2 set -e -f ${DRY_RUN:+-n} -u
5 do tool
=$
(readlink
"$tool")
12 rule_help
() { # SYNTAX: [--hidden]
13 local hidden
; [ ${1:+set} ] || hidden
=set
16 ce script regroupe des règles pour administrer la VM ($vm_fqdn)
17 _depuis_ la VM hébergée ($vm_fqdn) ;
18 il sert à la fois d'outil (aisément bidouillable)
19 et de documentation (préçise).
20 Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
21 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
23 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/ \1\2/p" "$tool"/etc/vm.sh "$0")
25 TRACE # affiche les commandes avant leur exécution
26 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
30 rule_git_configure
() {
33 git config
--replace branch.master.remote .
34 git config
--replace branch.master.merge refs
/remotes
/master
36 tool
=$
(cd "$tool"; cd -)
37 install -m 770 /dev
/stdin .git
/hooks
/post-update
<<-EOF
42 git --git-dir=\$PWD/.git checkout -f -B master remotes/master
43 git --git-dir=\$PWD/.git clean -f -d -x
52 git checkout
-f -B master remotes
/master
58 local user
="$1"; shift
59 getent passwd
"$user" >/dev
/null ||
60 sudo adduser
"$@" "$user"
62 rule_apt_get_install
() { # SYNTAX: $package
64 DEBIAN_FRONTEND
=noninteractive \
66 apt-get
install --yes "$@"
68 rule_dpkg_reconfigure
() { # SYNTAX: $package
70 DEBIAN_FRONTEND
=noninteractive \
75 rule__chrooted_configure
() { # NOTE: est-ce bien utile à un moment ?
81 rule_apache2_configure
() { # XXX: cette règle n'est pas testée/mise-à-jour
83 rule apt_get_install \
86 # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
87 # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
88 # NOTE: apache2-mpm-itk semble le plus sécurisé,
89 # car on est certain que tout est exécuté avec les uid/gid
90 # assignés au VirtualHost/Directory/Location
91 # néamoins il se peut qu'une combinaison du genre :
92 # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
93 # soit plus performante (threads et pas forks),
94 # cependant l'usage de suexec impose des forks il semble..
95 # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
96 # donc pour l'instant : apache2-mpm-itk
99 sudo
install -d -m 770 -o www
-g www \
101 /etc
/apache
2/site.d \
103 cat /dev
/stdin
"$tool"/etc
/apache
2/apache2.conf
<<-EOF |
104 ServerName "$vm_fqdn"
106 sudo
install -m 660 -o root
-g root
/dev
/stdin \
107 /etc
/apache
2/apache2.conf
108 sudo
install -m 660 -o root
-g root \
109 "$tool"/etc
/apache
2/envvars \
111 sudo
install -m 660 -o root
-g root \
112 "$tool"/etc
/apache
2/httpd.conf \
113 /etc
/apache
2/httpd.conf
114 #sudo install -m 660 -o root -g root /dev/stdin \
115 # /etc/apache2/suexec/www-data <<-EOF
119 sudo
install -m 660 -o root
-g root \
120 "$tool"/etc
/apache
2/ports.conf \
121 /etc
/apache
2/ports.conf
131 /home
/www
/etc
/apache2
132 for conf
in "$tool"/etc
/apache
2/site.d
/*/VirtualHost.conf
133 do conf
=${conf#"$tool"/etc/apache2/site.d/}
134 local site
=${conf%/VirtualHost.conf}
137 local hint
="run vm_remote apache2_key_send before"
138 assert
"sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
139 sudo
install -d -m 770 -o www-
"$site" -g www-
"$site" \
141 /etc
/apache
2/site.d
/"$site" \
142 /etc
/apache
2/x509.d
/"$site" \
143 /etc
/apache
2/x509.d
/"$site"/ca \
144 /etc
/apache
2/x509.d
/"$site"/empty \
145 /etc
/apache
2/x509.d
/"$site"/rvk \
146 /etc
/apache
2/x509.d
/"$site"/usr
147 sudo
install -m 664 -o www
-g www \
148 "$tool"/var
/pub
/x509
/"$site"/crt.self-signed.pem \
149 /etc
/apache
2/x509.d
/"$site"/crt.self-signed.pem
150 #sudo install -m 664 -o www-"$site" -g www-"$site" \
151 # "$tool"/var/pub/x509/"$site"/rvk.pem \
152 # /etc/apache2/x509.d/"$site"/rvk.pem
153 sudo
install -m 664 -o www
-g www \
