--- /dev/null
+#! /bin/sh -e
+export export BOOTUUID=`uuidgen`
+export export DATANAME='data'
+export export DATAUUID=`uuidgen`
+export export LUKSDATAUUID=`uuidgen`
+export export ARCH='x86_64'
+export export MGARELEASE='cauldron'
+export export IHTTPD_RPM=`dirname ihttpd-*.${ARCH}.rpm`/`basename ihttpd-*.${ARCH}.rpm`
+export export ZONE='Europe/Paris'
+export export KEYMAP='fr-latin9'
+export export LOCALE='fr_FR.UTF-8'
+export export LOCALE_ALT='fr'
+export export MAIL='user@example.com'
+export export NETHOSTNAME='host.example.com'
+export export NETALIAS='host'
+export export NETCONFIG=static
+export export NETADDRESS4=`printf '192.168.2.%d/24' $[RANDOM%253+2]`
+export export NETGATEWAY4='192.168.2.1'
+export export NETADDRESS6=`printf 'fd4b:842b:7f35:f1ba::%x/64' $[RANDOM%65534+2]`
+export export NETGATEWAY6='fd4b:842b:7f35:f1ba::1'
+export export NETDNS='8.8.8.8 8.8.4.4'
+export export NETMAC=`printf '%02x:%02x:%02x:%02x:%02x:%02x' $[RANDOM%256] $[RANDOM%256] $[RANDOM%256] $[RANDOM%256] $[RANDOM%256] $[RANDOM%256]`
+export export ROOTPASS=`apg -m 32 -x 32 -a 0 -d -n 1`
+export export SLASHNAME='slash'
+export export SLASHUUID=`uuidgen`
+export export LUKSSLASHUUID=`uuidgen`
+export export SWAPAUUID=`uuidgen`
+export export SWAPBUUID=`uuidgen`
+export export USERLOGIN=`apg -M L -a 0 -m 8 -x 8 -d -n 1`
+export export USERPASS=`apg -m 32 -x 32 -a 0 -d -n 1`
--- /dev/null
+#! /bin/sh -e
+
+# Failsafe check
+if [ -z "$PWD" -o "$PWD" = "/" ]; then
+ echo "Don't run it from slash moron"
+ exit 1;
+fi
+
+# Check for trashed %_tmppath by ~/.rpmmacros or else
+if [ "$(rpm --eval '%_tmppath')" != "/var/tmp" ]; then
+ echo "Run with a clean %_tmppath rpm macro moron (start me from sudo su -)"
+ exit 1;
+fi
+
+# Check if we have a root directory
+if [ -d "$PWD/root" ]; then
+ read -p 'Confirm root directory destruction (yes/NO): ' confirm
+ if [ "$confirm" = "yes" -o "$confirm" = "YES" ]; then
+ rm -fr "$PWD/root"
+ elif [ ! "$confirm" = "no" -a ! "$confirm" = "NO" ]; then
+ echo "I need a clean directory"
+ exit 1;
+ else
+ read -p "I re-install over existing directory, press a key to continue"
+ fi
+fi
+
+# Make root directory
+mkdir -p "$PWD/root"
+
+# Install base config
+LC_ALL=C urpmi --downloader=wget --no-verify-rpm --no-recommends --noclean --auto --root=$PWD/root filesystem basesystem-minimal rpm urpmi grub kernel-server-latest vim-enhanced wget
+
+# Reinstall lockdev to fix missing lock group on binary
+LC_ALL=C urpmi --downloader=wget --no-verify-rpm --no-recommends --noclean --auto --replacepkgs --replacefiles --root=$PWD/root lockdev
+
+# Install remaining
+LC_ALL=C urpmi --downloader=wget --no-verify-rpm --no-recommends --noclean --auto --root=$PWD/root \
+ acl \
+ acpi \
+ acpid \
+ bash-completion \
+ bind \
+ bind-utils \
+ binutils \
+ btrfs-progs \
+ cronie-anacron \
