git config --replace branch.master.merge refs/remotes/master
local tool
tool=$(cd "$tool"; cd -)
- sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/
- sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm
- sudo install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
+ install -m 770 /dev/stdin .git/hooks/post-update <<-EOF
#!/bin/sh -efux
case \$1 in
(refs/remotes/master)
. /etc/profile
}
-rule_apache2_configure () {
+rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour
local -; set +f
rule apt_get_install \
apache2-mpm-itk \
}
rule_apt_configure () {
sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF
- deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free
+ deb http://ftp.rezopole.net/debian $vm_lsb_name main
EOF
- sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF
- #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free
+ sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF
+ deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main
EOF
sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF
Package: *
Pin: release a=$vm_lsb_name
- Pin-Priority: 170
+ Pin-Priority: 200
Package: *
Pin: release a=$vm_lsb_name-backports
- Pin-Priority: 200
+ Pin-Priority: 170
EOF
- #sudo install -m 660 -o root -g root /dev/stdin /etc/apt/apt.conf.d/02proxy-grenode <<-EOF
- # Acquire::http::Proxy "http://outils.grenode.net:3142";
- # EOF
sudo apt-get update
rule apt_get_install apticron
sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF
$users
EOF
do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
+ sudo cat "$home"/etc/ssh/authorized_keys
done
done |
- sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys
+ sudo install -m 644 -o root -g root /dev/stdin \
+ /etc/initramfs-tools/root/.ssh/authorized_keys
sudo rm -f \
/etc/initramfs-tools/root/.ssh/id_rsa.dropbear \
/etc/initramfs-tools/root/.ssh/id_rsa.pub \
--home /home/git/log \
--shell /bin/false \
--system
- rule adduser git-data\
+ rule adduser git-data \
--disabled-login \
--disabled-password \
--group \
--home /home/git/pub \
--shell /bin/false \
--system
- rule adduser git-daemon\
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/git/pub \
- --shell /bin/false \
- --system
- rule adduser log-git-daemon\
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/git/log/git-daemon \
- --shell /bin/false \
- --system
sudo adduser git git-data
- sudo adduser git-daemon git-data
- sudo adduser log-git log-git-daemon
sudo install -d -m 770 -o git -g git \
/etc/gitolite \
/home/git/etc \
/home/git/etc/ssh
sudo install -d -m 751 -o git -g git \
/home/git
- sudo install -d -m 3771 -o git-data -g git-data \
+ sudo install -d -m 2770 -o git-data -g git-data \
/home/git/pub
sudo install -d -m 1771 -o git -g git \
/home/git/log
sudo install -d -m 2770 -o git -g log-git \
/home/git/log/gitolite \
/home/git/log/gitolite/perf
- sudo install -d -m 770 -o log-git-daemon -g log-git-daemon \
- /home/git/log/git-daemon
- sudo install -d -m 550 -o www-lhc-git -g www-lhc-git \
- /etc/gitweb \
- /etc/gitweb/cgi
+ sudo install -d -m 3771 -o git -g git \
+ /home/git/hooks
sudo ln -fns /etc/gitolite /home/git/etc/gitolite
sudo ln -fns /etc/gitweb /home/git/etc/gitweb
sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc
\$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf";
\$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm";
#\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups"
- \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*";
+ \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*";
#\$GL_HOSTNAME = "git.$vm_domainname";
