]> Raphaƫl G. Git Repositories - distcook/blob - lib/pattern.sh
Enable systemd-resolved by default
[distcook] / lib / pattern.sh
1 #! /bin/sh -e
2
3 #Fix bash completion
4 perl -pne 's%(?:(COMP_CONFIGURE_HINTS|COMP_TAR_INTERNAL_PATHS)=1?)%${1}=1%' -i "$PWD/root/etc/sysconfig/bash-completion"
5
6 #Disable gpg agent
7 perl -pne 's%(?:(START_GPGAGENT|START_GPGAGENT_SH)=(?:"?(no|yes)"?)?)%${1}="no"%' -i "$PWD/root/etc/sysconfig/gnupg2"
8
9 #Locale config
10 cat << EOF > "$PWD/root/etc/vconsole.conf"
11 KEYMAP=$KEYMAP
12 FONT=lat0-16
13 EOF
14 cat << EOF > "$PWD/root/etc/locale.conf"
15 LANGUAGE=$LOCALE:${LOCALE_ALT}
16 LANG=$LOCALE
17 EOF
18
19 #Setup networking
20 cat << EOF > "$PWD/root/etc/sysconfig/network"
21 NETWORKING=yes
22 AUTOMATIC_IFCFG=no
23 EOF
24
25 #Setup network
26 cat << EOF > "$PWD/root/etc/hostname"
27 ${NETHOSTNAME}
28 EOF
29
30 #Setup machine-info
31 cat << EOF > "$PWD/root/etc/machine-info"
32 CHASSIS=server
33 EOF
34
35 #Setup hosts
36 #XXX: we remove mask from address
37 cat << EOF > "$PWD/root/etc/hosts"
38 127.0.0.1 localhost
39 ::1 localhost
40 ${NETADDRESS4%/*} ${NETHOSTNAME} ${NETALIAS}
41 ${NETADDRESS6%/*} ${NETHOSTNAME} ${NETALIAS}
42 EOF
43
44 #Fix named config
45 perl -pne 's%listen-on port 53 \{ .+; \};%listen-on port 53 { 127.0.0.1; };%' -i "$PWD/root/etc/named.conf"
46 perl -pne 's%listen-on-v6 port 53 \{ .+; \};%listen-on-v6 port 53 { ::1; };%' -i "$PWD/root/etc/named.conf"
47
48 #Network
49 mkdir -p "$PWD/root/etc/systemd/network"
50 if [ ! -z "${NETCONFIG}" -a "${NETCONFIG}" = 'static' ]; then
51 cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
52 [Match]
53 MACAddress=${NETMAC}
54
55 [Network]
56 DHCP=no
57 Address=${NETADDRESS4}
58 Address=${NETADDRESS6}
59 DNS=${NETDNS}
60
61 [Route]
62 Destination=${NETGATEWAY4}
63
64 [Route]
65 Destination=0.0.0.0/0
66 Gateway=${NETGATEWAY4}
67
68 [Route]
69 Destination=${NETGATEWAY6}
70
71 [Route]
72 Destination=::/0
73 Gateway=${NETGATEWAY6}
74 EOF
75 else
76 cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
77 [Match]
78 MACAddress=${NETMAC}
79
80 [Network]
81 DHCP=yes
82 EOF
83 fi
84
85 #Mysql
86 mkdir -p "$PWD/root/var/lib/mysql"
87
88 #Mail
89 mkdir -p "$PWD/root/var/spool/mail"
90
91 #Fstab
92 cat << EOF > "$PWD/root/etc/fstab"
93 UUID=${BOOTUUID} /boot ext3 defaults,noatime 1 2
94 UUID=${DATAUUID} / btrfs subvol=/slash,defaults,relatime 1 1
95 UUID=${SWAPAUUID} none swap sw 0 0
96 UUID=${SWAPBUUID} none swap sw 0 0
97 UUID=${DATAUUID} /home btrfs subvol=/home,defaults,relatime 1 1
98 UUID=${DATAUUID} /var/lib/mysql btrfs subvol=/mysql,defaults,relatime 1 1
99 UUID=${DATAUUID} /var/spool/mail btrfs subvol=/mail,defaults,relatime 1 1
100 proc /proc proc defaults 0 0
101 EOF
102
103 #Crypttab
104 #XXX: Don't forget to add option nofail,noauto for every devices requiring manual unlocking
105 cat << EOF > "$PWD/root/etc/crypttab"
106 ${DATANAME} UUID=${LUKSDATAUUID}
107 EOF
108
109 #Set resolv.conf
110 ln -fs "/run/systemd/resolve/resolv.conf" "$PWD/root/etc/resolv.conf"
111 #Disable LLMNR, enable localhost
112 perl -pne 's/^#LLMNR=yes$/LLMNR=no/;s/^#DNS=/DNS=127.0.0.1/' -i "$PWD/root/etc/systemd/resolved.conf"
113
114 #Disable resolvconf
115 rm -f "$PWD/root/etc/resolvconf/run/enable-updates"
116
117 #Mail
118 cat << EOF >> "$PWD/root/etc/mdadm.conf"
119 MAILADDR ${MAIL}
120 EOF
121
122 #Password
123 echo -n "$ROOTPASS" | chroot $PWD/root passwd root --stdin
124 chroot $PWD/root adduser -m "$USERLOGIN"
125 echo -n "$USERPASS" | chroot $PWD/root passwd "$USERLOGIN" --stdin
126
127 # Fix grub config
128 perl -pne 's/^GRUB_TIMEOUT=[0-9]+$/GRUB_TIMEOUT=1/' -i $PWD/root/etc/default/grub
129
130 #Shorewall
131 cat << EOF >> $PWD/root/etc/shorewall/zones
132 net ipv4
133 EOF
