}
rule_apt_get_install () { # SYNTAX: $package
- sudo apt-get install "$@"
+ sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@"
+ }
+rule_dpkg_reconfigure () { # SYNTAX: $package
+ sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@"
}
rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
Pin: release a=$vm_lsb_name-backports
Pin-Priority: 200
EOF
- sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
- deb http://nightly.openerp.com/trunk/nightly/deb/ ./
- EOF
sudo apt-get update
rule apt_get_install apticron
sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF
EOF
}
rule_boot_configure () {
- warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
+ #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
+ sudo debconf-set-selections <<-EOF
+ grub-pc grub-pc/install_devices multiselect
+ EOF
rule apt_get_install grub-pc
sudo install -d -m 644 -o root -g root /boot/grub
rule apt_get_install linux-image-$vm_arch
EOF
sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
rule initramfs_configure
+ rule apt_get_install molly-guard
+ sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
+ ALWAYS_QUERY_HOSTNAME=true
+ # NOTE: une alternative est de dire à sudo de conserver les SSH_*
+ # néamoins demander tout le temps n'est pas trop contraignant
+ # et davantage sécurisant.
+ EOF
}
rule_dovecot_configure () {
rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve
LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0
proc /proc proc defaults 0 0
sysfs /sys sysfs defaults 0 0
- tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0
/dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
/dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
/dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0
${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
EOF
- sudo install -m 644 -o root -g root /dev/stdin /etc/sysctl.d/local-swap.conf <<-EOF
- vm.swappiness = 10 # NOTE: n'utilise le swap qu'en cas d'absolue nécessité
- vm.vfs_cache_pressure=50
+ sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
+ LOCK_SIZE=5242880 # NOTE: 5MiB
+ RAMLOCK=yes
+ RAMSHM=yes
+ RAMTMP=yes
+ RUN_SIZE=10%
+ SHM_SIZE=
+ TMP_MODE=1777,nr_inodes=1000k,noatime
+ TMP_OVERFLOW_LIMIT=1024
+ # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
+ # on the root filesystem (overriding RAMTMP).
+ TMP_SIZE=200m
+ TMPFS_SIZE=20%VM
EOF
+ sudo install -m 775 -o root -g root \
+ "$tool"/etc/init.d/tmpfs \
+ /etc/init.d/tmpfs
+ sudo update-rc.d tmpfs defaults
}
rule_initramfs_configure () {
sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
# NOTE: clefs générées par Debian
sudo update-initramfs -u
}
-rule_time_configure () {
- sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
- Europe/Paris
+rule_gitolite_configure () {
+ local user=git
+ sudo debconf-set-selections <<-EOF
+ gitolite gitolite/gituser string $user
+ gitolite gitolite/adminkey string
+ gitolite gitolite/gitdir string /home/$user
EOF
- sudo dpkg-reconfigure tzdata
- rule apt_get_install ntp
+ rule apt_get_install gitolite
+ getent passwd "$user" >/dev/null ||
+ sudo adduser \
+ --disabled-password \
+ --group \
+ --shell /bin/bash \
+ --system \
+ "$user"
+ sudo chfn --full-name "$user" "$user"
+ eval local home\; home="~$user"
+ sudo install -d -m 770 -o "$user" -g "$user" \
+ /etc/gitolite \
+ "$home"/etc \
+ "$home"/etc/ssh \
+ "$home"/pub \
+ "$home"/log \
+ "$home"/log/gitolite \
+ "$home"/log/gitolite/perf
+ sudo ln -fns /etc/gitolite "$home"/etc/gitolite
+ sudo ln -fns etc/gitolite/gitolite.rc "$home"/.gitolite.rc
+ sudo ln -fns etc/ssh "$home"/.ssh
+ sudo install -m 770 -o "$user" -g "$user" /dev/stdin \
+ "$home"/etc/gitolite/gitolite.rc <<-EOF
+ #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
+ #\$BIG_INFO_CAP = 20;
+ #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
+ # NOTE: Please use single quotes, not double quotes.
