vm_hosted

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=$0
   4 while test -L "$tool"
   5  do tool=$(readlink "$tool")
   6  done
   7 tool=${tool%/*}
   8 . "$tool"/lib/rule.sh
   9 . "$tool"/etc/vm.sh
  10 export TRACE=1
  11
  12 rule_help () { # SYNTAX: [--hidden]
  13         local hidden; [ ${1:+set} ] || hidden=set
  14         cat >&2 <<-EOF
  15                 DESCRIPTION:
  16                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  17                   _depuis_ la VM hébergée ($vm_fqdn) ;
  18                   il sert à la fois d'outil (aisément bidouillable)
  19                   et de documentation (préçise).
  20                   Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
  21                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  22                 RULES:
  23                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  24                 ENVIRONMENT:
  25                   TRACE # affiche les commandes avant leur exécution
  26                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  27                 EOF
  28  }
  29
  30 rule_git_configure () {
  31         (
  32         cd "$tool"
  33         git config --replace branch.master.remote .
  34         git config --replace branch.master.merge refs/remotes/master
  35         local tool
  36         tool=$(cd "$tool"; cd -)
  37         install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
  38                 #!/bin/sh -efux
  39                 case \$1 in
  40                  (refs/remotes/master)
  41                         cd ..
  42                         git --git-dir=\$PWD/.git checkout -f -B master remotes/master
  43                         git --git-dir=\$PWD/.git clean -f -d -x
  44                         ;;
  45                  esac
  46                 EOF
  47         )
  48  }
  49 rule_git_reset () {
  50         (
  51         cd "$tool"
  52         git checkout -f -B master remotes/master
  53         git clean -f -d -x
  54         )
  55  }
  56
  57 rule_adduser () {
  58         local user="$1"; shift
  59         getent passwd "$user" >/dev/null ||
  60         sudo adduser "$@" "$user"
  61  }
  62 rule_apt_get_install () { # SYNTAX: $package
  63         sudo \
  64          DEBIAN_FRONTEND=noninteractive \
  65          DEBIAN_PRIORITY=low \
  66          apt-get install --yes "$@"
  67  }
  68 rule_dpkg_reconfigure () { # SYNTAX: $package
  69         sudo \
  70          DEBIAN_FRONTEND=noninteractive \
  71          DEBIAN_PRIORITY=low \
  72          dpkg-reconfigure "$@"
  73  }
  74
  75 rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
  76         export LANG=C
  77         export LC_CTYPE=C
  78         . /etc/profile
  79  }
  80
  81 rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour
  82         local -; set +f
  83         rule apt_get_install \
  84          apache2-mpm-itk \
  85          libapache2-mod-php5
  86                 # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
  87                 # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
  88                 # NOTE: apache2-mpm-itk semble le plus sécurisé,
  89                 # car on est certain que tout est exécuté avec les uid/gid
  90                 # assignés au VirtualHost/Directory/Location
  91                 # néamoins il se peut qu'une combinaison du genre :
  92                 # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
  93                 # soit plus performante (threads et pas forks),
  94                 # cependant l'usage de suexec impose des forks il semble..
  95                 # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
  96                 # donc pour l'instant : apache2-mpm-itk
  97         sudo rm -rf \
  98          /etc/apache2/site.d
  99         sudo install -d -m 770 -o www -g www \
 100          /etc/apache2 \
 101          /etc/apache2/site.d \
 102          /etc/apache2/x509.d
 103         cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF |
 104                 ServerName "$vm_fqdn"
 105                 EOF
 106         sudo install -m 660 -o root -g root /dev/stdin \
 107          /etc/apache2/apache2.conf
 108         sudo install -m 660 -o root -g root \
 109          "$tool"/etc/apache2/envvars \
 110                 /etc/apache2/envvars
 111         sudo install -m 660 -o root -g root \
 112          "$tool"/etc/apache2/httpd.conf \
 113                 /etc/apache2/httpd.conf
 114         #sudo install -m 660 -o root -g root /dev/stdin \
 115         # /etc/apache2/suexec/www-data <<-EOF
 116         #       /home
 117         #       pub/www/cgi
 118         #       EOF
 119         sudo install -m 660 -o root -g root \
 120          "$tool"/etc/apache2/ports.conf \
 121                 /etc/apache2/ports.conf
 122         sudo a2enmod actions
 123         sudo a2enmod headers
 124         sudo a2enmod rewrite
 125         sudo a2enmod ssl
 126         sudo a2enmod userdir
 127         local conf
 128         sudo a2dissite "*"
 129         sudo ln -fns \
 130          /etc/apache2 \
 131          /home/www/etc/apache2
 132         for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
 133          do conf=${conf#"$tool"/etc/apache2/site.d/}
 134                 local site=${conf%/VirtualHost.conf}
 135                 case $site in
 136                  (*-tls)
 137                         local hint="run vm_remote apache2_key_send before"
 138                         assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
 139                         sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 140                          /etc/apache2 \
 141                          /etc/apache2/site.d/"$site" \
 142                          /etc/apache2/x509.d/"$site" \
 143                          /etc/apache2/x509.d/"$site"/ca \
 144                          /etc/apache2/x509.d/"$site"/empty \