154 "$tool"/var
/pub
/x509
/"$site"/ca
/crt.self-signed.pem \
155 /etc
/apache
2/x509.d
/"$site"/ca
/crt.pem
156 sudo
install -m 664 -o www
-g www \
157 "$tool"/var
/pub
/x509
/"$site"/crt.pem \
158 /etc
/apache
2/x509.d
/"$site"/crt.pem
165 <VirtualHost *:$port>
166 AssignUserID www-$site www-$site
167 BrowserMatch "MSIE [2-6]" ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
168 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
169 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
170 #CustomLog "/dev/null" Combined
171 DocumentRoot /home/www/pub/$site
172 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
173 #ErrorLog "/dev/null"
175 SSLCACertificateFile /etc/apache2/x509.d/$site/crt.self-signed.pem
176 SSLCACertificatePath /etc/apache2/x509.d/$site/usr/
177 #SSLCARevocationFile /etc/apache2/x509.d/$site/rvk.pem
178 SSLCADNRequestFile /etc/apache2/x509.d/$site/crt.self-signed.pem
179 SSLCADNRequestPath /etc/apache2/x509.d/$site/empty/
180 # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés
181 SSLCARevocationPath /etc/apache2/x509.d/$site/rvk/
182 SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem
183 SSLCertificateFile /etc/apache2/x509.d/$site/crt.pem
184 SSLCertificateKeyFile /etc/apache2/x509.d/$site/key.pem
185 SSLCipherSuite AES+RSA+SHA256
187 SSLInsecureRenegotiation Off
188 SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
189 SSLProtocol -All +TLSv1
190 #SSLRenegBufferSize 262144
191 SSLSessionCacheTimeout 1200
192 SSLStrictSNIVHostCheck On
193 SSLUserName SSL_CLIENT_S_DN_CN
196 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
203 <VirtualHost *:$port>
204 AssignUserID www-$site www-$site
205 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
206 #CustomLog "/dev/null" Combined
207 DocumentRoot /home/www/pub/$site
208 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
209 #ErrorLog "/dev/null"
211 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
216 sudo
install -m 660 -o root
-g root
/dev
/stdin \
217 /etc
/apache
2/site.d
/"$site"/VirtualHost.conf
219 ..
/site.d
/"$site"/VirtualHost.conf \
220 /etc
/apache
2/sites-available
/"$site"
221 sudo
install -d -m 770 -o www-
"$site" -g www-
"$site" \
222 /home
/www
/log
/"$site" \
223 /home
/www
/log
/"$site"/apache2
225 /etc
/apache
2/site.d
/"$site" \
226 /home
/www
/etc
/apache
2/"$site"
227 test -e /home
/www
/pub
/"$site" ||
228 sudo
install -d -m 2770 -o www-
"$site" -g www-
"$site" \
229 /home
/www
/pub
/"$site"
230 rule adduser www-
"$site"
231 --disabled-password \
234 --home /home
/www
/pub
/"$site" \
237 #sudo setfacl -m u:"www-$site":--x \
240 # /home/www/pub/"$site"/
241 #sudo setfacl -m d:u:"www-$site":rwx \
242 # "$home"/pub/www/"$site"/
243 test ! -r "$tool"/etc
/apache
2/site.d
/"$site"/configure.sh ||
244 .
"$tool"/etc
/apache
2/site.d
/"$site"/configure.sh
245 test -e /etc
/apache
2/sites-enabled
/"$site" ||
246 sudo a2ensite
"$site"
248 sudo service apache2 restart
250 rule_apt_configure
() {
251 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/sources.list
<<-EOF
252 deb http://ftp.rezopole.net/debian $vm_lsb_name main
254 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/sources.list.d
/$vm_lsb_name-backports.list
<<-EOF
255 deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
257 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/sources.list.d
/openerp.list
<<-EOF
258 deb http://nightly.openerp.com/7.0/nightly/deb/ ./
260 sudo
install -m 664 -o root
-g root
/dev
/stdin
/etc
/apt
/preferences
<<-EOF
262 Pin: release a=$vm_lsb_name
266 Pin: release a=$vm_lsb_name-backports
270 rule apt_get_install apticron
272 --define=VM_DOMAINNAME
=$vm_domainname \
273 <"$tool"/etc
/apticron
/apticron.conf.