134 cat << EOF >> $PWD/root/etc/shorewall/policy
135 fw net ACCEPT
136 net all DROP info
137 all all REJECT info
138 EOF
139 cat << EOF >> $PWD/root/etc/shorewall/rules
140 INCLUDE rules.drakx
141 EOF
142 cat << EOF > $PWD/root/etc/shorewall/rules.drakx
143 ACCEPT net fw udp 68,6700:7000 -
144 ACCEPT net fw icmp 8 -
145 ACCEPT net fw tcp 20,21,22,80,443,6700:7000 -
146 EOF
147
148 #Shorewall6
149 cat << EOF >> $PWD/root/etc/shorewall6/zones
150 net ipv6
151 EOF
152 cat << EOF >> $PWD/root/etc/shorewall6/policy
153 fw net ACCEPT
154 net all DROP info
155 all all REJECT info
156 EOF
157 cat << EOF >> $PWD/root/etc/shorewall6/rules
158 INCLUDE rules.drakx
159 EOF
160 cat << EOF > $PWD/root/etc/shorewall6/rules.drakx
161 ACCEPT net fw udp 546,6700:7000 -
162 ACCEPT net fw icmp 128 -
163 ACCEPT net fw tcp 20,21,22,80,443,546,6700:7000 -
164 EOF
165
166 # Disable old services
167 # Strip WantedBy=multi-user.target in [Install] section of lm_sensors.service ?
168 for s in lm_sensors network network-auth network-up resolvconf smartd; do
169 if [ -f "$PWD/root/etc/rc.d/init.d/$s" -a -x "$PWD/root/etc/rc.d/init.d/$s" ]; then
170 chroot $PWD/root /usr/lib/systemd/systemd-sysv-install disable $s
171 fi
172 if [ -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service" ]; then
173 rm -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service"
174 fi
175 done
176
177 # Extract last kernel version
178 KVER=`chroot $PWD/root rpm -qa | perl -pne '/kernel-server-latest/||undef $_;s%^kernel-(server)-latest-([^-]+)-(.+)$%\2-\1-\3%'`
179 #XXX: we do not regenerate initrd here, it will be generated at image build step
180 rm -f "$PWD/root/boot/initrd-${KVER}.img"
181
182 # Check rc.local state
183 if [ -f "$PWD/root/etc/rc.d/rc.local" ]; then
184 echo "$PWD/root/etc/rc.d/rc.local not empty"
185 exit 1
186 fi
187
188 # First boot startup script
189 #XXX: regenerate initrd after first successfull boot to strip from useless modules
190 touch "$PWD/root/etc/rc.d/rc.local"
191 chmod a+x "$PWD/root/etc/rc.d/rc.local"
192 cat << EOF > "$PWD/root/etc/rc.d/rc.local"
193 #! /bin/sh
194 . /etc/init.d/functions
195 case "\$1" in
196 start)
197 gprintf "Disabling lm_sensors.service: "
198 /usr/bin/systemctl disable lm_sensors.service
199 [ \$? -eq 0 ] && success || failure
200 echo
201 gprintf "Stopping lm_sensors.service: "
202 /usr/bin/systemctl stop lm_sensors.service
203 [ \$? -eq 0 ] && success || failure
204 echo
205 gprintf "Generating initrd: "
206 /usr/sbin/mkinitrd -f -v /boot/initrd-${KVER}.img ${KVER}
207 [ \$? -eq 0 ] && success || failure
208 echo
209 rm -f "\$0"
210 exit 0
211 ;;
212 *)
213 echo "Usage: \$0 start" >&2
214 exit 3
215 ;;
216 esac
217 EOF
218
219 # Fix msec
220 chroot "$PWD/root" msec -f webserver
221
222 # Fix postfix
223 perl -pne "my \$m='${MAIL}'; s%^(root:[\\t\\s]+)postfix\$%\\1\$m%" -i "$PWD/root/etc/postfix/aliases"
224
225 # Generate ssh keys
226 chroot "$PWD/root" /usr/sbin/sshd-keygen
227
228 # Allow root access
229 #XXX: forced because msec decides otherwise
230 perl -pne 's%^PermitRootLogin .*%PermitRootLogin yes%' -i "$PWD/root/etc/ssh/sshd_config"
231
232 # Add rsa key if available
233 #XXX: dsa is unsupported anymore
234 if [ -e "$HOME/.ssh/id_rsa.pub" ]; then
235 [ ! -d "$PWD/root/root/.ssh" ] && mkdir -m 0700 "$PWD/root/root/.ssh"
236 cp -f "$HOME/.ssh/id_rsa.pub" "$PWD/root/root/.ssh/authorized_keys"
237 fi
238
239 #TODO ntp /etc/systemd/timesyncd.conf
240
241 # Force enable systemd-networkd.service
242 chroot "$PWD/root" /usr/bin/systemctl enable systemd-networkd.service
243
244 # Force enable systemd-resolved.service
245 chroot "$PWD/root" /usr/bin/systemctl enable systemd-resolved.service
246
247 # Cleanup tmp and run
248 rm -fr $PWD/root/tmp/* $PWD/root/run/*