 145                          /etc/apache2/x509.d/"$site"/rvk \
 146                          /etc/apache2/x509.d/"$site"/usr
 147                         sudo install -m 664 -o www -g www \
 148                          "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \
 149                           /etc/apache2/x509.d/"$site"/crt.self-signed.pem
 150                         #sudo install -m 664 -o www-"$site" -g www-"$site" \
 151                         # "$tool"/var/pub/x509/"$site"/rvk.pem \
 152                         #  /etc/apache2/x509.d/"$site"/rvk.pem
 153                         sudo install -m 664 -o www -g www \
 154                          "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \
 155                           /etc/apache2/x509.d/"$site"/ca/crt.pem
 156                         sudo install -m 664 -o www -g www \
 157                          "$tool"/var/pub/x509/"$site"/crt.pem \
 158                           /etc/apache2/x509.d/"$site"/crt.pem
 159                         ;;
 160                  esac
 161                 case $site in
 162                  (*-tls)
 163                         cat <<-EOF
 164                                 <IfModule mod_ssl.c>
 165                                         <VirtualHost *:$port>
 166                                                 AssignUserID www-$site www-$site
 167                                                 BrowserMatch "MSIE [2-6]"  ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
 168                                                 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
 169                                                 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 170                                                 #CustomLog "/dev/null" Combined
 171                                                 DocumentRoot /home/www/pub/$site
 172                                                 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 173                                                 #ErrorLog "/dev/null"
 174                                                 LogLevel Warn
 175                                                 SSLCACertificateFile    /etc/apache2/x509.d/$site/crt.self-signed.pem
 176                                                 SSLCACertificatePath    /etc/apache2/x509.d/$site/usr/
 177                                                 #SSLCARevocationFile    /etc/apache2/x509.d/$site/rvk.pem
 178                                                 SSLCADNRequestFile      /etc/apache2/x509.d/$site/crt.self-signed.pem
 179                                                 SSLCADNRequestPath      /etc/apache2/x509.d/$site/empty/
 180                                                         # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés
 181                                                 SSLCARevocationPath     /etc/apache2/x509.d/$site/rvk/
 182                                                 SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem
 183                                                 SSLCertificateFile      /etc/apache2/x509.d/$site/crt.pem
 184                                                 SSLCertificateKeyFile   /etc/apache2/x509.d/$site/key.pem
 185                                                 SSLCipherSuite AES+RSA+SHA256
 186                                                 SSLEngine On
 187                                                 SSLInsecureRenegotiation Off
 188                                                 SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
 189                                                 SSLProtocol -All +TLSv1
 190                                                 #SSLRenegBufferSize 262144
 191                                                 SSLSessionCacheTimeout 1200
 192                                                 SSLStrictSNIVHostCheck On
 193                                                 SSLUserName SSL_CLIENT_S_DN_CN
 194                                                 SSLVerifyClient None
 195                                                 SSLVerifyDepth 1
 196                                                 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 197                                          </VirtualHost>
 198                                  </IfModule>
 199                                 EOF
 200                         ;;
 201                  (*)
 202                         cat <<-EOF
 203                                 <VirtualHost *:$port>
 204                                         AssignUserID www-$site www-$site
 205                                         CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 206                                         #CustomLog "/dev/null" Combined
 207                                         DocumentRoot /home/www/pub/$site
 208                                         ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 209                                         #ErrorLog "/dev/null"
 210                                         LogLevel Warn
 211                                         $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 212                                  </VirtualHost>
 213                                 EOF
 214                         ;;
 215                  esac |
 216                 sudo install -m 660 -o root -g root /dev/stdin \
 217                  /etc/apache2/site.d/"$site"/VirtualHost.conf
 218                 sudo ln -fns \
 219                  ../site.d/"$site"/VirtualHost.conf \
 220                  /etc/apache2/sites-available/"$site"
 221                 sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 222                  /home/www/log/"$site" \
 223                  /home/www/log/"$site"/apache2
 224                 sudo ln -fns \
 225                  /etc/apache2/site.d/"$site" \
