ateliers_host

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3
   4 tool=${0%/*}
   5 . "$tool"/env.sh
   6
   7 rule_help () {
   8         cat >&2 <<-EOF
   9                 DESCRIPTION: ce script regroupe des fonctions utilitaires
  10                              pour gérer la VM des ateliers _depuis_ son hôte ;
  11                              il sert à la fois d'outil et de documentation.
  12                              Voir \`$tool/ateliers_hosted' pour les utilitaires côté VM hébergée.
  13                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  14                 RULES:
  15                 $(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$0")
  16                 ENVIRONMENT:
  17                   TRACE # affiche les commandes avant leur exécution
  18                 $(sed -ne 's/^readonly \([^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
  19                 EOF
  20  }
  21
  22 readonly vm_dev_disk="/dev/xvda"
  23 readonly vm_dev_disk_boot="${vm_dev_disk}1"
  24 readonly vm_dev_disk_swap="${vm_dev_disk}5"
  25 readonly vm_dev_disk_root="${vm_dev_disk}6"
  26 readonly vm_dev_disk_var="${vm_dev_disk}7"
  27 readonly vm_dev_disk_home="${vm_dev_disk}8"
  28
  29 rule_xen_config_init () {
  30         sudo tee /etc/xen/$vm_fqdn.cfg <<-EOF
  31                 #  -*- mode: python; -*-
  32                 import os, re
  33                 name         = "$vm_fqdn"
  34                 arch         = os.uname()[4]
  35                 memory       = 2048
  36                 vcpus        = 1
  37                 vif          = ['mac=$vm_mac,bridge=$vm_bridge']
  38                 disk         = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
  39                 kernel       = "/usr/lib/xen-4.0/boot/hvmloader"
  40                 builder      = 'hvm'
  41                 device_model = 'qemu-dm'
  42                 acpi         = 1
  43                 apic         = 1
  44                 # boot on floppy (a), hard disk (c) or CD-ROM (d)
  45                 #boot         = 'd'
  46
  47                 #vnc        = 1
  48                 #sdl        = 0
  49                 #vncconsole = 0
  50                 #vnclisten  = "0.0.0.0"
  51                 #vncpasswd  = ""
  52                 #usbdevice  = 'tablet'
  53
  54                 keymap      = 'fr'
  55                 serial      = 'pty'
  56                 on_poweroff = 'destroy'
  57                 on_reboot   = 'restart'
  58                 on_crash    = 'restart'
  59                 EOF
  60  }
  61 rule_xen_on () {
  62         sudo xm create $vm_fqdn.cfg
  63  }
  64 rule_xen_off () {
  65         sudo xm shutdown $vm_fqdn.cfg
  66  }
  67
  68 rule_disk_mount () { # DESCRIPTION: montage du disque de la VM depuis l'hôte
  69         test -e $vm_dev_disk ||
  70         sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
  71         # NOTE: on pourrait utiliser kpartx à la place je pense ; détail.
  72  }
  73 rule_disk_umount () { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
  74         mountpoint /mnt/$vm_fqdn ||
  75         sudo xm block-detach 0 $vm_dev_disk
  76  }
  77 rule_disk_part () { # DESCRIPTION: partitionage du disque de la VM
  78  # NOTE: on fait le choix de ne pas utiliser LVM sur la machine virtuelle car :
  79  # - pour l'extension de mémoire:
  80  #   1. on créera une nouvelle partition sur le LVM de l'hôte
  81  #   2. on l'ajoutera comme un disque supplémentaire dans /etc/xen/$vm_fqdn.cfg
  82  #   3. on le montera sur /home2 en pensant à changer DHOME=/home2 dans /etc/adduser.conf
  83  # - pour la sauvegarde: LVM snapshoot est trop
  84  #   1. sauvegarde au niveau applicatif (pgdump, mysqldump)
  85  #   2. sauvegarde des configurations (etckeeper, git)
  86  #   3. sauvegarde incrémentale et chiffrée des autres fichiers (duplicity)
  87         sudo sfdisk -d $vm_dev_disk <<-EOF
  88                 # partition table of $vm_dev_disk
  89                 unit: sectors
  90
  91                 ${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
  92                 ${vm_dev_disk}2 : start=   498015, size=418927005, Id= 5
  93                 ${vm_dev_disk}3 : start=        0, size=        0, Id= 0
  94                 ${vm_dev_disk}4 : start=        0, size=        0, Id= 0
  95                 ${vm_dev_disk}5 : start=   498078, size=  1959867, Id=82
  96                 ${vm_dev_disk}6 : start=  2458008, size= 29302497, Id=83
  97                 ${vm_dev_disk}7 : start= 31760568, size=  9767457, Id=83
  98                 ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
  99         EOF
 100  }
 101
 102 rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
 103         local part=$1
 104         eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
 105  }
 106 rule_part_randomize_stat () { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_clean
 107         local part=$1
 108         eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
 109  }
 110 rule__part_encrypted_format () { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
 111  # NOTE: la clef de chiffrement est dérivée de celle de /,
 112  #       / doit être déchiffrée pour que cela fonctionne.
 113         local part=$1
 114         eval "local dev=\$vm_dev_disk_$part"
 115         test ! -e /dev/mapper/${vm}_root_deciphered ||
 116         sudo /lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
 117         sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
 118          --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev
 119  }
 120 rule__part_encrypted_mount () { # SYNTAX: $part
 121         local part=$1
 122         eval "local dev=\$vm_dev_disk_$part"
 123         test ! -e /dev/mapper/${vm}_root_deciphered ||
 124         sudo /lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
 125         sudo cryptsetup luksOpen --key-file=- $dev ${vm}_${part}_deciphered
 126  }
 127 rule__part_encrypted_umount () { # SYNTAX: $part
 128         local part=$1
 129         eval "local dev=\$vm_dev_disk_$part"
 130         test ! -e     /dev/mapper/${vm}_${part}_deciphered ||
 131         sudo cryptsetup luksClose ${vm}_${part}_deciphered
 132  }
 133 rule_part_root_format () {
 134         if ! mount | grep -q "^$vm_dev_disk_root "
 135          then
 136                 sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
 137                  --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $vm_dev_disk_root
 138                 sudo cryptsetup luksOpen --key-file=- $vm_dev_disk_root ${vm}_root_deciphered
 139                 sudo mkfs.ext4 -m 5 -T ext4 -L ${vm}_root -E stripe_width=32,resize=15G \
 140                  /dev/mapper/${vm}_root_deciphered
 141                 ! mountpoint /mnt/$vm_fqdn
 142                 sudo mount -v /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
 143                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/boot
 144                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/dev
 145                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/home
 146                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/proc
 147                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/sys
 148                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/var
 149                 sudo umount -v /mnt/$vm_fqdn
 150          fi
 151  }
 152 rule_part_root_mount () {
 153         test -e /dev/mapper/${vm}_root_deciphered ||
 154         sudo cryptsetup luksOpen $vm_dev_disk_root ${vm}_root_deciphered
 155         ! mountpoint /mnt/$vm_fqdn ||
 156         sudo mount -v /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
 157  }
 158 rule_part_root_umount () {
 159         ! mountpoint   /mnt/$vm_fqdn ||
 160         sudo umount -v /mnt/$vm_fqdn
 161         ! test -e     /dev/mapper/${vm}_root_deciphered ||
 162         sudo cryptsetup luksClose ${vm}_root_deciphered
 163  }
 164 rule_part_swap_format () {
 165         rule__part_encrypted_format swap
 166         rule__part_encrypted_mount  swap
 167         sudo mkswap -f -L ${vm}_swap /dev/mapper/${vm}_swap_deciphered
 168         rule__part_encrypted_umount swap
 169  }
 170 rule_part_boot_format () {
 171         mount | grep -q "^$vm_dev_disk_boot " ||
 172         sudo mkfs.ext2 -m 0 -T small -L ${vm}_boot $vm_dev_disk_boot
 173  }
 174 rule_part_boot_mount () {
 175         mountpoint /mnt/$vm_fqdn
 176         test -d /mnt/$vm_fqdn/boot
 177         mountpoint                      /mnt/$vm_fqdn/boot ||
 178         sudo mount -v $vm_dev_disk_boot /mnt/$vm_fqdn/boot
 179  }
 180 rule_part_boot_umount () {
 181         ! mountpoint   /mnt/$vm_fqdn/boot ||
 182         sudo umount -v /mnt/$vm_fqdn/boot
 183  }
 184 rule_part_var_format () {
 185         rule__part_encrypted_format var
 186         rule__part_encrypted_mount  var
 187         sudo mkfs.ext4 -m 5 -T ext4 -L ${vm}_var -E stripe_width=32,resize=5G \
 188          /dev/mapper/${vm}_${part}_deciphered
 189         rule__part_encrypted_umount var
 190  }
 191 rule_part_var_mount () {
 192         rule__part_encrypted_mount  var
 193         mountpoint /mnt/$vm_fqdn/var ||
 194         sudo mount -v /dev/mapper/${vm}_var_deciphered /mnt/$vm_fqdn/var
 195  }
 196 rule_part_var_umount () {
 197         ! mountpoint   /mnt/$vm_fqdn/var ||
 198         sudo umount -v /mnt/$vm_fqdn/var
 199         rule__part_encrypted_umount var
 200  }
 201 rule_part_home_format () {
 202         rule__part_encrypted_format home
 203         rule__part_encrypted_mount  home
 204         sudo mkfs.ext4 -m 0 -T ext4 -L ${vm}_home -E stripe_width=32,resize=200G \
 205          /dev/mapper/${vm}_home_deciphered
 206         rule__part_encrypted_umount home
 207  }
 208 rule_part_home_mount () {
 209         rule__part_encrypted_mount home
 210         mountpoint /mnt/$vm_fqdn/home ||
 211         sudo mount -v /dev/mapper/${vm}_home_deciphered /mnt/$vm_fqdn/home
 212  }
 213 rule_part_home_umount () {
 214         ! mountpoint   /mnt/$vm_fqdn/home ||
 215         sudo umount -v /mnt/$vm_fqdn/home
 216         rule__part_encrypted_umount home
 217  }
 218
 219 rule_debian_install () {
 220         sudo DEBOOTSTRAP_DIR=/usr/share/debootstrap/ debootstrap \
 221          --arch=$vm_arch --verbose --keyring=/usr/share/keyrings/debian-archive-keyring.gpg \
 222          --exclude=vim-tiny \
 223          --include=$(printf '%s,' \
 224                  acl \
 225                  bsdmainutils \
 226                  busybox \
 227                  ca-certificates \
 228                  console-setup \
 229                  cryptsetup \
 230                  dash \
 231                  dnsutils \
 232                  dropbear \
 233                  etckeeper \
 234                  hashalot \
 235                  htop \
 236                  ifupdown \
 237                  initramfs-tools \
 238                  kbd \
 239                  less \
 240                  mosh \
 241                  ncurses-term \
 242                  openssh-client \
 243                  openssh-server \
 244                  openssl \
 245                  pciutils \
 246                  procps \
 247                  quota \
 248                  quotatool \
 249                  rsync \
 250                  screen \
 251                  sudo \
 252                  sysprofile \
 253                  vim-nox \
 254                  wget \
 255                  zsh \
 256          ) \
 257          $vm_lsb_name /mnt/$vm_fqdn/ \
 258          http://ftp.fr.debian.org/debian/
 259  }
 260 rule_chroot () {
 261         rule_part_boot_mount
 262         rule_part_root_mount
 263         rule_part_var_mount
 264         #rule_part_home_mount
 265         mountpoint /mnt/$vm_fqdn/proc ||
 266         mount -t proc proc /mnt/$vm_fqdn/proc
 267         mountpoint /mnt/$vm_fqdn/sys ||
 268         mount -t sysfs sys /mnt/$vm_fqdn/sys
 269         mountpoint /mnt/$vm_fqdn/dev ||
 270         mount --bind /dev /mnt/$vm_fqdn/dev
 271         sudo chroot /mnt/$vm_fqdn /bin/bash || true
 272         rule__chroot_clean
 273  }
 274 rule__chroot_clean () {
 275         umount -v /mnt/$vm_fqdn/dev
 276         umount -v /mnt/$vm_fqdn/sys
 277         umount -v /mnt/$vm_fqdn/proc
 278         #rule_part_home_umount
 279         rule_part_var_umount
 280         rule_part_root_umount
 281         rule_part_boot_umount
 282  }
 283
 284 rule=${1:-help}
 285 ${1+shift}
 286 set "${TRACE:+-x}"
 287 rule_$rule "$@"