+++ /dev/null
-#!/bin/sh
-set -e -f ${DRY_RUN:+-n} -u
-tool=${0%/*}
-. "$tool"/lib/rule.sh
-. "$tool"/etc/vm.sh
-export TRACE=1
-
-rule_help () { # SYNTAX: [--hidden]
- local hidden; [ ${1:+set} ] || hidden=set
- cat >&2 <<-EOF
- DESCRIPTION:
- ce script regroupe des règles pour administrer la VM ($vm_fqdn)
- _depuis_ son hôte ($vm_host) ;
- il sert à la fois d'outil (aisément bidouillable)
- et de documentation (préçise).
- Voir \`$tool/vm_hosted' pour les règles côté VM hébergée.
- SYNTAX: $0 \$RULE \${RULE}_SYNTAX
- RULES:
- $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/ \1\2/p" "$tool"/etc/vm.sh "$0")
- ENVIRONMENT:
- TRACE # affiche les commandes avant leur exécution
- $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
- EOF
- }
-
-readonly vm_dev_disk=/dev/mapper/domU-$(printf %s "$vm_fqdn-disk" | sed -e 's/-/--/g')
-readonly vm_dev_disk_boot="${vm_dev_disk}1"
-
-rule_git_configure () {
- (
- cd "$tool"
- git config --replace branch.master.remote .
- git config --replace branch.master.merge refs/remotes/master
- local tool
- tool=$(cd "$tool"; cd -)
- install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
- #!/bin/sh -efux
- case \$1 in
- (refs/remotes/master)
- cd ..
- #git --git-dir=\$PWD/.git checkout -f -B master remotes/master &&
- git --git-dir=\$PWD/.git checkout HEAD'^' &&
- git --git-dir=\$PWD/.git branch -f master remotes/master &&
- git --git-dir=\$PWD/.git checkout master
- git --git-dir=\$PWD/.git clean -f -d -x
- ;;
- esac
- EOF
- )
- }
-
-rule_vm_configure () {
- sudo install -m 644 -u root -g root /dev/stdin /etc/xen/$vm_fqdn.cfg <<-EOF
- # -*- mode: python; -*-
- # DOC: http://wiki.xen.org/wiki/Xen_Linux_PV_on_HVM_drivers
- import os, re
- name = "$vm_fqdn"
- arch = os.uname()[4]
- memory = 2048
- vcpus = 1
- pae = 1
- acpi = 1
- apic = 1
- vif = ['mac=$vm_mac,bridge=$vm_bridge']
- disk = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
- device_model = 'qemu-dm'
- # HVM :
- #kernel = "/usr/lib/xen-4.0/boot/hvmloader"
- #builder = 'hvm'
- #xen_platform_pci = 1 # NOTE: the guest VM can use optimized PV on HVM drivers
- # PV :
- #kernel = "pv-grub.gz" # NOTE: pas encore dans Debian car il ne fonctionne qu'avec grub-legacy
- #extra = "(hd0,0)/grub/grub.cfg"
- bootloader = '/usr/bin/pygrub'
-
- # boot on floppy (a), hard disk (c) or CD-ROM (d)
- #boot = 'd'
-
- #vnc = 1
- #sdl = 0
- #vncconsole = 0
- #vnclisten = "0.0.0.0"
- #vncpasswd = ""
- #usbdevice = 'tablet'
-
- keymap = 'fr'
- serial = 'pty'
- on_poweroff = 'destroy'
- on_reboot = 'restart'
- on_crash = 'restart'
- EOF
- }
-rule_vm_start () {
- test ! -e /dev/domU/$vm_fqdn-disk1
- sudo xm create $vm_fqdn.cfg
- rule vm_attach
- }
-rule_vm_attach () {
- assert '! pgrep -f "sudo xm console $vm_fqdn"'
- info 'Ctrl-] pour se détacher de la console'
- sudo xm console $vm_fqdn
- }
-rule_vm_stop () {
- sudo xm shutdown $vm_fqdn
- }
-rule_vm_stop_force () {
- sudo xm destroy $vm_fqdn
- }
-
-rule_disk_mount () { # DESCRIPTION: montage du disque de la VM depuis l'hôte
- sudo kpartx -a -v /dev/domU/$vm_fqdn-disk
- #sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
- }
-rule_disk_umount () { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
- rule part_boot_umount
- case $vm_use_lvm in
- (yes)
- rule part_lvm_umount
- ;;
- (no)
- rule part_root_umount
- rule part_var_umount
- rule part_home_umount
- ;;
- (*) exit 1;;
- esac
- sudo kpartx -d -v /dev/domU/$vm_fqdn-disk
