X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=f63df93a9137f9af57a88106aba4f684aa4a2537;hp=df9e3481a4f3d614116d9797bc3c2d94f6be2333;hb=1f7d526ae02689e645426cd130e9cb1f4a0bf4aa;hpb=4856433be903ee078c1da1e4b7491968e66f6461 diff --git a/vm_hosted b/vm_hosted index df9e348..f63df93 100755 --- a/vm_hosted +++ b/vm_hosted @@ -46,7 +46,10 @@ rule_git_reset () { } rule_apt_get_install () { # SYNTAX: $package - sudo apt-get install "$@" + sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@" + } +rule_dpkg_reconfigure () { # SYNTAX: $package + sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure "$@" } rule__chrooted_configure () { # NOTE: est-ce bien utile à un moment ? @@ -246,9 +249,6 @@ rule_apt_configure () { Pin: release a=$vm_lsb_name-backports Pin-Priority: 200 EOF - sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF - deb http://nightly.openerp.com/trunk/nightly/deb/ ./ - EOF sudo apt-get update rule apt_get_install apticron sudo install -m 644 -o root -g root /dev/stdin /etc/apticron/apticron.conf <<-EOF @@ -268,7 +268,10 @@ rule_apt_configure () { EOF } rule_boot_configure () { - warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" + #warn "lors de l'installation Debian, surtout n'installer GRUB sur AUCUN disque proposé !" + sudo debconf-set-selections <<-EOF + grub-pc grub-pc/install_devices multiselect + EOF rule apt_get_install grub-pc sudo install -d -m 644 -o root -g root /boot/grub rule apt_get_install linux-image-$vm_arch @@ -287,6 +290,13 @@ rule_boot_configure () { EOF sudo update-grub2 # NOTE: prend en compte /boot/grub/device.map rule initramfs_configure + rule apt_get_install molly-guard + sudo install -m 644 -o root -g root /dev/stdin /etc/molly-guard/rc <<-EOF + ALWAYS_QUERY_HOSTNAME=true + # NOTE: une alternative est de dire à sudo de conserver les SSH_* + # néamoins demander tout le temps n'est pas trop contraignant + # et davantage sécurisant. + EOF } rule_dovecot_configure () { rule apt_get_install dovecot-imapd dovecot-managesieved dovecot-sieve @@ -390,7 +400,6 @@ rule_filesystem_configure () { LABEL=${vm_lvm_lv}_boot /boot ext2 defaults 0 0 proc /proc proc defaults 0 0 sysfs /sys sysfs defaults 0 0 - tmpfs /tmp tmpfs rw,nosuid,nodev,auto,size=200m,nr_inodes=1000k,mode=1777,noatime,nodiratime 0 0 /dev/mapper/${vm_lvm_lv}_root_deciphered / ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 /dev/mapper/${vm_lvm_lv}_var_deciphered /var ext4 defaults,errors=remount-ro,acl,barrier=1,noatime 0 1 /dev/mapper/${vm_lvm_lv}_home_deciphered /home ext4 defaults,errors=remount-ro,acl,barrier=1,noatime,usrquota,grpquota 0 0 @@ -404,6 +413,24 @@ rule_filesystem_configure () { ${vm_lvm_lv}_home_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_home ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_swap_deciphered /dev/$vm_lvm_vg/${vm_lvm_lv}_swap ${vm_lvm_lv}_root_deciphered luks,lvm=$vm_lvm_vg,keyscript=/lib/cryptsetup/scripts/decrypt_derived EOF + sudo install -m 644 -o root -g root /dev/stdin /etc/default/tmpfs <<-EOF + LOCK_SIZE=5242880 # NOTE: 5MiB + RAMLOCK=yes + RAMSHM=yes + RAMTMP=yes + RUN_SIZE=10% + SHM_SIZE= + TMP_MODE=1777,nr_inodes=1000k,noatime + TMP_OVERFLOW_LIMIT=1024 + # NOTE: mount tmpfs on /tmp if there is less than the limit size (in kiB) + # on the root filesystem (overriding RAMTMP). + TMP_SIZE=200m + TMPFS_SIZE=20%VM + EOF + sudo install -m 775 -o root -g root \ + "$tool"/etc/init.d/tmpfs \ + /etc/init.d/tmpfs + sudo update-rc.d tmpfs defaults } rule_initramfs_configure () { sudo install -m 644 -o root -g root /dev/stdin /etc/initramfs-tools/initramfs.conf <<-EOF @@ -463,30 +490,134 @@ rule_initramfs_configure () { # NOTE: clefs générées par Debian sudo update-initramfs -u } -rule_time_configure () { - sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF - Europe/Paris +rule_gitolite_configure () { + local user=git + sudo debconf-set-selections <<-EOF + gitolite gitolite/gituser string $user + gitolite gitolite/adminkey string + gitolite gitolite/gitdir string /home/$user EOF - sudo dpkg-reconfigure tzdata - rule apt_get_install ntp + rule apt_get_install gitolite + getent passwd "$user" >/dev/null || + sudo adduser \ + --disabled-password \ + --group \ + --shell /bin/bash \ + --system \ + "$user" + sudo chfn --full-name "$user" "$user" + eval local home\; home="~$user" + sudo install -d -m 770 -o "$user" -g "$user" \ + /etc/gitolite \ + "$home"/etc \ + "$home"/etc/ssh \ + "$home"/pub \ + "$home"/log \ + "$home"/log/gitolite \ + "$home"/log/gitolite/perf + sudo ln -fns /etc/gitolite "$home"/etc/gitolite + sudo ln -fns etc/gitolite/gitolite.rc "$home"/.gitolite.rc + sudo ln -fns etc/ssh "$home"/.ssh + sudo install -m 770 -o "$user" -g "$user" /dev/stdin \ + "$home"/etc/gitolite/gitolite.rc <<-EOF + #\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary"; + #\$BIG_INFO_CAP = 20; + #\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3'; + # NOTE: Please use single quotes, not double quotes. + #\$GITWEB_URI_ESCAPE = 0; + \$GIT_PATH = ""; + #\$GL_ADC_PATH = ""; + \$GL_ADMINDIR = \$ENV{HOME} . "/etc/gitolite"; + #\$GL_ALL_INCLUDES_SPECIAL = 0; + #\$GL_ALL_READ_ALL = 0; + \$GL_BIG_CONFIG = 0; + \$GL_CONF = "\$GL_ADMINDIR/conf/gitolite.conf"; + \$GL_CONF_COMPILED = "\$GL_ADMINDIR/conf/gitolite.conf.pm"; + #\$GL_GET_MEMBERSHIPS_PGM = "/usr/local/bin/expand-ldap-user-to-groups" + \$GL_GITCONFIG_KEYS = "hooks\\..* repo\\..*"; + #\$GL_HOSTNAME = "git.$vm_domainname"; + # NOTE: read doc/mirroring.mkd COMPLETELY before setting this. + #\$GL_HTTP_ANON_USER = "mob"; + \$GL_KEYDIR = "\$GL_ADMINDIR/keydir"; + \$GL_LOGT = \$ENV{HOME} . "/log/gitolite/%y-%m-%d.log"; + #\$GL_NICE_VALUE = 0; + \$GL_NO_CREATE_REPOS = 0; + \$GL_NO_DAEMON_NO_GITWEB = 0; + \$GL_NO_SETUP_AUTHKEYS = 0; + \$GL_PACKAGE_CONF = "/usr/share/gitolite/conf"; + \$GL_PACKAGE_HOOKS = "/usr/share/gitolite/hooks"; + #\$GL_PERFLOGT = \$ENV{HOME} . "/log/gitolite/perf/%y-%m-%d.log"; + #\$GL_REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][0-9a-zA-Z._\\@/+ :,-]*\$); + \$GL_SITE_INFO = "git.$vm_domainname"; + #\$GL_SLAVE_MODE = 0; + \$GL_WILDREPOS = 0; + #\$GL_WILDREPOS_DEFPERMS = 'R @all'; + \$GL_WILDREPOS_PERM_CATS = "READERS WRITERS"; + \$HTPASSWD_FILE = ""; + \$PROJECTS_LIST = \$ENV{HOME} . "/projects.list"; + \$REPO_BASE = "pub"; + \$REPO_UMASK = 0007; + \$RSYNC_BASE = ""; + \$SVNSERVE = ""; + #\$UPDATE_CHAINS_TO = "hooks/update.secondary"; + #\$WEB_INTERFACE = "gitweb"; + 1; + EOF + sudo install -m 770 -o "$user" -g "$user" /dev/stdin \ + "$home"/etc/gitweb/gitweb.conf <<-EOF + \$commit_oneline_message_width = 70; + \$default_projects_order = 'age'; + \$default_text_plain_charset = 'UTF-8'; + @diff_opts = (); + \$favicon = "img/git-favicon.png"; + \$git_temp = "/run/shm/gitweb"; + \$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc"; + \$home_header = "/etc/gitweb/cgi/home-header.cgi.inc"; + \$home_link = "/"; + \$home_link_str = 'dépôts'; + \$home_th_age = 'activité'; + \$home_th_descr = 'description'; + \$home_th_owner = 'contact'; + \$home_th_project = 'dépôt'; + \$javascript = "js/gitweb.js"; + \$logo = "img/git-logo.png"; + \$my_uri = ""; + \$projectroot = "../git"; + \$projects_list = "/etc/gitolite/projects.list"; + \$projects_list_description_width = 42; + \$projects_list_owner_width = 15; + \$search_str = "Filtre :"; + \$site_footer = "/home/fai/pub/www/git.autogeree.net/cgi/site-footer.bin"; + \$site_header = undef; + \$site_name = "git.