+ cryptmount \
+ cryptsetup \
+ deltarpm \
+ dhcp-client \
+ dosfstools \
+ gdb \
+ gdisk \
+ mageia-gfxboot-theme \
+ git \
+ git-prompt \
+ git-svn \
+ gnupg \
+ gnupg2 \
+ hdparm \
+ info \
+ kernel-firmware \
+ kernel-firmware-nonfree \
+ lftp \
+ lm_sensors \
+ locales \
+ locales-en \
+ lshw \
+ lsof \
+ luit \
+ lynx \
+ man \
+ man-pages \
+ mdadm \
+ microcode \
+ mirrordir \
+ mlocate \
+ msec \
+ nail \
+ ntfs-3g \
+ openssh-server \
+ openvpn \
+ p7zip \
+ parted \
+ patch \
+ pax \
+ pciutils \
+ postfix \
+ rsnapshot \
+ rsync \
+ sectool \
+ shorewall \
+ shorewall-ipv6 \
+ smartmontools \
+ strace \
+ sudo \
+ traceroute \
+ tree \
+ unzip \
+ whois \
+ xauth \
+ xfsprogs \
+ zip
+
+# Install locale
+if [ ! -z "$LOCALE_ALT" -a "$LOCALE_ALT" != 'en' ]; then
+ LC_ALL=C urpmi --downloader=wget --no-verify-rpm --no-recommends --noclean --auto --root=$PWD/root \
+ locales-${LOCALE_ALT} \
+ man-pages-${LOCALE_ALT}
+fi
+
+# Install ihttpd
+LC_ALL=C urpmi --no-verify-rpm --no-recommends --noclean --auto --root=$PWD/root ${IHTTPD_RPM}
--- /dev/null
+#! /bin/sh -e
+
+#Fix bash completion
+perl -pne 's%(?:(COMP_CONFIGURE_HINTS|COMP_TAR_INTERNAL_PATHS)=1?)%${1}=1%' -i "$PWD/root/etc/sysconfig/bash-completion"
+
+#Disable gpg agent
+perl -pne 's%(?:(START_GPGAGENT|START_GPGAGENT_SH)=(?:"?(no|yes)"?)?)%${1}="no"%' -i "$PWD/root/etc/sysconfig/gnupg2"
+
+#Locale config
+cat << EOF > "$PWD/root/etc/vconsole.conf"
+KEYMAP=$KEYMAP
+FONT=lat0-16
+EOF
+cat << EOF > "$PWD/root/etc/locale.conf"
+LANGUAGE=$LOCALE:${LOCALE_ALT}
+LANG=$LOCALE
+EOF
+
+#Setup networking
+cat << EOF > "$PWD/root/etc/sysconfig/network"
+NETWORKING=yes
+AUTOMATIC_IFCFG=no
+EOF
+
+#Setup network
+cat << EOF > "$PWD/root/etc/hostname"
+${NETHOSTNAME}
+EOF
+
+#Setup machine-info
+cat << EOF > "$PWD/root/etc/machine-info"
+CHASSIS=server
+EOF
+
+#Setup hosts
+#XXX: we remove mask from address
+cat << EOF > "$PWD/root/etc/hosts"
+127.0.0.1 localhost
+::1 localhost
+${NETADDRESS4%/*} ${NETHOSTNAME} ${NETALIAS}
+${NETADDRESS6%/*} ${NETHOSTNAME} ${NETALIAS}
+EOF
+
+#Fix named config
+perl -pne 's%listen-on port 53 \{ .+; \};%listen-on port 53 { 127.0.0.1; };%' -i "$PWD/root/etc/named.conf"
+perl -pne 's%listen-on-v6 port 53 \{ .+; \};%listen-on-v6 port 53 { ::1; };%' -i "$PWD/root/etc/named.conf"
+
+#Network
+mkdir -p "$PWD/root/etc/systemd/network"
+if [ ! -z "${NETCONFIG}" -a "${NETCONFIG}" = 'static' ]; then
+ cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
+[Match]
+MACAddress=${NETMAC}
+
+[Network]
+DHCP=no
+Address=${NETADDRESS4}
+Address=${NETADDRESS6}
+DNS=${NETDNS}
+
+[Route]
+Destination=${NETGATEWAY4}
+
+[Route]
+Destination=0.0.0.0/0
+Gateway=${NETGATEWAY4}
+
+[Route]
+Destination=${NETGATEWAY6}
+
+[Route]
+Destination=::/0
+Gateway=${NETGATEWAY6}
+EOF
+else
+ cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