- #sudo xm block-detach 0 $vm_dev_disk
- # XXX: DANGEREUX ; si jamais il bloque parce que le disque était encore utilisé :
- # utiliser xm block-detach 0 $vm_dev_disk --force ;
- # ôter les éventuels mappages LVM concernés avec dmsetup table et dmsetup remove --force ;
- # ôter les mappages concernés dans /etc/lvm/cache/.cache,
- # et pour bien trouver tous les mappages :
- # % sudo find /dev -type l -exec sh -c 'printf "%s -> " "$@"; readlink "$@"' - {} \; | grep $vm_dev_disk
- # enfin, ôter l'éventuel verrou dans /var/lock/lvm/
- }
-
-case $vm_use_lvm in
- (no)
- readonly vm_dev_disk_swap="${vm_dev_disk}5"
- readonly vm_dev_disk_root="${vm_dev_disk}6"
- readonly vm_dev_disk_var="${vm_dev_disk}7"
- readonly vm_dev_disk_home="${vm_dev_disk}8"
- ;;
- (yes)
- readonly vm_lvm_pv="${vm_dev_disk}2"
- readonly vm_dev_disk_swap=/dev/$vm_lvm_vg/${vm_lvm_lv}_swap
- readonly vm_dev_disk_root=/dev/$vm_lvm_vg/${vm_lvm_lv}_root
- readonly vm_dev_disk_var=/dev/$vm_lvm_vg/${vm_lvm_lv}_var
- readonly vm_dev_disk_home=/dev/$vm_lvm_vg/${vm_lvm_lv}_home
- ;;
- (*) exit 1;;
- esac
-
-rule_disk_format () { # DESCRIPTION: partitionnage du disque de la VM
- case $vm_use_lvm in
- (no)
- sudo sfdisk $vm_dev_disk <<-EOF
- # partition table of $vm_dev_disk
- unit: sectors
-
- ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
- ${vm_dev_disk}2 : start= 498015, size=418927005, Id= 5
- ${vm_dev_disk}3 : start= 0, size= 0, Id= 0
- ${vm_dev_disk}4 : start= 0, size= 0, Id= 0
- ${vm_dev_disk}5 : start= 498078, size= 1959867, Id=82
- ${vm_dev_disk}6 : start= 2458008, size= 29302497, Id=83
- ${vm_dev_disk}7 : start= 31760568, size= 9767457, Id=83
- ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
- EOF
- ;;
- (yes)
- sudo sfdisk $vm_dev_disk <<-EOF
- # partition table of $vm_dev_disk
- unit: sectors
-
- ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
- ${vm_dev_disk}2 : start= 498015, size=418927005, Id=8E
- EOF
- ;;
- (*) exit 1;;
- esac
- #sudo partprobe $vm_dev_disk
- sudo kpartx -u -v /dev/domU/$vm_fqdn-disk
- }
-
-rule_part_lvm_format () {
- rule part_lvm_umount
- ! sudo vgs | grep -q "^ $vm_lvm_vg " ||
- sudo vgremove $vm_lvm_vg
- sudo pvcreate --dataalignment 512k $vm_lvm_pv
- sudo vgcreate --dataalignment 512k $vm_lvm_vg $vm_lvm_pv
- sudo lvcreate --contiguous y -n ${vm_lvm_lv}_swap -L 1G $vm_lvm_vg
- sudo lvcreate --contiguous y -n ${vm_lvm_lv}_root -L 15G $vm_lvm_vg
- sudo lvcreate --contiguous y -n ${vm_lvm_lv}_var -L 5G $vm_lvm_vg
- sudo lvcreate --contiguous y -n ${vm_lvm_lv}_home -l 99%FREE $vm_lvm_vg
- rule part_lvm_umount
- }
-rule_part_lvm_mount () {
- case $vm_use_lvm in
- (yes)
- sudo vgchange -a y $vm_lvm_vg
- ;;
- (*) exit 1;;
- esac
- }
-rule_part_lvm_umount () {
- case $vm_use_lvm in
- (yes)
- rule part_root_umount
- rule part_var_umount
- rule part_home_umount
- ! sudo vgs | grep -q "^ $vm_lvm_vg " ||
- sudo vgchange -a n $vm_lvm_vg
- ;;
- (*) exit 1;;
- esac
- }
-
-rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
- local part="$1"
- eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
- }
-rule_part_randomize_stat () { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_randomize
- local part="$1"
- eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
- }
-rule__part_encrypted_format () { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
- # NOTE: la clef de chiffrement est dérivée de celle de /,
- # / doit être déchiffrée pour que cela fonctionne.
