X-Git-Url: https://git.cyclocoop.org/?a=blobdiff_plain;f=vm_hosted;h=f1670ba1dfa1f861804539c2e6e65aaec48fcec0;hb=ee0303a5c9eda65949857d0d192c5910cd41f1e2;hp=a793041250965f70df73d1211274a0b252bafe06;hpb=ac6452c7821434c9750210bf75a95e51d876dc3d;p=lhc%2Fateliers.git

diff --git a/vm_hosted b/vm_hosted
index a793041..f1670ba 100755
--- a/vm_hosted
+++ b/vm_hosted
@@ -287,11 +287,18 @@ rule_boot_configure () {
 		EOF
 	sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
 	rule initramfs_configure
+	rule apt_get_install molly-guard
+	sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
+		ALWAYS_QUERY_HOSTNAME=true
+		 # NOTE: une alternative est de dire à sudo de conserver les SSH_*
+		 #       néamoins demander tout le temps n'est pas trop contraignant
+		 #       et davantage sécurisant.
+		EOF
  }
 rule_dovecot_configure () {
 	rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve
 	local hint="run vm_remote dovecot_key_send before"
-	assert "test -f /etc/dovecot/$vm_domainname/imap/x509/key.pem" hint
+	assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint
 	sudo install -m 400 -o root -g root \
 	     "$tool"/var/pub/x509/$vm_domainname/imap/crt+crl.self-signed.pem \
 	 /etc/dovecot/$vm_domainname/imap/x509/crt+crl.self-signed.pem
@@ -390,7 +397,6 @@ rule_filesystem_configure () {
 		LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0
 		proc /proc proc defaults 0 0
 		sysfs /sys sysfs defaults 0 0
-		tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0
 		/dev/mapper/${vm_lvm_lv}_root_deciphered /     ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
 		/dev/mapper/${vm_lvm_lv}_var_deciphered  /var  ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
 		/dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0
@@ -404,10 +410,24 @@ rule_filesystem_configure () {
 		${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
 		${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
 		EOF
-	sudo install -m 644 -o root -g root /dev/stdin /etc/sysctl.d/local-swap.conf <<-EOF
-		vm.swappiness = 10 # NOTE: n'utilise le swap qu'en cas d'absolue nécessité
-		vm.vfs_cache_pressure=50
+	sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
+		LOCK_SIZE=5242880 # NOTE: 5MiB
+		RAMLOCK=yes
+		RAMSHM=yes
+		RAMTMP=yes
+		RUN_SIZE=10%
+		SHM_SIZE=
+		TMP_MODE=1777,nr_inodes=1000k,noatime
+		TMP_OVERFLOW_LIMIT=1024
+		 # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
+		 #       on the root filesystem (overriding RAMTMP).
+		TMP_SIZE=200m
+		TMPFS_SIZE=20%VM
 		EOF
+	sudo install -m 775 -o root -g root \
+	 "$tool"/etc/init.d/tmpfs \
+	        /etc/init.d/tmpfs
+	sudo update-rc.d tmpfs defaults
  }
 rule_initramfs_configure () {
 	sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
@@ -481,16 +501,6 @@ rule_locale_configure () {
 	sudo update-locale
  }
 rule_login_configure () {
-	grep -q '^hvc0$' /etc/securetty ||
-	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
-		$(cat /etc/securetty)
-		hvc0
-		EOF
-	grep -q '^xvc0$' /etc/securetty ||
-	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
-		$(cat /etc/securetty)
-		xvc0
-		EOF
 	sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF
 		# /etc/inittab: init(8) configuration.
 		
@@ -576,6 +586,16 @@ rule_login_configure () {
 		$(cat /etc/pam.d/common-session)
 		session optional pam_umask.so
 		EOF
+	grep -q '^hvc0$' /etc/securetty ||
+	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+		$(cat /etc/securetty)
+		hvc0
+		EOF
+	grep -q '^xvc0$' /etc/securetty ||
+	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+		$(cat /etc/securetty)
+		xvc0
+		EOF
  }
 rule_mail_configure () {
 	rule postfix_configure
@@ -1008,6 +1028,16 @@ rule_ssh_configure () {
 		EOF
 	sudo service ssh restart
  }
+rule_sysctl_configure () {
+	local -; set +f
+	for conf in "$tool"/etc/sysctl.d/*.conf
+	 do conf=${conf#"$tool"/etc/sysctl.d/}
+		sudo install -m 660 -o root -g root \
+		 "$tool"/etc/sysctl.d/"$conf" \
+		 /etc/sysctl.d/"$conf"
+	 done
+	sudo sysctl --system
+ }
 rule_user_add () { # SYNTAX: $user
 	rule user_configure
 	local user=$1
@@ -1125,6 +1155,7 @@ rule_configure () {
 	rule ssh_configure
 	rule user_root_configure
 	rule boot_configure
+	rule sysctl_configure
 	rule user_configure
 	rule mail_configure
 	#rule apache2_configure