+++ /dev/null
-#!/bin/sh
-set -e -f ${DRY_RUN:+-n} -u
-tool=$0
-while test -L "$tool"
- do tool=$(readlink "$tool")
- done
-tool=${tool%/*}
-. "$tool"/lib/rule.sh
-. "$tool"/etc/vm.sh
-export TRACE=1
-
-rule_help () { # SYNTAX: [--hidden]
- local hidden; [ ${1:+set} ] || hidden=set
- cat >&2 <<-EOF
- DESCRIPTION:
- ce script regroupe des règles pour administrer la VM ($vm_fqdn)
- _depuis_ la VM hébergée ($vm_fqdn) ;
- il sert à la fois d'outil (aisément bidouillable)
- et de documentation (préçise).
- Voir \`$tool/vm_host' pour les règles côté machine hôte ($vm_host).
- SYNTAX: $0 \$RULE \${RULE}_SYNTAX
- RULES:
- $(sed -ne "s/^rule_\(${hidden:+[^_]}[^ ]*\) () {\( *#.*\|\)/ \1\2/p" "$tool"/etc/vm.sh "$0")
- ENVIRONMENT:
- TRACE # affiche les commandes avant leur exécution
- $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/etc/vm.sh "$0")
- EOF
- }
-
-rule_git_configure () {
- (
- cd "$tool"
- git config --replace branch.master.remote .
- git config --replace branch.master.merge refs/remotes/master
- local tool
- tool=$(cd "$tool"; cd -)
- install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
- #!/bin/sh -efux
- case \$1 in
- (refs/remotes/master)
- cd ..
- git --git-dir=\$PWD/.git checkout -f -B master remotes/master
- git --git-dir=\$PWD/.git clean -f -d -x
- ;;
- esac
- EOF
- )
- }
-rule_git_reset () {
- (
- cd "$tool"
- git checkout -f -B master remotes/master
- git clean -f -d -x
- )
- }
-
-rule_adduser () {
- local user="$1"; shift
- getent passwd "$user" >/dev/null ||
- sudo adduser "$@" "$user"
- }
-rule_apt_get_install () { # SYNTAX: $package
- sudo \
- DEBIAN_FRONTEND=noninteractive \
- DEBIAN_PRIORITY=low \
- apt-get install --yes "$@"
- }
-rule_dpkg_reconfigure () { # SYNTAX: $package
- sudo \
- DEBIAN_FRONTEND=noninteractive \
- DEBIAN_PRIORITY=low \
- dpkg-reconfigure "$@"
- }
-
-rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
- export LANG=C
- export LC_CTYPE=C
- . /etc/profile
- }
-
-rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour
- local -; set +f
- rule apt_get_install \
- apache2-mpm-itk \
- libapache2-mod-php5
- # VOIR: http://serverfault.com/questions/383526/how-do-i-select-which-apache-mpm-to-use/383634#383634
- # VOIR: http://jkroon.blogs.uls.co.za/it/security/using-php-fpm-and-mod_proxy_fcgi-to-optimize-and-secure-lamp-servers
- # NOTE: apache2-mpm-itk semble le plus sécurisé,
- # car on est certain que tout est exécuté avec les uid/gid
- # assignés au VirtualHost/Directory/Location
- # néamoins il se peut qu'une combinaison du genre :
- # apache2-mpm-{worker,event} + mod_proxy_fcgi + apache2-suexec-custom + php-fpm
- # soit plus performante (threads et pas forks),
- # cependant l'usage de suexec impose des forks il semble..
