X-Git-Url: https://git.cyclocoop.org/?a=blobdiff_plain;f=vm_remote;h=c167f30adaec6a761e73e8f0bc08993d316546d5;hb=399e114e11dac0cd1d5e340e5c4a1db5725a85e5;hp=467d52875c6010794593f240ee15d3fa6b0841d3;hpb=82f0ba3e09ca73635984d0592bc44fef88b391c3;p=lhc%2Fateliers.git diff --git a/vm_remote b/vm_remote index 467d528..c167f30 100755 --- a/vm_remote +++ b/vm_remote @@ -57,18 +57,12 @@ rule__ssh_known_hosts_update () { whoami } -rule__x509_service_key_send_deciphered () { # SYNTAX: $service $remote_destination ${ssh_options-} - local service="$1"; shift - local remote_destination="$1"; shift - gpg --decrypt "var/sec/x509/$vm_domainname/$service/key.pass.gpg" | +rule__x509_site_key_decrypt () { # SYNTAX: $site + local site="$1"; shift + gpg --decrypt "$tool"/var/sec/x509/"$site"/key.pass.gpg | openssl rsa -passin 'stdin' \ - -in "var/sec/x509/$vm_domainname/$service/key.pem" \ - -out '/dev/stdout' | - rule ssh "$@" ' \ - install -m 400 -o root -g root \ - /dev/stdin \ - '"$remote_destination"' \ - ' + -in var/sec/x509/"$site"/key.pem \ + -out '/dev/stdout' } rule_luks_key_send () { # DESCRIPTION: envoie la clef de déchiffrement des partitions au démarrage de la VM. @@ -100,34 +94,28 @@ rule_luks_key_backup () { # SYNTAX: ${gpg_options:---recipient $USER@} DESCRIPTI rule_apache2_key_send () { local -; set +f - for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf - do conf=${conf#"$tool"/etc/apache2/site.d/} - local port domain - IFS=. read -r port domain <<-EOF - ${conf%\/VirtualHost\.conf} - EOF - assert 'test "${port:+set}"' - assert 'test "${domain:+set}"' - local site="$port.$domain" - case $port in - (443) - rule ssh -l root ' \ - sudo install -d -m 770 -o '"$user"' -g '"$user"' \ - /etc/apache2 \ - /etc/apache2/site.d/'"$site"' \ - /etc/apache2/site.d/'"$site"'/x509; \ - sudo install -m 644 -o '"$user"' -g '"$user"' /dev/stdin \ - /etc/apache2/site.d/'"$site"'/x509/.gitignore <<-EOF - key.pem - EOF - ' - rule _x509_service_key_send_deciphered $service \ - /etc/apache2/"$site"/x509/key.pem -l root "$@" - ;; - esac + for conf in "$tool"/etc/nginx/site.d/*/key_send + do conf=${conf#"$tool"/etc/nginx/site.d/} + local site=${conf%/key_send} + rule _x509_site_key_decrypt \ + "$(cat "$tool"/etc/apache2/site.d/"$site"/key_send)" | + rule ssh -l root ' \ + sudo install -d -m 770 -o '"$user"' -g '"$user"' \ + /etc/apache2 \ + /etc/apache2/x509.d \ + /etc/apache2/x509.d/'"$site"'; \ + sudo install -m 644 -o '"$user"' -g '"$user"' /dev/stdin \ + /etc/apache2/x509.d/'"$site"'/.gitignore <<-EOF + key.pem + EOF + sudo install -m 400 -o root -g root \ + /dev/stdin \ + /etc/apache2/x509.d/'"'$site'"'/key.pem + ' done } rule_dovecot_key_send () { + rule _x509_site_key_decrypt imap."$vm_domainname" | rule ssh -l root ' \ sudo install -d -m 770 -o root -g root \ /etc/dovecot/'"$vm_domainname"'/ \ @@ -137,9 +125,10 @@ rule_dovecot_key_send () { /etc/dovecot/'"$vm_domainname"'/imap/x509/.gitignore <<-EOF key.pem EOF + sudo install -m 400 -o root -g root \ + /dev/stdin \ + /etc/dovecot/"$vm_domainname"/imap/x509/key.pem ' - rule _x509_service_key_send_deciphered imap \ - /etc/dovecot/$vm_domainname/$service/x509/key.pem -l root "$@" } rule_gitolite_configure () { ( @@ -154,35 +143,28 @@ rule_gitolite_configure () { } rule_nginx_key_send () { local -; set +f - for conf in "$tool"/etc/nginx/site.d/*/server.conf + for conf in "$tool"/etc/nginx/site.d/*/key_send do conf=${conf#"$tool"/etc/nginx/site.d/} - local port domain - IFS=. read -r port domain <<-EOF - ${conf%\/server\.conf} - EOF - assert 'test "${port:+set}"' - assert 'test "${domain:+set}"' - local site="$port.$domain" - case $port in - (443) - rule ssh -l root ' \ - sudo install -d -m 770 -o root -g root \ - /etc/nginx \ - /etc/nginx/site.d \ - /etc/nginx/site.d/'"$site"' \ - /etc/nginx/site.d/'"$site"'/x509; \ - sudo install -m 644 -o root -g root /dev/stdin \ - /etc/nginx/site.d/'"$site"'/x509/.gitignore <<-EOF - key.pem - EOF - ' - rule _x509_service_key_send_deciphered $service \ - /etc/nginx/"$site"/x509/key.pem -l root "$@" - ;; - esac + local site=${conf%/key_send} + rule _x509_site_key_decrypt \ + "$(cat "$tool"/etc/nginx/site.d/"$site"/key_send)" | + rule ssh -l root ' \ + sudo install -d -m 770 -o root -g root \ + /etc/nginx \ + /etc/nginx/x509.d \ + /etc/nginx/x509.d/'"'$site'"'; \ + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/nginx/x509.d/'"'$site'"'/.gitignore <<-EOF + key.pem + EOF + sudo install -m 400 -o root -g root \ + /dev/stdin \ + /etc/nginx/x509.d/'"'$site'"'/key.pem + ' done } rule_postfix_key_send () { + rule _x509_site_key_decrypt smtpd."$vm_domainname" | rule ssh -l root ' \ sudo install -d -m 770 -o root -g root \ /etc/postfix/'"$vm_domainname"'/ \ @@ -196,9 +178,10 @@ rule_postfix_key_send () { /etc/postfix/'"$vm_domainname"'/smtpd/x509/.gitignore <<-EOF key.pem EOF + install -m 400 -o root -g root \ + /dev/stdin \ + /etc/postfix/'"'$vm_domainname'"'/smtpd/x509/key.pem ' - rule _x509_service_key_send_deciphered smtpd \ - /etc/postfix/$vm_domainname/smtpd/x509/key.pem -l root "$@" } rule=${1:-help}