 226                  /home/www/etc/apache2/"$site"
 227                 test -e /home/www/pub/"$site" ||
 228                 sudo install -d -m 2770 -o www-"$site" -g www-"$site" \
 229                  /home/www/pub/"$site"
 230                 rule adduser www-"$site"
 231                  --disabled-password \
 232                  --group \
 233                  --no-create-home \
 234                  --home /home/www/pub/"$site" \
 235                  --shell /bin/false \
 236                  --system
 237                 #sudo setfacl -m u:"www-$site":--x \
 238                 # /home/www/ \
 239                 # /home/www/pub/ \
 240                 # /home/www/pub/"$site"/
 241                 #sudo setfacl -m d:u:"www-$site":rwx \
 242                 # "$home"/pub/www/"$site"/
 243                 test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh ||
 244                 .         "$tool"/etc/apache2/site.d/"$site"/configure.sh
 245                 test -e /etc/apache2/sites-enabled/"$site" ||
 246                 sudo a2ensite "$site"
 247          done
 248         sudo service apache2 restart
 249  }
 250 rule_apt_configure () {
 251         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
 252                 deb http://ftp.rezopole.net/debian $vm_lsb_name main
 253                 EOF
 254         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
 255                 deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
 256                 EOF
 257         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
 258                 deb http://nightly.openerp.com/7.0/nightly/deb/ ./
 259                 EOF
 260         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
 261                 Package: *
 262                 Pin: release a=$vm_lsb_name
 263                 Pin-Priority: 200
 264
 265                 Package: *
 266                 Pin: release a=$vm_lsb_name-backports
 267                 Pin-Priority: 170
 268                 EOF
 269         sudo apt-get update
 270         rule apt_get_install apticron
 271         m4 \
 272          --define=VM_DOMAINNAME=$vm_domainname \
 273          <"$tool"/etc/apticron/apticron.conf.m4 |
 274         sudo install -m 644 -o root -g root /dev/stdin \
 275          /etc/apticron/apticron.conf
 276  }
 277 rule_boot_configure () {
 278         #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
 279         sudo debconf-set-selections <<-EOF
 280                 grub-pc grub-pc/install_devices multiselect
 281                 EOF
 282         rule apt_get_install grub-pc
 283         sudo install -d -m 644 -o root -g root /boot/grub
 284         rule apt_get_install linux-image-$vm_arch
 285         sudo install -m 644 -o root -g root /dev/stdin /etc/default/grub <<-EOF
 286                 GRUB_DEFAULT=0
 287                 GRUB_TIMEOUT=5
 288                 GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
 289                 GRUB_CMDLINE_LINUX_DEFAULT="quiet"
 290                 GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
 291                 GRUB_DISABLE_RECOVERY="true"
 292                 #GRUB_PRELOAD_MODULES="lvm"
 293                 EOF
 294         sudo install -m 644 -o root -g root /dev/stdin /boot/grub/device.map <<-EOF
 295                 (hd0)   /dev/xvda
 296                 (hd0)   /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
 297                 EOF
 298         sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
 299         rule initramfs_configure
 300         rule apt_get_install molly-guard
 301         sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
 302                 ALWAYS_QUERY_HOSTNAME=true
 303                  # NOTE: une alternative est de dire à sudo de conserver les SSH_*
 304                  #       néamoins demander tout le temps n'est pas trop contraignant
 305                  #       et davantage sécurisant.
 306                 EOF
 307  }
 308 rule_duplicity_configure () {
 309         rule apt_get_install duplicity
 310         home="/home/backup"
 311         rule adduser backup \
 312          --disabled-password \
 313          --group \
 314          --home "$home" \
 315          --shell /bin/bash \
 316          --system
 317         sudo usermod --home "$home" backup
 318         sudo install -d -m 750 -o backup -g backup \
 319          "$home" \
 320          "$home"/etc \
 321          "$home"/etc/gpg \
 322          "$home"/etc/ssh
 323         sudo install -d -m 770 -o backup -g backup \
 324          "$home"/mysql \
 325          "$home"/postgres
 326         getent group sudo backup |
 327         while IFS=: read -r group x x users
 328          do while test -n "$users" && IFS=, read -r user users <<-EOF
 329                         $users
 330                         EOF
 331                  do eval local home\; home="~$user"
 332                         sudo cat "$home"/etc/ssh/authorized_keys
 333                  done
 334          done |
 335         sudo install -m 640 -o backup -g backup /dev/stdin \
 336          "$home"/etc/ssh/authorized_keys
 337         sudo ln -fns etc/gpg "$home"/.gnupg
 338         #sudo adduser backup mysql-data
 339         #sudo adduser backup postgres-data
 340  }
 341 rule_etckeeper_configure () {
 342         sudo install -m 644 -o root -g root /dev/stdin /etc/etckeeper/etckeeper.conf <<-EOF
 343                 VCS=git
 344                 GIT_COMMIT_OPTIONS=""
 345                 AVOID_DAILY_AUTOCOMMITS=1
 346                 #AVOID_SPECIAL_FILE_WARNING=1
 347                 AVOID_COMMIT_BEFORE_INSTALL=1
 348                 HIGHLEVEL_PACKAGE_MANAGER=apt
 349                 LOWLEVEL_PACKAGE_MANAGER=dpkg
 350                 EOF
 351         sudo install -m 644 -o root -g root \
 352          "$tool"/etc/etckeeper/prompt.sh \
 353                 /etc/etckeeper/prompt.sh
 354         rule apt_get_install etckeeper