- # et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
- # donc pour l'instant : apache2-mpm-itk
- sudo rm -rf \
- /etc/apache2/site.d
- sudo install -d -m 770 -o www -g www \
- /etc/apache2 \
- /etc/apache2/site.d \
- /etc/apache2/x509.d
- cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF |
- ServerName "$vm_fqdn"
- EOF
- sudo install -m 660 -o root -g root /dev/stdin \
- /etc/apache2/apache2.conf
- sudo install -m 660 -o root -g root \
- "$tool"/etc/apache2/envvars \
- /etc/apache2/envvars
- sudo install -m 660 -o root -g root \
- "$tool"/etc/apache2/httpd.conf \
- /etc/apache2/httpd.conf
- #sudo install -m 660 -o root -g root /dev/stdin \
- # /etc/apache2/suexec/www-data <<-EOF
- # /home
- # pub/www/cgi
- # EOF
- sudo install -m 660 -o root -g root \
- "$tool"/etc/apache2/ports.conf \
- /etc/apache2/ports.conf
- sudo a2enmod actions
- sudo a2enmod headers
- sudo a2enmod rewrite
- sudo a2enmod ssl
- sudo a2enmod userdir
- local conf
- sudo a2dissite "*"
- sudo ln -fns \
- /etc/apache2 \
- /home/www/etc/apache2
- for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
- do conf=${conf#"$tool"/etc/apache2/site.d/}
- local site=${conf%/VirtualHost.conf}
- case $site in
- (*-tls)
- local hint="run vm_remote apache2_key_send before"
- assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
- sudo install -d -m 770 -o www-"$site" -g www-"$site" \
- /etc/apache2 \
- /etc/apache2/site.d/"$site" \
- /etc/apache2/x509.d/"$site" \
- /etc/apache2/x509.d/"$site"/ca \
- /etc/apache2/x509.d/"$site"/empty \
- /etc/apache2/x509.d/"$site"/rvk \
- /etc/apache2/x509.d/"$site"/usr
- sudo install -m 664 -o www -g www \
- "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \
- /etc/apache2/x509.d/"$site"/crt.self-signed.pem
- #sudo install -m 664 -o www-"$site" -g www-"$site" \
- # "$tool"/var/pub/x509/"$site"/rvk.pem \
- # /etc/apache2/x509.d/"$site"/rvk.pem
- sudo install -m 664 -o www -g www \
- "$tool"/var/pub/x509/"$site"/ca/crt.self-signed.pem \
- /etc/apache2/x509.d/"$site"/ca/crt.pem
- sudo install -m 664 -o www -g www \
- "$tool"/var/pub/x509/"$site"/crt.pem \
- /etc/apache2/x509.d/"$site"/crt.pem
- ;;
- esac
- case $site in
- (*-tls)
- cat <<-EOF
- <IfModule mod_ssl.c>
- <VirtualHost *:$port>
- AssignUserID www-$site www-$site
- BrowserMatch "MSIE [2-6]" ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
- BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
- CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
- #CustomLog "/dev/null" Combined
- DocumentRoot /home/www/pub/$site
- ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
- #ErrorLog "/dev/null"
- LogLevel Warn
- SSLCACertificateFile /etc/apache2/x509.d/$site/crt.self-signed.pem
- SSLCACertificatePath /etc/apache2/x509.d/$site/usr/
- #SSLCARevocationFile /etc/apache2/x509.d/$site/rvk.pem
- SSLCADNRequestFile /etc/apache2/x509.d/$site/crt.self-signed.pem
- SSLCADNRequestPath /etc/apache2/x509.d/$site/empty/
- # NOTE: ne publie pas les certificats d’utilisateur-ice-s acceptés
- SSLCARevocationPath /etc/apache2/x509.d/$site/rvk/
- SSLCertificateChainFile /etc/apache2/x509.d/$site/ca/crt.pem
- SSLCertificateFile /etc/apache2/x509.d/$site/crt.pem
- SSLCertificateKeyFile /etc/apache2/x509.d/$site/key.pem
- SSLCipherSuite AES+RSA+SHA256
- SSLEngine On
- SSLInsecureRenegotiation Off
- SSLOptions +StrictRequire +OptRenegotiate +StdEnvVars
- SSLProtocol -All +TLSv1
- #SSLRenegBufferSize 262144
- SSLSessionCacheTimeout 1200
- SSLStrictSNIVHostCheck On
- SSLUserName SSL_CLIENT_S_DN_CN
- SSLVerifyClient None
- SSLVerifyDepth 1
- $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
- </VirtualHost>
