Raphaël G. Git Repositories - distcook/blob - lib/pattern.sh

   1 #! /bin/sh -e
   2
   3 #Fix bash completion
   4 perl -pne 's%(?:(COMP_CONFIGURE_HINTS|COMP_TAR_INTERNAL_PATHS)=1?)%${1}=1%' -i "$PWD/root/etc/sysconfig/bash-completion"
   5
   6 #Disable gpg agent
   7 perl -pne 's%(?:(START_GPGAGENT|START_GPGAGENT_SH)=(?:"?(no|yes)"?)?)%${1}="no"%' -i "$PWD/root/etc/sysconfig/gnupg2"
   8
   9 #Locale config
  10 cat << EOF > "$PWD/root/etc/vconsole.conf"
  11 KEYMAP=$KEYMAP
  12 FONT=lat0-16
  13 EOF
  14 cat << EOF > "$PWD/root/etc/locale.conf"
  15 LANGUAGE=$LOCALE:${LOCALE_ALT}
  16 LANG=$LOCALE
  17 EOF
  18
  19 #Setup networking
  20 cat << EOF > "$PWD/root/etc/sysconfig/network"
  21 NETWORKING=yes
  22 AUTOMATIC_IFCFG=no
  23 EOF
  24
  25 #Setup network
  26 cat << EOF > "$PWD/root/etc/hostname"
  27 ${NETHOSTNAME}
  28 EOF
  29
  30 #Setup machine-info
  31 cat << EOF > "$PWD/root/etc/machine-info"
  32 CHASSIS=server
  33 EOF
  34
  35 #Setup hosts
  36 #XXX: we remove mask from address
  37 cat << EOF > "$PWD/root/etc/hosts"
  38 127.0.0.1                               localhost
  39 ::1                                     localhost
  40 ${NETADDRESS4%/*}                               ${NETHOSTNAME}  ${NETALIAS}
  41 ${NETADDRESS6%/*}       ${NETHOSTNAME}  ${NETALIAS}
  42 EOF
  43
  44 #Fix named config
  45 perl -pne 's%listen-on port 53 \{ .+; \};%listen-on port 53 { 127.0.0.1; };%' -i "$PWD/root/etc/named.conf"
  46 perl -pne 's%listen-on-v6 port 53 \{ .+; \};%listen-on-v6 port 53 { ::1; };%' -i "$PWD/root/etc/named.conf"
  47
  48 #Network
  49 mkdir -p "$PWD/root/etc/systemd/network"
  50 if [ ! -z "${NETCONFIG}" -a "${NETCONFIG}" = 'static' ]; then
  51         cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
  52 [Match]
  53 MACAddress=${NETMAC}
  54
  55 [Network]
  56 DHCP=no
  57 Address=${NETADDRESS4}
  58 Address=${NETADDRESS6}
  59 DNS=${NETDNS}
  60
  61 [Route]
  62 Destination=${NETGATEWAY4}
  63
  64 [Route]
  65 Destination=0.0.0.0/0
  66 Gateway=${NETGATEWAY4}
  67
  68 [Route]
  69 Destination=${NETGATEWAY6}
  70
  71 [Route]
  72 Destination=::/0
  73 Gateway=${NETGATEWAY6}
  74 EOF
  75 else
  76         cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
  77 [Match]
  78 MACAddress=${NETMAC}
  79
  80 [Network]
  81 DHCP=yes
  82 EOF
  83 fi
  84
  85 #Fstab
  86 cat << EOF > "$PWD/root/etc/fstab"
  87 UUID=${BOOTUUID}        /boot   ext3    defaults,noatime 1 2
  88 UUID=${DATAUUID}        /       btrfs   subvol=/slash,defaults,relatime 1 1
  89 UUID=${SWAPAUUID}       none    swap    sw 0 0
  90 UUID=${SWAPBUUID}       none    swap    sw 0 0
  91 UUID=${DATAUUID}        /home   btrfs   subvol=/home,defaults,relatime 1 1
  92 proc                                            /proc   proc    defaults 0 0
  93 EOF
  94
  95 #Crypttab
  96 #XXX: Don't forget to add option nofail,noauto for every devices requiring manual unlocking
  97 cat << EOF > "$PWD/root/etc/crypttab"
  98 ${DATANAME}     UUID=${LUKSDATAUUID}
  99 EOF
 100
 101 #Set resolv.conf
 102 ln -fs "/run/systemd/resolve/resolv.conf" "$PWD/root/etc/resolv.conf"
 103 #Disable LLMNR, enable localhost
 104 perl -pne 's/^#LLMNR=yes$/LLMNR=no/;s/^#DNS=/DNS=127.0.0.1/' -i "$PWD/root/etc/systemd/resolved.conf"
 105
 106 #Disable resolvconf
 107 rm -f "$PWD/root/etc/resolvconf/run/enable-updates"
 108
 109 #Mail
 110 cat << EOF >> "$PWD/root/etc/mdadm.conf"
 111 MAILADDR ${MAIL}
 112 EOF
 113
 114 #Password
 115 echo -n "$ROOTPASS" | chroot $PWD/root passwd root --stdin
 116 chroot $PWD/root adduser -m "$USERLOGIN"
 117 echo -n "$USERPASS" | chroot $PWD/root passwd "$USERLOGIN" --stdin
 118
 119 # Fix grub config
 120 perl -pne 's/^GRUB_TIMEOUT=[0-9]+$/GRUB_TIMEOUT=1/' -i $PWD/root/etc/default/grub
 121
 122 #Shorewall
 123 cat << EOF >> $PWD/root/etc/shorewall/zones
 124 net             ipv4
 125 EOF
 126 cat << EOF >> $PWD/root/etc/shorewall/policy
 127 fw      net     ACCEPT
 128 net     all     DROP    info
 129 all     all     REJECT  info
 130 EOF
