vm_remote

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=$(cd "${0%/*}"; cd -)
   4 . "$tool"/lib/rule.sh
   5 . "$tool"/etc/vm.sh
   6
   7 rule_help () { # SYNTAX: [--hidden]
   8         local hidden; [ ${1:+set} ] || hidden=set
   9         cat >&2 <<-EOF
  10                 DESCRIPTION:
  11                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  12                   _depuis_ une machine distante ;
  13                   il sert à la fois d'outil (aisément bidouillable)
  14                   et de documentation (préçise).
  15                   Voir \`$tool/vm_host'   pour les règles côté machine hôte ($vm_host).
  16                   Voir \`$tool/vm_hosted' pour les règles côté VM hébergée ($vm_fqdn).
  17                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  18                 RULES:
  19                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  20                 ENVIRONMENT:
  21                   TRACE # affiche les commandes avant leur exécution
  22                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  23                 EOF
  24  }
  25
  26 rule_git_configure () { # DESCRIPTION: configure ./.git correctement
  27         (
  28         cd "$tool"
  29         git remote rm host || true
  30         git remote add host $vm_host:tool/vm
  31         git config --replace remote.host.push HEAD:refs/remotes/master
  32         git remote rm hosted || true
  33         git remote add hosted root@$vm_fqdn:tool/vm
  34         git config --replace remote.hosted.push HEAD:refs/remotes/master
  35         git submodule update --init
  36         )
  37  }
  38 rule_git_push () { # SYNTAX: {host|hosted} $git_push_options
  39         (
  40         cd "$tool"
  41         local remote=${1#remote=}; shift
  42         GIT_SSH=./lib/ssh git push -v "$remote" "$@"
  43         info "penser à faire : vm_hosted git_reset"
  44         )
  45  }
  46
  47 rule_ssh () {
  48         "$tool"/lib/ssh $vm_fqdn "$@"
  49  }
  50 rule_mosh () {
  51         mosh --ssh="$tool/lib/ssh $*" $vm_fqdn
  52  }
  53 rule__ssh_known_hosts_update () {
  54         rule ssh \
  55          -o StrictHostKeyChecking=no \
  56          -o CheckHostIP=no \
  57          -o HashKnownHosts=no \
  58          whoami
  59  }
  60
  61 rule__x509_service_key_send_deciphered () { # SYNTAX: $service $remote_destination ${ssh_options-}
  62         local service="$1"; shift
  63         local remote_destination="$1"; shift
  64         gpg --decrypt "var/sec/x509/$vm_domainname/$service/key.pass.gpg" |
  65         openssl rsa -passin 'stdin' \
  66          -in  "var/sec/x509/$vm_domainname/$service/key.pem" \
  67          -out '/dev/stdout' |
  68         rule ssh "$@"  ' \
  69                 install -m 400 -o root -g root \
  70                  /dev/stdin \
  71                  '"$remote_destination"' \
  72          '
  73  }
  74
  75 rule_luks_key_send () { # DESCRIPTION: envoie la clef de déchiffrement des partitions au démarrage de la VM.
  76         gpg --decrypt var/sec/luks/$vm_fqdn.key.gpg |
  77         "$tool"/lib/ssh root@$vm_fqdn "$@" \
  78          -o CheckHostIP=no \
  79          -o HostKeyAlias=init.$vm_fqdn \
  80          tee /lib/cryptsetup/passfifo \>/dev/null
  81  }
  82 rule_luks_key_backup () { # SYNTAX: ${gpg_options:---recipient $USER@} DESCRIPTION: sauvegarde localement les entêtes des partitions chiffrées.
