]> Raphaƫl G. Git Repositories - distcook/blob - lib/pattern.sh
Switch to single btrfs data device
[distcook] / lib / pattern.sh
1 #! /bin/sh -e
2
3 #Fix bash completion
4 perl -pne 's%(?:(COMP_CONFIGURE_HINTS|COMP_TAR_INTERNAL_PATHS)=1?)%${1}=1%' -i "$PWD/root/etc/sysconfig/bash-completion"
5
6 #Disable gpg agent
7 perl -pne 's%(?:(START_GPGAGENT|START_GPGAGENT_SH)=(?:"?(no|yes)"?)?)%${1}="no"%' -i "$PWD/root/etc/sysconfig/gnupg2"
8
9 #Locale config
10 cat << EOF > "$PWD/root/etc/vconsole.conf"
11 KEYMAP=$KEYMAP
12 FONT=lat0-16
13 EOF
14 cat << EOF > "$PWD/root/etc/locale.conf"
15 LANGUAGE=$LOCALE:${LOCALE_ALT}
16 LANG=$LOCALE
17 EOF
18
19 #Setup networking
20 cat << EOF > "$PWD/root/etc/sysconfig/network"
21 NETWORKING=yes
22 AUTOMATIC_IFCFG=no
23 EOF
24
25 #Setup network
26 cat << EOF > "$PWD/root/etc/hostname"
27 ${NETHOSTNAME}
28 EOF
29
30 #Setup machine-info
31 cat << EOF > "$PWD/root/etc/machine-info"
32 CHASSIS=server
33 EOF
34
35 #Setup hosts
36 #XXX: we remove mask from address
37 cat << EOF > "$PWD/root/etc/hosts"
38 127.0.0.1 localhost
39 ::1 localhost
40 ${NETADDRESS4%/*} ${NETHOSTNAME} ${NETALIAS}
41 ${NETADDRESS6%/*} ${NETHOSTNAME} ${NETALIAS}
42 EOF
43
44 #Fix named config
45 perl -pne 's%listen-on port 53 \{ .+; \};%listen-on port 53 { 127.0.0.1; };%' -i "$PWD/root/etc/named.conf"
46 perl -pne 's%listen-on-v6 port 53 \{ .+; \};%listen-on-v6 port 53 { ::1; };%' -i "$PWD/root/etc/named.conf"
47
48 #Network
49 mkdir -p "$PWD/root/etc/systemd/network"
50 if [ ! -z "${NETCONFIG}" -a "${NETCONFIG}" = 'static' ]; then
51 cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
52 [Match]
53 MACAddress=${NETMAC}
54
55 [Network]
56 DHCP=no
57 Address=${NETADDRESS4}
58 Address=${NETADDRESS6}
59 DNS=${NETDNS}
60
61 [Route]
62 Destination=${NETGATEWAY4}
63
64 [Route]
65 Destination=0.0.0.0/0
66 Gateway=${NETGATEWAY4}
67
68 [Route]
69 Destination=${NETGATEWAY6}
70
71 [Route]
72 Destination=::/0
73 Gateway=${NETGATEWAY6}
74 EOF
75 else
76 cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
77 [Match]
78 MACAddress=${NETMAC}
79
80 [Network]
81 DHCP=yes
82 EOF
83 fi
84
85 #Fstab
86 cat << EOF > "$PWD/root/etc/fstab"
87 UUID=${BOOTUUID} /boot ext3 defaults,noatime 1 2
88 UUID=${DATAUUID} / btrfs subvol=/slash,defaults,relatime 1 1
89 UUID=${SWAPAUUID} none swap sw 0 0
90 UUID=${SWAPBUUID} none swap sw 0 0
91 UUID=${DATAUUID} /home btrfs subvol=/home,defaults,relatime 1 1
92 proc /proc proc defaults 0 0
93 EOF
94
95 #Crypttab
96 #XXX: Don't forget to add option nofail,noauto for every devices requiring manual unlocking
97 cat << EOF > "$PWD/root/etc/crypttab"
98 ${DATANAME} UUID=${LUKSDATAUUID}
99 EOF
100
101 #Set resolv.conf
102 ln -fs "/run/systemd/resolve/resolv.conf" "$PWD/root/etc/resolv.conf"
103 #Disable LLMNR, enable localhost
104 perl -pne 's/^#LLMNR=yes$/LLMNR=no/;s/^#DNS=/DNS=127.0.0.1/' -i "$PWD/root/etc/systemd/resolved.conf"
105
106 #Disable resolvconf
107 rm -f "$PWD/root/etc/resolvconf/run/enable-updates"
108
109 #Mail
110 cat << EOF >> "$PWD/root/etc/mdadm.conf"
111 MAILADDR ${MAIL}
112 EOF
113
114 #Password
115 echo -n "$ROOTPASS" | chroot $PWD/root passwd root --stdin
116 chroot $PWD/root adduser -m "$USERLOGIN"
117 echo -n "$USERPASS" | chroot $PWD/root passwd "$USERLOGIN" --stdin
118
119 # Fix grub config
120 perl -pne 's/^GRUB_TIMEOUT=[0-9]+$/GRUB_TIMEOUT=1/' -i $PWD/root/etc/default/grub
121
122 #Shorewall
123 cat << EOF >> $PWD/root/etc/shorewall/zones
124 net ipv4
125 EOF