m4 |
274 sudo
install -m 644 -o root
-g root
/dev
/stdin \
275 /etc
/apticron
/apticron.conf
277 rule_boot_configure
() {
278 #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
279 sudo debconf-set-selections
<<-EOF
280 grub-pc grub-pc/install_devices multiselect
282 rule apt_get_install grub-pc
283 sudo
install -d -m 644 -o root
-g root
/boot
/grub
284 rule apt_get_install linux-image-
$vm_arch
285 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/default
/grub
<<-EOF
288 GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
289 GRUB_CMDLINE_LINUX_DEFAULT="quiet"
290 GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
291 GRUB_DISABLE_RECOVERY="true"
292 #GRUB_PRELOAD_MODULES="lvm"
294 sudo
install -m 644 -o root
-g root
/dev
/stdin
/boot
/grub
/device.map
<<-EOF
296 (hd0) /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
298 sudo update-grub2
# NOTE: prend en compte /boot/grub/device.map
299 rule initramfs_configure
300 rule apt_get_install molly-guard
301 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/molly-guard
/rc
<<-EOF
302 ALWAYS_QUERY_HOSTNAME=true
303 # NOTE: une alternative est de dire à sudo de conserver les SSH_*
304 # néamoins demander tout le temps n'est pas trop contraignant
305 # et davantage sécurisant.
308 rule_duplicity_configure
() {
309 rule apt_get_install duplicity
311 rule adduser backup \
312 --disabled-password \
317 sudo usermod
--home "$home" backup
318 sudo
install -d -m 750 -o backup
-g backup \
323 sudo
install -d -m 770 -o backup
-g backup \
326 getent group sudo backup |
327 while IFS
=: read -r group x x users
328 do while test -n "$users" && IFS
=, read -r user users
<<-EOF
331 do eval local home\
; home
="~$user"
332 sudo
cat "$home"/etc
/ssh
/authorized_keys
335 sudo
install -m 640 -o backup
-g backup
/dev
/stdin \
336 "$home"/etc
/ssh
/authorized_keys
337 sudo
ln -fns etc
/gpg
"$home"/.gnupg
338 #sudo adduser backup mysql-data
339 #sudo adduser backup postgres-data
341 rule_etckeeper_configure
() {
342 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/etckeeper
/etckeeper.conf
<<-EOF
344 GIT_COMMIT_OPTIONS=""
345 AVOID_DAILY_AUTOCOMMITS=1
346 #AVOID_SPECIAL_FILE_WARNING=1
347 AVOID_COMMIT_BEFORE_INSTALL=1
348 HIGHLEVEL_PACKAGE_MANAGER=apt
349 LOWLEVEL_PACKAGE_MANAGER=dpkg
351 sudo
install -m 644 -o root
-g root \
352 "$tool"/etc
/etckeeper
/prompt.sh \
353 /etc
/etckeeper
/prompt.sh
354 rule apt_get_install etckeeper
356 rule_filesystem_configure
() {
358 --define=VM_LVM_LV
=$vm_lvm_lv \
359 --define=VM_LVM_VG
=$vm_lvm_vg \
360 <"$tool"/etc
/fstab.
m4 |
361 sudo
install -m 644 -o root
-g root
/dev
/stdin \
364 --define=VM_LVM_LV
=$vm_lvm_lv \
365 --define=VM_LVM_VG
=$vm_lvm_vg \
366 <"$tool"/etc
/crypttab.
