X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=1ffd17654001188654ccc4cb84589633e9515b1e;hp=3fa1ea8a9dad7111b816c1d770195c495523bcf8;hb=a5a85db110bc4840b9806773b4b6e79298117ce4;hpb=86b63d97ad5491f85ba3b10cd406e963778bac1e

diff --git a/vm_hosted b/vm_hosted
index 3fa1ea8..1ffd176 100755
--- a/vm_hosted
+++ b/vm_hosted
@@ -46,7 +46,10 @@ rule_git_reset () {
  }
 
 rule_apt_get_install () { # SYNTAX: $package
-	sudo apt-get install "$@"
+	sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@"
+ }
+rule_dpkg_reconfigure () { # SYNTAX: $package
+	sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@"
  }
 
 rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ?
@@ -268,7 +271,10 @@ rule_apt_configure () {
 		EOF
  }
 rule_boot_configure () {
-	warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
+	#warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !"
+	sudo debconf-set-selections <<-EOF
+		grub-pc	grub-pc/install_devices	multiselect	
+		EOF
 	rule apt_get_install grub-pc
 	sudo install -d -m 644 -o root -g root /boot/grub
 	rule apt_get_install linux-image-$vm_arch
@@ -287,13 +293,20 @@ rule_boot_configure () {
 		EOF
 	sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map
 	rule initramfs_configure
+	rule apt_get_install molly-guard
+	sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF
+		ALWAYS_QUERY_HOSTNAME=true
+		 # NOTE: une alternative est de dire à sudo de conserver les SSH_*
+		 #       néamoins demander tout le temps n'est pas trop contraignant
+		 #       et davantage sécurisant.
+		EOF
  }
 rule_dovecot_configure () {
 	rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve
 	local hint="run vm_remote dovecot_key_send before"
-	assert "test -f /etc/dovecot/$vm_domainname/imap/x509/key.pem" hint
+	assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint
 	sudo install -m 400 -o root -g root \
-	     "$tool"/var/pub/x509/service/imap/crt+crl.self-signed.pem \
+	     "$tool"/var/pub/x509/$vm_domainname/imap/crt+crl.self-signed.pem \
 	 /etc/dovecot/$vm_domainname/imap/x509/crt+crl.self-signed.pem
 	sudo install -d -m 770 -o root -g adm \
 	 /etc/skel/etc/mail \
@@ -390,7 +403,6 @@ rule_filesystem_configure () {
 		LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0
 		proc /proc proc defaults 0 0
 		sysfs /sys sysfs defaults 0 0
-		tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0
 		/dev/mapper/${vm_lvm_lv}_root_deciphered /     ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
 		/dev/mapper/${vm_lvm_lv}_var_deciphered  /var  ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1
 		/dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0
@@ -404,10 +416,24 @@ rule_filesystem_configure () {
 		${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
 		${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived
 		EOF
-	sudo install -m 644 -o root -g root /dev/stdin /etc/sysctl.d/local-swap.conf <<-EOF
-		vm.swappiness = 10 # NOTE: n'utilise le swap qu'en cas d'absolue nécessité
-		vm.vfs_cache_pressure=50
+	sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF
+		LOCK_SIZE=5242880 # NOTE: 5MiB
+		RAMLOCK=yes
+		RAMSHM=yes
+		RAMTMP=yes
+		RUN_SIZE=10%
+		SHM_SIZE=
+		TMP_MODE=1777,nr_inodes=1000k,noatime
+		TMP_OVERFLOW_LIMIT=1024
+		 # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB)
+		 #       on the root filesystem (overriding RAMTMP).