- </IfModule>
- EOF
- ;;
- (*)
- cat <<-EOF
- <VirtualHost *:$port>
- AssignUserID www-$site www-$site
- CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
- #CustomLog "/dev/null" Combined
- DocumentRoot /home/www/pub/$site
- ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
- #ErrorLog "/dev/null"
- LogLevel Warn
- $(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
- </VirtualHost>
- EOF
- ;;
- esac |
- sudo install -m 660 -o root -g root /dev/stdin \
- /etc/apache2/site.d/"$site"/VirtualHost.conf
- sudo ln -fns \
- ../site.d/"$site"/VirtualHost.conf \
- /etc/apache2/sites-available/"$site"
- sudo install -d -m 770 -o www-"$site" -g www-"$site" \
- /home/www/log/"$site" \
- /home/www/log/"$site"/apache2
- sudo ln -fns \
- /etc/apache2/site.d/"$site" \
- /home/www/etc/apache2/"$site"
- test -e /home/www/pub/"$site" ||
- sudo install -d -m 2770 -o www-"$site" -g www-"$site" \
- /home/www/pub/"$site"
- rule adduser www-"$site"
- --disabled-password \
- --group \
- --no-create-home \
- --home /home/www/pub/"$site" \
- --shell /bin/false \
- --system
- #sudo setfacl -m u:"www-$site":--x \
- # /home/www/ \
- # /home/www/pub/ \
- # /home/www/pub/"$site"/
- #sudo setfacl -m d:u:"www-$site":rwx \
- # "$home"/pub/www/"$site"/
- test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh ||
- . "$tool"/etc/apache2/site.d/"$site"/configure.sh
- test -e /etc/apache2/sites-enabled/"$site" ||
- sudo a2ensite "$site"
- done
- sudo service apache2 restart
- }
-rule_apt_configure () {
- sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
- deb http://ftp.rezopole.net/debian $vm_lsb_name main
- EOF
- sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
- deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
- EOF
- sudo install -m 664 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF
- deb http://nightly.openerp.com/7.0/nightly/deb/ ./
- EOF
- sudo install -m 664 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
- Package: *
- Pin: release a=$vm_lsb_name
- Pin-Priority: 200
-
- Package: *
- Pin: release a=$vm_lsb_name-backports
- Pin-Priority: 170
- EOF
- sudo apt-get update
- rule apt_get_install apticron
- m4 \
- --define=VM_DOMAINNAME=$vm_domainname \
- <"$tool"/etc/apticron/apticron.conf.m4 |
- sudo install -m 644 -o root -g root /dev/stdin \
- /etc/apticron/apticron.conf
- }
-rule_boot_configure () {
- #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
- sudo debconf-set-selections <<-EOF
- grub-pc grub-pc/install_devices multiselect
- EOF
- rule apt_get_install grub-pc
- sudo install -d -m 644 -o root -g root /boot/grub
- rule apt_get_install linux-image-$vm_arch
- sudo install -m 644 -o root -g root /dev/stdin /etc/default/grub <<-EOF
- GRUB_DEFAULT=0
- GRUB_TIMEOUT=5
- GRUB_DISTRIBUTOR=\`lsb_release -i -s 2> /dev/null || echo Debian\`
- GRUB_CMDLINE_LINUX_DEFAULT="quiet"
- GRUB_CMDLINE_LINUX="vt.default_utf8=1 rootfstype=ext4 loglevel=5 console=hvc0 ip=$vm_ipv4::$vm_ipv4:255.255.255.254:$vm:eth0:off resume=/dev/mapper/${vm}_swap_deciphered"
- GRUB_DISABLE_RECOVERY="true"
- #GRUB_PRELOAD_MODULES="lvm"
- EOF
- sudo install -m 644 -o root -g root /dev/stdin /boot/grub/device.map <<-EOF
- (hd0) /dev/xvda
- (hd0) /dev/mapper/domU-$(printf %s $vm_fqdn-disk | sed -e 's/-/--/g')
- EOF
- sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
- rule initramfs_configure
- rule apt_get_install molly-guard
- sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
- ALWAYS_QUERY_HOSTNAME=true
- # NOTE: une alternative est de dire à sudo de conserver les SSH_*
- # néamoins demander tout le temps n'est pas trop contraignant
- # et davantage sécurisant.