$vm_domainname"; + \$space_to_nbsp = 0; + @stylesheets = ("css/gitweb.css");# + \$untabify_tabstop = 2; + EOF + sudo install -m 600 -o "$user" -g "$user" \ + "$tool"/var/pub/ssh/"$user".key \ + "$home"/etc/ssh/"$user".pub + sudo -u "$user" \ + GL_RC="$home"/etc/gitolite/gitolite.rc \ + GIT_AUTHOR_NAME="$user" \ + gl-setup -q "$home"/etc/ssh/"$user".pub "$user" + local d + for d in doc logs src + do test ! -d "$home"/etc/gitolite/"$d" || + rmdir "$home"/etc/gitolite/"$d" + done + rule apt_get_install gitweb highlight + #sudo sv restart spawn-fcgi.git.80.git.heureux-cyclage.org + #sudo sv restart git-daemon.git.9418 } rule_locale_configure () { - sudo install -m 644 -o root -g root /dev/stdin /etc/locale.gen <<-EOF - fr_FR.UTF-8 UTF-8 + sudo debconf-set-selections <<-EOF + locales locales/default_environment_locale select None + locales locales/locales_to_be_generated multiselect fr_FR.UTF-8 UTF-8 EOF - sudo update-locale + rule dpkg_reconfigure locales } rule_login_configure () { - grep -q '^hvc0$' /etc/securetty || - sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF - $(cat /etc/securetty) - hvc0 - EOF - grep -q '^xvc0$' /etc/securetty || - sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF - $(cat /etc/securetty) - xvc0 - EOF sudo install -m 644 -o root -g root /dev/stdin /etc/inittab <<-EOF # /etc/inittab: init(8) configuration. @@ -572,6 +703,16 @@ rule_login_configure () { $(cat /etc/pam.d/common-session) session optional pam_umask.so EOF + grep -q '^hvc0$' /etc/securetty || + sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF + $(cat /etc/securetty) + hvc0 + EOF + grep -q '^xvc0$' /etc/securetty || + sudo install -m 644 -o root -g root /dev/stdin /etc/securetty <<-EOF + $(cat /etc/securetty) + xvc0 + EOF } rule_mail_configure () { rule postfix_configure @@ -579,6 +720,10 @@ rule_mail_configure () { rule procmail_configure rule dovecot_configure } +rule_mysql_configure () { + rule apt_get_install mysql-server-5.5 + sudo service mysql restart + } rule_network_configure () { sudo install -m 644 -o root -g root /dev/stdin /etc/hostname <<-EOF $vm @@ -847,7 +992,10 @@ rule_php5_fpm_configure () { rule_postfix_configure () { local hint="run vm_remote postfix_key_send before" assert "test -f /etc/postfix/$vm_domainname/smtpd/x509/key.pem" hint - warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix" + #warn "lors de l'installation Debian, ne sélectionner aucune configuration pour postfix" + sudo debconf-set-selections <<-EOF + postfix postfix/main_mailer_type select No configuration + EOF rule apt_get_install postfix sudo install -m 640 -o root -g root /dev/stdin /etc/postfix/.gitignore <<-EOF *.db @@ -937,6 +1085,13 @@ rule_postfix_configure () { sudo postmap hash:/etc/postfix/$vm_domainname/virtual_alias sudo service postfix restart } +rule_openerp_configure () { + sudo install -m 660 -o root -g root /dev/stdin /etc/apt/sources.list.d/openerp.list <<-EOF + deb http://nightly.openerp.com/trunk/nightly/deb/ ./ + EOF + sudo apt-get update + rule apt_get_install openerp + } rule_postgrey_configure () { rule apt_get_install postgrey sudo service postgrey restart @@ -1010,10 +1165,21 @@ rule_sysctl_configure () { do conf=${conf#"$tool"/etc/sysctl.d/} sudo install -m 660 -o root -g root \ "$tool"/etc/sysctl.d/"$conf" \ - /etc/sysctl.d/"$conf" + /etc/sysctl.d/"$conf" done sudo sysctl --system } +rule_time_configure () { + sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF + Europe/Paris + EOF + sudo debconf-set-selections <<-EOF + tzdata tzdata/Areas select Europe + tzdata tzdata/Zones/Europe select Paris + EOF + rule dpkg_reconfigure tzdata + rule apt_get_install ntp + } rule_user_add () { # SYNTAX: $user rule user_configure local user=$1 @@ -1119,6 +1285,17 @@ rule_user_root_configure () { do sudo gpg --import "$key" done } +rule_xinetd_configure () { + rule apt_get_install xinetd + local -; set +f + for conf in "$tool"/etc/xinetd.d/* + do conf=${conf#"$tool"/etc/xinetd.d/} + sudo install -m 660 -o root -g root \ + "$tool"/etc/xinetd.d/"$conf" \ + /etc/xinetd.d/"$conf" + done + sudo service xinetd restart + } rule_configure () { rule apt_configure rule git_configure @@ -1137,6 +1314,8 @@ rule_configure () { #rule apache2_configure rule nginx_configure rule php5_fpm_configure + rule gitolite_configure + rule xinetd_configure } rule_luks_key_change () {