+[Match]
+MACAddress=${NETMAC}
+
+[Network]
+DHCP=yes
+EOF
+fi
+
+#Fstab
+#XXX: grub-legacy don't support ext4 and xfs V5 file format for /boot
+cat << EOF > "$PWD/root/etc/fstab"
+UUID=${BOOTUUID} /boot ext3 defaults,noatime 1 2
+UUID=${SLASHUUID} / btrfs defaults,relatime 1 1
+UUID=${SWAPAUUID} none swap sw 0 0
+UUID=${SWAPBUUID} none swap sw 0 0
+UUID=${DATAUUID} /media btrfs defaults,relatime,nofail 1 2
+proc /proc proc defaults 0 0
+EOF
+
+# Copy grub files
+cp -f $PWD/root/lib/grub/${ARCH}-mageia/{e2fs_stage1_5,stage{1,2}} $PWD/root/boot/grub/
+
+#Crypttab
+cat << EOF > "$PWD/root/etc/crypttab"
+${SLASHNAME} UUID=${LUKSSLASHUUID}
+${DATANAME} UUID=${LUKSDATAUUID} - nofail,noauto
+EOF
+
+#Set resolv.conf
+ln -fs "/run/systemd/resolve/resolv.conf" "$PWD/root/etc/resolv.conf"
+#Disable LLMNR, enable localhost
+perl -pne 's/^#LLMNR=yes$/LLMNR=no/;s/^#DNS=/DNS=127.0.0.1/' -i "$PWD/root/etc/systemd/resolved.conf"
+
+#Disable resolvconf
+rm -f "$PWD/root/etc/resolvconf/run/enable-updates"
+
+#Mail
+cat << EOF >> "$PWD/root/etc/mdadm.conf"
+MAILADDR ${MAIL}
+EOF
+
+#Password
+echo -n "$ROOTPASS" | chroot $PWD/root passwd root --stdin
+chroot $PWD/root adduser -m "$USERLOGIN"
+echo -n "$USERPASS" | chroot $PWD/root passwd "$USERLOGIN" --stdin
+
+#Grub file
+cat << EOF > $PWD/root/boot/grub/menu.lst
+timeout 5
+color black/cyan yellow/cyan
+gfxmenu (hd0,0)/gfxmenu
+default 0
+
+title linux
+root (hd0,0)
+kernel /vmlinuz-server BOOT_IMAGE=linux root=UUID=$SLASHUUID PROFILE=default splash=verbose vga=793
+initrd /initrd-server.img
+
+title failsafe
+root (hd0,0)
+kernel /vmlinuz-server BOOT_IMAGE=failsafe root=UUID=$SLASHUUID rd.luks.uuid=$LUKSSLASHUUID failsafe
+initrd /initrd-server.img
+EOF
+#Update grub fx menu
+chroot $PWD/root grub-gfxmenu --lang fr --update-theme --update-gfxmenu
+
+#Grub device.map
+cat << EOF > $PWD/root/boot/grub/device.map
+(hd0) /dev/sda
+EOF
+
+#Shorewall
+cat << EOF >> $PWD/root/etc/shorewall/zones
+net ipv4
+EOF
+cat << EOF >> $PWD/root/etc/shorewall/policy
+fw net ACCEPT
+net all DROP info
+all all REJECT info
+EOF
+cat << EOF >> $PWD/root/etc/shorewall/rules
+INCLUDE rules.drakx
+EOF
+cat << EOF > $PWD/root/etc/shorewall/rules.drakx
+ACCEPT net fw udp 68,6700:7000 -
+ACCEPT net fw icmp 8 -
+ACCEPT net fw tcp 20,21,22,80,443,6700:7000 -
+EOF
+
+#Shorewall6
+cat << EOF >> $PWD/root/etc/shorewall6/zones
+net ipv6
+EOF
+cat << EOF >> $PWD/root/etc/shorewall6/policy
+fw net ACCEPT
+net all DROP info
+all all REJECT info
+EOF
+cat << EOF >> $PWD/root/etc/shorewall6/rules
+INCLUDE rules.drakx
+EOF
+cat << EOF > $PWD/root/etc/shorewall6/rules.drakx
+ACCEPT net fw udp 546,6700:7000 -
+ACCEPT net fw icmp 128 -
+ACCEPT net fw tcp 20,21,22,80,443,546,6700:7000 -
+EOF
+
+# Disable old services
+# Strip WantedBy=multi-user.target in [Install] section of lm_sensors.service ?
