X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=ed42445f9fd41537e00370ca956452b3593a2609;hp=4bfbede44076542ac2409aacea22e7eba82d34b0;hb=7343218cce2a1d7845ab90df70ad894ba9e5b79a;hpb=9447dd1f7837e04e0ec922df4b47174b38801874 diff --git a/vm_hosted b/vm_hosted index 4bfbede..ed42445 100755 --- a/vm_hosted +++ b/vm_hosted @@ -8,6 +8,7 @@ tool=${tool%/*} . "$tool"/lib/rule.sh . "$tool"/etc/vm.sh export TRACE=1 +cd / rule_help () { # SYNTAX: [--hidden] local hidden; [ ${1:+set} ] || hidden=set @@ -34,9 +35,7 @@ rule_git_configure () { git config --replace branch.master.merge refs/remotes/master local tool tool=$(cd "$tool"; cd -) - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/ - sudo ln -fns "$tool"/vm_hosted /usr/local/sbin/vm - sudo install -m 770 /dev/stdin .git/hooks/post-update <<-EOF + install -m 770 /dev/stdin .git/hooks/post-update <<-EOF #!/bin/sh -efux case \$1 in (refs/remotes/master) @@ -62,7 +61,7 @@ rule_adduser () { sudo adduser "$@" "$user" } rule_apt_get_install () { # SYNTAX: $package - sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@" + sudo DEBIAN_FRONTEND=noninteractive apt-get install --yes "$@" } rule_dpkg_reconfigure () { # SYNTAX: $package sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@" @@ -74,7 +73,7 @@ rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? . /etc/profile } -rule_apache2_configure () { +rule_apache2_configure () { # XXX: cette règle n'est pas testée/mise-à-jour local -; set +f rule apt_get_install \ apache2-mpm-itk \ @@ -245,40 +244,27 @@ rule_apache2_configure () { } rule_apt_configure () { sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list <<-EOF - deb http://ftp.fr.debian.org/debian $vm_lsb_name main contrib non-free + deb http://ftp.rezopole.net/debian $vm_lsb_name main EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/$vm_lsb_name-backports.list <<-EOF - #deb http://backports.debian.org/debian-backports $vm_lsb_name-backports main contrib non-free + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/$vm_lsb_name-backports.list <<-EOF + deb http://ftp.rezopole.net/debian $vm_lsb_name-backports main EOF sudo install -m 660 -o root -g root /dev/stdin /etc/apt/preferences <<-EOF Package: * Pin: release a=$vm_lsb_name - Pin-Priority: 170 + Pin-Priority: 200 Package: * Pin: release a=$vm_lsb_name-backports - Pin-Priority: 200 + Pin-Priority: 170 EOF sudo apt-get update rule apt_get_install apticron - sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF - EMAIL="admin@$vm_domainname" - # DIFF_ONLY="1" - # LISTCHANGES_PROFILE="apticron" - # ALL_FQDNS="1" - # SYSTEM="foobar.example.com" - # IPADDRESSNUM="1" - # IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1" - # NOTIFY_HOLDS="0" - # NOTIFY_NEW="0" - # NOTIFY_NO_UPDATES="0" - # CUSTOM_SUBJECT="" - # CUSTOM_NO_UPDATES_SUBJECT="" - # CUSTOM_FROM="root@$vm_fqdn" - EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/apt.conf.d/01proxy-grenode <<-EOF - Acquire::http::Proxy "http://outils.grenode.net:3142"; - EOF + m4 \ + --define=VM_DOMAINNAME=$vm_domainname \ + <"$tool"/etc/apticron/apticron.conf.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/apticron/apticron.conf } rule_boot_configure () { #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" @@ -313,6 +299,7 @@ rule_boot_configure () { } rule_dovecot_configure () { rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve + rule insserv_remove dovecot local hint="run vm_remote dovecot_key_send before" assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint sudo install -m 400 -o root -g root \ @@ -324,62 +311,11 @@ rule_dovecot_configure () { sudo install -d -m 1777 -o root -g root \ /var/lib/dovecot-control \ /var/lib/dovecot-index - sudo install -m 664 -o root -g root /dev/stdin /etc/dovecot/local.conf <<-EOF - auth_ssl_username_from_cert = yes - listen = * - log_timestamp = "%Y-%m-%d %H:%M:%S " - mail_debug = yes - mail_location = maildir:~/var/mail:INDEX=/var/lib/dovecot-index/%u:CONTROL=/var/lib/dovecot-control/%u - # NOTE: INDEX et CONTROL sont sur une partition sans quota comme le demande la doc - # VOIR: http://wiki2.dovecot.org/Quota/FS - mail_plugins = \$mail_plugins quota - mail_privileged_group = mail - passdb { - args = /home/%u/etc/dovecot/passwd - driver = passwd-file - } - plugin { - quota = fs:user - recipient_delimiter = + - sieve = ~/etc/mail/filter.sieve - sieve_dir = ~/etc/mail/sieve - sieve_global_dir = /var/lib/dovecot/sieve/global/ - sieve_max_script_size = 1M - sieve_quota_max_scripts = 0 - sieve_quota_max_storage = 10M - sieve_user_log = ~/var/log/mail/sieve.log - } - protocol imap { - mail_plugins = \$mail_plugins imap_quota - } - protocol lda { - auth_socket_path = /var/run/dovecot/auth-master - hostname = $vm_domainname - info_log_path = - log_path = - mail_plugins = \$mail_plugins sieve - postmaster_address = contact+dovecot+lda@$vm_domainname - syslog_facility = mail - } - protocols = imap sieve - service auth { - user = root - unix_listener /var/spool/postfix/private/auth { - mode = 0660 - user = postfix - group = postfix - } - } - ssl_ca = - LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0 - proc /proc proc defaults 0 0 - sysfs /sys sysfs defaults 0 0 - /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 - /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0 - # NOTE: barrier=1 réduit drastiquement les performances d'écriture, mais garantit la cohérence du système de fichiers. - /dev/mapper/${vm_lvm_lv}_swap_deciphered swap swap sw 0 0 - EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/crypttab <<-EOF - # - ${vm_lvm_lv}_root_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_root none luks,lvm=$vm_lvm_vg - ${vm_lvm_lv}_var_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_var ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - ${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - ${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived - EOF + m4 \ + --define=VM_LVM_LV=$vm_lvm_lv \ + --define=VM_LVM_VG=$vm_lvm_vg \ + <"$tool"/etc/fstab.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/fstab + m4 \ + --define=VM_LVM_LV=$vm_lvm_lv \ + --define=VM_LVM_VG=$vm_lvm_vg \ + <"$tool"/etc/crypttab.m4 | + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/crypttab rule tmpfs_configure } rule_initramfs_configure () { @@ -475,10 +404,11 @@ rule_initramfs_configure () { $users EOF do eval local home\; home="~$user" - cat "$home"/etc/ssh/authorized_keys + sudo cat "$home"/etc/ssh/authorized_keys done done | - sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/root/.ssh/authorized_keys + sudo install -m 644 -o root -g root /dev/stdin \ + /etc/initramfs-tools/root/.ssh/authorized_keys sudo rm -f \ /etc/initramfs-tools/root/.ssh/id_rsa.dropbear \ /etc/initramfs-tools/root/.ssh/id_rsa.pub \ @@ -486,6 +416,13 @@ rule_initramfs_configure () { # NOTE: clefs générées par Debian sudo update-initramfs -u } +rule_insserv_remove () { # SYNTAX: $sv + local sv="$1" + sudo chmod u+x /etc/init.d/"$sv" + sudo insserv --force --remove "$sv" + sudo /etc/init.d/"$sv" stop + sudo chmod ugo-x /etc/init.d/"$sv" + } rule_gitolite_configure () { sudo debconf-set-selections <<-EOF gitolite gitolite/gituser string git @@ -507,48 +444,29 @@ rule_gitolite_configure () { --home /home/git/log \ --shell /bin/false \ --system - rule adduser git-data\ + rule adduser git-data \ --disabled-login \ --disabled-password \ --group \ --home /home/git/pub \ --shell /bin/false \ --system - rule adduser git-daemon\ - --disabled-login \ - --disabled-password \ - --group \ - --home /home/git/pub \ - --shell /bin/false \ - --system - rule adduser log-git-daemon\ - --disabled-login \ - --disabled-password \ - --group \ - --home /home/git/log/git-daemon \ - --shell /bin/false \ - --system sudo adduser git git-data - sudo adduser git-daemon git-data - sudo adduser log-git log-git-daemon - sudo install -d -m 770 -o git -g git \ + sudo install -d -m 750 -o git -g git \ /etc/gitolite \ /home/git/etc \ /home/git/etc/ssh sudo install -d -m 751 -o git -g git \ /home/git - sudo install -d -m 3771 -o git-data -g git-data \ + sudo install -d -m 2770 -o git-data -g git-data \ /home/git/pub sudo install -d -m 1771 -o git -g git \ /home/git/log sudo install -d -m 2770 -o git -g log-git \ /home/git/log/gitolite \ /home/git/log/gitolite/perf - sudo install -d -m 770 -o log-git-daemon -g log-git-daemon \ - /home/git/log/git-daemon - sudo install -d -m 550 -o www-lhc-git -g www-lhc-git \ - /etc/gitweb \ - /etc/gitweb/cgi + sudo install -d -m 3771 -o git -g git \ + /home/git/hooks sudo ln -fns /etc/gitolite /home/git/etc/gitolite sudo ln -fns /etc/gitweb /home/git/etc/gitweb sudo ln -fns etc/gitolite/gitolite.rc /home/git/.gitolite.rc @@ -569,7 +487,7 @@ rule_gitolite_configure () { \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf"; \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm"; #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups" - \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*"; + \$GL_GITCONFIG_KEYS = "gitweb\\..* hooks\\..*"; #\$GL_HOSTNAME = "git.$vm_domainname"; # NOTE: read doc/mirroring.mkd COMPLETELY before setting this. #\$GL_HTTP_ANON_USER = "mob"; @@ -589,7 +507,7 @@ rule_gitolite_configure () { #\$GL_WILDREPOS_DEFPERMS = 'R @all'; \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS"; \$HTPASSWD_FILE = ""; - \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list"; + \$PROJECTS_LIST = \$ENV{HOME} . "/etc/gitweb/projects.list"; \$REPO_BASE = "pub"; \$REPO_UMASK = 0007; \$RSYNC_BASE = ""; @@ -598,40 +516,9 @@ rule_gitolite_configure () { \$WEB_INTERFACE = "gitweb"; 1; EOF - sudo install -m 740 -o git -g www-lhc-git /dev/stdin \ - /home/git/etc/gitweb/gitweb.conf <<-EOF - \$commit_oneline_message_width = 70; - \$default_projects_order = 'age'; - \$default_text_plain_charset = 'UTF-8'; - @diff_opts = (); - \$favicon = "img/git-favicon.png"; - \$git_temp = "/run/shm/tmp/gitweb"; - \$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc"; - \$home_header = "/etc/gitweb/cgi/home-header.cgi.inc"; - \$home_link = "/"; - \$home_link_str = 'dépôts'; - \$home_th_age = 'activité'; - \$home_th_descr = 'description'; - \$home_th_owner = 'contact'; - \$home_th_project = 'dépôt'; - \$javascript = "js/gitweb.js"; - \$logo = "img/git-logo.png"; - \$my_uri = ""; - \$projectroot = "../git"; - \$projects_list = "/etc/gitolite/projects.list"; - \$projects_list_description_width = 42; - \$projects_list_owner_width = 15; - \$search_str = "Filtre :"; - \$site_footer = "/etc/gitweb/cgi/site-footer.bin"; - \$site_header = undef; - \$site_name = "git.$vm_domainname"; - \$space_to_nbsp = 0; - @stylesheets = ("css/gitweb.css");# - \$untabify_tabstop = 2; - EOF sudo install -m 600 -o git -g git \ "$tool"/var/pub/ssh/git.key \ - /home/git/etc/ssh/git.pub + /home/git/etc/ssh/git.pub sudo -u git \ GL_RC=/home/git/etc/gitolite/gitolite.rc \ GIT_AUTHOR_NAME=git \ @@ -641,8 +528,7 @@ rule_gitolite_configure () { do test ! -d /home/git/etc/gitolite/"$d" || rmdir /home/git/etc/gitolite/"$d" done - rule apt_get_install gitweb highlight - sudo service tmpfs restart + rule tmpfs_configure } rule_locales_configure () { sudo debconf-set-selections <<-EOF @@ -652,90 +538,12 @@ rule_locales_configure () { rule dpkg_reconfigure locales } rule_login_configure () { - sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF - # /etc/inittab: init(8) configuration. - - # The default runlevel. - id:2:initdefault: - - # Boot-time system configuration/initialization script. - # This is run first except when booting in emergency (-b) mode. - si::sysinit:/etc/init.d/rcS - - # What to do in single-user mode. - ~~:S:wait:/sbin/sulogin - - # /etc/init.d executes the S and K scripts upon change - # of runlevel. - # - # Runlevel 0 is halt. - # Runlevel 1 is single-user. - # Runlevels 2-5 are multi-user. - # Runlevel 6 is reboot. - - l0:0:wait:/etc/init.d/rc 0 - l1:1:wait:/etc/init.d/rc 1 - l2:2:wait:/etc/init.d/rc 2 - l3:3:wait:/etc/init.d/rc 3 - l4:4:wait:/etc/init.d/rc 4 - l5:5:wait:/etc/init.d/rc 5 - l6:6:wait:/etc/init.d/rc 6 - # Normally not reached, but fallthrough in case of emergency. - z6:6:respawn:/sbin/sulogin - - # What to do when CTRL-ALT-DEL is pressed. - ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now - - # What to do when the power fails/returns. - pf::powerwait:/etc/init.d/powerfail start - pn::powerfailnow:/etc/init.d/powerfail now - po::powerokwait:/etc/init.d/powerfail stop - - # Xen hypervisor console - hvc:2345:respawn:/sbin/getty 38400 hvc0 - #xvc:2345:respawn:/sbin/getty 38400 xvc0 - - #-- runit begin - SV:123456:respawn:/usr/sbin/runsvdir-start - #-- runit end - EOF - sudo install -m 644 -o root -g root /dev/stdin /etc/login.defs <<-EOF - MAIL_DIR /var/mail - FAILLOG_ENAB yes - LOG_UNKFAIL_ENAB no - LOG_OK_LOGINS no - SYSLOG_SU_ENAB yes - SYSLOG_SG_ENAB yes - FTMP_FILE /var/log/btmp - SU_NAME su - HUSHLOGIN_FILE .hushlogin - ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - ENV_PATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - # NOTE: met les sbin/ dans ENV_PATH ; - # - ça n'apporte aucune protection de ne pas les mettre ; - # - ça frustre de ne pas les trouver. - TTYGROUP tty - TTYPERM 0600 - ERASECHAR 0177 - KILLCHAR 025 - UMASK 007 - # NOTE: rwxrwx--- ; - # - donne une même confiance au groupe propriétaire qu'au propriétaire ; - # - facilite l'utilisation des ACL, qui sont dépendantes des droits du groupe propriétaire. - PASS_MAX_DAYS 99999 - PASS_MIN_DAYS 0 - PASS_WARN_AGE 7 - UID_MIN 1000 - UID_MAX 60000 - GID_MIN 1000 - GID_MAX 60000 - LOGIN_RETRIES 3 - LOGIN_TIMEOUT 60 - CHFN_RESTRICT rwh - DEFAULT_HOME yes - USERGROUPS_ENAB yes - ENCRYPT_METHOD SHA512 - EOF + sudo install -m 644 -o root -g root \ + "$tool"/etc/inittab \ + /etc/inittab + sudo install -m 644 -o root -g root \ + "$tool"/etc/login.defs \ + /etc/login.defs grep -q '^session optional pam_umask.so\>' /etc/pam.d/common-session || sudo install -m 644 -o root -g root /dev/stdin /etc/pam.d/common-session <<-EOF $(cat /etc/pam.d/common-session) @@ -760,14 +568,85 @@ rule_mail_configure () { } rule_mysql_configure () { rule apt_get_install mysql-server-5.5 - sudo install -m 644 -o root -g root \ - "$tool"/etc/mysql/my.cnf \ - /etc/mysql/my.cnf - if test ! -d /home/mysql; then - sudo install -d -m 750 -o mysql -g mysql \ - /home/mysql - sudo -u mysql mysql_install_db --no-defaults --datadir=/home/mysql/ - fi + rule insserv_remove mysql + rule adduser mysql \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql \ + --shell /bin/false \ + --system + rule adduser mysql-data \ + --disabled-login \ + --disabled-password \ + --group \ + --home /home/mysql/data \ + --no-create-home \ + --shell /bin/false \ + --system + sudo usermod --home /home/mysql mysql + sudo adduser mysql mysql-data + sudo install -d -m 751 -o mysql -g mysql \ + /home/mysql + sudo rm -rf /etc/mysql + sudo install -d -m 750 -o mysql -g mysql \ + /etc/mysql \ + /etc/mysql/conf.d \ + /home/mysql/etc + sudo ln -fns \ + /etc/mysql \ + /home/mysql/etc/mysql + sudo install -m 644 -o mysql -g mysql \ + "$tool"/etc/mysql/my.cnf \ + /etc/mysql/my.cnf + if sudo test ! -d /home/mysql/data + then + sudo install -d -m 750 -o mysql -g mysql-data \ + /home/mysql/data + sudo -u mysql mysql_install_db \ + --datadir=/home/mysql/data \ + --no-defaults + fi + rule tmpfs_configure + rule runit_sv_configure mysql + rule runit_sv_restart mysql + while ! sudo -u mysql mysql -u mysql