git config --replace branch.master.merge refs/remotes/master
local tool
tool=$(cd "$tool"; cd -)
- sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/
- sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm
- sudo install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
+ install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
#!/bin/sh -efux
case \$1 in
(refs/remotes/master)
sudo adduser "$@" "$user"
}
rule_apt_get_install () { # SYNTAX: $package
- sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@"
+ sudo DEBIAN_FRONTEND=noninteractive apt-get install --yes "$@"
}
rule_dpkg_reconfigure () { # SYNTAX: $package
sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@"
. /etc/profile
}
-rule_apache2_configure () {
+rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour
local -; set +f
rule apt_get_install \
apache2-mpm-itk \
}
rule_apt_configure () {
sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
- deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free
+ deb http://ftp.rezopole.net/debian $vm_lsb_name main
EOF
- sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF
- #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
+ deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
EOF
sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
Package: *
Pin: release a=$vm_lsb_name
- Pin-Priority: 170
+ Pin-Priority: 200
Package: *
Pin: release a=$vm_lsb_name-backports
- Pin-Priority: 200
+ Pin-Priority: 170
EOF
sudo apt-get update
rule apt_get_install apticron
$users
EOF
do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
+ sudo cat "$home"/etc/ssh/authorized_keys
done
done |
- sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys
+ sudo install -m 644 -o root -g root /dev/stdin \
+ /etc/initramfs-tools/root/.ssh/authorized_keys
sudo rm -f \
/etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
/etc/initramfs-tools/root/.ssh/id_rsa.pub \
--home /home/git/log \
--shell /bin/false \
--system
- rule adduser git-data\
+ rule adduser git-data \
--disabled-login \
--disabled-password \
--group \
--home /home/git/pub \
--shell /bin/false \
--system
- rule adduser git-daemon\
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/git/pub \
- --shell /bin/false \
- --system
- rule adduser log-git-daemon\
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/git/log/git-daemon \
- --shell /bin/false \
- --system
sudo adduser git git-data
- sudo adduser git-daemon git-data
- sudo adduser log-git log-git-daemon
sudo install -d -m 770 -o git -g git \
/etc/gitolite \
/home/git/etc \
/home/git/etc/ssh
sudo install -d -m 751 -o git -g git \
/home/git
- sudo install -d -m 3771 -o git-data -g git-data \
+ sudo install -d -m 2770 -o git-data -g git-data \
/home/git/pub
sudo install -d -m 1771 -o git -g git \
/home/git/log
sudo install -d -m 2770 -o git -g log-git \
/home/git/log/gitolite \
/home/git/log/gitolite/perf
- sudo install -d -m 770 -o log-git-daemon -g log-git-daemon \
- /home/git/log/git-daemon
- sudo install -d -m 550 -o www-lhc-git -g www-lhc-git \
- /etc/gitweb \
- /etc/gitweb/cgi
+ sudo install -d -m 3771 -o git -g git \
+ /home/git/hooks
sudo ln -fns /etc/gitolite /home/git/etc/gitolite
sudo ln -fns /etc/gitweb /home/git/etc/gitweb
sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc
\$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
\$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
#\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
- \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*";
+ \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