 131 cat << EOF >> $PWD/root/etc/shorewall/rules
 132 INCLUDE rules.drakx
 133 EOF
 134 cat << EOF > $PWD/root/etc/shorewall/rules.drakx
 135 ACCEPT  net     fw      udp     68,6700:7000    -
 136 ACCEPT  net     fw      icmp    8       -
 137 ACCEPT  net     fw      tcp     20,21,22,80,443,6700:7000       -
 138 EOF
 139
 140 #Shorewall6
 141 cat << EOF >> $PWD/root/etc/shorewall6/zones
 142 net             ipv6
 143 EOF
 144 cat << EOF >> $PWD/root/etc/shorewall6/policy
 145 fw      net     ACCEPT
 146 net     all     DROP    info
 147 all     all     REJECT  info
 148 EOF
 149 cat << EOF >> $PWD/root/etc/shorewall6/rules
 150 INCLUDE rules.drakx
 151 EOF
 152 cat << EOF > $PWD/root/etc/shorewall6/rules.drakx
 153 ACCEPT  net     fw      udp     546,6700:7000   -
 154 ACCEPT  net     fw      icmp    128     -
 155 ACCEPT  net     fw      tcp     20,21,22,80,443,546,6700:7000   -
 156 EOF
 157
 158 # Disable old services
 159 # Strip WantedBy=multi-user.target in [Install] section of lm_sensors.service ?
 160 for s in lm_sensors network network-auth network-up resolvconf smartd; do
 161         if [ -f "$PWD/root/etc/rc.d/init.d/$s" -a -x "$PWD/root/etc/rc.d/init.d/$s" ]; then
 162                 chroot $PWD/root /usr/lib/systemd/systemd-sysv-install disable $s
 163         fi
 164         if [ -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service" ]; then
 165                 rm -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service"
 166         fi
 167 done
 168
 169 # Extract last kernel version
 170 KVER=`chroot $PWD/root rpm -qa | perl -pne '/kernel-server-latest/||undef $_;s%^kernel-(server)-latest-([^-]+)-(.+)$%\2-\1-\3%'`
 171 #XXX: we do not regenerate initrd here, it will be generated at image build step
 172 rm -f "$PWD/root/boot/initrd-${KVER}.img"
 173
 174 # Check rc.local state
 175 if [ -f "$PWD/root/etc/rc.d/rc.local" ]; then
 176         echo "$PWD/root/etc/rc.d/rc.local not empty"
 177         exit 1
 178 fi
 179
 180 # First boot startup script
 181 #XXX: regenerate initrd after first successfull boot to strip from useless modules
 182 touch "$PWD/root/etc/rc.d/rc.local"
 183 chmod a+x "$PWD/root/etc/rc.d/rc.local"
 184 cat << EOF > "$PWD/root/etc/rc.d/rc.local"
 185 #! /bin/sh
 186 . /etc/init.d/functions
 187 case "\$1" in
 188         start)
 189                 gprintf "Disabling lm_sensors.service: "
 190                 /usr/bin/systemctl disable lm_sensors.service
 191                 [ \$? -eq 0 ] && success || failure
 192                 echo
 193                 gprintf "Stopping lm_sensors.service: "
 194                 /usr/bin/systemctl stop lm_sensors.service
 195                 [ \$? -eq 0 ] && success || failure
 196                 echo
 197                 gprintf "Generating initrd: "
 198                 /usr/sbin/mkinitrd -f -v /boot/initrd-${KVER}.img ${KVER}
 199                 [ \$? -eq 0 ] && success || failure
 200                 echo
 201                 rm -f "\$0"
 202                 exit 0
 203                 ;;
 204         *)
 205                 echo "Usage: \$0 start" >&2
 206                 exit 3
 207                 ;;
 208 esac
 209 EOF
 210
 211 # Fix msec
 212 chroot "$PWD/root" msec -f webserver
 213
 214 # Fix postfix
 215 perl -pne "my \$m='${MAIL}'; s%^(root:[\\t\\s]+)postfix\$%\\1\$m%" -i "$PWD/root/etc/postfix/aliases"
 216
 217 # Generate ssh keys
 218 chroot "$PWD/root" /usr/sbin/sshd-keygen
 219
 220 # Allow root access
 221 #XXX: forced because msec decides otherwise
 222 perl -pne 's%^PermitRootLogin .*%PermitRootLogin yes%' -i "$PWD/root/etc/ssh/sshd_config"
 223
 224 # Add rsa key if available
 225 #XXX: dsa is unsupported anymore
 226 if [ -e "$HOME/.ssh/id_rsa.pub" ]; then
 227         [ ! -d "$PWD/root/root/.ssh" ] && mkdir -m 0700 "$PWD/root/root/.ssh"
 228         cp -f "$HOME/.ssh/id_rsa.pub" "$PWD/root/root/.ssh/authorized_keys"
 229 fi
 230
 231 #TODO ntp /etc/systemd/timesyncd.conf
 232
 233 # Cleanup tmp and run
 234 rm -fr $PWD/root/tmp/* $PWD/root/run/*