install -m 640 -o root
-g root
/dev
/stdin
/root
/etc
/ssh
/authorized_keys
826 local key
; local -; set +f
827 for key
in "$tool"/var
/pub
/openpgp
/*.key
828 do sudo gpg
--import "$key"
831 rule_www_configure
() {
834 --disabled-password \
839 rule adduser log-www \
841 --disabled-password \
843 --home /home
/www
/log \
846 #sudo adduser www www-data
847 sudo adduser www log-www
848 #sudo adduser log log-www
849 usermod
--home /home
/www
/pub www-data
850 sudo
install -d -m 751 -o www
-g www \
852 sudo
install -d -m 750 -o www
-g www \
854 sudo
install -d -m 1771 -o www-data
-g www-data \
856 sudo
install -d -m 1771 -o log-www
-g log-www \
862 rule etckeeper_configure
863 rule locales_configure
865 rule network_configure
866 rule filesystem_configure
869 rule user_root_configure
871 rule sysctl_configure
873 rule gitolite_configure
874 rule shorewall_configure
878 rule_luks_key_change
() {
879 sudo cryptsetup luksChangeKey
/dev
/$vm_lvm_vg/${vm_lvm_lv}_root
887 assert
'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn