X-Git-Url: https://git.cyclocoop.org/?a=blobdiff_plain;f=vm_hosted;h=df6f6dbd6564cea3df16c9e6fa6ac2d0c727ff0d;hb=30fcfa9a18a93d1447059a759c5c62a4d6d55e06;hp=f80192c902c26f7742e11399cbe033ec336eb4f5;hpb=135dd5935139bd9a072ae5073779ab5488ecbeb6;p=lhc%2Fateliers.git

diff --git a/vm_hosted b/vm_hosted
index f80192c..df6f6db 100755
--- a/vm_hosted
+++ b/vm_hosted
@@ -722,18 +722,19 @@ rule_mysql_configure () {
 	 --system
 	sudo usermod --home /home/mysql mysql
 	sudo adduser mysql mysql-data
-	sudo install -m 644 -o mysql -g mysql \
-	 "$tool"/etc/mysql/my.cnf \
-	        /etc/mysql/my.cnf
 	sudo install -d -m 751 -o mysql -g mysql \
 	 /home/mysql
 	sudo rm -rf /etc/mysql
 	sudo install -d -m 750 -o mysql -g mysql \
 	 /etc/mysql \
+	 /etc/mysql/conf.d \
 	 /home/mysql/etc
 	sudo ln -fns \
 	            /etc/mysql \
 	 /home/mysql/etc/mysql
+	sudo install -m 644 -o mysql -g mysql \
+	 "$tool"/etc/mysql/my.cnf \
+	        /etc/mysql/my.cnf
 	if sudo test ! -d /home/mysql/data
 	 then
 		sudo install -d -m 750 -o mysql -g mysql-data \
@@ -747,9 +748,14 @@ rule_mysql_configure () {
 	sudo chmod ugo-x /etc/init.d/mysql
 	case $(sudo sv status mysql || true) in
 	 (''|run:*|*"s, normally up;"*)
-		sudo sv restart mysql
-		case $(sudo inotifywait -e create -- /run/mysqld/sock/) in
-		 ("/run/mysqld/sock/ CREATE mysql")
+		rule runit_sv_restart mysql
+		while case $(sudo inotifywait -e create -- /run/mysqld/sock/) in
+		 ("/run/mysqld/sock/ CREATE mysql") false;;
+		 (*) true;;
+		 esac
+		do true; done
+		(
+		cd /
 			# NOTE:
 			# - ajoute l'accès par socket Unix à mysql
 			# - ajoute les droits de super-utilisateur à mysql
@@ -769,8 +775,8 @@ rule_mysql_configure () {
 				DELETE FROM mysql.user WHERE user = '';
 				FLUSH PRIVILEGES;
 				EOF
-			;;
-		 esac
+		)
+		;;
 	 esac
  }
 rule_mysql_db_add () { # SYNTAX: $user $db
@@ -1061,8 +1067,8 @@ rule_php5_fpm_configure () {
 		sudo install -m 664 -o php5 -g php5 \
 		 "$tool"/etc/php5/fpm/php.ini \
 		        /etc/php5/fpm/php.ini
-		case $(sudo sv status php5-"$pool") in
-		 (run:*) sudo sv restart php5-"$pool"
+		case $(sudo sv status php5-"$pool" || true) in
+		 (''|run:*) rule runit_sv_restart php5-"$pool"
 		 esac
 	 done
 	rule tmpfs_configure
@@ -1180,7 +1186,7 @@ rule_postgresql_configure () {
 	sudo adduser postgres postgres-data
 	sudo rm -rf \
 	 /etc/postgresql
-	sudo install -d -m 750 -o postgres -g postgres \
+	sudo install -d -m 1751 -o postgres -g postgres-data \
 	 /home/postgresql \
 	 /home/postgresql/etc \
 	 /etc/postgresql \
@@ -1189,9 +1195,10 @@ rule_postgresql_configure () {
 	sudo ln -fns \
 	                 /etc/postgresql \
 	 /home/postgresql/etc/postgresql
-	sudo install -d -m 751 -o postgres -g postgres \
+	sudo install -d -m 2770 -o postgres -g log-postgres \
 	 /home/postgresql/log \
-	 /home/postgresql/log/9.1
+	 /home/postgresql/log/9.1 \
+	 /home/postgresql/log/9.1/main
 	sudo service tmpfs restart
 	if sudo test ! -d /home/postgresql/data
 	 then
@@ -1201,9 +1208,9 @@ rule_postgresql_configure () {
 		cd /
 		sudo -u postgres pg_createcluster \
 		 --datadir=/home/postgresql/data \
-		 --logfile=/home/postgresql/log/9.1/main  \
-		 --socketdir=/run/postgresql/sock \
-		 --start 9.1 main
+		 --logfile=/home/postgresql/log/9.1/main/cluster.log  \
+		 --socketdir=/run/postgresql \
+		 9.1 main
 		)
 	 fi
 	sudo install -m 770 -o postgres -g postgres /dev/stdin \
@@ -1211,62 +1218,143 @@ rule_postgresql_configure () {
 		local all postgres peer
 		local all all      peer
 		EOF
-	sudo install -m 660 -o postgres -g postgres \
+	sudo install -m 640 -o postgres -g postgres-data \
 	 "$tool"/etc/postgresql/9.1/main/postgresql.conf \
 	        /etc/postgresql/9.1/main/postgresql.conf
 	sudo insserv -r postgresql
 	sudo chmod ugo-x /etc/init.d/postgresql
 	case $(sudo sv status postgres || true) in
 	 (''|run:*|*"s, normally up;"*)
-		sudo sv restart postgres
+		rule runit_sv_restart postgres
+		while case $(sudo inotifywait -e create -- /run/postgresql/) in
+		 ("/run/postgresql/ CREATE .s.PGSQL.5432") false;;
+		 (*) true;;
+		 esac
+		do true; done
 		(
 		cd /
-		case $(sudo inotifywait -e create -- /run/postgresql/sock/) in
-		 ("/run/postgresql/sock/ CREATE .s.PGSQL."*)
-			# NOTE:
-			# - supprime l'accès au schéma public depuis public,
-			#   de sorte à ce que les différents utilisateurices
-			#   ne voient pas leurs bases de données entre-elleux ;
-			# - ajoute le support de PL/PGSQL.
-			sudo -u postgres psql template1 -f - <<-EOF
-				REVOKE ALL ON DATABASE template1 FROM public;
-				REVOKE ALL ON SCHEMA   public    FROM public;
-				GRANT  ALL ON SCHEMA   public    TO   postgres;
-				CREATE LANGUAGE plpgsql;
-				EOF
-			# NOTE:
-			# - supprime l'accès à la liste des bases données
-			#   et utilisateurices depuis public.
-			sudo -u postgres psql template1 -f - <<-EOF
-				REVOKE ALL ON pg_auth_members FROM public;
-				REVOKE ALL ON pg_authid       FROM public;
-				REVOKE ALL ON pg_database     FROM public;
-				REVOKE ALL ON pg_group        FROM public;
-				REVOKE ALL ON pg_roles        FROM public;
-				REVOKE ALL ON pg_settings     FROM public;
-				REVOKE ALL ON pg_tablespace   FROM public;
-				REVOKE ALL ON pg_user         FROM public;
-				EOF
-			;;
-		 esac
+		# NOTE: supprime l'accès au schéma public depuis public,
+		#       de sorte à ce que les différents utilisateurices
+		#       ne voient pas leurs bases de données entre-elleux ;
+		sudo -u postgres psql template1 -a -f - <<-EOF
+			\set ON_ERROR_STOP on
+			REVOKE ALL ON DATABASE template1 FROM public;
+			REVOKE ALL ON SCHEMA   public    FROM public;
+			GRANT  ALL ON SCHEMA   public    TO   postgres;
+			EOF
+		# NOTE: ajoute le support de PL/PGSQL s'il ne l'est pas déjà.
+		sudo -u postgres psql template1 -a -f - <<-EOF
+			\set ON_ERROR_STOP on
+			CREATE OR REPLACE FUNCTION create_language_plpgsql()
+				RETURNS BOOLEAN AS \$\$
+					CREATE LANGUAGE plpgsql;
+					SELECT TRUE;
+				\$\$ LANGUAGE SQL;
+			SELECT CASE WHEN NOT (
+				SELECT  TRUE AS exists
+				FROM    pg_language
+				WHERE   lanname = 'plpgsql'
+				UNION
+				SELECT  FALSE AS exists
+				ORDER BY exists DESC
+				LIMIT 1
+			 )
+			THEN
+				create_language_plpgsql()
+			ELSE
+				FALSE
+			END AS plpgsql_created;
+			DROP FUNCTION create_language_plpgsql();
+			EOF
+		# NOTE: supprime l'accès à la liste des bases données
+		#       et utilisateurices depuis public.
+		sudo -u postgres psql template1 -a -f - <<-EOF
+			\set ON_ERROR_STOP on
+			REVOKE ALL ON pg_auth_members FROM public;
+			REVOKE ALL ON pg_authid       FROM public;
+			REVOKE ALL ON pg_database     FROM public;
+			REVOKE ALL ON pg_group        FROM public;
+			REVOKE ALL ON pg_roles        FROM public;
+			REVOKE ALL ON pg_settings     FROM public;
+			REVOKE ALL ON pg_tablespace   FROM public;
+			REVOKE ALL ON pg_user         FROM public;
+			EOF
 		)
 		;;
 	 esac
  }
 rule_postgresql_db_add () { # SYNTAX: $db $db_user
 	local db="$1" db_user="$2"
-	sudo -u postgresql psql template1 -f - <<-EOF
-		CREATE ROLE $db      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOLOGIN;
-		CREATE ROLE $db_user NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT LOGIN ENCRYPTED;
-		GRANT $db TO $db_user;
-		CREATE DATABASE $db WITH OWNER=$db_user;
+	sudo -u postgres psql template1 -a -f - <<-EOF
+		\set ON_ERROR_STOP on
+		DO LANGUAGE plpgsql \$\$
+		BEGIN
+			IF NOT EXISTS (
+			 SELECT *
+			 FROM pg_catalog.pg_roles
+			 WHERE rolname = '${db}_role'
+			 LIMIT 1
+			) THEN
+				CREATE ROLE ${db}_role
+				 NOCREATEDB
+				 NOCREATEROLE
+				 NOINHERIT
+				 NOLOGIN
+				 NOSUPERUSER;
+			END IF;
+			IF NOT EXISTS (
+				SELECT *
+				FROM pg_catalog.pg_user
+				WHERE usename = '$db_user'
+				LIMIT 1
+			) THEN
+				CREATE ROLE $db_user
+				 LOGIN
+				 NOCREATEDB
+				 NOCREATEROLE
+				 NOINHERIT
+				 NOSUPERUSER;
+			END IF;
+		END;
+		\$\$;
+		EOF
+	case $(sudo -u postgres psql template1 -t -c \
+		"SELECT datname FROM pg_catalog.pg_database WHERE datname = '$db' LIMIT 1") in
+	 (" $db") true;;
+	 (*)
+		sudo -u postgres psql template1 -a -f - <<-EOF
+			\set ON_ERROR_STOP on
+			CREATE DATABASE $db WITH OWNER=$db_user;
+			EOF
+		;;
+	 esac
+	sudo -u postgres psql template1 -a -f - <<-EOF
+		\set ON_ERROR_STOP on
+		GRANT ${db}_role TO $db_user;
 		REVOKE ALL ON DATABASE $db FROM public;
 		EOF
  }
 rule_postgresql_db_user_add () { # SYNTAX: $db $user
 	local db="$1" user="$2"
-	sudo -u postgresql psql template1 -f - <<-EOF
-		CREATE ROLE $user NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT LOGIN ENCRYPTED;
+	sudo -u postgres psql template1 -a -f - <<-EOF
+		\set ON_ERROR_STOP on
+		DO LANGUAGE plpgsql \$\$
+		BEGIN
+			IF NOT EXISTS (
+			 SELECT *
+			 FROM pg_catalog.pg_user
+			 WHERE usename = '$user'
+			 LIMIT 1
+			) THEN
+				CREATE ROLE $user
+				 LOGIN
+				 NOCREATEDB
+				 NOCREATEROLE
+				 NOINHERIT
+				 NOSUPERUSER;
+			END IF;
+		END;
+		\$\$;
 		GRANT USAGE ON SCHEMA public TO $user;
 		GRANT CONNECT,TEMPORARY ON DATABASE $db TO $user;
 		GRANT $db TO $user;
@@ -1274,10 +1362,14 @@ rule_postgresql_db_user_add () { # SYNTAX: $db $user
  }
 rule_openerp_configure () {
 	sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
-		deb http://nightly.openerp.com/trunk/nightly/deb/ ./
+		deb http://nightly.openerp.com/7.0/nightly/deb/ ./
 		EOF
+	sudo install -d -m 1777 -o root -g root \
+	 /etc/openerp
 	sudo apt-get update
-	rule apt_get_install openerp
+	rule apt_get_install openerp --force-yes
+		# XXX: --force-yes car les paquets de nightly.openerp.com
+		#      ne sont pas signés par OpenPGP..
  }
 rule_postgrey_configure () {
 	rule apt_get_install postgrey
@@ -1299,38 +1391,59 @@ rule_runit_configure () { # SYNTAX: $service
 	local -; set +f
 	for sv in ${1-/etc/service/*}
 	 # NOTE: stoppe les services en retenant leur status de départ
-	 do sv=$(basename "$sv")
+	 do sv=${sv##*/}
 		local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
 		local sv_status
 		IFS= read -r sv_status_$sv_hash <<-EOF
-			$(sudo sv status "$sv")
+			$(sudo sv status "$sv" || true)
 			EOF
 		sudo rm -f /etc/service/"$sv"
 	 done
-	for sv in ${1-"$tool"/etc/sv/*}
+	set -$- ${1-"$tool"/etc/sv/*}
+	while test -n "$*"
 	 # NOTE: configure et (re-)démarre les services
-	 do sv=$(basename "$sv")
-		local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
-		sudo install -d -m 770 -o root -g root \
-		 /etc/sv/"$sv"
-		sudo install -m 770 -o root -g root \
-		 "$tool"/etc/sv/"$sv"/run \
-		        /etc/sv/"$sv"/run
-		if test -e "$tool"/etc/sv/"$sv"/log/run
-		 then
+	 do local first=yes
+		for sv in "$@"
+		do sv=${sv##*/}
+			case $first in
+			 (yes) shift $#; first=;;
+			 esac
+			local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
 			sudo install -d -m 770 -o root -g root \
-			 /etc/sv/"$sv"/log
+			 /etc/sv/"$sv"
 			sudo install -m 770 -o root -g root \
-			 "$tool"/etc/sv/"$sv"/log/run \
-			        /etc/sv/"$sv"/log/run
-		 fi
-		test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
-		.         "$tool"/etc/sv/"$sv"/configure.sh
-		sudo ln -fns ../sv/"$sv" /etc/service/"$sv"
-		eval local sv_status=\"\${sv_status_$sv_hash-}\"
-		case $sv_status in
-		 ("") true;;
-		 (run:*) sudo sv restart "$sv";;
+			 "$tool"/etc/sv/"$sv"/run \
+			        /etc/sv/"$sv"/run
+			if test -e "$tool"/etc/sv/"$sv"/log/run
+			 then
+				sudo install -d -m 770 -o root -g root \
+				 /etc/sv/"$sv"/log
+				sudo install -m 770 -o root -g root \
+				 "$tool"/etc/sv/"$sv"/log/run \
+				        /etc/sv/"$sv"/log/run
+			 fi
+			local continue=
+			test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
+			.         "$tool"/etc/sv/"$sv"/configure.sh
+			case $continue in
+			 (yes) continue;;
+			 esac
+			sudo ln -fns ../sv/"$sv" /etc/service/"$sv"
+			eval local sv_status=\"\${sv_status_$sv_hash-}\"
+			case $sv_status in
+			 ("") true;;
+			 (fail:*) sleep 1 && sudo sv start "$sv";;
+			 (run:*) rule runit_sv_restart "$sv";;
+			 esac
+		 done
+	 done
+ }
+rule_runit_sv_restart () { # SYNTAX: $sv
+	local sv="$1"
+	while true
+	 do case $(sudo sv restart "$sv") in
+		 ("fail: $sv: runsv not running") sleep 1;;
+		 (*) break;;
 		 esac
 	 done
  }