git config --replace branch.master.merge refs/remotes/master
local tool
tool=$(cd "$tool"; cd -)
- sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/
- sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm
- sudo install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
+ install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
#!/bin/sh -efux
case \$1 in
(refs/remotes/master)
}
rule_apt_configure () {
sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
- deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free
+ deb http://ftp.rezopole.net/debian $vm_lsb_name main
EOF
- sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF
- #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
+ deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
EOF
sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
Package: *
Pin: release a=$vm_lsb_name
- Pin-Priority: 170
+ Pin-Priority: 200
Package: *
Pin: release a=$vm_lsb_name-backports
- Pin-Priority: 200
+ Pin-Priority: 170
EOF
- #sudo install -m 660 -o root -g root /dev/stdin /etc/apt/apt.conf.d/02proxy-grenode <<-EOF
- # Acquire::http::Proxy "http://outils.grenode.net:3142";
- # EOF
sudo apt-get update
rule apt_get_install apticron
sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF
$users
EOF
do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
+ sudo cat "$home"/etc/ssh/authorized_keys
done
done |
- sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys
+ sudo install -m 644 -o root -g root /dev/stdin \
+ /etc/initramfs-tools/root/.ssh/authorized_keys
sudo rm -f \
/etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
/etc/initramfs-tools/root/.ssh/id_rsa.pub \
\$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
\$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
#\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
- \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*";
+ \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
#\$GL_HOSTNAME = "git.$vm_domainname";
# NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
#\$GL_HTTP_ANON_USER = "mob";
#\$GL_WILDREPOS_DEFPERMS = 'R @all';
\$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
\$HTPASSWD_FILE = "";
- \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list";
+ \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
\$REPO_BASE = "pub";
\$REPO_UMASK = 0007;
\$RSYNC_BASE = "";
}
rule_mysql_configure () {
rule apt_get_install mysql-server-5.5
- sudo install -m 644 -o root -g root \
+ rule adduser mysql \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/mysql \
+ --shell /bin/false \
+ --system
+ rule adduser mysql-data \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/mysql/data \
+ --shell /bin/false \
+ --system
+ sudo usermod --home /home/mysql mysql
+ sudo adduser mysql mysql-data
+ sudo install -m 640 -o mysql -g mysql \
"$tool"/etc/mysql/my.cnf \
/etc/mysql/my.cnf
- if test ! -d /home/mysql
+ sudo install -d -m 751 -o mysql -g mysql \
+ /home/mysql
+ sudo install -d -m 750 -o mysql-data -g mysql-data \
+ /home/mysql/data
+ if test ! -d /home/mysql/data
then
- sudo install -d -m 750 -o mysql -g mysql /home/mysql
- sudo -u mysql mysql_install_db --no-defaults --datadir=/home/mysql
- sudo usermod --home /home/mysql mysql
+ sudo -u mysql mysql_install_db \
+ --no-defaults \
+ --datadir=/home/mysql/data
fi
+ sudo service tmpfs restart
+ case $(sudo sv status mysql || true) in
+ (run:*) sudo sv restart mysql
+ esac
}
rule_network_configure () {
sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
pre-down ip address delete $vm_ipv4/32 dev \$IFACE
EOF
}
-rule_www_configure () {
- rule adduser www \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/www \
- --shell /bin/false \
- --system
- rule adduser log-www \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/www/log \