+for s in lm_sensors network network-auth network-up resolvconf smartd; do
+ if [ -f "$PWD/root/etc/rc.d/init.d/$s" -a -x "$PWD/root/etc/rc.d/init.d/$s" ]; then
+ chroot $PWD/root /usr/lib/systemd/systemd-sysv-install disable $s
+ fi
+ if [ -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service" ]; then
+ rm -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service"
+ fi
+done
+
+# Extract last kernel version
+KVER=`chroot $PWD/root rpm -qa | perl -pne '/kernel-server-latest/||undef $_;s%^kernel-(server)-latest-([^-]+)-(.+)$%\2-\1-\3%'`
+#XXX: we do not regenerate initrd here, it will be generated at image build step
+rm -f "$PWD/root/boot/initrd-${KVER}.img"
+
+# Check rc.local state
+if [ -f "$PWD/root/etc/rc.d/rc.local" ]; then
+ echo "$PWD/root/etc/rc.d/rc.local not empty"
+ exit 1
+fi
+
+# First boot startup script
+#XXX: regenerate initrd after first successfull boot to strip from useless modules
+touch "$PWD/root/etc/rc.d/rc.local"
+chmod a+x "$PWD/root/etc/rc.d/rc.local"
+cat << EOF > "$PWD/root/etc/rc.d/rc.local"
+#! /bin/sh
+. /etc/init.d/functions
+case "\$1" in
+ start)
+ gprintf "Disabling lm_sensors.service: "
+ /usr/bin/systemctl disable lm_sensors.service
+ [ \$? -eq 0 ] && success || failure
+ echo
+ gprintf "Stopping lm_sensors.service: "
+ /usr/bin/systemctl stop lm_sensors.service
+ [ \$? -eq 0 ] && success || failure
+ echo
+ gprintf "Generating initrd: "
+ /usr/sbin/mkinitrd -f -v /boot/initrd-${KVER}.img ${KVER}
+ [ \$? -eq 0 ] && success || failure
+ echo
+ rm -f "\$0"
+ exit 0
+ ;;
+ *)
+ echo "Usage: \$0 start" >&2
+ exit 3
+ ;;
+esac
+EOF
+
+# Fix msec
+chroot "$PWD/root" msec -f webserver
+
+# Fix postfix
+perl -pne "my \$m='${MAIL}'; s%^(root:[\\t\\s]+)postfix\$%\\1\$m%" -i "$PWD/root/etc/postfix/aliases"
+
+# Generate ssh keys
+chroot "$PWD/root" /usr/sbin/sshd-keygen
+
+# Allow root access
+#XXX: forced because msec decides otherwise
+perl -pne 's%^PermitRootLogin .*%PermitRootLogin yes%' -i "$PWD/root/etc/ssh/sshd_config"
+
+# Add rsa key if available
+#XXX: dsa is unsupported anymore
+if [ -e "$HOME/.ssh/id_rsa.pub" ]; then
+ [ ! -d "$PWD/root/root/.ssh" ] && mkdir -m 0700 "$PWD/root/root/.ssh"
+ cp -f "$HOME/.ssh/id_rsa.pub" "$PWD/root/root/.ssh/authorized_keys"
+fi
+
+#TODO ntp /etc/systemd/timesyncd.conf
+
+# Cleanup tmp and run
+rm -fr $PWD/root/tmp/* $PWD/root/run/*
Rapsys Git / distcook / commitdiff