- sudo install -m 644 -o root -g root /dev/stdin /etc/network/interfaces <<-EOF
- auto lo
- iface lo inet loopback
-
- auto eth0=grenode
- iface grenode inet static
- address $vm_ipv4
- gateway $vm_ipv4 # NOTE: proxy_arp sur la passerelle permet d'utiliser la même adresse
- network $vm_ipv4
- broadcast $vm_ipv4
- netmask 255.255.255.255
- mtu 1300
- # NOTE: il y a besoin de ça en l'état actuel du réseau de Grenode
- # car la MTU des tunnels GRE/IPsec entre les routeurs de Grenode l'impose.
- #
- # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200)) soupirail.grenode.net
- # PING soupirail.grenode.net (91.216.110.1) 1272(1300) bytes of data.
- # 1280 bytes from soupirail.grenode.net (91.216.110.1): icmp_req=1 ttl=63 time=18.0 ms
- #
- # --- soupirail.grenode.net ping statistics ---
- # 1 packets transmitted, 1 received, 0% packet loss, time 0ms
- # rtt min/avg/max/mdev = 18.027/18.027/18.027/0.000 ms
- # root@ateliers:~# ping -M do -c 1 -s \$((1500-20-8-200+1)) soupirail.grenode.net
- # PING soupirail.grenode.net (91.216.110.1) 1273(1301) bytes of data.
- # From estran.grenode.net (91.216.110.6) icmp_seq=1 Frag needed and DF set (mtu = 1300)
- #
- # --- soupirail.grenode.net ping statistics ---
- # 0 packets transmitted, 0 received, +1 errors
- post-up ip address add $vm_ipv4/32 dev \$IFACE
- pre-down ip address delete $vm_ipv4/32 dev \$IFACE
+ sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
+ search ${vm_host#*.}
+ nameserver ${vm_host_nameserver}
+ EOF
+ m4 \
+ --define=VM_IPV4=$vm_ipv4 \
+ <"$tool"/etc/network/interfaces.m4 |
+ sudo install -m 640 -o root -g root /dev/stdin \
+ /etc/network/interfaces
+ }
+rule_nginx_configure () {
+ local -; set +f
+ rule php5_fpm_configure
+ rule apt_get_install nginx spawn-fcgi fcgiwrap
+ rule insserv_remove nginx
+ rule insserv_remove fcgiwrap
+ sudo rm -rf \
+ /etc/nginx/conf.d \
+ /etc/nginx/site.d
+ sudo install -d -m 770 -o www -g www \
+ /etc/nginx \
+ /etc/nginx/conf.d \
+ /etc/nginx/site.d \
+ /etc/nginx/x509.d
+ sudo ln -fns \
+ /etc/nginx \
+ /home/www/etc/nginx
+ sudo install -m 660 -o www -g www \
+ "$tool"/etc/nginx/nginx.conf \
+ /etc/nginx/nginx.conf
+ local conf
+ for conf in "$tool"/etc/nginx/conf.d/*.conf
+ do conf=${conf#"$tool"/etc/nginx/conf.d/}
+ sudo install -m 660 -o www -g www \
+ "$tool"/etc/nginx/conf.d/"$conf" \
+ /etc/nginx/conf.d/"$conf"
+ done
+ for conf in "$tool"/etc/nginx/site.d/*/site.conf
+ do conf=${conf#"$tool"/etc/nginx/site.d/}
+ local site="${conf%/site.conf}"
+ rule adduser www-"$site" \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/www/pub/"$site" \
+ --shell /bin/false \
+ --system
+ rule adduser log-www-"$site" \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/www/log/"$site"/nginx \
+ --shell /bin/false \
+ --system
+ sudo install -d -m 771 -o log-www -g log-www \
+ /home/www/log/"$site"
+ sudo install -d -m 770 -o www -g www \
+ /etc/nginx/site.d/"$site"
+ sudo install -d -m 770 -o www -g www \
+ /etc/nginx/x509.d/"$site"
+ test -L /home/www/pub/"$site" ||
+ sudo install -d -m 2770 -o www-"$site" -g www-"$site" \
+ /home/www/pub/"$site"
+ sudo adduser www-data www-"$site"
+ sudo adduser www-data log-www-"$site"
+ sudo install -m 660 -o www -g www \
+ "$tool"/etc/nginx/site.d/"$site"/local.conf \
+ /etc/nginx/site.d/"$site"/local.inc
+ sudo install -m 660 -o www -g www \
+ "$tool"/etc/nginx/site.d/"$site"/site.conf \
+ /etc/nginx/site.d/"$site"/site.inc
+ sudo install -m 660 -o www -g www /dev/stdin \
+ /etc/nginx/site.d/"$site"/server.conf <<-EOF
+ server {
+ access_log /home/www/log/$site/nginx/access.log main;
+ error_log /home/www/log/$site/nginx/error.log warn;
+ root /home/www/pub/$site;
+ include /etc/nginx/site.d/$site/local.inc;
+ include /etc/nginx/site.d/$site/site.inc;
+ }
+ EOF
+ test ! -r "$tool"/etc/nginx/site.d/"$site"/configure.sh ||
+ . "$tool"/etc/nginx/site.d/"$site"/configure.sh
+ done
+ rule runit_configure nginx
+ }
+rule_nsd3_configure () { # NOTE: DNS autoritaire uniquement
+ local -; set +f
+ rule apt_get_install nsd
+ rule insserv_remove nsd3
+ sudo rm -rf \
+ /etc/nsd3/zone.d
+ sudo install -d -m 750 -o root -g nsd \
+ /etc/nsd3/zone.d
+ {
+ cat <<-EOF
+ server:
+ ip-address: $vm_ipv4
+ ip4-only: yes
+ EOF
+ cat "$tool"/etc/nsd3/nsd.conf
+ local conf
+ for conf in "$tool"/etc/nsd3/zone.d/*.conf
+ do conf=${conf#"$tool"/etc/nsd3/zone.d/}
+ local domain=${conf%.conf}
+ if test -e "$tool"/etc/nsd3/zone.d/"$domain".zone.m4
+ then m4 \
+ --define=ZONE_DOMAIN=$domain \
+ --define=ZONE_SERIAL=$(cd "$tool" && git log -1 --format="%ct" -- etc/nsd3/zone.d/"$domain".zone.m4) \
+ --define=VM_IP4=$vm_ipv4 \
+ "$tool"/etc/nsd3/zone.d/"$domain".zone.m4
+ else cat "$tool"/etc/nsd3/zone.d/"$domain".zone
+ fi |
+ sudo install -m 440 -o root -g nsd /dev/stdin \
+ /etc/nsd3/zone.d/"$domain".zone
+ sudo install -m 440 -o root -g nsd \
+ "$tool"/etc/nsd3/zone.d/"$conf" \
+ /etc/nsd3/zone.d/"$conf"
+ cat <<-EOF
+ zone:
+ name: $domain
+ zonefile: /etc/nsd3/zone.d/$domain.zone
+ EOF
+ done
+ } |
+ sudo install -m 640 -o root -g nsd /dev/stdin \
+ /etc/nsd3/nsd.conf
+ sudo nsdc rebuild
+ rule runit_configure nsd3
+ }
+rule_ntp_configure () {
+ # NOTE: http://my.opera.com/marcomarongiu/blog/2011/01/05/independent-wallclock-in-xen-4
+ rule apt_get_install ntp
+ rule insserv_remove ntp
+ rule runit_configure ntp
+ }
+rule_openerp_configure () {
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
+ deb http://nightly.openerp.com/7.0/nightly/deb/ ./