- local part="$1"
- eval "local dev=\"\$vm_dev_disk_$part\""
- test ! -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
- sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
- cryptsetup luksFormat --hash=sha512 --key-size=512 \
- --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev"
- }
-rule__part_encrypted_mount () { # SYNTAX: $part
- local part="$1"
- eval "local dev=\"\$vm_dev_disk_$part\""
- test -e /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
- sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
- cryptsetup luksOpen --key-file=- $dev ${vm_lvm_lv}_${part}_deciphered"
- }
-rule__part_encrypted_umount () { # SYNTAX: $part
- local part="$1"
- eval "local dev=\"\$vm_dev_disk_$part\""
- test ! -e /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
- sudo cryptsetup luksClose ${vm_lvm_lv}_${part}_deciphered
- }
-
-rule_part_root_format () {
- if ! mount | grep -q "^$vm_dev_disk_root "
- then
- sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
- --cipher=aes-xts-essiv:sha256 --align-payload=8 $vm_dev_disk_root
- sudo cryptsetup luksOpen $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
- sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
- -E resize=30G${vm_e2fs_extended_options} \
- -L ${vm_lvm_lv}_root \
- /dev/mapper/${vm_lvm_lv}_root_deciphered
- ! mountpoint -q /mnt/$vm_fqdn
- sudo mount -v /dev/mapper/${vm_lvm_lv}_root_deciphered /mnt/$vm_fqdn
- sudo install -d -m 770 -o root -g root \
- /mnt/$vm_fqdn/boot \
- /mnt/$vm_fqdn/dev \
- /mnt/$vm_fqdn/home \
- /mnt/$vm_fqdn/proc \
- /mnt/$vm_fqdn/root \
- /mnt/$vm_fqdn/root/src \
- /mnt/$vm_fqdn/root/src/$vm \
- /mnt/$vm_fqdn/sys \
- /mnt/$vm_fqdn/var
- sudo umount -v /mnt/$vm_fqdn
- sudo cryptsetup luksClose ${vm_lvm_lv}_root_deciphered
- fi
- }
-rule_part_root_mount () {
- test -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
- sudo cryptsetup luksOpen $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
- mountpoint -q /mnt/$vm_fqdn ||
- sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_root_deciphered /mnt/$vm_fqdn
- }
-rule_part_root_umount () {
- ! mountpoint -q /mnt/$vm_fqdn ||
- sudo umount -v /mnt/$vm_fqdn
- ! test -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
- sudo cryptsetup luksClose ${vm_lvm_lv}_root_deciphered
- }
-rule_part_swap_format () {
- rule _part_encrypted_format swap
- rule _part_encrypted_mount swap
- sudo mkswap -f -L ${vm_lvm_lv}_swap \
- /dev/mapper/${vm_lvm_lv}_swap_deciphered
- rule _part_encrypted_umount swap
- }
-rule_part_boot_format () {
- mount | grep -q "^$vm_dev_disk_boot " ||
- sudo mke2fs -t ext2 -c -c -m 5 -T small \
- -E resize=1G${vm_e2fs_extended_options} \
- -L ${vm_lvm_lv}_boot $vm_dev_disk_boot
- }
-rule_part_boot_mount () {
- mountpoint -q /mnt/$vm_fqdn
- test -d /mnt/$vm_fqdn/boot
- mountpoint -q /mnt/$vm_fqdn/boot ||
- sudo mount -v -t ext2 $vm_dev_disk_boot /mnt/$vm_fqdn/boot
- }
-rule_part_boot_umount () {
- ! mountpoint -q /mnt/$vm_fqdn/boot ||
- sudo umount -v /mnt/$vm_fqdn/boot
- }
-rule_part_var_format () {
- rule _part_encrypted_format var
- rule _part_encrypted_mount var
- sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
- -E resize=10G${vm_e2fs_extended_options} \
- -L ${vm_lvm_lv}_var \
- /dev/mapper/${vm_lvm_lv}_var_deciphered
- rule _part_encrypted_umount var
- }
-rule_part_var_mount () {
