#!/bin/sh
set -e -f ${DRY_RUN:+-n} -u
tool=${0%/*}
. "$tool"/lib/rule.sh
. "$tool"/etc/vm.sh

rule_help () { # SYNTAX: [--hidden]
	local hidden; [ ${1:+set} ] || hidden=set
	cat >&2 <<-EOF
		DESCRIPTION:
		  ce script regroupe des règles pour administrer la VM ($vm_fqdn)
		  _depuis_ son hôte ($vm_host) ;
		  il sert à la fois d'outil (aisément bidouillable)
		  et de documentation (préçise).
		  Voir \`$tool/vm_hosted' pour les règles côté VM hébergée.
		SYNTAX: $0 \$RULE \${RULE}_SYNTAX
		RULES:
		$(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/  \1\2/p" "$tool"/etc/vm.sh "$0")
		ENVIRONMENT:
		  TRACE # affiche les commandes avant leur exécution
		$(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
		EOF
 }

readonly vm_dev_disk=/dev/mapper/domU-$(printf %s "$vm_fqdn-disk" | sed -e 's/-/--/g')
readonly vm_dev_disk_boot="${vm_dev_disk}1"

rule_git_config () {
	(
	cd "$tool"
	git config --replace branch.master.remote .
	git config --replace branch.master.merge refs/remotes/master
	)
 }
rule_git_reset () {
	(
	cd "$tool"
	#git checkout -f -B master remotes/master
	# NOTE: pas de -B sous squeeze
	git checkout HEAD'^' &&
	git branch -f master remotes/master &&
	git checkout master
	git clean -f -d -x
	)
 }

rule_vm_configure () {
	sudo install -m 644 -u root -g root /dev/stdin /etc/xen/$vm_fqdn.cfg <<-EOF
		#  -*- mode: python; -*-
		# DOC: http://wiki.xen.org/wiki/Xen_Linux_PV_on_HVM_drivers
		import os, re
		name         = "$vm_fqdn"
		arch         = os.uname()[4]
		memory       = 2048
		vcpus        = 1
		pae          = 1
		acpi         = 1
		apic         = 1
		vif          = ['mac=$vm_mac,bridge=$vm_bridge']
		disk         = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
		device_model = 'qemu-dm'
		# HVM :
		#kernel       = "/usr/lib/xen-4.0/boot/hvmloader"
		#builder      = 'hvm'
		#xen_platform_pci = 1 # NOTE: the guest VM can use optimized PV on HVM drivers
		# PV :
		#kernel       = "pv-grub.gz" # NOTE: pas encore dans Debian car il ne fonctionne qu'avec grub-legacy
		#extra        = "(hd0,0)/grub/grub.cfg"
		bootloader    = '/usr/bin/pygrub'
		
		# boot on floppy (a), hard disk (c) or CD-ROM (d)
		#boot         = 'd'
		
		#vnc        = 1
		#sdl        = 0
		#vncconsole = 0
		#vnclisten  = "0.0.0.0"
		#vncpasswd  = ""
		#usbdevice  = 'tablet'
		
		keymap      = 'fr'
		serial      = 'pty'
		on_poweroff = 'destroy'
		on_reboot   = 'restart'
		on_crash    = 'restart'
		EOF
 }
rule_vm_start () {
	test ! -e /dev/domU/$vm_fqdn-disk1
	sudo xm create $vm_fqdn.cfg
	rule vm_attach
 }
rule_vm_attach () {
	assert '! pgrep -f "sudo xm console $vm_fqdn"'
	info 'Ctrl-] pour se détacher de la console'
	sudo xm console $vm_fqdn
 }
rule_vm_stop () {
	sudo xm shutdown $vm_fqdn
 }
rule_vm_stop_force () {
	sudo xm destroy $vm_fqdn
 }

rule_disk_mount () { # DESCRIPTION: montage du disque de la VM depuis l'hôte
	sudo kpartx -a -v /dev/domU/$vm_fqdn-disk
	#sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
 }
rule_disk_umount () { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
	rule part_boot_umount
	case $vm_use_lvm in
	 (yes)
		rule part_lvm_umount
		;;
	 (no)
		rule part_root_umount
		rule part_var_umount
		rule part_home_umount
		;;
	 (*) exit 1;;
	 esac
	sudo kpartx -d -v /dev/domU/$vm_fqdn-disk
	#sudo xm block-detach 0 $vm_dev_disk
	# XXX: DANGEREUX ; si jamais il bloque parce que le disque était encore utilisé :
	#      utiliser xm block-detach 0 $vm_dev_disk --force ;
	#      ôter les éventuels mappages LVM concernés avec dmsetup table et dmsetup remove --force ;
	#      ôter les mappages concernés dans /etc/lvm/cache/.cache,
	#      et pour bien trouver tous les mappages :
	#        % sudo find /dev -type l -exec sh -c 'printf "%s -> " "$@"; readlink "$@"' - {} \; | grep $vm_dev_disk
	#      enfin, ôter l'éventuel verrou dans /var/lock/lvm/
 }

