vm_hosted

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=$0
   4 while test -L "$tool"
   5  do tool=$(readlink "$tool")
   6  done
   7 tool=${tool%/*}
   8 . "$tool"/lib/rule.sh
   9 . "$tool"/etc/vm.sh
  10 export TRACE=1
  11
  12 rule_help () { # SYNTAX: [--hidden]
  13         local hidden; [ ${1:+set} ] || hidden=set
  14         cat >&2 <<-EOF
  15                 DESCRIPTION:
  16                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  17                   _depuis_ la VM hébergée ($vm_fqdn) ;
  18                   il sert à la fois d'outil (aisément bidouillable)
  19                   et de documentation (préçise).
  20                   Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
  21                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  22                 RULES:
  23                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  24                 ENVIRONMENT:
  25                   TRACE # affiche les commandes avant leur exécution
  26                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  27                 EOF
  28  }
  29
  30 rule_git_configure () {
  31         (
  32         cd "$tool"
  33         git config --replace branch.master.remote .
  34         git config --replace branch.master.merge refs/remotes/master
  35         local tool
  36         tool=$(cd "$tool"; cd -)
  37         install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
  38                 #!/bin/sh -efux
  39                 case \$1 in
  40                  (refs/remotes/master)
  41                         cd ..
  42                         git --git-dir=\$PWD/.git checkout -f -B master remotes/master
  43                         git --git-dir=\$PWD/.git clean -f -d -x
  44                         ;;
  45                  esac
  46                 EOF
  47         )
  48  }
  49 rule_git_reset () {
  50         (
  51         cd "$tool"
  52         git checkout -f -B master remotes/master
  53         git clean -f -d -x
  54         )
  55  }
  56
  57 rule_adduser () {
  58         local user="$1"; shift
  59         getent passwd "$user" >/dev/null ||
  60         sudo adduser "$@" "$user"
  61  }
  62 rule_apt_get_install () { # SYNTAX: $package
  63         sudo \
  64          DEBIAN_FRONTEND=noninteractive \
  65          DEBIAN_PRIORITY=low \
  66          apt-get install --yes "$@"
  67  }
  68 rule_dpkg_reconfigure () { # SYNTAX: $package
  69         sudo \
  70          DEBIAN_FRONTEND=noninteractive \
  71          DEBIAN_PRIORITY=low \
  72          dpkg-reconfigure "$@"
  73  }
  74
  75 rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
  76         export LANG=C
  77         export LC_CTYPE=C
  78         . /etc/profile
  79  }
  80
  81 rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour
  82         local -; set +f
  83         rule apt_get_install \
  84          apache2-mpm-itk \
  85          libapache2-mod-php5
  86                 # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
  87                 # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
  88                 # NOTE: apache2-mpm-itk semble le plus sécurisé,
  89                 # car on est certain que tout est exécuté avec les uid/gid
  90                 # assignés au VirtualHost/Directory/Location
  91                 # néamoins il se peut qu'une combinaison du genre :
  92                 # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
  93                 # soit plus performante (threads et pas forks),
  94                 # cependant l'usage de suexec impose des forks il semble..
  95                 # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
  96                 # donc pour l'instant : apache2-mpm-itk
  97         sudo rm -rf \
  98          /etc/apache2/site.d
  99         sudo install -d -m 770 -o www -g www \
 100          /etc/apache2 \
 101          /etc/apache2/site.d \
 102          /etc/apache2/x509.d
 103         cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF |
 104                 ServerName "$vm_fqdn"
 105                 EOF
 106         sudo install -m 660 -o root -g root /dev/stdin \
 107          /etc/apache2/apache2.conf
 108         sudo install -m 660 -o root -g root \
 109          "$tool"/etc/apache2/envvars \
 110                 /etc/apache2/envvars
 111         sudo install -m 660 -o root -g root \
 112          "$tool"/etc/apache2/httpd.conf \
 113                 /etc/apache2/httpd.conf
 114         #sudo install -m 660 -o root -g root /dev/stdin \
 115         # /etc/apache2/suexec/www-data <<-EOF
 116         #       /home
 117         #       pub/www/cgi
 118         #       EOF
 119         sudo install -m 660 -o root -g root \
 120          "$tool"/etc/apache2/ports.conf \
 121                 /etc/apache2/ports.conf
 122         sudo a2enmod actions
 123         sudo a2enmod headers
 124         sudo a2enmod rewrite
 125         sudo a2enmod ssl
 126         sudo a2enmod userdir
 127         local conf
 128         sudo a2dissite "*"
 129         sudo ln -fns \
 130          /etc/apache2 \
 131          /home/www/etc/apache2
 132         for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
 133          do conf=${conf#"$tool"/etc/apache2/site.d/}
 134                 local site=${conf%/VirtualHost.conf}
 135                 case $site in
 136                  (*-tls)
 137                         local hint="run vm_remote apache2_key_send before"
 138                         assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
 139                         sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 140                          /etc/apache2 \
 141                          /etc/apache2/site.d/"$site" \
 142                          /etc/apache2/x509.d/"$site" \
 143                          /etc/apache2/x509.d/"$site"/ca \
 144                          /etc/apache2/x509.d/"$site"/empty \
 145                          /etc/apache2/x509.d/"$site"/rvk \
 146                          /etc/apache2/x509.d/"$site"/usr
 147                         sudo install -m 664 -o www -g www \
 148                          "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \
 149                           /etc/apache2/x509.d/"$site"/crt.self-signed.pem
 150                         #sudo install -m 664 -o www-"$site" -g www-"$site" \
 151                         # "$tool"/var/pub/x509/"$site"/rvk.pem \
 152                         #  /etc/apache2/x509.d/"$site"/rvk.pem
 153                         sudo install -m 664 -o www -g www \
 154                          "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \
 155                           /etc/apache2/x509.d/"$site"/ca/crt.pem
 156                         sudo install -m 664 -o www -g www \
 157                          "$tool"/var/pub/x509/"$site"/crt.pem \
 158                           /etc/apache2/x509.d/"$site"/crt.pem
 159                         ;;
 160                  esac
 161                 case $site in
 162                  (*-tls)
 163                         cat <<-EOF
 164                                 <IfModule mod_ssl.c>
 165                                         <VirtualHost *:$port>
 166                                                 AssignUserID www-$site www-$site
 167                                                 BrowserMatch "MSIE [2-6]"  ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
 168                                                 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
 169                                                 CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 170                                                 #CustomLog "/dev/null" Combined
 171                                                 DocumentRoot /home/www/pub/$site
 172                                                 ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 173                                                 #ErrorLog "/dev/null"
 174                                                 LogLevel Warn
 175                                                 SSLCACertificateFile    /etc/apache2/x509.d/$site/crt.self-signed.pem
 176                                                 SSLCACertificatePath    /etc/apache2/x509.d/$site/usr/
 177                                                 #SSLCARevocationFile    /etc/apache2/x509.d/$site/rvk.pem
 178                                                 SSLCADNRequestFile      /etc/apache2/x509.d/$site/crt.self-signed.pem
 179                                                 SSLCADNRequestPath      /etc/apache2/x509.d/$site/empty/
 180                                                         # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés
 181                                                 SSLCARevocationPath     /etc/apache2/x509.d/$site/rvk/
 182                                                 SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem
 183                                                 SSLCertificateFile      /etc/apache2/x509.d/$site/crt.pem
 184                                                 SSLCertificateKeyFile   /etc/apache2/x509.d/$site/key.pem
 185                                                 SSLCipherSuite AES+RSA+SHA256
 186                                                 SSLEngine On
 187                                                 SSLInsecureRenegotiation Off
 188                                                 SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
 189                                                 SSLProtocol -All +TLSv1
 190                                                 #SSLRenegBufferSize 262144
 191                                                 SSLSessionCacheTimeout 1200
 192                                                 SSLStrictSNIVHostCheck On
 193                                                 SSLUserName SSL_CLIENT_S_DN_CN
 194                                                 SSLVerifyClient None
 195                                                 SSLVerifyDepth 1
 196                                                 $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 197                                          </VirtualHost>
 198                                  </IfModule>
 199                                 EOF
 200                         ;;
 201                  (*)
 202                         cat <<-EOF
 203                                 <VirtualHost *:$port>
 204                                         AssignUserID www-$site www-$site
 205                                         CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
 206                                         #CustomLog "/dev/null" Combined
 207                                         DocumentRoot /home/www/pub/$site
 208                                         ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 209                                         #ErrorLog "/dev/null"
 210                                         LogLevel Warn
 211                                         $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
 212                                  </VirtualHost>
 213                                 EOF
 214                         ;;
 215                  esac |
 216                 sudo install -m 660 -o root -g root /dev/stdin \
 217                  /etc/apache2/site.d/"$site"/VirtualHost.conf
 218                 sudo ln -fns \
 219                  ../site.d/"$site"/VirtualHost.conf \
 220                  /etc/apache2/sites-available/"$site"
 221                 sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 222                  /home/www/log/"$site" \
 223                  /home/www/log/"$site"/apache2
 224                 sudo ln -fns \
 225                  /etc/apache2/site.d/"$site" \
 226                  /home/www/etc/apache2/"$site"
 227                 test -e /home/www/pub/"$site" ||
 228                 sudo install -d -m 2770 -o www-"$site" -g www-"$site" \
 229                  /home/www/pub/"$site"
 230                 rule adduser www-"$site"
 231                  --disabled-password \
 232                  --group \
 233                  --no-create-home \
 234                  --home /home/www/pub/"$site" \
 235                  --shell /bin/false \
 236                  --system
 237                 #sudo setfacl -m u:"www-$site":--x \
 238                 # /home/www/ \
 239                 # /home/www/pub/ \
 240                 # /home/www/pub/"$site"/
 241                 #sudo setfacl -m d:u:"www-$site":rwx \
 242                 # "$home"/pub/www/"$site"/
 243                 test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh ||
 244                 .         "$tool"/etc/apache2/site.d/"$site"/configure.sh
 245                 test -e /etc/apache2/sites-enabled/"$site" ||
 246                 sudo a2ensite "$site"
 247          done
 248         sudo service apache2 restart
 249  }
 250 rule_apt_configure () {
 251         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
 252                 deb http://ftp.rezopole.net/debian $vm_lsb_name main
 253                 EOF
 254         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
 255                 deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
 256                 EOF
 257         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
 258                 deb http://nightly.openerp.com/7.0/nightly/deb/ ./
 259                 EOF
 260         sudo install -m 664 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
 261                 Package: *
 262                 Pin: release a=$vm_lsb_name
 263                 Pin-Priority: 200
 264
 265                 Package: *
 266                 Pin: release a=$vm_lsb_name-backports
 267                 Pin-Priority: 170
 268                 EOF
 269         sudo apt-get update
 270         rule apt_get_install apticron
 271         m4 \
 272          --define=VM_DOMAINNAME=$vm_domainname \
 273          <"$tool"/etc/apticron/apticron.conf.m4 |
 274         sudo install -m 644 -o root -g root /dev/stdin \
 275          /etc/apticron/apticron.conf
 276  }
 277 rule_boot_configure () {
 278         #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
 279         sudo debconf-set-selections <<-EOF
 280                 grub-pc grub-pc/install_devices multiselect
 281                 EOF
 282         rule apt_get_install grub-pc
 283         sudo install -d -m 644 -o root -g root /boot/grub
 284         rule apt_get_install linux-image-$vm_arch
 285         sudo install -m 644 -o root -g root /dev/stdin /etc/default/grub <<-EOF
 286                 GRUB_DEFAULT=0
 287                 GRUB_TIMEOUT=5
 288                 GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
 289                 GRUB_CMDLINE_LINUX_DEFAULT="quiet"
 290                 GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
 291                 GRUB_DISABLE_RECOVERY="true"
 292                 #GRUB_PRELOAD_MODULES="lvm"
 293                 EOF
 294         sudo install -m 644 -o root -g root /dev/stdin /boot/grub/device.map <<-EOF
 295                 (hd0)   /dev/xvda
 296                 (hd0)   /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
 297                 EOF
 298         sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
 299         rule initramfs_configure
 300         rule apt_get_install molly-guard
 301         sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
 302                 ALWAYS_QUERY_HOSTNAME=true
 303                  # NOTE: une alternative est de dire à sudo de conserver les SSH_*
 304                  #       néamoins demander tout le temps n'est pas trop contraignant
 305                  #       et davantage sécurisant.
 306                 EOF
 307  }
 308 rule_etckeeper_configure () {
 309         sudo install -m 644 -o root -g root /dev/stdin /etc/etckeeper/etckeeper.conf <<-EOF
 310                 VCS=git
 311                 GIT_COMMIT_OPTIONS=""
 312                 AVOID_DAILY_AUTOCOMMITS=1
 313                 #AVOID_SPECIAL_FILE_WARNING=1
 314                 AVOID_COMMIT_BEFORE_INSTALL=1
 315                 HIGHLEVEL_PACKAGE_MANAGER=apt
 316                 LOWLEVEL_PACKAGE_MANAGER=dpkg
 317                 EOF
 318         sudo install -m 644 -o root -g root \
 319          "$tool"/etc/etckeeper/prompt.sh \
 320                 /etc/etckeeper/prompt.sh
 321         rule apt_get_install etckeeper
 322  }
 323 rule_filesystem_configure () {
 324         m4 \
 325          --define=VM_LVM_LV=$vm_lvm_lv \
 326          --define=VM_LVM_VG=$vm_lvm_vg \
 327          <"$tool"/etc/fstab.m4 |
 328         sudo install -m 644 -o root -g root /dev/stdin \
 329          /etc/fstab
 330         m4 \
 331          --define=VM_LVM_LV=$vm_lvm_lv \
 332          --define=VM_LVM_VG=$vm_lvm_vg \
 333          <"$tool"/etc/crypttab.m4 |
 334         sudo install -m 644 -o root -g root /dev/stdin \
 335          /etc/crypttab
 336         rule tmpfs_configure
 337  }
 338 rule_initramfs_configure () {
 339         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
 340                 MODULES=most
 341                 BUSYBOX=y
 342                 KEYMAP=y
 343                 COMPRESS=gzip
 344                 DEVICE=eth0
 345                 EOF
 346         sudo install -m 644 -o root -g root /dev/stdin /etc/modprobe.d/xen-pv.conf <<-EOF
 347                 alias eth0 xennet
 348                 alias scsi_hostadapter xenblk
 349                 EOF
 350         sudo install -m 644 -o root -g root /dev/stdin /etc/modules <<-EOF
 351                 sha1_generic
 352                 sha256_generic
 353                 sha512_generic
 354                 aes-x86_64
 355                 xts
 356                 # NOTE: pour Xen en mode HVM :
 357                 #modprobe xen-platform-pci
 358                 EOF
 359         sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/modules <<-EOF
 360                 EOF
 361         sudo sed -e '/^configure_networking /s/ &$//' \
 362          -i /usr/share/initramfs-tools/scripts/init-premount/dropbear
 363          # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
 364         ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
 365         ( while IFS= read -r line
 366          do case $line in (*" RSA") return 0; break;; esac
 367          done; return 1 ) ||
 368          {
 369         sudo rm -f \
 370          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \
 371          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub
 372         sudo dropbearkey -t rsa -s 4096 -f \
 373          /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
 374          }
 375         # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
 376         sudo install -d -m 640 -o root -g root \
 377          /etc/initramfs-tools/root \
 378          /etc/initramfs-tools/root/.ssh
 379         getent group sudo |
 380         while IFS=: read -r group x x users
 381          do while test -n "$users" && IFS=, read -r user users <<-EOF
 382                         $users
 383                         EOF
 384                  do eval local home\; home="~$user"
 385                         sudo cat "$home"/etc/ssh/authorized_keys
 386                  done
 387          done |
 388         sudo install -m 644 -o root -g root /dev/stdin \
 389          /etc/initramfs-tools/root/.ssh/authorized_keys
 390         sudo rm -f \
 391          /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
 392          /etc/initramfs-tools/root/.ssh/id_rsa.pub \
 393          /etc/initramfs-tools/root/.ssh/id_rsa
 394          # NOTE: clefs générées par Debian
 395         sudo update-initramfs -u
 396  }
 397 rule_insserv_remove () { # SYNTAX: $sv
 398         local sv="$1"
 399         #sudo chmod u+x /etc/init.d/"$sv"
 400         sudo insserv --force --remove "$sv"
 401         sudo test ! -x /etc/init.d/"$sv" ||
 402         sudo /etc/init.d/"$sv" stop
 403         sudo chmod ugo-x /etc/init.d/"$sv"
 404  }
 405 rule_gitolite_configure () {
 406         sudo debconf-set-selections <<-EOF
 407                 gitolite        gitolite/gituser        string  git
 408                 gitolite        gitolite/adminkey       string
 409                 gitolite        gitolite/gitdir string  /home/git
 410                 EOF
 411         rule apt_get_install gitolite
 412         rule adduser git \
 413          --disabled-password \
 414          --group \
 415          --home /home/git \
 416          --shell /bin/bash \
 417          --system
 418         sudo chfn --full-name git git
 419         rule adduser log-git \
 420          --disabled-login \
 421          --disabled-password \
 422          --group \
 423          --home /home/git/log \
 424          --shell /bin/false \
 425          --system
 426         rule adduser git-data \
 427          --disabled-login \
 428          --disabled-password \
 429          --group \
 430          --home /home/git/pub \
 431          --shell /bin/false \
 432          --system
 433         sudo adduser git        git-data
 434         sudo install -d -m 750 -o git -g git \
 435          /etc/gitolite \
 436          /home/git/etc \
 437          /home/git/etc/ssh
 438         sudo install -d -m 751 -o git -g git \
 439          /home/git
 440         sudo install -d -m 2770 -o git-data -g git-data \
 441          /home/git/pub
 442         sudo install -d -m 1771 -o git -g git \
 443          /home/git/log
 444         sudo install -d -m 2770 -o git -g log-git \
 445          /home/git/log/gitolite \
 446          /home/git/log/gitolite/perf
 447         sudo install -d -m 3771 -o git -g git \
 448          /home/git/hooks
 449         sudo ln -fns /etc/gitolite /home/git/etc/gitolite
 450         sudo ln -fns /etc/gitweb /home/git/etc/gitweb
 451         sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc
 452         sudo ln -fns etc/ssh /home/git/.ssh
 453         sudo install -m 770 -o git -g git /dev/stdin \
 454          /home/git/etc/gitolite/gitolite.rc <<-EOF
 455                 #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
 456                 #\$BIG_INFO_CAP = 20;
 457                 #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
 458                         # NOTE: Please use single quotes, not double quotes.
 459                 #\$GITWEB_URI_ESCAPE = 0;
 460                 \$GIT_PATH = "";
 461                 #\$GL_ADC_PATH = "";
 462                 \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
 463                 #\$GL_ALL_INCLUDES_SPECIAL = 0;
 464                 #\$GL_ALL_READ_ALL = 0;
 465                 \$GL_BIG_CONFIG = 0;
 466                 \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
 467                 \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
 468                 #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
 469                 \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
 470                 #\$GL_HOSTNAME = "git.$vm_domainname";
 471                         # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
 472                 #\$GL_HTTP_ANON_USER = "mob";
 473                 \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
 474                 \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
 475                 #\$GL_NICE_VALUE = 0;
 476                 \$GL_NO_CREATE_REPOS = 0;
 477                 \$GL_NO_DAEMON_NO_GITWEB = 0;
 478                 \$GL_NO_SETUP_AUTHKEYS = 0;
 479                 \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
 480                 \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
 481                 #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
 482                 #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
 483                 \$GL_SITE_INFO = "git.$vm_domainname";
 484                 #\$GL_SLAVE_MODE = 0;
 485                 \$GL_WILDREPOS = 0;
 486                 #\$GL_WILDREPOS_DEFPERMS = 'R @all';
 487                 \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
 488                 \$HTPASSWD_FILE = "";
 489                 \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
 490                 \$REPO_BASE = "pub";
 491                 \$REPO_UMASK = 0007;
 492                 \$RSYNC_BASE = "";
 493                 \$SVNSERVE = "";
 494                 #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
 495                 \$WEB_INTERFACE = "gitweb";
 496                 1;
 497                 EOF
 498         sudo install -m 600 -o git -g git \
 499          "$tool"/var/pub/ssh/git.key \
 500            /home/git/etc/ssh/git.pub
 501         sudo -u git \
 502          GL_RC=/home/git/etc/gitolite/gitolite.rc \
 503          GIT_AUTHOR_NAME=git \
 504                 gl-setup -q /home/git/etc/ssh/git.pub git
 505         local d
 506         for d in doc logs src
 507          do test ! -d /home/git/etc/gitolite/"$d" ||
 508                 rmdir /home/git/etc/gitolite/"$d"
 509          done
 510  }
 511 rule_locales_configure () {
 512         sudo debconf-set-selections <<-EOF
 513                 locales locales/default_environment_locale      select  None
 514                 locales locales/locales_to_be_generated multiselect     fr_FR.UTF-8 UTF-8
 515                 EOF
 516         rule dpkg_reconfigure locales
 517  }
 518 rule_login_configure () {
 519         sudo install -m 644 -o root -g root \
 520          "$tool"/etc/inittab \
 521                 /etc/inittab
 522         sudo install -m 644 -o root -g root \
 523          "$tool"/etc/login.defs \
 524                 /etc/login.defs
 525         grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session ||
 526         sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF
 527                 $(cat /etc/pam.d/common-session)
 528                 session optional pam_umask.so
 529                 EOF
 530         grep -q '^hvc0$' /etc/securetty ||
 531         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 532                 $(cat /etc/securetty)
 533                 hvc0
 534                 EOF
 535         grep -q '^xvc0$' /etc/securetty ||
 536         sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
 537                 $(cat /etc/securetty)
 538                 xvc0
 539                 EOF
 540  }
 541 rule_network_configure () {
 542         sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
 543                 $vm
 544                 EOF
 545         grep -q " $vm\$" /etc/hosts ||
 546         sudo install -m 644 -o root -g root /dev/stdin /etc/hosts <<-EOF
 547                 $(cat /etc/hosts)
 548                 127.0.0.1 $vm_fqdn $vm
 549                 EOF
 550         sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
 551                 search ${vm_host#*.}
 552                 nameserver ${vm_host_nameserver}
 553                 EOF
 554         m4 \
 555          --define=VM_IPV4=$vm_ipv4 \
 556          <"$tool"/etc/network/interfaces.m4 |
 557         sudo install -m 640 -o root -g root /dev/stdin \
 558          /etc/network/interfaces
 559  }
 560 rule_runit_configure () { # SYNTAX: $sv [...] -- $configure_options
 561         rule apt_get_install runit
 562         if test $# = 0
 563          then
 564                 set +x
 565                 sudo sv status \
 566                  $(sudo find /etc/sv \
 567                  -mindepth 1 -maxdepth 1 -type d \
 568                  -printf '%p\n' | sort)
 569          else
 570                 local services=
 571                 while [ $# -gt 0 ]
 572                  do case $1 in
 573                          (--) shift; break;;
 574                          (*) services="$services $1"; shift;;
 575                          esac
 576                  done
 577                 #for sv in $(sudo find /etc/sv \
 578                 # -mindepth 1 -maxdepth 1 -type d \
 579                 # -false $(printf -- '-or -name %s\n' $services) \
 580                 # -printf '%f\n')
 581                 # do
 582                 #       case $(sudo sv stop "$sv" | tee /dev/stderr) in
 583                 #        (*": runsv not running") true;;
 584                 #        (*": unable to open supervise/ok: file does not exist") true;;
 585                 #        ("ok: down:"*) true;;
 586                 #        (*) false;;
 587                 #        esac
 588                 # done
 589                 for sv in $(find "$tool"/etc/sv \
 590                  -mindepth 1 -maxdepth 1 -type d \
 591                  -false $(printf -- '-or -name %s\n' $services) \
 592                  -printf '%f\n')
 593                  do
 594                         rule _runit_sv_configure "$sv" "$@"
 595                         rule _runit_sv_start     "$sv"
 596                  done
 597                 #sleep 3
 598                 #sudo find -L /etc/service -type l -delete
 599          fi
 600  }
 601 rule__runit_sv_configure () { # SYNTAX: $sv $configure_options
 602         local sv="$1"; shift
 603         sudo install -d -m 770 -o root -g root \
 604          /etc/sv/"$sv"
 605         sudo install -m 770 -o root -g root \
 606          "$tool"/etc/sv/"$sv"/run \
 607                 /etc/sv/"$sv"/run
 608         if test -e "$tool"/etc/sv/"$sv"/log/run
 609          then
 610                 sudo install -d -m 770 -o root -g root \
 611                  /etc/sv/"$sv"/log
 612                 sudo install -m 770 -o root -g root \
 613                  "$tool"/etc/sv/"$sv"/log/run \
 614                         /etc/sv/"$sv"/log/run
 615          fi
 616         (
 617         test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
 618         .         "$tool"/etc/sv/"$sv"/configure.sh || return 1
 619         )
 620         (
 621         test ! -r "$tool"/etc/sv/"$sv"/log/configure.sh ||
 622         .         "$tool"/etc/sv/"$sv"/log/configure.sh || return 1
 623         )
 624         sudo ln -fns \
 625                 ../sv/"$sv" \
 626          /etc/service/"$sv"
 627  }
 628 rule__runit_sv_restart () { # SYNTAX: $sv
 629         local sv="$1"
 630         while true
 631          do case $(sudo sv restart "$sv" | tee /dev/stderr) in
 632                  (*": runsv not running") sleep 1;;
 633                  (*": unable to open supervise/ok: file does not exist") sleep 1;;
 634                  (*) break;;
 635                  esac
 636          done
 637  }
 638 rule__runit_sv_start () { # SYNTAX: $sv
 639         local sv="$1"
 640         while true
 641          do case $(sudo sv start "$sv" | tee /dev/stderr) in
 642                  (*": runsv not running") sleep 1;;
 643                  (*": unable to open supervise/ok: file does not exist") sleep 1;;
 644                  (*) break;;
 645                  esac
 646          done
 647  }
 648 rule_shorewall_configure () {
 649         # DOC: http://shorewall.net/Introduction.html
 650         local -; set +f
 651         rule apt_get_install shorewall
 652         sudo install -m 644 -o root -g root /dev/stdin \
 653          /etc/default/shorewall <<-EOF
 654                 INITLOG=/dev/null
 655                 OPTIONS=""
 656                 RESTARTOPTIONS=""
 657                 SAFESTOP=0
 658                 STARTOPTIONS=""
 659                 startup=1
 660                 EOF
 661         local conf
 662         for conf in "$tool"/etc/shorewall/*
 663          do conf=${conf#"$tool"/etc/shorewall/}
 664                 sudo test ! -f "$tool"/etc/shorewall/"$conf" ||
 665                 sudo install -m 640 -o root -g root \
 666                  "$tool"/etc/shorewall/"$conf" \
 667                         /etc/shorewall/"$conf"
 668          done
 669         sudo install -d -m 750 -o root -g root \
 670          /etc/shorewall/macro.d
 671         for conf in "$tool"/etc/shorewall/macro.d/*
 672          do conf=${conf#"$tool"/etc/shorewall/macro.d/}
 673                 sudo test ! -f "$tool"/etc/shorewall/macro.d/"$conf" ||
 674                 sudo install -m 640 -o root -g root \
 675                  "$tool"/etc/shorewall/macro.d/"$conf" \
 676                         /etc/shorewall/macro.d/"$conf"
 677          done
 678         sudo install -d -m 750 -o root -g root \
 679          /etc/shorewall/action.d
 680         #for conf in "$tool"/etc/shorewall/action.d/*
 681         # do conf=${conf#"$tool"/etc/shorewall/action.d/}
 682         #       sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" ||
 683         #       sudo install -m 640 -o root -g root \
 684         #        "$tool"/etc/shorewall/action.d/"$conf" \
 685         #               /etc/shorewall/action.d/"$conf"
 686         # done
 687         #sudo shorewall safe-restart
 688  }
 689 rule_sysctl_configure () {
 690         local -; set +f
 691         for conf in "$tool"/etc/sysctl.d/*.conf
 692          do conf=${conf#"$tool"/etc/sysctl.d/}
 693                 sudo install -m 660 -o root -g root \
 694                  "$tool"/etc/sysctl.d/"$conf" \
 695                         /etc/sysctl.d/"$conf"
 696          done
 697         sudo install -m 660 -o root -g root /dev/stdin \
 698          /etc/sysctl.d/local-kernel-name.conf <<-EOF
 699                 kernel.hostname   = $vm_hostname
 700                 kernel.domainname = $vm_domainname
 701                 EOF
 702         sudo sysctl --system
 703  }
 704 rule_tmpfs_configure () {
 705         sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
 706                 LOCK_SIZE=5242880 # NOTE: 5MiB
 707                 RAMLOCK=yes
 708                 RAMSHM=yes
 709                 RAMTMP=yes
 710                 RUN_SIZE=10%
 711                 SHM_SIZE=
 712                 TMP_MODE=1777,nr_inodes=1000k,noatime
 713                 TMP_OVERFLOW_LIMIT=1024
 714                  # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
 715                  #       on the root filesystem (overriding RAMTMP).
 716                 TMP_SIZE=200m
 717                 TMPFS_SIZE=20%VM
 718                 EOF
 719  }
 720 rule_user_add () { # SYNTAX: $user
 721         local user="$1"; shift
 722         rule adduser "$user" --disabled-password "$@"
 723                 # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
 724         eval local home\; home="~$user"
 725         sudo adduser "$user" users
 726         sudo install -m 640 -o "$user" -g "$user" \
 727          "$tool"/var/pub/ssh/"$user".key \
 728          "$home"/etc/ssh/authorized_keys
 729         local key; local -; set +f
 730         for key in "$tool"/var/pub/openpgp/*.key
 731          do sudo -u "$user" gpg --import - <"$key"
 732          done
 733  }
 734 rule_user_configure () {
 735         rule apt_get_install bash-completion
 736         sudo install -m 660 -o root -g root \
 737          "$tool"/etc/adduser.conf \
 738                 /etc/adduser.conf
 739         sudo install -d -m 750 -o root -g root \
 740          /etc/skel \
 741          /etc/skel/etc \
 742          /etc/skel/etc/gpg \
 743          /etc/skel/etc/ssh
 744         sudo install -d -m 770 -o root -g root \
 745          /etc/skel/var \
 746          /etc/skel/var/cache \
 747          /etc/skel/var/log \
 748          /etc/skel/var/run \
 749          /etc/skel/var/run/ssh
 750         sudo ln -fns etc/ssh /etc/skel/.ssh
 751         sudo ln -fns etc/gpg /etc/skel/.gnupg
 752         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF
 753                 %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
 754                   case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
 755                     ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
 756                 EOF
 757         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
 758                 %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
 759                 EOF
 760         sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
 761                 Defaults env_keep = " \\
 762                   EDITOR \\
 763                   GIT_AUTHOR_NAME \\
 764                   GIT_AUTHOR_EMAIL \\
 765                   GIT_COMMITTER_NAME \\
 766                   GIT_COMMITTER_EMAIL \\
 767                  "
 768                 EOF
 769         sudo install -m 755 -o root -g root /dev/stdin /usr/local/bin/passwd-init <<-EOF
 770                 #!/bin/sh -efu
 771                 # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
 772                 sudo /bin/sh -e -f -u -c \
 773                   'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
 774                 EOF
 775         sudo install -m 644 -o root -g root \
 776          "$tool"/etc/bash.bashrc \
 777                 /etc/bash.bashrc
 778         sudo install -m 644 -o root -g root \
 779          "$tool"/etc/screenrc \
 780                 /etc/screenrc
 781         local sh; local -; set +f
 782         for sh in "$tool"/etc/user.d/*/configure.sh
 783          do sh=${sh#"$tool"/etc/user.d/}
 784                 local user="${sh%/configure.sh}"
 785                 (
 786                 . "$tool"/etc/user.d/"$sh" || return 1
 787                 )
 788          done
 789  }
 790 rule_user_admin_add () { # SYNTAX: $user
 791         rule user_configure
 792         local user=$1
 793         rule adduser "$user" --disabled-password
 794         eval local home\; home="~$user"
 795         sudo adduser "$user" sudo
 796         sudo install -m 640 -o root -g root \
 797          "$tool"/var/pub/ssh/"$user".key \
 798          "$home"/etc/ssh/authorized_keys
 799         local key; local -; set +f
 800         for key in "$tool"/var/pub/openpgp/*.key
 801          do sudo -u "$user" gpg --import - <"$key"
 802          done
 803         rule user_admin_configure
 804  }
 805 rule_user_admin_configure () {
 806         rule initramfs_configure
 807         rule user_root_configure
 808  }
 809 rule_user_root_configure () {
 810         sudo install -d -m 750 -o root -g root \
 811          /root/etc \
 812          /root/etc/gpg \
 813          /root/etc/ssh
 814         sudo ln -fns etc/gpg /root/.gnupg
 815         sudo ln -fns etc/ssh /root/.ssh
 816         getent group sudo |
 817         while IFS=: read -r group x x users
 818          do while test -n "$users" && IFS=, read -r user users <<-EOF
 819                         $users
 820                         EOF
 821                  do eval local home\; home="~$user"
 822                         sudo cat "$home"/etc/ssh/authorized_keys
 823                  done
 824          done |
 825         sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys
 826         local key; local -; set +f
 827         for key in "$tool"/var/pub/openpgp/*.key
 828          do sudo gpg --import "$key"
 829          done
 830  }
 831 rule__www_configure () {
 832         rule adduser www \
 833          --disabled-login \
 834          --disabled-password \
 835          --group \
 836          --home /home/www \
 837          --shell /bin/false \
 838          --system
 839         rule adduser log-www \
 840          --disabled-login \
 841          --disabled-password \
 842          --group \
 843          --home /home/www/log \
 844          --shell /bin/false \
 845          --system
 846         #sudo adduser www www-data
 847         sudo adduser www log-www
 848         #sudo adduser log log-www
 849         usermod --home /home/www/pub www-data
 850         sudo install -d -m 751 -o www -g www \
 851          /home/www
 852         sudo install -d -m 750 -o www -g www \
 853          /home/www/etc
 854         sudo install -d -m 1771 -o www-data -g www-data \
 855          /home/www/pub
 856         sudo install -d -m 1771 -o log-www -g log-www \
 857          /home/www/log
 858  }
 859 rule_configure () {
 860         rule apt_configure
 861         rule git_configure
 862         rule etckeeper_configure
 863         rule locales_configure
 864         rule time_configure
 865         rule network_configure
 866         rule filesystem_configure
 867         rule login_configure
 868         rule ssh_configure
 869         rule user_root_configure
 870         rule boot_configure
 871         rule sysctl_configure
 872         rule user_configure
 873         rule gitolite_configure
 874         rule shorewall_configure
 875         rule runit_configure
 876  }
 877
 878 rule_luks_key_change () {
 879         sudo cryptsetup luksChangeKey /dev/$vm_lvm_vg/${vm_lvm_lv}_root
 880  }
 881
 882 rule=${1:-help}
 883 ${1+shift}
 884 case $rule in
 885  (help);;
 886  (*)
 887         assert 'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
 888         cd /
 889         ;;
 890  esac
 891 rule $rule "$@"