vm_remote

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=$0
   4 while test -L "$tool"
   5  do tool=$(readlink "$tool")
   6  done
   7 tool=${tool%/*}
   8 . "$tool"/lib/rule.sh
   9 . "$tool"/etc/vm.sh
  10
  11 rule_help () { # SYNTAX: [--hidden]
  12         local hidden; [ ${1:+set} ] || hidden=set
  13         cat >&2 <<-EOF
  14                 DESCRIPTION:
  15                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  16                   _depuis_ une machine distante ;
  17                   il sert à la fois d'outil (aisément bidouillable)
  18                   et de documentation (préçise).
  19                   Voir \`$tool/vm_host'   pour les règles côté machine hôte ($vm_host).
  20                   Voir \`$tool/vm_hosted' pour les règles côté VM hébergée ($vm_fqdn).
  21                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  22                 RULES:
  23                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  24                 ENVIRONMENT:
  25                   TRACE # affiche les commandes avant leur exécution
  26                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  27                 EOF
  28  }
  29
  30 rule_git_configure () { # DESCRIPTION: configure ./.git correctement
  31         (
  32         cd "$tool"
  33         git remote rm host || true
  34         git remote add host $vm_host:src/vm
  35         git config --replace remote.host.push HEAD:refs/remotes/master
  36         git remote rm hosted || true
  37         git remote add hosted $vm_fqdn:src/vm
  38         git config --replace remote.hosted.push HEAD:refs/remotes/master
  39         git submodule update --init
  40         )
  41  }
  42 rule_git_push () { # SYNTAX: {host|hosted} $git_push_options
  43         (
  44         cd "$tool"
  45         local remote=${1#remote=}; shift
  46         GIT_SSH=./lib/ssh git push -v "$remote" "$@"
  47         )
  48  }
  49
  50 rule_ssh () {
  51         "$tool"/lib/ssh $vm_fqdn "$@"
  52  }
  53 rule_mosh () {
  54         mosh --ssh="$tool/lib/ssh $*" $vm_fqdn
  55  }
  56 rule__ssh_known_hosts_update () {
  57         rule ssh \
  58          -o StrictHostKeyChecking=no \
  59          -o CheckHostIP=no \
  60          -o HashKnownHosts=no \
  61          whoami
  62  }
  63
  64 rule__x509_site_key_decrypt () { # SYNTAX: $site
  65         local site="$1"; shift
  66         gpg --decrypt "$tool"/var/sec/x509/"$site"/key.pass.gpg |
  67         openssl rsa -passin 'stdin' \
  68          -in  var/sec/x509/"$site"/key.pem \
  69          -out '/dev/stdout'
  70  }
  71
  72 rule_luks_key_send () { # DESCRIPTION: envoie la clef de déchiffrement des partitions au démarrage de la VM.
  73         gpg --decrypt var/sec/luks/$vm_fqdn.key.gpg |
  74         "$tool"/lib/ssh root@$vm_fqdn "$@" \
  75          -o CheckHostIP=no \
  76          -o HostKeyAlias=init.$vm_fqdn \
  77          tee /lib/cryptsetup/passfifo \>/dev/null
  78  }
  79 rule_luks_key_backup () { # SYNTAX: ${gpg_options:---recipient $USER@} DESCRIPTION: sauvegarde localement les entêtes des partitions chiffrées.
