Mise-à-jour : TODO .

[lhc/ateliers.git] / vm_remote

diff --git a/vm_remote b/vm_remote
index 467d528..0a7ef55 100755 (executable)
--- a/vm_remote
+++ b/vm_remote
@@ -1,6 +1,6 @@
 #!/bin/sh
 set -e -f ${DRY_RUN:+-n} -u
-tool=$(cd "${0%/*}"; cd -)
+tool=$(readlink -e "${0%/*}")
 . "$tool"/lib/rule.sh
 . "$tool"/etc/vm.sh
 
@@ -27,10 +27,10 @@ rule_git_configure () { # DESCRIPTION: configure ./.git correctement
        (
        cd "$tool"
        git remote rm host || true
-       git remote add host $vm_host:tool/vm
+       git remote add host $vm_host:src/vm
        git config --replace remote.host.push HEAD:refs/remotes/master
        git remote rm hosted || true
-       git remote add hosted root@$vm_fqdn:tool/vm
+       git remote add hosted $vm_fqdn:src/vm
        git config --replace remote.hosted.push HEAD:refs/remotes/master
        git submodule update --init
        )
@@ -57,18 +57,12 @@ rule__ssh_known_hosts_update () {
         whoami
  }
 
-rule__x509_service_key_send_deciphered () { # SYNTAX: $service $remote_destination ${ssh_options-}
-       local service="$1"; shift
-       local remote_destination="$1"; shift
-       gpg --decrypt "var/sec/x509/$vm_domainname/$service/key.pass.gpg" |
+rule__x509_site_key_decrypt () { # SYNTAX: $site
+       local site="$1"; shift
+       gpg --decrypt "$tool"/var/sec/x509/"$site"/key.pass.gpg |
        openssl rsa -passin 'stdin' \
-        -in  "var/sec/x509/$vm_domainname/$service/key.pem" \
-        -out '/dev/stdout' |
-       rule ssh "$@"  ' \
-               install -m 400 -o root -g root \
-                /dev/stdin \
-                '"$remote_destination"' \
-        '
+        -in  var/sec/x509/"$site"/key.pem \
+        -out '/dev/stdout'
  }
 
 rule_luks_key_send () { # DESCRIPTION: envoie la clef de déchiffrement des partitions au démarrage de la VM.
@@ -100,34 +94,28 @@ rule_luks_key_backup () { # SYNTAX: ${gpg_options:---recipient $USER@} DESCRIPTI
 