+ #\$GITWEB_URI_ESCAPE = 0;
+ \$GIT_PATH = "";
+ #\$GL_ADC_PATH = "";
+ \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
+ #\$GL_ALL_INCLUDES_SPECIAL = 0;
+ #\$GL_ALL_READ_ALL = 0;
+ \$GL_BIG_CONFIG = 0;
+ \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
+ \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
+ #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
+ \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*";
+ #\$GL_HOSTNAME = "git.$vm_domainname";
+ # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
+ #\$GL_HTTP_ANON_USER = "mob";
+ \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
+ \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
+ #\$GL_NICE_VALUE = 0;
+ \$GL_NO_CREATE_REPOS = 0;
+ \$GL_NO_DAEMON_NO_GITWEB = 0;
+ \$GL_NO_SETUP_AUTHKEYS = 0;
+ \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
+ \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
+ #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
+ #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
+ \$GL_SITE_INFO = "git.$vm_domainname";
+ #\$GL_SLAVE_MODE = 0;
+ \$GL_WILDREPOS = 0;
+ #\$GL_WILDREPOS_DEFPERMS = 'R @all';
+ \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
+ \$HTPASSWD_FILE = "";
+ \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list";
+ \$REPO_BASE = "pub";
+ \$REPO_UMASK = 0007;
+ \$RSYNC_BASE = "";
+ \$SVNSERVE = "";
+ #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
+ #\$WEB_INTERFACE = "gitweb";
+ 1;
+ EOF
+ sudo install -m 770 -o "$user" -g "$user" /dev/stdin \
+ "$home"/etc/gitweb/gitweb.conf <<-EOF
+ \$commit_oneline_message_width = 70;
+ \$default_projects_order = 'age';
+ \$default_text_plain_charset = 'UTF-8';
+ @diff_opts = ();
+ \$favicon = "img/git-favicon.png";
+ \$git_temp = "/run/shm/gitweb";
+ \$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc";
+ \$home_header = "/etc/gitweb/cgi/home-header.cgi.inc";
+ \$home_link = "/";
+ \$home_link_str = 'dépôts';
+ \$home_th_age = 'activité';
+ \$home_th_descr = 'description';
+ \$home_th_owner = 'contact';
+ \$home_th_project = 'dépôt';
+ \$javascript = "js/gitweb.js";
+ \$logo = "img/git-logo.png";
+ \$my_uri = "";
+ \$projectroot = "../git";
+ \$projects_list = "/etc/gitolite/projects.list";
+ \$projects_list_description_width = 42;
+ \$projects_list_owner_width = 15;
+ \$search_str = "Filtre :";
+ \$site_footer = "/home/fai/pub/www/git.autogeree.net/cgi/site-footer.bin";
+ \$site_header = undef;
+ \$site_name = "git.$vm_domainname";
+ \$space_to_nbsp = 0;
+ @stylesheets = ("css/gitweb.css");#
+ \$untabify_tabstop = 2;
+ EOF
+ sudo install -m 600 -o "$user" -g "$user" \
+ "$tool"/var/pub/ssh/"$user".key \
+ "$home"/etc/ssh/"$user".pub
+ sudo -u "$user" \
+ GL_RC="$home"/etc/gitolite/gitolite.rc \
+ GIT_AUTHOR_NAME="$user" \
+ gl-setup -q "$home"/etc/ssh/"$user".pub "$user"
+ local d
+ for d in doc logs src
+ do test ! -d "$home"/etc/gitolite/"$d" ||
+ rmdir "$home"/etc/gitolite/"$d"
+ done
+ rule apt_get_install gitweb highlight
+ #sudo sv restart spawn-fcgi.git.80.git.heureux-cyclage.org
+ #sudo sv restart git-daemon.git.9418
}
rule_locale_configure () {
- sudo install -m 644 -o root -g root /dev/stdin /etc/locale.gen <<-EOF
- fr_FR.UTF-8 UTF-8
+ sudo debconf-set-selections <<-EOF
+ locales locales/default_environment_locale select None
+ locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8
EOF
- sudo update-locale
+ rule dpkg_reconfigure locales
}
rule_login_configure () {
- grep -q '^hvc0$' /etc/securetty ||
- sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
- $(cat /etc/securetty)
- hvc0
- EOF
- grep -q '^xvc0$' /etc/securetty ||
- sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
- $(cat /etc/securetty)
- xvc0
- EOF
sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF
# /etc/inittab: init(8) configuration.
$(cat /etc/pam.d/common-session)
session optional pam_umask.so
EOF
+ grep -q '^hvc0$' /etc/securetty ||
+ sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+ $(cat /etc/securetty)
+ hvc0
+ EOF
+ grep -q '^xvc0$' /etc/securetty ||
+ sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+ $(cat /etc/securetty)
+ xvc0
+ EOF
}
rule_mail_configure () {
rule postfix_configure
rule procmail_configure
rule dovecot_configure
}
+rule_mysql_configure () {
+ rule apt_get_install mysql-server-5.5
+ sudo service mysql restart
+ }
rule_network_configure () {
sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
$vm
rule_postfix_configure () {
local hint="run vm_remote postfix_key_send before"
assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint
- warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix"
+ #warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix"
+ sudo debconf-set-selections <<-EOF
+ postfix postfix/main_mailer_type select No configuration
+ EOF
rule apt_get_install postfix
sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF
*.db
sudo postmap hash:/etc/postfix/$vm_domainname/virtual_alias
sudo service postfix restart
}
+rule_openerp_configure () {
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
+ deb http://nightly.openerp.com/trunk/nightly/deb/ ./
+ EOF
+ sudo apt-get update
+ rule apt_get_install openerp
+ }
rule_postgrey_configure () {
rule apt_get_install postgrey
sudo service postgrey restart
EOF
sudo service ssh restart
}
+rule_sysctl_configure () {
+ local -; set +f
+ for conf in "$tool"/etc/sysctl.d/*.conf
+ do conf=${conf#"$tool"/etc/sysctl.d/}
+ sudo install -m 660 -o root -g root \
+ "$tool"/etc/sysctl.d/"$conf" \
+ /etc/sysctl.d/"$conf"
+ done
+ sudo sysctl --system
+ }
+rule_time_configure () {
+ sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
+ Europe/Paris
+ EOF
+ sudo debconf-set-selections <<-EOF
+ tzdata tzdata/Areas select Europe
+ tzdata tzdata/Zones/Europe select Paris
+ EOF
+ rule dpkg_reconfigure tzdata
+ rule apt_get_install ntp
+ }
rule_user_add () { # SYNTAX: $user
rule user_configure
local user=$1
rule ssh_configure
rule user_root_configure
rule boot_configure
+ rule sysctl_configure
rule user_configure
rule mail_configure
#rule apache2_configure
rule nginx_configure
rule php5_fpm_configure
+ rule gitolite_configure
}
rule_luks_key_change () {