2 set -e -f ${DRY_RUN:+-n} -u
9 DESCRIPTION: ce script regroupe des fonctions utilitaires
10 pour gérer la VM des ateliers _depuis_ son hôte ;
11 il sert à la fois d'outil et de documentation.
12 Voir \`$tool/ateliers_hosted' pour les utilitaires côté VM hébergée.
13 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
15 $(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$0")
17 TRACE # affiche les commandes avant leur exécution
18 $(sed -ne 's/^readonly \([^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
22 readonly vm_dev_disk
="/dev/xvda"
23 readonly vm_dev_disk_boot
="${vm_dev_disk}1"
24 readonly vm_dev_disk_swap
="${vm_dev_disk}5"
25 readonly vm_dev_disk_root
="${vm_dev_disk}6"
26 readonly vm_dev_disk_var
="${vm_dev_disk}7"
27 readonly vm_dev_disk_home
="${vm_dev_disk}8"
29 rule_xen_config_init
() {
30 sudo
tee /etc
/xen
/$vm_fqdn.cfg
<<-EOF
31 # -*- mode: python; -*-
37 vif = ['mac=$vm_mac,bridge=$vm_bridge']
38 disk = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
39 kernel = "/usr/lib/xen-4.0/boot/hvmloader"
41 device_model = 'qemu-dm'
44 # boot on floppy (a), hard disk (c) or CD-ROM (d)
50 #vnclisten = "0.0.0.0"
56 on_poweroff = 'destroy'
62 sudo xm create
$vm_fqdn.cfg
65 sudo xm shutdown
$vm_fqdn.cfg
68 rule_disk_mount
() { # DESCRIPTION: montage du disque de la VM depuis l'hôte
69 test -e $vm_dev_disk ||
70 sudo xm block-attach
0 phy
:/dev
/domU
/$vm_fqdn-disk $vm_dev_disk w
71 # NOTE: on pourrait utiliser kpartx à la place je pense ; détail.
73 rule_disk_umount
() { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
74 mountpoint
/mnt
/$vm_fqdn ||
75 sudo xm block-detach
0 $vm_dev_disk
77 rule_disk_part
() { # DESCRIPTION: partitionage du disque de la VM
78 # NOTE: on fait le choix de ne pas utiliser LVM sur la machine virtuelle car :
79 # - pour l'extension de mémoire:
80 # 1. on créera une nouvelle partition sur le LVM de l'hôte
81 # 2. on l'ajoutera comme un disque supplémentaire dans /etc/xen/$vm_fqdn.cfg
82 # 3. on le montera sur /home2 en pensant à changer DHOME=/home2 dans /etc/adduser.conf
83 # - pour la sauvegarde: LVM snapshoot est trop
84 # 1. sauvegarde au niveau applicatif (pgdump, mysqldump)
85 # 2. sauvegarde des configurations (etckeeper, git)
86 # 3. sauvegarde incrémentale et chiffrée des autres fichiers (duplicity)
87 sudo sfdisk
-d $vm_dev_disk <<-EOF
88 # partition table of $vm_dev_disk
91 ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
92 ${vm_dev_disk}2 : start= 498015, size=418927005, Id= 5
93 ${vm_dev_disk}3 : start= 0, size= 0, Id= 0
94 ${vm_dev_disk}4 : start= 0, size= 0, Id= 0
95 ${vm_dev_disk}5 : start= 498078, size= 1959867, Id=82
96 ${vm_dev_disk}6 : start= 2458008, size= 29302497, Id=83
97 ${vm_dev_disk}7 : start= 31760568, size= 9767457, Id=83
98 ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
102 rule_part_randomize
() { # SYNTAX: $part # NOTE: à anticiper
104 eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
106 rule_part_randomize_stat
() { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_clean
108 eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
110 rule__part_encrypted_format
() { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
111 # NOTE: la clef de chiffrement est dérivée de celle de /,
112 # / doit être déchiffrée pour que cela fonctionne.