+		TMP_SIZE=200m
+		TMPFS_SIZE=20%VM
 		EOF
+	sudo install -m 775 -o root -g root \
+	 "$tool"/etc/init.d/tmpfs \
+	        /etc/init.d/tmpfs
+	sudo update-rc.d tmpfs defaults
  }
 rule_initramfs_configure () {
 	sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF
@@ -467,30 +493,14 @@ rule_initramfs_configure () {
 	 # NOTE: clefs générées par Debian
 	sudo update-initramfs -u
  }
-rule_time_configure () {
-	sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
-		Europe/Paris
-		EOF
-	sudo dpkg-reconfigure tzdata
-	rule apt_get_install ntp
- }
 rule_locale_configure () {
-	sudo install -m 644 -o root -g root /dev/stdin /etc/locale.gen <<-EOF
-		fr_FR.UTF-8 UTF-8
+	sudo debconf-set-selections <<-EOF
+		locales	locales/default_environment_locale	select	None
+		locales	locales/locales_to_be_generated	multiselect	fr_FR.UTF-8 UTF-8
 		EOF
-	sudo update-locale
+	rule dpkg_reconfigure locales
  }
 rule_login_configure () {
-	grep -q '^hvc0$' /etc/securetty ||
-	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
-		$(cat /etc/securetty)
-		hvc0
-		EOF
-	grep -q '^xvc0$' /etc/securetty ||
-	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
-		$(cat /etc/securetty)
-		xvc0
-		EOF
 	sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF
 		# /etc/inittab: init(8) configuration.
 		
@@ -576,6 +586,16 @@ rule_login_configure () {
 		$(cat /etc/pam.d/common-session)
 		session optional pam_umask.so
 		EOF
+	grep -q '^hvc0$' /etc/securetty ||
+	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+		$(cat /etc/securetty)
+		hvc0
+		EOF
+	grep -q '^xvc0$' /etc/securetty ||
+	sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF
+		$(cat /etc/securetty)
+		xvc0
+		EOF
  }
 rule_mail_configure () {
 	rule postfix_configure
@@ -624,10 +644,237 @@ rule_network_configure () {
 		    pre-down  ip address delete $vm_ipv4/32 dev \$IFACE
 		EOF
  }
+rule_www_configure () {
+	getent passwd www >/dev/null ||
+	sudo adduser \
+	 --disabled-login \
+	 --disabled-password \
+	 --group \
+	 --home /home/www \
+	 --shell /bin/false \
+	 --system \
+	 www
+	sudo adduser \
+	 --disabled-login \
+	 --disabled-password \
+	 --group \
+	 --home ~www/log \
+	 --shell /bin/false \
+	 --system \
+	 log.www
+	#sudo adduser www www-data
+	sudo adduser www log.www
+	#sudo adduser log log.www
+	usermod --home /home/www/pub www-data
+	sudo install -d -m 751 -o www -g www \
+	 /home/www
+	sudo install -d -m 750 -o www -g www \
+	 /home/www/etc
+	sudo install -d -m 1771 -o www-data -g www-data \
+	 /home/www/pub \
+	sudo install -d -m 1771 -o log.www -g log.www \
+	 /home/www/log
+ }
+rule_nginx_configure () {
+	local -; set +f
+	rule apt_get_install nginx
+	rule www_configure
+	sudo rm -rf \
+	 /etc/nginx/conf.d \
+	 /etc/nginx/site.d
+	sudo install -d -m 770 -o www -g www \
+	 /etc/nginx \
+	 /etc/nginx/conf.d \
+	 /etc/nginx/site.d
+	sudo ln -fns \
+	 /etc/nginx \
+	 /home/www/etc/nginx
+	sudo install -m 660 -o www -g www \
+	 "$tool"/etc/nginx/nginx.conf \
+	        /etc/nginx/nginx.conf
+	local conf
+	for conf in "$tool"/etc/nginx/conf.d/*.conf
+	 do conf=${conf#"$tool"/etc/nginx/conf.d/}
+		sudo install -m 660 -o www -g www \
+		 "$tool"/etc/nginx/conf.d/"$conf" \
+		        /etc/nginx/conf.d/"$conf"
+	 done
+	for conf in "$tool"/etc/nginx/site.d/*/server.conf
+	 do conf=${conf#"$tool"/etc/nginx/site.d/}
+		local port site
+		IFS=. read -r port site <<-EOF
+			${conf%\/server\.conf}
+			EOF
+		assert 'test "${port:+set}"'
+		assert 'test "${site:+set}"'
+		site="$port.$site"
+		getent passwd www."$site" >/dev/null ||
+		sudo adduser \
+		 --disabled-login \
+		 --disabled-password \
+		 --group \
+		 --home ~www-data/"$site" \
+		 --shell /bin/false \
+		 --system \
+		 www."$site"
+		getent passwd log."$site" >/dev/null ||
+		sudo adduser \
+		 --disabled-login \
+		 --disabled-password \
+		 --group \
+		 --shell /bin/false \
+		 --system \
+		 log."$site"
+		sudo usermod --home ~www/log/"$site"/nginx log."$site"
+		sudo install -d -m 770 -o www -g www \
+		 /etc/nginx/site.d/"$site"
+		case $port in
+		 (443)
+			local hint="run vm_remote nginx_key_send before"
+			assert "sudo test -f /etc/nginx/\"$site\"/x509/key.pem" hint
+			sudo install -m 664 -o www -g www \
+			 "$tool"/var/pub/x509/"$site"/crt+ca.pem \
+			 /etc/nginx/site.d/"$site"/x509/crt.pem
+			;;
+		 esac
+		case $port in
+		 (80)
+			cat <<-EOF
+				server {
+					listen $port;
+					access_log /home/www/log/$site/nginx/access.log main;
+					error_log  /home/www/log/$site/nginx/error.log warn;
+					root /home/www/pub/$site;
+					server_name $site;
+					$(cat "$tool"/etc/nginx/site.d/"$site"/server.conf)
+				 }
+				EOF
+			;;
+		 (443)
+			cat <<-EOF
+				server {
+					listen $port;
+					access_log /home/www/log/$site/nginx/access.log main;
+					error_log  /home/www/log/$site/nginx/error.log warn;
+					keepalive_timeout 70;
+					root /home/www/pub/$site;
+					server_name $site;
+					# DOC: http://wiki.nginx.org/HttpSslModule
+					ssl on;
+					ssl_certificate     /home/www/etc/nginx/site.d/$site/x509/crt.pem;
+					ssl_certificate_key /home/www/etc/nginx/site.d/$site/x509/key.pem;
+					ssl_ciphers HIGH:!ADH:!MD5;
+					ssl_prefer_server_ciphers on;
+					ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+					ssl_session_cache shared:SSL:10m;
+					$(cat "$tool"/etc/nginx/site.d/"$site"/server.conf)
+				 }
+				EOF
+			;;
+		 esac |
+		sudo install -m 660 -o www -g www /dev/stdin \
+		 /etc/nginx/site.d/"$site"/server.conf
+		adduser www-data "$site"
+		test -e /home/www/pub/"$site" ||
+		sudo install -d -m 3770 -o "$site" -g "$site" \
+		 /home/www/pub/"$site"
+		sudo install -d -m 3770 -o log."$site" -g log."$site" \
+		 /home/www/log/"$site"/nginx
+		test ! -r "$tool"/etc/nginx/site.d/"$site"/configure.sh ||
+		.         "$tool"/etc/nginx/site.d/"$site"/configure.sh
+	 done
+	rule apt_get_install spawn-fcgi fcgiwrap
+	sudo insserv --remove fcgiwrap
+	rule tmpfs_configure
+	sudo service nginx restart
+ }
+rule_php5_fpm_configure () {
+	local -; set +f
+	rule apt_get_install \
+	 php5-fpm \
+	 php-apc
+	getent passwd php5 >/dev/null ||
+	sudo adduser \
+	 --disabled-login \
+	 --disabled-password \
+	 --group \
+	 --shell /bin/false \
+	 --system \
+	 php5
+	local conf
+	sudo ln -fns \
+	 /etc/php5-fpm \
+	 /home/www/etc/php5
+	sudo rm -f /etc/php5/fpm/pool.d/*
+	for conf in "$tool"/etc/php5/fpm/pool.d/*.conf
+	 do conf=${conf#"$tool"/etc/php5/fpm/pool.d/}