case $vm_use_lvm in
 (no)
	readonly vm_dev_disk_swap="${vm_dev_disk}5"
	readonly vm_dev_disk_root="${vm_dev_disk}6"
	readonly vm_dev_disk_var="${vm_dev_disk}7"
	readonly vm_dev_disk_home="${vm_dev_disk}8"
	;;
 (yes)
	readonly vm_lvm_pv="${vm_dev_disk}2"
	readonly vm_dev_disk_swap=/dev/$vm_lvm_vg/${vm_lvm_lv}_swap
	readonly vm_dev_disk_root=/dev/$vm_lvm_vg/${vm_lvm_lv}_root
	readonly vm_dev_disk_var=/dev/$vm_lvm_vg/${vm_lvm_lv}_var
	readonly vm_dev_disk_home=/dev/$vm_lvm_vg/${vm_lvm_lv}_home
	;;
 (*) exit 1;;
 esac

rule_disk_format () { # DESCRIPTION: partitionnage du disque de la VM
	case $vm_use_lvm in
	(no)
		sudo sfdisk $vm_dev_disk <<-EOF
			# partition table of $vm_dev_disk
			unit: sectors
			
			${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
			${vm_dev_disk}2 : start=   498015, size=418927005, Id= 5
			${vm_dev_disk}3 : start=        0, size=        0, Id= 0
			${vm_dev_disk}4 : start=        0, size=        0, Id= 0
			${vm_dev_disk}5 : start=   498078, size=  1959867, Id=82
			${vm_dev_disk}6 : start=  2458008, size= 29302497, Id=83
			${vm_dev_disk}7 : start= 31760568, size=  9767457, Id=83
			${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
		EOF
		;;
	(yes)
		sudo sfdisk $vm_dev_disk <<-EOF
			# partition table of $vm_dev_disk
			unit: sectors
			
			${vm_dev_disk}1 : start=       63, size=   497952, Id=83, bootable
			${vm_dev_disk}2 : start=   498015, size=418927005, Id=8E
			EOF
		;;
	(*) exit 1;;
	 esac
	#sudo partprobe $vm_dev_disk
	sudo kpartx -u -v /dev/domU/$vm_fqdn-disk
 }

rule_part_lvm_format () {
	rule part_lvm_umount
	! sudo vgs | grep -q "^  $vm_lvm_vg " ||
	sudo vgremove $vm_lvm_vg
	sudo pvcreate --dataalignment 512k $vm_lvm_pv
	sudo vgcreate --dataalignment 512k $vm_lvm_vg $vm_lvm_pv
	sudo lvcreate --contiguous y -n ${vm_lvm_lv}_swap -L  1G     $vm_lvm_vg
	sudo lvcreate --contiguous y -n ${vm_lvm_lv}_root -L 15G     $vm_lvm_vg
	sudo lvcreate --contiguous y -n ${vm_lvm_lv}_var  -L  5G     $vm_lvm_vg
	sudo lvcreate --contiguous y -n ${vm_lvm_lv}_home -l 99%FREE $vm_lvm_vg
	rule part_lvm_umount
 }
rule_part_lvm_mount () {
	case $vm_use_lvm in
	 (yes)
		sudo vgchange -a y $vm_lvm_vg
		;;
	 (*) exit 1;;
	 esac
 }
rule_part_lvm_umount () {
	case $vm_use_lvm in
	 (yes)
		rule part_root_umount
		rule part_var_umount
		rule part_home_umount
		! sudo vgs | grep -q "^  $vm_lvm_vg " ||
		sudo vgchange -a n $vm_lvm_vg
		;;
	 (*) exit 1;;
	 esac
 }

rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
	local part="$1"
	eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
 }
rule_part_randomize_stat () { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_randomize
	local part="$1"
	eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
 }
rule__part_encrypted_format () { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
 # NOTE: la clef de chiffrement est dérivée de celle de /,
 #       / doit être déchiffrée pour que cela fonctionne.
	local part="$1"
	eval "local dev=\"\$vm_dev_disk_$part\""
	test ! -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
	sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
	cryptsetup luksFormat --hash=sha512 --key-size=512 \
	 --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev"
 }
rule__part_encrypted_mount () { # SYNTAX: $part
	local part="$1"
	eval "local dev=\"\$vm_dev_disk_$part\""
	test -e /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
	sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
	cryptsetup luksOpen --key-file=- $dev ${vm_lvm_lv}_${part}_deciphered"
 }
rule__part_encrypted_umount () { # SYNTAX: $part
	local part="$1"
	eval "local dev=\"\$vm_dev_disk_$part\""
	test ! -e     /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
	sudo cryptsetup luksClose ${vm_lvm_lv}_${part}_deciphered
 }

rule_part_root_format () {
	if ! mount | grep -q "^$vm_dev_disk_root "
	 then
		sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
		 --cipher=aes-xts-essiv:sha256 --align-payload=8 $vm_dev_disk_root
		sudo cryptsetup luksOpen $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
		sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
		 -E resize=30G${vm_e2fs_extended_options} \
		 -L ${vm_lvm_lv}_root \
		 /dev/mapper/${vm_lvm_lv}_root_deciphered
		! mountpoint -q /mnt/$vm_fqdn
		sudo mount -v /dev/mapper/${vm_lvm_lv}_root_deciphered /mnt/$vm_fqdn
		sudo install -d -m 770 -o root -g root \
		 /mnt/$vm_fqdn/boot \
		 /mnt/$vm_fqdn/dev \
		 /mnt/$vm_fqdn/home \
		 /mnt/$vm_fqdn/proc \
		 /mnt/$vm_fqdn/root \
		 /mnt/$vm_fqdn/root/src \
		 /mnt/$vm_fqdn/root/src/$vm \
		 /mnt/$vm_fqdn/sys \
		 /mnt/$vm_fqdn/var
		sudo umount -v /mnt/$vm_fqdn
		sudo cryptsetup luksClose ${vm_lvm_lv}_root_deciphered
	 fi
 }
rule_part_root_mount () {
	test -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
	sudo cryptsetup luksOpen $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
	mountpoint -q /mnt/$vm_fqdn ||
	sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_root_deciphered /mnt/$vm_fqdn
 }
rule_part_root_umount () {
	! mountpoint -q /mnt/$vm_fqdn ||
	sudo umount -v  /mnt/$vm_fqdn
	! test -e     /dev/mapper/${vm_lvm_lv}_root_deciphered ||
	sudo cryptsetup luksClose ${vm_lvm_lv}_root_deciphered
 }
rule_part_swap_format () {
	rule _part_encrypted_format swap
	rule _part_encrypted_mount  swap
	sudo mkswap -f -L ${vm_lvm_lv}_swap \
	 /dev/mapper/${vm_lvm_lv}_swap_deciphered
	rule _part_encrypted_umount swap
 }
rule_part_boot_format () {
	mount | grep -q "^$vm_dev_disk_boot " ||
	sudo mke2fs -t ext2 -c -c -m 5 -T small \
	 -E resize=1G${vm_e2fs_extended_options} \
	 -L ${vm_lvm_lv}_boot $vm_dev_disk_boot
 }
rule_part_boot_mount () {
	mountpoint -q /mnt/$vm_fqdn
	test -d /mnt/$vm_fqdn/boot
	mountpoint -q                           /mnt/$vm_fqdn/boot ||
	sudo mount -v -t ext2 $vm_dev_disk_boot /mnt/$vm_fqdn/boot
 }
rule_part_boot_umount () {
	! mountpoint -q /mnt/$vm_fqdn/boot ||
	sudo umount -v  /mnt/$vm_fqdn/boot
 }
rule_part_var_format () {
	rule _part_encrypted_format var
	rule _part_encrypted_mount  var
	sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
	 -E resize=10G${vm_e2fs_extended_options} \
	 -L ${vm_lvm_lv}_var \
	 /dev/mapper/${vm_lvm_lv}_var_deciphered
	rule _part_encrypted_umount var
 }
rule_part_var_mount () {
	rule _part_encrypted_mount var
	mountpoint -q /mnt/$vm_fqdn/var ||
	sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_var_deciphered /mnt/$vm_fqdn/var
 }
rule_part_var_umount () {
	! mountpoint -q /mnt/$vm_fqdn/var ||
	sudo umount -v  /mnt/$vm_fqdn/var
	rule _part_encrypted_umount var
 }
rule_part_home_format () {
	rule _part_encrypted_format home
	rule _part_encrypted_mount  home
	sudo mke2fs -t ext4 -c -c -m 0 -T ext4 -b $vm_e2fs_block_size \
	 -E resize=400G${vm_e2fs_extended_options} \
	 -L ${vm_lvm_lv}_home \
	 /dev/mapper/${vm_lvm_lv}_home_deciphered
	 # NOTE: -O quota pas supporté par e2fsprogs/squeeze
	rule _part_encrypted_umount home
 }
rule_part_home_mount () {
	rule _part_encrypted_mount home
	mountpoint -q /mnt/$vm_fqdn/home ||
	sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_home_deciphered /mnt/$vm_fqdn/home
 }
rule_part_home_umount () {
	! mountpoint -q /mnt/$vm_fqdn/home ||
	sudo umount -v  /mnt/$vm_fqdn/home
	rule _part_encrypted_umount home
 }