126 cat << EOF >> $PWD/root/etc/shorewall/policy
127 fw net ACCEPT
128 net all DROP info
129 all all REJECT info
130 EOF
131 cat << EOF >> $PWD/root/etc/shorewall/rules
132 INCLUDE rules.drakx
133 EOF
134 cat << EOF > $PWD/root/etc/shorewall/rules.drakx
135 ACCEPT net fw udp 68,6700:7000 -
136 ACCEPT net fw icmp 8 -
137 ACCEPT net fw tcp 20,21,22,80,443,6700:7000 -
138 EOF
139
140 #Shorewall6
141 cat << EOF >> $PWD/root/etc/shorewall6/zones
142 net ipv6
143 EOF
144 cat << EOF >> $PWD/root/etc/shorewall6/policy
145 fw net ACCEPT
146 net all DROP info
147 all all REJECT info
148 EOF
149 cat << EOF >> $PWD/root/etc/shorewall6/rules
150 INCLUDE rules.drakx
151 EOF
152 cat << EOF > $PWD/root/etc/shorewall6/rules.drakx
153 ACCEPT net fw udp 546,6700:7000 -
154 ACCEPT net fw icmp 128 -
155 ACCEPT net fw tcp 20,21,22,80,443,546,6700:7000 -
156 EOF
157
158 # Disable old services
159 # Strip WantedBy=multi-user.target in [Install] section of lm_sensors.service ?
160 for s in lm_sensors network network-auth network-up resolvconf smartd; do
161 if [ -f "$PWD/root/etc/rc.d/init.d/$s" -a -x "$PWD/root/etc/rc.d/init.d/$s" ]; then
162 chroot $PWD/root /usr/lib/systemd/systemd-sysv-install disable $s
163 fi
164 if [ -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service" ]; then
165 rm -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service"
166 fi
167 done
168
169 # Extract last kernel version
170 KVER=`chroot $PWD/root rpm -qa | perl -pne '/kernel-server-latest/||undef $_;s%^kernel-(server)-latest-([^-]+)-(.+)$%\2-\1-\3%'`
171 #XXX: we do not regenerate initrd here, it will be generated at image build step
172 rm -f "$PWD/root/boot/initrd-${KVER}.img"
173
174 # Check rc.local state
175 if [ -f "$PWD/root/etc/rc.d/rc.local" ]; then
176 echo "$PWD/root/etc/rc.d/rc.local not empty"
177 exit 1
178 fi
179
180 # First boot startup script
181 #XXX: regenerate initrd after first successfull boot to strip from useless modules
182 touch "$PWD/root/etc/rc.d/rc.local"
183 chmod a+x "$PWD/root/etc/rc.d/rc.local"
184 cat << EOF > "$PWD/root/etc/rc.d/rc.local"
185 #! /bin/sh
186 . /etc/init.d/functions
187 case "\$1" in
188 start)
189 gprintf "Disabling lm_sensors.service: "
190 /usr/bin/systemctl disable lm_sensors.service
191 [ \$? -eq 0 ] && success || failure
192 echo
193 gprintf "Stopping lm_sensors.service: "
194 /usr/bin/systemctl stop lm_sensors.service
195 [ \$? -eq 0 ] && success || failure
196 echo
197 gprintf "Generating initrd: "
198 /usr/sbin/mkinitrd -f -v /boot/initrd-${KVER}.img ${KVER}
199 [ \$? -eq 0 ] && success || failure
200 echo
201 rm -f "\$0"
202 exit 0
203 ;;
204 *)
205 echo "Usage: \$0 start" >&2
206 exit 3
207 ;;
208 esac
209 EOF
210
211 # Fix msec
212 chroot "$PWD/root" msec -f webserver
213
214 # Fix postfix
215 perl -pne "my \$m='${MAIL}'; s%^(root:[\\t\\s]+)postfix\$%\\1\$m%" -i "$PWD/root/etc/postfix/aliases"
216
217 # Generate ssh keys
218 chroot "$PWD/root" /usr/sbin/sshd-keygen
219
220 # Allow root access
221 #XXX: forced because msec decides otherwise
222 perl -pne 's%^PermitRootLogin .*%PermitRootLogin yes%' -i "$PWD/root/etc/ssh/sshd_config"
223
224 # Add rsa key if available
225 #XXX: dsa is unsupported anymore
226 if [ -e "$HOME/.ssh/id_rsa.pub" ]; then
227 [ ! -d "$PWD/root/root/.ssh" ] && mkdir -m 0700 "$PWD/root/root/.ssh"
228 cp -f "$HOME/.ssh/id_rsa.pub" "$PWD/root/root/.ssh/authorized_keys"
229 fi
230
231 #TODO ntp /etc/systemd/timesyncd.conf
232
233 # Cleanup tmp and run
234 rm -fr $PWD/root/tmp/* $PWD/root/run/*