- EOF
- }
-rule_duplicity_configure () {
- rule apt_get_install duplicity
- home="/home/backup"
- rule adduser backup \
- --disabled-password \
- --group \
- --home "$home" \
- --shell /bin/bash \
- --system
- sudo usermod --home "$home" backup
- sudo install -d -m 750 -o backup -g backup \
- "$home" \
- "$home"/etc \
- "$home"/etc/gpg \
- "$home"/etc/ssh
- sudo install -d -m 770 -o backup -g backup \
- "$home"/mysql \
- "$home"/postgres
- getent group sudo backup |
- while IFS=: read -r group x x users
- do while test -n "$users" && IFS=, read -r user users <<-EOF
- $users
- EOF
- do eval local home\; home="~$user"
- sudo cat "$home"/etc/ssh/authorized_keys
- done
- done |
- sudo install -m 640 -o backup -g backup /dev/stdin \
- "$home"/etc/ssh/authorized_keys
- sudo ln -fns etc/gpg "$home"/.gnupg
- #sudo adduser backup mysql-data
- #sudo adduser backup postgres-data
- }
-rule_etckeeper_configure () {
- sudo install -m 644 -o root -g root /dev/stdin /etc/etckeeper/etckeeper.conf <<-EOF
- VCS=git
- GIT_COMMIT_OPTIONS=""
- AVOID_DAILY_AUTOCOMMITS=1
- #AVOID_SPECIAL_FILE_WARNING=1
- AVOID_COMMIT_BEFORE_INSTALL=1
- HIGHLEVEL_PACKAGE_MANAGER=apt
- LOWLEVEL_PACKAGE_MANAGER=dpkg
- EOF
- sudo install -m 644 -o root -g root \
- "$tool"/etc/etckeeper/prompt.sh \
- /etc/etckeeper/prompt.sh
- rule apt_get_install etckeeper
- }
-rule_filesystem_configure () {
- m4 \
- --define=VM_LVM_LV=$vm_lvm_lv \
- --define=VM_LVM_VG=$vm_lvm_vg \
- <"$tool"/etc/fstab.m4 |
- sudo install -m 644 -o root -g root /dev/stdin \
- /etc/fstab
- m4 \
- --define=VM_LVM_LV=$vm_lvm_lv \
- --define=VM_LVM_VG=$vm_lvm_vg \
- <"$tool"/etc/crypttab.m4 |
- sudo install -m 644 -o root -g root /dev/stdin \
- /etc/crypttab
- rule tmpfs_configure
- }
-rule_initramfs_configure () {
- sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
- MODULES=most
- BUSYBOX=y
- KEYMAP=y
- COMPRESS=gzip
- DEVICE=eth0
- EOF
- sudo install -m 644 -o root -g root /dev/stdin /etc/modprobe.d/xen-pv.conf <<-EOF
- alias eth0 xennet
- alias scsi_hostadapter xenblk
- EOF
- sudo install -m 644 -o root -g root /dev/stdin /etc/modules <<-EOF
- sha1_generic
- sha256_generic
- sha512_generic
- aes-x86_64
- xts
- # NOTE: pour Xen en mode HVM :
- #modprobe xen-platform-pci
- EOF
- sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/modules <<-EOF
- EOF
- sudo sed -e '/^configure_networking /s/ &$//' \
- -i /usr/share/initramfs-tools/scripts/init-premount/dropbear
- # NOTE: corrige une vermine : dropbear doit attendre que le réseau soit configuré..
- ssh-keygen -F "init.$vm_fqdn" -f "$tool"/etc/openssh/known_hosts |
- ( while IFS= read -r line
- do case $line in (*" RSA") return 0; break;; esac
- done; return 1 ) ||
- {
- sudo rm -f \
- /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key \
- /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key.pub
- sudo dropbearkey -t rsa -s 4096 -f \
- /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
- }
- # NOTE: ne se préoccupe pas de dropbear_dss_host_key ; Debian la génère et l'utilise néamoins.