m4 |
367 sudo
install -m 644 -o root
-g root
/dev
/stdin \
371 rule_initramfs_configure
() {
372 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/initramfs-tools
/initramfs.conf
<<-EOF
379 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/modprobe.d
/xen-pv.conf
<<-EOF
381 alias scsi_hostadapter xenblk
383 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/modules
<<-EOF
389 # NOTE: pour Xen en mode HVM :
390 #modprobe xen-platform-pci
392 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/initramfs-tools
/modules
<<-EOF
394 sudo
sed -e '/^configure_networking /s/ &$//' \
395 -i /usr
/share
/initramfs-tools
/scripts
/init-premount
/dropbear
396 # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
397 ssh-keygen
-F "init.$vm_fqdn" -f "$tool"/etc
/openssh
/known_hosts |
398 ( while IFS
= read -r line
399 do case $line in (*" RSA") return 0; break;; esac
403 /etc
/initramfs-tools
/etc
/dropbear
/dropbear_rsa_host_key \
404 /etc
/initramfs-tools
/etc
/dropbear
/dropbear_rsa_host_key.pub
405 sudo dropbearkey
-t rsa
-s 4096 -f \
406 /etc
/initramfs-tools
/etc
/dropbear
/dropbear_rsa_host_key
408 # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
409 sudo
install -d -m 640 -o root
-g root \
410 /etc
/initramfs-tools
/root \
411 /etc
/initramfs-tools
/root
/.
ssh
413 while IFS
=: read -r group x x users
414 do while test -n "$users" && IFS
=, read -r user users
<<-EOF
417 do eval local home\
; home
="~$user"
418 sudo
cat "$home"/etc
/ssh
/authorized_keys
421 sudo
install -m 644 -o root
-g root
/dev
/stdin \
422 /etc
/initramfs-tools
/root
/.ssh
/authorized_keys
424 /etc
/initramfs-tools
/root
/.ssh
/id_rsa.dropbear \
425 /etc
/initramfs-tools
/root
/.ssh
/id_rsa.pub \
426 /etc
/initramfs-tools
/root
/.ssh
/id_rsa
427 # NOTE: clefs générées par Debian
428 sudo update-initramfs
-u
430 rule_insserv_remove
() { # SYNTAX: $sv
432 #sudo chmod u+x /etc/init.d/"$sv"
433 sudo insserv
--force --remove "$sv"
434 sudo
test ! -x /etc
/init.d
/"$sv" ||
435 sudo
/etc
/init.d
/"$sv" stop
436 sudo
chmod ugo-x
/etc
/init.d
/"$sv"
438 rule_gitolite_configure
() {
439 sudo debconf-set-selections
<<-EOF
440 gitolite gitolite/gituser string git
441 gitolite gitolite/adminkey string
442 gitolite gitolite/gitdir string /home/git
444 rule apt_get_install gitolite
446 --disabled-password \
451 sudo chfn
--full-name git git
452 rule adduser log-git \
454 --disabled-password \
456 --home /home
/git
/log \
459 rule adduser git-data \
461 --disabled-password \
463 --home /home
/git
/pub \
466 sudo adduser git git-data
467 sudo
install -d -m 750 -o git
-g git \
471 sudo
install -d -m 751 -o git
-g git \
473 sudo
install -d -m 2770 -o git-data
-g git-data \
475 sudo
install -d -m 1771 -o git
-g git \
477 sudo
install -d -m 2770 -o git
-g log-git \
478 /home
/git
/log
/gitolite \
479 /home
/git
/log
/gitolite
/perf
480 sudo
install -d -m 3771 -o git
-g git \
482 sudo
ln -fns /etc
/gitolite
/home
/git
/etc
/gitolite
483 sudo
ln -fns /etc
/gitweb
/home
/git
/etc
/gitweb
484 sudo
ln -fns etc
/gitolite
/gitolite.rc
/home
/git
/.gitolite.rc
485 sudo
ln -fns etc
/ssh /home
/git
/.
ssh
486 sudo
install -m 770 -o git
-g git
/dev
/stdin \
487 /home
/git
/etc
/gitolite
/gitolite.rc
<<-EOF
488 #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
489 #\$BIG_INFO_CAP = 20;
490 #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
491 # NOTE: Please use single quotes, not double quotes.