#\$GL_HOSTNAME = "git.$vm_domainname";
# NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
#\$GL_HTTP_ANON_USER = "mob";
#\$GL_WILDREPOS_DEFPERMS = 'R @all';
\$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
\$HTPASSWD_FILE = "";
- \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list";
+ \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
\$REPO_BASE = "pub";
\$REPO_UMASK = 0007;
\$RSYNC_BASE = "";
\$WEB_INTERFACE = "gitweb";
1;
EOF
- sudo install -m 740 -o git -g www-lhc-git /dev/stdin \
- /home/git/etc/gitweb/gitweb.conf <<-EOF
- \$commit_oneline_message_width = 70;
- \$default_projects_order = 'age';
- \$default_text_plain_charset = 'UTF-8';
- @diff_opts = ();
- \$favicon = "img/git-favicon.png";
- \$git_temp = "/run/shm/tmp/gitweb";
- \$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc";
- \$home_header = "/etc/gitweb/cgi/home-header.cgi.inc";
- \$home_link = "/";
- \$home_link_str = 'dépôts';
- \$home_th_age = 'activité';
- \$home_th_descr = 'description';
- \$home_th_owner = 'contact';
- \$home_th_project = 'dépôt';
- \$javascript = "js/gitweb.js";
- \$logo = "img/git-logo.png";
- \$my_uri = "";
- \$projectroot = "../git";
- \$projects_list = "/etc/gitolite/projects.list";
- \$projects_list_description_width = 42;
- \$projects_list_owner_width = 15;
- \$search_str = "Filtre :";
- \$site_footer = "/etc/gitweb/cgi/site-footer.bin";
- \$site_header = undef;
- \$site_name = "git.$vm_domainname";
- \$space_to_nbsp = 0;
- @stylesheets = ("css/gitweb.css");#
- \$untabify_tabstop = 2;
- EOF
sudo install -m 600 -o git -g git \
"$tool"/var/pub/ssh/git.key \
- /home/git/etc/ssh/git.pub
+ /home/git/etc/ssh/git.pub
sudo -u git \
GL_RC=/home/git/etc/gitolite/gitolite.rc \
GIT_AUTHOR_NAME=git \
do test ! -d /home/git/etc/gitolite/"$d" ||
rmdir /home/git/etc/gitolite/"$d"
done
- rule apt_get_install gitweb highlight
sudo service tmpfs restart
}
rule_locales_configure () {
}
rule_mysql_configure () {
rule apt_get_install mysql-server-5.5
- sudo install -m 644 -o root -g root \
- "$tool"/etc/mysql/my.cnf \
- /etc/mysql/my.cnf
- if test ! -d /home/mysql; then
- sudo install -d -m 750 -o mysql -g mysql \
- /home/mysql
- sudo -u mysql mysql_install_db --no-defaults --datadir=/home/mysql/
- fi
+ rule adduser mysql \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/mysql \
+ --shell /bin/false \
+ --system
+ rule adduser mysql-data \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/mysql/data \
+ --shell /bin/false \
+ --system
+ sudo usermod --home /home/mysql mysql
+ sudo adduser mysql mysql-data
+ sudo install -m 640 -o mysql -g mysql \
+ "$tool"/etc/mysql/my.cnf \
+ /etc/mysql/my.cnf
+ sudo install -d -m 751 -o mysql -g mysql \
+ /home/mysql
+ sudo install -d -m 750 -o mysql-data -g mysql-data \
+ /home/mysql/data
+ if test ! -d /home/mysql/data
+ then
+ sudo -u mysql mysql_install_db \
+ --no-defaults \
+ --datadir=/home/mysql/data
+ fi
+ sudo service tmpfs restart
+ case $(sudo sv status mysql || true) in
+ (run:*) sudo sv restart mysql
+ esac
}
rule_network_configure () {
sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
--disabled-login \
--disabled-password \
--group \
- --home /home/www-data/"$site" \
+ --home /home/www/pub/"$site" \
--shell /bin/false \
--system
rule adduser log-www-"$site" \
--home /home/www/log/"$site"/nginx \
--shell /bin/false \
--system
- sudo install -d -m 2770 -o log-www-"$site" -g log-www-"$site" \
+ sudo install -d -m 771 -o log-www -g log-www \
/home/www/log/"$site"
sudo install -d -m 770 -o www -g www \
/etc/nginx/site.d/"$site"