- sudo install -d -m 640 -o root -g root \
- /etc/initramfs-tools/root \
- /etc/initramfs-tools/root/.ssh
- getent group sudo |
- while IFS=: read -r group x x users
- do while test -n "$users" && IFS=, read -r user users <<-EOF
- $users
- EOF
- do eval local home\; home="~$user"
- sudo cat "$home"/etc/ssh/authorized_keys
- done
- done |
- sudo install -m 644 -o root -g root /dev/stdin \
- /etc/initramfs-tools/root/.ssh/authorized_keys
- sudo rm -f \
- /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
- /etc/initramfs-tools/root/.ssh/id_rsa.pub \
- /etc/initramfs-tools/root/.ssh/id_rsa
- # NOTE: clefs générées par Debian
- sudo update-initramfs -u
- }
-rule_insserv_remove () { # SYNTAX: $sv
- local sv="$1"
- #sudo chmod u+x /etc/init.d/"$sv"
- sudo insserv --force --remove "$sv"
- sudo test ! -x /etc/init.d/"$sv" ||
- sudo /etc/init.d/"$sv" stop
- sudo chmod ugo-x /etc/init.d/"$sv"
- }
-rule_gitolite_configure () {
- sudo debconf-set-selections <<-EOF
- gitolite gitolite/gituser string git
- gitolite gitolite/adminkey string
- gitolite gitolite/gitdir string /home/git
- EOF
- rule apt_get_install gitolite
- rule adduser git \
- --disabled-password \
- --group \
- --home /home/git \
- --shell /bin/bash \
- --system
- sudo chfn --full-name git git
- rule adduser log-git \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/git/log \
- --shell /bin/false \
- --system
- rule adduser git-data \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/git/pub \
- --shell /bin/false \
- --system
- sudo adduser git git-data
- sudo install -d -m 750 -o git -g git \
- /etc/gitolite \
- /home/git/etc \
- /home/git/etc/ssh
- sudo install -d -m 751 -o git -g git \
- /home/git
- sudo install -d -m 2770 -o git-data -g git-data \
- /home/git/pub
- sudo install -d -m 1771 -o git -g git \
- /home/git/log
- sudo install -d -m 2770 -o git -g log-git \
- /home/git/log/gitolite \
- /home/git/log/gitolite/perf
- sudo install -d -m 3771 -o git -g git \
- /home/git/hooks
- sudo ln -fns /etc/gitolite /home/git/etc/gitolite
- sudo ln -fns /etc/gitweb /home/git/etc/gitweb
- sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc
- sudo ln -fns etc/ssh /home/git/.ssh
- sudo install -m 770 -o git -g git /dev/stdin \
- /home/git/etc/gitolite/gitolite.rc <<-EOF
- #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
- #\$BIG_INFO_CAP = 20;
- #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
- # NOTE: Please use single quotes, not double quotes.
- #\$GITWEB_URI_ESCAPE = 0;
- \$GIT_PATH = "";
- #\$GL_ADC_PATH = "";
- \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite";
- #\$GL_ALL_INCLUDES_SPECIAL = 0;
- #\$GL_ALL_READ_ALL = 0;
- \$GL_BIG_CONFIG = 0;
- \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
- \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
- #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
- \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
- #\$GL_HOSTNAME = "git.$vm_domainname";
- # NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
- #\$GL_HTTP_ANON_USER = "mob";
- \$GL_KEYDIR = "\$GL_ADMINDIR/keydir";
- \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log";
- #\$GL_NICE_VALUE = 0;
- \$GL_NO_CREATE_REPOS = 0;
- \$GL_NO_DAEMON_NO_GITWEB = 0;
- \$GL_NO_SETUP_AUTHKEYS = 0;
- \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf";
- \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks";
- #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log";
- #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$);
- \$GL_SITE_INFO = "git.$vm_domainname";
- #\$GL_SLAVE_MODE = 0;
- \$GL_WILDREPOS = 0;
- #\$GL_WILDREPOS_DEFPERMS = 'R @all';
- \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
- \$HTPASSWD_FILE = "";
- \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
- \$REPO_BASE = "pub";
- \$REPO_UMASK = 0007;
- \$RSYNC_BASE = "";
- \$SVNSERVE = "";
- #\$UPDATE_CHAINS_TO = "hooks/update.secondary";
- \$WEB_INTERFACE = "gitweb";
- 1;
- EOF
