ateliers_host

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3
   4 tool=${0%/*}
   5 . "$tool"/env.sh
   6
   7 rule_help () {
   8         cat >&2 <<-EOF
   9                 DESCRIPTION: ce script regroupe des fonctions utilitaires
  10                              pour gérer la VM des ateliers _depuis_ son hôte ;
  11                              il sert à la fois d'outil et de documentation.
  12                              Voir \`$tool/ateliers_hosted' pour les utilitaires côté VM hébergée.
  13                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  14                 RULES:
  15                 $(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$0")
  16                 ENVIRONMENT:
  17                   TRACE # affiche les commandes avant leur exécution
  18                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
  19                 EOF
  20  }
  21
  22 readonly vm_dev_disk="/dev/xvda"
  23 readonly vm_dev_disk_boot="${vm_dev_disk}1"
  24
  25 rule_xen_config_init () {
  26         sudo tee /etc/xen/$vm_fqdn.cfg <<-EOF
  27                 #  -*- mode: python; -*-
  28                 import os, re
  29                 name         = "$vm_fqdn"
  30                 arch         = os.uname()[4]
  31                 memory       = 2048
  32                 vcpus        = 1
  33                 vif          = ['mac=$vm_mac,bridge=$vm_bridge']
  34                 disk         = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
  35                 kernel       = "/usr/lib/xen-4.0/boot/hvmloader"
  36                 builder      = 'hvm'
  37                 device_model = 'qemu-dm'
  38                 acpi         = 1
  39                 apic         = 1
  40                 # boot on floppy (a), hard disk (c) or CD-ROM (d)
  41                 #boot         = 'd'
  42
  43                 #vnc        = 1
  44                 #sdl        = 0
  45                 #vncconsole = 0
  46                 #vnclisten  = "0.0.0.0"
  47                 #vncpasswd  = ""
  48                 #usbdevice  = 'tablet'
  49
  50                 keymap      = 'fr'
  51                 serial      = 'pty'
  52                 on_poweroff = 'destroy'
  53                 on_reboot   = 'restart'
  54                 on_crash    = 'restart'
  55                 EOF
  56  }
  57 rule_xen_on () {
  58         sudo xm create $vm_fqdn.cfg
  59  }
  60 rule_xen_off () {
  61         sudo xm shutdown $vm_fqdn.cfg
  62  }
  63
  64 rule_disk_mount () { # DESCRIPTION: montage du disque de la VM depuis l'hôte
  65         sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
  66         # NOTE: on pourrait utiliser kpartx à la place je pense ; détail.
  67  }
  68 rule_disk_umount () { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
  69         rule_part_boot_umount
  70         case $vm_use_lvm in
  71          (yes)
  72                 rule_part_lvm_umount
  73                 ;;
  74          (no)
  75                 rule_part_root_umount
  76                 rule_part_var_umount
  77                 rule_part_home_umount
  78                 ;;
  79          (*) exit 1;;
  80          esac
  81         sudo xm block-detach 0 $vm_dev_disk
  82  }
  83
  84 case $vm_use_lvm in
  85 (no)
  86         readonly vm_dev_disk_swap="${vm_dev_disk}5"
  87         readonly vm_dev_disk_root="${vm_dev_disk}6"
  88         readonly vm_dev_disk_var="${vm_dev_disk}7"
  89         readonly vm_dev_disk_home="${vm_dev_disk}8"
  90         ;;
  91 (yes)
  92         readonly vm_lvm_pv="${vm_dev_disk}2"
  93         readonly vm_lvm_vg=$vm
  94         readonly vm_lvm_dev=$(printf %s $vm_lvm_vg | sed -e 's/-/--/g')
  95         readonly vm_lvm_lv=$vm
  96         readonly vm_dev_disk_swap=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}_swap
  97         readonly vm_dev_disk_root=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}_root
  98         readonly vm_dev_disk_var=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}_var
  99         readonly vm_dev_disk_home=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}home
 100         ;;
 101 (*)
 102         exit 1;;
 103  esac
 104
 105 rule_disk_format () { # DESCRIPTION: partitionnage du disque de la VM
 106         case $vm_use_lvm in
 107         (no)
 108                 sudo sfdisk $vm_dev_disk <<-EOF
 109                         # partition table of $vm_dev_disk
 110                         unit: sectors
 111
 112                         ${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
 113                         ${vm_dev_disk}2 : start=   498015, size=418927005, Id= 5
 114                         ${vm_dev_disk}3 : start=        0, size=        0, Id= 0
 115                         ${vm_dev_disk}4 : start=        0, size=        0, Id= 0
 116                         ${vm_dev_disk}5 : start=   498078, size=  1959867, Id=82
 117                         ${vm_dev_disk}6 : start=  2458008, size= 29302497, Id=83
 118                         ${vm_dev_disk}7 : start= 31760568, size=  9767457, Id=83