done
rule apt_get_install spawn-fcgi fcgiwrap
sudo insserv --remove fcgiwrap
- sudo insserv --remove nginx
+ #sudo insserv --remove nginx
rule tmpfs_configure
sudo service php5-fpm restart
# NOTE: relance les processus du pool
# pour leur donner les droits
# de leurs groupes supplémentaires.
sudo service nginx restart
- #case $(sv status nginx) in
- # (run:*) sudo sv restart nginx
- # esac
}
rule_php5_fpm_configure () {
local -; set +f
sudo install -m 664 -o php5 -g php5 \
"$tool"/etc/php5/fpm/php.ini \
/etc/php5/fpm/php.ini
- case $(sv status php5-"$pool") in
+ case $(sudo sv status php5-"$pool") in
(run:*) sudo sv restart php5-"$pool"
esac
done
local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
local sv_status
IFS= read -r sv_status_$sv_hash <<-EOF
- $(sv status "$sv")
+ $(sudo sv status "$sv")
EOF
- rm -f /etc/service/"$sv"
+ sudo rm -f /etc/service/"$sv"
done
for sv in ${1-"$tool"/etc/sv/*}
# NOTE: configure et (re-)démarre les services
"$tool"/etc/sv/"$sv"/log/run \
/etc/sv/"$sv"/log/run
fi
- test ! -x "$tool"/etc/sv/"$sv"/configure ||
- "$tool"/etc/sv/"$sv"/configure
- ln -fns ../sv/"$sv" /etc/service/"$sv"
+ test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
+ . "$tool"/etc/sv/"$sv"/configure.sh
+ sudo ln -fns ../sv/"$sv" /etc/service/"$sv"
eval local sv_status=\"\${sv_status_$sv_hash-}\"
case $sv_status in
- ("") sv start "$sv";;
- (run:*) sv restart "$sv";;
+ ("") true;;
+ (run:*) sudo sv restart "$sv";;
esac
done
}
/etc/ssh/ssh_host_ecdsa_key \
/etc/ssh/ssh_host_ecdsa_key.pub
# NOTE: clefs générées par Debian
- sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF
- Port 22
- ListenAddress $vm_ipv4
- #ListenAddress ::
- Protocol 2
+ sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF
+ AcceptEnv LANG LC_*
+ AuthorizedKeysFile %h/etc/ssh/authorized_keys
+ ChallengeResponseAuthentication no
+ ClientAliveInterval 0
Compression yes
+ DebianBanner no
+ GSSAPIAuthentication no
HostKey /etc/ssh/ssh_host_rsa_key
- UsePrivilegeSeparation yes
+ HostbasedAuthentication no
+ IgnoreRhosts yes
+ IgnoreUserKnownHosts no
+ KerberosAuthentication no
KeyRegenerationInterval 3600
- ServerKeyBits 768
- SyslogFacility AUTH
+ Port 22
+ ListenAddress 127.0.0.1
+ ListenAddress $vm_ipv4
LogLevel INFO
LoginGraceTime 120
+ PasswordAuthentication no
+ PermitEmptyPasswords no
PermitRootLogin yes
- StrictModes yes
- RSAAuthentication yes
+ PrintLastLog yes
+ PrintMotd no
+ Protocol 2
PubkeyAuthentication yes
- AuthorizedKeysFile %h/etc/ssh/authorized_keys
- IgnoreRhosts yes
+ RSAAuthentication yes
RhostsRSAAuthentication no
- HostbasedAuthentication no
- IgnoreUserKnownHosts no
- PermitEmptyPasswords no
- ChallengeResponseAuthentication no
- PasswordAuthentication no
- KerberosAuthentication no
- GSSAPIAuthentication no
- X11Forwarding no
- X11DisplayOffset 10
- PrintMotd no
- DebianBanner no
- PrintLastLog yes
- TCPKeepAlive yes
- ClientAliveInterval 0
- AcceptEnv LANG LC_*
+ ServerKeyBits 768
+ StrictModes yes
Subsystem sftp /usr/lib/openssh/sftp-server
+ SyslogFacility AUTH
+ TCPKeepAlive yes
UsePAM yes
+ UsePrivilegeSeparation yes
+ X11DisplayOffset 10
+ X11Forwarding no
+ EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/ssh_config <<-EOF
+ Host *
+ #Compression yes
+ #CompressionLevel 9
+ #ControlMaster auto
+ #ControlPath ~/var/run/ssh/sock/%h-%p-%r
+ GSSAPIAuthentication no
+ GSSAPIDelegateCredentials no
+ HashKnownHosts yes
+ IdentityFile ~/etc/ssh/id_dsa
+ IdentityFile ~/etc/ssh/id_rsa
+ IdentityFile ~/etc/ssh/identity
+ SendEnv LANG LC_*
+ StrictHostKeyChecking ask
+ UserKnownHostsFile ~/etc/ssh/known_hosts
EOF
sudo service ssh restart
}
done
}
rule_user_configure () {
+ rule apt_get_install bash-completion
sudo install -m 660 -o root -g root /dev/stdin \
/etc/adduser.conf <<-EOF
ADD_EXTRA_GROUPS=1
("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
EOF
sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
- %sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean
+ %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
EOF
sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
Defaults env_keep = " \\
$users
EOF
do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
+ sudo cat "$home"/etc/ssh/authorized_keys
done
done |
sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys
rule sysctl_configure
rule user_configure
rule mail_configure
+ rule gitolite_configure
rule www_configure
rule php5_fpm_configure
rule nginx_configure
#rule apache2_configure
- rule gitolite_configure
rule runit_configure
}
dépôts / lhc / ateliers.git / blobdiff