+		local port site
+		IFS=. read -r port site <<-EOF
+			${conf%\.conf}
+			EOF
+		assert 'test "${port:+set}"'
+		assert 'test "${site:+set}"'
+		site="$port.$site"
+		getent passwd php5"$site" >/dev/null ||
+		sudo adduser \
+		 --disabled-login \
+		 --disabled-password \
+		 --group \
+		 --no-create-home \
+		 --home ~www/pub/"$site" \
+		 --shell /bin/false \
+		 --system \
+		 php5."$site"
+		sudo install -d -m 770 -o php5 -g php5 \
+		 /home/www/log/php5 \
+		 /home/www/log/php5/fpm
+		sudo install -d -m 770 -o log."$site" -g log."$site" \
+		 /home/www/log/"$site"
+		sudo adduser php5."$user" www."$site"
+		sudo install -m 660 -o root -g root /dev/stdin \
+		 /etc/php5/fpm/pool.d/"$conf" <<-EOF
+			[php5.$site]
+			access.log = /home/www/log/$site/php5/fpm/access.log
+			catch_workers_output = yes
+			chdir = /
+			env[HOSTNAME] = \$HOSTNAME
+			env[TEMP] = /tmp
+			env[TMPDIR] = /tmp
+			env[TMP] = /tmp
+			group = www-data
+			listen = /run/nginx/fastcgi/php5.$site
+			#listen = 127.0.0.1:9000
+			#listen.allowed_clients = 127.0.0.1
+			listen.backlog = -1
+			pm = dynamic
+			pm.max_children = 5
+			pm.max_requests = 200
+			pm.max_spare_servers = 4
+			pm.min_spare_servers = 2
+			pm.start_servers = 3
+			pm.status_path = /status
+			request_slowlog_timeout = 5s
+			request_terminate_timeout = 120s
+			rlimit_core = unlimited
+			rlimit_files = 131072
+			slowlog = /home/www/log/$site/php5/fpm/slow.log
+			user = $php5_user
+			$(cat "$tool"/etc/php5/fpm/pool.d/"$conf")
+			EOF
+		sudo install -m 664 -o root -g root \
+		 "$tool"/etc/php5/fpm/php.ini \
+		        /etc/php5/fpm/php.ini
+	 done
+	rule tmpfs_configure
+	sudo service php5-fpm restart
+ }
 rule_postfix_configure () {
 	local hint="run vm_remote postfix_key_send before"
 	assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint
-	warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix"
+	#warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix"
+	sudo debconf-set-selections <<-EOF
+		postfix	postfix/main_mailer_type	select	No configuration
+		EOF
 	rule apt_get_install postfix
 	sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF
 		*.db
@@ -652,16 +899,16 @@ rule_postfix_configure () {
 	 ../crt+crl.self-signed.pem \
 	 /etc/postfix/$vm_domainname/smtpd/x509/ca/crt.pem
 	sudo install -m 400 -o root -g root \
-	     "$tool"/var/pub/x509/service/smtpd/crt+crl.self-signed.pem \
+	     "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+crl.self-signed.pem \
 	 /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem
 	sudo install -m 400 -o root -g root \
-	     "$tool"/var/pub/x509/service/smtpd/crt.pem \
+	     "$tool"/var/pub/x509/$vm_domainname/smtpd/crt.pem \
 	 /etc/postfix/$vm_domainname/smtpd/x509/crt.pem
 	sudo install -m 400 -o root -g root \
-	     "$tool"/var/pub/x509/service/smtpd/crt+root.pem \
-	 /etc/postfix/$vm_domainname/smtpd/x509/crt+root.pem
+	     "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+ca.pem \
+	 /etc/postfix/$vm_domainname/smtpd/x509/crt+ca.pem
 	sudo install -m 400 -o root -g root \
-	     "$tool"/var/pub/x509/service/smtpd/crt+crl.self-signed.pem \
+	     "$tool"/var/pub/x509/$vm_domainname/smtpd/crt+crl.self-signed.pem \