- --shell /bin/false \
- --system
- #sudo adduser www www-data
- sudo adduser www log-www
- #sudo adduser log log-www
- usermod --home /home/www/pub www-data
- sudo install -d -m 751 -o www -g www \
- /home/www
- sudo install -d -m 750 -o www -g www \
- /home/www/etc
- sudo install -d -m 1771 -o www-data -g www-data \
- /home/www/pub
- sudo install -d -m 1771 -o log-www -g log-www \
- /home/www/log
- }
rule_nginx_configure () {
local -; set +f
rule apt_get_install nginx
done
rule apt_get_install spawn-fcgi fcgiwrap
sudo insserv --remove fcgiwrap
- sudo insserv --remove nginx
+ #sudo insserv --remove nginx
rule tmpfs_configure
sudo service php5-fpm restart
# NOTE: relance les processus du pool
# pour leur donner les droits
# de leurs groupes supplémentaires.
sudo service nginx restart
- #case $(sv status nginx) in
- # (run:*) sudo sv restart nginx
- # esac
+ }
+rule_nsd3_configure () { # NOTE: DNS autoritaire uniquement
+ local -; set +f
+ rule apt_get_install nsd m4
+ sudo rm -rf \
+ /etc/nsd3/zone.d
+ sudo install -d -m 750 -o root -g nsd \
+ /etc/nsd3/zone.d
+ {
+ cat <<-EOF
+ server:
+ ip-address: $vm_ipv4
+ ip4-only: yes
+ EOF
+ cat "$tool"/etc/nsd3/nsd.conf
+ local conf
+ for conf in "$tool"/etc/nsd3/zone.d/*.conf
+ do conf=${conf#"$tool"/etc/nsd3/zone.d/}
+ local domain=${conf%.conf}
+ if test -e "$tool"/etc/nsd3/zone.d/"$domain".zone.m4
+ then m4 \
+ --define=ZONE_DOMAIN=$domain \
+ --define=ZONE_SERIAL=$(cd "$tool" && git log -1 --format="%ct" -- etc/nsd3/zone.d/"$domain".zone.m4) \
+ --define=VM_IP4=$vm_ipv4 \
+ "$tool"/etc/nsd3/zone.d/"$domain".zone.m4
+ else cat "$tool"/etc/nsd3/zone.d/"$domain".zone
+ fi |
+ sudo install -m 440 -o root -g nsd /dev/stdin \
+ /etc/nsd3/zone.d/"$domain".zone
+ sudo install -m 440 -o root -g nsd \
+ "$tool"/etc/nsd3/zone.d/"$conf" \
+ /etc/nsd3/zone.d/"$conf"
+ cat <<-EOF
+ zone:
+ name: $domain
+ zonefile: /etc/nsd3/zone.d/$domain.zone
+ EOF
+ done
+ } |
+ sudo install -m 640 -o root -g nsd /dev/stdin \
+ /etc/nsd3/nsd.conf
+ sudo service nsd3 restart
}
rule_php5_fpm_configure () {
local -; set +f
sudo install -m 664 -o php5 -g php5 \
"$tool"/etc/php5/fpm/php.ini \
/etc/php5/fpm/php.ini
- case $(sv status php5-"$pool") in
+ case $(sudo sv status php5-"$pool") in
(run:*) sudo sv restart php5-"$pool"
esac
done
local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
local sv_status
IFS= read -r sv_status_$sv_hash <<-EOF
- $(sv status "$sv")
+ $(sudo sv status "$sv")
EOF
- rm -f /etc/service/"$sv"
+ sudo rm -f /etc/service/"$sv"
done
for sv in ${1-"$tool"/etc/sv/*}
# NOTE: configure et (re-)démarre les services
/etc/sv/"$sv"/log/run
fi
test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
- . "$tool"/etc/sv/"$sv"/configure.sh
- ln -fns ../sv/"$sv" /etc/service/"$sv"
+ . "$tool"/etc/sv/"$sv"/configure.sh
+ sudo ln -fns ../sv/"$sv" /etc/service/"$sv"
eval local sv_status=\"\${sv_status_$sv_hash-}\"
case $sv_status in
("") true;;
- (run:*) sv restart "$sv";;
+ (run:*) sudo sv restart "$sv";;
esac
done
}
#Compression yes
#CompressionLevel 9
#ControlMaster auto
- #ControlPath ~/var/run/ssh/%h-%p-%r.sock
+ #ControlPath ~/var/run/ssh/sock/%h-%p-%r
GSSAPIAuthentication no
GSSAPIDelegateCredentials no
HashKnownHosts yes
done
}
rule_user_configure () {
+ rule apt_get_install bash-completion
sudo install -m 660 -o root -g root /dev/stdin \
/etc/adduser.conf <<-EOF
ADD_EXTRA_GROUPS=1
("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
EOF
sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
- %sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean
+ %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
EOF
sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
Defaults env_keep = " \\
$users
EOF
do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
+ sudo cat "$home"/etc/ssh/authorized_keys
done
done |
sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys
do sudo gpg --import "$key"
done
}
+rule_www_configure () {
+ rule adduser www \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/www \
+ --shell /bin/false \
+ --system
+ rule adduser log-www \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/www/log \
+ --shell /bin/false \
+ --system
+ #sudo adduser www www-data
+ sudo adduser www log-www
+ #sudo adduser log log-www
+ usermod --home /home/www/pub www-data
+ sudo install -d -m 751 -o www -g www \
+ /home/www
+ sudo install -d -m 750 -o www -g www \
+ /home/www/etc
+ sudo install -d -m 1771 -o www-data -g www-data \
+ /home/www/pub
+ sudo install -d -m 1771 -o log-www -g log-www \
+ /home/www/log
+ }
rule_configure () {
rule apt_configure
rule git_configure
rule php5_fpm_configure
rule nginx_configure
#rule apache2_configure
+ rule nsd3_configure
rule runit_configure
}