492 #\$GITWEB_URI_ESCAPE = 0;
495 \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
496 #\$GL_ALL_INCLUDES_SPECIAL = 0;
497 #\$GL_ALL_READ_ALL = 0;
499 \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
500 \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
501 #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
502 \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
503 #\$GL_HOSTNAME = "git.$vm_domainname";
504 # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
505 #\$GL_HTTP_ANON_USER = "mob";
506 \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
507 \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
508 #\$GL_NICE_VALUE = 0;
509 \$GL_NO_CREATE_REPOS = 0;
510 \$GL_NO_DAEMON_NO_GITWEB = 0;
511 \$GL_NO_SETUP_AUTHKEYS = 0;
512 \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
513 \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
514 #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
515 #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
516 \$GL_SITE_INFO = "git.$vm_domainname";
517 #\$GL_SLAVE_MODE = 0;
519 #\$GL_WILDREPOS_DEFPERMS = 'R @all';
520 \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
521 \$HTPASSWD_FILE = "";
522 \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
527 #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
528 \$WEB_INTERFACE = "gitweb";
531 sudo
install -m 600 -o git
-g git \
532 "$tool"/var
/pub
/ssh
/git.key \
533 /home
/git
/etc
/ssh
/git.pub
535 GL_RC
=/home
/git
/etc
/gitolite
/gitolite.rc \
536 GIT_AUTHOR_NAME
=git \
537 gl-setup
-q /home
/git
/etc
/ssh
/git.pub git
539 for d
in doc logs src
540 do test ! -d /home
/git
/etc
/gitolite
/"$d" ||
541 rmdir /home
/git
/etc
/gitolite
/"$d"
544 rule_locales_configure
() {
545 sudo debconf-set-selections
<<-EOF
546 locales locales/default_environment_locale select None
547 locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8
549 rule dpkg_reconfigure locales
551 rule_login_configure
() {
552 sudo
install -m 644 -o root
-g root \
553 "$tool"/etc
/inittab \
555 sudo
install -m 644 -o root
-g root \
556 "$tool"/etc
/login.defs \
558 grep -q '^session optional pam_umask.so\>' /etc
/pam.d
/common-session ||
559 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/pam.d
/common-session
<<-EOF
560 $(cat /etc/pam.d/common-session)
561 session optional pam_umask.so
563 grep -q '^hvc0$' /etc
/securetty ||
564 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/securetty
<<-EOF
565 $(cat /etc/securetty)
568 grep -q '^xvc0$' /etc
/securetty ||
569 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/securetty
<<-EOF
570 $(cat /etc/securetty)
574 rule_network_configure
() {
575 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/hostname
<<-EOF
578 grep -q " $vm\$" /etc
/hosts ||
579 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/hosts
<<-EOF
581 127.0.0.1 $vm_fqdn $vm
583 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/resolv.conf
<<-EOF
585 nameserver ${vm_host_nameserver}
588 --define=VM_IPV4
=$vm_ipv4 \
589 <"$tool"/etc
/network
/interfaces.
m4 |
590 sudo
install -m 640 -o root
-g root
/dev
/stdin \
591 /etc
/network
/interfaces
593 rule_runit_configure
() { # SYNTAX: $sv [...] -- $configure_options
594 rule apt_get_install runit
599 $
(sudo
find /etc
/sv \
600 -mindepth 1 -maxdepth 1 -type d \
601 -printf '%p\n' |
sort)
607 (*) services
="$services $1"; shift;;
610 #for sv in $(sudo find /etc/sv \
611 # -mindepth 1 -maxdepth 1 -type d \
612 # -false $(printf -- '-or -name %s\n' $services) \
615 # case $(sudo sv stop "$sv" | tee /dev/stderr) in
616 # (*": runsv not running") true;;
617 # (*": unable to open supervise/ok: file does not exist") true;;
618 # ("ok: down:"*) true;;
622 for sv
in $
(find "$tool"/etc
/sv \
623 -mindepth 1 -maxdepth 1 -type d \
624 -false $
(printf -- '-or -name %s\n' $services) \
627 rule _runit_sv_configure
"$sv" "$@"
628 rule _runit_sv_start
"$sv"
631 #sudo find -L /etc/service -type l -delete
634 rule__runit_sv_configure
() { # SYNTAX: $sv $configure_options
636 sudo
install -d -m 770 -o root
-g root \
638 sudo
install -m 770 -o root
-g root \
639 "$tool"/etc
/sv
/"$sv"/run \
641 if test -e "$tool"/etc
/sv
/"$sv"/log
/run
643 sudo
install -d -m 770 -o root
-g root \
645 sudo
install -m 770 -o root
-g root \
646 "$tool"/etc
/sv
/"$sv"/log
/run \
647 /etc
/sv
/"$sv"/log
/run
650 test ! -r "$tool"/etc
/sv
/"$sv"/configure.sh ||
651 .