 355  }
 356 rule_filesystem_configure () {
 357         m4 \
 358          --define=VM_LVM_LV=$vm_lvm_lv \
 359          --define=VM_LVM_VG=$vm_lvm_vg \
 360          <"$tool"/etc/fstab.m4 |
 361         sudo install -m 644 -o root -g root /dev/stdin \
 362          /etc/fstab
 363         m4 \
 364          --define=VM_LVM_LV=$vm_lvm_lv \
 365          --define=VM_LVM_VG=$vm_lvm_vg \
 366          <"$tool"/etc/crypttab.m4 |
 367         sudo install -m 644 -o root -g root /dev/stdin \
 368          /etc/crypttab
 369         rule tmpfs_configure
 370  }
 371 rule_initramfs_configure () {
 372         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
 373                 MODULES=most
 374                 BUSYBOX=y
 375                 KEYMAP=y
 376                 COMPRESS=gzip
 377                 DEVICE=eth0
 378                 EOF
 379         sudo install -m 644 -o root -g root /dev/stdin /etc/modprobe.d/xen-pv.conf <<-EOF
 380                 alias eth0 xennet
 381                 alias scsi_hostadapter xenblk
 382                 EOF
 383         sudo install -m 644 -o root -g root /dev/stdin /etc/modules <<-EOF
 384                 sha1_generic
 385                 sha256_generic
 386                 sha512_generic
 387                 aes-x86_64
 388                 xts
 389                 # NOTE: pour Xen en mode HVM :
 390                 #modprobe xen-platform-pci
 391                 EOF
 392         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/modules <<-EOF
 393                 EOF
 394         sudo sed -e '/^configure_networking /s/ &$//' \
 395          -i /usr/share/initramfs-tools/scripts/init-premount/dropbear
 396          # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
 397         ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
 398         ( while IFS= read -r line
 399          do case $line in (*" RSA") return 0; break;; esac
 400          done; return 1 ) ||
 401          {
 402         sudo rm -f \
 403          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \
 404          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub
 405         sudo dropbearkey -t rsa -s 4096 -f \
 406          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
 407          }
 408         # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
 409         sudo install -d -m 640 -o root -g root \
 410          /etc/initramfs-tools/root \
 411          /etc/initramfs-tools/root/.ssh
 412         getent group sudo |
 413         while IFS=: read -r group x x users
 414          do while test -n "$users" && IFS=, read -r user users <<-EOF
 415                         $users
 416                         EOF
 417                  do eval local home\; home="~$user"
 418                         sudo cat "$home"/etc/ssh/authorized_keys
 419                  done
 420          done |
 421         sudo install -m 644 -o root -g root /dev/stdin \
 422          /etc/initramfs-tools/root/.ssh/authorized_keys
 423         sudo rm -f \
 424          /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
 425          /etc/initramfs-tools/root/.ssh/id_rsa.pub \
 426          /etc/initramfs-tools/root/.ssh/id_rsa
 427          # NOTE: clefs générées par Debian
 428         sudo update-initramfs -u
 429  }
 430 rule_insserv_remove () { # SYNTAX: $sv
 431         local sv="$1"
 432         #sudo chmod u+x /etc/init.d/"$sv"
 433         sudo insserv --force --remove "$sv"
 434         sudo test ! -x /etc/init.d/"$sv" ||
 435         sudo /etc/init.d/"$sv" stop
 436         sudo chmod ugo-x /etc/init.d/"$sv"
 437  }
 438 rule_gitolite_configure () {
 439         sudo debconf-set-selections <<-EOF
 440                 gitolite        gitolite/gituser        string  git
 441                 gitolite        gitolite/adminkey       string
 442                 gitolite        gitolite/gitdir string  /home/git
 443                 EOF
 444         rule apt_get_install gitolite
 445         rule adduser git \
 446          --disabled-password \
 447          --group \
 448          --home /home/git \
 449          --shell /bin/bash \
 450          --system
 451         sudo chfn --full-name git git
 452         rule adduser log-git \
 453          --disabled-login \
 454          --disabled-password \
 455          --group \
 456          --home /home/git/log \
 457          --shell /bin/false \
 458          --system
 459         rule adduser git-data \
 460          --disabled-login \
 461          --disabled-password \
 462          --group \
 463          --home /home/git/pub \
 464          --shell /bin/false \
 465          --system
 466         sudo adduser git        git-data
 467         sudo install -d -m 750 -o git -g git \
 468          /etc/gitolite \
 469          /home/git/etc \
 470          /home/git/etc/ssh
 471         sudo install -d -m 751 -o git -g git \
 472          /home/git
 473         sudo install -d -m 2770 -o git-data -g git-data \
 474          /home/git/pub
 475         sudo install -d -m 1771 -o git -g git \
 476          /home/git/log
 477         sudo install -d -m 2770 -o git -g log-git \
 478          /home/git/log/gitolite \
 479          /home/git/log/gitolite/perf
 480         sudo install -d -m 3771 -o git -g git \
 481          /home/git/hooks
 482         sudo ln -fns /etc/gitolite /home/git/etc/gitolite
 483         sudo ln -fns /etc/gitweb /home/git/etc/gitweb
 484         sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc
 485         sudo ln -fns etc/ssh /home/git/.ssh
 486         sudo install -m 770 -o git -g git /dev/stdin \
 487          /home/git/etc/gitolite/gitolite.rc <<-EOF
 488                 #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
 489                 #\$BIG_INFO_CAP = 20;
 490                 #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
 491                         # NOTE: Please use single quotes, not double quotes.
