X-Git-Url: https://git.cyclocoop.org/?a=blobdiff_plain;f=vm_hosted;h=54e7257050fa5c1aa982e54a1afde1daac211576;hb=2e5bb0ff5df2b7a5d527a4f896b802df31d3c6bc;hp=ed42445f9fd41537e00370ca956452b3593a2609;hpb=8eb1ec9c265b8994222499cfcc0ca376d4efbdb3;p=lhc%2Fateliers.git

diff --git a/vm_hosted b/vm_hosted
index ed42445..54e7257 100755
--- a/vm_hosted
+++ b/vm_hosted
@@ -299,7 +299,7 @@ rule_boot_configure () {
  }
 rule_dovecot_configure () {
 	rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve
-	rule insserv_remove dovecot
+	rule insserv_remove  dovecot
 	local hint="run vm_remote dovecot_key_send before"
 	assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint
 	sudo install -m 400 -o root -g root \
@@ -324,8 +324,7 @@ rule_dovecot_configure () {
 		\$USER:\$(/usr/bin/doveadm pw -s SHA512-CRYPT):::::::
 		_EOF
 		EOF
-	rule runit_sv_configure dovecot
-	rule runit_sv_restart   dovecot
+	rule runit_configure dovecot
  }
 rule_etckeeper_configure () {
 	sudo install -m 644 -o root -g root /dev/stdin /etc/etckeeper/etckeeper.conf <<-EOF
@@ -418,8 +417,9 @@ rule_initramfs_configure () {
  }
 rule_insserv_remove () { # SYNTAX: $sv
 	local sv="$1"
-	sudo chmod u+x /etc/init.d/"$sv"
+	#sudo chmod u+x /etc/init.d/"$sv"
 	sudo insserv --force --remove "$sv"
+	sudo test ! -x /etc/init.d/"$sv" ||
 	sudo /etc/init.d/"$sv" stop
 	sudo chmod ugo-x /etc/init.d/"$sv"
  }
@@ -528,7 +528,6 @@ rule_gitolite_configure () {
 	 do test ! -d /home/git/etc/gitolite/"$d" ||
 		rmdir /home/git/etc/gitolite/"$d"
 	 done
-	rule tmpfs_configure
  }
 rule_locales_configure () {
 	sudo debconf-set-selections <<-EOF
@@ -568,7 +567,7 @@ rule_mail_configure () {
  }
 rule_mysql_configure () {
 	rule apt_get_install mysql-server-5.5
-	rule insserv_remove mysql
+	rule insserv_remove  mysql
 	rule adduser mysql \
 	 --disabled-login \
 	 --disabled-password \
@@ -607,9 +606,7 @@ rule_mysql_configure () {
 		 --datadir=/home/mysql/data \
 		 --no-defaults
 	 fi
-	rule tmpfs_configure
-	rule runit_sv_configure mysql
-	rule runit_sv_restart   mysql
+	rule runit_configure mysql
 	while ! sudo -u mysql mysql -u mysql </dev/null
 	do sleep 0.3; done
 	# NOTE:
@@ -625,7 +622,21 @@ rule_mysql_configure () {
 	#   DELETE FROM mysql.user WHERE user = 'root' AND host NOT IN ('localhost', '127.0.0.1', '::1');
 	sudo mysql -u root --batch --verbose <<-EOF
 		DELETE FROM mysql.user WHERE user = 'root' and plugin = '';
-		GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' IDENTIFIED WITH auth_socket;
+		DROP PROCEDURE IF EXISTS mysql.create_user_mysql;
+		DELIMITER //
+			CREATE PROCEDURE mysql.create_user_mysql ()
+				BEGIN
+					IF NOT (EXISTS (SELECT User
+						FROM mysql.user
+						WHERE User='mysql'
+						AND Host='localhost'
+						LIMIT 1))
+					 THEN GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' IDENTIFIED WITH auth_socket;
+					 END IF;
+				 END;
+		 //
+		CALL mysql.create_user_mysql();
+		DROP PROCEDURE mysql.create_user_mysql;
 		UPDATE mysql.user SET grant_priv='Y',super_priv='Y' WHERE user='mysql';
 		DELETE FROM mysql.db   WHERE user = '';
 		DELETE FROM mysql.user WHERE user = '';
@@ -741,9 +752,7 @@ rule_nginx_configure () {
 		test ! -r "$tool"/etc/nginx/site.d/"$site"/configure.sh ||
 		.         "$tool"/etc/nginx/site.d/"$site"/configure.sh
 	 done
-	rule tmpfs_configure
-	rule runit_sv_configure nginx
-	rule runit_sv_restart   nginx
+	rule runit_configure nginx
  }
 rule_nsd3_configure () { # NOTE: DNS autoritaire uniquement
 	local -; set +f
@@ -787,15 +796,13 @@ rule_nsd3_configure () { # NOTE: DNS autoritaire uniquement
 	sudo install -m 640 -o root -g nsd /dev/stdin \
 	 /etc/nsd3/nsd.conf
 	sudo nsdc rebuild
-	rule runit_sv_configure nsd3
-	rule runit_sv_restart   nsd3
+	rule runit_configure nsd3