 	 /etc/postfix/$vm_domainname/smtpd/x509/crt+crl.self-signed.pem
 	sudo install -m 660 -o root -g root \
 	 "$tool"/etc/postfix/$vm_domainname/header_checks \
@@ -784,19 +1031,60 @@ rule_ssh_configure () {
 		EOF
 	sudo service ssh restart
  }
-rule_user_admin_add () { # SYNTAX: $user
+rule_sysctl_configure () {
+	local -; set +f
+	for conf in "$tool"/etc/sysctl.d/*.conf
+	 do conf=${conf#"$tool"/etc/sysctl.d/}
+		sudo install -m 660 -o root -g root \
+		 "$tool"/etc/sysctl.d/"$conf" \
+		        /etc/sysctl.d/"$conf"
+	 done
+	sudo sysctl --system
+ }
+rule_time_configure () {
+	sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
+		Europe/Paris
+		EOF
+	sudo debconf-set-selections <<-EOF
+		tzdata	tzdata/Areas	select	Europe
+		tzdata	tzdata/Zones/Europe	select	Paris
+		EOF
+	rule dpkg_reconfigure tzdata
+	rule apt_get_install ntp
+ }
+rule_user_add () { # SYNTAX: $user
+	rule user_configure
 	local user=$1
 	id "$user" >/dev/null ||
 	sudo adduser --disabled-password "$user"
 		# NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
 	eval local home\; home="~$user"
+	sudo adduser "$user" users
+	sudo install -m 640 -o root -g root \
+	 "$tool"/var/pub/ssh/"$user".key \
+	 "$home"/etc/ssh/authorized_keys
+	local key; local -; set +f
+	for key in "$tool"/var/pub/openpgp/*.key
+	 do sudo -u "$user" gpg --import - <"$key"
+	 done
+ }
+rule_user_configure () {
+	true
+ }
+rule_user_admin_add () { # SYNTAX: $user
+	rule user_configure
+	local user=$1
+	id "$user" >/dev/null ||
+	sudo adduser --disabled-password "$user"
+	eval local home\; home="~$user"
 	sudo adduser "$user" sudo
+	sudo adduser "$user" users
 	sudo install -m 640 -o root -g root \
 	 "$tool"/var/pub/ssh/"$user".key \
 	 "$home"/etc/ssh/authorized_keys
 	local key; local -; set +f
 	for key in "$tool"/var/pub/openpgp/*.key
-	 do sudo -u "$user" gpg --import "$key"
+	 do sudo -u "$user" gpg --import - <"$key"
 	 done
 	rule user_admin_configure
  }
@@ -807,12 +1095,14 @@ rule_user_admin_configure () {
 rule_user_configure () {
 	sudo install -d -m 750 -o root -g adm \
 	 /etc/skel/etc \
+	 /etc/skel/etc/gpg \
 	 /etc/skel/etc/ssh
 	sudo install -d -m 770 -o root -g adm \
 	 /etc/skel/var \
-	 /etc/skel/var/log \
 	 /etc/skel/var/cache \
-	 /etc/skel/var/cache/ssh
+	 /etc/skel/var/log \
+	 /etc/skel/var/run \
+	 /etc/skel/var/run/ssh
 	sudo ln -fns etc/ssh /etc/skel/.ssh
 	sudo ln -fns etc/gpg /etc/skel/.gnupg
 	sudo install -m 640 -o root -g root /dev/stdin /etc/sudoers.d/passwd-init <<-EOF
@@ -848,8 +1138,8 @@ rule_user_configure () {
 rule_user_root_configure () {
 	sudo install -d -m 750 -o root -g adm \
 	 /root/etc \
-	 /root/etc/ssh \
-	 /root/etc/gpg
+	 /root/etc/gpg \
+	 /root/etc/ssh
 	sudo ln -fns etc/gpg /root/.gnupg
 	sudo ln -fns etc/ssh /root/.ssh
 	getent group sudo |
@@ -877,11 +1167,14 @@ rule_configure () {
 	rule filesystem_configure
 	rule login_configure
 	rule ssh_configure
-	rule mail_configure
-	rule apache2_configure
 	rule user_root_configure
 	rule boot_configure
+	rule sysctl_configure
 	rule user_configure
+	rule mail_configure
+	#rule apache2_configure
+	rule nginx_configure
+	rule php5_fpm_configure
  }
 
 rule_luks_key_change () {