vm_remote

   1 #!/bin/sh
   2 set -e -f ${DRY_RUN:+-n} -u
   3 tool=$(cd "${0%/*}"; cd -)
   4 . "$tool"/lib/rule.sh
   5 . "$tool"/etc/vm.sh
   6
   7 rule_help () { # SYNTAX: [--hidden]
   8         local hidden; [ ${1:+set} ] || hidden=set
   9         cat >&2 <<-EOF
  10                 DESCRIPTION:
  11                   ce script regroupe des règles pour administrer la VM ($vm_fqdn)
  12                   _depuis_ une machine distante ;
  13                   il sert à la fois d'outil (aisément bidouillable)
  14                   et de documentation (préçise).
  15                   Voir \`$tool/vm_host'   pour les règles côté machine hôte ($vm_host).
  16                   Voir \`$tool/vm_hosted' pour les règles côté VM hébergée ($vm_fqdn).
  17                 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
  18                 RULES:
  19                 $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
  20                 ENVIRONMENT:
  21                   TRACE # affiche les commandes avant leur exécution
  22                 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
  23                 EOF
  24  }
  25
  26 rule_git_configure () { # DESCRIPTION: configure ./.git correctement
  27         (
  28         cd "$tool"
  29         git remote rm host || true
  30         git remote add host $vm_host:tool/vm
  31         git config --replace remote.host.push HEAD:refs/remotes/master
  32         git remote rm hosted || true
  33         git remote add hosted root@$vm_fqdn:tool/vm
  34         git config --replace remote.hosted.push HEAD:refs/remotes/master
  35         git submodule update --init
  36         )
  37  }
  38 rule_git_push () { # SYNTAX: {host|hosted} $git_push_options
  39         (
  40         cd "$tool"
  41         local remote=${1#remote=}; shift
  42         GIT_SSH=./lib/ssh git push -v "$remote" "$@"
  43         )
  44  }
  45
  46 rule_ssh () {
  47         "$tool"/lib/ssh $vm_fqdn "$@"
  48  }
  49 rule_mosh () {
  50         mosh --ssh="$tool/lib/ssh $*" $vm_fqdn
  51  }
  52 rule__ssh_known_hosts_update () {
  53         rule ssh \
  54          -o StrictHostKeyChecking=no \
  55          -o CheckHostIP=no \
  56          -o HashKnownHosts=no \
  57          whoami
  58  }
  59
  60 rule__x509_site_key_decrypt () { # SYNTAX: $site
  61         local site="$1"; shift
  62         gpg --decrypt "$tool"/var/sec/x509/"$site"/key.pass.gpg |
  63         openssl rsa -passin 'stdin' \
  64          -in  var/sec/x509/"$site"/key.pem \
  65          -out '/dev/stdout'
  66  }
  67
  68 rule_luks_key_send () { # DESCRIPTION: envoie la clef de déchiffrement des partitions au démarrage de la VM.
  69         gpg --decrypt var/sec/luks/$vm_fqdn.key.gpg |
  70         "$tool"/lib/ssh root@$vm_fqdn "$@" \
  71          -o CheckHostIP=no \
  72          -o HostKeyAlias=init.$vm_fqdn \
  73          tee /lib/cryptsetup/passfifo \>/dev/null
  74  }
  75 rule_luks_key_backup () { # SYNTAX: ${gpg_options:---recipient $USER@} DESCRIPTION: sauvegarde localement les entêtes des partitions chiffrées.