- sudo install -m 600 -o git -g git \
- "$tool"/var/pub/ssh/git.key \
- /home/git/etc/ssh/git.pub
- sudo -u git \
- GL_RC=/home/git/etc/gitolite/gitolite.rc \
- GIT_AUTHOR_NAME=git \
- gl-setup -q /home/git/etc/ssh/git.pub git
- local d
- for d in doc logs src
- do test ! -d /home/git/etc/gitolite/"$d" ||
- rmdir /home/git/etc/gitolite/"$d"
- done
- }
-rule_locales_configure () {
- sudo debconf-set-selections <<-EOF
- locales locales/default_environment_locale select None
- locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8
- EOF
- rule dpkg_reconfigure locales
- }
-rule_login_configure () {
- sudo install -m 644 -o root -g root \
- "$tool"/etc/inittab \
- /etc/inittab
- sudo install -m 644 -o root -g root \
- "$tool"/etc/login.defs \
- /etc/login.defs
- grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session ||
- sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF
- $(cat /etc/pam.d/common-session)
- session optional pam_umask.so
- EOF
- grep -q '^hvc0$' /etc/securetty ||
- sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
- $(cat /etc/securetty)
- hvc0
- EOF
- grep -q '^xvc0$' /etc/securetty ||
- sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
- $(cat /etc/securetty)
- xvc0
- EOF
- }
-rule_network_configure () {
- sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
- $vm
- EOF
- grep -q " $vm\$" /etc/hosts ||
- sudo install -m 644 -o root -g root /dev/stdin /etc/hosts <<-EOF
- $(cat /etc/hosts)
- 127.0.0.1 $vm_fqdn $vm
- EOF
- sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
- search ${vm_host#*.}
- nameserver ${vm_host_nameserver}
- EOF
- m4 \
- --define=VM_IPV4=$vm_ipv4 \
- <"$tool"/etc/network/interfaces.m4 |
- sudo install -m 640 -o root -g root /dev/stdin \
- /etc/network/interfaces
- }
-rule_runit_configure () { # SYNTAX: $sv [...] -- $configure_options
- rule apt_get_install runit
- if test $# = 0
- then
- set +x
- sudo sv status \
- $(sudo find /etc/sv \
- -mindepth 1 -maxdepth 1 -type d \
- -printf '%p\n' | sort)
- else
- local services=
- while [ $# -gt 0 ]
- do case $1 in
- (--) shift; break;;
- (*) services="$services $1"; shift;;
- esac
- done
- #for sv in $(sudo find /etc/sv \
- # -mindepth 1 -maxdepth 1 -type d \
- # -false $(printf -- '-or -name %s\n' $services) \
- # -printf '%f\n')
- # do
- # case $(sudo sv stop "$sv" | tee /dev/stderr) in
- # (*": runsv not running") true;;
- # (*": unable to open supervise/ok: file does not exist") true;;
- # ("ok: down:"*) true;;
- # (*) false;;
- # esac
- # done
- for sv in $(find "$tool"/etc/sv \
- -mindepth 1 -maxdepth 1 -type d \
- -false $(printf -- '-or -name %s\n' $services) \
- -printf '%f\n')
- do
- rule _runit_sv_configure "$sv" "$@"
- rule _runit_sv_start "$sv"
- done
- #sleep 3
- #sudo find -L /etc/service -type l -delete
- fi
- }
-rule__runit_sv_configure () { # SYNTAX: $sv $configure_options
- local sv="$1"; shift
- sudo install -d -m 770 -o root -g root \
- /etc/sv/"$sv"
- sudo install -m 770 -o root -g root \
- "$tool"/etc/sv/"$sv"/run \
- /etc/sv/"$sv"/run
- if test -e "$tool"/etc/sv/"$sv"/log/run
- then
- sudo install -d -m 770 -o root -g root \
- /etc/sv/"$sv"/log
- sudo install -m 770 -o root -g root \
- "$tool"/etc/sv/"$sv"/log/run \
- /etc/sv/"$sv"/log/run
- fi
- (
- test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
- . "$tool"/etc/sv/"$sv"/configure.sh || return 1
- )
- (
- test ! -r "$tool"/etc/sv/"$sv"/log/configure.sh ||
- . "$tool"/etc/sv/"$sv"/log/configure.sh || return 1
- )
- sudo ln -fns \
- ../sv/"$sv" \
- /etc/service/"$sv"
- }
-rule__runit_sv_restart () { # SYNTAX: $sv
- local sv="$1"
- while true
- do case $(sudo sv restart "$sv" | tee /dev/stderr) in
- (*": runsv not running") sleep 1;;
- (*": unable to open supervise/ok: file does not exist") sleep 1;;
- (*) break;;
- esac
- done
- }
-rule__runit_sv_start () { # SYNTAX: $sv
- local sv="$1"
- while true
- do case $(sudo sv start "$sv" | tee /dev/stderr) in
- (*": runsv not running") sleep 1;;
