vm_host

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=${0%/*}
   4 . "$tool"/lib/functions.sh
   5 . "$tool"/etc/vm.sh
   6
   7 rule_help () { # SYNTAX: [--hidden]
   8         local hidden; [ ${1:+set} ] || hidden=set
   9         cat >&2 <<-EOF
  10                 DESCRIPTION:
  11                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  12                   _depuis_ son hôte ($vm_host) ;
  13                   il sert à la fois d'outil (aisément bidouillable)
  14                   et de documentation (préçise).
  15                   Voir \`$tool/vm_hosted' pour les règles côté VM hébergée.
  16                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  17                 RULES:
  18                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  19                 ENVIRONMENT:
  20                   TRACE # affiche les commandes avant leur exécution
  21                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  22                 EOF
  23  }
  24
  25 readonly vm_dev_disk=/dev/mapper/domU-$(printf %s "$vm_fqdn-disk" | sed -e 's/-/--/g')
  26 readonly vm_dev_disk_boot="${vm_dev_disk}1"
  27
  28 rule_git_config () {
  29         (
  30         cd "$tool"
  31         git config --replace branch.master.remote .
  32         git config --replace branch.master.merge refs/remotes/master
  33         )
  34  }
  35 rule_git_reset () {
  36         (
  37         cd "$tool"
  38         #git checkout -f -B master remotes/master
  39         # NOTE: pas de -B sous squeeze
  40         git checkout HEAD'^' &&
  41         git branch -f master remotes/master &&
  42         git checkout master
  43         git clean -f -d -x
  44         )
  45  }
  46
  47 rule_vm_configure () {
  48         mk_reg mod=644 own=root:root /etc/xen/$vm_fqdn.cfg <<-EOF
  49                 #  -*- mode: python; -*-
  50                 # DOC: http://wiki.xen.org/wiki/Xen_Linux_PV_on_HVM_drivers
  51                 import os, re
  52                 name         = "$vm_fqdn"
  53                 arch         = os.uname()[4]
  54                 memory       = 2048
  55                 vcpus        = 1
  56                 pae          = 1
  57                 acpi         = 1
  58                 apic         = 1
  59                 vif          = ['mac=$vm_mac,bridge=$vm_bridge']
  60                 disk         = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
  61                 device_model = 'qemu-dm'
  62                 # HVM :
  63                 #kernel       = "/usr/lib/xen-4.0/boot/hvmloader"
  64                 #builder      = 'hvm'
  65                 #xen_platform_pci = 1 # NOTE: the guest VM can use optimized PV on HVM drivers
  66                 # PV :
  67                 #kernel       = "pv-grub.gz" # NOTE: pas encore dans Debian car il ne fonctionne qu'avec grub-legacy
  68                 #extra        = "(hd0,0)/grub/grub.cfg"
  69                 bootloader    = '/usr/bin/pygrub'
  70
  71                 # boot on floppy (a), hard disk (c) or CD-ROM (d)
  72                 #boot         = 'd'
  73
  74                 #vnc        = 1
  75                 #sdl        = 0
  76                 #vncconsole = 0
  77                 #vnclisten  = "0.0.0.0"
  78                 #vncpasswd  = ""
  79                 #usbdevice  = 'tablet'
  80
  81                 keymap      = 'fr'
  82                 serial      = 'pty'
  83                 on_poweroff = 'destroy'
  84                 on_reboot   = 'restart'
  85                 on_crash    = 'restart'
  86                 EOF
  87  }
  88 rule_vm_start () {
  89         test ! -e /dev/domU/$vm_fqdn-disk1
  90         sudo xm create $vm_fqdn.cfg
  91         rule vm_attach
  92  }
  93 rule_vm_attach () {
  94         assert '! pgrep -f "sudo xm console $vm_fqdn"'
  95         cat <<-EOF
  96                 NOTE: Ctrl-] pour se détacher de la console
  97                 EOF
  98         sudo xm console $vm_fqdn
  99  }
 100 rule_vm_stop () {
 101         sudo xm shutdown $vm_fqdn
 102  }
 103 rule_vm_stop_force () {
 104         sudo xm destroy $vm_fqdn
 105  }
 106
 107 rule_disk_mount () { # DESCRIPTION: montage du disque de la VM depuis l'hôte
 108         sudo kpartx -a -v /dev/domU/$vm_fqdn-disk
 109         #sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
 110  }
 111 rule_disk_umount () { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
 112         rule part_boot_umount
 113         case $vm_use_lvm in
 114          (yes)
 115                 rule part_lvm_umount
 116                 ;;
 117          (no)
 118                 rule part_root_umount
 119                 rule part_var_umount
 120                 rule part_home_umount
 121                 ;;
 122          (*) exit 1;;
 123          esac
 124         sudo kpartx -d -v /dev/domU/$vm_fqdn-disk
 125         #sudo xm block-detach 0 $vm_dev_disk
 126         # XXX: DANGEREUX ; si jamais il bloque parce que le disque était encore utilisé :
 127         #      utiliser xm block-detach 0 $vm_dev_disk --force ;
 128         #      ôter les éventuels mappages LVM concernés avec dmsetup table et dmsetup remove --force ;
 129         #      ôter les mappages concernés dans /etc/lvm/cache/.cache,
 130         #      et pour bien trouver tous les mappages :
 131         #        % sudo find /dev -type l -exec sh -c 'printf "%s -> " "$@"; readlink "$@"' - {} \; | grep $vm_dev_disk
 132         #      enfin, ôter l'éventuel verrou dans /var/lock/lvm/
 133  }
 134
 135 case $vm_use_lvm in
 136  (no)
 137         readonly vm_dev_disk_swap="${vm_dev_disk}5"
 138         readonly vm_dev_disk_root="${vm_dev_disk}6"
 139         readonly vm_dev_disk_var="${vm_dev_disk}7"
 140         readonly vm_dev_disk_home="${vm_dev_disk}8"
 141         ;;
 142  (yes)
 143         readonly vm_lvm_pv="${vm_dev_disk}2"
 144         readonly vm_dev_disk_swap=/dev/$vm_lvm_vg/${vm_lvm_lv}_swap
 145         readonly vm_dev_disk_root=/dev/$vm_lvm_vg/${vm_lvm_lv}_root
 146         readonly vm_dev_disk_var=/dev/$vm_lvm_vg/${vm_lvm_lv}_var
 147         readonly vm_dev_disk_home=/dev/$vm_lvm_vg/${vm_lvm_lv}_home
 148         ;;
 149  (*) exit 1;;
 150  esac
 151
 152 rule_disk_format () { # DESCRIPTION: partitionnage du disque de la VM
 153         case $vm_use_lvm in
 154         (no)
 155                 sudo sfdisk $vm_dev_disk <<-EOF
 156                         # partition table of $vm_dev_disk
 157                         unit: sectors
 158
 159                         ${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
 160                         ${vm_dev_disk}2 : start=   498015, size=418927005, Id= 5
 161                         ${vm_dev_disk}3 : start=        0, size=        0, Id= 0
 162                         ${vm_dev_disk}4 : start=        0, size=        0, Id= 0
 163                         ${vm_dev_disk}5 : start=   498078, size=  1959867, Id=82
 164                         ${vm_dev_disk}6 : start=  2458008, size= 29302497, Id=83
 165                         ${vm_dev_disk}7 : start= 31760568, size=  9767457, Id=83
 166                         ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
 167                 EOF
 168                 ;;
 169         (yes)
 170                 sudo sfdisk $vm_dev_disk <<-EOF
 171                         # partition table of $vm_dev_disk
 172                         unit: sectors
 173
 174                         ${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
 175                         ${vm_dev_disk}2 : start=   498015, size=418927005, Id=8E
 176                         EOF
 177                 ;;
 178         (*) exit 1;;
 179          esac
 180         #sudo partprobe $vm_dev_disk
 181         sudo kpartx -u -v /dev/domU/$vm_fqdn-disk
 182  }
 183
 184 rule_part_lvm_format () {
 185         rule part_lvm_umount
 186         ! sudo vgs | grep -q "^  $vm_lvm_vg " ||
 187         sudo vgremove $vm_lvm_vg
 188         sudo pvcreate --dataalignment 512k $vm_lvm_pv
 189         sudo vgcreate --dataalignment 512k $vm_lvm_vg $vm_lvm_pv
 190         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_swap -L  1G     $vm_lvm_vg
 191         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_root -L 15G     $vm_lvm_vg
 192         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_var  -L  5G     $vm_lvm_vg
 193         sudo lvcreate --contiguous y -n ${vm_lvm_lv}_home -l 99%FREE $vm_lvm_vg
 194         rule part_lvm_umount
 195  }
 196 rule_part_lvm_mount () {
 197         case $vm_use_lvm in
 198          (yes)
 199                 sudo vgchange -a y $vm_lvm_vg
 200                 ;;
 201          (*) exit 1;;
 202          esac
 203  }
 204 rule_part_lvm_umount () {
 205         case $vm_use_lvm in
 206          (yes)
 207                 rule part_root_umount
 208                 rule part_var_umount
 209                 rule part_home_umount
 210                 ! sudo vgs | grep -q "^  $vm_lvm_vg " ||
 211                 sudo vgchange -a n $vm_lvm_vg
 212                 ;;
 213          (*) exit 1;;
 214          esac
 215  }
 216
 217 rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
 218         local part="$1"
 219         eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
 220  }
 221 rule_part_randomize_stat () { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_randomize
 222         local part="$1"
 223         eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
 224  }
 225 rule__part_encrypted_format () { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
 226  # NOTE: la clef de chiffrement est dérivée de celle de /,
 227  #       / doit être déchiffrée pour que cela fonctionne.
 228         local part="$1"
 229         eval "local dev=\"\$vm_dev_disk_$part\""
 230         test ! -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
 231         sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
 232         cryptsetup luksFormat --hash=sha512 --key-size=512 \
 233          --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev"
 234  }
 235 rule__part_encrypted_mount () { # SYNTAX: $part
 236         local part="$1"
 237         eval "local dev=\"\$vm_dev_disk_$part\""
 238         test -e /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
 239         sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
 240         cryptsetup luksOpen --key-file=- $dev ${vm_lvm_lv}_${part}_deciphered"
 241  }
 242 rule__part_encrypted_umount () { # SYNTAX: $part
 243         local part="$1"
 244         eval "local dev=\"\$vm_dev_disk_$part\""
 245         test ! -e     /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
 246         sudo cryptsetup luksClose ${vm_lvm_lv}_${part}_deciphered
 247  }
 248
 249 rule_part_root_format () {
 250         if ! mount | grep -q "^$vm_dev_disk_root "
 251          then
 252                 sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
 253                  --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $vm_dev_disk_root
 254                 sudo cryptsetup luksOpen --key-file=- $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
 255                 sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
 256                  -E resize=30G${vm_e2fs_extended_options} \
 257                  -L ${vm_lvm_lv}_root \
 258                  /dev/mapper/${vm_lvm_lv}_root_deciphered
 259                 ! mountpoint -q /mnt/$vm_fqdn
 260                 sudo mount -v /dev/mapper/${vm_lvm_lv}_root_deciphered /mnt/$vm_fqdn
 261                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/boot
 262                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/dev
 263                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/home
 264                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/proc
 265                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/sys
 266                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/var
 267                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/root
 268                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/root/tool
 269                 mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/root/tool/ateliers
 270                 sudo umount -v /mnt/$vm_fqdn
 271                 sudo cryptsetup luksClose ${vm_lvm_lv}_root_deciphered
 272          fi
 273  }
 274 rule_part_root_mount () {
 275         test -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
 276         sudo cryptsetup luksOpen $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
 277         mountpoint -q /mnt/$vm_fqdn ||
 278         sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_root_deciphered /mnt/$vm_fqdn
 279  }
 280 rule_part_root_umount () {
 281         ! mountpoint -q /mnt/$vm_fqdn ||
 282         sudo umount -v  /mnt/$vm_fqdn
 283         ! test -e     /dev/mapper/${vm_lvm_lv}_root_deciphered ||
 284         sudo cryptsetup luksClose ${vm_lvm_lv}_root_deciphered
 285  }
 286 rule_part_root_backup_luks () {
 287         sudo cryptsetup luksHeaderBackup $vm_dev_disk_root --header-backup-file ./root.luks
 288  }
 289 rule_part_swap_format () {
 290         rule _part_encrypted_format swap
 291         rule _part_encrypted_mount  swap
 292         sudo mkswap -f -L ${vm_lvm_lv}_swap \
 293          /dev/mapper/${vm_lvm_lv}_swap_deciphered
 294         rule _part_encrypted_umount swap
 295  }
 296 rule_part_boot_format () {
 297         mount | grep -q "^$vm_dev_disk_boot " ||
 298         sudo mke2fs -t ext2 -c -c -m 5 -T small \
 299          -E resize=1G${vm_e2fs_extended_options} \
 300          -L ${vm_lvm_lv}_boot $vm_dev_disk_boot
 301  }
 302 rule_part_boot_mount () {
 303         mountpoint -q /mnt/$vm_fqdn
 304         test -d /mnt/$vm_fqdn/boot
 305         mountpoint -q                           /mnt/$vm_fqdn/boot ||
 306         sudo mount -v -t ext2 $vm_dev_disk_boot /mnt/$vm_fqdn/boot
 307  }
 308 rule_part_boot_umount () {
 309         ! mountpoint -q /mnt/$vm_fqdn/boot ||
 310         sudo umount -v  /mnt/$vm_fqdn/boot
 311  }
 312 rule_part_var_format () {
 313         rule _part_encrypted_format var
 314         rule _part_encrypted_mount  var
 315         sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
 316          -E resize=10G${vm_e2fs_extended_options} \
 317          -L ${vm_lvm_lv}_var \
 318          /dev/mapper/${vm_lvm_lv}_var_deciphered
 319         rule _part_encrypted_umount var
 320  }
 321 rule_part_var_mount () {
 322         rule _part_encrypted_mount var
 323         mountpoint -q /mnt/$vm_fqdn/var ||
 324         sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_var_deciphered /mnt/$vm_fqdn/var
 325  }
 326 rule_part_var_umount () {
 327         ! mountpoint -q /mnt/$vm_fqdn/var ||
 328         sudo umount -v  /mnt/$vm_fqdn/var
 329         rule _part_encrypted_umount var
 330  }
 331 rule_part_home_format () {
 332         rule _part_encrypted_format home
 333         rule _part_encrypted_mount  home
 334         sudo mke2fs -t ext4 -c -c -m 0 -T ext4 -b $vm_e2fs_block_size \
 335          -E resize=400G${vm_e2fs_extended_options} \
 336          -L ${vm_lvm_lv}_home \
 337          /dev/mapper/${vm_lvm_lv}_home_deciphered
 338          # NOTE: -O quota pas supporté par e2fsprogs/squeeze
 339         rule _part_encrypted_umount home
 340  }
 341 rule_part_home_mount () {
 342         rule _part_encrypted_mount home
 343         mountpoint -q /mnt/$vm_fqdn/home ||
 344         sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_home_deciphered /mnt/$vm_fqdn/home
 345  }
 346 rule_part_home_umount () {
 347         ! mountpoint -q /mnt/$vm_fqdn/home ||
 348         sudo umount -v  /mnt/$vm_fqdn/home
 349         rule _part_encrypted_umount home
 350  }
 351
 352 rule_debian_install () {
 353         rule disk_mount
 354         rule part_lvm_mount
 355         rule part_root_mount
 356         rule part_boot_mount
 357         rule part_var_mount
 358         sudo DEBOOTSTRAP_DIR=/usr/share/debootstrap/ LANG=C LC_CTYPE=C debootstrap \
 359          --arch=$vm_arch --verbose --keyring=/usr/share/keyrings/debian-archive-keyring.gpg \
 360          --exclude=vim-tiny \
 361          --include=$(printf '%s,' \
 362                  acl \
 363                  bsdmainutils \
 364                  busybox \
 365                  ca-certificates \
 366                  console-setup \
 367                  cryptsetup \
 368                  dash \
 369                  dnsutils \
 370                  dropbear \
 371                  etckeeper \
 372                  git-core \
 373                  gnupg \
 374                  hashalot \
 375                  htop \
 376                  ifupdown \
 377                  initramfs-tools \
 378                  kbd \
 379                  less \
 380                  locales \
 381                  lvm2 \
 382                  mosh \
 383                  molly-guard \
 384                  ncurses-term \
 385                  openssh-client \
 386                  openssh-server \
 387                  openssl \
 388                  pciutils \
 389                  procps \
 390                  quota \
 391                  quotatool \
 392                  rsync \
 393                  screen \
 394                  sudo \
 395                  sysprofile \
 396                  vim-nox \
 397                  wget \
 398                  zsh \
 399          ) \
 400          $vm_lsb_name /mnt/$vm_fqdn/ \
 401          http://ftp.fr.debian.org/debian/
 402         rule part_var_umount
 403         rule part_boot_umount
 404         rule part_root_umount
 405  }
 406
 407 rule_chroot () {
 408         rule disk_mount
 409         rule part_lvm_mount
 410         rule part_root_mount
 411         rule part_boot_mount
 412         rule part_var_mount
 413         #rule_part_home_mount
 414         mountpoint -q /mnt/$vm_fqdn/proc ||
 415         sudo mount -t proc proc /mnt/$vm_fqdn/proc
 416         mountpoint -q /mnt/$vm_fqdn/sys ||
 417         sudo mount -t sysfs sys /mnt/$vm_fqdn/sys
 418         mountpoint -q /mnt/$vm_fqdn/dev ||
 419         sudo mount --bind /dev /mnt/$vm_fqdn/dev
 420         if test -d /mnt/$vm_fqdn/root/tool/vm/.git
 421          then
 422                 mountpoint -q /mnt/$vm_fqdn/root/tool/vm ||
 423                 sudo mount --bind "$tool" /mnt/$vm_fqdn/root/tool/vm
 424          else
 425                 rsync -a "$tool"/ /mnt/$vm_fqdn/root/tool/vm
 426          fi
 427         sudo chroot /mnt/$vm_fqdn /bin/bash || true
 428         rule _chroot_clean
 429  }
 430 rule__chroot_clean () {
 431         ! sudo mountpoint -q /mnt/$vm_fqdn/root/tool/vm ||
 432         sudo umount -v /mnt/$vm_fqdn/root/tool/$vm
 433         ! mountpoint -q /mnt/$vm_fqdn/dev ||
 434         sudo umount -v /mnt/$vm_fqdn/dev
 435         ! mountpoint -q /mnt/$vm_fqdn/sys ||
 436         sudo umount -v /mnt/$vm_fqdn/sys
 437         ! mountpoint -q /mnt/$vm_fqdn/proc ||
 438         sudo umount -v /mnt/$vm_fqdn/proc
 439         rule part_home_umount
 440         rule part_var_umount
 441         rule part_boot_umount
 442         rule part_root_umount
 443         rule disk_umount
 444  }
 445
 446 rule=${1:-help}
 447 ${1+shift}
 448 case $rule in
 449  (help);;
 450  (*)
 451         assert 'test "$(hostname --fqdn)" = "$vm_host"' vm_host
 452         ;;
 453  esac
 454 rule $rule "$@"