X-Git-Url: https://git.cyclocoop.org/?a=blobdiff_plain;f=vm_hosted;h=54e7257050fa5c1aa982e54a1afde1daac211576;hb=2e5bb0ff5df2b7a5d527a4f896b802df31d3c6bc;hp=fae784e9eb60335e894ae7f996ec0ce3f27307dd;hpb=a69c7802612266236658a37bda14547fada629c4;p=lhc%2Fateliers.git diff --git a/vm_hosted b/vm_hosted index fae784e..54e7257 100755 --- a/vm_hosted +++ b/vm_hosted @@ -7,6 +7,8 @@ while test -L "$tool" tool=${tool%/*} . "$tool"/lib/rule.sh . "$tool"/etc/vm.sh +export TRACE=1 +cd / rule_help () { # SYNTAX: [--hidden] local hidden; [ ${1:+set} ] || hidden=set @@ -33,8 +35,16 @@ rule_git_configure () { git config --replace branch.master.merge refs/remotes/master local tool tool=$(cd "$tool"; cd -) - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/ - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm + install -m 770 /dev/stdin .git/hooks/post-update <<-EOF + #!/bin/sh -efux + case \$1 in + (refs/remotes/master) + cd .. + git --git-dir=\$PWD/.git checkout -f -B master remotes/master + git --git-dir=\$PWD/.git clean -f -d -x + ;; + esac + EOF ) } rule_git_reset () { @@ -45,8 +55,13 @@ rule_git_reset () { ) } +rule_adduser () { + local user="$1"; shift + getent passwd "$user" >/dev/null || + sudo adduser "$@" "$user" + } rule_apt_get_install () { # SYNTAX: $package - sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@" + sudo DEBIAN_FRONTEND=noninteractive apt-get install --yes "$@" } rule_dpkg_reconfigure () { # SYNTAX: $package sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@" @@ -58,7 +73,7 @@ rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? . /etc/profile } -rule_apache2_configure () { +rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour local -; set +f rule apt_get_install \ apache2-mpm-itk \ @@ -74,7 +89,12 @@ rule_apache2_configure () { # cependant l'usage de suexec impose des forks il semble.. # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ; # donc pour l'instant : apache2-mpm-itk - rule www_configure + sudo rm -rf \ + /etc/apache2/site.d + sudo install -d -m 770 -o www -g www \ + /etc/apache2 \ + /etc/apache2/site.d \ + /etc/apache2/x509.d cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF | ServerName "$vm_fqdn" EOF @@ -106,80 +126,57 @@ rule_apache2_configure () { /home/www/etc/apache2 for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf do conf=${conf#"$tool"/etc/apache2/site.d/} - local port site - IFS=. read -r port site <<-EOF - ${conf%\/VirtualHost\.conf} - EOF - assert 'test "${site:+set}"' - assert 'test "${port:+set}"' - local site_user="$user.$port.$site" - local site_dir="$user.$port.$site" - case $port in - (443) + local site=${conf%/VirtualHost.conf} + case $site in + (*-tls) local hint="run vm_remote apache2_key_send before" - assert "sudo test -f /etc/apache2/site.d/\"$site_dir\"/x509/key.pem" hint - sudo install -d -m 770 -o "$user" -g "$user" \ + assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint + sudo install -d -m 770 -o www-"$site" -g www-"$site" \ /etc/apache2 \ - /etc/apache2/site.d/"$site_dir" \ - /etc/apache2/site.d/"$site_dir"/x509 \ - /etc/apache2/site.d/"$site_dir"/x509/ca \ - /etc/apache2/site.d/"$site_dir"/x509/empty \ - /etc/apache2/site.d/"$site_dir"/x509/rvk \ - /etc/apache2/site.d/"$site_dir"/x509/usr + /etc/apache2/site.d/"$site" \ + /etc/apache2/x509.d/"$site" \ + /etc/apache2/x509.d/"$site"/ca \ + /etc/apache2/x509.d/"$site"/empty \ + /etc/apache2/x509.d/"$site"/rvk \ + /etc/apache2/x509.d/"$site"/usr sudo install -m 664 -o www -g www \ "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \ - /etc/apache2/site.d/"$site_dir"/x509/crt.self-signed.pem - #sudo install -m 664 -o "$user" -g "$user" \ + /etc/apache2/x509.d/"$site"/crt.self-signed.pem + #sudo install -m 664 -o www-"$site" -g www-"$site" \ # "$tool"/var/pub/x509/"$site"/rvk.pem \ - # /etc/apache2/site.d/"$site_dir"/x509/rvk.pem + # /etc/apache2/x509.d/"$site"/rvk.pem sudo install -m 664 -o www -g www \ "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \ - /etc/apache2/site.d/"$site_dir"/x509/ca/crt.pem + /etc/apache2/x509.d/"$site"/ca/crt.pem sudo install -m 664 -o www -g www \ "$tool"/var/pub/x509/"$site"/crt.pem \ - /etc/apache2/site.d/"$site_dir"/x509/crt.pem + /etc/apache2/x509.d/"$site"/crt.pem ;; esac - case $port in - (80) - cat <<-EOF - - AssignUserID $site_user $site_user - CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/access/%Y-%m-%d.log 86400 60" Combined - #CustomLog "/dev/null" Combined - DocumentRoot /home/www/pub/$site_dir - ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/error/%Y-%m-%d.log 86400 60" - #ErrorLog "/dev/null" - ServerName $site - LogLevel Warn - $(cat "$tool"/etc/apache2/site.d/"$site_dir"/VirtualHost.conf) - - EOF - ;; - (443) + case $site in + (*-tls) cat <<-EOF - AssignUserID $site_user $site_user + AssignUserID www-$site www-$site BrowserMatch "MSIE [2-6]" ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown - CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/access/%Y-%m-%d.log 86400 60" Combined + CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined #CustomLog "/dev/null" Combined - DocumentRoot /home/www/pub/$site_dir - ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site_dir/apache2/error/%Y-%m-%d.log 86400 60" + DocumentRoot /home/www/pub/$site + ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60" #ErrorLog "/dev/null" LogLevel Warn - ServerName $site - SSLCACertificateFile /etc/apache2/site.d/$site_dir/x509/crt.self-signed.pem - SSLCACertificatePath /etc/apache2/site.d/$site_dir/x509/usr/ - #SSLCARevocationFile /etc/apache2/site.d/$site_dir/x509/rvk.pem - SSLCADNRequestFile /etc/apache2/site.d/$site_dir/x509/crt.self-signed.pem - SSLCADNRequestPath /etc/apache2/site.d/$site_dir/x509/empty/ + SSLCACertificateFile /etc/apache2/x509.d/$site/crt.self-signed.pem + SSLCACertificatePath /etc/apache2/x509.d/$site/usr/ + #SSLCARevocationFile /etc/apache2/x509.d/$site/rvk.pem + SSLCADNRequestFile /etc/apache2/x509.d/$site/crt.self-signed.pem + SSLCADNRequestPath /etc/apache2/x509.d/$site/empty/ # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés - SSLCARevocationPath /etc/apache2/site.d/$site_dir/x509/rvk/ - SSLCertificateChainFile /etc/apache2/site.d/$site_dir/x509/ca/crt.pem - SSLCertificateFile /etc/apache2/site.d/$site_dir/x509/crt.pem - SSLCertificateKeyFile /etc/apache2/site.d/$site_dir/x509/key.pem + SSLCARevocationPath /etc/apache2/x509.d/$site/rvk/ + SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem + SSLCertificateFile /etc/apache2/x509.d/$site/crt.pem + SSLCertificateKeyFile /etc/apache2/x509.d/$site/key.pem SSLCipherSuite AES+RSA+SHA256 SSLEngine On SSLInsecureRenegotiation Off @@ -191,81 +188,83 @@ rule_apache2_configure () { SSLUserName SSL_CLIENT_S_DN_CN SSLVerifyClient None SSLVerifyDepth 1 - $(cat "$tool"/etc/apache2/site.d/"$site_dir"/VirtualHost.conf) + $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf) EOF ;; + (*) + cat <<-EOF + + AssignUserID www-$site www-$site + CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined + #CustomLog "/dev/null" Combined + DocumentRoot /home/www/pub/$site + ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60" + #ErrorLog "/dev/null" + LogLevel Warn + $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf) + + EOF + ;; esac | sudo install -m 660 -o root -g root /dev/stdin \ - /etc/apache2/site.d/"$site_dir"/VirtualHost.conf + /etc/apache2/site.d/"$site"/VirtualHost.conf sudo ln -fns \ - ../site.d/"$site_dir"/VirtualHost.conf \ - /etc/apache2/sites-available/"$site_dir" - sudo install -d -m 770 -o "$user" -g "$user" \ - /home/www/log/"$site_dir" \ - /home/www/log/"$site_dir"/apache2 + ../site.d/"$site"/VirtualHost.conf \ + /etc/apache2/sites-available/"$site" + sudo install -d -m 770 -o www-"$site" -g www-"$site" \ + /home/www/log/"$site" \ + /home/www/log/"$site"/apache2 sudo ln -fns \ - /etc/apache2/site.d/"$site_dir" \ - /home/www/etc/apache2/"$site_dir" - test -e /home/www/pub/"$site_dir" || - sudo install -d -m 770 -o "$user" -g "$user" \ - /home/www/pub/"$site_dir" - getent passwd "$site_user" >/dev/null || - sudo adduser \ + /etc/apache2/site.d/"$site" \ + /home/www/etc/apache2/"$site" + test -e /home/www/pub/"$site" || + sudo install -d -m 2770 -o www-"$site" -g www-"$site" \ + /home/www/pub/"$site" + rule adduser www-"$site" --disabled-password \ --group \ --no-create-home \ - --home /home/www/pub/"$site_dir" \ + --home /home/www/pub/"$site" \ --shell /bin/false \ - --system \ - "$site_user" - sudo setfacl -m u:"$site_user":--x \ - /home/www/ \ - /home/www/pub/ \ - /home/www/pub/"$site_dir"/ - sudo setfacl -m d:u:"$site_user":rwx \ - "$home"/pub/www/"$site_dir"/ - test ! -r "$tool"/etc/apache2/site.d/"$site_dir"/configure.sh || - . "$tool"/etc/apache2/site.d/"$site_dir"/configure.sh - test -e /etc/apache2/sites-enabled/"$site_dir" || - sudo a2ensite "$site_dir" + --system + #sudo setfacl -m u:"www-$site":--x \ + # /home/www/ \ + # /home/www/pub/ \ + # /home/www/pub/"$site"/ + #sudo setfacl -m d:u:"www-$site":rwx \ + # "$home"/pub/www/"$site"/ + test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh || + . "$tool"/etc/apache2/site.d/"$site"/configure.sh + test -e /etc/apache2/sites-enabled/"$site" || + sudo a2ensite "$site" done sudo service apache2 restart } rule_apt_configure () { sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF - deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free + deb http://ftp.rezopole.net/debian $vm_lsb_name main EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF - #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF + deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main EOF sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF Package: * Pin: release a=$vm_lsb_name - Pin-Priority: 170 + Pin-Priority: 200 Package: * Pin: release a=$vm_lsb_name-backports - Pin-Priority: 200 + Pin-Priority: 170 EOF sudo apt-get update rule apt_get_install apticron - sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF - EMAIL="admin@$vm_domainname" - # DIFF_ONLY="1" - # LISTCHANGES_PROFILE="apticron" - # ALL_FQDNS="1" - # SYSTEM="foobar.example.com" - # IPADDRESSNUM="1" - # IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1" - # NOTIFY_HOLDS="0" - # NOTIFY_NEW="0" - # NOTIFY_NO_UPDATES="0" - # CUSTOM_SUBJECT="" - # CUSTOM_NO_UPDATES_SUBJECT="" - # CUSTOM_FROM="root@$vm_fqdn" - EOF + m4 \ + --define=VM_DOMAINNAME=$vm_domainname \ + <"$tool"/etc/apticron/apticron.conf.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/apticron/apticron.conf } rule_boot_configure () { #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" @@ -300,73 +299,23 @@ rule_boot_configure () { } rule_dovecot_configure () { rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve + rule insserv_remove dovecot local hint="run vm_remote dovecot_key_send before" assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint sudo install -m 400 -o root -g root \ - "$tool"/var/pub/x509/$vm_domainname/imap/crt+crl.self-signed.pem \ - /etc/dovecot/$vm_domainname/imap/x509/crt+crl.self-signed.pem + "$tool"/var/pub/x509/imap."$vm_domainname"/crt+crl.self-signed.pem \ + /etc/dovecot/"$vm_domainname"/imap/x509/crt+crl.self-signed.pem sudo install -d -m 770 -o root -g root \ /etc/skel/etc/mail \ /etc/skel/etc/sieve sudo install -d -m 1777 -o root -g root \ /var/lib/dovecot-control \ /var/lib/dovecot-index - sudo install -m 664 -o root -g root /dev/stdin /etc/dovecot/local.conf <<-EOF - auth_ssl_username_from_cert = yes - listen = * - log_timestamp = "%Y-%m-%d %H:%M:%S " - mail_debug = yes - mail_location = maildir:~/var/mail:INDEX=/var/lib/dovecot-index/%u:CONTROL=/var/lib/dovecot-control/%u - # NOTE: INDEX et CONTROL sont sur une partition sans quota comme le demande la doc - # VOIR: http://wiki2.dovecot.org/Quota/FS - mail_plugins = \$mail_plugins quota - mail_privileged_group = mail - passdb { - args = /home/%u/etc/dovecot/passwd - driver = passwd-file - } - plugin { - quota = fs:user - recipient_delimiter = + - sieve = ~/etc/mail/filter.sieve - sieve_dir = ~/etc/mail/sieve - sieve_global_dir = /var/lib/dovecot/sieve/global/ - sieve_max_script_size = 1M - sieve_quota_max_scripts = 0 - sieve_quota_max_storage = 10M - sieve_user_log = ~/var/log/mail/sieve.log - } - protocol imap { - mail_plugins = \$mail_plugins imap_quota - } - protocol lda { - auth_socket_path = /var/run/dovecot/auth-master - hostname = $vm_domainname - info_log_path = - log_path = - mail_plugins = \$mail_plugins sieve - postmaster_address = contact+dovecot+lda@$vm_domainname - syslog_facility = mail - } - protocols = imap sieve - service auth { - user = root - unix_listener /var/spool/postfix/private/auth { - mode = 0660 - user = postfix - group = postfix - } - } - ssl_ca = - LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0 - proc /proc proc defaults 0 0 - sysfs /sys sysfs defaults 0 0 - /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0 - # NOTE: barrier=1 réduit drastiquement les performances d'écriture, mais garantit la cohérence du système de fichiers. - /dev/mapper/${vm_lvm_lv}_swap_deciphered swap swap sw 0 0 - EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/crypttab <<-EOF - # - ${vm_lvm_lv}_root_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_root none luks,lvm=$vm_lvm_vg - ${vm_lvm_lv}_var_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_var ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - ${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - ${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - EOF + m4 \ + --define=VM_LVM_LV=$vm_lvm_lv \ + --define=VM_LVM_VG=$vm_lvm_vg \ + <"$tool"/etc/fstab.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/fstab + m4 \ + --define=VM_LVM_LV=$vm_lvm_lv \ + --define=VM_LVM_VG=$vm_lvm_vg \ + <"$tool"/etc/crypttab.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/crypttab rule tmpfs_configure } rule_initramfs_configure () { @@ -462,10 +403,11 @@ rule_initramfs_configure () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | - sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/initramfs-tools/root/.ssh/authorized_keys sudo rm -f \ /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \ /etc/initramfs-tools/root/.ssh/id_rsa.pub \ @@ -473,36 +415,64 @@ rule_initramfs_configure () { # NOTE: clefs générées par Debian sudo update-initramfs -u } +rule_insserv_remove () { # SYNTAX: $sv + local sv="$1" + #sudo chmod u+x /etc/init.d/"$sv" + sudo insserv --force --remove "$sv" + sudo test ! -x /etc/init.d/"$sv" || + sudo /etc/init.d/"$sv" stop + sudo chmod ugo-x /etc/init.d/"$sv" + } rule_gitolite_configure () { - local user=git sudo debconf-set-selections <<-EOF - gitolite gitolite/gituser string $user + gitolite gitolite/gituser string git gitolite gitolite/adminkey string - gitolite gitolite/gitdir string /home/$user + gitolite gitolite/gitdir string /home/git EOF rule apt_get_install gitolite - getent passwd "$user" >/dev/null || - sudo adduser \ + rule adduser git \ --disabled-password \ --group \ + --home /home/git \ --shell /bin/bash \ - --system \ - "$user" - sudo chfn --full-name "$user" "$user" - eval local home\; home="~$user" - sudo install -d -m 770 -o "$user" -g "$user" \ + --system + sudo chfn --full-name git git + rule adduser log-git \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/git/log \ + --shell /bin/false \ + --system + rule adduser git-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/git/pub \ + --shell /bin/false \ + --system + sudo adduser git git-data + sudo install -d -m 750 -o git -g git \ /etc/gitolite \ - "$home"/etc \ - "$home"/etc/ssh \ - "$home"/pub \ - "$home"/log \ - "$home"/log/gitolite \ - "$home"/log/gitolite/perf - sudo ln -fns /etc/gitolite "$home"/etc/gitolite - sudo ln -fns etc/gitolite/gitolite.rc "$home"/.gitolite.rc - sudo ln -fns etc/ssh "$home"/.ssh - sudo install -m 770 -o "$user" -g "$user" /dev/stdin \ - "$home"/etc/gitolite/gitolite.rc <<-EOF + /home/git/etc \ + /home/git/etc/ssh + sudo install -d -m 751 -o git -g git \ + /home/git + sudo install -d -m 2770 -o git-data -g git-data \ + /home/git/pub + sudo install -d -m 1771 -o git -g git \ + /home/git/log + sudo install -d -m 2770 -o git -g log-git \ + /home/git/log/gitolite \ + /home/git/log/gitolite/perf + sudo install -d -m 3771 -o git -g git \ + /home/git/hooks + sudo ln -fns /etc/gitolite /home/git/etc/gitolite + sudo ln -fns /etc/gitweb /home/git/etc/gitweb + sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc + sudo ln -fns etc/ssh /home/git/.ssh + sudo install -m 770 -o git -g git /dev/stdin \ + /home/git/etc/gitolite/gitolite.rc <<-EOF #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary"; #\$BIG_INFO_CAP = 20; #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3'; @@ -517,7 +487,7 @@ rule_gitolite_configure () { \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf"; \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm"; #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups" - \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*"; + \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*"; #\$GL_HOSTNAME = "git.$vm_domainname"; # NOTE: read doc/mirroring.mkd COMPLETELY before setting this. #\$GL_HTTP_ANON_USER = "mob"; @@ -537,61 +507,27 @@ rule_gitolite_configure () { #\$GL_WILDREPOS_DEFPERMS = 'R @all'; \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS"; \$HTPASSWD_FILE = ""; - \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list"; + \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list"; \$REPO_BASE = "pub"; \$REPO_UMASK = 0007; \$RSYNC_BASE = ""; \$SVNSERVE = ""; #\$UPDATE_CHAINS_TO = "hooks/update.secondary"; - #\$WEB_INTERFACE = "gitweb"; + \$WEB_INTERFACE = "gitweb"; 1; EOF - sudo install -m 770 -o "$user" -g "$user" /dev/stdin \ - "$home"/etc/gitweb/gitweb.conf <<-EOF - \$commit_oneline_message_width = 70; - \$default_projects_order = 'age'; - \$default_text_plain_charset = 'UTF-8'; - @diff_opts = (); - \$favicon = "img/git-favicon.png"; - \$git_temp = "/run/shm/gitweb"; - \$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc"; - \$home_header = "/etc/gitweb/cgi/home-header.cgi.inc"; - \$home_link = "/"; - \$home_link_str = 'dépôts'; - \$home_th_age = 'activité'; - \$home_th_descr = 'description'; - \$home_th_owner = 'contact'; - \$home_th_project = 'dépôt'; - \$javascript = "js/gitweb.js"; - \$logo = "img/git-logo.png"; - \$my_uri = ""; - \$projectroot = "../git"; - \$projects_list = "/etc/gitolite/projects.list"; - \$projects_list_description_width = 42; - \$projects_list_owner_width = 15; - \$search_str = "Filtre :"; - \$site_footer = "/home/fai/pub/www/git.autogeree.net/cgi/site-footer.bin"; - \$site_header = undef; - \$site_name = "git.$vm_domainname"; - \$space_to_nbsp = 0; - @stylesheets = ("css/gitweb.css");# - \$untabify_tabstop = 2; - EOF - sudo install -m 600 -o "$user" -g "$user" \ - "$tool"/var/pub/ssh/"$user".key \ - "$home"/etc/ssh/"$user".pub - sudo -u "$user" \ - GL_RC="$home"/etc/gitolite/gitolite.rc \ - GIT_AUTHOR_NAME="$user" \ - gl-setup -q "$home"/etc/ssh/"$user".pub "$user" + sudo install -m 600 -o git -g git \ + "$tool"/var/pub/ssh/git.key \ + /home/git/etc/ssh/git.pub + sudo -u git \ + GL_RC=/home/git/etc/gitolite/gitolite.rc \ + GIT_AUTHOR_NAME=git \ + gl-setup -q /home/git/etc/ssh/git.pub git local d for d in doc logs src - do test ! -d "$home"/etc/gitolite/"$d" || - rmdir "$home"/etc/gitolite/"$d" + do test ! -d /home/git/etc/gitolite/"$d" || + rmdir /home/git/etc/gitolite/"$d" done - rule apt_get_install gitweb highlight - #sudo sv restart spawn-fcgi.git.80.git.heureux-cyclage.org - #sudo sv restart git-daemon.git.9418 } rule_locales_configure () { sudo debconf-set-selections <<-EOF @@ -601,90 +537,12 @@ rule_locales_configure () { rule dpkg_reconfigure locales } rule_login_configure () { - sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF - # /etc/inittab: init(8) configuration. - - # The default runlevel. - id:2:initdefault: - - # Boot-time system configuration/initialization script. - # This is run first except when booting in emergency (-b) mode. - si::sysinit:/etc/init.d/rcS - - # What to do in single-user mode. - ~~:S:wait:/sbin/sulogin - - # /etc/init.d executes the S and K scripts upon change - # of runlevel. - # - # Runlevel 0 is halt. - # Runlevel 1 is single-user. - # Runlevels 2-5 are multi-user. - # Runlevel 6 is reboot. - - l0:0:wait:/etc/init.d/rc 0 - l1:1:wait:/etc/init.d/rc 1 - l2:2:wait:/etc/init.d/rc 2 - l3:3:wait:/etc/init.d/rc 3 - l4:4:wait:/etc/init.d/rc 4 - l5:5:wait:/etc/init.d/rc 5 - l6:6:wait:/etc/init.d/rc 6 - # Normally not reached, but fallthrough in case of emergency. - z6:6:respawn:/sbin/sulogin - - # What to do when CTRL-ALT-DEL is pressed. - ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now - - # What to do when the power fails/returns. - pf::powerwait:/etc/init.d/powerfail start - pn::powerfailnow:/etc/init.d/powerfail now - po::powerokwait:/etc/init.d/powerfail stop - - # Xen hypervisor console - hvc:2345:respawn:/sbin/getty 38400 hvc0 - #xvc:2345:respawn:/sbin/getty 38400 xvc0 - - #-- runit begin - SV:123456:respawn:/usr/sbin/runsvdir-start - #-- runit end - EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/login.defs <<-EOF - MAIL_DIR /var/mail - FAILLOG_ENAB yes - LOG_UNKFAIL_ENAB no - LOG_OK_LOGINS no - SYSLOG_SU_ENAB yes - SYSLOG_SG_ENAB yes - FTMP_FILE /var/log/btmp - SU_NAME su - HUSHLOGIN_FILE .hushlogin - ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - ENV_PATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - # NOTE: met les sbin/ dans ENV_PATH ; - # - ça n'apporte aucune protection de ne pas les mettre ; - # - ça frustre de ne pas les trouver. - TTYGROUP tty - TTYPERM 0600 - ERASECHAR 0177 - KILLCHAR 025 - UMASK 007 - # NOTE: rwxrwx--- ; - # - donne une même confiance au groupe propriétaire qu'au propriétaire ; - # - facilite l'utilisation des ACL, qui sont dépendantes des droits du groupe propriétaire. - PASS_MAX_DAYS 99999 - PASS_MIN_DAYS 0 - PASS_WARN_AGE 7 - UID_MIN 1000 - UID_MAX 60000 - GID_MIN 1000 - GID_MAX 60000 - LOGIN_RETRIES 3 - LOGIN_TIMEOUT 60 - CHFN_RESTRICT rwh - DEFAULT_HOME yes - USERGROUPS_ENAB yes - ENCRYPT_METHOD SHA512 - EOF + sudo install -m 644 -o root -g root \ + "$tool"/etc/inittab \ + /etc/inittab + sudo install -m 644 -o root -g root \ + "$tool"/etc/login.defs \ + /etc/login.defs grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session || sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF $(cat /etc/pam.d/common-session) @@ -709,7 +567,97 @@ rule_mail_configure () { } rule_mysql_configure () { rule apt_get_install mysql-server-5.5 - sudo service mysql restart + rule insserv_remove mysql + rule adduser mysql \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql \ + --shell /bin/false \ + --system + rule adduser mysql-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql/data \ + --no-create-home \ + --shell /bin/false \ + --system + sudo usermod --home /home/mysql mysql + sudo adduser mysql mysql-data + sudo install -d -m 751 -o mysql -g mysql \ + /home/mysql + sudo rm -rf /etc/mysql + sudo install -d -m 750 -o mysql -g mysql \ + /etc/mysql \ + /etc/mysql/conf.d \ + /home/mysql/etc + sudo ln -fns \ + /etc/mysql \ + /home/mysql/etc/mysql + sudo install -m 644 -o mysql -g mysql \ + "$tool"/etc/mysql/my.cnf \ + /etc/mysql/my.cnf + if sudo test ! -d /home/mysql/data + then + sudo install -d -m 750 -o mysql -g mysql-data \ + /home/mysql/data + sudo -u mysql mysql_install_db \ + --datadir=/home/mysql/data \ + --no-defaults + fi + rule runit_configure mysql + while ! sudo -u mysql mysql -u mysql /dev/null || - sudo adduser \ - --disabled-login \ - --disabled-password \ - --group \ - --home /home/www \ - --shell /bin/false \ - --system \ - www - sudo adduser \ - --disabled-login \ - --disabled-password \ - --group \ - --home ~www/log \ - --shell /bin/false \ - --system \ - log.www - #sudo adduser www www-data - sudo adduser www log.www - #sudo adduser log log.www - usermod --home /home/www/pub www-data - sudo install -d -m 751 -o www -g www \ - /home/www - sudo install -d -m 750 -o www -g www \ - /home/www/etc - sudo install -d -m 1771 -o www-data -g www-data \ - /home/www/pub \ - sudo install -d -m 1771 -o log.www -g log.www \ - /home/www/log + m4 \ + --define=VM_IPV4=$vm_ipv4 \ + <"$tool"/etc/network/interfaces.m4 | + sudo install -m 640 -o root -g root /dev/stdin \ + /etc/network/interfaces } rule_nginx_configure () { local -; set +f - rule apt_get_install nginx - rule www_configure + rule php5_fpm_configure + rule apt_get_install nginx spawn-fcgi fcgiwrap + rule insserv_remove nginx + rule insserv_remove fcgiwrap sudo rm -rf \ /etc/nginx/conf.d \ /etc/nginx/site.d sudo install -d -m 770 -o www -g www \ /etc/nginx \ /etc/nginx/conf.d \ - /etc/nginx/site.d + /etc/nginx/site.d \ + /etc/nginx/x509.d sudo ln -fns \ /etc/nginx \ /home/www/etc/nginx @@ -807,152 +705,197 @@ rule_nginx_configure () { "$tool"/etc/nginx/conf.d/"$conf" \ /etc/nginx/conf.d/"$conf" done - for conf in "$tool"/etc/nginx/site.d/*/server.conf + for conf in "$tool"/etc/nginx/site.d/*/site.conf do conf=${conf#"$tool"/etc/nginx/site.d/} - local port site - IFS=. read -r port site <<-EOF - ${conf%\/server\.conf} - EOF - assert 'test "${port:+set}"' - assert 'test "${site:+set}"' - site="$port.$site" - getent passwd www."$site" >/dev/null || - sudo adduser \ + local site="${conf%/site.conf}" + rule adduser www-"$site" \ --disabled-login \ --disabled-password \ --group \ - --home ~www-data/"$site" \ + --home /home/www/pub/"$site" \ --shell /bin/false \ - --system \ - www."$site" - getent passwd log."$site" >/dev/null || - sudo adduser \ + --system + rule adduser log-www-"$site" \ --disabled-login \ --disabled-password \ --group \ + --home /home/www/log/"$site"/nginx \ --shell /bin/false \ - --system \ - log."$site" - sudo usermod --home ~www/log/"$site"/nginx log."$site" + --system + sudo install -d -m 771 -o log-www -g log-www \ + /home/www/log/"$site" sudo install -d -m 770 -o www -g www \ /etc/nginx/site.d/"$site" - case $port in - (443) - local hint="run vm_remote nginx_key_send before" - assert "sudo test -f /etc/nginx/\"$site\"/x509/key.pem" hint - sudo install -m 664 -o www -g www \ - "$tool"/var/pub/x509/"$site"/crt+ca.pem \ - /etc/nginx/site.d/"$site"/x509/crt.pem - ;; - esac - case $port in - (80) - cat <<-EOF - server { - listen $port; - access_log /home/www/log/$site/nginx/access.log main; - error_log /home/www/log/$site/nginx/error.log warn; - root /home/www/pub/$site; - server_name $site; - $(cat "$tool"/etc/nginx/site.d/"$site"/server.conf) - } - EOF - ;; - (443) - cat <<-EOF - server { - listen $port; - access_log /home/www/log/$site/nginx/access.log main; - error_log /home/www/log/$site/nginx/error.log warn; - keepalive_timeout 70; - root /home/www/pub/$site; - server_name $site; - # DOC: http://wiki.nginx.org/HttpSslModule - ssl on; - ssl_certificate /home/www/etc/nginx/site.d/$site/x509/crt.pem; - ssl_certificate_key /home/www/etc/nginx/site.d/$site/x509/key.pem; - ssl_ciphers HIGH:!ADH:!MD5; - ssl_prefer_server_ciphers on; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_session_cache shared:SSL:10m; - $(cat "$tool"/etc/nginx/site.d/"$site"/server.conf) - } - EOF - ;; - esac | - sudo install -m 660 -o www -g www /dev/stdin \ - /etc/nginx/site.d/"$site"/server.conf - adduser www-data "$site" - test -e /home/www/pub/"$site" || - sudo install -d -m 3770 -o "$site" -g "$site" \ + sudo install -d -m 770 -o www -g www \ + /etc/nginx/x509.d/"$site" + test -L /home/www/pub/"$site" || + sudo install -d -m 2770 -o www-"$site" -g www-"$site" \ /home/www/pub/"$site" - sudo install -d -m 3770 -o log."$site" -g log."$site" \ - /home/www/log/"$site"/nginx + sudo adduser www-data www-"$site" + sudo adduser www-data log-www-"$site" + sudo install -m 660 -o www -g www \ + "$tool"/etc/nginx/site.d/"$site"/local.conf \ + /etc/nginx/site.d/"$site"/local.inc + sudo install -m 660 -o www -g www \ + "$tool"/etc/nginx/site.d/"$site"/site.conf \ + /etc/nginx/site.d/"$site"/site.inc + sudo install -m 660 -o www -g www /dev/stdin \ + /etc/nginx/site.d/"$site"/server.conf <<-EOF + server { + access_log /home/www/log/$site/nginx/access.log main; + error_log /home/www/log/$site/nginx/error.log warn; + root /home/www/pub/$site; + include /etc/nginx/site.d/$site/local.inc; + include /etc/nginx/site.d/$site/site.inc; + } + EOF test ! -r "$tool"/etc/nginx/site.d/"$site"/configure.sh || . "$tool"/etc/nginx/site.d/"$site"/configure.sh done - rule apt_get_install spawn-fcgi fcgiwrap - sudo insserv --remove fcgiwrap - rule tmpfs_configure - sudo service nginx restart + rule runit_configure nginx + } +rule_nsd3_configure () { # NOTE: DNS autoritaire uniquement + local -; set +f + rule apt_get_install nsd + rule insserv_remove nsd3 + sudo rm -rf \ + /etc/nsd3/zone.d + sudo install -d -m 750 -o root -g nsd \ + /etc/nsd3/zone.d + { + cat <<-EOF + server: + ip-address: $vm_ipv4 + ip4-only: yes + EOF + cat "$tool"/etc/nsd3/nsd.conf + local conf + for conf in "$tool"/etc/nsd3/zone.d/*.conf + do conf=${conf#"$tool"/etc/nsd3/zone.d/} + local domain=${conf%.conf} + if test -e "$tool"/etc/nsd3/zone.d/"$domain".zone.m4 + then m4 \ + --define=ZONE_DOMAIN=$domain \ + --define=ZONE_SERIAL=$(cd "$tool" && git log -1 --format="%ct" -- etc/nsd3/zone.d/"$domain".zone.m4) \ + --define=VM_IP4=$vm_ipv4 \ + "$tool"/etc/nsd3/zone.d/"$domain".zone.m4 + else cat "$tool"/etc/nsd3/zone.d/"$domain".zone + fi | + sudo install -m 440 -o root -g nsd /dev/stdin \ + /etc/nsd3/zone.d/"$domain".zone + sudo install -m 440 -o root -g nsd \ + "$tool"/etc/nsd3/zone.d/"$conf" \ + /etc/nsd3/zone.d/"$conf" + cat <<-EOF + zone: + name: $domain + zonefile: /etc/nsd3/zone.d/$domain.zone + EOF + done + } | + sudo install -m 640 -o root -g nsd /dev/stdin \ + /etc/nsd3/nsd.conf + sudo nsdc rebuild + rule runit_configure nsd3 + } +rule_ntp_configure () { + # NOTE: http://my.opera.com/marcomarongiu/blog/2011/01/05/independent-wallclock-in-xen-4 + rule apt_get_install ntp + rule insserv_remove ntp + rule runit_configure ntp + } +rule_openerp_configure () { + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF + deb http://nightly.openerp.com/7.0/nightly/deb/ ./ + EOF + sudo install -d -m 1777 -o root -g root \ + /etc/openerp + rule apt_get_install openerp --force-yes + # XXX: --force-yes car les paquets de nightly.openerp.com + # ne sont pas signés par OpenPGP.. + rule insserv_remove openerp } rule_php5_fpm_configure () { local -; set +f - rule apt_get_install \ - php5-fpm \ - php-apc - getent passwd php5 >/dev/null || - sudo adduser \ + rule apt_get_install php5-fpm php-apc + rule insserv_remove php5-fpm + rule adduser php5 \ --disabled-login \ --disabled-password \ --group \ + --home /etc/php5/fpm \ --shell /bin/false \ - --system \ - php5 - local conf + --system + rule adduser log-php5 \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/log/php5/fpm \ + --shell /bin/false \ + --system sudo ln -fns \ - /etc/php5-fpm \ + /etc/php5/fpm \ /home/www/etc/php5 - sudo rm -f /etc/php5/fpm/pool.d/* + sudo rm -rf \ + /etc/php5/fpm/conf.d \ + /etc/php5/fpm/pool.d + sudo install -d -m 770 -o php5 -g php5 \ + /etc/php5/fpm/conf.d \ + /etc/php5/fpm/pool.d + sudo install -m 440 -o php5 -g php5 \ + "$tool"/etc/php5/fpm/php-fpm.conf \ + /etc/php5/fpm/php-fpm.conf + local conf + #for conf in "$tool"/etc/php5/fpm/conf.d/*.conf + # do conf=${conf#"$tool"/etc/php5/fpm/conf.d/} + # sudo install -m 660 -o php5 -g php5 \ + # "$tool"/etc/php5/fpm/conf.d/"$conf" \ + # /etc/php5/fpm/conf.d/"$conf" + # done for conf in "$tool"/etc/php5/fpm/pool.d/*.conf do conf=${conf#"$tool"/etc/php5/fpm/pool.d/} - local port site - IFS=. read -r port site <<-EOF - ${conf%\.conf} + IFS=. read -r pool <<-EOF + ${conf%.conf} EOF - assert 'test "${port:+set}"' - assert 'test "${site:+set}"' - site="$port.$site" - getent passwd php5"$site" >/dev/null || - sudo adduser \ + assert 'test "${pool:+set}"' + rule adduser php5-"$pool" \ + --disabled-login \ + --disabled-password \ + --group \ + --no-create-home \ + --home /etc/php5/fpm/pool.d \ + --shell /bin/false \ + --system + rule adduser log-php5-"$pool" \ --disabled-login \ --disabled-password \ --group \ --no-create-home \ - --home ~www/pub/"$site" \ + --home /home/www/log/php5/fpm/"$pool" \ --shell /bin/false \ - --system \ - php5."$site" - sudo install -d -m 770 -o php5 -g php5 \ + --system + sudo install -d -m 770 -o log-php5 -g log-php5 \ /home/www/log/php5 \ /home/www/log/php5/fpm - sudo install -d -m 770 -o log."$site" -g log."$site" \ - /home/www/log/"$site" - sudo adduser php5."$user" www."$site" - sudo install -m 660 -o root -g root /dev/stdin \ - /etc/php5/fpm/pool.d/"$conf" <<-EOF - [php5.$site] - access.log = /home/www/log/$site/php5/fpm/access.log + sudo install -d -m 770 -o log-php5-"$pool" -g log-php5-"$pool" \ + /home/www/log/php5/fpm/"$pool" + sudo install -m 660 -o php5 -g php5 /dev/stdin \ + /etc/php5/fpm/pool.d/"$pool".conf <<-EOF + [$pool] + access.log = /home/www/log/php5/fpm/$pool/access.log catch_workers_output = yes chdir = / env[HOSTNAME] = \$HOSTNAME env[TEMP] = /tmp env[TMPDIR] = /tmp env[TMP] = /tmp - group = www-data - listen = /run/nginx/fastcgi/php5.$site + group = php5-$pool #listen = 127.0.0.1:9000 + listen = /run/php5/fpm/$pool #listen.allowed_clients = 127.0.0.1 + listen.group = www-data + listen.mode = 0660 + #listen.owner = www-data listen.backlog = -1 pm = dynamic pm.max_children = 5 @@ -965,16 +908,15 @@ rule_php5_fpm_configure () { request_terminate_timeout = 120s rlimit_core = unlimited rlimit_files = 131072 - slowlog = /home/www/log/$site/php5/fpm/slow.log - user = $php5_user + slowlog = /home/www/log/php5/fpm/$pool/slow.log + user = php5-$pool $(cat "$tool"/etc/php5/fpm/pool.d/"$conf") EOF - sudo install -m 664 -o root -g root \ + sudo install -m 664 -o php5 -g php5 \ "$tool"/etc/php5/fpm/php.ini \ /etc/php5/fpm/php.ini done - rule tmpfs_configure - sudo service php5-fpm restart + rule runit_configure php5-fpm } rule_postfix_configure () { local hint="run vm_remote postfix_key_send before" @@ -984,18 +926,12 @@ rule_postfix_configure () { postfix postfix/main_mailer_type select No configuration EOF rule apt_get_install postfix + rule insserv_remove postfix sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF *.db EOF - sudo install -d -m 770 -o root -g root \ - /etc/postfix/$vm_domainname/ \ - /etc/postfix/$vm_domainname/smtp \ - /etc/postfix/$vm_domainname/smtp/x509 \ - /etc/postfix/$vm_domainname/smtp/x509/ca \ - /etc/postfix/$vm_domainname/smtpd \ - /etc/postfix/$vm_domainname/smtpd/x509 \ - /etc/postfix/$vm_domainname/smtpd/x509/ca - sudo install -d -m 770 -o root -g root \ + sudo install -d -m 771 -o root -g root \ + /etc/postfix/ \ /etc/postfix/$vm_domainname/ \ /etc/postfix/$vm_domainname/smtp \ /etc/postfix/$vm_domainname/smtp/x509 \ @@ -1007,26 +943,27 @@ rule_postfix_configure () { ../crt+crl.self-signed.pem \ /etc/postfix/$vm_domainname/smtpd/x509/ca/crt.pem sudo install -m 400 -o root -g root \ - "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+crl.self-signed.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt+crl.self-signed.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem sudo install -m 400 -o root -g root \ - "$tool"/var/pub/x509/$vm_domainname/smtpd/crt.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt.pem + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt.pem sudo install -m 400 -o root -g root \ - "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+ca.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt+ca.pem + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt+ca.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt+ca.pem sudo install -m 400 -o root -g root \ - "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+crl.self-signed.pem \ - /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem - sudo install -m 660 -o root -g root \ + "$tool"/var/pub/x509/smtpd.$vm_domainname/crt+crl.self-signed.pem \ + /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/header_checks \ /etc/postfix/$vm_domainname/header_checks - sudo install -m 664 -o root -g root /dev/stdin \ + sudo install -m 644 -o root -g root /dev/stdin \ /etc/postfix/aliases <<-EOF # See man 5 aliases for format abuse: root admin: root contact: root + mailer-daemon: root postmaster: root root: $(getent group sudo | cut -f 4 -d : | tr , ' ') EOF @@ -1038,60 +975,44 @@ rule_postfix_configure () { mail_name = \$myhostname mydestination = $vm_hostname \$myhostname \$myorigin EOF - sudo install -m 664 -o root -g root /dev/stdin \ + sudo install -m 640 -o root -g root /dev/stdin \ /etc/postfix/main.cf - sudo install -m 664 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/master.cf \ /etc/postfix/master.cf - sudo install -m 660 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/smtp/x509/policy \ /etc/postfix/$vm_domainname/smtp/x509/policy sudo postmap hash:/etc/postfix/$vm_domainname/smtp/x509/policy - sudo install -m 660 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/smtp/header_checks \ /etc/postfix/$vm_domainname/smtp/header_checks - sudo install -m 660 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/smtpd/sender_access \ /etc/postfix/$vm_domainname/smtpd/sender_access sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/sender_access - sudo install -m 660 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/smtpd/client_blacklist \ /etc/postfix/$vm_domainname/smtpd/client_blacklist sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/client_blacklist - sudo install -m 660 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/smtpd/relay_clientcerts \ /etc/postfix/$vm_domainname/smtpd/relay_clientcerts sudo postmap hash:/etc/postfix/$vm_domainname/smtpd/relay_clientcerts - sudo install -m 660 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/transport \ /etc/postfix/$vm_domainname/transport sudo postmap hash:/etc/postfix/$vm_domainname/transport - sudo install -m 660 -o root -g root \ + sudo install -m 640 -o root -g root \ "$tool"/etc/postfix/$vm_domainname/virtual_alias \ /etc/postfix/$vm_domainname/virtual_alias sudo postmap hash:/etc/postfix/$vm_domainname/virtual_alias - sudo service postfix restart - } -rule_postgresql_configure () { - rule apt_get_install postgresql-9.1 - if [ ! -d /var/lib/postgresql/9.1/ ]; then - pg_createcluster -u postgres --start 9.1 main - fi - sudo install -m 660 -o root -g root \ - "$tool"/etc/postgresql/9.1/main/postgresql.conf \ - /etc/postgresql/9.1/main/postgresql.conf - sudo service postgresql restart - } -rule_openerp_configure () { - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF - deb http://nightly.openerp.com/trunk/nightly/deb/ ./ - EOF - sudo apt-get update - rule apt_get_install openerp + rule runit_configure postfix } rule_postgrey_configure () { - rule apt_get_install postgrey - sudo service postgrey restart + rule apt_get_install postgrey + rule insserv_remove postgrey + rule runit_configure postgrey } rule_procmail_configure () { rule apt_get_install procmail @@ -1104,35 +1025,109 @@ rule_procmail_configure () { "$tool"/etc/skel/etc/mail/delivery.procmailrc \ /etc/skel/etc/mail/delivery.procmailrc } -rule_runit_configure () { +rule_runit_configure () { # SYNTAX: $sv rule apt_get_install runit local -; set +f - rm -f /etc/service/* - # NOTE: runsvdir éteindra les services qui n'apparaîtront plus ici. - for sv in "$tool"/etc/sv/* - do sv=${sv#"$tool"/etc/sv/} + sudo find /etc/sv -mindepth 1 -maxdepth 1 -type d -name "${1:-*}" -exec \ + /bin/sh -efux -c 'case $(sv stop "$1") in + (*": runsv not running") true;; + (*": unable to open supervise/ok: file does not exist") true;; + ("ok: down:"*) true;; + (*) false;; + esac' '' {} + + set -$- ${1-"$tool"/etc/sv/*} + while test -n "$*" + do local first=yes + for sv in "$@" + do sv=${sv##*/} + case $first in + (yes) shift $#; first=;; + esac + rule _runit_sv_configure "$sv" + rule runit_sv_restart "$sv" + done + done + sudo find -L /etc/service -type l -delete + } +rule__runit_sv_configure () { # SYNTAX: $sv + local sv="$1" + sudo install -d -m 770 -o root -g root \ + /etc/sv/"$sv" + sudo install -m 770 -o root -g root \ + "$tool"/etc/sv/"$sv"/run \ + /etc/sv/"$sv"/run + if test -e "$tool"/etc/sv/"$sv"/log/run + then sudo install -d -m 770 -o root -g root \ - /etc/sv/"$sv" + /etc/sv/"$sv"/log sudo install -m 770 -o root -g root \ - "$tool"/etc/sv/"$sv"/run \ - /etc/sv/"$sv"/run - if test -e "$tool"/etc/sv/"$sv"/log/run - then - sudo install -d -m 770 -o root -g root \ - /etc/sv/"$sv"/log - sudo install -m 770 -o root -g root \ - "$tool"/etc/sv/"$sv"/log/run \ - /etc/sv/"$sv"/log/run - fi - if test ! -x "$tool"/etc/sv/"$sv"/configure || - "$tool"/etc/sv/"$sv"/configure - then - ln -fns ../sv/"$sv" /etc/service/"$sv" - sv restart "$sv" - fi + "$tool"/etc/sv/"$sv"/log/run \ + /etc/sv/"$sv"/log/run + fi + local continue= + test ! -r "$tool"/etc/sv/"$sv"/configure.sh || + . "$tool"/etc/sv/"$sv"/configure.sh + case $continue in + (yes) continue;; + esac + sudo ln -fns \ + ../sv/"$sv" \ + /etc/service/"$sv" + } +rule_runit_sv_restart () { # SYNTAX: $sv + local sv="$1" + while true + do case $(sudo sv restart "$sv") in + ("fail: $sv: runsv not running") sleep 1;; + ("warning: $sv: unable to open supervise/ok: file does not exists") sleep 1;; + (*) break;; + esac done } +rule_shorewall_configure () { + # DOC: http://shorewall.net/Introduction.html + local -; set +f + rule apt_get_install shorewall + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/default/shorewall <<-EOF + INITLOG=/dev/null + OPTIONS="" + RESTARTOPTIONS="" + SAFESTOP=0 + STARTOPTIONS="" + startup=1 + EOF + local conf + for conf in "$tool"/etc/shorewall/* + do conf=${conf#"$tool"/etc/shorewall/} + sudo test ! -f "$tool"/etc/shorewall/"$conf" || + sudo install -m 640 -o root -g root \ + "$tool"/etc/shorewall/"$conf" \ + /etc/shorewall/"$conf" + done + sudo install -d -m 750 -o root -g root \ + /etc/shorewall/macro.d + for conf in "$tool"/etc/shorewall/macro.d/* + do conf=${conf#"$tool"/etc/shorewall/macro.d/} + sudo test ! -f "$tool"/etc/shorewall/macro.d/"$conf" || + sudo install -m 640 -o root -g root \ + "$tool"/etc/shorewall/macro.d/"$conf" \ + /etc/shorewall/macro.d/"$conf" + done + sudo install -d -m 750 -o root -g root \ + /etc/shorewall/action.d + #for conf in "$tool"/etc/shorewall/action.d/* + # do conf=${conf#"$tool"/etc/shorewall/action.d/} + # sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" || + # sudo install -m 640 -o root -g root \ + # "$tool"/etc/shorewall/action.d/"$conf" \ + # /etc/shorewall/action.d/"$conf" + # done + #sudo shorewall safe-restart + } rule_ssh_configure () { + rule apt_get_install openssh-server + rule insserv_remove ssh ssh-keygen -F "$vm_fqdn" -f "$tool"/etc/openssh/known_hosts | ( while IFS= read -r line do case $line in (*" RSA") return 0; break;; esac @@ -1144,45 +1139,15 @@ rule_ssh_configure () { /etc/ssh/ssh_host_ecdsa_key \ /etc/ssh/ssh_host_ecdsa_key.pub # NOTE: clefs générées par Debian - sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF - Port 22 - ListenAddress $vm_ipv4 - #ListenAddress :: - Protocol 2 - Compression yes - HostKey /etc/ssh/ssh_host_rsa_key - UsePrivilegeSeparation yes - KeyRegenerationInterval 3600 - ServerKeyBits 768 - SyslogFacility AUTH - LogLevel INFO - LoginGraceTime 120 - PermitRootLogin yes - StrictModes yes - RSAAuthentication yes - PubkeyAuthentication yes - AuthorizedKeysFile %h/etc/ssh/authorized_keys - IgnoreRhosts yes - RhostsRSAAuthentication no - HostbasedAuthentication no - IgnoreUserKnownHosts no - PermitEmptyPasswords no - ChallengeResponseAuthentication no - PasswordAuthentication no - KerberosAuthentication no - GSSAPIAuthentication no - X11Forwarding no - X11DisplayOffset 10 - PrintMotd no - DebianBanner no - PrintLastLog yes - TCPKeepAlive yes - ClientAliveInterval 0 - AcceptEnv LANG LC_* - Subsystem sftp /usr/lib/openssh/sftp-server - UsePAM yes - EOF - sudo service ssh restart + m4 \ + --define=VM_IPV4=$vm_ipv4 \ + <"$tool"/etc/ssh/sshd_config.m4 | + sudo install -m 640 -o root -g root /dev/stdin \ + /etc/ssh/sshd_config + sudo install -m 644 -o root -g root \ + "$tool"/etc/ssh/ssh_config \ + /etc/ssh/ssh_config + rule runit_configure sshd } rule_sysctl_configure () { local -; set +f @@ -1209,10 +1174,6 @@ rule_tmpfs_configure () { TMP_SIZE=200m TMPFS_SIZE=20%VM EOF - sudo install -m 775 -o root -g root \ - "$tool"/etc/init.d/tmpfs \ - /etc/init.d/tmpfs - sudo update-rc.d tmpfs defaults } rule_time_configure () { sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF @@ -1223,17 +1184,33 @@ rule_time_configure () { tzdata tzdata/Zones/Europe select Paris EOF rule dpkg_reconfigure tzdata - rule apt_get_install ntp + rule ntp_configure + } +rule_unbound_configure () { + sudo apt-get install unbound + rule insserv_remove unbound + sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF + search ${vm_host#*.} + nameserver 127.0.0.1 + #nameserver ${vm_host_nameserver} + EOF + sudo install -m 440 -o unbound -g unbound \ + "$tool"/etc/unbound/named.cache \ + /etc/unbound/named.cache + m4 \ + --define=OUTGOING_INTERFACE=$vm_ipv4 \ + <"$tool"/etc/unbound/unbound.conf | + sudo install -m 440 -o unbound -g unbound /dev/stdin \ + /etc/unbound/unbound.conf + rule runit_configure unbound } rule_user_add () { # SYNTAX: $user - rule user_configure - local user=$1 - getent passwd "$user" >/dev/null || - sudo adduser --disabled-password "$user" + local user="$1"; shift + rule adduser "$user" --disabled-password "$@" # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init . eval local home\; home="~$user" sudo adduser "$user" users - sudo install -m 640 -o root -g root \ + sudo install -m 640 -o "$user" -g "$user" \ "$tool"/var/pub/ssh/"$user".key \ "$home"/etc/ssh/authorized_keys local key; local -; set +f @@ -1242,53 +1219,10 @@ rule_user_add () { # SYNTAX: $user done } rule_user_configure () { - sudo install -m 660 -o root -g root /dev/stdin \ - /etc/adduser.conf <<-EOF - ADD_EXTRA_GROUPS=1 - DHOME=/home - DIR_MODE=0750 - DSHELL=/bin/bash - EXTRA_GROUPS="users" - FIRST_GID=1000 - FIRST_SYSTEM_GID=100 - FIRST_SYSTEM_UID=100 - FIRST_UID=1000 - GROUPHOMES=no - LAST_GID=29999 - LAST_SYSTEM_GID=999 - LAST_SYSTEM_UID=999 - LAST_UID=29999 - LETTERHOMES=no - NAME_REGEX="^[a-z][-a-z0-9_.]*\$" - QUOTAUSER="" # TODO: init - SETGID_HOME=no - SKEL=/etc/skel - SKEL_IGNORE_REGEX="dpkg-(old|new|dist|save)" - USERGROUPS=yes - USERS_GID=100 - EOF - } -rule_user_admin_add () { # SYNTAX: $user - rule user_configure - local user=$1 - getent passwd "$user" >/dev/null || - sudo adduser --disabled-password "$user" - eval local home\; home="~$user" - sudo adduser "$user" sudo - sudo install -m 640 -o root -g root \ - "$tool"/var/pub/ssh/"$user".key \ - "$home"/etc/ssh/authorized_keys - local key; local -; set +f - for key in "$tool"/var/pub/openpgp/*.key - do sudo -u "$user" gpg --import - <"$key" - done - rule user_admin_configure - } -rule_user_admin_configure () { - rule initramfs_configure - rule user_root_configure - } -rule_user_configure () { + rule apt_get_install bash-completion + sudo install -m 660 -o root -g root \ + "$tool"/etc/adduser.conf \ + /etc/adduser.conf sudo install -d -m 750 -o root -g root \ /etc/skel \ /etc/skel/etc \ @@ -1308,7 +1242,7 @@ rule_user_configure () { ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac EOF sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF - %sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean + %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean EOF sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF Defaults env_keep = " \\ @@ -1331,6 +1265,31 @@ rule_user_configure () { sudo install -m 644 -o root -g root \ "$tool"/etc/screenrc \ /etc/screenrc + local sh; local -; set +f + for sh in "$tool"/etc/user.d/*/configure.sh + do sh=${sh#"$tool"/etc/user.d/} + local user="${sh%/configure.sh}" + . "$tool"/etc/user.d/"$sh" + done + } +rule_user_admin_add () { # SYNTAX: $user + rule user_configure + local user=$1 + rule adduser "$user" --disabled-password + eval local home\; home="~$user" + sudo adduser "$user" sudo + sudo install -m 640 -o root -g root \ + "$tool"/var/pub/ssh/"$user".key \ + "$home"/etc/ssh/authorized_keys + local key; local -; set +f + for key in "$tool"/var/pub/openpgp/*.key + do sudo -u "$user" gpg --import - <"$key" + done + rule user_admin_configure + } +rule_user_admin_configure () { + rule initramfs_configure + rule user_root_configure } rule_user_root_configure () { sudo install -d -m 750 -o root -g root \ @@ -1345,7 +1304,7 @@ rule_user_root_configure () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys @@ -1354,6 +1313,34 @@ rule_user_root_configure () { do sudo gpg --import "$key" done } +rule_www_configure () { + rule adduser www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www \ + --shell /bin/false \ + --system + rule adduser log-www \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/www/log \ + --shell /bin/false \ + --system + #sudo adduser www www-data + sudo adduser www log-www + #sudo adduser log log-www + usermod --home /home/www/pub www-data + sudo install -d -m 751 -o www -g www \ + /home/www + sudo install -d -m 750 -o www -g www \ + /home/www/etc + sudo install -d -m 1771 -o www-data -g www-data \ + /home/www/pub + sudo install -d -m 1771 -o log-www -g log-www \ + /home/www/log + } rule_configure () { rule apt_configure rule git_configure @@ -1369,10 +1356,15 @@ rule_configure () { rule sysctl_configure rule user_configure rule mail_configure - #rule apache2_configure - rule nginx_configure - rule php5_fpm_configure rule gitolite_configure + rule www_configure + rule nginx_configure + #rule apache2_configure + rule nsd3_configure + rule unbound_configure + rule postgresql_configure + rule mysql_configure + rule shorewall_configure rule runit_configure }