# NOTE: read doc/mirroring.mkd COMPLETELY before setting this.
#\$GL_HTTP_ANON_USER = "mob";
#\$GL_WILDREPOS_DEFPERMS = 'R @all';
\$GL_WILDREPOS_PERM_CATS = "READERS WRITERS";
\$HTPASSWD_FILE = "";
- \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list";
+ \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list";
\$REPO_BASE = "pub";
\$REPO_UMASK = 0007;
\$RSYNC_BASE = "";
\$WEB_INTERFACE = "gitweb";
1;
EOF
- sudo install -m 740 -o git -g www-lhc-git /dev/stdin \
- /home/git/etc/gitweb/gitweb.conf <<-EOF
- \$commit_oneline_message_width = 70;
- \$default_projects_order = 'age';
- \$default_text_plain_charset = 'UTF-8';
- @diff_opts = ();
- \$favicon = "img/git-favicon.png";
- \$git_temp = "/run/shm/tmp/gitweb";
- \$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc";
- \$home_header = "/etc/gitweb/cgi/home-header.cgi.inc";
- \$home_link = "/";
- \$home_link_str = 'dépôts';
- \$home_th_age = 'activité';
- \$home_th_descr = 'description';
- \$home_th_owner = 'contact';
- \$home_th_project = 'dépôt';
- \$javascript = "js/gitweb.js";
- \$logo = "img/git-logo.png";
- \$my_uri = "";
- \$projectroot = "../git";
- \$projects_list = "/etc/gitolite/projects.list";
- \$projects_list_description_width = 42;
- \$projects_list_owner_width = 15;
- \$search_str = "Filtre :";
- \$site_footer = "/etc/gitweb/cgi/site-footer.bin";
- \$site_header = undef;
- \$site_name = "git.$vm_domainname";
- \$space_to_nbsp = 0;
- @stylesheets = ("css/gitweb.css");#
- \$untabify_tabstop = 2;
- EOF
sudo install -m 600 -o git -g git \
"$tool"/var/pub/ssh/git.key \
- /home/git/etc/ssh/git.pub
+ /home/git/etc/ssh/git.pub
sudo -u git \
GL_RC=/home/git/etc/gitolite/gitolite.rc \
GIT_AUTHOR_NAME=git \
do test ! -d /home/git/etc/gitolite/"$d" ||
rmdir /home/git/etc/gitolite/"$d"
done
- rule apt_get_install gitweb highlight
sudo service tmpfs restart
}
rule_locales_configure () {
}
rule_mysql_configure () {
rule apt_get_install mysql-server-5.5
- sudo install -m 644 -o root -g root \
- "$tool"/etc/mysql/my.cnf \
- /etc/mysql/my.cnf
- if test ! -d /home/mysql; then
- sudo install -d -m 750 -o mysql -g mysql \
- /home/mysql
- sudo -u mysql mysql_install_db --no-defaults --datadir=/home/mysql/
- fi
+ rule adduser mysql \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/mysql \
+ --shell /bin/false \
+ --system
+ rule adduser mysql-data \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/mysql/data \
+ --shell /bin/false \
+ --system
+ sudo usermod --home /home/mysql mysql
+ sudo adduser mysql mysql-data
+ sudo install -m 640 -o mysql -g mysql \
+ "$tool"/etc/mysql/my.cnf \
+ /etc/mysql/my.cnf
+ sudo install -d -m 751 -o mysql -g mysql \
+ /home/mysql
+ sudo install -d -m 750 -o mysql-data -g mysql-data \
+ /home/mysql/data
+ if test ! -d /home/mysql/data
+ then
+ sudo -u mysql mysql_install_db \
+ --no-defaults \
+ --datadir=/home/mysql/data
+ fi
+ sudo service tmpfs restart
+ case $(sudo sv status mysql || true) in
+ (run:*) sudo sv restart mysql
+ esac
}
rule_network_configure () {
sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF
$(cat /etc/hosts)
127.0.0.1 $vm_fqdn $vm
EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
+ search ${vm_host#*.}
+ nameserver ${vm_host_nameserver}
+ EOF
sudo install -m 644 -o root -g root /dev/stdin /etc/network/interfaces <<-EOF
auto lo
iface lo inet loopback
pre-down ip address delete $vm_ipv4/32 dev \$IFACE
EOF
}
-rule_www_configure () {
- rule adduser www \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/www \
- --shell /bin/false \
- --system
- rule adduser log-www \
- --disabled-login \
- --disabled-password \
- --group \
- --home /home/www/log \
- --shell /bin/false \
- --system
- #sudo adduser www www-data
- sudo adduser www log-www
- #sudo adduser log log-www
- usermod --home /home/www/pub www-data
- sudo install -d -m 751 -o www -g www \
- /home/www
- sudo install -d -m 750 -o www -g www \
- /home/www/etc
- sudo install -d -m 1771 -o www-data -g www-data \
- /home/www/pub
- sudo install -d -m 1771 -o log-www -g log-www \
- /home/www/log
- }
rule_nginx_configure () {
local -; set +f
rule apt_get_install nginx
--disabled-login \
--disabled-password \
--group \
- --home /home/www-data/"$site" \
+ --home /home/www/pub/"$site" \
--shell /bin/false \
--system
rule adduser log-www-"$site" \
--home /home/www/log/"$site"/nginx \
--shell /bin/false \
--system
- sudo install -d -m 2770 -o log-www-"$site" -g log-www-"$site" \
+ sudo install -d -m 771 -o log-www -g log-www \
/home/www/log/"$site"
sudo install -d -m 770 -o www -g www \
/etc/nginx/site.d/"$site"