 492                 #\$GITWEB_URI_ESCAPE = 0;
 493                 \$GIT_PATH = "";
 494                 #\$GL_ADC_PATH = "";
 495                 \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
 496                 #\$GL_ALL_INCLUDES_SPECIAL = 0;
 497                 #\$GL_ALL_READ_ALL = 0;
 498                 \$GL_BIG_CONFIG = 0;
 499                 \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
 500                 \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
 501                 #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
 502                 \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
 503                 #\$GL_HOSTNAME = "git.$vm_domainname";
 504                         # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
 505                 #\$GL_HTTP_ANON_USER = "mob";
 506                 \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
 507                 \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
 508                 #\$GL_NICE_VALUE = 0;
 509                 \$GL_NO_CREATE_REPOS = 0;
 510                 \$GL_NO_DAEMON_NO_GITWEB = 0;
 511                 \$GL_NO_SETUP_AUTHKEYS = 0;
 512                 \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
 513                 \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
 514                 #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
 515                 #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
 516                 \$GL_SITE_INFO = "git.$vm_domainname";
 517                 #\$GL_SLAVE_MODE = 0;
 518                 \$GL_WILDREPOS = 0;
 519                 #\$GL_WILDREPOS_DEFPERMS = 'R @all';
 520                 \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
 521                 \$HTPASSWD_FILE = "";
 522                 \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
 523                 \$REPO_BASE = "pub";
 524                 \$REPO_UMASK = 0007;
 525                 \$RSYNC_BASE = "";
 526                 \$SVNSERVE = "";
 527                 #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
 528                 \$WEB_INTERFACE = "gitweb";
 529                 1;
 530                 EOF
 531         sudo install -m 600 -o git -g git \
 532          "$tool"/var/pub/ssh/git.key \
 533            /home/git/etc/ssh/git.pub
 534         sudo -u git \
 535          GL_RC=/home/git/etc/gitolite/gitolite.rc \
 536          GIT_AUTHOR_NAME=git \
 537                 gl-setup -q /home/git/etc/ssh/git.pub git
 538         local d
 539         for d in doc logs src
 540          do test ! -d /home/git/etc/gitolite/"$d" ||
 541                 rmdir /home/git/etc/gitolite/"$d"
 542          done
 543  }
 544 rule_locales_configure () {
 545         sudo debconf-set-selections <<-EOF
 546                 locales locales/default_environment_locale      select  None
 547                 locales locales/locales_to_be_generated multiselect     fr_FR.UTF-8 UTF-8
 548                 EOF
 549         rule dpkg_reconfigure locales
 550  }
 551 rule_login_configure () {
 552         sudo install -m 644 -o root -g root \
 553          "$tool"/etc/inittab \
 554                 /etc/inittab
 555         sudo install -m 644 -o root -g root \
 556          "$tool"/etc/login.defs \
 557                 /etc/login.defs
 558         grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session ||
 559         sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF
 560                 $(cat /etc/pam.d/common-session)
 561                 session optional pam_umask.so
 562                 EOF
 563         grep -q '^hvc0$' /etc/securetty ||
 564         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 565                 $(cat /etc/securetty)
 566                 hvc0
 567                 EOF
 568         grep -q '^xvc0$' /etc/securetty ||
 569         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 570                 $(cat /etc/securetty)
 571                 xvc0
 572                 EOF
 573  }
 574 rule_network_configure () {
 575         sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
 576                 $vm
 577                 EOF
 578         grep -q " $vm\$" /etc/hosts ||
 579         sudo install -m 644 -o root -g root /dev/stdin /etc/hosts <<-EOF
 580                 $(cat /etc/hosts)
 581                 127.0.0.1 $vm_fqdn $vm
 582                 EOF
 583         sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
 584                 search ${vm_host#*.}
 585                 nameserver ${vm_host_nameserver}
 586                 EOF
 587         m4 \
 588          --define=VM_IPV4=$vm_ipv4 \
