Raphaël G. Git Repositories - distcook/blob - lib/pattern.sh

   1 #! /bin/sh -e
   2
   3 #Fix bash completion
   4 perl -pne 's%(?:(COMP_CONFIGURE_HINTS|COMP_TAR_INTERNAL_PATHS)=1?)%${1}=1%' -i "$PWD/root/etc/sysconfig/bash-completion"
   5
   6 #Disable gpg agent
   7 perl -pne 's%(?:(START_GPGAGENT|START_GPGAGENT_SH)=(?:"?(no|yes)"?)?)%${1}="no"%' -i "$PWD/root/etc/sysconfig/gnupg2"
   8
   9 #Locale config
  10 cat << EOF > "$PWD/root/etc/vconsole.conf"
  11 KEYMAP=$KEYMAP
  12 FONT=lat0-16
  13 EOF
  14 cat << EOF > "$PWD/root/etc/locale.conf"
  15 LANGUAGE=$LOCALE:${LOCALE_ALT}
  16 LANG=$LOCALE
  17 EOF
  18
  19 #Setup networking
  20 cat << EOF > "$PWD/root/etc/sysconfig/network"
  21 NETWORKING=yes
  22 AUTOMATIC_IFCFG=no
  23 EOF
  24
  25 #Setup network
  26 cat << EOF > "$PWD/root/etc/hostname"
  27 ${NETHOSTNAME}
  28 EOF
  29
  30 #Setup machine-info
  31 cat << EOF > "$PWD/root/etc/machine-info"
  32 CHASSIS=server
  33 EOF
  34
  35 #Setup hosts
  36 #XXX: we remove mask from address
  37 cat << EOF > "$PWD/root/etc/hosts"
  38 127.0.0.1                               localhost
  39 ::1                                     localhost
  40 ${NETADDRESS4%/*}                               ${NETHOSTNAME}  ${NETALIAS}
  41 ${NETADDRESS6%/*}       ${NETHOSTNAME}  ${NETALIAS}
  42 EOF
  43
  44 #Fix named config
  45 perl -pne 's%listen-on port 53 \{ .+; \};%listen-on port 53 { 127.0.0.1; };%' -i "$PWD/root/etc/named.conf"
  46 perl -pne 's%listen-on-v6 port 53 \{ .+; \};%listen-on-v6 port 53 { ::1; };%' -i "$PWD/root/etc/named.conf"
  47
  48 #Network
  49 mkdir -p "$PWD/root/etc/systemd/network"
  50 if [ ! -z "${NETCONFIG}" -a "${NETCONFIG}" = 'static' ]; then
  51         cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
  52 [Match]
  53 MACAddress=${NETMAC}
  54
  55 [Network]
  56 DHCP=no
  57 Address=${NETADDRESS4}
  58 Address=${NETADDRESS6}
  59 DNS=${NETDNS}
  60
  61 [Route]
  62 Destination=${NETGATEWAY4}
  63
  64 [Route]
  65 Destination=0.0.0.0/0
  66 Gateway=${NETGATEWAY4}
  67
  68 [Route]
  69 Destination=${NETGATEWAY6}
  70
  71 [Route]
  72 Destination=::/0
  73 Gateway=${NETGATEWAY6}
  74 EOF
  75 else
  76         cat << EOF > "$PWD/root/etc/systemd/network/${NETMAC}.network"
  77 [Match]
  78 MACAddress=${NETMAC}
  79
  80 [Network]
  81 DHCP=yes
  82 EOF
  83 fi
  84
  85 #Mysql
  86 mkdir -p "$PWD/root/var/lib/mysql"
  87
  88 #Mail
  89 mkdir -p "$PWD/root/var/spool/mail"
  90
  91 #Fstab
  92 cat << EOF > "$PWD/root/etc/fstab"
  93 UUID=${BOOTUUID}        /boot           ext3    defaults,noatime 1 2
  94 UUID=${DATAUUID}        /               btrfs   subvol=/slash,defaults,relatime 1 1
  95 UUID=${SWAPAUUID}       none            swap    sw 0 0
  96 UUID=${SWAPBUUID}       none            swap    sw 0 0
  97 UUID=${DATAUUID}        /home           btrfs   subvol=/home,defaults,relatime 1 1
  98 UUID=${DATAUUID}        /var/lib/mysql  btrfs   subvol=/mysql,defaults,relatime 1 1
  99 UUID=${DATAUUID}        /var/spool/mail btrfs   subvol=/mail,defaults,relatime 1 1
 100 proc                                            /proc   proc    defaults 0 0
 101 EOF
 102
 103 #Crypttab
 104 #XXX: Don't forget to add option nofail,noauto for every devices requiring manual unlocking
 105 cat << EOF > "$PWD/root/etc/crypttab"
 106 ${DATANAME}     UUID=${LUKSDATAUUID}
 107 EOF
 108
 109 #Set resolv.conf
 110 ln -fs "/run/systemd/resolve/resolv.conf" "$PWD/root/etc/resolv.conf"
 111 #Disable LLMNR, enable localhost
 112 perl -pne 's/^#LLMNR=yes$/LLMNR=no/;s/^#DNS=/DNS=127.0.0.1/' -i "$PWD/root/etc/systemd/resolved.conf"
 113
 114 #Disable resolvconf
 115 rm -f "$PWD/root/etc/resolvconf/run/enable-updates"
 116
 117 #Mail
 118 cat << EOF >> "$PWD/root/etc/mdadm.conf"
 119 MAILADDR ${MAIL}
 120 EOF
 121
 122 #Password
 123 echo -n "$ROOTPASS" | chroot $PWD/root passwd root --stdin
 124 chroot $PWD/root adduser -m "$USERLOGIN"
 125 echo -n "$USERPASS" | chroot $PWD/root passwd "$USERLOGIN" --stdin
 126
 127 # Fix grub config
 128 perl -pne 's/^GRUB_TIMEOUT=[0-9]+$/GRUB_TIMEOUT=1/' -i $PWD/root/etc/default/grub
 129
 130 #Shorewall
 131 cat << EOF >> $PWD/root/etc/shorewall/zones
 132 net             ipv4
 133 EOF
 134 cat << EOF >> $PWD/root/etc/shorewall/policy
 135 fw      net     ACCEPT
 136 net     all     DROP    info
 137 all     all     REJECT  info
 138 EOF
 139 cat << EOF >> $PWD/root/etc/shorewall/rules
 140 INCLUDE rules.drakx
 141 EOF
 142 cat << EOF > $PWD/root/etc/shorewall/rules.drakx
 143 ACCEPT  net     fw      udp     68,6700:7000    -
 144 ACCEPT  net     fw      icmp    8       -
 145 ACCEPT  net     fw      tcp     20,21,22,80,443,6700:7000       -
 146 EOF
 147
 148 #Shorewall6
 149 cat << EOF >> $PWD/root/etc/shorewall6/zones
 150 net             ipv6
 151 EOF
 152 cat << EOF >> $PWD/root/etc/shorewall6/policy
 153 fw      net     ACCEPT
 154 net     all     DROP    info
 155 all     all     REJECT  info
 156 EOF
 157 cat << EOF >> $PWD/root/etc/shorewall6/rules
 158 INCLUDE rules.drakx
 159 EOF
 160 cat << EOF > $PWD/root/etc/shorewall6/rules.drakx
 161 ACCEPT  net     fw      udp     546,6700:7000   -
 162 ACCEPT  net     fw      icmp    128     -
 163 ACCEPT  net     fw      tcp     20,21,22,80,443,546,6700:7000   -
 164 EOF
 165
 166 # Disable old services
 167 # Strip WantedBy=multi-user.target in [Install] section of lm_sensors.service ?
 168 for s in lm_sensors network network-auth network-up resolvconf smartd; do
 169         if [ -f "$PWD/root/etc/rc.d/init.d/$s" -a -x "$PWD/root/etc/rc.d/init.d/$s" ]; then
 170                 chroot $PWD/root /usr/lib/systemd/systemd-sysv-install disable $s
 171         fi
 172         if [ -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service" ]; then
 173                 rm -f "$PWD/root/etc/systemd/system/multi-user.target.wants/${s}.service"
 174         fi
 175 done
 176
 177 # Extract last kernel version
 178 KVER=`chroot $PWD/root rpm -qa | perl -pne '/kernel-server-latest/||undef $_;s%^kernel-(server)-latest-([^-]+)-(.+)$%\2-\1-\3%'`
 179 #XXX: we do not regenerate initrd here, it will be generated at image build step
 180 rm -f "$PWD/root/boot/initrd-${KVER}.img"
 181
 182 # Check rc.local state
 183 if [ -f "$PWD/root/etc/rc.d/rc.local" ]; then
 184         echo "$PWD/root/etc/rc.d/rc.local not empty"
 185         exit 1
 186 fi
 187
 188 # First boot startup script
 189 #XXX: regenerate initrd after first successfull boot to strip from useless modules
 190 touch "$PWD/root/etc/rc.d/rc.local"
 191 chmod a+x "$PWD/root/etc/rc.d/rc.local"
 192 cat << EOF > "$PWD/root/etc/rc.d/rc.local"
 193 #! /bin/sh
 194 . /etc/init.d/functions
 195 case "\$1" in
 196         start)
 197                 gprintf "Disabling lm_sensors.service: "
 198                 /usr/bin/systemctl disable lm_sensors.service
 199                 [ \$? -eq 0 ] && success || failure
 200                 echo
 201                 gprintf "Stopping lm_sensors.service: "
 202                 /usr/bin/systemctl stop lm_sensors.service
 203                 [ \$? -eq 0 ] && success || failure
 204                 echo
 205                 gprintf "Generating initrd: "
 206                 /usr/sbin/mkinitrd -f -v /boot/initrd-${KVER}.img ${KVER}
 207                 [ \$? -eq 0 ] && success || failure
 208                 echo
 209                 rm -f "\$0"
 210                 exit 0
 211                 ;;
 212         *)
 213                 echo "Usage: \$0 start" >&2
 214                 exit 3
 215                 ;;
 216 esac
 217 EOF
 218
 219 # Fix msec
 220 chroot "$PWD/root" msec -f webserver
 221
 222 # Fix postfix
 223 perl -pne "my \$m='${MAIL}'; s%^(root:[\\t\\s]+)postfix\$%\\1\$m%" -i "$PWD/root/etc/postfix/aliases"
 224
 225 # Generate ssh keys
 226 chroot "$PWD/root" /usr/sbin/sshd-keygen
 227
 228 # Allow root access
 229 #XXX: forced because msec decides otherwise
 230 perl -pne 's%^PermitRootLogin .*%PermitRootLogin yes%' -i "$PWD/root/etc/ssh/sshd_config"
 231
 232 # Prevent btmp warning
 233 cat << EOF > "$PWD/root/etc/tmpfiles.d/var.conf"
 234 # See tmpfiles.d(5) for details
 235
 236 # Prevent msec warning about enforcing permissions
 237 f /var/log/btmp 0600 root utmp -
 238 EOF
 239
 240 # Authorized keys
 241 if [ -e "$HOME/.ssh/id_rsa.pub" -o -e "$HOME/.ssh/id_ed25519.pub" ]; then
 242         mkdir -m 0700 "$PWD/root/root/.ssh"
 243         touch "$PWD/root/root/.ssh/authorized_keys"
 244         chmod u=rw,go=r "$PWD/root/root/.ssh/authorized_keys"
 245
 246         # Add rsa key if available
 247         if [ -e "$HOME/.ssh/id_rsa.pub" ]; then
 248                 cat "$HOME/.ssh/id_rsa.pub" >> "$PWD/root/root/.ssh/authorized_keys"
 249         fi
 250
 251         # Add ed25519 key if available
 252         if [ -e "$HOME/.ssh/id_ed25519.pub" ]; then
 253                 cat "$HOME/.ssh/id_ed25519.pub" >> "$PWD/root/root/.ssh/authorized_keys"
 254         fi
 255 fi
 256
 257 #TODO ntp /etc/systemd/timesyncd.conf
 258
 259 # Force enable systemd-networkd.service
 260 chroot "$PWD/root" /usr/bin/systemctl enable systemd-networkd.service
 261
 262 # Force enable systemd-resolved.service
 263 chroot "$PWD/root" /usr/bin/systemctl enable systemd-resolved.service
 264
 265 # Cleanup tmp and run
 266 rm -fr $PWD/root/tmp/* $PWD/root/run/*