ateliers_host

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3
   4 tool=${0%/*}
   5 . "$tool"/env.sh
   6 . "$tool"/inc.sh
   7
   8 rule_help () {
   9         cat >&2 <<-EOF
  10                 DESCRIPTION: ce script regroupe des fonctions utilitaires
  11                              pour gérer la VM des ateliers _depuis_ son hôte ;
  12                              il sert à la fois d'outil et de documentation.
  13                              Voir \`$tool/ateliers_hosted' pour les utilitaires côté VM hébergée.
  14                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  15                 RULES:
  16                 $(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$tool"/env.sh "$0")
  17                 ENVIRONMENT:
  18                   TRACE # affiche les commandes avant leur exécution
  19                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
  20                 EOF
  21  }
  22
  23 readonly vm_dev_disk=/dev/mapper/domU-$(printf %s "$vm_fqdn-disk" | sed -e 's/-/--/g')
  24 readonly vm_dev_disk_boot="${vm_dev_disk}1"
  25
  26 rule_xen_config_init () {
  27         sudo tee /etc/xen/$vm_fqdn.cfg <<-EOF
  28                 #  -*- mode: python; -*-
  29                 import os, re
  30                 name         = "$vm_fqdn"
  31                 arch         = os.uname()[4]
  32                 memory       = 2048
  33                 vcpus        = 1
  34                 vif          = ['mac=$vm_mac,bridge=$vm_bridge']
  35                 disk         = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
  36                 kernel       = "/usr/lib/xen-4.0/boot/hvmloader"
  37                 builder      = 'hvm'
  38                 device_model = 'qemu-dm'
  39                 acpi         = 1
  40                 apic         = 1
  41                 # boot on floppy (a), hard disk (c) or CD-ROM (d)
  42                 #boot         = 'd'
  43
  44                 #vnc        = 1
  45                 #sdl        = 0
  46                 #vncconsole = 0
  47                 #vnclisten  = "0.0.0.0"
  48                 #vncpasswd  = ""
  49                 #usbdevice  = 'tablet'
  50
  51                 keymap      = 'fr'
  52                 serial      = 'pty'
  53                 on_poweroff = 'destroy'
  54                 on_reboot   = 'restart'
  55                 on_crash    = 'restart'
  56                 EOF
  57  }
  58 rule_xen_on () {
  59         sudo xm create $vm_fqdn.cfg
  60  }
  61 rule_xen_off () {
  62         sudo xm shutdown $vm_fqdn.cfg
  63  }
  64
  65 rule_disk_mount () { # DESCRIPTION: montage du disque de la VM depuis l'hôte
  66         sudo kpartx -a -v /dev/domU/$vm_fqdn-disk
  67         #sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
  68  }
  69 rule_disk_umount () { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
  70         rule_part_boot_umount
  71         case $vm_use_lvm in
  72          (yes)
  73                 rule_part_lvm_umount
  74                 ;;
  75          (no)
  76                 rule_part_root_umount
  77                 rule_part_var_umount
  78                 rule_part_home_umount
  79                 ;;
  80          (*) exit 1;;
  81          esac
  82         sudo kpartx -d -v /dev/domU/$vm_fqdn-disk
  83         #sudo xm block-detach 0 $vm_dev_disk
  84         # XXX: DANGEREUX ; si jamais il bloque parce que le disque était encore utilisé :
  85         #      utiliser xm block-detach 0 $vm_dev_disk --force ;
  86         #      ôter les éventuels mappages LVM concernés avec dmsetup table et dmsetup remove --force ;
  87         #      ôter les mappages concernés dans /etc/lvm/cache/.cache,
  88         #      et pour bien trouver tous les mappages :
  89         #        % sudo find /dev -type l -exec sh -c 'printf "%s -> " "$@"; readlink "$@"' - {} \; | grep $vm_dev_disk
  90         #      enfin, ôter l'éventuel verrou dans /var/lock/lvm/
  91  }
  92
  93 case $vm_use_lvm in