- (*": unable to open supervise/ok: file does not exist") sleep 1;;
- (*) break;;
- esac
- done
- }
-rule_shorewall_configure () {
- # DOC: http://shorewall.net/Introduction.html
- local -; set +f
- rule apt_get_install shorewall
- sudo install -m 644 -o root -g root /dev/stdin \
- /etc/default/shorewall <<-EOF
- INITLOG=/dev/null
- OPTIONS=""
- RESTARTOPTIONS=""
- SAFESTOP=0
- STARTOPTIONS=""
- startup=1
- EOF
- local conf
- for conf in "$tool"/etc/shorewall/*
- do conf=${conf#"$tool"/etc/shorewall/}
- sudo test ! -f "$tool"/etc/shorewall/"$conf" ||
- sudo install -m 640 -o root -g root \
- "$tool"/etc/shorewall/"$conf" \
- /etc/shorewall/"$conf"
- done
- sudo install -d -m 750 -o root -g root \
- /etc/shorewall/macro.d
- for conf in "$tool"/etc/shorewall/macro.d/*
- do conf=${conf#"$tool"/etc/shorewall/macro.d/}
- sudo test ! -f "$tool"/etc/shorewall/macro.d/"$conf" ||
- sudo install -m 640 -o root -g root \
- "$tool"/etc/shorewall/macro.d/"$conf" \
- /etc/shorewall/macro.d/"$conf"
- done
- sudo install -d -m 750 -o root -g root \
- /etc/shorewall/action.d
- #for conf in "$tool"/etc/shorewall/action.d/*
- # do conf=${conf#"$tool"/etc/shorewall/action.d/}
- # sudo test ! -f "$tool"/etc/shorewall/action.d/"$conf" ||
- # sudo install -m 640 -o root -g root \
- # "$tool"/etc/shorewall/action.d/"$conf" \
- # /etc/shorewall/action.d/"$conf"
- # done
- #sudo shorewall safe-restart
- }
-rule_sysctl_configure () {
- local -; set +f
- for conf in "$tool"/etc/sysctl.d/*.conf
- do conf=${conf#"$tool"/etc/sysctl.d/}
- sudo install -m 660 -o root -g root \
- "$tool"/etc/sysctl.d/"$conf" \
- /etc/sysctl.d/"$conf"
- done
- sudo install -m 660 -o root -g root /dev/stdin \
- /etc/sysctl.d/local-kernel-name.conf <<-EOF
- kernel.hostname = $vm_hostname
- kernel.domainname = $vm_domainname
- EOF
- sudo sysctl --system
- }
-rule_tmpfs_configure () {
- sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
- LOCK_SIZE=5242880 # NOTE: 5MiB
- RAMLOCK=yes
- RAMSHM=yes
- RAMTMP=yes
- RUN_SIZE=10%
- SHM_SIZE=
- TMP_MODE=1777,nr_inodes=1000k,noatime
- TMP_OVERFLOW_LIMIT=1024
- # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
- # on the root filesystem (overriding RAMTMP).
- TMP_SIZE=200m
- TMPFS_SIZE=20%VM
- EOF
- }
-rule_user_add () { # SYNTAX: $user
- local user="$1"; shift
- rule adduser "$user" --disabled-password "$@"
- # NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
- eval local home\; home="~$user"
- sudo adduser "$user" users
- sudo install -m 640 -o "$user" -g "$user" \
- "$tool"/var/pub/ssh/"$user".key \
- "$home"/etc/ssh/authorized_keys
- gpg \
- --homedir "$tool"/var/pub/openpgp/ \
- --no-default-keyring \
- --secret-keyring /dev/null \
- --export |
- sudo -u "$user" gpg --import -
- }
-rule_user_configure () {
- rule apt_get_install bash-completion
- sudo install -m 660 -o root -g root \
- "$tool"/etc/adduser.conf \
- /etc/adduser.conf
- sudo install -d -m 750 -o root -g root \
- /etc/skel \
- /etc/skel/etc \
- /etc/skel/etc/gpg \
- /etc/skel/etc/ssh
- sudo install -d -m 770 -o root -g root \
- /etc/skel/var \
- /etc/skel/var/cache \
- /etc/skel/var/log \
- /etc/skel/var/run \
- /etc/skel/var/run/ssh
- sudo ln -fns etc/ssh /etc/skel/.ssh
- sudo ln -fns etc/gpg /etc/skel/.gnupg
- sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF
- %sudo ALL=(ALL) NOPASSWD: /bin/sh -e -f -u -c \\
- case \$(/usr/bin/passwd --status "\$SUDO_USER") in \\
- ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
- EOF
- sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
- %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
- EOF
- sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
- Defaults env_keep = " \\
- EDITOR \\
- GIT_AUTHOR_NAME \\
- GIT_AUTHOR_EMAIL \\
- GIT_COMMITTER_NAME \\
- GIT_COMMITTER_EMAIL \\
- "
- EOF
- sudo install -m 755 -o root -g root /dev/stdin /usr/local/bin/passwd-init <<-EOF
- #!/bin/sh -efu
- # DESCRIPTION: permet à un-e utilisateurice d'initialiser ellui-même son mot-de-passe système.