  83         test "${*+set}" || set -- --recipient "$USER@"
  84         for part in root var home
  85          do
  86                 mkdir -p var/sec/luks
  87                 rule ssh -l root ' \
  88                         set -e -f -u;
  89                         exec 2>/dev/null;
  90                         tmp=$(mktemp -t "luks.'"$part"'.XXXXXXXX.tmp" --dry-run);
  91                         cryptsetup luksHeaderBackup >/dev/null \
  92                          /dev/'"$vm_lvm_vg"'/'"$vm_lvm_lv"'_'"$part"' \
  93                          --header-backup-file "$tmp"; \
  94                         cat "$tmp";
  95                         shred >/dev/null --remove "$tmp"; \
  96                  ' |
  97                 gpg "$@" --encrypt \
  98                  -o var/sec/luks/${vm_lvm_lv}_${part}.luks.gpg
  99          done
 100  }
 101
 102 rule_apache2_key_send () {
 103         local -; set +f
 104         for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
 105          do conf=${conf#"$tool"/etc/apache2/site.d/}
 106                 local user port service site
 107                 IFS=. read -r user port service site <<-EOF
 108                         ${conf%\/VirtualHost\.conf}
 109                         EOF
 110                 assert 'test "${user:+set}"'
 111                 assert 'test "${service:+set}"'
 112                 assert 'test "${site:+set}"'
 113                 assert 'test "${port:+set}"'
 114                 local site_dir="$user.$port.$service.$site"
 115                 case $port in
 116                  (443)
 117                         rule ssh -l root ' \
 118                                 sudo install -d -m 770 -o '"$user"' -g '"$user"' \
 119                                  /etc/apache2 \
 120                                  /etc/apache2/site.d/'"$site_dir"' \
 121                                  /etc/apache2/site.d/'"$site_dir"'/x509; \
 122                                 sudo install -m 644 -o '"$user"' -g '"$user"' /dev/stdin \
 123                                  /etc/apache2/site.d/'"$site_dir"'/x509/.gitignore <<-EOF
 124                                         key.pem
 125                                         EOF
 126                          '
 127                         rule _x509_service_key_send_deciphered $service \
 128                          ~"$user"/etc/apache2/"$site_dir"/x509/key.pem -l root "$@"
 129                         ;;
 130                  esac
 131          done
 132  }
 133 rule_dovecot_key_send () {
 134         rule ssh -l root ' \
 135                 sudo install -d -m 770 -o root -g root \
 136                  /etc/dovecot/'"$vm_domainname"'/ \
 137                  /etc/dovecot/'"$vm_domainname"'/imap \
 138                  /etc/dovecot/'"$vm_domainname"'/imap/x509 ; \
 139                 sudo install -m 644 -o root -g root /dev/stdin \
 140                  /etc/dovecot/'"$vm_domainname"'/imap/x509/.gitignore <<-EOF
 141                         key.pem
 142                         EOF
 143          '
 144         rule _x509_service_key_send_deciphered imap \
 145          /etc/dovecot/$vm_domainname/$service/x509/key.pem -l root "$@"
 146  }
 147 rule_gitolite_configure () {
 148         (
 149         cd "$tool"/etc/gitolite
 150         GIT_SSH=../../lib/ssh \
 151         ssh-agent sh -c ' \
 152                 SSH_ASKPASS='"$tool"'/lib/ssh-pass \
 153                 SSH_ID=git \
 154                 ssh-add '"$tool"'/var/sec/ssh/git </dev/null && \
 155                 git push -v origin '"$*"
 156         )
 157  }
 158 rule_nginx_key_send () {
 159         local -; set +f
 160         for conf in "$tool"/etc/nginx/site.d/*/server.conf
 161          do conf=${conf#"$tool"/etc/nginx/site.d/}
 162                 local user port service site
 163                 IFS=. read -r user port service site <<-EOF
 164                         ${conf%\/server\.conf}
 165                         EOF
 166                 assert 'test "${user:+set}"'
 167                 assert 'test "${service:+set}"'
 168                 assert 'test "${site:+set}"'
 169                 assert 'test "${port:+set}"'
 170                 local site_dir="$user.$port.$service.$site"
 171                 case $port in
 172                  (443)
 173                         rule ssh -l root ' \
 174                                 sudo install -d -m 770 -o root -g root \
 175                                  /etc/nginx \
 176                                  /etc/nginx/site.d \
 177                                  /etc/nginx/site.d/'"$site_dir"' \
 178                                  /etc/nginx/site.d/'"$site_dir"'/x509; \
 179                                 sudo install -m 644 -o root -g root /dev/stdin \
 180                                  /etc/nginx/site.d/'"$site_dir"'/x509/.gitignore <<-EOF
 181                                         key.pem
 182                                         EOF
 183                          '
 184                         rule _x509_service_key_send_deciphered $service \
 185                          /etc/nginx/"$site_dir"/x509/key.pem -l root "$@"
 186                         ;;
 187                  esac
 188          done
 189  }
 190 rule_postfix_key_send () {
 191         rule ssh -l root ' \
 192                 sudo install -d -m 770 -o root -g root \
 193                  /etc/postfix/'"$vm_domainname"'/ \
 194                  /etc/postfix/'"$vm_domainname"'/smptd \
 195                  /etc/postfix/'"$vm_domainname"'/smptd/x509; \
 196                 sudo install -m 644 -o root -g root /dev/stdin \
 197                  /etc/postfix/'"$vm_domainname"'/smtp/x509/.gitignore <<-EOF
 198                         key.pem
 199                         EOF
 200                 sudo install -m 644 -o root -g root /dev/stdin \
 201                  /etc/postfix/'"$vm_domainname"'/smtpd/x509/.gitignore <<-EOF
 202                         key.pem
 203                         EOF
 204          '
 205         rule _x509_service_key_send_deciphered smtpd \
 206          /etc/postfix/$vm_domainname/smtpd/x509/key.pem -l root "$@"
 207  }
 208
 209 rule=${1:-help}
 210 ${1+shift}
 211 case $rule in
 212  (help);;
 213  (*)
 214         assert 'test ! "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
 215         assert 'test ! "$(hostname --fqdn)" = "$vm_host"' vm_host
 216         ;;
 217  esac
 218 rule $rule "$@"