  94  (no)
  95         readonly vm_dev_disk_swap="${vm_dev_disk}5"
  96         readonly vm_dev_disk_root="${vm_dev_disk}6"
  97         readonly vm_dev_disk_var="${vm_dev_disk}7"
  98         readonly vm_dev_disk_home="${vm_dev_disk}8"
  99         ;;
 100  (yes)
 101         readonly vm_lvm_pv="${vm_dev_disk}2"
 102         readonly vm_dev_disk_swap=/dev/$vm_lvm_vg/${vm_lvm_lv}_swap
 103         readonly vm_dev_disk_root=/dev/$vm_lvm_vg/${vm_lvm_lv}_root
 104         readonly vm_dev_disk_var=/dev/$vm_lvm_vg/${vm_lvm_lv}_var
 105         readonly vm_dev_disk_home=/dev/$vm_lvm_vg/${vm_lvm_lv}_home
 106         ;;
 107  (*)
 108         exit 1;;
 109  esac
 110
 111 rule_disk_format () { # DESCRIPTION: partitionnage du disque de la VM
 112         case $vm_use_lvm in
 113         (no)
 114                 sudo sfdisk $vm_dev_disk <<-EOF
 115                         # partition table of $vm_dev_disk
 116                         unit: sectors
 117
 118                         ${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
 119                         ${vm_dev_disk}2 : start=   498015, size=418927005, Id= 5
 120                         ${vm_dev_disk}3 : start=        0, size=        0, Id= 0
 121                         ${vm_dev_disk}4 : start=        0, size=        0, Id= 0
 122                         ${vm_dev_disk}5 : start=   498078, size=  1959867, Id=82
 123                         ${vm_dev_disk}6 : start=  2458008, size= 29302497, Id=83
 124                         ${vm_dev_disk}7 : start= 31760568, size=  9767457, Id=83
 125                         ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
 126                 EOF
 127                 ;;
 128         (yes)
 129                 sudo sfdisk $vm_dev_disk <<-EOF
 130                         # partition table of $vm_dev_disk
 131                         unit: sectors
 132
 133                         ${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
 134                         ${vm_dev_disk}2 : start=   498015, size=418927005, Id=8E
 135                         EOF
 136                 ;;
 137         (*) exit 1;;
 138          esac
 139         #sudo partprobe $vm_dev_disk
 140         sudo kpartx -u -v /dev/domU/$vm_fqdn-disk
 141  }
 142
 143 rule_part_lvm_format () {
 144         rule_part_lvm_umount
 145         ! sudo vgs | grep -q "^  $vm_lvm_vg " ||
 146         sudo vgremove $vm_lvm_vg
 147         sudo pvcreate --dataalignment 512k $vm_lvm_pv
 148         sudo vgcreate --dataalignment 512k $vm_lvm_vg $vm_lvm_pv
 149         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_swap -L  1G     $vm_lvm_vg
 150         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_root -L 15G     $vm_lvm_vg
 151         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_var  -L  5G     $vm_lvm_vg
 152         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_home -l 99%FREE $vm_lvm_vg
 153         rule_part_lvm_umount
 154  }
 155 rule_part_lvm_mount () {
 156         sudo vgchange -a y $vm_lvm_vg
 157         sudo lvchange -a y $vm_lvm_lv
 158  }
 159 rule_part_lvm_umount () {
 160         rule_part_root_umount
 161         rule_part_var_umount
 162         rule_part_home_umount
 163         if sudo vgs | grep -q "^  $vm_lvm_vg "
 164          then
 165                 sudo lvchange -a n $vm_lvm_vg
 166                 sudo vgchange -a n $vm_lvm_vg
 167          fi
 168  }
 169
 170 rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
 171         local part=$1
 172         eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
 173  }
 174 rule_part_randomize_stat () { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_clean
 175         local part=$1
 176         eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
 177  }
 178 rule__part_encrypted_format () { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
 179  # NOTE: la clef de chiffrement est dérivée de celle de /,
 180  #       / doit être déchiffrée pour que cela fonctionne.
 181         local part=$1
 182         eval "local dev=\$vm_dev_disk_$part"
 183         test ! -e /dev/mapper/${vm}_root_deciphered ||
 184         sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
 185         cryptsetup luksFormat --hash=sha512 --key-size=512 \
 186          --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev"
 187  }
 188 rule__part_encrypted_mount () { # SYNTAX: $part
 189         local part=$1
 190         eval "local dev=\$vm_dev_disk_$part"
 191         test -e /dev/mapper/${vm}_${part}_deciphered ||
 192         sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
 193         cryptsetup luksOpen --key-file=- $dev ${vm}_${part}_deciphered"
 194  }
 195 rule__part_encrypted_umount () { # SYNTAX: $part
 196         local part=$1
 197         eval "local dev=\$vm_dev_disk_$part"
 198         test ! -e     /dev/mapper/${vm}_${part}_deciphered ||
 199         sudo cryptsetup luksClose ${vm}_${part}_deciphered
 200  }
 201
 202 rule_part_root_format () {
 203         if ! mount | grep -q "^$vm_dev_disk_root "
 204          then
 205                 sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
 206                  --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $vm_dev_disk_root
 207                 sudo cryptsetup luksOpen --key-file=- $vm_dev_disk_root ${vm}_root_deciphered
 208                 sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
 209                  -E resize=30G${vm_e2fs_extended_options} \
 210                  -L ${vm}_root \
 211                  /dev/mapper/${vm}_root_deciphered
 212                 ! mountpoint -q /mnt/$vm_fqdn
 213                 sudo mount -v /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
 214                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/boot
 215                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/dev
 216                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/home
 217                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/proc
 218                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/sys
 219                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/var
 220                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/root
 221                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/root/tool
 222                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/root/tool/ateliers
 223                 sudo umount -v /mnt/$vm_fqdn
 224                 sudo cryptsetup luksClose ${vm}_root_deciphered
 225          fi
 226  }
 227 rule_part_root_mount () {
 228         test -e /dev/mapper/${vm}_root_deciphered ||
 229         sudo cryptsetup luksOpen $vm_dev_disk_root ${vm}_root_deciphered
 230         mountpoint -q /mnt/$vm_fqdn ||
 231         sudo mount -v -t ext4 /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
 232  }
 233 rule_part_root_umount () {
 234         ! mountpoint -q /mnt/$vm_fqdn ||
 235         sudo umount -v  /mnt/$vm_fqdn
 236         ! test -e     /dev/mapper/${vm}_root_deciphered ||
 237         sudo cryptsetup luksClose ${vm}_root_deciphered
 238  }
 239 rule_part_root_backup_luks () {
 240         sudo cryptsetup luksHeaderBackup $vm_dev_disk_root --header-backup-file ./root.luks
 241  }
 242 rule_part_swap_format () {
 243         rule__part_encrypted_format swap
 244         rule__part_encrypted_mount  swap
 245         sudo mkswap -f -L ${vm}_swap /dev/mapper/${vm}_swap_deciphered
 246         rule__part_encrypted_umount swap
 247  }
 248 rule_part_boot_format () {
 249         mount | grep -q "^$vm_dev_disk_boot " ||
 250         sudo mke2fs -t ext2 -c -c -m 5 -T small \
 251          -E resize=1G${vm_e2fs_extended_options} \
 252          -L ${vm}_boot $vm_dev_disk_boot
 253  }
 254 rule_part_boot_mount () {
 255         mountpoint -q /mnt/$vm_fqdn
 256         test -d /mnt/$vm_fqdn/boot
 257         mountpoint -q                           /mnt/$vm_fqdn/boot ||
 258         sudo mount -v -t ext2 $vm_dev_disk_boot /mnt/$vm_fqdn/boot
 259  }
 260 rule_part_boot_umount () {
 261         ! mountpoint -q /mnt/$vm_fqdn/boot ||
 262         sudo umount -v  /mnt/$vm_fqdn/boot
 263  }
 264 rule_part_var_format () {
 265         rule__part_encrypted_format var
 266         rule__part_encrypted_mount  var
 267         sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
 268          -E resize=10G${vm_e2fs_extended_options} \
 269          -L ${vm}_var \
 270          /dev/mapper/${vm}_var_deciphered
 271         rule__part_encrypted_umount var
 272  }
 273 rule_part_var_mount () {
 274         rule__part_encrypted_mount var
 275         mountpoint -q /mnt/$vm_fqdn/var ||
 276         sudo mount -v -t ext4 /dev/mapper/${vm}_var_deciphered /mnt/$vm_fqdn/var
 277  }
 278 rule_part_var_umount () {
 279         ! mountpoint -q /mnt/$vm_fqdn/var ||
 280         sudo umount -v  /mnt/$vm_fqdn/var
 281         rule__part_encrypted_umount var
 282  }
 283 rule_part_home_format () {
 284         rule__part_encrypted_format home
 285         rule__part_encrypted_mount  home
 286         sudo mke2fs -t ext4 -c -c -m 0 -T ext4 -b $vm_e2fs_block_size \
 287          -E resize=400G${vm_e2fs_extended_options} \
 288          -L ${vm}_home \
 289          /dev/mapper/${vm}_home_deciphered
 290          # NOTE: -O quota pas supporté par e2fsprogs/squeeze
 291         rule__part_encrypted_umount home
 292  }
 293 rule_part_home_mount () {
 294         rule__part_encrypted_mount home
 295         mountpoint -q /mnt/$vm_fqdn/home ||
 296         sudo mount -v -t ext4 /dev/mapper/${vm}_home_deciphered /mnt/$vm_fqdn/home
 297  }
 298 rule_part_home_umount () {
 299         ! mountpoint -q /mnt/$vm_fqdn/home ||
 300         sudo umount -v  /mnt/$vm_fqdn/home
 301         rule__part_encrypted_umount home
 302  }
 303
 304 rule_debian_install () {
 305         rule_part_root_mount
 306         rule_part_boot_mount
 307         rule_part_var_mount
 308         sudo DEBOOTSTRAP_DIR=/usr/share/debootstrap/ debootstrap \
 309          --arch=$vm_arch --verbose --keyring=/usr/share/keyrings/debian-archive-keyring.gpg \
 310          --exclude=vim-tiny \
 311          --include=$(printf '%s,' \
 312                  acl \
 313                  bsdmainutils \
 314                  busybox \
 315                  ca-certificates \
 316                  console-setup \
 317                  cryptsetup \
 318                  dash \
 319                  dnsutils \
 320                  dropbear \
 321                  etckeeper \
 322                  hashalot \
 323                  htop \
 324                  ifupdown \
 325                  initramfs-tools \
 326                  kbd \
 327                  less \
 328                  mosh \
 329                  ncurses-term \
 330                  openssh-client \
 331                  openssh-server \
 332                  openssl \
 333                  pciutils \
 334                  procps \
 335                  quota \
 336                  quotatool \
 337                  rsync \
 338                  screen \
 339                  sudo \
 340                  sysprofile \
 341                  vim-nox \
 342                  wget \
 343                  zsh \
 344          ) \
 345          $vm_lsb_name /mnt/$vm_fqdn/ \
 346          http://ftp.fr.debian.org/debian/
 347  }
 348 rule_chroot () {
 349         rule_part_root_mount
 350         rule_part_boot_mount
 351         rule_part_var_mount
 352         #rule_part_home_mount
 353         mountpoint -q /mnt/$vm_fqdn/proc ||
 354         sudo mount -t proc proc /mnt/$vm_fqdn/proc
 355         mountpoint -q /mnt/$vm_fqdn/sys ||
 356         sudo mount -t sysfs sys /mnt/$vm_fqdn/sys
 357         mountpoint -q /mnt/$vm_fqdn/dev ||
 358         sudo mount --bind /dev /mnt/$vm_fqdn/dev
 359         mountpoint -q /mnt/$vm_fqdn/root/tool/ateliers ||
 360         sudo mount --bind "$tool" /mnt/$vm_fqdn/root/tool/ateliers
 361         sudo chroot /mnt/$vm_fqdn /bin/dash || true
 362         rule__chroot_clean
 363  }
 364 rule__chroot_clean () {
 365         ! sudo mountpoint -q /mnt/$vm_fqdn/root/tool/ateliers ||
 366         sudo umount -v /mnt/$vm_fqdn/root/tool/ateliers
 367         ! mountpoint -q /mnt/$vm_fqdn/dev ||
 368         sudo umount -v /mnt/$vm_fqdn/dev
 369         ! mountpoint -q /mnt/$vm_fqdn/sys ||
 370         sudo umount -v /mnt/$vm_fqdn/sys
 371         ! mountpoint -q /mnt/$vm_fqdn/proc ||
 372         sudo umount -v /mnt/$vm_fqdn/proc
 373         rule_part_home_umount
 374         rule_part_var_umount
 375         rule_part_boot_umount
 376         rule_part_root_umount
 377  }
 378
 379 rule=${1:-help}
 380 ${1+shift}
 381 set "${TRACE:+-x}"
 382 rule_$rule "$@"