 589          <"$tool"/etc/network/interfaces.m4 |
 590         sudo install -m 640 -o root -g root /dev/stdin \
 591          /etc/network/interfaces
 592  }
 593 rule_runit_configure () { # SYNTAX: $sv [...] -- $configure_options
 594         rule apt_get_install runit
 595         if test $# = 0
 596          then
 597                 set +x
 598                 sudo sv status \
 599                  $(sudo find /etc/sv \
 600                  -mindepth 1 -maxdepth 1 -type d \
 601                  -printf '%p\n' | sort)
 602          else
 603                 local services=
 604                 while [ $# -gt 0 ]
 605                  do case $1 in
 606                          (--) shift; break;;
 607                          (*) services="$services $1"; shift;;
 608                          esac
 609                  done
 610                 #for sv in $(sudo find /etc/sv \
 611                 # -mindepth 1 -maxdepth 1 -type d \
 612                 # -false $(printf -- '-or -name %s\n' $services) \
 613                 # -printf '%f\n')
 614                 # do
 615                 #       case $(sudo sv stop "$sv" | tee /dev/stderr) in
 616                 #        (*": runsv not running") true;;
 617                 #        (*": unable to open supervise/ok: file does not exist") true;;
 618                 #        ("ok: down:"*) true;;
 619                 #        (*) false;;
 620                 #        esac
 621                 # done
 622                 for sv in $(find "$tool"/etc/sv \
 623                  -mindepth 1 -maxdepth 1 -type d \
 624                  -false $(printf -- '-or -name %s\n' $services) \
 625                  -printf '%f\n')
 626                  do
 627                         rule _runit_sv_configure "$sv" "$@"
 628                         rule _runit_sv_start     "$sv"
 629                  done
 630                 #sleep 3
 631                 #sudo find -L /etc/service -type l -delete
 632          fi
 633  }
 634 rule__runit_sv_configure () { # SYNTAX: $sv $configure_options
 635         local sv="$1"; shift
 636         sudo install -d -m 770 -o root -g root \
 637          /etc/sv/"$sv"
 638         sudo install -m 770 -o root -g root \
 639          "$tool"/etc/sv/"$sv"/run \
 640                 /etc/sv/"$sv"/run
 641         if test -e "$tool"/etc/sv/"$sv"/log/run
 642          then
 643                 sudo install -d -m 770 -o root -g root \
 644                  /etc/sv/"$sv"/log
 645                 sudo install -m 770 -o root -g root \
 646                  "$tool"/etc/sv/"$sv"/log/run \
 647                         /etc/sv/"$sv"/log/run
 648          fi
 649         (
 650         test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
 651         .         "$tool"/etc/sv/"$sv"/configure.sh || return 1
 652         )
 653         (
 654         test ! -r "$tool"/etc/sv/"$sv"/log/configure.sh ||
 655         .         "$tool"/etc/sv/"$sv"/log/configure.sh || return 1
 656         )
 657         sudo ln -fns \
 658                 ../sv/"$sv" \
 659          /etc/service/"$sv"
 660  }
 661 rule__runit_sv_restart () { # SYNTAX: $sv
 662         local sv="$1"
 663         while true
 664          do case $(sudo sv restart "$sv" | tee /dev/stderr) in
 665                  (*": runsv not running") sleep 1;;
 666                  (*": unable to open supervise/ok: file does not exist") sleep 1;;
 667                  (*) break;;
 668                  esac
 669          done
 670  }
 671 rule__runit_sv_start () { # SYNTAX: $sv
 672         local sv="$1"
 673         while true
 674          do case $(sudo sv start "$sv" | tee /dev/stderr) in
 675                  (*": runsv not running") sleep 1;;
 676                  (*": unable to open supervise/ok: file does not exist") sleep 1;;
 677                  (*) break;;
 678                  esac
 679          done
 680  }
 681 rule_shorewall_configure () {
 682         # DOC: http://shorewall.net/Introduction.html
 683         local -; set +f
 684         rule apt_get_install shorewall
 685         sudo install -m 644 -o root -g root /dev/stdin \
 686          /etc/default/shorewall <<-EOF
 687                 INITLOG=/dev/null
 688                 OPTIONS=""
 689                 RESTARTOPTIONS=""
 690                 SAFESTOP=0
 691                 STARTOPTIONS=""
 692                 startup=1
 693                 EOF
 694         local conf
 695         for conf in "$tool"/etc/shorewall/*
 696          do conf=${conf#"$tool"/etc/shorewall/}
 697                 sudo test ! -f "$tool"/etc/shorewall/"$conf" ||
 698                 sudo install -m 640 -o root -g root \
 699                  "$tool"/etc/shorewall/"$conf" \