  80         test "${*+set}" || set -- --recipient "$USER@"
  81         for part in root var home
  82          do
  83                 mkdir -p var/sec/luks
  84                 rule ssh -l root ' \
  85                         set -e -f -u;
  86                         exec 2>/dev/null;
  87                         tmp=$(mktemp -t "luks.'"$part"'.XXXXXXXX.tmp" --dry-run);
  88                         cryptsetup luksHeaderBackup >/dev/null \
  89                          /dev/'"$vm_lvm_vg"'/'"$vm_lvm_lv"'_'"$part"' \
  90                          --header-backup-file "$tmp"; \
  91                         cat "$tmp";
  92                         shred >/dev/null --remove "$tmp"; \
  93                  ' |
  94                 gpg "$@" --encrypt \
  95                  -o var/sec/luks/${vm_lvm_lv}_${part}.luks.gpg
  96          done
  97  }
  98
  99 rule_apache2_key_send () {
 100         local -; set +f
 101         for conf in "$tool"/etc/nginx/site.d/*/key_send
 102          do conf=${conf#"$tool"/etc/nginx/site.d/}
 103                 local site=${conf%/key_send}
 104                 rule _x509_site_key_decrypt \
 105                  "$(cat "$tool"/etc/apache2/site.d/"$site"/x509_host)" |
 106                 rule ssh -l root ' \
 107                         sudo install -d -m 770 -o '"$user"' -g '"$user"' \
 108                          /etc/apache2 \
 109                          /etc/apache2/x509.d \
 110                          /etc/apache2/x509.d/'"$site"'; \
 111                         sudo install -m 644 -o '"$user"' -g '"$user"' /dev/stdin \
 112                          /etc/apache2/x509.d/'"$site"'/.gitignore <<-EOF
 113                                 key.pem
 114                                 EOF
 115                         sudo install -m 400 -o root -g root \
 116                          /dev/stdin \
 117                          /etc/apache2/x509.d/'"'$site'"'/key.pem
 118                  '
 119          done
 120  }
 121 rule_dovecot_key_send () {
 122         rule _x509_site_key_decrypt imap."$vm_domainname" |
 123         rule ssh -l root ' \
 124                 sudo install -d -m 770 -o root -g root \
 125                  /etc/dovecot/'"$vm_domainname"'/ \
 126                  /etc/dovecot/'"$vm_domainname"'/imap \
 127                  /etc/dovecot/'"$vm_domainname"'/imap/x509 ; \
 128                 sudo install -m 644 -o root -g root /dev/stdin \
 129                  /etc/dovecot/'"$vm_domainname"'/imap/x509/.gitignore <<-EOF
 130                         key.pem
 131                         EOF
 132                 sudo install -m 400 -o root -g root \
 133                  /dev/stdin \
 134                  /etc/dovecot/"$vm_domainname"/imap/x509/key.pem
 135          '
 136  }
 137 rule_gitolite_git () {
 138         (
 139         cd "$tool"/etc/gitolite
 140         GIT_SSH=../../lib/ssh \
 141         ssh-agent sh -c ' \
 142                 SSH_ASKPASS='"$tool"'/lib/ssh-pass \
 143                 SSH_ID=git \
 144                 ssh-add '"$tool"'/var/sec/ssh/git </dev/null && \
 145                 git '"$*"
 146         )
 147  }
 148 rule_nginx_configure () {
 149         local -; set +f
 150         for conf in "$tool"/etc/nginx/site.d/*/site.conf
 151          do conf=${conf#"$tool"/etc/nginx/site.d/}
 152                 local site="${conf%/site.conf}"
 153                 if test -f "$tool"/etc/nginx/site.d/"$site"/x509_host
 154                  then
 155                         rule _x509_site_key_decrypt \
 156                          "$(cat "$tool"/etc/nginx/site.d/"$site"/x509_host)" |
 157                         rule ssh -l root ' \
 158                                 sudo install -d -m 770 -o root -g root \
 159                                  /etc/nginx \
 160                                  /etc/nginx/x509.d \
 161                                  /etc/nginx/x509.d/'"'$site'"'; \
 162                                 sudo install -m 644 -o root -g root /dev/stdin \
 163                                  /etc/nginx/x509.d/'"'$site'"'/.gitignore <<-EOF
 164                                         key.pem
 165                                         EOF
 166                                 sudo install -m 400 -o root -g root /dev/stdin \
 167                                  /etc/nginx/x509.d/'"'$site'"'/key.pem
 168                          '
 169                  fi
 170                 test ! -r "$tool"/etc/nginx/site.d/"$site"/remote.sh ||
 171                 .         "$tool"/etc/nginx/site.d/"$site"/remote.sh
 172          done
 173  }
 174 rule_postfix_key_send () {
 175         rule _x509_site_key_decrypt smtpd."$vm_domainname" |
 176         rule ssh -l root ' \
 177                 sudo install -d -m 770 -o root -g root \
 178                  /etc/postfix/'"$vm_domainname"'/ \
 179                  /etc/postfix/'"$vm_domainname"'/smtpd \
 180                  /etc/postfix/'"$vm_domainname"'/smtpd/x509; \
 181                 sudo install -m 644 -o root -g root /dev/stdin \
 182                  /etc/postfix/'"$vm_domainname"'/smtp/x509/.gitignore <<-EOF
 183                         key.pem
 184                         EOF
 185                 sudo install -m 644 -o root -g root /dev/stdin \
 186                  /etc/postfix/'"$vm_domainname"'/smtpd/x509/.gitignore <<-EOF
 187                         key.pem
 188                         EOF
 189                 install -m 400 -o root -g root \
 190                  /dev/stdin \
 191                  /etc/postfix/'"'$vm_domainname'"'/smtpd/x509/key.pem
 192          '
 193  }
 194
 195 rule=${1:-help}
 196 ${1+shift}
 197 case $rule in
 198  (help);;
 199  (*)
 200         assert 'test ! "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
 201         assert 'test ! "$(hostname --fqdn)" = "$vm_host"' vm_host
 202         ;;
 203  esac
 204 rule $rule "$@"