Ajout : vm_hosted : utilise debconf-set-selections .

[lhc/ateliers.git] / vm_hosted

diff --git a/vm_hosted b/vm_hosted
index df9e348..1ffd176 100755 (executable)
--- a/vm_hosted
+++ b/vm_hosted
@@ -46,7 +46,10 @@ rule_git_reset () {
  }
 
 rule_apt_get_install () { # SYNTAX: $package
-       sudo apt-get install "$@"
+       sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@"
+ }
+rule_dpkg_reconfigure () { # SYNTAX: $package
+       sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@"
  }
 
 rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
@@ -268,7 +271,10 @@ rule_apt_configure () {
                EOF
  }
 rule_boot_configure () {
-       warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
+       #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
+       sudo debconf-set-selections <<-EOF
+               grub-pc grub-pc/install_devices multiselect     
+               EOF
        rule apt_get_install grub-pc
        sudo install -d -m 644 -o root -g root /boot/grub
        rule apt_get_install linux-image-$vm_arch
@@ -287,6 +293,13 @@ rule_boot_configure () {
                EOF
        sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
        rule initramfs_configure
+       rule apt_get_install molly-guard
+       sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
+               ALWAYS_QUERY_HOSTNAME=true
+                # NOTE: une alternative est de dire à sudo de conserver les SSH_*
+                #       néamoins demander tout le temps n'est pas trop contraignant
+                #       et davantage sécurisant.
+               EOF
  }
 rule_dovecot_configure () {
        rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve
@@ -390,7 +403,6 @@ rule_filesystem_configure () {
                LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0
                proc /proc proc defaults 0 0
                sysfs /sys sysfs defaults 0 0
-               tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0
                /dev/mapper/${vm_lvm_lv}_root_deciphered /     ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
                /dev/mapper/${vm_lvm_lv}_var_deciphered  /var  ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
                /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0
@@ -404,6 +416,24 @@ rule_filesystem_configure () {
                ${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
                ${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
                EOF
+       sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
+               LOCK_SIZE=5242880 # NOTE: 5MiB
+               RAMLOCK=yes
+               RAMSHM=yes
+               RAMTMP=yes
+               RUN_SIZE=10%
+               SHM_SIZE=
+               TMP_MODE=1777,nr_inodes=1000k,noatime
+               TMP_OVERFLOW_LIMIT=1024
+                # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
+                #       on the root filesystem (overriding RAMTMP).
+               TMP_SIZE=200m
+               TMPFS_SIZE=20%VM
+               EOF
+       sudo install -m 775 -o root -g root \
+        "$tool"/etc/init.d/tmpfs \
+               /etc/init.d/tmpfs
+       sudo update-rc.d tmpfs defaults
  }
 rule_initramfs_configure () {
        sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
@@ -463,30 +493,14 @@ rule_initramfs_configure () {
         # NOTE: clefs générées par Debian
        sudo update-initramfs -u
  }
-rule_time_configure () {
-       sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
-               Europe/Paris
-               EOF
-       sudo dpkg-reconfigure tzdata
-       rule apt_get_install ntp
- }
 rule_locale_configure () {
-       sudo install -m 644 -o root -g root /dev/stdin /etc/locale.gen <<-EOF
-               fr_FR.UTF-8 UTF-8
+       sudo debconf-set-selections <<-EOF
+               locales locales/default_environment_locale      select  None
+               locales locales/locales_to_be_generated multiselect     fr_FR.UTF-8 UTF-8
                EOF
-       sudo update-locale
+       rule dpkg_reconfigure locales
  }
 rule_login_configure () {
-       grep -q '^hvc0$' /etc/securetty ||
-       sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
-               $(cat /etc/securetty)
-               hvc0
-               EOF
-       grep -q '^xvc0$' /etc/securetty ||
-       sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
-               $(cat /etc/securetty)
-               xvc0
-               EOF
        sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF
                # /etc/inittab: init(8) configuration.
                
@@ -572,6 +586,16 @@ rule_login_configure () {
                $(cat /etc/pam.d/common-session)
                session optional pam_umask.so
                EOF
+       grep -q '^hvc0$' /etc/securetty ||
+       sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+               $(cat /etc/securetty)
+               hvc0
+               EOF
+       grep -q '^xvc0$' /etc/securetty ||
+       sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+               $(cat /etc/securetty)
+               xvc0
+               EOF
  }
 rule_mail_configure () {
        rule postfix_configure
@@ -847,7 +871,10 @@ rule_php5_fpm_configure () {
 rule_postfix_configure () {
        local hint="run vm_remote postfix_key_send before"
        assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint
-       warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix"
+       #warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix"
+       sudo debconf-set-selections <<-EOF
+               postfix postfix/main_mailer_type        select  No configuration
+               EOF
        rule apt_get_install postfix
        sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF
                *.db
@@ -1010,10 +1037,21 @@ rule_sysctl_configure () {
         do conf=${conf#"$tool"/etc/sysctl.d/}
                sudo install -m 660 -o root -g root \
                 "$tool"/etc/sysctl.d/"$conf" \
-                /etc/sysctl.d/"$conf"
+                       /etc/sysctl.d/"$conf"
         done
        sudo sysctl --system
  }
+rule_time_configure () {
+       sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
+               Europe/Paris
+               EOF
+       sudo debconf-set-selections <<-EOF
+               tzdata  tzdata/Areas    select  Europe
+               tzdata  tzdata/Zones/Europe     select  Paris
+               EOF
+       rule dpkg_reconfigure tzdata
+       rule apt_get_install ntp
+ }
 rule_user_add () { # SYNTAX: $user
        rule user_configure
        local user=$1