 119                         ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
 120                 EOF
 121                 ;;
 122         (yes)
 123                 sudo sfdisk $vm_dev_disk <<-EOF
 124                         # partition table of $vm_dev_disk
 125                         unit: sectors
 126
 127                         ${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
 128                         ${vm_dev_disk}2 : start=   498015, size=418927005, Id=8E
 129                         EOF
 130                 ;;
 131         (*) exit 1;;
 132          esac
 133         sudo partprobe $vm_dev_disk
 134  }
 135
 136 rule_part_lvm_format () {
 137         rule_part_lvm_umount
 138         ! sudo vgs | grep -q "^  $vm_lvm_vg " ||
 139         sudo vgremove $vm_lvm_vg
 140         sudo pvcreate --dataalignment 512k $vm_lvm_pv
 141         sudo vgcreate --dataalignment 512k $vm_lvm_vg $vm_lvm_pv
 142         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_swap -L  1G     $vm_lvm_vg
 143         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_root -L 15G     $vm_lvm_vg
 144         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_var  -L  5G     $vm_lvm_vg
 145         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_home -l 99%FREE $vm_lvm_vg
 146         rule_part_lvm_umount
 147  }
 148 rule_part_lvm_mount () {
 149         sudo vgchange -a y $vm_lvm_vg
 150         sudo lvchange -a y $vm_lvm_lv
 151  }
 152 rule_part_lvm_umount () {
 153         rule_part_root_umount
 154         rule_part_var_umount
 155         rule_part_home_umount
 156         if sudo vgs | grep -q "^  $vm_lvm_vg "
 157          then
 158                 sudo lvchange -a n $vm_lvm_vg
 159                 sudo vgchange -a n $vm_lvm_vg
 160          fi
 161  }
 162
 163 rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
 164         local part=$1
 165         eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
 166  }
 167 rule_part_randomize_stat () { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_clean
 168         local part=$1
 169         eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
 170  }
 171 rule__part_encrypted_format () { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
 172  # NOTE: la clef de chiffrement est dérivée de celle de /,
 173  #       / doit être déchiffrée pour que cela fonctionne.
 174         local part=$1
 175         eval "local dev=\$vm_dev_disk_$part"
 176         test ! -e /dev/mapper/${vm}_root_deciphered ||
 177         sudo /lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
 178         sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
 179          --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev
 180  }
 181 rule__part_encrypted_mount () { # SYNTAX: $part
 182         local part=$1
 183         eval "local dev=\$vm_dev_disk_$part"
 184         test ! -e /dev/mapper/${vm}_root_deciphered ||
 185         sudo /lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
 186         sudo cryptsetup luksOpen --key-file=- $dev ${vm}_${part}_deciphered
 187  }
 188 rule__part_encrypted_umount () { # SYNTAX: $part
 189         local part=$1
 190         eval "local dev=\$vm_dev_disk_$part"
 191         test ! -e     /dev/mapper/${vm}_${part}_deciphered ||
 192         sudo cryptsetup luksClose ${vm}_${part}_deciphered
 193  }
 194
 195 rule_part_root_format () {
 196         if ! mount | grep -q "^$vm_dev_disk_root "
 197          then
 198                 sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
 199                  --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $vm_dev_disk_root
 200                 sudo cryptsetup luksOpen --key-file=- $vm_dev_disk_root ${vm}_root_deciphered
 201                 sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
 202                  -E resize=15G${vm_e2fs_extended_options} \
 203                  -L ${vm}_root \
 204                  /dev/mapper/${vm}_root_deciphered
 205                 ! mountpoint -q /mnt/$vm_fqdn
 206                 sudo mount -v /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
 207                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/boot
 208                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/dev
 209                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/home
 210                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/proc
 211                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/sys
 212                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/var
 213                 sudo umount -v /mnt/$vm_fqdn
 214          fi
 215  }
 216 rule_part_root_mount () {
 217         test -e /dev/mapper/${vm}_root_deciphered ||
 218         sudo cryptsetup luksOpen $vm_dev_disk_root ${vm}_root_deciphered
 219         ! mountpoint -q /mnt/$vm_fqdn ||
 220         sudo mount -v /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
 221  }
 222 rule_part_root_umount () {
 223         ! mountpoint -q /mnt/$vm_fqdn ||
 224         sudo umount -v  /mnt/$vm_fqdn
 225         ! test -e     /dev/mapper/${vm}_root_deciphered ||
 226         sudo cryptsetup luksClose ${vm}_root_deciphered
 227  }
 228 rule_part_swap_format () {
 229         rule__part_encrypted_format swap
 230         rule__part_encrypted_mount  swap
 231         sudo mkswap -f -L ${vm}_swap /dev/mapper/${vm}_swap_deciphered
 232         rule__part_encrypted_umount swap
 233  }
 234 rule_part_boot_format () {
 235         mount | grep -q "^$vm_dev_disk_boot " ||
 236         sudo mke2fs -t ext2 -c -c -m 5 -T small \
 237          -E resize=1G${vm_e2fs_extended_options} \
 238          -L ${vm}_boot $vm_dev_disk_boot
 239  }
 240 rule_part_boot_mount () {
 241         mountpoint -q /mnt/$vm_fqdn
 242         test -d /mnt/$vm_fqdn/boot
 243         mountpoint -q                      /mnt/$vm_fqdn/boot ||
 244         sudo mount -v $vm_dev_disk_boot /mnt/$vm_fqdn/boot
 245  }
 246 rule_part_boot_umount () {
 247         ! mountpoint -q /mnt/$vm_fqdn/boot ||
 248         sudo umount -v  /mnt/$vm_fqdn/boot
 249  }
 250 rule_part_var_format () {
 251         rule__part_encrypted_format var
 252         rule__part_encrypted_mount  var
 253         sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
 254          -E resize=10G${vm_e2fs_extended_options} \
 255          -L ${vm}_var \
 256          /dev/mapper/${vm}_var_deciphered
 257         rule__part_encrypted_umount var
 258  }
 259 rule_part_var_mount () {
 260         rule__part_encrypted_mount var
 261         mountpoint -q /mnt/$vm_fqdn/var ||
 262         sudo mount -v /dev/mapper/${vm}_var_deciphered /mnt/$vm_fqdn/var
 263  }
 264 rule_part_var_umount () {
 265         ! mountpoint -q /mnt/$vm_fqdn/var ||
 266         sudo umount -v  /mnt/$vm_fqdn/var
 267         rule__part_encrypted_umount var
 268  }
 269 rule_part_home_format () {
 270         rule__part_encrypted_format home
 271         rule__part_encrypted_mount  home
 272         sudo mke2fs -t ext4 -c -c -m 0 -T ext4 -b $vm_e2fs_block_size \
 273          -E resize=400G${vm_e2fs_extended_options} \
 274          -O quota \
 275          -L ${vm}_home \
 276          /dev/mapper/${vm}_home_deciphered
 277         rule__part_encrypted_umount home
 278  }
 279 rule_part_home_mount () {
 280         rule__part_encrypted_mount home
 281         mountpoint -q /mnt/$vm_fqdn/home ||
 282         sudo mount -v /dev/mapper/${vm}_home_deciphered /mnt/$vm_fqdn/home
 283  }
 284 rule_part_home_umount () {
 285         ! mountpoint -q /mnt/$vm_fqdn/home ||
 286         sudo umount -v  /mnt/$vm_fqdn/home
 287         rule__part_encrypted_umount home
 288  }
 289
 290 rule_debian_install () {
 291         sudo DEBOOTSTRAP_DIR=/usr/share/debootstrap/ debootstrap \
 292          --arch=$vm_arch --verbose --keyring=/usr/share/keyrings/debian-archive-keyring.gpg \
 293          --exclude=vim-tiny \
 294          --include=$(printf '%s,' \
 295                  acl \
 296                  bsdmainutils \
 297                  busybox \
 298                  ca-certificates \
 299                  console-setup \
 300                  cryptsetup \
 301                  dash \
 302                  dnsutils \
 303                  dropbear \
 304                  etckeeper \
 305                  hashalot \
 306                  htop \
 307                  ifupdown \
 308                  initramfs-tools \
 309                  kbd \
 310                  less \
 311                  mosh \
 312                  ncurses-term \
 313                  openssh-client \
 314                  openssh-server \
 315                  openssl \
 316                  pciutils \
 317                  procps \
 318                  quota \
 319                  quotatool \
 320                  rsync \
 321                  screen \
 322                  sudo \
 323                  sysprofile \
 324                  vim-nox \
 325                  wget \
 326                  zsh \
 327          ) \
 328          $vm_lsb_name /mnt/$vm_fqdn/ \
 329          http://ftp.fr.debian.org/debian/
 330  }
 331 rule_chroot () {
 332         rule_part_boot_mount
 333         rule_part_root_mount
 334         rule_part_var_mount
 335         #rule_part_home_mount
 336         mountpoint -q /mnt/$vm_fqdn/proc ||
 337         mount -t proc proc /mnt/$vm_fqdn/proc
 338         mountpoint -q /mnt/$vm_fqdn/sys ||
 339         mount -t sysfs sys /mnt/$vm_fqdn/sys
 340         mountpoint -q /mnt/$vm_fqdn/dev ||
 341         mount --bind /dev /mnt/$vm_fqdn/dev
 342         sudo chroot /mnt/$vm_fqdn /bin/bash || true
 343         rule__chroot_clean
 344  }
 345 rule__chroot_clean () {
 346         umount -v /mnt/$vm_fqdn/dev
 347         umount -v /mnt/$vm_fqdn/sys
 348         umount -v /mnt/$vm_fqdn/proc
 349         #rule_part_home_umount
 350         rule_part_var_umount
 351         rule_part_root_umount
 352         rule_part_boot_umount
 353  }
 354
 355 rule=${1:-help}
 356 ${1+shift}
 357 set "${TRACE:+-x}"
 358 rule_$rule "$@"