  76         test "${*+set}" || set -- --recipient "$USER@"
  77         for part in root var home
  78          do
  79                 mkdir -p var/sec/luks
  80                 rule ssh -l root ' \
  81                         set -e -f -u;
  82                         exec 2>/dev/null;
  83                         tmp=$(mktemp -t "luks.'"$part"'.XXXXXXXX.tmp" --dry-run);
  84                         cryptsetup luksHeaderBackup >/dev/null \
  85                          /dev/'"$vm_lvm_vg"'/'"$vm_lvm_lv"'_'"$part"' \
  86                          --header-backup-file "$tmp"; \
  87                         cat "$tmp";
  88                         shred >/dev/null --remove "$tmp"; \
  89                  ' |
  90                 gpg "$@" --encrypt \
  91                  -o var/sec/luks/${vm_lvm_lv}_${part}.luks.gpg
  92          done
  93  }
  94
  95 rule_apache2_key_send () {
  96         local -; set +f
  97         for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
  98          do conf=${conf#"$tool"/etc/apache2/site.d/}
  99                 local port domain
 100                 IFS=. read -r port domain <<-EOF
 101                         ${conf%/VirtualHost.conf}
 102                         EOF
 103                 assert 'test "${port:+set}"'
 104                 assert 'test "${domain:+set}"'
 105                 local site="$port.$domain"
 106                 case $port in
 107                  (443)
 108                         rule _x509_site_key_decrypt "$domain" |
 109                         rule ssh -l root ' \
 110                                 sudo install -d -m 770 -o '"$user"' -g '"$user"' \
 111                                  /etc/apache2 \
 112                                  /etc/apache2/site.d/'"$site"' \
 113                                  /etc/apache2/site.d/'"$site"'/x509; \
 114                                 sudo install -m 644 -o '"$user"' -g '"$user"' /dev/stdin \
 115                                  /etc/apache2/site.d/'"$site"'/x509/.gitignore <<-EOF
 116                                         key.pem
 117                                         EOF
 118                                 sudo install -m 400 -o root -g root \
 119                                  /dev/stdin \
 120                                  /etc/apache2/'"'$site'"'/x509/key.pem
 121                          '
 122                         ;;
 123                  esac
 124          done
 125  }
 126 rule_dovecot_key_send () {
 127         rule _x509_site_key_decrypt imap."$vm_domainname" |
 128         rule ssh -l root ' \
 129                 sudo install -d -m 770 -o root -g root \
 130                  /etc/dovecot/'"$vm_domainname"'/ \
 131                  /etc/dovecot/'"$vm_domainname"'/imap \
 132                  /etc/dovecot/'"$vm_domainname"'/imap/x509 ; \
 133                 sudo install -m 644 -o root -g root /dev/stdin \
 134                  /etc/dovecot/'"$vm_domainname"'/imap/x509/.gitignore <<-EOF
 135                         key.pem
 136                         EOF
 137                 sudo install -m 400 -o root -g root \
 138                  /dev/stdin \
 139                  /etc/dovecot/"$vm_domainname"/imap/x509/key.pem
 140          '
 141  }
 142 rule_gitolite_configure () {
 143         (
 144         cd "$tool"/etc/gitolite
 145         GIT_SSH=../../lib/ssh \
 146         ssh-agent sh -c ' \
 147                 SSH_ASKPASS='"$tool"'/lib/ssh-pass \
 148                 SSH_ID=git \
 149                 ssh-add '"$tool"'/var/sec/ssh/git </dev/null && \
 150                 git push -v origin '"$*"
 151         )
 152  }
 153 rule_nginx_key_send () {
 154         local -; set +f
 155         for conf in "$tool"/etc/nginx/site.d/*/key_send
 156          do conf=${conf#"$tool"/etc/nginx/site.d/}
 157                 local site=${conf%/key_send}
 158                 rule _x509_site_key_decrypt \
 159                  "$(cat "$tool"/etc/nginx/site.d/"$site"/key_send)" |
 160                 rule ssh -l root ' \
 161                         sudo install -d -m 770 -o root -g root \
 162                          /etc/nginx \
 163                          /etc/nginx/x509.d \
 164                          /etc/nginx/x509.d/'"'$site'"'; \
 165                         sudo install -m 644 -o root -g root /dev/stdin \
 166                          /etc/nginx/x509.d/'"'$site'"'/.gitignore <<-EOF
 167                                 key.pem
 168                                 EOF
 169
 170                         install -m 400 -o root -g root \
 171                          /dev/stdin \
 172                          /etc/nginx/x509.d/'"'$site'"'/key.pem
 173                  '
 174          done
 175  }
 176 rule_postfix_key_send () {
 177         rule _x509_site_key_decrypt smtpd."$vm_domainname" |
 178         rule ssh -l root ' \
 179                 sudo install -d -m 770 -o root -g root \
 180                  /etc/postfix/'"$vm_domainname"'/ \
 181                  /etc/postfix/'"$vm_domainname"'/smtpd \
 182                  /etc/postfix/'"$vm_domainname"'/smtpd/x509; \
 183                 sudo install -m 644 -o root -g root /dev/stdin \
 184                  /etc/postfix/'"$vm_domainname"'/smtp/x509/.gitignore <<-EOF
 185                         key.pem
 186                         EOF
 187                 sudo install -m 644 -o root -g root /dev/stdin \
 188                  /etc/postfix/'"$vm_domainname"'/smtpd/x509/.gitignore <<-EOF
 189                         key.pem
 190                         EOF
 191                 install -m 400 -o root -g root \
 192                  /dev/stdin \
 193                  /etc/postfix/'"'$vm_domainname'"'/smtpd/x509/key.pem
 194          '
 195  }
 196
 197 rule=${1:-help}
 198 ${1+shift}
 199 case $rule in
 200  (help);;
 201  (*)
 202         assert 'test ! "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
 203         assert 'test ! "$(hostname --fqdn)" = "$vm_host"' vm_host
 204         ;;
 205  esac
 206 rule $rule "$@"