114 eval "local dev=\$vm_dev_disk_$part"
115 test ! -e /dev
/mapper
/${vm}_root_deciphered ||
116 sudo
/lib
/cryptsetup
/scripts
/decrypt_derived
${vm}_root_deciphered |
117 sudo cryptsetup luksFormat
--hash=sha512
--key-size=512 \
118 --cipher=aes-xts-essiv
:sha256
--key-file=- --align-payload=8 $dev
120 rule__part_encrypted_mount
() { # SYNTAX: $part
122 eval "local dev=\$vm_dev_disk_$part"
123 test ! -e /dev
/mapper
/${vm}_root_deciphered ||
124 sudo
/lib
/cryptsetup
/scripts
/decrypt_derived
${vm}_root_deciphered |
125 sudo cryptsetup luksOpen
--key-file=- $dev ${vm}_
${part}_deciphered
127 rule__part_encrypted_umount
() { # SYNTAX: $part
129 eval "local dev=\$vm_dev_disk_$part"
130 test ! -e /dev
/mapper
/${vm}_
${part}_deciphered ||
131 sudo cryptsetup luksClose
${vm}_
${part}_deciphered
133 rule_part_root_format
() {
134 if ! mount |
grep -q "^$vm_dev_disk_root "
136 sudo cryptsetup luksFormat
--hash=sha512
--key-size=512 \
137 --cipher=aes-xts-essiv
:sha256
--key-file=- --align-payload=8 $vm_dev_disk_root
138 sudo cryptsetup luksOpen
--key-file=- $vm_dev_disk_root ${vm}_root_deciphered
139 sudo mkfs.ext4
-m 5 -T ext4
-L ${vm}_root
-E stripe_width
=32,resize
=15G \
140 /dev
/mapper
/${vm}_root_deciphered
141 ! mountpoint
/mnt
/$vm_fqdn
142 sudo mount
-v /dev
/mapper
/${vm}_root_deciphered
/mnt
/$vm_fqdn
143 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/boot
144 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/dev
145 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/home
146 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/proc
147 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/sys
148 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/var
149 sudo umount
-v /mnt
/$vm_fqdn
152 rule_part_root_mount
() {
153 test -e /dev
/mapper
/${vm}_root_deciphered ||
154 sudo cryptsetup luksOpen
$vm_dev_disk_root ${vm}_root_deciphered
155 ! mountpoint
/mnt
/$vm_fqdn ||
156 sudo mount
-v /dev
/mapper
/${vm}_root_deciphered
/mnt
/$vm_fqdn
158 rule_part_root_umount
() {
159 ! mountpoint
/mnt
/$vm_fqdn ||
160 sudo umount
-v /mnt
/$vm_fqdn
161 ! test -e /dev
/mapper
/${vm}_root_deciphered ||
162 sudo cryptsetup luksClose
${vm}_root_deciphered
164 rule_part_swap_format
() {
165 rule__part_encrypted_format swap
166 rule__part_encrypted_mount swap
167 sudo mkswap
-f -L ${vm}_swap
/dev
/mapper
/${vm}_swap_deciphered
168 rule__part_encrypted_umount swap
170 rule_part_boot_format
() {
171 mount |
grep -q "^$vm_dev_disk_boot " ||
172 sudo mkfs.ext2
-m 0 -T small
-L ${vm}_boot
$vm_dev_disk_boot
174 rule_part_boot_mount
() {
175 mountpoint
/mnt
/$vm_fqdn
176 test -d /mnt
/$vm_fqdn/boot
177 mountpoint
/mnt
/$vm_fqdn/boot ||
178 sudo mount
-v $vm_dev_disk_boot /mnt
/$vm_fqdn/boot
180 rule_part_boot_umount
() {
181 ! mountpoint
/mnt
/$vm_fqdn/boot ||
182 sudo umount
-v /mnt
/$vm_fqdn/boot
184 rule_part_var_format
() {
185 rule__part_encrypted_format var
186 rule__part_encrypted_mount var
187 sudo mkfs.ext4
-m 5 -T ext4
-L ${vm}_var
-E stripe_width
=32,resize
=5G \
188 /dev
/mapper
/${vm}_
${part}_deciphered
189 rule__part_encrypted_umount var
191 rule_part_var_mount
() {
192 rule__part_encrypted_mount var
193 mountpoint
/mnt
/$vm_fqdn/var ||
194 sudo mount
-v /dev
/mapper
/${vm}_var_deciphered
/mnt
/$vm_fqdn/var
196 rule_part_var_umount
() {
197 ! mountpoint
/mnt
/$vm_fqdn/var ||
198 sudo umount
-v /mnt
/$vm_fqdn/var
199 rule__part_encrypted_umount var
201 rule_part_home_format
() {
202 rule__part_encrypted_format home
203 rule__part_encrypted_mount home
204 sudo mkfs.ext4
-m 0 -T ext4
-L ${vm}_home
-E stripe_width
=32,resize
=200G \
205 /dev
/mapper
/${vm}_home_deciphered
206 rule__part_encrypted_umount home
208 rule_part_home_mount
() {
209 rule__part_encrypted_mount home
210 mountpoint
/mnt
/$vm_fqdn/home ||
211 sudo mount
-v /dev
/mapper
/${vm}_home_deciphered
/mnt
/$vm_fqdn/home
213 rule_part_home_umount
() {
214 ! mountpoint
/mnt
/$vm_fqdn/home ||
215 sudo umount
-v /mnt
/$vm_fqdn/home
216 rule__part_encrypted_umount home
219 rule_debian_install
() {
220 sudo DEBOOTSTRAP_DIR
=/usr
/share
/debootstrap
/ debootstrap \
221 --arch=$vm_arch --verbose --keyring=/usr
/share
/keyrings
/debian-archive-keyring.gpg \
223 --include=$
(printf '%s,' \
257 $vm_lsb_name /mnt
/$vm_fqdn/ \
258 http
://ftp.fr.debian.org
/debian
/
264 #rule_part_home_mount
265 mountpoint
/mnt
/$vm_fqdn/proc ||
266 mount
-t proc proc
/mnt
/$vm_fqdn/proc
267 mountpoint
/mnt
/$vm_fqdn/sys ||
268 mount
-t sysfs sys
/mnt
/$vm_fqdn/sys
269 mountpoint
/mnt
/$vm_fqdn/dev ||
270 mount
--bind /dev
/mnt
/$vm_fqdn/dev
271 sudo chroot
/mnt
/$vm_fqdn /bin
/bash || true
274 rule__chroot_clean
() {
275 umount
-v /mnt
/$vm_fqdn/dev
276 umount
-v /mnt
/$vm_fqdn/sys
277 umount
-v /mnt
/$vm_fqdn/proc
278 #rule_part_home_umount
280 rule_part_root_umount
281 rule_part_boot_umount