"$tool"/etc
/sv
/"$sv"/configure.sh ||
return 1
654 test ! -r "$tool"/etc
/sv
/"$sv"/log
/configure.sh ||
655 .
"$tool"/etc
/sv
/"$sv"/log
/configure.sh ||
return 1
661 rule__runit_sv_restart
() { # SYNTAX: $sv
664 do case $
(sudo sv restart
"$sv" |
tee /dev
/stderr
) in
665 (*": runsv not running") sleep 1;;
666 (*": unable to open supervise/ok: file does not exist") sleep 1;;
671 rule__runit_sv_start
() { # SYNTAX: $sv
674 do case $
(sudo sv start
"$sv" |
tee /dev
/stderr
) in
675 (*": runsv not running") sleep 1;;
676 (*": unable to open supervise/ok: file does not exist") sleep 1;;
681 rule_shorewall_configure
() {
682 # DOC: http://shorewall.net/Introduction.html
684 rule apt_get_install shorewall
685 sudo
install -m 644 -o root
-g root
/dev
/stdin \
686 /etc
/default
/shorewall
<<-EOF
695 for conf
in "$tool"/etc
/shorewall
/*
696 do conf
=${conf#"$tool"/etc/shorewall/}
697 sudo
test ! -f "$tool"/etc
/shorewall
/"$conf" ||
698 sudo
install -m 640 -o root
-g root \
699 "$tool"/etc
/shorewall
/"$conf" \
700 /etc
/shorewall
/"$conf"
702 sudo
install -d -m 750 -o root
-g root \
703 /etc
/shorewall
/macro.d
704 for conf
in "$tool"/etc
/shorewall
/macro.d
/*
705 do conf
=${conf#"$tool"/etc/shorewall/macro.d/}
706 sudo
test ! -f "$tool"/etc
/shorewall
/macro.d
/"$conf" ||
707 sudo
install -m 640 -o root
-g root \
708 "$tool"/etc
/shorewall
/macro.d
/"$conf" \
709 /etc
/shorewall
/macro.d
/"$conf"
711 sudo
install -d -m 750 -o root
-g root \
712 /etc
/shorewall
/action.d
713 #for conf in "$tool"/etc/shorewall/action.d/*
714 # do conf=${conf#"$tool"/etc/shorewall/action.d/}
715 # sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" ||
716 # sudo install -m 640 -o root -g root \
717 # "$tool"/etc/shorewall/action.d/"$conf" \
718 # /etc/shorewall/action.d/"$conf"
720 #sudo shorewall safe-restart
722 rule_sysctl_configure
() {
724 for conf
in "$tool"/etc
/sysctl.d
/*.conf
725 do conf
=${conf#"$tool"/etc/sysctl.d/}
726 sudo
install -m 660 -o root
-g root \
727 "$tool"/etc
/sysctl.d
/"$conf" \
728 /etc
/sysctl.d
/"$conf"
730 sudo
install -m 660 -o root
-g root
/dev
/stdin \
731 /etc
/sysctl.d
/local-kernel-name.conf
<<-EOF
732 kernel.hostname = $vm_hostname
733 kernel.domainname = $vm_domainname
737 rule_tmpfs_configure
() {
738 sudo
install -m 644 -o root
-g root
/dev
/stdin
/etc
/default
/tmpfs
<<-EOF
739 LOCK_SIZE=5242880 # NOTE: 5MiB
745 TMP_MODE=1777,nr_inodes=1000k,noatime
746 TMP_OVERFLOW_LIMIT=1024
747 # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
748 # on the root filesystem (overriding RAMTMP).
753 rule_user_add
() { # SYNTAX: $user
754 local user
="$1"; shift
755 rule adduser
"$user" --disabled-password "$@"
756 # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
757 eval local home\
; home
="~$user"
758 sudo adduser
"$user" users
759 sudo
install -m 640 -o "$user" -g "$user" \
760 "$tool"/var
/pub
/ssh
/"$user".key \
761 "$home"/etc
/ssh
/authorized_keys
763 --homedir "$tool"/var
/pub
/openpgp
/ \
764 --no-default-keyring \
765 --secret-keyring /dev
/null \
767 sudo
-u "$user" gpg
--import -
769 rule_user_configure
() {
770 rule apt_get_install bash-completion
771 sudo
install -m 660 -o root
-g root \
772 "$tool"/etc
/adduser.conf \
774 sudo
install -d -m 750 -o root
-g root \
779 sudo
install -d -m 770 -o root
-g root \
781 /etc
/skel
/var
/cache \
784 /etc
/skel
/var
/run
/ssh
785 sudo
ln -fns etc
/ssh /etc
/skel
/.