  }
 rule_ntp_configure () {
 	# NOTE: http://my.opera.com/marcomarongiu/blog/2011/01/05/independent-wallclock-in-xen-4
-	rule apt_get_install    ntp
-	rule insserv_remove     ntp
-	rule runit_sv_configure ntp
-	rule runit_sv_restart   ntp
+	rule apt_get_install ntp
+	rule insserv_remove  ntp
+	rule runit_configure ntp
  }
 rule_openerp_configure () {
 	sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
@@ -909,9 +916,7 @@ rule_php5_fpm_configure () {
 		 "$tool"/etc/php5/fpm/php.ini \
 		        /etc/php5/fpm/php.ini
 	 done
-	rule tmpfs_configure
-	rule runit_sv_configure php5-fpm
-	rule runit_sv_restart   php5-fpm
+	rule runit_configure php5-fpm
  }
 rule_postfix_configure () {
 	local hint="run vm_remote postfix_key_send before"
@@ -1002,200 +1007,12 @@ rule_postfix_configure () {
 	 "$tool"/etc/postfix/$vm_domainname/virtual_alias \
 	        /etc/postfix/$vm_domainname/virtual_alias
 	sudo postmap hash:/etc/postfix/$vm_domainname/virtual_alias
-	rule runit_sv_configure postfix
-	rule runit_sv_restart   postfix
- }
-rule_postgresql_configure () {
- # DOC: http://wiki.postgresql.org/wiki/Shared_Database_Hosting
-	rule apt_get_install postgresql-9.1
-	rule insserv_remove postgresql
-	rule adduser postgres \
-	 --disabled-login \
-	 --disabled-password \
-	 --group \
-	 --home /home/postgresql \
-	 --shell /bin/false \
-	 --system
-	rule adduser postgres-data \
-	 --disabled-login \
-	 --disabled-password \
-	 --group \
-	 --home /home/postgresql/data \
-	 --no-create-home \
-	 --shell /bin/false \
-	 --system
-	sudo usermod --home /home/postgresql postgres
-	sudo adduser postgres postgres-data
-	sudo rm -rf \
-	 /etc/postgresql
-	sudo install -d -m 1751 -o postgres -g postgres-data \
-	 /home/postgresql \
-	 /home/postgresql/etc \
-	 /etc/postgresql \
-	 /etc/postgresql/9.1 \
-	 /etc/postgresql/9.1/main
-	sudo ln -fns \
-	                 /etc/postgresql \
-	 /home/postgresql/etc/postgresql
-	sudo install -d -m 2770 -o postgres -g log-postgres \
-	 /home/postgresql/log \
-	 /home/postgresql/log/9.1 \
-	 /home/postgresql/log/9.1/main
-	rule tmpfs_configure
-	if sudo test ! -d /home/postgresql/data
-	 then
-		sudo install -d -m 750 -o postgres -g postgres \
-		 /home/postgresql/data
-		sudo -u postgres pg_createcluster \
-		 --datadir=/home/postgresql/data \
-		 --logfile=/home/postgresql/log/9.1/main/cluster.log  \
-		 --socketdir=/run/postgresql \
-		 9.1 main
-	 fi
-	
-	sudo install -m 640 -o postgres -g postgres /dev/stdin \
-	 /etc/postgresql/9.1/main/pg_ctl.conf <<-EOF
-		pg_ctl_options = ''
-		EOF
-	sudo install -m 640 -o postgres -g postgres /dev/stdin \
-	 /etc/postgresql/9.1/main/pg_ident.conf <<-EOF
-		# MAPNAME       SYSTEM-USERNAME         PG-USERNAME
-		EOF
-	sudo install -m 640 -o postgres -g postgres /dev/stdin \
-	 /etc/postgresql/9.1/main/start.conf <<-EOF
-		EOF
-	sudo install -m 640 -o postgres -g postgres /dev/stdin \
-	 /etc/postgresql/9.1/main/pg_hba.conf <<-EOF
-		local all postgres peer
-		local all all      peer
-		EOF
-	sudo install -m 640 -o postgres -g postgres-data \
-	 "$tool"/etc/postgresql/9.1/main/postgresql.conf \
-	        /etc/postgresql/9.1/main/postgresql.conf
-	rule runit_sv_configure postgres
-	rule runit_sv_restart   postgres
-	while ! sudo -u postgres psql </dev/null
-	do sleep 1; done
-	# NOTE: supprime l'accès au schéma public depuis public,
-	#       de sorte à ce que les différents utilisateurices
-	#       ne voient pas leurs bases de données entre-elleux ;
-	sudo -u postgres psql template1 -a -f - <<-EOF
-		\set ON_ERROR_STOP on
-		REVOKE ALL ON DATABASE template1 FROM public;
-		REVOKE ALL ON SCHEMA   public    FROM public;
-		GRANT  ALL ON SCHEMA   public    TO   postgres;
-		EOF
-	# NOTE: ajoute le support de PL/PGSQL s'il ne l'est pas déjà.