done
rule apt_get_install spawn-fcgi fcgiwrap
sudo insserv --remove fcgiwrap
- sudo insserv --remove nginx
+ #sudo insserv --remove nginx
rule tmpfs_configure
sudo service php5-fpm restart
# NOTE: relance les processus du pool
# pour leur donner les droits
# de leurs groupes supplémentaires.
sudo service nginx restart
- #case $(sv status nginx) in
- # (run:*) sudo sv restart nginx
- # esac
+ }
+rule_nsd3_configure () { # NOTE: DNS autoritaire uniquement
+ local -; set +f
+ rule apt_get_install nsd m4
+ sudo rm -rf \
+ /etc/nsd3/zone.d
+ sudo install -d -m 750 -o root -g nsd \
+ /etc/nsd3/zone.d
+ {
+ cat <<-EOF
+ server:
+ ip-address: $vm_ipv4
+ ip4-only: yes
+ EOF
+ cat "$tool"/etc/nsd3/nsd.conf
+ local conf
+ for conf in "$tool"/etc/nsd3/zone.d/*.conf
+ do conf=${conf#"$tool"/etc/nsd3/zone.d/}
+ local domain=${conf%.conf}
+ if test -e "$tool"/etc/nsd3/zone.d/"$domain".zone.m4
+ then m4 \
+ --define=ZONE_DOMAIN=$domain \
+ --define=ZONE_SERIAL=$(cd "$tool" && git log -1 --format="%ct" -- etc/nsd3/zone.d/"$domain".zone.m4) \
+ --define=VM_IP4=$vm_ipv4 \
+ "$tool"/etc/nsd3/zone.d/"$domain".zone.m4
+ else cat "$tool"/etc/nsd3/zone.d/"$domain".zone
+ fi |
+ sudo install -m 440 -o root -g nsd /dev/stdin \
+ /etc/nsd3/zone.d/"$domain".zone
+ sudo install -m 440 -o root -g nsd \
+ "$tool"/etc/nsd3/zone.d/"$conf" \
+ /etc/nsd3/zone.d/"$conf"
+ cat <<-EOF
+ zone:
+ name: $domain
+ zonefile: /etc/nsd3/zone.d/$domain.zone
+ EOF
+ done
+ } |
+ sudo install -m 640 -o root -g nsd /dev/stdin \
+ /etc/nsd3/nsd.conf
+ sudo service nsd3 restart
}
rule_php5_fpm_configure () {
local -; set +f
sudo install -m 664 -o php5 -g php5 \
"$tool"/etc/php5/fpm/php.ini \
/etc/php5/fpm/php.ini
- case $(sv status php5-"$pool") in
+ case $(sudo sv status php5-"$pool") in
(run:*) sudo sv restart php5-"$pool"
esac
done
local sv_hash=$(printf %s "$sv" | sha1sum | cut -f 1 -d ' ')
local sv_status
IFS= read -r sv_status_$sv_hash <<-EOF
- $(sv status "$sv")
+ $(sudo sv status "$sv")
EOF
- rm -f /etc/service/"$sv"
+ sudo rm -f /etc/service/"$sv"
done
for sv in ${1-"$tool"/etc/sv/*}
# NOTE: configure et (re-)démarre les services
"$tool"/etc/sv/"$sv"/log/run \
/etc/sv/"$sv"/log/run
fi
- test ! -x "$tool"/etc/sv/"$sv"/configure ||
- "$tool"/etc/sv/"$sv"/configure
- ln -fns ../sv/"$sv" /etc/service/"$sv"
+ test ! -r "$tool"/etc/sv/"$sv"/configure.sh ||
+ . "$tool"/etc/sv/"$sv"/configure.sh
+ sudo ln -fns ../sv/"$sv" /etc/service/"$sv"
eval local sv_status=\"\${sv_status_$sv_hash-}\"
case $sv_status in
- ("") sv start "$sv";;
- (run:*) sv restart "$sv";;
+ ("") true;;
+ (run:*) sudo sv restart "$sv";;
esac
done
}
/etc/ssh/ssh_host_ecdsa_key \
/etc/ssh/ssh_host_ecdsa_key.pub
# NOTE: clefs générées par Debian
- sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF
- Port 22
- ListenAddress $vm_ipv4
- #ListenAddress ::
- Protocol 2
+ sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/sshd_config <<-EOF
+ AcceptEnv LANG LC_*
+ AuthorizedKeysFile %h/etc/ssh/authorized_keys
+ ChallengeResponseAuthentication no
+ ClientAliveInterval 0
Compression yes
+ DebianBanner no
+ GSSAPIAuthentication no
HostKey /etc/ssh/ssh_host_rsa_key
- UsePrivilegeSeparation yes
+ HostbasedAuthentication no
+ IgnoreRhosts yes
+ IgnoreUserKnownHosts no
+ KerberosAuthentication no
KeyRegenerationInterval 3600
- ServerKeyBits 768
- SyslogFacility AUTH
+ Port 22
+ ListenAddress 127.0.0.1
+ ListenAddress $vm_ipv4
LogLevel INFO
LoginGraceTime 120
+ PasswordAuthentication no
+ PermitEmptyPasswords no
PermitRootLogin yes
- StrictModes yes
- RSAAuthentication yes
+ PrintLastLog yes
+ PrintMotd no
+ Protocol 2
PubkeyAuthentication yes