ssh
786 sudo
ln -fns etc
/gpg
/etc
/skel
/.gnupg
787 sudo
install -m 640 -o root
-g root
/dev
/stdin
/etc
/sudoers.d
/passwd-init
<<-EOF
788 %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
789 case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
790 ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
792 sudo
install -m 640 -o root
-g root
/dev
/stdin
/etc
/sudoers.d
/etckeeper-unclean
<<-EOF
793 %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
795 sudo
install -m 640 -o root
-g root
/dev
/stdin
/etc
/sudoers.d
/env_keep
<<-EOF
796 Defaults env_keep = " \\
800 GIT_COMMITTER_NAME \\
801 GIT_COMMITTER_EMAIL \\
804 sudo
install -m 755 -o root
-g root
/dev
/stdin
/usr
/local
/bin
/passwd-init
<<-EOF
806 # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
807 sudo /bin/sh -e -f -u -c \
808 'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
810 sudo
install -m 644 -o root
-g root \
811 "$tool"/etc
/bash.bashrc \
813 sudo
install -m 644 -o root
-g root \
814 "$tool"/etc
/inputrc \
816 sudo
install -m 644 -o root
-g root \
817 "$tool"/etc
/screenrc \
819 local sh
; local -; set +f
820 for sh
in "$tool"/etc
/user.d
/*/configure.sh
821 do sh
=${sh#"$tool"/etc/user.d/}
822 local user
="${sh%/configure.sh}"
824 .
"$tool"/etc
/user.d
/"$sh" ||
return 1
828 rule_user_admin_add
() { # SYNTAX: $user
831 rule adduser
"$user" --disabled-password
832 eval local home\
; home
="~$user"
833 sudo adduser
"$user" sudo
834 sudo
install -m 640 -o root
-g root \
835 "$tool"/var
/pub
/ssh
/"$user".key \
836 "$home"/etc
/ssh
/authorized_keys
838 --homedir "$tool"/var
/pub
/openpgp
/ \
839 --no-default-keyring \
840 --secret-keyring /dev
/null \
842 sudo
-u "$user" gpg
--import -
843 rule user_admin_configure
845 rule_user_admin_configure
() {
846 rule initramfs_configure
847 rule user_root_configure
849 rule_user_root_configure
() {
850 sudo
install -d -m 750 -o root
-g root \
854 sudo
ln -fns etc
/gpg
/root
/.gnupg
855 sudo
ln -fns etc
/ssh /root
/.
ssh
857 while IFS
=: read -r group x x users
858 do while test -n "$users" && IFS
=, read -r user users
<<-EOF
861 do eval local home\
; home
="~$user"
862 sudo
cat "$home"/etc
/ssh
/authorized_keys
865 sudo
install -m 640 -o root
-g root
/dev
/stdin \
866 /root
/etc
/ssh
/authorized_keys
868 --homedir "$tool"/var
/pub
/openpgp
/ \
869 --no-default-keyring \
870 --secret-keyring /dev
/null \
874 rule__www_configure
() {
877 --disabled-password \
882 rule adduser log-www \
884 --disabled-password \
886 --home /home
/www
/log \
889 #sudo adduser www www-data
890 sudo adduser www log-www
891 #sudo adduser log log-www
892 usermod
--home /home
/www
/pub www-data
893 sudo
install -d -m 751 -o www
-g www \
895 sudo
install -d -m 750 -o www
-g www \
897 sudo
install -d -m 1771 -o www-data
-g www-data \
899 sudo
install -d -m 1771 -o log-www
-g log-www \
905 rule etckeeper_configure
906 rule locales_configure
908 rule network_configure
909 rule filesystem_configure
912 rule user_root_configure
914 rule sysctl_configure
916 rule gitolite_configure
917 rule shorewall_configure
921 rule_luks_key_change
() {
922 sudo cryptsetup luksChangeKey
/dev
/$vm_lvm_vg/${vm_lvm_lv}_root
930 assert
'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn