vm_hosted

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=$0
   4 while test -L "$tool"
   5  do tool=$(readlink "$tool")
   6  done
   7 tool=${tool%/*}
   8 . "$tool"/lib/rule.sh
   9 . "$tool"/etc/vm.sh
  10 export TRACE=1
  11 cd /
  12
  13 rule_help () { # SYNTAX: [--hidden]
  14         local hidden; [ ${1:+set} ] || hidden=set
  15         cat >&2 <<-EOF
  16                 DESCRIPTION:
  17                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  18                   _depuis_ la VM hébergée ($vm_fqdn) ;
  19                   il sert à la fois d'outil (aisément bidouillable)
  20                   et de documentation (préçise).
  21                   Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
  22                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  23                 RULES:
  24                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  25                 ENVIRONMENT:
  26                   TRACE # affiche les commandes avant leur exécution
  27                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  28                 EOF
  29  }
  30
  31 rule_git_configure () {
  32         (
  33         cd "$tool"
  34         git config --replace branch.master.remote .
  35         git config --replace branch.master.merge refs/remotes/master
  36         local tool
  37         tool=$(cd "$tool"; cd -)
  38         install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
  39                 #!/bin/sh -efux
  40                 case \$1 in
  41                  (refs/remotes/master)
  42                         cd ..
  43                         git --git-dir=\$PWD/.git checkout -f -B master remotes/master
  44                         git --git-dir=\$PWD/.git clean -f -d -x
  45                         ;;
  46                  esac
  47                 EOF
  48         )
  49  }
  50 rule_git_reset () {
  51         (
  52         cd "$tool"
  53         git checkout -f -B master remotes/master
  54         git clean -f -d -x
  55         )
  56  }
  57
  58 rule_adduser () {
  59         local user="$1"; shift
  60         getent passwd "$user" >/dev/null ||
  61         sudo adduser "$@" "$user"
  62  }
  63 rule_apt_get_install () { # SYNTAX: $package
  64         sudo \
  65          DEBIAN_FRONTEND=noninteractive \
  66          DEBIAN_PRIORITY=low \
  67          apt-get install --yes "$@"
  68  }
  69 rule_dpkg_reconfigure () { # SYNTAX: $package
  70         sudo \
  71          DEBIAN_FRONTEND=noninteractive \
  72          DEBIAN_PRIORITY=low \
  73          dpkg-reconfigure "$@"
  74  }
  75
  76 rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
  77         export LANG=C
  78         export LC_CTYPE=C
  79         . /etc/profile
  80  }
  81
  82 rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour
  83         local -; set +f
  84         rule apt_get_install \
  85          apache2-mpm-itk \
  86          libapache2-mod-php5
  87                 # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
  88                 # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
  89                 # NOTE: apache2-mpm-itk semble le plus sécurisé,
  90                 # car on est certain que tout est exécuté avec les uid/gid
  91                 # assignés au VirtualHost/Directory/Location
  92                 # néamoins il se peut qu'une combinaison du genre :
  93                 # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
  94                 # soit plus performante (threads et pas forks),
  95                 # cependant l'usage de suexec impose des forks il semble..
  96                 # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
  97                 # donc pour l'instant : apache2-mpm-itk
  98         sudo rm -rf \
  99          /etc/apache2/site.d
 100         sudo install -d -m 770 -o www -g www \
 101          /etc/apache2 \
 102          /etc/apache2/site.d \
 103          /etc/apache2/x509.d
 104         cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF |
 105                 ServerName "$vm_fqdn"
 106                 EOF
 107         sudo install -m 660 -o root -g root /dev/stdin \
 108          /etc/apache2/apache2.conf
 109         sudo install -m 660 -o root -g root \
 110          "$tool"/etc/apache2/envvars \
 111                 /etc/apache2/envvars
 112         sudo install -m 660 -o root -g root \
 113          "$tool"/etc/apache2/httpd.conf \
 114                 /etc/apache2/httpd.conf
 115         #sudo install -m 660 -o root -g root /dev/stdin \
 116         # /etc/apache2/suexec/www-data <<-EOF
 117         #       /home
 118         #       pub/www/cgi
 119         #       EOF
 120         sudo install -m 660 -o root -g root \
 121          "$tool"/etc/apache2/ports.conf \
 122                 /etc/apache2/ports.conf
 123         sudo a2enmod actions
 124         sudo a2enmod headers
 125         sudo a2enmod rewrite
 126         sudo a2enmod ssl
 127         sudo a2enmod userdir
 128         local conf
 129         sudo a2dissite "*"
 130         sudo ln -fns \
 131          /etc/apache2 \
 132          /home/www/etc/apache2
 133         for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
 134          do conf=${conf#"$tool"/etc/apache2/site.d/}
 135                 local site=${conf%/VirtualHost.conf}
 136                 case $site in
 137                  (*-tls)
 138                         local hint="run vm_remote apache2_key_send before"
 139                         assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
 140                         sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 141                          /etc/apache2 \
 142                          /etc/apache2/site.d/"$site" \
 143                          /etc/apache2/x509.d/"$site" \
 144                          /etc/apache2/x509.d/"$site"/ca \
 145                          /etc/apache2/x509.d/"$site"/empty \
 146                          /etc/apache2/x509.d/"$site"/rvk \
 147                          /etc/apache2/x509.d/"$site"/usr
 148                         sudo install -m 664 -o www -g www \
 149                          "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \
 150                           /etc/apache2/x509.d/"$site"/crt.self-signed.pem
 151                         #sudo install -m 664 -o www-"$site" -g www-"$site" \
 152                         # "$tool"/var/pub/x509/"$site"/rvk.pem \
 153                         #  /etc/apache2/x509.d/"$site"/rvk.pem
 154                         sudo install -m 664 -o www -g www \
 155                          "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \
 156                           /etc/apache2/x509.d/"$site"/ca/crt.pem
 157                         sudo install -m 664 -o www -g www \
 158                          "$tool"/var/pub/x509/"$site"/crt.pem \
 159                           /etc/apache2/x509.d/"$site"/crt.pem
 160                         ;;
 161                  esac
 162                 case $site in
 163                  (*-tls)
 164                         cat <<-EOF
 165                                 <IfModule mod_ssl.c>
 166                                         <VirtualHost *:$port>
 167                                                 AssignUserID www-$site www-$site
 168                                                 BrowserMatch "MSIE [2-6]"  ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
 169                                                 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
 170                                                 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 171                                                 #CustomLog "/dev/null" Combined
 172                                                 DocumentRoot /home/www/pub/$site
 173                                                 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 174                                                 #ErrorLog "/dev/null"
 175                                                 LogLevel Warn
 176                                                 SSLCACertificateFile    /etc/apache2/x509.d/$site/crt.self-signed.pem
 177                                                 SSLCACertificatePath    /etc/apache2/x509.d/$site/usr/
 178                                                 #SSLCARevocationFile    /etc/apache2/x509.d/$site/rvk.pem
 179                                                 SSLCADNRequestFile      /etc/apache2/x509.d/$site/crt.self-signed.pem
 180                                                 SSLCADNRequestPath      /etc/apache2/x509.d/$site/empty/
 181                                                         # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés
 182                                                 SSLCARevocationPath     /etc/apache2/x509.d/$site/rvk/
 183                                                 SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem
 184                                                 SSLCertificateFile      /etc/apache2/x509.d/$site/crt.pem
 185                                                 SSLCertificateKeyFile   /etc/apache2/x509.d/$site/key.pem
 186                                                 SSLCipherSuite AES+RSA+SHA256
 187                                                 SSLEngine On
 188                                                 SSLInsecureRenegotiation Off
 189                                                 SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
 190                                                 SSLProtocol -All +TLSv1
 191                                                 #SSLRenegBufferSize 262144
 192                                                 SSLSessionCacheTimeout 1200
 193                                                 SSLStrictSNIVHostCheck On
 194                                                 SSLUserName SSL_CLIENT_S_DN_CN
 195                                                 SSLVerifyClient None
 196                                                 SSLVerifyDepth 1
 197                                                 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 198                                          </VirtualHost>
 199                                  </IfModule>
 200                                 EOF
 201                         ;;
 202                  (*)
 203                         cat <<-EOF
 204                                 <VirtualHost *:$port>
 205                                         AssignUserID www-$site www-$site
 206                                         CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 207                                         #CustomLog "/dev/null" Combined
 208                                         DocumentRoot /home/www/pub/$site
 209                                         ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 210                                         #ErrorLog "/dev/null"
 211                                         LogLevel Warn
 212                                         $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 213                                  </VirtualHost>
 214                                 EOF
 215                         ;;
 216                  esac |
 217                 sudo install -m 660 -o root -g root /dev/stdin \
 218                  /etc/apache2/site.d/"$site"/VirtualHost.conf
 219                 sudo ln -fns \
 220                  ../site.d/"$site"/VirtualHost.conf \
 221                  /etc/apache2/sites-available/"$site"
 222                 sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 223                  /home/www/log/"$site" \
 224                  /home/www/log/"$site"/apache2
 225                 sudo ln -fns \
 226                  /etc/apache2/site.d/"$site" \
 227                  /home/www/etc/apache2/"$site"
 228                 test -e /home/www/pub/"$site" ||
 229                 sudo install -d -m 2770 -o www-"$site" -g www-"$site" \
 230                  /home/www/pub/"$site"
 231                 rule adduser www-"$site"
 232                  --disabled-password \
 233                  --group \
 234                  --no-create-home \
 235                  --home /home/www/pub/"$site" \
 236                  --shell /bin/false \
 237                  --system
 238                 #sudo setfacl -m u:"www-$site":--x \
 239                 # /home/www/ \
 240                 # /home/www/pub/ \
 241                 # /home/www/pub/"$site"/
 242                 #sudo setfacl -m d:u:"www-$site":rwx \
 243                 # "$home"/pub/www/"$site"/
 244                 test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh ||
 245                 .         "$tool"/etc/apache2/site.d/"$site"/configure.sh
 246                 test -e /etc/apache2/sites-enabled/"$site" ||
 247                 sudo a2ensite "$site"
 248          done
 249         sudo service apache2 restart
 250  }
 251 rule_apt_configure () {
 252         sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
 253                 deb http://ftp.rezopole.net/debian $vm_lsb_name main
 254                 EOF
 255         sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
 256                 deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
 257                 EOF
 258         sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
 259                 deb http://nightly.openerp.com/7.0/nightly/deb/ ./
 260                 EOF
 261         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
 262                 Package: *
 263                 Pin: release a=$vm_lsb_name
 264                 Pin-Priority: 200
 265
 266                 Package: *
 267                 Pin: release a=$vm_lsb_name-backports
 268                 Pin-Priority: 170
 269                 EOF
 270         sudo apt-get update
 271         rule apt_get_install apticron
 272         m4 \
 273          --define=VM_DOMAINNAME=$vm_domainname \
 274          <"$tool"/etc/apticron/apticron.conf.m4 |
 275         sudo install -m 644 -o root -g root /dev/stdin \
 276          /etc/apticron/apticron.conf
 277  }
 278 rule_boot_configure () {
 279         #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
 280         sudo debconf-set-selections <<-EOF
 281                 grub-pc grub-pc/install_devices multiselect
 282                 EOF
 283         rule apt_get_install grub-pc
 284         sudo install -d -m 644 -o root -g root /boot/grub
 285         rule apt_get_install linux-image-$vm_arch
 286         sudo install -m 644 -o root -g root /dev/stdin /etc/default/grub <<-EOF
 287                 GRUB_DEFAULT=0
 288                 GRUB_TIMEOUT=5
 289                 GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
 290                 GRUB_CMDLINE_LINUX_DEFAULT="quiet"
 291                 GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
 292                 GRUB_DISABLE_RECOVERY="true"
 293                 #GRUB_PRELOAD_MODULES="lvm"
 294                 EOF
 295         sudo install -m 644 -o root -g root /dev/stdin /boot/grub/device.map <<-EOF
 296                 (hd0)   /dev/xvda
 297                 (hd0)   /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
 298                 EOF
 299         sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
 300         rule initramfs_configure
 301         rule apt_get_install molly-guard
 302         sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
 303                 ALWAYS_QUERY_HOSTNAME=true
 304                  # NOTE: une alternative est de dire à sudo de conserver les SSH_*
 305                  #       néamoins demander tout le temps n'est pas trop contraignant
 306                  #       et davantage sécurisant.
 307                 EOF
 308  }
 309 rule_etckeeper_configure () {
 310         sudo install -m 644 -o root -g root /dev/stdin /etc/etckeeper/etckeeper.conf <<-EOF
 311                 VCS=git
 312                 GIT_COMMIT_OPTIONS=""
 313                 AVOID_DAILY_AUTOCOMMITS=1
 314                 #AVOID_SPECIAL_FILE_WARNING=1
 315                 AVOID_COMMIT_BEFORE_INSTALL=1
 316                 HIGHLEVEL_PACKAGE_MANAGER=apt
 317                 LOWLEVEL_PACKAGE_MANAGER=dpkg
 318                 EOF
 319         sudo install -m 644 -o root -g root \
 320          "$tool"/etc/etckeeper/prompt.sh \
 321                 /etc/etckeeper/prompt.sh
 322         rule apt_get_install etckeeper
 323  }
 324 rule_filesystem_configure () {
 325         m4 \
 326          --define=VM_LVM_LV=$vm_lvm_lv \
 327          --define=VM_LVM_VG=$vm_lvm_vg \
 328          <"$tool"/etc/fstab.m4 |
 329         sudo install -m 644 -o root -g root /dev/stdin \
 330          /etc/fstab
 331         m4 \
 332          --define=VM_LVM_LV=$vm_lvm_lv \
 333          --define=VM_LVM_VG=$vm_lvm_vg \
 334          <"$tool"/etc/crypttab.m4 |
 335         sudo install -m 644 -o root -g root /dev/stdin \
 336          /etc/crypttab
 337         rule tmpfs_configure
 338  }
 339 rule_initramfs_configure () {
 340         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
 341                 MODULES=most
 342                 BUSYBOX=y
 343                 KEYMAP=y
 344                 COMPRESS=gzip
 345                 DEVICE=eth0
 346                 EOF
 347         sudo install -m 644 -o root -g root /dev/stdin /etc/modprobe.d/xen-pv.conf <<-EOF
 348                 alias eth0 xennet
 349                 alias scsi_hostadapter xenblk
 350                 EOF
 351         sudo install -m 644 -o root -g root /dev/stdin /etc/modules <<-EOF
 352                 sha1_generic
 353                 sha256_generic
 354                 sha512_generic
 355                 aes-x86_64
 356                 xts
 357                 # NOTE: pour Xen en mode HVM :
 358                 #modprobe xen-platform-pci
 359                 EOF
 360         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/modules <<-EOF
 361                 EOF
 362         sudo sed -e '/^configure_networking /s/ &$//' \
 363          -i /usr/share/initramfs-tools/scripts/init-premount/dropbear
 364          # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
 365         ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
 366         ( while IFS= read -r line
 367          do case $line in (*" RSA") return 0; break;; esac
 368          done; return 1 ) ||
 369          {
 370         sudo rm -f \
 371          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \
 372          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub
 373         sudo dropbearkey -t rsa -s 4096 -f \
 374          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
 375          }
 376         # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
 377         sudo install -d -m 640 -o root -g root \
 378          /etc/initramfs-tools/root \
 379          /etc/initramfs-tools/root/.ssh
 380         getent group sudo |
 381         while IFS=: read -r group x x users
 382          do while test -n "$users" && IFS=, read -r user users <<-EOF
 383                         $users
 384                         EOF
 385                  do eval local home\; home="~$user"
 386                         sudo cat "$home"/etc/ssh/authorized_keys
 387                  done
 388          done |
 389         sudo install -m 644 -o root -g root /dev/stdin \
 390          /etc/initramfs-tools/root/.ssh/authorized_keys
 391         sudo rm -f \
 392          /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
 393          /etc/initramfs-tools/root/.ssh/id_rsa.pub \
 394          /etc/initramfs-tools/root/.ssh/id_rsa
 395          # NOTE: clefs générées par Debian
 396         sudo update-initramfs -u
 397  }
 398 rule_insserv_remove () { # SYNTAX: $sv
 399         local sv="$1"
 400         #sudo chmod u+x /etc/init.d/"$sv"
 401         sudo insserv --force --remove "$sv"
 402         sudo test ! -x /etc/init.d/"$sv" ||
 403         sudo /etc/init.d/"$sv" stop
 404         sudo chmod ugo-x /etc/init.d/"$sv"
 405  }
 406 rule_gitolite_configure () {
 407         sudo debconf-set-selections <<-EOF
 408                 gitolite        gitolite/gituser        string  git
 409                 gitolite        gitolite/adminkey       string
 410                 gitolite        gitolite/gitdir string  /home/git
 411                 EOF
 412         rule apt_get_install gitolite
 413         rule adduser git \
 414          --disabled-password \
 415          --group \
 416          --home /home/git \
 417          --shell /bin/bash \
 418          --system
 419         sudo chfn --full-name git git
 420         rule adduser log-git \
 421          --disabled-login \
 422          --disabled-password \
 423          --group \
 424          --home /home/git/log \
 425          --shell /bin/false \
 426          --system
 427         rule adduser git-data \
 428          --disabled-login \
 429          --disabled-password \
 430          --group \
 431          --home /home/git/pub \
 432          --shell /bin/false \
 433          --system
 434         sudo adduser git        git-data
 435         sudo install -d -m 750 -o git -g git \
 436          /etc/gitolite \
 437          /home/git/etc \
 438          /home/git/etc/ssh
 439         sudo install -d -m 751 -o git -g git \
 440          /home/git
 441         sudo install -d -m 2770 -o git-data -g git-data \
 442          /home/git/pub
 443         sudo install -d -m 1771 -o git -g git \
 444          /home/git/log
 445         sudo install -d -m 2770 -o git -g log-git \
 446          /home/git/log/gitolite \
 447          /home/git/log/gitolite/perf
 448         sudo install -d -m 3771 -o git -g git \
 449          /home/git/hooks
 450         sudo ln -fns /etc/gitolite /home/git/etc/gitolite
 451         sudo ln -fns /etc/gitweb /home/git/etc/gitweb
 452         sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc
 453         sudo ln -fns etc/ssh /home/git/.ssh
 454         sudo install -m 770 -o git -g git /dev/stdin \
 455          /home/git/etc/gitolite/gitolite.rc <<-EOF
 456                 #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
 457                 #\$BIG_INFO_CAP = 20;
 458                 #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
 459                         # NOTE: Please use single quotes, not double quotes.
 460                 #\$GITWEB_URI_ESCAPE = 0;
 461                 \$GIT_PATH = "";
 462                 #\$GL_ADC_PATH = "";
 463                 \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
 464                 #\$GL_ALL_INCLUDES_SPECIAL = 0;
 465                 #\$GL_ALL_READ_ALL = 0;
 466                 \$GL_BIG_CONFIG = 0;
 467                 \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
 468                 \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
 469                 #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
 470                 \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
 471                 #\$GL_HOSTNAME = "git.$vm_domainname";
 472                         # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
 473                 #\$GL_HTTP_ANON_USER = "mob";
 474                 \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
 475                 \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
 476                 #\$GL_NICE_VALUE = 0;
 477                 \$GL_NO_CREATE_REPOS = 0;
 478                 \$GL_NO_DAEMON_NO_GITWEB = 0;
 479                 \$GL_NO_SETUP_AUTHKEYS = 0;
 480                 \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
 481                 \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
 482                 #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
 483                 #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
 484                 \$GL_SITE_INFO = "git.$vm_domainname";
 485                 #\$GL_SLAVE_MODE = 0;
 486                 \$GL_WILDREPOS = 0;
 487                 #\$GL_WILDREPOS_DEFPERMS = 'R @all';
 488                 \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
 489                 \$HTPASSWD_FILE = "";
 490                 \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
 491                 \$REPO_BASE = "pub";
 492                 \$REPO_UMASK = 0007;
 493                 \$RSYNC_BASE = "";
 494                 \$SVNSERVE = "";
 495                 #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
 496                 \$WEB_INTERFACE = "gitweb";
 497                 1;
 498                 EOF
 499         sudo install -m 600 -o git -g git \
 500          "$tool"/var/pub/ssh/git.key \
 501            /home/git/etc/ssh/git.pub
 502         sudo -u git \
 503          GL_RC=/home/git/etc/gitolite/gitolite.rc \
 504          GIT_AUTHOR_NAME=git \
 505                 gl-setup -q /home/git/etc/ssh/git.pub git
 506         local d
 507         for d in doc logs src
 508          do test ! -d /home/git/etc/gitolite/"$d" ||
 509                 rmdir /home/git/etc/gitolite/"$d"
 510          done
 511  }
 512 rule_locales_configure () {
 513         sudo debconf-set-selections <<-EOF
 514                 locales locales/default_environment_locale      select  None
 515                 locales locales/locales_to_be_generated multiselect     fr_FR.UTF-8 UTF-8
 516                 EOF
 517         rule dpkg_reconfigure locales
 518  }
 519 rule_login_configure () {
 520         sudo install -m 644 -o root -g root \
 521          "$tool"/etc/inittab \
 522                 /etc/inittab
 523         sudo install -m 644 -o root -g root \
 524          "$tool"/etc/login.defs \
 525                 /etc/login.defs
 526         grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session ||
 527         sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF
 528                 $(cat /etc/pam.d/common-session)
 529                 session optional pam_umask.so
 530                 EOF
 531         grep -q '^hvc0$' /etc/securetty ||
 532         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 533                 $(cat /etc/securetty)
 534                 hvc0
 535                 EOF
 536         grep -q '^xvc0$' /etc/securetty ||
 537         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 538                 $(cat /etc/securetty)
 539                 xvc0
 540                 EOF
 541  }
 542 rule_network_configure () {
 543         sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
 544                 $vm
 545                 EOF
 546         grep -q " $vm\$" /etc/hosts ||
 547         sudo install -m 644 -o root -g root /dev/stdin /etc/hosts <<-EOF
 548                 $(cat /etc/hosts)
 549                 127.0.0.1 $vm_fqdn $vm
 550                 EOF
 551         sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
 552                 search ${vm_host#*.}
 553                 nameserver ${vm_host_nameserver}
 554                 EOF
 555         m4 \
 556          --define=VM_IPV4=$vm_ipv4 \
 557          <"$tool"/etc/network/interfaces.m4 |
 558         sudo install -m 640 -o root -g root /dev/stdin \
 559          /etc/network/interfaces
 560  }
 561 rule_runit_configure () { # SYNTAX: $sv
 562         #rule apt_get_install runit
 563         if test $# = 0
 564          then
 565                 set +x
 566                 sudo sv status \
 567                  $(sudo find /etc/sv \
 568                  -mindepth 1 -maxdepth 1 -type d \
 569                  -printf '%p\n' | sort)
 570          else
 571                 local services=
 572                 while [ $# -gt 0 ]
 573                  do case $1 in
 574                          (--) shift; break;;
 575                          (*) services="$services $1"; shift;;
 576                          esac
 577                  done
 578                 #for sv in $(sudo find /etc/sv \
 579                 # -mindepth 1 -maxdepth 1 -type d \
 580                 # -false $(printf -- '-or -name %s\n' $services) \
 581                 # -printf '%f\n')
 582                 # do
 583                 #       case $(sudo sv stop "$sv" | tee /dev/stderr) in
 584                 #        (*": runsv not running") true;;
 585                 #        (*": unable to open supervise/ok: file does not exist") true;;
 586                 #        ("ok: down:"*) true;;
 587                 #        (*) false;;
 588                 #        esac
 589                 # done
 590                 for sv in $(find "$tool"/etc/sv \
 591                  -mindepth 1 -maxdepth 1 -type d \
 592                  -false $(printf -- '-or -name %s\n' $services) \
 593                  -printf '%f\n')
 594                  do
 595                         rule runit_sv_configure "$sv" "$@"
 596                         rule runit_sv_start     "$sv"
 597                  done
 598                 #sleep 3
 599                 #sudo find -L /etc/service -type l -delete
 600          fi
 601  }
 602 rule_runit_sv_configure () { # SYNTAX: $sv $configure_options
 603         local sv="$1"; shift
 604         sudo install -d -m 770 -o root -g root \
 605          /etc/sv/"$sv"
 606         sudo install -m 770 -o root -g root \
 607          "$tool"/etc/sv/"$sv"/run \
 608                 /etc/sv/"$sv"/run
 609         if test -e "$tool"/etc/sv/"$sv"/log/run
 610          then
 611                 sudo install -d -m 770 -o root -g root \
 612                  /etc/sv/"$sv"/log
 613                 sudo install -m 770 -o root -g root \
 614                  "$tool"/etc/sv/"$sv"/log/run \
 615                         /etc/sv/"$sv"/log/run
 616          fi
 617         (
 618         test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
 619         .         "$tool"/etc/sv/"$sv"/configure.sh || return 1
 620         )
 621         (
 622         test ! -r "$tool"/etc/sv/"$sv"/log/configure.sh ||
 623         .         "$tool"/etc/sv/"$sv"/log/configure.sh || return 1
 624         )
 625         sudo ln -fns \
 626                 ../sv/"$sv" \
 627          /etc/service/"$sv"
 628  }
 629 rule_runit_sv_restart () { # SYNTAX: $sv
 630         local sv="$1"
 631         while true
 632          do case $(sudo sv restart "$sv" | tee /dev/stderr) in
 633                  (*": runsv not running") sleep 1;;
 634                  (*": unable to open supervise/ok: file does not exist") sleep 1;;
 635                  (*) break;;
 636                  esac
 637          done
 638  }
 639 rule_runit_sv_start () { # SYNTAX: $sv
 640         local sv="$1"
 641         while true
 642          do case $(sudo sv start "$sv" | tee /dev/stderr) in
 643                  (*": runsv not running") sleep 1;;
 644                  (*": unable to open supervise/ok: file does not exist") sleep 1;;
 645                  (*) break;;
 646                  esac
 647          done
 648  }
 649 rule_shorewall_configure () {
 650         # DOC: http://shorewall.net/Introduction.html
 651         local -; set +f
 652         rule apt_get_install shorewall
 653         sudo install -m 644 -o root -g root /dev/stdin \
 654          /etc/default/shorewall <<-EOF
 655                 INITLOG=/dev/null
 656                 OPTIONS=""
 657                 RESTARTOPTIONS=""
 658                 SAFESTOP=0
 659                 STARTOPTIONS=""
 660                 startup=1
 661                 EOF
 662         local conf
 663         for conf in "$tool"/etc/shorewall/*
 664          do conf=${conf#"$tool"/etc/shorewall/}
 665                 sudo test ! -f "$tool"/etc/shorewall/"$conf" ||
 666                 sudo install -m 640 -o root -g root \
 667                  "$tool"/etc/shorewall/"$conf" \
 668                         /etc/shorewall/"$conf"
 669          done
 670         sudo install -d -m 750 -o root -g root \
 671          /etc/shorewall/macro.d
 672         for conf in "$tool"/etc/shorewall/macro.d/*
 673          do conf=${conf#"$tool"/etc/shorewall/macro.d/}
 674                 sudo test ! -f "$tool"/etc/shorewall/macro.d/"$conf" ||
 675                 sudo install -m 640 -o root -g root \
 676                  "$tool"/etc/shorewall/macro.d/"$conf" \
 677                         /etc/shorewall/macro.d/"$conf"
 678          done
 679         sudo install -d -m 750 -o root -g root \
 680          /etc/shorewall/action.d
 681         #for conf in "$tool"/etc/shorewall/action.d/*
 682         # do conf=${conf#"$tool"/etc/shorewall/action.d/}
 683         #       sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" ||
 684         #       sudo install -m 640 -o root -g root \
 685         #        "$tool"/etc/shorewall/action.d/"$conf" \
 686         #               /etc/shorewall/action.d/"$conf"
 687         # done
 688         #sudo shorewall safe-restart
 689  }
 690 rule_sysctl_configure () {
 691         local -; set +f
 692         for conf in "$tool"/etc/sysctl.d/*.conf
 693          do conf=${conf#"$tool"/etc/sysctl.d/}
 694                 sudo install -m 660 -o root -g root \
 695                  "$tool"/etc/sysctl.d/"$conf" \
 696                         /etc/sysctl.d/"$conf"
 697          done
 698         sudo install -m 660 -o root -g root /dev/stdin \
 699          /etc/sysctl.d/local-kernel-name.conf <<-EOF
 700                 kernel.hostname   = $vm_hostname
 701                 kernel.domainname = $vm_domainname
 702                 EOF
 703         sudo sysctl --system
 704  }
 705 rule_tmpfs_configure () {
 706         sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
 707                 LOCK_SIZE=5242880 # NOTE: 5MiB
 708                 RAMLOCK=yes
 709                 RAMSHM=yes
 710                 RAMTMP=yes
 711                 RUN_SIZE=10%
 712                 SHM_SIZE=
 713                 TMP_MODE=1777,nr_inodes=1000k,noatime
 714                 TMP_OVERFLOW_LIMIT=1024
 715                  # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
 716                  #       on the root filesystem (overriding RAMTMP).
 717                 TMP_SIZE=200m
 718                 TMPFS_SIZE=20%VM
 719                 EOF
 720  }
 721 rule_user_add () { # SYNTAX: $user
 722         local user="$1"; shift
 723         rule adduser "$user" --disabled-password "$@"
 724                 # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
 725         eval local home\; home="~$user"
 726         sudo adduser "$user" users
 727         sudo install -m 640 -o "$user" -g "$user" \
 728          "$tool"/var/pub/ssh/"$user".key \
 729          "$home"/etc/ssh/authorized_keys
 730         local key; local -; set +f
 731         for key in "$tool"/var/pub/openpgp/*.key
 732          do sudo -u "$user" gpg --import - <"$key"
 733          done
 734  }
 735 rule_user_configure () {
 736         rule apt_get_install bash-completion
 737         sudo install -m 660 -o root -g root \
 738          "$tool"/etc/adduser.conf \
 739                 /etc/adduser.conf
 740         sudo install -d -m 750 -o root -g root \
 741          /etc/skel \
 742          /etc/skel/etc \
 743          /etc/skel/etc/gpg \
 744          /etc/skel/etc/ssh
 745         sudo install -d -m 770 -o root -g root \
 746          /etc/skel/var \
 747          /etc/skel/var/cache \
 748          /etc/skel/var/log \
 749          /etc/skel/var/run \
 750          /etc/skel/var/run/ssh
 751         sudo ln -fns etc/ssh /etc/skel/.ssh
 752         sudo ln -fns etc/gpg /etc/skel/.gnupg
 753         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF
 754                 %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
 755                   case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
 756                     ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
 757                 EOF
 758         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
 759                 %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
 760                 EOF
 761         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
 762                 Defaults env_keep = " \\
 763                   EDITOR \\
 764                   GIT_AUTHOR_NAME \\
 765                   GIT_AUTHOR_EMAIL \\
 766                   GIT_COMMITTER_NAME \\
 767                   GIT_COMMITTER_EMAIL \\
 768                  "
 769                 EOF
 770         sudo install -m 755 -o root -g root /dev/stdin /usr/local/bin/passwd-init <<-EOF
 771                 #!/bin/sh -efu
 772                 # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
 773                 sudo /bin/sh -e -f -u -c \
 774                   'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
 775                 EOF
 776         sudo install -m 644 -o root -g root \
 777          "$tool"/etc/bash.bashrc \
 778                 /etc/bash.bashrc
 779         sudo install -m 644 -o root -g root \
 780          "$tool"/etc/screenrc \
 781                 /etc/screenrc
 782         local sh; local -; set +f
 783         for sh in "$tool"/etc/user.d/*/configure.sh
 784          do sh=${sh#"$tool"/etc/user.d/}
 785                 local user="${sh%/configure.sh}"
 786                 (
 787                 . "$tool"/etc/user.d/"$sh" || return 1
 788                 )
 789          done
 790  }
 791 rule_user_admin_add () { # SYNTAX: $user
 792         rule user_configure
 793         local user=$1
 794         rule adduser "$user" --disabled-password
 795         eval local home\; home="~$user"
 796         sudo adduser "$user" sudo
 797         sudo install -m 640 -o root -g root \
 798          "$tool"/var/pub/ssh/"$user".key \
 799          "$home"/etc/ssh/authorized_keys
 800         local key; local -; set +f
 801         for key in "$tool"/var/pub/openpgp/*.key
 802          do sudo -u "$user" gpg --import - <"$key"
 803          done
 804         rule user_admin_configure
 805  }
 806 rule_user_admin_configure () {
 807         rule initramfs_configure
 808         rule user_root_configure
 809  }
 810 rule_user_root_configure () {
 811         sudo install -d -m 750 -o root -g root \
 812          /root/etc \
 813          /root/etc/gpg \
 814          /root/etc/ssh
 815         sudo ln -fns etc/gpg /root/.gnupg
 816         sudo ln -fns etc/ssh /root/.ssh
 817         getent group sudo |
 818         while IFS=: read -r group x x users
 819          do while test -n "$users" && IFS=, read -r user users <<-EOF
 820                         $users
 821                         EOF
 822                  do eval local home\; home="~$user"
 823                         sudo cat "$home"/etc/ssh/authorized_keys
 824                  done
 825          done |
 826         sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys
 827         local key; local -; set +f
 828         for key in "$tool"/var/pub/openpgp/*.key
 829          do sudo gpg --import "$key"
 830          done
 831  }
 832 rule_www_configure () {
 833         rule adduser www \
 834          --disabled-login \
 835          --disabled-password \
 836          --group \
 837          --home /home/www \
 838          --shell /bin/false \
 839          --system
 840         rule adduser log-www \
 841          --disabled-login \
 842          --disabled-password \
 843          --group \
 844          --home /home/www/log \
 845          --shell /bin/false \
 846          --system
 847         #sudo adduser www www-data
 848         sudo adduser www log-www
 849         #sudo adduser log log-www
 850         usermod --home /home/www/pub www-data
 851         sudo install -d -m 751 -o www -g www \
 852          /home/www
 853         sudo install -d -m 750 -o www -g www \
 854          /home/www/etc
 855         sudo install -d -m 1771 -o www-data -g www-data \
 856          /home/www/pub
 857         sudo install -d -m 1771 -o log-www -g log-www \
 858          /home/www/log
 859  }
 860 rule_configure () {
 861         rule apt_configure
 862         rule git_configure
 863         rule etckeeper_configure
 864         rule locales_configure
 865         rule time_configure
 866         rule network_configure
 867         rule filesystem_configure
 868         rule login_configure
 869         rule ssh_configure
 870         rule user_root_configure
 871         rule boot_configure
 872         rule sysctl_configure
 873         rule user_configure
 874         rule gitolite_configure
 875         rule shorewall_configure
 876         rule runit_configure
 877  }
 878
 879 rule_luks_key_change () {
 880         sudo cryptsetup luksChangeKey /dev/$vm_lvm_vg/${vm_lvm_lv}_root
 881  }
 882
 883 rule=${1:-help}
 884 ${1+shift}
 885 case $rule in
 886  (help);;
 887  (*)
 888         assert 'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
 889         ;;
 890  esac
 891 rule $rule "$@"