-	sudo -u postgres psql template1 -a -f - <<-EOF
-		\set ON_ERROR_STOP on
-		CREATE OR REPLACE FUNCTION create_language_plpgsql()
-			RETURNS BOOLEAN AS \$\$
-				CREATE LANGUAGE plpgsql;
-				SELECT TRUE;
-			\$\$ LANGUAGE SQL;
-		SELECT CASE WHEN NOT (
-			SELECT  TRUE AS exists
-			FROM    pg_language
-			WHERE   lanname = 'plpgsql'
-			UNION
-			SELECT  FALSE AS exists
-			ORDER BY exists DESC
-			LIMIT 1
-		 )
-		THEN
-			create_language_plpgsql()
-		ELSE
-			FALSE
-		END AS plpgsql_created;
-		DROP FUNCTION create_language_plpgsql();
-		EOF
-	# NOTE: supprime l'accès à la liste des bases données
-	#       et utilisateurices depuis public.
-	sudo -u postgres psql template1 -a -f - <<-EOF
-		\set ON_ERROR_STOP on
-		REVOKE ALL ON pg_auth_members FROM public;
-		REVOKE ALL ON pg_authid       FROM public;
-		REVOKE ALL ON pg_database     FROM public;
-		REVOKE ALL ON pg_group        FROM public;
-		REVOKE ALL ON pg_roles        FROM public;
-		REVOKE ALL ON pg_settings     FROM public;
-		REVOKE ALL ON pg_tablespace   FROM public;
-		REVOKE ALL ON pg_user         FROM public;
-		EOF
- }
-rule_postgresql_db_add () { # SYNTAX: $db $owner
-	local db="$1"
-	local owner="${2:-$db}"
-	sudo -u postgres psql template1 -a -f - <<-EOF
-		\set ON_ERROR_STOP on
-		DO LANGUAGE plpgsql \$\$
-		BEGIN
-			IF NOT EXISTS (
-			 SELECT *
-			 FROM pg_catalog.pg_user
-			 WHERE usename = '$owner'
-			 LIMIT 1
-			) THEN
-				CREATE ROLE $owner
-				 LOGIN
-				 NOCREATEDB
-				 NOCREATEROLE
-				 NOINHERIT
-				 NOSUPERUSER;
-			END IF;
-		END;
-		\$\$;
-		EOF
-	case $(sudo -u postgres psql template1 -t -c \
-		"SELECT datname FROM pg_catalog.pg_database WHERE datname = '$db' LIMIT 1") in
-	 (" $db") true;;
-	 (*)
-		sudo -u postgres psql template1 -a -f - <<-EOF
-			\set ON_ERROR_STOP on
-			CREATE DATABASE $db WITH OWNER=$owner;
-			EOF
-		;;
-	 esac
-	sudo -u postgres psql template1 -a -f - <<-EOF
-		\set ON_ERROR_STOP on
-		REVOKE ALL ON DATABASE $db FROM public;
-		EOF
-	sudo -u postgres psql "$db" -a -f - <<-EOF
-		\set ON_ERROR_STOP on
-		GRANT ALL ON SCHEMA public TO $owner WITH GRANT OPTION;
-		EOF
- }
-rule_postgresql_db_user_add () { # SYNTAX: $db $user
-	local db="$1" user="$2"
-	sudo -u postgres psql "$db" -a -f - <<-EOF
-		\set ON_ERROR_STOP on
-		DO LANGUAGE plpgsql \$\$
-		BEGIN
-			IF NOT EXISTS (
-			 SELECT *
-			 FROM pg_catalog.pg_user
-			 WHERE usename = '$user'
-			 LIMIT 1
-			) THEN
-				CREATE ROLE $user
-				 LOGIN
-				 NOCREATEDB
-				 NOCREATEROLE
-				 NOINHERIT
-				 NOSUPERUSER;
-			END IF;
-		END;
-		\$\$;
-		GRANT USAGE ON SCHEMA public TO $user;
-		GRANT CONNECT,TEMPORARY ON DATABASE $db TO $user;
-		EOF
+	rule runit_configure postfix
  }
 rule_postgrey_configure () {
 	rule apt_get_install    postgrey
 	rule insserv_remove     postgrey
-	rule tmpfs_configure
-	rule runit_sv_configure postgrey
-	rule runit_sv_restart   postgrey
+	rule runit_configure postgrey
  }
 rule_procmail_configure () {
 	rule apt_get_install procmail
@@ -1208,39 +1025,31 @@ rule_procmail_configure () {
 	 "$tool"/etc/skel/etc/mail/delivery.procmailrc \