- sudo /bin/sh -e -f -u -c \
- 'case \$(/usr/bin/passwd --status "\$SUDO_USER") in ("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac'
- EOF
- sudo install -m 644 -o root -g root \
- "$tool"/etc/bash.bashrc \
- /etc/bash.bashrc
- sudo install -m 644 -o root -g root \
- "$tool"/etc/inputrc \
- /etc/inputrc
- sudo install -m 644 -o root -g root \
- "$tool"/etc/screenrc \
- /etc/screenrc
- local sh; local -; set +f
- for sh in "$tool"/etc/user.d/*/configure.sh
- do sh=${sh#"$tool"/etc/user.d/}
- local user="${sh%/configure.sh}"
- (
- . "$tool"/etc/user.d/"$sh" || return 1
- )
- done
- }
-rule_user_admin_add () { # SYNTAX: $user
- rule user_configure
- local user=$1
- rule adduser "$user" --disabled-password
- eval local home\; home="~$user"
- sudo adduser "$user" sudo
- sudo install -m 640 -o root -g root \
- "$tool"/var/pub/ssh/"$user".key \
- "$home"/etc/ssh/authorized_keys
- gpg \
- --homedir "$tool"/var/pub/openpgp/ \
- --no-default-keyring \
- --secret-keyring /dev/null \
- --export |
- sudo -u "$user" gpg --import -
- rule user_admin_configure
- }
-rule_user_admin_configure () {
- rule initramfs_configure
- rule user_root_configure
- }
-rule_user_root_configure () {
- sudo install -d -m 750 -o root -g root \
- /root/etc \
- /root/etc/gpg \
- /root/etc/ssh
- sudo ln -fns etc/gpg /root/.gnupg
- sudo ln -fns etc/ssh /root/.ssh
- getent group sudo |
- while IFS=: read -r group x x users
- do while test -n "$users" && IFS=, read -r user users <<-EOF
- $users
- EOF
- do eval local home\; home="~$user"
- sudo cat "$home"/etc/ssh/authorized_keys
- done
- done |
- sudo install -m 640 -o root -g root /dev/stdin \
- /root/etc/ssh/authorized_keys
- gpg \
- --homedir "$tool"/var/pub/openpgp/ \
- --no-default-keyring \
- --secret-keyring /dev/null \
- --export |
- sudo gpg --import -
- }
-rule__www_configure () {
- rule adduser www \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/www \
- --shell /bin/false \
- --system
- rule adduser log-www \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/www/log \
- --shell /bin/false \
- --system
- #sudo adduser www www-data
- sudo adduser www log-www
- #sudo adduser log log-www
- usermod --home /home/www/pub www-data
- sudo install -d -m 751 -o www -g www \
- /home/www
- sudo install -d -m 750 -o www -g www \
- /home/www/etc
- sudo install -d -m 1771 -o www-data -g www-data \
- /home/www/pub
- sudo install -d -m 1771 -o log-www -g log-www \
- /home/www/log
- }
-rule_configure () {
- rule apt_configure
- rule git_configure
- rule etckeeper_configure
- rule locales_configure
- rule time_configure
- rule network_configure
- rule filesystem_configure
- rule login_configure
- rule ssh_configure
- rule user_root_configure
- rule boot_configure
- rule sysctl_configure
- rule user_configure
- rule gitolite_configure
- rule shorewall_configure
- rule runit_configure
- }
-
-rule_luks_key_change () {
- sudo cryptsetup luksChangeKey /dev/$vm_lvm_vg/${vm_lvm_lv}_root
- }
-
-rule=${1:-help}
-${1+shift}
-case $rule in
- (help);;
- (*)
- assert 'test "$(hostname --fqdn)" = "$vm_fqdn"' vm_fqdn
- cd /
- ;;
- esac
-rule $rule "$@"
dépôts / lhc / ateliers.git / blobdiff