 700                         /etc/shorewall/"$conf"
 701          done
 702         sudo install -d -m 750 -o root -g root \
 703          /etc/shorewall/macro.d
 704         for conf in "$tool"/etc/shorewall/macro.d/*
 705          do conf=${conf#"$tool"/etc/shorewall/macro.d/}
 706                 sudo test ! -f "$tool"/etc/shorewall/macro.d/"$conf" ||
 707                 sudo install -m 640 -o root -g root \
 708                  "$tool"/etc/shorewall/macro.d/"$conf" \
 709                         /etc/shorewall/macro.d/"$conf"
 710          done
 711         sudo install -d -m 750 -o root -g root \
 712          /etc/shorewall/action.d
 713         #for conf in "$tool"/etc/shorewall/action.d/*
 714         # do conf=${conf#"$tool"/etc/shorewall/action.d/}
 715         #       sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" ||
 716         #       sudo install -m 640 -o root -g root \
 717         #        "$tool"/etc/shorewall/action.d/"$conf" \
 718         #               /etc/shorewall/action.d/"$conf"
 719         # done
 720         #sudo shorewall safe-restart
 721  }
 722 rule_sysctl_configure () {
 723         local -; set +f
 724         for conf in "$tool"/etc/sysctl.d/*.conf
 725          do conf=${conf#"$tool"/etc/sysctl.d/}
 726                 sudo install -m 660 -o root -g root \
 727                  "$tool"/etc/sysctl.d/"$conf" \
 728                         /etc/sysctl.d/"$conf"
 729          done
 730         sudo install -m 660 -o root -g root /dev/stdin \
 731          /etc/sysctl.d/local-kernel-name.conf <<-EOF
 732                 kernel.hostname   = $vm_hostname
 733                 kernel.domainname = $vm_domainname
 734                 EOF
 735         sudo sysctl --system
 736  }
 737 rule_tmpfs_configure () {
 738         sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
 739                 LOCK_SIZE=5242880 # NOTE: 5MiB
 740                 RAMLOCK=yes
 741                 RAMSHM=yes
 742                 RAMTMP=yes
 743                 RUN_SIZE=10%
 744                 SHM_SIZE=
 745                 TMP_MODE=1777,nr_inodes=1000k,noatime
 746                 TMP_OVERFLOW_LIMIT=1024
 747                  # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
 748                  #       on the root filesystem (overriding RAMTMP).
 749                 TMP_SIZE=200m
 750                 TMPFS_SIZE=20%VM
 751                 EOF
 752  }
 753 rule_user_add () { # SYNTAX: $user
 754         local user="$1"; shift
 755         rule adduser "$user" --disabled-password "$@"
 756                 # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
 757         eval local home\; home="~$user"
 758         sudo adduser "$user" users
 759         sudo install -m 640 -o "$user" -g "$user" \
 760          "$tool"/var/pub/ssh/"$user".key \
 761          "$home"/etc/ssh/authorized_keys
 762         gpg \
 763          --homedir "$tool"/var/pub/openpgp/ \
 764          --no-default-keyring \
 765          --secret-keyring /dev/null \
 766          --export |
 767         sudo -u "$user" gpg --import -
 768  }
 769 rule_user_configure () {
 770         rule apt_get_install bash-completion
 771         sudo install -m 660 -o root -g root \
 772          "$tool"/etc/adduser.conf \
 773                 /etc/adduser.conf
 774         sudo install -d -m 750 -o root -g root \
 775          /etc/skel \
 776          /etc/skel/etc \
 777          /etc/skel/etc/gpg \
 778          /etc/skel/etc/ssh
 779         sudo install -d -m 770 -o root -g root \
 780          /etc/skel/var \
 781          /etc/skel/var/cache \
 782          /etc/skel/var/log \
 783          /etc/skel/var/run \
 784          /etc/skel/var/run/ssh
 785         sudo ln -fns etc/ssh /etc/skel/.ssh
 786         sudo ln -fns etc/gpg /etc/skel/.gnupg
 787         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF
 788                 %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
 789                   case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
 790                     ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
 791                 EOF
 792         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
 793                 %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
 794                 EOF
 795         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
 796                 Defaults env_keep = " \\
 797                   EDITOR \\
 798                   GIT_AUTHOR_NAME \\
 799                   GIT_AUTHOR_EMAIL \\
 800                   GIT_COMMITTER_NAME \\
 801                   GIT_COMMITTER_EMAIL \\
 802                  "
 803                 EOF