 	        /etc/skel/etc/mail/delivery.procmailrc
  }
-rule_runit_configure () { # SYNTAX: $service
+rule_runit_configure () { # SYNTAX: $sv
 	rule apt_get_install runit
 	local -; set +f
-	for sv in ${1-/etc/service/*}
-	 # NOTE: stoppe les services en retenant leur status de départ
-	 do sv=${sv##*/}
-		local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
-		local sv_status
-		IFS= read -r sv_status_$sv_hash <<-EOF
-			$(sudo sv status "$sv" || true)
-			EOF
-		sudo rm -f /etc/service/"$sv"
-	 done
+	sudo find /etc/sv -mindepth 1 -maxdepth 1 -type d -name "${1:-*}" -exec \
+		/bin/sh -efux -c 'case $(sv stop "$1") in
+		 (*": runsv not running") true;;
+		 (*": unable to open supervise/ok: file does not exist") true;;
+		 ("ok: down:"*) true;;
+		 (*) false;;
+		 esac' '' {} +
 	set -$- ${1-"$tool"/etc/sv/*}
 	while test -n "$*"
-	 # NOTE: configure et (re-)démarre les services
 	 do local first=yes
 		for sv in "$@"
 		do sv=${sv##*/}
 			case $first in
 			 (yes) shift $#; first=;;
 			 esac
-			local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
-			rule runit_sv_configure "$sv"
-			eval local sv_status=\"\${sv_status_$sv_hash-}\"
-			case $sv_status in
-			 ("") true;;
-			 (run:*|fail:*) rule runit_sv_restart "$sv";;
-			 esac
+			rule _runit_sv_configure "$sv"
+			rule runit_sv_restart    "$sv"
 		 done
 	 done
+	sudo find -L /etc/service -type l -delete
  }
-rule_runit_sv_configure () { # SYNTAX: $sv
+rule__runit_sv_configure () { # SYNTAX: $sv
 	local sv="$1"
 	sudo install -d -m 770 -o root -g root \
 	 /etc/sv/"$sv"
@@ -1267,7 +1076,6 @@ rule_runit_sv_configure () { # SYNTAX: $sv
  }
 rule_runit_sv_restart () { # SYNTAX: $sv
 	local sv="$1"
-	rule runit_sv_configure "$sv"
 	while true
 	 do case $(sudo sv restart "$sv") in
 		 ("fail: $sv: runsv not running") sleep 1;;
@@ -1339,8 +1147,7 @@ rule_ssh_configure () {
 	sudo install -m 644 -o root -g root \
 	 "$tool"/etc/ssh/ssh_config \
 	        /etc/ssh/ssh_config
-	rule runit_sv_configure sshd
-	rule runit_sv_restart   sshd
+	rule runit_configure sshd
  }
 rule_sysctl_configure () {
 	local -; set +f
@@ -1367,11 +1174,6 @@ rule_tmpfs_configure () {
 		TMP_SIZE=200m
 		TMPFS_SIZE=20%VM
 		EOF
-	sudo install -m 775 -o root -g root \
-	 "$tool"/etc/init.d/tmpfs \
-	        /etc/init.d/tmpfs
-	sudo update-rc.d tmpfs defaults
-	sudo service tmpfs restart
  }
 rule_time_configure () {
 	sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
@@ -1386,7 +1188,7 @@ rule_time_configure () {
  }
 rule_unbound_configure () {
 	sudo apt-get install unbound
-	rule insserv_remove unbound
+	rule insserv_remove  unbound
 	sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
 		search ${vm_host#*.}
 		nameserver 127.0.0.1
@@ -1400,8 +1202,7 @@ rule_unbound_configure () {
 	 <"$tool"/etc/unbound/unbound.conf |
 	sudo install -m 440 -o unbound -g unbound /dev/stdin \
 	 /etc/unbound/unbound.conf
-	rule runit_sv_configure unbound
-	rule runit_sv_restart   unbound
+	rule runit_configure unbound
  }
 rule_user_add () { # SYNTAX: $user
 	local user="$1"; shift