X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=1ffd17654001188654ccc4cb84589633e9515b1e;hp=df9e3481a4f3d614116d9797bc3c2d94f6be2333;hb=a5a85db110bc4840b9806773b4b6e79298117ce4;hpb=4856433be903ee078c1da1e4b7491968e66f6461 diff --git a/vm_hosted b/vm_hosted index df9e348..1ffd176 100755 --- a/vm_hosted +++ b/vm_hosted @@ -46,7 +46,10 @@ rule_git_reset () { } rule_apt_get_install () { # SYNTAX: $package - sudo apt-get install "$@" + sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@" + } +rule_dpkg_reconfigure () { # SYNTAX: $package + sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@" } rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? @@ -268,7 +271,10 @@ rule_apt_configure () { EOF } rule_boot_configure () { - warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" + #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" + sudo debconf-set-selections <<-EOF + grub-pc grub-pc/install_devices multiselect + EOF rule apt_get_install grub-pc sudo install -d -m 644 -o root -g root /boot/grub rule apt_get_install linux-image-$vm_arch @@ -287,6 +293,13 @@ rule_boot_configure () { EOF sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map rule initramfs_configure + rule apt_get_install molly-guard + sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF + ALWAYS_QUERY_HOSTNAME=true + # NOTE: une alternative est de dire à sudo de conserver les SSH_* + # néamoins demander tout le temps n'est pas trop contraignant + # et davantage sécurisant. + EOF } rule_dovecot_configure () { rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve @@ -390,7 +403,6 @@ rule_filesystem_configure () { LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0 proc /proc proc defaults 0 0 sysfs /sys sysfs defaults 0 0 - tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0 /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0 @@ -404,6 +416,24 @@ rule_filesystem_configure () { ${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF + LOCK_SIZE=5242880 # NOTE: 5MiB + RAMLOCK=yes + RAMSHM=yes + RAMTMP=yes + RUN_SIZE=10% + SHM_SIZE= + TMP_MODE=1777,nr_inodes=1000k,noatime + TMP_OVERFLOW_LIMIT=1024 + # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB) + # on the root filesystem (overriding RAMTMP). + TMP_SIZE=200m + TMPFS_SIZE=20%VM + EOF + sudo install -m 775 -o root -g root \ + "$tool"/etc/init.d/tmpfs \ + /etc/init.d/tmpfs + sudo update-rc.d tmpfs defaults } rule_initramfs_configure () { sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF @@ -463,30 +493,14 @@ rule_initramfs_configure () { # NOTE: clefs générées par Debian sudo update-initramfs -u } -rule_time_configure () { - sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF - Europe/Paris - EOF - sudo dpkg-reconfigure tzdata - rule apt_get_install ntp - } rule_locale_configure () { - sudo install -m 644 -o root -g root /dev/stdin /etc/locale.gen <<-EOF - fr_FR.UTF-8 UTF-8 + sudo debconf-set-selections <<-EOF + locales locales/default_environment_locale select None + locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8 EOF - sudo update-locale + rule dpkg_reconfigure locales } rule_login_configure () { - grep -q '^hvc0$' /etc/securetty || - sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF - $(cat /etc/securetty) - hvc0 - EOF - grep -q '^xvc0$' /etc/securetty || - sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF - $(cat /etc/securetty) - xvc0 - EOF sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF # /etc/inittab: init(8) configuration. @@ -572,6 +586,16 @@ rule_login_configure () { $(cat /etc/pam.d/common-session) session optional pam_umask.so EOF + grep -q '^hvc0$' /etc/securetty || + sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF + $(cat /etc/securetty) + hvc0 + EOF + grep -q '^xvc0$' /etc/securetty || + sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF + $(cat /etc/securetty) + xvc0 + EOF } rule_mail_configure () { rule postfix_configure @@ -847,7 +871,10 @@ rule_php5_fpm_configure () { rule_postfix_configure () { local hint="run vm_remote postfix_key_send before" assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint - warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix" + #warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix" + sudo debconf-set-selections <<-EOF + postfix postfix/main_mailer_type select No configuration + EOF rule apt_get_install postfix sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF *.db @@ -1010,10 +1037,21 @@ rule_sysctl_configure () { do conf=${conf#"$tool"/etc/sysctl.d/} sudo install -m 660 -o root -g root \ "$tool"/etc/sysctl.d/"$conf" \ - /etc/sysctl.d/"$conf" + /etc/sysctl.d/"$conf" done sudo sysctl --system } +rule_time_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF + Europe/Paris + EOF + sudo debconf-set-selections <<-EOF + tzdata tzdata/Areas select Europe + tzdata tzdata/Zones/Europe select Paris + EOF + rule dpkg_reconfigure tzdata + rule apt_get_install ntp + } rule_user_add () { # SYNTAX: $user rule user_configure local user=$1