vm_hosted

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=$0
   4 while test -L "$tool"
   5  do tool=$(readlink "$tool")
   6  done
   7 tool=${tool%/*}
   8 . "$tool"/lib/rule.sh
   9 . "$tool"/etc/vm.sh
  10 export TRACE=1
  11 cd /
  12
  13 rule_help () { # SYNTAX: [--hidden]
  14         local hidden; [ ${1:+set} ] || hidden=set
  15         cat >&2 <<-EOF
  16                 DESCRIPTION:
  17                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  18                   _depuis_ la VM hébergée ($vm_fqdn) ;
  19                   il sert à la fois d'outil (aisément bidouillable)
  20                   et de documentation (préçise).
  21                   Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
  22                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  23                 RULES:
  24                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  25                 ENVIRONMENT:
  26                   TRACE # affiche les commandes avant leur exécution
  27                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  28                 EOF
  29  }
  30
  31 rule_git_configure () {
  32         (
  33         cd "$tool"
  34         git config --replace branch.master.remote .
  35         git config --replace branch.master.merge refs/remotes/master
  36         local tool
  37         tool=$(cd "$tool"; cd -)
  38         install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
  39                 #!/bin/sh -efux
  40                 case \$1 in
  41                  (refs/remotes/master)
  42                         cd ..
  43                         git --git-dir=\$PWD/.git checkout -f -B master remotes/master
  44                         git --git-dir=\$PWD/.git clean -f -d -x
  45                         ;;
  46                  esac
  47                 EOF
  48         )
  49  }
  50 rule_git_reset () {
  51         (
  52         cd "$tool"
  53         git checkout -f -B master remotes/master
  54         git clean -f -d -x
  55         )
  56  }
  57
  58 rule_adduser () {
  59         local user="$1"; shift
  60         getent passwd "$user" >/dev/null ||
  61         sudo adduser "$@" "$user"
  62  }
  63 rule_apt_get_install () { # SYNTAX: $package
  64         sudo DEBIAN_FRONTEND=noninteractive apt-get install --yes "$@"
  65  }
  66 rule_dpkg_reconfigure () { # SYNTAX: $package
  67         sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@"
  68  }
  69
  70 rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
  71         export LANG=C
  72         export LC_CTYPE=C
  73         . /etc/profile
  74  }
  75
  76 rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour
  77         local -; set +f
  78         rule apt_get_install \
  79          apache2-mpm-itk \
  80          libapache2-mod-php5
  81                 # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
  82                 # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
  83                 # NOTE: apache2-mpm-itk semble le plus sécurisé,
  84                 # car on est certain que tout est exécuté avec les uid/gid
  85                 # assignés au VirtualHost/Directory/Location
  86                 # néamoins il se peut qu'une combinaison du genre :
  87                 # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
  88                 # soit plus performante (threads et pas forks),
  89                 # cependant l'usage de suexec impose des forks il semble..
  90                 # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
  91                 # donc pour l'instant : apache2-mpm-itk
  92         sudo rm -rf \
  93          /etc/apache2/site.d
  94         sudo install -d -m 770 -o www -g www \
  95          /etc/apache2 \
  96          /etc/apache2/site.d \
  97          /etc/apache2/x509.d
  98         cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF |
  99                 ServerName "$vm_fqdn"
 100                 EOF
 101         sudo install -m 660 -o root -g root /dev/stdin \
 102          /etc/apache2/apache2.conf
 103         sudo install -m 660 -o root -g root \
 104          "$tool"/etc/apache2/envvars \
 105                 /etc/apache2/envvars
 106         sudo install -m 660 -o root -g root \
 107          "$tool"/etc/apache2/httpd.conf \
 108                 /etc/apache2/httpd.conf
 109         #sudo install -m 660 -o root -g root /dev/stdin \
 110         # /etc/apache2/suexec/www-data <<-EOF
 111         #       /home
 112         #       pub/www/cgi
 113         #       EOF
 114         sudo install -m 660 -o root -g root \
 115          "$tool"/etc/apache2/ports.conf \
 116                 /etc/apache2/ports.conf
 117         sudo a2enmod actions
 118         sudo a2enmod headers
 119         sudo a2enmod rewrite
 120         sudo a2enmod ssl
 121         sudo a2enmod userdir
 122         local conf
 123         sudo a2dissite "*"
 124         sudo ln -fns \
 125          /etc/apache2 \
 126          /home/www/etc/apache2
 127         for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
 128          do conf=${conf#"$tool"/etc/apache2/site.d/}
 129                 local site=${conf%/VirtualHost.conf}
 130                 case $site in
 131                  (*-tls)
 132                         local hint="run vm_remote apache2_key_send before"
 133                         assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
 134                         sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 135                          /etc/apache2 \
 136                          /etc/apache2/site.d/"$site" \
 137                          /etc/apache2/x509.d/"$site" \
 138                          /etc/apache2/x509.d/"$site"/ca \
 139                          /etc/apache2/x509.d/"$site"/empty \
 140                          /etc/apache2/x509.d/"$site"/rvk \
 141                          /etc/apache2/x509.d/"$site"/usr
 142                         sudo install -m 664 -o www -g www \
 143                          "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \
 144                           /etc/apache2/x509.d/"$site"/crt.self-signed.pem
 145                         #sudo install -m 664 -o www-"$site" -g www-"$site" \
 146                         # "$tool"/var/pub/x509/"$site"/rvk.pem \
 147                         #  /etc/apache2/x509.d/"$site"/rvk.pem
 148                         sudo install -m 664 -o www -g www \
 149                          "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \
 150                           /etc/apache2/x509.d/"$site"/ca/crt.pem
 151                         sudo install -m 664 -o www -g www \
 152                          "$tool"/var/pub/x509/"$site"/crt.pem \
 153                           /etc/apache2/x509.d/"$site"/crt.pem
 154                         ;;
 155                  esac
 156                 case $site in
 157                  (*-tls)
 158                         cat <<-EOF
 159                                 <IfModule mod_ssl.c>
 160                                         <VirtualHost *:$port>
 161                                                 AssignUserID www-$site www-$site
 162                                                 BrowserMatch "MSIE [2-6]"  ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
 163                                                 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
 164                                                 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 165                                                 #CustomLog "/dev/null" Combined
 166                                                 DocumentRoot /home/www/pub/$site
 167                                                 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 168                                                 #ErrorLog "/dev/null"
 169                                                 LogLevel Warn
 170                                                 SSLCACertificateFile    /etc/apache2/x509.d/$site/crt.self-signed.pem
 171                                                 SSLCACertificatePath    /etc/apache2/x509.d/$site/usr/
 172                                                 #SSLCARevocationFile    /etc/apache2/x509.d/$site/rvk.pem
 173                                                 SSLCADNRequestFile      /etc/apache2/x509.d/$site/crt.self-signed.pem
 174                                                 SSLCADNRequestPath      /etc/apache2/x509.d/$site/empty/
 175                                                         # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés
 176                                                 SSLCARevocationPath     /etc/apache2/x509.d/$site/rvk/
 177                                                 SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem
 178                                                 SSLCertificateFile      /etc/apache2/x509.d/$site/crt.pem
 179                                                 SSLCertificateKeyFile   /etc/apache2/x509.d/$site/key.pem
 180                                                 SSLCipherSuite AES+RSA+SHA256
 181                                                 SSLEngine On
 182                                                 SSLInsecureRenegotiation Off
 183                                                 SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
 184                                                 SSLProtocol -All +TLSv1
 185                                                 #SSLRenegBufferSize 262144
 186                                                 SSLSessionCacheTimeout 1200
 187                                                 SSLStrictSNIVHostCheck On
 188                                                 SSLUserName SSL_CLIENT_S_DN_CN
 189                                                 SSLVerifyClient None
 190                                                 SSLVerifyDepth 1
 191                                                 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 192                                          </VirtualHost>
 193                                  </IfModule>
 194                                 EOF
 195                         ;;
 196                  (*)
 197                         cat <<-EOF
 198                                 <VirtualHost *:$port>
 199                                         AssignUserID www-$site www-$site
 200                                         CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 201                                         #CustomLog "/dev/null" Combined
 202                                         DocumentRoot /home/www/pub/$site
 203                                         ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 204                                         #ErrorLog "/dev/null"
 205                                         LogLevel Warn
 206                                         $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 207                                  </VirtualHost>
 208                                 EOF
 209                         ;;
 210                  esac |
 211                 sudo install -m 660 -o root -g root /dev/stdin \
 212                  /etc/apache2/site.d/"$site"/VirtualHost.conf
 213                 sudo ln -fns \
 214                  ../site.d/"$site"/VirtualHost.conf \
 215                  /etc/apache2/sites-available/"$site"
 216                 sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 217                  /home/www/log/"$site" \
 218                  /home/www/log/"$site"/apache2
 219                 sudo ln -fns \
 220                  /etc/apache2/site.d/"$site" \
 221                  /home/www/etc/apache2/"$site"
 222                 test -e /home/www/pub/"$site" ||
 223                 sudo install -d -m 2770 -o www-"$site" -g www-"$site" \
 224                  /home/www/pub/"$site"
 225                 rule adduser www-"$site"
 226                  --disabled-password \
 227                  --group \
 228                  --no-create-home \
 229                  --home /home/www/pub/"$site" \
 230                  --shell /bin/false \
 231                  --system
 232                 #sudo setfacl -m u:"www-$site":--x \
 233                 # /home/www/ \
 234                 # /home/www/pub/ \
 235                 # /home/www/pub/"$site"/
 236                 #sudo setfacl -m d:u:"www-$site":rwx \
 237                 # "$home"/pub/www/"$site"/
 238                 test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh ||
 239                 .         "$tool"/etc/apache2/site.d/"$site"/configure.sh
 240                 test -e /etc/apache2/sites-enabled/"$site" ||
 241                 sudo a2ensite "$site"
 242          done
 243         sudo service apache2 restart
 244  }
 245 rule_apt_configure () {
 246         sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
 247                 deb http://ftp.rezopole.net/debian $vm_lsb_name main
 248                 EOF
 249         sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
 250                 deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
 251                 EOF
 252         sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
 253                 deb http://nightly.openerp.com/7.0/nightly/deb/ ./
 254                 EOF
 255         sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
 256                 Package: *
 257                 Pin: release a=$vm_lsb_name
 258                 Pin-Priority: 200
 259
 260                 Package: *
 261                 Pin: release a=$vm_lsb_name-backports
 262                 Pin-Priority: 170
 263                 EOF
 264         sudo apt-get update
 265         rule apt_get_install apticron
 266         m4 \
 267          --define=VM_DOMAINNAME=$vm_domainname \
 268          <"$tool"/etc/apticron/apticron.conf.m4 |
 269         sudo install -m 644 -o root -g root /dev/stdin \
 270          /etc/apticron/apticron.conf
 271  }
 272 rule_boot_configure () {
 273         #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
 274         sudo debconf-set-selections <<-EOF
 275                 grub-pc grub-pc/install_devices multiselect
 276                 EOF
 277         rule apt_get_install grub-pc
 278         sudo install -d -m 644 -o root -g root /boot/grub
 279         rule apt_get_install linux-image-$vm_arch
 280         sudo install -m 644 -o root -g root /dev/stdin /etc/default/grub <<-EOF
 281                 GRUB_DEFAULT=0
 282                 GRUB_TIMEOUT=5
 283                 GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
 284                 GRUB_CMDLINE_LINUX_DEFAULT="quiet"
 285                 GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
 286                 GRUB_DISABLE_RECOVERY="true"
 287                 #GRUB_PRELOAD_MODULES="lvm"
 288                 EOF
 289         sudo install -m 644 -o root -g root /dev/stdin /boot/grub/device.map <<-EOF
 290                 (hd0)   /dev/xvda
 291                 (hd0)   /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
 292                 EOF
 293         sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
 294         rule initramfs_configure
 295         rule apt_get_install molly-guard
 296         sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
 297                 ALWAYS_QUERY_HOSTNAME=true
 298                  # NOTE: une alternative est de dire à sudo de conserver les SSH_*
 299                  #       néamoins demander tout le temps n'est pas trop contraignant
 300                  #       et davantage sécurisant.
 301                 EOF
 302  }
 303 rule_etckeeper_configure () {
 304         sudo install -m 644 -o root -g root /dev/stdin /etc/etckeeper/etckeeper.conf <<-EOF
 305                 VCS=git
 306                 GIT_COMMIT_OPTIONS=""
 307                 AVOID_DAILY_AUTOCOMMITS=1
 308                 #AVOID_SPECIAL_FILE_WARNING=1
 309                 AVOID_COMMIT_BEFORE_INSTALL=1
 310                 HIGHLEVEL_PACKAGE_MANAGER=apt
 311                 LOWLEVEL_PACKAGE_MANAGER=dpkg
 312                 EOF
 313         sudo install -m 644 -o root -g root \
 314          "$tool"/etc/etckeeper/prompt.sh \
 315                 /etc/etckeeper/prompt.sh
 316         rule apt_get_install etckeeper
 317  }
 318 rule_filesystem_configure () {
 319         m4 \
 320          --define=VM_LVM_LV=$vm_lvm_lv \
 321          --define=VM_LVM_VG=$vm_lvm_vg \
 322          <"$tool"/etc/fstab.m4 |
 323         sudo install -m 644 -o root -g root /dev/stdin \
 324          /etc/fstab
 325         m4 \
 326          --define=VM_LVM_LV=$vm_lvm_lv \
 327          --define=VM_LVM_VG=$vm_lvm_vg \
 328          <"$tool"/etc/crypttab.m4 |
 329         sudo install -m 644 -o root -g root /dev/stdin \
 330          /etc/crypttab
 331         rule tmpfs_configure
 332  }
 333 rule_initramfs_configure () {
 334         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
 335                 MODULES=most
 336                 BUSYBOX=y
 337                 KEYMAP=y
 338                 COMPRESS=gzip
 339                 DEVICE=eth0
 340                 EOF
 341         sudo install -m 644 -o root -g root /dev/stdin /etc/modprobe.d/xen-pv.conf <<-EOF
 342                 alias eth0 xennet
 343                 alias scsi_hostadapter xenblk
 344                 EOF
 345         sudo install -m 644 -o root -g root /dev/stdin /etc/modules <<-EOF
 346                 sha1_generic
 347                 sha256_generic
 348                 sha512_generic
 349                 aes-x86_64
 350                 xts
 351                 # NOTE: pour Xen en mode HVM :
 352                 #modprobe xen-platform-pci
 353                 EOF
 354         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/modules <<-EOF
 355                 EOF
 356         sudo sed -e '/^configure_networking /s/ &$//' \
 357          -i /usr/share/initramfs-tools/scripts/init-premount/dropbear
 358          # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
 359         ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
 360         ( while IFS= read -r line
 361          do case $line in (*" RSA") return 0; break;; esac
 362          done; return 1 ) ||
 363          {
 364         sudo rm -f \
 365          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \
 366          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub
 367         sudo dropbearkey -t rsa -s 4096 -f \
 368          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
 369          }
 370         # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
 371         sudo install -d -m 640 -o root -g root \
 372          /etc/initramfs-tools/root \
 373          /etc/initramfs-tools/root/.ssh
 374         getent group sudo |
 375         while IFS=: read -r group x x users
 376          do while test -n "$users" && IFS=, read -r user users <<-EOF
 377                         $users
 378                         EOF
 379                  do eval local home\; home="~$user"
 380                         sudo cat "$home"/etc/ssh/authorized_keys
 381                  done
 382          done |
 383         sudo install -m 644 -o root -g root /dev/stdin \
 384          /etc/initramfs-tools/root/.ssh/authorized_keys
 385         sudo rm -f \
 386          /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
 387          /etc/initramfs-tools/root/.ssh/id_rsa.pub \
 388          /etc/initramfs-tools/root/.ssh/id_rsa
 389          # NOTE: clefs générées par Debian
 390         sudo update-initramfs -u
 391  }
 392 rule_insserv_remove () { # SYNTAX: $sv
 393         local sv="$1"
 394         #sudo chmod u+x /etc/init.d/"$sv"
 395         sudo insserv --force --remove "$sv"
 396         sudo test ! -x /etc/init.d/"$sv" ||
 397         sudo /etc/init.d/"$sv" stop
 398         sudo chmod ugo-x /etc/init.d/"$sv"
 399  }
 400 rule_gitolite_configure () {
 401         sudo debconf-set-selections <<-EOF
 402                 gitolite        gitolite/gituser        string  git
 403                 gitolite        gitolite/adminkey       string
 404                 gitolite        gitolite/gitdir string  /home/git
 405                 EOF
 406         rule apt_get_install gitolite
 407         rule adduser git \
 408          --disabled-password \
 409          --group \
 410          --home /home/git \
 411          --shell /bin/bash \
 412          --system
 413         sudo chfn --full-name git git
 414         rule adduser log-git \
 415          --disabled-login \
 416          --disabled-password \
 417          --group \
 418          --home /home/git/log \
 419          --shell /bin/false \
 420          --system
 421         rule adduser git-data \
 422          --disabled-login \
 423          --disabled-password \
 424          --group \
 425          --home /home/git/pub \
 426          --shell /bin/false \
 427          --system
 428         sudo adduser git        git-data
 429         sudo install -d -m 750 -o git -g git \
 430          /etc/gitolite \
 431          /home/git/etc \
 432          /home/git/etc/ssh
 433         sudo install -d -m 751 -o git -g git \
 434          /home/git
 435         sudo install -d -m 2770 -o git-data -g git-data \
 436          /home/git/pub
 437         sudo install -d -m 1771 -o git -g git \
 438          /home/git/log
 439         sudo install -d -m 2770 -o git -g log-git \
 440          /home/git/log/gitolite \
 441          /home/git/log/gitolite/perf
 442         sudo install -d -m 3771 -o git -g git \
 443          /home/git/hooks
 444         sudo ln -fns /etc/gitolite /home/git/etc/gitolite
 445         sudo ln -fns /etc/gitweb /home/git/etc/gitweb
 446         sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc
 447         sudo ln -fns etc/ssh /home/git/.ssh
 448         sudo install -m 770 -o git -g git /dev/stdin \
 449          /home/git/etc/gitolite/gitolite.rc <<-EOF
 450                 #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
 451                 #\$BIG_INFO_CAP = 20;
 452                 #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
 453                         # NOTE: Please use single quotes, not double quotes.
 454                 #\$GITWEB_URI_ESCAPE = 0;
 455                 \$GIT_PATH = "";
 456                 #\$GL_ADC_PATH = "";
 457                 \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
 458                 #\$GL_ALL_INCLUDES_SPECIAL = 0;
 459                 #\$GL_ALL_READ_ALL = 0;
 460                 \$GL_BIG_CONFIG = 0;
 461                 \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
 462                 \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
 463                 #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
 464                 \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
 465                 #\$GL_HOSTNAME = "git.$vm_domainname";
 466                         # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
 467                 #\$GL_HTTP_ANON_USER = "mob";
 468                 \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
 469                 \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
 470                 #\$GL_NICE_VALUE = 0;
 471                 \$GL_NO_CREATE_REPOS = 0;
 472                 \$GL_NO_DAEMON_NO_GITWEB = 0;
 473                 \$GL_NO_SETUP_AUTHKEYS = 0;
 474                 \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
 475                 \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
 476                 #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
 477                 #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
 478                 \$GL_SITE_INFO = "git.$vm_domainname";
 479                 #\$GL_SLAVE_MODE = 0;
 480                 \$GL_WILDREPOS = 0;
 481                 #\$GL_WILDREPOS_DEFPERMS = 'R @all';
 482                 \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
 483                 \$HTPASSWD_FILE = "";
 484                 \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
 485                 \$REPO_BASE = "pub";
 486                 \$REPO_UMASK = 0007;
 487                 \$RSYNC_BASE = "";
 488                 \$SVNSERVE = "";
 489                 #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
 490                 \$WEB_INTERFACE = "gitweb";
 491                 1;
 492                 EOF
 493         sudo install -m 600 -o git -g git \
 494          "$tool"/var/pub/ssh/git.key \
 495            /home/git/etc/ssh/git.pub
 496         sudo -u git \
 497          GL_RC=/home/git/etc/gitolite/gitolite.rc \
 498          GIT_AUTHOR_NAME=git \
 499                 gl-setup -q /home/git/etc/ssh/git.pub git
 500         local d
 501         for d in doc logs src
 502          do test ! -d /home/git/etc/gitolite/"$d" ||
 503                 rmdir /home/git/etc/gitolite/"$d"
 504          done
 505  }
 506 rule_locales_configure () {
 507         sudo debconf-set-selections <<-EOF
 508                 locales locales/default_environment_locale      select  None
 509                 locales locales/locales_to_be_generated multiselect     fr_FR.UTF-8 UTF-8
 510                 EOF
 511         rule dpkg_reconfigure locales
 512  }
 513 rule_login_configure () {
 514         sudo install -m 644 -o root -g root \
 515          "$tool"/etc/inittab \
 516                 /etc/inittab
 517         sudo install -m 644 -o root -g root \
 518          "$tool"/etc/login.defs \
 519                 /etc/login.defs
 520         grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session ||
 521         sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF
 522                 $(cat /etc/pam.d/common-session)
 523                 session optional pam_umask.so
 524                 EOF
 525         grep -q '^hvc0$' /etc/securetty ||
 526         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 527                 $(cat /etc/securetty)
 528                 hvc0
 529                 EOF
 530         grep -q '^xvc0$' /etc/securetty ||
 531         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 532                 $(cat /etc/securetty)
 533                 xvc0
 534                 EOF
 535  }
 536 rule_network_configure () {
 537         sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
 538                 $vm
 539                 EOF
 540         grep -q " $vm\$" /etc/hosts ||
 541         sudo install -m 644 -o root -g root /dev/stdin /etc/hosts <<-EOF
 542                 $(cat /etc/hosts)
 543                 127.0.0.1 $vm_fqdn $vm
 544                 EOF
 545         sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
 546                 search ${vm_host#*.}
 547                 nameserver ${vm_host_nameserver}
 548                 EOF
 549         m4 \
 550          --define=VM_IPV4=$vm_ipv4 \
 551          <"$tool"/etc/network/interfaces.m4 |
 552         sudo install -m 640 -o root -g root /dev/stdin \
 553          /etc/network/interfaces
 554  }
 555 rule_runit_configure () { # SYNTAX: $sv
 556         rule apt_get_install runit
 557         local -; set +f
 558         sudo find /etc/sv -mindepth 1 -maxdepth 1 -type d -name "${1:-*}" -exec \
 559                 /bin/sh -efux -c 'case $(sv stop "$1") in
 560                  (*": runsv not running") true;;
 561                  (*": unable to open supervise/ok: file does not exist") true;;
 562                  ("ok: down:"*) true;;
 563                  (*) false;;
 564                  esac' '' {} +
 565         for sv in ${1-"$tool"/etc/sv/*}
 566          do sv=${sv##*/}
 567                 rule runit_sv_configure "$sv"
 568                 rule runit_sv_start     "$sv"
 569          done
 570         #sleep 3
 571         #sudo find -L /etc/service -type l -delete
 572  }
 573 rule_runit_sv_configure () { # SYNTAX: $sv
 574         local sv="$1"
 575         sudo install -d -m 770 -o root -g root \
 576          /etc/sv/"$sv"
 577         sudo install -m 770 -o root -g root \
 578          "$tool"/etc/sv/"$sv"/run \
 579                 /etc/sv/"$sv"/run
 580         if test -e "$tool"/etc/sv/"$sv"/log/run
 581          then
 582                 sudo install -d -m 770 -o root -g root \
 583                  /etc/sv/"$sv"/log
 584                 sudo install -m 770 -o root -g root \
 585                  "$tool"/etc/sv/"$sv"/log/run \
 586                         /etc/sv/"$sv"/log/run
 587          fi
 588         (
 589         test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
 590         .         "$tool"/etc/sv/"$sv"/configure.sh
 591         test ! -r "$tool"/etc/sv/"$sv"/log/configure.sh ||
 592         .         "$tool"/etc/sv/"$sv"/log/configure.sh
 593         )
 594         sudo ln -fns \
 595                 ../sv/"$sv" \
 596          /etc/service/"$sv"
 597  }
 598 rule_runit_sv_restart () { # SYNTAX: $sv
 599         local sv="$1"
 600         while true
 601          do case $(sudo sv restart "$sv") in
 602                  ("fail: $sv: runsv not running") sleep 1;;
 603                  ("warning: $sv: unable to open supervise/ok: file does not exists") sleep 1;;
 604                  (*) break;;
 605                  esac
 606          done
 607  }
 608 rule_runit_sv_start () { # SYNTAX: $sv
 609         local sv="$1"
 610         while true
 611          do case $(sudo sv start "$sv") in
 612                  ("fail: $sv: runsv not running") sleep 1;;
 613                  ("warning: $sv: unable to open supervise/ok: file does not exists") sleep 1;;
 614                  (*) break;;
 615                  esac
 616          done
 617  }
 618 rule_shorewall_configure () {
 619         # DOC: http://shorewall.net/Introduction.html
 620         local -; set +f
 621         rule apt_get_install shorewall
 622         sudo install -m 644 -o root -g root /dev/stdin \
 623          /etc/default/shorewall <<-EOF
 624                 INITLOG=/dev/null
 625                 OPTIONS=""
 626                 RESTARTOPTIONS=""
 627                 SAFESTOP=0
 628                 STARTOPTIONS=""
 629                 startup=1
 630                 EOF
 631         local conf
 632         for conf in "$tool"/etc/shorewall/*
 633          do conf=${conf#"$tool"/etc/shorewall/}
 634                 sudo test ! -f "$tool"/etc/shorewall/"$conf" ||
 635                 sudo install -m 640 -o root -g root \
 636                  "$tool"/etc/shorewall/"$conf" \
 637                         /etc/shorewall/"$conf"
 638          done
 639         sudo install -d -m 750 -o root -g root \
 640          /etc/shorewall/macro.d
 641         for conf in "$tool"/etc/shorewall/macro.d/*
 642          do conf=${conf#"$tool"/etc/shorewall/macro.d/}
 643                 sudo test ! -f "$tool"/etc/shorewall/macro.d/"$conf" ||
 644                 sudo install -m 640 -o root -g root \
 645                  "$tool"/etc/shorewall/macro.d/"$conf" \
 646                         /etc/shorewall/macro.d/"$conf"
 647          done
 648         sudo install -d -m 750 -o root -g root \
 649          /etc/shorewall/action.d
 650         #for conf in "$tool"/etc/shorewall/action.d/*
 651         # do conf=${conf#"$tool"/etc/shorewall/action.d/}
 652         #       sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" ||
 653         #       sudo install -m 640 -o root -g root \
 654         #        "$tool"/etc/shorewall/action.d/"$conf" \
 655         #               /etc/shorewall/action.d/"$conf"
 656         # done
 657         #sudo shorewall safe-restart
 658  }
 659 rule_sysctl_configure () {
 660         local -; set +f
 661         for conf in "$tool"/etc/sysctl.d/*.conf
 662          do conf=${conf#"$tool"/etc/sysctl.d/}
 663                 sudo install -m 660 -o root -g root \
 664                  "$tool"/etc/sysctl.d/"$conf" \
 665                         /etc/sysctl.d/"$conf"
 666          done
 667         sudo install -m 660 -o root -g root /dev/stdin \
 668          /etc/sysctl.d/local-kernel-name.conf <<-EOF
 669                 kernel.hostname   = $vm_hostname
 670                 kernel.domainname = $vm_domainname
 671                 EOF
 672         sudo sysctl --system
 673  }
 674 rule_tmpfs_configure () {
 675         sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
 676                 LOCK_SIZE=5242880 # NOTE: 5MiB
 677                 RAMLOCK=yes
 678                 RAMSHM=yes
 679                 RAMTMP=yes
 680                 RUN_SIZE=10%
 681                 SHM_SIZE=
 682                 TMP_MODE=1777,nr_inodes=1000k,noatime
 683                 TMP_OVERFLOW_LIMIT=1024
 684                  # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
 685                  #       on the root filesystem (overriding RAMTMP).
 686                 TMP_SIZE=200m
 687                 TMPFS_SIZE=20%VM
 688                 EOF
 689  }
 690 rule_user_add () { # SYNTAX: $user
 691         local user="$1"; shift
 692         rule adduser "$user" --disabled-password "$@"
 693                 # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
 694         eval local home\; home="~$user"
 695         sudo adduser "$user" users
 696         sudo install -m 640 -o "$user" -g "$user" \
 697          "$tool"/var/pub/ssh/"$user".key \
 698          "$home"/etc/ssh/authorized_keys
 699         local key; local -; set +f
 700         for key in "$tool"/var/pub/openpgp/*.key
 701          do sudo -u "$user" gpg --import - <"$key"
 702          done
 703  }
 704 rule_user_configure () {
 705         rule apt_get_install bash-completion
 706         sudo install -m 660 -o root -g root \
 707          "$tool"/etc/adduser.conf \
 708                 /etc/adduser.conf
 709         sudo install -d -m 750 -o root -g root \
 710          /etc/skel \
 711          /etc/skel/etc \
 712          /etc/skel/etc/gpg \
 713          /etc/skel/etc/ssh
 714         sudo install -d -m 770 -o root -g root \
 715          /etc/skel/var \
 716          /etc/skel/var/cache \
 717          /etc/skel/var/log \
 718          /etc/skel/var/run \
 719          /etc/skel/var/run/ssh
 720         sudo ln -fns etc/ssh /etc/skel/.ssh
 721         sudo ln -fns etc/gpg /etc/skel/.gnupg
 722         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF
 723                 %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
 724                   case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
 725                     ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
 726                 EOF
 727         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
 728                 %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
 729                 EOF
 730         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
 731                 Defaults env_keep = " \\
 732                   EDITOR \\
 733                   GIT_AUTHOR_NAME \\
 734                   GIT_AUTHOR_EMAIL \\
 735                   GIT_COMMITTER_NAME \\
 736                   GIT_COMMITTER_EMAIL \\
 737                  "
 738                 EOF
 739         sudo install -m 755 -o root -g root /dev/stdin /usr/local/bin/passwd-init <<-EOF
 740                 #!/bin/sh -efu
 741                 # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
 742                 sudo /bin/sh -e -f -u -c \
 743                   'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
 744                 EOF
 745         sudo install -m 644 -o root -g root \
 746          "$tool"/etc/bash.bashrc \
 747                 /etc/bash.bashrc
 748         sudo install -m 644 -o root -g root \
 749          "$tool"/etc/screenrc \
 750                 /etc/screenrc
 751         local sh; local -; set +f
 752         for sh in "$tool"/etc/user.d/*/configure.sh
 753          do sh=${sh#"$tool"/etc/user.d/}
 754                 local user="${sh%/configure.sh}"
 755                 . "$tool"/etc/user.d/"$sh"
 756          done
 757  }
 758 rule_user_admin_add () { # SYNTAX: $user
 759         rule user_configure
 760         local user=$1
 761         rule adduser "$user" --disabled-password
 762         eval local home\; home="~$user"
 763         sudo adduser "$user" sudo
 764         sudo install -m 640 -o root -g root \
 765          "$tool"/var/pub/ssh/"$user".key \
 766          "$home"/etc/ssh/authorized_keys
 767         local key; local -; set +f
 768         for key in "$tool"/var/pub/openpgp/*.key
 769          do sudo -u "$user" gpg --import - <"$key"
 770          done
 771         rule user_admin_configure
 772  }
 773 rule_user_admin_configure () {
 774         rule initramfs_configure
 775         rule user_root_configure
 776  }
 777 rule_user_root_configure () {
 778         sudo install -d -m 750 -o root -g root \
 779          /root/etc \
 780          /root/etc/gpg \
 781          /root/etc/ssh
 782         sudo ln -fns etc/gpg /root/.gnupg
 783         sudo ln -fns etc/ssh /root/.ssh
 784         getent group sudo |
 785         while IFS=: read -r group x x users
 786          do while test -n "$users" && IFS=, read -r user users <<-EOF
 787                         $users
 788                         EOF
 789                  do eval local home\; home="~$user"
 790                         sudo cat "$home"/etc/ssh/authorized_keys
 791                  done
 792          done |
 793         sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys
 794         local key; local -; set +f
 795         for key in "$tool"/var/pub/openpgp/*.key
 796          do sudo gpg --import "$key"
 797          done
 798  }
 799 rule_www_configure () {
 800         rule adduser www \
 801          --disabled-login \
 802          --disabled-password \
 803          --group \
 804          --home /home/www \
 805          --shell /bin/false \
 806          --system
 807         rule adduser log-www \
 808          --disabled-login \
 809          --disabled-password \
 810          --group \
 811          --home /home/www/log \
 812          --shell /bin/false \
 813          --system
 814         #sudo adduser www www-data
 815         sudo adduser www log-www
 816         #sudo adduser log log-www
 817         usermod --home /home/www/pub www-data
 818         sudo install -d -m 751 -o www -g www \
 819          /home/www
 820         sudo install -d -m 750 -o www -g www \
 821          /home/www/etc
 822         sudo install -d -m 1771 -o www-data -g www-data \
 823          /home/www/pub
 824         sudo install -d -m 1771 -o log-www -g log-www \
 825          /home/www/log
 826  }
 827 rule_configure () {
 828         rule apt_configure
 829         rule git_configure
 830         rule etckeeper_configure
 831         rule locales_configure
 832         rule time_configure
 833         rule network_configure
 834         rule filesystem_configure
 835         rule login_configure
 836         rule ssh_configure
 837         rule user_root_configure
 838         rule boot_configure
 839         rule sysctl_configure
 840         rule user_configure
 841         rule gitolite_configure
 842         rule shorewall_configure
 843         rule runit_configure
 844  }
 845
 846 rule_luks_key_change () {
 847         sudo cryptsetup luksChangeKey /dev/$vm_lvm_vg/${vm_lvm_lv}_root
 848  }
 849
 850 rule=${1:-help}
 851 ${1+shift}
 852 case $rule in
 853  (help);;
 854  (*)
 855         assert 'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
 856         ;;
 857  esac
 858 rule $rule "$@"