 rule_apache2_key_send () {
        local -; set +f
-       for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
-        do conf=${conf#"$tool"/etc/apache2/site.d/}
-               local port domain
-               IFS=. read -r port domain <<-EOF
-                       ${conf%\/VirtualHost\.conf}
-                       EOF
-               assert 'test "${port:+set}"'
-               assert 'test "${domain:+set}"'
-               local site="$port.$domain"
-               case $port in
-                (443)
-                       rule ssh -l root ' \
-                               sudo install -d -m 770 -o '"$user"' -g '"$user"' \
-                                /etc/apache2 \
-                                /etc/apache2/site.d/'"$site"' \
-                                /etc/apache2/site.d/'"$site"'/x509; \
-                               sudo install -m 644 -o '"$user"' -g '"$user"' /dev/stdin \
-                                /etc/apache2/site.d/'"$site"'/x509/.gitignore <<-EOF
-                                       key.pem
-                                       EOF
-                        '
-                       rule _x509_service_key_send_deciphered $service \
-                        /etc/apache2/"$site"/x509/key.pem -l root "$@"
-                       ;;
-                esac
+       for conf in "$tool"/etc/nginx/site.d/*/key_send
+        do conf=${conf#"$tool"/etc/nginx/site.d/}
+               local site=${conf%/key_send}
+               rule _x509_site_key_decrypt \
+                "$(cat "$tool"/etc/apache2/site.d/"$site"/x509_host)" |
+               rule ssh -l root ' \
+                       sudo install -d -m 770 -o '"$user"' -g '"$user"' \
+                        /etc/apache2 \
+                        /etc/apache2/x509.d \
+                        /etc/apache2/x509.d/'"$site"'; \
+                       sudo install -m 644 -o '"$user"' -g '"$user"' /dev/stdin \
+                        /etc/apache2/x509.d/'"$site"'/.gitignore <<-EOF
+                               key.pem
+                               EOF
+                       sudo install -m 400 -o root -g root \
+                        /dev/stdin \
+                        /etc/apache2/x509.d/'"'$site'"'/key.pem
+                '
         done
  }
 rule_dovecot_key_send () {
+       rule _x509_site_key_decrypt imap."$vm_domainname" |
        rule ssh -l root ' \
                sudo install -d -m 770 -o root -g root \
                 /etc/dovecot/'"$vm_domainname"'/ \
@@ -137,11 +125,12 @@ rule_dovecot_key_send () {
                 /etc/dovecot/'"$vm_domainname"'/imap/x509/.gitignore <<-EOF
                        key.pem
                        EOF
+               sudo install -m 400 -o root -g root \
+                /dev/stdin \
+                /etc/dovecot/"$vm_domainname"/imap/x509/key.pem
         '
-       rule _x509_service_key_send_deciphered imap \
-        /etc/dovecot/$vm_domainname/$service/x509/key.pem -l root "$@"
  }
-rule_gitolite_configure () {
+rule_gitolite_git () {
        (
        cd "$tool"/etc/gitolite
        GIT_SSH=../../lib/ssh \
@@ -149,40 +138,37 @@ rule_gitolite_configure () {
                SSH_ASKPASS='"$tool"'/lib/ssh-pass \
                SSH_ID=git \
                ssh-add '"$tool"'/var/sec/ssh/git </dev/null && \
-               git push -v origin '"$*"
+               git '"$*"
        )
  }
-rule_nginx_key_send () {
+rule_nginx_configure () {
        local -; set +f
-       for conf in "$tool"/etc/nginx/site.d/*/server.conf
+       for conf in "$tool"/etc/nginx/site.d/*/site.conf
         do conf=${conf#"$tool"/etc/nginx/site.d/}
-               local port domain
-               IFS=. read -r port domain <<-EOF
-                       ${conf%\/server\.conf}
-                       EOF
-               assert 'test "${port:+set}"'
-               assert 'test "${domain:+set}"'
-               local site="$port.$domain"
-               case $port in
-                (443)
+               local site="${conf%/site.conf}"
+               if test -f "$tool"/etc/nginx/site.d/"$site"/x509_host
+                then
+                       rule _x509_site_key_decrypt \
+                        "$(cat "$tool"/etc/nginx/site.d/"$site"/x509_host)" |
                        rule ssh -l root ' \
                                sudo install -d -m 770 -o root -g root \
                                 /etc/nginx \
-                                /etc/nginx/site.d \
-                                /etc/nginx/site.d/'"$site"' \
-                                /etc/nginx/site.d/'"$site"'/x509; \
+                                /etc/nginx/x509.d \
+                                /etc/nginx/x509.d/'"'$site'"'; \
                                sudo install -m 644 -o root -g root /dev/stdin \
-                                /etc/nginx/site.d/'"$site"'/x509/.gitignore <<-EOF
+                                /etc/nginx/x509.d/'"'$site'"'/.gitignore <<-EOF
                                        key.pem
                                        EOF
+                               sudo install -m 400 -o root -g root /dev/stdin \
+                                /etc/nginx/x509.d/'"'$site'"'/key.pem
                         '
-                       rule _x509_service_key_send_deciphered $service \
-                        /etc/nginx/"$site"/x509/key.pem -l root "$@"
-                       ;;
-                esac
+                fi
+               test ! -r "$tool"/etc/nginx/site.d/"$site"/remote.sh ||
+               .         "$tool"/etc/nginx/site.d/"$site"/remote.sh
         done
  }
 rule_postfix_key_send () {
+       rule _x509_site_key_decrypt smtpd."$vm_domainname" |
        rule ssh -l root ' \
                sudo install -d -m 770 -o root -g root \
                 /etc/postfix/'"$vm_domainname"'/ \
@@ -196,9 +182,10 @@ rule_postfix_key_send () {
                 /etc/postfix/'"$vm_domainname"'/smtpd/x509/.gitignore <<-EOF
                        key.pem
                        EOF
+               install -m 400 -o root -g root \
+                /dev/stdin \
+                /etc/postfix/'"'$vm_domainname'"'/smtpd/x509/key.pem
         '
-       rule _x509_service_key_send_deciphered smtpd \
-        /etc/postfix/$vm_domainname/smtpd/x509/key.pem -l root "$@"
  }
 
 rule=${1:-help}