 804         sudo install -m 755 -o root -g root /dev/stdin /usr/local/bin/passwd-init <<-EOF
 805                 #!/bin/sh -efu
 806                 # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
 807                 sudo /bin/sh -e -f -u -c \
 808                   'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
 809                 EOF
 810         sudo install -m 644 -o root -g root \
 811          "$tool"/etc/bash.bashrc \
 812                 /etc/bash.bashrc
 813         sudo install -m 644 -o root -g root \
 814          "$tool"/etc/inputrc \
 815                 /etc/inputrc
 816         sudo install -m 644 -o root -g root \
 817          "$tool"/etc/screenrc \
 818                 /etc/screenrc
 819         local sh; local -; set +f
 820         for sh in "$tool"/etc/user.d/*/configure.sh
 821          do sh=${sh#"$tool"/etc/user.d/}
 822                 local user="${sh%/configure.sh}"
 823                 (
 824                 . "$tool"/etc/user.d/"$sh" || return 1
 825                 )
 826          done
 827  }
 828 rule_user_admin_add () { # SYNTAX: $user
 829         rule user_configure
 830         local user=$1
 831         rule adduser "$user" --disabled-password
 832         eval local home\; home="~$user"
 833         sudo adduser "$user" sudo
 834         sudo install -m 640 -o root -g root \
 835          "$tool"/var/pub/ssh/"$user".key \
 836          "$home"/etc/ssh/authorized_keys
 837         gpg \
 838          --homedir "$tool"/var/pub/openpgp/ \
 839          --no-default-keyring \
 840          --secret-keyring /dev/null \
 841          --export |
 842         sudo -u "$user" gpg --import -
 843         rule user_admin_configure
 844  }
 845 rule_user_admin_configure () {
 846         rule initramfs_configure
 847         rule user_root_configure
 848  }
 849 rule_user_root_configure () {
 850         sudo install -d -m 750 -o root -g root \
 851          /root/etc \
 852          /root/etc/gpg \
 853          /root/etc/ssh
 854         sudo ln -fns etc/gpg /root/.gnupg
 855         sudo ln -fns etc/ssh /root/.ssh
 856         getent group sudo |
 857         while IFS=: read -r group x x users
 858          do while test -n "$users" && IFS=, read -r user users <<-EOF
 859                         $users
 860                         EOF
 861                  do eval local home\; home="~$user"
 862                         sudo cat "$home"/etc/ssh/authorized_keys
 863                  done
 864          done |
 865         sudo install -m 640 -o root -g root /dev/stdin \
 866          /root/etc/ssh/authorized_keys
 867         gpg \
 868          --homedir "$tool"/var/pub/openpgp/ \
 869          --no-default-keyring \
 870          --secret-keyring /dev/null \
 871          --export |
 872         sudo gpg --import -
 873  }
 874 rule__www_configure () {
 875         rule adduser www \
 876          --disabled-login \
 877          --disabled-password \
 878          --group \
 879          --home /home/www \
 880          --shell /bin/false \
 881          --system
 882         rule adduser log-www \
 883          --disabled-login \
 884          --disabled-password \
 885          --group \
 886          --home /home/www/log \
 887          --shell /bin/false \
 888          --system
 889         #sudo adduser www www-data
 890         sudo adduser www log-www
 891         #sudo adduser log log-www
 892         usermod --home /home/www/pub www-data
 893         sudo install -d -m 751 -o www -g www \
 894          /home/www
 895         sudo install -d -m 750 -o www -g www \
 896          /home/www/etc
 897         sudo install -d -m 1771 -o www-data -g www-data \
 898          /home/www/pub
 899         sudo install -d -m 1771 -o log-www -g log-www \
 900          /home/www/log
 901  }
 902 rule_configure () {
 903         rule apt_configure
 904         rule git_configure
 905         rule etckeeper_configure
 906         rule locales_configure
 907         rule time_configure
 908         rule network_configure
 909         rule filesystem_configure
 910         rule login_configure
 911         rule ssh_configure
 912         rule user_root_configure
 913         rule boot_configure
 914         rule sysctl_configure
 915         rule user_configure
 916         rule gitolite_configure
 917         rule shorewall_configure
 918         rule runit_configure
 919  }
 920
 921 rule_luks_key_change () {
 922         sudo cryptsetup luksChangeKey /dev/$vm_lvm_vg/${vm_lvm_lv}_root
 923  }
 924
 925 rule=${1:-help}
 926 ${1+shift}
 927 case $rule in
 928  (help);;
 929  (*)
 930         assert 'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
 931         cd /
 932         ;;
 933  esac
 934 rule $rule "$@"