Correction : vm_{hosted,remote} : chemins et noms .

[lhc/ateliers.git] / vm_remote

diff --git a/vm_remote b/vm_remote
index 467d528..37e6dc1 100755 (executable)
--- a/vm_remote
+++ b/vm_remote
@@ -57,18 +57,12 @@ rule__ssh_known_hosts_update () {
         whoami
  }
 
-rule__x509_service_key_send_deciphered () { # SYNTAX: $service $remote_destination ${ssh_options-}
-       local service="$1"; shift
-       local remote_destination="$1"; shift
-       gpg --decrypt "var/sec/x509/$vm_domainname/$service/key.pass.gpg" |
+rule__x509_site_key_decrypt () { # SYNTAX: $site
+       local site="$1"; shift
+       gpg --decrypt "$tool"/var/sec/x509/"$site"/key.pass.gpg |
        openssl rsa -passin 'stdin' \
-        -in  "var/sec/x509/$vm_domainname/$service/key.pem" \
-        -out '/dev/stdout' |
-       rule ssh "$@"  ' \
-               install -m 400 -o root -g root \
-                /dev/stdin \
-                '"$remote_destination"' \
-        '
+        -in  var/sec/x509/"$site"/key.pem \
+        -out '/dev/stdout'
  }
 
 rule_luks_key_send () { # DESCRIPTION: envoie la clef de déchiffrement des partitions au démarrage de la VM.
@@ -104,13 +98,14 @@ rule_apache2_key_send () {
         do conf=${conf#"$tool"/etc/apache2/site.d/}
                local port domain
                IFS=. read -r port domain <<-EOF
-                       ${conf%\/VirtualHost\.conf}
+                       ${conf%/VirtualHost.conf}
                        EOF
                assert 'test "${port:+set}"'
                assert 'test "${domain:+set}"'
                local site="$port.$domain"
                case $port in
                 (443)
+                       rule _x509_site_key_decrypt "$domain" |
                        rule ssh -l root ' \
                                sudo install -d -m 770 -o '"$user"' -g '"$user"' \
                                 /etc/apache2 \
@@ -120,14 +115,16 @@ rule_apache2_key_send () {
                                 /etc/apache2/site.d/'"$site"'/x509/.gitignore <<-EOF
                                        key.pem
                                        EOF
+                               sudo install -m 400 -o root -g root \
+                                /dev/stdin \
+                                /etc/apache2/'"'$site'"'/x509/key.pem
                         '
-                       rule _x509_service_key_send_deciphered $service \
-                        /etc/apache2/"$site"/x509/key.pem -l root "$@"
                        ;;
                 esac
         done
  }
 rule_dovecot_key_send () {
+       rule _x509_site_key_decrypt imap."$vm_domainname" |
        rule ssh -l root ' \
                sudo install -d -m 770 -o root -g root \
                 /etc/dovecot/'"$vm_domainname"'/ \
@@ -137,9 +134,10 @@ rule_dovecot_key_send () {
                 /etc/dovecot/'"$vm_domainname"'/imap/x509/.gitignore <<-EOF
                        key.pem
                        EOF
+               sudo install -m 400 -o root -g root \
+                /dev/stdin \
+                /etc/dovecot/"$vm_domainname"/imap/x509/key.pem
         '
-       rule _x509_service_key_send_deciphered imap \
-        /etc/dovecot/$vm_domainname/$service/x509/key.pem -l root "$@"
  }
 rule_gitolite_configure () {
        (
@@ -154,35 +152,29 @@ rule_gitolite_configure () {
  }
 rule_nginx_key_send () {
        local -; set +f
-       for conf in "$tool"/etc/nginx/site.d/*/server.conf
+       for conf in "$tool"/etc/nginx/site.d/*/key_send
         do conf=${conf#"$tool"/etc/nginx/site.d/}
-               local port domain
-               IFS=. read -r port domain <<-EOF
-                       ${conf%\/server\.conf}
-                       EOF
-               assert 'test "${port:+set}"'
-               assert 'test "${domain:+set}"'
-               local site="$port.$domain"
-               case $port in
-                (443)
-                       rule ssh -l root ' \
-                               sudo install -d -m 770 -o root -g root \
-                                /etc/nginx \
-                                /etc/nginx/site.d \
-                                /etc/nginx/site.d/'"$site"' \
-                                /etc/nginx/site.d/'"$site"'/x509; \
-                               sudo install -m 644 -o root -g root /dev/stdin \
-                                /etc/nginx/site.d/'"$site"'/x509/.gitignore <<-EOF
-                                       key.pem
-                                       EOF
-                        '
-                       rule _x509_service_key_send_deciphered $service \
-                        /etc/nginx/"$site"/x509/key.pem -l root "$@"
-                       ;;
-                esac
+               local site=${conf%/key_send}
+               rule _x509_site_key_decrypt \
+                "$(cat "$tool"/etc/nginx/site.d/"$site"/key_send)" |
+               rule ssh -l root ' \
+                       sudo install -d -m 770 -o root -g root \
+                        /etc/nginx \
+                        /etc/nginx/x509.d \
+                        /etc/nginx/x509.d/'"'$site'"'; \
+                       sudo install -m 644 -o root -g root /dev/stdin \
+                        /etc/nginx/x509.d/'"'$site'"'/.gitignore <<-EOF
+                               key.pem
+                               EOF
+                       
+                       install -m 400 -o root -g root \
+                        /dev/stdin \
+                        /etc/nginx/x509.d/'"'$site'"'/key.pem
+                '
         done
  }
 rule_postfix_key_send () {
+       rule _x509_site_key_decrypt smtpd."$vm_domainname" |
        rule ssh -l root ' \
                sudo install -d -m 770 -o root -g root \
                 /etc/postfix/'"$vm_domainname"'/ \
@@ -196,9 +188,10 @@ rule_postfix_key_send () {
                 /etc/postfix/'"$vm_domainname"'/smtpd/x509/.gitignore <<-EOF
                        key.pem
                        EOF
+               install -m 400 -o root -g root \
+                /dev/stdin \
+                /etc/postfix/'"'$vm_domainname'"'/smtpd/x509/key.pem
         '
-       rule _x509_service_key_send_deciphered smtpd \
-        /etc/postfix/$vm_domainname/smtpd/x509/key.pem -l root "$@"
  }
 
 rule=${1:-help}