- rule _part_encrypted_mount var
- mountpoint -q /mnt/$vm_fqdn/var ||
- sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_var_deciphered /mnt/$vm_fqdn/var
- }
-rule_part_var_umount () {
- ! mountpoint -q /mnt/$vm_fqdn/var ||
- sudo umount -v /mnt/$vm_fqdn/var
- rule _part_encrypted_umount var
- }
-rule_part_home_format () {
- rule _part_encrypted_format home
- rule _part_encrypted_mount home
- sudo mke2fs -t ext4 -c -c -m 0 -T ext4 -b $vm_e2fs_block_size \
- -E resize=400G${vm_e2fs_extended_options} \
- -L ${vm_lvm_lv}_home \
- /dev/mapper/${vm_lvm_lv}_home_deciphered
- # NOTE: -O quota pas supporté par e2fsprogs/squeeze
- rule _part_encrypted_umount home
- }
-rule_part_home_mount () {
- rule _part_encrypted_mount home
- mountpoint -q /mnt/$vm_fqdn/home ||
- sudo mount -v -t ext4 /dev/mapper/${vm_lvm_lv}_home_deciphered /mnt/$vm_fqdn/home
- }
-rule_part_home_umount () {
- ! mountpoint -q /mnt/$vm_fqdn/home ||
- sudo umount -v /mnt/$vm_fqdn/home
- rule _part_encrypted_umount home
- }
-
-rule_debian_install () {
- rule disk_mount
- rule part_lvm_mount
- rule part_root_mount
- rule part_boot_mount
- rule part_var_mount
- sudo DEBOOTSTRAP_DIR=/usr/share/debootstrap/ LANG=C LC_CTYPE=C debootstrap \
- --arch=$vm_arch --verbose --keyring=/usr/share/keyrings/debian-archive-keyring.gpg \
- --exclude=vim-tiny \
- --include=$(printf '%s,' \
- acl \
- bsdmainutils \
- busybox \
- ca-certificates \
- console-setup \
- cryptsetup \
- dash \
- dnsutils \
- dropbear \
- etckeeper \
- git-core \
- gnupg \
- hashalot \
- htop \
- ifupdown \
- initramfs-tools \
- kbd \
- less \
- locales \
- lvm2 \
- m4 \
- mosh \
- molly-guard \
- ncurses-term \
- openssh-client \
- openssh-server \
- openssl \
- pciutils \
- procps \
- quota \
- quotatool \
- rsync \
- screen \
- sudo \
- sysprofile \
- vim-nox \
- wget \
- zsh \
- ) \
- $vm_lsb_name /mnt/$vm_fqdn/ \
- http://ftp.fr.debian.org/debian/
- rule part_var_umount
- rule part_boot_umount
- rule part_root_umount
- }
-
-rule_chroot () {
- rule disk_mount
- rule part_lvm_mount
- rule part_root_mount
- rule part_boot_mount
- rule part_var_mount
- #rule_part_home_mount
- mountpoint -q /mnt/$vm_fqdn/proc ||
- sudo mount -t proc proc /mnt/$vm_fqdn/proc
- mountpoint -q /mnt/$vm_fqdn/sys ||
- sudo mount -t sysfs sys /mnt/$vm_fqdn/sys
- mountpoint -q /mnt/$vm_fqdn/dev ||
- sudo mount --bind /dev /mnt/$vm_fqdn/dev
- if test -d /mnt/$vm_fqdn/root/src/vm/.git
- then
- mountpoint -q /mnt/$vm_fqdn/root/src/vm ||
- sudo mount --bind "$tool" /mnt/$vm_fqdn/root/src/vm
- else
- sudo rsync -a "$tool"/ /mnt/$vm_fqdn/root/src/vm
- fi
- sudo chroot /mnt/$vm_fqdn /bin/bash || true
- rule _chroot_clean
- }
-rule__chroot_clean () {
- ! sudo mountpoint -q /mnt/$vm_fqdn/root/src/vm ||
- sudo umount -v /mnt/$vm_fqdn/root/src/vm
- ! mountpoint -q /mnt/$vm_fqdn/dev ||
- sudo umount -v /mnt/$vm_fqdn/dev
- ! mountpoint -q /mnt/$vm_fqdn/sys ||
- sudo umount -v /mnt/$vm_fqdn/sys
- ! mountpoint -q /mnt/$vm_fqdn/proc ||
- sudo umount -v /mnt/$vm_fqdn/proc
- rule part_home_umount
- rule part_var_umount
- rule part_boot_umount
- rule part_root_umount
- rule disk_umount
- }
-
-rule=${1:-help}
-${1+shift}
-case $rule in
- (help);;
- (*)
- assert 'test "$(hostname --fqdn)" = "$vm_host"' vm_host
- ;;
- esac
-rule $rule "$@"
dépôts / lhc / ateliers.git / blobdiff