rule_debian_install () {
	rule disk_mount
	rule part_lvm_mount
	rule part_root_mount
	rule part_boot_mount
	rule part_var_mount
	sudo DEBOOTSTRAP_DIR=/usr/share/debootstrap/ LANG=C LC_CTYPE=C debootstrap \
	 --arch=$vm_arch --verbose --keyring=/usr/share/keyrings/debian-archive-keyring.gpg \
	 --exclude=vim-tiny \
	 --include=$(printf '%s,' \
		 acl \
		 bsdmainutils \
		 busybox \
		 ca-certificates \
		 console-setup \
		 cryptsetup \
		 dash \
		 dnsutils \
		 dropbear \
		 etckeeper \
		 git-core \
		 gnupg \
		 hashalot \
		 htop \
		 ifupdown \
		 initramfs-tools \
		 kbd \
		 less \
		 locales \
		 lvm2 \
		 mosh \
		 molly-guard \
		 ncurses-term \
		 openssh-client \
		 openssh-server \
		 openssl \
		 pciutils \
		 procps \
		 quota \
		 quotatool \
		 rsync \
		 screen \
		 sudo \
		 sysprofile \
		 vim-nox \
		 wget \
		 zsh \
	 ) \
	 $vm_lsb_name /mnt/$vm_fqdn/ \
	 http://ftp.fr.debian.org/debian/
	rule part_var_umount
	rule part_boot_umount
	rule part_root_umount
 }

rule_chroot () {
	rule disk_mount
	rule part_lvm_mount
	rule part_root_mount
	rule part_boot_mount
	rule part_var_mount
	#rule_part_home_mount
	mountpoint -q /mnt/$vm_fqdn/proc ||
	sudo mount -t proc proc /mnt/$vm_fqdn/proc
	mountpoint -q /mnt/$vm_fqdn/sys ||
	sudo mount -t sysfs sys /mnt/$vm_fqdn/sys
	mountpoint -q /mnt/$vm_fqdn/dev ||
	sudo mount --bind /dev /mnt/$vm_fqdn/dev
	if test -d /mnt/$vm_fqdn/root/src/vm/.git
	 then
		mountpoint -q /mnt/$vm_fqdn/root/src/vm ||
		sudo mount --bind "$tool" /mnt/$vm_fqdn/root/src/vm
	 else
		rsync -a "$tool"/ /mnt/$vm_fqdn/root/src/vm
	 fi
	sudo chroot /mnt/$vm_fqdn /bin/bash || true
	rule _chroot_clean
 }
rule__chroot_clean () {
	! sudo mountpoint -q /mnt/$vm_fqdn/root/src/vm ||
	sudo umount -v /mnt/$vm_fqdn/root/src/vm
	! mountpoint -q /mnt/$vm_fqdn/dev ||
	sudo umount -v /mnt/$vm_fqdn/dev
	! mountpoint -q /mnt/$vm_fqdn/sys ||
	sudo umount -v /mnt/$vm_fqdn/sys
	! mountpoint -q /mnt/$vm_fqdn/proc ||
	sudo umount -v /mnt/$vm_fqdn/proc
	rule part_home_umount
	rule part_var_umount
	rule part_boot_umount
	rule part_root_umount
	rule disk_umount
 }

rule=${1:-help}
${1+shift}
case $rule in
 (help);;
 (*)
	assert 'test "$(hostname --fqdn)" = "$vm_host"' vm_host
	;;
 esac
rule $rule "$@"