- AuthorizedKeysFile %h/etc/ssh/authorized_keys
- IgnoreRhosts yes
+ RSAAuthentication yes
RhostsRSAAuthentication no
- HostbasedAuthentication no
- IgnoreUserKnownHosts no
- PermitEmptyPasswords no
- ChallengeResponseAuthentication no
- PasswordAuthentication no
- KerberosAuthentication no
- GSSAPIAuthentication no
- X11Forwarding no
- X11DisplayOffset 10
- PrintMotd no
- DebianBanner no
- PrintLastLog yes
- TCPKeepAlive yes
- ClientAliveInterval 0
- AcceptEnv LANG LC_*
+ ServerKeyBits 768
+ StrictModes yes
Subsystem sftp /usr/lib/openssh/sftp-server
+ SyslogFacility AUTH
+ TCPKeepAlive yes
UsePAM yes
+ UsePrivilegeSeparation yes
+ X11DisplayOffset 10
+ X11Forwarding no
+ EOF
+ sudo install -m 644 -o root -g root /dev/stdin /etc/ssh/ssh_config <<-EOF
+ Host *
+ #Compression yes
+ #CompressionLevel 9
+ #ControlMaster auto
+ #ControlPath ~/var/run/ssh/sock/%h-%p-%r
+ GSSAPIAuthentication no
+ GSSAPIDelegateCredentials no
+ HashKnownHosts yes
+ IdentityFile ~/etc/ssh/id_dsa
+ IdentityFile ~/etc/ssh/id_rsa
+ IdentityFile ~/etc/ssh/identity
+ SendEnv LANG LC_*
+ StrictHostKeyChecking ask
+ UserKnownHostsFile ~/etc/ssh/known_hosts
EOF
sudo service ssh restart
}
rule dpkg_reconfigure tzdata
rule apt_get_install ntp
}
+rule_unbound_configure () {
+ sudo apt-get install unbound m4
+ sudo install -m 644 -o root -g root /dev/stdin /etc/resolv.conf <<-EOF
+ search ${vm_host#*.}
+ nameserver 127.0.0.1
+ #nameserver ${vm_host_nameserver}
+ EOF
+ sudo install -m 440 -o unbound -g unbound \
+ "$tool"/etc/unbound/named.cache \
+ /etc/unbound/named.cache
+ m4 \
+ --define=OUTGOING_INTERFACE=$vm_ipv4 \
+ <"$tool"/etc/unbound/unbound.conf |
+ sudo install -m 440 -o unbound -g unbound /dev/stdin \
+ /etc/unbound/unbound.conf
+ sudo service unbound restart
+ }
rule_user_add () { # SYNTAX: $user
rule user_configure
local user=$1
done
}
rule_user_configure () {
+ rule apt_get_install bash-completion
sudo install -m 660 -o root -g root /dev/stdin \
/etc/adduser.conf <<-EOF
ADD_EXTRA_GROUPS=1
("\$SUDO_USER L "*) /usr/bin/passwd \$SUDO_USER;; esac
EOF
sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/etckeeper-unclean <<-EOF
- %sudo ALL=(ALL) NOPASSWD: /usr/sbin/etckeeper unclean
+ %sudo ALL=(ALL) NOPASSWD: /usr/bin/etckeeper unclean
EOF
sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/env_keep <<-EOF
Defaults env_keep = " \\
$users
EOF
do eval local home\; home="~$user"
- cat "$home"/etc/ssh/authorized_keys
+ sudo cat "$home"/etc/ssh/authorized_keys
done
done |
sudo install -m 640 -o root -g root /dev/stdin /root/etc/ssh/authorized_keys
do sudo gpg --import "$key"
done
}
+rule_www_configure () {
+ rule adduser www \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/www \
+ --shell /bin/false \
+ --system
+ rule adduser log-www \
+ --disabled-login \
+ --disabled-password \
+ --group \
+ --home /home/www/log \
+ --shell /bin/false \
+ --system
+ #sudo adduser www www-data
+ sudo adduser www log-www
+ #sudo adduser log log-www
+ usermod --home /home/www/pub www-data
+ sudo install -d -m 751 -o www -g www \
+ /home/www
+ sudo install -d -m 750 -o www -g www \
+ /home/www/etc
+ sudo install -d -m 1771 -o www-data -g www-data \
+ /home/www/pub
+ sudo install -d -m 1771 -o log-www -g log-www \
+ /home/www/log
+ }
rule_configure () {
rule apt_configure
rule git_configure
rule sysctl_configure
rule user_configure
rule mail_configure
+ rule gitolite_configure
rule www_configure
rule php5_fpm_configure
rule nginx_configure
#rule apache2_configure
- rule gitolite_configure
+ rule nsd3_configure
rule runit_configure
}
dépôts / lhc / ateliers.git / blobdiff